@warmhub/cli 0.87.0 → 0.89.0

package/dist/wh.js

@@ -19389,6 +19389,19 @@ var ALL_BUILTIN_SHAPE_DEFS = {
   ...BUILTIN_VIEW_SHAPE_DEFS,
   ...BUILTIN_LICENSE_SHAPE_DEFS
 };
+// ../../packages/rules/src/client-flags.ts
+var CLIENT_FLAGS_HEADER = "X-WarmHub-Client-Flags";
+var CLIENT_FLAG_COMPATIBILITY_OVERRIDE = "compatibility-override";
+var KNOWN_CLIENT_FLAGS = new Set([
+  CLIENT_FLAG_COMPATIBILITY_OVERRIDE
+]);
+var CLIENT_FLAG_TOKEN_RE = /^[a-z0-9-]+$/;
+function isValidClientFlagToken(token) {
+  return CLIENT_FLAG_TOKEN_RE.test(token);
+}
+function serializeClientFlags(flags) {
+  return [...new Set(flags)].sort().join(",");
+}
 // ../../packages/rules/src/client-header.ts
 var CLIENT_HEADER = "X-WarmHub-Client";
 var WARMHUB_SDK_CLIENT_NAME = "@warmhub/sdk-ts";
@@ -19930,16 +19943,21 @@ function validateComponentManifestCliContract(manifest) {
   }
   return findings;
 }
+// ../../packages/rules/src/component-manifest-validate-types.ts
+function failureIfAny(errors, warnings) {
+  const [first, ...rest] = errors;
+  if (first === undefined)
+    return;
+  return { valid: false, errors: [first, ...rest], warnings };
+}
+
 // ../../packages/rules/src/component-version.ts
 var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
-function isValidSemver(version) {
-  return SEMVER_RE.test(version);
+function parseSemver(version) {
+  return SEMVER_RE.test(version) ? version : null;
 }
-function parse(version) {
+function decompose(version) {
   const match = SEMVER_RE.exec(version);
-  if (!match) {
-    throw new Error(`Invalid semver: ${JSON.stringify(version)}`);
-  }
   return {
     major: Number(match[1]),
     minor: Number(match[2]),
@@ -19959,6 +19977,8 @@ function comparePrerelease(a, b) {
   for (let i = 0;i < len; i++) {
     const ai = a[i];
     const bi = b[i];
+    if (ai === undefined || bi === undefined)
+      break;
     if (ai === bi)
       continue;
     const aNum = NUMERIC_RE.test(ai);
@@ -19977,8 +19997,8 @@ function comparePrerelease(a, b) {
   return a.length < b.length ? -1 : 1;
 }
 function compareSemver(a, b) {
-  const pa = parse(a);
-  const pb = parse(b);
+  const pa = decompose(a);
+  const pb = decompose(b);
   if (pa.major !== pb.major)
     return pa.major < pb.major ? -1 : 1;
   if (pa.minor !== pb.minor)
@@ -19989,8 +20009,8 @@ function compareSemver(a, b) {
 }
 
 // ../../packages/rules/src/component-manifest-validate-json.ts
-function fail(errors, warnings = []) {
-  return { valid: false, errors, warnings };
+function failWith(message) {
+  return { valid: false, errors: [message], warnings: [] };
 }
 function isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -20020,7 +20040,7 @@ function optionalStringArray(obj, field, path, errors) {
 }
 function validateComponentJson(data) {
   if (!isObject2(data)) {
-    return fail(["component.json must be a JSON object"]);
+    return failWith("component.json must be a JSON object");
   }
   const errors = [];
   requireString(data, "id", "component", errors);
@@ -20029,11 +20049,8 @@ function validateComponentJson(data) {
   optionalString(data, "description", "component", errors);
   optionalString(data, "author", "component", errors);
   optionalStringArray(data, "tags", "component", errors);
-  if (errors.length > 0)
-    return fail(errors);
-  return {
+  return failureIfAny(errors, []) ?? {
     valid: true,
-    errors: [],
     warnings: [],
     value: data
   };
@@ -20067,7 +20084,7 @@ function validateManifestComponent(data, errors) {
   requireString(data, "name", "manifest.component", errors);
   requireString(data, "version", "manifest.component", errors);
   if (typeof data.version === "string" && data.version.length > 0) {
-    if (!isValidSemver(data.version)) {
+    if (parseSemver(data.version) === null) {
       errors.push(`manifest.component.version "${data.version}" is not valid semver (e.g. 1.2.3, 1.2.3-rc.1)`);
     }
   }
@@ -20260,7 +20277,7 @@ function validateTeardown(teardown, path, errors) {
 }
 function validateManifestJson(data) {
   if (!isObject2(data)) {
-    return fail(["manifest.json must be a JSON object"]);
+    return failWith("manifest.json must be a JSON object");
   }
   const errors = [];
   const warnings = [];
@@ -20313,11 +20330,8 @@ function validateManifestJson(data) {
   if (data.cli !== undefined) {
     errors.push(...validateComponentManifestCliShape(data.cli).map((finding) => finding.message));
   }
-  if (errors.length > 0)
-    return { valid: false, errors, warnings };
-  return {
+  return failureIfAny(errors, warnings) ?? {
     valid: true,
-    errors: [],
     warnings,
     value: data
   };
@@ -20538,17 +20552,27 @@ function joinFieldIdentityPath(...segments) {
 function joinFieldPathWithEscaper(escapeSegment, segments) {
   return segments.map((segment) => typeof segment === "number" ? `[${segment}]` : escapeSegment(segment)).join(".").replace(/\.\[/g, "[");
 }
-// ../../packages/rules/src/tokens.ts
-var COMMIT_TOKEN_SYNTAX_REMOVED_MESSAGE = "$N/#N commit-token syntax is no longer supported. Use explicit names and explicit wrefs. For assertions about newly created things, create the thing with a deterministic name and set about to that wref in the same commit.";
-var ANY_TOKEN_RE = /[$#]\d+/;
-function hasAnyTokens(s) {
-  return ANY_TOKEN_RE.test(s);
+// ../../packages/rules/src/org-qualified-ref.ts
+function splitOrgQualified(ref) {
+  const parts = ref.split("/");
+  if (parts.length !== 2)
+    return null;
+  const [first, second] = parts;
+  if (!first || !second)
+    return null;
+  return [first, second];
+}
+function parseRepoSlug(ref) {
+  const parts = splitOrgQualified(ref);
+  return parts === null ? null : { org: parts[0], repo: parts[1] };
+}
+function parseComponentRef(ref) {
+  const parts = splitOrgQualified(ref);
+  return parts === null ? null : { org: parts[0], name: parts[1] };
 }
-
 // ../../packages/rules/src/preflight-commit.ts
 function preflightCommitDiagnostics(operations, options) {
   const errors = [];
-  rejectCommitTokenSyntax(operations, errors, options);
   illegalOpSequences(operations, errors, options?.checkAddAdd ?? true, options);
   return errors;
 }
@@ -20558,33 +20582,6 @@ function sourceOperationIndex(filteredIndex, options) {
 function getOpName(op) {
   return op.name;
 }
-function tokenStringFields(op) {
-  const fields = [getOpName(op), op.newName];
-  if (typeof op.about === "string") {
-    fields.push(op.about);
-  }
-  if (op.members) {
-    fields.push(...op.members);
-  }
-  return fields;
-}
-function rejectCommitTokenSyntax(operations, errors, options) {
-  for (let i = 0;i < operations.length; i++) {
-    const op = operations[i];
-    if (!op)
-      continue;
-    for (const field of tokenStringFields(op)) {
-      if (field && hasAnyTokens(field)) {
-        errors.push({
-          code: "COMMIT_TOKEN_SYNTAX_REMOVED",
-          operationIndex: sourceOperationIndex(i, options),
-          message: COMMIT_TOKEN_SYNTAX_REMOVED_MESSAGE
-        });
-        break;
-      }
-    }
-  }
-}
 function illegalOpSequences(operations, errors, checkAddAdd, options) {
   const opHistory = new Map;
   for (let i = 0;i < operations.length; i++) {
@@ -20594,8 +20591,6 @@ function illegalOpSequences(operations, errors, checkAddAdd, options) {
     const name = getOpName(op);
     if (!name)
       continue;
-    if (hasAnyTokens(name))
-      continue;
     const kind = inferOperationKind({ ...op, name });
     const qualName = kind === "shape" ? `shape:${name}` : `thing:${name}`;
     const history = opHistory.get(qualName) ?? [];
@@ -20638,6 +20633,12 @@ var canonicalCollectionTypes = ["arc", "bond", "set", "list"];
 var collectionOps = ["add", "revise"];
 var COLLECTION_CREATE_REQUIRES_NAME_MESSAGE = "Collection create requires a name. Collections are ordinary named things (ADR 0004).";
 var COLLECTION_ABOUT_REMOVED_MESSAGE = 'about accepts a wref. Create the collection as its own named operation, then point the assertion at it. Prefer deterministic relationship names, for example: [{"operation":"add","kind":"collection","type":"arc","name":"a-to-b","members":["A","B"]},{"operation":"add","kind":"assertion","about":"Arc/a-to-b","name":"Assertion/example","data":{}}]. For CLI usage, use wh commit submit --file with the two operations.';
+function parseCollectionType(value) {
+  return collectionTypes.find((candidate) => candidate === value) ?? null;
+}
+function parseCollectionOp(value) {
+  return collectionOps.find((candidate) => candidate === value) ?? null;
+}
 function preflightOpDiagnostics(op, operationIndex) {
   const errors = [];
   errors.push(...builtinShapeGuard(op, operationIndex));
@@ -20770,7 +20771,7 @@ function validateCollectionOps(op, operationIndex) {
   const errors = [];
   if (op.kind !== "collection")
     return errors;
-  if (!collectionOps.includes(op.operation)) {
+  if (parseCollectionOp(op.operation) === null) {
     return errors;
   }
   if (op.operation === "add" && !op.name) {
@@ -20780,7 +20781,8 @@ function validateCollectionOps(op, operationIndex) {
       message: COLLECTION_CREATE_REQUIRES_NAME_MESSAGE
     });
   }
-  if (!op.type || !collectionTypes.includes(op.type)) {
+  const collectionType = parseCollectionType(op.type);
+  if (collectionType === null) {
     errors.push({
       code: "VALIDATION_ERROR",
       operationIndex,
@@ -20804,8 +20806,8 @@ function validateCollectionOps(op, operationIndex) {
       }
     }
   }
-  if (op.type && op.members) {
-    const arityError = collectionArityError(op.type, op.members);
+  if (collectionType !== null && op.members) {
+    const arityError = collectionArityError(collectionType, op.members);
     if (arityError) {
       errors.push({
         code: "VALIDATION_ERROR",
@@ -20827,6 +20829,10 @@ function collectionArityError(tag, members) {
     case "set":
     case "list":
       return members.length < 1 ? `${tag === "set" ? "Set" : "List"} requires at least 1 member, got 0` : null;
+    default: {
+      const unhandled = tag;
+      return unhandled;
+    }
   }
 }
 // ../../packages/rules/src/preflight.ts
@@ -20896,7 +20902,7 @@ __export(exports_external, {
   pipe: () => pipe,
   partialRecord: () => partialRecord,
   parseAsync: () => parseAsync2,
-  parse: () => parse4,
+  parse: () => parse3,
   overwrite: () => _overwrite,
   optional: () => optional,
   object: () => object,
@@ -21098,7 +21104,7 @@ __export(exports_core2, {
   process: () => process2,
   prettifyError: () => prettifyError,
   parseAsync: () => parseAsync,
-  parse: () => parse2,
+  parse: () => parse,
   meta: () => meta,
   locales: () => exports_locales,
   isValidJWT: () => isValidJWT,
@@ -22282,7 +22288,7 @@ var _parse = (_Err) => (schema, value, _ctx, _params) => {
   }
   return result.value;
 };
-var parse2 = /* @__PURE__ */ _parse($ZodRealError);
+var parse = /* @__PURE__ */ _parse($ZodRealError);
 var _parseAsync = (_Err) => async (schema, value, _ctx, params) => {
   const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
   let result = schema._zod.run({ value, issues: [] }, ctx);
@@ -25069,10 +25075,10 @@ var $ZodFunction = /* @__PURE__ */ $constructor("$ZodFunction", (inst, def) => {
       throw new Error("implement() must be called with a function");
     }
     return function(...args) {
-      const parsedArgs = inst._def.input ? parse2(inst._def.input, args) : args;
+      const parsedArgs = inst._def.input ? parse(inst._def.input, args) : args;
       const result = Reflect.apply(func, this, parsedArgs);
       if (inst._def.output) {
-        return parse2(inst._def.output, result);
+        return parse(inst._def.output, result);
       }
       return result;
     };
@@ -33294,7 +33300,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, {
 });
 
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/parse.js
-var parse4 = /* @__PURE__ */ _parse(ZodRealError);
+var parse3 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -33357,7 +33363,7 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
   inst.def = def;
   inst.type = def.type;
   Object.defineProperty(inst, "_def", { value: def });
-  inst.parse = (data, params) => parse4(inst, data, params, { callee: inst.parse });
+  inst.parse = (data, params) => parse3(inst, data, params, { callee: inst.parse });
   inst.safeParse = (data, params) => safeParse2(inst, data, params);
   inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
   inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
@@ -35417,16 +35423,8 @@ var BASE_PRIMITIVE_TYPES = [
 ];
 var BASE_PRIMITIVE_TYPE_SET = new Set(BASE_PRIMITIVE_TYPES);
 var VALID_PRIMITIVE_TYPES = new Set([
-  "number",
-  "string",
-  "boolean",
-  "wref",
-  "array",
-  "number?",
-  "string?",
-  "boolean?",
-  "wref?",
-  "array?"
+  ...BASE_PRIMITIVE_TYPES,
+  ...BASE_PRIMITIVE_TYPES.map((type) => `${type}?`)
 ]);
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -42601,6 +42599,54 @@ var SYSTEM_INFRA_SHAPE_NAMES = new Set(SYSTEM_COMPONENTS.filter((entry) => entry
 function findSystemComponent(componentId) {
   return SYSTEM_COMPONENTS.find((entry) => entry.componentId === componentId);
 }
+// ../../packages/sdk-ts/src/grant-client.ts
+function createGrantClient(getTrpc, mapError) {
+  return {
+    create: async (orgName, repoName, input) => {
+      try {
+        return await getTrpc().grant.create.mutate({
+          orgName,
+          repoName,
+          ...input
+        });
+      } catch (error51) {
+        throw mapError(error51);
+      }
+    },
+    get: async (orgName, repoName, grantId) => {
+      try {
+        return await getTrpc().grant.get.query({ orgName, repoName, grantId });
+      } catch (error51) {
+        throw mapError(error51);
+      }
+    },
+    list: async (orgName, repoName, opts) => {
+      try {
+        return await getTrpc().grant.list.query({
+          orgName,
+          repoName,
+          limit: opts?.limit,
+          cursor: opts?.cursor
+        });
+      } catch (error51) {
+        throw mapError(error51);
+      }
+    },
+    revoke: async (orgName, repoName, grantId, opts) => {
+      try {
+        return await getTrpc().grant.revoke.mutate({
+          orgName,
+          repoName,
+          grantId,
+          reason: opts?.reason
+        });
+      } catch (error51) {
+        throw mapError(error51);
+      }
+    }
+  };
+}
+
 // ../../packages/sdk-ts/src/repository-checkpoint-client.ts
 function normalizeRepositoryCheckpointStatus(status) {
   return {
@@ -43379,7 +43425,7 @@ function completedOperationsFrom(result) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.85.0",
+  version: "0.87.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -43514,21 +43560,23 @@ function clientCompatibilityFailure(capabilities, identity2) {
       hint: "Upgrade the WarmHub backend before retrying this write."
     };
   }
-  const minimum = capabilities.minSupportedClients[identity2.name];
-  if (typeof minimum !== "string" || !isValidSemver(minimum)) {
+  const advertised = capabilities.minSupportedClients[identity2.name];
+  const minimum = typeof advertised === "string" ? parseSemver(advertised) : null;
+  if (!minimum) {
     return {
       message: `The backend does not advertise a valid compatibility floor for ${identity2.name}.`,
       hint: "Upgrade the WarmHub backend or register this first-party client family before writing."
     };
   }
   if (!sdkVersionIsDevelopment(identity2.version)) {
-    if (!isValidSemver(identity2.version)) {
+    const version2 = parseSemver(identity2.version);
+    if (!version2) {
       return {
         message: `${identity2.name} reported malformed version "${identity2.version}".`,
         hint: "Use a released WarmHub client with a SemVer package version."
       };
     }
-    if (compareSemver(identity2.version, minimum) < 0) {
+    if (compareSemver(version2, minimum) < 0) {
       return {
         message: `${identity2.name} ${identity2.version} is older than the backend's minimum supported version ${minimum}.`,
         hint: clientUpgradeHint(identity2.name)
@@ -43556,7 +43604,8 @@ var WARMHUB_CLIENT_OPTION_NAMES = [
   "accessToken",
   "auth",
   "functionLogs",
-  "client"
+  "client",
+  "clientFlags"
 ];
 var WARMHUB_CLIENT_OPTION_NAME_SET = new Set(WARMHUB_CLIENT_OPTION_NAMES);
 var ACCESS_TOKEN_OPTION_ALIASES = new Set(["token", "apiKey", "bearer"]);
@@ -43572,6 +43621,17 @@ function validateWarmHubClientOptions(options) {
     throw new TypeError(`Unknown WarmHubClient option "${key}"${hint}`);
   }
 }
+function normalizeClientFlags(flags) {
+  if (!flags || flags.length === 0) {
+    return [];
+  }
+  for (const token of flags) {
+    if (!isValidClientFlagToken(token)) {
+      throw new TypeError(`Invalid client flag "${token}": expected lowercase tokens matching [a-z0-9-]+.`);
+    }
+  }
+  return [...new Set(flags)].sort();
+}
 var DEFAULT_API_URL = "https://api.warmhub.ai";
 var UNBATCHED_TRPC_PATHS = new Set([
   "repo.shapeInstanceCounts",
@@ -43891,9 +43951,11 @@ function connectionErrorMessage(url2) {
 function sdkVersionIsBelowMinimum(version2, minimum) {
   if (sdkVersionIsDevelopment(version2))
     return false;
-  if (!isValidSemver(version2) || !isValidSemver(minimum))
+  const parsed = parseSemver(version2);
+  const floor = parseSemver(minimum);
+  if (!parsed || !floor)
     return false;
-  return compareSemver(version2, minimum) < 0;
+  return compareSemver(parsed, floor) < 0;
 }
 function clientIncompatible(message, hint) {
   return new WarmHubError("CLIENT_INCOMPATIBLE", message, 412, hint);
@@ -43910,10 +43972,22 @@ class WarmHubClient {
   fetchImpl;
   accessToken;
   clientIdentity;
+  clientFlags;
   functionLogMode;
   getToken;
   compatibilityCheck;
+  overrideNoticePrinted = false;
+  noteCompatibilityOverride() {
+    if (this.overrideNoticePrinted)
+      return;
+    this.overrideNoticePrinted = true;
+    console.error(`warmhub: compatibility checks overridden by client flag ${CLIENT_FLAG_COMPATIBILITY_OVERRIDE}; the server remains authoritative.`);
+  }
   assertWriteCompatible() {
+    if (this.clientFlags.includes(CLIENT_FLAG_COMPATIBILITY_OVERRIDE)) {
+      this.noteCompatibilityOverride();
+      return Promise.resolve();
+    }
     if (sdkVersionIsDevelopment(this.clientIdentity.version) && isProductionApiUrl(this.apiUrl, DEFAULT_API_URL)) {
       return Promise.reject(clientIncompatible(`Development client ${this.clientIdentity.name}/${this.clientIdentity.version} cannot write to production.`, "Install a released WarmHub client artifact before writing to api.warmhub.ai."));
     }
@@ -45224,6 +45298,32 @@ class WarmHubClient {
       }
     }
   };
+  view = {
+    evaluate: async (orgName, repoName, wref, opts) => {
+      try {
+        return await this.trpc.view.evaluate.query({
+          orgName,
+          repoName,
+          wref,
+          limit: opts?.limit,
+          cursor: opts?.cursor
+        });
+      } catch (error51) {
+        throw toWarmHubError(error51);
+      }
+    },
+    evaluateIter: (orgName, repoName, wref, opts) => {
+      return paginate((cursor) => this.view.evaluate(orgName, repoName, wref, { ...opts, cursor }), (page) => page.items, opts?.cursor);
+    },
+    evaluateAll: async (orgName, repoName, wref, opts) => {
+      const { max, ...pageOpts } = opts ?? {};
+      return await collectPaginatedPages((cursor) => this.view.evaluate(orgName, repoName, wref, {
+        ...pageOpts,
+        cursor
+      }), (page) => page.items, max, pageOpts.cursor);
+    }
+  };
+  grant = createGrantClient(() => this.trpc, toWarmHubError);
   thing = {
     head: async (orgName, repoName, opts) => {
       try {
@@ -45803,6 +45903,7 @@ class WarmHubClient {
       name: options?.client?.name ?? WARMHUB_SDK_CLIENT_NAME,
       version: options?.client?.version ?? SDK_VERSION
     };
+    this.clientFlags = normalizeClientFlags(options?.clientFlags);
     if (typeof this.accessToken === "function") {
       const provider = this.accessToken;
       this.getToken = async () => await provider();
@@ -45833,7 +45934,8 @@ class WarmHubClient {
       apiUrl: this.apiUrl,
       fetch: this.fetchImpl,
       accessToken,
-      client: this.clientIdentity
+      client: this.clientIdentity,
+      clientFlags: this.clientFlags
     });
   }
   actions = this.action;
@@ -45906,6 +46008,9 @@ class WarmHubClient {
     if (!headers.has(CLIENT_HEADER)) {
       headers.set(CLIENT_HEADER, formatClientHeader(this.clientIdentity.name, this.clientIdentity.version));
     }
+    if (this.clientFlags.length > 0 && !headers.has(CLIENT_FLAGS_HEADER)) {
+      headers.set(CLIENT_FLAGS_HEADER, serializeClientFlags(this.clientFlags));
+    }
   }
   async fetchWithAuth(input, init) {
     const fetchImpl = this.fetchImpl ?? globalThis.fetch;
@@ -46173,7 +46278,9 @@ var CONFLICT_SHAPED_CODES = new Set([
   "REPO_PENDING_DELETE",
   "ALREADY_RETRACTED",
   "LEASE_UNAVAILABLE",
-  "INCREMENTAL_READ_UNAVAILABLE"
+  "INCREMENTAL_READ_UNAVAILABLE",
+  "VIEW_EVALUATION_UNAVAILABLE",
+  "IDEMPOTENCY_CONFLICT"
 ]);
 
