@overaihq/cli 0.14.7 → 0.14.8

package/dist/{chunk-4QWKERK2.js → chunk-7BY65TM4.js}

@@ -385,6 +385,14 @@ var injectCodeMessageSchema = external_exports.object({
 
 // ../common/src/webPage.ts
 var webPageLanguage = ["react"];
+var webPagePermissions = [
+  "camera",
+  "microphone",
+  "geolocation",
+  "display-capture",
+  "fullscreen",
+  "screen-wake-lock"
+];
 var configFlag = external_exports.union([external_exports.boolean(), external_exports.string()]).nullish().transform((value) => value === true || value === "true").catch(false);
 var webPageConfigFields = {
   language: external_exports.enum(webPageLanguage),
@@ -403,7 +411,13 @@ var webPageConfigFields = {
    * iframe; "v2" serves the page from its own origin (separate renderer
    * process, real localStorage).
    */
-  runtime: external_exports.enum(["v1", "v2"])
+  runtime: external_exports.enum(["v1", "v2"]),
+  /*
+   * Prompt-gated browser features the v2 iframe delegates to the page. Opt-in
+   * because the visitor's grant is stored against the app origin, so every
+   * other page declaring the same feature inherits it without a prompt.
+   */
+  permissions: external_exports.array(external_exports.enum(webPagePermissions)).nullish()
 };
 var webPageConfigSchema = external_exports.object({
   ...webPageConfigFields,
@@ -416,7 +430,9 @@ var webPageConfigSchema = external_exports.object({
   hideTopBar: configFlag,
   // Absent or invalid reads as "v1" so a legacy config never fails to parse
   // over the toggle.
-  runtime: webPageConfigFields.runtime.catch("v1")
+  runtime: webPageConfigFields.runtime.catch("v1"),
+  // One unknown name drops the whole list rather than failing the page.
+  permissions: webPageConfigFields.permissions.catch(null)
 });
 var webPageConfigUpdateSchema = external_exports.object(webPageConfigFields).partial();
 var webPageConfigWriteSchema = webPageConfigSchema.extend({
@@ -424,7 +440,8 @@ var webPageConfigWriteSchema = webPageConfigSchema.extend({
   hideTopBar: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
   // Without this override the read schema's .catch would silently push a typo
   // ("V2", "2") as v1.
-  runtime: external_exports.enum(["v1", "v2"]).nullish()
+  runtime: external_exports.enum(["v1", "v2"]).nullish(),
+  permissions: webPageConfigFields.permissions
 });
 var defaultWebPageTemplate = reactDefaultTemplate.replace(
   'className="page"',
@@ -435,6 +452,7 @@ export {
   itemFilterExpressionRootSchema,
   reactDefaultTemplate,
   webPageLanguage,
+  webPagePermissions,
   webPageConfigSchema,
   webPageConfigUpdateSchema,
   webPageConfigWriteSchema,

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   itemFilterExpressionRootSchema,
   reactDefaultTemplate,
   webPageConfigSchema
-} from "./chunk-4QWKERK2.js";
+} from "./chunk-7BY65TM4.js";
 import {
   external_exports
 } from "./chunk-PF6GZFT4.js";
@@ -8000,12 +8000,12 @@ var require_dom = __commonJS({
               if (node !== base && node.nodeType === ELEMENT_NODE) {
                 var nodeClassNames = node.getAttribute("class");
                 if (nodeClassNames) {
-                  var matches = classNames === nodeClassNames;
-                  if (!matches) {
+                  var matches2 = classNames === nodeClassNames;
+                  if (!matches2) {
                     var nodeClassNamesSet = toOrderedSet(nodeClassNames);
-                    matches = classNamesSet.every(arrayIncludes2(nodeClassNamesSet));
+                    matches2 = classNamesSet.every(arrayIncludes2(nodeClassNamesSet));
                   }
-                  if (matches) {
+                  if (matches2) {
                     ls.push(node);
                   }
                 }
@@ -13757,11 +13757,11 @@ var require_lib2 = __commonJS({
       }
       addComment(comment) {
         if (this.flowPragma === void 0) {
-          const matches = FLOW_PRAGMA_REGEX.exec(comment.value);
-          if (!matches) ;
-          else if (matches[1] === "flow") {
+          const matches2 = FLOW_PRAGMA_REGEX.exec(comment.value);
+          if (!matches2) ;
+          else if (matches2[1] === "flow") {
             this.flowPragma = "flow";
-          } else if (matches[1] === "noflow") {
+          } else if (matches2[1] === "noflow") {
             this.flowPragma = "noflow";
           } else {
             throw new Error("Unexpected flow pragma");
@@ -26793,42 +26793,8 @@ var expiresIn = (at) => {
   return hours < 48 ? `${String(hours)}h` : `${String(Math.floor(hours / 24))}d`;
 };
 
-// ../common/src/stdlib/iife.ts
-var iife = (fn2) => fn2();
-
-// ../common/src/stdlib/omit.ts
-var omit = (obj, ...keys) => {
-  const result = { ...obj };
-  keys.forEach((key) => delete result[key]);
-  return result;
-};
-
-// src/api.ts
-var commandApiBaseUrl;
-var explicitRemote;
-var cloneRemote;
-var setRemoteScope = (apiBaseUrl_) => {
-  if (commandApiBaseUrl != null && commandApiBaseUrl !== apiBaseUrl_)
-    throw new Error("Cannot change remote after a command has started.");
-  explicitRemote = apiBaseUrl_;
-};
-var setCloneRemote = (apiBaseUrl_, organizationId) => {
-  cloneRemote = { apiBaseUrl: apiBaseUrl_, organizationId };
-};
-var apiBaseUrl = () => commandApiBaseUrl ??= iife(() => {
-  if (apiBaseUrlOverride != null) return apiBaseUrlOverride;
-  if (explicitRemote != null) return explicitRemote;
-  const store = readStore();
-  const override = orgOverride();
-  if (override?.apiBaseUrl != null) return override.apiBaseUrl;
-  if (cloneRemote != null && (override == null || override.orgId === cloneRemote.organizationId))
