@burdenoff/bigconsole-cli 2026.802.1 → 2026.1029.1

package/dist/graphql/operations.js

@@ -38,10 +38,10 @@ export const LIST_DASHBOARDS = `
     $first: Int
     $after: String
     $search: String
-    $visibility: DashboardVisibility
-    $category: DashboardCategory
+    $visibility: BigConsoleDashboardVisibility
+    $category: BigConsoleDashboardCategory
     $includeArchived: Boolean
-    $sortBy: DashboardSortField
+    $sortBy: BigConsoleDashboardSortField
     $sortOrder: SortOrder
   ) {
     listDashboards(
@@ -106,7 +106,7 @@ export const DELETE_DASHBOARD = `
 // Widgets (workspace gateway)
 // ---------------------------------------------------------------------------
 export const LIST_WIDGETS = `
-  query ListWidgets($pageId: ID!, $first: Int, $after: String, $type: WidgetType) {
+  query ListWidgets($pageId: ID!, $first: Int, $after: String, $type: BigConsoleWidgetType) {
     listWidgets(pageId: $pageId, first: $first, after: $after, type: $type) {
       edges {
         node {
@@ -204,12 +204,25 @@ export const GET_DATASINK = `
 `;
 export const GET_DATASINK_DATA = `
   query GetDataSinkData($id: ID, $key: String, $dataPath: String, $forceRefresh: Boolean) {
-    getDataSinkData(id: $id, key: $key, dataPath: $dataPath, forceRefresh: $forceRefresh)
+    getDataSinkData(id: $id, key: $key, dataPath: $dataPath, forceRefresh: $forceRefresh) {
+      raw
+      extracted
+      cached
+      fetchedAt
+      version
+      totalCount
+      hasMore
+      limit
+      offset
+    }
   }
 `;
 export const DELETE_DATASINK = `
   mutation DeleteDataSink($id: ID!) {
-    deleteDataSink(id: $id)
+    deleteDataSink(id: $id) {
+      id
+      name
+    }
   }
 `;
 // ---------------------------------------------------------------------------
@@ -342,7 +355,7 @@ export const UPDATE_DASHBOARD = `
   }
 `;
 export const IMPORT_DASHBOARD = `
-  mutation ImportDashboard($input: ImportDashboardInput!) {
+  mutation ImportDashboard($input: BigConsoleImportDashboardInput!) {
     importDashboard(input: $input) {
       id
       name
@@ -354,8 +367,8 @@ export const IMPORT_DASHBOARD = `
   }
 `;
 export const EXPORT_DASHBOARD = `
-  query ExportDashboard($id: ID!, $includeComments: Boolean, $options: ExportDashboardOptions) {
-    exportDashboard(id: $id, includeComments: $includeComments, options: $options)
+  query ExportDashboard($id: ID!, $options: BigConsoleExportDashboardOptions) {
+    exportDashboard(id: $id, options: $options)
   }
 `;
 // ---------------------------------------------------------------------------
@@ -474,15 +487,28 @@ export const GET_WIDGET_ACTIONS = `
       id
       widgetId
       type
+      name
       label
-      config
+      order
+      disabled
+      hidden
       createdAt
     }
   }
 `;
 export const DELETE_WIDGET_DRILLDOWN = `
-  mutation DeleteWidgetDrilldown($widgetId: ID!) {
-    deleteWidgetDrilldown(widgetId: $widgetId)
+  mutation DeleteWidgetDrilldown($id: ID!) {
+    deleteWidgetDrilldown(id: $id)
+  }
+`;
+export const GET_WIDGET_DRILLDOWN = `
+  query GetWidgetDrilldown($id: ID!) {
+    getWidget(id: $id) {
+      id
+      drilldown {
+        id
+      }
+    }
   }
 `;
 // ---------------------------------------------------------------------------
@@ -494,8 +520,8 @@ export const LIST_DASHBOARD_SHARES = `
     $first: Int
     $after: String
     $isActive: Boolean
-    $permission: SharePermission
-    $recipientType: ShareRecipientType
+    $permission: BigConsoleDashboardSharePermission
+    $recipientType: BigConsoleDashboardShareRecipientType
   ) {
     listDashboardShares(
       dashboardId: $dashboardId
@@ -527,7 +553,7 @@ export const LIST_TEMPLATES = `
   query ListTemplates(
     $first: Int
     $after: String
-    $category: DashboardCategory
+    $category: BigConsoleDashboardCategory
     $search: String
     $isFeatured: Boolean
   ) {
@@ -571,7 +597,7 @@ export const GET_TEMPLATE = `
 // Prompt (AI) — generate, list, get, cancel
 // ---------------------------------------------------------------------------
 export const GENERATE_DASHBOARD_FROM_PROMPT = `
-  mutation GenerateDashboardFromPrompt($input: GenerateDashboardFromPromptInput!) {
+  mutation GenerateDashboardFromPrompt($input: BigConsoleGenerateDashboardFromPromptInput!) {
     generateDashboardFromPrompt(input: $input) {
       id
       status
@@ -607,8 +633,8 @@ export const GET_PROMPT_GENERATION = `
   }
 `;
 export const CANCEL_PROMPT_GENERATION = `
-  mutation CancelPromptGeneration($id: ID!) {
-    cancelPromptGeneration(id: $id) {
+  mutation CancelPromptGeneration($generationId: ID!) {
+    cancelPromptGeneration(generationId: $generationId) {
       id
       status
     }