 // ../../packages/warmhub-cli/src/errors-types.ts
@@ -46652,11 +46759,13 @@ function cliErrorFromAllFailed(failures) {
     return bestErr;
   return new CliError(4 /* Backend */, "BACKEND", `All ${failures.length} operations failed`);
 }
-function assertSingleOpSuccess(result) {
+function requireSingleOpSuccess(result) {
   const op = result.operations[0];
-  if (!op || !isFailedOpStatus(op.status))
-    return;
-  throw cliErrorFromOpFailure(op);
+  if (!op)
+    throw new Error("Commit returned no operation result");
+  if (isFailedOpStatus(op.status))
+    throw cliErrorFromOpFailure(op);
+  return op;
 }
 
 // ../../packages/warmhub-cli/src/args.ts
@@ -48010,9 +48119,11 @@ async function modifyStore(mutator, path) {
     return result;
   });
 }
-async function saveProfileLocked(name, profile, path) {
+async function saveProfileWithFlagsLocked(name, profile, flags, path) {
   await modifyStore((store) => {
-    setProfile(store, name, profile);
+    const stored = hasProfile(store, name) ? store.profiles[name]?.flags : undefined;
+    const resolved = flags ?? (Array.isArray(stored) ? stored : undefined);
+    setProfile(store, name, resolved?.length ? { ...profile, flags: [...resolved] } : profile);
   }, path);
 }
 async function deleteProfileLocked(name, path) {
@@ -48392,7 +48503,8 @@ function createClient(config2, opts = {}) {
     },
     fetch: createBenchmarkAwareFetch(benchmarkId, opts.signal),
     functionLogs: opts.functionLogs,
-    client: cliClientIdentity()
+    client: cliClientIdentity(),
+    clientFlags: opts.clientFlags
   });
 }
 function createUnauthenticatedClient(config2, opts = {}) {
@@ -48401,7 +48513,8 @@ function createUnauthenticatedClient(config2, opts = {}) {
     apiUrl: config2.apiUrl,
     fetch: createBenchmarkAwareFetch(benchmarkId, opts.signal),
     functionLogs: opts.functionLogs,
-    client: cliClientIdentity()
+    client: cliClientIdentity(),
+    clientFlags: opts.clientFlags
   });
 }
 function wantsStructuredLiveOutput(format) {
@@ -48434,7 +48547,8 @@ async function runLive(opts) {
     auth,
     fetch: createBenchmarkAwareFetch(benchmarkId, controller.signal),
     functionLogs: opts.functionLogs,
-    client: cliClientIdentity()
+    client: cliClientIdentity(),
+    clientFlags: opts.clientFlags
   });
   if (opts.signal) {
     if (opts.signal.aborted)
@@ -48516,15 +48630,29 @@ function shouldGuardDomain(domainPath, canonicalVerb, args) {
   }
   return true;
 }
+async function probeCapabilities(ctx) {
+  try {
+    return await ctx.client.diagnostics.capabilities();
+  } catch {
+    return;
+  }
+}
 async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
   if (!shouldGuardDomain(domainPath, canonicalVerb, args))
     return;
+  const clientFlags = ctx.clientFlags ?? [];
+  if (clientFlags.includes(CLIENT_FLAG_COMPATIBILITY_OVERRIDE)) {
+    ctx.err(`compatibility checks overridden by client flag ${CLIENT_FLAG_COMPATIBILITY_OVERRIDE}`);
+  }
+  let capabilities;
   try {
     const diagnostics = ctx.client.diagnostics;
     if (typeof diagnostics.assertCompatible === "function") {
       await diagnostics.assertCompatible();
+      if (clientFlags.length > 0)
+        capabilities = await probeCapabilities(ctx);
     } else {
-      await diagnostics.capabilities();
+      capabilities = await diagnostics.capabilities();
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -48533,6 +48661,17 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
     } else {
       ctx.err(`Could not verify compatibility: ${message}`);
     }
+    if (clientFlags.length > 0)
+      capabilities = await probeCapabilities(ctx);
+  }
+  if (clientFlags.length === 0 || !capabilities)
+    return;
+  const echoed = capabilities.honoredClientFlags;
+  const honored = new Set(Array.isArray(echoed) ? echoed : []);
+  for (const flagName of clientFlags) {
+    if (honored.has(flagName))
+      continue;
+    ctx.err(`client flag "${flagName}" is not honored by this backend`);
   }
 }
 
@@ -48603,15 +48742,9 @@ function getRepoRef(ctx) {
     return r[r.length - 1];
   return;
 }
-function splitRepoSlug(ref) {
-  const parts = ref.split("/");
-  if (parts.length !== 2 || !parts[0] || !parts[1])
-    return null;
-  return { org: parts[0], repo: parts[1] };
-}
 function parseOrgRepo(ref, config2) {
   if (ref?.includes("/")) {
-    const parsed = splitRepoSlug(ref);
+    const parsed = parseRepoSlug(ref);
     if (!parsed) {
       throw new CliError(3 /* Config */, "CONFIG", `Invalid repo format "${ref}". Expected "org/repo".`);
     }
@@ -48621,7 +48754,7 @@ function parseOrgRepo(ref, config2) {
     return { org: config2.defaultOrg, repo: ref };
   }
   if (config2.defaultRepo) {
-    const parsed = splitRepoSlug(config2.defaultRepo);
+    const parsed = parseRepoSlug(config2.defaultRepo);
     if (!parsed) {
       throw new CliError(3 /* Config */, "CONFIG", `Invalid repo format "${config2.defaultRepo}". Expected "org/repo".`);
     }
@@ -49188,20 +49321,20 @@ function getCacheBaseDir() {
     return override;
   return join7(homedir3(), ".warmhub", "cache", "install-snapshots");
 }
-function isValidSegment(segment) {
-  return segment.length > 0 && segment !== "." && segment !== ".." && /^[a-zA-Z0-9._-]+$/.test(segment);
+function isPathSafeSegment(segment) {
+  return segment !== "." && segment !== ".." && /^[a-zA-Z0-9._-]+$/.test(segment);
 }
-function parseRepoSlug(repoSlug) {
-  const segments = repoSlug.split("/");
-  if (segments.length !== 2)
+function parseSnapshotCacheSlug(repoSlug) {
+  const parsed = parseRepoSlug(repoSlug);
+  if (!parsed)
     return null;
-  const [org, repo] = segments;
-  if (!isValidSegment(org) || !isValidSegment(repo))
+  const { org, repo } = parsed;
+  if (!isPathSafeSegment(org) || !isPathSafeSegment(repo))
     return null;
   return { org, repo, fileName: `${org}--${repo}.json` };
 }
 function getInstallSnapshotCachePath(repoSlug) {
-  const parsed = parseRepoSlug(repoSlug);
+  const parsed = parseSnapshotCacheSlug(repoSlug);
   if (!parsed)
     return null;
   return join7(getCacheBaseDir(), parsed.fileName);
@@ -49328,7 +49461,7 @@ async function loadOrPopulateInstallSnapshotCacheForComponent(repoSlug, client,
   if (cached2 && isCacheFresh(cached2, opts))
     return cached2;
   try {
-    const parsed = parseRepoSlug(repoSlug);
+    const parsed = parseSnapshotCacheSlug(repoSlug);
     if (!parsed)
       return null;
     const activeItems = filterActiveItems(await fetchAllSummaries(client, parsed.org, parsed.repo));
@@ -49358,7 +49491,7 @@ async function ensureFreshInstallSnapshotCache(repoSlug, client, opts) {
   }
 }
 async function refreshInstallSnapshotCache(repoSlug, client, opts) {
-  const parsed = parseRepoSlug(repoSlug);
+  const parsed = parseSnapshotCacheSlug(repoSlug);
   if (!parsed) {
     throw new Error(`Invalid repo slug for install snapshot cache: '${repoSlug}'`);
   }
@@ -49446,15 +49579,15 @@ function filterActiveItems(items) {
   return items.filter((i) => i.active && i.state !== "uninstalled" && i.state !== "paused" && i.state !== "error");
 }
 function extractRegisteredRef(ref) {
-  if (typeof ref !== "string" || ref.length === 0)
-    return null;
-  const segments = ref.split("/");
-  if (segments.length !== 2)
+  if (typeof ref !== "string")
     return null;
-  const [org, name] = segments;
-  if (!org || !name)
+  const parsed = parseComponentRef(ref);
+  if (!parsed)
     return null;
-  return { ownerOrgName: org, registeredComponentName: name };
+  return {
+    ownerOrgName: parsed.org,
+    registeredComponentName: parsed.name
+  };
 }
 
 // ../../packages/warmhub-cli/src/domain-help.ts
@@ -50047,7 +50180,7 @@ function parseAbout(raw) {
     return raw;
   }
   const tag = raw.slice(0, colonIdx).toLowerCase();
-  if (!COLLECTION_TAGS.includes(tag)) {
+  if (!COLLECTION_TAGS.some((candidate) => candidate === tag)) {
     return raw;
   }
   throw new CliError(2 /* UserInput */, "USER_INPUT", COLLECTION_ABOUT_REMOVED_MESSAGE, undefined, "Use wh commit submit --file with a named collection add followed by an assertion add.");
@@ -50192,10 +50325,7 @@ var handleRevise = async (ctx, { flags, args }) => {
       data
     }
   ], { committer: flags.committer });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  const result = requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => renderSingleOpSuccess(ctx.out, c, ctx.chars, result, {
     marker: "~",
     color: c.yellow,
@@ -50220,14 +50350,10 @@ var handleRetract = async (ctx, { flags, args }) => {
   ], {
     committer: flags.committer
   });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  const result = requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => {
-    const op = result;
     renderCommitterEcho(ctx.out, ctx.colors, flags.committer);
-    ctx.out(`${ctx.colors.red}-${ctx.colors.reset} ${displayName(ctx.colors, op?.name ?? name)}`);
+    ctx.out(`${ctx.colors.red}-${ctx.colors.reset} ${displayName(ctx.colors, result.name)}`);
   });
 };
 var handleCreate = async (ctx, { flags, args }) => {
@@ -50254,10 +50380,7 @@ var handleCreate = async (ctx, { flags, args }) => {
     }
   ];
   const commitResult = await ctx.client.commit.apply(org, repo, message ?? `assert ${shape}`, operations, { committer });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  const result = requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => renderSingleOpSuccess(ctx.out, c, ctx.chars, result, {
     marker: "+",
     color: c.green,
@@ -50420,6 +50543,7 @@ var handleAbout = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -50566,10 +50690,7 @@ var handleCreate2 = async (ctx, { flags, args }) => {
       data
     }
   ], { committer });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  const result = requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => renderSingleOpSuccess(ctx.out, c, ctx.chars, result, {
     marker: "+",
     color: c.green,
@@ -51090,6 +51211,7 @@ var handleHistory = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -51192,8 +51314,9 @@ var VALID_KINDS = [
 function validateKind(value, flagName = "--kind") {
   if (value === undefined)
     return;
-  if (VALID_KINDS.includes(value))
-    return value;
+  const parsed = VALID_KINDS.find((candidate) => candidate === value);
+  if (parsed)
+    return parsed;
   const message = `Invalid ${flagName} "${value}". Supported kinds: ${VALID_KINDS.join(", ")}.`;
   const hint = /^[A-Z]/.test(value) ? `Did you mean --shape ${value} --kind assertion?` : `Example: ${flagName} assertion`;
   throw new CliError(2 /* UserInput */, "USER_INPUT", message, undefined, hint);
@@ -51396,6 +51519,7 @@ var handleHead = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -51585,6 +51709,7 @@ var handleQuery = async (ctx, { flags }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -51868,14 +51993,10 @@ var handleThingRetract = async (ctx, { flags, args }) => {
       ...leaseId ? { leaseId } : {}
     }
   ], { committer });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  const result = requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => {
-    const op = result;
     renderCommitterEcho(ctx.out, c, committer);
-    ctx.out(`${c.red}-${c.reset} ${displayName(c, op?.name ?? name)}`);
+    ctx.out(`${c.red}-${c.reset} ${displayName(c, result.name)}`);
   });
 };
 
@@ -51918,10 +52039,7 @@ var handleRevise2 = async (ctx, { flags, args }) => {
       ...leaseId ? { leaseId } : {}
     }
   ], { committer });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  const result = requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => renderSingleOpSuccess(ctx.out, c, ctx.chars, result, {
     marker: "~",
     color: c.yellow,
@@ -52292,6 +52410,7 @@ async function runSingleView(ctx, wref, flags) {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -52362,7 +52481,7 @@ var handleView = async (ctx, { flags, args, terminator }) => {
   }
   if (isBatch)
     return runBatchView(ctx, wrefs, flags);
-  const singleWref = wrefs[0];
+  const [singleWref] = wrefs;
   return runSingleView(ctx, singleWref, flags);
 };
 
@@ -52576,6 +52695,7 @@ var handleView2 = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -52632,6 +52752,7 @@ var handleHistory2 = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -52756,6 +52877,7 @@ var handleList = async (ctx, { flags, args }) => {
         inactivityTimeoutMs: ctx.inactivityTimeoutMs,
         functionLogs: ctx.functionLogMode,
         profile: ctx.profile,
+        clientFlags: ctx.clientFlags,
         signal: ctx.signal
       });
       return;
@@ -52799,6 +52921,7 @@ var handleList = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -52903,8 +53026,99 @@ var ASSERTION_DOMAIN = defineDomain({
   }
 });
 