-    return cloneRemote.apiBaseUrl;
-  const overrideHome = override == null ? void 0 : remoteForOrg(override.orgId, store);
-  if (overrideHome != null) return overrideHome;
-  if (cloneRemote != null) return cloneRemote.apiBaseUrl;
-  return (orgScopeOverride == null ? void 0 : remoteForOrg(orgScopeOverride, store)) ?? defaultApiBaseUrl(store);
-});
-var AuthRpcError = class extends Error {
+// ../sdk/src/trpc.ts
+var TrpcError = class extends Error {
   constructor(status, message) {
     super(message);
     this.status = status;
@@ -26838,7 +26804,7 @@ var AuthRpcError = class extends Error {
 var trpcResult = async (res, procedure) => {
   const body = await res.json().catch(() => null);
   if (body != null && "error" in body) {
-    throw new AuthRpcError(
+    throw new TrpcError(
       res.status,
       body.error.message || `${procedure} failed (${String(res.status)})`
     );
@@ -26848,7 +26814,7 @@ var trpcResult = async (res, procedure) => {
   }
   return body.result.data;
 };
-var trpcMutation = async (procedure, input, baseUrl = apiBaseUrl()) => {
+var unauthenticatedTrpc = async (baseUrl, procedure, input) => {
   const res = await fetch(
     `${baseUrl}/v1/utils/trpc/unauthenticated/${procedure}`,
     {
@@ -26860,33 +26826,215 @@ var trpcMutation = async (procedure, input, baseUrl = apiBaseUrl()) => {
   );
   return trpcResult(res, procedure);
 };
-var exchangeCliAuthCode = (code, codeVerifier) => trpcMutation("exchangeCliAuthCode", { code, codeVerifier });
-var exchangeSessionToken = (refreshToken, destinationOrgId, backend = apiBaseUrl()) => trpcMutation(
-  "exchangeSessionToken",
-  { refreshToken, destinationOrgId },
-  backend
-);
-var signOutHeadless = (refreshToken, baseUrl = apiBaseUrl()) => trpcMutation(
-  "signOutHeadless",
-  { refreshToken },
-  baseUrl
-);
-var cancelCliOrgSession = (sourceSessionId, sourceRefreshToken, destinationOrgId, requestId, backend = apiBaseUrl()) => trpcMutation(
-  "cancelCliOrgSession",
-  { sourceSessionId, sourceRefreshToken, destinationOrgId, requestId },
-  backend
-);
-var InteractiveSignInRequired = class extends Error {
+
+// ../sdk/src/auth.ts
+var exchangeSessionToken = (baseUrl, refreshToken, destinationOrgId) => unauthenticatedTrpc(baseUrl, "exchangeSessionToken", {
+  refreshToken,
+  destinationOrgId
+});
+
+// ../sdk/src/error.ts
+var OverAIError = class extends Error {
+  /** HTTP status; 200 for a GraphQL errors-array failure. */
+  status;
+  /** URL pathname of the request, "" when unknown. */
+  path;
+  /** Parsed JSON body, the raw string when not JSON, or null. */
+  body;
+  /** The org the request ran as, when known. */
+  organizationId;
+  /** GraphQL errors array, when that is the cause. */
+  errors;
+  constructor(message, fields) {
+    super(message);
+    this.status = fields.status;
+    this.path = fields.path;
+    this.body = fields.body;
+    this.organizationId = fields.organizationId;
+    if (fields.errors != null) this.errors = fields.errors;
+  }
+};
+var responsePath = (res) => {
+  try {
+    return new URL(res.url).pathname;
+  } catch {
+    return "";
+  }
 };
+var STATUS_TEXT = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  409: "Conflict",
+  413: "Payload Too Large",
+  429: "Too Many Requests",
+  500: "Internal Server Error",
+  503: "Service Unavailable"
+};
+var apiError = (label, res, rawBody, organizationId) => {
+  const body = (() => {
+    try {
+      return JSON.parse(rawBody);
+    } catch {
+      return rawBody;
+    }
+  })();
+  const structured = typeof body === "object" && body != null ? body : null;
+  const field = structured?.error ?? structured?.message;
+  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
+  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
+  const path = responsePath(res);
+  const fields = { status: res.status, path, body, organizationId };
+  if (reason != null) return new OverAIError(reason, fields);
+  return new OverAIError(
+    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
+  ${path}`}${organizationId == null ? "" : `
+  Asked as org ${organizationId}.`}`,
+    fields
+  );
+};
+
+// ../sdk/src/jwt.ts
 var decodeJwtClaims = (token) => {
   const payload = token.split(".")[1];
   if (payload == null) return {};
   try {
-    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    const binary = atob(payload.replaceAll("-", "+").replaceAll("_", "/"));
+    return JSON.parse(
+      new TextDecoder().decode(
+        Uint8Array.from(binary, (char) => char.charCodeAt(0))
+      )
+    );
   } catch {
     return {};
   }
 };
+
+// ../sdk/src/tokens.ts
+var exchangeSchema = external_exports.object({ token: external_exports.string(), expiresIn: external_exports.number() });
+var staticToken = (jwt) => () => jwt;
+
+// ../sdk/src/client.ts
+var OverAIClient = class {
+  baseUrl;
+  #token;
+  #claims = null;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.#token = typeof options.token === "string" ? staticToken(options.token) : options.token;
+  }
+  /** Authenticated fetch to `${baseUrl}${path}`; sets Authorization: Bearer <token>. Does not throw on non-2xx. */
+  async fetch(path, init) {
+    const token = await this.#token();
+    this.#claims = decodeJwtClaims(token);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(`${this.baseUrl}${path}`, { ...init, headers });
+  }
+  /**
+   * POST /v2/graphql. Throws with the server's error messages — callers (and
+   * agents driving them) need the actual reason, not a status code.
