@amerged/ohmyhost-mcp 0.1.43 → 0.1.45

package/src/apps/mcp/src/local-server.ts

@@ -8,16 +8,22 @@ import {
   DATABASE_SCHEDULE_MIN_EVERY_SECONDS,
   DATABASE_SCHEDULE_MIN_TIMEOUT_MS,
   DATABASE_SCHEDULE_STATEMENT_MAX_BYTES,
+  DATABASE_WATCH_OPERATIONS,
+  isDatabaseWatchSchema,
+  isDatabaseWebhookEventPattern,
   type DatabaseExecutionUsagePage,
   type DatabaseSchedule,
   type DatabaseSchedulePage,
   type DatabaseScheduleDeleted,
   type DatabaseScheduleRunAccepted,
   type DatabaseScheduleRunPage,
+  type DatabaseWatch,
+  type DatabaseWatchDeleted,
+  type DatabaseWatchPage,
   type DatabaseWebhookCreated,
   type DatabaseWebhookDeleted,
   type DatabaseWebhookDeliveryPage,
-  type DatabaseWebhookEventType,
+  type DatabaseWebhookEventPattern,
   type DatabaseWebhookPage,
   type DatabaseWebhookReplayAccepted,
   type DatabaseWebhookTestResult,
@@ -323,11 +329,30 @@ export interface LocalMcpProductClient {
     readonly projectId: string;
     readonly environment?: DatabaseEnvironment;
   }): Promise<DatabaseWebhookPage>;
+  listDatabaseWatches(input: {
+    readonly projectId: string;
+    readonly environment?: DatabaseEnvironment;
+  }): Promise<DatabaseWatchPage>;
+  createDatabaseWatch(input: {
+    readonly projectId: string;
+    readonly environment: DatabaseEnvironment;
+    readonly schema?: string;
+    readonly table: string;
+    readonly columns: readonly string[];
+    readonly operations?: readonly (typeof DATABASE_WATCH_OPERATIONS)[number][];
+    readonly idempotencyKey: string;
+  }): Promise<DatabaseWatch>;
+  deleteDatabaseWatch(input: {
+    readonly projectId: string;
+    readonly environment: DatabaseEnvironment;
+    readonly watchId: string;
+    readonly idempotencyKey: string;
+  }): Promise<DatabaseWatchDeleted>;
   createDatabaseWebhook(input: {
     readonly projectId: string;
     readonly environment: DatabaseEnvironment;
     readonly url: string;
-    readonly eventTypes: readonly DatabaseWebhookEventType[];
+    readonly eventTypes: readonly DatabaseWebhookEventPattern[];
     readonly headers: Readonly<Record<string, string>>;
     readonly idempotencyKey: string;
   }): Promise<DatabaseWebhookCreated>;
@@ -539,6 +564,8 @@ interface ProjectDeleteInput {
 const identifier = z.string().min(1).max(256);
 const databaseEnvironment = z.enum(["dev", "prod"]);
 const databaseWebhookId = z.string().regex(/^whk_[a-z0-9]{20}$/u);
+const databaseWatchId = z.string().regex(/^pgcf_watch_[0-9a-f]{8}$/u);
+const databaseIdentifier = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/u);
 const databaseDeliveryId = z.string().regex(/^dlv_[0-9a-f]{20}$/u);
 const databaseScheduleName = z.string().regex(/^[a-z][a-z0-9_-]{0,62}$/u);
 /** Every product tool accepts the saved login to act as; it is an alias, never a credential. */
@@ -1122,6 +1149,75 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
       client.revokeDatabaseAccess({ projectId: input.project_id, accessId: input.access_id }),
     destructiveAnnotations(),
   );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_watch_list",
+    "List this project's database watches of one Dev or Prod environment (dev when omitted). Each watch shows its table, columns, operations and the event type data.<topic> it publishes. Listing wakes a sleeping database.",
+    z.object({ project_id: identifier, environment: databaseEnvironment.optional() }),
+    (client, input) =>
+      client.listDatabaseWatches({
+        projectId: input.project_id,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_watch_create",
+    "Publish row changes of one table of a Dev or Prod database as data events: only the listed columns (at most 32) of each insert, update or delete are published, with the event type data.<topic> returned by this call. Pass that event type to database_webhook_create. The table must exist as an ordinary table of the application, created by a deployed migration; a sleeping database wakes. Rows written before the watch exists are not published, and a published column must not be dropped while the watch exists. Requires confirmed: true and an idempotency key. Refused with project_budget_exceeded while the Stop budget is reached.",
+    z.object({
+      project_id: identifier,
+      environment: databaseEnvironment,
+      schema: databaseIdentifier.refine(isDatabaseWatchSchema).optional(),
+      table: databaseIdentifier,
+      columns: z
+        .array(databaseIdentifier)
+        .min(1)
+        .max(32)
+        .refine((columns) => new Set(columns).size === columns.length),
