@overaihq/cli 0.14.11 → 0.14.13

package/dist/index.js

@@ -52345,6 +52345,317 @@ var exchangeSessionToken = (baseUrl, refreshToken, destinationOrgId) => unauthen
   destinationOrgId
 });
 
+// ../sdk/src/error.ts
+var OverAIError = class extends Error {
+  /** HTTP status; 200 for a GraphQL errors-array failure. */
+  status;
+  /** URL pathname of the request, "" when unknown. */
+  path;
+  /** Parsed JSON body, the raw string when not JSON, or null. */
+  body;
+  /** The org the request ran as, when known. */
+  organizationId;
+  /** GraphQL errors array, when that is the cause. */
+  errors;
+  constructor(message, fields) {
+    super(message);
+    this.status = fields.status;
+    this.path = fields.path;
+    this.body = fields.body;
+    this.organizationId = fields.organizationId;
+    if (fields.errors != null) this.errors = fields.errors;
+  }
+};
+var responsePath = (res) => {
+  try {
+    return new URL(res.url).pathname;
+  } catch {
+    return "";
+  }
+};
+var STATUS_TEXT = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  409: "Conflict",
+  413: "Payload Too Large",
+  429: "Too Many Requests",
+  500: "Internal Server Error",
+  503: "Service Unavailable"
+};
+var apiError = (label, res, rawBody, organizationId) => {
+  const body = (() => {
+    try {
+      return JSON.parse(rawBody);
+    } catch {
+      return rawBody;
+    }
+  })();
+  const structured = typeof body === "object" && body != null ? body : null;
+  const field = structured?.error ?? structured?.message;
+  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
+  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
+  const path = responsePath(res);
+  const fields = { status: res.status, path, body, organizationId };
+  if (reason != null) return new OverAIError(reason, fields);
+  return new OverAIError(
+    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
+  ${path}`}${organizationId == null ? "" : `
+  Asked as org ${organizationId}.`}`,
+    fields
+  );
+};
+
+// ../sdk/src/agentRun.ts
+var agentRun = (client, id) => {
+  const deployedVersionNumber = async () => {
+    const deployed = await client.graphql(
+      `query SdkAgentDeployedVersion($id: String!) {
+      agentDeployedVersions(condition: { agentId: $id }) { nodes { versionNumber } }
+    }`,
+      { id }
+    );
+    const versionNumber = deployed.agentDeployedVersions?.nodes[0]?.versionNumber;
+    if (versionNumber == null) {
+      throw new Error(
+        `Agent ${id} has no deployed version; pass --version <n> to inspect a saved one.`
+      );
+    }
+    return versionNumber;
+  };
+  return {
+    generate: async (message) => {
+      const organizationId = await client.organizationId();
+      const res = await client.fetch(
+        `/v2/agents/${organizationId}/${id}/generate/text`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ message })
+        }
+      );
+      const raw2 = await res.text();
+      if (!res.ok) throw apiError("agent generate", res, raw2, organizationId);
+      return JSON.parse(raw2);
+    },
+    /*
+     * What an agent can actually do is spread over five bindings and a model,
+     * and nothing in the product shows it in one place.
+     */
+    tools: async (ref = "deployed") => {
+      const version2 = typeof ref === "number" ? ref : ref === "latest" ? (await client.agent(id).head()).latestVersion : await deployedVersionNumber();
+      const data = await client.graphql(
+        `query SdkAgentTools($id: String!, $version: Int!) {
+      agent(id: $id) {
+        name
+        agentVersions(first: 1, condition: { versionNumber: $version }) {
+          nodes {
+            versionNumber
+            model
+            agentVersionFunctionsByAgentIdAndVersionNumber(orderBy: [FUNCTION_ID_ASC]) {
+              nodes { functionId function { name } }
+            }
+            agentVersionTableSpacesByAgentIdAndVersionNumber(orderBy: [TABLE_SPACE_ID_ASC]) {
+              nodes { tableSpaceId accessMode }
+            }
+            agentVersionAgentsByAgentIdAndVersionNumber(orderBy: [ATTACHED_AGENT_ID_ASC]) {
+              nodes { attachedAgentId }
+            }
+            agentVersionKnowledgeBasesByAgentIdAndVersionNumber(orderBy: [KNOWLEDGE_BASE_ID_ASC]) {
+              nodes { knowledgeBaseId }
+            }
+            agentVersionBuiltinToolSetsByAgentIdAndVersionNumber(orderBy: [TOOL_SET_ASC]) {
+              nodes { toolSet }
+            }
+          }
+        }
+      }
+    }`,
+        { id, version: version2 }
+      );
+      if (data.agent == null) throw new Error(`Agent ${id} not found.`);
+      const agentVersion = data.agent.agentVersions.nodes[0];
+      if (agentVersion == null) {
+        throw new Error(`Agent ${id} has no version ${String(version2)}.`);
+      }
+      return {
+        agent: data.agent.name,
+        version: agentVersion.versionNumber,
+        model: agentVersion.model,
+        tools: [
+          ...agentVersion.agentVersionFunctionsByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "function",
+              name: link.function?.name ?? link.functionId,
+              detail: link.functionId
+            })
+          ),
+          ...agentVersion.agentVersionTableSpacesByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "table space",
+              name: link.tableSpaceId,
+              detail: link.accessMode
+            })
+          ),
+          ...agentVersion.agentVersionAgentsByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "sub-agent",
+              name: link.attachedAgentId,
+              detail: ""
+            })
+          ),
+          ...agentVersion.agentVersionKnowledgeBasesByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "knowledge base",
+              name: link.knowledgeBaseId,
+              detail: ""
+            })
+          ),
+          ...agentVersion.agentVersionBuiltinToolSetsByAgentIdAndVersionNumber.nodes.map(
+            (link) => ({
+              kind: "built-in",
+              name: link.toolSet,
+              detail: ""
+            })
+          )
+        ]
+      };
+    },
+    /* A caller that wants a second turn must create the conversation first — as the webapp does. */
+    createConversation: async (title) => {
+      const versionNumber = await deployedVersionNumber();
+      const created = await client.graphql(
+        `mutation SdkCreateAgentConversation($input: CreateAgentConversationInput!) {
+      createAgentConversation(input: $input) { agentConversation { id } }
+    }`,
+        {
+          input: {
+            agentConversation: {
+              agentId: id,
+              versionNumber,
+              title: title.length > 50 ? `${title.slice(0, 47)}...` : title
+            }
+          }
+        }
+      );
+      const conversationId = created.createAgentConversation?.agentConversation?.id;
+      if (conversationId == null)
+        throw new Error("Failed to create a conversation.");
+      return conversationId;
+    },
+    chat: async (messages, options) => {
+      const organizationId = await client.organizationId();
+      const res = await client.fetch(`/v2/agents/${organizationId}/${id}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          messages,
+          conversationId: options.conversationId
+        })
+      });
+      if (!res.ok)
+        throw apiError("agent chat", res, await res.text(), organizationId);
+      return res;
+    }
+  };
+};
+var agentStreamEvents = (response) => {
+  const parse4 = (line) => {
+    if (!line.startsWith("data: ")) return null;
+    const payload = line.slice(6);
+    if (payload === "[DONE]") return "done";
+    const event = (() => {
+      try {
+        return JSON.parse(payload);
+      } catch {
+        return null;
+      }
+    })();
+    if (event?.type === "text-delta" && event.delta != null)
+      return { type: "text-delta", delta: event.delta };
+    if (event?.type === "error")
+      return event.errorText == null ? { type: "error" } : { type: "error", errorText: event.errorText };
+    return null;
+  };
+  return (async function* () {
+    const body = response.body;
+    if (body == null) return;
+    const decoder = new TextDecoder();
+    const reader = body.getReader();
+    let buffer = "";
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const event = parse4(line);
+        if (event === "done") return;
+        if (event != null) yield event;
+      }
+    }
+    const last2 = parse4(buffer + decoder.decode());
+    if (last2 != null && last2 !== "done") yield last2;
+  })();
+};
+
+// ../sdk/src/automationRun.ts
+var automationRunApi = (client, id) => ({
+  run: async (inputs) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/automations/${organizationId}/${id}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(inputs ?? {})
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("automation run", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  },
+  /*
+   * The v2 condition filters only by automationId; status filters apply
+   * here (the condition type has no errored/isCancelled fields), so a
+   * filtered read over-fetches to still fill the limit.
+   */
+  runs: async (options) => {
+    const limit2 = options?.limit ?? 20;
+    const filtered = options?.failed === true || options?.running === true;
+    const data = await client.graphql(
+      `query SdkAutomationRuns($automationId: String!, $first: Int!) {
+      automationRuns(condition: { automationId: $automationId }, orderBy: [STARTED_AT_DESC], first: $first) {
+        nodes { id startedAt endedAt errored isCancelled manuallyTriggered version { num } }
+      }
+    }`,
+      { automationId: id, first: filtered ? limit2 * 5 : limit2 }
+    );
+    return data.automationRuns.nodes.filter((r) => options?.failed !== true || r.errored).filter(
+      (r) => options?.running !== true || r.endedAt == null && !r.isCancelled
+    ).slice(0, limit2).map((r) => ({
+      id: r.id,
+      version: r.version?.num,
+      startedAt: r.startedAt,
+      endedAt: r.endedAt,
+      status: r.errored ? "errored" : r.isCancelled ? "cancelled" : r.endedAt == null ? "running" : "ok",
+      manual: r.manuallyTriggered
+    }));
+  }
+});
+var automationRunState = async (client, runId) => {
+  const data = await client.graphql(
+    `query SdkAutomationRunState($id: String!) {
+      automationRun(id: $id) { state }
+    }`,
+    { id: runId }
+  );
+  if (data.automationRun == null) throw new Error(`Run ${runId} not found.`);
+  return data.automationRun.state ?? {};
+};
+
 // ../common/src/agent.ts
 var agentVersionConfigSchema = external_exports.object({
   systemPrompt: external_exports.string(),
@@ -58547,6 +58858,81 @@ var createDataFile = async (client, input2) => {
   return { id };
 };
 
+// ../sdk/src/dataFiles.ts
+var dataFileResource = (client, id) => ({
+  read: async () => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(`/v2/data-files/${organizationId}/${id}`, {
+      redirect: "follow"
+    });
+    if (!res.ok)
+      throw apiError(
+        "data-file download",
+        res,
+        await res.text(),
+        organizationId
+      );
+    return res;
+  },
+  head: async (options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/data-files/${organizationId}/${id}/head?numLines=${String(options?.lines ?? 50)}`,
+      { redirect: "follow" }
+    );
+    if (!res.ok)
+      throw apiError("data-file head", res, await res.text(), organizationId);
+    return res;
+  },
+  upload: async (content, options) => {
+    const url2 = await client.trpc("dataFiles.getDataFileUploadUrl", {
+      dataFileId: id,
+      fileSize: content.size,
+      message: options?.message ?? ""
+    });
+    const res = await fetch(url2, { method: "PUT", body: content });
+    if (!res.ok)
+      throw apiError(
+        "data-file upload",
+        res,
+        await res.text(),
+        await client.organizationId()
+      );
+  }
+});
+
+// ../sdk/src/dataStreams.ts
+var dataStreamResource = (client, id) => ({
+  append: async (records) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(`/v1/data-streams/${organizationId}/${id}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        data: Array.isArray(records) ? records : [records]
+      })
+    });
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("data-stream append", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  },
+  query: async (options) => {
+    const organizationId = await client.organizationId();
+    const search2 = new URLSearchParams({
+      startAt: options.startAt,
+      endAt: options.endAt,
+      query: options.query ?? ""
+    });
+    if (options.limit != null) search2.set("limit", String(options.limit));
+    const res = await client.fetch(
+      `/v1/data-streams/${organizationId}/${id}?${search2.toString()}`
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("data-stream query", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  }
+});
+
 // ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/base.js
 var Diff = class {
   diff(oldStr, newStr, options = {}) {
@@ -60392,67 +60778,106 @@ var functionResource = (client, id) => {
   };
 };
 
-// ../sdk/src/error.ts
-var OverAIError = class extends Error {
-  /** HTTP status; 200 for a GraphQL errors-array failure. */
-  status;
-  /** URL pathname of the request, "" when unknown. */
-  path;
-  /** Parsed JSON body, the raw string when not JSON, or null. */
-  body;
-  /** The org the request ran as, when known. */
-  organizationId;
-  /** GraphQL errors array, when that is the cause. */
-  errors;
-  constructor(message, fields) {
-    super(message);
-    this.status = fields.status;
-    this.path = fields.path;
-    this.body = fields.body;
-    this.organizationId = fields.organizationId;
-    if (fields.errors != null) this.errors = fields.errors;
-  }
-};
-var responsePath = (res) => {
-  try {
-    return new URL(res.url).pathname;
-  } catch {
-    return "";
+// ../sdk/src/functionRun.ts
+var functionRun = (client, id) => ({
+  /*
+   * Mirrors `env.FNxxx.call` (common-server envProxy `__callFunction`), so a
+   * caller moving between the sandbox and the SDK keeps one mental model.
+   */
+  call: async (init) => {
+    const { path: rawPath = "", query = {}, body, ...rest } = init ?? {};
+    const queryStart = rawPath.indexOf("?");
+    const pathOnly = queryStart === -1 ? rawPath : rawPath.slice(0, queryStart);
+    const subPath = pathOnly === "" || pathOnly.startsWith("/") ? pathOnly : `/${pathOnly}`;
+    const params = new URLSearchParams(
+      queryStart === -1 ? "" : rawPath.slice(queryStart + 1)
+    );
+    Object.entries(query).forEach(([name2, value]) => {
+      params.set(name2, value);
+    });
+    const search2 = params.toString();
+    const headers = new Headers(rest.headers);
+    const isNativeBody = typeof body === "string" || body instanceof Blob || body instanceof FormData || body instanceof URLSearchParams || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof ReadableStream;
+    if (body != null && !isNativeBody && !headers.has("Content-Type"))
+      headers.set("Content-Type", "application/json");
+    return client.fetch(
+      `/v2/functions/${await client.organizationId()}/${id}${subPath}${search2 === "" ? "" : `?${search2}`}`,
+      {
+        ...rest,
+        method: rest.method ?? "POST",
+        headers,
+        body: body == null ? void 0 : isNativeBody ? body : JSON.stringify(body)
+      }
+    );
+  },
+  executions: async (options) => (await client.graphql(
+    `query SdkFunctionExecutions($functionId: String!, $first: Int!) {
+        functionExecutions(condition: { functionId: $functionId }, orderBy: [CREATED_AT_DESC], first: $first) {
+          nodes { id createdAt httpStatusCode executionTime requestMethod requestPath versionNumber }
+        }
+      }`,
+    { functionId: id, first: options?.limit ?? 20 }
+  )).functionExecutions.nodes,
+  // Logs and bodies live behind presigned S3 URLs (valid ~1h); they carry
+  // their own auth, so they go through the global fetch with no token.
+  execution: async (executionId) => {
+    const data = await client.graphql(
+      `query SdkFunctionExecution($functionId: String!, $id: String!) {
+      functionExecutions(condition: { functionId: $functionId, id: $id }, first: 1) {
+        nodes { id summary createdAt httpStatusCode executionTime versionNumber logsUrl inputBodyUrl outputBodyUrl }
+      }
+    }`,
+      { functionId: id, id: executionId }
+    );
+    const execution = data.functionExecutions.nodes[0];
+    if (execution == null)
+      throw new Error(`Execution ${executionId} not found.`);
+    const [logs, input2, output2] = await Promise.all(
+      [execution.logsUrl, execution.inputBodyUrl, execution.outputBodyUrl].map(
+        async (url2) => url2 == null ? null : await fetch(url2).then((r) => r.ok ? r.text() : null)
+      )
+    );
+    return {
+      id: execution.id,
+      createdAt: execution.createdAt,
+      httpStatusCode: execution.httpStatusCode,
+      executionTime: execution.executionTime,
+      versionNumber: execution.versionNumber,
+      summary: execution.summary,
+      input: input2 ?? null,
+      output: output2 ?? null,
+      logs: logs ?? null
+    };
   }
-};
-var STATUS_TEXT = {
-  400: "Bad Request",
-  401: "Unauthorized",
-  403: "Forbidden",
-  404: "Not Found",
-  409: "Conflict",
-  413: "Payload Too Large",
-  429: "Too Many Requests",
-  500: "Internal Server Error",
-  503: "Service Unavailable"
-};
-var apiError = (label, res, rawBody, organizationId) => {
-  const body = (() => {
-    try {
-      return JSON.parse(rawBody);
-    } catch {
-      return rawBody;
-    }
-  })();
-  const structured = typeof body === "object" && body != null ? body : null;
-  const field = structured?.error ?? structured?.message;
-  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
-  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
-  const path = responsePath(res);
-  const fields = { status: res.status, path, body, organizationId };
-  if (reason != null) return new OverAIError(reason, fields);
-  return new OverAIError(
-    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
-  ${path}`}${organizationId == null ? "" : `
-  Asked as org ${organizationId}.`}`,
-    fields
-  );
-};
+});
+
+// ../sdk/src/integrations.ts
+var integrationResource = (client, id) => ({
+  configure: async (value) => {
+    await client.trpc("putIntegrationConfig", { id, value });
+  },
+  // Config reads are for inspection, not secret export; keep credentials out
+  // of terminals, shell history captures, and agent transcripts.
+  config: () => client.trpc("getMaskedIntegrationConfig", { id }),
+  setSecret: async (key, value) => {
+    await client.graphql(
+      `mutation SdkSetIntegrationSecret($input: UpdateIntegrationConfigInput!) {
+      updateIntegrationConfig(input: $input) { success }
+    }`,
+      { input: { integrationId: id, partialConfig: { [key]: value } } }
+    );
+  },
+  // The merge mutation stores a JSON null for `{key: null}`, so removal is its
+  // own mutation server-side.
+  unsetSecret: async (key) => {
+    await client.graphql(
+      `mutation SdkUnsetIntegrationSecret($input: DeleteIntegrationConfigKeyInput!) {
+      deleteIntegrationConfigKey(input: $input) { success }
+    }`,
+      { input: { integrationId: id, key } }
+    );
+  }
+});
 
