sovaria-cli 0.2.7__tar.gz → 0.2.8__tar.gz

sovaria_cli-0.2.8/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

sovaria_cli-0.2.8/.github/workflows/ci.yml

@@ -0,0 +1,174 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_call:
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp
+          sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
+      - name: Run Gitleaks
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            RANGE="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+          else
+            RANGE="HEAD~1..HEAD"
+          fi
+          echo "Scanning commit range: $RANGE"
+          gitleaks detect --source . --redact --no-banner --config .gitleaks.toml --log-opts="$RANGE"
+
+  lint:
+    name: Ruff
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install ruff
+        run: pip install "ruff>=0.9"
+      - name: Ruff check
+        run: |
+          ruff check \
+            apps/cli/src/commands/login.py \
+            apps/cli/src/commands/deploy.py \
+            apps/cli/src/commands/realtime.py \
+            apps/cli/src/utils/api_client.py \
+            apps/cli/src/utils/auth_store.py \
+            apps/cli/src/utils/config.py \
+            apps/cli/tests/test_aug18_cli_tickets.py \
+            apps/cli/tests/test_config_profiles.py
+
+  typecheck:
+    name: Mypy
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      # Fine-grained token with contents:read on sovaria/sovaria-sdk. Without it, CI installs the
+      # pinned SDK release from PyPI instead.
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install SDK + CLI
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -e ".[dev]"
+      - name: Mypy
+        run: |
+          mypy \
+            apps/cli/src/commands/login.py \
+            apps/cli/src/commands/deploy.py \
+            apps/cli/src/commands/realtime.py \
+            apps/cli/src/utils/api_client.py \
+            apps/cli/src/utils/auth_store.py \
+            apps/cli/src/utils/config.py
+
+  install-requirements:
+    name: requirements.txt install
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      # Fine-grained token with contents:read on sovaria/sovaria-sdk. Without it, CI installs the
+      # pinned SDK release from PyPI instead.
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install from requirements.txt
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -r requirements.txt
+          pip install --no-deps .
+      - name: sov --help
+        run: sov --help
+
+  test:
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install SDK + CLI
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest apps/cli/tests -q
+
+      - name: Build wheel
+        run: python -m build
+
+      - name: Validate wheel metadata
+        run: python -m twine check dist/*

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/.github/workflows/publish.yml

@@ -8,8 +8,13 @@ on:
         required: true
 
 jobs:
+  test:
+    if: github.event.inputs.confirm == 'publish'
+    uses: ./.github/workflows/ci.yml
+
   publish:
     if: github.event.inputs.confirm == 'publish'
+    needs: test
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/.gitignore

@@ -4,3 +4,7 @@ __pycache__/
 .mypy_cache/
 dist/
 *.egg-info/
+.env
+.env.*
+!.env.example
+!.env.*.example

sovaria_cli-0.2.8/.gitleaks.toml

@@ -0,0 +1,17 @@
+title = "Sovaria CLI gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Placeholder credentials and CLI test fixtures"
+paths = [
+  '''\.env\.example$''',
+  '''apps/cli/tests/''',
+]
+regexes = [
+  '''change-me''',
+  '''CHANGE_ME''',
+  '''do-not-use-in-prod''',
+  '''replace-with''',
+]

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sovaria-cli
-Version: 0.2.7
+Version: 0.2.8
 Summary: Sovaria BaaS command-line interface (sov)
 Project-URL: Homepage, https://sovaria.in
 Project-URL: Documentation, https://docs.sovaria.in/cli
@@ -12,14 +12,17 @@ Requires-Dist: httpx>=0.28.1
 Requires-Dist: keyring>=25.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich>=13.7.0
-Requires-Dist: sovaria-sdk>=0.2.0
+Requires-Dist: sovaria-sdk==0.4.0
 Requires-Dist: tomli-w>=1.2.0
 Requires-Dist: typer>=0.17.4
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.13; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.9; extra == 'dev'
 Requires-Dist: twine>=6.0; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: sovaria-sdk[mcp]==0.4.0; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Sovaria CLI
@@ -61,6 +64,43 @@ scripts/cli_sdk_happy_path.sh
 
 If you already have valid CLI tokens, omit `SOVARIA_EMAIL` and `SOVARIA_PASSWORD`.
 
