@amerged/ohmyhost-cli 0.1.43 → 0.1.45

package/dist/{chunk-5TO5I2HF.js → chunk-C6KEAOJP.js}

@@ -38879,12 +38879,12 @@ var failures = {
     "Do not repeat the write with a new key. Inspect the target data with a read query and retain this operation ID. The same key only reads this receipt."
   ],
   database_compute_failed: [
-    "The database size change failed at the provider.",
-    "Read the current database compute and report this operation ID through feedback. Preserve data; do not reset or redeploy the database to repair its size."
+    "The database provider refused the size change or had no room for it. The database keeps its previous size and keeps running, and no credits are charged for the failed change.",
+    "Read the current size with 'ohmyhost database compute get --project PROJECT_ULID --environment dev|prod --json' or MCP database_compute_get, then repeat the change with a new idempotency key; the old key only returns this failure. If it fails again after a few minutes, start a new deployment of the project, repeat the change and report this operation ID through feedback. Never reset the database to change its size."
   ],
   database_compute_plan_changed: [
-    "Paid access ended before the database size change started.",
-    "Read the organization's plan and current database compute, then confirm a new standard-size request. This operation did not resize the database."
+    "Paid access ended before the database size change started, so it was not sent to the database provider. The database keeps its previous size and keeps running, and no credits are charged for the change.",
+    "Read the organization's plan with 'ohmyhost credits account --organization ORGANIZATION_ULID --json' or MCP organization_account_get. Sizes above 256 MiB need active Paid: ask the organization Owner to activate Paid through billing checkout, then read the current size with database compute get and repeat the change with a new idempotency key."
   ],
   database_compute_rejected: [
     "The database size change could not be started.",
@@ -40219,6 +40219,36 @@ var PROBLEM_POLICY = {
     action: "The platform is still retrying this webhook delivery. Read the delivery in the delivery list; replay it only if it ends dead_lettered or the receiver needs the event again.",
     title: "Webhook delivery still pending"
   },
+  database_watch_limit: {
+    status: 409,
+    retryable: false,
+    action: "List the project's database watches for this environment and delete one you no longer need, then create the watch again.",
+    title: "Database watch limit reached"
+  },
+  database_watch_table_unavailable: {
+    status: 409,
+    retryable: false,
+    action: "The table must exist as an ordinary table owned by the application, created by a deployed migration; views, partitions, temporary tables and the schemas pgcf, ohmyhost, information_schema and pg_* cannot be watched. Fix the name or deploy the migration, then create the watch again.",
+    title: "Table cannot be watched"
+  },
+  database_watch_column_unavailable: {
+    status: 409,
+    retryable: false,
+    action: "List only existing column names exactly as written, names are case-sensitive. Delete the watch before a migration drops a published column, because the write would fail.",
+    title: "Watched column does not exist"
+  },
+  database_watch_events_unavailable: {
+    status: 409,
+    retryable: false,
+    action: "The platform event schema is installed when the database wakes: run any query against that environment, wait for the answer, then create the watch again. If it still fails, report the request_id through feedback.",
+    title: "Database events not installed yet"
+  },
+  database_watch_conflict: {
+    status: 409,
+    retryable: false,
+    action: "A migration already attaches a capture trigger to this table: keep it and skip the watch, or remove it from the migrations, deploy and create the watch again. A table carries one capture trigger.",
+    title: "Table already has a capture trigger"
+  },
   project_notes_conflict: {
     status: 409,
     retryable: false,
@@ -40483,7 +40513,7 @@ var PROBLEM_POLICY = {
   api_key_permissions_unavailable: {
     status: 503,
     retryable: false,
-    action: "Report the platform user-key permission configuration through feedback. Repeated login or creation will not fix it.",
+    action: "Report the platform user-key permission configuration through feedback with this request_id; it affects every token the same way, whatever the integration. Repeated login does not fix it. After the platform confirms the fix, repeat the same create with the same name and Idempotency-Key.",
     title: "Token permissions unavailable"
   },
   reconciliation_exhausted: {
@@ -42389,6 +42419,9 @@ var DATABASE_WEBHOOK_EVENT_TYPES = [
   "database.resized",
