railcode 0.1.19 → 0.1.21

package/README.md

@@ -22,6 +22,8 @@ railcode login --setup-token <token>  Sign in with a one-time onboarding setup t
 railcode init <app> [--template react|static]
 railcode deploy                    Build (if configured) and deploy the app here
 railcode db <list|query> ...       List data connectors / run read-only SQL
+railcode agent <list|show|create|update|delete|run|schedule> ...
+                                   Manage org-scoped managed agents
 ```
 
 - **`login`** prompts for the server URL (default `https://api.railcode.app`),
@@ -56,10 +58,28 @@ railcode db <list|query> ...       List data connectors / run read-only SQL
   `railcode db list` (aliases `ls`, `connections`) prints each connector's
   `name` + `engine` (`--json` for the raw array). `railcode db query "<sql>"`
   (alias `sql`) runs SQL against `--connection` (default `default`) and prints a
-  table + row count; `--engine <postgres|bigquery|snowflake>` is inferred from the connector
+  table + row count; `--engine <postgres|bigquery|turso>` is inferred from the connector
   list when omitted, `--params '<json-array>'` binds `$1, $2, …` placeholders
   (SQL is never interpolated), `--file <path>` reads SQL from a file, and
   `--json` prints the raw `{ columns, rows, rowcount, truncated }` envelope.
+- **`agent`** manages org-scoped managed agents when your permissions allow it.
+  Manifests are JSON files in the same shape the API stores under
+  `agent.manifest`.
+  - `railcode agent list` lists agents; `--json` prints raw `AgentOut[]`.
+  - `railcode agent show <name|uuid>` prints one agent; `--manifest` prints only
+    its manifest JSON.
+  - `railcode agent pull <name|uuid> --output agent.json` writes the existing
+    manifest for editing.
+  - `railcode agent create --file agent.json` creates an agent; `update <agent>
+    --file agent.json` replaces an existing agent manifest; `delete <agent> --yes`
+    archives it.
+  - `railcode agent test --file agent.json --input '{"k":"v"}'` runs a draft
+    manifest without saving; `railcode agent run <agent> --input '{"k":"v"}'`
+    invokes a saved agent and prints the result. Use `--trace` for the step trace
+    and `--json` for the raw run detail.
+  - `railcode agent schedule set <agent> --cron "0 9 * * *" --timezone UTC`
+    creates or updates the agent's one schedule. `schedule show`, `pause`,
+    `resume`, `delete --yes`, and `run-now` operate on that single schedule.
 
 ## Configuration
 

package/dist/db.js

@@ -3,7 +3,7 @@
 // the command layer in index.ts does the HTTP, file reads, and printing.
 export class DbError extends Error {
 }
-export const DB_ENGINES = ["postgres", "bigquery", "snowflake"];
+export const DB_ENGINES = ["postgres", "bigquery", "turso"];
 // `--params '<json-array>'` → the positional $1,$2,… values. Empty when omitted.
 export function parseSqlParams(raw) {
     if (raw === undefined)

package/dist/index.js

@@ -43,6 +43,8 @@ Usage:
   railcode connector <list|docs|fetch> ...  List connectors / show API docs / proxy a call
   railcode llm <providers|models>      List the LLM providers/models apps can call
   railcode manifest <validate|show> ...  Validate ${APP_MANIFEST_NAME} locally / show an app's ratified manifest
+  railcode agent <list|show|create|update|delete|run|schedule> ...
+                                      Manage org-scoped managed agents
   railcode --version
   railcode --help
 
@@ -97,6 +99,10 @@ async function main() {
         case "manifest":
             await commandManifest(args);
             return;
+        case "agent":
+        case "agents":
+            await commandAgent(args);
+            return;
         default:
             throw new CliError(`Unknown command: ${args.command}\n\n${HELP}`, 2);
     }
@@ -820,7 +826,7 @@ export default defineConfig({
 }
 function reactRailcodeTypes() {
     return `type Me = {
-  user: { uuid: string; name: string; email: string };
+  user: { uuid: string; name: string; email: string; is_admin: boolean; roles: RoleRef[] };
   app: { uuid: string; slug: string; name: string };
   org: { uuid: string; slug: string; name: string };
 };
@@ -829,9 +835,12 @@ type AppUser = {
   uuid: string;
   name: string;
   email: string;
-  role: string | null;
+  is_admin: boolean;
 };
 
+type RoleRef = { uuid: string; name: string };
+type OrgRole = RoleRef & { description: string; is_member: boolean };
+
 type KvRecord<T = unknown> = {
   key: string;
   value: T;
@@ -875,7 +884,7 @@ type SqlRows = Array<Record<string, unknown>> & {
 };
 
 type DataConnectorInfo = {
-  engine: "postgres" | "bigquery" | "snowflake" | string;
+  engine: "postgres" | "bigquery" | "turso" | string;
   name: string;
 };
 
@@ -954,8 +963,25 @@ type LlmModelInfo = { model: string; default: boolean };
 
 type LlmProviderInfo = { provider: string; default: boolean; models: LlmModelInfo[] };
 
+type EmailSendOptions = {
+  to: string | string[];
+  subject: string;
+  html?: string;
+  text?: string;
+  cc?: string | string[];
+  bcc?: string | string[];
+  replyTo?: string;
+};
+
+type EmailSendResult = {
+  id: string;
+  status: string;
+  requestId: string;
+};
+
 declare const me: () => Promise<Me>;
 declare const appUsers: () => Promise<AppUser[]>;
+declare const roles: () => Promise<OrgRole[]>;
 declare const designSystem: () => Promise<string>;
 declare const db: { collection<T = unknown>(name: string): Collection<T> };
 declare const files: {
@@ -967,7 +993,6 @@ declare const files: {
 declare const data: DatabaseNamespace;
 declare const postgres: DatabaseNamespace;
 declare const bigquery: DatabaseNamespace;
-declare const snowflake: DatabaseNamespace;
 declare const dataConnectors: () => Promise<DataConnectorInfo[]>;
 declare const savedQueries: () => Promise<SavedQueryInfo[]>;
 declare const query: (name: string, params?: Record<string, unknown>) => Promise<SqlRows>;
@@ -980,6 +1005,7 @@ declare const llm: {
   stream(input: string | LlmMessage[], opts?: LlmOptions): AsyncIterable<LlmStreamEvent>;
 };
 declare const llmProviders: () => Promise<LlmProviderInfo[]>;
+declare const email: { send(opts: EmailSendOptions): Promise<EmailSendResult> };
 `;
 }
 function reactViteEnvTypes() {
@@ -1054,6 +1080,14 @@ function message(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
+function httpStatus(error: unknown): number | null {
