@overaihq/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2428 @@
+#!/usr/bin/env node
+import "./chunk-MLKGABMK.js";
+
+// src/auth.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { createServer } from "http";
+import { hostname } from "os";
+
+// src/config.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var configDir = join(homedir(), ".overai");
+var configFilePath = join(configDir, "config.json");
+var readConfig = () => {
+  try {
+    return JSON.parse(readFileSync(configFilePath, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var writeConfig = (config) => {
+  mkdirSync(configDir, { recursive: true });
+  chmodSync(configDir, 448);
+  writeFileSync(configFilePath, `${JSON.stringify(config, null, 2)}
+`, {
+    mode: 384
+  });
+  chmodSync(configFilePath, 384);
+};
+var clearConfig = () => {
+  rmSync(configFilePath, { force: true });
+};
+
+// src/env.ts
+var trimSlash = (url) => url.replace(/\/+$/, "");
+var DEFAULT_API_BASE_URL = "https://api.overai.com";
+var apiBaseUrlOverride = process.env.OVERAI_API_URL != null ? trimSlash(process.env.OVERAI_API_URL) : void 0;
+var appBaseUrl = trimSlash(
+  process.env.OVERAI_APP_URL ?? "https://app.overai.com"
+);
+
+// src/api.ts
+var apiBaseUrl = () => apiBaseUrlOverride ?? readConfig()?.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+var trpcMutation = async (procedure, input) => {
+  const res = await fetch(
+    `${apiBaseUrl()}/v1/utils/trpc/unauthenticated/${procedure}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(input)
+    }
+  );
+  const body = await res.json().catch(() => null);
+  if (body != null && "error" in body) {
+    throw new Error(
+      body.error.message || `${procedure} failed (${String(res.status)})`
+    );
+  }
+  if (!res.ok || body == null || !("result" in body)) {
+    throw new Error(`${procedure} failed (${String(res.status)})`);
+  }
+  return body.result.data;
+};
+var exchangeCliAuthCode = (code, codeVerifier) => trpcMutation("exchangeCliAuthCode", { code, codeVerifier });
+var exchangeSessionToken = (refreshToken, destinationOrgId) => trpcMutation("exchangeSessionToken", {
+  refreshToken,
+  destinationOrgId
+});
+var signOutHeadless = (refreshToken) => trpcMutation("signOutHeadless", { refreshToken });
+var decodeJwtClaims = (token) => {
+  const payload = token.split(".")[1];
+  if (payload == null) return {};
+  try {
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  } catch {
+    return {};
+  }
+};
+var orgScopeOverride = null;
+var setOrgScope = (organizationId) => {
+  orgScopeOverride = organizationId;
+};
+var inFlightExchange = null;
+var processToken = null;
+var getAccessToken = async () => {
+  const config = readConfig();
+  if (config == null) {
+    throw new Error("Not signed in. Run `overai signin`.");
+  }
+  const targetOrgId = orgScopeOverride ?? config.organizationId;
+  const skewMs = 6e4;
+  if (targetOrgId === config.organizationId && config.accessToken != null && config.accessTokenExpiresAt != null && config.accessTokenExpiresAt - skewMs > Date.now()) {
+    return { token: config.accessToken, organizationId: config.organizationId };
+  }
+  if (processToken?.organizationId === targetOrgId && processToken.expiresAt - skewMs > Date.now()) {
+    return { token: processToken.token, organizationId: targetOrgId };
+  }
+  inFlightExchange ??= (async () => {
+    const result = await exchangeSessionToken(config.refreshToken, targetOrgId);
+    if (result.type === "redirect") {
+      throw new Error(
+        targetOrgId === config.organizationId ? "Your session expired. Run `overai signin`." : `Org ${targetOrgId} requires interactive sign-in (SSO). Run \`overai org switch ${targetOrgId}\`.`
+      );
+    }
+    const forActiveOrg = targetOrgId === config.organizationId;
+    writeConfig({
+      ...config,
+      email: decodeJwtClaims(result.token).email ?? config.email,
+      refreshToken: result.refreshToken,
+      accessToken: forActiveOrg ? result.token : config.accessToken,
+      accessTokenExpiresAt: forActiveOrg ? Date.now() + result.accessTokenValiditySeconds * 1e3 : config.accessTokenExpiresAt
+    });
+    processToken = {
+      organizationId: targetOrgId,
+      token: result.token,
+      expiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3
+    };
+    return { token: result.token, organizationId: targetOrgId };
+  })();
+  try {
+    return await inFlightExchange;
+  } finally {
+    inFlightExchange = null;
+  }
+};
+var v2Fetch = async (path, init) => {
+  const auth = await getAccessToken();
+  const headers = new Headers(init?.headers);
+  headers.set("Authorization", `Bearer ${auth.token}`);
+  return fetch(`${apiBaseUrl()}${path}`, { ...init, headers });
+};
+
+// src/browser.ts
+import { spawn } from "child_process";
+import { platform } from "os";
+var openBrowser = (url) => {
+  const [command, args] = platform() === "darwin" ? ["open", [url]] : platform() === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+};
+
+// src/pkce.ts
+import { createHash, randomBytes } from "crypto";
+var createPkcePair = () => {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+};
+
+// src/auth.ts
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var startCallbackServer = (expectedState) => {
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((resolve3, reject) => {
+    resolveCode = resolve3;
+    rejectCode = reject;
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/") {
+      res.writeHead(204).end();
+      return;
+    }
+    const respond = (message) => {
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end(
+        `<html><body style="font-family:sans-serif;text-align:center;padding:3rem"><p>${message}</p><p>You can close this tab.</p></body></html>`
+      );
+    };
+    const error = url.searchParams.get("error");
+    const state = url.searchParams.get("state");
+    const code = url.searchParams.get("code");
+    if (error != null) {
+      respond("Authorization was denied.");
+      rejectCode?.(new Error(`Authorization denied: ${error}`));
+      return;
+    }
+    if (state !== expectedState) {
+      respond("Invalid authorization state.");
+      rejectCode?.(new Error("State mismatch \u2014 aborting."));
+      return;
+    }
+    if (code == null) {
+      respond("Missing authorization code.");
+      rejectCode?.(new Error("No authorization code returned."));
+      return;
+    }
+    respond("Authorized! Return to your terminal.");
+    resolveCode?.(code);
+  });
+  let timeout;
+  const close = () => {
+    if (timeout != null) clearTimeout(timeout);
+    server.closeAllConnections();
+    server.close();
+  };
+  return new Promise((resolveServer, rejectServer) => {
+    server.on("error", rejectServer);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (address == null || typeof address === "string") {
+        rejectServer(new Error("Failed to bind loopback callback server."));
+        return;
+      }
+      timeout = setTimeout(() => {
+        rejectCode?.(new Error("Timed out waiting for browser authorization."));
+      }, CALLBACK_TIMEOUT_MS);
+      timeout.unref();
+      resolveServer({ port: address.port, codePromise, close });
+    });
+  });
+};
+var signIn = async () => {
+  const { verifier, challenge } = createPkcePair();
+  const state = randomBytes2(16).toString("base64url");
+  const { port, codePromise, close } = await startCallbackServer(state);
+  const authorizeUrl = `${appBaseUrl}/cli-auth?${new URLSearchParams({
+    redirect_uri: `http://127.0.0.1:${String(port)}`,
+    code_challenge: challenge,
+    state,
+    label: hostname()
+  }).toString()}`;
+  const autoOpen = process.env.OVERAI_NO_BROWSER == null;
+  process.stdout.write(
+    `${autoOpen ? "Opening your browser to authorize the CLI.\nIf it doesn't open, visit" : "Visit this URL to authorize the CLI"}:
+${authorizeUrl}
+`
+  );
+  if (autoOpen) openBrowser(authorizeUrl);
+  try {
+    const code = await codePromise;
+    const session = await exchangeCliAuthCode(code, verifier);
+    const email = decodeJwtClaims(session.token).email;
+    writeConfig({
+      refreshToken: session.refreshToken,
+      organizationId: session.organizationId,
+      apiBaseUrl: apiBaseUrlOverride ?? DEFAULT_API_BASE_URL,
+      email,
+      accessToken: session.token,
+      accessTokenExpiresAt: Date.now() + session.accessTokenValiditySeconds * 1e3
+    });
+    process.stdout.write(
+      `Signed in${email != null ? ` as ${email}` : ""} (org ${session.organizationId}).
+`
+    );
+  } finally {
+    close();
+  }
+};
+var signOut = async () => {
+  const config = readConfig();
+  if (config == null) {
+    process.stdout.write("Not signed in.\n");
+    return;
+  }
+  await signOutHeadless(config.refreshToken).catch(() => void 0);
+  clearConfig();
+  process.stdout.write("Signed out.\n");
+};
+var whoami = () => {
+  const config = readConfig();
+  if (config == null) {
+    process.stderr.write("Not signed in. Run `overai signin`.\n");
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(
+    `Signed in${config.email != null ? ` as ${config.email}` : ""} (org ${config.organizationId}).
+`
+  );
+};
+
+// src/args.ts
+var flagValue = (args, ...names) => {
+  for (const name of names) {
+    const i = args.indexOf(name);
+    if (i !== -1 && i + 1 < args.length) return args[i + 1];
+  }
+  return void 0;
+};
+var readStdin = async () => {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+};
+
+// src/gql.ts
+var gqlRequest = async (query, variables) => {
+  const res = await v2Fetch("/v2/graphql", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ query, variables })
+  });
+  const body = await res.json().catch(() => null);
+  if (body?.errors != null && body.errors.length > 0) {
+    throw new Error(body.errors.map((e) => e.message).join("; "));
+  }
+  if (!res.ok || body?.data == null) {
+    throw new Error(`graphql failed (${String(res.status)})`);
+  }
+  return body.data;
+};
+
+// src/output.ts
+var resolveFormat = (explicit) => {
+  if (explicit === "json" || explicit === "csv" || explicit === "table") {
+    return explicit;
+  }
+  if (explicit != null) {
+    throw new Error(
+      `Unknown output format "${explicit}". Use json, table, or csv.`
+    );
+  }
+  return process.stdout.isTTY ? "table" : "json";
+};
+var cell = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+};
+var formatResult = (data, format) => {
+  if (format === "json" || !Array.isArray(data)) {
+    return JSON.stringify(data, null, 2);
+  }
+  const records = data.map(
+    (row) => row != null && typeof row === "object" ? row : { value: row }
+  );
+  if (records.length === 0) return "(no rows)";
+  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
+  if (format === "csv") {
+    const escape = (value) => {
+      const text = cell(value);
+      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+    };
+    return [
+      columns.join(","),
+      ...records.map((r) => columns.map((c) => escape(r[c])).join(","))
+    ].join("\n");
+  }
+  const widths = columns.map(
+    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
+  );
+  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
+  return [
+    line(columns),
+    line(widths.map((w) => "-".repeat(w))),
+    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
+  ].join("\n");
+};
+var printResult = (data, format) => {
+  process.stdout.write(`${formatResult(data, format)}
+`);
+};
+
+// src/commands/automation.ts
+var runRuns = async (automationId, args) => {
+  const limit = Number(flagValue(args, "--limit") ?? 20);
+  const data = await gqlRequest(
+    `query CliAutomationRuns($automationId: String!, $first: Int!) {
+      automationRuns(condition: { automationId: $automationId }, orderBy: [STARTED_AT_DESC], first: $first) {
+        nodes { id startedAt endedAt errored isCancelled manuallyTriggered version { num } }
+      }
+    }`,
+    // Over-fetch when status-filtering so --failed still fills the limit.
