@overaihq/cli 0.14.11 → 0.14.12

package/dist/index.js

@@ -52345,6 +52345,317 @@ var exchangeSessionToken = (baseUrl, refreshToken, destinationOrgId) => unauthen
   destinationOrgId
 });
 
+// ../sdk/src/error.ts
+var OverAIError = class extends Error {
+  /** HTTP status; 200 for a GraphQL errors-array failure. */
+  status;
+  /** URL pathname of the request, "" when unknown. */
+  path;
+  /** Parsed JSON body, the raw string when not JSON, or null. */
+  body;
+  /** The org the request ran as, when known. */
+  organizationId;
+  /** GraphQL errors array, when that is the cause. */
+  errors;
+  constructor(message, fields) {
+    super(message);
+    this.status = fields.status;
+    this.path = fields.path;
+    this.body = fields.body;
+    this.organizationId = fields.organizationId;
+    if (fields.errors != null) this.errors = fields.errors;
+  }
+};
+var responsePath = (res) => {
+  try {
+    return new URL(res.url).pathname;
+  } catch {
+    return "";
+  }
+};
+var STATUS_TEXT = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  409: "Conflict",
+  413: "Payload Too Large",
+  429: "Too Many Requests",
+  500: "Internal Server Error",
+  503: "Service Unavailable"
+};
+var apiError = (label, res, rawBody, organizationId) => {
+  const body = (() => {
+    try {
+      return JSON.parse(rawBody);
+    } catch {
+      return rawBody;
+    }
+  })();
+  const structured = typeof body === "object" && body != null ? body : null;
+  const field = structured?.error ?? structured?.message;
+  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
+  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
+  const path = responsePath(res);
+  const fields = { status: res.status, path, body, organizationId };
+  if (reason != null) return new OverAIError(reason, fields);
+  return new OverAIError(
+    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
+  ${path}`}${organizationId == null ? "" : `
+  Asked as org ${organizationId}.`}`,
+    fields
+  );
+};
+
+// ../sdk/src/agentRun.ts
+var agentRun = (client, id) => {
+  const deployedVersionNumber = async () => {
+    const deployed = await client.graphql(
+      `query SdkAgentDeployedVersion($id: String!) {
+      agentDeployedVersions(condition: { agentId: $id }) { nodes { versionNumber } }
+    }`,
+      { id }
+    );
+    const versionNumber = deployed.agentDeployedVersions?.nodes[0]?.versionNumber;
+    if (versionNumber == null) {
+      throw new Error(
+        `Agent ${id} has no deployed version; pass --version <n> to inspect a saved one.`
+      );
+    }
+    return versionNumber;
+  };
+  return {
+    generate: async (message) => {
+      const organizationId = await client.organizationId();
+      const res = await client.fetch(
+        `/v2/agents/${organizationId}/${id}/generate/text`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ message })
+        }
+      );
+      const raw2 = await res.text();
+      if (!res.ok) throw apiError("agent generate", res, raw2, organizationId);
+      return JSON.parse(raw2);
+    },
+    /*
+     * What an agent can actually do is spread over five bindings and a model,
+     * and nothing in the product shows it in one place.
+     */
+    tools: async (ref = "deployed") => {
+      const version2 = typeof ref === "number" ? ref : ref === "latest" ? (await client.agent(id).head()).latestVersion : await deployedVersionNumber();
+      const data = await client.graphql(
+        `query SdkAgentTools($id: String!, $version: Int!) {
+      agent(id: $id) {
+        name
+        agentVersions(first: 1, condition: { versionNumber: $version }) {
+          nodes {
+            versionNumber
+            model
+            agentVersionFunctionsByAgentIdAndVersionNumber(orderBy: [FUNCTION_ID_ASC]) {
+              nodes { functionId function { name } }
+            }
+            agentVersionTableSpacesByAgentIdAndVersionNumber(orderBy: [TABLE_SPACE_ID_ASC]) {
+              nodes { tableSpaceId accessMode }
+            }
+            agentVersionAgentsByAgentIdAndVersionNumber(orderBy: [ATTACHED_AGENT_ID_ASC]) {
+              nodes { attachedAgentId }
+            }
+            agentVersionKnowledgeBasesByAgentIdAndVersionNumber(orderBy: [KNOWLEDGE_BASE_ID_ASC]) {
+              nodes { knowledgeBaseId }
+            }
+            agentVersionBuiltinToolSetsByAgentIdAndVersionNumber(orderBy: [TOOL_SET_ASC]) {
+              nodes { toolSet }
+            }
+          }
+        }
+      }
+    }`,
+        { id, version: version2 }
+      );
+      if (data.agent == null) throw new Error(`Agent ${id} not found.`);
+      const agentVersion = data.agent.agentVersions.nodes[0];
+      if (agentVersion == null) {
+        throw new Error(`Agent ${id} has no version ${String(version2)}.`);
+      }
+      return {
+        agent: data.agent.name,
+        version: agentVersion.versionNumber,
+        model: agentVersion.model,
+        tools: [
+          ...agentVersion.agentVersionFunctionsByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "function",
+              name: link.function?.name ?? link.functionId,
+              detail: link.functionId
+            })
+          ),
+          ...agentVersion.agentVersionTableSpacesByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "table space",
+              name: link.tableSpaceId,
+              detail: link.accessMode
+            })
+          ),
+          ...agentVersion.agentVersionAgentsByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "sub-agent",
+              name: link.attachedAgentId,
+              detail: ""
+            })
+          ),
+          ...agentVersion.agentVersionKnowledgeBasesByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "knowledge base",
+              name: link.knowledgeBaseId,
+              detail: ""
+            })
+          ),
+          ...agentVersion.agentVersionBuiltinToolSetsByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "built-in",
+              name: link.toolSet,
+              detail: ""
+            })
+          )
+        ]
+      };
+    },
+    /* A caller that wants a second turn must create the conversation first — as the webapp does. */
+    createConversation: async (title) => {
+      const versionNumber = await deployedVersionNumber();
+      const created = await client.graphql(
+        `mutation SdkCreateAgentConversation($input: CreateAgentConversationInput!) {
+      createAgentConversation(input: $input) { agentConversation { id } }
+    }`,
+        {
+          input: {
+            agentConversation: {
+              agentId: id,
+              versionNumber,
+              title: title.length > 50 ? `${title.slice(0, 47)}...` : title
+            }
+          }
+        }
+      );
+      const conversationId = created.createAgentConversation?.agentConversation?.id;
+      if (conversationId == null)
+        throw new Error("Failed to create a conversation.");
+      return conversationId;
+    },
+    chat: async (messages, options) => {
+      const organizationId = await client.organizationId();
+      const res = await client.fetch(`/v2/agents/${organizationId}/${id}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          messages,
+          conversationId: options.conversationId
+        })
+      });
+      if (!res.ok)
+        throw apiError("agent chat", res, await res.text(), organizationId);
+      return res;
+    }
+  };
+};
+var agentStreamEvents = (response) => {
+  const parse4 = (line) => {
+    if (!line.startsWith("data: ")) return null;
+    const payload = line.slice(6);
+    if (payload === "[DONE]") return "done";
+    const event = (() => {
+      try {
+        return JSON.parse(payload);
+      } catch {
+        return null;
+      }
+    })();
+    if (event?.type === "text-delta" && event.delta != null)
+      return { type: "text-delta", delta: event.delta };
+    if (event?.type === "error")
+      return event.errorText == null ? { type: "error" } : { type: "error", errorText: event.errorText };
+    return null;
+  };
+  return (async function* () {
+    const body = response.body;
+    if (body == null) return;
+    const decoder = new TextDecoder();
+    const reader = body.getReader();
+    let buffer = "";
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const event = parse4(line);
+        if (event === "done") return;
+        if (event != null) yield event;
+      }
+    }
+    const last2 = parse4(buffer + decoder.decode());
+    if (last2 != null && last2 !== "done") yield last2;
+  })();
+};
+
+// ../sdk/src/automationRun.ts
+var automationRunApi = (client, id) => ({
+  run: async (inputs) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/automations/${organizationId}/${id}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(inputs ?? {})
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("automation run", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  },
+  /*
+   * The v2 condition filters only by automationId; status filters apply
+   * here (the condition type has no errored/isCancelled fields), so a
+   * filtered read over-fetches to still fill the limit.
+   */
+  runs: async (options) => {
+    const limit2 = options?.limit ?? 20;
+    const filtered = options?.failed === true || options?.running === true;
+    const data = await client.graphql(
+      `query SdkAutomationRuns($automationId: String!, $first: Int!) {
+      automationRuns(condition: { automationId: $automationId }, orderBy: [STARTED_AT_DESC], first: $first) {
+        nodes { id startedAt endedAt errored isCancelled manuallyTriggered version { num } }
+      }
+    }`,
+      { automationId: id, first: filtered ? limit2 * 5 : limit2 }
+    );
+    return data.automationRuns.nodes.filter((r) => options?.failed !== true || r.errored).filter(
+      (r) => options?.running !== true || r.endedAt == null && !r.isCancelled
+    ).slice(0, limit2).map((r) => ({
+      id: r.id,
+      version: r.version?.num,
+      startedAt: r.startedAt,
+      endedAt: r.endedAt,
+      status: r.errored ? "errored" : r.isCancelled ? "cancelled" : r.endedAt == null ? "running" : "ok",
+      manual: r.manuallyTriggered
+    }));
+  }
+});
+var automationRunState = async (client, runId) => {
+  const data = await client.graphql(
+    `query SdkAutomationRunState($id: String!) {
+      automationRun(id: $id) { state }
+    }`,
+    { id: runId }
+  );
+  if (data.automationRun == null) throw new Error(`Run ${runId} not found.`);
+  return data.automationRun.state ?? {};
+};
+
 // ../common/src/agent.ts
 var agentVersionConfigSchema = external_exports.object({
   systemPrompt: external_exports.string(),
@@ -58547,6 +58858,81 @@ var createDataFile = async (client, input2) => {
   return { id };
 };
 
+// ../sdk/src/dataFiles.ts
+var dataFileResource = (client, id) => ({
+  read: async () => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(`/v2/data-files/${organizationId}/${id}`, {
+      redirect: "follow"
+    });
+    if (!res.ok)
+      throw apiError(
+        "data-file download",
+        res,
+        await res.text(),
+        organizationId
+      );
+    return res;
+  },
+  head: async (options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/data-files/${organizationId}/${id}/head?numLines=${String(options?.lines ?? 50)}`,
+      { redirect: "follow" }
+    );
+    if (!res.ok)
+      throw apiError("data-file head", res, await res.text(), organizationId);
+    return res;
+  },
+  upload: async (content, options) => {
+    const url2 = await client.trpc("dataFiles.getDataFileUploadUrl", {
+      dataFileId: id,
+      fileSize: content.size,
+      message: options?.message ?? ""
+    });
+    const res = await fetch(url2, { method: "PUT", body: content });
+    if (!res.ok)
+      throw apiError(
+        "data-file upload",
+        res,
+        await res.text(),
+        await client.organizationId()
+      );
+  }
+});
+
+// ../sdk/src/dataStreams.ts
+var dataStreamResource = (client, id) => ({
+  append: async (records) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(`/v1/data-streams/${organizationId}/${id}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        data: Array.isArray(records) ? records : [records]
+      })
+    });
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("data-stream append", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  },
+  query: async (options) => {
+    const organizationId = await client.organizationId();
+    const search2 = new URLSearchParams({
+      startAt: options.startAt,
+      endAt: options.endAt,
+      query: options.query ?? ""
+    });
+    if (options.limit != null) search2.set("limit", String(options.limit));
+    const res = await client.fetch(
+      `/v1/data-streams/${organizationId}/${id}?${search2.toString()}`
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("data-stream query", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  }
+});
+
 // ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/base.js
 var Diff = class {
   diff(oldStr, newStr, options = {}) {
@@ -60392,67 +60778,106 @@ var functionResource = (client, id) => {
   };
 };
 
