@overaihq/cli 0.14.14 → 0.15.0

package/dist/index.js

@@ -38209,7 +38209,7 @@ var agentToolRequestSchema = external_exports.object({
   path: external_exports.string().prefault("/").transform((p) => p.startsWith("/") ? p : `/${p}`),
   headers: external_exports.record(external_exports.string(), external_exports.string()).prefault({}),
   queryParams: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).prefault({}),
-  body: external_exports.unknown()
+  body: external_exports.unknown().optional()
 });
 var agentToolRequestJsonSchemaSchema = external_exports.object({
   type: external_exports.literal("object"),
@@ -43967,6 +43967,10 @@ var consoleLogsPayloadSchema = external_exports.object({
 var runtimeErrorPayloadSchema = external_exports.object({
   error: external_exports.string().nullable()
 });
+var hostShortcutPayloadSchema = external_exports.enum([
+  "commandPalette",
+  "architect"
+]);
 var pageInteractionPayloadSchema = external_exports.object({
   clicks: external_exports.number().int().min(0),
   keypresses: external_exports.number().int().min(0)
@@ -45112,6 +45116,8 @@ var NodeEnum = /* @__PURE__ */ ((NodeEnum2) => {
   NodeEnum2["readFoldersFromLocalFolder"] = "READ_FOLDERS_FROM_LOCAL_FOLDER";
   NodeEnum2["redisAction"] = "REDIS_ACTION";
   NodeEnum2["renameLocalFile"] = "RENAME_LOCAL_FILE";
+  NodeEnum2["ringcentralAction"] = "RINGCENTRAL_ACTION";
+  NodeEnum2["ringcentralQuery"] = "RINGCENTRAL_QUERY";
   NodeEnum2["runContainerScript"] = "RUN_CONTAINER_SCRIPT";
   NodeEnum2["runFunction"] = "RUN_FUNCTION";
   NodeEnum2["runTableSpaceQuery"] = "RUN_TABLE_SPACE_QUERY";
@@ -45319,7 +45325,7 @@ var automationNodeSchema = external_exports.lazy(
 var automationNodesSchema = external_exports.array(automationNodeSchema);
 var iterationStateSchema = external_exports.object({
   iteration: external_exports.number().int(),
-  iteratee: external_exports.any(),
+  iteratee: external_exports.any().nonoptional(),
   state: external_exports.lazy(() => automationStateSchema),
   /**
    * Set when a completed iteration's `state` is compacted to `{}` to keep the
@@ -60689,6 +60695,58 @@ var printablePageRender = (client, id) => ({
   }
 });
 
+// ../sdk/src/references.ts
+var referencesSchema = external_exports.object({
+  inbound: external_exports.array(
+    external_exports.object({
+      resourceId: external_exports.string(),
+      referencerId: external_exports.string(),
+      referencerKind: external_exports.string(),
+      referencerName: external_exports.string(),
+      referencerWorkspaceId: external_exports.string()
+    })
+  ),
+  outbound: external_exports.array(
+    external_exports.object({
+      resourceId: external_exports.string(),
+      targetId: external_exports.string(),
+      targetKind: external_exports.string(),
+      targetName: external_exports.string(),
+      targetWorkspaceId: external_exports.string()
+    })
+  )
+});
+var resourceReferences = async (client, resourceIds, options) => resourceIds.length === 0 ? { inbound: [], outbound: [] } : referencesSchema.parse(
+  await client.trpc("getResourceReferences", {
+    resourceIds,
+    referencerWorkspaceIds: options?.referencerWorkspaceIds
+  })
+);
+var agentToolReachSchema = external_exports.array(
+  external_exports.object({
+    agentId: external_exports.string(),
+    agentName: external_exports.string(),
+    agentWorkspaceId: external_exports.string(),
+    tools: external_exports.array(
+      external_exports.object({
+        kind: external_exports.string(),
+        id: external_exports.string(),
+        name: external_exports.string(),
+        accessMode: external_exports.string().nullable(),
+        isReachable: external_exports.boolean(),
+        isReachableFromTarget: external_exports.boolean().nullable()
+      })
+    ),
+    hiddenCount: external_exports.number(),
+    hiddenUnreachableCount: external_exports.number(),
+    hiddenLostAtTargetCount: external_exports.number(),
+    canShareIntoTarget: external_exports.boolean()
+  })
+);
+var agentToolReach = async (client, agentIds, targetWorkspaceId) => agentToolReachSchema.parse(
+  await client.trpc("getAgentToolReach", { agentIds, targetWorkspaceId })
+);
+
 // ../sdk/src/report.ts
 var report = async (client, kind, details, options) => {
   await client.trpc("architectIssues.report", {
@@ -60773,6 +60831,7 @@ var ID_PREFIXES = {
   knowledge_base: { prefix: "kb", body: 10 },
   knowledge_base_chunk: { prefix: "kbc", body: 20 },
   knowledge_base_document: { prefix: "kbd", body: 20 },
+  library: { prefix: "lib", body: 10 },
   mailbox: { prefix: "mbx", body: 10 },
   mailbox_address: { prefix: "mba", body: 10 },
   mailbox_message: { prefix: "mbm", body: 10 },
@@ -60852,6 +60911,153 @@ var idTableByPrefix = (id) => {
   return best?.table ?? null;
 };
 