+  if (typeof error === "object" && error !== null && "status" in error) {
+    const status = (error as { status?: unknown }).status;
+    return typeof status === "number" ? status : null;
+  }
+  return null;
+}
+
 function truncate(value: string, max: number): string {
   return value.length > max ? value.slice(0, max - 1) + "…" : value;
 }
@@ -1355,7 +1389,7 @@ function Hero() {
             </div>
           ) : null}
           {teammates.slice(0, 4).map((user) => (
-            <div className="avatar" key={user.uuid} title={user.name + (user.role ? " · " + user.role : "")}>
+            <div className="avatar" key={user.uuid} title={user.name + (user.is_admin ? " · admin" : "")}>
               {initials(user.name)}
             </div>
           ))}
@@ -1861,9 +1895,124 @@ function ConnectorsCard() {
   );
 }
 
+function emailFailureMessage(error: unknown): string {
+  const status = httpStatus(error);
+  if (status === 403) return "Email is not granted for this app or user yet.";
+  if (status === 429) return "The daily email recipient limit has been reached.";
+  if (status === 503) return "Email is not configured for this Railcode instance.";
+  return message(error);
+}
+
+function EmailCard() {
+  const { identity } = useAppStore();
+  const [to, setTo] = useState("");
+  const [subject, setSubject] = useState("Hello from " + APP_SLUG);
+  const [body, setBody] = useState(
+    "This message was sent by the Railcode starter app through the platform email gateway.",
+  );
+  const [busy, setBusy] = useState(false);
+  const [status, setStatus] = useState<{ kind: "sent" | "error"; text: string } | null>(null);
+
+  useEffect(() => {
+    if (!to && identity?.user.email) setTo(identity.user.email);
+  }, [identity, to]);
+
+  async function sendMessage(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const recipient = to.trim();
+    const trimmedSubject = subject.trim() || "Hello from " + APP_SLUG;
+    const text = body.trim() || "Sent from a Railcode starter app.";
+    if (!recipient) {
+      setStatus({ kind: "error", text: "Add a recipient email address first." });
+      return;
+    }
+
+    setBusy(true);
+    setStatus(null);
+    try {
+      const result = await email.send({ to: recipient, subject: trimmedSubject, text });
+      setStatus({
+        kind: "sent",
+        text: "Sent with status " + result.status + " · " + result.requestId,
+      });
+    } catch (error) {
+      setStatus({ kind: "error", text: emailFailureMessage(error) });
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <article className="card">
+      <div className="card-head">
+        <div>
+          <div className="card-title-row">
+            <Icon name="mail" />
+            <span className="card-title">
+              <Reveal code="await email.send(message)">Email</Reveal>
+            </span>
+          </div>
+        </div>
+      </div>
+
+      <form className="email-form" onSubmit={sendMessage}>
+        <label className="control-field">
+          <span>Recipient</span>
+          <input
+            className="field"
+            type="email"
+            autoComplete="email"
+            value={to}
+            onChange={(event) => setTo(event.target.value)}
+          />
+        </label>
+        <label className="control-field">
+          <span>Subject</span>
+          <input
+            className="field"
+            type="text"
+            value={subject}
+            onChange={(event) => setSubject(event.target.value)}
+          />
+        </label>
+        <label className="json-editor">
+          <span>Message</span>
+          <textarea
+            className="field"
+            rows={4}
+            value={body}
+            onChange={(event) => setBody(event.target.value)}
+          />
+        </label>
+        <ActionTip code={\`await email.send({
+  to,
+  subject,
+  text
+})\`} className="upload-tip">
+          <button className="btn btn-primary" type="submit" disabled={busy}>
+            {busy ? <span className="spinner" /> : <Icon name="mail" />}
+            {busy ? "Sending..." : "Send test email"}
+          </button>
+        </ActionTip>
+      </form>
+
+      <div className="email-state">
+        <div className="result-status">
+          <span>Delivery</span>
+          <span>{status?.kind === "sent" ? "Sent" : status?.kind === "error" ? "Needs setup" : "Ready"}</span>
+        </div>
+        <p className={status?.kind === "error" ? "email-note is-error" : "email-note"}>
+          {status?.text ||
+            "Email uses the platform sender and requires an email grant or app manifest approval."}
+        </p>
+      </div>
+    </article>
+  );
+}
+
 const AI_SAMPLE_PROMPT = "Summarize what this Railcode template demonstrates in one sentence.";
 const AI_SAMPLE_RESPONSE =
-  "This template shows a live Railcode app reading identity, storing notes in KV, uploading files, querying Postgres, invoking a saved query, calling Stripe through a service connector, and generating text — all without handling a single credential in the browser.";
+  "This template shows a live Railcode app reading identity, storing notes in KV, uploading files, querying Postgres, invoking a saved query, calling Stripe through a service connector, sending email, and generating text — all without handling a single credential in the browser.";
 
 function AiCard() {
   const [prompt, setPrompt] = useState(AI_SAMPLE_PROMPT);
@@ -2004,6 +2153,10 @@ function IconSprite() {
       <symbol id="i-chat" viewBox="0 0 24 24">
         <path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z" />
       </symbol>
+      <symbol id="i-mail" viewBox="0 0 24 24">
+        <rect x="3" y="5" width="18" height="14" rx="2" />
+        <path d="m3 7 9 6 9-6" />
+      </symbol>
       <symbol id="i-code" viewBox="0 0 24 24">
         <polyline points="16 18 22 12 16 6" />
         <polyline points="8 6 2 12 8 18" />
@@ -2070,11 +2223,18 @@ export function App() {
 
           <GuideSection
             title="They can connect to external services"
-            body="Railcode apps can securely connect to your SaaS services so you can manage refunds, send emails, view data, and anything else you need."
+            body="Railcode apps can securely connect to your SaaS services so you can manage refunds, sync tickets, enrich records, and anything else you need."