package/dist/index.d.ts

@@ -2,5 +2,5 @@
  * @burdenoff/bigconsole-cli — public API exports.
  */
 export * from './config/index.js';
-export { workspaceRequest, globalRequest, resetClients } from './graphql/client.js';
+export { workspaceRequest, globalRequest, resetClients, BigConsoleRequestError, } from './graphql/client.js';
 export * from './commands/index.js';

package/dist/index.js

@@ -2,5 +2,5 @@
  * @burdenoff/bigconsole-cli — public API exports.
  */
 export * from './config/index.js';
-export { workspaceRequest, globalRequest, resetClients } from './graphql/client.js';
+export { workspaceRequest, globalRequest, resetClients, BigConsoleRequestError, } from './graphql/client.js';
 export * from './commands/index.js';

package/dist/utils/index.d.ts

@@ -1 +1,2 @@
 export * from './output.js';
+export * from './sanitize.js';

package/dist/utils/index.js

@@ -1 +1,2 @@
 export * from './output.js';
+export * from './sanitize.js';

package/dist/utils/output.d.ts

@@ -1,6 +1,12 @@
 /**
  * Output utilities for CLI display.
  * Provides consistent formatting for both interactive and non-interactive modes.
+ *
+ * stdout carries only command data (JSON, YAML, tables); status lines
+ * (success, info, warning, error) go to stderr so piping stays clean. Remote
+ * strings are made inert before they reach the terminal: tables and status
+ * lines pass through `sanitizeForTerminal`, while JSON and YAML stay exact
+ * data and only use escape forms their own syntax defines.
  */
 export type OutputFormat = 'json' | 'table' | 'yaml';
 /**
@@ -13,32 +19,47 @@ export declare function isInteractive(): boolean;
 export declare function getFormat(options: {
     format?: string;
 }): OutputFormat;
+/**
+ * Serialize data as pretty-printed JSON. Characters in
+ * {@link JSON_DISPLAY_ESCAPES} can only occur inside JSON strings, so writing
+ * them as `\uXXXX` escapes leaves the parsed value unchanged.
+ */
+export declare function toJson(data: unknown): string;
 /**
  * Print data as formatted JSON.
  */
 export declare function printJson(data: unknown): void;
 /**
- * Print data as a simple ASCII table.
+ * Print data as a simple ASCII table. Headers and cells are sanitized for the
+ * terminal (single line, no control sequences) before widths are measured;
+ * columns are padded to at most {@link MAX_COLUMN_WIDTH} characters.
  */
 export declare function printTable(headers: string[], rows: string[][]): void;
 /**
- * Print data as YAML-like output (simple key-value).
+ * Serialize data as YAML with js-yaml, restricted to the JSON schema (no
+ * custom tags) and without anchors/aliases. Control characters are escaped by
+ * the dumper; bidirectional controls, which YAML treats as printable, are
+ * written as `\uXXXX` inside double-quoted scalars.
+ */
+export declare function toYaml(data: unknown): string;
+/**
+ * Print data as YAML.
  */
 export declare function printYaml(data: unknown): void;
 /**
- * Print a success message.
+ * Print a success message (stderr).
  */
 export declare function printSuccess(message: string): void;
 /**
- * Print an error message to stderr.
+ * Print an error message to stderr. Credential-shaped values are masked.
  */
 export declare function printError(message: string): void;
 /**
- * Print a warning message.
+ * Print a warning message to stderr. Credential-shaped values are masked.
  */
 export declare function printWarning(message: string): void;
 /**
- * Print an info message.
+ * Print an info message (stderr).
  */
 export declare function printInfo(message: string): void;
 /**
@@ -57,6 +78,7 @@ export declare function outputData(format: OutputFormat, data: unknown, tableCon
     rows: string[][];
 }): void;
 /**
- * Truncate a string to a maximum length, appending ellipsis if needed.
+ * Sanitize a string for the terminal, then truncate it to a maximum length,
+ * appending an ellipsis if needed.
  */
 export declare function truncate(str: string | null | undefined, maxLen: number): string;