+// ../sdk/src/resourceGroups.ts
+var memberKind = (table) => table.replace(/_(\w)/g, (_, letter) => letter.toUpperCase());
+var resolveMember = async (client, resourceId) => {
+  const row = await client.resource(resourceId).show();
+  const table = idTableByPrefix(row.id);
+  if (table == null) throw new Error(`Unsupported resource id: ${resourceId}`);
+  return {
+    member: { resourceKind: memberKind(table), resourceId: row.id },
+    workspaceId: row.workspaceId
+  };
+};
+var membershipOf = async (client, member) => {
+  const data = await client.graphql(
+    `query SdkResourceGroupMembership($resourceKind: String!, $resourceId: String!) {
+      resourceGroupMembers(condition: { resourceKind: $resourceKind, resourceId: $resourceId }) {
+        nodes { groupId group { name } }
+      }
+    }`,
+    { ...member }
+  );
+  const row = data.resourceGroupMembers?.nodes[0];
+  return row == null ? null : { ...member, groupId: row.groupId, groupName: row.group?.name ?? null };
+};
+var removeMembership = async (client, member) => {
+  const membership = await membershipOf(client, member);
+  if (membership == null) return null;
+  await client.graphql(
+    `mutation SdkRemoveResourceGroupMember($resourceKind: String!, $resourceId: String!) {
+      deleteResourceGroupMember(input: { resourceKind: $resourceKind, resourceId: $resourceId }) {
+        deletedResourceGroupMemberNodeId
+      }
+    }`,
+    { ...member }
+  );
+  return membership;
+};
+var removeResourceFromGroup = async (client, storedId) => {
+  const table = idTableByPrefix(storedId);
+  return table == null ? null : removeMembership(client, {
+    resourceKind: memberKind(table),
+    resourceId: storedId
+  });
+};
+var resourceGroupCollection = (client) => ({
+  list: async (options) => {
+    const data = await client.graphql(
+      `query SdkResourceGroups($condition: ResourceGroupCondition) {
+        resourceGroups(condition: $condition) {
+          nodes {
+            id name workspaceId
+            resourceGroupMembersByGroupId { nodes { resourceKind resourceId } }
+          }
+        }
+      }`,
+      {
+        condition: options?.workspaceId == null ? null : { workspaceId: options.workspaceId }
+      }
+    );
+    return (data.resourceGroups?.nodes ?? []).map((group) => ({
+      id: group.id,
+      name: group.name,
+      workspaceId: group.workspaceId,
+      members: group.resourceGroupMembersByGroupId.nodes
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  },
+  create: async (input2) => {
+    const data = await client.graphql(
+      `mutation SdkCreateResourceGroup($workspaceId: String!, $name: String!) {
+        createResourceGroup(input: { resourceGroup: { workspaceId: $workspaceId, name: $name } }) {
+          resourceGroup { id }
+        }
+      }`,
+      input2
+    );
+    const id = data.createResourceGroup?.resourceGroup?.id;
+    if (id == null) throw new Error("createResourceGroup returned no group.");
+    return { id };
+  },
+  membershipOf: async (resourceId) => membershipOf(client, (await resolveMember(client, resourceId)).member),
+  removeMember: async (resourceId) => removeMembership(client, (await resolveMember(client, resourceId)).member)
+});
+var resourceGroupResource = (client, id) => ({
+  id,
+  rename: async (name2) => {
+    const data = await client.graphql(
+      `mutation SdkRenameResourceGroup($id: String!, $name: String!) {
+        updateResourceGroup(input: { id: $id, patch: { name: $name } }) { resourceGroup { id } }
+      }`,
+      { id, name: name2 }
+    );
+    if (data.updateResourceGroup?.resourceGroup == null) {
+      throw new Error(`Resource group ${id} was not renamed.`);
+    }
+  },
+  delete: async () => {
+    await client.graphql(
+      `mutation SdkDeleteResourceGroup($id: String!) {
+        deleteResourceGroup(input: { id: $id }) { deletedResourceGroupNodeId }
+      }`,
+      { id }
+    );
+  },
+  add: async (resourceIds) => {
+    const data = await client.graphql(
+      `query SdkResourceGroupWorkspace($id: String!) {
+        resourceGroup(id: $id) { workspaceId }
+      }`,
+      { id }
+    );
+    const groupWorkspaceId = data.resourceGroup?.workspaceId;
+    if (groupWorkspaceId == null) {
+      throw new Error(
+        `Resource group ${id} not found (or not editable by you).`
+      );
+    }
+    const resolved = await Promise.all(
+      resourceIds.map(async (resourceId) => ({
+        resourceId,
+        ...await resolveMember(client, resourceId)
+      }))
+    );
+    const misplaced = resolved.filter(
+      (entry) => entry.workspaceId !== groupWorkspaceId
+    );
+    if (misplaced.length > 0) {
+      throw new Error(
+        `${misplaced.map(
+          (entry) => `${entry.resourceId} is in workspace ${String(entry.workspaceId)}`
+        ).join("; ")}, but group ${id} is in ${groupWorkspaceId}. Move ${misplaced.length === 1 ? "it" : "them"} to that workspace first.`
+      );
+    }
+    const previous = [];
+    for (const { member } of resolved) {
+      previous.push(await removeMembership(client, member));
+      await client.graphql(
+        `mutation SdkAddResourceGroupMember($member: ResourceGroupMemberInput!) {
+          createResourceGroupMember(input: { resourceGroupMember: $member }) {
+            resourceGroupMember { groupId }
+          }
+        }`,
+        { member: { groupId: id, ...member } }
+      );
+    }
+    return previous;
+  }
+});
+
 // ../sdk/src/resourceShow.ts
 var resourceTables = {
   workspace: {
@@ -61015,7 +61221,33 @@ var genericResource = (client, id) => {
         throw new Error(`No supported changes supplied for ${id}.`);
       }
       return show(current.id);
-    }
+    },
+    move: async (workspaceId) => {
+      const resource = resourceTableFor(id);
+      if (resource === resourceTables.workspace) {
+        throw new Error(
+          `${id} is a workspace; reparent it instead of moving it.`
+        );
+      }
+      const current = await show(id);
+      const result = await client.graphql(
+        `mutation SdkMoveResource($id: String!, $workspaceId: String!) {
+          ${resource.mutation}(input: { id: $id, patch: { workspaceId: $workspaceId } }) {
+            updated: ${resource.result} { id workspaceId }
+          }
+        }`,
+        { id: current.id, workspaceId }
+      );
+      const updated = result[resource.mutation]?.updated;
+      if (updated == null) {
+        throw new Error(
+          `Resource ${id} was not moved; check that you can edit both workspaces.`
+        );
+      }
+      const leftGroup = await removeResourceFromGroup(client, current.id);
+      return { ...updated, leftGroup };
+    },
+    references: () => resourceReferences(client, [id])
   };
 };
 
@@ -61318,9 +61550,137 @@ var tableSpaceCredentialResource = (client, credentialId) => {
 var exchangeSchema = external_exports.object({ token: external_exports.string(), expiresIn: external_exports.number() });
 var staticToken = (jwt2) => () => jwt2;
 
