@overaihq/cli 0.14.6 → 0.14.8

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   itemFilterExpressionRootSchema,
   reactDefaultTemplate,
   webPageConfigSchema
-} from "./chunk-4QWKERK2.js";
+} from "./chunk-7BY65TM4.js";
 import {
   external_exports
 } from "./chunk-PF6GZFT4.js";
@@ -8000,12 +8000,12 @@ var require_dom = __commonJS({
               if (node !== base && node.nodeType === ELEMENT_NODE) {
                 var nodeClassNames = node.getAttribute("class");
                 if (nodeClassNames) {
-                  var matches = classNames === nodeClassNames;
-                  if (!matches) {
+                  var matches2 = classNames === nodeClassNames;
+                  if (!matches2) {
                     var nodeClassNamesSet = toOrderedSet(nodeClassNames);
-                    matches = classNamesSet.every(arrayIncludes2(nodeClassNamesSet));
+                    matches2 = classNamesSet.every(arrayIncludes2(nodeClassNamesSet));
                   }
-                  if (matches) {
+                  if (matches2) {
                     ls.push(node);
                   }
                 }
@@ -13757,11 +13757,11 @@ var require_lib2 = __commonJS({
       }
       addComment(comment) {
         if (this.flowPragma === void 0) {
-          const matches = FLOW_PRAGMA_REGEX.exec(comment.value);
-          if (!matches) ;
-          else if (matches[1] === "flow") {
+          const matches2 = FLOW_PRAGMA_REGEX.exec(comment.value);
+          if (!matches2) ;
+          else if (matches2[1] === "flow") {
             this.flowPragma = "flow";
-          } else if (matches[1] === "noflow") {
+          } else if (matches2[1] === "noflow") {
             this.flowPragma = "noflow";
           } else {
             throw new Error("Unexpected flow pragma");
@@ -26793,42 +26793,8 @@ var expiresIn = (at) => {
   return hours < 48 ? `${String(hours)}h` : `${String(Math.floor(hours / 24))}d`;
 };
 
-// ../common/src/stdlib/iife.ts
-var iife = (fn2) => fn2();
-
-// ../common/src/stdlib/omit.ts
-var omit = (obj, ...keys) => {
-  const result = { ...obj };
-  keys.forEach((key) => delete result[key]);
-  return result;
-};
-
-// src/api.ts
-var commandApiBaseUrl;
-var explicitRemote;
-var cloneRemote;
-var setRemoteScope = (apiBaseUrl_) => {
-  if (commandApiBaseUrl != null && commandApiBaseUrl !== apiBaseUrl_)
-    throw new Error("Cannot change remote after a command has started.");
-  explicitRemote = apiBaseUrl_;
-};
-var setCloneRemote = (apiBaseUrl_, organizationId) => {
-  cloneRemote = { apiBaseUrl: apiBaseUrl_, organizationId };
-};
-var apiBaseUrl = () => commandApiBaseUrl ??= iife(() => {
-  if (apiBaseUrlOverride != null) return apiBaseUrlOverride;
-  if (explicitRemote != null) return explicitRemote;
-  const store = readStore();
-  const override = orgOverride();
-  if (override?.apiBaseUrl != null) return override.apiBaseUrl;
-  if (cloneRemote != null && (override == null || override.orgId === cloneRemote.organizationId))
-    return cloneRemote.apiBaseUrl;
-  const overrideHome = override == null ? void 0 : remoteForOrg(override.orgId, store);
-  if (overrideHome != null) return overrideHome;
-  if (cloneRemote != null) return cloneRemote.apiBaseUrl;
-  return (orgScopeOverride == null ? void 0 : remoteForOrg(orgScopeOverride, store)) ?? defaultApiBaseUrl(store);
-});
-var AuthRpcError = class extends Error {
+// ../sdk/src/trpc.ts
+var TrpcError = class extends Error {
   constructor(status, message) {
     super(message);
     this.status = status;
@@ -26838,7 +26804,7 @@ var AuthRpcError = class extends Error {
 var trpcResult = async (res, procedure) => {
   const body = await res.json().catch(() => null);
   if (body != null && "error" in body) {
-    throw new AuthRpcError(
+    throw new TrpcError(
       res.status,
       body.error.message || `${procedure} failed (${String(res.status)})`
     );
@@ -26848,7 +26814,7 @@ var trpcResult = async (res, procedure) => {
   }
   return body.result.data;
 };
-var trpcMutation = async (procedure, input, baseUrl = apiBaseUrl()) => {
+var unauthenticatedTrpc = async (baseUrl, procedure, input) => {
   const res = await fetch(
     `${baseUrl}/v1/utils/trpc/unauthenticated/${procedure}`,
     {
@@ -26860,33 +26826,215 @@ var trpcMutation = async (procedure, input, baseUrl = apiBaseUrl()) => {
   );
   return trpcResult(res, procedure);
 };
-var exchangeCliAuthCode = (code, codeVerifier) => trpcMutation("exchangeCliAuthCode", { code, codeVerifier });
-var exchangeSessionToken = (refreshToken, destinationOrgId, backend = apiBaseUrl()) => trpcMutation(
-  "exchangeSessionToken",
-  { refreshToken, destinationOrgId },
-  backend
-);
-var signOutHeadless = (refreshToken, baseUrl = apiBaseUrl()) => trpcMutation(
-  "signOutHeadless",
-  { refreshToken },
-  baseUrl
-);
-var cancelCliOrgSession = (sourceSessionId, sourceRefreshToken, destinationOrgId, requestId, backend = apiBaseUrl()) => trpcMutation(
-  "cancelCliOrgSession",
-  { sourceSessionId, sourceRefreshToken, destinationOrgId, requestId },
-  backend
-);
-var InteractiveSignInRequired = class extends Error {
+
+// ../sdk/src/auth.ts
+var exchangeSessionToken = (baseUrl, refreshToken, destinationOrgId) => unauthenticatedTrpc(baseUrl, "exchangeSessionToken", {
+  refreshToken,
+  destinationOrgId
+});
+
+// ../sdk/src/error.ts
+var OverAIError = class extends Error {
+  /** HTTP status; 200 for a GraphQL errors-array failure. */
+  status;
+  /** URL pathname of the request, "" when unknown. */
+  path;
+  /** Parsed JSON body, the raw string when not JSON, or null. */
+  body;
+  /** The org the request ran as, when known. */
+  organizationId;
+  /** GraphQL errors array, when that is the cause. */
+  errors;
+  constructor(message, fields) {
+    super(message);
+    this.status = fields.status;
+    this.path = fields.path;
+    this.body = fields.body;
+    this.organizationId = fields.organizationId;
+    if (fields.errors != null) this.errors = fields.errors;
+  }
+};
+var responsePath = (res) => {
+  try {
+    return new URL(res.url).pathname;
+  } catch {
+    return "";
+  }
+};
+var STATUS_TEXT = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  409: "Conflict",
+  413: "Payload Too Large",
+  429: "Too Many Requests",
+  500: "Internal Server Error",
+  503: "Service Unavailable"
 };
+var apiError = (label, res, rawBody, organizationId) => {
+  const body = (() => {
+    try {
+      return JSON.parse(rawBody);
+    } catch {
+      return rawBody;
+    }
+  })();
+  const structured = typeof body === "object" && body != null ? body : null;
+  const field = structured?.error ?? structured?.message;
+  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
+  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
+  const path = responsePath(res);
+  const fields = { status: res.status, path, body, organizationId };
+  if (reason != null) return new OverAIError(reason, fields);
+  return new OverAIError(
+    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
+  ${path}`}${organizationId == null ? "" : `
+  Asked as org ${organizationId}.`}`,
+    fields
+  );
+};
+
+// ../sdk/src/jwt.ts
 var decodeJwtClaims = (token) => {
   const payload = token.split(".")[1];
   if (payload == null) return {};
   try {
-    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    const binary = atob(payload.replaceAll("-", "+").replaceAll("_", "/"));
+    return JSON.parse(
+      new TextDecoder().decode(
+        Uint8Array.from(binary, (char) => char.charCodeAt(0))
+      )
+    );
   } catch {
     return {};
   }
 };
+
+// ../sdk/src/tokens.ts
+var exchangeSchema = external_exports.object({ token: external_exports.string(), expiresIn: external_exports.number() });
+var staticToken = (jwt) => () => jwt;
+
+// ../sdk/src/client.ts
+var OverAIClient = class {
+  baseUrl;
+  #token;
+  #claims = null;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.#token = typeof options.token === "string" ? staticToken(options.token) : options.token;
+  }
+  /** Authenticated fetch to `${baseUrl}${path}`; sets Authorization: Bearer <token>. Does not throw on non-2xx. */
+  async fetch(path, init) {
+    const token = await this.#token();
+    this.#claims = decodeJwtClaims(token);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(`${this.baseUrl}${path}`, { ...init, headers });
+  }
+  /**
+   * POST /v2/graphql. Throws with the server's error messages — callers (and
+   * agents driving them) need the actual reason, not a status code.