+    {
+      automationId,
+      first: args.includes("--failed") || args.includes("--running") ? limit * 5 : limit
+    }
+  );
+  let runs = data.automationRuns.nodes;
+  if (args.includes("--failed")) runs = runs.filter((r) => r.errored);
+  if (args.includes("--running")) {
+    runs = runs.filter((r) => r.endedAt == null && !r.isCancelled);
+  }
+  printResult(
+    runs.slice(0, limit).map((r) => ({
+      id: r.id,
+      version: r.version?.num,
+      startedAt: r.startedAt,
+      endedAt: r.endedAt,
+      status: r.errored ? "errored" : r.isCancelled ? "cancelled" : r.endedAt == null ? "running" : "ok",
+      manual: r.manuallyTriggered
+    })),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var runState = async (runId, args) => {
+  const data = await gqlRequest(
+    `query CliAutomationRunState($id: String!) {
+      automationRun(id: $id) { state }
+    }`,
+    { id: runId }
+  );
+  if (data.automationRun == null) throw new Error(`Run ${runId} not found.`);
+  const node = flagValue(args, "--node");
+  const state = data.automationRun.state ?? {};
+  printResult(
+    node != null ? { [node]: state[node] ?? "(no state for this node)" } : state,
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var runTrigger = async (automationId, args) => {
+  const { organizationId } = await getAccessToken();
+  const body = {};
+  if (args.includes("-")) {
+    Object.assign(
+      body,
+      JSON.parse(await readStdin())
+    );
+  }
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--input") {
+      const pair = args[i + 1] ?? "";
+      const eq = pair.indexOf("=");
+      if (eq > 0) body[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+  }
+  const res = await v2Fetch(
+    `/v2/automations/${organizationId}/${automationId}/run`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    }
+  );
+  const responseBody = await res.json().catch(() => null);
+  if (!res.ok) {
+    throw new Error(
+      responseBody?.error ?? `run failed (${String(res.status)})`
+    );
+  }
+  printResult(responseBody, resolveFormat(flagValue(args, "-o", "--output")));
+};
+var runAutomation = async (args) => {
+  const [sub, id, ...rest] = args;
+  if (sub === "runs" && id != null) return runRuns(id, rest);
+  if (sub === "state" && id != null) return runState(id, rest);
+  if (sub === "run" && id != null) return runTrigger(id, rest);
+  process.stderr.write(
+    "Usage: overai automation runs <automationId> [--limit N] [--failed] [--running]\n       overai automation state <runId> [--node <variableId>]\n       overai automation run <automationId> [--input k=v ... | -]\n"
+  );
+  process.exitCode = 1;
+};
+
+// src/commands/dev.ts
+import { createHash as createHash2 } from "crypto";
+import { watch } from "fs";
+import { createServer as createServer2 } from "http";
+import { dirname as dirname2, join as join4 } from "path";
+
+// src/workspace/manifest.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, join as join2, resolve } from "path";
+var MANIFEST_DIR = ".overai";
+var MANIFEST_FILE = "manifest.json";
+var BASE_DIR = "base";
+var findWorkspaceRoot = (from = process.cwd()) => {
+  let dir = resolve(from);
+  for (; ; ) {
+    if (existsSync(join2(dir, MANIFEST_DIR, MANIFEST_FILE))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) {
+      throw new Error(
+        "Not inside a cloned workspace (no .overai/manifest.json found). Run `overai clone <workspaceId>` first."
+      );
+    }
+    dir = parent;
+  }
+};
+var readManifest = (root) => JSON.parse(
+  readFileSync2(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
+);
+var openClone = () => {
+  const root = findWorkspaceRoot();
+  const manifest = readManifest(root);
+  setOrgScope(manifest.organizationId);
+  return { root, manifest };
+};
+var writeManifest = (root, manifest) => {
+  mkdirSync2(join2(root, MANIFEST_DIR), { recursive: true });
+  writeFileSync2(
+    join2(root, MANIFEST_DIR, MANIFEST_FILE),
+    `${JSON.stringify(manifest, null, 2)}
+`
+  );
+};
+var basePath = (root, relPath) => join2(root, MANIFEST_DIR, BASE_DIR, relPath);
+var writeSynced = (root, relPath, content) => {
+  for (const abs of [join2(root, relPath), basePath(root, relPath)]) {
+    mkdirSync2(dirname(abs), { recursive: true });
+    writeFileSync2(abs, content);
+  }
+};
+var readWorkingFile = (root, relPath) => {
+  try {
+    return readFileSync2(join2(root, relPath), "utf8");
+  } catch {
+    return null;
+  }
+};
+var readBaseFile = (root, relPath) => {
+  try {
+    return readFileSync2(basePath(root, relPath), "utf8");
+  } catch {
+    return null;
+  }
+};
+var slugify = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "untitled";
+var localState = (root, resource) => {
+  const changedFiles = [];
+  let missing = false;
+  for (const relPath of resource.files) {
+    const working = readWorkingFile(root, relPath);
+    if (working == null) {
+      missing = true;
+      continue;
+    }
+    if (working !== readBaseFile(root, relPath)) changedFiles.push(relPath);
+  }
+  return {
+    state: missing ? "missing" : changedFiles.length > 0 ? "modified" : "unchanged",
+    changedFiles
+  };
+};
+
+// src/workspace/validateElements.ts
+var validateAutomationElements = async (elements) => {
+  const { automationNodesSchema } = await import("./types-5J3QQFGH.js");
+  const parsed = automationNodesSchema.safeParse(elements);
+  return parsed.success ? [] : parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+};
+
+// src/workspace/adapters.ts
+var metaJson = (value) => `${JSON.stringify(value, null, 2)}
+`;
+var fileBySuffix = (files, suffix) => {
+  const entry = Object.entries(files).find(([path]) => path.endsWith(suffix));
+  if (entry == null) throw new Error(`Missing local file (*${suffix}).`);
+  return entry[1];
+};
+var functionFiles = (id, name, version) => {
+  const stem = `functions/${slugify(name)}.${id}`;
+  return {
+    [`${stem}.ts`]: version.code,
+    [`${stem}.meta.json`]: metaJson({
+      inputSchema: version.inputSchema,
+      executionTimeout: version.executionTimeout,
+      executionMemory: version.executionMemory
+    })
+  };
+};
+var functionAdapter = {
+  type: "function",
+  fetchAll: async (workspaceId) => {
+    const data = await gqlRequest(
+      `query CliFunctions($workspaceId: String!) {
+        functions(condition: { workspaceId: $workspaceId }, includeArchived: NO) {
+          nodes {
+            id name
+            functionVersions(orderBy: [CREATED_AT_DESC], first: 1) {
+              nodes { versionNumber code inputSchema executionTimeout executionMemory }
+            }
+            functionDeployedVersion { versionNumber }
+          }
+        }
+      }`,
+      { workspaceId }
+    );
+    return data.functions.nodes.flatMap((fn) => {
+      const version = fn.functionVersions.nodes[0];
+      if (version == null) return [];
+      return [
+        {
+          id: fn.id,
+          name: fn.name,
+          latestVersion: version.versionNumber,
+          deployedVersion: fn.functionDeployedVersion?.versionNumber ?? null,
+          files: functionFiles(fn.id, fn.name, version)
+        }
+      ];
+    });
+  },
+  head: async (id) => {
+    const data = await gqlRequest(
+      `query CliFunctionHead($id: String!) {
+        function(id: $id) {
+          functionVersions(orderBy: [CREATED_AT_DESC], first: 1) { nodes { versionNumber } }
+          functionDeployedVersion { versionNumber }
+        }
+      }`,
+      { id }
+    );
+    if (data.function == null) throw new Error(`Function ${id} not found.`);
+    return {
+      latestVersion: data.function.functionVersions.nodes[0]?.versionNumber ?? 0,
+      deployedVersion: data.function.functionDeployedVersion?.versionNumber ?? null
+    };
+  },
+  fetchVersion: async (id, versionNumber, name) => {
+    const data = await gqlRequest(
+      `query CliFunctionVersion($functionId: String!, $versionNumber: Int!) {
+        functionVersion(functionId: $functionId, versionNumber: $versionNumber) {
+          versionNumber code inputSchema executionTimeout executionMemory
+        }
+      }`,
+      { functionId: id, versionNumber }
+    );
+    if (data.functionVersion == null) {
+      throw new Error(
+        `Function ${id} has no version ${String(versionNumber)}.`
+      );
+    }
+    return functionFiles(id, name, data.functionVersion);
+  },
+  push: async (id, files, message) => {
+    const meta = JSON.parse(fileBySuffix(files, ".meta.json"));
+    const data = await gqlRequest(
+      `mutation CliCreateFunctionVersion($functionId: String!, $code: String!, $message: String, $inputSchema: JSON, $executionTimeout: Int, $executionMemory: Int) {
+        createFunctionVersion(input: { functionVersion: {
+          functionId: $functionId, code: $code, message: $message,
+          inputSchema: $inputSchema, executionTimeout: $executionTimeout, executionMemory: $executionMemory
+        }}) { functionVersion { versionNumber } }
+      }`,
+      {
+        functionId: id,
+        code: fileBySuffix(files, ".ts"),
+        message,
+        inputSchema: meta.inputSchema,
+        // Match the webapp's save defaults so a missing meta doesn't zero out limits.