+   */
+  async graphql(query, variables) {
+    const res = await this.fetch("/v2/graphql", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ query, variables })
+    });
+    const raw2 = await res.text();
+    const body = (() => {
+      try {
+        return JSON.parse(raw2);
+      } catch {
+        return null;
+      }
+    })();
+    const organizationId = this.claims()?.org ?? null;
+    if (body?.errors != null && body.errors.length > 0) {
+      throw new OverAIError(body.errors.map((e) => e.message).join("; "), {
+        status: res.status,
+        path: responsePath(res),
+        body,
+        organizationId,
+        errors: body.errors
+      });
+    }
+    if (!res.ok) throw apiError("graphql", res, raw2, organizationId);
+    if (body?.data == null) {
+      throw new OverAIError("graphql returned no data and no errors.", {
+        status: res.status,
+        path: responsePath(res),
+        body,
+        organizationId
+      });
+    }
+    return body.data;
+  }
+  /** POST to the JWT-gated user tRPC router; returns the procedure's data. */
+  async trpc(procedure, input) {
+    const res = await this.fetch(`/v1/utils/trpc/${procedure}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(input)
+    });
+    return trpcResult(res, procedure);
+  }
+  /** Claims of the JWT most recently obtained from the token source, or null before any request. Display only. */
+  claims() {
+    return this.#claims;
+  }
+};
+var createClient = (options) => new OverAIClient(options);
+
+// ../common/src/stdlib/iife.ts
+var iife = (fn2) => fn2();
+
+// ../common/src/stdlib/omit.ts
+var omit = (obj, ...keys) => {
+  const result = { ...obj };
+  keys.forEach((key) => delete result[key]);
+  return result;
+};
+
+// src/api.ts
+var commandApiBaseUrl;
+var explicitRemote;
+var cloneRemote;
+var setRemoteScope = (apiBaseUrl_) => {
+  if (commandApiBaseUrl != null && commandApiBaseUrl !== apiBaseUrl_)
+    throw new Error("Cannot change remote after a command has started.");
+  explicitRemote = apiBaseUrl_;
+};
+var setCloneRemote = (apiBaseUrl_, organizationId) => {
+  cloneRemote = { apiBaseUrl: apiBaseUrl_, organizationId };
+};
+var apiBaseUrl = () => commandApiBaseUrl ??= iife(() => {
+  if (apiBaseUrlOverride != null) return apiBaseUrlOverride;
+  if (explicitRemote != null) return explicitRemote;
+  const store = readStore();
+  const override = orgOverride();
+  if (override?.apiBaseUrl != null) return override.apiBaseUrl;
+  if (cloneRemote != null && (override == null || override.orgId === cloneRemote.organizationId))
+    return cloneRemote.apiBaseUrl;
+  const overrideHome = override == null ? void 0 : remoteForOrg(override.orgId, store);
+  if (overrideHome != null) return overrideHome;
+  if (cloneRemote != null) return cloneRemote.apiBaseUrl;
+  return (orgScopeOverride == null ? void 0 : remoteForOrg(orgScopeOverride, store)) ?? defaultApiBaseUrl(store);
+});
+var exchangeCliAuthCode = (code, codeVerifier) => unauthenticatedTrpc(apiBaseUrl(), "exchangeCliAuthCode", { code, codeVerifier });
+var exchangeSessionToken2 = (refreshToken, destinationOrgId, backend = apiBaseUrl()) => exchangeSessionToken(backend, refreshToken, destinationOrgId);
+var signOutHeadless = (refreshToken, baseUrl = apiBaseUrl()) => unauthenticatedTrpc(baseUrl, "signOutHeadless", {
+  refreshToken
+});
+var cancelCliOrgSession = (sourceSessionId, sourceRefreshToken, destinationOrgId, requestId, backend = apiBaseUrl()) => unauthenticatedTrpc(backend, "cancelCliOrgSession", {
+  sourceSessionId,
+  sourceRefreshToken,
+  destinationOrgId,
+  requestId
+});
+var InteractiveSignInRequired = class extends Error {
+};
 var orgScopeOverride = null;
 var commandContext;
 var setOrgScope = (organizationId) => {
@@ -26961,9 +27109,9 @@ var getAccessToken = async () => {
     }
     const result = await (async () => {
       if (existing != null) {
-        return exchangeSessionToken(existing.refreshToken, null).catch(
+        return exchangeSessionToken2(existing.refreshToken, null).catch(
           (error) => {
-            if (error instanceof AuthRpcError && (error.status === 400 || error.status === 401))
+            if (error instanceof TrpcError && (error.status === 400 || error.status === 401))
               throw new InteractiveSignInRequired(
                 `Session expired or revoked. ${signin}`
               );
@@ -26977,11 +27125,11 @@ var getAccessToken = async () => {
       );
       for (const source of candidates) {
         if (source.accessToken == null || decodeJwtClaims(source.accessToken).sid == null) {
-          const refreshed = await exchangeSessionToken(
+          const refreshed = await exchangeSessionToken2(
             source.refreshToken,