+// ../sdk/src/paginate.ts
+var paginate = async (client, query, field, variables = {}) => {
+  const nodes = [];
+  let after = null;
+  do {
+    const data = await client.graphql(
+      query,
+      { ...variables, after }
+    );
+    const connection = data[field];
+    if (connection == null) return nodes;
+    nodes.push(...connection.nodes);
+    const page = connection.pageInfo;
+    if (page.hasNextPage && (page.endCursor == null || page.endCursor === after))
+      throw new Error(`${field} pagination did not advance.`);
+    after = page.hasNextPage ? page.endCursor : null;
+  } while (after != null);
+  return nodes;
+};
+
 // ../sdk/src/workspaces.ts
+var SHARE_KINDS = [
+  "table_space",
+  "function",
+  "agent",
+  "integration",
+  "action_runner"
+];
+var SHARE_FIELDS = "id fromWorkspaceId toWorkspaceId resourceKind resourceId fromWorkspace { name } toWorkspace { name }";
+var shareFromRow = (row) => ({
+  id: row.id,
+  fromWorkspaceId: row.fromWorkspaceId,
+  fromWorkspaceName: row.fromWorkspace?.name ?? null,
+  toWorkspaceId: row.toWorkspaceId,
+  toWorkspaceName: row.toWorkspace?.name ?? null,
+  resourceKind: row.resourceKind,
+  resourceId: row.resourceId
+});
+var storedShareEnds = async (client, from, to) => {
+  const data = await client.graphql(
+    `query SdkShareWorkspaceIds($from: String!, $to: String!) {
+      from: workspaces(condition: { idIgnoringCase: $from }, includeArchived: YES, first: 1) { nodes { id } }
+      to: workspaces(condition: { idIgnoringCase: $to }, includeArchived: YES, first: 1) { nodes { id } }
+    }`,
+    { from, to }
+  );
+  const stored = {
+    from: data.from?.nodes[0]?.id,
+    to: data.to?.nodes[0]?.id
+  };
+  if (stored.from == null) {
+    throw new Error(`Workspace ${from} not found (or not visible to you).`);
+  }
+  if (stored.to == null) {
+    throw new Error(`Workspace ${to} not found (or not visible to you).`);
+  }
+  return { from: stored.from, to: stored.to };
+};
+var workspaceTree = async (client, includeArchived) => {
+  const [workspaces, edges, roles] = await Promise.all([
+    paginate(
+      client,
+      `query SdkWorkspaceTreeNodes($after: Cursor, $includeArchived: IncludeArchivedOption!) {
+        workspaces(first: 100, after: $after, includeArchived: $includeArchived) {
+          nodes { id name isArchived }
+          pageInfo { hasNextPage endCursor }
+        }
+      }`,
+      "workspaces",
+      { includeArchived: includeArchived ? "YES" : "NO" }
+    ),
+    paginate(
+      client,
+      `query SdkWorkspaceTreeEdges($after: Cursor) {
+        workspaceWorkspaces(first: 100, after: $after) {
+          nodes { workspaceId parentWorkspaceId }
+          pageInfo { hasNextPage endCursor }
+        }
+      }`,
+      "workspaceWorkspaces"
+    ),
+    client.graphql(
+      `query SdkWorkspaceTreeRoles { myWorkspaceRoles { nodes { workspaceId role } } }`
+    )
+  ]);
+  const role = new Map(
+    roles.myWorkspaceRoles.nodes.map((r) => [r.workspaceId, r.role])
+  );
+  const parentOf = new Map(
+    edges.map((e) => [e.workspaceId, e.parentWorkspaceId])
+  );
+  const nodes = new Map(
+    workspaces.map((w) => [
+      w.id,
+      {
+        id: w.id,
+        name: w.name,
+        isArchived: w.isArchived,
+        role: role.get(w.id) ?? null,
+        parentWorkspaceId: null,
+        children: []
+      }
+    ])
+  );
+  const roots = [...nodes.values()].filter((node2) => {
+    const parent = nodes.get(parentOf.get(node2.id) ?? "");
+    if (parent == null) return true;
+    node2.parentWorkspaceId = parent.id;
+    parent.children.push(node2);
+    return false;
+  });
+  const sort2 = (list) => {
+    list.sort((a, b) => a.name.localeCompare(b.name));
+    list.forEach((node2) => sort2(node2.children));
+    return list;
+  };
+  return sort2(roots);
+};
 var workspaceCollection = (client) => ({
   create: (input2) => createWorkspace(client, input2),
+  tree: (options) => workspaceTree(client, options?.includeArchived === true),
+  shares: async () => (await paginate(
+    client,
+    `query SdkAllWorkspaceShares($after: Cursor) {
+          workspaceResourceShares(first: 100, after: $after) {
+            nodes { ${SHARE_FIELDS} }
+            pageInfo { hasNextPage endCursor }
+          }
+        }`,
+    "workspaceResourceShares"
+  )).map(shareFromRow),
   list: async (options) => {
     const data = await client.graphql(
       `query SdkWorkspaceList($first: Int!, $includeArchived: IncludeArchivedOption!) {
@@ -61394,6 +61754,109 @@ var workspaceResource = (client, id) => ({
         }
       ]
     );
+  },
+  tree: async (options) => {
+    const find2 = (list) => list.map(
+      (node3) => node3.id.toLowerCase() === id.toLowerCase() ? node3 : find2(node3.children)
+    ).find((node3) => node3 != null);
+    const node2 = find2(
+      await workspaceTree(client, options?.includeArchived === true)
+    );
+    if (node2 == null) {
+      throw new Error(`Workspace ${id} not found (or not visible to you).`);
+    }
+    return node2;
+  },
+  setParent: async (parentWorkspaceId) => {
+    const data = await client.graphql(
+      `mutation SdkSetWorkspaceParent($workspaceId: String!, $parentWorkspaceId: String!) {
+        setWorkspaceParent(input: { workspaceId: $workspaceId, parentWorkspaceId: $parentWorkspaceId }) {
+          workspaceWorkspace { workspaceId }
+        }
+      }`,
+      { workspaceId: id, parentWorkspaceId }
+    );
+    if (data.setWorkspaceParent?.workspaceWorkspace == null) {
+      throw new Error(
+        `Workspace ${id} was not moved; check that you manage both workspaces.`
+      );
+    }
+  },
+  moveToRoot: async () => {
+    const data = await client.graphql(
+      `mutation SdkMoveWorkspaceToRoot($workspaceId: String!) {
+        deleteWorkspaceWorkspaceByWorkspaceId(input: { workspaceId: $workspaceId }) {
+          workspaceWorkspace { workspaceId }
+        }
+      }`,
+      { workspaceId: id }
+    );
+    return data.deleteWorkspaceWorkspaceByWorkspaceId?.workspaceWorkspace != null;
+  },
+  shares: async () => {
+    const data = await client.graphql(
+      `query SdkWorkspaceShares($id: String!) {
+        from: workspaceResourceShares(condition: { fromWorkspaceId: $id }) { nodes { ${SHARE_FIELDS} } }
+        to: workspaceResourceShares(condition: { toWorkspaceId: $id }) { nodes { ${SHARE_FIELDS} } }
+      }`,
+      { id }
+    );
+    return [...data.from?.nodes ?? [], ...data.to?.nodes ?? []].map(
+      shareFromRow
+    );
+  },
+  share: async (input2) => {
+    if (!SHARE_KINDS.includes(input2.kind)) {
+      throw new Error(
+        `Unknown share kind "${input2.kind}". Use one of: ${SHARE_KINDS.join(", ")}.`
+      );
+    }
+    const ends = await storedShareEnds(client, id, input2.toWorkspaceId);
+    const data = await client.graphql(
+      `mutation SdkCreateWorkspaceShare($share: WorkspaceResourceShareInput!) {
+        createWorkspaceResourceShare(input: { workspaceResourceShare: $share }) {
+          workspaceResourceShare { id }
+        }
+      }`,
+      {
+        share: {
+          fromWorkspaceId: ends.from,
+          toWorkspaceId: ends.to,
+          resourceKind: input2.kind,
+          resourceId: input2.resourceId ?? null
+        }
+      }
+    );
+    const shareId = data.createWorkspaceResourceShare?.workspaceResourceShare?.id;
+    if (shareId == null)
+      throw new Error("createWorkspaceResourceShare returned no share.");
+    return { id: shareId };
+  },
+  unshare: async (input2) => {
+    const ends = await storedShareEnds(client, id, input2.toWorkspaceId);
+    const data = await client.graphql(
+      `query SdkFindWorkspaceShare($from: String!, $to: String!, $kind: String!) {
+        workspaceResourceShares(condition: { fromWorkspaceId: $from, toWorkspaceId: $to, resourceKind: $kind }) {
+          nodes { ${SHARE_FIELDS} }
+        }
+      }`,
+      { from: ends.from, to: ends.to, kind: input2.kind }
+    );
+    const resourceId = input2.resourceId?.toLowerCase() ?? null;
+    const row = data.workspaceResourceShares?.nodes.find(
+      (share) => (share.resourceId?.toLowerCase() ?? null) === resourceId
+    );
+    if (row == null) {
+      throw new Error(
+        `No ${input2.resourceId == null ? `whole-kind ${input2.kind}` : `${input2.kind} ${input2.resourceId}`} share from ${ends.from} to ${ends.to}.`
+      );
+    }
+    await client.graphql(
+      `mutation SdkDeleteWorkspaceShare($id: String!) {
+        deleteWorkspaceResourceShare(input: { id: $id }) { deletedWorkspaceResourceShareNodeId }
+      }`,
+      { id: row.id }
+    );
   }
 });
 
@@ -61512,6 +61975,7 @@ var OverAIClient = class {
   };
   workspaces = workspaceCollection(this);
   runners = runnerCollection(this);
+  resourceGroups = resourceGroupCollection(this);
   storage = storageApi(this);
   /** Its `deploy` checks deployed callers first; see `FunctionResource`. */
   fn(id) {
@@ -61581,6 +62045,20 @@ var OverAIClient = class {
   resource(id) {
     return genericResource(this, id);
   }
+  resourceGroup(id) {
+    return resourceGroupResource(this, id);
+  }
+  /**
+   * References to and from many resources at once (at most 200 ids).
+   * `referencerWorkspaceIds` limits inbound referencers to those workspaces.
+   */
+  resourceReferences(resourceIds, options) {
+    return resourceReferences(this, resourceIds, options);
+  }
+  /** Whether each agent's deployed tools resolve from its workspace and from `targetWorkspaceId`. */
+  agentToolReach(agentIds, targetWorkspaceId) {
+    return agentToolReach(this, agentIds, targetWorkspaceId);
+  }
   /** Claims of the JWT most recently obtained from the token source, or null before any request. Display only. */
   claims() {
     return this.#claims;
@@ -61899,6 +62377,9 @@ var unknownFlags = (args, known, valueFlags = []) => {
   }
   return out;
 };
+var positionals = (args, valueFlags) => args.filter(
+  (arg, index) => !arg.startsWith("-") && !valueFlags.includes(args[index - 1] ?? "")
+);
 var flagValue = (args, ...names) => {
   for (const name2 of names) {
     const i = args.indexOf(name2);
@@ -63203,7 +63684,7 @@ ${lines.join("\n")}
 var runRestore = (args) => {
   const { root, manifest } = openClone();
   const all = args.includes("--all");
-  const filter2 = positionals(args)[0];
+  const filter2 = positionals2(args)[0];
   if (filter2 == null && !all) {
     throw new Error(
       "Usage: overai restore <filter> (resource id, name, or path substring), or --all to discard every local edit."
@@ -63306,7 +63787,7 @@ var runPull = async (clone2) => {
 var resourcesMatching = (manifest, filter2) => Object.entries(manifest.resources).filter(
   ([id, resource]) => filter2 == null || id === filter2 || resource.name.toLowerCase().includes(filter2.toLowerCase()) || resource.files.some((f) => f.includes(filter2))
 );
-var positionals = (args) => {
+var positionals2 = (args) => {
   const valueFlags = /* @__PURE__ */ new Set(["-m", "--message", "-o", "--output"]);
   const out = [];
   for (let i = 0; i < args.length; i++) {
@@ -63348,7 +63829,7 @@ var runPush = async (args, clone2) => {
   const deploy = args.includes("--deploy");
   const force = args.includes("--force");
   const allowBreaking = args.includes("--allow-breaking");
-  const pathFilter = positionals(args)[0];
+  const pathFilter = positionals2(args)[0];
   let pushed = 0;
   for (const [id, resource] of resourcesMatching(manifest, pathFilter)) {
     const { state, changedFiles } = localState(root, resource);
@@ -63431,7 +63912,7 @@ var runPush = async (args, clone2) => {
 };
 var runDeploy = async (args) => {
   const { root, manifest } = openClone();
-  const pathFilter = positionals(args)[0];
+  const pathFilter = positionals2(args)[0];
   const allowBreaking = args.includes("--allow-breaking");
   const pending = resourcesMatching(manifest, pathFilter).filter(
     ([, r]) => r.deployedVersion !== r.baseVersion
@@ -64697,12 +65178,478 @@ var runReport = async (args) => {
   );
 };
 
