@overaihq/cli 0.5.0 → 0.7.0

package/README.md

@@ -24,7 +24,7 @@ overai clone <workspaceId>      # materialize resources and WORKSPACE.md
 # ...edit files...
 overai status                   # local edits + remote drift
 overai diff                     # what changed
-overai review                   # validation + best-practice review packet
+overai review                   # local checks + authenticated TypeScript lint + guides
 overai report bug "<details>"    # report broken or unexplained behavior
 overai report feature "<details>" # request a missing platform capability
 overai push -m "why"            # create new versions (not live yet)

package/dist/index.js

@@ -34764,7 +34764,8 @@ var workflow = `# CLI editing workflow
    each nested workspace you need separately.
 2. Edit files. The id in each filename is authoritative; slugs are cosmetic.
 3. \`overai status\` / \`overai diff\` \u2014 review what changed.
-4. \`overai review\` \u2014 validation + these guides; fix findings first.
+4. \`overai review\` \u2014 local checks, authenticated TypeScript lint against the
+   live workspace, and these guides; fix findings first.
 5. \`overai push -m "why"\` \u2014 creates NEW versions (not live). Fast-forward
    only: if the resource moved remotely, pull, re-apply, retry. Write commit
    messages like PR titles \u2014 they're the version history.
@@ -34774,11 +34775,34 @@ var workflow = `# CLI editing workflow
 
 Never edit .overai/ by hand \u2014 it holds the manifest and pristine base copies
 that make status/diff/fast-forward work.`;
+var tablespaces = `# TableSpace best practices
+
+TableSpaces are isolated PostgreSQL databases. Use PostgreSQL syntax and the
+generated env.TBSxxx client from pages, functions, and automation code.
+
+- \`overai sql <tableSpaceId>\` runs SQL through OverAI's authenticated,
+  audited HTTP surface. This is the normal interactive CLI path.
+- \`overai sql credential create <tableSpaceId> --name <name>\` creates a
+  durable \`postgresql://\` connection string for standard database clients.
+  The CLI prints a PostgreSQL 16+ libpq URL with
+  \`sslmode=verify-full&sslrootcert=system\`. Older libpq clients must point
+  \`sslrootcert\` at a trusted CA file. Other drivers should use the host,
+  port, database, username, and secret with hostname and certificate
+  verification enabled through that driver's TLS settings.
+  It expires after one year unless \`--expires-in <days>\` or \`--never\` is
+  supplied and permitted by organization policy.
+- Give each service its own credential. List, rotate, or revoke it with
+  \`overai sql credential list|rotate|revoke\`.
+- The generated secret is the PostgreSQL password. Account passwords, PATs,
+  and JWTs are not accepted. Create and rotate show the secret once.
+- Rotation, expiration, and revocation reject new connections. Existing
+  sessions continue until disconnect.`;
 var BEST_PRACTICES = {
   platform: platform2,
   automations,
   pages,
   functions,
+  tablespaces,
   workflow
 };
 