 // ../sdk/src/jwt.ts
 var decodeJwtClaims = (token) => {
@@ -60470,6 +60895,112 @@ var decodeJwtClaims = (token) => {
   }
 };
 
+// ../sdk/src/knowledgeBases.ts
+var knowledgeBaseResource = (client, id) => ({
+  upload: async (file2, name2) => {
+    const organizationId = await client.organizationId();
+    const formData = new FormData();
+    formData.append("file", file2, name2);
+    const res = await client.fetch(
+      `/v2/knowledge-bases/${organizationId}/${id}/upload`,
+      { method: "POST", body: formData }
+    );
+    const raw2 = await res.text();
+    if (!res.ok)
+      throw apiError("knowledge-base upload", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  },
+  search: async (query, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/knowledge-bases/${organizationId}/${id}/search`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          query,
+          ...options?.limit != null ? { limit: options.limit } : {}
+        })
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok)
+      throw apiError("knowledge-base search", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  }
+});
+
+// ../sdk/src/lint.ts
+var lint = async (client, input2) => {
+  const res = await client.fetch("/v2/architect/lint", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input2)
+  });
+  const raw2 = await res.text();
+  if (!res.ok) throw apiError("lint", res, raw2, await client.organizationId());
+  const parsed = lintResponseSchema.safeParse(
+    (() => {
+      try {
+        return JSON.parse(raw2);
+      } catch {
+        return null;
+      }
+    })()
+  );
+  if (!parsed.success)
+    throw new OverAIError("lint: invalid response from lint service", {
+      status: res.status,
+      path: responsePath(res),
+      body: raw2,
+      organizationId: await client.organizationId()
+    });
+  return parsed.data;
+};
+
+// ../sdk/src/printablePageRender.ts
+var printablePageRender = (client, id) => ({
+  render: async (options) => {
+    const data = await client.graphql(
+      `query SdkPrintablePageWorkspace($id: String!) { printablePage(id: $id) { workspaceId } }`,
+      { id }
+    );
+    if (data.printablePage == null)
+      throw new Error(`Printable page ${id} not found.`);
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/actions/${organizationId}/${data.printablePage.workspaceId}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          actionId: "PRINTABLE_PAGE_TO_PDF",
+          inputs: {
+            printablePageId: id,
+            searchParams: options?.searchParams ?? "{}",
+            includeDiagnostics: true
+          }
+        }),
+        signal: AbortSignal.timeout(options?.timeoutMs ?? 6e4)
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok)
+      throw apiError("printable-page render", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  }
+});
+
+// ../sdk/src/report.ts
+var report = async (client, kind, details, options) => {
+  await client.trpc("architectIssues.report", {
+    feedbackType: kind,
+    detailedBugReport: details,
+    source: options?.source ?? "cli",
+    cliContext: options?.cliContext
+  });
+};
+
 // ../common/src/random/index.ts
 var UNMISTAKABLE_CHARS = "0123456789abcdefghjkmnpqrstvwxyz";
 var nanoid4 = customAlphabet(UNMISTAKABLE_CHARS, 12);
@@ -60514,6 +61045,7 @@ var ID_PREFIXES = {
   automation_email_alert: { prefix: "aes", body: 10 },
   automation_error_alert_queue: { prefix: "aeaq", body: 10 },
   billing_period: { prefix: "bpd", body: 12 },
+  billing_term: { prefix: "btm", body: 12 },
   browser_automation: { prefix: "bra", body: 10 },
   browser_automation_run: { prefix: "brr", body: 20 },
   browser_session_usage: { prefix: "bsu", body: 12 },
@@ -60785,6 +61317,301 @@ var genericResource = (client, id) => {
   };
 };
 
+// ../sdk/src/runners.ts
+var runnerCollection = (client) => ({
+  /*
+   * Two steps, same as the webapp: createMachineIdentity mints the identity
+   * and binds it to the active org atomically — a plain createIdentity cannot
+   * RETURN a row not yet in the caller's org — then the runner is created in
+   * the workspace.
+   */
+  create: async (input2) => {
+    const identityResult = await client.graphql(
+      `mutation SdkCreateMachineIdentity($name: String!) {
+      createMachineIdentity(input: { name: $name }) {
+        identity { id }
+      }
+    }`,
+      { name: input2.name ?? "Action Runner" }
+    );
+    const identityId = identityResult.createMachineIdentity?.identity?.id;
+    if (identityId == null)
+      throw new Error("Failed to create machine identity");
+    const runnerResult = await client.graphql(
+      `mutation SdkCreateActionRunner($identityId: String!, $workspaceId: String!) {
+      createActionRunner(
+        input: { actionRunner: { identityId: $identityId, workspaceId: $workspaceId } }
+      ) { actionRunner { id } }
+    }`,
+      { identityId, workspaceId: input2.workspaceId }
+    );
+    const actionRunnerId = runnerResult.createActionRunner?.actionRunner?.id;
+    if (actionRunnerId == null)
+      throw new Error("Failed to create action runner");
+    return { actionRunnerId, identityId };
+  },
+  // An explicit null in a PostGraphile condition means IS NULL, so the key is
+  // left out when no workspace is given and the whole org lists.
+  list: async (options) => {
+    const data = await client.graphql(
+      `query SdkRunnerList($condition: ActionRunnerCondition!, $first: Int!) {
+      actionRunners(condition: $condition, first: $first) {
+        nodes { id identity { name } workspaceId isCloud isArchived createdAt }
+      }
+    }`,
+      {
+        condition: options?.workspaceId == null ? {} : { workspaceId: options.workspaceId },
+        first: options?.limit ?? 50
+      }
+    );
+    return data.actionRunners.nodes.map((r) => ({
+      id: r.id,
+      name: r.identity?.name ?? null,
+      workspaceId: r.workspaceId,
+      kind: r.isCloud ? "cloud" : "self-hosted",
+      archived: r.isArchived,
+      createdAt: r.createdAt
+    }));
+  }
+});
+var runnerResource = (client, id) => {
+  const enqueueAction = async (actionId, inputs) => {
+    const organizationId = await client.organizationId();
+    const data = await client.graphql(
+      `query SdkResolveRunner($id: String!) {
+      actionRunners(condition: { id: $id }, first: 1) { nodes { workspaceId } }
+    }`,
+      { id }
+    );
+    const workspaceId = data.actionRunners.nodes[0]?.workspaceId;
+    if (workspaceId == null) {
+      throw new Error(
+        `Unknown runner ${id} (or it has no workspace). Try: overai runner list`
+      );
+    }
+    const res = await client.fetch(
+      `/v2/actions/${organizationId}/${workspaceId}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ actionId, inputs, actionRunnerId: id })
+      }
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("runner run", res, raw2, organizationId);
+    return JSON.parse(raw2);
+  };
+  return {
+    token: async (options) => {
+      const result = await client.graphql(
+        `mutation SdkCreateActionRunnerToken($actionRunnerId: String!, $note: String) {
+      createActionRunnerToken(
+        input: { actionRunnerId: $actionRunnerId, note: $note }
+      ) { result }
+    }`,
+        { actionRunnerId: id, note: options?.note ?? "cli" }
+      );
+      const secret = result.createActionRunnerToken?.result;
+      if (secret == null) throw new Error("Failed to mint runner token");
+      return secret;
+    },
+    run: (input2) => enqueueAction("RUNNER_RUN_COMMAND", {
+      actionRunnerId: id,
+      interpreter: input2.interpreter ?? "shell",
+      code: input2.code
+    }),
+    upload: (path) => enqueueAction("RUNNER_UPLOAD_FILE", {
+      actionRunnerId: id,
+      filePath: path
+    })
+  };
+};
+
+// ../sdk/src/storage.ts
+var storageApi = (client) => ({
+  upload: async (file2, options) => {
+    const organizationId = await client.organizationId();
+    const query = options.randomPrefix === false ? "?disableRandomPrefix=true" : "";
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/stream${query}`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/octet-stream",
+          "x-file-name": options.name
+        },
+        body: file2
+      }
+    );
+    if (!res.ok)
+      throw apiError("storage upload", res, await res.text(), organizationId);
+    const { path } = await res.json();
+    const key = path.startsWith(`${organizationId}/`) ? path.slice(organizationId.length + 1) : path;
+    return { key, path };
+  },
+  download: async (key) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}`,
+      { redirect: "follow" }
+    );
+    if (!res.ok)
+      throw apiError("storage download", res, await res.text(), organizationId);
+    return res;
+  },
+  exists: async (key) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}/exists`
+    );
+    if (res.status === 404) return null;
+    if (!res.ok)
+      throw apiError("storage exists", res, await res.text(), organizationId);
+    return await res.json();
+  },
+  head: async (key, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}/head?numLines=${String(options?.lines ?? 50)}`
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("storage head", res, raw2, organizationId);
+    return raw2;
+  },
+  presign: async (key, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/storage/${organizationId}/${encodeURIComponent(key)}/presign?expiresIn=${String(options?.expiresIn ?? 60 * 60 * 24 * 7)}`
+    );
+    const raw2 = await res.text();
+    if (!res.ok) throw apiError("storage presign", res, raw2, organizationId);
+    return raw2.trim();
+  }
+});
+
+// ../sdk/src/tableSpaceRun.ts
+var clusterInfo = async (client) => {
+  const res = await client.fetch("/v2/cluster-info");
+  const raw2 = await res.text();
+  if (!res.ok)
+    throw apiError("cluster-info", res, raw2, await client.organizationId());
+  return JSON.parse(raw2);
+};
+var connectionString = async (client, tableSpaceId, secret) => {
+  const { postgres } = await clusterInfo(client);
+  return `postgresql://overai:${encodeURIComponent(secret)}@${postgres.host}:${String(postgres.port)}/${tableSpaceId}?sslmode=${postgres.sslMode}${postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
+};
+var tableSpaceResource = (client, id) => ({
+  /*
+   * The controlled /run endpoint (our auth + audit). `params` switches to the
+   * parameterized `unsafe` shape so identifiers stay injection-safe;
+   * ignoreCamelCase keeps real column names.
+   */
+  sql: async (query, options) => {
+    const organizationId = await client.organizationId();
+    const res = await client.fetch(
+      `/v2/table-spaces/${organizationId}/${id}/run`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(
+          options?.params == null ? { query, ignoreCamelCase: true } : { unsafe: { query, params: options.params } }
+        )
+      }
+    );
+    const raw2 = await res.text();
+    const body = (() => {
+      try {
+        return JSON.parse(raw2);
+      } catch {
+        return null;
+      }
+    })();
+    if (!res.ok || body?.ok === false)
+      throw apiError("sql", res, raw2, organizationId);
+    return {
+      rows: body?.rows ?? [],
+      rowCount: body?.rowCount ?? 0,
+      resultSetCount: body?.resultSetCount ?? 1,
+      durationMs: body?.durationMs ?? 0
+    };
+  },
+  credentials: {
+    create: async (input2) => {
+      const data = await client.graphql(
+        `mutation SdkCreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
+        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
+      }`,
+        {
+          tableSpaceId: id,
+          name: input2.name,
+          validUntil: input2.validUntil?.toISOString() ?? null
+        }
+      );
+      const result = data.createTableSpaceCredential?.result;
+      if (!result) throw new Error("The server did not return a credential");
+      return {
+        id: result.id,
+        secret: result.secret,
+        connectionString: await connectionString(client, id, result.secret)
+      };
+    },
+    list: async () => (await client.graphql(
+      `query SdkTableSpaceCredentials($tableSpaceId: String!) {
+        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
+          nodes { id name validUntil lastUsedAt createdAt }
+        }
+      }`,
+      { tableSpaceId: id }
+    )).tableSpaceCredentials?.nodes ?? []
+  }
+});
+var tableSpaceCredentialResource = (client, credentialId) => {
+  const tableSpaceId = async () => {
+    const data = await client.graphql(
+      `query SdkTableSpaceCredential($id: String!) {
+      tableSpaceCredential(id: $id) { tableSpaceId }
+    }`,
+      { id: credentialId }
+    );
+    if (!data.tableSpaceCredential)
+      throw new Error("Credential not found or you lack access to it");
+    return data.tableSpaceCredential.tableSpaceId;
+  };
+  return {
+    rotate: async () => {
+      const resolvedTableSpaceId = await tableSpaceId();
+      const data = await client.graphql(
+        `mutation SdkRotateTableSpaceCredential($credentialId: String!) {
+        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
+      }`,
+        { credentialId }
+      );
+      const secret = data.rotateTableSpaceCredential?.result;
+      if (!secret) throw new Error("The server did not return a credential");
+      return {
+        secret,
+        connectionString: await connectionString(
+          client,
+          resolvedTableSpaceId,
+          secret
+        )
+      };
+    },
+    revoke: async () => {
+      await tableSpaceId();
+      await client.graphql(
+        `mutation SdkRevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
+        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
+          tableSpaceCredential { id }
+        }
+      }`,
+        { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
+      );
+    }
+  };
+};
+
 // ../sdk/src/tokens.ts
 var exchangeSchema = external_exports.object({ token: external_exports.string(), expiresIn: external_exports.number() });
 var staticToken = (jwt2) => () => jwt2;
@@ -60885,6 +61712,17 @@ var OverAIClient = class {
     headers.set("Authorization", `Bearer ${token}`);
     return fetch(`${this.baseUrl}${path}`, { ...init, headers });
   }
+  /** The bearer the next request would send. For hosts that build their own requests, like `createEnv`. */
+  token() {
+    return Promise.resolve(this.#token());
+  }
+  /** The org the token source's JWT names; every org-scoped REST path takes it. */
+  async organizationId() {
+    const org = (this.#claims ?? decodeJwtClaims(await this.#token())).org;
+    if (org == null || org === "")
+      throw new Error("The token carries no organization claim.");
+    return org;
+  }
   /**
    * POST /v2/graphql. Throws with the server's error messages — callers (and
    * agents driving them) need the actual reason, not a status code.
@@ -60971,21 +61809,68 @@ var OverAIClient = class {
     create: (input2) => createDataFile(this, input2)
   };
   workspaces = workspaceCollection(this);
+  runners = runnerCollection(this);
+  storage = storageApi(this);
   /** Its `deploy` checks deployed callers first; see `FunctionResource`. */
   fn(id) {
-    return functionResource(this, id);
+    return { ...functionResource(this, id), ...functionRun(this, id) };
   }
   page(id) {
     return codeResource(webPageSource(this), id);
   }
   printablePage(id) {
-    return codeResource(printablePageSource(this), id);
+    return {
+      ...codeResource(printablePageSource(this), id),
+      ...printablePageRender(this, id)
+    };
   }
   automation(id) {
-    return versionedResource(automationSource(this), id);
+    return {
+      ...versionedResource(automationSource(this), id),
+      ...automationRunApi(this, id)
+    };
   }
   agent(id) {
-    return versionedResource(agentSource(this), id);
+    return {
+      ...versionedResource(agentSource(this), id),
+      ...agentRun(this, id)
+    };
+  }
+  /** A run addresses no automation, so its state is read by run id alone. */
+  automationRunState(runId) {
+    return automationRunState(this, runId);
+  }
+  tableSpace(id) {
+    return tableSpaceResource(this, id);
+  }
+  tableSpaceCredential(credentialId) {
+    return tableSpaceCredentialResource(this, credentialId);
+  }
+  dataFile(id) {
+    return dataFileResource(this, id);
+  }
+  dataStream(id) {
+    return dataStreamResource(this, id);
+  }
+  knowledgeBase(id) {
+    return knowledgeBaseResource(this, id);
+  }
+  integration(id) {
+    return integrationResource(this, id);
+  }
+  runner(id) {
+    return runnerResource(this, id);
+  }
+  clusterInfo() {
+    return clusterInfo(this);
+  }
+  /** The platform's authenticated lint, which knows the workspace's resources. */
+  lint(input2) {
+    return lint(this, input2);
+  }
+  /** Files a bug report or feature request with OverAI. */
+  report(kind, details, options) {
+    return report(this, kind, details, options);
   }
   workspace(id) {
     return workspaceResource(this, id);
@@ -61279,7 +62164,6 @@ var cliClient = () => createClient({
   baseUrl: apiBaseUrl(),
   token: async () => (await getAccessToken()).token
 });
-var v2Fetch = async (path, init) => cliClient().fetch(path, init);
 var v2Error = (label, res, rawBody) => withOrgHint(apiError(label, res, rawBody, scopedOrgId()));
 var ORG_HINT = "\n  If it lives in another org, name that org: overai --org <ref> ... (`overai org list` shows them, `overai org alias` your shorthands).";
 var withOrgHint = (error62) => {
@@ -61287,7 +62171,6 @@ var withOrgHint = (error62) => {
     error62.message = `${error62.message}${ORG_HINT}`;
   return error62;
 };
-var userTrpcMutation = async (procedure, input2) => cliClient().trpc(procedure, input2);
 
