@overaihq/cli 0.14.2 → 0.14.4

package/README.md

@@ -157,6 +157,10 @@ send a literal value that starts with `@`.
 
 ## For AI agents
 
+To onboard an agent, point it at this README and paste:
+
+> I use OverAI. Help me get set up with the CLI (https://www.npmjs.com/package/@overaihq/cli): install it, get me logged in, and then walk me through onboarding.
+
 The CLI bundles its own guidance — no extra setup files needed. Point your
 agent at a cloned workspace and have it run:
 

package/dist/{chunk-FTBTDB2B.js → chunk-4QWKERK2.js}

@@ -386,26 +386,39 @@ var injectCodeMessageSchema = external_exports.object({
 // ../common/src/webPage.ts
 var webPageLanguage = ["react"];
 var configFlag = external_exports.union([external_exports.boolean(), external_exports.string()]).nullish().transform((value) => value === true || value === "true").catch(false);
-var webPageConfigSchema = external_exports.object({
-  language: external_exports.enum(["react"]).catch("react"),
-  /* Missing on legacy versions; invalid modes fail closed instead of granting workspace access. */
-  authorizationMode: external_exports.enum(["workspace", "viewer"]).default("workspace"),
+var webPageConfigFields = {
+  language: external_exports.enum(webPageLanguage),
+  /* Invalid modes fail closed instead of granting workspace access. */
+  authorizationMode: external_exports.enum(["workspace", "viewer"]),
   customTitle: external_exports.string().nullish(),
-  code: external_exports.string().default(reactDefaultTemplate),
+  code: external_exports.string(),
   dataSourceUrl: external_exports.string().nullish(),
-  filter: itemFilterExpressionRootSchema.nullish().catch(null),
+  filter: itemFilterExpressionRootSchema.nullish(),
   /* Drops the iframe's sandbox attribute — needed for storage, cookies, forms. */
-  noSandbox: configFlag,
+  noSandbox: external_exports.boolean().nullish(),
   /* Renders the page fullscreen for end users by hiding the workspace top bar. */
-  hideTopBar: configFlag,
+  hideTopBar: external_exports.boolean().nullish(),
   /*
    * Which iframe runtime renders the page. "v1" is the sandboxed srcdoc
    * iframe; "v2" serves the page from its own origin (separate renderer
-   * process, real localStorage). Absent or invalid reads as "v1" so a legacy
-   * config never fails to parse over the toggle.
+   * process, real localStorage).
    */
-  runtime: external_exports.enum(["v1", "v2"]).catch("v1")
+  runtime: external_exports.enum(["v1", "v2"])
+};
+var webPageConfigSchema = external_exports.object({
+  ...webPageConfigFields,
+  language: webPageConfigFields.language.catch("react"),
+  // Missing on legacy versions.
+  authorizationMode: webPageConfigFields.authorizationMode.default("workspace"),
+  code: webPageConfigFields.code.default(reactDefaultTemplate),
+  filter: webPageConfigFields.filter.catch(null),
+  noSandbox: configFlag,
+  hideTopBar: configFlag,
+  // Absent or invalid reads as "v1" so a legacy config never fails to parse
+  // over the toggle.
+  runtime: webPageConfigFields.runtime.catch("v1")
 });
+var webPageConfigUpdateSchema = external_exports.object(webPageConfigFields).partial();
 var webPageConfigWriteSchema = webPageConfigSchema.extend({
   noSandbox: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
   hideTopBar: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
@@ -420,8 +433,10 @@ var defaultWebPageTemplate = reactDefaultTemplate.replace(
 
 export {
   itemFilterExpressionRootSchema,
+  reactDefaultTemplate,
   webPageLanguage,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   defaultWebPageTemplate
 };

package/dist/index.js

@@ -4,8 +4,9 @@ import {
 } from "./chunk-WGPBYGU6.js";
 import {
   itemFilterExpressionRootSchema,
+  reactDefaultTemplate,
   webPageConfigSchema
-} from "./chunk-FTBTDB2B.js";
+} from "./chunk-4QWKERK2.js";
 import {
   external_exports
 } from "./chunk-PF6GZFT4.js";
@@ -27811,6 +27812,112 @@ var runAutomation = async (args) => {
   process.exitCode = 1;
 };
 
