@overaihq/cli 0.6.0 → 0.8.0

package/dist/{chunk-XGGDXRQI.js → chunk-2F4ZHHFG.js}

@@ -362,6 +362,14 @@ var consoleLogsPayloadSchema = external_exports.object({
 var runtimeErrorPayloadSchema = external_exports.object({
   error: external_exports.string().nullable()
 });
+var pageInteractionPayloadSchema = external_exports.object({
+  clicks: external_exports.number().int().min(0),
+  keypresses: external_exports.number().int().min(0)
+});
+var pageErrorPayloadSchema = external_exports.object({
+  message: external_exports.string(),
+  stack: external_exports.string().optional()
+});
 
 // ../common/src/webPage.ts
 var webPageLanguage = ["react"];

package/dist/index.js

@@ -5,7 +5,7 @@ import {
 import {
   itemFilterExpressionRootSchema,
   webPageConfigSchema
-} from "./chunk-XGGDXRQI.js";
+} from "./chunk-2F4ZHHFG.js";
 import {
   external_exports
 } from "./chunk-6YTIPJTD.js";
@@ -26360,11 +26360,6 @@ var require_lib2 = __commonJS({
   }
 });
 
-// src/auth.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { createServer } from "http";
-import { hostname } from "os";
-
 // src/config.ts
 import {
   chmodSync,
@@ -26401,6 +26396,7 @@ var clearConfig = () => {
 var trimSlash = (url) => url.replace(/\/+$/, "");
 var DEFAULT_API_BASE_URL = "https://api.overai.com";
 var apiBaseUrlOverride = process.env.OVERAI_API_URL != null ? trimSlash(process.env.OVERAI_API_URL) : void 0;
+var orgIdOverride = process.env.OVERAI_ORG_ID != null && process.env.OVERAI_ORG_ID !== "" ? process.env.OVERAI_ORG_ID : void 0;
 var appBaseUrl = trimSlash(
   process.env.OVERAI_APP_URL ?? "https://app.overai.com"
 );
@@ -26449,6 +26445,21 @@ var orgScopeOverride = null;
 var setOrgScope = (organizationId) => {
   orgScopeOverride = organizationId;
 };
+var resolveOrgId = (config) => orgIdOverride ?? orgScopeOverride ?? config.organizationId;
+var scopedOrgId = () => {
+  const config = readConfig();
+  return config == null ? null : resolveOrgId(config);
+};
+var announceOrgScope = () => {
+  const config = readConfig();
+  if (config == null) return;
+  const targetOrgId = resolveOrgId(config);
+  if (targetOrgId === config.organizationId) return;
+  process.stderr.write(
+    `Using org ${targetOrgId} (${orgIdOverride != null ? "OVERAI_ORG_ID" : ".overai/manifest.json"}); the active org is ${config.organizationId}.
+`
+  );
+};
 var inFlightExchange = null;
 var processToken = null;
 var getAccessToken = async () => {
@@ -26456,7 +26467,7 @@ var getAccessToken = async () => {
   if (config == null) {
     throw new Error("Not signed in. Run `overai signin`.");
   }
-  const targetOrgId = orgScopeOverride ?? config.organizationId;
+  const targetOrgId = resolveOrgId(config);
   const skewMs = 6e4;
   if (targetOrgId === config.organizationId && config.accessToken != null && config.accessTokenExpiresAt != null && config.accessTokenExpiresAt - skewMs > Date.now()) {
     return { token: config.accessToken, organizationId: config.organizationId };
@@ -26498,6 +26509,45 @@ var v2Fetch = async (path, init) => {
   headers.set("Authorization", `Bearer ${auth.token}`);
   return fetch(`${apiBaseUrl()}${path}`, { ...init, headers });
 };
+var STATUS_TEXT = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  409: "Conflict",
+  413: "Payload Too Large",
+  429: "Too Many Requests",
+  500: "Internal Server Error",
+  503: "Service Unavailable"
+};
+var v2Error = (label, res, rawBody) => {
+  const structured = (() => {
+    try {
+      return JSON.parse(rawBody);
+    } catch {
+      return null;
+    }
+  })();
+  const field = structured?.error ?? structured?.message;
+  const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
+  const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
+  const orgHint = res.status === 404 || res.status === 403 ? `
+  If it lives in another org, prefix the command with OVERAI_ORG_ID=<orgId> (\`overai org list\` shows them).` : "";
+  if (reason != null) return new Error(`${reason}${orgHint}`);
+  const path = (() => {
+    try {
+      return new URL(res.url).pathname;
+    } catch {
+      return "";
+    }
+  })();
+  const org = scopedOrgId();
+  return new Error(
+    `${label}: HTTP ${String(res.status)}, no reason given by the server.${path === "" ? "" : `
+  ${path}`}${org == null ? "" : `
+  Asked as org ${org}.`}${orgHint}`
+  );
+};
 var userTrpcMutation = async (procedure, input) => {
   const res = await v2Fetch(`/v1/utils/trpc/${procedure}`, {
     method: "POST",
@@ -26507,6 +26557,11 @@ var userTrpcMutation = async (procedure, input) => {
   return trpcResult(res, procedure);
 };
 
+// src/auth.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { createServer } from "http";
+import { hostname } from "os";
+
 // src/browser.ts
 import { spawn } from "child_process";
 import { platform } from "os";
@@ -26521,6 +26576,175 @@ var openBrowser = (url) => {
   }
 };
 
