@overaihq/cli 0.14.6 → 0.14.7

package/dist/index.js

@@ -35733,6 +35733,7 @@ var ID_PREFIXES = {
   automation_email_address: { prefix: "aea", body: 10 },
   automation_email_alert: { prefix: "aes", body: 10 },
   automation_error_alert_queue: { prefix: "aeaq", body: 10 },
+  billing_period: { prefix: "bpd", body: 12 },
   browser_automation: { prefix: "bra", body: 10 },
   browser_automation_run: { prefix: "brr", body: 20 },
   browser_session_usage: { prefix: "bsu", body: 12 },
@@ -35837,6 +35838,108 @@ var idTableByPrefix = (id) => {
   return best?.table ?? null;
 };
 
+// src/commands/resource.ts
+var resources = {
+  workspace: { collection: "workspaces", mutation: "updateWorkspace", result: "workspace", patch: "WorkspacePatch", fields: "id name description isArchived", editable: ["name", "description", "isArchived"] },
+  automation: { collection: "automations", mutation: "updateAutomation", result: "automation", patch: "AutomationPatch", fields: "id name description isArchived isActive workspaceId", editable: ["name", "description", "isArchived", "isActive"] },
+  function: { collection: "functions", mutation: "updateFunction", result: "function", patch: "FunctionPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
+  web_page: { collection: "webPages", mutation: "updateWebPage", result: "webPage", patch: "WebPagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
+  printable_page: { collection: "printablePages", mutation: "updatePrintablePage", result: "printablePage", patch: "PrintablePagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
+  agent: { collection: "agents", mutation: "updateAgent", result: "agent", patch: "AgentPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
+  integration: { collection: "integrations", mutation: "updateIntegration", result: "integration", patch: "IntegrationPatch", fields: "id name description isArchived integrationTypeId workspaceId", editable: ["name", "description", "isArchived", "integrationTypeId"] },
+  table_space: { collection: "tableSpaces", mutation: "updateTableSpace", result: "tableSpace", patch: "TableSpacePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  data_stream: { collection: "dataStreams", mutation: "updateDataStream", result: "dataStream", patch: "DataStreamPatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  knowledge_base: { collection: "knowledgeBases", mutation: "updateKnowledgeBase", result: "knowledgeBase", patch: "KnowledgeBasePatch", fields: "id name description isArchived embeddingModel workspaceId", editable: ["name", "description", "isArchived"] },
+  data_file: { collection: "dataFiles", mutation: "updateDataFile", result: "dataFile", patch: "DataFilePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  action_runner: { collection: "actionRunners", mutation: "updateActionRunner", result: "actionRunner", patch: "ActionRunnerPatch", fields: "id isArchived actionTimeoutSeconds config workspaceId identityId identity { name }", editable: ["isArchived", "actionTimeoutSeconds", "config"] }
+  // Keyed by table so `idTableByPrefix` can index it; `satisfies` rejects a key
+  // the registry does not know.
+};
+var resourceFor = (id) => {
+  const table = idTableByPrefix(id);
+  const resource = table == null ? void 0 : resources[table];
+  if (resource == null) throw new Error(`Unsupported resource id: ${id}`);
+  return resource;
+};
+var readResource = async (id, resource) => {
+  const data = await gqlRequest(
+    `query CliResource($id: String!) {
+      ${resource.collection}(condition: { idIgnoringCase: $id }, includeArchived: YES, first: 1) {
+        nodes { ${resource.fields} }
+      }
+    }`,
+    { id }
+  );
+  const row = data[resource.collection]?.nodes[0];
+  if (row == null) throw new Error(`Resource ${id} not found.`);
+  return row;
+};
+var runResource = async (args) => {
+  const [operation, id] = args;
+  if (operation !== "show" && operation !== "update" || id == null) {
+    throw new Error("Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]");
+  }
+  const resource = resourceFor(id);
+  if (operation === "show") {
+    printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
+    return;
+  }
+  const patch = {};