 // src/args.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -61321,6 +62204,15 @@ var flagValue = (args, ...names) => {
   }
   return void 0;
 };
+function integerFlag(args, name2, fallback2) {
+  const names = typeof name2 === "string" ? [name2] : [...name2];
+  const raw2 = flagValue(args, ...names);
+  if (raw2 == null) return fallback2;
+  const value = Number(raw2);
+  if (!Number.isInteger(value))
+    throw new Error(`${names[0] ?? ""} must be a whole number.`);
+  return value;
+}
 var stdinClaimedBy = null;
 var readStdin = async (claimant = "stdin") => {
   if (stdinClaimedBy != null) {
@@ -61481,13 +62373,21 @@ var pinOrgFromClone = () => {
   } catch {
   }
 };
+var IGNORE_FILES = [".ignore", ".gitignore"];
+var IGNORE_ALL = "*\n";
 var writeManifest = (root, manifest) => {
-  mkdirSync2(join3(root, MANIFEST_DIR), { recursive: true });
+  const dir = join3(root, MANIFEST_DIR);
+  mkdirSync2(dir, { recursive: true });
   writeFileSync2(
-    join3(root, MANIFEST_DIR, MANIFEST_FILE),
+    join3(dir, MANIFEST_FILE),
     `${JSON.stringify(manifest, null, 2)}
 `
   );
+  for (const name2 of IGNORE_FILES) {
+    const path = join3(dir, name2);
+    if (!existsSync2(path) || readFileSync4(path, "utf8") !== IGNORE_ALL)
+      writeFileSync2(path, IGNORE_ALL);
+  }
 };
 var basePath = (root, relPath) => join3(root, MANIFEST_DIR, BASE_DIR, relPath);
 var writeSynced = (root, relPath, content) => {
@@ -61834,17 +62734,6 @@ var whoami = (args = []) => {
 
 // src/commands/agent.ts
 import { createInterface } from "readline";
-
-// src/gql.ts
-var gqlRequest = async (query, variables) => {
-  try {
-    return await cliClient().graphql(query, variables);
-  } catch (error62) {
-    throw withOrgHint(error62);
-  }
-};
-
-// src/commands/agent.ts
 var USAGE = [
   "Usage:",
   "  overai agent generate <id> --message <text|@file|@->",
@@ -61857,210 +62746,51 @@ var generate = async (args, id) => {
     "--message"
   );
   if (message == null) throw new Error("Agent generate requires --message.");
-  const { organizationId } = await getAccessToken();
-  const response = await v2Fetch(
-    `/v2/agents/${organizationId}/${id}/generate/text`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ message })
-    }
-  );
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("agent generate", response, raw2);
   printResult(
-    JSON.parse(raw2),
+    await cliClient().agent(id).generate(message),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var deployedVersionNumber = async (id) => {
-  const deployed = await gqlRequest(
-    `query CliAgentDeployedVersion($id: String!) {
-      agentDeployedVersions(condition: { agentId: $id }) { nodes { versionNumber } }
-    }`,
-    { id }
-  );
-  const versionNumber = deployed.agentDeployedVersions?.nodes[0]?.versionNumber;
-  if (versionNumber == null) {
-    throw new Error(
-      `Agent ${id} has no deployed version; pass --version <n> to inspect a saved one.`
-    );
-  }
-  return versionNumber;
-};
 var tools = async (args, id) => {
-  const versionFlag = flagValue(args, "--version", "-v");
-  if (versionFlag != null && !Number.isInteger(Number(versionFlag))) {
-    throw new Error("--version must be an integer.");
-  }
-  const version2 = versionFlag == null ? await deployedVersionNumber(id) : Number(versionFlag);
-  const data = await gqlRequest(
-    `query CliAgentTools($id: String!, $version: Int!) {
-      agent(id: $id) {
-        name
-        agentVersions(first: 1, condition: { versionNumber: $version }) {
-          nodes {
-            versionNumber
-            model
-            agentVersionFunctionsByAgentIdAndVersionNumber(orderBy: [FUNCTION_ID_ASC]) {
-              nodes { functionId function { name } }
-            }
-            agentVersionTableSpacesByAgentIdAndVersionNumber(orderBy: [TABLE_SPACE_ID_ASC]) {
-              nodes { tableSpaceId accessMode }
-            }
-            agentVersionAgentsByAgentIdAndVersionNumber(orderBy: [ATTACHED_AGENT_ID_ASC]) {
-              nodes { attachedAgentId }
-            }
-            agentVersionKnowledgeBasesByAgentIdAndVersionNumber(orderBy: [KNOWLEDGE_BASE_ID_ASC]) {
-              nodes { knowledgeBaseId }
-            }
-            agentVersionBuiltinToolSetsByAgentIdAndVersionNumber(orderBy: [TOOL_SET_ASC]) {
-              nodes { toolSet }
-            }
-          }
-        }
-      }
-    }`,
-    { id, version: version2 }
-  );
-  if (data.agent == null) throw new Error(`Agent ${id} not found.`);
-  const agentVersion = data.agent.agentVersions.nodes[0];
-  if (agentVersion == null) {
-    throw new Error(`Agent ${id} has no version ${String(version2)}.`);
-  }
-  const rows = [
-    ...agentVersion.agentVersionFunctionsByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "function",
-        name: link.function?.name ?? link.functionId,
-        detail: link.functionId
-      })
-    ),
-    ...agentVersion.agentVersionTableSpacesByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "table space",
-        name: link.tableSpaceId,
-        detail: link.accessMode
-      })
-    ),
-    ...agentVersion.agentVersionAgentsByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "sub-agent",
-        name: link.attachedAgentId,
-        detail: ""
-      })
-    ),
-    ...agentVersion.agentVersionKnowledgeBasesByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({
-        kind: "knowledge base",
-        name: link.knowledgeBaseId,
-        detail: ""
-      })
-    ),
-    ...agentVersion.agentVersionBuiltinToolSetsByAgentIdAndVersionNumber.nodes.map(
-      (link) => ({ kind: "built-in", name: link.toolSet, detail: "" })
-    )
-  ];
+  const version2 = integerFlag(args, ["--version", "-v"]);
+  const result = await cliClient().agent(id).tools(version2 ?? "deployed");
   const format2 = resolveFormat(flagValue(args, "-o", "--output"));
   if (format2 === "json") {
-    printResult(
-      {
-        agent: data.agent.name,
-        version: agentVersion.versionNumber,
-        model: agentVersion.model,
-        tools: rows
-      },
-      format2
-    );
+    printResult(result, format2);
     return;
   }
   if (format2 === "table") {
     process.stdout.write(
-      `${data.agent.name} \xB7 version ${String(agentVersion.versionNumber)} \xB7 ${agentVersion.model}
+      `${result.agent} \xB7 version ${String(result.version)} \xB7 ${result.model}
 `
     );
   }
-  printResult(rows, format2);
+  printResult(result.tools, format2);
 };
-var printStreamLine = (line) => {
-  if (!line.startsWith("data: ")) return;
-  const payload = line.slice(6);
-  if (payload === "[DONE]") return;
-  let event;
-  try {
-    event = JSON.parse(payload);
-  } catch {
-    return;
-  }
-  if (event.type === "text-delta" && event.delta != null) {
-    process.stdout.write(event.delta);
-  }
-  if (event.type === "error") {
-    process.stderr.write(`
+var send = async (agent, message, conversationId) => {
+  const response = await agent.chat(
+    [{ role: "user", parts: [{ type: "text", text: message }] }],
+    { conversationId }
+  );
+  for await (const event of agentStreamEvents(response)) {
+    if (event.type === "text-delta") process.stdout.write(event.delta);
+    else process.stderr.write(`
 ${event.errorText ?? "agent turn failed"}
 `);
   }
-};
-var streamReply = async (response) => {
-  const body = response.body;
-  if (body == null) return;
-  const decoder = new TextDecoder();
-  let buffer = "";
-  for await (const chunk of body) {
-    buffer += decoder.decode(chunk, { stream: true });
-    const lines = buffer.split("\n");
-    buffer = lines.pop() ?? "";
-    lines.forEach(printStreamLine);
-  }
-  printStreamLine(buffer + decoder.decode());
-};
-var send = async (organizationId, id, message, conversationId) => {
-  const response = await v2Fetch(`/v2/agents/${organizationId}/${id}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      messages: [{ role: "user", parts: [{ type: "text", text: message }] }],
-      conversationId
-    })
-  });
-  if (!response.ok) {
-    throw v2Error("agent chat", response, await response.text());
-  }
-  await streamReply(response);
   process.stdout.write("\n");
 };
-var createConversation = async (id, firstMessage) => {
-  const versionNumber = await deployedVersionNumber(id);
-  const created = await gqlRequest(
-    `mutation CliCreateAgentConversation($input: CreateAgentConversationInput!) {
-      createAgentConversation(input: $input) { agentConversation { id } }
-    }`,
-    {
-      input: {
-        agentConversation: {
-          agentId: id,
-          versionNumber,
-          title: firstMessage.length > 50 ? `${firstMessage.slice(0, 47)}...` : firstMessage
-        }
-      }
-    }
-  );
-  const conversationId = created.createAgentConversation?.agentConversation?.id;
-  if (conversationId == null)
-    throw new Error("Failed to create a conversation.");
-  return conversationId;
-};
 var chat = async (args, id) => {
-  const { organizationId } = await getAccessToken();
+  const agent = cliClient().agent(id);
   let conversationId = flagValue(args, "--conversation", "-c") ?? null;
   const single = await readValue(
     flagValue(args, "--message", "-m"),
     "--message"
   );
   if (single != null) {
-    conversationId ??= await createConversation(id, single);
+    conversationId ??= await agent.createConversation(single);
     try {
-      await send(organizationId, id, single, conversationId);
+      await send(agent, single, conversationId);
     } finally {
       process.stderr.write(`Conversation: ${conversationId}
 `);
@@ -62087,11 +62817,12 @@ var chat = async (args, id) => {
       continue;
     }
     try {
-      conversationId ??= await createConversation(id, message);
-      await send(organizationId, id, message, conversationId);
+      conversationId ??= await agent.createConversation(message);
+      await send(agent, message, conversationId);
     } catch (error62) {
+      const hinted = withOrgHint(error62);
       process.stderr.write(
-        `${error62 instanceof Error ? error62.message : String(error62)}
+        `${hinted instanceof Error ? hinted.message : String(hinted)}
 `
       );
     }
@@ -62123,53 +62854,24 @@ var runAgent = async (args) => {
 