+   */
+  async graphql(query, variables) {
+    const res = await this.fetch("/v2/graphql", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ query, variables })
+    });
+    const raw2 = await res.text();
+    const body = (() => {
+      try {
+        return JSON.parse(raw2);
+      } catch {
+        return null;
+      }
+    })();
+    const organizationId = this.claims()?.org ?? null;
+    if (body?.errors != null && body.errors.length > 0) {
+      throw new OverAIError(body.errors.map((e) => e.message).join("; "), {
+        status: res.status,
+        path: responsePath(res),
+        body,
+        organizationId,
+        errors: body.errors
+      });
+    }
+    if (!res.ok) throw apiError("graphql", res, raw2, organizationId);
+    if (body?.data == null) {
+      throw new OverAIError("graphql returned no data and no errors.", {
+        status: res.status,
+        path: responsePath(res),
+        body,
+        organizationId
+      });
+    }
+    return body.data;
+  }
+  /** POST to the JWT-gated user tRPC router; returns the procedure's data. */
+  async trpc(procedure, input) {
+    const res = await this.fetch(`/v1/utils/trpc/${procedure}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(input)
+    });
+    return trpcResult(res, procedure);
+  }
+  /** Claims of the JWT most recently obtained from the token source, or null before any request. Display only. */
+  claims() {
+    return this.#claims;
+  }
+};
+var createClient = (options) => new OverAIClient(options);
+
+// ../common/src/stdlib/iife.ts
+var iife = (fn2) => fn2();
+
+// ../common/src/stdlib/omit.ts
+var omit = (obj, ...keys) => {
+  const result = { ...obj };
+  keys.forEach((key) => delete result[key]);
+  return result;
+};
+
+// src/api.ts
+var commandApiBaseUrl;
+var explicitRemote;
+var cloneRemote;
+var setRemoteScope = (apiBaseUrl_) => {
+  if (commandApiBaseUrl != null && commandApiBaseUrl !== apiBaseUrl_)
+    throw new Error("Cannot change remote after a command has started.");
+  explicitRemote = apiBaseUrl_;
+};
+var setCloneRemote = (apiBaseUrl_, organizationId) => {
+  cloneRemote = { apiBaseUrl: apiBaseUrl_, organizationId };
+};
+var apiBaseUrl = () => commandApiBaseUrl ??= iife(() => {
+  if (apiBaseUrlOverride != null) return apiBaseUrlOverride;
+  if (explicitRemote != null) return explicitRemote;
+  const store = readStore();
+  const override = orgOverride();
+  if (override?.apiBaseUrl != null) return override.apiBaseUrl;
+  if (cloneRemote != null && (override == null || override.orgId === cloneRemote.organizationId))
+    return cloneRemote.apiBaseUrl;
+  const overrideHome = override == null ? void 0 : remoteForOrg(override.orgId, store);
+  if (overrideHome != null) return overrideHome;
+  if (cloneRemote != null) return cloneRemote.apiBaseUrl;
+  return (orgScopeOverride == null ? void 0 : remoteForOrg(orgScopeOverride, store)) ?? defaultApiBaseUrl(store);
+});
+var exchangeCliAuthCode = (code, codeVerifier) => unauthenticatedTrpc(apiBaseUrl(), "exchangeCliAuthCode", { code, codeVerifier });
+var exchangeSessionToken2 = (refreshToken, destinationOrgId, backend = apiBaseUrl()) => exchangeSessionToken(backend, refreshToken, destinationOrgId);
+var signOutHeadless = (refreshToken, baseUrl = apiBaseUrl()) => unauthenticatedTrpc(baseUrl, "signOutHeadless", {
+  refreshToken
+});
+var cancelCliOrgSession = (sourceSessionId, sourceRefreshToken, destinationOrgId, requestId, backend = apiBaseUrl()) => unauthenticatedTrpc(backend, "cancelCliOrgSession", {
+  sourceSessionId,
+  sourceRefreshToken,
+  destinationOrgId,
+  requestId
+});
+var InteractiveSignInRequired = class extends Error {
+};
 var orgScopeOverride = null;
 var commandContext;
 var setOrgScope = (organizationId) => {
@@ -26961,9 +27109,9 @@ var getAccessToken = async () => {
     }
     const result = await (async () => {
       if (existing != null) {
-        return exchangeSessionToken(existing.refreshToken, null).catch(
+        return exchangeSessionToken2(existing.refreshToken, null).catch(
           (error) => {
-            if (error instanceof AuthRpcError && (error.status === 400 || error.status === 401))
+            if (error instanceof TrpcError && (error.status === 400 || error.status === 401))
               throw new InteractiveSignInRequired(
                 `Session expired or revoked. ${signin}`
               );
@@ -26977,11 +27125,11 @@ var getAccessToken = async () => {
       );
       for (const source of candidates) {
         if (source.accessToken == null || decodeJwtClaims(source.accessToken).sid == null) {
-          const refreshed = await exchangeSessionToken(
+          const refreshed = await exchangeSessionToken2(
             source.refreshToken,
             null
           ).catch((error) => {
-            if (error instanceof AuthRpcError && (error.status === 400 || error.status === 401))
+            if (error instanceof TrpcError && (error.status === 400 || error.status === 401))
               return null;
             throw error;
           });
@@ -27018,7 +27166,8 @@ var getAccessToken = async () => {
         };
         deployment.pending[target.organizationId] = operation;
         writeStore(store);
-        const response = await trpcMutation(
+        const response = await unauthenticatedTrpc(
+          baseUrl,
           "establishCliOrgSession",
           {
             refreshToken: source.refreshToken,
@@ -27026,8 +27175,7 @@ var getAccessToken = async () => {
             requestId: operation.requestId
           }
         ).catch((error) => {
-          if (error instanceof AuthRpcError && error.status === 401)
-            return null;
+          if (error instanceof TrpcError && error.status === 401) return null;
           throw new Error(
             `Could not establish an independent org session: ${error instanceof Error ? error.message : String(error)}. No legacy switch was attempted.`
           );
@@ -27080,20 +27228,16 @@ var getAccessToken = async () => {
 var accessTokenForSavedSession = async (backend, organizationId) => withStoreLock(async (store) => {
   const session = store.deployments[backend]?.sessions[organizationId];
   if (session == null)
-    throw new InteractiveSignInRequired(
-      signinHint(organizationId, backend)
-    );
+    throw new InteractiveSignInRequired(signinHint(organizationId, backend));
   if (session.accessToken != null && (session.accessTokenExpiresAt ?? 0) > Date.now() + 6e4)
     return session.accessToken;
-  const result = await exchangeSessionToken(
+  const result = await exchangeSessionToken2(
     session.refreshToken,
     null,
     backend
   );
   if (result.type !== "success")
-    throw new InteractiveSignInRequired(
-      signinHint(organizationId, backend)
-    );
+    throw new InteractiveSignInRequired(signinHint(organizationId, backend));
   if (decodeJwtClaims(result.token).org !== organizationId)
     throw new Error(
       "The auth server returned a session for a different org or identity."
