@amerged/ohmyhost-mcp 0.1.44 → 0.1.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/mcp",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/mcp/src/local-client.ts

@@ -20,6 +20,10 @@ import {
   assertDatabaseScheduleRunAccepted,
   assertDatabaseScheduleRunPage,
   assertDatabaseWebhookCreated,
+  assertDatabaseWatch,
+  assertDatabaseWatchDeleted,
+  assertDatabaseWatchPage,
+  DATABASE_WATCH_DEFAULT_SCHEMA,
   assertDatabaseWebhookDeleted,
   assertDatabaseWebhookDeliveryPage,
   assertDatabaseWebhookPage,
@@ -115,6 +119,10 @@ import {
   createProjectDatabaseWebhook,
   listProjectDatabaseWebhooks,
   deleteProjectDatabaseWebhook,
+  createProjectDatabaseTable,
+  createProjectDatabaseWatch,
+  listProjectDatabaseWatches,
+  deleteProjectDatabaseWatch,
   testProjectDatabaseWebhook,
   listProjectDatabaseWebhookDeliveries,
   replayProjectDatabaseWebhookDelivery,
@@ -177,6 +185,8 @@ import {
   type LocalProfile,
   type ProfileRegistry,
   type WorkspaceSession,
+  type DatabaseTableAnswer,
+  assertDatabaseTableAnswer,
 } from "@ohmyhost/product-cli";
 
 export class OperationEventsUnavailableError extends Error {
@@ -849,6 +859,83 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     requireScope(value.items.every((webhook) => webhook.environment === environment));
     return value;
   }
+  public async listDatabaseWatches(
+    input: Parameters<LocalMcpProductClient["listDatabaseWatches"]>[0],
+  ) {
+    const environment = input.environment ?? "dev";
+    const value = await listProjectDatabaseWatches(
+      { project_id: input.projectId, environment },
+      { client: this.#client },
+    );
+    assertDatabaseWatchPage(value);
+    requireScope(value.items.every((watch) => watch.environment === environment));
+    return value;
+  }
+  public async createDatabaseWatch(
+    input: Parameters<LocalMcpProductClient["createDatabaseWatch"]>[0],
+  ) {
+    const value = await createProjectDatabaseWatch(
+      {
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        databaseWatchCreateRequest: {
+          environment: input.environment,
+          ...(input.schema === undefined ? {} : { schema: input.schema }),
+          table: input.table,
+          columns: [...input.columns],
+          ...(input.operations === undefined ? {} : { operations: [...input.operations] }),
+        },
+      },
+      { client: this.#client },
+    );
+    assertDatabaseWatch(value);
+    requireScope(
+      value.environment === input.environment &&
+        value.table === input.table &&
+        value.schema === (input.schema ?? DATABASE_WATCH_DEFAULT_SCHEMA),
+    );
+    return value;
+  }
+  public async createDatabaseTable(
+    input: Parameters<LocalMcpProductClient["createDatabaseTable"]>[0],
+  ): Promise<DatabaseTableAnswer> {
+    const value = await createProjectDatabaseTable(
+      {
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        databaseTableCreateRequest: {
+          environment: input.environment,
+          table: input.table,
+          columns: [...input.columns],
+          ...(input.primaryKey === undefined || input.primaryKey.length === 0
+            ? {}
+            : { primary_key: [...input.primaryKey] }),
+        },
+      },
+      { client: this.#client },
+    );
+    assertDatabaseTableAnswer(value);
+    requireScope(
+      value.table.environment === input.environment && value.table.table === input.table,
+    );
+    return value;
+  }
+  public async deleteDatabaseWatch(
+    input: Parameters<LocalMcpProductClient["deleteDatabaseWatch"]>[0],
+  ) {
+    const value = await deleteProjectDatabaseWatch(
+      {
+        project_id: input.projectId,
+        environment: input.environment,
+        "Idempotency-Key": input.idempotencyKey,
+        watch_id: input.watchId,
+      },
+      { client: this.#client },
+    );
+    assertDatabaseWatchDeleted(value);
+    requireScope(value.id === input.watchId);
+    return value;
+  }
   /** The signing secret exists only in this response and is never stored by the client. */
   public async createDatabaseWebhook(
     input: Parameters<LocalMcpProductClient["createDatabaseWebhook"]>[0],

package/src/apps/mcp/src/local-server.ts

@@ -8,16 +8,22 @@ import {
   DATABASE_SCHEDULE_MIN_EVERY_SECONDS,
   DATABASE_SCHEDULE_MIN_TIMEOUT_MS,
