@overaihq/cli 0.14.1 → 0.14.3

package/README.md

@@ -157,6 +157,10 @@ send a literal value that starts with `@`.
 
 ## For AI agents
 
+To onboard an agent, point it at this README and paste:
+
+> I use OverAI. Help me get set up with the CLI (https://www.npmjs.com/package/@overaihq/cli): install it, get me logged in, and then walk me through onboarding.
+
 The CLI bundles its own guidance — no extra setup files needed. Point your
 agent at a cloned workspace and have it run:
 

package/dist/{chunk-FTBTDB2B.js → chunk-4QWKERK2.js}

@@ -386,26 +386,39 @@ var injectCodeMessageSchema = external_exports.object({
 // ../common/src/webPage.ts
 var webPageLanguage = ["react"];
 var configFlag = external_exports.union([external_exports.boolean(), external_exports.string()]).nullish().transform((value) => value === true || value === "true").catch(false);
-var webPageConfigSchema = external_exports.object({
-  language: external_exports.enum(["react"]).catch("react"),
-  /* Missing on legacy versions; invalid modes fail closed instead of granting workspace access. */
-  authorizationMode: external_exports.enum(["workspace", "viewer"]).default("workspace"),
+var webPageConfigFields = {
+  language: external_exports.enum(webPageLanguage),
+  /* Invalid modes fail closed instead of granting workspace access. */
+  authorizationMode: external_exports.enum(["workspace", "viewer"]),
   customTitle: external_exports.string().nullish(),
-  code: external_exports.string().default(reactDefaultTemplate),
+  code: external_exports.string(),
   dataSourceUrl: external_exports.string().nullish(),
-  filter: itemFilterExpressionRootSchema.nullish().catch(null),
+  filter: itemFilterExpressionRootSchema.nullish(),
   /* Drops the iframe's sandbox attribute — needed for storage, cookies, forms. */
-  noSandbox: configFlag,
+  noSandbox: external_exports.boolean().nullish(),
   /* Renders the page fullscreen for end users by hiding the workspace top bar. */
-  hideTopBar: configFlag,
+  hideTopBar: external_exports.boolean().nullish(),
   /*
    * Which iframe runtime renders the page. "v1" is the sandboxed srcdoc
    * iframe; "v2" serves the page from its own origin (separate renderer
-   * process, real localStorage). Absent or invalid reads as "v1" so a legacy
-   * config never fails to parse over the toggle.
+   * process, real localStorage).
    */
-  runtime: external_exports.enum(["v1", "v2"]).catch("v1")
+  runtime: external_exports.enum(["v1", "v2"])
+};
+var webPageConfigSchema = external_exports.object({
+  ...webPageConfigFields,
+  language: webPageConfigFields.language.catch("react"),
+  // Missing on legacy versions.
+  authorizationMode: webPageConfigFields.authorizationMode.default("workspace"),
+  code: webPageConfigFields.code.default(reactDefaultTemplate),
+  filter: webPageConfigFields.filter.catch(null),
+  noSandbox: configFlag,
+  hideTopBar: configFlag,
+  // Absent or invalid reads as "v1" so a legacy config never fails to parse
+  // over the toggle.
+  runtime: webPageConfigFields.runtime.catch("v1")
 });
+var webPageConfigUpdateSchema = external_exports.object(webPageConfigFields).partial();
 var webPageConfigWriteSchema = webPageConfigSchema.extend({
   noSandbox: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
   hideTopBar: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
@@ -420,8 +433,10 @@ var defaultWebPageTemplate = reactDefaultTemplate.replace(
 
 export {
   itemFilterExpressionRootSchema,
+  reactDefaultTemplate,
   webPageLanguage,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   defaultWebPageTemplate
 };