+// src/args.ts
+import { readFileSync as readFileSync2 } from "fs";
+var flagValue = (args, ...names) => {
+  for (const name2 of names) {
+    const i = args.indexOf(name2);
+    if (i !== -1 && i + 1 < args.length) return args[i + 1];
+  }
+  return void 0;
+};
+var stdinClaimedBy = null;
+var readStdin = async (claimant = "stdin") => {
+  if (stdinClaimedBy != null) {
+    throw new Error(
+      `Only one value can be read from stdin; ${stdinClaimedBy} already consumed it.`
+    );
+  }
+  stdinClaimedBy = claimant;
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+};
+var readValue = async (value, label) => {
+  if (value?.startsWith("@") !== true) return value;
+  if (value.startsWith("@@")) return value.slice(1);
+  const path = value.slice(1);
+  if (path === "-") return (await readStdin(`${label} @-`)).trim();
+  try {
+    return readFileSync2(path, "utf8").trim();
+  } catch {
+    throw new Error(
+      `${label}: could not read file "${path}". Write "@@" to send a literal value starting with "@".`
+    );
+  }
+};
+
+// src/output.ts
+var resolveFormat = (explicit) => {
+  if (explicit === "json" || explicit === "csv" || explicit === "table") {
+    return explicit;
+  }
+  if (explicit != null) {
+    throw new Error(
+      `Unknown output format "${explicit}". Use json, table, or csv.`
+    );
+  }
+  return process.stdout.isTTY ? "table" : "json";
+};
+var cell = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+};
+var formatResult = (data, format2) => {
+  if (format2 === "json" || !Array.isArray(data)) {
+    return JSON.stringify(data, null, 2);
+  }
+  const records = data.map(
+    (row) => row != null && typeof row === "object" ? row : { value: row }
+  );
+  if (records.length === 0) return "(no rows)";
+  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
+  if (format2 === "csv") {
+    const escape2 = (value) => {
+      const text = cell(value);
+      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+    };
+    return [
+      columns.join(","),
+      ...records.map((r) => columns.map((c) => escape2(r[c])).join(","))
+    ].join("\n");
+  }
+  const widths = columns.map(
+    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
+  );
+  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
+  return [
+    line(columns),
+    line(widths.map((w) => "-".repeat(w))),
+    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
+  ].join("\n");
+};
+var printResult = (data, format2) => {
+  process.stdout.write(`${formatResult(data, format2)}
+`);
+};
+
+// src/commands/org.ts
+var USER_ORGS_QUERY = `
+  query UserOrganizations($identityId: String!) {
+    identityOrganizations(
+      where: { identityId: { _eq: $identityId }, disabled: { _eq: false } }
+    ) {
+      organization { id name }
+    }
+  }
+`;
+var fetchOrgNames = async () => {
+  const orgs = await listOrgRows();
+  return new Map(orgs.map((org) => [org.id, org.name ?? ""]));
+};
+var listOrgRows = async () => {
+  const auth = await getAccessToken();
+  const identityId = decodeJwtClaims(auth.token).user_id;
+  if (identityId == null) {
+    throw new Error("Could not read identity from the current session.");
+  }
+  const res = await v2Fetch("/v1/graphql", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ query: USER_ORGS_QUERY, variables: { identityId } })
+  });
+  const body = await res.json().catch(() => null);
+  if (body?.errors != null && body.errors.length > 0) {
+    throw new Error(body.errors.map((e) => e.message).join("; "));
+  }
+  if (!res.ok || body == null) {
+    throw new Error(`org list failed (${String(res.status)})`);
+  }
+  return (body.data?.identityOrganizations ?? []).map((edge) => edge.organization).filter((org) => org != null);
+};
+var listOrgs = async (args) => {
+  const active = scopedOrgId();
+  printResult(
+    (await listOrgRows()).map((org) => ({
+      id: org.id,
+      name: org.name ?? "",
+      active: org.id === active
+    })),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var switchOrg = async (orgId) => {
+  const config = readConfig();
+  if (config == null) {
+    process.stderr.write("Not signed in. Run `overai signin`.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const result = await exchangeSessionToken(config.refreshToken, orgId);
+  if (result.type === "redirect") {
+    process.stdout.write(
+      `This organization requires SSO. Complete sign-in in your browser, then run \`overai signin\`.
+${result.redirectUrl}
+`
+    );
+    openBrowser(result.redirectUrl);
+    process.exitCode = 1;
+    return;
+  }
+  writeConfig({
+    ...config,
+    organizationId: orgId,
+    email: decodeJwtClaims(result.token).email ?? config.email,
+    accessToken: result.token,
+    accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3,
+    refreshToken: result.refreshToken
+  });
+  process.stdout.write(
+    `Switched to org ${orgId}.
+This is machine-global \u2014 every shell and editor session on this machine now uses it. Prefix a command with OVERAI_ORG_ID=<orgId> to scope just one.
+`
+  );
+};
+
 // src/pkce.ts
 import { createHash, randomBytes } from "crypto";
 var createPkcePair = () => {
@@ -26529,6 +26753,87 @@ var createPkcePair = () => {
   return { verifier, challenge };
 };
 