             null
           ).catch((error) => {
-            if (error instanceof AuthRpcError && (error.status === 400 || error.status === 401))
+            if (error instanceof TrpcError && (error.status === 400 || error.status === 401))
               return null;
             throw error;
           });
@@ -27018,7 +27166,8 @@ var getAccessToken = async () => {
         };
         deployment.pending[target.organizationId] = operation;
         writeStore(store);
-        const response = await trpcMutation(
+        const response = await unauthenticatedTrpc(
+          baseUrl,
           "establishCliOrgSession",
           {
             refreshToken: source.refreshToken,
@@ -27026,8 +27175,7 @@ var getAccessToken = async () => {
             requestId: operation.requestId
           }
         ).catch((error) => {
-          if (error instanceof AuthRpcError && error.status === 401)
-            return null;
+          if (error instanceof TrpcError && error.status === 401) return null;
           throw new Error(
             `Could not establish an independent org session: ${error instanceof Error ? error.message : String(error)}. No legacy switch was attempted.`
           );
@@ -27080,20 +27228,16 @@ var getAccessToken = async () => {
 var accessTokenForSavedSession = async (backend, organizationId) => withStoreLock(async (store) => {
   const session = store.deployments[backend]?.sessions[organizationId];
   if (session == null)
-    throw new InteractiveSignInRequired(
-      signinHint(organizationId, backend)
-    );
+    throw new InteractiveSignInRequired(signinHint(organizationId, backend));
   if (session.accessToken != null && (session.accessTokenExpiresAt ?? 0) > Date.now() + 6e4)
     return session.accessToken;
-  const result = await exchangeSessionToken(
+  const result = await exchangeSessionToken2(
     session.refreshToken,
     null,
     backend
   );
   if (result.type !== "success")
-    throw new InteractiveSignInRequired(
-      signinHint(organizationId, backend)
-    );
+    throw new InteractiveSignInRequired(signinHint(organizationId, backend));
   if (decodeJwtClaims(result.token).org !== organizationId)
     throw new Error(
       "The auth server returned a session for a different org or identity."
@@ -27105,59 +27249,19 @@ var accessTokenForSavedSession = async (backend, organizationId) => withStoreLoc
   writeStore(store);
   return result.token;
 });
-var v2Fetch = async (path, init) => {
-  const auth = await getAccessToken();
-  const headers = new Headers(init?.headers);
-  headers.set("Authorization", `Bearer ${auth.token}`);
-  return fetch(`${apiBaseUrl()}${path}`, { ...init, headers });
-};
-var STATUS_TEXT = {
-  400: "Bad Request",
-  401: "Unauthorized",
-  403: "Forbidden",
-  404: "Not Found",
-  409: "Conflict",
-  413: "Payload Too Large",
-  429: "Too Many Requests",
-  500: "Internal Server Error",
-  503: "Service Unavailable"
-};
-var v2Error = (label, res, rawBody) => {
-  const structured = (() => {
-    try {
-      return JSON.parse(rawBody);
-    } catch {
-      return null;
-    }
-  })();
-  const field = structured?.error ?? structured?.message;
-  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
-  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
-  const orgHint = res.status === 404 || res.status === 403 ? `
-  If it lives in another org, name that org: overai --org <ref> ... (\`overai org list\` shows them, \`overai org alias\` your shorthands).` : "";
-  if (reason != null) return new Error(`${reason}${orgHint}`);
-  const path = (() => {
-    try {
-      return new URL(res.url).pathname;
-    } catch {
-      return "";
-    }
-  })();
-  const org = scopedOrgId();
-  return new Error(
-    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
-  ${path}`}${org == null ? "" : `
-  Asked as org ${org}.`}${orgHint}`
-  );
-};
-var userTrpcMutation = async (procedure, input) => {
-  const res = await v2Fetch(`/v1/utils/trpc/${procedure}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  return trpcResult(res, procedure);
-};
+var cliClient = () => createClient({
+  baseUrl: apiBaseUrl(),
+  token: async () => (await getAccessToken()).token
+});
+var v2Fetch = async (path, init) => cliClient().fetch(path, init);
+var v2Error = (label, res, rawBody) => withOrgHint(apiError(label, res, rawBody, scopedOrgId()));
+var withOrgHint = (error) => {
+  if (error.status === 404 || error.status === 403)
+    error.message = `${error.message}
+  If it lives in another org, name that org: overai --org <ref> ... (\`overai org list\` shows them, \`overai org alias\` your shorthands).`;
+  return error;
+};
+var userTrpcMutation = async (procedure, input) => cliClient().trpc(procedure, input);
 