+        executionTimeout: meta.executionTimeout ?? 1e4,
+        executionMemory: meta.executionMemory ?? 512
+      }
+    );
+    return data.createFunctionVersion.functionVersion.versionNumber;
+  },
+  deploy: async (id, versionNumber) => {
+    await gqlRequest(
+      `mutation CliDeployFunction($functionId: String!, $versionNumber: Int!) {
+        updateFunctionDeployedVersion(input: { functionId: $functionId, patch: { versionNumber: $versionNumber } }) {
+          functionDeployedVersion { functionId }
+        }
+      }`,
+      { functionId: id, versionNumber }
+    );
+  }
+};
+var pageFiles = (dir, id, name, config) => {
+  const { code, ...meta } = config;
+  const ext = config.language === "liquid" ? "liquid" : "tsx";
+  const stem = `${dir}/${slugify(name)}.${id}`;
+  return {
+    [`${stem}.${ext}`]: code ?? "",
+    [`${stem}.meta.json`]: metaJson(meta)
+  };
+};
+var pageConfigFromFiles = (files) => {
+  const meta = JSON.parse(fileBySuffix(files, ".meta.json"));
+  const codeEntry = Object.entries(files).find(
+    ([path]) => !path.endsWith(".meta.json")
+  );
+  if (codeEntry == null) throw new Error("Missing local code file.");
+  return { ...meta, code: codeEntry[1] };
+};
+var pageAdapter = (opts) => {
+  const { gqlName } = opts;
+  const plural = `${gqlName}s`;
+  const versionField = `${gqlName}Versions`;
+  const deployedField = `${gqlName}DeployedVersion`;
+  const idArg = `${gqlName}Id`;
+  const capitalized = gqlName.charAt(0).toUpperCase() + gqlName.slice(1);
+  return {
+    type: opts.type,
+    fetchAll: async (workspaceId) => {
+      const data = await gqlRequest(
+        `query CliPages($workspaceId: String!) {
+          ${plural}(condition: { workspaceId: $workspaceId }, includeArchived: NO) {
+            nodes {
+              id name
+              ${versionField}(orderBy: PRIMARY_KEY_DESC, first: 1) { nodes { versionNumber config } }
+              ${deployedField} { versionNumber }
+            }
+          }
+        }`,
+        { workspaceId }
+      );
+      const nodes = data[plural]?.nodes ?? [];
+      return nodes.flatMap((node) => {
+        const versions = node[versionField];
+        const version = versions.nodes[0];
+        if (version == null) return [];
+        return [
+          {
+            id: node.id,
+            name: node.name,
+            latestVersion: version.versionNumber,
+            deployedVersion: node[deployedField]?.versionNumber ?? null,
+            files: pageFiles(
+              opts.dir,
+              node.id,
+              node.name,
+              version.config
+            )
+          }
+        ];
+      });
+    },
+    head: async (id) => {
+      const data = await gqlRequest(
+        `query CliPageHead($id: String!) {
+          ${gqlName}(id: $id) {
+            ${versionField}(orderBy: PRIMARY_KEY_DESC, first: 1) { nodes { versionNumber } }
+            ${deployedField} { versionNumber }
+          }
+        }`,
+        { id }
+      );
+      const node = data[gqlName];
+      if (node == null) throw new Error(`${capitalized} ${id} not found.`);
+      const versions = node[versionField];
+      return {
+        latestVersion: versions.nodes[0]?.versionNumber ?? 0,
+        deployedVersion: node[deployedField]?.versionNumber ?? null
+      };
+    },
+    fetchVersion: async (id, versionNumber, name) => {
+      const data = await gqlRequest(
+        `query CliPageVersion($id: String!, $versionNumber: Int!) {
+          ${gqlName}Version(${idArg}: $id, versionNumber: $versionNumber) { config }
+        }`,
+        { id, versionNumber }
+      );
+      const version = data[`${gqlName}Version`];
+      if (version == null) {
+        throw new Error(
+          `${capitalized} ${id} has no version ${String(versionNumber)}.`
+        );
+      }
+      return pageFiles(opts.dir, id, name, version.config);
+    },
+    push: async (id, files, message) => {
+      const config = pageConfigFromFiles(files);
+      const data = await gqlRequest(
+        `mutation CliCreatePageVersion($id: String!, $message: String, $config: JSON!) {
+          create${capitalized}Version(input: { ${gqlName}Version: { ${idArg}: $id, message: $message, config: $config } }) {
+            ${gqlName}Version { versionNumber }
+          }
+        }`,
+        { id, message, config }
+      );
+      const versionNumber = data[`create${capitalized}Version`]?.[`${gqlName}Version`]?.versionNumber;
+      if (versionNumber == null) {
+        throw new Error(`create${capitalized}Version returned no version.`);
+      }
+      return versionNumber;
+    },
+    deploy: async (id, versionNumber) => {
+      await gqlRequest(
+        `mutation CliDeployPageVersion($id: String!, $versionNumber: Int!) {
+          update${capitalized}DeployedVersion(input: { ${idArg}: $id, patch: { versionNumber: $versionNumber } }) {
+            ${gqlName}DeployedVersion { versionNumber }
+          }
+        }`,
+        { id, versionNumber }
+      );
+    }
+  };
+};
+var automationAdapter = {
+  type: "automation",
+  fetchAll: async (workspaceId) => {
+    const data = await gqlRequest(
+      `query CliAutomations($workspaceId: String!) {
+        automations(condition: { workspaceId: $workspaceId }, includeArchived: NO) {
+          nodes {
+            id name
+            automationVersions(orderBy: [NUM_DESC], first: 1) {
+              nodes { num elements maxConcurrentRuns }
+            }
+            automationDeployedVersion { automationVersion { num } }
+          }
+        }
+      }`,
+      { workspaceId }
+    );
+    return data.automations.nodes.flatMap((automation) => {
+      const version = automation.automationVersions.nodes[0];
+      if (version == null) return [];
+      const path = `automations/${slugify(automation.name)}.${automation.id}.json`;
+      return [
+        {
+          id: automation.id,
+          name: automation.name,
+          latestVersion: version.num,
+          deployedVersion: automation.automationDeployedVersion?.automationVersion?.num ?? null,
+          files: {
+            [path]: metaJson({
+              maxConcurrentRuns: version.maxConcurrentRuns,
+              elements: version.elements
+            })
+          }
+        }
+      ];
+    });
+  },
+  head: async (id) => {
+    const data = await gqlRequest(
+      `query CliAutomationHead($id: String!) {
+        automation(id: $id) {
+          automationVersions(orderBy: [NUM_DESC], first: 1) { nodes { num } }
+          automationDeployedVersion { automationVersion { num } }
+        }
+      }`,
+      { id }
+    );
+    if (data.automation == null) throw new Error(`Automation ${id} not found.`);
+    return {
+      latestVersion: data.automation.automationVersions.nodes[0]?.num ?? 0,
+      deployedVersion: data.automation.automationDeployedVersion?.automationVersion?.num ?? null
+    };
+  },
+  fetchVersion: async (id, versionNumber, name) => {
+    const data = await gqlRequest(
+      `query CliAutomationVersion($automationId: String!, $num: Int!) {
+        automationVersionByAutomationIdAndNum(automationId: $automationId, num: $num) {
+          num elements maxConcurrentRuns
+        }
+      }`,
+      { automationId: id, num: versionNumber }
+    );
+    const version = data.automationVersionByAutomationIdAndNum;
+    if (version == null) {
+      throw new Error(
+        `Automation ${id} has no version ${String(versionNumber)}.`
+      );
+    }
+    return {
+      [`automations/${slugify(name)}.${id}.json`]: metaJson({
+        maxConcurrentRuns: version.maxConcurrentRuns,
+        elements: version.elements
+      })
+    };
+  },
+  push: async (id, files, message) => {
+    const doc = JSON.parse(fileBySuffix(files, ".json"));
+    const findings = await validateAutomationElements(doc.elements);
+    if (findings.length > 0) {
+      throw new Error(
+        `Invalid automation elements:
+${findings.map((f) => `  ${f}`).join("\n")}`
+      );
+    }
+    const data = await gqlRequest(
+      `mutation CliCreateAutomationVersion($automationId: String!, $elements: JSON!, $message: String, $maxConcurrentRuns: Int) {
+        createAutomationVersion(input: { automationVersion: {
+          automationId: $automationId, elements: $elements, message: $message, maxConcurrentRuns: $maxConcurrentRuns
+        }}) { automationVersion { num } }
+      }`,
+      {
+        automationId: id,
+        elements: doc.elements,
+        message,
+        maxConcurrentRuns: doc.maxConcurrentRuns
+      }
+    );
+    return data.createAutomationVersion.automationVersion.num;
+  },
+  deploy: async (id, versionNumber) => {
+    const data = await gqlRequest(
+      `query CliAutomationVersionId($automationId: String!, $num: Int!) {
+        automationVersionByAutomationIdAndNum(automationId: $automationId, num: $num) { id }
+      }`,
+      { automationId: id, num: versionNumber }
+    );
+    const versionId = data.automationVersionByAutomationIdAndNum?.id;
+    if (versionId == null) {
+      throw new Error(
+        `Automation ${id} has no version ${String(versionNumber)}.`
+      );
+    }
+    await gqlRequest(
+      `mutation CliDeployAutomation($automationId: String!, $automationVersionId: String!) {
+        updateAutomationDeployedVersion(input: { automationId: $automationId, patch: { automationVersionId: $automationVersionId } }) {
+          automationDeployedVersion { automationId }
+        }
+      }`,
+      { automationId: id, automationVersionId: versionId }
+    );
+  }
+};
+var webPageAdapter = pageAdapter({
+  type: "webPage",
+  dir: "web-pages",
+  gqlName: "webPage"
+});
+var printablePageAdapter = pageAdapter({
+  type: "printablePage",
+  dir: "printable-pages",
+  gqlName: "printablePage"
+});
+var allAdapters = [
+  automationAdapter,
+  functionAdapter,
+  webPageAdapter,
+  printablePageAdapter
+];
+var adapterFor = (type) => {
+  const adapter = allAdapters.find((a) => a.type === type);
+  if (adapter == null) throw new Error(`No adapter for resource type ${type}.`);
+  return adapter;
+};
+
+// src/commands/sync.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join3, resolve as resolve2 } from "path";
+var toManifestResource = (type, remote) => ({
+  type,
+  name: remote.name,
+  files: Object.keys(remote.files),
+  baseVersion: remote.latestVersion,
+  deployedVersion: remote.deployedVersion
+});
+var fetchWorkspace = async (workspaceId) => {
+  const data = await gqlRequest(
+    `query CliWorkspace($id: String!) { workspace(id: $id) { id name organizationId } }`,
+    { id: workspaceId }
+  );
+  if (data.workspace == null) {
+    throw new Error(
+      `Workspace ${workspaceId} not found (or not visible to you).`
+    );