package/dist/utils/output.js

@@ -1,7 +1,17 @@
 /**
  * Output utilities for CLI display.
  * Provides consistent formatting for both interactive and non-interactive modes.
+ *
+ * stdout carries only command data (JSON, YAML, tables); status lines
+ * (success, info, warning, error) go to stderr so piping stays clean. Remote
+ * strings are made inert before they reach the terminal: tables and status
+ * lines pass through `sanitizeForTerminal`, while JSON and YAML stay exact
+ * data and only use escape forms their own syntax defines.
  */
+import { DEFAULT_SCALAR_STYLE_RULES, JSON_SCHEMA, SCALAR_STYLE, dump, strTag, } from 'js-yaml';
+import { escapeBidiControls, redactSecrets, sanitizeForTerminal, toUnicodeEscape, } from './sanitize.js';
+/** Widest a table column is padded to; longer cells extend past it. */
+const MAX_COLUMN_WIDTH = 50;
 /**
  * Check if the current terminal session is interactive (TTY).
  */
@@ -16,101 +26,140 @@ export function getFormat(options) {
         const f = options.format.toLowerCase();
         if (f === 'json' || f === 'table' || f === 'yaml')
             return f;
+        if (f === 'yml')
+            return 'yaml';
     }
     return isInteractive() ? 'table' : 'json';
 }
+/**
+ * Characters that are valid raw inside JSON strings but act on, or are
+ * invisible in, a terminal: DEL, C1 controls, line/paragraph separators and
+ * bidirectional formatting controls.
+ */
+const JSON_DISPLAY_ESCAPES = /[\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+/**
+ * Serialize data as pretty-printed JSON. Characters in
+ * {@link JSON_DISPLAY_ESCAPES} can only occur inside JSON strings, so writing
+ * them as `\uXXXX` escapes leaves the parsed value unchanged.
+ */
+export function toJson(data) {
+    const json = JSON.stringify(data, null, 2) ?? 'null';
+    return json.replace(JSON_DISPLAY_ESCAPES, toUnicodeEscape);
+}
 /**
  * Print data as formatted JSON.
  */
 export function printJson(data) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(toJson(data));
 }
 /**
- * Print data as a simple ASCII table.
+ * Print data as a simple ASCII table. Headers and cells are sanitized for the
+ * terminal (single line, no control sequences) before widths are measured;
+ * columns are padded to at most {@link MAX_COLUMN_WIDTH} characters.
  */
 export function printTable(headers, rows) {
     if (headers.length === 0)
         return;
-    const colWidths = headers.map((h, i) => {
-        let max = h.length;
-        for (const row of rows) {
-            const cell = row[i] ?? '';
-            if (cell.length > max)
-                max = cell.length;
-        }
-        return Math.min(max, 50);
-    });
+    const header = headers.map((h) => sanitizeForTerminal(h));
+    const body = rows.map((row) => headers.map((_, i) => sanitizeForTerminal(row[i])));
+    const colWidths = header.map((h, i) => Math.min(body.reduce((max, row) => Math.max(max, (row[i] ?? '').length), h.length), MAX_COLUMN_WIDTH));