 // src/commands/automation.ts
 var runRuns = async (automationId, args) => {
-  const limit2 = Number(flagValue(args, "--limit") ?? 20);
-  const data = await gqlRequest(
-    `query CliAutomationRuns($automationId: String!, $first: Int!) {
-      automationRuns(condition: { automationId: $automationId }, orderBy: [STARTED_AT_DESC], first: $first) {
-        nodes { id startedAt endedAt errored isCancelled manuallyTriggered version { num } }
-      }
-    }`,
-    // Over-fetch when status-filtering so --failed still fills the limit.
-    {
-      automationId,
-      first: args.includes("--failed") || args.includes("--running") ? limit2 * 5 : limit2
-    }
-  );
-  let runs = data.automationRuns.nodes;
-  if (args.includes("--failed")) runs = runs.filter((r) => r.errored);
-  if (args.includes("--running")) {
-    runs = runs.filter((r) => r.endedAt == null && !r.isCancelled);
-  }
   printResult(
-    runs.slice(0, limit2).map((r) => ({
-      id: r.id,
-      version: r.version?.num,
-      startedAt: r.startedAt,
-      endedAt: r.endedAt,
-      status: r.errored ? "errored" : r.isCancelled ? "cancelled" : r.endedAt == null ? "running" : "ok",
-      manual: r.manuallyTriggered
-    })),
+    await cliClient().automation(automationId).runs({
+      limit: integerFlag(args, "--limit", 20),
+      failed: args.includes("--failed"),
+      running: args.includes("--running")
+    }),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
 var runState = async (runId, args) => {
-  const data = await gqlRequest(
-    `query CliAutomationRunState($id: String!) {
-      automationRun(id: $id) { state }
-    }`,
-    { id: runId }
-  );
-  if (data.automationRun == null) throw new Error(`Run ${runId} not found.`);
+  const state = await cliClient().automationRunState(runId);
   const node2 = flagValue(args, "--node");
-  const state = data.automationRun.state ?? {};
   printResult(
     node2 != null ? { [node2]: state[node2] ?? "(no state for this node)" } : state,
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
 var runTrigger = async (automationId, args) => {
-  const { organizationId } = await getAccessToken();
   const body = {};
   if (args.includes("-")) {
     Object.assign(
@@ -62184,18 +62886,10 @@ var runTrigger = async (automationId, args) => {
       if (eq > 0) body[pair.slice(0, eq)] = pair.slice(eq + 1);
     }
   }
-  const res = await v2Fetch(
-    `/v2/automations/${organizationId}/${automationId}/run`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    }
+  printResult(
+    await cliClient().automation(automationId).run(body),
+    resolveFormat(flagValue(args, "-o", "--output"))
   );
-  const raw2 = await res.text();
-  if (!res.ok) throw v2Error("automation run", res, raw2);
-  const responseBody = JSON.parse(raw2);
-  printResult(responseBody, resolveFormat(flagValue(args, "-o", "--output")));
 };
 var runAutomation = async (args) => {
   const [sub, id, ...rest] = args;
@@ -62300,29 +62994,7 @@ var adapterFor = (type) => {
 };
 
 // src/commands/runner.ts
-var createActionRunner = async (workspaceId, name2) => {
-  const identityResult = await gqlRequest(
-    `mutation CliCreateMachineIdentity($name: String!) {
-      createMachineIdentity(input: { name: $name }) {
-        identity { id }
-      }
-    }`,
-    { name: name2 }
-  );
-  const identityId = identityResult.createMachineIdentity?.identity?.id;
-  if (identityId == null) throw new Error("Failed to create machine identity");
-  const runnerResult = await gqlRequest(
-    `mutation CliCreateActionRunner($identityId: String!, $workspaceId: String!) {
-      createActionRunner(
-        input: { actionRunner: { identityId: $identityId, workspaceId: $workspaceId } }
-      ) { actionRunner { id } }
-    }`,
-    { identityId, workspaceId }
-  );
-  const actionRunnerId = runnerResult.createActionRunner?.actionRunner?.id;
-  if (actionRunnerId == null) throw new Error("Failed to create action runner");
-  return { actionRunnerId, identityId };
-};
+var createActionRunner = (workspaceId, name2) => cliClient().runners.create({ workspaceId, name: name2 });
 var runCreate = async (workspaceId, args) => {
   const name2 = flagValue(args, "--name") ?? "Action Runner";
   printResult(
@@ -62331,53 +63003,12 @@ var runCreate = async (workspaceId, args) => {
   );
 };
 var runToken = async (runnerId, args) => {
-  const note = flagValue(args, "--note") ?? "cli";
-  const result = await gqlRequest(
-    `mutation CliCreateActionRunnerToken($actionRunnerId: String!, $note: String) {
-      createActionRunnerToken(
-        input: { actionRunnerId: $actionRunnerId, note: $note }
-      ) { result }
-    }`,
-    { actionRunnerId: runnerId, note }
-  );
-  const secret = result.createActionRunnerToken?.result;
-  if (secret == null) throw new Error("Failed to mint runner token");
+  const secret = await cliClient().runner(runnerId).token({ note: flagValue(args, "--note") ?? "cli" });
   printResult(
     { runnerId, secret },
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var resolveWorkspaceId = async (runnerId) => {
-  const data = await gqlRequest(
-    `query CliResolveRunner($id: String!) {
-      actionRunners(condition: { id: $id }, first: 1) { nodes { workspaceId } }
-    }`,
-    { id: runnerId }
-  );
-  const workspaceId = data.actionRunners.nodes[0]?.workspaceId;
-  if (workspaceId == null) {
-    throw new Error(
-      `Unknown runner ${runnerId} (or it has no workspace). Try: overai runner list`
-    );
-  }
-  return workspaceId;
-};
-var enqueueAction = async (runnerId, actionId, inputs, args) => {
-  const { organizationId } = await getAccessToken();
-  const workspaceId = await resolveWorkspaceId(runnerId);
-  const res = await v2Fetch(
-    `/v2/actions/${organizationId}/${workspaceId}/run`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ actionId, inputs, actionRunnerId: runnerId })
-    }
-  );
-  const raw2 = await res.text();
-  if (!res.ok) throw v2Error("runner run", res, raw2);
-  const body = JSON.parse(raw2);
-  printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
-};
 var runRun = async (runnerId, args) => {
   const code = await readValue(flagValue(args, "--code"), "--code") ?? (process.stdin.isTTY ? "" : (await readStdin("the code")).trim());
   if (code.length === 0) {
@@ -62389,48 +63020,30 @@ var runRun = async (runnerId, args) => {
   if (interpreter !== "shell" && interpreter !== "powershell") {
     throw new Error("--interpreter must be 'shell' or 'powershell'.");
   }
-  await enqueueAction(
-    runnerId,
-    "RUNNER_RUN_COMMAND",
-    { actionRunnerId: runnerId, interpreter, code },
-    args
-  );
-};
-var runUpload = async (runnerId, args) => {
-  const path = flagValue(args, "--path");
-  if (path == null || path.length === 0) {
-    throw new Error("Provide a file with --path '<path>'.");
-  }
-  await enqueueAction(
-    runnerId,
-    "RUNNER_UPLOAD_FILE",
-    { actionRunnerId: runnerId, filePath: path },
-    args
+  printResult(
+    await cliClient().runner(runnerId).run({ code, interpreter }),
+    resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var runList = async (args) => {
-  const workspaceId = args.find((a) => !a.startsWith("-"));
-  const limit2 = Number(flagValue(args, "--limit") ?? 50);
-  const data = await gqlRequest(
-    `query CliRunnerList($workspaceId: String, $first: Int!) {
-      actionRunners(condition: { workspaceId: $workspaceId }, first: $first) {
-        nodes { id identity { name } workspaceId isCloud isArchived createdAt }
-      }
-    }`,
-    { workspaceId: workspaceId ?? null, first: limit2 }
-  );
-  printResult(
-    data.actionRunners.nodes.map((r) => ({
-      id: r.id,
-      name: r.identity?.name ?? null,
-      workspaceId: r.workspaceId,
-      kind: r.isCloud ? "cloud" : "self-hosted",
-      archived: r.isArchived,
-      createdAt: r.createdAt
-    })),
+var runUpload = async (runnerId, args) => {
+  const path = flagValue(args, "--path");
+  if (path == null || path.length === 0) {
+    throw new Error("Provide a file with --path '<path>'.");
+  }
+  printResult(
+    await cliClient().runner(runnerId).upload(path),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
+var runList = async (args) => {
+  const workspaceId = args.find((a) => !a.startsWith("-"));
+  const limit2 = integerFlag(args, "--limit", 50);
+  const runners = await cliClient().runners.list({
+    ...workspaceId != null ? { workspaceId } : {},
+    limit: limit2
+  });
+  printResult(runners, resolveFormat(flagValue(args, "-o", "--output")));
+};
 var USAGE2 = "Usage: overai runner create <workspaceId> [--name <name>]\n       overai runner token <runnerId> [--note <note>]\n       overai runner run <runnerId> [--interpreter shell|powershell] --code '<code>'\n       overai runner upload <runnerId> --path '<path>'\n       overai runner list [workspaceId] [--limit <n>]\n";
 var runRunner = async (args) => {
   const [sub, id, ...rest] = args;
@@ -62574,29 +63187,26 @@ var runCreate2 = async (args) => {
 };
 
 // src/commands/dataFile.ts
-import { readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { openAsBlob, writeFileSync as writeFileSync3 } from "fs";
 var runDataFile = async (args) => {
   const [operation, id, path] = args;
   if (id == null || !["upload", "download", "head"].includes(operation ?? "")) {
-    throw new Error("Usage: overai data-file upload <id> <path> [-m <message>] | data-file download <id> [path|-] | data-file head <id> [--lines N]");
+    throw new Error(
+      "Usage: overai data-file upload <id> <path> [-m <message>] | data-file download <id> [path|-] | data-file head <id> [--lines N]"
+    );
   }
-  const { organizationId } = await getAccessToken();
+  const dataFile = cliClient().dataFile(id);
   if (operation === "upload") {
-    if (path == null || path === "-") throw new Error("Upload requires a file path.");
-    const url2 = await userTrpcMutation("dataFiles.getDataFileUploadUrl", {
-      dataFileId: id,
-      fileSize: statSync2(path).size,
+    if (path == null || path === "-")
+      throw new Error("Upload requires a file path.");
+    await dataFile.upload(await openAsBlob(path), {
       message: flagValue(args, "-m", "--message") ?? ""
     });
-    const response2 = await fetch(url2, { method: "PUT", body: readFileSync5(path) });
-    if (!response2.ok) throw v2Error("data-file upload", response2, await response2.text());
     process.stdout.write(`${id}
 `);
     return;
   }
-  const suffix = operation === "head" ? `/head?numLines=${encodeURIComponent(flagValue(args, "--lines") ?? "50")}` : "";
-  const response = await v2Fetch(`/v2/data-files/${organizationId}/${id}${suffix}`, { redirect: "follow" });
-  if (!response.ok) throw v2Error(`data-file ${String(operation)}`, response, await response.text());
+  const response = operation === "head" ? await dataFile.head({ lines: integerFlag(args, "--lines", 50) }) : await dataFile.read();
   const bytes = Buffer.from(await response.arrayBuffer());
   if (path != null && path !== "-") writeFileSync3(path, bytes);
   else process.stdout.write(bytes);
@@ -62606,40 +63216,39 @@ var runDataFile = async (args) => {
 var runDataStream = async (args) => {
   const [operation, id] = args;
   if (id == null || operation !== "append" && operation !== "query") {
-    throw new Error("Usage: overai data-stream append <id> <json|@file|@-> | data-stream query <id> --start <date> --end <date> [--query <filter>] [--limit N]");
+    throw new Error(
+      "Usage: overai data-stream append <id> <json|@file|@-> | data-stream query <id> --start <date> --end <date> [--query <filter>] [--limit N]"
+    );
   }
-  const { organizationId } = await getAccessToken();
+  const dataStream = cliClient().dataStream(id);
   if (operation === "append") {
-    const raw3 = await readValue(args[2], "data stream input");
-    if (raw3 == null) throw new Error("Data stream append requires JSON, @<file>, or @-.");
+    const raw2 = await readValue(args[2], "data stream input");
+    if (raw2 == null)
+      throw new Error("Data stream append requires JSON, @<file>, or @-.");
     const parsed = (() => {
       try {
-        return JSON.parse(raw3);
+        return JSON.parse(raw2);
       } catch {
         throw new Error("Data stream input must be valid JSON.");
       }
     })();
-    const response2 = await v2Fetch(`/v1/data-streams/${organizationId}/${id}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ data: Array.isArray(parsed) ? parsed : [parsed] })
-    });
-    const appended = await response2.text();
-    if (!response2.ok) throw v2Error("data-stream append", response2, appended);
-    const body2 = JSON.parse(appended);
-    printResult(body2, resolveFormat(flagValue(args, "-o", "--output")));
+    printResult(
+      await dataStream.append(parsed),
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
     return;
   }
   const start = flagValue(args, "--start");
   const end = flagValue(args, "--end");
-  if (start == null || end == null) throw new Error("Data stream query requires --start and --end.");
-  const query = new URLSearchParams({ startAt: start, endAt: end, query: flagValue(args, "--query") ?? "" });
-  const limit2 = flagValue(args, "--limit");
-  if (limit2 != null) query.set("limit", limit2);
-  const response = await v2Fetch(`/v1/data-streams/${organizationId}/${id}?${query.toString()}`);
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("data-stream query", response, raw2);
-  const body = JSON.parse(raw2);
+  if (start == null || end == null)
+    throw new Error("Data stream query requires --start and --end.");
+  const limit2 = integerFlag(args, "--limit");
+  const body = await dataStream.query({
+    startAt: start,
+    endAt: end,
+    query: flagValue(args, "--query") ?? "",
+    ...limit2 != null ? { limit: limit2 } : {}
+  });
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -62654,12 +63263,21 @@ import {
   existsSync as existsSync3,
   lstatSync,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync5,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "fs";
 import { join as join4, resolve as resolve3 } from "path";
 