+// src/commands/move.ts
+var printReport = (args, report2) => {
+  if (flagValue(args, "-o", "--output") === "json") {
+    printResult(report2, "json");
+    return;
+  }
+  process.stdout.write(
+    [
+      ...report2.plan,
+      "",
+      ...report2.warnings.length === 0 ? ["No warnings."] : report2.warnings.map(
+        (line, index) => index === 0 ? line : `  ${line}`
+      ),
+      "",
+      report2.dryRun ? "Dry run: nothing changed." : ""
+    ].join("\n").trimEnd() + "\n"
+  );
+};
+var workspacesById = (forest) => {
+  const byId = /* @__PURE__ */ new Map();
+  const visit2 = (node2) => {
+    byId.set(node2.id.toLowerCase(), node2);
+    node2.children.forEach(visit2);
+  };
+  forest.forEach(visit2);
+  return byId;
+};
+var subtreeIds = (node2) => [
+  node2.id,
+  ...node2.children.flatMap(subtreeIds)
+];
+var userLabel = (user) => user.email ?? user.name ?? user.id;
+var ROLE_ORDER = ["manager", "editor", "viewer", "end_user"];
+var roleRank = (role) => {
+  const rank = role == null ? -1 : ROLE_ORDER.indexOf(role);
+  return rank === -1 ? ROLE_ORDER.length : rank;
+};
+var strongerRole = (a, b) => roleRank(a) <= roleRank(b) ? a : b;
+var reaches = (shares, from, to, kind, resourceId) => {
+  const target = to.toLowerCase();
+  const seen = /* @__PURE__ */ new Set([from.toLowerCase()]);
+  const queue = [from.toLowerCase()];
+  for (let at = queue.shift(); at != null; at = queue.shift()) {
+    if (at === target) return true;
+    shares.filter(
+      (share) => share.fromWorkspaceId.toLowerCase() === at && share.resourceKind === kind && (share.resourceId == null || share.resourceId.toLowerCase() === resourceId.toLowerCase())
+    ).forEach((share) => {
+      const next = share.toWorkspaceId.toLowerCase();
+      if (!seen.has(next)) {
+        seen.add(next);
+        queue.push(next);
+      }
+    });
+  }
+  return false;
+};
+var rowName = (row) => {
+  if (typeof row.name === "string") return row.name;
+  const identity = row.identity;
+  return typeof identity?.name === "string" ? identity.name : row.id;
+};
+var accessibleViews = {
+  function: {
+    collection: "workspaceAccessibleFunctions",
+    idField: "functionId",
+    relation: "function"
+  },
+  table_space: {
+    collection: "workspaceAccessibleTableSpaces",
+    idField: "tableSpaceId",
+    relation: "tableSpace"
+  },
+  agent: {
+    collection: "workspaceAccessibleAgents",
+    idField: "agentId",
+    relation: "agent"
+  },
+  integration: {
+    collection: "workspaceAccessibleIntegrations",
+    idField: "integrationId",
+    relation: "integration"
+  },
+  action_runner: {
+    collection: "workspaceAccessibleActionRunners",
+    idField: "actionRunnerId",
+    relation: "actionRunner"
+  }
+};
+var SHARED_RESOURCE_CAP = 200;
+var sharedResources = async (client, share) => {
+  if (share.resourceId != null) {
+    const row = await client.resource(share.resourceId).show().catch(() => null);
+    return {
+      resources: [
+        {
+          id: share.resourceId,
+          name: row == null ? share.resourceId : rowName(row)
+        }
+      ],
+      total: 1
+    };
+  }
+  const kind = SHARE_KINDS.find((known) => known === share.resourceKind);
+  if (kind == null) return { resources: [], total: 0 };
+  const view = accessibleViews[kind];
+  const data = await client.graphql(
+    `query CliSharedKindResources($workspaceId: String!, $first: Int!) {
+      ${view.collection}(condition: { workspaceId: $workspaceId }, first: $first) {
+        totalCount
+        nodes { ${view.idField} ${view.relation} { ${resourceTables[kind].fields} } }
+      }
+    }`,
+    { workspaceId: share.fromWorkspaceId, first: SHARED_RESOURCE_CAP }
+  );
+  const connection = data[view.collection];
+  return {
+    resources: (connection?.nodes ?? []).map((node2) => {
+      const id = String(node2[view.idField]);
+      const row = node2[view.relation];
+      return { id, name: row == null ? id : rowName(row) };
+    }),
+    total: connection?.totalCount ?? 0
+  };
+};
+var moveWorkspace = async (args) => {
+  const [workspaceId] = positionals(args, ["--to", "-o", "--output"]);
+  const to = flagValue(args, "--to");
+  if (workspaceId == null || to == null) {
+    throw new Error(
+      "Usage: overai workspace move <workspaceId> --to <parentWorkspaceId|root> [--dry-run]"
+    );
+  }
+  const dryRun = args.includes("--dry-run");
+  const client = cliClient();
+  const [forest, allShares] = await Promise.all([
+    client.workspaces.tree({ includeArchived: true }),
+    client.workspaces.shares()
+  ]);
+  const byId = workspacesById(forest);
+  const label = (id) => {
+    if (id == null) return "the top level";
+    const node2 = byId.get(id.toLowerCase());
+    return node2 == null ? id : `"${node2.name}" (${node2.id})`;
+  };
+  const moved = byId.get(workspaceId.toLowerCase());
+  if (moved == null) {
+    throw new Error(
+      `Workspace ${workspaceId} not found (or not visible to you).`
+    );
+  }
+  const newParent = to === "root" ? null : byId.get(to.toLowerCase());
+  if (newParent === void 0) {
+    throw new Error(`Workspace ${to} not found (or not visible to you).`);
+  }
+  const oldParentId = moved.parentWorkspaceId;
+  if (oldParentId != null && oldParentId.toLowerCase() === newParent?.id.toLowerCase()) {
+    (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(
+      `${label(moved.id)} is already under ${label(oldParentId)}; nothing to move.
+`
+    );
+    return;
+  }
+  const subtreeStoredIds = subtreeIds(moved);
+  const subtree = new Set(subtreeStoredIds.map((id) => id.toLowerCase()));
+  const deletedShares = oldParentId == null ? [] : allShares.filter(
+    (share) => share.fromWorkspaceId.toLowerCase() === oldParentId.toLowerCase() && share.toWorkspaceId.toLowerCase() === moved.id.toLowerCase()
+  );
+  const [movedUsers, parentUsers, shared] = await Promise.all([
+    client.workspace(moved.id).users(),
+    newParent == null ? [] : client.workspace(newParent.id).users(),
+    Promise.all(
+      deletedShares.map(async (share) => ({
+        share,
+        ...await sharedResources(client, share)
+      }))
+    )
+  ]);
+  const plan = [
+    `Moving workspace ${label(moved.id)} from ${oldParentId == null ? "the top level (or a parent you cannot see)" : label(oldParentId)} to ${label(newParent?.id ?? null)}.`,
+    oldParentId == null ? "Shares from a parent you cannot see cannot be listed; the database deletes them with the move." : deletedShares.length === 0 ? `No shares from ${label(oldParentId)} into it to delete.` : `Will delete ${String(deletedShares.length)} share${deletedShares.length === 1 ? "" : "s"} from ${label(oldParentId)} into it: ${shared.map(
+      ({ share, resources }) => share.resourceId == null ? `all ${share.resourceKind}` : `${share.resourceKind} "${resources[0]?.name ?? share.resourceId}" (${share.resourceId})`
+    ).join("; ")}.`
+  ];
+  const warnings = [];
+  if (newParent != null && subtree.has(newParent.id.toLowerCase())) {
+    warnings.push(
+      `${label(newParent.id)} is inside ${label(moved.id)}; the database will refuse this move.`
+    );
+  }
+  const movedById = new Map(movedUsers.map((user) => [user.id, user]));
+  const parentById = new Map(parentUsers.map((user) => [user.id, user]));
+  const access = [
+    ...movedUsers,
+    ...parentUsers.filter((user) => !movedById.has(user.id))
+  ].flatMap((user) => {
+    const before = movedById.get(user.id)?.role ?? null;
+    const after = strongerRole(
+      movedById.get(user.id)?.directRole ?? null,
+      parentById.get(user.id)?.role ?? null
+    );
+    if (before === after) return [];
+    if (after == null)
+      return [`${userLabel(user)} loses ${before ?? "access"}`];
+    if (before == null) return [`${userLabel(user)} gains ${after}`];
+    return roleRank(after) > roleRank(before) ? [`${userLabel(user)} drops to ${after} from ${before}`] : [`${userLabel(user)} rises to ${after} from ${before}`];
+  });
+  if (access.length > 0) {
+    warnings.push(
+      `Access on ${label(moved.id)} (from its direct and inherited roles; descendants with their own grants may differ):`,
+      ...access.map((line) => `  ${line}`)
+    );
+  }
+  const sharedIds = shared.flatMap(
+    ({ share, resources }) => resources.map((resource) => ({ ...resource, kind: share.resourceKind }))
+  );
+  const sharedTotal = shared.reduce((sum2, { total }) => sum2 + total, 0);
+  const references = await client.resourceReferences(
+    sharedIds.slice(0, SHARED_RESOURCE_CAP).map((resource) => resource.id),
+    { referencerWorkspaceIds: subtreeStoredIds.slice(0, 500) }
+  ).catch((error62) => {
+    warnings.push(
+      `Could not check references: ${error62 instanceof Error ? error62.message : String(error62)}`
+    );
+    return null;
+  });
+  const sharedById = new Map(
+    sharedIds.map((resource) => [resource.id.toLowerCase(), resource])
+  );
+  const brokenReferences = (references?.inbound ?? []).flatMap((ref) => {
+    const resource = sharedById.get(ref.resourceId.toLowerCase());
+    return resource != null && subtree.has(ref.referencerWorkspaceId.toLowerCase()) ? [
+      `${ref.referencerKind} "${ref.referencerName}" (${ref.referencerId}) in ${label(ref.referencerWorkspaceId)} references ${resource.kind} "${resource.name}" (${resource.id}), shared by a share this move deletes`
+    ] : [];
+  });
+  if (brokenReferences.length > 0) {
+    warnings.push(
+      "May stop resolving (deployed content found by id; another share path may still reach it):",