 // src/auth.ts
 import { randomBytes as randomBytes2 } from "crypto";
@@ -27707,30 +27811,11 @@ import { createInterface } from "readline";
 
 // src/gql.ts
 var gqlRequest = async (query, variables) => {
-  const res = await v2Fetch("/v2/graphql", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ query, variables })
-  });
-  const raw2 = await res.text();
-  const body = (() => {
-    try {
-      return JSON.parse(raw2);
-    } catch {
-      return null;
-    }
-  })();
-  if (body?.errors != null && body.errors.length > 0) {
-    throw Object.assign(
-      new Error(body.errors.map((e) => e.message).join("; ")),
-      { errors: body.errors }
-    );
-  }
-  if (!res.ok) throw v2Error("graphql", res, raw2);
-  if (body?.data == null) {
-    throw new Error("graphql returned no data and no errors.");
+  try {
+    return await cliClient().graphql(query, variables);
+  } catch (error) {
+    throw error instanceof OverAIError && error.errors == null ? withOrgHint(error) : error;
   }
-  return body.data;
 };
 
 // src/commands/agent.ts
@@ -28210,7 +28295,7 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-ICODVQMY.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-SH7GBOWZ.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
@@ -28970,7 +29055,7 @@ var runRunner = async (args) => {
 // ../common/src/liquidjs/liquidjs.ts
 var import_jmespath = __toESM(require_jmespath(), 1);
 
-// ../../node_modules/.pnpm/liquidjs@10.29.0/node_modules/liquidjs/dist/liquid.node.mjs
+// ../../node_modules/.pnpm/liquidjs@10.30.0/node_modules/liquidjs/dist/liquid.node.mjs
 import { PassThrough } from "stream";
 import { sep, extname, resolve as resolve$1, dirname as dirname$1 } from "path";
 import { statSync, readFileSync as readFileSync$1, realpathSync, stat, readFile as readFile$1, realpath } from "fs";
@@ -29318,8 +29403,8 @@ function assertEmpty(predicate, message = `unexpected ${JSON.stringify(predicate
   assert(!predicate, message);
 }
 var NullDrop = class extends Drop {
-  equals(value) {
-    return isNil(toValue(value));
+  *equals(value) {
+    return isNil(yield toValue(value));
   }
   gt() {
     return false;
@@ -29338,10 +29423,10 @@ var NullDrop = class extends Drop {
   }
 };
 var EmptyDrop = class _EmptyDrop extends Drop {
-  equals(value) {
+  *equals(value) {
     if (value instanceof _EmptyDrop)
       return false;
-    value = toValue(value);
+    value = yield toValue(value);
     if (isString(value) || isArray(value))
       return value.length === 0;
     if (isObject(value))
@@ -29368,14 +29453,14 @@ var EmptyDrop = class _EmptyDrop extends Drop {
   }
 };
 var BlankDrop = class _BlankDrop extends EmptyDrop {
-  equals(value) {
+  *equals(value) {
     if (value === false)
       return true;
-    if (isNil(toValue(value)))
+    if (isNil(yield toValue(value)))
       return true;
     if (isString(value))
       return /^\s*$/.test(value);
-    return super.equals(value);
+    return yield super.equals(value);
   }
   static is(value) {
     return value instanceof _BlankDrop;
@@ -29601,10 +29686,8 @@ function getDayOfYear(d) {
   return num + d.getDate();
 }
 function getWeekOfYear(d, startDay) {
-  const now = getDayOfYear(d) + (startDay - d.getDay());
-  const jan1 = new Date(d.getFullYear(), 0, 1);
-  const then = 7 - jan1.getDay() + startDay;
-  return String(Math.floor((now - then) / 7) + 1);
+  const daysSinceStartDay = (d.getDay() - startDay + 7) % 7;
+  return String(Math.floor((getDayOfYear(d) - 1 - daysSinceStartDay + 7) / 7));
 }
 function isLeapYear(d) {
   const year = d.getFullYear();
@@ -29626,9 +29709,10 @@ function ordinal(d) {
   }
 }
 function century(d) {
-  return parseInt(d.getFullYear().toString().substring(0, 2), 10);
+  return Math.floor(d.getFullYear() / 100);
 }
 var padWidths = {
+  C: 2,
   d: 2,
   e: 2,
   H: 2,
@@ -29641,7 +29725,8 @@ var padWidths = {
   M: 2,
   S: 2,
   U: 2,
-  W: 2
+  W: 2,
+  y: 2
 };
 var padSpaceChars = new Set("aAbBceklpP");
 function getTimezoneOffset(d, opts) {
@@ -29685,7 +29770,7 @@ var formatCodes = {
   W: (d) => getWeekOfYear(d, 1),
   x: (d) => d.toLocaleDateString(),
   X: (d) => d.toLocaleTimeString(),
-  y: (d) => d.getFullYear().toString().slice(2, 4),
+  y: (d) => (d.getFullYear() % 100 + 100) % 100,
   Y: (d) => d.getFullYear(),
   z: getTimezoneOffset,
   Z: (d, opts) => d.getTimeZoneName() || getTimezoneOffset(d, opts),
@@ -30260,10 +30345,13 @@ function* evalFilteredValueToken(token, ctx, lenient) {
   }
   return val;
 }
+function* evalTokenValue(token, ctx, lenient = false) {
+  return yield toValue(yield evalToken(token, ctx, lenient));
+}
 function* evalPropertyAccessToken(token, ctx, lenient) {
   const props = [];
   for (const prop of token.props) {