   "database.deleted"
 ];
+var DATABASE_WATCH_OPERATIONS = ["insert", "update", "delete"];
+var DATABASE_WATCH_MAX_COLUMNS = 32;
+var DATABASE_WATCH_DEFAULT_SCHEMA = "public";
 var DATABASE_WEBHOOK_MAX_EVENT_TYPES = 16;
 var DATABASE_WEBHOOK_MAX_HEADERS = 8;
 var DATABASE_WEBHOOK_URL_MAX_LENGTH = 2048;
@@ -42432,7 +42465,22 @@ var USAGE_MAX_RANGE_MS = 31 * 24 * USAGE_HOUR_MS;
 var WEBHOOK_KEYS = ["id", "environment", "url", "event_types", "header_names", "created_at"];
 var WEBHOOK_ID_PATTERN = /^whk_[a-z0-9]{20}$/u;
 var DELIVERY_ID_PATTERN = /^dlv_[0-9a-f]{20}$/u;
-var EVENT_ID_PATTERN = /^evt_[0-9a-f]{20}$/u;
+var EVENT_ID_PATTERN = /^(?:evt_[0-9a-f]{20}|[a-z][a-z0-9]{19}:[1-9][0-9]{0,15}:[1-9][0-9]{0,15})$/u;
+var DATA_SUBSCRIPTION_PATTERN = /^data\.(?:\*|[a-z][a-z0-9_]{0,47})$/u;
+var DATA_EVENT_TYPE_PATTERN = /^data\.[a-z][a-z0-9_]{0,47}$/u;
+var DATABASE_WATCH_ID_PATTERN = /^pgcf_watch_[0-9a-f]{8}$/u;
+var DATABASE_WATCH_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,62}$/u;
+var DATABASE_WATCH_FORBIDDEN_SCHEMAS = ["information_schema", "pgcf", "ohmyhost"];
+var DATABASE_WATCH_KEYS = [
+  "id",
+  "environment",
+  "schema",
+  "table",
+  "columns",
+  "operations",
+  "topic",
+  "event_type"
+];
 var SCHEDULE_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,62}$/u;
 var CURSOR_PATTERN = /^[A-Za-z0-9._|:=+/-]{1,200}$/u;
 var HEADER_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]{0,63}$/u;
@@ -42454,11 +42502,53 @@ function parseDatabaseWebhookId(value) {
     throw new TypeError("Invalid database webhook id");
   return value;
 }
+function parseDatabaseWatchId(value) {
+  if (!isDatabaseWatchTriggerName(value))
+    throw new TypeError("Invalid database watch id");
+  return value;
+}
 function parseDatabaseDeliveryId(value) {
   if (!matches(value, DELIVERY_ID_PATTERN))
     throw new TypeError("Invalid database delivery id");
   return value;
 }
+function isDatabaseWatchTriggerName(value) {
+  return matches(value, DATABASE_WATCH_ID_PATTERN);
+}
+function isDatabaseWatchIdentifier(value) {
+  return matches(value, DATABASE_WATCH_IDENTIFIER_PATTERN);
+}
+function isDatabaseWatchSchema(value) {
+  if (!isDatabaseWatchIdentifier(value))
+    return false;
+  const lower = value.toLowerCase();
+  return !lower.startsWith("pg_") && !DATABASE_WATCH_FORBIDDEN_SCHEMAS.includes(lower);
+}
+function dataEventTopic(tableName) {
+  const mapped = Array.from(tableName, (character) => {
+    const lower = Array.from(character.toLowerCase())[0] ?? "_";
+    return /^[a-z0-9_]$/u.test(lower) ? lower : "_";
+  }).join("");
+  const topic = /^[a-z]/u.test(mapped) ? mapped : `t_${mapped}`;
+  return topic.slice(0, 48);
+}
+function parseDatabaseWatchCreateRequest(value) {
+  if (!record2(value) || !onlyKeys(value, ["schema", "table", "columns", "operations"]) || !isDatabaseWatchIdentifier(value["table"]) || !Array.isArray(value["columns"]) || value["columns"].length < 1 || value["columns"].length > DATABASE_WATCH_MAX_COLUMNS || !value["columns"].every(isDatabaseWatchIdentifier) || new Set(value["columns"]).size !== value["columns"].length)
+    throw new TypeError("Invalid database watch request");
+  return {
+    ...parseDatabaseWatchTarget({ schema: value["schema"], table: value["table"] }),
+    columns: value["columns"],
+    operations: parseWatchOperations(value["operations"])
+  };
+}
+function parseDatabaseWatchTarget(value) {
+  if (!record2(value) || !onlyKeys(value, ["schema", "table"]) || !isDatabaseWatchIdentifier(value["table"]))
+    throw new TypeError("Invalid database watch target");
+  const schema = value["schema"] === void 0 ? DATABASE_WATCH_DEFAULT_SCHEMA : value["schema"];
+  if (!isDatabaseWatchSchema(schema))
+    throw new TypeError("Invalid database watch target");
+  return { schema, table: value["table"] };
+}
 function parseDatabaseScheduleName(value) {
   if (!matches(value, SCHEDULE_NAME_PATTERN))
     throw new TypeError("Invalid database schedule name");
@@ -42515,6 +42605,20 @@ function assertDatabaseWebhook(value) {
     throw new TypeError("Invalid database webhook");
   assertWebhookFields(value);
 }
+function assertDatabaseWatch(value) {
+  if (!record2(value) || !exact2(value, DATABASE_WATCH_KEYS) || !matches(value["id"], DATABASE_WATCH_ID_PATTERN) || !oneOf(["dev", "prod"], value["environment"]) || !isDatabaseWatchSchema(value["schema"]) || !isDatabaseWatchIdentifier(value["table"]) || !Array.isArray(value["columns"]) || value["columns"].length < 1 || value["columns"].length > DATABASE_WATCH_MAX_COLUMNS || !value["columns"].every(isDatabaseWatchIdentifier) || !isCanonicalOperations(value["operations"]) || value["topic"] !== dataEventTopic(value["table"]) || value["event_type"] !== `data.${value["topic"]}`)
+    throw new TypeError("Invalid database watch");
+}
+function assertDatabaseWatchPage(value) {