+      ...brokenReferences.map((line) => `  ${line}`)
+    );
+  }
+  if (sharedTotal > SHARED_RESOURCE_CAP) {
+    warnings.push(
+      `Checked references for the first ${String(SHARED_RESOURCE_CAP)} of ${String(sharedTotal)} shared resources.`
+    );
+  }
+  printReport(args, {
+    plan,
+    warnings: warnings.length === 0 ? [] : ["WARN", ...warnings],
+    dryRun
+  });
+  if (dryRun) return;
+  const didMove = newParent == null ? await client.workspace(moved.id).moveToRoot() : await client.workspace(moved.id).setParent(newParent.id).then(() => true);
+  (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(
+    didMove ? `Moved ${label(moved.id)}.
+` : `${label(moved.id)} was already at the top level, or its parent is not visible to you; nothing changed.
+`
+  );
+};
+var moveResource = async (args) => {
+  const [id] = positionals(args, ["--to", "-o", "--output"]);
+  const to = flagValue(args, "--to");
+  if (id == null || to == null) {
+    throw new Error(
+      "Usage: overai resource move <id> --to <workspaceId> [--dry-run]"
+    );
+  }
+  const dryRun = args.includes("--dry-run");
+  const client = cliClient();
+  const row = await client.resource(id).show();
+  const kind = idTableByPrefix(row.id);
+  const fromId = typeof row.workspaceId === "string" ? row.workspaceId : null;
+  if (kind == null || kind === "workspace" || fromId == null) {
+    throw new Error(
+      `${id} cannot be moved; use overai workspace move for a workspace.`
+    );
+  }
+  const [forest, allShares, membership] = await Promise.all([
+    client.workspaces.tree({ includeArchived: true }),
+    client.workspaces.shares(),
+    client.resourceGroups.membershipOf(row.id)
+  ]);
+  const byId = workspacesById(forest);
+  const label = (workspaceId) => {
+    const node2 = byId.get(workspaceId.toLowerCase());
+    return node2 == null ? workspaceId : `"${node2.name}" (${node2.id})`;
+  };
+  const destination = byId.get(to.toLowerCase());
+  if (destination == null) {
+    throw new Error(`Workspace ${to} not found (or not visible to you).`);
+  }
+  const subject = `${kind} "${rowName(row)}" (${row.id})`;
+  if (destination.id.toLowerCase() === fromId.toLowerCase()) {
+    (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(`${subject} is already in ${label(fromId)}; nothing to move.
+`);
+    return;
+  }
+  const ownShares = allShares.filter(
+    (share) => share.resourceKind === kind && share.resourceId?.toLowerCase() === row.id.toLowerCase()
+  );
+  const plan = [
+    `Moving ${subject} from ${label(fromId)} to ${label(destination.id)}.`,
+    membership == null ? "It is in no resource group." : `Will remove it from group "${membership.groupName ?? membership.groupId}" (${membership.groupId}); a group holds only its own workspace's resources.`,
+    ownShares.length === 0 ? "No shares name it." : `Will delete ${String(ownShares.length)} share${ownShares.length === 1 ? "" : "s"} naming it: ${ownShares.map(
+      (share) => `${label(share.fromWorkspaceId)} \u2192 ${label(share.toWorkspaceId)}`
+    ).join("; ")}.`
+  ];
+  const warnings = [];
+  const failed = (what) => (error62) => {
+    warnings.push(
+      `Could not check ${what}: ${error62 instanceof Error ? error62.message : String(error62)}`
+    );
+    return null;
+  };
+  const [references, reach] = await Promise.all([
+    client.resource(row.id).references().catch(failed("references")),
+    kind === "agent" ? client.agentToolReach([row.id], destination.id).catch(failed("agent tool reach")) : null
+  ]);
+  const sharesAfter = allShares.filter((share) => !ownShares.includes(share));
+  const lostReach = [
+    ...(references?.inbound ?? []).flatMap(
+      (ref) => reaches(allShares, fromId, ref.referencerWorkspaceId, kind, row.id) && !reaches(
+        sharesAfter,
+        destination.id,
+        ref.referencerWorkspaceId,
+        kind,
+        row.id
+      ) ? [
+        `${ref.referencerKind} "${ref.referencerName}" (${ref.referencerId}) in ${label(ref.referencerWorkspaceId)} will no longer reach ${subject}`
+      ] : []
+    ),
+    ...(references?.outbound ?? []).flatMap(
+      (ref) => reaches(
+        allShares,
+        ref.targetWorkspaceId,
+        fromId,
+        ref.targetKind,
+        ref.targetId
+      ) && !reaches(
+        allShares,
+        ref.targetWorkspaceId,
+        destination.id,
+        ref.targetKind,
+        ref.targetId
+      ) ? [
+        `${subject} will no longer reach ${ref.targetKind} "${ref.targetName}" (${ref.targetId}) in ${label(ref.targetWorkspaceId)}`
+      ] : []
+    )
+  ];
+  if (lostReach.length > 0) {
+    warnings.push(
+      "References by id in deployed content (heuristic: same workspace, or a chain of shares of that kind):",
+      ...lostReach.map((line) => `  ${line}`)
+    );
+  }
+  const tools2 = (reach ?? []).flatMap((agent) => [
+    ...agent.tools.filter(
+      (tool) => tool.isReachable && tool.isReachableFromTarget === false
+    ).map(
+      (tool) => `${subject} will lose tool ${tool.kind} "${tool.name}" (${tool.id})`
+    ),
+    ...agent.hiddenLostAtTargetCount > 0 ? [
+      `${subject} will lose ${String(agent.hiddenLostAtTargetCount)} tool${agent.hiddenLostAtTargetCount === 1 ? "" : "s"} you cannot see`
+    ] : []
+  ]);
+  if (tools2.length > 0) {
+    warnings.push(
+      "Agent tools (from the server):",
+      ...tools2.map((line) => `  ${line}`)
+    );
+  }
+  printReport(args, {
+    plan,
+    warnings: warnings.length === 0 ? [] : ["WARN", ...warnings],
+    dryRun
+  });
+  if (dryRun) return;
+  const result = await client.resource(row.id).move(destination.id);
+  (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(
+    `Moved ${subject} to ${label(result.workspaceId)}${result.leftGroup == null ? "" : `; it left group "${result.leftGroup.groupName ?? result.leftGroup.groupId}"`}.
+`
+  );
+};
+
 // src/commands/resource.ts
+var GROUP_USAGE = `Usage:
+  overai resource group list [--workspace <id>]
+  overai resource group create --workspace <id> --name <name>
+  overai resource group rename <groupId> --name <name>
+  overai resource group delete <groupId>
+  overai resource group add <groupId> <resourceId>...
+  overai resource group remove <resourceId>...
+`;
+var runGroup = async (args) => {
+  const [operation, ...rest] = args;
+  const ids = positionals(rest, ["--workspace", "--name", "-o", "--output"]);
+  const name2 = flagValue(rest, "--name");
+  const client = cliClient();
+  if (operation === "list") {
+    const workspaceId = flagValue(rest, "--workspace");
+    printResult(
+      (await client.resourceGroups.list({ workspaceId })).map((group) => ({
+        id: group.id,
+        name: group.name,
+        workspaceId: group.workspaceId,
+        resources: group.members.map((member) => member.resourceId).join(" ")
+      })),
+      resolveFormat(flagValue(rest, "-o", "--output"))
+    );
+    return;
+  }
+  if (operation === "create" && name2 != null) {
+    const workspaceId = flagValue(rest, "--workspace") ?? openClone().manifest.workspaceId;
+    const { id } = await client.resourceGroups.create({ workspaceId, name: name2 });
+    process.stdout.write(
+      `Created group "${name2}" (${id}) in ${workspaceId}.
+`
+    );
+    return;
+  }
+  const [groupId, ...resourceIds] = ids;
+  if (operation === "rename" && groupId != null && name2 != null) {
+    await client.resourceGroup(groupId).rename(name2);
+    process.stdout.write(`Renamed group ${groupId} to "${name2}".
+`);
+    return;
+  }
+  if (operation === "delete" && groupId != null) {
+    await client.resourceGroup(groupId).delete();
+    process.stdout.write(
+      `Deleted group ${groupId}; its resources stay in the workspace.
+`
+    );
+    return;
+  }
+  if (operation === "add" && groupId != null && resourceIds.length > 0) {
+    const previous = await client.resourceGroup(groupId).add(resourceIds);
+    resourceIds.forEach((resourceId, index) => {
+      const from = previous[index];
+      process.stdout.write(
+        `Added ${resourceId} to group ${groupId}${from == null || from.groupId === groupId ? "" : ` (left group "${from.groupName ?? from.groupId}")`}.
+`
+      );
+    });
+    return;
+  }
+  if (operation === "remove" && ids.length > 0) {
+    for (const resourceId of ids) {
+      const membership = await client.resourceGroups.removeMember(resourceId);
+      process.stdout.write(
+        membership == null ? `${resourceId} is in no group.
+` : `Removed ${resourceId} from group "${membership.groupName ?? membership.groupId}".
+`
+      );
+    }
+    return;
+  }
+  throw new Error(GROUP_USAGE.trimEnd());
+};
 var runResource = async (args) => {
   const [operation, id] = args;
+  if (operation === "move") {
+    await moveResource(args.slice(1));
+    return;
+  }
+  if (operation === "group") {
+    await runGroup(args.slice(1));
+    return;
+  }
   if (operation !== "show" && operation !== "update" || id == null) {
     throw new Error(
-      "Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]"
+      `Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive] | resource move <id> --to <workspaceId> [--dry-run]
+${GROUP_USAGE}`
     );
   }
   const resource = resourceTableFor(id);
@@ -65132,7 +66079,7 @@ When a parent executes, it resolves to one of these handles. Child nodes only be
 To run an event node, call \`runAutomationNode\` with a \`eventPayload\` object whose fields match the event node's declared outputs:
 