+// ../common/src/agent.ts
+var agentVersionConfigSchema = external_exports.object({
+  systemPrompt: external_exports.string(),
+  model: external_exports.string(),
+  temperature: external_exports.number(),
+  maxTokens: external_exports.number(),
+  rateLimitRequestsPerMinute: external_exports.number(),
+  rateLimitTokensPerMinute: external_exports.number()
+});
+var defaultAgentVersionConfig = {
+  systemPrompt: "You are a helpful assistant.",
+  model: "claude-sonnet-4-6",
+  temperature: 0.7,
+  maxTokens: 4096,
+  rateLimitRequestsPerMinute: 20,
+  rateLimitTokensPerMinute: 2e5
+};
+var agentTableSpaceAccessModeSchema = external_exports.enum(["read", "read_write"]);
+var BUILTIN_TOOL_SETS = {
+  web: {
+    label: "Web search",
+    description: "Search the web. Runs on the model provider's infrastructure; not every model offers it."
+  },
+  documents: {
+    label: "Read documents",
+    description: "Read PDFs, Word documents, spreadsheets and text files from this organization's storage."
+  },
+  storage: {
+    label: "Save files",
+    description: "Write text files to this organization's storage for other tools and people to use."
+  }
+};
+var isBuiltinToolSetName = (name2) => Object.hasOwn(BUILTIN_TOOL_SETS, name2);
+var agentEditableConfigSchema = agentVersionConfigSchema.extend({
+  agentVersionFunctionsByAgentIdAndVersionNumber: external_exports.object({
+    nodes: external_exports.array(
+      external_exports.object({
+        functionId: external_exports.string()
+      })
+    )
+  }),
+  agentVersionTableSpacesByAgentIdAndVersionNumber: external_exports.object({
+    nodes: external_exports.array(
+      external_exports.object({
+        tableSpaceId: external_exports.string(),
+        accessMode: agentTableSpaceAccessModeSchema
+      })
+    )
+  }),
+  agentVersionAgentsByAgentIdAndVersionNumber: external_exports.object({
+    nodes: external_exports.array(
+      external_exports.object({
+        attachedAgentId: external_exports.string()
+      })
+    )
+  }),
+  agentVersionKnowledgeBasesByAgentIdAndVersionNumber: external_exports.object({
+    nodes: external_exports.array(
+      external_exports.object({
+        knowledgeBaseId: external_exports.string()
+      })
+    )
+  }),
+  // Prefaulted: configs from before built-ins (stale clients, saved drafts)
+  // still parse.
+  agentVersionBuiltinToolSetsByAgentIdAndVersionNumber: external_exports.object({
+    nodes: external_exports.array(
+      external_exports.object({
+        toolSet: external_exports.string()
+      })
+    )
+  }).prefault({ nodes: [] })
+});
+var agentToolHttpMethodSchema = external_exports.enum([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+var agentToolRequestSchema = external_exports.object({
+  method: agentToolHttpMethodSchema,
+  // Sub-path under the function base URL; functions route on it
+  path: external_exports.string().prefault("/").transform((p) => p.startsWith("/") ? p : `/${p}`),
+  headers: external_exports.record(external_exports.string(), external_exports.string()).prefault({}),
+  queryParams: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).prefault({}),
+  body: external_exports.unknown()
+});
+var agentToolRequestJsonSchemaSchema = external_exports.object({
+  type: external_exports.literal("object"),
+  properties: external_exports.object({
+    method: external_exports.object({ type: external_exports.literal("string") }).loose(),
+    headers: external_exports.object({ type: external_exports.literal("object") }).loose(),
+    queryParams: external_exports.object({ type: external_exports.literal("object") }).loose(),
+    body: external_exports.object({}).loose()
+  }).loose(),
+  required: external_exports.array(external_exports.string()).refine(
+    (arr) => ["method", "headers", "queryParams", "body"].every(
+      (key) => arr.includes(key)
+    ),
+    {
+      message: "required array must include: method, headers, queryParams, body"
+    }
+  )
+}).loose();
+
 // src/workspace/validateElements.ts
 var findings = (parsed) => parsed.success ? [] : parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
 var validateAutomationElements = async (elements) => {
@@ -27818,45 +27925,51 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-7BXDGWX5.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-ICODVQMY.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
 // ../common/src/function.ts
-var defaultAgentFunctionInputSchema = `{
-    "type": "object",
-    "properties": {
-      "method": {
-        "type": "string",
-        "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
-        "default": "POST",
-        "description": "HTTP method for this function call."
+var agentToolPathJsonSchema = {
+  type: "string",
+  default: "/",
+  description: 'Sub-path under the function URL, e.g. "/notes". Use "/" for the base.'
+};
+var defaultAgentFunctionInputSchema = JSON.stringify(
+  {
+    type: "object",
+    properties: {
+      method: {
+        type: "string",
+        enum: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+        default: "POST",
+        description: "HTTP method for this function call."
       },
-      "headers": {
-        "type": "object",
-        "description": "Request headers. Use {} when none are needed.",
-        "default": {},
-        "additionalProperties": {
-          "type": "string"
-        }
+      path: agentToolPathJsonSchema,
+      headers: {
+        type: "object",
+        description: "Request headers. Use {} when none are needed.",
+        default: {},
+        additionalProperties: { type: "string" }
       },
-      "queryParams": {
-        "type": "object",
-        "description": "URL query params. Use {} when none are needed.",
-        "default": {},
-        "additionalProperties": {
-          "type": ["string", "number", "boolean"]
-        }
+      queryParams: {
+        type: "object",
+        description: "URL query params. Use {} when none are needed.",
+        default: {},
+        additionalProperties: { type: ["string", "number", "boolean"] }
       },
-      "body": {
-        "type": "object",
-        "description": "Request body payload. Use {} when none is needed.",
-        "default": {},
-        "additionalProperties": true
+      body: {
+        type: "object",
+        description: "Request body payload. Use {} when none is needed.",
+        default: {},
+        additionalProperties: true
       }
     },
-    "required": ["method", "headers", "queryParams", "body"]
-  }`;
+    required: ["method", "headers", "queryParams", "body"]
+  },
+  null,
+  2
+);
 var DEFAULT_FUNCTION_EXECUTION_TIMEOUT_MS = 3e4;
 var DEFAULT_FUNCTION_EXECUTION_MEMORY_MB = 512;
 