-// ../sdk/src/error.ts
-var OverAIError = class extends Error {
-  /** HTTP status; 200 for a GraphQL errors-array failure. */
-  status;
-  /** URL pathname of the request, "" when unknown. */
-  path;
-  /** Parsed JSON body, the raw string when not JSON, or null. */
-  body;
-  /** The org the request ran as, when known. */
-  organizationId;
-  /** GraphQL errors array, when that is the cause. */
-  errors;
-  constructor(message, fields) {
-    super(message);
-    this.status = fields.status;
-    this.path = fields.path;
-    this.body = fields.body;
-    this.organizationId = fields.organizationId;
-    if (fields.errors != null) this.errors = fields.errors;
-  }
-};
-var responsePath = (res) => {
-  try {
-    return new URL(res.url).pathname;
-  } catch {
-    return "";
+// ../sdk/src/functionRun.ts
+var functionRun = (client, id) => ({
+  /*
+   * Mirrors `env.FNxxx.call` (common-server envProxy `__callFunction`), so a
+   * caller moving between the sandbox and the SDK keeps one mental model.
+   */
+  call: async (init) => {
+    const { path: rawPath = "", query = {}, body, ...rest } = init ?? {};
+    const queryStart = rawPath.indexOf("?");
+    const pathOnly = queryStart === -1 ? rawPath : rawPath.slice(0, queryStart);
+    const subPath = pathOnly === "" || pathOnly.startsWith("/") ? pathOnly : `/${pathOnly}`;
+    const params = new URLSearchParams(
+      queryStart === -1 ? "" : rawPath.slice(queryStart + 1)
+    );
+    Object.entries(query).forEach(([name2, value]) => {
+      params.set(name2, value);
+    });
+    const search2 = params.toString();
+    const headers = new Headers(rest.headers);
+    const isNativeBody = typeof body === "string" || body instanceof Blob || body instanceof FormData || body instanceof URLSearchParams || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof ReadableStream;
+    if (body != null && !isNativeBody && !headers.has("Content-Type"))
+      headers.set("Content-Type", "application/json");
+    return client.fetch(
+      `/v2/functions/${await client.organizationId()}/${id}${subPath}${search2 === "" ? "" : `?${search2}`}`,
+      {
+        ...rest,
+        method: rest.method ?? "POST",
+        headers,
+        body: body == null ? void 0 : isNativeBody ? body : JSON.stringify(body)
+      }
+    );
+  },
+  executions: async (options) => (await client.graphql(
+    `query SdkFunctionExecutions($functionId: String!, $first: Int!) {
+        functionExecutions(condition: { functionId: $functionId }, orderBy: [CREATED_AT_DESC], first: $first) {
+          nodes { id createdAt httpStatusCode executionTime requestMethod requestPath versionNumber }
+        }
+      }`,
+    { functionId: id, first: options?.limit ?? 20 }
+  )).functionExecutions.nodes,
+  // Logs and bodies live behind presigned S3 URLs (valid ~1h); they carry
+  // their own auth, so they go through the global fetch with no token.
+  execution: async (executionId) => {
+    const data = await client.graphql(
+      `query SdkFunctionExecution($functionId: String!, $id: String!) {
+      functionExecutions(condition: { functionId: $functionId, id: $id }, first: 1) {
+        nodes { id summary createdAt httpStatusCode executionTime versionNumber logsUrl inputBodyUrl outputBodyUrl }
+      }
+    }`,
+      { functionId: id, id: executionId }
+    );
+    const execution = data.functionExecutions.nodes[0];
+    if (execution == null)
+      throw new Error(`Execution ${executionId} not found.`);
+    const [logs, input2, output2] = await Promise.all(
+      [execution.logsUrl, execution.inputBodyUrl, execution.outputBodyUrl].map(
+        async (url2) => url2 == null ? null : await fetch(url2).then((r) => r.ok ? r.text() : null)
+      )
+    );
+    return {
+      id: execution.id,
+      createdAt: execution.createdAt,
+      httpStatusCode: execution.httpStatusCode,
+      executionTime: execution.executionTime,
+      versionNumber: execution.versionNumber,
+      summary: execution.summary,
+      input: input2 ?? null,
+      output: output2 ?? null,
+      logs: logs ?? null
+    };
   }
-};
-var STATUS_TEXT = {
-  400: "Bad Request",
-  401: "Unauthorized",
-  403: "Forbidden",
-  404: "Not Found",
-  409: "Conflict",
-  413: "Payload Too Large",
-  429: "Too Many Requests",
-  500: "Internal Server Error",
-  503: "Service Unavailable"
-};
-var apiError = (label, res, rawBody, organizationId) => {
-  const body = (() => {
-    try {
-      return JSON.parse(rawBody);
-    } catch {
-      return rawBody;
-    }
-  })();
-  const structured = typeof body === "object" && body != null ? body : null;
-  const field = structured?.error ?? structured?.message;
-  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
-  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
-  const path = responsePath(res);
-  const fields = { status: res.status, path, body, organizationId };
-  if (reason != null) return new OverAIError(reason, fields);
-  return new OverAIError(
-    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
-  ${path}`}${organizationId == null ? "" : `
-  Asked as org ${organizationId}.`}`,
-    fields
-  );
-};
+});
+
+// ../sdk/src/integrations.ts
+var integrationResource = (client, id) => ({
+  configure: async (value) => {
+    await client.trpc("putIntegrationConfig", { id, value });
+  },
+  // Config reads are for inspection, not secret export; keep credentials out
+  // of terminals, shell history captures, and agent transcripts.
+  config: () => client.trpc("getMaskedIntegrationConfig", { id }),
+  setSecret: async (key, value) => {
+    await client.graphql(
+      `mutation SdkSetIntegrationSecret($input: UpdateIntegrationConfigInput!) {
+      updateIntegrationConfig(input: $input) { success }
+    }`,
+      { input: { integrationId: id, partialConfig: { [key]: value } } }
+    );
+  },
+  // The merge mutation stores a JSON null for `{key: null}`, so removal is its
+  // own mutation server-side.
+  unsetSecret: async (key) => {
+    await client.graphql(
+      `mutation SdkUnsetIntegrationSecret($input: DeleteIntegrationConfigKeyInput!) {
+      deleteIntegrationConfigKey(input: $input) { success }
+    }`,
+      { input: { integrationId: id, key } }
+    );
+  }
+});
 
 // ../sdk/src/jwt.ts
 var decodeJwtClaims = (token) => {
@@ -60470,6 +60895,112 @@ var decodeJwtClaims = (token) => {
   }
 };
 
+// ../sdk/src/knowledgeBases.ts
+var knowledgeBaseResource = (client, id) => ({
+  upload: async (file2, name2) => {
+    const organizationId = await client.organizationId();
+    const formData = new FormData();
+    formData.append("file", file2, name2);
+    const res = await client.fetch(
+      `/v2/knowledge-bases/${organizationId}/${id}/upload`,
+      { method: "POST", body: formData }
+    );
+    const raw2 = await res.text();
+    if (!res.ok)
+      throw apiError("knowledge-base upload", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  },
+  search: async (query, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/knowledge-bases/${organizationId}/${id}/search`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          query,
+          ...options?.limit != null ? { limit: options.limit } : {}
+        })
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok)
+      throw apiError("knowledge-base search", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  }
+});
+
+// ../sdk/src/lint.ts
+var lint = async (client, input2) => {
+  const res = await client.fetch("/v2/architect/lint", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input2)
+  });
+  const raw2 = await res.text();
+  if (!res.ok) throw apiError("lint", res, raw2, await client.organizationId());
+  const parsed = lintResponseSchema.safeParse(
+    (() => {
+      try {
+        return JSON.parse(raw2);
+      } catch {
+        return null;
+      }
+    })()
+  );
+  if (!parsed.success)
+    throw new OverAIError("lint: invalid response from lint service", {
+      status: res.status,
+      path: responsePath(res),
+      body: raw2,
+      organizationId: await client.organizationId()
+    });
+  return parsed.data;
+};
+
+// ../sdk/src/printablePageRender.ts
+var printablePageRender = (client, id) => ({
+  render: async (options) => {
+    const data = await client.graphql(
+      `query SdkPrintablePageWorkspace($id: String!) { printablePage(id: $id) { workspaceId } }`,
+      { id }
+    );
+    if (data.printablePage == null)
+      throw new Error(`Printable page ${id} not found.`);
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/actions/${organizationId}/${data.printablePage.workspaceId}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          actionId: "PRINTABLE_PAGE_TO_PDF",
+          inputs: {
+            printablePageId: id,
+            searchParams: options?.searchParams ?? "{}",
+            includeDiagnostics: true
+          }
+        }),
+        signal: AbortSignal.timeout(options?.timeoutMs ?? 6e4)
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok)
+      throw apiError("printable-page render", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  }
+});
+
+// ../sdk/src/report.ts
+var report = async (client, kind, details, options) => {
+  await client.trpc("architectIssues.report", {
+    feedbackType: kind,
+    detailedBugReport: details,
+    source: options?.source ?? "cli",
+    cliContext: options?.cliContext
+  });
+};
+
 // ../common/src/random/index.ts
 var UNMISTAKABLE_CHARS = "0123456789abcdefghjkmnpqrstvwxyz";
 var nanoid4 = customAlphabet(UNMISTAKABLE_CHARS, 12);
@@ -60514,6 +61045,7 @@ var ID_PREFIXES = {
   automation_email_alert: { prefix: "aes", body: 10 },
   automation_error_alert_queue: { prefix: "aeaq", body: 10 },
   billing_period: { prefix: "bpd", body: 12 },
+  billing_term: { prefix: "btm", body: 12 },
   browser_automation: { prefix: "bra", body: 10 },
   browser_automation_run: { prefix: "brr", body: 20 },
   browser_session_usage: { prefix: "bsu", body: 12 },
@@ -60785,6 +61317,301 @@ var genericResource = (client, id) => {
   };
 };
 
