@overaihq/cli 0.6.0 → 0.7.0

package/dist/index.js

@@ -34775,11 +34775,34 @@ var workflow = `# CLI editing workflow
 
 Never edit .overai/ by hand \u2014 it holds the manifest and pristine base copies
 that make status/diff/fast-forward work.`;
+var tablespaces = `# TableSpace best practices
+
+TableSpaces are isolated PostgreSQL databases. Use PostgreSQL syntax and the
+generated env.TBSxxx client from pages, functions, and automation code.
+
+- \`overai sql <tableSpaceId>\` runs SQL through OverAI's authenticated,
+  audited HTTP surface. This is the normal interactive CLI path.
+- \`overai sql credential create <tableSpaceId> --name <name>\` creates a
+  durable \`postgresql://\` connection string for standard database clients.
+  The CLI prints a PostgreSQL 16+ libpq URL with
+  \`sslmode=verify-full&sslrootcert=system\`. Older libpq clients must point
+  \`sslrootcert\` at a trusted CA file. Other drivers should use the host,
+  port, database, username, and secret with hostname and certificate
+  verification enabled through that driver's TLS settings.
+  It expires after one year unless \`--expires-in <days>\` or \`--never\` is
+  supplied and permitted by organization policy.
+- Give each service its own credential. List, rotate, or revoke it with
+  \`overai sql credential list|rotate|revoke\`.
+- The generated secret is the PostgreSQL password. Account passwords, PATs,
+  and JWTs are not accepted. Create and rotate show the secret once.
+- Rotation, expiration, and revocation reject new connections. Existing
+  sessions continue until disconnect.`;
 var BEST_PRACTICES = {
   platform: platform2,
   automations,
   pages,
   functions,
+  tablespaces,
   workflow
 };
 
@@ -34986,6 +35009,112 @@ var runReview = async () => {
 
 // src/commands/sql.ts
 import { createInterface } from "readline";
+
+// src/commands/sqlCredential.ts
+var connectionString = async (tableSpaceId, secret) => {
+  const response = await v2Fetch("/v2/cluster-info");
+  const body = await response.json();
+  return `postgresql://overai:${encodeURIComponent(secret)}@${body.postgres.host}:${String(body.postgres.port)}/${tableSpaceId}?sslmode=${body.postgres.sslMode}${body.postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
+};
+var credentialTableSpaceId = async (credentialId) => {
+  const data = await gqlRequest(
+    `query TableSpaceCredential($id: String!) {
+      tableSpaceCredential(id: $id) { tableSpaceId }
+    }`,
+    { id: credentialId }
+  );
+  if (!data.tableSpaceCredential) {
+    throw new Error("Credential not found or you lack access to it");
+  }
+  return data.tableSpaceCredential.tableSpaceId;
+};
+var runSqlCredential = async (args) => {
+  const [action, id] = args;
+  if (!action || !id) {
+    throw new Error(
+      "Usage: overai sql credential create|list <tableSpaceId> | rotate|revoke <credentialId>"
+    );
+  }
+  if (action === "create") {
+    const tableSpaceId = id;
+    const name2 = flagValue(args, "--name");
+    if (!name2) throw new Error("create requires --name <name>");
+    const expiresIn = flagValue(args, "--expires-in");
+    if (expiresIn && args.includes("--never")) {
+      throw new Error("Use either --expires-in <days> or --never, not both");
+    }
+    const days = expiresIn ? Number(expiresIn) : 365;
+    if (!args.includes("--never") && (!Number.isInteger(days) || days < 1)) {
+      throw new Error("--expires-in must be a positive whole number of days");
+    }
+    const data = await gqlRequest(
+      `mutation CreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
+        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
+      }`,
+      {
+        tableSpaceId,
+        name: name2,
+        validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5).toISOString()
+      }
+    );
+    const result = data.createTableSpaceCredential?.result;
+    if (!result) throw new Error("The server did not return a credential");
+    process.stdout.write(
+      `${await connectionString(tableSpaceId, result.secret)}
+`
+    );
+    return;
+  }
+  if (action === "list") {
+    const tableSpaceId = id;
+    const data = await gqlRequest(
+      `query TableSpaceCredentials($tableSpaceId: String!) {
+        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
+          nodes { id name validUntil lastUsedAt createdAt }
+        }
+      }`,
+      { tableSpaceId }
+    );
+    printResult(
+      data.tableSpaceCredentials?.nodes ?? [],
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
+    return;
+  }
+  if (action === "rotate") {
+    const credentialId = id;
+    const tableSpaceId = await credentialTableSpaceId(credentialId);
+    const data = await gqlRequest(
+      `mutation RotateTableSpaceCredential($credentialId: String!) {
+        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
+      }`,
+      { credentialId }
+    );
+    const secret = data.rotateTableSpaceCredential?.result;
+    if (!secret) throw new Error("The server did not return a credential");
+    process.stdout.write(`${await connectionString(tableSpaceId, secret)}
+`);
+    return;
+  }
+  if (action === "revoke") {
+    const credentialId = id;
+    await credentialTableSpaceId(credentialId);
+    await gqlRequest(
+      `mutation RevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
+        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
+          tableSpaceCredential { id }
+        }
+      }`,
+      { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    process.stdout.write(`${credentialId} revoked
+`);
+    return;
+  }
+  throw new Error(`Unknown credential action: ${action}`);
+};
+
+// src/commands/sql.ts
 var runQuery = async (organizationId, tableSpaceId, query, params) => {
   const res = await v2Fetch(
     `/v2/table-spaces/${organizationId}/${tableSpaceId}/run`,
@@ -35135,6 +35264,9 @@ var runRepl = async (organizationId, tableSpaceId, format2) => {
   });
 };
 var runSql = async (args) => {
+  if (args[0] === "credential") {
+    return runSqlCredential(args.slice(1));
+  }
   const tableSpaceId = args[0];
   if (tableSpaceId == null || tableSpaceId.startsWith("-")) {
     throw new Error(
@@ -35608,6 +35740,10 @@ Usage:
                                        Execution history / logs
   overai sql <tableSpaceId> ["<SQL>"]  Run SQL against a tablespace; no query
                                        opens a psql-style session (stdin scripts work)
+  overai sql credential create <tableSpaceId> --name <name> [--expires-in <days>|--never]
+                                       Create a durable PostgreSQL connection string
+  overai sql credential list <tableSpaceId>
+  overai sql credential rotate|revoke <credentialId>
 
 Workspace sync (edit resources as local files):
   overai clone <workspaceId> [dir]     Materialize resources and WORKSPACE.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",