+// src/gql.ts
+var gqlRequest = async (query, variables) => {
+  try {
+    return await cliClient().graphql(query, variables);
+  } catch (error62) {
+    throw withOrgHint(error62);
+  }
+};
+
 // src/workspace/tree.ts
 var fetchWorkspaceChildren = async (id) => {
   const children = [];
@@ -62724,7 +63342,7 @@ var runClone = async (args, isShallow = false) => {
       `${root} is already a cloned workspace. Use \`overai pull\` to refresh.`
     );
   }
-  const partialCloneWorkspaceId = existsSync3(cloneMarker) ? readFileSync6(cloneMarker, "utf8").trim() : null;
+  const partialCloneWorkspaceId = existsSync3(cloneMarker) ? readFileSync5(cloneMarker, "utf8").trim() : null;
   if (partialCloneWorkspaceId != null && partialCloneWorkspaceId !== workspaceId) {
     throw new Error(
       `${root} contains an incomplete clone of ${partialCloneWorkspaceId}. Retry that workspace or choose another directory.`
@@ -62742,7 +63360,7 @@ var runClone = async (args, isShallow = false) => {
     if (entry.root !== root && existsSync3(entry.root)) {
       if (lstatSync(entry.root).isSymbolicLink())
         throw new Error(`Refusing to clone into symbolic link ${entry.root}.`);
-      const savedId = completed ? readManifest(entry.root).workspaceId : existsSync3(marker) ? readFileSync6(marker, "utf8").trim() : null;
+      const savedId = completed ? readManifest(entry.root).workspaceId : existsSync3(marker) ? readFileSync5(marker, "utf8").trim() : null;
       if (partialCloneWorkspaceId !== workspaceId || savedId !== entry.workspace.id)
         throw new Error(
           `${entry.root} already exists. Choose another clone directory.`
@@ -63261,7 +63879,7 @@ var runDev = async (args) => {
       clearTimeout(timer);
     });
   });
-  const port = Number(flagValue(args, "--port") ?? 4820);
+  const port = integerFlag(args, "--port", 4820);
   await new Promise((resolve4, reject2) => {
     server.once("error", reject2);
     server.listen(port, "127.0.0.1", resolve4);
@@ -63309,54 +63927,16 @@ var runLogs = async (args) => {
     );
   }
   const executionId = flagValue(args, "--execution");
+  const fn2 = cliClient().fn(functionId);
+  const fmt = resolveFormat(flagValue(args, "-o", "--output"));
   if (executionId == null) {
-    const limit2 = Number(flagValue(args, "--limit") ?? 20);
-    const data2 = await gqlRequest(
-      `query CliFunctionExecutions($functionId: String!, $first: Int!) {
-        functionExecutions(condition: { functionId: $functionId }, orderBy: [CREATED_AT_DESC], first: $first) {
-          nodes { id createdAt httpStatusCode executionTime requestMethod requestPath versionNumber }
-        }
-      }`,
-      { functionId, first: limit2 }
-    );
     printResult(
-      data2.functionExecutions.nodes,
-      resolveFormat(flagValue(args, "-o", "--output"))
+      await fn2.executions({ limit: integerFlag(args, "--limit", 20) }),
+      fmt
     );
     return;
   }
-  const data = await gqlRequest(
-    `query CliFunctionExecution($functionId: String!, $id: String!) {
-      functionExecutions(condition: { functionId: $functionId, id: $id }, first: 1) {
-        nodes { id summary createdAt httpStatusCode executionTime versionNumber logsUrl inputBodyUrl outputBodyUrl }
-      }
-    }`,
-    { functionId, id: executionId }
-  );
-  const execution = data.functionExecutions.nodes[0];
-  if (execution == null) throw new Error(`Execution ${executionId} not found.`);
-  const fetchText = async (url2) => url2 == null ? null : await fetch(url2).then((r) => r.ok ? r.text() : null);
-  const [logs, input2, output2] = await Promise.all([
-    fetchText(execution.logsUrl),
-    fetchText(execution.inputBodyUrl),
-    fetchText(execution.outputBodyUrl)
-  ]);
-  const fmt = resolveFormat(flagValue(args, "-o", "--output"));
-  printResult(
-    {
-      id: execution.id,
-      createdAt: execution.createdAt,
-      httpStatusCode: execution.httpStatusCode,
-      executionTime: execution.executionTime,
-      versionNumber: execution.versionNumber,
-      summary: execution.summary,
-      input: input2,
-      output: output2,
-      logs
-    },
-    // A single nested record reads better as JSON than a 1-row table.
-    fmt === "table" ? "json" : fmt
-  );
+  printResult(await fn2.execution(executionId), fmt === "table" ? "json" : fmt);
 };
 var runFn = async (args) => {
   if (args[0] === "logs") return runLogs(args.slice(1));
@@ -63367,8 +63947,6 @@ var runFn = async (args) => {
     );
   }
   const method = (flagValue(args, "--method") ?? "POST").toUpperCase();
-  const rawPath = flagValue(args, "--path") ?? "";
-  const subPath = rawPath && !rawPath.startsWith("/") ? `/${rawPath}` : rawPath;
   const sendsBody = !["GET", "HEAD", "DELETE"].includes(method);
   if (!sendsBody && (args.includes("--input") || args.includes("-"))) {
     process.stderr.write(
@@ -63376,16 +63954,12 @@ var runFn = async (args) => {
 `
     );
   }
-  const input2 = sendsBody ? await collectInput(args) : void 0;
-  const { organizationId } = await getAccessToken();
-  const res = await v2Fetch(
-    `/v2/functions/${organizationId}/${functionId}${subPath}`,
-    {
-      method,
-      headers: sendsBody ? { "Content-Type": "application/json" } : {},
-      body: sendsBody ? JSON.stringify(input2) : void 0
-    }
-  );
+  const res = await cliClient().fn(functionId).call({
+    method,
+    path: flagValue(args, "--path"),
+    headers: sendsBody ? { "Content-Type": "application/json" } : {},
+    body: sendsBody ? JSON.stringify(await collectInput(args)) : void 0
+  });
   const executionId = res.headers.get("x-execution-id");
   if (executionId != null) {
     process.stderr.write(`execution: ${executionId}
@@ -63398,11 +63972,11 @@ var runFn = async (args) => {
 };
 
 // src/commands/graphql.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 var runGraphql = async (args) => {
   const inline = await readValue(flagValue(args, "-q", "--query"), "-q");
   const file2 = flagValue(args, "-f", "--file");
-  const query = inline ?? (file2 != null ? readFileSync7(file2, "utf8") : process.stdin.isTTY ? "" : (await readStdin("the query")).trim());
+  const query = inline ?? (file2 != null ? readFileSync6(file2, "utf8") : process.stdin.isTTY ? "" : (await readStdin("the query")).trim());
   if (query.length === 0) {
     throw new Error(
       "Provide a query with -q '<query>', -q @<file>, -f <file>, or stdin."
@@ -63426,14 +64000,19 @@ var runGraphql = async (args) => {
       );
     }
   })();
-  const res = await v2Fetch(
-    args.includes("--v1") ? "/v1/graphql" : "/v2/graphql",
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ query, variables })
-    }
-  );
+  const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+  if (!args.includes("--v1")) {
+    printResult(
+      await gqlRequest(query, variables),
+      format2
+    );
+    return;
+  }
+  const res = await cliClient().fetch("/v1/graphql", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ query, variables })
+  });
   const raw2 = await res.text();
   const body = (() => {
     try {
@@ -63449,39 +64028,11 @@ var runGraphql = async (args) => {
   if (body == null) {
     throw new Error("graphql returned an unreadable body.");
   }
-  printResult(body.data, resolveFormat(flagValue(args, "-o", "--output")));
+  printResult(body.data, format2);
 };
 
 // src/commands/integration.ts
 var USAGE3 = "Usage: overai integration configure <id> --config <json|@file|@-> | integration config <id> | integration secret set <id> <KEY> --value <@file|@-> | integration secret unset <id> <KEY>";
-var setSecret = async (integrationId, key, rawValue) => {
-  if (rawValue == null) {
-    throw new Error("Integration secret set requires --value.");
-  }
-  if (!rawValue.startsWith("@")) {
-    throw new Error(
-      "--value must be @- (stdin) or @<file>, so the secret stays out of your shell history."
-    );
-  }
-  const value = await readValue(rawValue, "--value");
-  if (value == null || value === "") {
-    throw new Error("--value resolved to an empty string.");
-  }
-  await gqlRequest(
-    `mutation SetIntegrationSecret($input: UpdateIntegrationConfigInput!) {
-      updateIntegrationConfig(input: $input) { success }
-    }`,
-    { input: { integrationId, partialConfig: { [key]: value } } }
-  );
-};
-var unsetSecret = async (integrationId, key) => {
-  await gqlRequest(
-    `mutation UnsetIntegrationSecret($input: DeleteIntegrationConfigKeyInput!) {
-      deleteIntegrationConfigKey(input: $input) { success }
-    }`,
-    { input: { integrationId, key } }
-  );
-};
 var runIntegration = async (args) => {
   const [operation] = args;
   if (operation === "secret") {
@@ -63489,22 +64040,36 @@ var runIntegration = async (args) => {
     if (action !== "set" && action !== "unset" || id2 == null || key == null || key.startsWith("-")) {
       throw new Error(USAGE3);
     }
+    const integration2 = cliClient().integration(id2);
     if (action === "set") {
-      await setSecret(id2, key, flagValue(args, "--value"));
+      const rawValue = flagValue(args, "--value");
+      if (rawValue == null) {
+        throw new Error("Integration secret set requires --value.");
+      }
+      if (!rawValue.startsWith("@")) {
+        throw new Error(
+          "--value must be @- (stdin) or @<file>, so the secret stays out of your shell history."
+        );
+      }
+      const value = await readValue(rawValue, "--value");
+      if (value == null || value === "") {
+        throw new Error("--value resolved to an empty string.");
+      }
+      await integration2.setSecret(key, value);
     } else {
-      await unsetSecret(id2, key);
+      await integration2.unsetSecret(key);
     }
-    const result2 = await userTrpcMutation(
-      "getMaskedIntegrationConfig",
-      { id: id2 }
+    printResult(
+      await integration2.config(),
+      resolveFormat(flagValue(args, "-o", "--output"))
     );
-    printResult(result2, resolveFormat(flagValue(args, "-o", "--output")));
     return;
   }
   const [, id] = args;
   if (id == null || operation !== "configure" && operation !== "config") {
     throw new Error(USAGE3);
   }
+  const integration = cliClient().integration(id);
   if (operation === "configure") {
     const raw2 = await readValue(flagValue(args, "--config"), "--config");
     if (raw2 == null)
@@ -63516,16 +64081,16 @@ var runIntegration = async (args) => {
         throw new Error("--config must be valid JSON.");
       }
     })();
-    await userTrpcMutation("putIntegrationConfig", { id, value });
+    await integration.configure(value);
   }
-  const result = await userTrpcMutation("getMaskedIntegrationConfig", {
-    id
-  });
-  printResult(result, resolveFormat(flagValue(args, "-o", "--output")));
+  printResult(
+    await integration.config(),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
 };
 
 // src/commands/knowledgeBase.ts
-import { readFile as readFile2 } from "fs/promises";
+import { openAsBlob as openAsBlob2 } from "fs";
 import { basename } from "path";
 var runKnowledgeBase = async (args) => {
   const [operation, id] = args;
@@ -63534,7 +64099,7 @@ var runKnowledgeBase = async (args) => {
       "Usage: overai knowledge-base upload <id> <file...> | knowledge-base search <id> <query> [--limit N]"
     );
   }
-  const { organizationId } = await getAccessToken();
+  const knowledgeBase = cliClient().knowledgeBase(id);
   if (operation === "upload") {
     const paths = args.slice(2).filter(
       (arg, i, all) => !arg.startsWith("-") && all[i - 1] !== "-o" && all[i - 1] !== "--output"
@@ -63543,20 +64108,11 @@ var runKnowledgeBase = async (args) => {
       throw new Error("Knowledge base upload requires at least one file path.");
     const uploads = [];
     for (const path of paths) {
-      const bytes = await readFile2(path);
-      const formData = new FormData();
-      formData.append(
-        "file",
-        new Blob([new Uint8Array(bytes)]),
+      const result = await knowledgeBase.upload(
+        await openAsBlob2(path),
         basename(path)
       );
-      const response2 = await v2Fetch(
-        `/v2/knowledge-bases/${organizationId}/${id}/upload`,
-        { method: "POST", body: formData }
-      );
-      const raw3 = await response2.text();
-      if (!response2.ok) throw v2Error("knowledge-base upload", response2, raw3);
-      uploads.push({ file: basename(path), ...JSON.parse(raw3) });
+      uploads.push({ file: basename(path), ...result });
     }
     printResult(uploads, resolveFormat(flagValue(args, "-o", "--output")));
     return;
@@ -63564,22 +64120,9 @@ var runKnowledgeBase = async (args) => {
   const query = args[2];
   if (query == null || query.startsWith("-"))
     throw new Error("Knowledge base search requires a query string.");
-  const limit2 = flagValue(args, "--limit");
-  const response = await v2Fetch(
-    `/v2/knowledge-bases/${organizationId}/${id}/search`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        query,
-        ...limit2 != null ? { limit: Number(limit2) } : {}
-      })
-    }
-  );
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("knowledge-base search", response, raw2);
+  const limit2 = integerFlag(args, "--limit");
   printResult(
-    JSON.parse(raw2),
+    await knowledgeBase.search(query, limit2 != null ? { limit: limit2 } : {}),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
@@ -63872,25 +64415,16 @@ var unaliasOrg = async (alias) => {
 // src/commands/printablePage.ts
 var runPrintablePage = async (args) => {
   const [operation, id] = args;
-  if (operation !== "render" || id == null) throw new Error("Usage: overai printable-page render <id> [--search-params <json|@file>] [--timeout <ms>]");
-  const data = await gqlRequest(
-    `query CliPrintablePageWorkspace($id: String!) { printablePage(id: $id) { workspaceId } }`,
-    { id }
-  );
-  if (data.printablePage == null) throw new Error(`Printable page ${id} not found.`);
+  if (operation !== "render" || id == null)
+    throw new Error(
+      "Usage: overai printable-page render <id> [--search-params <json|@file>] [--timeout <ms>]"
+    );
   const searchParams = await readValue(flagValue(args, "--search-params"), "--search-params") ?? "{}";
   JSON.parse(searchParams);
-  const { organizationId } = await getAccessToken();
-  const timeoutMs = Number(flagValue(args, "--timeout") ?? 6e4);
-  const response = await v2Fetch(`/v2/actions/${organizationId}/${data.printablePage.workspaceId}/run`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ actionId: "PRINTABLE_PAGE_TO_PDF", inputs: { printablePageId: id, searchParams, includeDiagnostics: true } }),
-    signal: AbortSignal.timeout(timeoutMs)
+  const body = await cliClient().printablePage(id).render({
+    searchParams,
+    timeoutMs: integerFlag(args, "--timeout", 6e4)
   });
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("printable-page render", response, raw2);
-  const body = JSON.parse(raw2);
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -64313,7 +64847,7 @@ var runRemote = async (args) => {
 
 // src/commands/update.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@overaihq/cli";
 var packageRootUrl = () => {
@@ -64331,7 +64865,7 @@ var compareVersions = (a, b) => {
 };
 var cliVersion = () => {
   const pkg = JSON.parse(
-    readFileSync8(new URL("package.json", packageRootUrl()), "utf8")
+    readFileSync7(new URL("package.json", packageRootUrl()), "utf8")
   );
   return pkg.version;
 };
@@ -64438,8 +64972,7 @@ var runReport = async (args) => {
     }
   })();
   const resources = manifest ? Object.entries(manifest.resources) : [];
-  await userTrpcMutation("architectIssues.report", {
-    ...input2,
+  await cliClient().report(input2.feedbackType, input2.detailedBugReport, {
     source: "cli",
     cliContext: {
       cliVersion: cliVersion(),
@@ -64478,12 +65011,12 @@ var runResource = async (args) => {
     );
     return;
   }
-  const timeout = flagValue(args, "--timeout");
+  const timeout = integerFlag(args, "--timeout");
   const patch = {
     name: flagValue(args, "--name"),
     description: flagValue(args, "--description"),
     integrationTypeId: flagValue(args, "--type"),
-    actionTimeoutSeconds: timeout == null ? void 0 : Number(timeout)
+    actionTimeoutSeconds: timeout
   };
   [
     ["isArchived", "--archive", true],
@@ -64538,7 +65071,9 @@ var workflow = `# CLI editing workflow
    step users can feel; push freely, deploy deliberately.
 
 Never edit .overai/ by hand \u2014 it holds the manifest and pristine base copies
-that make status/diff/fast-forward work.
+that make status/diff/fast-forward work. \`.overai/base/\` mirrors every
+resource file as last synced; edit the working copy, never the base. Git and
+ripgrep skip the folder through its own ignore files.
 
 A push conflict does not deploy anything. Normal push sends the manifest base
 to an atomic server check; only explicit --force omits it. Never use --force as
@@ -64617,6 +65152,19 @@ around a clone-sync mismatch; use the correct workspace folder.
 - Give each service its own credential. List, rotate, or revoke it with
   \`overai sql credential list|rotate|revoke\`.
 
+## From a script
+
+- The CLI is a shell over \`@overaihq/sdk\`. A Node script or a long-running
+  program uses the package directly: \`createClient({ baseUrl, token: patToken(secret, baseUrl) })\`
+  gives \`client.fn(id).call()\`, \`client.tableSpace(id).sql()\`,
+  \`client.page(id).save()\`/\`.deploy()\`, \`client.workspaces.list()\`, and the
+  rest of what the commands do, with the same errors. \`overai\` stays the right
+  tool at a terminal; the SDK is for code.
+- \`@overaihq/sdk/env\` exports \`createEnv\`: \`await createEnv(client)\` is the \`env\` object function
+  code already uses, outside the platform. Everything HTTP-backed is there
+  (\`env.FNxxx.call\`, \`env.TBSxxx.sql\`, \`env.DFxxx.read\`, \`env.STORAGE\`,
+  \`env.AI\`); \`env.BROWSER\` and \`env.CALLER\` exist only inside a function.
+
 ## Reporting platform problems
 
 When broken or unexplained platform behavior blocks progress, send a detailed
@@ -65015,7 +65563,7 @@ Users who prefer their own editor or an AI coding agent (Claude Code, Cursor) ca
 
 Clone includes accessible, non-archived descendants under \`workspaces/<slug>.<workspaceId>/\`, each with its own manifest and overview. Commands use the nearest workspace folder: change into a child to work there. Add \`--recursive\` to status/diff/pull/push to include the live accessible subtree; recursive pull clones new children and matches existing folders by workspace ID. Recursive push saves only and rejects --deploy; deploy/restore remain single-workspace. Conflicts or failures exit nonzero while preserving local edits and successful work. Unavailable or moved-out workspaces stay on disk and are skipped. Local file moves do not move resources between workspaces in OverAI.
 