+// ../sdk/src/runners.ts
+var runnerCollection = (client) => ({
+  /*
+   * Two steps, same as the webapp: createMachineIdentity mints the identity
+   * and binds it to the active org atomically — a plain createIdentity cannot
+   * RETURN a row not yet in the caller's org — then the runner is created in
+   * the workspace.
+   */
+  create: async (input2) => {
+    const identityResult = await client.graphql(
+      `mutation SdkCreateMachineIdentity($name: String!) {
+      createMachineIdentity(input: { name: $name }) {
+        identity { id }
+      }
+    }`,
+      { name: input2.name ?? "Action Runner" }
+    );
+    const identityId = identityResult.createMachineIdentity?.identity?.id;
+    if (identityId == null)
+      throw new Error("Failed to create machine identity");
+    const runnerResult = await client.graphql(
+      `mutation SdkCreateActionRunner($identityId: String!, $workspaceId: String!) {
+      createActionRunner(
+        input: { actionRunner: { identityId: $identityId, workspaceId: $workspaceId } }
+      ) { actionRunner { id } }
+    }`,
+      { identityId, workspaceId: input2.workspaceId }
+    );
+    const actionRunnerId = runnerResult.createActionRunner?.actionRunner?.id;
+    if (actionRunnerId == null)
+      throw new Error("Failed to create action runner");
+    return { actionRunnerId, identityId };
+  },
+  // An explicit null in a PostGraphile condition means IS NULL, so the key is
+  // left out when no workspace is given and the whole org lists.
+  list: async (options) => {
+    const data = await client.graphql(
+      `query SdkRunnerList($condition: ActionRunnerCondition!, $first: Int!) {
+      actionRunners(condition: $condition, first: $first) {
+        nodes { id identity { name } workspaceId isCloud isArchived createdAt }
+      }
+    }`,
+      {
+        condition: options?.workspaceId == null ? {} : { workspaceId: options.workspaceId },
+        first: options?.limit ?? 50
+      }
+    );
+    return data.actionRunners.nodes.map((r) => ({
+      id: r.id,
+      name: r.identity?.name ?? null,
+      workspaceId: r.workspaceId,
+      kind: r.isCloud ? "cloud" : "self-hosted",
+      archived: r.isArchived,
+      createdAt: r.createdAt
+    }));
+  }
+});
+var runnerResource = (client, id) => {
+  const enqueueAction = async (actionId, inputs) => {
+    const organizationId = await client.organizationId();
+    const data = await client.graphql(
+      `query SdkResolveRunner($id: String!) {
+      actionRunners(condition: { id: $id }, first: 1) { nodes { workspaceId } }
+    }`,
+      { id }
+    );
+    const workspaceId = data.actionRunners.nodes[0]?.workspaceId;
+    if (workspaceId == null) {
+      throw new Error(
+        `Unknown runner ${id} (or it has no workspace). Try: overai runner list`
+      );
+    }
+    const res = await client.fetch(
+      `/v2/actions/${organizationId}/${workspaceId}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ actionId, inputs, actionRunnerId: id })
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("runner run", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  };
+  return {
+    token: async (options) => {
+      const result = await client.graphql(
+        `mutation SdkCreateActionRunnerToken($actionRunnerId: String!, $note: String) {
+      createActionRunnerToken(
+        input: { actionRunnerId: $actionRunnerId, note: $note }
+      ) { result }
+    }`,
+        { actionRunnerId: id, note: options?.note ?? "cli" }
+      );
+      const secret = result.createActionRunnerToken?.result;
+      if (secret == null) throw new Error("Failed to mint runner token");
+      return secret;
+    },
+    run: (input2) => enqueueAction("RUNNER_RUN_COMMAND", {
+      actionRunnerId: id,
+      interpreter: input2.interpreter ?? "shell",
+      code: input2.code
+    }),
+    upload: (path) => enqueueAction("RUNNER_UPLOAD_FILE", {
+      actionRunnerId: id,
+      filePath: path
+    })
+  };
+};
+
+// ../sdk/src/storage.ts
+var storageApi = (client) => ({
+  upload: async (file2, options) => {
+    const organizationId = await client.organizationId();
+    const query = options.randomPrefix === false ? "?disableRandomPrefix=true" : "";
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/stream${query}`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/octet-stream",
+          "x-file-name": options.name
+        },
+        body: file2
+      }
+    );
+    if (!res.ok)
+      throw apiError("storage upload", res, await res.text(), organizationId);
+    const { path } = await res.json();
+    const key = path.startsWith(`${organizationId}/`) ? path.slice(organizationId.length + 1) : path;
+    return { key, path };
+  },
+  download: async (key) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}`,
+      { redirect: "follow" }
+    );
+    if (!res.ok)
+      throw apiError("storage download", res, await res.text(), organizationId);
+    return res;
+  },
+  exists: async (key) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}/exists`
+    );
+    if (res.status === 404) return null;
+    if (!res.ok)
+      throw apiError("storage exists", res, await res.text(), organizationId);
+    return await res.json();
+  },
+  head: async (key, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}/head?numLines=${String(options?.lines ?? 50)}`
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("storage head", res, raw2, organizationId);
+    return raw2;
+  },
+  presign: async (key, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}/presign?expiresIn=${String(options?.expiresIn ?? 60 * 60 * 24 * 7)}`
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("storage presign", res, raw2, organizationId);
+    return raw2.trim();
+  }
+});
+
+// ../sdk/src/tableSpaceRun.ts
+var clusterInfo = async (client) => {
+  const res = await client.fetch("/v2/cluster-info");
+  const raw2 = await res.text();
+  if (!res.ok)
+    throw apiError("cluster-info", res, raw2, await client.organizationId());
+  return JSON.parse(raw2);
+};
+var connectionString = async (client, tableSpaceId, secret) => {
+  const { postgres } = await clusterInfo(client);
+  return `postgresql://overai:${encodeURIComponent(secret)}@${postgres.host}:${String(postgres.port)}/${tableSpaceId}?sslmode=${postgres.sslMode}${postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
+};
+var tableSpaceResource = (client, id) => ({
+  /*
+   * The controlled /run endpoint (our auth + audit). `params` switches to the
+   * parameterized `unsafe` shape so identifiers stay injection-safe;
+   * ignoreCamelCase keeps real column names.
+   */
+  sql: async (query, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/table-spaces/${organizationId}/${id}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(
+          options?.params == null ? { query, ignoreCamelCase: true } : { unsafe: { query, params: options.params } }
+        )
+      }
+    );
+    const raw2 = await res.text();
+    const body = (() => {
+      try {
+        return JSON.parse(raw2);
+      } catch {
+        return null;
+      }
+    })();
+    if (!res.ok || body?.ok === false)
+      throw apiError("sql", res, raw2, organizationId);
+    return {
+      rows: body?.rows ?? [],
+      rowCount: body?.rowCount ?? 0,
+      resultSetCount: body?.resultSetCount ?? 1,
+      durationMs: body?.durationMs ?? 0
+    };
+  },
+  credentials: {
+    create: async (input2) => {
+      const data = await client.graphql(
+        `mutation SdkCreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
+        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
+      }`,
+        {
+          tableSpaceId: id,
+          name: input2.name,
+          validUntil: input2.validUntil?.toISOString() ?? null
+        }
+      );
+      const result = data.createTableSpaceCredential?.result;
+      if (!result) throw new Error("The server did not return a credential");
+      return {
+        id: result.id,
+        secret: result.secret,
+        connectionString: await connectionString(client, id, result.secret)
+      };
+    },
+    list: async () => (await client.graphql(
+      `query SdkTableSpaceCredentials($tableSpaceId: String!) {
+        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
+          nodes { id name validUntil lastUsedAt createdAt }
+        }
+      }`,
+      { tableSpaceId: id }
+    )).tableSpaceCredentials?.nodes ?? []
+  }
+});
+var tableSpaceCredentialResource = (client, credentialId) => {
+  const tableSpaceId = async () => {
+    const data = await client.graphql(
+      `query SdkTableSpaceCredential($id: String!) {
+      tableSpaceCredential(id: $id) { tableSpaceId }
+    }`,
+      { id: credentialId }
+    );
+    if (!data.tableSpaceCredential)
+      throw new Error("Credential not found or you lack access to it");
+    return data.tableSpaceCredential.tableSpaceId;
+  };
+  return {
+    rotate: async () => {
+      const resolvedTableSpaceId = await tableSpaceId();
+      const data = await client.graphql(
+        `mutation SdkRotateTableSpaceCredential($credentialId: String!) {
+        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
+      }`,
+        { credentialId }
+      );
+      const secret = data.rotateTableSpaceCredential?.result;
+      if (!secret) throw new Error("The server did not return a credential");
+      return {
+        secret,
+        connectionString: await connectionString(
+          client,
+          resolvedTableSpaceId,
+          secret
+        )
+      };
+    },
+    revoke: async () => {
+      await tableSpaceId();
+      await client.graphql(
+        `mutation SdkRevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
+        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
+          tableSpaceCredential { id }
+        }
+      }`,
+        { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
+      );
+    }
+  };
+};
+
 // ../sdk/src/tokens.ts
 var exchangeSchema = external_exports.object({ token: external_exports.string(), expiresIn: external_exports.number() });
 var staticToken = (jwt2) => () => jwt2;
@@ -60885,6 +61712,17 @@ var OverAIClient = class {
     headers.set("Authorization", `Bearer ${token}`);
     return fetch(`${this.baseUrl}${path}`, { ...init, headers });
   }
+  /** The bearer the next request would send. For hosts that build their own requests, like `createEnv`. */
+  token() {
+    return Promise.resolve(this.#token());
+  }
+  /** The org the token source's JWT names; every org-scoped REST path takes it. */
+  async organizationId() {
+    const org = (this.#claims ?? decodeJwtClaims(await this.#token())).org;
+    if (org == null || org === "")
+      throw new Error("The token carries no organization claim.");
+    return org;
+  }
   /**
    * POST /v2/graphql. Throws with the server's error messages — callers (and
    * agents driving them) need the actual reason, not a status code.
@@ -60971,21 +61809,68 @@ var OverAIClient = class {
     create: (input2) => createDataFile(this, input2)
   };
   workspaces = workspaceCollection(this);
+  runners = runnerCollection(this);
+  storage = storageApi(this);
   /** Its `deploy` checks deployed callers first; see `FunctionResource`. */
   fn(id) {
-    return functionResource(this, id);
+    return { ...functionResource(this, id), ...functionRun(this, id) };
   }
   page(id) {
     return codeResource(webPageSource(this), id);
   }
   printablePage(id) {
-    return codeResource(printablePageSource(this), id);
+    return {
+      ...codeResource(printablePageSource(this), id),
+      ...printablePageRender(this, id)
+    };
   }
   automation(id) {
-    return versionedResource(automationSource(this), id);
+    return {
+      ...versionedResource(automationSource(this), id),
+      ...automationRunApi(this, id)
+    };
   }
   agent(id) {
-    return versionedResource(agentSource(this), id);
+    return {
+      ...versionedResource(agentSource(this), id),
+      ...agentRun(this, id)
+    };
+  }
+  /** A run addresses no automation, so its state is read by run id alone. */
+  automationRunState(runId) {
+    return automationRunState(this, runId);
+  }
+  tableSpace(id) {
+    return tableSpaceResource(this, id);
+  }
+  tableSpaceCredential(credentialId) {
+    return tableSpaceCredentialResource(this, credentialId);
+  }
+  dataFile(id) {
+    return dataFileResource(this, id);
+  }
+  dataStream(id) {
+    return dataStreamResource(this, id);
+  }
+  knowledgeBase(id) {
+    return knowledgeBaseResource(this, id);
+  }
+  integration(id) {
+    return integrationResource(this, id);
+  }
+  runner(id) {
+    return runnerResource(this, id);
+  }
+  clusterInfo() {
+    return clusterInfo(this);
+  }
+  /** The platform's authenticated lint, which knows the workspace's resources. */
+  lint(input2) {
+    return lint(this, input2);
+  }
+  /** Files a bug report or feature request with OverAI. */
+  report(kind, details, options) {
+    return report(this, kind, details, options);
   }
   workspace(id) {
     return workspaceResource(this, id);
@@ -61279,7 +62164,6 @@ var cliClient = () => createClient({
   baseUrl: apiBaseUrl(),
   token: async () => (await getAccessToken()).token
 });
-var v2Fetch = async (path, init) => cliClient().fetch(path, init);
 var v2Error = (label, res, rawBody) => withOrgHint(apiError(label, res, rawBody, scopedOrgId()));
 var ORG_HINT = "\n  If it lives in another org, name that org: overai --org <ref> ... (`overai org list` shows them, `overai org alias` your shorthands).";
 var withOrgHint = (error62) => {
@@ -61287,7 +62171,6 @@ var withOrgHint = (error62) => {
     error62.message = `${error62.message}${ORG_HINT}`;
   return error62;
 };
-var userTrpcMutation = async (procedure, input2) => cliClient().trpc(procedure, input2);
 