@@ -34802,11 +34826,11 @@ var runBestPractices = (args) => {
   );
 };
 var runReview = async () => {
-  const root = findWorkspaceRoot();
-  const manifest = readManifest(root);
+  const { root, manifest } = openClone();
   const findings2 = [];
   const touchedTypes = /* @__PURE__ */ new Set();
   const changed = [];
+  const lintTargets = [];
   for (const [id, resource] of Object.entries(manifest.resources)) {
     const { state, changedFiles } = localState(root, resource);
     if (state !== "modified") continue;
@@ -34853,6 +34877,37 @@ var runReview = async () => {
         }
       }
     }
+    if (resource.type === "webPage") {
+      changedFiles.filter((relPath) => relPath.endsWith(".tsx")).forEach((relPath) => {
+        const code = readWorkingFile(root, relPath);
+        if (code != null) {
+          lintTargets.push({ label: relPath, code, surface: "webPage" });
+        }
+      });
+    }
+    if (resource.type === "function") {
+      const codeFile = resource.files.find((path) => path.endsWith(".ts"));
+      const metaFile = resource.files.find(
+        (path) => path.endsWith(".meta.json")
+      );
+      const code = codeFile == null ? null : readWorkingFile(root, codeFile);
+      const meta = metaFile == null ? null : readWorkingFile(root, metaFile);
+      if (codeFile != null && code != null) {
+        const parsedMeta = (() => {
+          try {
+            return JSON.parse(meta ?? "null");
+          } catch {
+            return null;
+          }
+        })();
+        lintTargets.push({
+          label: codeFile,
+          code,
+          surface: "function",
+          functionOutputSchema: parsedMeta != null && typeof parsedMeta === "object" && "outputSchema" in parsedMeta && typeof parsedMeta.outputSchema === "string" ? parsedMeta.outputSchema : void 0
+        });
+      }
+    }
     if (resource.type === "automation") {
       const docFile = resource.files.find((f) => f.endsWith(".json"));
       const raw2 = docFile == null ? null : readWorkingFile(root, docFile);
@@ -34864,6 +34919,25 @@ var runReview = async () => {
               (f) => `${docFile} elements.${f}`
             )
           );
+          const nodes = Array.isArray(doc.elements) ? [...doc.elements] : [];
+          for (const node of nodes) {
+            if (node == null || typeof node !== "object") continue;
+            const nodeRecord = node;
+            if (Array.isArray(nodeRecord.elements)) {
+              nodes.push(...nodeRecord.elements);
+            }
+            const inputs = nodeRecord.inputs;
+            if (nodeRecord.nodeTypeId !== "TYPESCRIPT_CODE" || inputs == null || typeof inputs !== "object") {
+              continue;
+            }
+            const code = inputs.code;
+            if (typeof code !== "string") continue;
+            lintTargets.push({
+              label: `${docFile} ${typeof nodeRecord.variableId === "string" ? nodeRecord.variableId : "unknown node"}`,
+              code,
+              surface: "automationCode"
+            });
+          }
         } catch {
         }
       }
@@ -34873,6 +34947,47 @@ var runReview = async () => {
     process.stdout.write("Nothing modified locally \u2014 nothing to review.\n");
     return;
   }
+  for (const target of lintTargets) {
+    try {
+      const response = await v2Fetch("/v2/architect/lint", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          code: target.code,
+          surface: target.surface,
+          workspaceId: manifest.workspaceId,
+          functionOutputSchema: target.functionOutputSchema
+        })
+      });
+      const responseText = await response.text();
+      if (!response.ok) {
+        throw new Error(
+          `${target.label}: HTTP ${String(response.status)}${responseText ? ` \u2014 ${responseText}` : ""}`
+        );
+      }
+      const parsed = lintResponseSchema.safeParse(
+        (() => {
+          try {
+            return JSON.parse(responseText);
+          } catch {
+            return null;
+          }
+        })()
+      );
+      if (!parsed.success) {
+        throw new Error(`${target.label}: invalid response from lint service`);
+      }
+      findings2.push(
+        ...parsed.data.diagnostics.map(
+          (diagnostic) => `${target.label}:${String(diagnostic.line)}:${String(diagnostic.column)}: ${diagnostic.severity}: ${diagnostic.message}${diagnostic.ruleId == null ? "" : ` (${diagnostic.ruleId})`}`
+        )
+      );
+    } catch (error) {
+      findings2.push(
+        `${target.label}: remote lint could not run \u2014 ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
   const guides = ["workflow", ...touchedTypes].map((t) => t === "webPage" || t === "printablePage" ? "pages" : t).map((t) => t === "automation" ? "automations" : t).map((t) => t === "function" ? "functions" : t);
   const guideDocs = [...new Set(guides)].map((t) => BEST_PRACTICES[t]).filter((d) => d != null);
   process.stdout.write(
@@ -34894,6 +35009,112 @@ var runReview = async () => {
 