@@ -27105,59 +27249,19 @@ var accessTokenForSavedSession = async (backend, organizationId) => withStoreLoc
   writeStore(store);
   return result.token;
 });
-var v2Fetch = async (path, init) => {
-  const auth = await getAccessToken();
-  const headers = new Headers(init?.headers);
-  headers.set("Authorization", `Bearer ${auth.token}`);
-  return fetch(`${apiBaseUrl()}${path}`, { ...init, headers });
-};
-var STATUS_TEXT = {
-  400: "Bad Request",
-  401: "Unauthorized",
-  403: "Forbidden",
-  404: "Not Found",
-  409: "Conflict",
-  413: "Payload Too Large",
-  429: "Too Many Requests",
-  500: "Internal Server Error",
-  503: "Service Unavailable"
-};
-var v2Error = (label, res, rawBody) => {
-  const structured = (() => {
-    try {
-      return JSON.parse(rawBody);
-    } catch {
-      return null;
-    }
-  })();
-  const field = structured?.error ?? structured?.message;
-  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
-  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
-  const orgHint = res.status === 404 || res.status === 403 ? `
-  If it lives in another org, name that org: overai --org <ref> ... (\`overai org list\` shows them, \`overai org alias\` your shorthands).` : "";
-  if (reason != null) return new Error(`${reason}${orgHint}`);
-  const path = (() => {
-    try {
-      return new URL(res.url).pathname;
-    } catch {
-      return "";
-    }
-  })();
-  const org = scopedOrgId();
-  return new Error(
-    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
-  ${path}`}${org == null ? "" : `
-  Asked as org ${org}.`}${orgHint}`
-  );
-};
-var userTrpcMutation = async (procedure, input) => {
-  const res = await v2Fetch(`/v1/utils/trpc/${procedure}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  return trpcResult(res, procedure);
-};
+var cliClient = () => createClient({
+  baseUrl: apiBaseUrl(),
+  token: async () => (await getAccessToken()).token
+});
+var v2Fetch = async (path, init) => cliClient().fetch(path, init);
+var v2Error = (label, res, rawBody) => withOrgHint(apiError(label, res, rawBody, scopedOrgId()));
+var withOrgHint = (error) => {
+  if (error.status === 404 || error.status === 403)
+    error.message = `${error.message}
+  If it lives in another org, name that org: overai --org <ref> ... (\`overai org list\` shows them, \`overai org alias\` your shorthands).`;
+  return error;
+};
+var userTrpcMutation = async (procedure, input) => cliClient().trpc(procedure, input);
 
 // src/auth.ts
 import { randomBytes as randomBytes2 } from "crypto";
@@ -27707,30 +27811,11 @@ import { createInterface } from "readline";
 
 // src/gql.ts
 var gqlRequest = async (query, variables) => {
-  const res = await v2Fetch("/v2/graphql", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ query, variables })
-  });
-  const raw2 = await res.text();
-  const body = (() => {
-    try {
-      return JSON.parse(raw2);
-    } catch {
-      return null;
-    }
-  })();
-  if (body?.errors != null && body.errors.length > 0) {
-    throw Object.assign(
-      new Error(body.errors.map((e) => e.message).join("; ")),
-      { errors: body.errors }
-    );
-  }
-  if (!res.ok) throw v2Error("graphql", res, raw2);
-  if (body?.data == null) {
-    throw new Error("graphql returned no data and no errors.");
+  try {
+    return await cliClient().graphql(query, variables);
+  } catch (error) {
+    throw error instanceof OverAIError && error.errors == null ? withOrgHint(error) : error;
   }
-  return body.data;
 };
 
 // src/commands/agent.ts
@@ -28210,7 +28295,7 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-ICODVQMY.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-SH7GBOWZ.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
@@ -28970,7 +29055,7 @@ var runRunner = async (args) => {
 // ../common/src/liquidjs/liquidjs.ts
 var import_jmespath = __toESM(require_jmespath(), 1);
 
-// ../../node_modules/.pnpm/liquidjs@10.29.0/node_modules/liquidjs/dist/liquid.node.mjs
+// ../../node_modules/.pnpm/liquidjs@10.30.0/node_modules/liquidjs/dist/liquid.node.mjs
 import { PassThrough } from "stream";
 import { sep, extname, resolve as resolve$1, dirname as dirname$1 } from "path";
 import { statSync, readFileSync as readFileSync$1, realpathSync, stat, readFile as readFile$1, realpath } from "fs";
@@ -29318,8 +29403,8 @@ function assertEmpty(predicate, message = `unexpected ${JSON.stringify(predicate
   assert(!predicate, message);
 }
 var NullDrop = class extends Drop {
-  equals(value) {
-    return isNil(toValue(value));
+  *equals(value) {
+    return isNil(yield toValue(value));
   }
   gt() {
     return false;
@@ -29338,10 +29423,10 @@ var NullDrop = class extends Drop {
   }
 };
 var EmptyDrop = class _EmptyDrop extends Drop {
-  equals(value) {
+  *equals(value) {
     if (value instanceof _EmptyDrop)
       return false;
-    value = toValue(value);
+    value = yield toValue(value);
     if (isString(value) || isArray(value))
       return value.length === 0;
     if (isObject(value))
@@ -29368,14 +29453,14 @@ var EmptyDrop = class _EmptyDrop extends Drop {
   }
 };
 var BlankDrop = class _BlankDrop extends EmptyDrop {
-  equals(value) {
+  *equals(value) {
     if (value === false)
       return true;
-    if (isNil(toValue(value)))
+    if (isNil(yield toValue(value)))
       return true;
     if (isString(value))
       return /^\s*$/.test(value);
-    return super.equals(value);
+    return yield super.equals(value);
   }
   static is(value) {
     return value instanceof _BlankDrop;