+// ../../packages/warmhub-cli/src/cli-context.ts
+function resolveClientFlags(profileFlags, env = process.env) {
+  const candidates = [
+    ...Array.isArray(profileFlags) ? profileFlags : [],
+    ...(env.WH_CLIENT_FLAGS ?? "").split(",")
+  ];
+  const flags = new Set;
+  const dropped = [];
+  for (const raw of candidates) {
+    const token = typeof raw === "string" ? raw.trim() : "";
+    if (!token)
+      continue;
+    if (isValidClientFlagToken(token))
+      flags.add(token);
+    else
+      dropped.push(token);
+  }
+  return { flags: [...flags].sort(), dropped };
+}
+function resolveCliContext(args) {
+  const { invocation, format } = args;
+  const config2 = args.config ?? loadConfig();
+  const apiUrlFlag = invocation.flags["api-url"];
+  const explicitApiUrl = typeof apiUrlFlag === "string" ? apiUrlFlag : undefined;
+  const profileFlag = invocation.flags.profile;
+  const apiUrl = explicitApiUrl ?? process.env.WARMHUB_API_URL ?? config2.apiUrl;
+  config2.apiUrl = apiUrl;
+  const explicitProfile = (typeof profileFlag === "string" ? profileFlag : undefined) ?? config2.profile;
+  const effectiveProfile = explicitProfile ?? "default";
+  const overridesBypassProfile = !explicitProfile && !!process.env.WH_TOKEN && (!!process.env.WARMHUB_API_URL || !!explicitApiUrl);
+  let profileData = null;
+  if (!overridesBypassProfile) {
+    try {
+      profileData = getProfile(effectiveProfile);
+    } catch (err) {
+      if (explicitProfile)
+        throw err;
+      const reason = err instanceof Error ? err.message : String(err);
+      if (format === "json" || format === "jsonl") {
+        process.stderr.write(`${JSON.stringify({
+          level: "warning",
+          kind: "auth-file-unreadable",
+          message: `could not read auth.json: ${reason}`
+        })}
+`);
+      } else {
+        process.stderr.write(`warning: could not read auth.json (${reason})
+`);
+      }
+    }
+  }
+  if (profileData) {
+    if (profileData.apiUrl && !explicitApiUrl) {
+      config2.apiUrl = profileData.apiUrl;
+    }
+  } else if (explicitProfile) {
+    const isAuthLogin = invocation.kind === "static" && invocation.commandPath[0] === "auth" && invocation.commandPath[1] === "login";
+    if (!isAuthLogin) {
+      const available = listProfiles();
+      const availableHint = available.length > 0 ? `Available profiles: ${available.join(", ")}.` : "No profiles found.";
+      throw new CliError(5 /* Auth */, "AUTH", `Auth profile "${explicitProfile}" does not exist.`, undefined, `${availableHint}
+Run \`wh auth login --profile ${explicitProfile}\` to create it.`);
+    }
+  }
+  const { flags: clientFlags, dropped: droppedFlags } = resolveClientFlags(profileData?.flags);
+  for (const token of droppedFlags) {
+    process.stderr.write(`warning: ignoring malformed client flag "${token}"
+`);
+  }
+  const client = args.client ?? createClient(config2, {
+    functionLogs: args.functionLogs,
+    profile: effectiveProfile,
+    signal: args.signal,
+    clientFlags
+  });
+  return { config: config2, profile: effectiveProfile, client, clientFlags };
+}
+
 // ../../packages/warmhub-cli/src/domains/auth-shared.ts
-async function loginWithToken(ctx, profile) {
+function clientForStoredFlags(ctx, profile) {
+  const { flags } = resolveClientFlags(getProfile(profile)?.flags);
+  const active = ctx.clientFlags ?? [];
+  if (flags.length === active.length && flags.every((token, i) => token === active[i])) {
+    return ctx.client;
+  }
+  return createClient(ctx.config, {
+    functionLogs: ctx.functionLogMode,
+    profile,
+    signal: ctx.signal,
+    clientFlags: flags
+  });
+}
+async function loginWithToken(ctx, profile, explicitFlags) {
   const c = ctx.colors;
   if (process.stdin.isTTY) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", "No token provided on stdin.", undefined, 'Pipe a JWT token via stdin: echo "$TOKEN" | wh auth login --with-token');
@@ -52932,7 +53146,7 @@ async function loginWithToken(ctx, profile) {
   if (Date.now() >= new Date(expiresAt).getTime() - EXPIRY_BUFFER_MS) {
     throw new CliError(5 /* Auth */, "AUTH", `Token is already expired (at ${new Date(expiresAt).toLocaleString()}).`, undefined, "Provide a valid, non-expired JWT.");
   }
-  await saveProfileLocked(profile, {
+  await saveProfileWithFlagsLocked(profile, {
     tokens: {
       accessToken: jwt2,
       refreshToken: "",
@@ -52941,9 +53155,9 @@ async function loginWithToken(ctx, profile) {
       source: "token"
     },
     apiUrl: ctx.config.apiUrl
-  });
+  }, explicitFlags);
   try {
-    await ctx.client.auth.sync();
+    await clientForStoredFlags(ctx, profile).auth.sync();
   } catch (err) {
     ctx.err(`${c.yellow}Warning: could not sync user record: ${err instanceof Error ? err.message : String(err)}${c.reset}`);
   }
@@ -53030,7 +53244,7 @@ async function pollForDeviceToken(params) {
     poll().catch(reject);
   });
 }
-function renderTokenInfo(ctx, info, profileName, apiUrl, identityWref) {
+function renderTokenInfo(ctx, info, profileName, apiUrl, identityWref, flags) {
   const c = ctx.colors;
   const prefix = profileName ? `${c.bold}${profileName}${c.reset}: ` : "";
   const sourceLabel = {
@@ -53065,6 +53279,9 @@ function renderTokenInfo(ctx, info, profileName, apiUrl, identityWref) {
       ctx.status(`  ${c.dim}Identity:${c.reset} ${identityWref}`);
     }
   }
+  if (flags?.length) {
+    ctx.status(`  ${c.dim}Client flags:${c.reset} ${flags.join(", ")}`);
+  }
 }
 async function fetchIdentityWref(ctx) {
   if (process.env.WH_TOKEN)
@@ -53088,6 +53305,10 @@ function openBrowser(url2) {
 var loginFlags = {
   "with-token": flag.boolean({
     description: "Read a JWT token from stdin instead of using the browser flow"
+  }),
+  flag: flag.string({
+    multiple: true,
+    description: "Client flag to store on this profile. Repeatable. Validated " + "server-side; the backend honors only configured flags."
   })
 };
 function authStatusEntry(info, options) {
@@ -53098,6 +53319,7 @@ function authStatusEntry(info, options) {
     canRefresh: info.canRefresh,
     email: info.email ?? null,
     expiresAt: info.expiresAt ?? null,
+    flags: options.flags ?? [],
     identityWref: options.identityWref ?? null,
     profile: options.profile ?? null,
     source: info.source
@@ -53110,10 +53332,23 @@ function authStatusOutput(activeProfile, entries) {
     entries
   };
 }
+var GENERIC_CLIENT_FLAG_HINT = "Use lowercase tokens matching [a-z0-9-]+, e.g. `wh auth login --flag <name>`.";
+function invalidClientFlagMessage(token) {
+  const base = `Invalid client flag "${token}": expected lowercase tokens matching [a-z0-9-]+`;
+  const normalized = token.trim().toLowerCase();
+  return isValidClientFlagToken(normalized) ? `${base} (did you mean "${normalized}"?)` : `${base}.`;
+}
 var handleLogin = async (ctx, { flags }) => {
   const profile = flags.profile ?? ctx.config.profile ?? "default";
+  const requestedFlags = (flags.flag ?? []).map((t) => t.trim());
+  for (const token of requestedFlags) {
+    if (!isValidClientFlagToken(token)) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", invalidClientFlagMessage(token), undefined, GENERIC_CLIENT_FLAG_HINT);
+    }
+  }
+  const explicitFlags = requestedFlags.length > 0 ? [...new Set(requestedFlags)].sort() : undefined;
   if (flags["with-token"]) {
-    return loginWithToken(ctx, profile);
+    return loginWithToken(ctx, profile, explicitFlags);
   }
   const c = ctx.colors;
   let clientId;
@@ -53121,7 +53356,8 @@ var handleLogin = async (ctx, { flags }) => {
     clientId = await ctx.client.auth.getClientId();
   } catch {
     clientId = await createUnauthenticatedClient(ctx.config, {
-      functionLogs: ctx.functionLogMode
+      functionLogs: ctx.functionLogMode,
+      clientFlags: ctx.clientFlags
     }).auth.getClientId();
   }
   if (!clientId) {
@@ -53185,7 +53421,7 @@ var handleLogin = async (ctx, { flags }) => {
   } catch {
     expiresAt = new Date(Date.now() + 5 * 60 * 1000).toISOString();
   }
-  await saveProfileLocked(profile, {
+  await saveProfileWithFlagsLocked(profile, {
     tokens: {
       accessToken: tokenResponse.access_token,
       refreshToken: tokenResponse.refresh_token,
@@ -53196,9 +53432,9 @@ var handleLogin = async (ctx, { flags }) => {
       source: "device"
     },
     apiUrl: ctx.config.apiUrl
-  });
+  }, explicitFlags);
   try {
-    await ctx.client.auth.sync();
+    await clientForStoredFlags(ctx, profile).auth.sync();
   } catch (err) {
     ctx.err(`${c.yellow}Warning: could not sync user record: ${err instanceof Error ? err.message : String(err)}${c.reset}`);
   }
@@ -53238,10 +53474,11 @@ var handleStatus = async (ctx, { flags }) => {
     const entry = authStatusEntry(info, {
       active: true,
       apiUrl: prof.apiUrl,
+      flags: Array.isArray(prof.flags) ? prof.flags : [],
       identityWref,
       profile: selectedProfile
     });
-    writeOutput(ctx, authStatusOutput(selectedProfile, [entry]), () => renderTokenInfo(ctx, info, selectedProfile, prof.apiUrl, identityWref));
+    writeOutput(ctx, authStatusOutput(selectedProfile, [entry]), () => renderTokenInfo(ctx, info, selectedProfile, prof.apiUrl, identityWref, entry.flags));
     return;
   }
   const envToken = process.env.WH_TOKEN;
@@ -53270,13 +53507,15 @@ var handleStatus = async (ctx, { flags }) => {
         canRefresh: source === "device" && !!tokens.refreshToken
       };
       const identityWref = !info.expired && name === activeProfile ? await fetchIdentityWref(ctx) : null;
+      const profileFlags = Array.isArray(prof.flags) ? prof.flags : [];
       entries.push(authStatusEntry(info, {
         active: !envToken && name === activeProfile,
         apiUrl: prof.apiUrl,
+        flags: profileFlags,
         identityWref,
         profile: name
       }));
-      prettyEntries.push(() => renderTokenInfo(ctx, info, name, prof.apiUrl, identityWref));
+      prettyEntries.push(() => renderTokenInfo(ctx, info, name, prof.apiUrl, identityWref, profileFlags));
     }
   }
   writeOutput(ctx, authStatusOutput(envToken ? null : activeProfile, entries), () => {
@@ -53781,9 +54020,8 @@ function requireMembers(members, example) {
   }
 }
 function renderMutation(ctx, result) {
-  assertSingleOpSuccess(result);
-  const operation = result.operations[0];
-  if (!operation || !("version" in operation) || typeof operation.version !== "number") {
+  const operation = requireSingleOpSuccess(result);
+  if (!("version" in operation) || typeof operation.version !== "number") {
     throw new Error("Collection mutation returned no version-bearing operation");
   }
   const isNoop = operation.operation === "noop";
@@ -54023,10 +54261,11 @@ var collectionStatsFlags = {
   version: flag.number({ description: "Specific collection version number" })
 };
 function validateCollectionType(value) {
-  if (!value || !SUPPORTED_COLLECTION_TYPES.includes(value)) {
+  const parsed = SUPPORTED_COLLECTION_TYPES.find((candidate) => candidate === value);
+  if (!parsed) {
     usageError(`Usage: wh collection create --type ${CANONICAL_COLLECTION_TYPE_USAGE} --members <wref...>`, 'wh collection create --type set --name audited --members Location/a,Location/b -m "audit snapshot"');
   }
-  return value;
+  return parsed;
 }
 function validateDiffMode(value) {
   if (value === undefined)
@@ -54052,7 +54291,7 @@ function collectionQuerySourceFromFlags(flags) {
 function parseSourceRepoFlag(value) {
   if (!value)
     return;
-  const parsed = splitRepoSlug(value);
+  const parsed = parseRepoSlug(value);
   if (!parsed) {
     usageError("--source-repo must be an org/repo slug", "wh collection create --type set --name wake-voters --source-repo data/nc-voters --shape Voter --where county=Wake");
   }
@@ -54089,7 +54328,7 @@ function isMissingCollectionMemberError(error51, type) {
 function collectionTypeFromWref2(wref) {
   const local = wref.replace(/^wh:[^/]+\/[^/]+\//, "").replace(/@(?:HEAD|ALL|v\d+)$/, "");
   const shape = local.split("/")[0]?.toLowerCase();
-  return SUPPORTED_COLLECTION_TYPES.includes(shape) ? shape : undefined;
+  return SUPPORTED_COLLECTION_TYPES.find((candidate) => candidate === shape);
 }
 function parseCollectionReadRepo(ctx, wrefs) {
   const allDurable = wrefs.length > 0 && wrefs.every(looksLikeDurableId);
@@ -54685,6 +54924,7 @@ function assertNoNulBytes(data, locator) {
 
 // ../../packages/warmhub-cli/src/domains/commit-submit-template.ts
 import { writeFile } from "node:fs/promises";
+var WRITE_TEMPLATE_KINDS = ["thing", "assertion"];
 function zeroValueForField(fieldSpec) {
   if (Array.isArray(fieldSpec))
     return [];
@@ -54773,20 +55013,21 @@ var handleTemplate = async (ctx, { flags, args }) => {
   if (operationType !== "add" && operationType !== "revise" && operationType !== "retract") {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --operation "${operationType}". Must be "add", "revise", or "retract".`);
   }
-  const validKinds = operationType === "retract" ? COMMIT_OPERATION_KINDS : ["thing", "assertion"];
-  if (!validKinds.includes(flags.kind ?? "thing")) {
+  const requestedKind = flags.kind ?? "thing";
+  const validKinds = operationType === "retract" ? COMMIT_OPERATION_KINDS : WRITE_TEMPLATE_KINDS;
+  const templateKind = validKinds.find((candidate) => candidate === requestedKind);
+  if (templateKind === undefined) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --kind "${flags.kind}". Must be one of: ${validKinds.join(", ")}.`);
   }
   const count = Math.max(1, flags.count ?? 1);
   const operations = [];
   for (const shapeName of shapeNames) {
     if (operationType === "retract") {
-      const kind2 = flags.kind ?? "thing";
       for (let i = 0;i < count; i++) {
         operations.push({
           operation: "retract",
-          kind: kind2,
-          name: kind2 === "shape" ? shapeName : `${shapeName}/FILL_IN`
+          kind: templateKind,
+          name: templateKind === "shape" ? shapeName : `${shapeName}/FILL_IN`
         });
       }
       continue;
@@ -54795,9 +55036,8 @@ var handleTemplate = async (ctx, { flags, args }) => {
     const shapeVersion = shape.version;
     const shapeData = shapeVersion?.data;
     const fields = shapeData?.fields ?? {};
-    const kind = flags.kind ?? "thing";
     let aboutPlaceholder;
-    if (kind === "assertion") {
+    if (templateKind === "assertion") {
       aboutPlaceholder = flags.about ? parseCollectionAboutFlag(flags.about) : "Shape/FILL_IN";
     }
     const data = buildTemplateData(fields);
@@ -54805,13 +55045,13 @@ var handleTemplate = async (ctx, { flags, args }) => {
     for (let i = 0;i < count; i++) {
       const op = operationType === "add" ? {
         operation: "add",
-        kind,
+        kind: templateKind,
         name: `${shapeName}/${nameSuffix(i)}`,
         ...aboutPlaceholder ? { about: aboutPlaceholder } : {},
         data
       } : {
         operation: "revise",
-        kind,
+        kind: templateKind,
         name: `${shapeName}/FILL_IN`,
         data
       };
@@ -55481,17 +55721,19 @@ var handleSubmit = async (ctx, { flags, args }) => {
     "shape",
     "collection"
   ];
-  for (const k of kinds) {
-    if (!validKinds.includes(k)) {
+  const operationKinds = kinds.map((k) => {
+    const parsed = validKinds.find((candidate) => candidate === k);
+    if (!parsed) {
       throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --kind "${k}". Must be one of: ${validKinds.join(", ")}`);
     }
-  }
+    return parsed;
+  });
   const validCollectionTypes = ["arc", "bond", "set", "list", "pair"];
   const canonicalCollectionTypes2 = ["arc", "bond", "set", "list"];
-  if (flags.type && !validCollectionTypes.includes(flags.type)) {
+  const collectionType = validCollectionTypes.find((candidate) => candidate === flags.type);
+  if (flags.type !== undefined && collectionType === undefined) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --type "${flags.type}". Use one of: ${canonicalCollectionTypes2.join(", ")}`, undefined, "wh commit submit --type arc --name route --members Location/a,Location/b");
   }
-  const collectionType = flags.type;
   const jsonlFile = opsFile?.endsWith(".jsonl") === true;
   const operationSource = resolveCommitOperationSource({
     stream: streamInput,
@@ -55510,7 +55752,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
     shape: shapes.length > 0,
     about: abouts.length > 0,
     reason: reasons.length > 0,
-    kind: kinds.length > 0,
+    kind: operationKinds.length > 0,
     name: flags.name !== undefined,
     members: flags.members !== undefined
   });
@@ -55586,12 +55828,12 @@ var handleSubmit = async (ctx, { flags, args }) => {
       dataJsons,
       shapes,
       abouts,
-      kinds
+      kinds: operationKinds
     });
   } else if (operationSource === "--retract") {
     operations = buildRetractOperations({
       retractNames,
-      kinds,
+      kinds: operationKinds,
       reasons,
       expectedVersion,
       leaseId: leaseIdFlag
@@ -55600,12 +55842,12 @@ var handleSubmit = async (ctx, { flags, args }) => {
     if (dataJsons.length > 1) {
       throw new CliError(2 /* UserInput */, "USER_INPUT", `--revise supports a single operation, but --data was repeated ${dataJsons.length} times.`, undefined, "Use --file <path.json> for multi-revision writes.");
     }
-    if (kinds.length > 1) {
-      throw new CliError(2 /* UserInput */, "USER_INPUT", `--revise supports a single operation, but --kind was repeated ${kinds.length} times.`, undefined, "Use --file <path.json> for multi-revision writes.");
+    if (operationKinds.length > 1) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `--revise supports a single operation, but --kind was repeated ${operationKinds.length} times.`, undefined, "Use --file <path.json> for multi-revision writes.");
     }
     const rawData = dataJsons[0];
     const data = rawData !== undefined ? parseJsonObject(rawData, "--data") : undefined;
-    const kindFlag = kinds[0];
+    const kindFlag = operationKinds[0];
     const kind = kindFlag ?? "thing";
     operations = [
       {
@@ -56018,8 +56260,7 @@ function bindComponentMethodArgs(invocation, method) {
     }
     const coerced = coerceArg(arg, raw);
     if (!coerced.ok) {
-      if (coerced.error)
-        addError(record2.index, coerced.error);
+      addError(record2.index, coerced.error);
       continue;
     }
     if (!Object.hasOwn(args, arg.name))
@@ -56037,7 +56278,7 @@ function bindComponentMethodArgs(invocation, method) {
       const coerced = coerceArg(arg, arg.default);
       if (coerced.ok) {
         args[arg.name] = coerced.value;
-      } else if (coerced.error) {
+      } else {
         addError(Number.POSITIVE_INFINITY, coerced.error);
       }
       continue;
@@ -56397,63 +56638,62 @@ function formatReservedNameWarning(name) {
 // ../../packages/warmhub-cli/src/manifest/parser.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
 import { resolve } from "node:path";
-function parseComponentPackage(dirPath) {
-  const rootDir = resolve(dirPath);
-  const errors3 = [];
-  const warnings = [];
-  const componentJsonPath = resolve(rootDir, "warmhub", "component.json");
-  if (!existsSync8(componentJsonPath)) {
-    errors3.push(`Missing warmhub/component.json at ${componentJsonPath}`);
-    return { ok: false, errors: errors3, warnings };
+function loadDocument(rootDir, fileName, validate) {
+  const path2 = resolve(rootDir, "warmhub", fileName);
+  if (!existsSync8(path2)) {
+    return {
+      valid: false,
+      errors: [`Missing warmhub/${fileName} at ${path2}`],
+      warnings: []
+    };
   }
-  let componentRaw;
-  try {
-    componentRaw = JSON.parse(readFileSync9(componentJsonPath, "utf-8"));
-  } catch (err) {
-    errors3.push(`Failed to parse warmhub/component.json: ${err instanceof Error ? err.message : String(err)}`);
-    return { ok: false, errors: errors3, warnings };
-  }
-  const componentResult = validateComponentJson(componentRaw);
-  errors3.push(...componentResult.errors);
-  warnings.push(...componentResult.warnings);
-  const manifestJsonPath = resolve(rootDir, "warmhub", "manifest.json");
-  if (!existsSync8(manifestJsonPath)) {
-    errors3.push(`Missing warmhub/manifest.json at ${manifestJsonPath}`);
-    return { ok: false, errors: errors3, warnings };
-  }
-  let manifestRaw;
+  let raw;
   try {
-    manifestRaw = JSON.parse(readFileSync9(manifestJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync9(path2, "utf-8"));
   } catch (err) {
-    errors3.push(`Failed to parse warmhub/manifest.json: ${err instanceof Error ? err.message : String(err)}`);
-    return { ok: false, errors: errors3, warnings };
-  }
-  const manifestResult = validateManifestJson(manifestRaw);
-  errors3.push(...manifestResult.errors);
-  warnings.push(...manifestResult.warnings);
-  if (errors3.length > 0) {
-    return { ok: false, errors: errors3, warnings };
+    return {
+      valid: false,
+      errors: [
+        `Failed to parse warmhub/${fileName}: ${err instanceof Error ? err.message : String(err)}`
+      ],
+      warnings: []
+    };
   }
-  if (!componentResult.value || !manifestResult.value) {
+  return validate(raw);
+}
+function parseComponentPackage(dirPath) {
+  const rootDir = resolve(dirPath);
+  const component = loadDocument(rootDir, "component.json", validateComponentJson);
+  const manifest = loadDocument(rootDir, "manifest.json", validateManifestJson);
+  const warnings = [...component.warnings, ...manifest.warnings];
+  if (!component.valid && !manifest.valid) {
     return {
       ok: false,
-      errors: ["Validated component package is missing parsed values"],
+      errors: [...component.errors, ...manifest.errors],
       warnings
     };
   }
+  if (!component.valid) {
+    return { ok: false, errors: component.errors, warnings };
+  }
+  if (!manifest.valid) {
+    return { ok: false, errors: manifest.errors, warnings };
+  }
   return {
     ok: true,
-    errors: [],
     warnings,
     package: {
-      meta: componentResult.value,
-      manifest: manifestResult.value,
+      meta: component.value,
+      manifest: manifest.value,
       rootDir
     }
   };
 }
 