+      operations: z
+        .array(z.enum(DATABASE_WATCH_OPERATIONS))
+        .min(1)
+        .max(3)
+        .refine((operations) => new Set(operations).size === operations.length)
+        .optional(),
+      idempotency_key: idempotencyKey,
+      confirmed: z.literal(true),
+    }),
+    (client, input) =>
+      client.createDatabaseWatch({
+        projectId: input.project_id,
+        environment: input.environment,
+        ...(input.schema === undefined ? {} : { schema: input.schema }),
+        table: input.table,
+        columns: input.columns,
+        ...(input.operations === undefined ? {} : { operations: input.operations }),
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_watch_delete",
+    "Remove the capture trigger of one database watch: its table publishes no more data events. Destructive: requires confirmed: true and an idempotency key. Deleting an already deleted watch answers not found.",
+    z.object({
+      project_id: identifier,
+      environment: databaseEnvironment,
+      watch_id: databaseWatchId,
+      idempotency_key: idempotencyKey,
+      confirmed: z.literal(true),
+    }),
+    (client, input) =>
+      client.deleteDatabaseWatch({
+        projectId: input.project_id,
+        environment: input.environment,
+        watchId: input.watch_id,
+        idempotencyKey: input.idempotency_key,
+      }),
+    destructiveAnnotations(),
+  );
   registerProductTool(
     server,
     dependencies,
@@ -1138,7 +1234,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_webhook_create",
-    "Subscribe one HTTPS receiver to database lifecycle events (database.created, ready, woke, slept, suspended, resized, deleted) of one Dev or Prod database. The signing secret is RETURNED EXACTLY ONCE: store it in a secret manager and never write it into files, notes, source, commit messages or later messages. Deliveries are signed, retried and dead-lettered when retries stop. At most five webhooks exist per project environment. Requires confirmed: true and an idempotency key; the same key with the same request returns the stored answer.",
+    "Subscribe one HTTPS receiver to database lifecycle events (database.created, ready, woke, slept, suspended, resized, deleted) of one Dev or Prod database, or to data events: data.<topic> for the rows of one watched table (the event type database_watch_create returns) or data.* for every watched table; a bare * never matches data events. The signing secret is RETURNED EXACTLY ONCE: store it in a secret manager and never write it into files, notes, source, commit messages or later messages. Deliveries are signed, retried and dead-lettered when retries stop. At most five webhooks exist per project environment. Requires confirmed: true and an idempotency key; the same key with the same request returns the stored answer.",
     z.object({
       project_id: identifier,
       environment: databaseEnvironment,
@@ -1146,7 +1242,18 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
         .string()
         .max(2048)
         .regex(/^https:\/\//u),
-      event_types: z.array(z.enum(DATABASE_WEBHOOK_EVENT_TYPES)).min(1).max(16),
+      event_types: z
+        .array(
+          z.union([
+            z.enum(DATABASE_WEBHOOK_EVENT_TYPES),
+            z
+              .string()
+              .regex(/^data\.(?:\*|[a-z][a-z0-9_]{0,47})$/u)
+              .refine(isDatabaseWebhookEventPattern),
+          ]),
+        )
+        .min(1)
+        .max(16),
       headers: z.record(z.string(), z.string()).optional(),
       idempotency_key: idempotencyKey,
       confirmed: z.literal(true),
@@ -1254,7 +1361,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_schedule_set",
-    "Create or replace a named database schedule that runs SQL statements repeatedly on a timer, as the application's own runtime role, so row-level security applies. Send exactly one of cron (five-field UTC expression) or every_seconds (60 to 2678400). Each run is cancelled after timeout_ms (1000 to 30000, default 10000). Statements run in order and must be safe to repeat: write idempotent statements. Destructive: requires confirmed: true.",