 - **TIMER**: \`{ firedAt: "<ISO8601>", scheduledAt: "<ISO8601>" }\` \u2014 use current time for both when testing ad-hoc
-- **WEBHOOK**: \`{ payload: "<JSON string>", queryParams: {}, method: "POST", headers: { "Content-Type": "application/json" }, firedAt: "<ISO8601>" }\`
+- **WEBHOOK**: \`{ payload: { ... }, queryParams: {}, firedAt: "<ISO8601>" }\` \u2014 \`payload\` is the parsed request body (a JSON object, not a JSON string), matching a live run; use a raw string only to simulate an XML body
 - **EMAIL_RECEIVED**: \`{ from: "<email>", subject?: "<string>", text?: "<string>", html?: "<string>", headers?: {}, attachments?: [], firedAt: "<ISO8601>" }\`
 - **FILE_UPLOAD**: You **cannot** provide a file URL programmatically. Tell the user: "Please click the debug run button on the file upload event node and select a file. Once you've done that, I'll continue." Then wait for them to confirm before proceeding.
 
@@ -65730,6 +66677,45 @@ A function can email recipients when it breaks: the handler throws, times out, o
 `
 };
 
+// ../common/src/architectDocs/libraries.ts
+var librariesDoc = {
+  id: "libraries",
+  summary: "Libraries: reusable components and functions that v2 pages import as overai:<libraryId>, with a Preview export, versions and sharing.",
+  body: `
+## Libraries
+
+A Library is a workspace resource holding one TypeScript/TSX module. Pages on the v2 runtime import its named exports:
+
+\`\`\`tsx
+import { StatusBadge, formatMoney } from "overai:libxxxxxxxxxx";
+import { StatusBadge } from "overai:libxxxxxxxxxx@12"; // pinned to version 12
+\`\`\`
+
+An unpinned import gets the library's deployed version. Lint flags an import of a library this workspace can't import, an archived library, or a pin to a version that doesn't exist; such an import leaves the page showing "Couldn't load the page's imports". A page can load at most 50 libraries, counting the libraries they import. Deploying a new version reaches open pages through their "new version available" refresh prompt. Library ids are lowercase; write them that way in imports. Only v2 pages can import libraries.
+
+## Writing a library
+
+- Export what pages need by name. A default export is not importable.
+- \`Preview\` is reserved: export a component named \`Preview\` and it renders in the library's editor. Show each state and a usage example there. Pages never load it, so it costs them nothing.
+- A library is a real module, so import what it uses: \`import { useState } from "react";\`. The page globals (hooks, \`env\`, SDK helpers) are not in scope.
+- Imports may be \`react\`, \`react/jsx-runtime\`, \`react-dom\`, \`react-dom/client\`, \`superjson\`, \`@zumer/snapdom\`, other libraries (\`overai:<libraryId>\`) and https URLs (esm.sh). Anything else fails the build.
+- Take data as props and leave fetching to the page. The preview runs with no page data, and a component that fetches for itself is harder to reuse.
+- A build error is served as a module that throws it, so it appears in the console of any page importing the library.
+- To reuse a component a page already has, create a library, move the component into it with a \`Preview\`, deploy it, then replace the page's copy with an import.
+- A version that does not build is never deployed, by a save or by Deploy; fix the reported error and save again.
+
+## Versions and sharing
+
+Saving creates a version and Deploy points pages at it. A library's own \`overai:\` imports also resolve to deployed versions, so an unsaved or undeployed change in one library never reaches a deployed page through another.
+
+In the page editor's preview, the page's own library imports update on every edit, but the libraries those import keep the versions loaded when the preview opened. Reload the preview to pick up a newer deploy.
+
+A library is shared into child workspaces like a function. Builders there read its source and preview but cannot edit it. A shared library brings its own imports along: pages in the child load whatever the library imports from its owning workspace, without that being shared too. To import one of those directly, share it. Library code is visible to anyone who can import it: keep secrets in a function, never in a library.
+
+Archiving a library stops every deployed page and library that imports it from loading. \`setResourceArchived\` refuses at first and returns those importers; name them to the user, and call again with \`archiveDespiteImporters: true\` only if they still want it archived. Moving a library to another workspace warns the user about the same importers, since pages load a library only from the workspace that owns it or one it is shared into.
+`
+};
+
 // ../common/src/architectDocs/liquidTemplates.ts
 var liquidTemplatesDoc = {
   id: "liquidTemplates",
@@ -66335,6 +67321,10 @@ var webPagesDoc = {
   body: `
 Saves reject a stale editing base without discarding your draft. Incorporate the latest saved changes before retrying; never retry with a newer base unless those changes have been reconciled. A save conflict does not deploy anything.
 