   DATABASE_SCHEDULE_STATEMENT_MAX_BYTES,
+  DATABASE_WATCH_OPERATIONS,
+  isDatabaseWatchSchema,
+  isDatabaseWebhookEventPattern,
   type DatabaseExecutionUsagePage,
   type DatabaseSchedule,
   type DatabaseSchedulePage,
   type DatabaseScheduleDeleted,
   type DatabaseScheduleRunAccepted,
   type DatabaseScheduleRunPage,
+  type DatabaseWatch,
+  type DatabaseWatchDeleted,
+  type DatabaseWatchPage,
   type DatabaseWebhookCreated,
   type DatabaseWebhookDeleted,
   type DatabaseWebhookDeliveryPage,
-  type DatabaseWebhookEventType,
+  type DatabaseWebhookEventPattern,
   type DatabaseWebhookPage,
   type DatabaseWebhookReplayAccepted,
   type DatabaseWebhookTestResult,
@@ -76,6 +82,15 @@ import {
   type ProfileRequestInput,
 } from "@ohmyhost/product-cli";
 import { createOhmyhostMcpServer } from "./index.js";
+import type { DatabaseTableAnswer, DatabaseTableColumnInput } from "@ohmyhost/product-cli";
+import {
+  DATABASE_TABLE_COLUMN_TYPES,
+  DATABASE_TABLE_DEFAULTS,
+  DATABASE_TABLE_MAX_COLUMNS,
+  DATABASE_TABLE_MAX_PRIMARY_KEY_COLUMNS,
+  isDatabaseTableIdentifier,
+  parseDatabaseTableCreateRequest,
+} from "@ohmyhost/contracts/database-tables";
 
 import type {
   CurrentIdentity,
@@ -323,11 +338,38 @@ export interface LocalMcpProductClient {
     readonly projectId: string;
     readonly environment?: DatabaseEnvironment;
   }): Promise<DatabaseWebhookPage>;
+  createDatabaseTable(input: {
+    readonly projectId: string;
+    readonly environment: DatabaseEnvironment;
+    readonly table: string;
+    readonly columns: readonly DatabaseTableColumnInput[];
+    readonly primaryKey?: readonly string[];
+    readonly idempotencyKey: string;
+  }): Promise<DatabaseTableAnswer>;
+  listDatabaseWatches(input: {
+    readonly projectId: string;
+    readonly environment?: DatabaseEnvironment;
+  }): Promise<DatabaseWatchPage>;
+  createDatabaseWatch(input: {
+    readonly projectId: string;
+    readonly environment: DatabaseEnvironment;
+    readonly schema?: string;
+    readonly table: string;
+    readonly columns: readonly string[];
+    readonly operations?: readonly (typeof DATABASE_WATCH_OPERATIONS)[number][];
+    readonly idempotencyKey: string;
+  }): Promise<DatabaseWatch>;
+  deleteDatabaseWatch(input: {
+    readonly projectId: string;
+    readonly environment: DatabaseEnvironment;
+    readonly watchId: string;
+    readonly idempotencyKey: string;
+  }): Promise<DatabaseWatchDeleted>;
   createDatabaseWebhook(input: {
     readonly projectId: string;
     readonly environment: DatabaseEnvironment;
     readonly url: string;
-    readonly eventTypes: readonly DatabaseWebhookEventType[];
+    readonly eventTypes: readonly DatabaseWebhookEventPattern[];
     readonly headers: Readonly<Record<string, string>>;
     readonly idempotencyKey: string;
   }): Promise<DatabaseWebhookCreated>;
@@ -539,7 +581,10 @@ interface ProjectDeleteInput {
 const identifier = z.string().min(1).max(256);
 const databaseEnvironment = z.enum(["dev", "prod"]);
 const databaseWebhookId = z.string().regex(/^whk_[a-z0-9]{20}$/u);
+const databaseWatchId = z.string().regex(/^pgcf_watch_[0-9a-f]{8}$/u);
+const databaseIdentifier = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/u);
 const databaseDeliveryId = z.string().regex(/^dlv_[0-9a-f]{20}$/u);
+const databaseTableIdentifier = z.string().refine(isDatabaseTableIdentifier);
 const databaseScheduleName = z.string().regex(/^[a-z][a-z0-9_-]{0,62}$/u);
 /** Every product tool accepts the saved login to act as; it is an alias, never a credential. */
 const profileName = z
@@ -1122,6 +1167,122 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
       client.revokeDatabaseAccess({ projectId: input.project_id, accessId: input.access_id }),
     destructiveAnnotations(),
   );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_watch_list",
+    "List this project's database watches of one Dev or Prod environment (dev when omitted). Each watch shows its table, columns, operations and the event type data.<topic> it publishes. Listing wakes a sleeping database.",
+    z.object({ project_id: identifier, environment: databaseEnvironment.optional() }),
+    (client, input) =>
+      client.listDatabaseWatches({
+        projectId: input.project_id,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_watch_create",