           >
             <ConnectorsCard />
           </GuideSection>
 
+          <GuideSection
+            title="They can send email"
+            body="Send transactional email through the Railcode gateway without putting provider credentials in browser code."
+          >
+            <EmailCard />
+          </GuideSection>
+
           <GuideSection
             title="They can use AI"
             body="Build AI-native apps that use LLMs to enable powerful workflows."
@@ -3095,6 +3255,41 @@ th:first-child {
   }
 }
 
+/* ---------- email card ---------- */
+
+.email-form {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3);
+}
+
+.email-form .field {
+  width: 100%;
+}
+
+.email-state {
+  margin-top: var(--space-4);
+  padding: 12px 14px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-md);
+  background: var(--bg-inset);
+}
+
+.email-state .result-status {
+  margin-bottom: 6px;
+}
+
+.email-note {
+  color: var(--ink-3);
+  font-size: 12.5px;
+  line-height: 1.55;
+  overflow-wrap: anywhere;
+}
+
+.email-note.is-error {
+  color: #b42318;
+}
+
 /* ---------- reveal + action tooltips ---------- */
 
 .reveal {
@@ -3534,6 +3729,550 @@ async function commandManifestShow(args) {
     }
 }
 // ---------------------------------------------------------------------------
+// agent — managed agents (`railcode agent ...`)
+// ---------------------------------------------------------------------------
+const AGENT_HELP = `railcode agent — managed agents
+
+Usage:
+  railcode agent list                         List managed agents in this org
+  railcode agent show <agent>                 Show one agent
+  railcode agent pull <agent> [--output <path>]
+                                             Write the agent manifest as JSON
+  railcode agent create --file <path>         Create an agent from a JSON manifest
+  railcode agent update <agent> --file <path> Update an agent from a JSON manifest
+  railcode agent delete <agent> [--yes]       Delete/archive an agent
+  railcode agent test --file <path> [opts]    Run a draft manifest without saving
+  railcode agent run <agent> [opts]           Trigger a saved agent and print results
+  railcode agent schedule <show|set|add|update|pause|resume|delete|run-now> <agent>
+
+Agent options:
+  --json                                Print the raw API response
+  --file <path>                         JSON manifest file
+  --output <path>                       Output path for pull (default stdout)
+  --input '<json>'                      Invoke/test input JSON (default null)
+  --input-file <path>                   Read invoke/test input JSON from a file
+  --trace                               Include the run step trace in human output
+  --yes                                 Confirm delete without a prompt
+
+Schedule options:
+  --name <name>                         Schedule name (default: default on create)
+  --cron <expr>                         Five-field cron expression
+  --schedule <expr>                     Alias for --cron
+  --timezone <iana>                     IANA timezone (default: UTC on create)
+  --enabled / --disabled                Initial or updated enabled state
+
+Manifests are JSON files in the same shape the API stores under agent.manifest.
+Schedules are currently one per agent, so "set" creates the schedule if missing
+or updates the existing one.
+`;
+async function commandAgent(args) {
+    const sub = args.rest[0] ?? "";
+    switch (sub) {
+        case "list":
+        case "ls":
+            await commandAgentList(args);
+            return;
+        case "show":
+        case "get":
+            await commandAgentShow(args);
+            return;
+        case "pull":
+        case "export":
+            await commandAgentPull(args);
+            return;
+        case "create":
+            await commandAgentCreate(args);
+            return;
+        case "update":
+        case "edit":
+            await commandAgentUpdate(args);
+            return;
+        case "delete":
+        case "rm":
+            await commandAgentDelete(args);
+            return;
+        case "test":
+            await commandAgentTest(args);
+            return;
+        case "run":
+        case "invoke":
+            await commandAgentRun(args);
+            return;
+        case "schedule":
+        case "schedules":
+            await commandAgentSchedule(args);
+            return;
+        case "":
+        case "help":
+            console.log(AGENT_HELP);
+            return;
+        default:
+            throw new CliError(`Unknown agent command: ${sub}\n\n${AGENT_HELP}`, 2);
+    }
+}
+async function commandAgentList(args) {
+    assertKnownAgentOptions(args, ["json", "apiUrl"]);
+    if (args.rest.length > 1) {
+        throw new CliError(`railcode agent list takes no arguments (got "${args.rest[1]}").`, 2);
+    }
+    const config = requireLogin(args);
+    const agents = await fetchAgents(config);
+    if (args.options.json) {
+        console.log(JSON.stringify(agents, null, 2));
+        return;
+    }
+    if (agents.length === 0) {
+        console.log("No managed agents in this organization.");
+        return;
+    }
+    console.log(formatTable(["name", "model", "uuid", "updated"], agents.map((agent) => [
+        agent.name,
+        typeof agent.manifest.model === "string" ? agent.manifest.model : "-",
+        agent.uuid,
+        shortDate(agent.updated_at),
+    ])));
+}
+async function commandAgentShow(args) {
+    assertKnownAgentOptions(args, ["json", "manifest", "apiUrl"]);
+    const ref = agentArg(args, "show");
+    const config = requireLogin(args);
+    const agent = await fetchAgent(config, ref);
+    if (args.options.json) {
+        console.log(JSON.stringify(agent, null, 2));
+        return;
+    }
+    if (args.options.manifest) {
+        console.log(JSON.stringify(agent.manifest, null, 2));
+        return;
+    }
+    printAgent(agent);
+}
+async function commandAgentPull(args) {
+    assertKnownAgentOptions(args, ["output", "json", "apiUrl"]);
+    const ref = agentArg(args, "pull");
+    const output = optionString(args, "output");
+    const config = requireLogin(args);
+    const agent = await fetchAgent(config, ref);
+    const manifest = JSON.stringify(agent.manifest, null, 2) + "\n";
+    if (output) {
+        writeFileSync(resolve(process.cwd(), output), manifest, { mode: 0o644 });
+        console.log(`Wrote ${output}`);
+        return;
+    }