+  }
+  return data.workspace;
+};
+var runClone = async (args) => {
+  const [workspaceId, dirArg] = args.filter((a) => !a.startsWith("-"));
+  if (workspaceId == null) {
+    throw new Error("Usage: overai clone <workspaceId> [dir]");
+  }
+  await getAccessToken();
+  const workspace = await fetchWorkspace(workspaceId);
+  const root = resolve2(dirArg ?? slugify(workspace.name));
+  if (existsSync2(join3(root, ".overai", "manifest.json"))) {
+    throw new Error(
+      `${root} is already a cloned workspace. Use \`overai pull\` to refresh.`
+    );
+  }
+  mkdirSync3(root, { recursive: true });
+  const manifest = {
+    workspaceId: workspace.id,
+    workspaceName: workspace.name,
+    organizationId: workspace.organizationId,
+    resources: {}
+  };
+  for (const adapter of allAdapters) {
+    const resources = await adapter.fetchAll(workspaceId);
+    for (const remote of resources) {
+      for (const [relPath, content] of Object.entries(remote.files)) {
+        writeSynced(root, relPath, content);
+      }
+      manifest.resources[remote.id] = toManifestResource(adapter.type, remote);
+    }
+    process.stdout.write(
+      `${adapter.type}: ${String(resources.length)} cloned
+`
+    );
+  }
+  writeManifest(root, manifest);
+  process.stdout.write(`
+Cloned "${workspace.name}" into ${root}
+`);
+};
+var collectStatus = async (root, manifest) => {
+  const rows = [];
+  const untracked = [];
+  for (const adapter of allAdapters) {
+    const remotes = await adapter.fetchAll(manifest.workspaceId);
+    const remoteById = new Map(remotes.map((r) => [r.id, r]));
+    for (const [id, resource] of Object.entries(manifest.resources)) {
+      if (resource.type !== adapter.type) continue;
+      const remote = remoteById.get(id);
+      rows.push({
+        id,
+        resource,
+        local: localState(root, resource),
+        remoteLatest: remote?.latestVersion ?? resource.baseVersion,
+        behind: (remote?.latestVersion ?? resource.baseVersion) > resource.baseVersion
+      });
+    }
+    for (const remote of remotes) {
+      if (manifest.resources[remote.id] == null) untracked.push(remote);
+    }
+  }
+  return { rows, untracked };
+};
+var runStatus = async () => {
+  const { root, manifest } = openClone();
+  const { rows, untracked } = await collectStatus(root, manifest);
+  const lines = [];
+  let dirty = false;
+  for (const row of rows) {
+    const flags = [];
+    if (row.local.state === "modified") flags.push("modified");
+    if (row.local.state === "missing") flags.push("missing files");
+    if (row.behind) {
+      flags.push(`behind (remote v${String(row.remoteLatest)})`);
+    }
+    if (row.resource.baseVersion !== (row.resource.deployedVersion ?? -1)) {
+      flags.push("undeployed");
+    }
+    if (flags.length > 0) dirty = true;
+    const versions = `base v${String(row.resource.baseVersion)}, deployed ${row.resource.deployedVersion == null ? "none" : `v${String(row.resource.deployedVersion)}`}`;
+    lines.push(
+      `  ${row.resource.type}  ${row.resource.name} (${row.id}) [${versions}]${flags.length > 0 ? `: ${flags.join(", ")}` : ""}`
+    );
+    for (const file of row.local.changedFiles) lines.push(`      ${file}`);
+  }
+  for (const remote of untracked) {
+    dirty = true;
+    lines.push(`  new remote ${remote.name} \u2014 run \`overai pull\` to fetch`);
+  }
+  process.stdout.write(
+    `Workspace "${manifest.workspaceName}" (${manifest.workspaceId})${dirty ? "" : " \u2014 clean, everything in sync"}
+${lines.join("\n")}
+`
+  );
+};
+var runRestore = (args) => {
+  const { root, manifest } = openClone();
+  const all = args.includes("--all");
+  const filter = positionals(args)[0];
+  if (filter == null && !all) {
+    throw new Error(
+      "Usage: overai restore <filter> (resource id, name, or path substring), or --all to discard every local edit."
+    );
+  }
+  let restored = 0;
+  for (const [, resource] of resourcesMatching(
+    manifest,
+    all ? void 0 : filter
+  )) {
+    for (const relPath of resource.files) {
+      const base = readBaseFile(root, relPath);
+      if (base == null || readWorkingFile(root, relPath) === base) continue;
+      writeSynced(root, relPath, base);
+      restored += 1;
+      process.stdout.write(`restored ${relPath}
+`);
+    }
+  }
+  process.stdout.write(
+    restored === 0 ? "Nothing to restore (no modified files matched).\n" : `Restored ${String(restored)} file(s) to their base versions.
+`
+  );
+};
+var runPull = async () => {
+  const { root, manifest } = openClone();
+  for (const adapter of allAdapters) {
+    const remotes = await adapter.fetchAll(manifest.workspaceId);
+    const remoteById = new Map(remotes.map((r) => [r.id, r]));
+    for (const [id, resource] of Object.entries(manifest.resources)) {
+      if (resource.type !== adapter.type) continue;
+      const remote = remoteById.get(id);
+      if (remote == null) {
+        process.stdout.write(
+          `gone remotely (archived/deleted): ${resource.name} \u2014 local files kept
+`
+        );
+        continue;
+      }
+      const { state } = localState(root, resource);
+      if (remote.latestVersion === resource.baseVersion && state !== "missing") {
+        continue;
+      }
+      if (state === "modified" && remote.latestVersion > resource.baseVersion) {
+        process.stdout.write(
+          `CONFLICT ${resource.name}: local edits + remote v${String(remote.latestVersion)} (base v${String(resource.baseVersion)}). Kept local; copy your edits aside, re-run pull, re-apply.
+`
+        );
+        continue;
+      }
+      for (const [relPath, content] of Object.entries(remote.files)) {
+        writeSynced(root, relPath, content);
+      }
+      manifest.resources[id] = toManifestResource(adapter.type, remote);
+      process.stdout.write(
+        `updated ${resource.name} \u2192 v${String(remote.latestVersion)}
+`
+      );
+    }
+    for (const remote of remotes) {
+      if (manifest.resources[remote.id] != null) continue;
+      for (const [relPath, content] of Object.entries(remote.files)) {
+        writeSynced(root, relPath, content);
+      }
+      manifest.resources[remote.id] = toManifestResource(adapter.type, remote);
+      process.stdout.write(`added ${remote.name}
+`);
+    }
+  }
+  writeManifest(root, manifest);
+  process.stdout.write("Pull complete.\n");
+};
+var resourcesMatching = (manifest, filter) => Object.entries(manifest.resources).filter(
+  ([id, resource]) => filter == null || id === filter || resource.name.toLowerCase().includes(filter.toLowerCase()) || resource.files.some((f) => f.includes(filter))
+);
+var positionals = (args) => {
+  const valueFlags = /* @__PURE__ */ new Set(["-m", "--message", "-o", "--output"]);
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg == null) continue;
+    if (valueFlags.has(arg)) {
+      i++;
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    out.push(arg);
+  }
+  return out;
+};
+var runPush = async (args) => {
+  const { root, manifest } = openClone();
+  const message = flagValue(args, "-m", "--message") ?? "Pushed via overai CLI";
+  const deploy = args.includes("--deploy");
+  const force = args.includes("--force");
+  const pathFilter = positionals(args)[0];
+  let pushed = 0;
+  for (const [id, resource] of resourcesMatching(manifest, pathFilter)) {
+    const { state, changedFiles } = localState(root, resource);
+    if (state === "missing") {
+      const missing = resource.files.filter(
+        (f) => readWorkingFile(root, f) == null
+      ).length;
+      process.stdout.write(
+        `SKIP ${resource.name}: ${String(missing)} file(s) missing locally \u2014 run \`overai restore ${id}\` to recover.
+`
+      );
+      continue;
+    }
+    if (state !== "modified") continue;
+    const adapter = adapterFor(resource.type);
+    const head = await adapter.head(id);
+    if (head.latestVersion !== resource.baseVersion && !force) {
+      process.stdout.write(
+        `SKIP ${resource.name}: remote is at v${String(head.latestVersion)}, you branched from v${String(resource.baseVersion)}. \`overai pull\` first, or --force to push anyway.
+`
+      );
+      continue;
+    }
+    const files = {};
+    for (const relPath of resource.files) {
+      const content = readWorkingFile(root, relPath);
+      if (content == null) throw new Error(`${relPath} is missing locally.`);
+      files[relPath] = content;
+    }
+    const versionNumber = await adapter.push(id, files, message);
+    for (const relPath of changedFiles) {
+      const content = files[relPath];
+      if (content == null) continue;
+      writeSynced(root, relPath, content);
+    }
+    resource.baseVersion = versionNumber;
+    writeManifest(root, manifest);
+    pushed += 1;
+    process.stdout.write(
+      `pushed ${resource.name} \u2192 v${String(versionNumber)}${deploy ? "" : " (not deployed)"}
+`
+    );
+    if (deploy) {
+      await adapter.deploy(id, versionNumber);
+      resource.deployedVersion = versionNumber;
+      writeManifest(root, manifest);
+      process.stdout.write(
+        `deployed ${resource.name} v${String(versionNumber)}
+`
+      );
+    }
+  }
+  process.stdout.write(
+    pushed === 0 ? "Nothing to push (no local modifications matched).\n" : `Pushed ${String(pushed)} resource(s).
+`
+  );
+};
+var runDeploy = async (args) => {
+  const { root, manifest } = openClone();
+  const pathFilter = positionals(args)[0];
+  const pending = resourcesMatching(manifest, pathFilter).filter(
+    ([, r]) => r.deployedVersion !== r.baseVersion
+  );
+  if (pathFilter == null && !args.includes("--all") && pending.length > 1) {
+    throw new Error(
+      `${String(pending.length)} resources have undeployed versions:
+${pending.map(([id, r]) => `  ${r.name} (${id}) v${String(r.baseVersion)}`).join(
+        "\n"
+      )}
+Pass a filter to deploy one, or --all to deploy everything.`
+    );
+  }
+  let deployed = 0;
+  for (const [id, resource] of resourcesMatching(manifest, pathFilter)) {
+    if (resource.deployedVersion === resource.baseVersion) continue;
+    const { state } = localState(root, resource);
+    if (state === "modified") {
+      process.stdout.write(
+        `SKIP ${resource.name}: local edits not pushed \u2014 push first so you deploy what you see.
+`
+      );
+      continue;
+    }
+    await adapterFor(resource.type).deploy(id, resource.baseVersion);
+    resource.deployedVersion = resource.baseVersion;
+    writeManifest(root, manifest);
+    deployed += 1;
+    process.stdout.write(
+      `deployed ${resource.name} v${String(resource.baseVersion)}
+`
+    );
+  }
+  process.stdout.write(
+    deployed === 0 ? "Nothing to deploy.\n" : `Deployed ${String(deployed)} resource(s).