-The loop is git-shaped: \`overai clone <workspaceId>\` writes the workspace overview to \`WORKSPACE.md\` and materializes automations, functions, web pages, printable pages, and agents as local files; \`status\`/\`diff\`/\`pull\` track local resource edits against remote drift; \`push -m "why"\` creates new versions and \`deploy\` makes them live \u2014 **pushing alone changes nothing users see**. \`overai create <type>\` creates any current resource, while \`resource show|update <id>\` handles mutable metadata. \`workspace show [workspaceId]\` reads the current overview, and \`workspace users [workspaceId]\` lists effective, direct, and inherited access; inside a clone the id is optional. Resource-specific commands invoke functions and agents, trigger automations, run SQL, append/query streams, upload/download files, configure integrations, render printable pages, and pair or use runners. \`overai review\` validates changed resources before a push, and \`overai best-practices\` serves these same doc topics, plus the CLI's own workflow guide, to the local agent.
+The loop is git-shaped: \`overai clone <workspaceId>\` writes the workspace overview to \`WORKSPACE.md\` and materializes automations, functions, web pages, printable pages, and agents as local files (\`.overai/\` holds sync state and is ignored by git); \`status\`/\`diff\`/\`pull\` track local resource edits against remote drift; \`push -m "why"\` creates new versions and \`deploy\` makes them live \u2014 **pushing alone changes nothing users see**. \`overai create <type>\` creates any current resource, while \`resource show|update <id>\` handles mutable metadata. \`workspace show [workspaceId]\` reads the current overview, and \`workspace users [workspaceId]\` lists effective, direct, and inherited access; inside a clone the id is optional. Resource-specific commands invoke functions and agents, trigger automations, run SQL, append/query streams, upload/download files, configure integrations, render printable pages, and pair or use runners. \`overai review\` validates changed resources before a push, and \`overai best-practices\` serves these same doc topics, plus the CLI's own workflow guide, to the local agent.
 
 Point users here when they ask about editing outside the browser, using a local AI coding agent, version-controlling a workspace, or scripting against the platform. Everything the CLI does is also doable in the Architect \u2014 it is an alternative surface, not a required one. Full command list: \`overai help\`; the user-facing guide is the help center article at \`/<orgId>/help/cli\`.
 `
@@ -65237,6 +65785,10 @@ Two optional JSON Schemas declare the function's contract:
 
 The deployed version's schemas type \`env.FNxxx.call()\` everywhere authors call this function: the envelope's \`body\` member types the call body, and the output schema types \`res.json()\`. Declare the output schema whenever the response shape is stable \u2014 callers get autocomplete and typo-catching lint instead of \`any\` \u2014 and keep both schemas in sync with what the code actually reads and returns. They describe the base path; a router's sub-paths are outside the declared contract.
 
+Autocomplete and deployed-schema types cover functions owned by or shared into this workspace. A manually named \`env.FNxxx\` (or \`env.fnxxx\`) outside that list has a generic call type, not the target's schema. Static unlisted references warn through \`architect/unlisted-function\`; an intentional cross-workspace call may be valid, but verify the ID and the deployed caller access against the actual caller. Do not claim access was verified without checking, change sharing or caller access just to silence the warning, or invoke a side-effecting function merely to test it. After verification, acknowledge a known reference with \`// eslint-disable-next-line architect/unlisted-function -- <verified reason>\` directly above it. Give a concrete reason; avoid casts, \`@ts-ignore\`, and blanket suppressions. Dynamic IDs are outside this static check.
+
+If the warning gives a listed function's spelling, use that spelling instead of suppressing it; different casing loses its deployed-schema types.
+
 Lint enforces the output side: when an output schema is declared, a handler whose return value doesn't match it gets a lint error (both on code edits and on schema edits). Returning the plain JSON value (the runtime wraps it in a 200 response) keeps the check active; a hand-built \`Response\` passes unchecked because its payload is invisible to the type checker. Enum values are checked as their base type (\`string\`, not the exact members), and \`null\`/missing-return code paths are not caught \u2014 verify those yourself.
 
 Callers can also name the declared shapes: the deployed schemas generate \`Env.FNxxx.Input\` (the call body) and \`Env.FNxxx.Output\` (the response) for annotating payloads and results.
@@ -65266,6 +65818,12 @@ Built-in variables:
 - \`env.CALLER\` (verified JWT claims from the request, or null \u2014 useful for identifying the calling user from a web page)
 - Any custom secrets/environment variables configured on the function
 
+The same \`env\` is importable outside the platform: \`import { createEnv } from "@overaihq/sdk/env"\` and \`const env = await createEnv(client)\`
+gives a Node script every HTTP-backed member above with the same names and
+shapes. \`env.BROWSER\` and \`env.CALLER\` exist only inside a function, and
+\`env.TBSxxx.sql\` there returns \`{ rows, rowCount }\` over HTTP instead of a
+direct database connection.
+
 ## AI Access
 
 Generate text or structured objects using LLMs:
@@ -66055,8 +66613,6 @@ Saves reject a stale editing base without discarding your draft. Incorporate the
 
 \`\`\`typescript
 declare global {
-  const filterData: { id: string; attributes: { id: string; attributeId: string; value: string; }[]; }[] | null;
-  const dataFile: Record<string, unknown> | null;
   const searchParams: Record<string, unknown>;
   const setSearchParam: { (key: string, value: string | null): void; (params: Record<string, string | null>): void }; // pass null to delete a param; pass an object to set/delete several in one URL update
   const navigateToPage: (webPageId: string, queryParameters?: Record<string, string>, options?: { newTab?: boolean }) => void; // { newTab: true } opens the page in a new browser tab \u2014 use it instead of hand-building URLs with window.open
@@ -66070,6 +66626,8 @@ declare global {
   /** @deprecated Use useLLMText, useLLMObject, or useLLMChat instead. */
   const llmCompletion: (message: string, systemPrompt?: string, model?: string) => Promise<Record<string, unknown>>;
   const callFunction: (functionId: string, options?: { body?: unknown; method?: string; query?: Record<string, string>; path?: string }) => Promise<Response>;
+  // Start a deployed automation. \`inputs\` maps onto its event node's declared outputs (e.g. { fileUrl } for a file-upload trigger \u2014 upload with env.STORAGE.upload first). Throws on non-2xx.
+  const startAutomation: (automationId: string, inputs?: Record<string, unknown>) => Promise<{ automationRunId: string }>;
 
   // Imperative AI functions
   // Prefer stream: false for one-shot generateText calls \u2014 errors (invalid PDF, prompt too long, rate limit) come back as HTTP errors with a friendly message instead of an empty body. Only stream when you wire onChunk for progressive UI.
@@ -66086,20 +66644,10 @@ declare global {
   const callAgentGenerateObject: (agentId: string, message: string, schema: Record<string, unknown>) => Promise<{ object: unknown; model: string; finishReason: string; usage: { promptTokens: number; completionTokens: number; totalTokens: number }; toolResults: { toolName: string; input: unknown; output: unknown; error: unknown }[] }>;
   const callAgentChat: (agentId: string, messages: { role: string; parts: { type: string; text?: string }[] }[], options?: { conversationId?: string; onChunk?: (accumulated: string) => void }) => Promise<string>;
 
-  // Agent Hook \u2014 multi-turn streaming chat with an OverAI Agent.
-  // Every turn is persisted server-side for a signed-in viewer. Pass conversationId
-  // to resume a past thread (its full transcript, tool calls included, loads on
-  // mount). Omit it to start fresh \u2014 a conversation is created on the first send and
-  // returned as conversationId. messages[].parts holds full UI parts for loaded turns;
-  // the live-streaming turn carries text only.
-  // On a PUBLIC page there is no viewer identity: chat works, but the transcript
-  // lives in the hook for the tab's life, conversationId stays null, and the
-  // conversation helpers below throw. See "Public pages" below.
+  // Agent Hook \u2014 multi-turn streaming chat with an OverAI Agent; persistence and resume are explained below the block. messages[].parts holds full UI parts for loaded turns; the live-streaming turn carries text only.
   const useAgentChat: (agentId: string, options?: { conversationId?: string }) => { messages: { id?: string; role: string; text: string; parts?: { type: string; text?: string; toolName?: string; toolCallId?: string; state?: string; input?: unknown; output?: unknown }[] }[]; sendMessage: (text: string) => void; clearMessages: () => void; loading: boolean; error: string | null; conversationId: string | null };
 
-  // Agent conversation management \u2014 list/read/manage a signed-in user's chat threads
-  // with an agent. Unavailable on public pages (no identity owns a thread):
-  // useAgentConversations returns an empty list, the rest throw.
+  // Agent conversation management \u2014 list/read/manage a signed-in user's chat threads with an agent.
   const useAgentConversations: (agentId: string) => { conversations: { id: string; title: string; updatedAt: string }[]; loading: boolean; error: string | null; refresh: () => Promise<void> };
   const listAgentConversations: (agentId: string) => Promise<{ id: string; title: string; updatedAt: string }[]>;
   const getAgentConversationMessages: (conversationId: string) => Promise<{ id?: string; role: string; text: string; parts?: { type: string; text?: string }[] }[]>;
@@ -66121,9 +66669,12 @@ declare global {
         /** Escape hatch for dynamic SQL. Caller is responsible for parameterizing. */
         unsafe: <Row = any>(query: string, params?: unknown[]) => Promise<{ rows: Row[]; rowCount: number }>;
       };
+      /** Several statements that must all land or none do. Pass lazy \`sql\` fragments; resolves to { results, executionId, durationMs } with results[i] = { rows, rowCount }. Any failure rolls everything back and throws. */
+      transaction: (statements: readonly unknown[]) => Promise<{ results: { rows: Record<string, unknown>[]; rowCount: number }[]; executionId: string; durationMs: number }>;
       /** @deprecated Use \`sql\` \u2014 it auto-parameterizes interpolated values and returns rows directly. query returns camelCased columns (sql returns snake_case); do not mix the two. */
       query: (sql: TemplateStringsArray, ...values: unknown[]) => Promise<Response>;
     };
+    [automationId: \`AT\${string}\`]: { start: (inputs?: Record<string, unknown>) => Promise<{ automationRunId: string }> };
     /** \`path\` routes to a sub-path inside the function (e.g. "/features/123") for functions that ship their own router; omit it to hit the base path. Method still defaults to POST. */
     [functionId: \`FN\${string}\`]: { call: (options?: { body?: unknown; method?: string; query?: Record<string, string>; path?: string }) => Promise<Response> };
     [agentId: \`AG\${string}\`]: { generateText: (message: string) => Promise<{ text: string; model: string; finishReason: string; usage: { promptTokens: number; completionTokens: number; totalTokens: number }; toolResults: { toolName: string; input: unknown; output: unknown; error: unknown }[] }>; generateObject: (message: string, schema: Record<string, unknown>) => Promise<{ object: unknown; model: string; finishReason: string; usage: { promptTokens: number; completionTokens: number; totalTokens: number }; toolResults: { toolName: string; input: unknown; output: unknown; error: unknown }[] }> };
@@ -66140,8 +66691,6 @@ declare global {
     };
   };
   const React: typeof import("react");
-  const useDataFile: () => Record<string, unknown> | null;
-  const useFilterData: () => { id: string; attributes: { id: string; attributeId: string; value: string; }[]; }[] | null;
   const useCurrentUser: () => { id: string; email: string; name: string; } | null;
   // useTheme re-renders on the app's light/dark toggle. The page root already carries a \`dark\` class (Tailwind darkMode: "class"), so style with \`dark:\` variants \u2014 e.g. bg-white dark:bg-slate-900 \u2014 and reach for the hook only for JS-driven styling (chart palettes, canvas, map tiles).
   // Two things a light-only page gets wrong in dark mode: a border or divide utility with no color class falls back to Tailwind's default light gray, so \`border-b\` alone stays a bright rule \u2014 pair it, e.g. border-b border-gray-200 dark:border-gray-700. And if the page loads daisyUI, its theme drives the inherited text color, so a hardcoded bg-white left to inherit turns light-on-white; give every surface a dark counterpart.
@@ -66154,19 +66703,29 @@ declare global {
   const useLocalStorageState: <T>(key: string, initialValue: T) => [T, React.Dispatch<React.SetStateAction<T>>];
   // useSessionStorageState is a useState-like hook backed by sessionStorage. Persists for the lifetime of the tab. REQUIRES noSandbox: true in the page config.
   const useSessionStorageState: <T>(key: string, initialValue: T) => [T, React.Dispatch<React.SetStateAction<T>>];
+
+  // Legacy \u2014 populated only by the deprecated dataSourceUrl / filter page settings (see "Legacy data sources" below). New pages use env instead.
+  const dataFile: Record<string, unknown> | null;
+  const useDataFile: () => Record<string, unknown> | null;
+  const filterData: { id: string; attributes: { id: string; attributeId: string; value: string; }[]; }[] | null;
+  const useFilterData: () => { id: string; attributes: { id: string; attributeId: string; value: string; }[]; }[] | null;
 }
 \`\`\`
 
-IMPORTANT: Use the hooks (useDataFile, useFilterData, useSearchParamState) instead of the global variables when you need the component to re-render when data or URL state changes. URL state belongs in search params (via useSearchParamState), not local React state, so links and reloads preserve it.
+IMPORTANT: Use useSearchParamState instead of the searchParams global when the component must re-render as the URL changes. URL state belongs in search params (via useSearchParamState), not local React state, so links and reloads preserve it.
 
 IMPORTANT: callFunction and env.FNxxx.call return a Response object (like fetch) \u2014 call .json() or .text() to get the data. Date/timestamp values come back as ISO 8601 strings (e.g., "2026-04-06T00:00:00.000Z"). When the function declares input/output schemas, env.FNxxx.call types the body and .json() from them (the deployed version's declaration) \u2014 no annotation needed.
 
+Function autocomplete and deployed-schema types cover functions owned by or shared into this workspace. A manually named \`env.FNxxx\` or \`env.fnxxx\` outside that list remains a generic call, not a typed discovery of organization functions. A static unlisted reference raises advisory \`architect/unlisted-function\`; dynamic IDs are not checked. Verify the ID and deployed caller access for the page's actual caller before using an intentional cross-workspace reference. Never claim unverified access, change sharing or authorization just to silence the warning, or invoke a side-effecting function merely to test it. Once verified, acknowledge the reference with \`// eslint-disable-next-line architect/unlisted-function -- <verified reason>\` directly above it. Prefer a concrete reason, not casts, \`@ts-ignore\`, or blanket suppression.
+
+If the warning gives a listed function's spelling, use that spelling instead of suppressing it; different casing loses its deployed-schema types.
+
 The \`env\` proxy matches the API available in Functions and Automations \u2014 the same code works in all three.
 