-    props.push(yield evalToken(prop, ctx, false));
+    props.push(yield evalTokenValue(prop, ctx, false));
   }
   try {
     if (token.variable) {
@@ -30282,8 +30370,8 @@ function evalQuotedToken(token) {
   return token.content;
 }
 function* evalRangeToken(token, ctx) {
-  const low = yield evalToken(token.lhs, ctx);
-  const high = yield evalToken(token.rhs, ctx);
+  const low = yield evalTokenValue(token.lhs, ctx);
+  const high = yield evalTokenValue(token.rhs, ctx);
   ctx.memoryLimit.use(high - low + 1);
   return range(+low, +high + 1);
 }
@@ -30314,67 +30402,85 @@ function isFalsy(val, ctx) {
   }
 }
 var defaultOperators = {
-  "==": equals,
-  "!=": (l, r) => !equals(l, r),
-  ">": (l, r) => {
+  "==": function* (l, r) {
+    return yield equals(l, r);
+  },
+  "!=": function* (l, r) {
+    return !(yield equals(l, r));
+  },
+  ">": function* (l, r) {
     if (isComparable(l))
-      return l.gt(r);
+      return yield l.gt(r);
     if (isComparable(r))
-      return r.lt(l);
-    return toValue(l) > toValue(r);
+      return yield r.lt(l);
+    return (yield toValue(l)) > (yield toValue(r));
   },
-  "<": (l, r) => {
+  "<": function* (l, r) {
     if (isComparable(l))
-      return l.lt(r);
+      return yield l.lt(r);
     if (isComparable(r))
-      return r.gt(l);
-    return toValue(l) < toValue(r);
+      return yield r.gt(l);
+    return (yield toValue(l)) < (yield toValue(r));
   },
-  ">=": (l, r) => {
+  ">=": function* (l, r) {
     if (isComparable(l))
-      return l.geq(r);
+      return yield l.geq(r);
     if (isComparable(r))
-      return r.leq(l);
-    return toValue(l) >= toValue(r);
+      return yield r.leq(l);
+    return (yield toValue(l)) >= (yield toValue(r));
   },
-  "<=": (l, r) => {
+  "<=": function* (l, r) {
     if (isComparable(l))
-      return l.leq(r);
+      return yield l.leq(r);
     if (isComparable(r))
-      return r.geq(l);
-    return toValue(l) <= toValue(r);
+      return yield r.geq(l);
+    return (yield toValue(l)) <= (yield toValue(r));
   },
-  "contains": (l, r) => {
-    l = toValue(l);
+  "contains": function* (l, r) {
+    l = yield toValue(l);
     if (isArray(l))
-      return l.some((i) => equals(i, r));
+      return yield arrayIncludes(l, r);
     if (isFunction(l === null || l === void 0 ? void 0 : l.indexOf))
-      return l.indexOf(toValue(r)) > -1;
+      return l.indexOf(yield toValue(r)) > -1;
     return false;
   },
-  "not": (v, ctx) => isFalsy(toValue(v), ctx),
-  "and": (l, r, ctx) => isTruthy(toValue(l), ctx) && isTruthy(toValue(r), ctx),
-  "or": (l, r, ctx) => isTruthy(toValue(l), ctx) || isTruthy(toValue(r), ctx)
+  "not": function* (v, ctx) {
+    return isFalsy(yield toValue(v), ctx);
+  },
+  "and": function* (l, r, ctx) {
+    return isTruthy(yield toValue(l), ctx) && isTruthy(yield toValue(r), ctx);
+  },
+  "or": function* (l, r, ctx) {
+    return isTruthy(yield toValue(l), ctx) || isTruthy(yield toValue(r), ctx);
+  }
 };
-function equals(lhs, rhs) {
+function* equals(lhs, rhs) {
   if (isComparable(lhs))
-    return lhs.equals(rhs);
+    return yield lhs.equals(rhs);
   if (isComparable(rhs))
-    return rhs.equals(lhs);
-  lhs = toValue(lhs);
-  rhs = toValue(rhs);
+    return yield rhs.equals(lhs);
+  lhs = yield toValue(lhs);
+  rhs = yield toValue(rhs);
   if (isArray(lhs)) {
-    return isArray(rhs) && arrayEquals(lhs, rhs);
+    return isArray(rhs) && (yield arrayEquals(lhs, rhs));
   }
   return lhs === rhs;
 }
-function arrayEquals(lhs, rhs) {
+function* arrayEquals(lhs, rhs) {
   if (lhs.length !== rhs.length)
     return false;
-  return !lhs.some((value, i) => !equals(value, rhs[i]));
+  for (let i = 0; i < lhs.length; i++) {
+    if (!(yield equals(lhs[i], rhs[i])))
+      return false;
+  }
+  return true;
 }
-function arrayIncludes(arr, item) {
-  return arr.some((value) => equals(value, item));
+function* arrayIncludes(arr, item) {
+  for (const value of arr) {
+    if (yield equals(value, item))
+      return true;
+  }
+  return false;
 }
 var Node = class {
   constructor(key, value, next, prev) {
@@ -31383,7 +31489,7 @@ var Output = class extends TemplateImpl {
     }
   }
   *render(ctx, emitter) {
-    const val = yield this.value.value(ctx, false);
+    const val = yield toValue(yield this.value.value(ctx, false));
     emitter.write(val);
   }
   *arguments() {
@@ -32107,7 +32213,7 @@ var mathFilters = /* @__PURE__ */ Object.freeze({
   times,
   round
 });
-var url_decode = (x) => decodeURIComponent(stringify(x)).replace(/\+/g, " ");
+var url_decode = (x) => decodeURIComponent(stringify(x).replace(/\+/g, " "));
 var url_encode = (x) => encodeURIComponent(stringify(x)).replace(/%20/g, "+");
 var cgi_escape = (x) => encodeURIComponent(stringify(x)).replace(/%20/g, "+").replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