@@ -29601,10 +29686,8 @@ function getDayOfYear(d) {
   return num + d.getDate();
 }
 function getWeekOfYear(d, startDay) {
-  const now = getDayOfYear(d) + (startDay - d.getDay());
-  const jan1 = new Date(d.getFullYear(), 0, 1);
-  const then = 7 - jan1.getDay() + startDay;
-  return String(Math.floor((now - then) / 7) + 1);
+  const daysSinceStartDay = (d.getDay() - startDay + 7) % 7;
+  return String(Math.floor((getDayOfYear(d) - 1 - daysSinceStartDay + 7) / 7));
 }
 function isLeapYear(d) {
   const year = d.getFullYear();
@@ -29626,9 +29709,10 @@ function ordinal(d) {
   }
 }
 function century(d) {
-  return parseInt(d.getFullYear().toString().substring(0, 2), 10);
+  return Math.floor(d.getFullYear() / 100);
 }
 var padWidths = {
+  C: 2,
   d: 2,
   e: 2,
   H: 2,
@@ -29641,7 +29725,8 @@ var padWidths = {
   M: 2,
   S: 2,
   U: 2,
-  W: 2
+  W: 2,
+  y: 2
 };
 var padSpaceChars = new Set("aAbBceklpP");
 function getTimezoneOffset(d, opts) {
@@ -29685,7 +29770,7 @@ var formatCodes = {
   W: (d) => getWeekOfYear(d, 1),
   x: (d) => d.toLocaleDateString(),
   X: (d) => d.toLocaleTimeString(),
-  y: (d) => d.getFullYear().toString().slice(2, 4),
+  y: (d) => (d.getFullYear() % 100 + 100) % 100,
   Y: (d) => d.getFullYear(),
   z: getTimezoneOffset,
   Z: (d, opts) => d.getTimeZoneName() || getTimezoneOffset(d, opts),
@@ -30260,10 +30345,13 @@ function* evalFilteredValueToken(token, ctx, lenient) {
   }
   return val;
 }
+function* evalTokenValue(token, ctx, lenient = false) {
+  return yield toValue(yield evalToken(token, ctx, lenient));
+}
 function* evalPropertyAccessToken(token, ctx, lenient) {
   const props = [];
   for (const prop of token.props) {
-    props.push(yield evalToken(prop, ctx, false));
+    props.push(yield evalTokenValue(prop, ctx, false));
   }
   try {
     if (token.variable) {
@@ -30282,8 +30370,8 @@ function evalQuotedToken(token) {
   return token.content;
 }
 function* evalRangeToken(token, ctx) {
-  const low = yield evalToken(token.lhs, ctx);
-  const high = yield evalToken(token.rhs, ctx);
+  const low = yield evalTokenValue(token.lhs, ctx);
+  const high = yield evalTokenValue(token.rhs, ctx);
   ctx.memoryLimit.use(high - low + 1);
   return range(+low, +high + 1);
 }
@@ -30314,67 +30402,85 @@ function isFalsy(val, ctx) {
   }
 }
 var defaultOperators = {
-  "==": equals,
-  "!=": (l, r) => !equals(l, r),
-  ">": (l, r) => {
+  "==": function* (l, r) {
+    return yield equals(l, r);
+  },
+  "!=": function* (l, r) {
+    return !(yield equals(l, r));
+  },
+  ">": function* (l, r) {
     if (isComparable(l))
-      return l.gt(r);
+      return yield l.gt(r);
     if (isComparable(r))
-      return r.lt(l);
-    return toValue(l) > toValue(r);
+      return yield r.lt(l);
+    return (yield toValue(l)) > (yield toValue(r));
   },
-  "<": (l, r) => {
+  "<": function* (l, r) {
     if (isComparable(l))
-      return l.lt(r);
+      return yield l.lt(r);
     if (isComparable(r))
-      return r.gt(l);
-    return toValue(l) < toValue(r);
+      return yield r.gt(l);
+    return (yield toValue(l)) < (yield toValue(r));
   },
-  ">=": (l, r) => {
+  ">=": function* (l, r) {
     if (isComparable(l))
-      return l.geq(r);
+      return yield l.geq(r);
     if (isComparable(r))
-      return r.leq(l);
-    return toValue(l) >= toValue(r);
+      return yield r.leq(l);
+    return (yield toValue(l)) >= (yield toValue(r));
   },
-  "<=": (l, r) => {
+  "<=": function* (l, r) {
     if (isComparable(l))
-      return l.leq(r);
+      return yield l.leq(r);
     if (isComparable(r))
-      return r.geq(l);
-    return toValue(l) <= toValue(r);
+      return yield r.geq(l);
+    return (yield toValue(l)) <= (yield toValue(r));
   },
-  "contains": (l, r) => {
-    l = toValue(l);
+  "contains": function* (l, r) {
+    l = yield toValue(l);
     if (isArray(l))
-      return l.some((i) => equals(i, r));
+      return yield arrayIncludes(l, r);
     if (isFunction(l === null || l === void 0 ? void 0 : l.indexOf))
-      return l.indexOf(toValue(r)) > -1;
+      return l.indexOf(yield toValue(r)) > -1;
     return false;
   },
-  "not": (v, ctx) => isFalsy(toValue(v), ctx),
-  "and": (l, r, ctx) => isTruthy(toValue(l), ctx) && isTruthy(toValue(r), ctx),
-  "or": (l, r, ctx) => isTruthy(toValue(l), ctx) || isTruthy(toValue(r), ctx)
+  "not": function* (v, ctx) {
+    return isFalsy(yield toValue(v), ctx);
+  },
+  "and": function* (l, r, ctx) {
+    return isTruthy(yield toValue(l), ctx) && isTruthy(yield toValue(r), ctx);
+  },
+  "or": function* (l, r, ctx) {
+    return isTruthy(yield toValue(l), ctx) || isTruthy(yield toValue(r), ctx);
+  }
 };
-function equals(lhs, rhs) {
+function* equals(lhs, rhs) {
   if (isComparable(lhs))
-    return lhs.equals(rhs);
+    return yield lhs.equals(rhs);
   if (isComparable(rhs))
-    return rhs.equals(lhs);
-  lhs = toValue(lhs);
-  rhs = toValue(rhs);
+    return yield rhs.equals(lhs);
+  lhs = yield toValue(lhs);
+  rhs = yield toValue(rhs);
   if (isArray(lhs)) {
-    return isArray(rhs) && arrayEquals(lhs, rhs);
+    return isArray(rhs) && (yield arrayEquals(lhs, rhs));
   }
   return lhs === rhs;
 }
-function arrayEquals(lhs, rhs) {
+function* arrayEquals(lhs, rhs) {
   if (lhs.length !== rhs.length)
     return false;
-  return !lhs.some((value, i) => !equals(value, rhs[i]));
+  for (let i = 0; i < lhs.length; i++) {
+    if (!(yield equals(lhs[i], rhs[i])))
+      return false;
+  }
+  return true;
 }
-function arrayIncludes(arr, item) {