 // src/args.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -61321,6 +62204,15 @@ var flagValue = (args, ...names) => {
   }
   return void 0;
 };
+function integerFlag(args, name2, fallback2) {
+  const names = typeof name2 === "string" ? [name2] : [...name2];
+  const raw2 = flagValue(args, ...names);
+  if (raw2 == null) return fallback2;
+  const value = Number(raw2);
+  if (!Number.isInteger(value))
+    throw new Error(`${names[0] ?? ""} must be a whole number.`);
+  return value;
+}
 var stdinClaimedBy = null;
 var readStdin = async (claimant = "stdin") => {
   if (stdinClaimedBy != null) {
@@ -61834,17 +62726,6 @@ var whoami = (args = []) => {
 
 // src/commands/agent.ts
 import { createInterface } from "readline";
-
-// src/gql.ts
-var gqlRequest = async (query, variables) => {
-  try {
-    return await cliClient().graphql(query, variables);
-  } catch (error62) {
-    throw withOrgHint(error62);
-  }
-};
-
-// src/commands/agent.ts
 var USAGE = [
   "Usage:",
   "  overai agent generate <id> --message <text|@file|@->",
@@ -61857,210 +62738,51 @@ var generate = async (args, id) => {
     "--message"
   );
   if (message == null) throw new Error("Agent generate requires --message.");
-  const { organizationId } = await getAccessToken();
-  const response = await v2Fetch(
-    `/v2/agents/${organizationId}/${id}/generate/text`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ message })
-    }
-  );
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("agent generate", response, raw2);
   printResult(
-    JSON.parse(raw2),
+    await cliClient().agent(id).generate(message),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var deployedVersionNumber = async (id) => {
-  const deployed = await gqlRequest(
-    `query CliAgentDeployedVersion($id: String!) {
-      agentDeployedVersions(condition: { agentId: $id }) { nodes { versionNumber } }
-    }`,
-    { id }
-  );
-  const versionNumber = deployed.agentDeployedVersions?.nodes[0]?.versionNumber;
-  if (versionNumber == null) {
-    throw new Error(
-      `Agent ${id} has no deployed version; pass --version <n> to inspect a saved one.`
-    );
-  }
-  return versionNumber;
-};
 var tools = async (args, id) => {
-  const versionFlag = flagValue(args, "--version", "-v");
-  if (versionFlag != null && !Number.isInteger(Number(versionFlag))) {
-    throw new Error("--version must be an integer.");
-  }
-  const version2 = versionFlag == null ? await deployedVersionNumber(id) : Number(versionFlag);
-  const data = await gqlRequest(
-    `query CliAgentTools($id: String!, $version: Int!) {
-      agent(id: $id) {
-        name
-        agentVersions(first: 1, condition: { versionNumber: $version }) {
-          nodes {
-            versionNumber
-            model
-            agentVersionFunctionsByAgentIdAndVersionNumber(orderBy: [FUNCTION_ID_ASC]) {
-              nodes { functionId function { name } }
-            }
-            agentVersionTableSpacesByAgentIdAndVersionNumber(orderBy: [TABLE_SPACE_ID_ASC]) {
-              nodes { tableSpaceId accessMode }
-            }
-            agentVersionAgentsByAgentIdAndVersionNumber(orderBy: [ATTACHED_AGENT_ID_ASC]) {
-              nodes { attachedAgentId }
-            }
-            agentVersionKnowledgeBasesByAgentIdAndVersionNumber(orderBy: [KNOWLEDGE_BASE_ID_ASC]) {
-              nodes { knowledgeBaseId }
-            }
-            agentVersionBuiltinToolSetsByAgentIdAndVersionNumber(orderBy: [TOOL_SET_ASC]) {
-              nodes { toolSet }
-            }
-          }
-        }
-      }
-    }`,
-    { id, version: version2 }
-  );
-  if (data.agent == null) throw new Error(`Agent ${id} not found.`);
-  const agentVersion = data.agent.agentVersions.nodes[0];
-  if (agentVersion == null) {
-    throw new Error(`Agent ${id} has no version ${String(version2)}.`);
-  }
-  const rows = [
-    ...agentVersion.agentVersionFunctionsByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "function",
-        name: link.function?.name ?? link.functionId,
-        detail: link.functionId
-      })
-    ),
-    ...agentVersion.agentVersionTableSpacesByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "table space",
-        name: link.tableSpaceId,
-        detail: link.accessMode
-      })
-    ),
-    ...agentVersion.agentVersionAgentsByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "sub-agent",
-        name: link.attachedAgentId,
-        detail: ""
-      })
-    ),
-    ...agentVersion.agentVersionKnowledgeBasesByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "knowledge base",
-        name: link.knowledgeBaseId,
-        detail: ""
-      })
-    ),
-    ...agentVersion.agentVersionBuiltinToolSetsByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({ kind: "built-in", name: link.toolSet, detail: "" })
-    )
-  ];
+  const version2 = integerFlag(args, ["--version", "-v"]);
+  const result = await cliClient().agent(id).tools(version2 ?? "deployed");
   const format2 = resolveFormat(flagValue(args, "-o", "--output"));
   if (format2 === "json") {
-    printResult(
-      {
-        agent: data.agent.name,
-        version: agentVersion.versionNumber,
-        model: agentVersion.model,
-        tools: rows
-      },
-      format2
-    );
+    printResult(result, format2);
     return;
   }
   if (format2 === "table") {
     process.stdout.write(
-      `${data.agent.name} \xB7 version ${String(agentVersion.versionNumber)} \xB7 ${agentVersion.model}
+      `${result.agent} \xB7 version ${String(result.version)} \xB7 ${result.model}
 `
     );
   }
-  printResult(rows, format2);
+  printResult(result.tools, format2);
 };
-var printStreamLine = (line) => {
-  if (!line.startsWith("data: ")) return;
-  const payload = line.slice(6);
-  if (payload === "[DONE]") return;
-  let event;
-  try {
-    event = JSON.parse(payload);
-  } catch {
-    return;
-  }
-  if (event.type === "text-delta" && event.delta != null) {
-    process.stdout.write(event.delta);
-  }
-  if (event.type === "error") {
-    process.stderr.write(`
+var send = async (agent, message, conversationId) => {
+  const response = await agent.chat(
+    [{ role: "user", parts: [{ type: "text", text: message }] }],
+    { conversationId }
+  );
+  for await (const event of agentStreamEvents(response)) {
+    if (event.type === "text-delta") process.stdout.write(event.delta);
+    else process.stderr.write(`
 ${event.errorText ?? "agent turn failed"}
 `);
   }
-};
-var streamReply = async (response) => {
-  const body = response.body;
-  if (body == null) return;
-  const decoder = new TextDecoder();
-  let buffer = "";
-  for await (const chunk of body) {
-    buffer += decoder.decode(chunk, { stream: true });
-    const lines = buffer.split("\n");
-    buffer = lines.pop() ?? "";
-    lines.forEach(printStreamLine);
-  }
-  printStreamLine(buffer + decoder.decode());
-};
-var send = async (organizationId, id, message, conversationId) => {
-  const response = await v2Fetch(`/v2/agents/${organizationId}/${id}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      messages: [{ role: "user", parts: [{ type: "text", text: message }] }],
-      conversationId
-    })
-  });
-  if (!response.ok) {
-    throw v2Error("agent chat", response, await response.text());
-  }
-  await streamReply(response);
   process.stdout.write("\n");
 };
-var createConversation = async (id, firstMessage) => {
-  const versionNumber = await deployedVersionNumber(id);
-  const created = await gqlRequest(
-    `mutation CliCreateAgentConversation($input: CreateAgentConversationInput!) {
-      createAgentConversation(input: $input) { agentConversation { id } }
-    }`,
-    {
-      input: {
-        agentConversation: {
-          agentId: id,
-          versionNumber,
-          title: firstMessage.length > 50 ? `${firstMessage.slice(0, 47)}...` : firstMessage
-        }
-      }
-    }
-  );
-  const conversationId = created.createAgentConversation?.agentConversation?.id;
-  if (conversationId == null)
-    throw new Error("Failed to create a conversation.");
-  return conversationId;
-};
 var chat = async (args, id) => {
-  const { organizationId } = await getAccessToken();
+  const agent = cliClient().agent(id);
   let conversationId = flagValue(args, "--conversation", "-c") ?? null;
   const single = await readValue(
     flagValue(args, "--message", "-m"),
     "--message"
   );
   if (single != null) {
-    conversationId ??= await createConversation(id, single);
+    conversationId ??= await agent.createConversation(single);
     try {
-      await send(organizationId, id, single, conversationId);
+      await send(agent, single, conversationId);
     } finally {
       process.stderr.write(`Conversation: ${conversationId}
 `);
@@ -62087,11 +62809,12 @@ var chat = async (args, id) => {
       continue;
     }
     try {
-      conversationId ??= await createConversation(id, message);
-      await send(organizationId, id, message, conversationId);
+      conversationId ??= await agent.createConversation(message);
+      await send(agent, message, conversationId);
     } catch (error62) {
+      const hinted = withOrgHint(error62);
       process.stderr.write(
-        `${error62 instanceof Error ? error62.message : String(error62)}
+        `${hinted instanceof Error ? hinted.message : String(hinted)}
 `
       );
     }
@@ -62123,53 +62846,24 @@ var runAgent = async (args) => {
 