+    process.stdout.write(manifest);
+}
+async function commandAgentCreate(args) {
+    assertKnownAgentOptions(args, ["file", "json", "apiUrl"]);
+    const manifest = readAgentManifest(args);
+    const config = requireLogin(args);
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ manifest }),
+    });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    const result = (await readJsonOrThrow(resp, "Create agent"));
+    printAgentMutation(result, args.options.json === true, "created");
+}
+async function commandAgentUpdate(args) {
+    assertKnownAgentOptions(args, ["file", "json", "apiUrl"]);
+    const ref = agentArg(args, "update");
+    const manifest = readAgentManifest(args);
+    const config = requireLogin(args);
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ manifest }),
+    });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    const result = (await readJsonOrThrow(resp, `Update agent "${ref}"`));
+    printAgentMutation(result, args.options.json === true, "updated");
+}
+async function commandAgentDelete(args) {
+    assertKnownAgentOptions(args, ["yes", "apiUrl"]);
+    const ref = agentArg(args, "delete");
+    if (args.options.yes !== true) {
+        if (!process.stdin.isTTY) {
+            throw new CliError("Pass --yes to delete an agent in a non-interactive session.", 2);
+        }
+        const answer = await prompt(`Delete agent "${ref}"? Its run history is kept. [y/N] `);
+        if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
+            throw new CliError("Delete cancelled.", 1);
+        }
+    }
+    const config = requireLogin(args);
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}`, { method: "DELETE" });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    if (!resp.ok) {
+        throw new CliError(`Delete agent "${ref}" failed (${resp.status}): ${await errorDetail(resp)}`, 1);
+    }
+    console.log(`Agent "${ref}" deleted.`);
+}
+async function commandAgentTest(args) {
+    assertKnownAgentOptions(args, ["file", "input", "inputFile", "json", "trace", "apiUrl"]);
+    const manifest = readAgentManifest(args);
+    const input = readJsonInput(args);
+    const config = requireLogin(args);
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/test`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ manifest, input }),
+    });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    const run = (await readJsonOrThrow(resp, "Test agent"));
+    printAgentRun(run, { json: args.options.json === true, trace: args.options.trace === true });
+}
+async function commandAgentRun(args) {
+    assertKnownAgentOptions(args, ["input", "inputFile", "json", "trace", "apiUrl"]);
+    const ref = agentArg(args, "run");
+    const input = readJsonInput(args);
+    const config = requireLogin(args);
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/invoke`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ input }),
+    });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    const run = (await readJsonOrThrow(resp, `Run agent "${ref}"`));
+    printAgentRun(run, { json: args.options.json === true, trace: args.options.trace === true });
+}
+async function commandAgentSchedule(args) {
+    const sub = args.rest[1] ?? "";
+    switch (sub) {
+        case "show":
+        case "list":
+        case "ls":
+            await commandAgentScheduleShow(args);
+            return;
+        case "set":
+            await commandAgentScheduleSet(args, "upsert");
+            return;
+        case "add":
+        case "create":
+            await commandAgentScheduleSet(args, "create");
+            return;
+        case "update":
+            await commandAgentScheduleSet(args, "update");
+            return;
+        case "pause":
+            await commandAgentScheduleEnabled(args, false);
+            return;
+        case "resume":
+            await commandAgentScheduleEnabled(args, true);
+            return;
+        case "delete":
+        case "rm":
+            await commandAgentScheduleDelete(args);
+            return;
+        case "run-now":
+        case "run":
+            await commandAgentScheduleRunNow(args);
+            return;
+        case "":
+        case "help":
+            console.log(AGENT_HELP);
+            return;
+        default:
+            throw new CliError(`Unknown agent schedule command: ${sub}\n\n${AGENT_HELP}`, 2);
+    }
+}
+async function commandAgentScheduleShow(args) {
+    assertKnownAgentOptions(args, ["json", "apiUrl"]);
+    const ref = agentScheduleAgentArg(args, "show");
+    const config = requireLogin(args);
+    const schedules = await fetchAgentSchedules(config, ref);
+    if (args.options.json) {
+        console.log(JSON.stringify(schedules, null, 2));
+        return;
+    }
+    if (schedules.length === 0) {
+        console.log(`Agent "${ref}" has no schedule.`);
+        return;
+    }
+    printSchedule(schedules[0]);
+}
+async function commandAgentScheduleSet(args, mode) {
+    assertKnownAgentOptions(args, [
+        "name",
+        "cron",
+        "schedule",
+        "timezone",
+        "enabled",
+        "disabled",
+        "json",
+        "apiUrl",
+    ]);
+    const ref = agentScheduleAgentArg(args, mode === "upsert" ? "set" : mode);
+    const config = requireLogin(args);
+    const existing = await fetchAgentSchedules(config, ref);
+    if (mode === "create" && existing.length > 0) {
+        throw new CliError(`Agent "${ref}" already has a schedule. Use \`railcode agent schedule set ${ref}\` to update it.`, 1);
+    }
+    if (mode === "update" && existing.length === 0) {
+        throw new CliError(`Agent "${ref}" has no schedule. Use \`railcode agent schedule set ${ref} --cron "0 9 * * *"\` to create one.`, 1);
+    }
+    const body = schedulePayload(args, existing.length === 0);
+    const path = existing.length === 0
+        ? `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/schedules`
+        : `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/schedules/${encodeURIComponent(existing[0].uuid)}`;
+    const resp = await authedFetch(config, path, {
+        method: existing.length === 0 ? "POST" : "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    const schedule = (await readJsonOrThrow(resp, `${existing.length === 0 ? "Create" : "Update"} agent schedule`));
+    if (args.options.json) {
+        console.log(JSON.stringify(schedule, null, 2));
+        return;
+    }
+    console.log(existing.length === 0 ? "Schedule created." : "Schedule updated.");