@@ -27874,6 +27987,7 @@ var functionFiles = (id, name2, version) => {
     [`${stem}.ts`]: version.code,
     [`${stem}.meta.json`]: metaJson({
       inputSchema: version.inputSchema,
+      callerAccess: version.callerAccess,
       outputSchema: version.outputSchema,
       executionTimeout: version.executionTimeout,
       executionCpu: version.executionCpu,
@@ -27890,7 +28004,7 @@ var functionAdapter = {
           nodes {
             id name
             functionVersions(orderBy: [VERSION_NUMBER_DESC], first: 1) {
-              nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory }
+              nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory callerAccess }
             }
             functionDeployedVersion { versionNumber }
           }
@@ -27932,7 +28046,7 @@ var functionAdapter = {
     const data = await gqlRequest(
       `query CliFunctionVersion($functionId: String!, $versionNumber: Int!) {
         functionVersion(functionId: $functionId, versionNumber: $versionNumber) {
-          versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory
+          versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory callerAccess
         }
       }`,
       { functionId: id, versionNumber }
@@ -27947,12 +28061,12 @@ var functionAdapter = {
   push: async (id, files, message, expectedLatestVersion) => {
     const meta = JSON.parse(fileBySuffix(files, ".meta.json"));
     const data = await gqlRequest(
-      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int) {
+      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int, $callerAccess: String) {
         createFunctionVersion(input: { expectedLatestVersion: $expectedLatestVersion, functionVersion: {
           functionId: $functionId, code: $code, message: $message,
           inputSchema: $inputSchema, outputSchema: $outputSchema,
           executionTimeout: $executionTimeout, executionCpu: $executionCpu,
-          executionMemory: $executionMemory
+          executionMemory: $executionMemory, callerAccess: $callerAccess
         }}) { functionVersion { versionNumber } }
       }`,
       {
@@ -27960,6 +28074,8 @@ var functionAdapter = {
         functionId: id,
         code: fileBySuffix(files, ".ts"),
         message,
+        // Omission in older clones lets the database inherit the latest policy.
+        callerAccess: meta.callerAccess ?? null,
         // Match the webapp's save defaults so a missing meta doesn't zero out
         // limits, and so an explicit null doesn't hit the NOT NULL column.
         inputSchema: meta.inputSchema ?? "",
@@ -28255,6 +28371,9 @@ var agentFiles = (id, name2, version) => ({
     ),
     knowledgeBaseIds: version.agentVersionKnowledgeBasesByAgentIdAndVersionNumber.nodes.map(
       (link) => link.knowledgeBaseId
+    ),
+    builtinToolSets: version.agentVersionBuiltinToolSetsByAgentIdAndVersionNumber.nodes.map(
+      (link) => link.toolSet
     )
   })
 });
@@ -28273,6 +28392,9 @@ var agentVersionFields = `
   agentVersionKnowledgeBasesByAgentIdAndVersionNumber(orderBy: [KNOWLEDGE_BASE_ID_ASC]) {
     nodes { knowledgeBaseId }
   }
+  agentVersionBuiltinToolSetsByAgentIdAndVersionNumber(orderBy: [TOOL_SET_ASC]) {
+    nodes { toolSet }
+  }
 `;
 var agentAdapter = {
   type: "agent",
@@ -28338,13 +28460,21 @@ var agentAdapter = {
   },
   push: async (id, files, message, expectedLatestVersion) => {
     const config = JSON.parse(fileBySuffix(files, ".json"));
+    const unknownToolSets = (config.builtinToolSets ?? []).filter(
+      (name2) => !isBuiltinToolSetName(name2)
+    );
+    if (unknownToolSets.length > 0) {
+      throw new Error(
+        `Unknown builtinToolSets: ${unknownToolSets.join(", ")}. Known: ${Object.keys(BUILTIN_TOOL_SETS).join(", ")}. If the name is new, upgrade the CLI.`
+      );
+    }
     const data = await gqlRequest(
       `mutation CliCreateAgentVersion($expectedLatestVersion: Int,
         $agentId: String!, $message: String!, $systemPrompt: String!,
         $model: String!, $temperature: Float!, $maxTokens: Int!,
         $rateLimitRequestsPerMinute: Int!, $rateLimitTokensPerMinute: Int!,
         $functionIds: [String], $tableSpaceBindings: JSON, $agentIds: [String],
-        $knowledgeBaseIds: [String]
+        $knowledgeBaseIds: [String], $builtinToolSets: [String]
       ) {
         createAgentVersionWithAttachments(input: { expectedLatestVersion: $expectedLatestVersion,
           agentId: $agentId, message: $message, systemPrompt: $systemPrompt,
@@ -28352,7 +28482,8 @@ var agentAdapter = {
           rateLimitRequestsPerMinute: $rateLimitRequestsPerMinute,
           rateLimitTokensPerMinute: $rateLimitTokensPerMinute,
           functionIds: $functionIds, tableSpaceBindings: $tableSpaceBindings,
-          agentIds: $agentIds, knowledgeBaseIds: $knowledgeBaseIds
+          agentIds: $agentIds, knowledgeBaseIds: $knowledgeBaseIds,
+          builtinToolSets: $builtinToolSets
         }) { result { versionNumber } }
       }`,
       {
@@ -28362,6 +28493,7 @@ var agentAdapter = {
         tableSpaceBindings: config.tableSpaceBindings ?? [],
         agentIds: config.agentIds ?? [],
         knowledgeBaseIds: config.knowledgeBaseIds ?? [],
+        builtinToolSets: config.builtinToolSets ?? null,
         expectedLatestVersion
       }
     );
@@ -28550,86 +28682,6 @@ var runRunner = async (args) => {
   process.exitCode = 1;
 };
 