+    "Create or replace a named database schedule that runs SQL statements repeatedly on a timer, as the application's own runtime role, so row-level security applies. Send exactly one of cron (five-field UTC expression) or every_seconds (60 to 2678400). Each run is cancelled after timeout_ms (1000 to 30000, default 10000). Statements run in order and must be safe to repeat: write idempotent statements. Destructive: requires confirmed: true. A project whose Stop budget is reached has its schedules disabled automatically, within about an hour of the billed usage reaching the budget: the credit service does this after its hourly pgcf pass, and Continue budgets are never touched. While the budget is reached, schedule set with enabled true and schedule run are refused with project_budget_exceeded (HTTP 402). Re-enabling is manual: raise the budget (or wait for the next UTC month) and run database schedule set --enabled true again with the schedule body (read it with schedule get).",
     z
       .object({
         project_id: identifier,
@@ -1339,7 +1446,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_schedule_run_now",
-    "Queue one immediate run of a database schedule. Refused while the schedule is disabled or a run is already queued. Destructive: the statements execute against the database; requires confirmed: true. If the answer is lost, read database_schedule_run_list before calling again; a second call queues another run.",
+    "Queue one immediate run of a database schedule. Refused while the schedule is disabled or a run is already queued. Destructive: the statements execute against the database; requires confirmed: true. If the answer is lost, read database_schedule_run_list before calling again; a second call queues another run. Refused with project_budget_exceeded while the project's Stop budget is reached.",
     z.object({
       project_id: identifier,
       environment: databaseEnvironment,
@@ -1358,7 +1465,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_execution_usage_get",
-    "Read metered database execution usage: schedule runs and webhook attempts per UTC hour or day window. from and to are UTC timestamps with milliseconds (Z), aligned to the granularity, at most 31 days apart. Only completed windows are final. Rejected, skipped, event and delivery counts are reported but not billed.",
+    "Read metered database execution usage: schedule runs and webhook attempts per UTC hour or day window. from and to are UTC timestamps with milliseconds (Z), aligned to the granularity, at most 31 days apart. Only completed windows are final. The counts are counters only: executions have no price of their own, and the awake compute time of the database is what is billed.",
     z.object({
       project_id: identifier,
       environment: databaseEnvironment.optional(),

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -419,8 +419,14 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost database access list --project ULID [--environment dev|prod] --json",
   "database access revoke":
     "ohmyhost database access revoke --project ULID --access ULID --yes --json",
+  "database watch create":
+    "ohmyhost database watch create --project ULID --environment dev|prod --table NAME [--schema public] --columns COL[,COL] [--operations insert,update,delete] --idempotency-key KEY --yes --json (publishes only the listed columns, at most 32, of each row change as the event type data.<topic> printed in this answer; the table must exist as an ordinary table of the application; a sleeping database wakes; next, subscribe with 'ohmyhost database webhook create ... --event-types data.<topic>')",
+  "database watch list":
+    "ohmyhost database watch list --project ULID [--environment dev|prod] --json (dev when omitted; a sleeping database wakes)",
+  "database watch delete":
+    "ohmyhost database watch delete --project ULID --environment dev|prod --watch ID --idempotency-key KEY --yes --json",
   "database webhook create":
-    "ohmyhost database webhook create --project ULID --environment dev|prod --url HTTPS_URL --event-types TYPE[,TYPE] [--headers-file PATH] --idempotency-key KEY --yes --json (the signing secret is shown once in this answer; types: database.created, database.ready, database.woke, database.slept, database.suspended, database.resized, database.deleted; the headers file is a UTF-8 JSON object of at most 8 KiB)",
+    "ohmyhost database webhook create --project ULID --environment dev|prod --url HTTPS_URL --event-types TYPE[,TYPE] [--headers-file PATH] --idempotency-key KEY --yes --json (the signing secret is shown once in this answer; types: database.created, database.ready, database.woke, database.slept, database.suspended, database.resized, database.deleted, data.<topic> for the rows of one watched table printed by database watch create, or data.* for every watched table; a bare * is not accepted and does not include data events; the headers file is a UTF-8 JSON object of at most 8 KiB)",