+    "Publish row changes of one table of a Dev or Prod database as data events: only the listed columns (at most 32) of each insert, update or delete are published, with the event type data.<topic> returned by this call. Pass that event type to database_webhook_create. The table must exist as an ordinary table of the application, created by a deployed migration; a sleeping database wakes. Rows written before the watch exists are not published, and a published column must not be dropped while the watch exists. Requires confirmed: true and an idempotency key. Refused with project_budget_exceeded while the Stop budget is reached.",
+    z.object({
+      project_id: identifier,
+      environment: databaseEnvironment,
+      schema: databaseIdentifier.refine(isDatabaseWatchSchema).optional(),
+      table: databaseIdentifier,
+      columns: z
+        .array(databaseIdentifier)
+        .min(1)
+        .max(32)
+        .refine((columns) => new Set(columns).size === columns.length),
+      operations: z
+        .array(z.enum(DATABASE_WATCH_OPERATIONS))
+        .min(1)
+        .max(3)
+        .refine((operations) => new Set(operations).size === operations.length)
+        .optional(),
+      idempotency_key: idempotencyKey,
+      confirmed: z.literal(true),
+    }),
+    (client, input) =>
+      client.createDatabaseWatch({
+        projectId: input.project_id,
+        environment: input.environment,
+        ...(input.schema === undefined ? {} : { schema: input.schema }),
+        table: input.table,
+        columns: input.columns,
+        ...(input.operations === undefined ? {} : { operations: input.operations }),
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_watch_delete",
+    "Remove the capture trigger of one database watch: its table publishes no more data events. Destructive: requires confirmed: true and an idempotency key. Deleting an already deleted watch answers not found.",
+    z.object({
+      project_id: identifier,
+      environment: databaseEnvironment,
+      watch_id: databaseWatchId,
+      idempotency_key: idempotencyKey,
+      confirmed: z.literal(true),
+    }),
+    (client, input) =>
+      client.deleteDatabaseWatch({
+        projectId: input.project_id,
+        environment: input.environment,
+        watchId: input.watch_id,
+        idempotencyKey: input.idempotency_key,
+      }),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "database_table_create",
+    "Create one ordinary table in the public schema of a Dev or Prod database, as the migration role with the same access as migration tables, so a database_watch_create can attach later. Each column has a lower-case name, a type (text, integer, bigint, boolean, numeric, double precision, timestamptz, date, uuid or jsonb) and optional nullable, identity (integer or bigint only) and default (now for timestamptz, uuid for uuid); at most 64 columns, 8 primary-key columns and 100 tables per database. An identical repeat answers created: false; a table of the same name with another definition is refused with database_table_conflict. Tables created this way are not in the repository's migration files: record them in project notes and add a migration when the source should reproduce the database. Requires confirmed: true and an idempotency key. Refused with project_budget_exceeded while the Stop budget is reached.",
+    z.object({
+      project_id: identifier,
+      environment: databaseEnvironment,
+      table: databaseTableIdentifier,
+      columns: z
+        .array(
+          z.object({
+            name: databaseTableIdentifier,
+            type: z.enum(DATABASE_TABLE_COLUMN_TYPES),
+            nullable: z.boolean().optional(),
+            identity: z.boolean().optional(),
+            default: z.enum(DATABASE_TABLE_DEFAULTS).optional(),
+          }),
+        )
+        .min(1)
+        .max(DATABASE_TABLE_MAX_COLUMNS),
+      primary_key: z
+        .array(databaseTableIdentifier)
+        .min(1)
+        .max(DATABASE_TABLE_MAX_PRIMARY_KEY_COLUMNS)
+        .optional(),
+      idempotency_key: idempotencyKey,
+      confirmed: z.literal(true),
+    }),
+    (client, input) => {
+      // The contract checks the column types, identity and defaults, unique names and key columns before any call.