 // src/commands/automation.ts
 var runRuns = async (automationId, args) => {
-  const limit2 = Number(flagValue(args, "--limit") ?? 20);
-  const data = await gqlRequest(
-    `query CliAutomationRuns($automationId: String!, $first: Int!) {
-      automationRuns(condition: { automationId: $automationId }, orderBy: [STARTED_AT_DESC], first: $first) {
-        nodes { id startedAt endedAt errored isCancelled manuallyTriggered version { num } }
-      }
-    }`,
-    // Over-fetch when status-filtering so --failed still fills the limit.
-    {
-      automationId,
-      first: args.includes("--failed") || args.includes("--running") ? limit2 * 5 : limit2
-    }
-  );
-  let runs = data.automationRuns.nodes;
-  if (args.includes("--failed")) runs = runs.filter((r) => r.errored);
-  if (args.includes("--running")) {
-    runs = runs.filter((r) => r.endedAt == null && !r.isCancelled);
-  }
   printResult(
-    runs.slice(0, limit2).map((r) => ({
-      id: r.id,
-      version: r.version?.num,
-      startedAt: r.startedAt,
-      endedAt: r.endedAt,
-      status: r.errored ? "errored" : r.isCancelled ? "cancelled" : r.endedAt == null ? "running" : "ok",
-      manual: r.manuallyTriggered
-    })),
+    await cliClient().automation(automationId).runs({
+      limit: integerFlag(args, "--limit", 20),
+      failed: args.includes("--failed"),
+      running: args.includes("--running")
+    }),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
 var runState = async (runId, args) => {
-  const data = await gqlRequest(
-    `query CliAutomationRunState($id: String!) {
-      automationRun(id: $id) { state }
-    }`,
-    { id: runId }
-  );
-  if (data.automationRun == null) throw new Error(`Run ${runId} not found.`);
+  const state = await cliClient().automationRunState(runId);
   const node2 = flagValue(args, "--node");
-  const state = data.automationRun.state ?? {};
   printResult(
     node2 != null ? { [node2]: state[node2] ?? "(no state for this node)" } : state,
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
 var runTrigger = async (automationId, args) => {
-  const { organizationId } = await getAccessToken();
   const body = {};
   if (args.includes("-")) {
     Object.assign(
@@ -62184,18 +62878,10 @@ var runTrigger = async (automationId, args) => {
       if (eq > 0) body[pair.slice(0, eq)] = pair.slice(eq + 1);
     }
   }
-  const res = await v2Fetch(
-    `/v2/automations/${organizationId}/${automationId}/run`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    }
+  printResult(
+    await cliClient().automation(automationId).run(body),
+    resolveFormat(flagValue(args, "-o", "--output"))
   );
-  const raw2 = await res.text();
-  if (!res.ok) throw v2Error("automation run", res, raw2);
-  const responseBody = JSON.parse(raw2);
-  printResult(responseBody, resolveFormat(flagValue(args, "-o", "--output")));
 };
 var runAutomation = async (args) => {
   const [sub, id, ...rest] = args;
@@ -62294,35 +62980,13 @@ var allAdapters = [
   agentAdapter
 ];
 var adapterFor = (type) => {
-  const adapter = allAdapters.find((a) => a.type === type);
-  if (adapter == null) throw new Error(`No adapter for resource type ${type}.`);
-  return adapter;
-};
-
-// src/commands/runner.ts
-var createActionRunner = async (workspaceId, name2) => {
-  const identityResult = await gqlRequest(
-    `mutation CliCreateMachineIdentity($name: String!) {
-      createMachineIdentity(input: { name: $name }) {
-        identity { id }
-      }
-    }`,
-    { name: name2 }
-  );
-  const identityId = identityResult.createMachineIdentity?.identity?.id;
-  if (identityId == null) throw new Error("Failed to create machine identity");
-  const runnerResult = await gqlRequest(
-    `mutation CliCreateActionRunner($identityId: String!, $workspaceId: String!) {
-      createActionRunner(
-        input: { actionRunner: { identityId: $identityId, workspaceId: $workspaceId } }
-      ) { actionRunner { id } }
-    }`,
-    { identityId, workspaceId }
-  );
-  const actionRunnerId = runnerResult.createActionRunner?.actionRunner?.id;
-  if (actionRunnerId == null) throw new Error("Failed to create action runner");
-  return { actionRunnerId, identityId };
+  const adapter = allAdapters.find((a) => a.type === type);
+  if (adapter == null) throw new Error(`No adapter for resource type ${type}.`);
+  return adapter;
 };
+
+// src/commands/runner.ts
+var createActionRunner = (workspaceId, name2) => cliClient().runners.create({ workspaceId, name: name2 });
 var runCreate = async (workspaceId, args) => {
   const name2 = flagValue(args, "--name") ?? "Action Runner";
   printResult(
@@ -62331,53 +62995,12 @@ var runCreate = async (workspaceId, args) => {
   );
 };
 var runToken = async (runnerId, args) => {
-  const note = flagValue(args, "--note") ?? "cli";
-  const result = await gqlRequest(
-    `mutation CliCreateActionRunnerToken($actionRunnerId: String!, $note: String) {
-      createActionRunnerToken(
-        input: { actionRunnerId: $actionRunnerId, note: $note }
-      ) { result }
-    }`,
-    { actionRunnerId: runnerId, note }
-  );
-  const secret = result.createActionRunnerToken?.result;
-  if (secret == null) throw new Error("Failed to mint runner token");
+  const secret = await cliClient().runner(runnerId).token({ note: flagValue(args, "--note") ?? "cli" });
   printResult(
     { runnerId, secret },
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var resolveWorkspaceId = async (runnerId) => {
-  const data = await gqlRequest(
-    `query CliResolveRunner($id: String!) {
-      actionRunners(condition: { id: $id }, first: 1) { nodes { workspaceId } }
-    }`,
-    { id: runnerId }
-  );
-  const workspaceId = data.actionRunners.nodes[0]?.workspaceId;
-  if (workspaceId == null) {
-    throw new Error(
-      `Unknown runner ${runnerId} (or it has no workspace). Try: overai runner list`
-    );
-  }
-  return workspaceId;
-};
-var enqueueAction = async (runnerId, actionId, inputs, args) => {
-  const { organizationId } = await getAccessToken();
-  const workspaceId = await resolveWorkspaceId(runnerId);
-  const res = await v2Fetch(
-    `/v2/actions/${organizationId}/${workspaceId}/run`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ actionId, inputs, actionRunnerId: runnerId })
-    }
-  );
-  const raw2 = await res.text();
-  if (!res.ok) throw v2Error("runner run", res, raw2);
-  const body = JSON.parse(raw2);
-  printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
-};
 var runRun = async (runnerId, args) => {
   const code = await readValue(flagValue(args, "--code"), "--code") ?? (process.stdin.isTTY ? "" : (await readStdin("the code")).trim());
   if (code.length === 0) {
@@ -62389,11 +63012,9 @@ var runRun = async (runnerId, args) => {
   if (interpreter !== "shell" && interpreter !== "powershell") {
     throw new Error("--interpreter must be 'shell' or 'powershell'.");
   }
-  await enqueueAction(
-    runnerId,
-    "RUNNER_RUN_COMMAND",
-    { actionRunnerId: runnerId, interpreter, code },
-    args
+  printResult(
+    await cliClient().runner(runnerId).run({ code, interpreter }),
+    resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
 var runUpload = async (runnerId, args) => {
@@ -62401,35 +63022,19 @@ var runUpload = async (runnerId, args) => {
   if (path == null || path.length === 0) {
     throw new Error("Provide a file with --path '<path>'.");
   }
-  await enqueueAction(
-    runnerId,
-    "RUNNER_UPLOAD_FILE",
-    { actionRunnerId: runnerId, filePath: path },
-    args
+  printResult(
+    await cliClient().runner(runnerId).upload(path),
+    resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
 var runList = async (args) => {
   const workspaceId = args.find((a) => !a.startsWith("-"));
-  const limit2 = Number(flagValue(args, "--limit") ?? 50);
-  const data = await gqlRequest(
-    `query CliRunnerList($workspaceId: String, $first: Int!) {
-      actionRunners(condition: { workspaceId: $workspaceId }, first: $first) {
-        nodes { id identity { name } workspaceId isCloud isArchived createdAt }
-      }
-    }`,
-    { workspaceId: workspaceId ?? null, first: limit2 }
-  );
-  printResult(
-    data.actionRunners.nodes.map((r) => ({
-      id: r.id,
-      name: r.identity?.name ?? null,
-      workspaceId: r.workspaceId,
-      kind: r.isCloud ? "cloud" : "self-hosted",
-      archived: r.isArchived,
-      createdAt: r.createdAt
-    })),
-    resolveFormat(flagValue(args, "-o", "--output"))
-  );
+  const limit2 = integerFlag(args, "--limit", 50);
+  const runners = await cliClient().runners.list({
+    ...workspaceId != null ? { workspaceId } : {},
+    limit: limit2
+  });
+  printResult(runners, resolveFormat(flagValue(args, "-o", "--output")));
 };
 var USAGE2 = "Usage: overai runner create <workspaceId> [--name <name>]\n       overai runner token <runnerId> [--note <note>]\n       overai runner run <runnerId> [--interpreter shell|powershell] --code '<code>'\n       overai runner upload <runnerId> --path '<path>'\n       overai runner list [workspaceId] [--limit <n>]\n";
 var runRunner = async (args) => {
@@ -62574,29 +63179,26 @@ var runCreate2 = async (args) => {
 };
 