+// src/workspace/manifest.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, join as join2, resolve } from "path";
+var MANIFEST_DIR = ".overai";
+var MANIFEST_FILE = "manifest.json";
+var BASE_DIR = "base";
+var findWorkspaceRoot = (from = process.cwd()) => {
+  let dir = resolve(from);
+  for (; ; ) {
+    if (existsSync(join2(dir, MANIFEST_DIR, MANIFEST_FILE))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) {
+      throw new Error(
+        "Not inside a cloned workspace (no .overai/manifest.json found). Run `overai clone <workspaceId>` first."
+      );
+    }
+    dir = parent;
+  }
+};
+var readManifest = (root) => JSON.parse(
+  readFileSync3(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
+);
+var openClone = () => {
+  const root = findWorkspaceRoot();
+  const manifest = readManifest(root);
+  setOrgScope(manifest.organizationId);
+  return { root, manifest };
+};
+var pinOrgFromClone = () => {
+  try {
+    setOrgScope(readManifest(findWorkspaceRoot()).organizationId);
+  } catch {
+  }
+};
+var writeManifest = (root, manifest) => {
+  mkdirSync2(join2(root, MANIFEST_DIR), { recursive: true });
+  writeFileSync2(
+    join2(root, MANIFEST_DIR, MANIFEST_FILE),
+    `${JSON.stringify(manifest, null, 2)}
+`
+  );
+};
+var basePath = (root, relPath) => join2(root, MANIFEST_DIR, BASE_DIR, relPath);
+var writeSynced = (root, relPath, content) => {
+  for (const abs2 of [join2(root, relPath), basePath(root, relPath)]) {
+    mkdirSync2(dirname(abs2), { recursive: true });
+    writeFileSync2(abs2, content);
+  }
+};
+var readWorkingFile = (root, relPath) => {
+  try {
+    return readFileSync3(join2(root, relPath), "utf8");
+  } catch {
+    return null;
+  }
+};
+var readBaseFile = (root, relPath) => {
+  try {
+    return readFileSync3(basePath(root, relPath), "utf8");
+  } catch {
+    return null;
+  }
+};
+var slugify = (name2) => name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "untitled";
+var localState = (root, resource) => {
+  const changedFiles = [];
+  let missing = false;
+  for (const relPath of resource.files) {
+    const working = readWorkingFile(root, relPath);
+    if (working == null) {
+      missing = true;
+      continue;
+    }
+    if (working !== readBaseFile(root, relPath)) changedFiles.push(relPath);
+  }
+  return {
+    state: missing ? "missing" : changedFiles.length > 0 ? "modified" : "unchanged",
+    changedFiles
+  };
+};
+
 // src/auth.ts
 var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
 var startCallbackServer = (expectedState) => {
@@ -26640,110 +26945,35 @@ var signOut = async () => {
   clearConfig();
   process.stdout.write("Signed out.\n");
 };
-var whoami = () => {
+var whoami = async () => {
   const config = readConfig();
   if (config == null) {
     process.stderr.write("Not signed in. Run `overai signin`.\n");
     process.exitCode = 1;
     return;
   }
+  const cloneOrgId = (() => {
+    try {
+      return readManifest(findWorkspaceRoot()).organizationId;
+    } catch {
+      return null;
+    }
+  })();
+  const effective = orgIdOverride ?? cloneOrgId ?? config.organizationId;
+  const names = await fetchOrgNames().catch(() => null);
+  const label = (id) => names?.get(id) == null ? id : `${id} \u2014 ${String(names.get(id))}`;
   process.stdout.write(
-    `Signed in${config.email != null ? ` as ${config.email}` : ""} (org ${config.organizationId}).
+    `Signed in${config.email != null ? ` as ${config.email}` : ""} (org ${label(effective)}).
 `
   );
-};
-
-// src/args.ts
-import { readFileSync as readFileSync2 } from "fs";
-var flagValue = (args, ...names) => {
-  for (const name2 of names) {
-    const i = args.indexOf(name2);
-    if (i !== -1 && i + 1 < args.length) return args[i + 1];
-  }
-  return void 0;
-};
-var stdinClaimedBy = null;
-var readStdin = async (claimant = "stdin") => {
-  if (stdinClaimedBy != null) {
-    throw new Error(
-      `Only one value can be read from stdin; ${stdinClaimedBy} already consumed it.`
-    );
-  }
-  stdinClaimedBy = claimant;
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks).toString("utf8");
-};
-var readValue = async (value, label) => {
-  if (value?.startsWith("@") !== true) return value;
-  if (value.startsWith("@@")) return value.slice(1);
-  const path = value.slice(1);
-  if (path === "-") return (await readStdin(`${label} @-`)).trim();
-  try {
-    return readFileSync2(path, "utf8").trim();
-  } catch {
-    throw new Error(
-      `${label}: could not read file "${path}". Write "@@" to send a literal value starting with "@".`
+  if (effective !== config.organizationId) {
+    process.stdout.write(
+      `Scoped by ${orgIdOverride != null ? "OVERAI_ORG_ID" : ".overai/manifest.json"}; the machine-global active org is ${label(config.organizationId)}.
+`
     );
   }
 };
 