-  return arr.some((value) => equals(value, item));
+function* arrayIncludes(arr, item) {
+  for (const value of arr) {
+    if (yield equals(value, item))
+      return true;
+  }
+  return false;
 }
 var Node = class {
   constructor(key, value, next, prev) {
@@ -31383,7 +31489,7 @@ var Output = class extends TemplateImpl {
     }
   }
   *render(ctx, emitter) {
-    const val = yield this.value.value(ctx, false);
+    const val = yield toValue(yield this.value.value(ctx, false));
     emitter.write(val);
   }
   *arguments() {
@@ -32107,7 +32213,7 @@ var mathFilters = /* @__PURE__ */ Object.freeze({
   times,
   round
 });
-var url_decode = (x) => decodeURIComponent(stringify(x)).replace(/\+/g, " ");
+var url_decode = (x) => decodeURIComponent(stringify(x).replace(/\+/g, " "));
 var url_encode = (x) => encodeURIComponent(stringify(x)).replace(/%20/g, "+");
 var cgi_escape = (x) => encodeURIComponent(stringify(x)).replace(/%20/g, "+").replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
 var uri_escape = (x) => encodeURI(stringify(x)).replace(/%5B/g, "[").replace(/%5D/g, "]");
@@ -32245,25 +32351,29 @@ function slice(v, begin, length = 1) {
   this.context.memoryLimit.use(length);
   return isArray(v) ? Array.prototype.slice.call(v, begin, begin + length) : String.prototype.slice.call(v, begin, begin + length);
 }
-function expectedMatcher(expected) {
+function* matches(value, expected) {
   if (this.context.opts.jekyllWhere) {
-    return (v) => EmptyDrop.is(expected) ? equals(v, expected) : isArray(v) ? arrayIncludes(v, expected) : equals(v, expected);
-  } else if (expected === void 0) {
-    return (v) => isTruthy(v, this.context);
-  } else {
-    return (v) => equals(v, expected);
-  }
+    if (EmptyDrop.is(expected))
+      return yield equals(value, expected);
+    if (isArray(value))
+      return yield arrayIncludes(value, expected);
+    return yield equals(value, expected);
+  }
+  if (expected === void 0)
+    return isTruthy(value, this.context);
+  return yield equals(value, expected);
 }
 function* filter(include, arr, property, expected) {
-  const values = [];
   arr = toArray(arr);
   this.context.memoryLimit.use(arr.length);
   const token = new Tokenizer(stringify(property)).readScopeValue();
+  const result = [];
   for (const item of arr) {
-    values.push(yield evalToken(token, this.context.spawn(item)));
+    const value = yield evalToken(token, this.context.spawn(item));
+    if ((yield matches.call(this, value, expected)) === include)
+      result.push(item);
   }
-  const matcher = expectedMatcher.call(this, expected);
-  return Array.prototype.filter.call(arr, (_, i) => matcher(values[i]) === include);
+  return result;
 }
 function* filter_exp(include, arr, itemName, exp) {
   const filtered = [];
@@ -32322,10 +32432,9 @@ function* group_by_exp(arr, itemName, exp) {
 function* search(arr, property, expected) {
   const token = new Tokenizer(stringify(property)).readScopeValue();
   const array = toArray(arr);
-  const matcher = expectedMatcher.call(this, expected);
   for (let index = 0; index < array.length; index++) {
     const value = yield evalToken(token, this.context.spawn(array[index]));
-    if (matcher(value))
+    if (yield matches.call(this, value, expected))
       return [index, array[index]];
   }
 }
@@ -32497,17 +32606,32 @@ function prepend(v, arg) {
   this.context.memoryLimit.use(lhs.length + rhs.length);
   return rhs + lhs;
 }
+function getTrimStart(str, chars) {
+  let start = 0;
+  for (const char of str) {
+    if (!chars.has(char))
+      break;
+    start += char.length;
+  }
+  return start;
+}
+function getTrimEnd(str, chars, start = 0) {
+  let end = str.length;
+  while (end > start) {
+    const size2 = end - start >= 2 && str.codePointAt(end - 2) > 65535 ? 2 : 1;
+    if (!chars.has(str.slice(end - size2, end)))
+      break;
+    end -= size2;
+  }
+  return end;
+}
 function lstrip(v, chars) {
   const str = stringify(v);
   this.context.memoryLimit.use(str.length);
   if (chars) {
     chars = stringify(chars);
     this.context.memoryLimit.use(chars.length);
-    for (let i = 0, set = new Set(chars); i < str.length; i++) {
-      if (!set.has(str[i]))
-        return str.slice(i);
-    }
-    return "";
+    return str.slice(getTrimStart(str, new Set(chars)));
   }
   return str.trimStart();
 }
@@ -32548,11 +32672,7 @@ function rstrip(str, chars) {
   if (chars) {
     chars = stringify(chars);
     this.context.memoryLimit.use(chars.length);
-    for (let i = str.length - 1, set = new Set(chars); i >= 0; i--) {
-      if (!set.has(str[i]))
-        return str.slice(0, i + 1);
-    }
-    return "";
+    return str.slice(0, getTrimEnd(str, new Set(chars)));
   }
   return str.trimEnd();
 }
@@ -32570,13 +32690,8 @@ function strip(v, chars) {
   if (chars) {
     const set = new Set(stringify(chars));
     this.context.memoryLimit.use(set.size);
-    let i = 0;
-    let j = str.length - 1;
-    while (set.has(str[i]))
-      i++;
-    while (j >= i && set.has(str[j]))
-      j--;
-    return str.slice(i, j + 1);
+    const start = getTrimStart(str, set);
+    return str.slice(start, getTrimEnd(str, set, start));
   }
   return str.trim();
 }
@@ -32633,7 +32748,7 @@ function truncatewords(v, words = 15, o = "...") {
   const str = stringify(v);
   o = stringify(o);
   this.context.memoryLimit.use(str.length + o.length);
-  const arr = str.split(/\s+/);
+  const arr = str.trimStart().split(/\s+/);
   if (words <= 0)
     words = 1;
   let ret = arr.slice(0, words).join(" ");