 // src/commands/dataFile.ts
-import { readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { openAsBlob, writeFileSync as writeFileSync3 } from "fs";
 var runDataFile = async (args) => {
   const [operation, id, path] = args;
   if (id == null || !["upload", "download", "head"].includes(operation ?? "")) {
-    throw new Error("Usage: overai data-file upload <id> <path> [-m <message>] | data-file download <id> [path|-] | data-file head <id> [--lines N]");
+    throw new Error(
+      "Usage: overai data-file upload <id> <path> [-m <message>] | data-file download <id> [path|-] | data-file head <id> [--lines N]"
+    );
   }
-  const { organizationId } = await getAccessToken();
+  const dataFile = cliClient().dataFile(id);
   if (operation === "upload") {
-    if (path == null || path === "-") throw new Error("Upload requires a file path.");
-    const url2 = await userTrpcMutation("dataFiles.getDataFileUploadUrl", {
-      dataFileId: id,
-      fileSize: statSync2(path).size,
+    if (path == null || path === "-")
+      throw new Error("Upload requires a file path.");
+    await dataFile.upload(await openAsBlob(path), {
       message: flagValue(args, "-m", "--message") ?? ""
     });
-    const response2 = await fetch(url2, { method: "PUT", body: readFileSync5(path) });
-    if (!response2.ok) throw v2Error("data-file upload", response2, await response2.text());
     process.stdout.write(`${id}
 `);
     return;
   }
-  const suffix = operation === "head" ? `/head?numLines=${encodeURIComponent(flagValue(args, "--lines") ?? "50")}` : "";
-  const response = await v2Fetch(`/v2/data-files/${organizationId}/${id}${suffix}`, { redirect: "follow" });
-  if (!response.ok) throw v2Error(`data-file ${String(operation)}`, response, await response.text());
+  const response = operation === "head" ? await dataFile.head({ lines: integerFlag(args, "--lines", 50) }) : await dataFile.read();
   const bytes = Buffer.from(await response.arrayBuffer());
   if (path != null && path !== "-") writeFileSync3(path, bytes);
   else process.stdout.write(bytes);
@@ -62606,40 +63208,39 @@ var runDataFile = async (args) => {
 var runDataStream = async (args) => {
   const [operation, id] = args;
   if (id == null || operation !== "append" && operation !== "query") {
-    throw new Error("Usage: overai data-stream append <id> <json|@file|@-> | data-stream query <id> --start <date> --end <date> [--query <filter>] [--limit N]");
+    throw new Error(
+      "Usage: overai data-stream append <id> <json|@file|@-> | data-stream query <id> --start <date> --end <date> [--query <filter>] [--limit N]"
+    );
   }
-  const { organizationId } = await getAccessToken();
+  const dataStream = cliClient().dataStream(id);
   if (operation === "append") {
-    const raw3 = await readValue(args[2], "data stream input");
-    if (raw3 == null) throw new Error("Data stream append requires JSON, @<file>, or @-.");
+    const raw2 = await readValue(args[2], "data stream input");
+    if (raw2 == null)
+      throw new Error("Data stream append requires JSON, @<file>, or @-.");
     const parsed = (() => {
       try {
-        return JSON.parse(raw3);
+        return JSON.parse(raw2);
       } catch {
         throw new Error("Data stream input must be valid JSON.");
       }
     })();
-    const response2 = await v2Fetch(`/v1/data-streams/${organizationId}/${id}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ data: Array.isArray(parsed) ? parsed : [parsed] })
-    });
-    const appended = await response2.text();
-    if (!response2.ok) throw v2Error("data-stream append", response2, appended);
-    const body2 = JSON.parse(appended);
-    printResult(body2, resolveFormat(flagValue(args, "-o", "--output")));
+    printResult(
+      await dataStream.append(parsed),
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
     return;
   }
   const start = flagValue(args, "--start");
   const end = flagValue(args, "--end");
-  if (start == null || end == null) throw new Error("Data stream query requires --start and --end.");
-  const query = new URLSearchParams({ startAt: start, endAt: end, query: flagValue(args, "--query") ?? "" });
-  const limit2 = flagValue(args, "--limit");
-  if (limit2 != null) query.set("limit", limit2);
-  const response = await v2Fetch(`/v1/data-streams/${organizationId}/${id}?${query.toString()}`);
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("data-stream query", response, raw2);
-  const body = JSON.parse(raw2);
+  if (start == null || end == null)
+    throw new Error("Data stream query requires --start and --end.");
+  const limit2 = integerFlag(args, "--limit");
+  const body = await dataStream.query({
+    startAt: start,
+    endAt: end,
+    query: flagValue(args, "--query") ?? "",
+    ...limit2 != null ? { limit: limit2 } : {}
+  });
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -62654,12 +63255,21 @@ import {
   existsSync as existsSync3,
   lstatSync,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync5,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "fs";
 import { join as join4, resolve as resolve3 } from "path";
 
+// src/gql.ts
+var gqlRequest = async (query, variables) => {
+  try {
+    return await cliClient().graphql(query, variables);
+  } catch (error62) {
+    throw withOrgHint(error62);
+  }
+};
+
 // src/workspace/tree.ts
 var fetchWorkspaceChildren = async (id) => {
   const children = [];
@@ -62724,7 +63334,7 @@ var runClone = async (args, isShallow = false) => {
       `${root} is already a cloned workspace. Use \`overai pull\` to refresh.`
     );
   }
-  const partialCloneWorkspaceId = existsSync3(cloneMarker) ? readFileSync6(cloneMarker, "utf8").trim() : null;
+  const partialCloneWorkspaceId = existsSync3(cloneMarker) ? readFileSync5(cloneMarker, "utf8").trim() : null;
   if (partialCloneWorkspaceId != null && partialCloneWorkspaceId !== workspaceId) {
     throw new Error(
       `${root} contains an incomplete clone of ${partialCloneWorkspaceId}. Retry that workspace or choose another directory.`
@@ -62742,7 +63352,7 @@ var runClone = async (args, isShallow = false) => {
     if (entry.root !== root && existsSync3(entry.root)) {
       if (lstatSync(entry.root).isSymbolicLink())
         throw new Error(`Refusing to clone into symbolic link ${entry.root}.`);
-      const savedId = completed ? readManifest(entry.root).workspaceId : existsSync3(marker) ? readFileSync6(marker, "utf8").trim() : null;
+      const savedId = completed ? readManifest(entry.root).workspaceId : existsSync3(marker) ? readFileSync5(marker, "utf8").trim() : null;
       if (partialCloneWorkspaceId !== workspaceId || savedId !== entry.workspace.id)
         throw new Error(
           `${entry.root} already exists. Choose another clone directory.`
@@ -63261,7 +63871,7 @@ var runDev = async (args) => {
       clearTimeout(timer);
     });
   });
-  const port = Number(flagValue(args, "--port") ?? 4820);
+  const port = integerFlag(args, "--port", 4820);
   await new Promise((resolve4, reject2) => {
     server.once("error", reject2);
     server.listen(port, "127.0.0.1", resolve4);
@@ -63309,54 +63919,16 @@ var runLogs = async (args) => {
     );
   }
   const executionId = flagValue(args, "--execution");
+  const fn2 = cliClient().fn(functionId);
+  const fmt = resolveFormat(flagValue(args, "-o", "--output"));
   if (executionId == null) {
-    const limit2 = Number(flagValue(args, "--limit") ?? 20);
-    const data2 = await gqlRequest(
-      `query CliFunctionExecutions($functionId: String!, $first: Int!) {
-        functionExecutions(condition: { functionId: $functionId }, orderBy: [CREATED_AT_DESC], first: $first) {
-          nodes { id createdAt httpStatusCode executionTime requestMethod requestPath versionNumber }
-        }
-      }`,
-      { functionId, first: limit2 }
-    );
     printResult(
-      data2.functionExecutions.nodes,
-      resolveFormat(flagValue(args, "-o", "--output"))
+      await fn2.executions({ limit: integerFlag(args, "--limit", 20) }),
+      fmt
     );
     return;
   }
-  const data = await gqlRequest(
-    `query CliFunctionExecution($functionId: String!, $id: String!) {
-      functionExecutions(condition: { functionId: $functionId, id: $id }, first: 1) {
-        nodes { id summary createdAt httpStatusCode executionTime versionNumber logsUrl inputBodyUrl outputBodyUrl }
-      }
-    }`,
-    { functionId, id: executionId }
-  );
-  const execution = data.functionExecutions.nodes[0];
-  if (execution == null) throw new Error(`Execution ${executionId} not found.`);
-  const fetchText = async (url2) => url2 == null ? null : await fetch(url2).then((r) => r.ok ? r.text() : null);
-  const [logs, input2, output2] = await Promise.all([
-    fetchText(execution.logsUrl),
-    fetchText(execution.inputBodyUrl),
-    fetchText(execution.outputBodyUrl)
-  ]);
-  const fmt = resolveFormat(flagValue(args, "-o", "--output"));
-  printResult(
-    {
-      id: execution.id,
-      createdAt: execution.createdAt,
-      httpStatusCode: execution.httpStatusCode,
-      executionTime: execution.executionTime,
-      versionNumber: execution.versionNumber,
-      summary: execution.summary,
-      input: input2,
-      output: output2,
-      logs
-    },
-    // A single nested record reads better as JSON than a 1-row table.
-    fmt === "table" ? "json" : fmt
-  );
+  printResult(await fn2.execution(executionId), fmt === "table" ? "json" : fmt);
 };
 var runFn = async (args) => {
   if (args[0] === "logs") return runLogs(args.slice(1));
@@ -63367,8 +63939,6 @@ var runFn = async (args) => {
     );
   }
   const method = (flagValue(args, "--method") ?? "POST").toUpperCase();
-  const rawPath = flagValue(args, "--path") ?? "";
-  const subPath = rawPath && !rawPath.startsWith("/") ? `/${rawPath}` : rawPath;
   const sendsBody = !["GET", "HEAD", "DELETE"].includes(method);
   if (!sendsBody && (args.includes("--input") || args.includes("-"))) {
     process.stderr.write(
@@ -63376,16 +63946,12 @@ var runFn = async (args) => {
 `
     );
   }
-  const input2 = sendsBody ? await collectInput(args) : void 0;
-  const { organizationId } = await getAccessToken();
-  const res = await v2Fetch(
-    `/v2/functions/${organizationId}/${functionId}${subPath}`,
-    {
-      method,
-      headers: sendsBody ? { "Content-Type": "application/json" } : {},
-      body: sendsBody ? JSON.stringify(input2) : void 0
-    }
-  );
+  const res = await cliClient().fn(functionId).call({
+    method,
+    path: flagValue(args, "--path"),
+    headers: sendsBody ? { "Content-Type": "application/json" } : {},
+    body: sendsBody ? JSON.stringify(await collectInput(args)) : void 0
+  });
   const executionId = res.headers.get("x-execution-id");
   if (executionId != null) {
     process.stderr.write(`execution: ${executionId}
@@ -63398,11 +63964,11 @@ var runFn = async (args) => {
 };
 
 // src/commands/graphql.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 var runGraphql = async (args) => {
   const inline = await readValue(flagValue(args, "-q", "--query"), "-q");
   const file2 = flagValue(args, "-f", "--file");
-  const query = inline ?? (file2 != null ? readFileSync7(file2, "utf8") : process.stdin.isTTY ? "" : (await readStdin("the query")).trim());
+  const query = inline ?? (file2 != null ? readFileSync6(file2, "utf8") : process.stdin.isTTY ? "" : (await readStdin("the query")).trim());
   if (query.length === 0) {
     throw new Error(
       "Provide a query with -q '<query>', -q @<file>, -f <file>, or stdin."
@@ -63426,14 +63992,19 @@ var runGraphql = async (args) => {
       );
     }
   })();
-  const res = await v2Fetch(
-    args.includes("--v1") ? "/v1/graphql" : "/v2/graphql",
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ query, variables })
-    }
-  );
+  const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+  if (!args.includes("--v1")) {
+    printResult(
+      await gqlRequest(query, variables),
+      format2
+    );
+    return;
+  }
+  const res = await cliClient().fetch("/v1/graphql", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ query, variables })
+  });
   const raw2 = await res.text();
   const body = (() => {
     try {
@@ -63449,39 +64020,11 @@ var runGraphql = async (args) => {
   if (body == null) {
     throw new Error("graphql returned an unreadable body.");
   }
-  printResult(body.data, resolveFormat(flagValue(args, "-o", "--output")));
+  printResult(body.data, format2);
 };
 
