@go-labs-sg/bb 1.13.0 → 1.15.0

package/README.md

@@ -6,6 +6,8 @@ For AI agents: bills and claims are stored as the same underlying bill records.
 
 For AI agents using this CLI: always check whether a newer `@go-labs-sg/bb` version is available before running Budget Builder commands, then update the CLI if needed so command flags and API behavior stay current.
 
+For AI agents using this CLI: do not execute approval decisions, approval requests, status updates, `mark-budget-won`, `submit-quotation`, or supplier approval request side effects until the user explicitly confirms the exact entity, target state, and side effects. Inspect the entity first, summarize what will change and whether emails/integrations will run, then wait for a clear confirmation from the user. These sensitive workflow commands also require an interactive `CONFIRM` prompt at runtime and abort in non-interactive shells.
+
 **Registry:** [`@go-labs-sg/bb`](https://www.npmjs.com/package/@go-labs-sg/bb)
 
 ## Requirements
@@ -56,6 +58,10 @@ Global options and flags use `--key=value` or `--key value` (see `bb help`).
 
 **Budget status automation:** Setting a budget to `ESTIMATE_ACCEPTED` requires a confirmed win-proof attachment. If the parent project is `PITCH` or `LOST`, the API now marks it `WON` automatically and, when the `asana-tasks` feature flag is enabled, creates the Asana project/section/tasks automatically. When rejecting the only accepted/closed budget on a commercial project, pass `--projectStatusOnCommercialRejection PITCH|LOST`.
 
+**Sensitive workflow changes:** Approval decisions/requests, entity status updates, `mark-budget-won`, `submit-quotation`, and supplier approval request side effects require an interactive `CONFIRM` prompt. Non-interactive runs abort before the guarded workflow mutation. Agents must get user confirmation in chat before attempting the command; the prompt is a final runtime guard, not a replacement for user approval.
+
+**Locked estimate budget changes:** Budget-changing CLI commands require an interactive `yes` confirmation when the current budget status is `ESTIMATE_CREATED`, `ESTIMATE_SENT`, `ESTIMATE_ACCEPTED`, `ESTIMATE_REJECTED`, or `ESTIMATE_CLOSED`. There is no force/override flag; non-interactive runs abort before mutating locked budgets.
+
 **Mutations with `--payload`:** Commands such as `create-budget`, `create-bill`, `update-supplier`, etc. take a single JSON object (`--payload '<json>'`) matching the corresponding tRPC procedure input. Use ISO strings for date/datetime fields; the CLI coerces them where needed. The API still validates the full shape. Plain `description` fields for item create/update are converted to `descriptionRichText`; pass `descriptionRichText` directly when formatted Tiptap JSON is required. For **`update-project`**, the project window is `dateRange.from` and `dateRange.to` (optional end); there are no separate event-date fields on the project payload. **`create-budget` / `update-budget`** do not accept `asanaTaskId`; configure the deal card on the project (`update-project` / project settings).
 