 For AI in React components, prefer the reactive hooks (useLLMText, useLLMObject, useLLMChat, useAgentChat) \u2014 they re-render as the response streams in. In event handlers or imperative code, call generateText/generateObject (or env.AI.*) directly.
 useAgentChat persists every turn server-side for a signed-in viewer: pass a conversationId to resume a past thread (full transcript, tool calls included, loads automatically), or omit it to start fresh and read the new thread's id off the returned conversationId. useAgentConversations(agentId) backs a history sidebar \u2014 call its refresh() after a first send so the newly created thread appears. listAgentConversations, getAgentConversationMessages, createAgentConversation, renameAgentConversation, and deleteAgentConversation are the imperative equivalents. On a public page none of that persistence exists (see Public pages) \u2014 useAgentChat still streams, holding the transcript in memory.
 All AI functions/hooks accept optional File[] attachments for images/PDFs, and webSearch: true to enable web search.
-Available models: the model ids this workspace can use. Omit \`model\` to use this workspace's default.
+Available models: read \`availableModelIds\` from the \`getWebPageContext\` data tool. Omit \`model\` to use this workspace's default.
 
 IMPORTANT: Keep generateObject / useLLMObject / agent generateObject schemas simple. Anthropic models reject schemas with more than 16 nullable or union-typed fields (this includes optional fields the AI SDK emits as \`type: [..., "null"]\`). Prefer non-nullable fields, split into multiple calls, or switch to a non-Anthropic model from the list above for larger schemas.
 
@@ -66242,25 +66801,16 @@ const { rows } = await env.TBS123.sql.unsafe(
 
 Pages render UI; they don't perform server-side actions directly. To do anything with side effects beyond table-space SQL (send email, hit a third-party API, post to Slack, etc.), call a Function or trigger an Automation. Table spaces are the exception: read AND write them directly with env.TBSxxx.sql as shown above.
 
-- **Common actions** like sending email, Slack messages, SMS, or HTTP calls are first-class Automation nodes. \`SEND_EMAIL\` and \`HTTP\` need no integration; \`SLACK_SEND_MESSAGE\` and \`TWILIO_SEND_SMS\` require their respective integration to be configured. Build a webhook-triggered automation and trigger it from the page (snippet below).
+- **Common actions** like sending email, Slack messages, SMS, or HTTP calls are first-class Automation nodes. \`SEND_EMAIL\` and \`HTTP\` need no integration; \`SLACK_SEND_MESSAGE\` and \`TWILIO_SEND_SMS\` require their respective integration to be configured. Build the automation, deploy it, and start it from the page with \`env.ATxxx.start(inputs)\` (snippet below) \u2014 never hand-build its webhook URL.
 - **Custom server logic** belongs in a Function. Call it from the page via \`callFunction('FN123', { body: {...} })\` or \`env.FN123.call({ body: {...} })\`. A Function that ships its own router serves many routes \u2014 reach one with \`path\`: \`env.FN123.call({ method: 'GET', path: '/features/123' })\`. Omit \`path\` for the base path; the method defaults to POST either way.
 - **Action runners** (\`env.ACTIONS.run\`) are server-only \u2014 not available on a page. To run an action runner action from a page, put the \`env.ACTIONS.run(...)\` call in a Function and invoke that Function from the page.
 - **Email** (\`env.EMAIL.send\`) is server-only for the same reason. Put the \`env.EMAIL.send(...)\` call in a Function and invoke that Function from the page.
 - **Integrations** are credentials/config consumed *by* automation nodes or functions \u2014 they are not available directly in the page context. Only reach for an Integration when the work requires authenticated access to a specific third-party service.
 
 \`\`\`typescript
-// Trigger a webhook-triggered automation from a page. The full webhook URL
-// is shown in the automation editor \u2014 webhook automations are unauthenticated,
-// so the URL itself is the credential.
-const response = await fetch(
-  'https://api.overai.com/v1/automation/webhook/ORG123/AT123',
-  {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ recipient: 'user@example.com' }),
-  },
-);
-const { automationRunId } = await response.json();
+// Start a deployed automation. inputs maps onto its event node's declared
+// outputs; for a file-upload trigger, upload first and pass the url.
+const { automationRunId } = await env.AT123.start({ recipient: 'user@example.com' });
 
 // To use an integration's credentials, call a Function that reads the integration config server-side.
 const config = await callFunction('FN123', { body: { integrationId: 'IN123' } });
@@ -66300,17 +66850,13 @@ Page settings (\`authorizationMode\`, \`noSandbox\`, \`hideTopBar\`, \`runtime\`
 
 \`runtime: "v2"\` serves the page from its own origin instead of the sandboxed srcdoc iframe: separate renderer process, real localStorage/sessionStorage and cookies with no noSandbox flag needed. It is versioned like every other setting \u2014 save and deploy to publish. Public (/public/:id) links always use v1 regardless of the toggle. Only v2 reaches browser devices: Web Serial, WebUSB and WebHID always work there; camera, microphone, geolocation, display-capture, fullscreen and screen-wake-lock work once listed in \`permissions\`.
 
-**\`dataSourceUrl\` and \`filter\` are legacy.** They populate the \`data\` and \`items\` globals, frozen at render start; \`filter\` reads the old item/attribute model, which builders can no longer create or manage. For new pages use \`env\` instead \u2014 \`env.TBSxxx.sql\` for tabular data, \`env.DFxxx\` for data files. That path can depend on search params, re-query on demand, and report its own errors. Don't rewrite a working page just to migrate it.
-
-\`dataSourceUrl\` is fetched **verbatim** and its response becomes the \`data\` global. It is a plain static URL, not a template:
+### Legacy data sources: \`dataSourceUrl\`, \`filter\`, \`data\`, \`items\`
 
-- It does **not** substitute search params. Neither \`{x}\` nor Liquid \`{{ x }}\` is interpolated \u2014 the URL is fetched exactly as written. (\`filter\` does support Liquid; \`dataSourceUrl\` does not.)
-- If your data depends on a search param or anything else known only at render time, don't use \`dataSourceUrl\` \u2014 fetch it in the page with \`useEffect\` + \`env\`/\`fetch\`, which is the normal path anyway.
-- To clear it, pass JSON \`null\`. The string \`"null"\` is a four-character URL, not an empty value, and it fails at fetch time.
+These populate the \`data\`/\`items\` globals once, at render start, from the old item/attribute model that builders can no longer create. New pages use \`env\` (\`env.TBSxxx.sql\`, \`env.DFxxx\`), which can depend on search params, re-query on demand and report its own errors. Don't rewrite a working page just to migrate it. If you must touch them:
 
-\`filter\`, unlike \`dataSourceUrl\`, **does** evaluate Liquid \u2014 in every string value it holds, against \`now\` (a Date rounded down to the minute, so it doesn't move mid-session) plus every search param by name. Use \`{{ now | minus: 1209600000 | toISOString }}\` for a relative date, \`{{ since }}\` for \`?since=\`. A template that won't evaluate, or that evaluates to nothing because its variable isn't on the URL, fails the whole page rather than quietly querying on an empty value.
-
-A templated filter is **not** an access boundary. On a public or portal page the visitor supplies the search params, so \`{"orgUnit": {"_eq": "{{ tenant }}"}}\` reads like tenant scoping but is editable from the URL bar. Scope with the workspace's own access, not with a filter.
+- \`dataSourceUrl\` is fetched verbatim \u2014 no \`{x}\` or Liquid interpolation. Anything that depends on a search param belongs in a page-side fetch instead. Clear it with JSON \`null\`; the string \`"null"\` is a four-character URL.
+- \`filter\` evaluates Liquid in every string value against \`now\` (rounded to the minute) and each search param by name, e.g. \`{{ now | minus: 1209600000 | toISOString }}\` or \`{{ since }}\`. A template whose variable is missing from the URL fails the whole page rather than querying on an empty value.
+- A templated filter is **not** an access boundary: on a public or portal page the visitor controls the search params, so \`{{ tenant }}\` scoping is editable from the URL bar. Scope with the workspace's own access.
 
 ## Critical Rules
 
@@ -66323,13 +66869,13 @@ A templated filter is **not** an access boundary. On a public or portal page the
    | \`useSessionStorageState(key, init)\` | Single-tab session state (wizard progress, scroll restoration) | Reload (same tab); cleared on tab close | **Requires \`noSandbox: true\`** |
    | \`useState\` | Truly ephemeral UI (hover, animation step, in-flight form field before submit) | Nothing | Lost on every navigation |
 
-   When the page uses \`useLocalStorageState\` or \`useSessionStorageState\`, set \`noSandbox: true\` in the page config first \u2014 the hooks throw a clear error otherwise.
+   When the page uses \`useLocalStorageState\` or \`useSessionStorageState\` on the default v1 runtime, set \`noSandbox: true\` in the page config first \u2014 the hooks throw a clear error otherwise. A \`runtime: "v2"\` page needs no flag.
 
 2. **DO NOT import React or hooks.** React, useState, useEffect, useRef, useMemo, useCallback, and useReducer are all globally available. Importing them will cause errors.
 3. **The main component MUST be named \`App\` and MUST NOT be exported.** Write \`function App() { ... }\` \u2014 no \`export\`.
 4. **Use Tailwind CSS for styling.** It's built in.
 5. **Import external libraries from esm.sh.** Example: \`import confetti from "https://esm.sh/canvas-confetti@1.9.3"\`. Imports must be absolute https URLs \u2014 the sandbox cannot resolve bare or relative specifiers.
-6. **Sandbox restrictions.** The page runs in a sandboxed iframe (allow-scripts only). Raw \`localStorage\`, \`sessionStorage\`, cookies, alert/confirm/prompt, and form submissions are blocked. Use \`useLocalStorageState\` / \`useSessionStorageState\` for storage (both require disabling the sandbox \u2014 see Rule 1). Set \`noSandbox: true\` in the page config to disable the sandbox when any of these are needed.
+6. **Sandbox restrictions (v1 runtime).** By default the page runs in a sandboxed iframe (allow-scripts only). Raw \`localStorage\`, \`sessionStorage\`, cookies, alert/confirm/prompt, and form submissions are blocked. Use \`useLocalStorageState\` / \`useSessionStorageState\` for storage (both require disabling the sandbox \u2014 see Rule 1). Set \`noSandbox: true\` to lift the sandbox, or \`runtime: "v2"\` (see Web Page Configuration) when the page also needs its own origin or browser devices.
 7. **Read code before editing.** Reading a large page's config returns its outline instead of the code \u2014 then read only the blocks or line ranges you are about to change. Edits return the changed lines, numbered, so don't re-read to verify. Prefer small, targeted edits \u2014 insert or search-replace \u2014 over rewriting a whole block.
 8. **Decompose large pages.** When a page exceeds ~200 lines, break it into multiple top-level function components (e.g., \`function DataTable() { ... }\` used inside \`function App() { ... }\`), so each can be read and edited on its own.
 9. **Add TSDoc comments to every top-level declaration.** Write a \`/** brief description */\` comment above each function, component, and constant. Code outlines show these comments, giving structural context without reading the full code. Always add or update these when creating or modifying a block.
@@ -66340,6 +66886,46 @@ A templated filter is **not** an access boundary. On a public or portal page the
 12. **Sanity-check chart math with console.log.** You cannot see the rendered output. When building or debugging visualizations, log intermediate values (scales, domains, ranges, computed positions, angles) and verify they make sense before saving. For example: \`console.log("gauge", { min, max, value, fraction, startAngle, endAngle, valueAngle })\`. Remove logs once the chart is working.
 13. **Rebuild imported HTML natively \u2014 never embed it.** When the user brings HTML from somewhere else (an exported dashboard, a design mockup, a page from another tool), recreate it as a native page: an \`App\` component, Tailwind, d3 for charts. Pay close attention to preserving the original styling \u2014 colors, spacing, type scale, layout. Do NOT load a foreign HTML file into a \`srcDoc\` iframe or inject it into the DOM. Embedded HTML is opaque to code outlines and reachable only by blind string patches that silently do nothing when the source drifts \u2014 so every later request turns into guesswork. Port it once and every edit after that is a normal edit. (A Liquid printable page is the exception: Liquid is HTML templating, so imported markup becomes the template body directly.)
 
+## Best Practices
+
+**Decide the page's purpose first, then design for it.** A page answers one question; several questions become tabs or separate pages. Most pages are one of three kinds, and each wants a different shape:
+
+- **Single-flow page** \u2014 one task, start to finish (submit a request, review an item, check in). Keep it simple: one column, one primary action per screen, generous spacing. Think consumer app, not admin panel.
+- **KPI dashboard** \u2014 a few measures that matter, seen from several angles (trend, breakdown, against target). Users don't want to read a number, they want to feel it: a dense, color-accented table or a chart built for the specific question beats a row of big-number tiles. Add headline tiles only when asked.
+- **Command center** \u2014 operators who live in the page and need to act fast. Information density is the point: compact rows, inline status, filters and actions within reach, no decorative whitespace.
+
+Name the kind to the user when you propose a design; if the request mixes kinds, split it rather than compromising all three.
+
+**Build a clear hierarchy.** Size is only one tool. Group related elements and separate unrelated ones with spacing, borders or dividers; order sections by importance, with the thing the user came for first; distinguish primary actions from secondary ones; mute labels and metadata so values stand out. The visible structure should mirror the data model underneath, so relationships between concepts are obvious. A reader should see what matters before reading a word.
+
+**Spend pixels on data, not decoration.** Don't repeat a label on every row or card when a column header or section title carries it. Use color sparingly and for meaning: if problems are red, tune the thresholds so only real problems are, or the signal is lost. No emojis. Add a tooltip where a value's origin or calculation isn't obvious. Disable a control the user can't use right now instead of hiding it, so the page teaches what it can do.
+
+**Choose the layout deliberately.**
+
+- A scrolling document, or a command center where panels scroll independently inside a fixed viewport? For the latter, use CSS grid over flex, fill the viewport, and don't cap the page with a top-level max-width.
+- Tables for rows the user compares; cards or grids for non-uniform items. Size each column for its content and decide which wrap and which truncate.
+- Drill in with a drawer when the surrounding context should stay visible, a large modal when the user needs focus. Make the background inert while a modal is open.
+- Decide whether the page must work on a small screen; not every page does, but check the ones that will be opened on a phone.
+- Style for both themes: the page root carries a \`dark\` class, so pair every surface and border with a \`dark:\` variant (see \`useTheme\` above).
+
+**Represent data accurately.** A page that looks right but misreports the data is worse than one that shows an error. Common failures:
+
+- **A query \`LIMIT\` is not a count.** Loading \`LIMIT 1000\` and labeling it "1000 items" misreports every larger table. Run a separate \`count(*)\` for totals, and label a truncated list as such ("Showing 1,000 of 14,212").
+- **Offer "Load more" when there is more.** Prefer a subtle "Load more" control over numbered pagination; either way the user must be able to reach every row.
+- **Dates are not timestamps \u2014 check the time zone before you format.** A \`date\` column (a calendar day, no time) arrives from \`env.TBSxxx.sql\` as a JS \`Date\` at 00:00 UTC, so \`toLocaleDateString()\` in any zone west of UTC shows the previous day. Format a day from its UTC fields (\`d.toISOString().slice(0, 10)\` or \`Intl.DateTimeFormat(undefined, { timeZone: "UTC", dateStyle: "medium" })\`), and never pass it through local-time math. A \`timestamptz\` is a real instant: format it in the viewer's zone and show the zone (\`timeZoneName: "short"\`) when readers may be in different places. A \`timestamp\` without zone is ambiguous \u2014 ask which zone it was written in rather than guessing. Function responses carry dates as ISO strings; the same rules apply after \`new Date(iso)\`. Day-boundary filters (\`today\`, \`this week\`) must be computed in the business's zone, in SQL via \`AT TIME ZONE\`, not in the browser's. Tell the user which columns are days and which are instants, and label the zone in the UI.
+- **Never fall back to a value that hides a data problem.** \`?? 0\`, \`?? "N/A"\`, \`?? []\` make a broken query or a missing column look like a legitimate result. Show an explicit empty or error state, and when a value is unexpectedly null, surface it (a dash, an "unknown" badge) rather than inventing a default.
+
+**Embed PDFs with \`<object>\` on a v2 page.** When \`runtime: "v2"\`, render a PDF with \`<object data={url} type="application/pdf" />\` rather than an \`<iframe>\`.
+
+**Link stored files through the app host.** Storage URLs are persisted as \`https://api.<host>/v1/storage/...\`, where the browser holds no session. Before rendering one as a link, embed or download, rewrite it to the app origin's proxy, \`https://app.<host>/api/v1/storage/...\`:
+
+\`\`\`typescript
+const browserStorageUrl = (url: string) =>
+  url.replace(/^https:\\/\\/api\\.([^/]+)\\/v1\\/storage\\//, "https://app.$1/api/v1/storage/");
+\`\`\`
+
+The edge also redirects a credential-less api.* read there, so an unrewritten link degrades to an extra hop rather than failing. The proxy authenticates with the signed-in session cookie, so it works for workspace members only. On a public page the visitor has no session: use \`presignFile\` for links there. Page code calling \`fetchFile\`, \`env.STORAGE.fetch\` or \`presignFile\` is unaffected either way \u2014 those carry their own credentials.
+
 ## Known-Good Libraries
 
 These libraries are tested and work from \`https://esm.sh/...\`. Do NOT import React \u2014 it's already global.
@@ -66349,10 +66935,15 @@ These libraries are tested and work from \`https://esm.sh/...\`. Do NOT import R
 - **date-fns** \u2014 \`import { format, parseISO } from "https://esm.sh/date-fns@4"\` \u2014 Date formatting and manipulation.
 - **papaparse** \u2014 \`import Papa from "https://esm.sh/papaparse@5"\` \u2014 CSV parsing.
 