+## Authentication
+
+```bash
+sov login
+sov login --email you@example.com
+sov login --file-storage          # headless: tokens in ~/.sovaria/credentials.toml
+sov logout
+sov logout --force                # clear local tokens if server revoke fails
+```
+
+- **Browser (PKCE):** authorize opens the console origin (`get_console_url`); the token exchange POSTs to the gateway `api_url` `/oauth/token` proxy. That split is intentional.
+- **Password:** never pass `--password`. Operator login prompts with `getpass`, or reads `SOVARIA_PASSWORD`.
+- **Product user create:** `sov auth-product create --email ...` prompts for the new user's password, or reads `SOVARIA_USER_PASSWORD`. Do not reuse `SOVARIA_PASSWORD` (that is the operator login secret).
+- **Magic link:** `sov auth magic-link verify` reads the token from stdin or `SOVARIA_MAGIC_TOKEN`.
+- **GitHub deploy PAT:** set `SOVARIA_GITHUB_TOKEN` or use `gh auth token`. There is no `--token` flag.
+- **OAuth callback:** binds `127.0.0.1` by default. Non-loopback `SOVARIA_CLI_CALLBACK_HOST` requires `--insecure-callback`.
+
+### Token refresh contract
+
+Axis supports two refresh modes. Do not mix them:
+
+| Client | How refresh is sent |
+|---|---|
+| **CLI / Python SDK** | JSON body: `POST /api/v1/auth/refresh` with `{"refresh_token": "<stored>"}`. The CLI keeps the refresh token in OS keyring (or `credentials.toml` with `--file-storage`). |
+| **Console / browser** | Empty JSON body `{}` plus the HttpOnly refresh cookie. The browser never puts the refresh token in the request body. |
+
+Copying the console cookie pattern into a CLI or SDK client will fail silently (no cookie jar). Copying the CLI JSON-body pattern into a browser app bypasses HttpOnly cookie storage.
+
+### Pulse WebSocket URLs
+
+`sov realtime ws-url` issues an opaque `ticket=` query parameter. Never put a JWT in `?token=` — production gateways disable `GATEWAY_WS_ALLOW_QUERY_TOKEN`. Local `.env.local` may still enable the legacy query-token path; do not copy that into clients.
+
+```bash
+sov realtime ws-url my-channel --org <org_id> --project <project_id>
+# wss://api.sovaria.in/api/v1/rt/ws/my-channel?ticket=...&org_id=...&project_id=...
+```
+
 ## Core Command Groups
 
 - `sov auth ...` auth login/logout

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/apps/cli/README.md

@@ -37,6 +37,43 @@ scripts/cli_sdk_happy_path.sh
 
 If you already have valid CLI tokens, omit `SOVARIA_EMAIL` and `SOVARIA_PASSWORD`.
 
+## Authentication
+
+```bash
+sov login
+sov login --email you@example.com
+sov login --file-storage          # headless: tokens in ~/.sovaria/credentials.toml
+sov logout
+sov logout --force                # clear local tokens if server revoke fails
+```
+
+- **Browser (PKCE):** authorize opens the console origin (`get_console_url`); the token exchange POSTs to the gateway `api_url` `/oauth/token` proxy. That split is intentional.
+- **Password:** never pass `--password`. Operator login prompts with `getpass`, or reads `SOVARIA_PASSWORD`.
+- **Product user create:** `sov auth-product create --email ...` prompts for the new user's password, or reads `SOVARIA_USER_PASSWORD`. Do not reuse `SOVARIA_PASSWORD` (that is the operator login secret).
+- **Magic link:** `sov auth magic-link verify` reads the token from stdin or `SOVARIA_MAGIC_TOKEN`.
+- **GitHub deploy PAT:** set `SOVARIA_GITHUB_TOKEN` or use `gh auth token`. There is no `--token` flag.
+- **OAuth callback:** binds `127.0.0.1` by default. Non-loopback `SOVARIA_CLI_CALLBACK_HOST` requires `--insecure-callback`.
+
+### Token refresh contract
+
+Axis supports two refresh modes. Do not mix them:
+
+| Client | How refresh is sent |
+|---|---|
+| **CLI / Python SDK** | JSON body: `POST /api/v1/auth/refresh` with `{"refresh_token": "<stored>"}`. The CLI keeps the refresh token in OS keyring (or `credentials.toml` with `--file-storage`). |
+| **Console / browser** | Empty JSON body `{}` plus the HttpOnly refresh cookie. The browser never puts the refresh token in the request body. |
+
+Copying the console cookie pattern into a CLI or SDK client will fail silently (no cookie jar). Copying the CLI JSON-body pattern into a browser app bypasses HttpOnly cookie storage.
+
+### Pulse WebSocket URLs
+
+`sov realtime ws-url` issues an opaque `ticket=` query parameter. Never put a JWT in `?token=` — production gateways disable `GATEWAY_WS_ALLOW_QUERY_TOKEN`. Local `.env.local` may still enable the legacy query-token path; do not copy that into clients.
+
+```bash
+sov realtime ws-url my-channel --org <org_id> --project <project_id>
+# wss://api.sovaria.in/api/v1/rt/ws/my-channel?ticket=...&org_id=...&project_id=...
+```
+
 ## Core Command Groups
 
 - `sov auth ...` auth login/logout

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/apps/cli/src/__init__.py

@@ -1,3 +1,3 @@
 """Sovaria CLI — sov command."""
 