-// ../common/src/agent.ts
-var agentVersionConfigSchema = external_exports.object({
-  systemPrompt: external_exports.string(),
-  model: external_exports.string(),
-  temperature: external_exports.number(),
-  maxTokens: external_exports.number(),
-  rateLimitRequestsPerMinute: external_exports.number(),
-  rateLimitTokensPerMinute: external_exports.number()
-});
-var defaultAgentVersionConfig = {
-  systemPrompt: "You are a helpful assistant.",
-  model: "claude-sonnet-4-6",
-  temperature: 0.7,
-  maxTokens: 4096,
-  rateLimitRequestsPerMinute: 20,
-  rateLimitTokensPerMinute: 2e5
-};
-var agentTableSpaceAccessModeSchema = external_exports.enum(["read", "read_write"]);
-var agentEditableConfigSchema = agentVersionConfigSchema.extend({
-  agentVersionFunctionsByAgentIdAndVersionNumber: external_exports.object({
-    nodes: external_exports.array(
-      external_exports.object({
-        functionId: external_exports.string()
-      })
-    )
-  }),
-  agentVersionTableSpacesByAgentIdAndVersionNumber: external_exports.object({
-    nodes: external_exports.array(
-      external_exports.object({
-        tableSpaceId: external_exports.string(),
-        accessMode: agentTableSpaceAccessModeSchema
-      })
-    )
-  }),
-  agentVersionAgentsByAgentIdAndVersionNumber: external_exports.object({
-    nodes: external_exports.array(
-      external_exports.object({
-        attachedAgentId: external_exports.string()
-      })
-    )
-  }),
-  agentVersionKnowledgeBasesByAgentIdAndVersionNumber: external_exports.object({
-    nodes: external_exports.array(
-      external_exports.object({
-        knowledgeBaseId: external_exports.string()
-      })
-    )
-  })
-});
-var agentToolHttpMethodSchema = external_exports.enum([
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE"
-]);
-var agentToolRequestSchema = external_exports.object({
-  method: agentToolHttpMethodSchema,
-  headers: external_exports.record(external_exports.string(), external_exports.string()).prefault({}),
-  queryParams: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).prefault({}),
-  body: external_exports.unknown()
-});
-var agentToolRequestJsonSchemaSchema = external_exports.object({
-  type: external_exports.literal("object"),
-  properties: external_exports.object({
-    method: external_exports.object({ type: external_exports.literal("string") }).loose(),
-    headers: external_exports.object({ type: external_exports.literal("object") }).loose(),
-    queryParams: external_exports.object({ type: external_exports.literal("object") }).loose(),
-    body: external_exports.object({}).loose()
-  }).loose(),
-  required: external_exports.array(external_exports.string()).refine(
-    (arr) => ["method", "headers", "queryParams", "body"].every(
-      (key) => arr.includes(key)
-    ),
-    {
-      message: "required array must include: method, headers, queryParams, body"
-    }
-  )
-}).loose();
-
 // ../common/src/liquidjs/liquidjs.ts
 var import_jmespath = __toESM(require_jmespath(), 1);
 