 var uri_escape = (x) => encodeURI(stringify(x)).replace(/%5B/g, "[").replace(/%5D/g, "]");
@@ -32245,25 +32351,29 @@ function slice(v, begin, length = 1) {
   this.context.memoryLimit.use(length);
   return isArray(v) ? Array.prototype.slice.call(v, begin, begin + length) : String.prototype.slice.call(v, begin, begin + length);
 }
-function expectedMatcher(expected) {
+function* matches(value, expected) {
   if (this.context.opts.jekyllWhere) {
-    return (v) => EmptyDrop.is(expected) ? equals(v, expected) : isArray(v) ? arrayIncludes(v, expected) : equals(v, expected);
-  } else if (expected === void 0) {
-    return (v) => isTruthy(v, this.context);
-  } else {
-    return (v) => equals(v, expected);
-  }
+    if (EmptyDrop.is(expected))
+      return yield equals(value, expected);
+    if (isArray(value))
+      return yield arrayIncludes(value, expected);
+    return yield equals(value, expected);
+  }
+  if (expected === void 0)
+    return isTruthy(value, this.context);
+  return yield equals(value, expected);
 }
 function* filter(include, arr, property, expected) {
-  const values = [];
   arr = toArray(arr);
   this.context.memoryLimit.use(arr.length);
   const token = new Tokenizer(stringify(property)).readScopeValue();
+  const result = [];
   for (const item of arr) {
-    values.push(yield evalToken(token, this.context.spawn(item)));
+    const value = yield evalToken(token, this.context.spawn(item));
+    if ((yield matches.call(this, value, expected)) === include)
+      result.push(item);
   }
-  const matcher = expectedMatcher.call(this, expected);
-  return Array.prototype.filter.call(arr, (_, i) => matcher(values[i]) === include);
+  return result;
 }
 function* filter_exp(include, arr, itemName, exp) {
   const filtered = [];
@@ -32322,10 +32432,9 @@ function* group_by_exp(arr, itemName, exp) {
 function* search(arr, property, expected) {
   const token = new Tokenizer(stringify(property)).readScopeValue();
   const array = toArray(arr);
-  const matcher = expectedMatcher.call(this, expected);
   for (let index = 0; index < array.length; index++) {
     const value = yield evalToken(token, this.context.spawn(array[index]));
-    if (matcher(value))
+    if (yield matches.call(this, value, expected))
       return [index, array[index]];
   }
 }
@@ -32497,17 +32606,32 @@ function prepend(v, arg) {
   this.context.memoryLimit.use(lhs.length + rhs.length);
   return rhs + lhs;
 }
+function getTrimStart(str, chars) {
+  let start = 0;
+  for (const char of str) {
+    if (!chars.has(char))
+      break;
+    start += char.length;
+  }
+  return start;
+}
+function getTrimEnd(str, chars, start = 0) {
+  let end = str.length;
+  while (end > start) {
+    const size2 = end - start >= 2 && str.codePointAt(end - 2) > 65535 ? 2 : 1;
+    if (!chars.has(str.slice(end - size2, end)))
+      break;
+    end -= size2;
+  }
+  return end;
+}
 function lstrip(v, chars) {
   const str = stringify(v);
   this.context.memoryLimit.use(str.length);
   if (chars) {
     chars = stringify(chars);
     this.context.memoryLimit.use(chars.length);
-    for (let i = 0, set = new Set(chars); i < str.length; i++) {
-      if (!set.has(str[i]))
-        return str.slice(i);
-    }
-    return "";
+    return str.slice(getTrimStart(str, new Set(chars)));
   }
   return str.trimStart();
 }
@@ -32548,11 +32672,7 @@ function rstrip(str, chars) {
   if (chars) {
     chars = stringify(chars);
     this.context.memoryLimit.use(chars.length);
-    for (let i = str.length - 1, set = new Set(chars); i >= 0; i--) {
-      if (!set.has(str[i]))
-        return str.slice(0, i + 1);
-    }
-    return "";
+    return str.slice(0, getTrimEnd(str, new Set(chars)));
   }
   return str.trimEnd();
 }
@@ -32570,13 +32690,8 @@ function strip(v, chars) {
   if (chars) {
     const set = new Set(stringify(chars));
     this.context.memoryLimit.use(set.size);
-    let i = 0;
-    let j = str.length - 1;
-    while (set.has(str[i]))
-      i++;
-    while (j >= i && set.has(str[j]))
-      j--;
-    return str.slice(i, j + 1);
+    const start = getTrimStart(str, set);
+    return str.slice(start, getTrimEnd(str, set, start));
   }
   return str.trim();
 }
@@ -32633,7 +32748,7 @@ function truncatewords(v, words = 15, o = "...") {
   const str = stringify(v);
   o = stringify(o);
   this.context.memoryLimit.use(str.length + o.length);
-  const arr = str.split(/\s+/);
+  const arr = str.trimStart().split(/\s+/);
   if (words <= 0)
     words = 1;
   let ret = arr.slice(0, words).join(" ");
@@ -32937,12 +33052,12 @@ var CaseTag = class extends Tag {
   }
   *render(ctx, emitter) {
     const r = this.liquid.renderer;