@@ -32937,12 +33052,12 @@ var CaseTag = class extends Tag {
   }
   *render(ctx, emitter) {
     const r = this.liquid.renderer;
-    const target = toValue(yield this.value.value(ctx, ctx.opts.lenientIf));
+    const target = yield toValue(yield this.value.value(ctx, ctx.opts.lenientIf));
     let branchHit = false;
     for (const branch of this.branches) {
       for (const valueToken of branch.values) {
         const value = yield evalToken(valueToken, ctx, ctx.opts.lenientIf);
-        if (equals(target, value)) {
+        if (yield equals(target, value)) {
           yield r.renderTemplates(branch.templates, ctx, emitter);
           branchHit = true;
           break;
@@ -33270,7 +33385,7 @@ var IfTag = class extends Tag {
   *render(ctx, emitter) {
     const r = this.liquid.renderer;
     for (const { value, templates } of this.branches) {
-      const v = yield value.value(ctx, ctx.opts.lenientIf);
+      const v = yield toValue(yield value.value(ctx, ctx.opts.lenientIf));
       if (isTruthy(v, ctx)) {
         yield r.renderTemplates(templates, ctx, emitter);
         return;
@@ -33542,7 +33657,7 @@ var UnlessTag = class extends Tag {
   *render(ctx, emitter) {
     const r = this.liquid.renderer;
     for (const { value, test, templates } of this.branches) {
-      const v = yield value.value(ctx, ctx.opts.lenientIf);
+      const v = yield toValue(yield value.value(ctx, ctx.opts.lenientIf));
       if (test(v, ctx)) {
         yield r.renderTemplates(templates, ctx, emitter);
         return;
@@ -33582,7 +33697,7 @@ var EchoTag = class extends Tag {
   *render(ctx, emitter) {
     if (!this.value)
       return;
-    const val = yield this.value.value(ctx, false);
+    const val = yield toValue(yield this.value.value(ctx, false));
     emitter.write(val);
   }
   *arguments() {
@@ -34013,12 +34128,12 @@ var intervalToMilliseconds = (interval, timeUnits = defaultTimeUnits) => {
   if (interval === null) {
     return null;
   }
-  const matches = interval.match(intervalRegex);
-  if (matches === null) {
+  const matches2 = interval.match(intervalRegex);
+  if (matches2 === null) {
     return null;
   }
   let milliseconds = 0;
-  matches.forEach((m) => {
+  matches2.forEach((m) => {
     const numericPart = /(\d+(?:\.\d+)?)/.exec(m)?.[1];
     const unitPart = m.replace(/\d+(?:\.\d+)?/, "").trim();
     if (numericPart && !isNaN(parseFloat(numericPart))) {
@@ -35733,6 +35848,7 @@ var ID_PREFIXES = {
   automation_email_address: { prefix: "aea", body: 10 },
   automation_email_alert: { prefix: "aes", body: 10 },
   automation_error_alert_queue: { prefix: "aeaq", body: 10 },
+  billing_period: { prefix: "bpd", body: 12 },
   browser_automation: { prefix: "bra", body: 10 },
   browser_automation_run: { prefix: "brr", body: 20 },
   browser_session_usage: { prefix: "bsu", body: 12 },
@@ -35837,6 +35953,108 @@ var idTableByPrefix = (id) => {
   return best?.table ?? null;
 };
 
+// src/commands/resource.ts
+var resources = {
+  workspace: { collection: "workspaces", mutation: "updateWorkspace", result: "workspace", patch: "WorkspacePatch", fields: "id name description isArchived", editable: ["name", "description", "isArchived"] },
+  automation: { collection: "automations", mutation: "updateAutomation", result: "automation", patch: "AutomationPatch", fields: "id name description isArchived isActive workspaceId", editable: ["name", "description", "isArchived", "isActive"] },
+  function: { collection: "functions", mutation: "updateFunction", result: "function", patch: "FunctionPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
+  web_page: { collection: "webPages", mutation: "updateWebPage", result: "webPage", patch: "WebPagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
+  printable_page: { collection: "printablePages", mutation: "updatePrintablePage", result: "printablePage", patch: "PrintablePagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
+  agent: { collection: "agents", mutation: "updateAgent", result: "agent", patch: "AgentPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
+  integration: { collection: "integrations", mutation: "updateIntegration", result: "integration", patch: "IntegrationPatch", fields: "id name description isArchived integrationTypeId workspaceId", editable: ["name", "description", "isArchived", "integrationTypeId"] },
+  table_space: { collection: "tableSpaces", mutation: "updateTableSpace", result: "tableSpace", patch: "TableSpacePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  data_stream: { collection: "dataStreams", mutation: "updateDataStream", result: "dataStream", patch: "DataStreamPatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  knowledge_base: { collection: "knowledgeBases", mutation: "updateKnowledgeBase", result: "knowledgeBase", patch: "KnowledgeBasePatch", fields: "id name description isArchived embeddingModel workspaceId", editable: ["name", "description", "isArchived"] },
+  data_file: { collection: "dataFiles", mutation: "updateDataFile", result: "dataFile", patch: "DataFilePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
+  action_runner: { collection: "actionRunners", mutation: "updateActionRunner", result: "actionRunner", patch: "ActionRunnerPatch", fields: "id isArchived actionTimeoutSeconds config workspaceId identityId identity { name }", editable: ["isArchived", "actionTimeoutSeconds", "config"] }
+  // Keyed by table so `idTableByPrefix` can index it; `satisfies` rejects a key
+  // the registry does not know.