   "database webhook list":
     "ohmyhost database webhook list --project ULID [--environment dev|prod] --json (dev when omitted; the secret is never listed)",
   "database webhook get":
@@ -434,7 +440,7 @@ const HELP_USAGE = Object.freeze({
   "database webhook replay":
     "ohmyhost database webhook replay --project ULID --environment dev|prod --delivery ID --yes --json",
   "database schedule set":
-    "ohmyhost database schedule set --project ULID --environment dev|prod --name NAME (--cron EXPR | --every-seconds N) --statements-file PATH [--timeout-ms N] [--enabled true|false] --yes --json (runs the statements in the file, a UTF-8 JSON array of 1 to 20 SQL strings, as the runtime role of the application; cron has five fields in UTC; every-seconds is 60 to 2678400; timeout-ms is 1000 to 30000, default 10000)",
+    "ohmyhost database schedule set --project ULID --environment dev|prod --name NAME (--cron EXPR | --every-seconds N) --statements-file PATH [--timeout-ms N] [--enabled true|false] --yes --json (runs the statements in the file, a UTF-8 JSON array of 1 to 20 SQL strings, as the runtime role of the application; cron has five fields in UTC; every-seconds is 60 to 2678400; timeout-ms is 1000 to 30000, default 10000). A project whose Stop budget is reached has its schedules disabled automatically, within about an hour of the billed usage reaching the budget: the credit service does this after its hourly pgcf pass, and Continue budgets are never touched. While the budget is reached, schedule set with enabled true and schedule run are refused with project_budget_exceeded (HTTP 402). Re-enabling is manual: raise the budget (or wait for the next UTC month) and run database schedule set --enabled true again with the schedule body (read it with schedule get).",
   "database schedule list":
     "ohmyhost database schedule list --project ULID [--environment dev|prod] --json (dev when omitted)",
   "database schedule get":
@@ -444,9 +450,9 @@ const HELP_USAGE = Object.freeze({
   "database schedule runs":
     "ohmyhost database schedule runs --project ULID [--environment dev|prod] --name NAME [--limit 1..50] --json",
   "database schedule run":
-    "ohmyhost database schedule run --project ULID --environment dev|prod --name NAME --yes --json (queues one run now, in addition to the timer)",
+    "ohmyhost database schedule run --project ULID --environment dev|prod --name NAME --yes --json (queues one run now, in addition to the timer; refused with project_budget_exceeded (HTTP 402) while the project's Stop budget is reached)",
   "database executions":
-    "ohmyhost database executions --project ULID [--environment dev|prod] --from ISO --to ISO --granularity hour|day [--limit 1..100] [--cursor CURSOR] --json (UTC timestamps like 2026-10-30T00:00:00.000Z aligned to the granularity, at most 31 days; counts schedule runs, webhook attempts and events per hour or day; usage counters only, nothing is charged for them until the operator prices them)",
+    "ohmyhost database executions --project ULID [--environment dev|prod] --from ISO --to ISO --granularity hour|day [--limit 1..100] [--cursor CURSOR] --json (UTC timestamps like 2026-10-30T00:00:00.000Z aligned to the granularity, at most 31 days; counts schedule runs, webhook attempts and events per hour or day; these are counters only, executions have no price of their own and the awake compute time of the database is what is billed)",
   "database psql":
     "ohmyhost database psql --project ULID --environment dev|prod [--mode read|write] [--ttl 5m|1h|24h|SECONDS] [--json] (starts local psql with a temporary credential and revokes it on exit)",
   link: "ohmyhost link --project ULID --repository-owner OWNER --repository-name REPOSITORY --idempotency-key KEY --json (uses the workspace GitHub connection and waits for the source-link operation)",
@@ -1191,6 +1197,12 @@ export class ProductCli {
         return await this.listDatabaseAccess(command, signal);
       if (command.kind === "database-access-revoke")
         return await this.revokeDatabaseAccess(command, signal);
+      if (command.kind === "database-watch-create")
+        return await this.createDatabaseWatch(command, signal);
+      if (command.kind === "database-watch-list")
+        return await this.listDatabaseWatches(command, signal);
+      if (command.kind === "database-watch-delete")
+        return await this.deleteDatabaseWatch(command, signal);