+  if (!record2(value) || !exact2(value, ["items"]) || !pageItems(value["items"]))
+    throw new TypeError("Invalid database watch page");
+  for (const item of value["items"])
+    assertDatabaseWatch(item);
+}
+function assertDatabaseWatchDeleted(value) {
+  if (!record2(value) || !exact2(value, ["id", "deleted"]) || !matches(value["id"], DATABASE_WATCH_ID_PATTERN) || value["deleted"] !== true)
+    throw new TypeError("Invalid database watch deletion");
+}
 function assertDatabaseWebhookCreated(value) {
   if (!record2(value) || !exact2(value, [...WEBHOOK_KEYS, "secret"]) || typeof value["secret"] !== "string" || value["secret"].length === 0)
     throw new TypeError("Invalid database webhook");
@@ -42543,7 +42647,7 @@ function assertDatabaseWebhookDelivery(value) {
     "delivered_at",
     "last_status",
     "last_error"
-  ]) || !matches(value["id"], DELIVERY_ID_PATTERN) || !matches(value["event_id"], EVENT_ID_PATTERN) || !oneOf(DATABASE_WEBHOOK_EVENT_TYPES, value["event_type"]) || !matches(value["webhook_id"], WEBHOOK_ID_PATTERN) || !oneOf(["pending", "delivered", "dead_lettered"], value["state"]) || !nonNegativeInteger(value["attempts"]) || !timestamp2(value["created_at"]) || !nullable(value["next_attempt_at"], timestamp2) || !nullable(value["delivered_at"], timestamp2) || !nullable(value["last_status"], Number.isSafeInteger) || !nullable(value["last_error"], (error) => oneOf(["timeout", "network", "http", "expired", "permanent"], error)))
+  ]) || !matches(value["id"], DELIVERY_ID_PATTERN) || !matches(value["event_id"], EVENT_ID_PATTERN) || !isDeliveredEventType(value["event_type"]) || !matches(value["webhook_id"], WEBHOOK_ID_PATTERN) || !oneOf(["pending", "delivered", "dead_lettered"], value["state"]) || !nonNegativeInteger(value["attempts"]) || !timestamp2(value["created_at"]) || !nullable(value["next_attempt_at"], timestamp2) || !nullable(value["delivered_at"], timestamp2) || !nullable(value["last_status"], Number.isSafeInteger) || !nullable(value["last_error"], (error) => oneOf(["timeout", "network", "http", "expired", "permanent"], error)))
     throw new TypeError("Invalid database webhook delivery");
 }
 function assertDatabaseWebhookDeliveryPage(value) {
@@ -42626,7 +42730,7 @@ function assertUsageRow(value) {
     throw new TypeError("Invalid database execution usage row");
 }
 function assertWebhookFields(value) {
-  if (!matches(value["id"], WEBHOOK_ID_PATTERN) || !oneOf(["dev", "prod"], value["environment"]) || !isHttpsUrl2(value["url"]) || !Array.isArray(value["event_types"]) || value["event_types"].length < 1 || value["event_types"].length > DATABASE_WEBHOOK_MAX_EVENT_TYPES || !value["event_types"].every((type) => oneOf(DATABASE_WEBHOOK_EVENT_TYPES, type)) || !Array.isArray(value["header_names"]) || value["header_names"].length > DATABASE_WEBHOOK_MAX_HEADERS || !value["header_names"].every((name) => matches(name, HEADER_NAME_PATTERN)) || !timestamp2(value["created_at"]))
+  if (!matches(value["id"], WEBHOOK_ID_PATTERN) || !oneOf(["dev", "prod"], value["environment"]) || !isHttpsUrl2(value["url"]) || !Array.isArray(value["event_types"]) || value["event_types"].length < 1 || value["event_types"].length > DATABASE_WEBHOOK_MAX_EVENT_TYPES || !value["event_types"].every(isDatabaseWebhookEventPattern) || !Array.isArray(value["header_names"]) || value["header_names"].length > DATABASE_WEBHOOK_MAX_HEADERS || !value["header_names"].every((name) => matches(name, HEADER_NAME_PATTERN)) || !timestamp2(value["created_at"]))
     throw new TypeError("Invalid database webhook");
 }
 function parseHttpsUrl(value) {
@@ -42643,11 +42747,33 @@ function isHttpsUrl2(value) {
     return false;
   }
 }
+function isDatabaseWebhookEventPattern(value) {
+  return oneOf(DATABASE_WEBHOOK_EVENT_TYPES, value) || matches(value, DATA_SUBSCRIPTION_PATTERN);
+}
+function isDeliveredEventType(value) {
+  return oneOf(DATABASE_WEBHOOK_EVENT_TYPES, value) || matches(value, DATA_EVENT_TYPE_PATTERN);
+}
+function isDatabaseWebhookEventTypes(value) {
+  return Array.isArray(value) && value.length >= 1 && value.length <= DATABASE_WEBHOOK_MAX_EVENT_TYPES && value.every(isDatabaseWebhookEventPattern) && new Set(value).size === value.length;
+}
 function parseEventTypes(value) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > DATABASE_WEBHOOK_MAX_EVENT_TYPES || !value.every((type) => oneOf(DATABASE_WEBHOOK_EVENT_TYPES, type)) || new Set(value).size !== value.length)
+  if (!isDatabaseWebhookEventTypes(value))
     throw new TypeError("Invalid database webhook event types");
   return value;
 }
+function parseWatchOperations(value) {
+  if (value === void 0)
+    return DATABASE_WATCH_OPERATIONS;
+  if (!Array.isArray(value) || value.length < 1 || !value.every((operation) => oneOf(DATABASE_WATCH_OPERATIONS, operation)) || new Set(value).size !== value.length)
+    throw new TypeError("Invalid database watch request");