+      const request = parseDatabaseTableCreateRequest({
+        table: input.table,
+        columns: input.columns,
+        ...(input.primary_key === undefined ? {} : { primaryKey: input.primary_key }),
+      });
+      return client.createDatabaseTable({
+        projectId: input.project_id,
+        environment: input.environment,
+        table: request.table,
+        columns: input.columns,
+        ...(request.primaryKey.length === 0 ? {} : { primaryKey: request.primaryKey }),
+        idempotencyKey: input.idempotency_key,
+      });
+    },
+    mutationAnnotations(),
+  );
   registerProductTool(
     server,
     dependencies,
@@ -1138,7 +1299,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_webhook_create",
-    "Subscribe one HTTPS receiver to database lifecycle events (database.created, ready, woke, slept, suspended, resized, deleted) of one Dev or Prod database. The signing secret is RETURNED EXACTLY ONCE: store it in a secret manager and never write it into files, notes, source, commit messages or later messages. Deliveries are signed, retried and dead-lettered when retries stop. At most five webhooks exist per project environment. Requires confirmed: true and an idempotency key; the same key with the same request returns the stored answer.",
+    "Subscribe one HTTPS receiver to database lifecycle events (database.created, ready, woke, slept, suspended, resized, deleted) of one Dev or Prod database, or to data events: data.<topic> for the rows of one watched table (the event type database_watch_create returns) or data.* for every watched table; a bare * never matches data events. The signing secret is RETURNED EXACTLY ONCE: store it in a secret manager and never write it into files, notes, source, commit messages or later messages. Deliveries are signed, retried and dead-lettered when retries stop. At most five webhooks exist per project environment. Requires confirmed: true and an idempotency key; the same key with the same request returns the stored answer.",
     z.object({
       project_id: identifier,
       environment: databaseEnvironment,
@@ -1146,7 +1307,18 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
         .string()
         .max(2048)
         .regex(/^https:\/\//u),
-      event_types: z.array(z.enum(DATABASE_WEBHOOK_EVENT_TYPES)).min(1).max(16),
+      event_types: z
+        .array(
+          z.union([
+            z.enum(DATABASE_WEBHOOK_EVENT_TYPES),
+            z
+              .string()
+              .regex(/^data\.(?:\*|[a-z][a-z0-9_]{0,47})$/u)
+              .refine(isDatabaseWebhookEventPattern),
+          ]),
+        )
+        .min(1)
+        .max(16),
       headers: z.record(z.string(), z.string()).optional(),
       idempotency_key: idempotencyKey,
       confirmed: z.literal(true),

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -68,7 +68,15 @@ import {
   type CurrentCredential,
   type StoredCredential,
 } from "./credential-store.js";
-import type { ProductApi } from "./product-api.js";
+import type {
+  DatabaseTableColumnInput,
+  DatabaseTableCreateInput,
+  ProductApi,
+} from "./product-api.js";
+import {
+  parseDatabaseTableCreateRequest,
+  type DatabaseTableColumn,
+} from "@ohmyhost/contracts/database-tables";
 import {
   defaultProfileName,
   isProfileUserId,
@@ -419,8 +427,16 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost database access list --project ULID [--environment dev|prod] --json",
   "database access revoke":
     "ohmyhost database access revoke --project ULID --access ULID --yes --json",
+  "database watch create":
+    "ohmyhost database watch create --project ULID --environment dev|prod --table NAME [--schema public] --columns COL[,COL] [--operations insert,update,delete] --idempotency-key KEY --yes --json (publishes only the listed columns, at most 32, of each row change as the event type data.<topic> printed in this answer; the table must exist as an ordinary table of the application; a sleeping database wakes; next, subscribe with 'ohmyhost database webhook create ... --event-types data.<topic>')",
+  "database watch list":
+    "ohmyhost database watch list --project ULID [--environment dev|prod] --json (dev when omitted; a sleeping database wakes)",
+  "database watch delete":
+    "ohmyhost database watch delete --project ULID --environment dev|prod --watch ID --idempotency-key KEY --yes --json",
+  "database table create":