+`
+  );
+};
+
+// src/commands/dev.ts
+var LONG_POLL_MS = 25e3;
+var runDev = async (args) => {
+  const { root, manifest } = openClone();
+  const filter = args.find(
+    (a, i) => !a.startsWith("-") && args[i - 1] !== "--port"
+  );
+  const pages2 = resourcesMatching(manifest, filter).filter(
+    ([, r]) => r.type === "webPage"
+  );
+  const match = pages2.length === 1 ? pages2[0] : null;
+  if (match == null) {
+    throw new Error(
+      pages2.length === 0 ? `No web page matched "${filter ?? ""}" (dev preview supports web pages for now).` : `Ambiguous \u2014 matched ${pages2.map(([, r]) => r.name).join(", ")}. Narrow the filter.`
+    );
+  }
+  const [id, resource] = match;
+  const snapshot = () => {
+    const base = {
+      id,
+      name: resource.name,
+      workspaceId: manifest.workspaceId
+    };
+    try {
+      const files = {};
+      for (const relPath of resource.files) {
+        const content = readWorkingFile(root, relPath);
+        if (content == null) throw new Error(`Missing local file ${relPath}.`);
+        files[relPath] = content;
+      }
+      const config = pageConfigFromFiles(files);
+      const revision = createHash2("sha1").update(JSON.stringify(config)).digest("hex");
+      return { ...base, revision, config };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        ...base,
+        revision: `error-${createHash2("sha1").update(message).digest("hex")}`,
+        error: message
+      };
+    }
+  };
+  let waiters = [];
+  let debounce = null;
+  const notifyChange = () => {
+    if (debounce != null) clearTimeout(debounce);
+    debounce = setTimeout(() => {
+      const pending = waiters;
+      waiters = [];
+      pending.forEach((wake) => {
+        wake();
+      });
+    }, 100);
+  };
+  const watchedDirs = [
+    ...new Set(resource.files.map((f) => join4(root, dirname2(f))))
+  ];
+  watchedDirs.forEach((dir) => watch(dir, notifyChange));
+  const appOrigin = new URL(appBaseUrl).origin;
+  const server = createServer2((req, res) => {
+    const headers = {
+      // The webapp page is a different origin; a secure page may also send a
+      // private-network preflight before touching loopback — allow both.
+      "Access-Control-Allow-Origin": appOrigin,
+      "Access-Control-Allow-Private-Network": "true",
+      "Cache-Control": "no-store"
+    };
+    if (req.method === "OPTIONS") {
+      res.writeHead(204, headers);
+      res.end();
+      return;
+    }
+    const url2 = new URL(req.url ?? "/", "http://localhost");
+    if (url2.pathname !== "/page") {
+      res.writeHead(404, headers);
+      res.end();
+      return;
+    }
+    const respond = () => {
+      res.writeHead(200, { ...headers, "Content-Type": "application/json" });
+      res.end(JSON.stringify(snapshot()));
+    };
+    const since = url2.searchParams.get("since");
+    if (since == null || since !== snapshot().revision) {
+      respond();
+      return;
+    }
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      respond();
+    };
+    const timer = setTimeout(finish, LONG_POLL_MS);
+    waiters.push(finish);
+    req.on("close", () => {
+      settled = true;
+      clearTimeout(timer);
+    });
+  });
+  const port = Number(flagValue(args, "--port") ?? 4820);
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", resolve3);
+  }).catch((error) => {
+    throw new Error(
+      error instanceof Error && "code" in error && error.code === "EADDRINUSE" ? `Port ${String(port)} is in use \u2014 pass --port <n>.` : String(error)
+    );
+  });
+  const url = `${appBaseUrl}/${manifest.organizationId}/dev?src=${encodeURIComponent(`http://127.0.0.1:${String(port)}`)}`;
+  process.stdout.write(
+    `Serving ${resource.name} (${id}) from local files.
+${url}
+Watching for changes \u2014 Ctrl+C to stop.
+`
+  );
+  if (args.includes("--open")) openBrowser(url);
+  await new Promise(() => void 0);
+};
+
+// src/commands/fn.ts
+var collectInput = async (args) => {
+  if (args.includes("-")) {
+    const raw = (await readStdin()).trim();
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error(`stdin must be valid JSON. Got: ${raw.slice(0, 120)}`);
+    }
+  }
+  const input = {};
+  args.forEach((arg, i) => {
+    if (arg === "--input" && i + 1 < args.length) {
+      const pair = args[i + 1] ?? "";
+      const eq = pair.indexOf("=");
+      if (eq > 0) input[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+  });
+  return input;
+};
+var runLogs = async (args) => {
+  const functionId = args[0];
+  if (functionId == null) {
+    throw new Error(
+      "Usage: overai fn logs <functionId> [--limit N] [--execution <id>]"
+    );
+  }
+  const executionId = flagValue(args, "--execution");
+  if (executionId == null) {
+    const limit = Number(flagValue(args, "--limit") ?? 20);
+    const data2 = await gqlRequest(
+      `query CliFunctionExecutions($functionId: String!, $first: Int!) {
+        functionExecutions(condition: { functionId: $functionId }, orderBy: [CREATED_AT_DESC], first: $first) {
+          nodes { id createdAt httpStatusCode executionTime requestMethod requestPath versionNumber }
+        }
+      }`,
+      { functionId, first: limit }
+    );
+    printResult(
+      data2.functionExecutions.nodes,
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
+    return;
+  }
+  const data = await gqlRequest(
+    `query CliFunctionExecution($functionId: String!, $id: String!) {
+      functionExecutions(condition: { functionId: $functionId, id: $id }, first: 1) {
+        nodes { id summary createdAt httpStatusCode executionTime versionNumber logsUrl inputBodyUrl outputBodyUrl }
+      }
+    }`,
+    { functionId, id: executionId }
+  );
+  const execution = data.functionExecutions.nodes[0];
+  if (execution == null) throw new Error(`Execution ${executionId} not found.`);
+  const fetchText = async (url) => url == null ? null : await fetch(url).then((r) => r.ok ? r.text() : null);
+  const [logs, input, output] = await Promise.all([
+    fetchText(execution.logsUrl),
+    fetchText(execution.inputBodyUrl),
+    fetchText(execution.outputBodyUrl)
+  ]);
+  const fmt = resolveFormat(flagValue(args, "-o", "--output"));
+  printResult(
+    {
+      id: execution.id,
+      createdAt: execution.createdAt,
+      httpStatusCode: execution.httpStatusCode,
+      executionTime: execution.executionTime,
+      versionNumber: execution.versionNumber,
+      summary: execution.summary,
+      input,
+      output,
+      logs
+    },
+    // A single nested record reads better as JSON than a 1-row table.
+    fmt === "table" ? "json" : fmt
+  );
+};
+var runFn = async (args) => {
+  if (args[0] === "logs") return runLogs(args.slice(1));
+  const functionId = args[0];
+  if (functionId == null || functionId.startsWith("-")) {
+    throw new Error(
+      "Usage: overai fn <functionId> [--input key=value ... | -]\n       overai fn logs <functionId> [--limit N] [--execution <id>]"
+    );
+  }
+  const input = await collectInput(args);
+  const { organizationId } = await getAccessToken();
+  const res = await v2Fetch(`/v2/functions/${organizationId}/${functionId}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  const executionId = res.headers.get("x-execution-id");
+  if (executionId != null) {
+    process.stderr.write(`execution: ${executionId}
+`);
+  }
+  const body = await res.text();
+  if (!res.ok) {
+    const structured = (() => {
+      try {
+        return JSON.parse(body);
+      } catch {
+        return null;
+      }
+    })();
+    throw new Error(
+      structured?.error ?? (body.trim() || `fn failed (${String(res.status)})`)
+    );
+  }
+  process.stdout.write(`${body}
+`);
+};
+
+// src/commands/graphql.ts
+import { readFileSync as readFileSync3 } from "fs";
+var runGraphql = async (args) => {
+  const inline = flagValue(args, "-q", "--query");
+  const file = flagValue(args, "-f", "--file");
+  const query = inline ?? (file != null ? readFileSync3(file, "utf8") : process.stdin.isTTY ? "" : (await readStdin()).trim());
+  if (query.length === 0) {
+    throw new Error("Provide a query with -q '<query>', -f <file>, or stdin.");
+  }
+  const variablesJson = flagValue(args, "--variables");
+  const variables = (() => {
+    if (variablesJson == null) return void 0;
+    try {
+      return JSON.parse(variablesJson);
+    } catch {
+      throw new Error(`--variables must be valid JSON. Got: ${variablesJson}`);
+    }
+  })();
+  const res = await v2Fetch(
+    args.includes("--v1") ? "/v1/graphql" : "/v2/graphql",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ query, variables })
+    }
+  );
+  const body = await res.json().catch(() => null);
+  if (body?.errors != null && body.errors.length > 0) {
+    throw new Error(body.errors.map((e) => e.message).join("; "));
+  }
+  if (!res.ok || body == null) {
+    throw new Error(`graphql failed (${String(res.status)})`);
+  }
+  printResult(body.data, resolveFormat(flagValue(args, "-o", "--output")));
+};
+
+// src/commands/open.ts
+var ROUTE_BY_TYPE = {
+  automation: "automations",
+  function: "functions",
+  webPage: "web-pages",
+  printablePage: "printable-pages"
+};
+var ROUTE_BY_PREFIX = [
+  ["WS", "workspaces"],
+  ["WP", "web-pages"],
+  ["PP", "printable-pages"],
+  ["FN", "functions"],
+  ["AT", "automations"],
+  ["TBS", "table-spaces"],
+  ["DF", "data-files"],
+  ["AG", "agents"]
+];
+var runOpen = async (args) => {
+  const filter = args.find((a) => !a.startsWith("-"));
+  const { organizationId } = await getAccessToken();
+  const url = (() => {
+    const manifest = (() => {
+      try {
+        return readManifest(findWorkspaceRoot());
+      } catch {
+        return null;
+      }
+    })();
+    if (manifest != null) {
+      if (filter == null) {
+        return `${appBaseUrl}/${manifest.organizationId}/workspaces/${manifest.workspaceId}`;
+      }
+      const match = Object.entries(manifest.resources).find(
+        ([id, r]) => id === filter || r.name.toLowerCase().includes(filter.toLowerCase()) || r.files.some((f) => f.includes(filter))
+      );
+      if (match != null) {
+        const [id, resource] = match;
+        return `${appBaseUrl}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource.type]}/${id}`;
+      }
+    }
+    if (filter == null) {
+      throw new Error(
+        "Not inside a cloned workspace \u2014 pass a resource id (WP..., FN..., WS..., AT...)."