package/dist/index.js

@@ -4,8 +4,9 @@ import {
 } from "./chunk-WGPBYGU6.js";
 import {
   itemFilterExpressionRootSchema,
+  reactDefaultTemplate,
   webPageConfigSchema
-} from "./chunk-FTBTDB2B.js";
+} from "./chunk-4QWKERK2.js";
 import {
   external_exports
 } from "./chunk-PF6GZFT4.js";
@@ -27818,7 +27819,7 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-7BXDGWX5.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-ICODVQMY.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
@@ -27874,6 +27875,7 @@ var functionFiles = (id, name2, version) => {
     [`${stem}.ts`]: version.code,
     [`${stem}.meta.json`]: metaJson({
       inputSchema: version.inputSchema,
+      callerAccess: version.callerAccess,
       outputSchema: version.outputSchema,
       executionTimeout: version.executionTimeout,
       executionCpu: version.executionCpu,
@@ -27890,7 +27892,7 @@ var functionAdapter = {
           nodes {
             id name
             functionVersions(orderBy: [VERSION_NUMBER_DESC], first: 1) {
-              nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory }
+              nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory callerAccess }
             }
             functionDeployedVersion { versionNumber }
           }
@@ -27932,7 +27934,7 @@ var functionAdapter = {
     const data = await gqlRequest(
       `query CliFunctionVersion($functionId: String!, $versionNumber: Int!) {
         functionVersion(functionId: $functionId, versionNumber: $versionNumber) {
-          versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory
+          versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory callerAccess
         }
       }`,
       { functionId: id, versionNumber }
@@ -27947,12 +27949,12 @@ var functionAdapter = {
   push: async (id, files, message, expectedLatestVersion) => {
     const meta = JSON.parse(fileBySuffix(files, ".meta.json"));
     const data = await gqlRequest(
-      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int) {
+      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int, $callerAccess: String) {
         createFunctionVersion(input: { expectedLatestVersion: $expectedLatestVersion, functionVersion: {
           functionId: $functionId, code: $code, message: $message,
           inputSchema: $inputSchema, outputSchema: $outputSchema,
           executionTimeout: $executionTimeout, executionCpu: $executionCpu,
-          executionMemory: $executionMemory
+          executionMemory: $executionMemory, callerAccess: $callerAccess
         }}) { functionVersion { versionNumber } }
       }`,
       {
@@ -27960,6 +27962,8 @@ var functionAdapter = {
         functionId: id,
         code: fileBySuffix(files, ".ts"),
         message,
+        // Omission in older clones lets the database inherit the latest policy.
+        callerAccess: meta.callerAccess ?? null,
         // Match the webapp's save defaults so a missing meta doesn't zero out
         // limits, and so an explicit null doesn't hit the NOT NULL column.
         inputSchema: meta.inputSchema ?? "",
@@ -33936,31 +33940,37 @@ engine.registerTag("generatePassword", GeneratePasswordTag);
 
 // ../common/src/printablePage.ts
 var printablePageLanguage = ["liquid", "react"];
-var reactDefaultTemplate = `function App() {
-  return (
-    <div className="page">
-      <h1>My Page Title</h1>
-      <p>Page content goes here...</p>
-    </div>
-  );
-}`;
+var printablePageConfigFields = {
+  pageSize: external_exports.object({ width: external_exports.string(), height: external_exports.string() }),
+  pageMargins: external_exports.object({
+    top: external_exports.string(),
+    right: external_exports.string(),
+    bottom: external_exports.string(),
+    left: external_exports.string()
+  }),
+  language: external_exports.enum(printablePageLanguage),
+  code: external_exports.string(),
+  dataSourceUrl: external_exports.string().nullish(),
+  filter: itemFilterExpressionRootSchema.nullish(),
+  customTitle: external_exports.string().nullish()
+};
 var printablePageConfigSchema = external_exports.object({
-  pageSize: external_exports.object({
+  ...printablePageConfigFields,
+  // Per-key defaults so a stored object missing one dimension still reads.
+  pageSize: printablePageConfigFields.pageSize.extend({
     width: external_exports.string().default("8.5in"),
     height: external_exports.string().default("11in")
   }).prefault({}),
-  pageMargins: external_exports.object({
+  pageMargins: printablePageConfigFields.pageMargins.extend({
     top: external_exports.string().default("0.5in"),
     right: external_exports.string().default("0.5in"),
     bottom: external_exports.string().default("0.5in"),
     left: external_exports.string().default("0.5in")
   }).prefault({}),
-  language: external_exports.enum(printablePageLanguage).default("react"),
-  code: external_exports.string().default(reactDefaultTemplate),
-  dataSourceUrl: external_exports.string().nullish(),
-  filter: itemFilterExpressionRootSchema.nullish(),
-  customTitle: external_exports.string().nullish()
+  language: printablePageConfigFields.language.default("react"),
+  code: printablePageConfigFields.code.default(reactDefaultTemplate)
 });
+var printablePageConfigUpdateSchema = external_exports.object(printablePageConfigFields).partial();
 var printablePageRenderDiagnosticsSchema = external_exports.object({
   /** Absent when the render itself failed before any text existed. */
   renderedTextLength: external_exports.number().optional(),
@@ -35354,6 +35364,7 @@ var generateRandomVariableName = customAlphabet(
 