-### Do NOT use these libraries (broken ESM imports):
+### Do NOT use libraries that depend on React
+
+An esm.sh build of a React library imports its own React (\`import "/react@>=16.8"\`), a second copy beside the page's global one, so every hook inside it fails with "Invalid hook call". The page has no import map to redirect that specifier, so there is no workaround. This rules out, among others:
+
 - **react-resize-detector** \u2014 Use a \`ResizeObserver\` hook instead (see pattern below).
 - **@tanstack/react-table** \u2014 Build tables with plain \`<table>\` + Tailwind + \`useState\` for sorting/filtering/pagination.
-- **recharts, visx** \u2014 Use d3 directly instead.
+- **recharts, visx, and any other React chart or component kit** \u2014 Use d3 directly instead.
+
+React-free libraries (d3, date-fns, papaparse) import fine.
 
 ### Responsive chart pattern
 
@@ -66683,38 +67274,17 @@ var runReview = async () => {
     process.stdout.write("Nothing modified locally \u2014 nothing to review.\n");
     return;
   }
+  const client = cliClient();
   for (const target of lintTargets) {
     try {
-      const response = await v2Fetch("/v2/architect/lint", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          code: target.code,
-          surface: target.surface,
-          workspaceId: manifest.workspaceId,
-          functionOutputSchema: target.functionOutputSchema
-        })
+      const response = await client.lint({
+        code: target.code,
+        surface: target.surface,
+        workspaceId: manifest.workspaceId,
+        functionOutputSchema: target.functionOutputSchema
       });
-      const responseText = await response.text();
-      if (!response.ok) {
-        throw new Error(
-          `${target.label}: HTTP ${String(response.status)}${responseText ? ` \u2014 ${responseText}` : ""}`
-        );
-      }
-      const parsed = lintResponseSchema.safeParse(
-        (() => {
-          try {
-            return JSON.parse(responseText);
-          } catch {
-            return null;
-          }
-        })()
-      );
-      if (!parsed.success) {
-        throw new Error(`${target.label}: invalid response from lint service`);
-      }
       findings2.push(
-        ...parsed.data.diagnostics.map(
+        ...response.diagnostics.map(
           (diagnostic) => `${target.label}:${String(diagnostic.line)}:${String(diagnostic.column)}: ${diagnostic.severity}: ${diagnostic.message}${diagnostic.ruleId == null ? "" : ` (${diagnostic.ruleId})`}`
         )
       );
@@ -66749,23 +67319,6 @@ var runReview = async () => {
 import { createInterface as createInterface3 } from "readline";
 
 // src/commands/sqlCredential.ts
-var connectionString = async (tableSpaceId, secret) => {
-  const response = await v2Fetch("/v2/cluster-info");
-  const body = await response.json();
-  return `postgresql://overai:${encodeURIComponent(secret)}@${body.postgres.host}:${String(body.postgres.port)}/${tableSpaceId}?sslmode=${body.postgres.sslMode}${body.postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
-};
-var credentialTableSpaceId = async (credentialId) => {
-  const data = await gqlRequest(
-    `query TableSpaceCredential($id: String!) {
-      tableSpaceCredential(id: $id) { tableSpaceId }
-    }`,
-    { id: credentialId }
-  );
-  if (!data.tableSpaceCredential) {
-    throw new Error("Credential not found or you lack access to it");
-  }
-  return data.tableSpaceCredential.tableSpaceId;
-};
 var runSqlCredential = async (args) => {
   const [action, id] = args;
   if (!action || !id) {
@@ -66785,67 +67338,31 @@ var runSqlCredential = async (args) => {
     if (!args.includes("--never") && (!Number.isInteger(days) || days < 1)) {
       throw new Error("--expires-in must be a positive whole number of days");
     }
-    const data = await gqlRequest(
-      `mutation CreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
-        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
-      }`,
-      {
-        tableSpaceId,
-        name: name2,
-        validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5).toISOString()
-      }
-    );
-    const result = data.createTableSpaceCredential?.result;
-    if (!result) throw new Error("The server did not return a credential");
-    process.stdout.write(
-      `${await connectionString(tableSpaceId, result.secret)}
-`
-    );
+    const credential = await cliClient().tableSpace(tableSpaceId).credentials.create({
+      name: name2,
+      validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5)
+    });
+    process.stdout.write(`${credential.connectionString}
+`);
     return;
   }
   if (action === "list") {
     const tableSpaceId = id;
-    const data = await gqlRequest(
-      `query TableSpaceCredentials($tableSpaceId: String!) {
-        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
-          nodes { id name validUntil lastUsedAt createdAt }
-        }
-      }`,
-      { tableSpaceId }
-    );
     printResult(
-      data.tableSpaceCredentials?.nodes ?? [],
+      await cliClient().tableSpace(tableSpaceId).credentials.list(),
       resolveFormat(flagValue(args, "-o", "--output"))
     );
     return;
   }
   if (action === "rotate") {
-    const credentialId = id;
-    const tableSpaceId = await credentialTableSpaceId(credentialId);
-    const data = await gqlRequest(
-      `mutation RotateTableSpaceCredential($credentialId: String!) {
-        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
-      }`,
-      { credentialId }
-    );
-    const secret = data.rotateTableSpaceCredential?.result;
-    if (!secret) throw new Error("The server did not return a credential");
-    process.stdout.write(`${await connectionString(tableSpaceId, secret)}
+    const { connectionString: connectionString2 } = await cliClient().tableSpaceCredential(id).rotate();
+    process.stdout.write(`${connectionString2}
 `);
     return;
   }
   if (action === "revoke") {
-    const credentialId = id;
-    await credentialTableSpaceId(credentialId);
-    await gqlRequest(
-      `mutation RevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
-        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
-          tableSpaceCredential { id }
-        }
-      }`,
-      { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
-    );
-    process.stdout.write(`${credentialId} revoked
+    await cliClient().tableSpaceCredential(id).revoke();
+    process.stdout.write(`${id} revoked
 `);
     return;
   }
@@ -66853,32 +67370,12 @@ var runSqlCredential = async (args) => {
 };
 
 // src/commands/sql.ts
-var runQuery = async (organizationId, tableSpaceId, query, params) => {
-  const res = await v2Fetch(
-    `/v2/table-spaces/${organizationId}/${tableSpaceId}/run`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(
-        params == null ? { query, ignoreCamelCase: true } : { unsafe: { query, params } }
-      )
-    }
-  );
-  const raw2 = await res.text();
-  const body = (() => {
-    try {
-      return JSON.parse(raw2);
-    } catch {
-      return null;
-    }
-  })();
-  if (!res.ok || body?.ok === false) throw v2Error("sql", res, raw2);
-  return {
-    rows: body?.rows ?? [],
-    rowCount: body?.rowCount ?? 0,
-    resultSetCount: body?.resultSetCount ?? 1,
-    durationMs: body?.durationMs ?? 0
-  };
+var runQuery = async (tableSpaceId, query, params) => {
+  try {
+    return await cliClient().tableSpace(tableSpaceId).sql(query, { params });
+  } catch (error62) {
+    throw withOrgHint(error62);
+  }
 };
 var summarize = (result) => `(${String(result.rowCount)} row${result.rowCount === 1 ? "" : "s"}, ${String(result.durationMs)}ms)`;
 var REPL_HELP = `  \\dt              list tables
@@ -66888,7 +67385,7 @@ var REPL_HELP = `  \\dt              list tables
 Statements run when a line ends with ";". Each statement runs in its own
 transaction \u2014 BEGIN/SET/temp tables don't carry across statements.
 `;
-var runRepl = async (organizationId, tableSpaceId, format2) => {
+var runRepl = async (tableSpaceId, format2) => {
   const interactive = process.stdin.isTTY;
   const rl = createInterface3({
     input: process.stdin,
@@ -66904,7 +67401,7 @@ var runRepl = async (organizationId, tableSpaceId, format2) => {
   };
   const execute = async (sql, params) => {
     try {
-      const result = await runQuery(organizationId, tableSpaceId, sql, params);
+      const result = await runQuery(tableSpaceId, sql, params);
       if (result.rows.length > 0) {
         process.stdout.write(`${formatResult(result.rows, format2)}
 `);
@@ -67008,7 +67505,7 @@ var runSql = async (args) => {
     );
   }
   const format2 = resolveFormat(flagValue(args, "-o", "--output"));
-  const { organizationId } = await getAccessToken();
+  await cliClient().organizationId();
   const query = (() => {
     const rest = args.slice(1);
     for (let i = 0; i < rest.length; i++) {
@@ -67021,9 +67518,8 @@ var runSql = async (args) => {
     }
     return void 0;
   })();
-  if (query == null) return runRepl(organizationId, tableSpaceId, format2);
+  if (query == null) return runRepl(tableSpaceId, format2);
   const result = await runQuery(
-    organizationId,
     tableSpaceId,
     await readValue(query, "the query") ?? query
   );
@@ -67035,35 +67531,22 @@ var runSql = async (args) => {
 };
 
 // src/commands/storage.ts
-import { openAsBlob, writeFileSync as writeFileSync5 } from "fs";
+import { openAsBlob as openAsBlob3, writeFileSync as writeFileSync5 } from "fs";
 var USAGE4 = "Usage: overai storage upload <path> [--no-random-prefix] | storage download <key> [path|-] | storage exists <key> | storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]";
 var runStorage = async (args) => {
   const [operation, first2, second] = args;
   if (operation == null) throw new Error(USAGE4);
-  const { organizationId } = await getAccessToken();
-  const segment = (key) => encodeURIComponent(key);
+  const storage = cliClient().storage;
   if (operation === "upload") {
     if (first2 == null || first2 === "-") {
-      throw new Error("Upload requires a file path (stdin uploads need a filename to build the key).");
-    }
-    const randomPrefix = !args.includes("--no-random-prefix");
-    const query = randomPrefix ? "" : "?disableRandomPrefix=true";
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/stream${query}`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/octet-stream",
-          "x-file-name": first2.split("/").pop() ?? first2
-        },
-        body: await openAsBlob(first2)
-      }
-    );
-    if (!response.ok) {
-      throw v2Error("storage upload", response, await response.text());
+      throw new Error(
+        "Upload requires a file path (stdin uploads need a filename to build the key)."
+      );
     }
-    const { path } = await response.json();
-    const key = path.startsWith(`${organizationId}/`) ? path.slice(organizationId.length + 1) : path;
+    const { key, path } = await storage.upload(await openAsBlob3(first2), {
+      name: first2.split("/").pop() ?? first2,
+      randomPrefix: !args.includes("--no-random-prefix")
+    });
     const format2 = resolveFormat(flagValue(args, "-o", "--output"));
     if (format2 === "json") printResult({ key, path }, format2);
     else process.stdout.write(`${key}
@@ -67072,59 +67555,38 @@ var runStorage = async (args) => {
   }
   if (first2 == null) throw new Error(USAGE4);
   if (operation === "download") {
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}`,
-      { redirect: "follow" }
-    );
-    if (!response.ok) {
-      throw v2Error("storage download", response, await response.text());
-    }
+    const response = await storage.download(first2);
     const bytes = Buffer.from(await response.arrayBuffer());
     if (second != null && second !== "-") writeFileSync5(second, bytes);
     else process.stdout.write(bytes);
     return;
   }
   if (operation === "exists") {
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}/exists`
-    );
-    if (response.status === 404) {
+    const meta3 = await storage.exists(first2);
+    if (meta3 == null) {
       if (resolveFormat(flagValue(args, "-o", "--output")) === "json") {
         printResult({ exists: false }, "json");
       }
       process.exitCode = 1;
       return;
     }
-    if (!response.ok) {
-      throw v2Error("storage exists", response, await response.text());
-    }
     printResult(
-      { exists: true, ...await response.json() },
+      { exists: true, ...meta3 },
       resolveFormat(flagValue(args, "-o", "--output"))
     );
     return;
   }
   if (operation === "head") {
-    const lines = flagValue(args, "--lines") ?? "50";
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}/head?numLines=${encodeURIComponent(lines)}`
+    process.stdout.write(
+      await storage.head(first2, { lines: integerFlag(args, "--lines", 50) })
     );
-    if (!response.ok) {
-      throw v2Error("storage head", response, await response.text());
-    }
-    process.stdout.write(await response.text());
     return;
   }
   if (operation === "presign") {
-    const expiresIn2 = flagValue(args, "--expires-in") ?? String(60 * 60 * 24 * 7);
-    const response = await v2Fetch(
-      `/v2/storage/${organizationId}/${segment(first2)}/presign?expiresIn=${encodeURIComponent(expiresIn2)}`
+    process.stdout.write(
+      `${await storage.presign(first2, { expiresIn: integerFlag(args, "--expires-in", 60 * 60 * 24 * 7) })}
+`
     );
-    if (!response.ok) {
-      throw v2Error("storage presign", response, await response.text());
-    }
-    process.stdout.write(`${(await response.text()).trim()}
-`);
     return;
   }
   throw new Error(USAGE4);
@@ -67136,7 +67598,7 @@ var workspaceIdFrom = (args) => args.find(
 ) ?? openClone().manifest.workspaceId;
 var listWorkspaces = async (args) => {
   const archived = args.includes("--archived");
-  const limit2 = Number(flagValue(args, "--limit") ?? 200);
+  const limit2 = integerFlag(args, "--limit", 200);
   printResult(
     (await cliClient().workspaces.list({
       first: limit2,
@@ -67312,7 +67774,8 @@ Usage:
   overai sql credential rotate|revoke <credentialId>
 
 Workspace sync (edit resources as local files):
-  overai clone <workspaceId> [dir]     Clone workspace and accessible descendants
+  overai clone <workspaceId> [dir]     Clone workspace and accessible descendants;
+                                       .overai/ holds sync state, ignored by git
   overai status [--recursive]          Local edits + remote drift
   overai diff [filter] [--from <ref>] [--to <ref>] [--recursive]
                                        Diff versions (refs: N, base, local, deployed, latest;