+      );
+    }
+    const prefixed = ROUTE_BY_PREFIX.find(
+      ([prefix]) => filter.startsWith(prefix)
+    );
+    if (prefixed == null) {
+      throw new Error(
+        `Nothing matched "${filter}" (not a tracked resource or a recognized id prefix).`
+      );
+    }
+    return `${appBaseUrl}/${organizationId}/${prefixed[1]}/${filter}`;
+  })();
+  process.stdout.write(`${url}
+`);
+  openBrowser(url);
+};
+
+// src/commands/org.ts
+var USER_ORGS_QUERY = `
+  query UserOrganizations($identityId: String!) {
+    identityOrganizations(
+      where: { identityId: { _eq: $identityId }, disabled: { _eq: false } }
+    ) {
+      organization { id name }
+    }
+  }
+`;
+var listOrgs = async (args) => {
+  const auth = await getAccessToken();
+  const identityId = decodeJwtClaims(auth.token).user_id;
+  if (identityId == null) {
+    throw new Error("Could not read identity from the current session.");
+  }
+  const res = await v2Fetch("/v1/graphql", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ query: USER_ORGS_QUERY, variables: { identityId } })
+  });
+  const body = await res.json().catch(() => null);
+  if (body?.errors != null && body.errors.length > 0) {
+    throw new Error(body.errors.map((e) => e.message).join("; "));
+  }
+  if (!res.ok || body == null) {
+    throw new Error(`org list failed (${String(res.status)})`);
+  }
+  const orgs = (body.data?.identityOrganizations ?? []).map((edge) => edge.organization).filter((org) => org != null).map((org) => ({
+    id: org.id,
+    name: org.name ?? "",
+    active: org.id === auth.organizationId
+  }));
+  printResult(orgs, resolveFormat(flagValue(args, "-o", "--output")));
+};
+var switchOrg = async (orgId) => {
+  const config = readConfig();
+  if (config == null) {
+    process.stderr.write("Not signed in. Run `overai signin`.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const result = await exchangeSessionToken(config.refreshToken, orgId);
+  if (result.type === "redirect") {
+    process.stdout.write(
+      `This organization requires SSO. Complete sign-in in your browser, then run \`overai signin\`.
+${result.redirectUrl}
+`
+    );
+    openBrowser(result.redirectUrl);
+    process.exitCode = 1;
+    return;
+  }
+  writeConfig({
+    ...config,
+    organizationId: orgId,
+    email: decodeJwtClaims(result.token).email ?? config.email,
+    accessToken: result.token,
+    accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3,
+    refreshToken: result.refreshToken
+  });
+  process.stdout.write(`Switched to org ${orgId}.
+`);
+};
+
+// src/docs/bestPractices.ts
+var platform2 = `# OverAI platform primer
+
+Resources live in Workspaces. The runtime always executes the DEPLOYED version
+of a resource, never the latest \u2014 \`overai push\` creates a version, \`overai
+deploy\` makes it live. Pick primitives by trigger:
+
+- User-initiated work (clicks, forms, reviewing data) \u2192 a **Web Page**.
+- Schedule / webhook / file upload / inbound email \u2192 an **Automation**.
+- Awaitable server-side logic, callable from pages/automations/agents \u2192 a
+  **Function** (Deno sandbox, can import from esm.sh, full env SDK).
+- Storage: **TableSpaces** (Postgres, via env.TBSxxx) for structured data;
+  **Data Files** (env.DFxxx) for versioned single-file datasets. Prefer
+  first-class platform features over third-party integrations.
+
+The env SDK is the same in pages, functions, and automation code nodes:
+env.TBSxxx.sql\`...\` (postgres.js tagged template \u2014 interpolations are
+auto-parameterized, never string-concatenate user input), env.FNxxx.call(),
+env.ATxxx.start(inputs?) (fire-and-forget), env.DFxxx.read.json()/.saveVersion(),
+env.STORAGE, env.AI.generateText/generateObject, env.GRAPHQL.request().`;
+var automations = `# Automation best practices
+
+An automation's elements document is the node graph: an array of nodes, each
+{ id, label, variableId, nodeTypeId, inputs, parents?, position?, elements? }.
+Edges are expressed as parents: [{ id, handle }] with handle \u2208
+success|failure|loop. The trigger node has id "event", variableId "EVENT".
+Loop children nest inside the loop node's own \`elements\` array.
+
+Rules that keep graphs healthy:
+- Never create cycles; a node must not be the child of two different outputs
+  of the same parent; never connect across loop boundaries.
+- Keep TYPESCRIPT_CODE nodes small and focused \u2014 split logic across nodes and
+  let the graph orchestrate, rather than one big code block.
+- Node inputs reference upstream state via variableIds (e.g. STATE.S1, Liquid
+  {{S1.field}}). After renaming/removing a node, grep the document for its
+  variableId \u2014 dangling references fail at runtime, not at push.
+- Bring IF_ELSE branches back together with an ALWAYS node.
+- Activation requires a deployed version with an EVENT trigger node \u2014
+  activating without one silently no-ops.
+
+Debugging without the canvas:
+- \`overai automation runs <id> --failed\` \u2014 recent errored runs.
+- \`overai automation state <runId>\` \u2014 per-node { inputs, outputs, outcome },
+  keyed by variableId; loop iterations nest under L*.iterations[i].state.
+  Large/old runs may have partial state here (authoritative copy lives in
+  object storage) \u2014 treat as best-effort.
+- \`overai automation run <id> --input k=v\` starts a real run of the DEPLOYED
+  version (fire-and-forget, returns automationRunId). Run read-only paths
+  first; verify before deploying mutating changes.`;
+var pages = `# Page best practices (web + printable)
+
+A page version's config JSON carries the code; the CLI splits it into
+<slug>.<id>.tsx (the code) and <slug>.<id>.meta.json (config minus code \u2014
+language, customTitle, hideTopBar, ...). Push reassembles them.
+
+- Web pages are React (TSX). Printable pages are React or Liquid.
+- Web page code is concatenated with an SDK that already provides React and
+  its hooks, then appends the <App /> render call. Declare a plain
+  \`function App() { ... }\` \u2014 no \`export default\`, no
+  \`import ... from "react"\` (redeclaring hooks is a SyntaxError \u2192 blank
+  page). Imports must be https URLs (\`https://esm.sh/...\`) \u2014 the sandbox
+  cannot resolve bare or relative specifiers.
+- Pages run sandboxed in an iframe with the env SDK plus hooks: useCurrentUser,
+  useSearchParam, useLLMText/Object/Chat, useAgentChat, useDataFile (legacy \u2014
+  prefer env.DFxxx), navigateToPage, openPrintablePage.
+- Call Functions for server-side logic \u2014 they're awaitable; automations are
+  fire-and-forget.
+- SQL from pages: env.TBSxxx.sql tagged templates only; compose dynamic SQL by
+  nesting sql fragments, sql([...]) for IN lists. sql.unsafe only for dynamic
+  identifiers.
+- For guest-facing workspaces, add page-to-page navigation (guests land on the
+  workspace homepage and can only follow links). "Hide Top Bar" gives an
+  app-like experience.
+- Console logs are visible in the webapp editor; use them to verify behavior
+  after deploying.`;
+var functions = `# Function best practices
+
+Functions are TypeScript HTTP handlers in a Deno sandbox: full env SDK,
+esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
+<slug>.<id>.meta.json (inputSchema, executionTimeout ms, executionMemory MB).
+
+- Functions are full HTTP apps: method + sub-path are forwarded to your code,
+  and each execution records requestMethod/requestPath.
+- Keep the inputSchema in sync with what the code actually reads \u2014 callers
+  (agents, pages, automations) rely on it.
+- Verify with \`overai fn <id> --input k=v\` (invokes the DEPLOYED version) and
+  \`overai fn logs <id>\` / \`--execution <FEX id>\` for status, timing, logs,
+  and input/output bodies.
+- Version discipline: function_execution.versionNumber tells you exactly which
+  version served a request \u2014 check it before blaming current code for an old
+  failure.`;
+var workflow = `# CLI editing workflow
+
+1. \`overai clone <workspaceId>\` (or \`overai pull\` in an existing clone).
+2. Edit files. The id in each filename is authoritative; slugs are cosmetic.
+3. \`overai status\` / \`overai diff\` \u2014 review what changed.
+4. \`overai review\` \u2014 validation + these guides; fix findings first.
+5. \`overai push -m "why"\` \u2014 creates NEW versions (not live). Fast-forward
+   only: if the resource moved remotely, pull, re-apply, retry. Write commit
+   messages like PR titles \u2014 they're the version history.
+6. Verify behavior (fn invoke, automation run, page preview in the webapp).
+7. \`overai deploy [filter]\` \u2014 move the deployed pointer. Deploy is the only
+   step users can feel; push freely, deploy deliberately.