       if (command.kind === "database-webhook-create")
         return await this.createDatabaseWebhook(command, signal);
       if (command.kind === "database-webhook-list")
@@ -1952,6 +1964,51 @@ export class ProductCli {
     return success("database access revoke", { status: "succeeded", access });
   }
 
+  /** The answer names the event type to subscribe to; the watch already carries the columns and the topic. */
+  private async createDatabaseWatch(
+    command: Extract<ProductCliCommand, { kind: "database-watch-create" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const watch = await api.createProjectDatabaseWatch({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      request: command.request,
+    });
+    return success("database watch create", {
+      status: "succeeded",
+      watch,
+      next_action: `Run '${this.dependencies.commandPrefix} database webhook create --project ${command.projectId} --environment ${command.environment} --url HTTPS_URL --event-types ${watch.event_type} --idempotency-key KEY --yes --json' to receive ${watch.event_type} events at an HTTPS receiver.`,
+    });
+  }
+
+  private async listDatabaseWatches(
+    command: Extract<ProductCliCommand, { kind: "database-watch-list" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const page = await api.listProjectDatabaseWatches({
+      projectId: command.projectId,
+      environment: command.environment,
+    });
+    return success("database watch list", { status: "succeeded", watch: page.items });
+  }
+
+  private async deleteDatabaseWatch(
+    command: Extract<ProductCliCommand, { kind: "database-watch-delete" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const deleted = await api.deleteProjectDatabaseWatch({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      watchId: command.watchId,
+    });
+    return success("database watch delete", { status: "succeeded", deleted });
+  }
+
   /** The signing secret is returned by create only; every other answer carries no secret. */
   private async createDatabaseWebhook(
     command: Extract<ProductCliCommand, { kind: "database-webhook-create" }>,
@@ -3526,6 +3583,9 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "database-access-list") return "database access list";
   if (command.kind === "database-access-revoke") return "database access revoke";
   if (command.kind === "database-psql") return "database psql";
+  if (command.kind === "database-watch-create") return "database watch create";
+  if (command.kind === "database-watch-list") return "database watch list";
+  if (command.kind === "database-watch-delete") return "database watch delete";
   if (command.kind === "database-webhook-create") return "database webhook create";
   if (command.kind === "database-webhook-list") return "database webhook list";
   if (command.kind === "database-webhook-get") return "database webhook get";

package/src/apps/product-cli/src/command.ts

@@ -6,9 +6,12 @@ import {
   parseDatabaseListLimit,
   parseDatabaseScheduleName,
   parseDatabaseUsageWindow,
+  parseDatabaseWatchCreateRequest,
+  parseDatabaseWatchId,
   parseDatabaseWebhookCreateRequest,
   parseDatabaseWebhookId,
-  type DatabaseWebhookEventType,
+  type DatabaseWatchRequest,
+  type DatabaseWebhookEventPattern,
 } from "@ohmyhost/contracts/database-events";
 import {
   databaseSizeForMemory,
@@ -404,12 +407,36 @@ export type ProductCliCommand =
       readonly yes: true;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "database-watch-create";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly request: DatabaseWatchRequest;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-watch-list";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "database-watch-delete";
+      readonly projectId: string;
+      readonly environment: "dev" | "prod";
+      readonly watchId: string;
+      readonly idempotencyKey: string;
+      readonly yes: true;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "database-webhook-create";
       readonly projectId: string;
       readonly environment: "dev" | "prod";
       readonly url: string;
-      readonly eventTypes: readonly DatabaseWebhookEventType[];
+      readonly eventTypes: readonly DatabaseWebhookEventPattern[];
       readonly headersFile: string | null;
       readonly idempotencyKey: string;
       readonly yes: true;
@@ -1003,6 +1030,9 @@ export type RecognizedCommandLabel =
   | "database access create"
   | "database access list"
   | "database access revoke"