+    "ohmyhost database table create --project ULID --environment dev|prod --table NAME --columns-file PATH [--primary-key COL[,COL]] --idempotency-key KEY --yes --json (the table is created in the public schema as the migration role, with the same access as migration tables, so a database watch can attach later; the columns file is a UTF-8 JSON array of 1 to 64 column objects, at most 64 KiB, each with name, type and optional nullable, identity and default; types: text, integer, bigint, boolean, numeric, double precision, timestamptz, date, uuid, jsonb; identity needs integer or bigint; default now needs timestamptz and default uuid needs uuid; identical repeats answer created false; at most 100 tables, 64 columns per table)",
   "database webhook create":
-    "ohmyhost database webhook create --project ULID --environment dev|prod --url HTTPS_URL --event-types TYPE[,TYPE] [--headers-file PATH] --idempotency-key KEY --yes --json (the signing secret is shown once in this answer; types: database.created, database.ready, database.woke, database.slept, database.suspended, database.resized, database.deleted; the headers file is a UTF-8 JSON object of at most 8 KiB)",
+    "ohmyhost database webhook create --project ULID --environment dev|prod --url HTTPS_URL --event-types TYPE[,TYPE] [--headers-file PATH] --idempotency-key KEY --yes --json (the signing secret is shown once in this answer; types: database.created, database.ready, database.woke, database.slept, database.suspended, database.resized, database.deleted, data.<topic> for the rows of one watched table printed by database watch create, or data.* for every watched table; a bare * is not accepted and does not include data events; the headers file is a UTF-8 JSON object of at most 8 KiB)",
   "database webhook list":
     "ohmyhost database webhook list --project ULID [--environment dev|prod] --json (dev when omitted; the secret is never listed)",
   "database webhook get":
@@ -659,6 +675,9 @@ const SCHEDULE_STATEMENTS_FILE_INVALID_ACTION =
 const SCHEDULE_INVALID_ACTION =
   "Check the schedule request: --cron takes five fields in UTC (9 to 120 characters), or --every-seconds takes 60 to 2678400, never both; --timeout-ms takes 1000 to 30000; the statements file must hold 1 to 20 non-blank SQL strings of at most 16 KiB each and 64 KiB in total. Nothing was saved; fix it and run the command again.";
 
+const COLUMNS_FILE_INVALID_ACTION =
+  "Put one JSON array of 1 to 64 column objects in the file named by --columns-file: UTF-8, at most 64 KiB, each with a lower-case name, a type (text, integer, bigint, boolean, numeric, double precision, timestamptz, date, uuid or jsonb) and optional nullable, identity (integer or bigint only) and default (now for timestamptz, uuid for uuid). Each --primary-key column must be one of them, at most 8 names. Nothing was created; fix the file or the flags and run the command again.";
+
 const STATEMENT_FILE_INVALID_ACTION =
   "Put one INSERT, UPDATE or DELETE statement that starts with that keyword (no leading comment or WITH), UTF-8, at most 64 KiB, in the file named by --statement-file, then rerun with the same --idempotency-key.";
 
@@ -1191,6 +1210,14 @@ export class ProductCli {
         return await this.listDatabaseAccess(command, signal);
       if (command.kind === "database-access-revoke")
         return await this.revokeDatabaseAccess(command, signal);
+      if (command.kind === "database-watch-create")
+        return await this.createDatabaseWatch(command, signal);
+      if (command.kind === "database-watch-list")
+        return await this.listDatabaseWatches(command, signal);
+      if (command.kind === "database-watch-delete")
+        return await this.deleteDatabaseWatch(command, signal);
+      if (command.kind === "database-table-create")
+        return await this.createDatabaseTable(command, signal);
       if (command.kind === "database-webhook-create")
         return await this.createDatabaseWebhook(command, signal);
       if (command.kind === "database-webhook-list")
@@ -1952,6 +1979,67 @@ export class ProductCli {
     return success("database access revoke", { status: "succeeded", access });
   }
 
+  /** The answer names the event type to subscribe to; the watch already carries the columns and the topic. */
+  private async createDatabaseWatch(
+    command: Extract<ProductCliCommand, { kind: "database-watch-create" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const watch = await api.createProjectDatabaseWatch({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      request: command.request,
+    });
+    return success("database watch create", {
+      status: "succeeded",