+
+Never edit .overai/ by hand \u2014 it holds the manifest and pristine base copies
+that make status/diff/fast-forward work.`;
+var BEST_PRACTICES = {
+  platform: platform2,
+  automations,
+  pages,
+  functions,
+  workflow
+};
+
+// src/commands/review.ts
+var runBestPractices = (args) => {
+  const topic = args[0];
+  if (topic != null) {
+    const doc = BEST_PRACTICES[topic];
+    if (doc == null) {
+      throw new Error(
+        `Unknown topic "${topic}". Topics: ${Object.keys(BEST_PRACTICES).join(", ")}`
+      );
+    }
+    process.stdout.write(`${doc}
+`);
+    return;
+  }
+  process.stdout.write(
+    `${Object.values(BEST_PRACTICES).join("\n\n---\n\n")}
+`
+  );
+};
+var runReview = async () => {
+  const root = findWorkspaceRoot();
+  const manifest = readManifest(root);
+  const findings = [];
+  const touchedTypes = /* @__PURE__ */ new Set();
+  const changed = [];
+  for (const [id, resource] of Object.entries(manifest.resources)) {
+    const { state, changedFiles } = localState(root, resource);
+    if (state !== "modified") continue;
+    touchedTypes.add(resource.type);
+    changed.push(
+      `${resource.type} "${resource.name}" (${id}): ${changedFiles.join(", ")}`
+    );
+    for (const relPath of changedFiles) {
+      const content = readWorkingFile(root, relPath);
+      if (content == null) continue;
+      if (relPath.endsWith(".json")) {
+        try {
+          JSON.parse(content);
+        } catch (error) {
+          findings.push(
+            `${relPath}: invalid JSON \u2014 ${error instanceof Error ? error.message : String(error)}`
+          );
+          continue;
+        }
+      }
+      if (!relPath.endsWith(".meta.json") && content.trim().length === 0) {
+        findings.push(
+          `${relPath}: file is empty \u2014 push would blank the resource.`
+        );
+      }
+      if (resource.type === "webPage" && relPath.endsWith(".tsx")) {
+        const importRe = /^\s*import\s+(?:[^'"\n]*?\bfrom\s+)?["']([^"']+)["']/gm;
+        for (const match of content.matchAll(importRe)) {
+          const specifier = match[1];
+          if (specifier == null || specifier.startsWith("https://")) continue;
+          findings.push(
+            /^react(-dom)?(\/|$)/.test(specifier) ? `${relPath}: imports "${specifier}" \u2014 React and its hooks are already in scope; remove the import or the page renders blank.` : `${relPath}: imports "${specifier}" \u2014 the page sandbox can only import https URLs (use https://esm.sh/...).`
+          );
+        }
+        if (/^\s*export\s+default\b/m.test(content)) {
+          findings.push(
+            `${relPath}: uses \`export default\` \u2014 declare a plain \`function App() {}\`; the runtime appends the render call.`
+          );
+        }
+        if (!/\b(function|const|let)\s+App\b/.test(content)) {
+          findings.push(
+            `${relPath}: no App component found \u2014 page code must declare \`function App() {}\`.`
+          );
+        }
+      }
+    }
+    if (resource.type === "automation") {
+      const docFile = resource.files.find((f) => f.endsWith(".json"));
+      const raw = docFile == null ? null : readWorkingFile(root, docFile);
+      if (docFile != null && raw != null) {
+        try {
+          const doc = JSON.parse(raw);
+          findings.push(
+            ...(await validateAutomationElements(doc.elements)).map(
+              (f) => `${docFile} elements.${f}`
+            )
+          );
+        } catch {
+        }
+      }
+    }
+  }
+  if (changed.length === 0) {
+    process.stdout.write("Nothing modified locally \u2014 nothing to review.\n");
+    return;
+  }
+  const guides = ["workflow", ...touchedTypes].map((t) => t === "webPage" || t === "printablePage" ? "pages" : t).map((t) => t === "automation" ? "automations" : t).map((t) => t === "function" ? "functions" : t);
+  const guideDocs = [...new Set(guides)].map((t) => BEST_PRACTICES[t]).filter((d) => d != null);
+  process.stdout.write(
+    [
+      "## Changed resources",
+      ...changed.map((c) => `- ${c}`),
+      "",
+      "## Validation findings",
+      findings.length > 0 ? findings.map((f) => `- ${f}`).join("\n") : "- none (mechanical checks passed \u2014 still review the diff against the guides below)",
+      "",
+      "## Review guides",
+      "Review `overai diff` output against these before pushing:",
+      "",
+      guideDocs.join("\n\n---\n\n"),
+      ""
+    ].join("\n")
+  );
+};
+
+// src/commands/sql.ts
+import { createInterface } from "readline";
+var runQuery = async (organizationId, tableSpaceId, query, params) => {
+  const res = await v2Fetch(
+    `/v2/table-spaces/${organizationId}/${tableSpaceId}/run`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(
+        params == null ? { query, ignoreCamelCase: true } : { unsafe: { query, params } }
+      )
+    }
+  );
+  const raw = await res.text();
+  const body = (() => {
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  })();
+  if (!res.ok || body?.ok === false) {
+    throw new Error(
+      body?.error ?? (raw.trim().length > 0 ? raw.trim() : res.status === 404 ? "table space not found or you lack access to it" : `HTTP ${String(res.status)}`)
+    );
+  }
+  return {
+    rows: body?.rows ?? [],
+    rowCount: body?.rowCount ?? 0,
+    resultSetCount: body?.resultSetCount ?? 1,
+    durationMs: body?.durationMs ?? 0
+  };
+};
+var summarize = (result) => `(${String(result.rowCount)} row${result.rowCount === 1 ? "" : "s"}, ${String(result.durationMs)}ms)`;
+var REPL_HELP = `  \\dt              list tables
+  \\d <table>       describe a table's columns (schema.table to disambiguate)
+  \\?               this help
+  \\q               quit
+Statements run when a line ends with ";". Each statement runs in its own
+transaction \u2014 BEGIN/SET/temp tables don't carry across statements.
+`;
+var runRepl = async (organizationId, tableSpaceId, format) => {
+  const interactive = process.stdin.isTTY;
+  const rl = createInterface({
+    input: process.stdin,
+    ...interactive ? { output: process.stdout, historySize: 1e3, terminal: true } : {}
+  });
+  let buffer = "";
+  const prompt = () => {
+    if (!interactive) return;
+    rl.setPrompt(
+      buffer.length === 0 ? `${tableSpaceId}=> ` : `${tableSpaceId}-> `
+    );
+    rl.prompt();
+  };
+  const execute = async (sql, params) => {
+    try {
+      const result = await runQuery(organizationId, tableSpaceId, sql, params);
+      if (result.rows.length > 0) {
+        process.stdout.write(`${formatResult(result.rows, format)}
+`);
+      }
+      if (result.resultSetCount > 1) {
+        process.stderr.write(
+          `(${String(result.resultSetCount)} result sets, showing the last)
+`
+        );
+      }
+      process.stderr.write(`${summarize(result)}
+`);
+      return result;
+    } catch (error) {
+      process.stderr.write(
+        `ERROR: ${error instanceof Error ? error.message : String(error)}
+`
+      );
+      if (!interactive) process.exitCode = 1;
+      return null;
+    }
+  };
+  const handleMeta = async (line) => {
+    const [cmd, arg] = line.split(/\s+/);
+    if (cmd === "\\q") {
+      rl.close();
+      return;
+    }
+    if (cmd === "\\?") {
+      process.stdout.write(REPL_HELP);
+      return;
+    }
+    if (cmd === "\\dt") {
+      await execute(
+        "SELECT table_schema, table_name FROM information_schema.tables WHERE table_schema NOT IN ('pg_catalog', 'information_schema') ORDER BY 1, 2"
+      );
+      return;
+    }
+    if (cmd === "\\d" && arg != null) {
+      const dot = arg.indexOf(".");
+      const result = await execute(
+        dot > 0 ? "SELECT column_name, data_type, is_nullable, column_default FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 ORDER BY ordinal_position" : "SELECT table_schema, column_name, data_type, is_nullable, column_default FROM information_schema.columns WHERE table_name = $1 ORDER BY table_schema, ordinal_position",
+        dot > 0 ? [arg.slice(0, dot), arg.slice(dot + 1)] : [arg]
+      );
+      if (result?.rows.length === 0) {
+        process.stderr.write(`Did not find any relation named "${arg}".
+`);
+      }
+      return;
+    }
+    process.stderr.write(`Unknown command ${line}. Try \\?
+`);
+  };
+  const handleLine = async (line) => {
+    const trimmed = line.trim();
+    if (buffer.length === 0 && trimmed.startsWith("\\")) {
+      await handleMeta(trimmed);
+    } else if (buffer.length > 0 || trimmed.length > 0) {
+      buffer += (buffer.length > 0 ? "\n" : "") + line;
+      if (trimmed.endsWith(";")) {
+        const sql = buffer;
+        buffer = "";
+        await execute(sql);
+      }
+    }
+    prompt();
+  };
+  if (interactive) {
+    process.stdout.write(
+      `Connected to table space ${tableSpaceId}. \\? for help, \\q to quit.
+`
+    );
+  }
+  await new Promise((resolve3) => {
+    let queue = Promise.resolve();
+    rl.on("line", (line) => {
+      queue = queue.then(() => handleLine(line));
+    });
+    rl.on("SIGINT", () => {
+      buffer = "";
+      process.stdout.write("\n");
+      prompt();
+    });
+    rl.on("close", () => {
+      queue = queue.then(async () => {
+        if (buffer.trim().length > 0) await execute(buffer);
+      });
+      queue.then(resolve3).catch(resolve3);
+    });
+    prompt();
+  });
+};
+var runSql = async (args) => {
+  const tableSpaceId = args[0];
+  if (tableSpaceId == null || tableSpaceId.startsWith("-")) {
+    throw new Error(
+      'Usage: overai sql <tableSpaceId> ["SELECT ..."]  (no query \u2192 interactive session)'
+    );
+  }
+  const format = resolveFormat(flagValue(args, "-o", "--output"));
+  const { organizationId } = await getAccessToken();
+  const query = (() => {
+    const rest = args.slice(1);
+    for (let i = 0; i < rest.length; i++) {
+      const arg = rest[i];
+      if (arg === "-o" || arg === "--output") {
+        i++;
+        continue;
+      }
+      if (arg != null && !arg.startsWith("-")) return arg;
+    }
+    return void 0;
+  })();
+  if (query == null) return runRepl(organizationId, tableSpaceId, format);
+  const result = await runQuery(organizationId, tableSpaceId, query);
+  printResult(result.rows, format);
+  if (process.stderr.isTTY) {
+    process.stderr.write(`${summarize(result)}
+`);
+  }
+};
+
+// src/commands/update.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { fileURLToPath } from "url";
+var PACKAGE_NAME = "@overaihq/cli";
+var packageRootUrl = () => {
+  for (const up of ["..", "../..", "../../.."]) {
+    if (existsSync3(new URL(`${up}/package.json`, import.meta.url))) {
+      return new URL(`${up}/`, import.meta.url);
+    }
+  }
+  throw new Error("package.json not found relative to the CLI bundle");
+};
+var cliVersion = () => {
+  const pkg = JSON.parse(
+    readFileSync4(new URL("package.json", packageRootUrl()), "utf8")
+  );
+  return pkg.version;
+};
+var detectInstaller = () => {
+  const path = fileURLToPath(import.meta.url);
+  if (path.includes("_npx") || path.includes("dlx-")) return "ephemeral";
+  if (path.includes(".pnpm") || /[\\/]pnpm[\\/]/.test(path)) return "pnpm";
+  if (path.includes(".bun")) return "bun";
+  return "npm";
+};
+var runUpdate = async () => {
+  const current = cliVersion();
+  if (existsSync3(new URL("src", packageRootUrl()))) {
+    process.stdout.write(
+      "Development build \u2014 rebuild from the repo instead of updating from npm.\n"
+    );
+    return;
+  }
+  const res = await fetch(
+    `https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`,
+    // Bound the lookup so a slow/unreachable registry can't hang the command.
+    { signal: AbortSignal.timeout(1e4) }
+  );
+  if (!res.ok) {
+    throw new Error(`npm registry lookup failed (HTTP ${String(res.status)})`);
+  }
+  const body = await res.json();
+  const latest = typeof body.version === "string" ? body.version : null;
+  if (latest == null) {
+    throw new Error("npm registry returned an unexpected response");
+  }
+  if (latest === current) {
+    process.stdout.write(`overai ${current} is up to date.
+`);
+    return;
+  }
+  const cur = current.split(".").map(Number);
+  const lat = latest.split(".").map(Number);
+  const cmp = cur.map((n, i) => n - (lat[i] ?? 0)).find((d) => d !== 0) ?? 0;
+  if (cmp > 0) {
+    process.stdout.write(
+      `overai ${current} is ahead of latest (${latest}) \u2014 likely a @next install; nothing to do.