-__version__ = "0.2.7"
+__version__ = "0.2.8"

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/apps/cli/src/commands/auth_product.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import getpass
+import os
 from typing import TypedDict
 from urllib.parse import quote
 
@@ -9,7 +11,7 @@ import typer
 
 from apps.cli.src.utils.api_client import CLIRequestError, call_api
 from apps.cli.src.utils.display import handle_cli_error, print_json
-from apps.cli.src.utils.premium_display import run_with_spinner
+from apps.cli.src.utils.premium_display import print_error_panel, run_with_spinner
 from apps.cli.src.utils.config import get_scope
 
 app = typer.Typer(help="Manage product users within an org/project scope")
@@ -33,6 +35,19 @@ def _scope_args(
     }
 
 
+def _read_new_user_password() -> str:
+    env = (os.getenv("SOVARIA_USER_PASSWORD") or "").strip()
+    if env:
+        return env
+    password = getpass.getpass("New user password: ")
+    if not password:
+        print_error_panel(
+            "Password is required. Enter it at the prompt or set SOVARIA_USER_PASSWORD."
+        )
+        raise typer.Exit(1)
+    return password
+
+
 def _project_auth_path(profile: str | None, project_id: str | None, suffix: str) -> str:
     resolved_project = (project_id or get_scope(profile).get("project_id") or "").strip()
     if not resolved_project:
@@ -164,7 +179,6 @@ def set_roles(
 @app.command("create")
 def create_user(
     email: str = typer.Option(..., "--email"),
-    password: str = typer.Option(..., "--password"),
     name: str | None = typer.Option(None, "--name", help="Display name (defaults to email local-part)"),
     profile: str | None = typer.Option(None, "--profile"),
     org_id: str | None = typer.Option(None, "--org"),
@@ -173,6 +187,7 @@ def create_user(
 ) -> None:
     """Create a product user in the current project scope."""
     display_name = name or email.split("@", maxsplit=1)[0]
+    password = _read_new_user_password()
     try:
         result = run_with_spinner(
             f"Creating user {email}…",

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/apps/cli/src/commands/deploy.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 
 import io
 import json
+import os
+import subprocess
 import time
 import zipfile
 from pathlib import Path
@@ -13,8 +15,18 @@ import httpx
 import typer
 
 from apps.cli.src.utils.api_client import CLIRequestError, build_request_context, call_api
-from apps.cli.src.utils.display import handle_cli_error, handle_command_error, print_json, print_success
-from apps.cli.src.utils.premium_display import format_http_error, poll_with_progress, print_error_panel, run_with_spinner
+from apps.cli.src.utils.display import (
+    handle_cli_error,
+    handle_command_error,
+    print_json,
+    print_success,
+)
+from apps.cli.src.utils.premium_display import (
+    format_http_error,
+    poll_with_progress,
+    print_error_panel,
+    run_with_spinner,
+)
 from apps.cli.src.utils.project_context import resolve_scope
 
 app = typer.Typer()
@@ -25,6 +37,27 @@ _ASYNC_POLL_INTERVAL = 2  # seconds
 _ASYNC_POLL_TIMEOUT = 600  # seconds
 
 
+def _github_pat() -> str | None:
+    """Resolve a GitHub PAT from SOVARIA_GITHUB_TOKEN or `gh auth token`."""
+    env = (os.getenv("SOVARIA_GITHUB_TOKEN") or "").strip()
+    if env:
+        return env
+    try:
+        completed = subprocess.run(
+            ["gh", "auth", "token"],
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=8,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+        return None
+    if completed.returncode != 0:
+        return None
+    token = (completed.stdout or "").strip()
+    return token or None
+
+
 def _http_error_panel(exc: httpx.HTTPStatusError, *, path: str) -> None:
     detail: object = exc.response.text
     try:
@@ -64,8 +97,10 @@ def _forge_context(
         return api_url, headers, resolved_org, resolved_project
     except CLIRequestError as exc:
         handle_cli_error(exc)
+        raise
     except ValueError as exc:
         handle_command_error(exc)
+        raise
 
 
 @app.command("deploy")
@@ -112,10 +147,32 @@ def deploy(
 
     headers = dict(headers)
 