+## Platform shortcuts
+
+In React pages (v1 and v2), Cmd/Ctrl+K toggles the command palette and Cmd/Ctrl+I toggles the Architect when the host provides them, including while typing in inputs. These combinations are reserved for OverAI; use other keys for page actions. Other keys stay inside the page. Pressing inside a page dismisses outside host dropdowns without cancelling the page interaction. Nested third-party iframes do not forward these events.
+
 ## Available Global Variables and Hooks
 
 \`\`\`typescript
@@ -66600,7 +67590,7 @@ These populate the \`data\`/\`items\` globals once, at render start, from the ol
 2. **DO NOT import React or hooks.** React, useState, useEffect, useRef, useMemo, useCallback, and useReducer are all globally available. Importing them will cause errors.
 3. **The main component MUST be named \`App\` and MUST NOT be exported.** Write \`function App() { ... }\` \u2014 no \`export\`.
 4. **Use Tailwind CSS for styling.** It's built in.
-5. **Import external libraries from esm.sh.** Example: \`import confetti from "https://esm.sh/canvas-confetti@1.9.3"\`. Imports must be absolute https URLs \u2014 the sandbox cannot resolve bare or relative specifiers.
+5. **Import external libraries from esm.sh.** Example: \`import confetti from "https://esm.sh/canvas-confetti@1.9.3"\`. Imports must be absolute https URLs \u2014 bare and relative specifiers do not resolve. On the v2 runtime, also import your organization's libraries as \`overai:<libraryId>\` (read the \`libraries\` topic).
 6. **Sandbox restrictions (v1 runtime).** By default the page runs in a sandboxed iframe (allow-scripts only). Raw \`localStorage\`, \`sessionStorage\`, cookies, alert/confirm/prompt, and form submissions are blocked. Use \`useLocalStorageState\` / \`useSessionStorageState\` for storage (both require disabling the sandbox \u2014 see Rule 1). Set \`noSandbox: true\` to lift the sandbox, or \`runtime: "v2"\` (see Web Page Configuration) when the page also needs its own origin or browser devices.
 7. **Read code before editing.** Reading a large page's config returns its outline instead of the code \u2014 then read only the blocks or line ranges you are about to change. Edits return the changed lines, numbered, so don't re-read to verify. Prefer small, targeted edits \u2014 insert or search-replace \u2014 over rewriting a whole block.
 8. **Decompose large pages.** When a page exceeds ~200 lines, break it into multiple top-level function components (e.g., \`function DataTable() { ... }\` used inside \`function App() { ... }\`), so each can be read and edited on its own.
@@ -66667,7 +67657,7 @@ These libraries are tested and work from \`https://esm.sh/...\`. Do NOT import R
 
 ### Do NOT use libraries that depend on React
 
-An esm.sh build of a React library imports its own React (\`import "/react@>=16.8"\`), a second copy beside the page's global one, so every hook inside it fails with "Invalid hook call". The page has no import map to redirect that specifier, so there is no workaround. This rules out, among others:
+An esm.sh build of a React library imports its own React (\`import "/react@>=16.8"\`), a second copy beside the page's global one, so every hook inside it fails with "Invalid hook call". The page's import map does not cover that specifier, so there is no workaround. This rules out, among others:
 
 - **react-resize-detector** \u2014 Use a \`ResizeObserver\` hook instead (see pattern below).
 - **@tanstack/react-table** \u2014 Build tables with plain \`<table>\` + Tailwind + \`useState\` for sorting/filtering/pagination.
@@ -66752,13 +67742,15 @@ var workspacesDoc = {
 
 Workspaces serve as permission boundaries. By design, a builder (viewer, editor, manager) in one workspace is able to see ALL child workspaces. It is NOT guaranteed that a builder in one workspace has permissions to see the parents though.
 
-Resources (functions, tablespaces, integrations, agents, action runners) can be shared from one workspace to another, but ONLY from a parent to a direct child. This is done such that any builder is guaranteed to be able to see all usages of a resource in their workspace. This prevents issues where a builder makes a change and unintentionally breaks something.
+Resources (functions, tablespaces, integrations, agents, action runners, libraries) can be shared from one workspace to another, but ONLY from a parent to a direct child. This is done such that any builder is guaranteed to be able to see all usages of a resource in their workspace. This prevents issues where a builder makes a change and unintentionally breaks something.
 
 To share a resource, go to the Workspace Overview page, and then click "Resource sharing" (Managers only) in the top bar.
 
-Resources shared into a workspace appear in its Workspace Overview resource table alongside its own, each marked "Shared from <parent workspace>" ("Shared from another workspace" when the viewer can't see the parent), and the "Shared" filter chip narrows the table to them. They are read-only there: no action menu, no activity stats. A shared resource's name links to its page only when the viewer holds a builder role in the workspace that owns it; otherwise the row is listed but not clickable. To change or unshare it, a manager of the parent workspace uses "Resource sharing" there.
+Moves clear sharing. Reparenting a workspace deletes the shares its old parent made into it, and moving a resource to another workspace deletes the shares that name it specifically and takes it out of its resource group. Re-share what the new location needs.
 
-An agent's tools (functions, tablespaces, sub-agents, knowledge bases) resolve from the agent's own workspace, never the caller's. Sharing an agent therefore lets the recipient use its tools through it without those tools being shared. Moving an agent to a workspace that can't reach a tool silently drops that tool at runtime; the agent page header shows "N tools unavailable" when this has happened. Fix it by sharing the tool into the agent's workspace or moving the tool, not by detaching it.
+Resources shared into a workspace appear in its Workspace Overview resource table alongside its own, each marked "Shared from <parent workspace>" ("Shared from another workspace" when the viewer can't see the parent), and the "Shared" filter chip narrows the table to them. They are read-only there: no action menu, no activity stats. A shared resource's name links to its page only when the viewer holds a builder role in the workspace that owns it; otherwise the row is listed but not clickable. A shared library is the exception: it always opens, read-only, viewed from the child workspace. To change or unshare it, a manager of the parent workspace uses "Resource sharing" there.
+
+An agent's tools (functions, tablespaces, sub-agents, knowledge bases) resolve from the agent's own workspace, never the caller's. Sharing an agent therefore lets the recipient use its tools through it without those tools being shared. A library's own imports work the same way: sharing a library brings what it imports along. Moving an agent to a workspace that can't reach a tool silently drops that tool at runtime; the agent page header shows "N tools unavailable" when this has happened. Fix it by sharing the tool into the agent's workspace or moving the tool, not by detaching it.
 
 Archived workspaces are hidden from the workspace tree but are not deleted. Archiving a workspace also archives its integrations, which deletes their credentials; restoring the workspace leaves them archived. Account admins can inventory every archived workspace from **All Workspaces \u2192 Show archived**. To restore one they manage, tell the user to right-click the workspace tree's root item, choose **View archived workspaces**, and then choose **Unarchive**.
 