 // src/commands/integration.ts
 var USAGE3 = "Usage: overai integration configure <id> --config <json|@file|@-> | integration config <id> | integration secret set <id> <KEY> --value <@file|@-> | integration secret unset <id> <KEY>";
-var setSecret = async (integrationId, key, rawValue) => {
-  if (rawValue == null) {
-    throw new Error("Integration secret set requires --value.");
-  }
-  if (!rawValue.startsWith("@")) {
-    throw new Error(
-      "--value must be @- (stdin) or @<file>, so the secret stays out of your shell history."
-    );
-  }
-  const value = await readValue(rawValue, "--value");
-  if (value == null || value === "") {
-    throw new Error("--value resolved to an empty string.");
-  }
-  await gqlRequest(
-    `mutation SetIntegrationSecret($input: UpdateIntegrationConfigInput!) {
-      updateIntegrationConfig(input: $input) { success }
-    }`,
-    { input: { integrationId, partialConfig: { [key]: value } } }
-  );
-};
-var unsetSecret = async (integrationId, key) => {
-  await gqlRequest(
-    `mutation UnsetIntegrationSecret($input: DeleteIntegrationConfigKeyInput!) {
-      deleteIntegrationConfigKey(input: $input) { success }
-    }`,
-    { input: { integrationId, key } }
-  );
-};
 var runIntegration = async (args) => {
   const [operation] = args;
   if (operation === "secret") {
@@ -63489,22 +64032,36 @@ var runIntegration = async (args) => {
     if (action !== "set" && action !== "unset" || id2 == null || key == null || key.startsWith("-")) {
       throw new Error(USAGE3);
     }
+    const integration2 = cliClient().integration(id2);
     if (action === "set") {
-      await setSecret(id2, key, flagValue(args, "--value"));
+      const rawValue = flagValue(args, "--value");
+      if (rawValue == null) {
+        throw new Error("Integration secret set requires --value.");
+      }
+      if (!rawValue.startsWith("@")) {
+        throw new Error(
+          "--value must be @- (stdin) or @<file>, so the secret stays out of your shell history."
+        );
+      }
+      const value = await readValue(rawValue, "--value");
+      if (value == null || value === "") {
+        throw new Error("--value resolved to an empty string.");
+      }
+      await integration2.setSecret(key, value);
     } else {
-      await unsetSecret(id2, key);
+      await integration2.unsetSecret(key);
     }
-    const result2 = await userTrpcMutation(
-      "getMaskedIntegrationConfig",
-      { id: id2 }
+    printResult(
+      await integration2.config(),
+      resolveFormat(flagValue(args, "-o", "--output"))
     );
-    printResult(result2, resolveFormat(flagValue(args, "-o", "--output")));
     return;
   }
   const [, id] = args;
   if (id == null || operation !== "configure" && operation !== "config") {
     throw new Error(USAGE3);
   }
+  const integration = cliClient().integration(id);
   if (operation === "configure") {
     const raw2 = await readValue(flagValue(args, "--config"), "--config");
     if (raw2 == null)
@@ -63516,16 +64073,16 @@ var runIntegration = async (args) => {
         throw new Error("--config must be valid JSON.");
       }
     })();
-    await userTrpcMutation("putIntegrationConfig", { id, value });
+    await integration.configure(value);
   }
-  const result = await userTrpcMutation("getMaskedIntegrationConfig", {
-    id
-  });
-  printResult(result, resolveFormat(flagValue(args, "-o", "--output")));
+  printResult(
+    await integration.config(),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
 };
 
 // src/commands/knowledgeBase.ts
-import { readFile as readFile2 } from "fs/promises";
+import { openAsBlob as openAsBlob2 } from "fs";
 import { basename } from "path";
 var runKnowledgeBase = async (args) => {
   const [operation, id] = args;
@@ -63534,7 +64091,7 @@ var runKnowledgeBase = async (args) => {
       "Usage: overai knowledge-base upload <id> <file...> | knowledge-base search <id> <query> [--limit N]"
     );
   }
-  const { organizationId } = await getAccessToken();
+  const knowledgeBase = cliClient().knowledgeBase(id);
   if (operation === "upload") {
     const paths = args.slice(2).filter(
       (arg, i, all) => !arg.startsWith("-") && all[i - 1] !== "-o" && all[i - 1] !== "--output"
@@ -63543,20 +64100,11 @@ var runKnowledgeBase = async (args) => {
       throw new Error("Knowledge base upload requires at least one file path.");
     const uploads = [];
     for (const path of paths) {
-      const bytes = await readFile2(path);
-      const formData = new FormData();
-      formData.append(
-        "file",
-        new Blob([new Uint8Array(bytes)]),
+      const result = await knowledgeBase.upload(
+        await openAsBlob2(path),
         basename(path)
       );
-      const response2 = await v2Fetch(
-        `/v2/knowledge-bases/${organizationId}/${id}/upload`,
-        { method: "POST", body: formData }
-      );
-      const raw3 = await response2.text();
-      if (!response2.ok) throw v2Error("knowledge-base upload", response2, raw3);
-      uploads.push({ file: basename(path), ...JSON.parse(raw3) });
+      uploads.push({ file: basename(path), ...result });
     }
     printResult(uploads, resolveFormat(flagValue(args, "-o", "--output")));
     return;
@@ -63564,22 +64112,9 @@ var runKnowledgeBase = async (args) => {
   const query = args[2];
   if (query == null || query.startsWith("-"))
     throw new Error("Knowledge base search requires a query string.");
-  const limit2 = flagValue(args, "--limit");
-  const response = await v2Fetch(
-    `/v2/knowledge-bases/${organizationId}/${id}/search`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        query,
-        ...limit2 != null ? { limit: Number(limit2) } : {}
-      })
-    }
-  );
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("knowledge-base search", response, raw2);
+  const limit2 = integerFlag(args, "--limit");
   printResult(
-    JSON.parse(raw2),
+    await knowledgeBase.search(query, limit2 != null ? { limit: limit2 } : {}),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
@@ -63872,25 +64407,16 @@ var unaliasOrg = async (alias) => {
 // src/commands/printablePage.ts
 var runPrintablePage = async (args) => {
   const [operation, id] = args;
-  if (operation !== "render" || id == null) throw new Error("Usage: overai printable-page render <id> [--search-params <json|@file>] [--timeout <ms>]");
-  const data = await gqlRequest(
-    `query CliPrintablePageWorkspace($id: String!) { printablePage(id: $id) { workspaceId } }`,
-    { id }
-  );
-  if (data.printablePage == null) throw new Error(`Printable page ${id} not found.`);
+  if (operation !== "render" || id == null)
+    throw new Error(
+      "Usage: overai printable-page render <id> [--search-params <json|@file>] [--timeout <ms>]"
+    );
   const searchParams = await readValue(flagValue(args, "--search-params"), "--search-params") ?? "{}";
   JSON.parse(searchParams);
-  const { organizationId } = await getAccessToken();
-  const timeoutMs = Number(flagValue(args, "--timeout") ?? 6e4);
-  const response = await v2Fetch(`/v2/actions/${organizationId}/${data.printablePage.workspaceId}/run`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ actionId: "PRINTABLE_PAGE_TO_PDF", inputs: { printablePageId: id, searchParams, includeDiagnostics: true } }),
-    signal: AbortSignal.timeout(timeoutMs)
+  const body = await cliClient().printablePage(id).render({
+    searchParams,
+    timeoutMs: integerFlag(args, "--timeout", 6e4)
   });
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("printable-page render", response, raw2);
-  const body = JSON.parse(raw2);
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -64313,7 +64839,7 @@ var runRemote = async (args) => {
 
 // src/commands/update.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@overaihq/cli";
 var packageRootUrl = () => {
@@ -64331,7 +64857,7 @@ var compareVersions = (a, b) => {
 };
 var cliVersion = () => {
   const pkg = JSON.parse(
-    readFileSync8(new URL("package.json", packageRootUrl()), "utf8")
+    readFileSync7(new URL("package.json", packageRootUrl()), "utf8")
   );
   return pkg.version;
 };
@@ -64438,8 +64964,7 @@ var runReport = async (args) => {
     }
   })();
   const resources = manifest ? Object.entries(manifest.resources) : [];
-  await userTrpcMutation("architectIssues.report", {
-    ...input2,
+  await cliClient().report(input2.feedbackType, input2.detailedBugReport, {
     source: "cli",
     cliContext: {
       cliVersion: cliVersion(),
@@ -64478,12 +65003,12 @@ var runResource = async (args) => {
     );
     return;
   }
-  const timeout = flagValue(args, "--timeout");
+  const timeout = integerFlag(args, "--timeout");
   const patch = {
     name: flagValue(args, "--name"),
     description: flagValue(args, "--description"),
     integrationTypeId: flagValue(args, "--type"),
-    actionTimeoutSeconds: timeout == null ? void 0 : Number(timeout)
+    actionTimeoutSeconds: timeout
   };
   [
     ["isArchived", "--archive", true],
@@ -64617,6 +65142,19 @@ around a clone-sync mismatch; use the correct workspace folder.
 - Give each service its own credential. List, rotate, or revoke it with
   \`overai sql credential list|rotate|revoke\`.
 
+## From a script
+
+- The CLI is a shell over \`@overaihq/sdk\`. A Node script or a long-running
+  program uses the package directly: \`createClient({ baseUrl, token: patToken(secret, baseUrl) })\`
+  gives \`client.fn(id).call()\`, \`client.tableSpace(id).sql()\`,
+  \`client.page(id).save()\`/\`.deploy()\`, \`client.workspaces.list()\`, and the
+  rest of what the commands do, with the same errors. \`overai\` stays the right
+  tool at a terminal; the SDK is for code.
+- \`@overaihq/sdk/env\` exports \`createEnv\`: \`await createEnv(client)\` is the \`env\` object function
+  code already uses, outside the platform. Everything HTTP-backed is there
+  (\`env.FNxxx.call\`, \`env.TBSxxx.sql\`, \`env.DFxxx.read\`, \`env.STORAGE\`,
+  \`env.AI\`); \`env.BROWSER\` and \`env.CALLER\` exist only inside a function.
+
 ## Reporting platform problems
 
 When broken or unexplained platform behavior blocks progress, send a detailed
@@ -65266,6 +65804,12 @@ Built-in variables:
 - \`env.CALLER\` (verified JWT claims from the request, or null \u2014 useful for identifying the calling user from a web page)
 - Any custom secrets/environment variables configured on the function
 
+The same \`env\` is importable outside the platform: \`import { createEnv } from "@overaihq/sdk/env"\` and \`const env = await createEnv(client)\`
+gives a Node script every HTTP-backed member above with the same names and
+shapes. \`env.BROWSER\` and \`env.CALLER\` exist only inside a function, and
+\`env.TBSxxx.sql\` there returns \`{ rows, rowCount }\` over HTTP instead of a
+direct database connection.
+
 ## AI Access
 
 Generate text or structured objects using LLMs:
@@ -66683,38 +67227,17 @@ var runReview = async () => {
     process.stdout.write("Nothing modified locally \u2014 nothing to review.\n");
     return;
   }
+  const client = cliClient();
   for (const target of lintTargets) {
     try {
-      const response = await v2Fetch("/v2/architect/lint", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          code: target.code,
-          surface: target.surface,
-          workspaceId: manifest.workspaceId,
-          functionOutputSchema: target.functionOutputSchema
-        })
+      const response = await client.lint({
+        code: target.code,
+        surface: target.surface,
+        workspaceId: manifest.workspaceId,
+        functionOutputSchema: target.functionOutputSchema
       });
-      const responseText = await response.text();
-      if (!response.ok) {
-        throw new Error(
-          `${target.label}: HTTP ${String(response.status)}${responseText ? ` \u2014 ${responseText}` : ""}`
-        );
-      }
-      const parsed = lintResponseSchema.safeParse(
-        (() => {
-          try {
-            return JSON.parse(responseText);
-          } catch {
-            return null;
-          }
-        })()
-      );
-      if (!parsed.success) {
-        throw new Error(`${target.label}: invalid response from lint service`);
-      }
       findings2.push(
-        ...parsed.data.diagnostics.map(
+        ...response.diagnostics.map(
           (diagnostic) => `${target.label}:${String(diagnostic.line)}:${String(diagnostic.column)}: ${diagnostic.severity}: ${diagnostic.message}${diagnostic.ruleId == null ? "" : ` (${diagnostic.ruleId})`}`
         )
       );
@@ -66749,23 +67272,6 @@ var runReview = async () => {
 import { createInterface as createInterface3 } from "readline";
 