 // ../../packages/warmhub-cli/src/manifest/validate.ts
+function hasBlockingFindings(findings) {
+  return findings.some((finding) => finding.level === "error");
+}
 function crossValidate(pkg) {
   const findings = [];
   const { meta: meta3, manifest } = pkg;
@@ -56472,8 +56712,7 @@ function crossValidate(pkg) {
     });
   }
   findings.push(...validateManifestSemantics(manifest));
-  const hasErrors = findings.some((f) => f.level === "error");
-  return { valid: !hasErrors, findings };
+  return { findings };
 }
 function validateComponentPackage(pkg) {
   return crossValidate(pkg);
@@ -56632,14 +56871,11 @@ function resolveRegisteredComponentRef(ref, usage, example) {
   if (!ref) {
     usageError(usage, example);
   }
-  const parts = ref.split("/");
-  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+  const parsed = parseComponentRef(ref);
+  if (!parsed) {
     usageError(`Invalid component reference '${ref}'. Expected '<org>/<name>' with no extra slashes and no empty parts.`, example);
   }
-  return {
-    orgName: parts[0],
-    componentName: parts[1]
-  };
+  return { orgName: parsed.org, componentName: parsed.name };
 }
 function resolveRegistryVisibility(args) {
   if (args.isPrivate && args.isPublic) {
@@ -56845,13 +57081,9 @@ var handleValidate = async (ctx, { args }) => {
     writeOutput(ctx, result2, () => renderValidationResult(ctx, result2));
     throw new CliError(2 /* UserInput */, "USER_INPUT", "Component package validation failed");
   }
-  const parsedPackage = parseResult.package;
-  if (!parsedPackage) {
-    throw new CliError(1 /* Runtime */, "UNKNOWN", "Component package validation returned no package");
-  }
-  const crossResult = validateComponentPackage(parsedPackage);
+  const crossResult = validateComponentPackage(parseResult.package);
   const result = {
-    valid: crossResult.valid,
+    valid: !hasBlockingFindings(crossResult.findings),
     errors: [],
     warnings: parseResult.warnings,
     findings: crossResult.findings
@@ -58305,7 +58537,7 @@ async function collectChecks(ctx) {
   const repoFlag = getRepoRef(ctx);
   const hasRepoFlag = repoFlag !== undefined;
   const repo = repoFlag ?? ctx.config.defaultRepo;
-  const repoParts = repo !== undefined ? splitRepoSlug(repo) : null;
+  const repoParts = repo !== undefined ? parseRepoSlug(repo) : null;
   const repoForDisplay = repo !== undefined ? escapeTerminalTextForDisplay(repo) : undefined;
   const repoSource = hasRepoFlag ? "flag" : ctx.config.configSource?.repo;
   const repoProvenance = repoSource === "env" ? " (from WARMHUB_REPO)" : repoSource === "wh-file" ? " (from .wh file)" : repoSource === "flag" ? " (from --repo flag)" : "";
@@ -58638,7 +58870,7 @@ var handleDoctor2 = async (ctx, { flags }) => {
           ctx.out(`      ${c.dim}${line}${c.reset}`);
         }
       }
-      if (check2.fix && check2.status !== "ok") {
+      if (check2.fix) {
         for (const line of check2.fix.split(`
 `)) {
           ctx.out(`      ${c.dim}${line}${c.reset}`);
@@ -58684,6 +58916,120 @@ var DOCTOR_DOMAIN = defineDomain({
   handler: handleDoctor2
 });
 
+// ../../packages/warmhub-cli/src/domains/grant.ts
+var createFlags5 = {
+  key: flag.string({ description: "issuer-scoped idempotency key" }),
+  coverage: flag.string({
+    description: "inline coverage JSON ({include, exclude?})"
+  }),
+  op: flag.string({
+    description: "operation to grant (repeatable)",
+    multiple: true
+  })
+};
+var listFlags3 = {
+  limit: flag.number({ description: "max records (default: 50, max: 100)" }),
+  cursor: flag.string({ description: "grant keyset cursor" })
+};
+var revokeFlags2 = {
+  reason: flag.string({ description: "revocation audit reason" })
+};
+function repo(ctx) {
+  return parseOrgRepo(getRepoRef(ctx), ctx.config);
+}
+var handleCreate4 = async (ctx, { args, flags }) => {
+  const [principalKind, principalId] = args;
+  if (!principalKind || !principalId || !flags.key || !flags.op?.length) {
+    usageError("Usage: wh grant create <member|pat|component> <principal-id> --key KEY --op OP [--op OP] --coverage JSON", `wh grant create component install-1:7 --key provision --op things:read --coverage '{"include":["Lesson/**"]}'`);
+  }
+  if (!flags.coverage) {
+    usageError("Grant create requires --coverage.", `wh grant create component install-1:7 --key provision --op things:read --coverage '{"include":["Lesson/**"]}'`);
+  }
+  if (!["member", "pat", "component"].includes(principalKind)) {
+    usageError("Grant grantee kind must be member, pat, or component.", `wh grant create component install-1:7 --key provision --op things:read --coverage '{"include":["Lesson/**"]}'`);
+  }
+  let coverage;
+  try {
+    coverage = JSON.parse(flags.coverage);
+  } catch {
+    usageError("--coverage must be valid JSON.", `wh grant create component install-1:7 --key provision --op things:read --coverage '{"include":["Lesson/**"]}'`);
+  }
+  const { org, repo: repoName } = repo(ctx);
+  const result = await ctx.client.grant.create(org, repoName, {
+    idempotencyKey: flags.key,
+    grantee: {
+      principalId,
+      principalKind
+    },
+    coverage,
+    ops: flags.op
+  });
+  writeOutput(ctx, result, () => ctx.out(JSON.stringify(result, null, 2)));
+};
+var handleGet = async (ctx, { args }) => {
+  const grantId = args[0];
+  if (!grantId) {
+    usageError("Usage: wh grant get <grant-id>", "wh grant get 019b57b6-7a42-7000-8000-000000000000");
+  }
+  const { org, repo: repoName } = repo(ctx);
+  const result = await ctx.client.grant.get(org, repoName, grantId);
+  writeOutput(ctx, result, () => ctx.out(JSON.stringify(result, null, 2)));
+};
+var handleList4 = async (ctx, { flags }) => {
+  const { org, repo: repoName } = repo(ctx);
+  const limit = Math.min(flags.limit ?? 50, 100);
+  const result = await ctx.client.grant.list(org, repoName, {
+    limit,
+    cursor: flags.cursor
+  });
+  writePageOutput(ctx, result.items, { limit, nextCursor: result.nextCursor ?? null }, () => ctx.out(JSON.stringify(result.items, null, 2)));
+};
+var handleRevoke2 = async (ctx, { args, flags }) => {
+  const grantId = args[0];
+  if (!grantId) {
+    usageError("Usage: wh grant revoke <grant-id> [--reason TEXT]", "wh grant revoke 019b57b6-7a42-7000-8000-000000000000 --reason superseded");
+  }
+  const { org, repo: repoName } = repo(ctx);
+  const result = await ctx.client.grant.revoke(org, repoName, grantId, {
+    reason: flags.reason
+  });
+  writeOutput(ctx, result, () => ctx.out(JSON.stringify(result, null, 2)));
+};
+var GRANT_DOMAIN = defineDomain({
+  name: "grant",
+  summary: "Immutable repository Grant administration",
+  group: "resource",
+  verbs: {
+    create: {
+      prime: true,
+      summary: "Create or replay an issuer-scoped Grant request",
+      args: "<member|pat|component> <principal-id>",
+      flags: createFlags5,
+      handler: handleCreate4
+    },
+    get: {
+      prime: true,
+      summary: "Get one active or revoked Grant",
+      args: "<grant-id>",
+      handler: handleGet
+    },
+    list: {
+      prime: true,
+      summary: "List active and revoked Grants",
+      args: "",
+      flags: listFlags3,
+      handler: handleList4
+    },
+    revoke: {
+      prime: true,
+      summary: "Revoke a Grant idempotently",
+      args: "<grant-id>",
+      flags: revokeFlags2,
+      handler: handleRevoke2
+    }
+  }
+});
+
 // ../../packages/warmhub-cli/src/domains/init.ts
 import { basename as basename4 } from "node:path";
 
@@ -58692,7 +59038,7 @@ async function onboardRepo(ctx, repoRef, description) {
   if (!repoRef?.includes("/")) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", "Usage: wh init [org/repo] [--description <desc>]", undefined, "Example: wh init my-org/my-repo");
   }
-  const parsed = splitRepoSlug(repoRef);
+  const parsed = parseRepoSlug(repoRef);
   if (!parsed) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid repo format "${repoRef}". Expected "org/repo".`, undefined, "Example: wh init my-org/my-repo");
   }
@@ -58890,8 +59236,8 @@ function parseSince(raw, usage, example) {
 var handleNotifications = async (ctx, { flags }) => {
   const usage = "Usage: wh notifications [--repo org/repo] [--limit n] [--since <epoch-ms|iso>]";
   const example = "wh notifications --repo myorg/myrepo --since 2026-03-30T12:00:00Z";
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.action.listNotifications(org, repo, {
+  const { org, repo: repo2 } = resolveRepoContext(ctx);
+  const result = await ctx.client.action.listNotifications(org, repo2, {
     since: parseSince(flags.since, usage, example),
     limit: flags.limit
   });
@@ -59321,11 +59667,11 @@ var handleUpdate2 = async (ctx, { args, flags }) => {
 };
 
 // ../../packages/warmhub-cli/src/domains/org.ts
-var createFlags5 = {
+var createFlags6 = {
   "display-name": flag.string({ description: "Display name for the org" }),
   description: flag.string({ short: "d", description: "Org description" })
 };
-var handleCreate4 = async (ctx, { flags, args }) => {
+var handleCreate5 = async (ctx, { flags, args }) => {
   const name = args[0];
   if (!name) {
     usageError('Usage: wh org create <name> [--display-name "..."] [--description "..."]', 'wh org create caryden --display-name "Carl Ryden" -d "A great org"');
@@ -59367,12 +59713,12 @@ var handleView5 = async (ctx, { args }) => {
     ctx.out(`${c.dim}Created: ${new Date(result.createdAt).toISOString().slice(0, 16)}${c.reset}`);
   });
 };
-var listFlags3 = {
+var listFlags4 = {
   "include-archived": flag.boolean({
     description: "Include archived organizations"
   })
 };
-var handleList4 = async (ctx, { flags }) => {
+var handleList5 = async (ctx, { flags }) => {
   const c = ctx.colors;
   const result = await ctx.client.org.list({
     includeArchived: flags["include-archived"]
@@ -59479,9 +59825,9 @@ var ORG_DOMAIN = defineDomain({
       prime: true,
       summary: "Create a new organization",
       args: "<name>",
-      flags: createFlags5,
+      flags: createFlags6,
       examples: ['wh org create caryden --display-name "Carl Ryden"'],
-      handler: handleCreate4
+      handler: handleCreate5
     },
     view: {
       prime: true,
@@ -59494,9 +59840,9 @@ var ORG_DOMAIN = defineDomain({
       prime: true,
       summary: "List all organizations",
       args: "",
-      flags: listFlags3,
+      flags: listFlags4,
       examples: ["wh org list", "wh org list --include-archived"],
-      handler: handleList4
+      handler: handleList5
     },
     update: {
       summary: "Update org settings",
@@ -59538,7 +59884,7 @@ var ORG_DOMAIN = defineDomain({
 });
 