-// src/output.ts
-var resolveFormat = (explicit) => {
-  if (explicit === "json" || explicit === "csv" || explicit === "table") {
-    return explicit;
-  }
-  if (explicit != null) {
-    throw new Error(
-      `Unknown output format "${explicit}". Use json, table, or csv.`
-    );
-  }
-  return process.stdout.isTTY ? "table" : "json";
-};
-var cell = (value) => {
-  if (value == null) return "";
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-};
-var formatResult = (data, format2) => {
-  if (format2 === "json" || !Array.isArray(data)) {
-    return JSON.stringify(data, null, 2);
-  }
-  const records = data.map(
-    (row) => row != null && typeof row === "object" ? row : { value: row }
-  );
-  if (records.length === 0) return "(no rows)";
-  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
-  if (format2 === "csv") {
-    const escape2 = (value) => {
-      const text = cell(value);
-      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
-    };
-    return [
-      columns.join(","),
-      ...records.map((r) => columns.map((c) => escape2(r[c])).join(","))
-    ].join("\n");
-  }
-  const widths = columns.map(
-    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
-  );
-  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
-  return [
-    line(columns),
-    line(widths.map((w) => "-".repeat(w))),
-    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
-  ].join("\n");
-};
-var printResult = (data, format2) => {
-  process.stdout.write(`${formatResult(data, format2)}
-`);
-};
-
 // src/commands/agent.ts
 var runAgent = async (args) => {
   const [operation, id] = args;
@@ -26756,8 +26986,9 @@ var runAgent = async (args) => {
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ message })
   });
-  const body = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(body == null ? `Agent generate failed (${String(response.status)}).` : JSON.stringify(body));
+  const raw2 = await response.text();
+  if (!response.ok) throw v2Error("agent generate", response, raw2);
+  const body = JSON.parse(raw2);
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -26771,12 +27002,20 @@ var gqlRequest = async (query, variables, options) => {
       body: JSON.stringify({ query, variables })
     }
   );
-  const body = await res.json().catch(() => null);
+  const raw2 = await res.text();
+  const body = (() => {
+    try {
+      return JSON.parse(raw2);
+    } catch {
+      return null;
+    }
+  })();
   if (body?.errors != null && body.errors.length > 0) {
     throw new Error(body.errors.map((e) => e.message).join("; "));
   }
-  if (!res.ok || body?.data == null) {
-    throw new Error(`graphql failed (${String(res.status)})`);
+  if (!res.ok) throw v2Error("graphql", res, raw2);
+  if (body?.data == null) {
+    throw new Error("graphql returned no data and no errors.");
   }
   return body.data;
 };
@@ -26852,12 +27091,9 @@ var runTrigger = async (automationId, args) => {
       body: JSON.stringify(body)
     }
   );
-  const responseBody = await res.json().catch(() => null);
-  if (!res.ok) {
-    throw new Error(
-      responseBody?.error ?? `run failed (${String(res.status)})`
-    );
-  }
+  const raw2 = await res.text();
+  if (!res.ok) throw v2Error("automation run", res, raw2);
+  const responseBody = JSON.parse(raw2);
   printResult(responseBody, resolveFormat(flagValue(args, "-o", "--output")));
 };
 var runAutomation = async (args) => {
@@ -26871,81 +27107,6 @@ var runAutomation = async (args) => {
   process.exitCode = 1;
 };
 