+`
+    );
+    return;
+  }
+  const installer = detectInstaller();
+  if (installer === "ephemeral") {
+    process.stdout.write(
+      `Running from an npx/dlx cache (current ${current}, latest ${latest}) \u2014 invoke as \`npx ${PACKAGE_NAME}@latest\` to always get the newest release.
+`
+    );
+    return;
+  }
+  const spec = `${PACKAGE_NAME}@${latest}`;
+  const argsByInstaller = {
+    npm: ["npm", "install", "-g", spec],
+    pnpm: ["pnpm", "add", "-g", spec],
+    bun: ["bun", "add", "-g", spec]
+  };
+  const [cmd, ...args] = argsByInstaller[installer];
+  process.stdout.write(
+    `Updating overai ${current} \u2192 ${latest} via ${installer}\u2026
+`
+  );
+  const result = spawnSync(cmd, args, {
+    stdio: "inherit",
+    // npm/pnpm are .cmd shims on Windows; a shell is required to resolve them.
+    shell: process.platform === "win32"
+  });
+  if (result.status !== 0) {
+    throw new Error(
+      `${[cmd, ...args].join(" ")} failed (exit ${String(result.status ?? "?")})`
+    );
+  }
+  process.stdout.write(`Updated to ${latest}.
+`);
+};
+
+// src/commands/versions.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { mkdirSync as mkdirSync4, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname3, join as join5 } from "path";
+var parseRef = (raw) => {
+  if (raw === "local" || raw === "base" || raw === "deployed" || raw === "latest") {
+    return raw;
+  }
+  const n = Number(raw.replace(/^v/, ""));
+  if (!Number.isInteger(n) || n < 1) {
+    throw new Error(
+      `Bad version ref "${raw}" \u2014 use a number, local, base, deployed, or latest.`
+    );
+  }
+  return n;
+};
+var findResource = (manifest, filter) => {
+  const matches = Object.entries(manifest.resources).filter(
+    ([id, r]) => id === filter || r.name.toLowerCase().includes(filter.toLowerCase()) || r.files.some((f) => f.includes(filter))
+  );
+  if (matches.length === 0) throw new Error(`Nothing matched "${filter}".`);
+  const match = matches[0];
+  if (match == null || matches.length > 1) {
+    throw new Error(
+      `"${filter}" is ambiguous:
+${matches.map(([id, r]) => `  ${r.name} (${id})`).join("\n")}`
+    );
+  }
+  return match;
+};
+var filesAtRef = async (root, id, resource, ref) => {
+  const local = (reader) => Object.fromEntries(
+    resource.files.flatMap((p) => {
+      const content = reader(root, p);
+      return content == null ? [] : [[p, content]];
+    })
+  );
+  if (ref === "local") return local(readWorkingFile);
+  if (ref === "base") return local(readBaseFile);
+  const adapter = adapterFor(resource.type);
+  const versionNumber = await (async () => {
+    if (typeof ref === "number") return ref;
+    const head = await adapter.head(id);
+    if (ref === "latest") return head.latestVersion;
+    if (head.deployedVersion == null) {
+      throw new Error(`${resource.name} has no deployed version.`);
+    }
+    return head.deployedVersion;
+  })();
+  return adapter.fetchVersion(id, versionNumber, resource.name);
+};
+var pickFile = (files, meta) => {
+  const entry = Object.entries(files).find(
+    ([p]) => meta ? p.endsWith(".meta.json") : !p.endsWith(".meta.json")
+  );
+  if (entry == null) {
+    throw new Error(meta ? "No meta file for this resource." : "No code file.");
+  }
+  return entry[1];
+};
+var runCat = async (args) => {
+  const target = args.find((a) => !a.startsWith("-"));
+  if (target == null) {
+    throw new Error(
+      "Usage: overai cat <filter>[@version|@deployed|@latest|@base] [--meta]"
+    );
+  }
+  const { root, manifest } = openClone();
+  const at = target.lastIndexOf("@");
+  const filter = at > 0 ? target.slice(0, at) : target;
+  const ref = at > 0 ? parseRef(target.slice(at + 1)) : "local";
+  const [id, resource] = findResource(manifest, filter);
+  const files = await filesAtRef(root, id, resource, ref);
+  process.stdout.write(pickFile(files, args.includes("--meta")));
+};
+var runDiff = async (args) => {
+  const { root, manifest } = openClone();
+  const filter = args.find((a) => !a.startsWith("-"));
+  const from = parseRef(flagValue(args, "--from") ?? "base");
+  const to = parseRef(flagValue(args, "--to") ?? "local");
+  const resources = filter != null ? [findResource(manifest, filter)] : Object.entries(manifest.resources);
+  for (const [id, resource] of resources) {
+    if (from === "base" && to === "local") {
+      for (const relPath of resource.files) {
+        const missing = readWorkingFile(root, relPath) == null;
+        spawnSync2(
+          "git",
+          [
+            "diff",
+            "--no-index",
+            "--src-prefix=base/",
+            "--dst-prefix=local/",
+            join5(".overai", "base", relPath),
+            missing ? "/dev/null" : relPath
+          ],
+          { stdio: "inherit", cwd: root }
+        );
+      }
+      continue;
+    }
+    const [fromFiles, toFiles] = await Promise.all([
+      filesAtRef(root, id, resource, from),
+      filesAtRef(root, id, resource, to)
+    ]);
+    const tmp = mkdtempSync(join5(tmpdir(), "overai-diff-"));
+    try {
+      for (const [side, files] of [
+        ["from", fromFiles],
+        ["to", toFiles]
+      ]) {
+        for (const [relPath, content] of Object.entries(files)) {
+          const abs = join5(tmp, side, relPath);
+          mkdirSync4(dirname3(abs), { recursive: true });
+          writeFileSync3(abs, content);
+        }
+      }
+      spawnSync2(
+        "git",
+        [
+          "diff",
+          "--no-index",
+          `--src-prefix=${String(from)}/`,
+          `--dst-prefix=${String(to)}/`,
+          "from",
+          "to"
+        ],
+        { stdio: "inherit", cwd: tmp }
+      );
+    } finally {
+      rmSync2(tmp, { recursive: true, force: true });
+    }
+  }
+};
+
+// src/index.ts
+var HELP = `overai \u2014 OverAI command-line interface
+
+Usage:
+  overai signin                        Sign in via your browser
+  overai signout                       Sign out and revoke this session
+  overai whoami                        Show the current identity and org
+  overai org list                      List your organizations
+  overai org switch <orgId>            Switch the active org
+  overai graphql -q '<query>' | -f <file> [--v1]
+                                       Run a GraphQL operation (/v2; --v1 = legacy Hasura)
+  overai fn <functionId> [--input k=v ... | -]
+                                       Invoke a function
+  overai fn logs <functionId> [--limit N] [--execution <id>]
+                                       Execution history / logs
+  overai sql <tableSpaceId> ["<SQL>"]  Run SQL against a tablespace; no query
+                                       opens a psql-style session (stdin scripts work)
+
+Workspace sync (edit resources as local files):
+  overai clone <workspaceId> [dir]     Materialize a workspace as files
+  overai status                        Local edits + remote drift
+  overai diff [filter] [--from <ref>] [--to <ref>]
+                                       Diff versions (refs: N, base, local, deployed, latest;
+                                       default base \u2192 local, i.e. your edits)
+  overai cat <filter>[@ref] [--meta]   Print a version's code to stdout
+                                       (composes: diff <(overai cat x@3) <(overai cat x@5))
+  overai pull                          Fast-forward clean resources to remote
+  overai push [filter] -m <msg> [--deploy] [--force]
+                                       Create new versions from local edits
+  overai deploy [filter | --all]       Point deployed versions at pushed ones
+  overai restore <filter | --all>      Discard local edits (back to base)
+  overai open [filter | id]            Open a resource (or the workspace) in the webapp
+  overai dev <filter> [--port N] [--open]
+                                       Live-preview a web page from local files
+  overai review                        Validation + best-practice review packet
+  overai best-practices [topic]        Print bundled guides
+  overai update                        Update the global install to the latest release
+  overai version                       Print the CLI version
+
+Automations:
+  overai automation runs <automationId> [--limit N] [--failed] [--running]
+  overai automation state <runId> [--node <variableId>]
+  overai automation run <automationId> [--input k=v ... | -]
+
+Output: table on a TTY, JSON when piped; -o json|table|csv to force.
+Aliases: login = signin, logout = signout.
+Env: OVERAI_API_URL, OVERAI_APP_URL override the target deployment.
+`;
+process.stdout.on("error", (error) => {
+  if (error.code === "EPIPE") process.exit(0);
+  throw error;
+});
+var run = async () => {
+  const [command, ...rest] = process.argv.slice(2);
+  switch (command) {
+    case "signin":
+    case "login":
+      await signIn();
+      return;
+    case "signout":
+    case "logout":
+      await signOut();
+      return;
+    case "whoami":
+      whoami();
+      return;
+    case "org":
+      if (rest[0] === "list") {
+        await listOrgs(rest.slice(1));
+        return;
+      }
+      if (rest[0] === "switch" && rest[1] != null) {
+        await switchOrg(rest[1]);
+        return;
+      }
+      process.stderr.write("Usage: overai org list | org switch <orgId>\n");
+      process.exitCode = 1;
+      return;
+    case "graphql":
+      await runGraphql(rest);
+      return;
+    case "fn":
+      await runFn(rest);
+      return;
+    case "sql":
+      await runSql(rest);
+      return;
+    case "clone":
+      await runClone(rest);
+      return;
+    case "status":
+      await runStatus();
+      return;
+    case "diff":
+      await runDiff(rest);
+      return;
+    case "cat":
+      await runCat(rest);
+      return;
+    case "pull":
+      await runPull();
+      return;
+    case "push":
+      await runPush(rest);
+      return;
+    case "deploy":
+      await runDeploy(rest);
+      return;
+    case "restore":
+      runRestore(rest);
+      return;
+    case "open":
+      await runOpen(rest);
+      return;
+    case "dev":
+      await runDev(rest);
+      return;
+    case "review":
+      await runReview();
+      return;
+    case "best-practices":
+      runBestPractices(rest);
+      return;
+    case "automation":
+      await runAutomation(rest);
+      return;
+    case "update":
+    case "upgrade":
+      await runUpdate();
+      return;
+    case "version":
+    case "--version":
+    case "-v":
+      process.stdout.write(`${cliVersion()}
+`);
+      return;
+    case void 0:
+    case "help":
+    case "--help":
+    case "-h":
+      process.stdout.write(HELP);
+      return;
+    default:
+      process.stderr.write(`Unknown command: ${command}
+
+${HELP}`);
+      process.exitCode = 1;
+  }
+};
+run().catch((error) => {
+  process.stderr.write(
+    `${error instanceof Error ? error.message : String(error)}
+`
+  );
+  process.exitCode = 1;
+});