+  const scalarFlags = [
+    ["name", "--name"],
+    ["description", "--description"],
+    ["integrationTypeId", "--type"],
+    ["actionTimeoutSeconds", "--timeout"]
+  ];
+  scalarFlags.forEach(([field, flag]) => {
+    const value = flagValue(args, flag);
+    if (value != null && resource.editable.includes(field)) {
+      patch[field] = field === "actionTimeoutSeconds" ? Number(value) : value;
+    }
+  });
+  [
+    ["isArchived", "--archive", true],
+    ["isArchived", "--restore", false],
+    ["isEnabled", "--enable", true],
+    ["isEnabled", "--disable", false],
+    ["isActive", "--active", true],
+    ["isActive", "--inactive", false]
+  ].forEach(([field, flag, value]) => {
+    if (args.includes(flag) && resource.editable.includes(field)) patch[field] = value;
+  });
+  const config = await readValue(flagValue(args, "--config"), "--config");
+  if (config != null && resource.editable.includes("config")) {
+    try {
+      patch.config = JSON.parse(config);
+    } catch {
+      throw new Error("--config must be valid JSON (or @<file> containing JSON).");
+    }
+  }
+  const current = await readResource(id, resource);
+  const name2 = flagValue(args, "--name");
+  if (name2 != null && idTableByPrefix(id) === "action_runner") {
+    const result = await gqlRequest(
+      `mutation CliRenameRunner($id: String!, $name: String!) {
+        updateIdentity(input: { id: $id, patch: { name: $name } }) { identity { id } }
+      }`,
+      { id: current.identityId, name: name2 }
+    );
+    if (result.updateIdentity?.identity == null) throw new Error(`Runner ${id} could not be renamed; check your workspace role.`);
+  }
+  if (Object.keys(patch).length > 0) {
+    const result = await gqlRequest(
+      `mutation CliUpdateResource($id: String!, $patch: ${resource.patch}!) {
+        ${resource.mutation}(input: { id: $id, patch: $patch }) { updated: ${resource.result} { id } }
+      }`,
+      { id: current.id, patch }
+    );
+    if (result[resource.mutation]?.updated == null) throw new Error(`Resource ${id} was not updated; check that it exists and your workspace role allows editing.`);
+  } else if (!(name2 != null && idTableByPrefix(id) === "action_runner")) {
+    throw new Error(`No supported changes supplied for ${id}.`);
+  }
+  printResult(await readResource(current.id, resource), resolveFormat(flagValue(args, "-o", "--output")));
+};
+
 // src/commands/open.ts
 var ROUTE_BY_TYPE = {
   automation: "automations",
@@ -35862,7 +35965,7 @@ var ROUTE_BY_TABLE = {
 var runOpen = async (args) => {
   const filter2 = args.find((a) => !a.startsWith("-"));
   const { organizationId } = await getAccessToken();
-  const url = (() => {
+  const url = await (async () => {
     const manifest = (() => {
       try {
         return readManifest(findWorkspaceRoot());
@@ -35875,11 +35978,11 @@ var runOpen = async (args) => {
         return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/workspaces/${manifest.workspaceId}`;
       }
       const match = Object.entries(manifest.resources).find(
-        ([id, r]) => id === filter2 || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
+        ([id2, r]) => id2.toLowerCase() === filter2.toLowerCase() || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
       );
       if (match != null) {
-        const [id, resource] = match;
-        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource.type]}/${id}`;
+        const [id2, resource2] = match;
+        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource2.type]}/${id2}`;
       }
     }
     if (filter2 == null) {
@@ -35894,7 +35997,9 @@ var runOpen = async (args) => {
         `Nothing matched "${filter2}" (not a tracked resource or a recognized id prefix).`
       );
     }
-    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${route}/${filter2}`;
+    const resource = table == null ? void 0 : resources[table];
+    const id = resource == null ? filter2 : (await readResource(filter2, resource)).id;
+    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${route}/${id}`;
   })();
   process.stdout.write(`${url}
 `);
@@ -36839,108 +36944,6 @@ var runReport = async (args) => {
   );
 };
 