     const separator = colWidths.map((w) => '-'.repeat(w + 2)).join('+');
-    const formatRow = (cells) => cells.map((cell, i) => ` ${(cell ?? '').padEnd(colWidths[i] ?? 0)} `).join('|');
-    console.log(formatRow(headers));
+    const formatRow = (cells) => cells.map((cell, i) => ` ${cell.padEnd(colWidths[i] ?? 0)} `).join('|');
+    console.log(formatRow(header));
     console.log(separator);
-    for (const row of rows) {
+    for (const row of body) {
         console.log(formatRow(row));
     }
 }
+function allowsStyle(mask, style) {
+    return (mask & (1 << style)) !== 0;
+}
+/** Bidirectional formatting controls (see `escapeBidiControls`). */
+const BIDI_CONTROL = /[\u202a-\u202e\u2066-\u2069]/;
 /**
- * Print data as YAML-like output (simple key-value).
+ * Strings that read back as the same string under the YAML 1.2 JSON and core
+ * schemas and under YAML 1.1: a letter first, then only letters, digits,
+ * spaces and `_ . / @ + -`, and not one of the words those schemas map to
+ * booleans or null.
  */
-export function printYaml(data) {
-    if (typeof data !== 'object' || data === null) {
-        console.log(String(data));
+const UNAMBIGUOUS_PLAIN = /^\p{L}[\p{L}\p{N} _./@+-]*$/u;
+const NON_STRING_WORDS = /^(?:y|n|yes|no|on|off|true|false|null)$/i;
+/**
+ * Double-quote any scalar containing a bidirectional formatting control.
+ * Double-quoted YAML supports `\uXXXX` escapes, so `toYaml` can then write
+ * those characters visibly without changing the parsed value.
+ */
+const doubleQuoteBidiControls = (layout) => {
+    if (BIDI_CONTROL.test(layout.node.value))
+        layout.style = SCALAR_STYLE.DOUBLE_QUOTED;
+};
+/**
+ * Quote string scalars (keys and values) that another YAML parser could read
+ * as a number, boolean, null, date or merge key. The JSON schema alone leaves
+ * values such as `yes`, `~`, `0x1F`, `2026-01-01` or the empty string plain.
+ * Runs after the default rules, so strings with invisible characters are
+ * already double-quoted and multi-line strings already use block scalars.
+ */
+const quoteAmbiguousStrings = (layout) => {
+    if (layout.style !== SCALAR_STYLE.PLAIN || layout.node.tag !== strTag.tagName)
         return;
-    }
-    const lines = yamlSerialize(data, 0);
-    console.log(lines);
-}
-function yamlSerialize(obj, indent) {
-    const prefix = '  '.repeat(indent);
-    const lines = [];
-    for (const [key, value] of Object.entries(obj)) {
-        if (value === null || value === undefined) {
-            lines.push(`${prefix}${key}: null`);
-        }
-        else if (Array.isArray(value)) {
-            lines.push(`${prefix}${key}:`);
-            for (const item of value) {
-                if (typeof item === 'object' && item !== null) {
-                    lines.push(`${prefix}  -`);
-                    lines.push(yamlSerialize(item, indent + 2));
-                }
-                else {
-                    lines.push(`${prefix}  - ${String(item)}`);
-                }
-            }
-        }
-        else if (typeof value === 'object') {