 // ../../packages/warmhub-cli/src/domains/prime-content.md
-var prime_content_default = "# WarmHub CLI Context\n> **Context Recovery**: Run `wh prime` after compaction or new session\n\n## Environment\n{{REPO_LINE}}\n\n## Core Concepts\n- **Thing**: A named entity versioned by writes. **Assertion**: A thing that makes a shape-validated claim about another thing.\n- **Shape**: A thing defining data structure; every other thing has one. **Write**: One or more add/revise/retract operations with per-operation results.\n- **wref**: A reference to a thing. Local: `Player` (the shape) or `Player/alice` (a thing with that shape). Cross-repo: `wh:org/repo/Shape` or `wh:org/repo/Shape/name`.\n\n## Versioned Wrefs\n- `Shape` addresses the shape itself; `Shape/name` addresses a thing with that shape. `@vN` pins either.\n- Floating write refs to retracted targets fail; existing pinned versions remain valid.\n- Rename invalidates old spellings, including `@vN`; the new name resolves history.\n- Untyped wrefs accept any thing. `wref<T>` requires the target's shape to be `T`; a shape has no shape, so never satisfies it. `wref?` coalesces only `thing_absent`, never a missing shape.\n\n## Key Workflows\n\n**Write data** (discover shapes → scaffold ops → submit):\n```bash\nwh shape list --repo org/repo                             # list available shapes\nwh shape view ShapeName --repo org/repo                   # inspect fields\nwh shape template ShapeName -o ops.json --repo org/repo   # scaffold write ops (supports --kind assertion)\n# edit ops.json — fill FILL_IN placeholders — then:\nwh commit submit --file ops.json -m \"msg\" --repo org/repo  # submit operations (bare `wh commit` also works)\n# or single assertion (no file needed):\nwh assertion create --shape ShapeName --about Target/name --name my-assertion --data '{\"field\":1}' --repo org/repo\n# Relay failed operation details when present. Never hand-guess ops JSON — use `wh shape template <Shape>`.\n```\n\n**Read data:**\n```bash\nwh thing list --repo org/repo                 # all things at HEAD\nwh thing view Shape/name --repo org/repo      # inspect a thing\nwh thing query --shape MyShape --repo org/repo  # find things by shape\nwh thing about Shape --repo org/repo          # assertions about a shape\nwh assertion list --repo org/repo             # all assertions at HEAD\nwh thing history Shape/name --repo org/repo   # version history\n\n# Batch read — wh thing view is variadic (max 500 wrefs/call):\nwh thing view Player/alice Player/bob               # variadic positionals\nwh thing view --file wrefs.txt --json               # one wref per line\ncat wrefs.txt | wh thing view --format jsonl        # one JSON line per *deduped* requested wref\n```\n\n## Wref Quick Reference\n\nWrites use explicit names and wrefs. Untyped fields, collection members,\nassertion `about`, and committers accept any thing. Create a deterministic\ntarget before referencing it in the same commit.\n\n## Command Reference\n\n**Global flags**: `--repo`, `--format`, `--json`, `--live`\n### thing — Thing operations\n- `wh thing list [--shape] [--kind] [--match] [--include-retracted]` — Current HEAD state\n- `wh thing view [<wref>...] [--file <path>] [--version] [--depth] [--include-retracted] [--data-mode auto|full]` — Thing details. Variadic (max 500). `--version` implies `--include-retracted`. Batch JSON returns `{ requested, items, missing }`; jsonl emits one row per deduped requested wref. Large Set/List bodies summarize by default; use `--data-mode full` for canonical collection JSON.\n- `wh thing history [wref] [--shape] [--about] [--include-retracted]` — Version history\n- `wh thing resolve <wref>` — Resolve a wref to its canonical thing identity\n- `wh thing create <name|Shape/name> (--data|--file) [--shape]` — Create\n- `wh thing revise <name> [--data] [--message] [--committer] [--expected-version]` — Revise (CONFLICT if HEAD≠n)\n- `wh thing retract <wref> -m <message> [--reason] [--kind] [--expected-version]` — Retract\n- `wh thing query [--shape] [--kind] [--about] [--match]` — Query by filters\n- `wh thing search <query> [--shape] [--kind] [--about] [--mode]` — Search text\n- `wh thing rename <Shape/oldName> <newName>` — Rename\n- `wh thing refs <wref> [--inbound] [--outbound] [--field]` — Show field references; use `wh thing about` for assertions about the target thing\n- `wh thing about <wref> [--shape] [--match] [--depth] [--resolve-collections] [--role from|to|ends] [--limit] [--include-retracted]` — Show assertions about the target identity; `--resolve-collections` expands bare/@HEAD/@ALL members, `--role` filters direction; not pinned @vN\n\n### commit — Write operations\n- `wh commit submit [--ops|--file|--add|--revise|--retract] [--kind] [--data] [--reason] [--expected-version] [--chunk-size] [--skip-existing] [--progress] [--stream-id]` — Submit operations (bare `wh commit` is equivalent). Use `--file ops.jsonl --stream-id <id> --chunk-size 5000 --skip-existing` for bulk ingest.\n- `wh shape template <shape> [shape2 ...] [--kind] [--operation add|revise|retract] [-o file]` — Generate sample ops\n\n### assertion — Assertion operations\n- `wh assertion list [--about wref] [--shape] [--match] [--include-retracted]` — Browse assertions\n- `wh assertion view <wref> [--version] [--include-retracted]` — Assertion details\n- `wh assertion create --shape <s> --name <n> --about <wref> [--data] [-m] [--committer]` — Create assertion\n- `wh assertion revise <wref> --data <json> [--message] [--committer]` — Revise assertion\n- `wh assertion retract <wref> -m <message> [--reason] [--committer] [--expected-version]` — Retract assertion\n- `wh assertion history <wref> [--include-retracted]` — Assertion history\n\n### shape — Shape management\n- `wh shape list [--match] [--include-retracted]` — List all shapes\n- `wh shape view <name> [--include-retracted]` — Shape details\n- `wh shape revise <name> (--fields|--file)`\n- `wh shape create <name> (--fields|--file)`\n- `wh shape retract <name> -m <message> [--reason] [--expected-version]` — Retract shape\n- `wh shape history <name> [--include-retracted]` — Shape history\n- `wh shape rename <oldName> <newName>` — Rename shape\n\n### repo — Repository management\n- `wh repo create <org/name> [--display-name] [--description] [--visibility]` — Create repo\n- `wh repo list [org]` — List repos\n- `wh repo view [org/repo]` — Repo details\n\n### org — Organization management\n- `wh org create <name> [--display-name]` — Create a new organization\n- `wh org view <name>` — View organization details (alias: info)\n- `wh org list` — List all organizations\n\n### sub — Subscription management\n- `wh sub create <name> [flags]` — Create a subscription\n- `wh sub view <name>` — View subscription details\n- `wh sub list` — List all subscriptions\n- `wh sub log <name>` — Tail subscription delivery feed\n- `wh sub attempts <runId>` — Show attempt history for a run\n- `wh sub pause <name>` — Pause a subscription\n- `wh sub resume <name>` — Resume a paused subscription\n- `wh sub bind <name> [--credentials]` — Bind a credential set to a subscription for webhook auth\n- `wh sub unbind <name>` — Remove credential binding from a subscription\n- `wh sub delete <name>` — Retire; name reserved\n\n### notifications — Action notification listing\n- `wh notifications [--limit] [--since]` — List repo-scoped action notifications\n\n### credential — Credential set management\n- `wh credential create <name> [--repo org/repo | --org org] [--scope] [--description]` — Create an empty credential set\n- `wh credential list [--repo org/repo | --org org]` — List credential sets accessible from a repo or org\n- `wh credential view <name> [--repo org/repo | --org org]` — View a credential set (key names only, no values)\n- `wh credential delete <name> [--repo org/repo | --org org]` — Delete a credential set and its Vault object\n- `wh credential set <setName> [<keyName>] [--repo org/repo | --org org] [--value]` — Set credential key(s). With `<keyName>`: single-key form (reads value from `--value` or stdin). Without `<keyName>`: batch form (reads JSON object from stdin, e.g. `{\"KEY\":\"val\"}`)\n- `wh credential unset <setName> <keyName> [--repo org/repo | --org org]` — Remove a key from a credential set\n- `wh credential audit <setName> [--repo org/repo | --org org]` — View audit log for a credential set\n- `wh credential revoke <setName> [--repo org/repo | --org org] [--reason]` — Revoke a credential set (blocks new binds and stops bound webhook deliveries)\n\n### component — Component management\n- `wh component validate <path>` — Validate package\n- `wh component install <org/name>` — Install a registered component\n- `wh component register <name> --org <org> --manifest <path> [flags]` — Register component identity\n- `wh component unregister <org/name>` — Remove a registered component identity\n- `wh component registry list --org <org>` — List registered components\n- `wh component registry view <org/name>` — View a registered component\n- `wh component registry update <org/name> [flags]` — Update a registered component\n- `wh component list` — List installed components\n- `wh component update <org/name>` — Update installed component\n- `wh component view <org/name>` — Show component details (alias: show)\n- `wh component doctor <org/name>` — Run component health checks\n- `wh component teardown <org/name>` — Pause component subscriptions\n\n### Getting More Info\n- `wh help` — help overview\n- `wh <domain>` — domain verbs\n- `wh <domain> <verb> --help` — verb flags and examples\n- `wh help --format json` — `CliSpecV2` (`schemaVersion: 2`): global/contextual/root tables and command overrides\n\n## Common Workflows\n\n**Explore a repo:**\n```bash\nwh thing list --repo org/repo             # see all things in HEAD\nwh thing view Shape/name --repo org/repo  # inspect a specific thing\nwh thing history Shape/name --repo org/repo # inspect version history\nwh thing about Shape/name                 # assertions about thing/shape\n```\n\n**Create an assertion** (most common write):\n```bash\n# --about takes an untyped target wref: Shape or Shape/name.\nwh assertion create --shape MyShape --about TargetShape/target-name \\\n  --name my-assertion --data '{\"field_a\":1,\"field_b\":\"value\"}' --repo org/repo\n# Output includes per-operation status; relay failures when present.\n```\n\n**Create via write entrypoint** (alternative, supports batches and streams):\n```bash\nwh commit submit --add my-item --shape MyShape --kind assertion \\\n  --about TargetShape/target-name --data '{\"field_a\":1}' --repo org/repo\n```\n\n**Batch write via file** (generate template → edit → submit):\n```bash\nwh shape template Hypothesis Evidence -o ops.json    # add --kind assertion --about TargetShape/name for assertions\n# edit ops.json — fill FILL_IN placeholders\nwh commit submit --file ops.json -m \"batch update\"   # submit all operations (bare `wh commit` is equivalent)\n# --file format: docs.warmhub.ai/cli-reference/commit-operations\n```\n\n**Bulk write (JSONL stream, >1k ops)** — one chunked stream beats per-record commits (~60× faster):\n```bash\nwh shape template MyShape -o ops.jsonl                          # one op per line (.jsonl)\nID=\"bulk-$(date +%s)\"   # caller id for chunk correlation\nwh commit submit --file ops.jsonl --stream-id \"$ID\" --chunk-size 5000 \\\n  --skip-existing --progress -m \"bulk ingest\" --repo org/repo\n# --chunk-size: ops per append chunk (default 1000, max 10000); chunk≈1 is ~60× slower\n# --skip-existing: skips already-written add ops (drops per-row read-before-write)\n# --stream-id identifies the submission but provides no receipt or resume.\n# After an outcome-unknown append, stop writes and reconcile attempted + unsent\n# work from a later verified checkpoint; never blindly replay revise/retract.\n```\n\n**Create collections:**\n```bash\nwh commit submit --type arc --name route --members Location/a,Location/b --repo org/repo\nwh assertion create --shape Supports --name route-support --about Arc/route --data '{\"confidence\":0.8}' --repo org/repo\n```\n\n**Modify data:**\n```bash\nwh thing revise Shape/name --data '{\"x\":5,\"y\":3}' -m \"update\" --repo org/repo\nwh thing retract Shape/old-item -m \"withdrawn\" --reason \"data feed contaminated\" --repo org/repo\n```\n\n**Query and filter:**\n```bash\nwh thing query --shape MyShape                       # by shape\nwh thing query --kind assertion --about Shape/name   # by kind + target\nwh thing history Shape/name --limit 10               # version history\n```\n\n## Built-in Content shape\n\nWarmHub repos expose three well-known content wrefs:\n- `Content/Readme`  — stored markdown for humans\n- `Content/Agents`  — stored markdown guidance for AI agents\n- `Content/LlmsTxt` — synthesized per-request sitemap (read-only)\n\nFetch via `wh repo content get --kind readme|agents|llms-txt`,\n`client.repo.getReadme/getAgents/getLlmsTxt`, MCP `warmhub_repo_content_get`,\nor raw HTTP `GET /{org}/{repo}/readme.md|agents.md|llms.txt`.\nSee `wh repo describe` → `additionalInformation` for the discovery field.\n\n## Query Discipline\n- Plan the repo, shapes, and wrefs you need before the first query.\n- Gather the needed facts from one repo before switching to another.\n- Do the queries first, then write one complete answer.\n\n## Agent Tips\n- **Always run commands for live data** — this context describes the CLI, not repo contents\n- **Before writing, discover wrefs** — run `wh thing list` or `wh shape list`\n- **Shape field types**: `string`, `number`, `boolean`, `wref`, arrays, optionals, nested objects\n- **Write commands return per-operation results** — relay failures and affected wrefs to the user\n- **Pass data inline** with `--data '{...}'` — do NOT create temp files\n- Add `--json` to any command for machine-readable JSON output\n- **Aliases teach canonical commands** — executing aliases emit a status hint; misleading lifecycle aliases reject and point to `retract`\n- Writes go through `wh commit submit` (or bare `wh commit`) or wrappers (`create`, `revise`, `retract`, `assertion create`). `retract` irreversibly withdraws an identity and creates a history entry.\n- Use `wh doctor` to check environment health\n";
+var prime_content_default = "# WarmHub CLI Context\n> **Context Recovery**: Run `wh prime` after compaction or new session\n\n## Environment\n{{REPO_LINE}}\n\n## Core Concepts\n- **Thing**: A named entity versioned by writes. **Assertion**: A thing that makes a shape-validated claim about another thing.\n- **Shape**: A thing defining data structure; every other thing has one. **Write**: One or more add/revise/retract operations with per-operation results.\n- **wref**: A reference to a thing. Local: `Player` (the shape) or `Player/alice` (a thing with that shape). Cross-repo: `wh:org/repo/Shape` or `wh:org/repo/Shape/name`.\n\n## Versioned Wrefs\n- `Shape` addresses the shape itself; `Shape/name` addresses a thing with that shape. `@vN` pins either.\n- Floating write refs to retracted targets fail; existing pinned versions remain valid.\n- Rename invalidates old spellings, including `@vN`; the new name resolves history.\n- Untyped wrefs accept any thing. `wref<T>` requires the target's shape to be `T`; a shape has no shape, so never satisfies it. `wref?` coalesces only `thing_absent`, never a missing shape.\n\n## Key Workflows\n\n**Write data** (discover shapes → scaffold ops → submit):\n```bash\nwh shape list --repo org/repo                             # list available shapes\nwh shape view ShapeName --repo org/repo                   # inspect fields\nwh shape template ShapeName -o ops.json --repo org/repo   # scaffold write ops (supports --kind assertion)\n# edit ops.json — fill FILL_IN placeholders — then:\nwh commit submit --file ops.json -m \"msg\" --repo org/repo  # submit operations (bare `wh commit` also works)\n# or single assertion (no file needed):\nwh assertion create --shape ShapeName --about Target/name --name my-assertion --data '{\"field\":1}' --repo org/repo\n# Relay failed operation details when present. Never hand-guess ops JSON — use `wh shape template <Shape>`.\n```\n\n**Read data:**\n```bash\nwh thing list --repo org/repo                 # all things at HEAD\nwh thing view Shape/name --repo org/repo      # inspect a thing\nwh thing query --shape MyShape --repo org/repo  # find things by shape\nwh thing about Shape --repo org/repo          # assertions about a shape\nwh assertion list --repo org/repo             # all assertions at HEAD\nwh thing history Shape/name --repo org/repo   # version history\n\n# Batch read — wh thing view is variadic (max 500 wrefs/call):\nwh thing view Player/alice Player/bob               # variadic positionals\nwh thing view --file wrefs.txt --json               # one wref per line\ncat wrefs.txt | wh thing view --format jsonl        # one JSON line per *deduped* requested wref\n```\n\n## Wref Quick Reference\n\nWrites use explicit names and wrefs. Untyped fields, collection members,\nassertion `about`, and committers accept any thing. Create a deterministic\ntarget before referencing it in the same commit.\n\n## Command Reference\n\n**Global flags**: `--repo`, `--format`, `--json`, `--live`\n### thing — Things\n- `wh thing list [--shape] [--kind] [--match] [--include-retracted]` — Current HEAD state\n- `wh thing view [<wref>...] [--file <path>] [--version] [--depth] [--include-retracted] [--data-mode auto|full]` — Thing details. Variadic (max 500). `--version` implies `--include-retracted`. Batch JSON returns `{ requested, items, missing }`; jsonl emits one row per deduped requested wref. Large Set/List bodies summarize by default; use `--data-mode full` for canonical collection JSON.\n- `wh thing history [wref] [--shape] [--about] [--include-retracted]` — Version history\n- `wh thing resolve <wref>` — Resolve a wref to its canonical thing identity\n- `wh thing create <name|Shape/name> (--data|--file) [--shape]` — Create\n- `wh thing revise <name> [--data] [--message] [--committer] [--expected-version]` — Revise (CONFLICT if HEAD≠n)\n- `wh thing retract <wref> -m <message> [--reason] [--kind] [--expected-version]` — Retract\n- `wh thing query [--shape] [--kind] [--about] [--match]` — Query by filters\n- `wh thing search <query> [--shape] [--kind] [--about] [--mode]` — Search text\n- `wh thing rename <Shape/oldName> <newName>` — Rename\n- `wh thing refs <wref> [--inbound] [--outbound] [--field]` — Show field references; use `wh thing about` for assertions about the target thing\n- `wh thing about <wref> [--shape] [--match] [--depth] [--resolve-collections] [--role from|to|ends] [--limit] [--include-retracted]` — Show assertions about the target identity; `--resolve-collections` expands bare/@HEAD/@ALL members, `--role` filters direction; not pinned @vN\n\n- `wh view evaluate VIEW [--limit N] [--cursor TOK] [--all]`\n### commit — Write operations\n- `wh commit submit [--ops|--file|--add|--revise|--retract] [--kind] [--data] [--reason] [--expected-version] [--chunk-size] [--skip-existing] [--progress] [--stream-id]` — Submit operations (bare `wh commit` is equivalent). Use `--file ops.jsonl --stream-id <id> --chunk-size 5000 --skip-existing` for bulk ingest.\n- `wh shape template <shape> [shape2 ...] [--kind] [--operation add|revise|retract] [-o file]` — Generate sample ops\n\n### assertion — Assertion operations\n- `wh assertion list [--about wref] [--shape] [--match] [--include-retracted]` — Browse assertions\n- `wh assertion view <wref> [--version] [--include-retracted]` — Assertion details\n- `wh assertion create --shape <s> --name <n> --about <wref> [--data] [-m] [--committer]` — Create assertion\n- `wh assertion revise <wref> --data <json> [--message] [--committer]` — Revise assertion\n- `wh assertion retract <wref> -m <message> [--reason] [--committer] [--expected-version]` — Retract assertion\n- `wh assertion history <wref> [--include-retracted]` — Assertion history\n\n### shape — Shape management\n- `wh shape list [--match] [--include-retracted]` — List all shapes\n- `wh shape view <name> [--include-retracted]` — Shape details\n- `wh shape revise <name> (--fields|--file)`\n- `wh shape create <name> (--fields|--file)`\n- `wh shape retract <name> -m <message> [--reason] [--expected-version]` — Retract shape\n- `wh shape history <name> [--include-retracted]` — Shape history\n- `wh shape rename <oldName> <newName>` — Rename shape\n\n### repo — Repository management\n- `wh repo create <org/name> [--display-name] [--description] [--visibility]` — Create repo\n- `wh repo list [org]` — List repos\n- `wh repo view [org/repo]` — Repo details\n\n### org — Organization management\n- `wh org create <name> [--display-name]` — Create a new organization\n- `wh org view <name>` — View organization details (alias: info)\n- `wh org list` — List all organizations\n\n### sub — Subscription management\n- `wh sub create <name> [flags]` — Create a subscription\n- `wh sub view <name>` — View subscription details\n- `wh sub list` — List all subscriptions\n- `wh sub log <name>` — Tail subscription delivery feed\n- `wh sub attempts <runId>` — Show attempt history for a run\n- `wh sub pause <name>` — Pause a subscription\n- `wh sub resume <name>` — Resume a paused subscription\n- `wh sub bind <name> [--credentials]` — Bind a credential set to a subscription for webhook auth\n- `wh sub unbind <name>` — Remove credential binding from a subscription\n- `wh sub delete <name>` — Retire; name reserved\n\n### notifications — Action notification listing\n- `wh notifications [--limit] [--since]` — List repo-scoped action notifications\n\n### credential — Credential set management\n- `wh credential create <name> [--repo org/repo | --org org] [--scope] [--description]` — Create an empty credential set\n- `wh credential list [--repo org/repo | --org org]` — List credential sets accessible from a repo or org\n- `wh credential view <name> [--repo org/repo | --org org]` — View a credential set (key names only, no values)\n- `wh credential delete <name> [--repo org/repo | --org org]` — Delete a credential set and its Vault object\n- `wh credential set <setName> [<keyName>] [--repo org/repo | --org org] [--value]` — Set credential key(s). With `<keyName>`: single-key form (reads value from `--value` or stdin). Without `<keyName>`: batch form (reads JSON object from stdin, e.g. `{\"KEY\":\"val\"}`)\n- `wh credential unset <setName> <keyName> [--repo org/repo | --org org]` — Remove a key from a credential set\n- `wh credential audit <setName> [--repo org/repo | --org org]` — View audit log for a credential set\n- `wh credential revoke <setName> [--repo org/repo | --org org] [--reason]` — Revoke a credential set (blocks new binds and stops bound webhook deliveries)\n\n### component — Component management\n- `wh component validate <path>` — Validate package\n- `wh component install <org/name>` — Install a registered component\n- `wh component register <name> --org <org> --manifest <path> [flags]` — Register component identity\n- `wh component unregister <org/name>` — Remove a registered component identity\n- `wh component registry list --org <org>` — List registered components\n- `wh component registry view <org/name>` — View a registered component\n- `wh component registry update <org/name> [flags]` — Update a registered component\n- `wh component list` — List installed components\n- `wh component update <org/name>` — Update installed component\n- `wh component view <org/name>` — Show component details (alias: show)\n- `wh component doctor <org/name>` — Run component health checks\n- `wh component teardown <org/name>` — Pause component subscriptions\n\n### Getting More Info\n- `wh help` — help overview\n- `wh <domain>` — domain verbs\n- `wh <domain> <verb> --help` — verb flags and examples\n- `wh help --format json` — `CliSpecV2` (`schemaVersion: 2`): global/contextual/root tables and command overrides\n\n## Common Workflows\n\n**Explore a repo:**\n```bash\nwh thing list --repo org/repo             # see all things in HEAD\nwh thing view Shape/name --repo org/repo  # inspect a specific thing\nwh thing history Shape/name --repo org/repo # inspect version history\nwh thing about Shape/name                 # assertions about thing/shape\n```\n\n**Create an assertion** (most common write):\n```bash\n# --about takes an untyped target wref: Shape or Shape/name.\nwh assertion create --shape MyShape --about TargetShape/target-name \\\n  --name my-assertion --data '{\"field_a\":1,\"field_b\":\"value\"}' --repo org/repo\n# Output includes per-operation status; relay failures when present.\n```\n\n**Create via write entrypoint** (alternative, supports batches and streams):\n```bash\nwh commit submit --add my-item --shape MyShape --kind assertion \\\n  --about TargetShape/target-name --data '{\"field_a\":1}' --repo org/repo\n```\n\n**Batch write via file** (generate template → edit → submit):\n```bash\nwh shape template Hypothesis Evidence -o ops.json    # add --kind assertion --about TargetShape/name for assertions\n# edit ops.json — fill FILL_IN placeholders\nwh commit submit --file ops.json -m \"batch update\"   # submit all operations (bare `wh commit` is equivalent)\n# --file format: docs.warmhub.ai/cli-reference/commit-operations\n```\n\n**Bulk write (JSONL stream, >1k ops)** — one chunked stream beats per-record commits (~60× faster):\n```bash\nwh shape template MyShape -o ops.jsonl                          # one op per line (.jsonl)\nID=\"bulk-$(date +%s)\"   # caller id for chunk correlation\nwh commit submit --file ops.jsonl --stream-id \"$ID\" --chunk-size 5000 \\\n  --skip-existing --progress -m \"bulk ingest\" --repo org/repo\n# --chunk-size: ops per append chunk (default 1000, max 10000); chunk≈1 is ~60× slower\n# --skip-existing: skips already-written add ops (drops per-row read-before-write)\n# --stream-id identifies the submission but provides no receipt or resume.\n# After an outcome-unknown append, stop writes and reconcile attempted + unsent\n# work from a later verified checkpoint; never blindly replay revise/retract.\n```\n\n**Create collections:**\n```bash\nwh commit submit --type arc --name route --members Location/a,Location/b --repo org/repo\nwh assertion create --shape Supports --name route-support --about Arc/route --data '{\"confidence\":0.8}' --repo org/repo\n```\n\n**Modify data:**\n```bash\nwh thing revise Shape/name --data '{\"x\":5,\"y\":3}' -m \"update\" --repo org/repo\nwh thing retract Shape/old-item -m \"withdrawn\" --reason \"data feed contaminated\" --repo org/repo\n```\n\n**Query and filter:**\n```bash\nwh thing query --shape MyShape                       # by shape\nwh thing query --kind assertion --about Shape/name   # by kind + target\nwh thing history Shape/name --limit 10               # version history\n```\n\n## Built-in Content shape\n\nWarmHub repos expose three well-known content wrefs:\n- `Content/Readme`  — stored markdown for humans\n- `Content/Agents`  — stored markdown guidance for AI agents\n- `Content/LlmsTxt` — synthesized per-request sitemap (read-only)\n\nFetch via `wh repo content get --kind readme|agents|llms-txt`,\n`client.repo.getReadme/getAgents/getLlmsTxt`, MCP `warmhub_repo_content_get`,\nor raw HTTP `GET /{org}/{repo}/readme.md|agents.md|llms.txt`.\nSee `wh repo describe` → `additionalInformation` for the discovery field.\n\n## Query Discipline\n- Plan the repo, shapes, and wrefs you need before the first query.\n- Gather the needed facts from one repo before switching to another.\n- Do the queries first, then write one complete answer.\n\n## Agent Tips\n- **Always run commands for live data** — this context describes the CLI, not repo contents\n- **Before writing, discover wrefs** — run `wh thing list` or `wh shape list`\n- **Shape field types**: `string`, `number`, `boolean`, `wref`, arrays, optionals, nested objects\n- **Write commands return per-operation results** — relay failures and affected wrefs to the user\n- **Pass data inline** with `--data '{...}'` — do NOT create temp files\n- Add `--json` to any command for machine-readable JSON output\n- **Aliases teach canonical commands** — executing aliases emit a status hint; misleading lifecycle aliases reject and point to `retract`\n- Writes go through `wh commit submit` (or bare `wh commit`) or wrappers (`create`, `revise`, `retract`, `assertion create`). `retract` irreversibly withdraws an identity and creates a history entry.\n- Use `wh doctor` to check environment health\n";
 