+  return DATABASE_WATCH_OPERATIONS.filter((operation) => value.includes(operation));
+}
+function isCanonicalOperations(value) {
+  if (!Array.isArray(value) || value.length < 1)
+    return false;
+  const canonical = DATABASE_WATCH_OPERATIONS.filter((operation) => value.includes(operation));
+  return canonical.length === value.length && canonical.every((op, index) => op === value[index]);
+}
 function parseHeaders(value) {
   if (!record2(value) || Object.keys(value).length > DATABASE_WEBHOOK_MAX_HEADERS || new Set(Object.keys(value).map((name) => name.toLowerCase())).size !== Object.keys(value).length)
     throw new TypeError("Invalid database webhook headers");
@@ -43083,6 +43209,14 @@ var recognizedCommandLabel = (argv) => {
       if (values[1] === "revoke")
         return "database access revoke";
     }
+    if (value === "database" && values[0] === "watch") {
+      if (values[1] === "create")
+        return "database watch create";
+      if (values[1] === "list")
+        return "database watch list";
+      if (values[1] === "delete")
+        return "database watch delete";
+    }
     if (value === "database" && values[0] === "webhook") {
       if (values[1] === "create")
         return "database webhook create";
@@ -43932,6 +44066,73 @@ var parseProductCliCommand = (argv) => {
     }
     throw new InvalidCommandError();
   }
+  if (first === "database" && values[0] === "watch") {
+    values.shift();
+    const subcommand = values.shift();
+    if (subcommand === "create") {
+      if (!yes || wait || follow || revoke || stdin)
+        throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, [
+        "--project",
+        "--environment",
+        "--table",
+        "--schema",
+        "--columns",
+        "--operations",
+        "--idempotency-key"
+      ]);
+      const projectId = options["--project"], environment = options["--environment"], table = options["--table"], schema = options["--schema"], columns = options["--columns"], operations = options["--operations"], idempotencyKey = options["--idempotency-key"];
+      if (!isValue(projectId) || !isValue(idempotencyKey) || !isValue(table) || !isValue(columns) || environment !== "dev" && environment !== "prod")
+        throw new InvalidCommandError();
+      const request = contractValue(() => parseDatabaseWatchCreateRequest({
+        schema,
+        table,
+        columns: columns.split(","),
+        ...operations === void 0 ? {} : { operations: operations.split(",") }
+      }));
+      return {
+        kind: "database-watch-create",
+        projectId,
+        environment,
+        request,
+        idempotencyKey,
+        yes: true,
+        credentialStore
+      };
+    }
+    if (subcommand === "list") {
+      if (yes || wait || follow || revoke || stdin)
+        throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, ["--project", "--environment"]);
+      const projectId = options["--project"], environment = options["--environment"] ?? "dev";
+      if (!isValue(projectId) || environment !== "dev" && environment !== "prod")
+        throw new InvalidCommandError();
+      return { kind: "database-watch-list", projectId, environment, credentialStore };
+    }
+    if (subcommand === "delete") {
+      if (!yes || wait || follow || revoke || stdin)
+        throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, [
+        "--project",
+        "--environment",
+        "--watch",
+        "--idempotency-key"
+      ]);
+      const projectId = options["--project"], environment = options["--environment"], watchId = options["--watch"], idempotencyKey = options["--idempotency-key"];
+      if (!isValue(projectId) || !isValue(idempotencyKey) || environment !== "dev" && environment !== "prod")
+        throw new InvalidCommandError();
+      return {
+        kind: "database-watch-delete",
+        projectId,
+        environment,
+        watchId: contractValue(() => parseDatabaseWatchId(watchId)),
+        idempotencyKey,
+        yes: true,
+        credentialStore
+      };
+    }
+    throw new InvalidCommandError();
+  }
   if (first === "database" && values[0] === "webhook") {
     values.shift();
     const subcommand = values.shift();
@@ -45317,7 +45518,7 @@ function exact4(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.43",
+  version: "0.1.45",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -45662,20 +45863,23 @@ var HELP_USAGE = Object.freeze({
   "database access create": "ohmyhost database access create --project ULID --environment dev|prod [--mode read|write] [--ttl 5m|1h|24h|SECONDS] [--label TEXT] --yes --json\n  The connection URI is shown once. Use it immediately, never store it in files, notes or source, and revoke it when finished.",
   "database access list": "ohmyhost database access list --project ULID [--environment dev|prod] --json",