-    const target = toValue(yield this.value.value(ctx, ctx.opts.lenientIf));
+    const target = yield toValue(yield this.value.value(ctx, ctx.opts.lenientIf));
     let branchHit = false;
     for (const branch of this.branches) {
       for (const valueToken of branch.values) {
         const value = yield evalToken(valueToken, ctx, ctx.opts.lenientIf);
-        if (equals(target, value)) {
+        if (yield equals(target, value)) {
           yield r.renderTemplates(branch.templates, ctx, emitter);
           branchHit = true;
           break;
@@ -33270,7 +33385,7 @@ var IfTag = class extends Tag {
   *render(ctx, emitter) {
     const r = this.liquid.renderer;
     for (const { value, templates } of this.branches) {
-      const v = yield value.value(ctx, ctx.opts.lenientIf);
+      const v = yield toValue(yield value.value(ctx, ctx.opts.lenientIf));
       if (isTruthy(v, ctx)) {
         yield r.renderTemplates(templates, ctx, emitter);
         return;
@@ -33542,7 +33657,7 @@ var UnlessTag = class extends Tag {
   *render(ctx, emitter) {
     const r = this.liquid.renderer;
     for (const { value, test, templates } of this.branches) {
-      const v = yield value.value(ctx, ctx.opts.lenientIf);
+      const v = yield toValue(yield value.value(ctx, ctx.opts.lenientIf));
       if (test(v, ctx)) {
         yield r.renderTemplates(templates, ctx, emitter);
         return;
@@ -33582,7 +33697,7 @@ var EchoTag = class extends Tag {
   *render(ctx, emitter) {
     if (!this.value)
       return;
-    const val = yield this.value.value(ctx, false);
+    const val = yield toValue(yield this.value.value(ctx, false));
     emitter.write(val);
   }
   *arguments() {
@@ -34013,12 +34128,12 @@ var intervalToMilliseconds = (interval, timeUnits = defaultTimeUnits) => {
   if (interval === null) {
     return null;
   }
-  const matches = interval.match(intervalRegex);
-  if (matches === null) {
+  const matches2 = interval.match(intervalRegex);
+  if (matches2 === null) {
     return null;
   }
   let milliseconds = 0;
-  matches.forEach((m) => {
+  matches2.forEach((m) => {
     const numericPart = /(\d+(?:\.\d+)?)/.exec(m)?.[1];
     const unitPart = m.replace(/\d+(?:\.\d+)?/, "").trim();
     if (numericPart && !isNaN(parseFloat(numericPart))) {
@@ -36532,15 +36647,15 @@ var parseRef = (raw2) => {
   return n;
 };
 var findResource = (manifest, filter2) => {
-  const matches = Object.entries(manifest.resources).filter(
+  const matches2 = Object.entries(manifest.resources).filter(
     ([id, r]) => id === filter2 || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
   );
-  if (matches.length === 0) throw new Error(`Nothing matched "${filter2}".`);
-  const match = matches[0];
-  if (match == null || matches.length > 1) {
+  if (matches2.length === 0) throw new Error(`Nothing matched "${filter2}".`);
+  const match = matches2[0];
+  if (match == null || matches2.length > 1) {
     throw new Error(
       `"${filter2}" is ambiguous:
-${matches.map(([id, r]) => `  ${r.name} (${id})`).join("\n")}`
+${matches2.map(([id, r]) => `  ${r.name} (${id})`).join("\n")}`
     );
   }
   return match;
@@ -37124,6 +37239,9 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
 - meta.json \`runtime\`: "v2" serves the page from its own origin (separate
   process, real localStorage/cookies \u2014 no noSandbox needed); absent or "v1" is
   the sandboxed srcdoc iframe. Anything else is rejected on push.
+- meta.json \`permissions\` (v2 only): array of "camera", "microphone",
+  "geolocation", "display-capture", "fullscreen", "screen-wake-lock" the page
+  may prompt for; declare only what it uses. Web Serial/USB/HID need none.
 - Write meta.json flags (noSandbox, hideTopBar) as JSON booleans. A page cloned
   before the shape settled may hold the strings "true"/"false" \u2014 those still
   push, anything else is rejected. noSandbox drops the iframe sandbox, which

package/dist/{webPage-ICODVQMY.js → webPage-SH7GBOWZ.js}

@@ -3,8 +3,9 @@ import {
   webPageConfigSchema,
   webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
-  webPageLanguage
-} from "./chunk-4QWKERK2.js";
+  webPageLanguage,
+  webPagePermissions
+} from "./chunk-7BY65TM4.js";
 import "./chunk-PF6GZFT4.js";
 import "./chunk-U67V476Y.js";
 export {
@@ -12,5 +13,6 @@ export {
   webPageConfigSchema,
   webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
-  webPageLanguage
+  webPageLanguage,
+  webPagePermissions
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.7",
+  "version": "0.14.8",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
@@ -20,6 +20,7 @@
     "access": "public"
   },
   "devDependencies": {
+    "@overaihq/sdk": "0.1.0",
     "@perygee/common": "0.0.0",
     "@types/node": "^24.19.0",
     "@types/proper-lockfile": "^4.1.4",