-            lines.push(`${prefix}${key}:`);
-            lines.push(yamlSerialize(value, indent + 1));
-        }
-        else {
-            lines.push(`${prefix}${key}: ${String(value)}`);
-        }
-    }
-    return lines.join('\n');
+    const value = layout.node.value;
+    if (UNAMBIGUOUS_PLAIN.test(value) && !NON_STRING_WORDS.test(value))
+        return;
+    layout.style = allowsStyle(layout.allowedStylesMask, SCALAR_STYLE.SINGLE_QUOTED)
+        ? SCALAR_STYLE.SINGLE_QUOTED
+        : SCALAR_STYLE.DOUBLE_QUOTED;
+};
+const YAML_STYLE_RULES = [
+    doubleQuoteBidiControls,
+    ...Object.values(DEFAULT_SCALAR_STYLE_RULES),
+    quoteAmbiguousStrings,
+];
+/**
+ * Serialize data as YAML with js-yaml, restricted to the JSON schema (no
+ * custom tags) and without anchors/aliases. Control characters are escaped by
+ * the dumper; bidirectional controls, which YAML treats as printable, are
+ * written as `\uXXXX` inside double-quoted scalars.
+ */
+export function toYaml(data) {
+    const yaml = dump(data ?? null, {
+        schema: JSON_SCHEMA,
+        noRefs: true,
+        skipInvalid: true,
+        lineWidth: -1,
+        scalarStyleRules: YAML_STYLE_RULES,
+    });
+    return escapeBidiControls(yaml).trimEnd();
+}
+/**
+ * Print data as YAML.
+ */
+export function printYaml(data) {
+    console.log(toYaml(data));
 }
 /**
- * Print a success message.
+ * Print a success message (stderr).
  */
 export function printSuccess(message) {
-    console.log(`\u2713 ${message}`);
+    console.error(`\u2713 ${sanitizeForTerminal(message)}`);
 }
 /**
- * Print an error message to stderr.
+ * Print an error message to stderr. Credential-shaped values are masked.
  */
 export function printError(message) {
-    console.error(`\u2717 ${message}`);
+    console.error(`\u2717 ${redactSecrets(sanitizeForTerminal(message))}`);
 }
 /**
- * Print a warning message.
+ * Print a warning message to stderr. Credential-shaped values are masked.
  */
 export function printWarning(message) {
-    console.warn(`! ${message}`);
+    console.warn(`! ${redactSecrets(sanitizeForTerminal(message))}`);
 }
 /**
- * Print an info message.
+ * Print an info message (stderr).
  */
 export function printInfo(message) {
-    console.log(`\u2139 ${message}`);
+    console.error(`\u2139 ${sanitizeForTerminal(message)}`);
 }
 /**
  * Format an ISO date string for display.
@@ -175,12 +224,14 @@ export function outputData(format, data, tableConfig) {
     }
 }
 /**
- * Truncate a string to a maximum length, appending ellipsis if needed.
+ * Sanitize a string for the terminal, then truncate it to a maximum length,
+ * appending an ellipsis if needed.
  */
 export function truncate(str, maxLen) {
     if (!str)
         return '-';
-    if (str.length <= maxLen)
-        return str;
-    return str.substring(0, maxLen - 3) + '...';
+    const clean = sanitizeForTerminal(str);
+    if (clean.length <= maxLen)
+        return clean;
+    return clean.substring(0, maxLen - 3) + '...';
 }