+};
+var resourceFor = (id) => {
+  const table = idTableByPrefix(id);
+  const resource = table == null ? void 0 : resources[table];
+  if (resource == null) throw new Error(`Unsupported resource id: ${id}`);
+  return resource;
+};
+var readResource = async (id, resource) => {
+  const data = await gqlRequest(
+    `query CliResource($id: String!) {
+      ${resource.collection}(condition: { idIgnoringCase: $id }, includeArchived: YES, first: 1) {
+        nodes { ${resource.fields} }
+      }
+    }`,
+    { id }
+  );
+  const row = data[resource.collection]?.nodes[0];
+  if (row == null) throw new Error(`Resource ${id} not found.`);
+  return row;
+};
+var runResource = async (args) => {
+  const [operation, id] = args;
+  if (operation !== "show" && operation !== "update" || id == null) {
+    throw new Error("Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]");
+  }
+  const resource = resourceFor(id);
+  if (operation === "show") {
+    printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
+    return;
+  }
+  const patch = {};
+  const scalarFlags = [
+    ["name", "--name"],
+    ["description", "--description"],
+    ["integrationTypeId", "--type"],
+    ["actionTimeoutSeconds", "--timeout"]
+  ];
+  scalarFlags.forEach(([field, flag]) => {
+    const value = flagValue(args, flag);
+    if (value != null && resource.editable.includes(field)) {
+      patch[field] = field === "actionTimeoutSeconds" ? Number(value) : value;
+    }
+  });
+  [
+    ["isArchived", "--archive", true],
+    ["isArchived", "--restore", false],
+    ["isEnabled", "--enable", true],
+    ["isEnabled", "--disable", false],
+    ["isActive", "--active", true],
+    ["isActive", "--inactive", false]
+  ].forEach(([field, flag, value]) => {
+    if (args.includes(flag) && resource.editable.includes(field)) patch[field] = value;
+  });
+  const config = await readValue(flagValue(args, "--config"), "--config");
+  if (config != null && resource.editable.includes("config")) {
+    try {
+      patch.config = JSON.parse(config);
+    } catch {
+      throw new Error("--config must be valid JSON (or @<file> containing JSON).");
+    }
+  }
+  const current = await readResource(id, resource);
+  const name2 = flagValue(args, "--name");
+  if (name2 != null && idTableByPrefix(id) === "action_runner") {
+    const result = await gqlRequest(
+      `mutation CliRenameRunner($id: String!, $name: String!) {
+        updateIdentity(input: { id: $id, patch: { name: $name } }) { identity { id } }
+      }`,
+      { id: current.identityId, name: name2 }
+    );
+    if (result.updateIdentity?.identity == null) throw new Error(`Runner ${id} could not be renamed; check your workspace role.`);
+  }
+  if (Object.keys(patch).length > 0) {
+    const result = await gqlRequest(
+      `mutation CliUpdateResource($id: String!, $patch: ${resource.patch}!) {
+        ${resource.mutation}(input: { id: $id, patch: $patch }) { updated: ${resource.result} { id } }
+      }`,
+      { id: current.id, patch }
+    );
+    if (result[resource.mutation]?.updated == null) throw new Error(`Resource ${id} was not updated; check that it exists and your workspace role allows editing.`);
+  } else if (!(name2 != null && idTableByPrefix(id) === "action_runner")) {
+    throw new Error(`No supported changes supplied for ${id}.`);
+  }
+  printResult(await readResource(current.id, resource), resolveFormat(flagValue(args, "-o", "--output")));
+};
+
 // src/commands/open.ts
 var ROUTE_BY_TYPE = {
   automation: "automations",
@@ -35862,7 +36080,7 @@ var ROUTE_BY_TABLE = {
 var runOpen = async (args) => {
   const filter2 = args.find((a) => !a.startsWith("-"));
   const { organizationId } = await getAccessToken();
-  const url = (() => {
+  const url = await (async () => {
     const manifest = (() => {
       try {
         return readManifest(findWorkspaceRoot());
@@ -35875,11 +36093,11 @@ var runOpen = async (args) => {
         return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/workspaces/${manifest.workspaceId}`;
       }
       const match = Object.entries(manifest.resources).find(
-        ([id, r]) => id === filter2 || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
+        ([id2, r]) => id2.toLowerCase() === filter2.toLowerCase() || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
       );
       if (match != null) {
-        const [id, resource] = match;
-        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource.type]}/${id}`;
+        const [id2, resource2] = match;
+        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource2.type]}/${id2}`;
       }
     }
     if (filter2 == null) {
@@ -35894,7 +36112,9 @@ var runOpen = async (args) => {
         `Nothing matched "${filter2}" (not a tracked resource or a recognized id prefix).`
       );
     }
-    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${route}/${filter2}`;
+    const resource = table == null ? void 0 : resources[table];
+    const id = resource == null ? filter2 : (await readResource(filter2, resource)).id;
+    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${route}/${id}`;
   })();
   process.stdout.write(`${url}
 `);
@@ -36427,15 +36647,15 @@ var parseRef = (raw2) => {
   return n;
 };
 var findResource = (manifest, filter2) => {
-  const matches = Object.entries(manifest.resources).filter(
+  const matches2 = Object.entries(manifest.resources).filter(
     ([id, r]) => id === filter2 || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
   );
-  if (matches.length === 0) throw new Error(`Nothing matched "${filter2}".`);
-  const match = matches[0];
-  if (match == null || matches.length > 1) {
+  if (matches2.length === 0) throw new Error(`Nothing matched "${filter2}".`);
+  const match = matches2[0];
+  if (match == null || matches2.length > 1) {
     throw new Error(
       `"${filter2}" is ambiguous:
-${matches.map(([id, r]) => `  ${r.name} (${id})`).join("\n")}`
+${matches2.map(([id, r]) => `  ${r.name} (${id})`).join("\n")}`
     );
   }
   return match;
@@ -36839,108 +37059,6 @@ var runReport = async (args) => {
   );
 };
 
-// src/commands/resource.ts
-var resources = {
-  workspace: { collection: "workspaces", mutation: "updateWorkspace", result: "workspace", patch: "WorkspacePatch", fields: "id name description isArchived", editable: ["name", "description", "isArchived"] },
-  automation: { collection: "automations", mutation: "updateAutomation", result: "automation", patch: "AutomationPatch", fields: "id name description isArchived isActive workspaceId", editable: ["name", "description", "isArchived", "isActive"] },
-  function: { collection: "functions", mutation: "updateFunction", result: "function", patch: "FunctionPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
-  web_page: { collection: "webPages", mutation: "updateWebPage", result: "webPage", patch: "WebPagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
-  printable_page: { collection: "printablePages", mutation: "updatePrintablePage", result: "printablePage", patch: "PrintablePagePatch", fields: "id name isArchived workspaceId", editable: ["name", "isArchived"] },
-  agent: { collection: "agents", mutation: "updateAgent", result: "agent", patch: "AgentPatch", fields: "id name description isArchived isEnabled workspaceId", editable: ["name", "description", "isArchived", "isEnabled"] },
-  integration: { collection: "integrations", mutation: "updateIntegration", result: "integration", patch: "IntegrationPatch", fields: "id name description isArchived integrationTypeId workspaceId", editable: ["name", "description", "isArchived", "integrationTypeId"] },
-  table_space: { collection: "tableSpaces", mutation: "updateTableSpace", result: "tableSpace", patch: "TableSpacePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  data_stream: { collection: "dataStreams", mutation: "updateDataStream", result: "dataStream", patch: "DataStreamPatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  knowledge_base: { collection: "knowledgeBases", mutation: "updateKnowledgeBase", result: "knowledgeBase", patch: "KnowledgeBasePatch", fields: "id name description isArchived embeddingModel workspaceId", editable: ["name", "description", "isArchived"] },
-  data_file: { collection: "dataFiles", mutation: "updateDataFile", result: "dataFile", patch: "DataFilePatch", fields: "id name description isArchived workspaceId", editable: ["name", "description", "isArchived"] },
-  action_runner: { collection: "actionRunners", mutation: "updateActionRunner", result: "actionRunner", patch: "ActionRunnerPatch", fields: "id isArchived actionTimeoutSeconds config workspaceId identityId identity { name }", editable: ["isArchived", "actionTimeoutSeconds", "config"] }
-  // Keyed by table so `idTableByPrefix` can index it; `satisfies` rejects a key
-  // the registry does not know.