@@ -66794,6 +67786,7 @@ var ARCHITECT_DOC_TOPICS = [
   automationExecutionRulesDoc,
   liquidTemplatesDoc,
   webPagesDoc,
+  librariesDoc,
   printablePagesDoc,
   functionsDoc,
   functionDebuggingDoc,
@@ -66918,12 +67911,34 @@ var runReview = async () => {
         );
       }
       if (resource.type === "webPage" && relPath.endsWith(".tsx")) {
+        const metaPath = resource.files.find(
+          (file2) => file2.endsWith(".meta.json")
+        );
+        const isV2 = iife(() => {
+          const meta3 = metaPath ? readWorkingFile(root, metaPath) : null;
+          const [parsed] = resultOfSync(
+            () => JSON.parse(meta3 ?? "{}")
+          );
+          return typeof parsed === "object" && parsed !== null && "runtime" in parsed && parsed.runtime === "v2";
+        });
         const importRe = /^\s*import\s+(?:[^'"\n]*?\bfrom\s+)?["']([^"']+)["']/gm;
         for (const match of content.matchAll(importRe)) {
           const specifier = match[1];
           if (specifier == null || specifier.startsWith("https://")) continue;
+          const library = /^overai:([^@]*)(?:@([0-9]+))?$/i.exec(specifier);
+          if (library) {
+            if (!isIdOf("library", library[1]))
+              findings2.push(
+                `${relPath}: imports "${specifier}" \u2014 not a library id; copy the import line from the library's page (overai:lib followed by 10 characters).`
+              );
+            else if (!isV2)
+              findings2.push(
+                `${relPath}: imports "${specifier}" \u2014 libraries load only on the v2 runtime; set "runtime": "v2" in ${metaPath ?? "the page's meta.json"}.`
+              );
+            continue;
+          }
           findings2.push(
-            /^react(-dom)?(\/|$)/.test(specifier) ? `${relPath}: imports "${specifier}" \u2014 React and its hooks are already in scope; remove the import or the page renders blank.` : `${relPath}: imports "${specifier}" \u2014 the page sandbox can only import https URLs (use https://esm.sh/...).`
+            /^react(-dom)?(\/|$)/.test(specifier) ? `${relPath}: imports "${specifier}" \u2014 React and its hooks are already in scope; remove the import or the page renders blank.` : `${relPath}: imports "${specifier}" \u2014 pages import https URLs (use https://esm.sh/...) or, on the v2 runtime, libraries as overai:<libraryId>.`
           );
         }
         if (/^\s*export\s+default\b/m.test(content)) {
@@ -67380,10 +68395,99 @@ var listWorkspaceUsers = async (args) => {
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
+var printTree = async (args) => {
+  const [workspaceId] = positionals(args, ["-o", "--output"]);
+  const includeArchived = args.includes("--archived");
+  const client = cliClient();
+  const roots = workspaceId == null ? await client.workspaces.tree({ includeArchived }) : [await client.workspace(workspaceId).tree({ includeArchived })];
+  if (resolveFormat(flagValue(args, "-o", "--output")) !== "table") {
+    printResult(roots, "json");
+    return;
+  }
+  const lines = (node2, depth) => [
+    `${"  ".repeat(depth)}${node2.name}  ${node2.id}${node2.role == null ? "" : `  ${node2.role}`}${node2.isArchived ? "  archived" : ""}`,
+    ...node2.children.flatMap((child) => lines(child, depth + 1))
+  ];
+  process.stdout.write(
+    `${roots.flatMap((root) => lines(root, 0)).join("\n") || "(no workspaces)"}
+`
+  );
+};
+var listShares = async (args) => {
+  const workspaceId = workspaceIdFrom(args);
+  const client = cliClient();
+  const shares = await client.workspace(workspaceId).shares();
+  const names = new Map(
+    await Promise.all(
+      shares.flatMap(
+        (share) => share.resourceId == null ? [] : [
+          client.resource(share.resourceId).show().then(
+            (row) => [
+              share.resourceId,
+              typeof row.name === "string" ? row.name : ""
+            ],
+            () => [share.resourceId, ""]
+          )
+        ]
+      )
+    )
+  );
+  printResult(
+    shares.map((share) => ({
+      from: `${share.fromWorkspaceName ?? ""} (${share.fromWorkspaceId})`,
+      to: `${share.toWorkspaceName ?? ""} (${share.toWorkspaceId})`,
+      kind: share.resourceKind,
+      resource: share.resourceId == null ? `all ${share.resourceKind}` : `${names.get(share.resourceId) ?? ""} (${share.resourceId})`
+    })),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var shareResource = async (args) => {
+  const [fromId] = positionals(args, [
+    "--to",
+    "--kind",
+    "--resource",
+    "-o",
+    "--output"
+  ]);
+  const to = flagValue(args, "--to");
+  const kind = flagValue(args, "--kind");
+  if (fromId == null || to == null || kind == null) {
+    throw new Error(
+      "Usage: overai workspace share <fromWorkspaceId> --to <childWorkspaceId> --kind <kind> [--resource <id>] [--remove]"
+    );
+  }
+  const shareKind = SHARE_KINDS.find((known) => known === kind);
+  if (shareKind == null) {
+    throw new Error(
+      `Unknown share kind "${kind}". Use one of: ${SHARE_KINDS.join(", ")}.`
+    );
+  }
+  const client = cliClient();
+  const typedResourceId = flagValue(args, "--resource");
+  const resourceId = typedResourceId == null ? null : (await client.resource(typedResourceId).show()).id;
+  const what = resourceId == null ? `all ${shareKind}` : `${shareKind} ${resourceId}`;
+  const input2 = { toWorkspaceId: to, kind: shareKind, resourceId };
+  if (args.includes("--remove")) {
+    await client.workspace(fromId).unshare(input2);
+    process.stdout.write(
+      `Stopped sharing ${what} from ${fromId} into ${to}.
+`
+    );
+    return;
+  }
+  await client.workspace(fromId).share(input2);
+  process.stdout.write(`Shared ${what} from ${fromId} into ${to}.
+`);
+};
 var USAGE5 = `Usage:
   overai workspace list [--archived] [--limit <n>]
   overai workspace show [workspaceId]
   overai workspace users [workspaceId]
+  overai workspace tree [workspaceId] [--archived]
+  overai workspace move <workspaceId> --to <parentWorkspaceId|root> [--dry-run]
+  overai workspace shares [workspaceId]
+  overai workspace share <fromWorkspaceId> --to <childWorkspaceId> --kind <${SHARE_KINDS.join("|")}> [--resource <id>] [--remove]
 `;
 var runWorkspace = async (args) => {
   if (args[0] === "list") {
@@ -67398,6 +68502,22 @@ var runWorkspace = async (args) => {
     await listWorkspaceUsers(args.slice(1));
     return;
   }
+  if (args[0] === "tree") {
+    await printTree(args.slice(1));
+    return;
+  }
+  if (args[0] === "move") {
+    await moveWorkspace(args.slice(1));
+    return;
+  }
+  if (args[0] === "shares") {
+    await listShares(args.slice(1));
+    return;
+  }
+  if (args[0] === "share") {
+    await shareResource(args.slice(1));
+    return;
+  }
   process.stderr.write(USAGE5);
   process.exitCode = 1;
 };
@@ -67501,10 +68621,33 @@ Usage:
   overai workspace show [workspaceId]  Show a workspace's name and overview
   overai workspace users [workspaceId] List users and effective/direct roles
                                        (workspaceId defaults from a clone)
+  overai workspace tree [workspaceId] [--archived]
+                                       Print the workspace hierarchy; no id
+                                       prints every top-level workspace
+  overai workspace move <workspaceId> --to <parentId|root> [--dry-run]
+                                       Reparent a workspace; prints the shares
+                                       it loses and who gains or loses access
+  overai workspace shares [workspaceId] List shares from and into a workspace
+  overai workspace share <fromWorkspaceId> --to <childWorkspaceId> --kind <kind> [--resource <id>] [--remove]
+                                       Share a kind (table_space, function,
+                                       agent, integration, action_runner), or
+                                       one resource, into a direct child
   overai create <type> [--workspace <id>] [--name <name>]
                                        Create a complete, usable resource
   overai resource show <id>             Show metadata for any resource
   overai resource update <id> [...]     Edit metadata, state, or archive status
+  overai resource move <id> --to <workspaceId> [--dry-run]
+                                       Move a resource to another workspace;
+                                       prints the group and shares it loses and
+                                       references that may stop resolving
+  overai resource group list [--workspace <id>]
+  overai resource group create --workspace <id> --name <name>
+  overai resource group rename <groupId> --name <name>
+  overai resource group delete <groupId>
+  overai resource group add <groupId> <resourceId>...
+  overai resource group remove <resourceId>...
+                                       Side-navigation groups: flat, one per
+                                       resource, same workspace
   overai graphql -q '<query>' | -f <file> [--variables <json>] [--v1]
                                        Run a GraphQL operation (/v2; --v1 = legacy Hasura)
   overai fn <functionId> [--method GET] [--path /features/123] [--input k=v ... | -]