 // ../../packages/warmhub-cli/src/domains/prime.ts
 function buildMarkdown(config2) {
@@ -60702,10 +61048,10 @@ var checkpointFlags = {
   latest: flag.boolean({
     description: "Use the latest completed checkpoint"
   }),
-  archive: flag.boolean({ description: "Download the checkpoint archive" }),
-  manifest: flag.boolean({ description: "Download the checkpoint manifest" }),
+  archive: flag.boolean({ description: "Select the checkpoint archive" }),
+  manifest: flag.boolean({ description: "Select the checkpoint manifest" }),
   chunk: flag.string({
-    description: "Download this checkpoint chunk path",
+    description: "Select this checkpoint chunk path",
     constraints: { nonEmpty: true }
   }),
   output: flag.string({
@@ -60714,6 +61060,8 @@ var checkpointFlags = {
   })
 };
 var CHECKPOINT_ID_EXAMPLE = "0198f6d5-78aa-7000-8000-000000000001";
+var CHECKPOINT_ACCESS_EXAMPLE = "wh repo checkpoint access acme/widgets --latest --archive";
+var CHECKPOINT_DOWNLOAD_EXAMPLE = "wh repo checkpoint download acme/widgets --latest --archive --output checkpoint.zip";
 var CHECKPOINT_READ_NOTE = "Requires unrestricted repo:read plus repo:checkpoint-read.";
 var CHECKPOINT_MANAGEMENT_NOTE = "Requires unrestricted repo:read, repo:checkpoint-read, and repo:admin.";
 var generateFlags = {
@@ -60728,13 +61076,16 @@ var retryFlags = {
   checkpoint: checkpointFlags.checkpoint,
   wait: checkpointFlags.wait
 };
-var downloadFlags = {
+var accessFlags = {
   latest: checkpointFlags.latest,
   checkpoint: checkpointFlags.checkpoint,
   "repo-seq": checkpointFlags["repo-seq"],
   archive: checkpointFlags.archive,
   manifest: checkpointFlags.manifest,
-  chunk: checkpointFlags.chunk,
+  chunk: checkpointFlags.chunk
+};
+var downloadFlags = {
+  ...accessFlags,
   output: checkpointFlags.output
 };
 function repoFor(ctx, args) {
@@ -60760,19 +61111,30 @@ function selectCheckpoint(flags) {
     return { repoSeq };
   throw new Error("Checkpoint selector was validated without a selector");
 }
-function selectDownloadCheckpoint(flags) {
+function selectArtifactCheckpoint(flags, example) {
   const selected = Number(flags.latest === true) + Number(flags.checkpoint !== undefined) + Number(flags["repo-seq"] !== undefined);
   if (selected !== 1) {
-    usageError("Provide exactly one checkpoint selector: --latest, --checkpoint, or --repo-seq.", "wh repo checkpoint download acme/widgets --latest --archive --output checkpoint.zip");
+    usageError("Provide exactly one checkpoint selector: --latest, --checkpoint, or --repo-seq.", example);
   }
   if (flags.latest)
     return "latest";
   return selectCheckpoint(flags);
 }
-function selectArtifact(flags) {
+function printAccess(ctx, result) {
+  writeOutput(ctx, result, () => {
+    ctx.out(`Checkpoint: ${result.checkpointId}`);
+    ctx.out(`Repository sequence: ${result.repoSeq}`);
+    ctx.out(`Content type: ${result.contentType}`);
+    ctx.out(`Bytes: ${result.byteLength}`);
+    ctx.out(`SHA-256: ${result.sha256}`);
+    ctx.out(`Expires at: ${result.expiresAt.toISOString()}`);
+    ctx.out(`URL: ${result.url}`);
+  });
+}
+function selectArtifact(flags, example) {
   const selected = Number(flags.archive === true) + Number(flags.manifest === true) + Number(flags.chunk !== undefined);
   if (selected !== 1) {
-    usageError("Provide exactly one artifact selector: --archive, --manifest, or --chunk PATH.", "wh repo checkpoint download acme/widgets --latest --archive --output checkpoint.zip");
+    usageError("Provide exactly one artifact selector: --archive, --manifest, or --chunk PATH.", example);
   }
   if (flags.archive)
     return "archive";
@@ -60803,13 +61165,13 @@ function printCheckpoint(ctx, result) {
       ctx.out(`Failure: ${result.failureCode}`);
   });
 }
-async function waitForCompletion(ctx, org, repo, initial) {
+async function waitForCompletion(ctx, org, repo2, initial) {
   let result = initial;
   let delayMs = 200;
   while (result.state === "queued" || result.state === "running") {
     ctx.status(`Checkpoint ${result.checkpointId} is ${result.state}; waiting…`);
     await delay2(delayMs, ctx.signal);
-    result = await checkpointClient(ctx).status(org, repo, {
+    result = await checkpointClient(ctx).status(org, repo2, {
       checkpointId: result.checkpointId
     });
     delayMs = Math.min(delayMs * 2, 5000);
@@ -60834,39 +61196,39 @@ function delay2(ms, signal) {
   });
 }
 var handleGenerate = async (ctx, { args, flags }) => {
-  const { org, repo } = repoFor(ctx, args);
-  const result = await checkpointClient(ctx).generate(org, repo, {
+  const { org, repo: repo2 } = repoFor(ctx, args);
+  const result = await checkpointClient(ctx).generate(org, repo2, {
     atLeastRepoSeq: requireSequence(flags["at-least-repo-seq"], "--at-least-repo-seq")
   });
-  printCheckpoint(ctx, flags.wait ? await waitForCompletion(ctx, org, repo, result) : result);
+  printCheckpoint(ctx, flags.wait ? await waitForCompletion(ctx, org, repo2, result) : result);
 };
 var handleStatus2 = async (ctx, { args, flags }) => {
-  const { org, repo } = repoFor(ctx, args);
-  printCheckpoint(ctx, await checkpointClient(ctx).status(org, repo, selectCheckpoint(flags)));
+  const { org, repo: repo2 } = repoFor(ctx, args);
+  printCheckpoint(ctx, await checkpointClient(ctx).status(org, repo2, selectCheckpoint(flags)));
 };
 var handleLatest = async (ctx, { args }) => {
-  const { org, repo } = repoFor(ctx, args);
-  printCheckpoint(ctx, await checkpointClient(ctx).latest(org, repo));
+  const { org, repo: repo2 } = repoFor(ctx, args);
+  printCheckpoint(ctx, await checkpointClient(ctx).latest(org, repo2));
 };
 var handleRetry = async (ctx, { args, flags }) => {
   if (!flags.checkpoint) {
     usageError("--checkpoint is required for retry.", `wh repo checkpoint retry acme/widgets --checkpoint ${CHECKPOINT_ID_EXAMPLE}`);
   }
-  const { org, repo } = repoFor(ctx, args);
-  const result = await checkpointClient(ctx).retry(org, repo, flags.checkpoint);
-  printCheckpoint(ctx, flags.wait ? await waitForCompletion(ctx, org, repo, result) : result);
+  const { org, repo: repo2 } = repoFor(ctx, args);
+  const result = await checkpointClient(ctx).retry(org, repo2, flags.checkpoint);
+  printCheckpoint(ctx, flags.wait ? await waitForCompletion(ctx, org, repo2, result) : result);
 };
 var handleDownload = async (ctx, { args, flags }) => {
   if (!flags.output) {
-    usageError("--output PATH|- is required for download.", "wh repo checkpoint download acme/widgets --latest --archive --output checkpoint.zip");
+    usageError("--output PATH|- is required for download.", CHECKPOINT_DOWNLOAD_EXAMPLE);
   }
   if (flags.output === "-" && ctx.format !== "pretty") {
     throw new CliError(2 /* UserInput */, "USER_INPUT", "Binary stdout requires --format pretty; JSON and JSONL cannot carry artifact bytes.");
   }
-  const { org, repo } = repoFor(ctx, args);
-  const access = await checkpointClient(ctx).getAccess(org, repo, {
-    checkpoint: selectDownloadCheckpoint(flags),
-    artifact: selectArtifact(flags)
+  const { org, repo: repo2 } = repoFor(ctx, args);
+  const access = await checkpointClient(ctx).getAccess(org, repo2, {
+    checkpoint: selectArtifactCheckpoint(flags, CHECKPOINT_DOWNLOAD_EXAMPLE),
+    artifact: selectArtifact(flags, CHECKPOINT_DOWNLOAD_EXAMPLE)
   });
   if (!ctx.rawFetch) {
     throw new CliError(1 /* Runtime */, "UNKNOWN", "Raw signed-URL transport is unavailable for this command context.");
@@ -60878,6 +61240,13 @@ var handleDownload = async (ctx, { args, flags }) => {
   if (flags.output !== "-")
     ctx.status(`Downloaded checkpoint artifact to ${flags.output}`);
 };
+var handleAccess = async (ctx, { args, flags }) => {
+  const { org, repo: repo2 } = repoFor(ctx, args);
+  printAccess(ctx, await checkpointClient(ctx).getAccess(org, repo2, {
+    checkpoint: selectArtifactCheckpoint(flags, CHECKPOINT_ACCESS_EXAMPLE),
+    artifact: selectArtifact(flags, CHECKPOINT_ACCESS_EXAMPLE)
+  }));
+};
 var handleVerify = async (ctx, { args }) => {
   const archive = args[0];
   if (!archive) {
@@ -60905,7 +61274,7 @@ var handleVerify = async (ctx, { args }) => {
 };
 var CHECKPOINT_SUBDOMAIN = defineDomain({
   name: "checkpoint",
-  summary: "Generate, download, and verify portable repository checkpoints",
+  summary: "Generate, access, download, and verify repository checkpoints",
   verbs: {
     generate: {
       summary: "Generate a repository checkpoint",
@@ -60945,6 +61314,18 @@ var CHECKPOINT_SUBDOMAIN = defineDomain({
       ],
       handler: handleRetry
     },
+    access: {
+      summary: "Show a short-lived checkpoint artifact URL",
+      args: "[org/repo]",
+      flags: accessFlags,
+      notes: [
+        CHECKPOINT_READ_NOTE,
+        "The URL is a short-lived bearer credential. Handle command output as a secret.",
+        "Requires exactly one checkpoint selector and one artifact selector."
+      ],
+      examples: [CHECKPOINT_ACCESS_EXAMPLE],
+      handler: handleAccess
+    },
     download: {
       summary: "Download one checkpoint artifact",
       args: "[org/repo]",
@@ -60953,9 +61334,7 @@ var CHECKPOINT_SUBDOMAIN = defineDomain({
         CHECKPOINT_READ_NOTE,
         "Requires exactly one checkpoint selector, one artifact selector, and --output PATH|-."
       ],
-      examples: [
-        "wh repo checkpoint download acme/widgets --latest --archive --output checkpoint.zip"
-      ],
+      examples: [CHECKPOINT_DOWNLOAD_EXAMPLE],
       handler: handleDownload
     },
     verify: {
@@ -61071,24 +61450,22 @@ function parseExplicitOrgRepoArg(ref, usage, example) {
   if (!ref?.includes("/")) {
     usageError(usage, example);
   }
-  const parts = ref.split("/");
-  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+  const parsed = parseRepoSlug(ref);
+  if (!parsed) {
     usageError(`Invalid repo format "${ref}". Expected "org/repo" with no extra slashes or empty segments.`, example);
   }
-  const [orgName, repoName] = parts;
-  return { orgName, repoName };
+  return { orgName: parsed.org, repoName: parsed.repo };
 }
 function resolveOrgRepoArg(ref, orgFlag) {
   if (ref?.includes("/")) {
-    const parts = ref.split("/");
-    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    const parsed = parseRepoSlug(ref);
+    if (!parsed) {
       usageError(`Invalid repo format '${ref}'. Expected '<org>/<name>' with no extra slashes and no empty parts.`, "wh repo create myorg/myrepo");
     }
-    const [orgName, repoName] = parts;
-    if (orgFlag && orgFlag !== orgName) {
-      usageError(`Conflicting org: positional '${orgName}' vs --org '${orgFlag}'`, "wh repo create myorg/myrepo");
+    if (orgFlag && orgFlag !== parsed.org) {
+      usageError(`Conflicting org: positional '${parsed.org}' vs --org '${orgFlag}'`, "wh repo create myorg/myrepo");
     }
-    return { orgName, repoName };
+    return { orgName: parsed.org, repoName: parsed.repo };
   }
   if (ref && orgFlag) {
     return {
@@ -61104,10 +61481,11 @@ function nameStrings(items) {
 }
 
 // ../../packages/warmhub-cli/src/domains/repo/content.ts
-var READ_ONLY_KINDS = new Set(["llms-txt"]);
 var CONTENT_KINDS = ["readme", "agents", "llms-txt"];
+var CONTENT_KIND_LIST = CONTENT_KINDS.join(", ");
+var READ_ONLY_KINDS = new Set(["llms-txt"]);
 var kindFlagDef = flag.string({
-  description: "Which content kind to operate on (readme, agents, llms-txt)"
+  description: `Which content kind to operate on (${CONTENT_KIND_LIST})`
 });
 var contentGetFlags = {
   kind: kindFlagDef
@@ -61127,19 +61505,20 @@ var promptFlags = {
 };
 function requireKind(kind) {
   if (!kind) {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", "--kind is required. Choose one of: readme, agents, llms-txt", undefined, "Example: wh repo content get myorg/myrepo --kind readme");
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `--kind is required. Choose one of: ${CONTENT_KIND_LIST}`, undefined, "Example: wh repo content get myorg/myrepo --kind readme");
   }
-  if (!CONTENT_KINDS.includes(kind)) {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --kind '${kind}'. Choose one of: readme, agents, llms-txt`);
+  const parsed = CONTENT_KINDS.find((candidate) => candidate === kind);
+  if (!parsed) {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --kind '${kind}'. Choose one of: ${CONTENT_KIND_LIST}`);
   }
-  return kind;
+  return parsed;
 }
 var handleContentGet = async (ctx, { args, flags }) => {
   const kind = requireKind(flags.kind);
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
   switch (kind) {
     case "readme": {
-      const result = await ctx.client.repo.getReadme(org, repo);
+      const result = await ctx.client.repo.getReadme(org, repo2);
       const content = result?.data?.content;
       const text = typeof content === "string" ? content : "";
       writeOutput(ctx, result, () => {
@@ -61148,7 +61527,7 @@ var handleContentGet = async (ctx, { args, flags }) => {
       break;
     }
     case "agents": {
-      const result = await ctx.client.repo.getAgents(org, repo);
+      const result = await ctx.client.repo.getAgents(org, repo2);
       const content = result?.data?.content;
       const text = typeof content === "string" ? content : "";
       writeOutput(ctx, result, () => {
@@ -61157,7 +61536,7 @@ var handleContentGet = async (ctx, { args, flags }) => {
       break;
     }
     case "llms-txt": {
-      const result = await ctx.client.repo.getLlmsTxt(org, repo);
+      const result = await ctx.client.repo.getLlmsTxt(org, repo2);
       writeOutput(ctx, result, () => {
         ctx.out(result.data.content);
       });
@@ -61170,26 +61549,26 @@ var handleContentSet = async (ctx, { args, flags }) => {
   if (READ_ONLY_KINDS.has(kind)) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `--kind ${kind} is read-only; \`set\` is rejected.`, undefined, `Use \`wh repo content get [org/repo] --kind ${kind}\` (or set --repo)`);
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
   const inputContent = await readContentInput(flags.file, flags.content, ctx.stdin);
   const eventRequestId = flags["event-request-id"] ?? createOperationEventRequestId();
   ctx.status(`Operation event request: ${eventRequestId}`);
   switch (kind) {
     case "readme": {
-      const result = await ctx.client.repo.setReadme(org, repo, inputContent, {
+      const result = await ctx.client.repo.setReadme(org, repo2, inputContent, {
         eventRequestId
       });
       writeOutput(ctx, result, () => {
-        ctx.status(`Content/Readme updated in ${org}/${repo}`);
+        ctx.status(`Content/Readme updated in ${org}/${repo2}`);
       });
       break;
     }
     case "agents": {
-      const result = await ctx.client.repo.setAgents(org, repo, inputContent, {
+      const result = await ctx.client.repo.setAgents(org, repo2, inputContent, {
         eventRequestId
       });
       writeOutput(ctx, result, () => {
-        ctx.status(`Content/Agents updated in ${org}/${repo}`);
+        ctx.status(`Content/Agents updated in ${org}/${repo2}`);
       });
       break;
     }
@@ -61203,24 +61582,24 @@ var handleContentPrompt = async (ctx, { args, flags }) => {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `--kind ${kind} is read-only; \`prompt\` is rejected.`, undefined, `Use \`wh repo content get [org/repo] --kind ${kind}\` (or set --repo)`);
   }
   const promptKind = kind;
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
   const [repoInfo, shapesPage, stats, thingsPage] = await Promise.all([
-    ctx.client.repo.get(org, repo),
-    ctx.client.shape.list(org, repo),
-    ctx.client.repo.getStats(org, repo),
-    ctx.client.thing.query(org, repo, { limit: 30 })
+    ctx.client.repo.get(org, repo2),
+    ctx.client.shape.list(org, repo2),
+    ctx.client.repo.getStats(org, repo2),
+    ctx.client.thing.query(org, repo2, { limit: 30 })
   ]);
   const { prompt, saveCommand } = buildContentPrompt({
     kind: promptKind,
     org,
-    repo,
+    repo: repo2,
     description: repoInfo.description ?? null,
     byKind: stats.byKind,
     byShape: stats.byShape,
     shapeNames: nameStrings(shapesPage.items),
     sampleThingNames: nameStrings(thingsPage.items)
   });
-  writeOutput(ctx, { kind: promptKind, org, repo, prompt, saveCommand }, () => {
+  writeOutput(ctx, { kind: promptKind, org, repo: repo2, prompt, saveCommand }, () => {
     ctx.out(prompt);
   });
   ctx.status(`Next: draft the content, then run:
@@ -61276,7 +61655,7 @@ var CONTENT_SUBDOMAIN = defineDomain({
 });
 