 // src/commands/sql.ts
 import { createInterface } from "readline";
+
+// src/commands/sqlCredential.ts
+var connectionString = async (tableSpaceId, secret) => {
+  const response = await v2Fetch("/v2/cluster-info");
+  const body = await response.json();
+  return `postgresql://overai:${encodeURIComponent(secret)}@${body.postgres.host}:${String(body.postgres.port)}/${tableSpaceId}?sslmode=${body.postgres.sslMode}${body.postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
+};
+var credentialTableSpaceId = async (credentialId) => {
+  const data = await gqlRequest(
+    `query TableSpaceCredential($id: String!) {
+      tableSpaceCredential(id: $id) { tableSpaceId }
+    }`,
+    { id: credentialId }
+  );
+  if (!data.tableSpaceCredential) {
+    throw new Error("Credential not found or you lack access to it");
+  }
+  return data.tableSpaceCredential.tableSpaceId;
+};
+var runSqlCredential = async (args) => {
+  const [action, id] = args;
+  if (!action || !id) {
+    throw new Error(
+      "Usage: overai sql credential create|list <tableSpaceId> | rotate|revoke <credentialId>"
+    );
+  }
+  if (action === "create") {
+    const tableSpaceId = id;
+    const name2 = flagValue(args, "--name");
+    if (!name2) throw new Error("create requires --name <name>");
+    const expiresIn = flagValue(args, "--expires-in");
+    if (expiresIn && args.includes("--never")) {
+      throw new Error("Use either --expires-in <days> or --never, not both");
+    }
+    const days = expiresIn ? Number(expiresIn) : 365;
+    if (!args.includes("--never") && (!Number.isInteger(days) || days < 1)) {
+      throw new Error("--expires-in must be a positive whole number of days");
+    }
+    const data = await gqlRequest(
+      `mutation CreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
+        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
+      }`,
+      {
+        tableSpaceId,
+        name: name2,
+        validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5).toISOString()
+      }
+    );
+    const result = data.createTableSpaceCredential?.result;
+    if (!result) throw new Error("The server did not return a credential");
+    process.stdout.write(
+      `${await connectionString(tableSpaceId, result.secret)}
+`
+    );
+    return;
+  }
+  if (action === "list") {
+    const tableSpaceId = id;
+    const data = await gqlRequest(
+      `query TableSpaceCredentials($tableSpaceId: String!) {
+        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
+          nodes { id name validUntil lastUsedAt createdAt }
+        }
+      }`,
+      { tableSpaceId }
+    );
+    printResult(
+      data.tableSpaceCredentials?.nodes ?? [],
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
+    return;
+  }
+  if (action === "rotate") {
+    const credentialId = id;
+    const tableSpaceId = await credentialTableSpaceId(credentialId);
+    const data = await gqlRequest(
+      `mutation RotateTableSpaceCredential($credentialId: String!) {
+        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
+      }`,
+      { credentialId }
+    );
+    const secret = data.rotateTableSpaceCredential?.result;
+    if (!secret) throw new Error("The server did not return a credential");
+    process.stdout.write(`${await connectionString(tableSpaceId, secret)}
+`);
+    return;
+  }
+  if (action === "revoke") {
+    const credentialId = id;
+    await credentialTableSpaceId(credentialId);
+    await gqlRequest(
+      `mutation RevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
+        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
+          tableSpaceCredential { id }
+        }
+      }`,
+      { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    process.stdout.write(`${credentialId} revoked
+`);
+    return;
+  }
+  throw new Error(`Unknown credential action: ${action}`);
+};
+
+// src/commands/sql.ts
 var runQuery = async (organizationId, tableSpaceId, query, params) => {
   const res = await v2Fetch(
     `/v2/table-spaces/${organizationId}/${tableSpaceId}/run`,
@@ -35043,6 +35264,9 @@ var runRepl = async (organizationId, tableSpaceId, format2) => {
   });
 };
 var runSql = async (args) => {
+  if (args[0] === "credential") {
+    return runSqlCredential(args.slice(1));
+  }
   const tableSpaceId = args[0];
   if (tableSpaceId == null || tableSpaceId.startsWith("-")) {
     throw new Error(
@@ -35516,6 +35740,10 @@ Usage:
                                        Execution history / logs
   overai sql <tableSpaceId> ["<SQL>"]  Run SQL against a tablespace; no query
                                        opens a psql-style session (stdin scripts work)
+  overai sql credential create <tableSpaceId> --name <name> [--expires-in <days>|--never]
+                                       Create a durable PostgreSQL connection string
+  overai sql credential list <tableSpaceId>
+  overai sql credential rotate|revoke <credentialId>
 
 Workspace sync (edit resources as local files):
   overai clone <workspaceId> [dir]     Materialize resources and WORKSPACE.md
@@ -35540,7 +35768,7 @@ Workspace sync (edit resources as local files):
   overai open [filter | id]            Open a resource (or the workspace) in the webapp
   overai dev <filter> [--port N] [--open]
                                        Live-preview a web page from local files
-  overai review                        Validation + best-practice review packet
+  overai review                        Local checks + authenticated TypeScript lint + guides
   overai best-practices [topic]        Print bundled guides
   overai report bug|feature "<details>"
                                        Send product feedback (use - for stdin)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
@@ -30,7 +30,7 @@
     "lint": "echo 'Run lint from the root of the repo'",
     "ts-check": "tsc --noEmit",
     "build": "tsup",
-    "build:watch": "tsc -w",
+    "build:watch": "tsup --watch",
     "start": "node dist/index.js",
     "test": "vitest",
     "test:localhost": "vitest --run --config vitest.localhost.config.js"