+    printSchedule(schedule);
+}
+async function commandAgentScheduleEnabled(args, enabled) {
+    assertKnownAgentOptions(args, ["json", "apiUrl"]);
+    const ref = agentScheduleAgentArg(args, enabled ? "resume" : "pause");
+    const config = requireLogin(args);
+    const schedule = await requireSingleSchedule(config, ref);
+    const updated = await patchAgentSchedule(config, ref, schedule.uuid, { enabled });
+    if (args.options.json) {
+        console.log(JSON.stringify(updated, null, 2));
+        return;
+    }
+    console.log(enabled ? "Schedule resumed." : "Schedule paused.");
+    printSchedule(updated);
+}
+async function commandAgentScheduleDelete(args) {
+    assertKnownAgentOptions(args, ["yes", "apiUrl"]);
+    const ref = agentScheduleAgentArg(args, "delete");
+    const config = requireLogin(args);
+    const schedule = await requireSingleSchedule(config, ref);
+    if (args.options.yes !== true) {
+        if (!process.stdin.isTTY) {
+            throw new CliError("Pass --yes to delete a schedule in a non-interactive session.", 2);
+        }
+        const answer = await prompt(`Delete schedule "${schedule.name}" for agent "${ref}"? [y/N] `);
+        if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
+            throw new CliError("Delete cancelled.", 1);
+        }
+    }
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/schedules/${encodeURIComponent(schedule.uuid)}`, { method: "DELETE" });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    if (!resp.ok) {
+        throw new CliError(`Delete agent schedule failed (${resp.status}): ${await errorDetail(resp)}`, 1);
+    }
+    console.log(`Schedule "${schedule.name}" deleted.`);
+}
+async function commandAgentScheduleRunNow(args) {
+    assertKnownAgentOptions(args, ["json", "trace", "apiUrl"]);
+    const ref = agentScheduleAgentArg(args, "run-now");
+    const config = requireLogin(args);
+    const schedule = await requireSingleSchedule(config, ref);
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/schedules/${encodeURIComponent(schedule.uuid)}/run-now`, { method: "POST" });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    const run = (await readJsonOrThrow(resp, `Run schedule "${schedule.name}"`));
+    printAgentRun(run, { json: args.options.json === true, trace: args.options.trace === true });
+}
+async function fetchAgents(config) {
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents`);
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    return (await readJsonOrThrow(resp, "List agents"));
+}
+async function fetchAgent(config, ref) {
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}`);
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    return (await readJsonOrThrow(resp, `Fetch agent "${ref}"`));
+}
+async function fetchAgentSchedules(config, ref) {
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/schedules`);
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    return (await readJsonOrThrow(resp, `List schedules for agent "${ref}"`));
+}
+async function patchAgentSchedule(config, ref, scheduleUuid, body) {
+    const resp = await authedFetch(config, `/api/organizations/${config.orgUuid}/agents/${encodeURIComponent(ref)}/schedules/${encodeURIComponent(scheduleUuid)}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (resp.status === 401)
+        await reLoginOrThrow();
+    return (await readJsonOrThrow(resp, "Update agent schedule"));
+}
+async function requireSingleSchedule(config, ref) {
+    const schedules = await fetchAgentSchedules(config, ref);
+    if (schedules.length === 0) {
+        throw new CliError(`Agent "${ref}" has no schedule.`, 1);
+    }
+    return schedules[0];
+}
+function readAgentManifest(args) {
+    const path = optionString(args, "file");
+    if (!path)
+        throw new CliError("Pass --file <agent-manifest.json>.", 2);
+    return readJsonObjectFile(path, "Agent manifest");
+}
+function readJsonObjectFile(path, label) {
+    const resolved = resolve(process.cwd(), path);
+    if (!existsSync(resolved))
+        throw new CliError(`${label} file not found: ${path}`, 2);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(resolved, "utf8"));
+    }
+    catch (error) {
+        throw new CliError(`${label} file is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, 2);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new CliError(`${label} file must contain a JSON object.`, 2);
+    }
+    return parsed;
+}
+function readJsonInput(args) {
+    const inline = optionString(args, "input");
+    const file = optionString(args, "inputFile");
+    if (inline !== undefined && file !== undefined) {
+        throw new CliError("Pass either --input or --input-file, not both.", 2);
+    }
+    if (inline === undefined && file === undefined)
+        return null;
+    const raw = inline ?? readFileSync(resolve(process.cwd(), file), "utf8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        throw new CliError(`Agent input is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, 2);
+    }
+}
+function schedulePayload(args, creating) {
+    const body = {};
+    const name = optionString(args, "name");
+    const cron = optionString(args, "cron") ?? optionString(args, "schedule");
+    const timezone = optionString(args, "timezone");
+    if (args.options.enabled === true && args.options.disabled === true) {
+        throw new CliError("Pass either --enabled or --disabled, not both.", 2);
+    }
+    if (name !== undefined)
+        body.name = name;
+    if (cron !== undefined)
+        body.schedule = cron;
+    if (timezone !== undefined)
+        body.timezone = timezone;
+    if (args.options.enabled === true)
+        body.enabled = true;
+    if (args.options.disabled === true)
+        body.enabled = false;
+    if (creating) {
+        if (!body.name)
+            body.name = "default";
+        if (!body.schedule)
+            throw new CliError("Creating an agent schedule requires --cron.", 2);
+        if (!body.timezone)
+            body.timezone = "UTC";
+        if (body.enabled === undefined)
+            body.enabled = true;
+    }
+    else if (Object.keys(body).length === 0) {
+        throw new CliError("Nothing to update. Pass --name, --cron, --timezone, --enabled or --disabled.", 2);
+    }
+    return body;
+}
+function agentArg(args, command) {
+    const ref = args.rest[1];
+    if (!ref || args.rest.length > 2) {