package/dist/utils/sanitize.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Text hygiene for everything the CLI prints.
+ *
+ * Remote data (resource names, server error messages, HTTP response bodies)
+ * ends up in terminals, CI logs and support captures. The helpers here:
+ *  - keep terminal output inert: escape sequences and control characters are
+ *    removed, and bidirectional formatting characters are made visible;
+ *  - mask credential-shaped values (bearer tokens, JWTs, URL credentials and
+ *    values stored under secret-like keys);
+ *  - turn any thrown value into a short, single-line message that is built
+ *    from an allowlist of fields and never includes request variables,
+ *    request headers or raw response bodies.
+ *
+ * The module is side-effect free and imports nothing from the rest of the CLI,
+ * so every layer can use it (and unit-test module mocks never replace it).
+ */
+/** Longest error message shown to the user. */
+export declare const MAX_ERROR_MESSAGE_LENGTH = 500;
+/** Longest excerpt of an HTTP response body or server message kept in an error. */
+export declare const MAX_HTTP_BODY_EXCERPT_LENGTH = 200;
+export interface TerminalSanitizeOptions {
+    /**
+     * Keep line structure: CRLF and CR become LF, LF and TAB are kept, and
+     * NEL/LS/PS are shown as `\uXXXX`. By default (single-line mode) every line
+     * break and TAB becomes a single space.
+     */
+    preserveNewlines?: boolean;
+}
+/** `\uXXXX` spelling of a single UTF-16 code unit (valid in JSON and YAML). */
+export declare function toUnicodeEscape(char: string): string;
+/** Make bidirectional formatting controls visible as `\uXXXX` text. */
+export declare function escapeBidiControls(text: string): string;
+/**
+ * Make a value safe to print on a terminal.
+ *
+ * - ANSI/VT escape sequences (CSI, OSC, DCS, SOS, PM, APC and two-character
+ *   ESC sequences, in 7-bit and 8-bit form) are removed entirely.
+ * - Other C0 controls, DEL and C1 controls are removed.
+ * - Line breaks and TAB become a space (see {@link TerminalSanitizeOptions}).
+ * - Bidirectional formatting controls are shown as `\uXXXX` text so the
+ *   printed text reads in its stored order.
+ *
+ * `null`/`undefined` become an empty string. The function is idempotent.
+ */
+export declare function sanitizeForTerminal(value: unknown, options?: TerminalSanitizeOptions): string;
+/**
+ * Mask credential-shaped values in free text: values under secret-like keys
+ * (`password`, `token`, `refreshToken`, `clientSecret`, `Authorization`, ...),
+ * `Bearer` credentials, JWT-shaped strings and credentials embedded in URLs.
+ */
+export declare function redactSecrets(text: string): string;
+/**
+ * Reduce untrusted text to one printable, credential-masked line of at most
+ * `maxLength` characters. Returns an empty string when nothing is left.
+ */
+export declare function toDisplayLine(value: unknown, maxLength?: number): string;
+/** Short, printable excerpt of an HTTP response body for an error message. */
+export declare function summarizeHttpBody(body: unknown): string;
+/** Safe, user-facing description of a failed request. */
+export interface SafeErrorDescription {
+    message: string;
+    /** HTTP status of the response, when there was one. */
+    status?: number;
+    /** Stable GraphQL error code (`extensions.code`), when the server sent one. */
+    code?: string;
+}
+/**
+ * Describe a failure of a GraphQL request for display. Network-level
+ * `TypeError`s (fetch failures) are reported as network errors; aborted
+ * requests as timeouts.
+ */
+export declare function describeRequestError(error: unknown): SafeErrorDescription;
+/**
+ * Convert any thrown value into a message that is safe to print: a single
+ * line, at most {@link MAX_ERROR_MESSAGE_LENGTH} characters, free of terminal
+ * control sequences and with credential-shaped values masked. Response-bearing
+ * errors are described from an allowlist of fields only.
+ */
+export declare function toSafeErrorMessage(error: unknown): string;