 // ../../packages/warmhub-cli/src/domains/repo/create.ts
-var createFlags6 = {
+var createFlags7 = {
   "display-name": flag.string({
     description: "Display name for the repo"
   }),
@@ -61289,7 +61668,7 @@ var createFlags6 = {
     description: "Org name (tolerance fallback; prefer the `<org/name>` positional form)"
   })
 };
-var handleCreate5 = async (ctx, { flags, args }) => {
+var handleCreate6 = async (ctx, { flags, args }) => {
   const ref = args[0];
   const orgFlag = flags.org;
   const resolved = resolveOrgRepoArg(ref, orgFlag);
@@ -61393,7 +61772,7 @@ var repoListFlags = {
 };
 var DEFAULT_REPO_LIST_LIMIT = 50;
 var MAX_REPO_LIST_LIMIT = 200;
-var handleList5 = async (ctx, { flags, args }) => {
+var handleList6 = async (ctx, { flags, args }) => {
   const orgName = args[0] ?? ctx.config.defaultOrg;
   if (!orgName) {
     usageError("Usage: wh repo list <org> (or set WARMHUB_ORG)", "wh repo list myorg");
@@ -61519,15 +61898,15 @@ var describeFlags = {
 };
 var handleDescribe = async (ctx, { args, flags }) => {
   const repoRef = args[0];
-  const { org, repo } = parseOrgRepo(repoRef, ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(repoRef, ctx.config);
   const c = ctx.colors;
   const showIndexedFields = flags["indexed-fields"] === true;
   const [repoInfo, license, shapesPage, stats, indexedFields] = await Promise.all([
-    ctx.client.repo.get(org, repo),
-    ctx.client.repo.getLicense(org, repo),
-    ctx.client.shape.list(org, repo),
-    ctx.client.repo.getStats(org, repo),
-    showIndexedFields ? ctx.client.repo.index.describe(org, repo) : null
+    ctx.client.repo.get(org, repo2),
+    ctx.client.repo.getLicense(org, repo2),
+    ctx.client.shape.list(org, repo2),
+    ctx.client.repo.getStats(org, repo2),
+    showIndexedFields ? ctx.client.repo.index.describe(org, repo2) : null
   ]);
   const shapes = shapesPage.items;
   const byShape = Object.fromEntries([
@@ -61545,7 +61924,7 @@ var handleDescribe = async (ctx, { args, flags }) => {
   } : null;
   const payload = {
     org,
-    repo,
+    repo: repo2,
     description: repoInfo.description ?? null,
     license,
     counts: {
@@ -61567,7 +61946,7 @@ var handleDescribe = async (ctx, { args, flags }) => {
     ...indexedFieldsPublic ? { indexedFields: indexedFieldsPublic } : {}
   };
   writeOutput(ctx, payload, () => {
-    ctx.out(`${c.bold}${org}/${repo}${c.reset}`);
+    ctx.out(`${c.bold}${org}/${repo2}${c.reset}`);
     if (repoInfo.description) {
       ctx.out(`  ${escapeTerminalTextForDisplay(repoInfo.description)}`);
     }
@@ -61695,12 +62074,12 @@ var handleRepoSearch = async (ctx, { flags, args }) => {
 // ../../packages/warmhub-cli/src/domains/repo/view.ts
 var handleView6 = async (ctx, { args }) => {
   const repoRef = args[0];
-  const { org, repo } = parseOrgRepo(repoRef, ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(repoRef, ctx.config);
   const c = ctx.colors;
   const [repoInfo, stats, configureStats] = await Promise.all([
-    ctx.client.repo.get(org, repo),
-    ctx.client.repo.getStats(org, repo),
-    ctx.client.repo.getConfigureStats(org, repo).catch((err) => {
+    ctx.client.repo.get(org, repo2),
+    ctx.client.repo.getStats(org, repo2),
+    ctx.client.repo.getConfigureStats(org, repo2).catch((err) => {
       if (err instanceof WarmHubError && (err.kind === "FORBIDDEN" || err.kind === "UNAUTHENTICATED")) {
         return null;
       }
@@ -61708,7 +62087,7 @@ var handleView6 = async (ctx, { args }) => {
     })
   ]);
   writeOutput(ctx, { ...repoInfo, stats, configureStats }, () => {
-    ctx.out(`${c.bold}${org}/${repo}${c.reset}`);
+    ctx.out(`${c.bold}${org}/${repo2}${c.reset}`);
     if (repoInfo.displayName && repoInfo.displayName !== repoInfo.name) {
       ctx.out(`  ${escapeTerminalTextForDisplay(repoInfo.displayName)}`);
     }
@@ -61730,7 +62109,7 @@ var handleVisibility = async (ctx, { args }) => {
   if (!orgRepo || !newVisibility || !orgRepo.includes("/") || newVisibility !== "public" && newVisibility !== "private") {
     usageError("Usage: wh repo visibility <org/repo> <public|private>", "wh repo visibility myorg/myrepo public");
   }
-  const parsed = splitRepoSlug(orgRepo);
+  const parsed = parseRepoSlug(orgRepo);
   if (!parsed) {
     usageError("Usage: wh repo visibility <org/repo> <public|private>", "wh repo visibility myorg/myrepo public");
   }
@@ -61752,14 +62131,14 @@ var REPO_DOMAIN = defineDomain({
       prime: true,
       summary: "Create a new repo",
       args: "<org/name>",
-      flags: createFlags6,
+      flags: createFlags7,
       examples: [
         "wh repo create myorg/myrepo",
         'wh repo create myorg/myrepo -d "My repo"',
         'wh repo create myorg/myrepo --display-name "My Repo"',
         'wh repo create myorg/myrepo --visibility private -d "Private repo"'
       ],
-      handler: handleCreate5
+      handler: handleCreate6
     },
     list: {
       prime: true,
@@ -61771,7 +62150,7 @@ var REPO_DOMAIN = defineDomain({
         "wh repo list myorg",
         "wh repo list myorg --include-archived"
       ],
-      handler: handleList5
+      handler: handleList6
     },
     search: {
       prime: true,
@@ -61898,7 +62277,7 @@ var handleHistory3 = async (ctx, { flags, args }) => {
   if (!shapeName) {
     usageError("Usage: wh shape history <name>", "wh shape history Location");
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const limit = flags.limit;
   const cursor = flags.cursor;
   const all = flags.all;
@@ -61914,7 +62293,7 @@ var handleHistory3 = async (ctx, { flags, args }) => {
   if (ctx.liveMode) {
     await runLive({
       apiUrl: ctx.config.apiUrl,
-      poll: (c) => c.shape.history(org, repo, bareName, {
+      poll: (c) => c.shape.history(org, repo2, bareName, {
         includeRetracted,
         limit: pageLimit,
         cursor
@@ -61929,6 +62308,7 @@ var handleHistory3 = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
@@ -61938,7 +62318,7 @@ var handleHistory3 = async (ctx, { flags, args }) => {
   let thing;
   let nextCursor;
   do {
-    const page = await ctx.client.shape.history(org, repo, bareName, {
+    const page = await ctx.client.shape.history(org, repo2, bareName, {
       includeRetracted,
       limit: pageLimit,
       cursor: next
@@ -61960,7 +62340,7 @@ var handleHistory3 = async (ctx, { flags, args }) => {
 };
 
 // ../../packages/warmhub-cli/src/domains/shape/list.ts
-var listFlags4 = {
+var listFlags5 = {
   match: flag.string({ description: "Filter by name glob pattern" }),
   component: flag.string({
     description: "Filter to shapes owned by this component (Org/Name ref)"
@@ -61972,15 +62352,15 @@ var listFlags4 = {
     description: "Include retracted shapes"
   })
 };
-var handleList6 = async (ctx, { flags }) => {
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+var handleList7 = async (ctx, { flags }) => {
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
   const match = flags.match;
   const componentRef = flags.component;
   const excludeComponents = !!flags["exclude-components"];
   const includeRetracted = flags["include-retracted"];
   validateComponentFilters(componentRef, excludeComponents, "wh shape list --component acme/veritas", "wh shape list --exclude-components");
-  const result = await ctx.client.shape.list(org, repo, {
+  const result = await ctx.client.shape.list(org, repo2, {
     match,
     componentRef,
     excludeComponents,
@@ -61992,7 +62372,7 @@ var handleList6 = async (ctx, { flags }) => {
       ctx.status(`${c.dim}No shapes registered${c.reset}`);
       return;
     }
-    ctx.out(`${c.bold}Shapes${c.reset} ${c.cyan}${org}/${repo}${c.reset}`);
+    ctx.out(`${c.bold}Shapes${c.reset} ${c.cyan}${org}/${repo2}${c.reset}`);
     for (const item of items) {
       const shape = item;
       const name = shape.name;
@@ -62036,9 +62416,9 @@ var handleView7 = async (ctx, { flags, args }) => {
   if (!shapeName) {
     usageError("Usage: wh shape view <name>", "wh shape view location");
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
-  const result = await ctx.client.shape.get(org, repo, shapeName, {
+  const result = await ctx.client.shape.get(org, repo2, shapeName, {
     includeRetracted: flags["include-retracted"]
   });
   writeOutput(ctx, result, () => {
@@ -62075,7 +62455,7 @@ var handleView7 = async (ctx, { flags, args }) => {
 var fieldsFileFlag = flag.string({
   description: "read fields from a JSON object file (portable alternative to inline --fields)"
 });
-var createFlags7 = {
+var createFlags8 = {
   "event-request-id": operationEventRequestIdFlag,
   fields: flag.string({ description: FIELDS_FLAG_DESCRIPTION }),
   file: fieldsFileFlag,
@@ -62098,9 +62478,8 @@ var renameFlags3 = {
   "event-request-id": operationEventRequestIdFlag
 };
 function shapeChangeFromReceipt(receipt) {
-  assertSingleOpSuccess(receipt);
-  const entry = receipt.operations[0];
-  if (!entry || entry.operation === "rename" || !("version" in entry) || typeof entry.version !== "number" || !("dataHash" in entry) || typeof entry.dataHash !== "string") {
+  const entry = requireSingleOpSuccess(receipt);
+  if (entry.operation === "rename" || !("version" in entry) || typeof entry.version !== "number" || !("dataHash" in entry) || typeof entry.dataHash !== "string") {
     throw new Error("Shape mutation returned no version-bearing operation");
   }
   return {
@@ -62158,7 +62537,7 @@ var retractFlags3 = {
     description: "Committer wref (shape or shaped thing; e.g. Agent/bot-1)"
   })
 };
-var handleCreate6 = async (ctx, { flags, args }) => {
+var handleCreate7 = async (ctx, { flags, args }) => {
   const shapeName = args[0];
   if (!shapeName) {
     usageError("Usage: wh shape create <name> (--fields '<json>' | --file <path>)", `wh shape create Location --fields '{"x":"number","y":"number"}'`, "wh shape create Location --file fields.json", `wh shape create Tags --fields '{"labels":["string"],"scores":["number"]}'`, `wh shape create Player --fields '{"name":"string","position":{"x":"number","y":"number"}}'`, `wh shape create Review --fields '{"score":"number","reason?":"string"}'`);
@@ -62170,14 +62549,14 @@ var handleCreate6 = async (ctx, { flags, args }) => {
     missingMessage: "Usage: wh shape create <name> (--fields '<json>' | --file <path>)",
     example: "wh shape create Location --file fields.json"
   });
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
   const eventRequestId = flags["event-request-id"] ?? createOperationEventRequestId();
   ctx.status(`Operation event request: ${eventRequestId}`);
   const opts = { eventRequestId };
   if (flags.description !== undefined)
     opts.description = flags.description;
-  const response = await ctx.client.shape.create(org, repo, shapeName, fields, opts);
+  const response = await ctx.client.shape.create(org, repo2, shapeName, fields, opts);
   const result = shapeChangeFromReceipt(response.receipt);
   writeOutput(ctx, response, () => {
     if (result.operation === "noop") {
@@ -62199,9 +62578,9 @@ var handleRevise3 = async (ctx, { flags, args }) => {
     missingMessage: "Usage: wh shape revise <name> (--fields '<json>' | --file <path>)",
     example: "wh shape revise Location --file fields.json"
   });
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
-  const previousShape = flags["show-diff"] ? await ctx.client.shape.get(org, repo, shapeName) : undefined;
+  const previousShape = flags["show-diff"] ? await ctx.client.shape.get(org, repo2, shapeName) : undefined;
   const previousVersion = previousShape?.version?.version;
   const previousFields = previousShape ? fieldsFromShapeData(previousShape.version?.data) : undefined;
   const eventRequestId = flags["event-request-id"] ?? createOperationEventRequestId();
@@ -62209,7 +62588,7 @@ var handleRevise3 = async (ctx, { flags, args }) => {
   const opts = { eventRequestId };
   if (flags.description !== undefined)
     opts.description = flags.description;
-  const response = await ctx.client.shape.revise(org, repo, shapeName, newFields, opts);
+  const response = await ctx.client.shape.revise(org, repo2, shapeName, newFields, opts);
   const result = shapeChangeFromReceipt(response.receipt);
   let diff;
   if (previousFields) {
@@ -62217,7 +62596,7 @@ var handleRevise3 = async (ctx, { flags, args }) => {
     if (result.operation === "noop") {
       committedBaseFields = newFields;
     } else if (previousVersion !== result.version - 1) {
-      const committedBase = await ctx.client.thing.get(org, repo, shapeName, result.version - 1);
+      const committedBase = await ctx.client.thing.get(org, repo2, shapeName, result.version - 1);
       committedBaseFields = fieldsFromShapeData(committedBase.data);
     }
     diff = diffShapeFields(committedBaseFields, newFields);
@@ -62237,10 +62616,10 @@ var handleRetract2 = async (ctx, { flags, args }) => {
   if (!shapeName) {
     usageError("Usage: wh shape retract <name> [--expected-version <n>]", "wh shape retract Location");
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const expectedVersion = parsePositiveIntFlag(flags["expected-version"], "--expected-version", "wh shape retract Location --expected-version 3");
   const c = ctx.colors;
-  const commitResult = await ctx.client.commit.apply(org, repo, flags.message ?? `retract shape ${shapeName}`, [
+  const commitResult = await ctx.client.commit.apply(org, repo2, flags.message ?? `retract shape ${shapeName}`, [
     {
       operation: "retract",
       kind: "shape",
@@ -62249,10 +62628,7 @@ var handleRetract2 = async (ctx, { flags, args }) => {
       ...expectedVersion !== undefined ? { expectedVersion } : {}
     }
   ], { committer: flags.committer });
-  const result = commitResult.operations[0];
-  if (!result)
-    throw new Error("Commit returned no operation result");
-  assertSingleOpSuccess(commitResult);
+  requireSingleOpSuccess(commitResult);
   writeOutput(ctx, commitResult, () => {
     renderCommitterEcho(ctx.out, c, flags.committer);
     ctx.out(`${c.red}Retracted${c.reset} ${c.magenta}${shapeName}${c.reset}`);
@@ -62264,11 +62640,11 @@ var handleShapeRename = async (ctx, { flags, args }) => {
   if (!oldName || !newName) {
     usageError("Usage: wh shape rename <oldName> <newName>", "wh shape rename Location Place");
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
   const eventRequestId = flags["event-request-id"] ?? createOperationEventRequestId();
   ctx.status(`Operation event request: ${eventRequestId}`);
-  const response = await ctx.client.shape.rename(org, repo, oldName, newName, {
+  const response = await ctx.client.shape.rename(org, repo2, oldName, newName, {
     eventRequestId
   });
   writeOutput(ctx, response, () => {
@@ -62286,9 +62662,9 @@ var SHAPE_DOMAIN = defineDomain({
       prime: true,
       summary: "List all shapes",
       args: "",
-      flags: listFlags4,
+      flags: listFlags5,
       examples: ["wh shape list", 'wh shape list --match "Game*"'],
-      handler: handleList6
+      handler: handleList7
     },
     view: {
       prime: true,
@@ -62315,14 +62691,14 @@ var SHAPE_DOMAIN = defineDomain({
       prime: true,
       summary: "Create a new shape",
       args: "<name>",
-      flags: createFlags7,
+      flags: createFlags8,
       examples: [
         `wh shape create GameConfig --repo org/repo --fields '{"x":"number"}'`,
         "wh shape create GameConfig --repo org/repo --file fields.json",
         `wh shape create Player --fields '{"name":{"type":"string","minLength":1,"maxLength":40},"role":{"type":"string","enum":["dm","player"]},"level":{"type":"number","minimum":1,"integer":true},"home":{"type":"wref","shape":"Location"},"tags":{"type":"array","items":"string","minItems":1}}'`
       ],
       notes: [...FIELD_CONSTRAINTS_NOTES],
-      handler: handleCreate6
+      handler: handleCreate7
     },
     retract: {
       prime: true,
@@ -62370,7 +62746,7 @@ var SHAPE_DOMAIN = defineDomain({
 var orgScopeFlag = flag.string({
   description: `org slug for org-scoped events (${ORG_SCOPED_EVENT_TYPES.join(", ")}); use instead of --repo`
 });
-var createFlags8 = {
+var createFlags9 = {
   on: flag.string({
     description: "Shape to subscribe to"
   }),
@@ -62408,27 +62784,27 @@ var createFlags8 = {
   })
 };
 var updateFlags4 = {
-  on: createFlags8.on,
-  kind: createFlags8.kind,
-  filter: createFlags8.filter,
-  cronspec: createFlags8.cronspec,
-  timezone: createFlags8.timezone,
+  on: createFlags9.on,
+  kind: createFlags9.kind,
+  filter: createFlags9.filter,
+  cronspec: createFlags9.cronspec,
+  timezone: createFlags9.timezone,
   "webhook-url": flag.string({
     description: "Webhook destination URL"
   }),
-  url: createFlags8.url,
-  "fallback-webhook-url": createFlags8["fallback-webhook-url"],
+  url: createFlags9.url,
+  "fallback-webhook-url": createFlags9["fallback-webhook-url"],
   "clear-fallback-webhook-url": flag.boolean({
     description: "Clear the fallback webhook URL"
   }),
-  "allow-trace-reentry": createFlags8["allow-trace-reentry"],
-  name: createFlags8.name,
+  "allow-trace-reentry": createFlags9["allow-trace-reentry"],
+  name: createFlags9.name,
   org: orgScopeFlag
 };
 var logFlags = {
   limit: flag.number({ description: "Max deliveries to return" })
 };
-var listFlags5 = {
+var listFlags6 = {
   limit: flag.number({ description: "Max subscriptions to return" }),
   org: orgScopeFlag
 };
@@ -62499,9 +62875,9 @@ function parseEventType(raw, _usage, example) {
   if (raw === undefined) {
     return COMMIT_EVENT_TYPE;
   }
-  if (SUBSCRIBABLE_EVENT_TYPES.includes(raw)) {
-    return raw;
-  }
+  const parsed = SUBSCRIBABLE_EVENT_TYPES.find((candidate) => candidate === raw);
+  if (parsed)
+    return parsed;
   usageError(`--event must be one of: ${SUBSCRIBABLE_EVENT_TYPES.join(", ")}`, example);
 }
 function buildSubscriptionPatchArgs(flags, usage, example) {
@@ -62561,8 +62937,8 @@ function resolveSubScope(ctx, flags, correctiveExample) {
   if (typeof flags.org === "string" && flags.org) {
     return { orgName: flags.org };
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  return { orgName: org, repoName: repo };
+  const { org, repo: repo2 } = resolveRepoContext(ctx);
+  return { orgName: org, repoName: repo2 };
 }
 function rejectConflictingSubScope(ctx, flags, correctiveExample) {
   if (flags.org !== undefined && ctx.invocation.flags.repo !== undefined) {
@@ -62574,7 +62950,7 @@ function scopeLabel(scope) {
 }
 