+        throw new CliError(`Usage: railcode agent ${command} <agent>`, 2);
+    }
+    return ref;
+}
+function agentScheduleAgentArg(args, command) {
+    const ref = args.rest[2];
+    if (!ref || args.rest.length > 3) {
+        throw new CliError(`Usage: railcode agent schedule ${command} <agent>`, 2);
+    }
+    return ref;
+}
+function printAgentMutation(result, json, verb) {
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`Agent "${result.agent.name}" ${verb}.`);
+    console.log(`UUID: ${result.agent.uuid}`);
+    if (result.warnings.length > 0) {
+        console.log("");
+        console.log("Warnings:");
+        for (const warning of result.warnings)
+            console.log(`- ${warning}`);
+    }
+}
+function printAgent(agent) {
+    console.log(agent.name);
+    console.log(`UUID: ${agent.uuid}`);
+    console.log(`Description: ${agent.description || "-"}`);
+    console.log(`Model: ${typeof agent.manifest.model === "string" ? agent.manifest.model : "-"}`);
+    console.log(`Updated: ${agent.updated_at}`);
+    console.log(`Content hash: ${agent.content_hash}`);
+}
+function printAgentRun(run, options) {
+    if (options.json) {
+        console.log(JSON.stringify(run, null, 2));
+        return;
+    }
+    console.log(`Status: ${run.status}`);
+    console.log(`Request: ${run.request_id}`);
+    if (run.error_code || run.error_message) {
+        console.log(`Error: ${[run.error_code, run.error_message].filter(Boolean).join(" - ")}`);
+    }
+    console.log("Output:");
+    console.log(JSON.stringify(run.output_json, null, 2));
+    if (options.trace) {
+        console.log("");
+        if (run.steps.length === 0) {
+            console.log("Trace: no steps");
+        }
+        else {
+            console.log("Trace:");
+            console.log(formatTable(["#", "kind", "status", "tool", "summary"], run.steps.map((step) => [
+                String(step.step_index),
+                step.kind,
+                step.status,
+                step.tool_name ?? "-",
+                step.result_summary ?? step.args_summary ?? step.error_message ?? "-",
+            ])));
+        }
+    }
+}
+function printSchedule(schedule) {
+    console.log(schedule.name);
+    console.log(`UUID: ${schedule.uuid}`);
+    console.log(`Cron: ${schedule.schedule}`);
+    console.log(`Timezone: ${schedule.timezone}`);
+    console.log(`Enabled: ${schedule.enabled ? "yes" : "no"}`);
+    console.log(`Next fire: ${schedule.next_fire_at}`);
+    console.log(`Last fire: ${schedule.last_fire_at ?? "-"}`);
+    console.log(`Last run: ${schedule.last_run_uuid ?? "-"}`);
+}
+function assertKnownAgentOptions(args, allowed) {
+    for (const key of Object.keys(args.options)) {
+        if (!allowed.includes(key)) {
+            throw new CliError(`Unknown option --${camelToKebab(key)} for \`railcode agent\`.\n\n${AGENT_HELP}`, 2);
+        }
+    }
+}
+function shortDate(value) {
+    return value.includes("T") ? value.slice(0, 10) : value;
+}
+// ---------------------------------------------------------------------------
 // db — list data connectors + run read-only SQL (`railcode db list|query`)
 //
 // Data connectors are org-wide, so these commands use the app-less org data
@@ -3552,7 +4291,7 @@ List options:
 
 Query options:
   --connection <name>                    Connector to query (default: default)
-  --engine <postgres|mysql>              Engine override (inferred from --connection otherwise)
+  --engine <postgres|bigquery|turso>      Engine override (inferred from --connection otherwise)
   --params '<json-array>'                Values for $1, $2, … placeholders
   --file <path>                          Read SQL from a file instead of the argument
   --json                                 Print the raw { columns, rows, rowcount, truncated } envelope
@@ -4903,6 +5642,10 @@ async function handleLocalApi(ctx, req, res, url) {
         sendJson(res, 200, [appUserEnvelope()]);
         return;
     }
+    if (path === "/roles") {
+        sendJson(res, 200, []);
+        return;
+    }
     if (path === "/config/design-system") {
         await handleDevDesignSystem(ctx, res);
         return;
@@ -5253,13 +5996,19 @@ async function handleDevDesignSystem(ctx, res) {
 // ── envelopes + http helpers ──────────────────────────────────────────────────
 function meEnvelope(ctx) {
     return {
-        user: { uuid: DEV_USER_UUID, name: "Local Dev", email: "dev@localhost" },
+        user: {
+            uuid: DEV_USER_UUID,
+            name: "Local Dev",
+            email: "dev@localhost",
+            is_admin: true,
+            roles: [],
+        },
         app: { uuid: DEV_APP_UUID, slug: ctx.app, name: titleCase(ctx.app) },
         org: { uuid: DEV_ORG_UUID, slug: "local", name: "Local" },
     };
 }
 function appUserEnvelope() {
-    return { uuid: DEV_USER_UUID, name: "Local Dev", email: "dev@localhost", role: "owner" };
+    return { uuid: DEV_USER_UUID, name: "Local Dev", email: "dev@localhost", is_admin: true };
 }
 function isLoopbackHost(host) {
     if (!host)

package/dist/manifest.js

@@ -16,6 +16,8 @@
 //   email: true
 //   adhoc_sql:
 //     - warehouse
+//   agents:
+//     - sales-digest
 //
 // Also supported, matching PyYAML: flow lists (`saved_queries: [a, b]`), a flow
 // map for connectors (`connectors: {stripe: [GET /v1/balance]}`), a whole-
@@ -31,7 +33,15 @@
 // test/manifest-fixtures.json (also run by
 // backend/tests/test_manifest_parse_fixtures.py) keeps the two parsers pinned.
 export const APP_MANIFEST_NAME = "manifest.yaml";
-const ALLOWED_KEYS = ["run_as", "saved_queries", "connectors", "llm", "email", "adhoc_sql"];
+const ALLOWED_KEYS = [
+    "run_as",
+    "saved_queries",
+    "connectors",
+    "llm",
+    "email",
+    "adhoc_sql",
+    "agents",
+];
 const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
 const SAVED_QUERY_NAME = /^[a-z0-9_]{1,80}$/;
 // PyYAML's YAML 1.1 plain-scalar resolver: a bare (unquoted) scalar matching one
@@ -385,6 +395,7 @@ export function parseManifestYaml(source) {
         llm: false,
         email: false,
         adhoc_sql: [],
+        agents: [],
     };
     for (const [key, entry] of entries) {
         if (key === "run_as") {
@@ -404,10 +415,12 @@ export function parseManifestYaml(source) {
             doc.connectors = parseConnectors(entry);
         }
         else {
-            // saved_queries / adhoc_sql: a list of names.
+            // saved_queries / adhoc_sql / agents: a list of names.