+    def _plan() -> dict[str, Any]:
+        resp = httpx.post(
+            f"{api_url}/api/v1/fn/plan",
+            headers=headers,
+            files={"bundle": (f"{fn_name}.zip", zip_bytes, "application/zip")},
+            data={"name": fn_name, "project_id": effective_project},
+            timeout=60,
+        )
+        resp.raise_for_status()
+        return resp.json()
+
+    # Plan first: Forge validates the bundle and signs a plan bound to these exact
+    # bytes; the deploy below applies only what was planned.
+    try:
+        plan = run_with_spinner("Planning deploy…", _plan, success="Plan approved")
+    except httpx.HTTPStatusError as exc:
+        _http_error_panel(exc, path="/api/v1/fn/plan")
+    plan_token = str(plan.get("token") or "")
+    if not wants_json():
+        for check in plan.get("checks") or []:
+            typer.echo(f"  ✓ {check.get('check')}")
+
     def _upload() -> dict[str, Any]:
         resp = httpx.post(
             f"{api_url}/api/v1/fn/deploy",
-            headers=headers,
+            headers={**headers, "X-Sovaria-Deploy-Plan": plan_token} if plan_token else headers,
             files={"bundle": (f"{fn_name}.zip", zip_bytes, "application/zip")},
             data={
                 "name": fn_name,
@@ -1111,15 +1168,18 @@ def bindings_set(
 
 @app.command("github-repos")
 def github_repos(
-    token: str | None = typer.Option(None, "--token", help="Optional GitHub PAT override"),
     limit: int = typer.Option(30, "--limit", min=1, max=100),
     profile: str | None = typer.Option(None, "--profile"),
     org_id: str | None = typer.Option(None, "--org"),
     project_id: str | None = typer.Option(None, "--project"),
     env_id: str | None = typer.Option(None, "--env"),
 ) -> None:
-    """List GitHub repositories available for import."""
+    """List GitHub repositories available for import.
+
+    Optional PAT: set SOVARIA_GITHUB_TOKEN or authenticate with `gh auth login`.
+    """
     body: dict[str, object] = {"limit": limit}
+    token = _github_pat()
     if token:
         body["token"] = token
     try:
@@ -1148,19 +1208,22 @@ def github_import(
     repository: str = typer.Option(..., "--repo", help="owner/repo"),
     path: str = typer.Option(..., "--path", help="Path within the repository"),
     ref: str = typer.Option("main", "--ref"),
-    token: str | None = typer.Option(None, "--token"),
     profile: str | None = typer.Option(None, "--profile"),
     org_id: str | None = typer.Option(None, "--org"),
     project_id: str | None = typer.Option(None, "--project"),
     env_id: str | None = typer.Option(None, "--env"),
 ) -> None:
-    """Import a function from a GitHub repository path."""
+    """Import a function from a GitHub repository path.
+
+    Optional PAT: set SOVARIA_GITHUB_TOKEN or authenticate with `gh auth login`.
+    """
     body: dict[str, object] = {
         "function_name": function_name,
         "repository": repository,
         "path": path,
         "ref": ref,
     }
+    token = _github_pat()
     if token:
         body["token"] = token
     try:
@@ -1190,7 +1253,6 @@ def github_commit(
     path: str = typer.Option(..., "--path", help="Target path in the repository"),
     message: str = typer.Option(..., "--message", help="Commit message"),
     ref: str = typer.Option("main", "--ref"),
-    token: str | None = typer.Option(None, "--token"),
     committer_name: str | None = typer.Option(None, "--committer-name"),
     committer_email: str | None = typer.Option(None, "--committer-email"),
     profile: str | None = typer.Option(None, "--profile"),
@@ -1198,7 +1260,10 @@ def github_commit(
     project_id: str | None = typer.Option(None, "--project"),
     env_id: str | None = typer.Option(None, "--env"),
 ) -> None:
-    """Commit local function source back to GitHub."""
+    """Commit local function source back to GitHub.
+
+    Optional PAT: set SOVARIA_GITHUB_TOKEN or authenticate with `gh auth login`.
+    """
     body: dict[str, object] = {
         "function_name": function_name,
         "repository": repository,
@@ -1206,6 +1271,7 @@ def github_commit(
         "message": message,
         "ref": ref,
     }
+    token = _github_pat()
     if token:
         body["token"] = token
     if committer_name:

{sovaria_cli-0.2.7 → sovaria_cli-0.2.8}/apps/cli/src/commands/governance.py

@@ -277,6 +277,25 @@ def db_resize(
     )
 
 
+@app.command("db-reconcile")
+def db_reconcile(
+    org_id: str = typer.Argument(..., help="Organisation / tenant ID"),
+    project_id: str = typer.Argument(..., help="Project ID"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Backfill tenant Postgres mirrors (policies, functions, platform schemas)."""
+    premium_mutate(
+        "Reconciling tenant data plane…",
+        success="Reconciled",
+        title="Database reconcile",
+        method="POST",
+        path=_gov_path("tenants", org_id, "databases", project_id, "reconcile"),
+        profile=profile,
+        require_scope=False,
+        body={},
+    )
+
+
 @app.command("db-backups")
 def db_backups(
     org_id: str = typer.Argument(..., help="Organisation / tenant ID"),