+      watch,
+      next_action: `Run '${this.dependencies.commandPrefix} database webhook create --project ${command.projectId} --environment ${command.environment} --url HTTPS_URL --event-types ${watch.event_type} --idempotency-key KEY --yes --json' to receive ${watch.event_type} events at an HTTPS receiver.`,
+    });
+  }
+
+  private async listDatabaseWatches(
+    command: Extract<ProductCliCommand, { kind: "database-watch-list" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const page = await api.listProjectDatabaseWatches({
+      projectId: command.projectId,
+      environment: command.environment,
+    });
+    return success("database watch list", { status: "succeeded", watch: page.items });
+  }
+
+  private async deleteDatabaseWatch(
+    command: Extract<ProductCliCommand, { kind: "database-watch-delete" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const deleted = await api.deleteProjectDatabaseWatch({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      watchId: command.watchId,
+    });
+    return success("database watch delete", { status: "succeeded", deleted });
+  }
+
+  /** The columns file and the key are checked before any request; a repeat answers the same table with created false. */
+  private async createDatabaseTable(
+    command: Extract<ProductCliCommand, { kind: "database-table-create" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const request = await tableCreateRequest(command);
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const answer = await api.createProjectDatabaseTable({
+      projectId: command.projectId,
+      environment: command.environment,
+      idempotencyKey: command.idempotencyKey,
+      request,
+    });
+    return success("database table create", { status: "succeeded", table: answer.table });
+  }
+
   /** The signing secret is returned by create only; every other answer carries no secret. */
   private async createDatabaseWebhook(
     command: Extract<ProductCliCommand, { kind: "database-webhook-create" }>,
@@ -3422,6 +3510,49 @@ const scheduleSetRequest = async (
   }
 };
 
+/**
+ * The table of `database table create`: the columns file is a UTF-8 JSON array, and the table, the
+ * columns and the key are checked by the contract the service uses. A refused file sends nothing.
+ */
+const tableCreateRequest = async (
+  command: Extract<ProductCliCommand, { kind: "database-table-create" }>,
+): Promise<DatabaseTableCreateInput> => {
+  const columnsFailure = () =>
+    new ProductCliFailure(2, "columns_file_invalid", false, COLUMNS_FILE_INVALID_ACTION);
+  const columns = await readBoundedUtf8File(command.columnsFile, 65_536, columnsFailure).then(
+    (text: string): unknown => {
+      try {
+        return JSON.parse(text) as unknown;
+      } catch {
+        throw columnsFailure();
+      }
+    },
+  );
+  try {
+    const parsed = parseDatabaseTableCreateRequest({
+      table: command.table,
+      columns,
+      ...(command.primaryKey.length === 0 ? {} : { primaryKey: command.primaryKey }),
+    });
+    return {
+      table: parsed.table,
+      columns: parsed.columns.map(tableColumnInput),
+      primaryKey: parsed.primaryKey,
+    };
+  } catch {
+    throw columnsFailure();
+  }
+};
+
+/** The checked column as the REST body names it; a default that is not set is left out, not sent as null. */
+const tableColumnInput = (column: DatabaseTableColumn): DatabaseTableColumnInput => ({
+  name: column.name,
+  type: column.type,
+  nullable: column.nullable,
+  identity: column.identity,
+  ...(column.default === null ? {} : { default: column.default }),
+});
+
 const psqlUnavailable = (): CliResult =>
   failure(
     "database psql",
@@ -3526,6 +3657,10 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "database-access-list") return "database access list";
   if (command.kind === "database-access-revoke") return "database access revoke";
   if (command.kind === "database-psql") return "database psql";
+  if (command.kind === "database-watch-create") return "database watch create";
+  if (command.kind === "database-watch-list") return "database watch list";
+  if (command.kind === "database-watch-delete") return "database watch delete";
+  if (command.kind === "database-table-create") return "database table create";
   if (command.kind === "database-webhook-create") return "database webhook create";
   if (command.kind === "database-webhook-list") return "database webhook list";
   if (command.kind === "database-webhook-get") return "database webhook get";