   "database access revoke": "ohmyhost database access revoke --project ULID --access ULID --yes --json",
-  "database webhook create": "ohmyhost database webhook create --project ULID --environment dev|prod --url HTTPS_URL --event-types TYPE[,TYPE] [--headers-file PATH] --idempotency-key KEY --yes --json (the signing secret is shown once in this answer; types: database.created, database.ready, database.woke, database.slept, database.suspended, database.resized, database.deleted; the headers file is a UTF-8 JSON object of at most 8 KiB)",
+  "database watch create": "ohmyhost database watch create --project ULID --environment dev|prod --table NAME [--schema public] --columns COL[,COL] [--operations insert,update,delete] --idempotency-key KEY --yes --json (publishes only the listed columns, at most 32, of each row change as the event type data.<topic> printed in this answer; the table must exist as an ordinary table of the application; a sleeping database wakes; next, subscribe with 'ohmyhost database webhook create ... --event-types data.<topic>')",
+  "database watch list": "ohmyhost database watch list --project ULID [--environment dev|prod] --json (dev when omitted; a sleeping database wakes)",
+  "database watch delete": "ohmyhost database watch delete --project ULID --environment dev|prod --watch ID --idempotency-key KEY --yes --json",
+  "database webhook create": "ohmyhost database webhook create --project ULID --environment dev|prod --url HTTPS_URL --event-types TYPE[,TYPE] [--headers-file PATH] --idempotency-key KEY --yes --json (the signing secret is shown once in this answer; types: database.created, database.ready, database.woke, database.slept, database.suspended, database.resized, database.deleted, data.<topic> for the rows of one watched table printed by database watch create, or data.* for every watched table; a bare * is not accepted and does not include data events; the headers file is a UTF-8 JSON object of at most 8 KiB)",
   "database webhook list": "ohmyhost database webhook list --project ULID [--environment dev|prod] --json (dev when omitted; the secret is never listed)",
   "database webhook get": "ohmyhost database webhook get --project ULID [--environment dev|prod] --webhook ID --json",
   "database webhook delete": "ohmyhost database webhook delete --project ULID --environment dev|prod --webhook ID --yes --json",
   "database webhook test": "ohmyhost database webhook test --project ULID --environment dev|prod --webhook ID --yes --json (sends one signed test request to the receiver; nothing is stored)",
   "database webhook deliveries": "ohmyhost database webhook deliveries --project ULID [--environment dev|prod] [--webhook ID] [--limit 1..100] [--cursor CURSOR] --json",
   "database webhook replay": "ohmyhost database webhook replay --project ULID --environment dev|prod --delivery ID --yes --json",
-  "database schedule set": "ohmyhost database schedule set --project ULID --environment dev|prod --name NAME (--cron EXPR | --every-seconds N) --statements-file PATH [--timeout-ms N] [--enabled true|false] --yes --json (runs the statements in the file, a UTF-8 JSON array of 1 to 20 SQL strings, as the runtime role of the application; cron has five fields in UTC; every-seconds is 60 to 2678400; timeout-ms is 1000 to 30000, default 10000)",
+  "database schedule set": "ohmyhost database schedule set --project ULID --environment dev|prod --name NAME (--cron EXPR | --every-seconds N) --statements-file PATH [--timeout-ms N] [--enabled true|false] --yes --json (runs the statements in the file, a UTF-8 JSON array of 1 to 20 SQL strings, as the runtime role of the application; cron has five fields in UTC; every-seconds is 60 to 2678400; timeout-ms is 1000 to 30000, default 10000). A project whose Stop budget is reached has its schedules disabled automatically, within about an hour of the billed usage reaching the budget: the credit service does this after its hourly pgcf pass, and Continue budgets are never touched. While the budget is reached, schedule set with enabled true and schedule run are refused with project_budget_exceeded (HTTP 402). Re-enabling is manual: raise the budget (or wait for the next UTC month) and run database schedule set --enabled true again with the schedule body (read it with schedule get).",
   "database schedule list": "ohmyhost database schedule list --project ULID [--environment dev|prod] --json (dev when omitted)",
   "database schedule get": "ohmyhost database schedule get --project ULID [--environment dev|prod] --name NAME --json",
   "database schedule delete": "ohmyhost database schedule delete --project ULID --environment dev|prod --name NAME --yes --json",
   "database schedule runs": "ohmyhost database schedule runs --project ULID [--environment dev|prod] --name NAME [--limit 1..50] --json",