 // ../../packages/warmhub-cli/src/domains/sub/handlers-create.ts
-var handleCreate7 = async (ctx, { flags, args }) => {
+var handleCreate8 = async (ctx, { flags, args }) => {
   const name = args[0] ?? flags.name;
   const usage = `Usage: wh sub create <name> (--repo org/repo | --org org) [--event ${SUBSCRIBABLE_EVENT_TYPES.join("|")}] [options]`;
   const example = `wh sub create signal-hook --repo myorg/myrepo --on Signal --filter '{"shape":"Signal"}' --webhook-url https://example.com/hook`;
@@ -62618,12 +62994,12 @@ var handleCreate7 = async (ctx, { flags, args }) => {
   if (flags.org !== undefined) {
     usageError(`Flag --org cannot be used with repo-scoped ${eventType} subscriptions`, `wh sub create repo-hook --repo myorg/myrepo --event ${eventType} --webhook-url https://example.com/hook`);
   }
-  const { org, repo } = resolveRepoContext(ctx);
+  const { org, repo: repo2 } = resolveRepoContext(ctx);
   if (eventType !== "commit") {
     rejectCommitOnlyFlags(flags, eventType);
     const result2 = await ctx.client.subscription.create({
       orgName: org,
-      repoName: repo,
+      repoName: repo2,
       name,
       eventType,
       kind,
@@ -62632,7 +63008,7 @@ var handleCreate7 = async (ctx, { flags, args }) => {
     });
     writeOutput(ctx, result2, () => {
       const c = ctx.colors;
-      ctx.status(`${c.green}Created subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${org}/${repo}${c.reset} (${eventType})`);
+      ctx.status(`${c.green}Created subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${org}/${repo2}${c.reset} (${eventType})`);
     });
     return;
   }
@@ -62640,7 +63016,7 @@ var handleCreate7 = async (ctx, { flags, args }) => {
   const sourceRepoRef = typeof flags.source === "string" ? flags.source : undefined;
   const result = await ctx.client.subscription.create({
     orgName: org,
-    repoName: repo,
+    repoName: repo2,
     name,
     webhookUrl,
     fallbackWebhookUrl: createArgs.fallbackWebhookUrl,
@@ -62652,7 +63028,7 @@ var handleCreate7 = async (ctx, { flags, args }) => {
   });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
-    ctx.status(`${c.green}Created subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${org}/${repo}${c.reset}`);
+    ctx.status(`${c.green}Created subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${org}/${repo2}${c.reset}`);
   });
 };
 var handleUpdate4 = async (ctx, { flags, args }) => {
@@ -62828,7 +63204,7 @@ function renderSubscriptionLog(out, statusOut, c, subscriptionName, result) {
 }
 
 // ../../packages/warmhub-cli/src/domains/sub/handlers-management.ts
-var handleList7 = async (ctx, { flags }) => {
+var handleList8 = async (ctx, { flags }) => {
   const scope = resolveSubScope(ctx, flags, "wh sub list --repo myorg/myrepo");
   const label = scopeLabel(scope);
   const all = await ctx.client.subscription.list(scope);
@@ -62928,11 +63304,11 @@ var handleLog = async (ctx, { flags, args }) => {
     usageError("Usage: wh sub log <name> [--repo org/repo]", "wh sub log my-sub --repo myorg/myrepo");
   }
   const org = scope.orgName;
-  const repo = scope.repoName;
+  const repo2 = scope.repoName;
   if (ctx.liveMode) {
     await runLive({
       apiUrl: ctx.config.apiUrl,
-      poll: (c) => c.action.liveFeed(org, repo, name, { limit: flags.limit }),
+      poll: (c) => c.action.liveFeed(org, repo2, name, { limit: flags.limit }),
       render: (result2) => renderSubscriptionLog(ctx.out, ctx.status, ctx.colors, name, result2),
       out: ctx.out,
       err: ctx.err,
@@ -62943,11 +63319,12 @@ var handleLog = async (ctx, { flags, args }) => {
       inactivityTimeoutMs: ctx.inactivityTimeoutMs,
       functionLogs: ctx.functionLogMode,
       profile: ctx.profile,
+      clientFlags: ctx.clientFlags,
       signal: ctx.signal
     });
     return;
   }
-  const result = await ctx.client.action.liveFeed(org, repo, name, {
+  const result = await ctx.client.action.liveFeed(org, repo2, name, {
     limit: flags.limit
   });
   writeOutput(ctx, result, () => renderSubscriptionLog(ctx.out, ctx.status, ctx.colors, name, result));
@@ -62957,8 +63334,8 @@ var handleAttempts = async (ctx, { args }) => {
   if (!runIdArg) {
     usageError("Usage: wh sub attempts <runId> [--repo org/repo]", "wh sub attempts 019d90f0-1111-7000-8000-000000000001 --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.action.getRunAttempts(org, repo, runIdArg);
+  const { org, repo: repo2 } = resolveRepoContext(ctx);
+  const result = await ctx.client.action.getRunAttempts(org, repo2, runIdArg);
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
     if (!result.length) {
@@ -62992,7 +63369,7 @@ var SUB_DOMAIN = defineDomain({
       prime: true,
       summary: "Create a subscription",
       args: "<name>",
-      flags: createFlags8,
+      flags: createFlags9,
       examples: [
         "# Create a webhook subscription for things of a shape",
         `  $ wh sub create signal-hook --repo myorg/myrepo --on Signal --kind webhook --filter '{"shape":"Signal"}' --webhook-url https://example.com/hook`,
@@ -63018,7 +63395,7 @@ var SUB_DOMAIN = defineDomain({
         '  $ echo "tok_secret" | wh credential set webhook-keys WEBHOOK_BEARER_TOKEN --repo myorg/myrepo',
         "  $ wh sub bind signal-hook --credentials webhook-keys --repo myorg/myrepo"
       ],
-      handler: handleCreate7
+      handler: handleCreate8
     },
     update: {
       status: "live",
@@ -63053,14 +63430,14 @@ var SUB_DOMAIN = defineDomain({
       prime: true,
       summary: "List all subscriptions",
       args: "",
-      flags: listFlags5,
+      flags: listFlags6,
       examples: [
         "wh sub list --repo myorg/myrepo",
         "wh sub list --limit 10",
         "# Org-scoped metadata subscriptions",
         "  $ wh sub list --org myorg"
       ],
-      handler: handleList7
+      handler: handleList8
     },
     log: {
       status: "live",
@@ -63239,7 +63616,7 @@ function tokenStatus(pat) {
     return "expired";
   return "active";
 }
-var createFlags9 = {
+var createFlags10 = {
   name: flag.string({ short: "n", description: "Token name" }),
   scope: flag.string({
     short: "s",
@@ -63260,7 +63637,7 @@ var createFlags9 = {
 var nameFlags = {
   name: flag.string({ short: "n", description: "Token name" })
 };
-var listFlags6 = {
+var listFlags7 = {
   all: flag.boolean({
     short: "a",
     description: "Include expired and revoked tokens (default: active only)"
@@ -63298,7 +63675,7 @@ function formatScopes(scopes) {
     return `${base}${formatAllowedMatches(e.allowedMatches)}`;
   }).join(" ");
 }
-var handleCreate8 = async (ctx, { flags }) => {
+var handleCreate9 = async (ctx, { flags }) => {
   if (!flags.name) {
     usageError("Usage: wh token create --name <name> [flags]", "wh token create --name ci-bot --scope myorg/myrepo=role:editor --expires 90d");
   }
@@ -63347,7 +63724,7 @@ var handleCreate8 = async (ctx, { flags }) => {
     ctx.status(`  expires: ${new Date(result.expiresAt).toISOString().slice(0, 16)}`);
   });
 };
-var handleList8 = async (ctx, { flags }) => {
+var handleList9 = async (ctx, { flags }) => {
   const c = ctx.colors;
   const items = await ctx.client.token.list({ includeInactive: flags.all });
   writePageOutput(ctx, items, { limit: items.length, nextCursor: null }, () => {
@@ -63367,7 +63744,7 @@ var handleList8 = async (ctx, { flags }) => {
     }
   });
 };
-var handleGet = async (ctx, { flags }) => {
+var handleGet2 = async (ctx, { flags }) => {
   if (!flags.name) {
     usageError("Usage: wh token get --name <name>", "wh token get --name ci-bot");
   }
@@ -63391,7 +63768,7 @@ var handleGet = async (ctx, { flags }) => {
     }
   });
 };
-var handleRevoke2 = async (ctx, { flags }) => {
+var handleRevoke3 = async (ctx, { flags }) => {
   if (!flags.name) {
     usageError("Usage: wh token revoke --name <name>", "wh token revoke --name ci-bot");
   }
@@ -63409,7 +63786,7 @@ var TOKEN_DOMAIN = defineDomain({
     create: {
       summary: "Create a new personal access token",
       args: "",
-      flags: createFlags9,
+      flags: createFlags10,
       examples: [
         "wh token create --name ci-bot --scope myorg/myrepo=repo:read,repo:write",
         "wh token create --name ci-bot --scope myorg/myrepo=role:editor",
@@ -63418,32 +63795,32 @@ var TOKEN_DOMAIN = defineDomain({
         `wh token create --name scoped --scopes-json '[{"resource":"myorg/myrepo","permissions":["repo:read"],"allowedMatches":["Signal/*"]}]'`,
         `wh token create --name global-reader --scopes-json '[{"permissions":["repo:read"]}]'`
       ],
-      handler: handleCreate8
+      handler: handleCreate9
     },
     list: {
       summary: "List your personal access tokens (active by default)",
       args: "",
-      flags: listFlags6,
+      flags: listFlags7,
       examples: [
         "wh token list",
         "wh token list --all",
         "wh token list --json"
       ],
-      handler: handleList8
+      handler: handleList9
     },
     get: {
       summary: "View a token by name",
       args: "",
       flags: nameFlags,
       examples: ["wh token get --name ci-bot"],
-      handler: handleGet
+      handler: handleGet2
     },
     revoke: {
       summary: "Revoke a token by name",
       args: "",
       flags: nameFlags,
       examples: ["wh token revoke --name ci-bot"],
-      handler: handleRevoke2
+      handler: handleRevoke3
     }
   }
 });
@@ -64069,14 +64446,14 @@ var handleUse = async (ctx, { args, flags }) => {
     });
     return;
   }
-  const parts = repoArg.split("/");
-  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+  const parsed = parseRepoSlug(repoArg);
+  if (!parsed) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid repo format "${repoArg}". Expected "org/repo" (exactly one slash).`, undefined, "Example: wh use myorg/myrepo");
   }
-  const [org, repo] = parts;
+  const { org, repo: repo2 } = parsed;
   const repoNotFoundMessage = `Repo "${repoArg}" not found`;
   try {
-    await ctx.client.repo.get(org, repo);
+    await ctx.client.repo.get(org, repo2);
   } catch (e) {
     if (!(e instanceof WarmHubError) || e.kind !== "NOT_FOUND" || e.errorCode !== "NOT_FOUND" || e.message !== repoNotFoundMessage) {
       throw e;
@@ -64111,6 +64488,69 @@ var USE_DOMAIN = defineDomain({
   handler: handleUse
 });
 
+// ../../packages/warmhub-cli/src/domains/view.ts
+var evaluateFlags = {
+  limit: flag.number({
+    description: "Max results per page (default: 50, max: 500)"
+  }),
+  cursor: flag.string({ description: "Opaque pagination cursor" }),
+  all: flag.boolean({ description: "Fetch all pages" })
+};
+var handleEvaluate = async (ctx, { args, flags }) => {
+  const wref = args[0]?.trim();
+  if (!wref) {
+    usageError("Usage: wh view evaluate <wref> [--limit N] [--cursor TOKEN] [--all]", "wh view evaluate View/active-users --limit 50");
+  }
+  if (flags.cursor && !flags.limit) {
+    usageError("Usage: wh view evaluate <wref> --limit N --cursor TOKEN", "wh view evaluate View/active-users --limit 50 --cursor <token>");
+  }
+  const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const boundedLimit = Math.min(flags.limit ?? DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT);
+  const pageLimit = flags.all ? Math.min(flags.limit ?? AUTO_PAGE_LIMIT, MAX_PAGE_LIMIT) : boundedLimit;
+  if (flags.all) {
+    const items = await ctx.client.view.evaluateAll(org, repo2, wref, {
+      limit: pageLimit,
+      cursor: flags.cursor
+    });
+    writePageOutput(ctx, items, { limit: pageLimit, nextCursor: null }, () => {
+      ctx.out(`${ctx.colors.bold}View ${escapeTerminalTextForDisplay(wref)}${ctx.colors.reset}`);
+      renderQueryResults(ctx.out, ctx.colors, { items });
+    });
+    return;
+  }
+  const result = await ctx.client.view.evaluate(org, repo2, wref, {
+    limit: boundedLimit,
+    cursor: flags.cursor
+  });
+  if (result.nextCursor) {
+    emitPartialPageHint(ctx, result.items.length, result.nextCursor, boundedLimit);
+  }
+  writePageOutput(ctx, result.items, { limit: boundedLimit, nextCursor: result.nextCursor ?? null }, () => {
+    const selected = `${result.view.wref}@v${result.view.version}`;
+    ctx.out(`${ctx.colors.bold}View ${escapeTerminalTextForDisplay(selected)}${ctx.colors.reset}`);
+    renderQueryResults(ctx.out, ctx.colors, result);
+  });
+};
+var VIEW_DOMAIN = defineDomain({
+  name: "view",
+  summary: "Stored View operations",
+  group: "resource",
+  verbs: {
+    evaluate: {
+      prime: true,
+      summary: "Evaluate a stored View against live repository results",
+      args: "<wref>",
+      flags: evaluateFlags,
+      examples: [
+        "wh view evaluate View/active-users",
+        "wh view evaluate View/active-users@v3 --limit 50",
+        "wh view evaluate View/active-users --all"
+      ],
+      handler: handleEvaluate
+    }
+  }
+});
+
 // ../../packages/warmhub-cli/src/domains/index.ts
 function registerAllDomains(registry3) {
   registry3.register(AUTH_DOMAIN);
@@ -64133,6 +64573,8 @@ function registerAllDomains(registry3) {
   registry3.register(TOKEN_DOMAIN);
   registry3.register(COMPONENT_DOMAIN);
   registry3.register(USE_DOMAIN);
+  registry3.register(VIEW_DOMAIN);
+  registry3.register(GRANT_DOMAIN);
 }
 
 // ../../packages/warmhub-cli/src/production-domain-registry.ts
@@ -64332,8 +64774,8 @@ async function printRootHelp(ctx) {
   }
   let repoSlug;
   try {
-    const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
-    repoSlug = `${org}/${repo}`;
+    const { org, repo: repo2 } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+    repoSlug = `${org}/${repo2}`;
   } catch {
     repoSlug = undefined;
   }
@@ -65370,60 +65812,6 @@ var catalog = {
 function prepareCliInvocation(argv) {
   return prepare(argv, resolver, catalog);
 }
-// ../../packages/warmhub-cli/src/cli-context.ts
-function resolveCliContext(args) {
-  const { invocation, format } = args;
-  const config2 = args.config ?? loadConfig();
-  const apiUrlFlag = invocation.flags["api-url"];
-  const explicitApiUrl = typeof apiUrlFlag === "string" ? apiUrlFlag : undefined;
-  const profileFlag = invocation.flags.profile;
-  const apiUrl = explicitApiUrl ?? process.env.WARMHUB_API_URL ?? config2.apiUrl;
-  config2.apiUrl = apiUrl;
-  const explicitProfile = (typeof profileFlag === "string" ? profileFlag : undefined) ?? config2.profile;
-  const effectiveProfile = explicitProfile ?? "default";
-  const overridesBypassProfile = !explicitProfile && !!process.env.WH_TOKEN && (!!process.env.WARMHUB_API_URL || !!explicitApiUrl);
-  let profileData = null;
-  if (!overridesBypassProfile) {
-    try {
-      profileData = getProfile(effectiveProfile);
-    } catch (err) {
-      if (explicitProfile)
-        throw err;
-      const reason = err instanceof Error ? err.message : String(err);
-      if (format === "json" || format === "jsonl") {
-        process.stderr.write(`${JSON.stringify({
-          level: "warning",
-          kind: "auth-file-unreadable",
-          message: `could not read auth.json: ${reason}`
-        })}
-`);
-      } else {
-        process.stderr.write(`warning: could not read auth.json (${reason})
-`);
-      }
-    }
-  }
-  if (profileData) {
-    if (profileData.apiUrl && !explicitApiUrl) {
-      config2.apiUrl = profileData.apiUrl;
-    }
-  } else if (explicitProfile) {
-    const isAuthLogin = invocation.kind === "static" && invocation.commandPath[0] === "auth" && invocation.commandPath[1] === "login";
-    if (!isAuthLogin) {
-      const available = listProfiles();
-      const availableHint = available.length > 0 ? `Available profiles: ${available.join(", ")}.` : "No profiles found.";
-      throw new CliError(5 /* Auth */, "AUTH", `Auth profile "${explicitProfile}" does not exist.`, undefined, `${availableHint}
-Run \`wh auth login --profile ${explicitProfile}\` to create it.`);
-    }
-  }
-  const client = args.client ?? createClient(config2, {
-    functionLogs: args.functionLogs,
-    profile: effectiveProfile,
-    signal: args.signal
-  });
-  return { config: config2, profile: effectiveProfile, client };
-}
-
 // ../../packages/warmhub-cli/src/confirm-prompt.ts
 function confirmPrompt(message, opts = {}) {
   const input = opts.input ?? process.stdin;
@@ -65471,8 +65859,8 @@ function selectedRepo(flags, config2) {
     }
   }
   try {
-    const { org, repo } = parseOrgRepo(repoRef, config2);
-    return `${org}/${repo}`;
+    const { org, repo: repo2 } = parseOrgRepo(repoRef, config2);
+    return `${org}/${repo2}`;
   } catch {
     return;
   }
@@ -65670,10 +66058,11 @@ async function runPreparedCli(rawArgv, prepared, opts) {
       requestedMode: requestedFunctionLogs
     });
     const localOnlyCommand = isLocalOnlyInvocation(invocation);
-    const { config: config2, client, profile } = localOnlyCommand ? {
+    const { config: config2, client, profile, clientFlags } = localOnlyCommand ? {
       config: loadConfig(),
       client: createLocalOnlyClient(),
-      profile: "default"
+      profile: "default",
+      clientFlags: []
     } : resolveCliContext({
       invocation,
       format,
@@ -65693,6 +66082,7 @@ async function runPreparedCli(rawArgv, prepared, opts) {
       config: config2,
       invocation,
       profile,
+      clientFlags,
       colors,
       chars,
       format,
@@ -65810,7 +66200,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.87.0",
+  version: "0.89.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -65954,9 +66344,9 @@ async function performRegisteredInstall(args) {
 }
 function mapInstallError(error51, componentRef, verb) {
   if (isMissingRegistrationError(error51)) {
-    const [ownerOrg, name] = componentRef.split("/");
+    const parsed = parseComponentRef(componentRef);
     const backendCode = warmHubErrorBackendCode(error51);
-    return new CliError(2 /* UserInput */, "USER_INPUT", `No component registered as ${componentRef}`, undefined, `Register it first with 'wh component register ${name ?? componentRef} --org ${ownerOrg ?? "<org>"} --manifest <path>'.`, undefined, backendCode ?? "NOT_FOUND");
+    return new CliError(2 /* UserInput */, "USER_INPUT", `No component registered as ${componentRef}`, undefined, `Register it first with 'wh component register ${parsed?.name ?? componentRef} --org ${parsed?.org ?? "<org>"} --manifest <path>'.`, undefined, backendCode ?? "NOT_FOUND");
   }
   if (isMissingManifestPermissionError(error51)) {
     const backendCode = warmHubErrorBackendCode(error51) ?? warmHubErrorKind(error51);
@@ -66429,5 +66819,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=8EDFBA735C4E16A864756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.87.0","sdkVersion":"0.85.0"}
+//# debugId=0D9B1F5B8E62352264756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.89.0","sdkVersion":"0.87.0"}