-// src/workspace/manifest.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname, join as join2, resolve } from "path";
-var MANIFEST_DIR = ".overai";
-var MANIFEST_FILE = "manifest.json";
-var BASE_DIR = "base";
-var findWorkspaceRoot = (from = process.cwd()) => {
-  let dir = resolve(from);
-  for (; ; ) {
-    if (existsSync(join2(dir, MANIFEST_DIR, MANIFEST_FILE))) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) {
-      throw new Error(
-        "Not inside a cloned workspace (no .overai/manifest.json found). Run `overai clone <workspaceId>` first."
-      );
-    }
-    dir = parent;
-  }
-};
-var readManifest = (root) => JSON.parse(
-  readFileSync3(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
-);
-var openClone = () => {
-  const root = findWorkspaceRoot();
-  const manifest = readManifest(root);
-  setOrgScope(manifest.organizationId);
-  return { root, manifest };
-};
-var writeManifest = (root, manifest) => {
-  mkdirSync2(join2(root, MANIFEST_DIR), { recursive: true });
-  writeFileSync2(
-    join2(root, MANIFEST_DIR, MANIFEST_FILE),
-    `${JSON.stringify(manifest, null, 2)}
-`
-  );
-};
-var basePath = (root, relPath) => join2(root, MANIFEST_DIR, BASE_DIR, relPath);
-var writeSynced = (root, relPath, content) => {
-  for (const abs2 of [join2(root, relPath), basePath(root, relPath)]) {
-    mkdirSync2(dirname(abs2), { recursive: true });
-    writeFileSync2(abs2, content);
-  }
-};
-var readWorkingFile = (root, relPath) => {
-  try {
-    return readFileSync3(join2(root, relPath), "utf8");
-  } catch {
-    return null;
-  }
-};
-var readBaseFile = (root, relPath) => {
-  try {
-    return readFileSync3(basePath(root, relPath), "utf8");
-  } catch {
-    return null;
-  }
-};
-var slugify = (name2) => name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "untitled";
-var localState = (root, resource) => {
-  const changedFiles = [];
-  let missing = false;
-  for (const relPath of resource.files) {
-    const working = readWorkingFile(root, relPath);
-    if (working == null) {
-      missing = true;
-      continue;
-    }
-    if (working !== readBaseFile(root, relPath)) changedFiles.push(relPath);
-  }
-  return {
-    state: missing ? "missing" : changedFiles.length > 0 ? "modified" : "unchanged",
-    changedFiles
-  };
-};
-
 // src/workspace/validateElements.ts
 var findings = (parsed) => parsed.success ? [] : parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
 var validateAutomationElements = async (elements) => {
@@ -26953,7 +27114,7 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-UHT5X2WK.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-G5HIZM7Q.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
@@ -27553,10 +27714,9 @@ var enqueueAction = async (runnerId, actionId, inputs, args) => {
       body: JSON.stringify({ actionId, inputs, actionRunnerId: runnerId })
     }
   );
-  const body = await res.json().catch(() => null);
-  if (!res.ok) {
-    throw new Error(body?.error ?? `run failed (${String(res.status)})`);
-  }
+  const raw2 = await res.text();
+  if (!res.ok) throw v2Error("runner run", res, raw2);
+  const body = JSON.parse(raw2);
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 var runRun = async (runnerId, args) => {
@@ -33361,14 +33521,14 @@ var runDataFile = async (args) => {
       message: flagValue(args, "-m", "--message") ?? ""
     });
     const response2 = await fetch(url, { method: "PUT", body: readFileSync5(path) });
-    if (!response2.ok) throw new Error(`Upload failed (${String(response2.status)}): ${await response2.text()}`);
+    if (!response2.ok) throw v2Error("data-file upload", response2, await response2.text());
     process.stdout.write(`${id}
 `);
     return;
   }
   const suffix = operation === "head" ? `/head?numLines=${encodeURIComponent(flagValue(args, "--lines") ?? "50")}` : "";
   const response = await v2Fetch(`/v2/data-files/${organizationId}/${id}${suffix}`, { redirect: "follow" });
-  if (!response.ok) throw new Error(`Data file ${String(operation)} failed (${String(response.status)}): ${await response.text()}`);
+  if (!response.ok) throw v2Error(`data-file ${String(operation)}`, response, await response.text());
   const bytes = Buffer.from(await response.arrayBuffer());
   if (path != null && path !== "-") writeFileSync3(path, bytes);
   else process.stdout.write(bytes);
@@ -33382,11 +33542,11 @@ var runDataStream = async (args) => {
   }
   const { organizationId } = await getAccessToken();
   if (operation === "append") {
-    const raw2 = await readValue(args[2], "data stream input");
-    if (raw2 == null) throw new Error("Data stream append requires JSON, @<file>, or @-.");
+    const raw3 = await readValue(args[2], "data stream input");
+    if (raw3 == null) throw new Error("Data stream append requires JSON, @<file>, or @-.");
     const parsed = (() => {
       try {
-        return JSON.parse(raw2);
+        return JSON.parse(raw3);
       } catch {
         throw new Error("Data stream input must be valid JSON.");
       }
@@ -33396,8 +33556,9 @@ var runDataStream = async (args) => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ data: Array.isArray(parsed) ? parsed : [parsed] })
     });
-    const body2 = await response2.json().catch(() => null);
-    if (!response2.ok) throw new Error(JSON.stringify(body2));
+    const appended = await response2.text();
+    if (!response2.ok) throw v2Error("data-stream append", response2, appended);
+    const body2 = JSON.parse(appended);
     printResult(body2, resolveFormat(flagValue(args, "-o", "--output")));
     return;
   }
@@ -33408,8 +33569,9 @@ var runDataStream = async (args) => {
   const limit2 = flagValue(args, "--limit");
   if (limit2 != null) query.set("limit", limit2);
   const response = await v2Fetch(`/v1/data-streams/${organizationId}/${id}?${query.toString()}`);
-  const body = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(JSON.stringify(body));
+  const raw2 = await response.text();
+  if (!response.ok) throw v2Error("data-stream query", response, raw2);
+  const body = JSON.parse(raw2);
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -34112,18 +34274,7 @@ var runFn = async (args) => {
 `);
   }
   const body = await res.text();
-  if (!res.ok) {
-    const structured = (() => {
-      try {
-        return JSON.parse(body);
-      } catch {
-        return null;
-      }
-    })();
-    throw new Error(
-      structured?.error ?? (body.trim() || `fn failed (${String(res.status)})`)
-    );
-  }
+  if (!res.ok) throw v2Error("fn", res, body);
   process.stdout.write(`${body}
 `);
 };
@@ -34165,12 +34316,20 @@ var runGraphql = async (args) => {
       body: JSON.stringify({ query, variables })
     }
   );
-  const body = await res.json().catch(() => null);
+  const raw2 = await res.text();
+  const body = (() => {
+    try {
+      return JSON.parse(raw2);
+    } catch {
+      return null;
+    }
+  })();
   if (body?.errors != null && body.errors.length > 0) {
     throw new Error(body.errors.map((e) => e.message).join("; "));
   }
-  if (!res.ok || body == null) {
-    throw new Error(`graphql failed (${String(res.status)})`);
+  if (!res.ok) throw v2Error("graphql", res, raw2);
+  if (body == null) {
+    throw new Error("graphql returned an unreadable body.");
   }
   printResult(body.data, resolveFormat(flagValue(args, "-o", "--output")));
 };
@@ -34262,71 +34421,6 @@ var runOpen = async (args) => {
   openBrowser(url);
 };
 