-  "database schedule run": "ohmyhost database schedule run --project ULID --environment dev|prod --name NAME --yes --json (queues one run now, in addition to the timer)",
-  "database executions": "ohmyhost database executions --project ULID [--environment dev|prod] --from ISO --to ISO --granularity hour|day [--limit 1..100] [--cursor CURSOR] --json (UTC timestamps like 2026-10-30T00:00:00.000Z aligned to the granularity, at most 31 days; counts schedule runs, webhook attempts and events per hour or day; usage counters only, nothing is charged for them until the operator prices them)",
+  "database schedule run": "ohmyhost database schedule run --project ULID --environment dev|prod --name NAME --yes --json (queues one run now, in addition to the timer; refused with project_budget_exceeded (HTTP 402) while the project's Stop budget is reached)",
+  "database executions": "ohmyhost database executions --project ULID [--environment dev|prod] --from ISO --to ISO --granularity hour|day [--limit 1..100] [--cursor CURSOR] --json (UTC timestamps like 2026-10-30T00:00:00.000Z aligned to the granularity, at most 31 days; counts schedule runs, webhook attempts and events per hour or day; these are counters only, executions have no price of their own and the awake compute time of the database is what is billed)",
   "database psql": "ohmyhost database psql --project ULID --environment dev|prod [--mode read|write] [--ttl 5m|1h|24h|SECONDS] [--json] (starts local psql with a temporary credential and revokes it on exit)",
   link: "ohmyhost link --project ULID --repository-owner OWNER --repository-name REPOSITORY --idempotency-key KEY --json (uses the workspace GitHub connection and waits for the source-link operation)",
   "source auto-deploy set": "ohmyhost source auto-deploy set --project ULID --branch BRANCH --enabled true|false --idempotency-key KEY --json",
@@ -46153,6 +46357,12 @@ var ProductCli = class {
         return await this.listDatabaseAccess(command, signal);
       if (command.kind === "database-access-revoke")
         return await this.revokeDatabaseAccess(command, signal);
+      if (command.kind === "database-watch-create")
+        return await this.createDatabaseWatch(command, signal);
+      if (command.kind === "database-watch-list")
+        return await this.listDatabaseWatches(command, signal);
+      if (command.kind === "database-watch-delete")
+        return await this.deleteDatabaseWatch(command, signal);
       if (command.kind === "database-webhook-create")
         return await this.createDatabaseWebhook(command, signal);
       if (command.kind === "database-webhook-list")
@@ -46684,6 +46894,39 @@ var ProductCli = class {
     assertProjectDatabaseAccess(access);
     return success("database access revoke", { status: "succeeded", access });
   }
+  /** The answer names the event type to subscribe to; the watch already carries the columns and the topic. */
+  async createDatabaseWatch(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const watch = await api.createProjectDatabaseWatch({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      request: command.request
+    });
+    return success("database watch create", {
+      status: "succeeded",
+      watch,
+      next_action: `Run '${this.dependencies.commandPrefix} database webhook create --project ${command.projectId} --environment ${command.environment} --url HTTPS_URL --event-types ${watch.event_type} --idempotency-key KEY --yes --json' to receive ${watch.event_type} events at an HTTPS receiver.`
+    });
+  }
+  async listDatabaseWatches(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const page = await api.listProjectDatabaseWatches({
+      projectId: command.projectId,
+      environment: command.environment
+    });
+    return success("database watch list", { status: "succeeded", watch: page.items });
+  }
+  async deleteDatabaseWatch(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const deleted = await api.deleteProjectDatabaseWatch({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      watchId: command.watchId
+    });
+    return success("database watch delete", { status: "succeeded", deleted });
+  }
   /** The signing secret is returned by create only; every other answer carries no secret. */
   async createDatabaseWebhook(command, signal) {
     const request = await webhookCreateRequest(command);
@@ -47714,6 +47957,12 @@ var parsedCommandName = (command) => {
     return "database access revoke";
   if (command.kind === "database-psql")
     return "database psql";
+  if (command.kind === "database-watch-create")
+    return "database watch create";
+  if (command.kind === "database-watch-list")
+    return "database watch list";
+  if (command.kind === "database-watch-delete")
+    return "database watch delete";
   if (command.kind === "database-webhook-create")