+  | "database watch create"
+  | "database watch list"
+  | "database watch delete"
   | "database webhook create"
   | "database webhook list"
   | "database webhook get"
@@ -1174,6 +1204,11 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       if (values[1] === "list") return "database access list";
       if (values[1] === "revoke") return "database access revoke";
     }
+    if (value === "database" && values[0] === "watch") {
+      if (values[1] === "create") return "database watch create";
+      if (values[1] === "list") return "database watch list";
+      if (values[1] === "delete") return "database watch delete";
+    }
     if (value === "database" && values[0] === "webhook") {
       if (values[1] === "create") return "database webhook create";
       if (values[1] === "list") return "database webhook list";
@@ -2063,6 +2098,92 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     }
     throw new InvalidCommandError();
   }
+  if (first === "database" && values[0] === "watch") {
+    values.shift();
+    const subcommand = values.shift();
+    if (subcommand === "create") {
+      if (!yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, [
+        "--project",
+        "--environment",
+        "--table",
+        "--schema",
+        "--columns",
+        "--operations",
+        "--idempotency-key",
+      ]);
+      const projectId = options["--project"],
+        environment = options["--environment"],
+        table = options["--table"],
+        schema = options["--schema"],
+        columns = options["--columns"],
+        operations = options["--operations"],
+        idempotencyKey = options["--idempotency-key"];
+      if (
+        !isValue(projectId) ||
+        !isValue(idempotencyKey) ||
+        !isValue(table) ||
+        !isValue(columns) ||
+        (environment !== "dev" && environment !== "prod")
+      )
+        throw new InvalidCommandError();
+      const request = contractValue(() =>
+        parseDatabaseWatchCreateRequest({
+          schema,
+          table,
+          columns: columns.split(","),
+          ...(operations === undefined ? {} : { operations: operations.split(",") }),
+        }),
+      );
+      return {
+        kind: "database-watch-create",
+        projectId,
+        environment,
+        request,
+        idempotencyKey,
+        yes: true,
+        credentialStore,
+      };
+    }
+    if (subcommand === "list") {
+      if (yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, ["--project", "--environment"]);
+      const projectId = options["--project"],
+        environment = options["--environment"] ?? "dev";
+      if (!isValue(projectId) || (environment !== "dev" && environment !== "prod"))
+        throw new InvalidCommandError();
+      return { kind: "database-watch-list", projectId, environment, credentialStore };
+    }
+    if (subcommand === "delete") {
+      if (!yes || wait || follow || revoke || stdin) throw new InvalidCommandError();
+      const options = parseOptionalOptions(values, [
+        "--project",
+        "--environment",
+        "--watch",
+        "--idempotency-key",
+      ]);
+      const projectId = options["--project"],
+        environment = options["--environment"],
+        watchId = options["--watch"],
+        idempotencyKey = options["--idempotency-key"];
+      if (
+        !isValue(projectId) ||
+        !isValue(idempotencyKey) ||
+        (environment !== "dev" && environment !== "prod")
+      )
+        throw new InvalidCommandError();
+      return {
+        kind: "database-watch-delete",
+        projectId,
+        environment,
+        watchId: contractValue(() => parseDatabaseWatchId(watchId)),
+        idempotencyKey,
+        yes: true,
+        credentialStore,
+      };
+    }
+    throw new InvalidCommandError();
+  }
   if (first === "database" && values[0] === "webhook") {
     values.shift();
     const subcommand = values.shift();

package/src/apps/product-cli/src/product-api.ts

@@ -33,6 +33,9 @@ import {
   assertDatabaseWebhookDeliveryPage,
   assertDatabaseWebhookPage,
   assertDatabaseWebhookReplayAccepted,
+  assertDatabaseWatch,
+  assertDatabaseWatchDeleted,
+  assertDatabaseWatchPage,
   assertDatabaseWebhookTest,
   type DatabaseExecutionUsagePage,
   type DatabaseSchedule,
@@ -45,7 +48,11 @@ import {
   type DatabaseWebhookCreated,
   type DatabaseWebhookDeleted,
   type DatabaseWebhookDeliveryPage,
-  type DatabaseWebhookEventType,
+  type DatabaseWatch,
+  type DatabaseWatchDeleted,