 // ../common/src/ids.ts
 var ID_PREFIXES = {
+  action: { prefix: "act", body: 20 },
   action_runner: { prefix: "ar", body: 10 },
   action_runner_email_alert: { prefix: "area", body: 10 },
   action_runner_email_subscription: { prefix: "ares", body: 10 },
@@ -35409,6 +35420,7 @@ var ID_PREFIXES = {
   mailbox: { prefix: "mbx", body: 10 },
   mailbox_address: { prefix: "mba", body: 10 },
   mailbox_message: { prefix: "mbm", body: 10 },
+  notification: { prefix: "ntf", body: 12 },
   organization_usage_credit: { prefix: "crd", body: 12 },
   organization_usage_transaction: { prefix: "utx", body: 12 },
   page: { prefix: "pg", body: 10 },
@@ -36667,8 +36679,13 @@ Rules that keep graphs healthy:
   of the same parent; never connect across loop boundaries.
 - Keep TYPESCRIPT_CODE nodes small and focused \u2014 split logic across nodes and
   let the graph orchestrate, rather than one big code block.
-- Node inputs reference upstream state via variableIds (e.g. STATE.S1, Liquid
-  {{S1.field}}). After renaming/removing a node, grep the document for its
+- Write TYPESCRIPT_CODE as a module:
+  \`export default async function step(state: StepState, ctx, env) { const s1 = await state.get("S1"); return s1.rows; }\`.
+  \`state.get\` fetches one step's output on first read (cached for that node's execution),
+  resolves undefined for a skipped step, and rejects for an id not visible
+  from the node. Bare snippets (STATE/OUTPUT globals) are legacy, being retired.
+- Node inputs reference upstream state via variableIds (e.g.
+  \`await state.get("S1")\`, Liquid {{S1.field}}). After renaming/removing a node, grep the document for its
   variableId \u2014 dangling references fail at runtime, not at push.
 - Bring IF_ELSE branches back together with an ALWAYS node.
 - A loop (LOOP_ARRAY/LOOP_RANGE) always resolves to its success handle once all
@@ -36732,9 +36749,10 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
 - SQL from pages: env.TBSxxx.sql tagged templates only; compose dynamic SQL by
   nesting sql fragments, sql([...]) for IN lists. sql.unsafe only for dynamic
   identifiers.
-- For end-user-facing workspaces, add page-to-page navigation (end users land
-  on the workspace homepage and can only follow links). "Hide Top Bar" gives
-  an app-like experience.
+- End-user-facing workspaces have two modes. App (the default): end users land
+  on the workspace homepage and can only follow links, so add page-to-page
+  navigation; "Hide Top Bar" gives an app-like experience. Pages: the top bar
+  lists every deployed page, so pages only need links to ones marked hidden.
 - Public pages (/public/:id) have no viewer identity \u2014 useCurrentUser() is
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
@@ -36783,8 +36801,14 @@ var functions = `# Function best practices
 Functions are TypeScript HTTP handlers in a Deno sandbox: full env SDK,
 esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
 <slug>.<id>.meta.json (inputSchema, outputSchema, executionTimeout ms,
-executionMemory MB).
+executionMemory MB, callerAccess).
 
+- New functions allow only callers with workspace access by default. Set
+  callerAccess to "public" in meta.json only when an unauthenticated endpoint is
+  intended. Existing functions retain their saved policy when older meta.json
+  files omit this field. The policy is versioned: deploy the saved version to
+  change who can call the live endpoint. Workspace uses Authorization for the
+  platform bearer token; put additional application credentials in another header.
 - Functions are full HTTP apps: method + sub-path are forwarded to your code,
   and each execution records requestMethod/requestPath. Callers reach a route
   with env.FNxxx.call({ method, path: "/features/123" }) \u2014 path defaults to the
@@ -37353,6 +37377,102 @@ var runSql = async (args) => {
   }
 };
 