-};
-var resourceFor = (id) => {
-  const table = idTableByPrefix(id);
-  const resource = table == null ? void 0 : resources[table];
-  if (resource == null) throw new Error(`Unsupported resource id: ${id}`);
-  return resource;
-};
-var readResource = async (id, resource) => {
-  const data = await gqlRequest(
-    `query CliResource($id: String!) {
-      ${resource.collection}(condition: { id: $id }, includeArchived: YES, first: 1) {
-        nodes { ${resource.fields} }
-      }
-    }`,
-    { id }
-  );
-  const row = data[resource.collection]?.nodes[0];
-  if (row == null) throw new Error(`Resource ${id} not found.`);
-  return row;
-};
-var runResource = async (args) => {
-  const [operation, id] = args;
-  if (operation !== "show" && operation !== "update" || id == null) {
-    throw new Error("Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]");
-  }
-  const resource = resourceFor(id);
-  if (operation === "show") {
-    printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
-    return;
-  }
-  const patch = {};
-  const scalarFlags = [
-    ["name", "--name"],
-    ["description", "--description"],
-    ["integrationTypeId", "--type"],
-    ["actionTimeoutSeconds", "--timeout"]
-  ];
-  scalarFlags.forEach(([field, flag]) => {
-    const value = flagValue(args, flag);
-    if (value != null && resource.editable.includes(field)) {
-      patch[field] = field === "actionTimeoutSeconds" ? Number(value) : value;
-    }
-  });
-  [
-    ["isArchived", "--archive", true],
-    ["isArchived", "--restore", false],
-    ["isEnabled", "--enable", true],
-    ["isEnabled", "--disable", false],
-    ["isActive", "--active", true],
-    ["isActive", "--inactive", false]
-  ].forEach(([field, flag, value]) => {
-    if (args.includes(flag) && resource.editable.includes(field)) patch[field] = value;
-  });
-  const config = await readValue(flagValue(args, "--config"), "--config");
-  if (config != null && resource.editable.includes("config")) {
-    try {
-      patch.config = JSON.parse(config);
-    } catch {
-      throw new Error("--config must be valid JSON (or @<file> containing JSON).");
-    }
-  }
-  const name2 = flagValue(args, "--name");
-  if (name2 != null && idTableByPrefix(id) === "action_runner") {
-    const current = await readResource(id, resource);
-    const result = await gqlRequest(
-      `mutation CliRenameRunner($id: String!, $name: String!) {
-        updateIdentity(input: { id: $id, patch: { name: $name } }) { identity { id } }
-      }`,
-      { id: current.identityId, name: name2 }
-    );
-    if (result.updateIdentity?.identity == null) throw new Error(`Runner ${id} could not be renamed; check your workspace role.`);
-  }
-  if (Object.keys(patch).length > 0) {
-    const result = await gqlRequest(
-      `mutation CliUpdateResource($id: String!, $patch: ${resource.patch}!) {
-        ${resource.mutation}(input: { id: $id, patch: $patch }) { updated: ${resource.result} { id } }
-      }`,
-      { id, patch }
-    );
-    if (result[resource.mutation]?.updated == null) throw new Error(`Resource ${id} was not updated; check that it exists and your workspace role allows editing.`);
-  } else if (!(name2 != null && idTableByPrefix(id) === "action_runner")) {
-    throw new Error(`No supported changes supplied for ${id}.`);
-  }
-  printResult(await readResource(id, resource), resolveFormat(flagValue(args, "-o", "--output")));
-};
-
 // src/docs/bestPractices.ts
 var platform2 = `# OverAI platform primer
 
@@ -37056,7 +37174,20 @@ A page version's config JSON carries the code; the CLI splits it into
 language, customTitle, hideTopBar, ...). Push reassembles them.
 
 - Web pages are React (TSX). Printable pages are React or Liquid.
-- Web page config authorizationMode defaults to "workspace" for shared access.
+- Web page config authorizationMode defaults to "workspace": every end user
+  who opens the page gets a workspace token that can read AND write every
+  table space in the workspace and any shared into it, call any function it
+  reaches, trigger any of its automations, and call any agent visible to it.
+  Four rules follow:
+  1. The workspace is the unit of trust. Everything in it trusts everything
+     else, and a page's end users count as "in it."
+  2. A public workspace is public all the way down. Public (or
+     password-protected) is a workspace setting, not a page setting; every table space, function, automation
+     and agent in it is reachable by anyone who can open a page.
+  3. Sharing into a workspace extends its trust. A table space shared into a
+     public or password-protected workspace is public.
+  4. Cross a trust line with a function, not a table. Keep data in a private
+     workspace and share a function into the page's workspace.
   Opt into "viewer" for personal pages spanning the signed-in viewer's workspaces.
   Page code uses their permissions; results/access errors can differ by user.
   Public links require sign-in. Save and deploy publishes the mode with the code.
@@ -37102,11 +37233,15 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
   conversation helpers throw), and author-requiring writes like
-  env.DFxxx.saveVersion 401. Reads use the workspace's own access, so treat
-  anything the page can query as public.
+  env.DFxxx.saveVersion 401. The page runs on the workspace token, so anyone
+  with the link can read and write every table space and call every function,
+  automation and agent the workspace reaches (rule 2 above).
 - meta.json \`runtime\`: "v2" serves the page from its own origin (separate
   process, real localStorage/cookies \u2014 no noSandbox needed); absent or "v1" is
   the sandboxed srcdoc iframe. Anything else is rejected on push.
+- meta.json \`permissions\` (v2 only): array of "camera", "microphone",
+  "geolocation", "display-capture", "fullscreen", "screen-wake-lock" the page
+  may prompt for; declare only what it uses. Web Serial/USB/HID need none.
 - Write meta.json flags (noSandbox, hideTopBar) as JSON booleans. A page cloned
   before the shape settled may hold the strings "true"/"false" \u2014 those still
   push, anything else is rejected. noSandbox drops the iframe sandbox, which
@@ -37149,11 +37284,15 @@ esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
 executionMemory MB, callerAccess).
 
 - New functions allow only callers with workspace access by default. Set
-  callerAccess to "public" in meta.json only when an unauthenticated endpoint is
-  intended. Existing functions retain their saved policy when older meta.json
-  files omit this field. The policy is versioned: deploy the saved version to
-  change who can call the live endpoint. Workspace uses Authorization for the
-  platform bearer token; put additional application credentials in another header.
+  callerAccess to "organization" to accept members of the function's organization
+  or tokens from any private workspace in that organization without a share.
+  A public-workspace token does not qualify; when a token has both workspace and
+  user claims, the workspace claim takes precedence. Set callerAccess to "public"
+  only when an unauthenticated endpoint is intended. Existing functions retain
+  their saved policy when older meta.json files omit this field. The policy is
+  versioned: deploy the saved version to change live access. Use Authorization
+  for the platform bearer token; put application credentials in another header.
+  Test as a user, a workspace, and anonymous before deploying.
 - Functions are full HTTP apps: method + sub-path are forwarded to your code,
   and each execution records requestMethod/requestPath. Callers reach a route
   with env.FNxxx.call({ method, path: "/features/123" }) \u2014 path defaults to the