-// src/commands/resource.ts
-var resources = {
-  workspace: { collection: "workspaces", mutation: "updateWorkspace", result: "workspace", patch: "WorkspacePatch", fields: "id name description isArchived", editable: ["name", "description", "isArchived"] },
-  automation: { collection: "automations", mutation: "updateAutomation", result: "automation", patch: "AutomationPatch", fields: "id name description isArchived isActive workspaceId", editable: ["name", "description", "isArchived", "isActive"] },
-  function: { collection: "functions", mutation: "updateFunction", result: "function", patch: "FunctionPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
-  web_page: { collection: "webPages", mutation: "updateWebPage", result: "webPage", patch: "WebPagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
-  printable_page: { collection: "printablePages", mutation: "updatePrintablePage", result: "printablePage", patch: "PrintablePagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
-  agent: { collection: "agents", mutation: "updateAgent", result: "agent", patch: "AgentPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
-  integration: { collection: "integrations", mutation: "updateIntegration", result: "integration", patch: "IntegrationPatch", fields: "id name description isArchived integrationTypeId workspaceId", editable: ["name", "description", "isArchived", "integrationTypeId"] },
-  table_space: { collection: "tableSpaces", mutation: "updateTableSpace", result: "tableSpace", patch: "TableSpacePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  data_stream: { collection: "dataStreams", mutation: "updateDataStream", result: "dataStream", patch: "DataStreamPatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  knowledge_base: { collection: "knowledgeBases", mutation: "updateKnowledgeBase", result: "knowledgeBase", patch: "KnowledgeBasePatch", fields: "id name description isArchived embeddingModel workspaceId", editable: ["name", "description", "isArchived"] },
-  data_file: { collection: "dataFiles", mutation: "updateDataFile", result: "dataFile", patch: "DataFilePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  action_runner: { collection: "actionRunners", mutation: "updateActionRunner", result: "actionRunner", patch: "ActionRunnerPatch", fields: "id isArchived actionTimeoutSeconds config workspaceId identityId identity { name }", editable: ["isArchived", "actionTimeoutSeconds", "config"] }
-  // Keyed by table so `idTableByPrefix` can index it; `satisfies` rejects a key
-  // the registry does not know.
-};
-var resourceFor = (id) => {
-  const table = idTableByPrefix(id);
-  const resource = table == null ? void 0 : resources[table];
-  if (resource == null) throw new Error(`Unsupported resource id: ${id}`);
-  return resource;
-};
-var readResource = async (id, resource) => {
-  const data = await gqlRequest(
-    `query CliResource($id: String!) {
-      ${resource.collection}(condition: { id: $id }, includeArchived: YES, first: 1) {
-        nodes { ${resource.fields} }
-      }
-    }`,
-    { id }
-  );
-  const row = data[resource.collection]?.nodes[0];
-  if (row == null) throw new Error(`Resource ${id} not found.`);
-  return row;
-};
-var runResource = async (args) => {
-  const [operation, id] = args;
-  if (operation !== "show" && operation !== "update" || id == null) {
-    throw new Error("Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]");
-  }
-  const resource = resourceFor(id);
-  if (operation === "show") {
-    printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
-    return;
-  }
-  const patch = {};
-  const scalarFlags = [
-    ["name", "--name"],
-    ["description", "--description"],
-    ["integrationTypeId", "--type"],
-    ["actionTimeoutSeconds", "--timeout"]
-  ];
-  scalarFlags.forEach(([field, flag]) => {
-    const value = flagValue(args, flag);
-    if (value != null && resource.editable.includes(field)) {
-      patch[field] = field === "actionTimeoutSeconds" ? Number(value) : value;
-    }
-  });
-  [
-    ["isArchived", "--archive", true],
-    ["isArchived", "--restore", false],
-    ["isEnabled", "--enable", true],
-    ["isEnabled", "--disable", false],
-    ["isActive", "--active", true],
-    ["isActive", "--inactive", false]
-  ].forEach(([field, flag, value]) => {
-    if (args.includes(flag) && resource.editable.includes(field)) patch[field] = value;
-  });
-  const config = await readValue(flagValue(args, "--config"), "--config");
-  if (config != null && resource.editable.includes("config")) {
-    try {
-      patch.config = JSON.parse(config);
-    } catch {
-      throw new Error("--config must be valid JSON (or @<file> containing JSON).");
-    }
-  }
-  const name2 = flagValue(args, "--name");
-  if (name2 != null && idTableByPrefix(id) === "action_runner") {
-    const current = await readResource(id, resource);
-    const result = await gqlRequest(
-      `mutation CliRenameRunner($id: String!, $name: String!) {
-        updateIdentity(input: { id: $id, patch: { name: $name } }) { identity { id } }
-      }`,
-      { id: current.identityId, name: name2 }
-    );
-    if (result.updateIdentity?.identity == null) throw new Error(`Runner ${id} could not be renamed; check your workspace role.`);
-  }
-  if (Object.keys(patch).length > 0) {
-    const result = await gqlRequest(
-      `mutation CliUpdateResource($id: String!, $patch: ${resource.patch}!) {
-        ${resource.mutation}(input: { id: $id, patch: $patch }) { updated: ${resource.result} { id } }
-      }`,
-      { id, patch }
-    );
-    if (result[resource.mutation]?.updated == null) throw new Error(`Resource ${id} was not updated; check that it exists and your workspace role allows editing.`);
-  } else if (!(name2 != null && idTableByPrefix(id) === "action_runner")) {
-    throw new Error(`No supported changes supplied for ${id}.`);
-  }
-  printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
-};
-
 // src/docs/bestPractices.ts
 var platform2 = `# OverAI platform primer
 