             const items = parseStringList(entry, key);
             if (key === "saved_queries")
                 doc.saved_queries = items;
+            else if (key === "agents")
+                doc.agents = items;
             else
                 doc.adhoc_sql = items;
         }
@@ -629,6 +642,7 @@ function validateDoc(doc, lines) {
     }
     doc.saved_queries = [...new Set(doc.saved_queries)].sort();
     doc.adhoc_sql = [...new Set(doc.adhoc_sql)].sort();
+    doc.agents = [...new Set(doc.agents)].sort();
     for (const name of Object.keys(doc.connectors)) {
         doc.connectors[name] = [...new Set(doc.connectors[name])].sort();
     }
@@ -673,6 +687,9 @@ export function renderManifestSummary(doc) {
     if (doc.adhoc_sql.length > 0) {
         lines.push("warning: adhoc_sql grants ad-hoc SQL authority — scarce by design; prefer saved queries");
     }
+    if (doc.agents.length > 0) {
+        lines.push(`agents: ${doc.agents.join(", ")}`);
+    }
     return lines.join("\n");
 }
 export function renderManifestDeployOutcome(m) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "railcode",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Developer CLI for the multi-tenant Railcode platform: log in, scaffold, and deploy static apps.",
   "license": "MIT",
   "type": "module",

package/static/sdk.js

@@ -35,7 +35,7 @@
       padding:2px 6px; border-radius:4px; white-space:nowrap; align-self:start; margin-top:2px; }
     .k-sql { background:#1e3a5f; color:#7cc4ff; } .k-db { background:#3a2752; color:#c79bff; }
     .k-files { background:#13413c; color:#5fd6c4; } .k-llm { background:#4a2b16; color:#f6b26b; }
-    .k-me, .k-connections, .k-app-users { background:#2a2f38; color:#9aa4b2; }
+    .k-me, .k-connections, .k-app-users, .k-roles { background:#2a2f38; color:#9aa4b2; }
     .body { min-width:0; }
     code { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size:11.5px; color:#e6e8eb;
       word-break:break-word; display:block; line-height:1.45; }
@@ -54,7 +54,7 @@
       <button id="collapse">Hide \u203A</button>
     </header>
     <div class="log" id="log"></div>
-    <footer>Calls made via <code>postgres()</code>, <code>llm</code>, <code>db</code>, <code>files</code>, <code>me()</code>, <code>appUsers()</code></footer>
+    <footer>Calls made via <code>postgres()</code>, <code>llm</code>, <code>db</code>, <code>files</code>, <code>me()</code>, <code>appUsers()</code>, <code>roles()</code></footer>
   </div>`;
   function mount() {
     (document.body || document.documentElement).appendChild(host);
@@ -219,6 +219,15 @@
     }();
   }
 
+  // ../sdk/src/agents.ts
+  async function doInvoke(name, input) {
+    return call("POST", `/agents/${encodeURIComponent(name)}`, { body: { input } });
+  }
+  function invoke(name, input) {
+    return track("agents", `agents.invoke(${q(name)})`, () => doInvoke(name, input));
+  }
+  var agents = { invoke };
+
   // ../sdk/src/databases.ts
   var QUERY_LABEL_MAX = 80;
   var PARAMS_LABEL_MAX = 40;
@@ -256,7 +265,7 @@
   var data = namespace();
   var postgres = namespace("postgres");
   var bigquery = namespace("bigquery");
-  var snowflake = namespace("snowflake");
+  var turso = namespace("turso");
   var dataConnectors = () => track("connections", "dataConnectors()", () => call("GET", "/connections"));
 
   // ../sdk/src/util.ts
@@ -268,9 +277,18 @@
   }
 
   // ../sdk/src/db.ts
+  function scopeParams(s) {
+    return { scope: s.scope, role: s.role };
+  }
+  function scopeLabel(s) {
+    if (s.scope === "user") return "db.user";
+    if (s.scope === "role") return `db.role(${q(s.role ?? "")})`;
+    return "db.shared";
+  }
   var Query = class {
-    constructor(collection) {
+    constructor(collection, scope) {
       this.collection = collection;
+      this.scope = scope;
       this._where = [];
     }
     where(field, op, value) {
@@ -300,11 +318,12 @@
         prefix: this._prefix,
         updated_since: this._since,
         updated_before: this._before,
+        ...scopeParams(this.scope),
         ...extra
       };
     }
     label(method) {
-      return `db.collection(${q(this.collection)}).${method}`;
+      return `${scopeLabel(this.scope)}.collection(${q(this.collection)}).${method}`;
     }
     async fetchPage(page, size) {
       const resp = await call("GET", `/kv/${encPath(this.collection)}`, {
@@ -331,16 +350,20 @@
     }
   };
   var Collection = class {
-    constructor(name) {
+    constructor(name, scope) {
       this.name = name;
+      this.scope = scope;
     }
     label(method) {
-      return `db.collection(${q(this.name)}).${method}`;
+      return `${scopeLabel(this.scope)}.collection(${q(this.name)}).${method}`;
     }
     /** The stored value for ``key``, or null if absent. */
     get(key) {
       return track("db", this.label(`get(${q(key)})`), async () => {
-        const record = await getOrNull(`/kv/${encPath(this.name)}/${encPath(key)}`);
+        const record = await getOrNull(
+          `/kv/${encPath(this.name)}/${encPath(key)}`,
+          scopeParams(this.scope)
+        );
         return record ? record.value : null;
       });
     }
@@ -348,7 +371,8 @@
     put(key, value) {
       return track("db", this.label(`put(${q(key)}, ${shorten(JSON.stringify(value), 40)})`), async () => {
         const record = await call("PUT", `/kv/${encPath(this.name)}/${encPath(key)}`, {
-          body: { value }
+          body: { value },
+          query: scopeParams(this.scope)
         });
         return record.value;
       });
@@ -357,18 +381,22 @@
       return track(
         "db",
         this.label(`delete(${q(key)})`),
-        () => call("DELETE", `/kv/${encPath(this.name)}/${encPath(key)}`)
+        () => call("DELETE", `/kv/${encPath(this.name)}/${encPath(key)}`, {
+          query: scopeParams(this.scope)
+        })
       );
     }
     /** All records in the collection (first page). */
     list() {
       return track("db", this.label("list()"), async () => {
-        const resp = await call("GET", `/kv/${encPath(this.name)}`);
+        const resp = await call("GET", `/kv/${encPath(this.name)}`, {
+          query: scopeParams(this.scope)
+        });
         return resp.items;
       });
     }
     query() {
-      return new Query(this.name);
+      return new Query(this.name, this.scope);
     }
     where(field, op, value) {
       return this.query().where(field, op, value);
@@ -377,8 +405,15 @@