     return "database webhook create";
   if (command.kind === "database-webhook-list")
@@ -50586,6 +50835,68 @@ var revokeProjectDatabaseAccess = (parameters, options) => {
     ...params
   });
 };
+var listProjectDatabaseWatches = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "query", key: "environment" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/database/watches",
+    ...options,
+    ...params
+  });
+};
+var createProjectDatabaseWatch = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "databaseWatchCreateRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/database/watches",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var deleteProjectDatabaseWatch = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "watch_id" },
+        { in: "query", key: "environment" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/database/watches/{watch_id}",
+    ...options,
+    ...params
+  });
+};
 var listProjectDatabaseWebhooks = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -51959,6 +52270,7 @@ function checkedResponse(kind, value) {
 
 // apps/product-cli/dist/product-api.js
 var WEBHOOK_SCOPE_MISMATCH = "Webhook response scope mismatch";
+var WATCH_SCOPE_MISMATCH = "Watch response scope mismatch";
 var SCHEDULE_SCOPE_MISMATCH = "Schedule response scope mismatch";
 var GeneratedSdkProductApi = class {
   #client;
@@ -52156,6 +52468,42 @@ var GeneratedSdkProductApi = class {
     assertProjectDatabaseAccess(value);
     return value;
   }
+  async createProjectDatabaseWatch(input) {
+    const value = await createProjectDatabaseWatch({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      databaseWatchCreateRequest: {
+        environment: input.environment,
+        schema: input.request.schema,
+        table: input.request.table,
+        columns: [...input.request.columns],
+        operations: [...input.request.operations]
+      }
+    }, { client: this.#client });
+    assertDatabaseWatch(value);
+    if (value.environment !== input.environment || value.schema !== input.request.schema || value.table !== input.request.table)
+      throw new TypeError(WATCH_SCOPE_MISMATCH);
+    return value;
+  }
+  async listProjectDatabaseWatches(input) {
+    const value = await listProjectDatabaseWatches({ project_id: input.projectId, environment: input.environment }, { client: this.#client });
+    assertDatabaseWatchPage(value);
+    if (value.items.some((item) => item.environment !== input.environment))
+      throw new TypeError(WATCH_SCOPE_MISMATCH);
+    return value;
+  }
+  async deleteProjectDatabaseWatch(input) {
+    const value = await deleteProjectDatabaseWatch({
+      project_id: input.projectId,
+      environment: input.environment,
+      "Idempotency-Key": input.idempotencyKey,
+      watch_id: input.watchId
+    }, { client: this.#client });
+    assertDatabaseWatchDeleted(value);
+    if (value.id !== input.watchId)
+      throw new TypeError(WATCH_SCOPE_MISMATCH);
+    return value;
+  }
   /** The signing secret exists only in this answer; the CLI prints it once and stores nothing. */
   async createProjectDatabaseWebhook(input) {
     const value = await createProjectDatabaseWebhook({
@@ -54123,6 +54471,8 @@ function rejectMigrationSqlReferences(tokens, allowIdentityHelpers = false) {
     if (token?.kind !== "word" && token?.kind !== "identifier")
       continue;
     const value = token.value.toLowerCase();
+    if (value === "pgcf")
+      throw new DatabaseMigrationAdmissionError("unsupported");
     if (value === "ohmyhost") {
       if (allowIdentityHelpers && token.value === "ohmyhost" && tokens[index + 1]?.kind === "symbol" && tokens[index + 1]?.value === "." && ["user_id", "claims"].includes(tokens[index + 2]?.value ?? "") && ["word", "identifier"].includes(tokens[index + 2]?.kind ?? "") && tokens[index + 3]?.kind === "symbol" && tokens[index + 3]?.value === "(" && tokens[index + 4]?.kind === "symbol" && tokens[index + 4]?.value === ")")
         continue;
@@ -54134,6 +54484,139 @@ function rejectMigrationSqlReferences(tokens, allowIdentityHelpers = false) {
   }
 }
 
+// packages/contracts/dist/database-migration-capture.js
+var MAX_NAME_BYTES = 63;
+function readMigrationCaptureTrigger(tokens) {
+  if (!isSqlKeyword(tokens[0], "create") || !isSqlKeyword(tokens[1], "trigger"))
+    return void 0;
+  if (!tokens.some((token) => isNamedPgcf(token, true)))
+    return void 0;
+  return new CaptureReader(tokens).read();
+}
+var CaptureReader = class {
+  tokens;
+  position = 2;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  read() {
+    const trigger = this.triggerName();
+    this.expectKeyword("after");
+    const operations = this.operations();
+    this.expectKeyword("on");
+    const schema = this.name();
+    this.expectSymbol(".");
+    const table = this.name();