@@ -37056,7 +37059,20 @@ A page version's config JSON carries the code; the CLI splits it into
 language, customTitle, hideTopBar, ...). Push reassembles them.
 
 - Web pages are React (TSX). Printable pages are React or Liquid.
-- Web page config authorizationMode defaults to "workspace" for shared access.
+- Web page config authorizationMode defaults to "workspace": every end user
+  who opens the page gets a workspace token that can read AND write every
+  table space in the workspace and any shared into it, call any function it
+  reaches, trigger any of its automations, and call any agent visible to it.
+  Four rules follow:
+  1. The workspace is the unit of trust. Everything in it trusts everything
+     else, and a page's end users count as "in it."
+  2. A public workspace is public all the way down. Public (or
+     password-protected) is a workspace setting, not a page setting; every table space, function, automation
+     and agent in it is reachable by anyone who can open a page.
+  3. Sharing into a workspace extends its trust. A table space shared into a
+     public or password-protected workspace is public.
+  4. Cross a trust line with a function, not a table. Keep data in a private
+     workspace and share a function into the page's workspace.
   Opt into "viewer" for personal pages spanning the signed-in viewer's workspaces.
   Page code uses their permissions; results/access errors can differ by user.
   Public links require sign-in. Save and deploy publishes the mode with the code.
@@ -37102,8 +37118,9 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
   conversation helpers throw), and author-requiring writes like
-  env.DFxxx.saveVersion 401. Reads use the workspace's own access, so treat
-  anything the page can query as public.
+  env.DFxxx.saveVersion 401. The page runs on the workspace token, so anyone
+  with the link can read and write every table space and call every function,
+  automation and agent the workspace reaches (rule 2 above).
 - meta.json \`runtime\`: "v2" serves the page from its own origin (separate
   process, real localStorage/cookies \u2014 no noSandbox needed); absent or "v1" is
   the sandboxed srcdoc iframe. Anything else is rejected on push.
@@ -37149,11 +37166,15 @@ esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
 executionMemory MB, callerAccess).
 
 - New functions allow only callers with workspace access by default. Set
-  callerAccess to "public" in meta.json only when an unauthenticated endpoint is
-  intended. Existing functions retain their saved policy when older meta.json
-  files omit this field. The policy is versioned: deploy the saved version to
-  change who can call the live endpoint. Workspace uses Authorization for the
-  platform bearer token; put additional application credentials in another header.
+  callerAccess to "organization" to accept members of the function's organization
+  or tokens from any private workspace in that organization without a share.
+  A public-workspace token does not qualify; when a token has both workspace and
+  user claims, the workspace claim takes precedence. Set callerAccess to "public"
+  only when an unauthenticated endpoint is intended. Existing functions retain
+  their saved policy when older meta.json files omit this field. The policy is
+  versioned: deploy the saved version to change live access. Use Authorization
+  for the platform bearer token; put application credentials in another header.
+  Test as a user, a workspace, and anonymous before deploying.
 - Functions are full HTTP apps: method + sub-path are forwarded to your code,
   and each execution records requestMethod/requestPath. Callers reach a route
   with env.FNxxx.call({ method, path: "/features/123" }) \u2014 path defaults to the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.6",
+  "version": "0.14.7",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",