-// src/commands/org.ts
-var USER_ORGS_QUERY = `
-  query UserOrganizations($identityId: String!) {
-    identityOrganizations(
-      where: { identityId: { _eq: $identityId }, disabled: { _eq: false } }
-    ) {
-      organization { id name }
-    }
-  }
-`;
-var listOrgs = async (args) => {
-  const auth = await getAccessToken();
-  const identityId = decodeJwtClaims(auth.token).user_id;
-  if (identityId == null) {
-    throw new Error("Could not read identity from the current session.");
-  }
-  const res = await v2Fetch("/v1/graphql", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ query: USER_ORGS_QUERY, variables: { identityId } })
-  });
-  const body = await res.json().catch(() => null);
-  if (body?.errors != null && body.errors.length > 0) {
-    throw new Error(body.errors.map((e) => e.message).join("; "));
-  }
-  if (!res.ok || body == null) {
-    throw new Error(`org list failed (${String(res.status)})`);
-  }
-  const orgs = (body.data?.identityOrganizations ?? []).map((edge) => edge.organization).filter((org) => org != null).map((org) => ({
-    id: org.id,
-    name: org.name ?? "",
-    active: org.id === auth.organizationId
-  }));
-  printResult(orgs, resolveFormat(flagValue(args, "-o", "--output")));
-};
-var switchOrg = async (orgId) => {
-  const config = readConfig();
-  if (config == null) {
-    process.stderr.write("Not signed in. Run `overai signin`.\n");
-    process.exitCode = 1;
-    return;
-  }
-  const result = await exchangeSessionToken(config.refreshToken, orgId);
-  if (result.type === "redirect") {
-    process.stdout.write(
-      `This organization requires SSO. Complete sign-in in your browser, then run \`overai signin\`.
-${result.redirectUrl}
-`
-    );
-    openBrowser(result.redirectUrl);
-    process.exitCode = 1;
-    return;
-  }
-  writeConfig({
-    ...config,
-    organizationId: orgId,
-    email: decodeJwtClaims(result.token).email ?? config.email,
-    accessToken: result.token,
-    accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3,
-    refreshToken: result.refreshToken
-  });
-  process.stdout.write(`Switched to org ${orgId}.
-`);
-};
-
 // src/commands/printablePage.ts
 var runPrintablePage = async (args) => {
   const [operation, id] = args;
@@ -34346,8 +34440,9 @@ var runPrintablePage = async (args) => {
     body: JSON.stringify({ actionId: "PRINTABLE_PAGE_TO_PDF", inputs: { printablePageId: id, searchParams, includeDiagnostics: true } }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  const body = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(JSON.stringify(body));
+  const raw2 = await response.text();
+  if (!response.ok) throw v2Error("printable-page render", response, raw2);
+  const body = JSON.parse(raw2);
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
@@ -34609,7 +34704,8 @@ deploy\` makes it live. Pick primitives by trigger:
 - Awaitable server-side logic, callable from pages/automations/agents \u2192 a
   **Function** (Deno sandbox, can import from esm.sh, full env SDK).
 - Storage: **TableSpaces** (Postgres, via env.TBSxxx) for structured data;
-  **Data Files** (env.DFxxx) for versioned single-file datasets. Prefer
+  **Data Files** (env.DFxxx) for versioned single-file datasets; **File
+  Buckets** (env.FBxxx) for browsable file collections and SFTP. Prefer
   first-class platform features over third-party integrations.
 
 When broken or unexplained platform behavior blocks progress, send a detailed
@@ -34629,16 +34725,22 @@ column autocomplete; joins/aggregates/projections take a hand-written type or
 Pick<...>), env.FNxxx.call()
 (pass \`path\` to hit a sub-path of a function that routes internally),
 env.ATxxx.start(inputs?) (fire-and-forget), env.DFxxx.read.json()/.saveVersion(),
+env.FBxxx.list()/read(entryId)/upload()/createFolder(),
 env.STORAGE.fetch/upload/presign (upload shortens stored names over 128
-characters in the middle while preserving their ends),
+characters in the middle while preserving their ends), env.STORAGE.text
+(best-effort text representation of PDF, DOCX, Excel, HTML, and text files
+without AI; \`{ vision: true }\` uses AI to represent PDFs or images as text and
+is required for images), env.STORAGE.csv (one Excel worksheet selected by name
+or zero-based index), env.STORAGE.image (PNG representation of a raster image,
+SVG, or single-page PDF),
 env.AI.generateText/generateObject,
 env.GRAPHQL.request().
 
 Not everything is available everywhere. Functions and automation code nodes
 also get env.STORAGE.zipTree/zipExtract \u2014 list a zip without decompressing it,
-then extract only the entries you need, each into its own storage URL.
-A web page does NOT have those two: expanding an archive is bulk server work
-and belongs in a function the page calls.`;
+then extract only the entries you need, each into its own storage URL. A web
+page does NOT have these server-side conversion and archive helpers: that work
+belongs in a function the page calls.`;
 var automations = `# Automation best practices
 
 An automation's elements document is the node graph: an array of nodes, each
@@ -34775,11 +34877,34 @@ var workflow = `# CLI editing workflow
 
 Never edit .overai/ by hand \u2014 it holds the manifest and pristine base copies
 that make status/diff/fast-forward work.`;
+var tablespaces = `# TableSpace best practices
+
+TableSpaces are isolated PostgreSQL databases. Use PostgreSQL syntax and the
+generated env.TBSxxx client from pages, functions, and automation code.
+
+- \`overai sql <tableSpaceId>\` runs SQL through OverAI's authenticated,
+  audited HTTP surface. This is the normal interactive CLI path.
+- \`overai sql credential create <tableSpaceId> --name <name>\` creates a
+  durable \`postgresql://\` connection string for standard database clients.
+  The CLI prints a PostgreSQL 16+ libpq URL with
+  \`sslmode=verify-full&sslrootcert=system\`. Older libpq clients must point
+  \`sslrootcert\` at a trusted CA file. Other drivers should use the host,
+  port, database, username, and secret with hostname and certificate
+  verification enabled through that driver's TLS settings.
+  It expires after one year unless \`--expires-in <days>\` or \`--never\` is
+  supplied and permitted by organization policy.
+- Give each service its own credential. List, rotate, or revoke it with
+  \`overai sql credential list|rotate|revoke\`.
+- The generated secret is the PostgreSQL password. Account passwords, PATs,
+  and JWTs are not accepted. Create and rotate show the secret once.
+- Rotation, expiration, and revocation reject new connections. Existing
+  sessions continue until disconnect.`;
 var BEST_PRACTICES = {
   platform: platform2,
   automations,
   pages,
   functions,
+  tablespaces,
   workflow
 };
 