+    if (!isDatabaseWatchSchema(schema))
+      throw unsupported();
+    for (const keyword of ["for", "each", "row", "execute", "function"]) {
+      this.expectKeyword(keyword);
+    }
+    const header = this.tokens.slice(0, this.position);
+    if (!isNamedPgcf(this.token(), false))
+      throw unsupported();
+    this.position += 1;
+    this.expectSymbol(".");
+    this.expectCapture();
+    this.expectSymbol("(");
+    const columns = this.columns();
+    this.expectSymbol(")");
+    if (this.position !== this.tokens.length)
+      throw unsupported();
+    return Object.freeze({
+      target: Object.freeze({ trigger, schema, table, operations, columns }),
+      header
+    });
+  }
+  triggerName() {
+    const token = this.token();
+    if (token.kind !== "word" && token.kind !== "identifier" || !isDatabaseWatchIdentifier(token.value)) {
+      throw unsupported();
+    }
+    this.position += 1;
+    return token.value;
+  }
+  /** Table and schema names may be quoted identifiers; the executor checks the catalog for the exact name. */
+  name() {
+    const token = this.token();
+    const valid = token.kind === "word" ? isDatabaseWatchIdentifier(token.value) : token.kind === "identifier" && isQuotedName(token.value);
+    if (!valid)
+      throw unsupported();
+    this.position += 1;
+    return token.value;
+  }
+  operations() {
+    const events = [];
+    do {
+      const token = this.token();
+      const operation = DATABASE_WATCH_OPERATIONS.find((name) => isSqlKeyword(token, name));
+      if (operation === void 0 || events.includes(operation))
+        throw unsupported();
+      this.position += 1;
+      events.push(operation);
+    } while (this.takeKeyword("or"));
+    return DATABASE_WATCH_OPERATIONS.filter((operation) => events.includes(operation));
+  }
+  expectCapture() {
+    const token = this.token();
+    if (token.kind !== "word" && token.kind !== "identifier" || token.value !== "capture") {
+      throw unsupported();
+    }
+    this.position += 1;
+  }
+  columns() {
+    const columns = [];
+    do {
+      const token = this.token();
+      if (columns.length >= DATABASE_WATCH_MAX_COLUMNS || token.kind !== "string" || token.text !== `'${token.value}'` || !isDatabaseWatchIdentifier(token.value) || columns.includes(token.value)) {
+        throw unsupported();
+      }
+      this.position += 1;
+      columns.push(token.value);
+    } while (this.takeSymbol(","));
+    return columns;
+  }
+  token() {
+    const token = this.tokens[this.position];
+    if (token === void 0)
+      throw unsupported();
+    return token;
+  }
+  takeKeyword(keyword) {
+    if (!isSqlKeyword(this.tokens[this.position], keyword))
+      return false;
+    this.position += 1;
+    return true;
+  }
+  expectKeyword(keyword) {
+    if (!this.takeKeyword(keyword))
+      throw unsupported();
+  }
+  takeSymbol(symbol) {
+    const token = this.tokens[this.position];
+    if (token?.kind !== "symbol" || token.value !== symbol)
+      return false;
+    this.position += 1;
+    return true;
+  }
+  expectSymbol(symbol) {
+    if (!this.takeSymbol(symbol))
+      throw unsupported();
+  }
+};
+function isNamedPgcf(token, ignoreCase) {
+  if (token.kind !== "word" && token.kind !== "identifier")
+    return false;
+  return ignoreCase ? token.value.toLowerCase() === "pgcf" : token.value === "pgcf";
+}
+function isQuotedName(value) {
+  const bytes = new TextEncoder().encode(value).byteLength;
+  return bytes >= 1 && bytes <= MAX_NAME_BYTES;
+}
+function unsupported() {
+  return new DatabaseMigrationAdmissionError("unsupported");
+}
+
 // packages/contracts/dist/database-migration-policies.js
 var PolicyReader = class {
   tokens;
@@ -54287,6 +54770,9 @@ function admitExpandOnlyMigrations(migrations) {
       throw new DatabaseMigrationAdmissionError("invalid");
     }
     const statements = parseDatabaseMigrationStatements(sql);
+    if (statements.some((statement) => statement.captureTrigger !== void 0 && isDatabaseWatchTriggerName(statement.captureTrigger.trigger))) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
     statementCount += statements.length;
     return Object.freeze({ path: migration.path, statementCount: statements.length });
   });
@@ -54300,6 +54786,11 @@ function parseDatabaseMigrationStatements(sql) {
   if (statements.length === 0)
     throw new DatabaseMigrationAdmissionError("invalid");
   return Object.freeze(statements.map((statement) => {
+    const capture = readMigrationCaptureTrigger(statement.tokens);
+    if (capture !== void 0) {
+      rejectMigrationSqlReferences(capture.header);
+      return Object.freeze({ sql: statement.sql, captureTrigger: capture.target });
+    }
     rejectMigrationSqlReferences(statement.tokens, true);
     const rlsTarget = readMigrationRlsTarget(statement.tokens);
     if (rlsTarget !== void 0)