@@ -33936,31 +33988,37 @@ engine.registerTag("generatePassword", GeneratePasswordTag);
 
 // ../common/src/printablePage.ts
 var printablePageLanguage = ["liquid", "react"];
-var reactDefaultTemplate = `function App() {
-  return (
-    <div className="page">
-      <h1>My Page Title</h1>
-      <p>Page content goes here...</p>
-    </div>
-  );
-}`;
+var printablePageConfigFields = {
+  pageSize: external_exports.object({ width: external_exports.string(), height: external_exports.string() }),
+  pageMargins: external_exports.object({
+    top: external_exports.string(),
+    right: external_exports.string(),
+    bottom: external_exports.string(),
+    left: external_exports.string()
+  }),
+  language: external_exports.enum(printablePageLanguage),
+  code: external_exports.string(),
+  dataSourceUrl: external_exports.string().nullish(),
+  filter: itemFilterExpressionRootSchema.nullish(),
+  customTitle: external_exports.string().nullish()
+};
 var printablePageConfigSchema = external_exports.object({
-  pageSize: external_exports.object({
+  ...printablePageConfigFields,
+  // Per-key defaults so a stored object missing one dimension still reads.
+  pageSize: printablePageConfigFields.pageSize.extend({
     width: external_exports.string().default("8.5in"),
     height: external_exports.string().default("11in")
   }).prefault({}),
-  pageMargins: external_exports.object({
+  pageMargins: printablePageConfigFields.pageMargins.extend({
     top: external_exports.string().default("0.5in"),
     right: external_exports.string().default("0.5in"),
     bottom: external_exports.string().default("0.5in"),
     left: external_exports.string().default("0.5in")
   }).prefault({}),
-  language: external_exports.enum(printablePageLanguage).default("react"),
-  code: external_exports.string().default(reactDefaultTemplate),
-  dataSourceUrl: external_exports.string().nullish(),
-  filter: itemFilterExpressionRootSchema.nullish(),
-  customTitle: external_exports.string().nullish()
+  language: printablePageConfigFields.language.default("react"),
+  code: printablePageConfigFields.code.default(reactDefaultTemplate)
 });
+var printablePageConfigUpdateSchema = external_exports.object(printablePageConfigFields).partial();
 var printablePageRenderDiagnosticsSchema = external_exports.object({
   /** Absent when the render itself failed before any text existed. */
   renderedTextLength: external_exports.number().optional(),
@@ -35363,6 +35421,9 @@ var ID_PREFIXES = {
   agent: { prefix: "agt", body: 10 },
   agent_conversation: { prefix: "agcv", body: 20 },
   agent_message: { prefix: "agmsg", body: 20 },
+  agent_message_part: { prefix: "amp", body: 16 },
+  agent_tool_invocation: { prefix: "ati", body: 16 },
+  agent_turn: { prefix: "atn", body: 16 },
   architect_chat: {
     prefix: "ac",
     body: 12,
@@ -35410,6 +35471,7 @@ var ID_PREFIXES = {
   mailbox: { prefix: "mbx", body: 10 },
   mailbox_address: { prefix: "mba", body: 10 },
   mailbox_message: { prefix: "mbm", body: 10 },
+  notification: { prefix: "ntf", body: 12 },
   organization_usage_credit: { prefix: "crd", body: 12 },
   organization_usage_transaction: { prefix: "utx", body: 12 },
   page: { prefix: "pg", body: 10 },
@@ -36668,8 +36730,15 @@ Rules that keep graphs healthy:
   of the same parent; never connect across loop boundaries.
 - Keep TYPESCRIPT_CODE nodes small and focused \u2014 split logic across nodes and
   let the graph orchestrate, rather than one big code block.
-- Node inputs reference upstream state via variableIds (e.g. STATE.S1, Liquid