@@ -34986,6 +35111,112 @@ var runReview = async () => {
 
 // src/commands/sql.ts
 import { createInterface } from "readline";
+
+// src/commands/sqlCredential.ts
+var connectionString = async (tableSpaceId, secret) => {
+  const response = await v2Fetch("/v2/cluster-info");
+  const body = await response.json();
+  return `postgresql://overai:${encodeURIComponent(secret)}@${body.postgres.host}:${String(body.postgres.port)}/${tableSpaceId}?sslmode=${body.postgres.sslMode}${body.postgres.sslMode === "verify-full" ? "&sslrootcert=system" : ""}`;
+};
+var credentialTableSpaceId = async (credentialId) => {
+  const data = await gqlRequest(
+    `query TableSpaceCredential($id: String!) {
+      tableSpaceCredential(id: $id) { tableSpaceId }
+    }`,
+    { id: credentialId }
+  );
+  if (!data.tableSpaceCredential) {
+    throw new Error("Credential not found or you lack access to it");
+  }
+  return data.tableSpaceCredential.tableSpaceId;
+};
+var runSqlCredential = async (args) => {
+  const [action, id] = args;
+  if (!action || !id) {
+    throw new Error(
+      "Usage: overai sql credential create|list <tableSpaceId> | rotate|revoke <credentialId>"
+    );
+  }
+  if (action === "create") {
+    const tableSpaceId = id;
+    const name2 = flagValue(args, "--name");
+    if (!name2) throw new Error("create requires --name <name>");
+    const expiresIn = flagValue(args, "--expires-in");
+    if (expiresIn && args.includes("--never")) {
+      throw new Error("Use either --expires-in <days> or --never, not both");
+    }
+    const days = expiresIn ? Number(expiresIn) : 365;
+    if (!args.includes("--never") && (!Number.isInteger(days) || days < 1)) {
+      throw new Error("--expires-in must be a positive whole number of days");
+    }
+    const data = await gqlRequest(
+      `mutation CreateTableSpaceCredential($tableSpaceId: String!, $name: String!, $validUntil: Datetime) {
+        createTableSpaceCredential(input: { tableSpaceId: $tableSpaceId, name: $name, validUntil: $validUntil }) { result }
+      }`,
+      {
+        tableSpaceId,
+        name: name2,
+        validUntil: args.includes("--never") ? null : new Date(Date.now() + days * 864e5).toISOString()
+      }
+    );
+    const result = data.createTableSpaceCredential?.result;
+    if (!result) throw new Error("The server did not return a credential");
+    process.stdout.write(
+      `${await connectionString(tableSpaceId, result.secret)}
+`
+    );
+    return;
+  }
+  if (action === "list") {
+    const tableSpaceId = id;
+    const data = await gqlRequest(
+      `query TableSpaceCredentials($tableSpaceId: String!) {
+        tableSpaceCredentials(condition: { tableSpaceId: $tableSpaceId }) {
+          nodes { id name validUntil lastUsedAt createdAt }
+        }
+      }`,
+      { tableSpaceId }
+    );
+    printResult(
+      data.tableSpaceCredentials?.nodes ?? [],
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
+    return;
+  }
+  if (action === "rotate") {
+    const credentialId = id;
+    const tableSpaceId = await credentialTableSpaceId(credentialId);
+    const data = await gqlRequest(
+      `mutation RotateTableSpaceCredential($credentialId: String!) {
+        rotateTableSpaceCredential(input: { credentialId: $credentialId }) { result }
+      }`,
+      { credentialId }
+    );
+    const secret = data.rotateTableSpaceCredential?.result;
+    if (!secret) throw new Error("The server did not return a credential");
+    process.stdout.write(`${await connectionString(tableSpaceId, secret)}
+`);
+    return;
+  }
+  if (action === "revoke") {
+    const credentialId = id;
+    await credentialTableSpaceId(credentialId);
+    await gqlRequest(
+      `mutation RevokeTableSpaceCredential($id: String!, $validUntil: Datetime!) {
+        updateTableSpaceCredential(input: { id: $id, patch: { validUntil: $validUntil } }) {
+          tableSpaceCredential { id }
+        }
+      }`,
+      { id: credentialId, validUntil: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    process.stdout.write(`${credentialId} revoked
+`);
+    return;
+  }
+  throw new Error(`Unknown credential action: ${action}`);
+};
+
+// src/commands/sql.ts
 var runQuery = async (organizationId, tableSpaceId, query, params) => {
   const res = await v2Fetch(
     `/v2/table-spaces/${organizationId}/${tableSpaceId}/run`,
@@ -35005,11 +35236,7 @@ var runQuery = async (organizationId, tableSpaceId, query, params) => {
       return null;
     }
   })();
-  if (!res.ok || body?.ok === false) {
-    throw new Error(
-      body?.error ?? (raw2.trim().length > 0 ? raw2.trim() : res.status === 404 ? "table space not found or you lack access to it" : `HTTP ${String(res.status)}`)
-    );
-  }
+  if (!res.ok || body?.ok === false) throw v2Error("sql", res, raw2);
   return {
     rows: body?.rows ?? [],
     rowCount: body?.rowCount ?? 0,
@@ -35135,6 +35362,9 @@ var runRepl = async (organizationId, tableSpaceId, format2) => {
   });
 };
 var runSql = async (args) => {
+  if (args[0] === "credential") {
+    return runSqlCredential(args.slice(1));
+  }
   const tableSpaceId = args[0];
   if (tableSpaceId == null || tableSpaceId.startsWith("-")) {
     throw new Error(
@@ -35461,20 +35691,9 @@ var runDiff = async (args) => {
 };
 