+  type DatabaseWatchPage,
+  type DatabaseWatchRequest,
+  type DatabaseWebhookEventPattern,
   type DatabaseWebhookPage,
   type DatabaseWebhookReplayAccepted,
   type DatabaseWebhookTestResult,
@@ -152,6 +159,9 @@ import {
   getProjectDatabaseWebhook,
   deleteProjectDatabaseWebhook,
   testProjectDatabaseWebhook,
+  createProjectDatabaseWatch,
+  listProjectDatabaseWatches,
+  deleteProjectDatabaseWatch,
   listProjectDatabaseWebhookDeliveries,
   replayProjectDatabaseWebhookDelivery,
   setProjectDatabaseSchedule,
@@ -328,7 +338,7 @@ export interface ProductApi {
     readonly environment: "dev" | "prod";
     readonly idempotencyKey: string;
     readonly url: string;
-    readonly eventTypes: readonly DatabaseWebhookEventType[];
+    readonly eventTypes: readonly DatabaseWebhookEventPattern[];
     readonly headers: Readonly<Record<string, string>>;
   }): Promise<DatabaseWebhookCreated>;
   listProjectDatabaseWebhooks(input: {
@@ -350,6 +360,22 @@ export interface ProductApi {
     readonly environment: "dev" | "prod";
     readonly webhookId: string;
   }): Promise<DatabaseWebhookTestResult>;
+  createProjectDatabaseWatch(input: {
+    readonly projectId: string;
+    readonly environment: "dev" | "prod";
+    readonly idempotencyKey: string;
+    readonly request: DatabaseWatchRequest;
+  }): Promise<DatabaseWatch>;
+  listProjectDatabaseWatches(input: {
+    readonly projectId: string;
+    readonly environment: "dev" | "prod";
+  }): Promise<DatabaseWatchPage>;
+  deleteProjectDatabaseWatch(input: {
+    readonly projectId: string;
+    readonly environment: "dev" | "prod";
+    readonly idempotencyKey: string;
+    readonly watchId: string;
+  }): Promise<DatabaseWatchDeleted>;
   listProjectDatabaseWebhookDeliveries(input: {
     readonly projectId: string;
     readonly environment: "dev" | "prod";
@@ -566,6 +592,7 @@ export interface ProductApi {
 
 /** A webhook answer that names another environment, webhook or delivery than the request did. */
 const WEBHOOK_SCOPE_MISMATCH = "Webhook response scope mismatch";
+const WATCH_SCOPE_MISMATCH = "Watch response scope mismatch";
 /** A schedule answer that names another environment or schedule than the request did. */
 const SCHEDULE_SCOPE_MISMATCH = "Schedule response scope mismatch";
 
@@ -889,6 +916,63 @@ export class GeneratedSdkProductApi implements ProductApi {
     return value;
   }
 
+  public async createProjectDatabaseWatch(
+    input: Parameters<ProductApi["createProjectDatabaseWatch"]>[0],
+  ): Promise<DatabaseWatch> {
+    const value = await createProjectDatabaseWatch(
+      {
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        databaseWatchCreateRequest: {
+          environment: input.environment,
+          schema: input.request.schema,
+          table: input.request.table,
+          columns: [...input.request.columns],
+          operations: [...input.request.operations],
+        },
+      },
+      { client: this.#client },
+    );
+    assertDatabaseWatch(value);
+    if (
+      value.environment !== input.environment ||
+      value.schema !== input.request.schema ||
+      value.table !== input.request.table
+    )
+      throw new TypeError(WATCH_SCOPE_MISMATCH);
+    return value;
+  }
+
+  public async listProjectDatabaseWatches(
+    input: Parameters<ProductApi["listProjectDatabaseWatches"]>[0],
+  ): Promise<DatabaseWatchPage> {
+    const value = await listProjectDatabaseWatches(
+      { project_id: input.projectId, environment: input.environment },
+      { client: this.#client },
+    );
+    assertDatabaseWatchPage(value);
+    if (value.items.some((item) => item.environment !== input.environment))
+      throw new TypeError(WATCH_SCOPE_MISMATCH);
+    return value;
+  }
+
+  public async deleteProjectDatabaseWatch(
+    input: Parameters<ProductApi["deleteProjectDatabaseWatch"]>[0],
+  ): Promise<DatabaseWatchDeleted> {
+    const value = await deleteProjectDatabaseWatch(
+      {
+        project_id: input.projectId,
+        environment: input.environment,
+        "Idempotency-Key": input.idempotencyKey,
+        watch_id: input.watchId,
+      },
+      { client: this.#client },
+    );
+    assertDatabaseWatchDeleted(value);
+    if (value.id !== input.watchId) throw new TypeError(WATCH_SCOPE_MISMATCH);
+    return value;
+  }
+
   /** The signing secret exists only in this answer; the CLI prints it once and stores nothing. */
   public async createProjectDatabaseWebhook(
     input: Parameters<ProductApi["createProjectDatabaseWebhook"]>[0],