       return this.query().prefix(value);
     }
   };
+  function namespace2(scope) {
+    return { collection: (name) => new Collection(name, scope) };
+  }
+  var shared = namespace2({});
   var db = {
-    collection: (name) => new Collection(name)
+    shared,
+    user: namespace2({ scope: "user" }),
+    role: (roleUuid) => namespace2({ scope: "role", role: roleUuid }),
+    collection: shared.collection
   };
 
   // ../sdk/src/design-system.ts
@@ -414,18 +449,41 @@
   var email = { send: send2 };
 
   // ../sdk/src/files.ts
+  var URL_EXPIRY_MARGIN_MS = 15e3;
+  var urlCache = /* @__PURE__ */ new Map();
+  function scopeParams2(s) {
+    return { scope: s.scope, role: s.role };
+  }
+  function scopeKey(s) {
+    if (s.scope === "user") return "user";
+    if (s.scope === "role") return `role:${s.role ?? ""}`;
+    return "shared";
+  }
+  function scopeLabel2(s) {
+    if (s.scope === "user") return "files.user";
+    if (s.scope === "role") return `files.role(${q(s.role ?? "")})`;
+    return "files.shared";
+  }
+  function cacheKey(s, name) {
+    return `${scopeKey(s)} ${name}`;
+  }
   function contentTypeOf(data2, explicit) {
     if (explicit) return explicit;
     if (data2 instanceof Blob && data2.type) return data2.type;
     return "application/octet-stream";
   }
-  function upload(name, data2, contentType) {
-    return track("files", `files.upload(${q(name)}, <blob>)`, () => doUpload(name, data2, contentType));
+  function upload(scope, name, data2, contentType) {
+    return track("files", `${scopeLabel2(scope)}.upload(${q(name)}, <blob>)`, async () => {
+      const result = await doUpload(scope, name, data2, contentType);
+      urlCache.delete(cacheKey(scope, name));
+      return result;
+    });
   }
-  async function doUpload(name, data2, contentType) {
+  async function doUpload(scope, name, data2, contentType) {
     const ct = contentTypeOf(data2, contentType);
     const target2 = await call("POST", "/files", {
-      body: { name, content_type: ct }
+      body: { name, content_type: ct },
+      query: scopeParams2(scope)
     });
     const headers = { "Content-Type": ct, ...target2.headers };
     if (target2.mode === "proxy") {
@@ -440,21 +498,79 @@
     }
     const resp = await fetch(target2.url, { method: target2.method, body: data2, headers });
     if (!resp.ok) throw new Error(`upload failed: ${resp.status}`);
-    return call("POST", "/files/finalize", { body: { name } });
+    return call("POST", "/files/finalize", { body: { name }, query: scopeParams2(scope) });
   }
-  function url(name) {
-    return buildUrl(`/files/${encPath(name)}`);
+  function url(scope, name) {
+    return buildUrl(`/files/${encPath(name)}`, scopeParams2(scope));
   }
-  var list = () => track("files", "files.list()", async () => {
-    const resp = await call("GET", "/files");
-    return resp.items;
-  });
-  var remove = (name) => track("files", `files.delete(${q(name)})`, () => call("DELETE", `/files/${encPath(name)}`));
-  var files = { upload, url, list, delete: remove };
+  async function urls(scope, names) {
+    return track("files", `${scopeLabel2(scope)}.urls(<${names.length} names>)`, async () => {
+      const unique = [...new Set(names)];
+      const now = Date.now();
+      const items = /* @__PURE__ */ new Map();
+      const unresolved = [];
+      for (const name of unique) {
+        const cached = urlCache.get(cacheKey(scope, name));
+        if (cached && cached.expiresAt > now + URL_EXPIRY_MARGIN_MS) items.set(name, cached.item);
+        else {
+          urlCache.delete(cacheKey(scope, name));
+          unresolved.push(name);
+        }
+      }
+      let missing = [];
+      if (unresolved.length) {
+        const resolved = await call("POST", "/files/urls", {
+          body: { names: unresolved },
+          query: scopeParams2(scope)
+        });
+        missing = resolved.missing;
+        for (const item of resolved.items) {
+          const normalized = { ...item, url: new URL(item.url, location.origin).toString() };
+          const expiresAt = item.expires_in === null ? Number.POSITIVE_INFINITY : now + item.expires_in * 1e3;
+          urlCache.set(cacheKey(scope, item.name), { item: normalized, expiresAt });
+          items.set(item.name, normalized);
+        }
+      }
+      return { items: unique.flatMap((name) => items.has(name) ? [items.get(name)] : []), missing };
+    });
+  }
+  function list(scope) {
+    return track("files", `${scopeLabel2(scope)}.list()`, async () => {
+      const resp = await call("GET", "/files", { query: scopeParams2(scope) });
+      return resp.items;
+    });
+  }
+  function remove(scope, name) {
+    return track("files", `${scopeLabel2(scope)}.delete(${q(name)})`, async () => {
+      await call("DELETE", `/files/${encPath(name)}`, { query: scopeParams2(scope) });
+      urlCache.delete(cacheKey(scope, name));
+    });
+  }
+  function fileNamespace(scope) {
+    return {
+      upload: (name, data2, contentType) => upload(scope, name, data2, contentType),
+      url: (name) => url(scope, name),
+      urls: (names) => urls(scope, names),
+      list: () => list(scope),
+      delete: (name) => remove(scope, name)
+    };
+  }
+  var shared2 = fileNamespace({});
+  var files = {
+    shared: shared2,
+    user: fileNamespace({ scope: "user" }),
+    role: (roleUuid) => fileNamespace({ scope: "role", role: roleUuid }),
+    upload: shared2.upload,
+    url: shared2.url,
+    urls: shared2.urls,
+    list: shared2.list,
+    delete: shared2.delete
+  };
 
   // ../sdk/src/identity.ts
   var me = () => track("me", "me()", () => call("GET", "/me"));
   var appUsers = () => track("app-users", "appUsers()", () => call("GET", "/app-users"));
+  var roles = () => track("roles", "roles()", () => call("GET", "/roles"));
 
   // ../sdk/src/llm.ts
   function label2(method, input, opts = {}) {
@@ -580,6 +696,7 @@
   target.files = files;
   target.me = me;
   target.appUsers = appUsers;
+  target.roles = roles;
   target.designSystem = designSystem;
   target.email = email;
   target.llm = llm;
@@ -587,10 +704,11 @@
   target.data = data;
   target.postgres = postgres;
   target.bigquery = bigquery;
-  target.snowflake = snowflake;
+  target.turso = turso;
   target.dataConnectors = dataConnectors;
   target.connector = connector;
   target.serviceConnectors = serviceConnectors;
   target.query = query;
   target.savedQueries = savedQueries;
+  target.agents = agents;
 })();