+// src/commands/storage.ts
+import { openAsBlob, writeFileSync as writeFileSync6 } from "fs";
+var USAGE3 = "Usage: overai storage upload <path> [--no-random-prefix] | storage download <key> [path|-] | storage exists <key> | storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]";
+var runStorage = async (args) => {
+  const [operation, first2, second] = args;
+  if (operation == null) throw new Error(USAGE3);
+  const { organizationId } = await getAccessToken();
+  const segment = (key) => encodeURIComponent(key);
+  if (operation === "upload") {
+    if (first2 == null || first2 === "-") {
+      throw new Error("Upload requires a file path (stdin uploads need a filename to build the key).");
+    }
+    const randomPrefix = !args.includes("--no-random-prefix");
+    const query = randomPrefix ? "" : "?disableRandomPrefix=true";
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/stream${query}`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/octet-stream",
+          "x-file-name": first2.split("/").pop() ?? first2
+        },
+        body: await openAsBlob(first2)
+      }
+    );
+    if (!response.ok) {
+      throw v2Error("storage upload", response, await response.text());
+    }
+    const { path } = await response.json();
+    const key = path.startsWith(`${organizationId}/`) ? path.slice(organizationId.length + 1) : path;
+    const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+    if (format2 === "json") printResult({ key, path }, format2);
+    else process.stdout.write(`${key}
+`);
+    return;
+  }
+  if (first2 == null) throw new Error(USAGE3);
+  if (operation === "download") {
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}`,
+      { redirect: "follow" }
+    );
+    if (!response.ok) {
+      throw v2Error("storage download", response, await response.text());
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (second != null && second !== "-") writeFileSync6(second, bytes);
+    else process.stdout.write(bytes);
+    return;
+  }
+  if (operation === "exists") {
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}/exists`
+    );
+    if (response.status === 404) {
+      if (resolveFormat(flagValue(args, "-o", "--output")) === "json") {
+        printResult({ exists: false }, "json");
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (!response.ok) {
+      throw v2Error("storage exists", response, await response.text());
+    }
+    printResult(
+      { exists: true, ...await response.json() },
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
+    return;
+  }
+  if (operation === "head") {
+    const lines = flagValue(args, "--lines") ?? "50";
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}/head?numLines=${encodeURIComponent(lines)}`
+    );
+    if (!response.ok) {
+      throw v2Error("storage head", response, await response.text());
+    }
+    process.stdout.write(await response.text());
+    return;
+  }
+  if (operation === "presign") {
+    const expiresIn2 = flagValue(args, "--expires-in") ?? String(60 * 60 * 24 * 7);
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}/presign?expiresIn=${encodeURIComponent(expiresIn2)}`
+    );
+    if (!response.ok) {
+      throw v2Error("storage presign", response, await response.text());
+    }
+    process.stdout.write(`${(await response.text()).trim()}
+`);
+    return;
+  }
+  throw new Error(USAGE3);
+};
+
 // src/commands/workspace.ts
 var workspaceIdFrom = (args) => args.find(
   (arg, index) => !arg.startsWith("-") && args[index - 1] !== "-o" && args[index - 1] !== "--output"
@@ -37436,7 +37556,7 @@ var listWorkspaceUsers = async (args) => {
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var USAGE3 = `Usage:
+var USAGE4 = `Usage:
   overai workspace list [--archived] [--limit <n>]
   overai workspace show [workspaceId]
   overai workspace users [workspaceId]
@@ -37454,7 +37574,7 @@ var runWorkspace = async (args) => {
     await listWorkspaceUsers(args.slice(1));
     return;
   }
-  process.stderr.write(USAGE3);
+  process.stderr.write(USAGE4);
   process.exitCode = 1;
 };
 
@@ -37616,6 +37736,9 @@ Other resources:
   overai data-stream query <id> --start <date> --end <date> [--query <filter>]
   overai data-file upload <id> <path> [-m <message>]
   overai data-file download <id> [path|-] | data-file head <id>
+  overai storage upload <path> [--no-random-prefix]
+  overai storage download <key> [path|-] | storage exists <key>
+  overai storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]
   overai knowledge-base upload <id> <file...>
   overai knowledge-base search <id> <query> [--limit N]
   overai integration configure <id> --config <json|@file|@->
@@ -37861,6 +37984,9 @@ var run = async () => {
     case "data-file":
       await runDataFile(rest);
       return;
+    case "storage":
+      await runStorage(rest);
+      return;
     case "integration":
       await runIntegration(rest);
       return;

package/dist/{webPage-7BXDGWX5.js → webPage-ICODVQMY.js}

@@ -1,14 +1,16 @@
 import {
   defaultWebPageTemplate,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   webPageLanguage
-} from "./chunk-FTBTDB2B.js";
+} from "./chunk-4QWKERK2.js";
 import "./chunk-PF6GZFT4.js";
 import "./chunk-U67V476Y.js";
 export {
   defaultWebPageTemplate,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   webPageLanguage
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "@perygee/common": "0.0.0",
-    "@types/node": "^24.13.5",
+    "@types/node": "^24.19.0",
     "@types/proper-lockfile": "^4.1.4",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",