 // src/commands/workspace.ts
-var workspaceIdFrom = (args) => {
-  const workspaceId = args.find(
-    (arg, index) => !arg.startsWith("-") && args[index - 1] !== "-o" && args[index - 1] !== "--output"
-  );
-  if (workspaceId == null) return openClone().manifest.workspaceId;
-  try {
-    openClone();
-  } catch (error) {
-    if (!(error instanceof Error) || !error.message.startsWith("Not inside a cloned workspace")) {
-      throw error;
-    }
-  }
-  return workspaceId;
-};
+var workspaceIdFrom = (args) => args.find(
+  (arg, index) => !arg.startsWith("-") && args[index - 1] !== "-o" && args[index - 1] !== "--output"
+) ?? openClone().manifest.workspaceId;
 var listWorkspaces = async (args) => {
   const archived = args.includes("--archived");
   const limit2 = Number(flagValue(args, "--limit") ?? 200);
@@ -35514,10 +35733,7 @@ var showWorkspace = async (args) => {
       `Workspace ${workspaceId} not found (or not visible to you).`
     );
   }
-  printResult(
-    data.workspace,
-    resolveFormat(flagValue(args, "-o", "--output"))
-  );
+  printResult(data.workspace, resolveFormat(flagValue(args, "-o", "--output")));
 };
 var listWorkspaceUsers = async (args) => {
   const workspaceId = workspaceIdFrom(args);
@@ -35553,9 +35769,7 @@ var listWorkspaceUsers = async (args) => {
           parentWorkspaceRole: membership.parentWorkspaceRole ?? ""
         }
       ]
-    ).sort(
-      (a, b) => (a.name || a.email).localeCompare(b.name || b.email)
-    ),
+    ).sort((a, b) => (a.name || a.email).localeCompare(b.name || b.email)),
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
@@ -35608,6 +35822,10 @@ Usage:
                                        Execution history / logs
   overai sql <tableSpaceId> ["<SQL>"]  Run SQL against a tablespace; no query
                                        opens a psql-style session (stdin scripts work)
+  overai sql credential create <tableSpaceId> --name <name> [--expires-in <days>|--never]
+                                       Create a durable PostgreSQL connection string
+  overai sql credential list <tableSpaceId>
+  overai sql credential rotate|revoke <credentialId>
 
 Workspace sync (edit resources as local files):
   overai clone <workspaceId> [dir]     Materialize resources and WORKSPACE.md
@@ -35667,16 +35885,43 @@ it from stdin. Prefer that for anything long or quote-heavy: an inline value is
 parsed by your shell first, and one apostrophe inside it silently truncates the
 rest. Write @@ to send a literal value that starts with "@".
 
+Organizations: commands run as the clone you're standing in (.overai/manifest.json),
+else the active org from \`org switch\`. The active org is machine-global \u2014 every
+shell shares it \u2014 so scope one command or one shell with OVERAI_ORG_ID=<orgId>
+instead. \`overai whoami\` says which org is in effect and why.
+
 Output: table on a TTY, JSON when piped; -o json|table|csv to force.
 Aliases: login = signin, logout = signout, ws = workspace.
 Env: OVERAI_API_URL, OVERAI_APP_URL override the target deployment.
+     OVERAI_ORG_ID overrides the organization for this shell.
 `;
 process.stdout.on("error", (error) => {
   if (error.code === "EPIPE") process.exit(0);
   throw error;
 });
+var ORG_AGNOSTIC_COMMANDS = /* @__PURE__ */ new Set([
+  "signin",
+  "login",
+  "signout",
+  "logout",
+  "whoami",
+  "org",
+  "clone",
+  "update",
+  "upgrade",
+  "version",
+  "--version",
+  "-v",
+  "help",
+  "--help",
+  "-h"
+]);
 var run = async () => {
   const [command, ...rest] = process.argv.slice(2);
+  if (command != null && !ORG_AGNOSTIC_COMMANDS.has(command)) {
+    pinOrgFromClone();
+    announceOrgScope();
+  }
   switch (command) {
     case "signin":
     case "login":
@@ -35687,7 +35932,7 @@ var run = async () => {
       await signOut();
       return;
     case "whoami":
-      whoami();
+      await whoami();
       return;
     case "org":
       if (rest[0] === "list") {

package/dist/{webPage-UHT5X2WK.js → webPage-G5HIZM7Q.js}

@@ -3,7 +3,7 @@ import {
   webPageConfigSchema,
   webPageConfigWriteSchema,
   webPageLanguage
-} from "./chunk-XGGDXRQI.js";
+} from "./chunk-2F4ZHHFG.js";
 import "./chunk-6YTIPJTD.js";
 import "./chunk-U67V476Y.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",