 // src/commands/sqlCredential.ts
-var connectionString = async (tableSpaceId, secret) => {
-  const response = await v2Fetch("/v2/cluster-info");
-  const body = await response.json();
-  return `postgresql://overai:${encodeURIComponent(secret)}@${body.postgres.host}:${String(body.postgres.port)}/${tableSpaceId}?sslmode=${body.postgres.sslMode}${body.postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
-};
-var credentialTableSpaceId = async (credentialId) => {
-  const data = await gqlRequest(
-    `query TableSpaceCredential($id: String!) {
-      tableSpaceCredential(id: $id) { tableSpaceId }
-    }`,
-    { id: credentialId }
-  );
-  if (!data.tableSpaceCredential) {
-    throw new Error("Credential not found or you lack access to it");
-  }
-  return data.tableSpaceCredential.tableSpaceId;
-};
 var runSqlCredential = async (args) => {
   const [action, id] = args;
   if (!action || !id) {
@@ -66785,67 +67291,31 @@ var runSqlCredential = async (args) => {
     if (!args.includes("--never") && (!Number.isInteger(days) || days < 1)) {
       throw new Error("--expires-in must be a positive whole number of days");
     }
-    const data = await gqlRequest(
-      `mutation CreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
-        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
-      }`,
-      {
-        tableSpaceId,
-        name: name2,
-        validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5).toISOString()
-      }
-    );
-    const result = data.createTableSpaceCredential?.result;
-    if (!result) throw new Error("The server did not return a credential");
-    process.stdout.write(
-      `${await connectionString(tableSpaceId, result.secret)}
-`
-    );
+    const credential = await cliClient().tableSpace(tableSpaceId).credentials.create({
+      name: name2,
+      validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5)
+    });
+    process.stdout.write(`${credential.connectionString}
+`);
     return;
   }
   if (action === "list") {
     const tableSpaceId = id;
-    const data = await gqlRequest(
-      `query TableSpaceCredentials($tableSpaceId: String!) {
-        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
-          nodes { id name validUntil lastUsedAt createdAt }
-        }
-      }`,
-      { tableSpaceId }
-    );
     printResult(
-      data.tableSpaceCredentials?.nodes ?? [],
+      await cliClient().tableSpace(tableSpaceId).credentials.list(),
       resolveFormat(flagValue(args, "-o", "--output"))
     );
     return;
   }
   if (action === "rotate") {
-    const credentialId = id;
-    const tableSpaceId = await credentialTableSpaceId(credentialId);
-    const data = await gqlRequest(
-      `mutation RotateTableSpaceCredential($credentialId: String!) {
-        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
-      }`,
-      { credentialId }
-    );
-    const secret = data.rotateTableSpaceCredential?.result;
-    if (!secret) throw new Error("The server did not return a credential");
-    process.stdout.write(`${await connectionString(tableSpaceId, secret)}
+    const { connectionString: connectionString2 } = await cliClient().tableSpaceCredential(id).rotate();
+    process.stdout.write(`${connectionString2}
 `);
     return;
   }
   if (action === "revoke") {
-    const credentialId = id;
-    await credentialTableSpaceId(credentialId);
-    await gqlRequest(
-      `mutation RevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
-        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
-          tableSpaceCredential { id }
-        }
-      }`,
-      { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
-    );
-    process.stdout.write(`${credentialId} revoked
+    await cliClient().tableSpaceCredential(id).revoke();
+    process.stdout.write(`${id} revoked
 `);
     return;
   }
@@ -66853,32 +67323,12 @@ var runSqlCredential = async (args) => {
 };
 
 // src/commands/sql.ts
-var runQuery = async (organizationId, tableSpaceId, query, params) => {
-  const res = await v2Fetch(
-    `/v2/table-spaces/${organizationId}/${tableSpaceId}/run`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(
-        params == null ? { query, ignoreCamelCase: true } : { unsafe: { query, params } }
-      )
-    }
-  );
-  const raw2 = await res.text();
-  const body = (() => {
-    try {
-      return JSON.parse(raw2);
-    } catch {
-      return null;
-    }
-  })();
-  if (!res.ok || body?.ok === false) throw v2Error("sql", res, raw2);
-  return {
-    rows: body?.rows ?? [],
-    rowCount: body?.rowCount ?? 0,
-    resultSetCount: body?.resultSetCount ?? 1,
-    durationMs: body?.durationMs ?? 0
-  };
+var runQuery = async (tableSpaceId, query, params) => {
+  try {
+    return await cliClient().tableSpace(tableSpaceId).sql(query, { params });
+  } catch (error62) {
+    throw withOrgHint(error62);
+  }
 };
 var summarize = (result) => `(${String(result.rowCount)} row${result.rowCount === 1 ? "" : "s"}, ${String(result.durationMs)}ms)`;
 var REPL_HELP = `  \\dt              list tables
@@ -66888,7 +67338,7 @@ var REPL_HELP = `  \\dt              list tables
 Statements run when a line ends with ";". Each statement runs in its own
 transaction \u2014 BEGIN/SET/temp tables don't carry across statements.
 `;
-var runRepl = async (organizationId, tableSpaceId, format2) => {
+var runRepl = async (tableSpaceId, format2) => {
   const interactive = process.stdin.isTTY;
   const rl = createInterface3({
     input: process.stdin,
@@ -66904,7 +67354,7 @@ var runRepl = async (organizationId, tableSpaceId, format2) => {
   };
   const execute = async (sql, params) => {
     try {
-      const result = await runQuery(organizationId, tableSpaceId, sql, params);
+      const result = await runQuery(tableSpaceId, sql, params);
       if (result.rows.length > 0) {
         process.stdout.write(`${formatResult(result.rows, format2)}
 `);
@@ -67008,7 +67458,7 @@ var runSql = async (args) => {
     );
   }
   const format2 = resolveFormat(flagValue(args, "-o", "--output"));
-  const { organizationId } = await getAccessToken();
+  await cliClient().organizationId();
   const query = (() => {
     const rest = args.slice(1);
     for (let i = 0; i < rest.length; i++) {
@@ -67021,9 +67471,8 @@ var runSql = async (args) => {
     }
     return void 0;
   })();
-  if (query == null) return runRepl(organizationId, tableSpaceId, format2);
+  if (query == null) return runRepl(tableSpaceId, format2);
   const result = await runQuery(
-    organizationId,
     tableSpaceId,
     await readValue(query, "the query") ?? query
   );
@@ -67035,35 +67484,22 @@ var runSql = async (args) => {
 };
 
 // src/commands/storage.ts
-import { openAsBlob, writeFileSync as writeFileSync5 } from "fs";
+import { openAsBlob as openAsBlob3, writeFileSync as writeFileSync5 } from "fs";
 var USAGE4 = "Usage: overai storage upload <path> [--no-random-prefix] | storage download <key> [path|-] | storage exists <key> | storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]";
 var runStorage = async (args) => {
   const [operation, first2, second] = args;
   if (operation == null) throw new Error(USAGE4);
-  const { organizationId } = await getAccessToken();
-  const segment = (key) => encodeURIComponent(key);
+  const storage = cliClient().storage;
   if (operation === "upload") {
     if (first2 == null || first2 === "-") {
-      throw new Error("Upload requires a file path (stdin uploads need a filename to build the key).");
-    }
-    const randomPrefix = !args.includes("--no-random-prefix");
-    const query = randomPrefix ? "" : "?disableRandomPrefix=true";
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/stream${query}`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/octet-stream",
-          "x-file-name": first2.split("/").pop() ?? first2
-        },
-        body: await openAsBlob(first2)
-      }
-    );
-    if (!response.ok) {
-      throw v2Error("storage upload", response, await response.text());
+      throw new Error(
+        "Upload requires a file path (stdin uploads need a filename to build the key)."
+      );
     }
-    const { path } = await response.json();
-    const key = path.startsWith(`${organizationId}/`) ? path.slice(organizationId.length + 1) : path;
+    const { key, path } = await storage.upload(await openAsBlob3(first2), {
+      name: first2.split("/").pop() ?? first2,
+      randomPrefix: !args.includes("--no-random-prefix")
+    });
     const format2 = resolveFormat(flagValue(args, "-o", "--output"));
     if (format2 === "json") printResult({ key, path }, format2);
     else process.stdout.write(`${key}
@@ -67072,59 +67508,38 @@ var runStorage = async (args) => {
   }
   if (first2 == null) throw new Error(USAGE4);
   if (operation === "download") {
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}`,
-      { redirect: "follow" }
-    );
-    if (!response.ok) {
-      throw v2Error("storage download", response, await response.text());
-    }
+    const response = await storage.download(first2);
     const bytes = Buffer.from(await response.arrayBuffer());
     if (second != null && second !== "-") writeFileSync5(second, bytes);
     else process.stdout.write(bytes);
     return;
   }
   if (operation === "exists") {
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}/exists`
-    );
-    if (response.status === 404) {
+    const meta3 = await storage.exists(first2);
+    if (meta3 == null) {
       if (resolveFormat(flagValue(args, "-o", "--output")) === "json") {
         printResult({ exists: false }, "json");
       }
       process.exitCode = 1;
       return;
     }
-    if (!response.ok) {
-      throw v2Error("storage exists", response, await response.text());
-    }
     printResult(
-      { exists: true, ...await response.json() },
+      { exists: true, ...meta3 },
       resolveFormat(flagValue(args, "-o", "--output"))
     );
     return;
   }
   if (operation === "head") {
-    const lines = flagValue(args, "--lines") ?? "50";
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}/head?numLines=${encodeURIComponent(lines)}`
+    process.stdout.write(
+      await storage.head(first2, { lines: integerFlag(args, "--lines", 50) })
     );
-    if (!response.ok) {
-      throw v2Error("storage head", response, await response.text());
-    }
-    process.stdout.write(await response.text());
     return;
   }
   if (operation === "presign") {
-    const expiresIn2 = flagValue(args, "--expires-in") ?? String(60 * 60 * 24 * 7);
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}/presign?expiresIn=${encodeURIComponent(expiresIn2)}`
+    process.stdout.write(
+      `${await storage.presign(first2, { expiresIn: integerFlag(args, "--expires-in", 60 * 60 * 24 * 7) })}
+`
     );
-    if (!response.ok) {
-      throw v2Error("storage presign", response, await response.text());
-    }
-    process.stdout.write(`${(await response.text()).trim()}
-`);
     return;
   }
   throw new Error(USAGE4);
@@ -67136,7 +67551,7 @@ var workspaceIdFrom = (args) => args.find(
 ) ?? openClone().manifest.workspaceId;
 var listWorkspaces = async (args) => {
   const archived = args.includes("--archived");
-  const limit2 = Number(flagValue(args, "--limit") ?? 200);
+  const limit2 = integerFlag(args, "--limit", 200);
   printResult(
     (await cliClient().workspaces.list({
       first: limit2,