-  {{S1.field}}). After renaming/removing a node, grep the document for its
+- Write TYPESCRIPT_CODE as a module:
+  \`export default async function step(state: StepState, ctx: StepContext, env: Env) { const s1 = await state.get("S1"); return s1.rows; }\`.
+  Annotate every parameter you declare \u2014 module code is checked with
+  noImplicitAny, so an unannotated one is an error.
+  \`state.get\` fetches one step's output on first read (cached for that node's execution),
+  resolves undefined for a skipped step, and rejects for an id not visible
+  from the node. Bare snippets (STATE/OUTPUT globals) are legacy, being retired.
+- Node inputs reference upstream state via variableIds (e.g.
+  \`await state.get("S1")\`, Liquid {{S1.field}}). After renaming/removing a node, grep the document for its
   variableId \u2014 dangling references fail at runtime, not at push.
 - Bring IF_ELSE branches back together with an ALWAYS node.
 - A loop (LOOP_ARRAY/LOOP_RANGE) always resolves to its success handle once all
@@ -36733,9 +36802,10 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
 - SQL from pages: env.TBSxxx.sql tagged templates only; compose dynamic SQL by
   nesting sql fragments, sql([...]) for IN lists. sql.unsafe only for dynamic
   identifiers.
-- For end-user-facing workspaces, add page-to-page navigation (end users land
-  on the workspace homepage and can only follow links). "Hide Top Bar" gives
-  an app-like experience.
+- End-user-facing workspaces have two modes. App (the default): end users land
+  on the workspace homepage and can only follow links, so add page-to-page
+  navigation; "Hide Top Bar" gives an app-like experience. Pages: the top bar
+  lists every deployed page, so pages only need links to ones marked hidden.
 - Public pages (/public/:id) have no viewer identity \u2014 useCurrentUser() is
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
@@ -36784,8 +36854,14 @@ var functions = `# Function best practices
 Functions are TypeScript HTTP handlers in a Deno sandbox: full env SDK,
 esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
 <slug>.<id>.meta.json (inputSchema, outputSchema, executionTimeout ms,
-executionMemory MB).
+executionMemory MB, callerAccess).
 
+- New functions allow only callers with workspace access by default. Set
+  callerAccess to "public" in meta.json only when an unauthenticated endpoint is
+  intended. Existing functions retain their saved policy when older meta.json
+  files omit this field. The policy is versioned: deploy the saved version to
+  change who can call the live endpoint. Workspace uses Authorization for the
+  platform bearer token; put additional application credentials in another header.
 - Functions are full HTTP apps: method + sub-path are forwarded to your code,
   and each execution records requestMethod/requestPath. Callers reach a route
   with env.FNxxx.call({ method, path: "/features/123" }) \u2014 path defaults to the

package/dist/{webPage-7BXDGWX5.js → webPage-ICODVQMY.js}

@@ -1,14 +1,16 @@
 import {
   defaultWebPageTemplate,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   webPageLanguage
-} from "./chunk-FTBTDB2B.js";
+} from "./chunk-4QWKERK2.js";
 import "./chunk-PF6GZFT4.js";
 import "./chunk-U67V476Y.js";
 export {
   defaultWebPageTemplate,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   webPageLanguage
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "@perygee/common": "0.0.0",
-    "@types/node": "^24.13.5",
+    "@types/node": "^24.19.0",
     "@types/proper-lockfile": "^4.1.4",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",