 ### Command overview
@@ -63,9 +69,10 @@ Global options and flags use `--key=value` or `--key value` (see `bb help`).
 | Area | Commands (non-exhaustive) |
 | --- | --- |
 | **Budgets** | `list-budgets` (full payload by default; `--summary` or `--includeDetails false` for slim list), `get-budget`, `get-budget-items`, `get-budget-details`, `get-budget-categories`, `get-budget-versions`, `update-budget-status` (`ESTIMATE_ACCEPTED` requires win proof, auto-marks `PITCH` or `LOST` projects `WON`, and auto-creates Asana project/section/tasks when enabled; `--projectStatusOnCommercialRejection PITCH\|LOST` is required when rejecting the only accepted/closed budget on a commercial project), `mark-budget-won` (`<budgetId>` + proof file path; `PITCH` or `LOST` projects become `WON` automatically), `create-budget` / `update-budget` (`--payload`), `delete-budget`, `create-budget-approval` (also sends approval request emails), `add-budget-items`, `update-budget-item`, `remove-budget-item`, `reorder-budget-items`, `update-budget-item-supplier`, `create-budget-category`, `update-budget-category`, `delete-budget-category`, `update-budget-commission`, `update-budget-discount` (`--payload` where noted), `upload-budget-attachment` (`<budgetId>` + local file path; uses `attachment.requestBudgetAttachmentUpload` + PUT + `attachment.confirmBudgetAttachment`) |
-| **Bills / claims** | `list-bills` (`--isClaimable false` for bills, `--isClaimable true` for claims, omit for both), `list-claims` (claims only), `create-bill` (`--payload`; set `isClaimable=false` for a bill or `isClaimable=true` for a claim), `update-bill` (`--payload`), `delete-bill`, `create-bill-approval` (also sends approval request emails), `update-bill-status`, `patch-bill-payment` (PAID bills: `--paymentTrackingUrl`, `--paymentReference`, `--quickbooksBillId`, `--paymentDate` ISO; clear with `--clearPaymentTrackingUrl` / `--clearPaymentReference` / `--clearQuickbooksBillId` / `--clearPaymentDate` `true`), `patch-bill-invoice-number`, `get-bill-attachments`, `upload-bill-attachment` (`<billId>` + local path), `get-bill-details` |
-| **Approvals** | `list-approvals` / `get-pending-approvals`, `approve-bill` / `reject-bill` (send reply email), `approve-budget` / `reject-budget` (send reply email), `approve-supplier` / `reject-supplier` (send reply email) |
-| **Companies & projects** | `list-companies`, `get-company`, `create-company`, `update-company` (`--payload`), `delete-company`, `list-projects`, `get-project`, `create-project` (required: `--name`, `--companyId`, `--contactPersonId`, `--insideSalesId`, `--businessDevelopmentId`, `--venue`, `--asanaTaskId`, `--slackChannelId`, `--slackChannelUrl`, `--slackChannelName`, `--startDate` as ISO datetime for project/window start; optional `--pax`; optional `--endDate`; optional `--description`; optional `--requestQboAccountantNotification false` to skip QBO accountant emails), `update-project` (`--payload` with `dateRange.from` / `dateRange.to` for the project window; optional `requestQboAccountantNotification` in JSON), `delete-project`, `update-project-status` (`<id>` `<status>`: `PITCH` \| `WON` \| `COMPLETED` \| `LOST`; for `PITCH` → `WON` also pass `--projectManagerId` or `--projectManagerName`; when marking `WON` without an accepted/closed budget or proof, pass `--wonOverrideReason`) |
+| **Bills / claims** | `list-bills` (`--isClaimable false` for bills, `--isClaimable true` for claims, omit for both), `list-claims` (claims only), `create-bill` (`--payload`; set `isClaimable=false` for a bill or `isClaimable=true` for a claim; non-legacy supplier bills from 1 Jul 2026 00:00 SGT require approved quotation coverage), `update-bill` (`--payload`), `delete-bill`, `create-bill-approval` (also sends approval request emails), `update-bill-status`, `patch-bill-payment` (PAID bills: `--paymentTrackingUrl`, `--paymentReference`, `--quickbooksBillId`, `--paymentDate` ISO; clear with `--clearPaymentTrackingUrl` / `--clearPaymentReference` / `--clearQuickbooksBillId` / `--clearPaymentDate` `true`), `patch-bill-invoice-number`, `get-bill-attachments`, `upload-bill-attachment` (`<billId>` + local path), `get-bill-details` |
+| **Quotations** | `list-quotations`, `get-quotation`, `upload-quotation-attachment` (`<projectId>` + local PDF path; returns attachment JSON for payload use), `create-quotation` (`--payload` for `quotation.createDraft`), `submit-quotation`, `approve-quotation`, `reject-quotation`, `download-quotation-pdf` (`original`, `staff`, or `final`) |
+| **Approvals** | `list-approvals` / `get-pending-approvals` (`--type budget\|supplier\|bill\|quotation\|all`), `approve-bill` / `reject-bill` (send reply email), `approve-budget` / `reject-budget` (send reply email), `approve-supplier` / `reject-supplier` (send reply email), `approve-quotation` / `reject-quotation` |
+| **Companies & projects** | `list-companies`, `get-company`, `create-company`, `update-company` (`--payload`), `delete-company`, `list-projects`, `get-project`, `create-project` (required: `--name`, `--companyId`, `--contactPersonId`, `--insideSalesId`, `--businessDevelopmentId`, `--venue`, `--asanaTaskId`, `--slackChannelId`, `--slackChannelUrl`, `--slackChannelName`, `--startDate` as ISO datetime for project/window start; optional `--pax`; optional `--endDate`; optional `--description`; always requests QBO project import like the web app), `update-project` (`--payload` with `dateRange.from` / `dateRange.to` for the project window; optional `requestQboAccountantNotification` in JSON), `delete-project`, `update-project-status` (`<id>` `<status>`: `PITCH` \| `WON` \| `COMPLETED` \| `LOST`; for `PITCH` → `WON` also pass `--projectManagerId` or `--projectManagerName`; when marking `WON` without an accepted/closed budget or proof, pass `--wonOverrideReason`) |
 | **Contacts** | `list-contacts`, `create-contact-person` (`--payload`), `update-contact-person` (`--payload`) |
 | **Suppliers & items** | `list-suppliers` (defaults to active suppliers, `--perPage 10`, sorted by `createdAt` desc; supports `--name`, `--sortBy` for scalar supplier fields, `--sortDir`, `--createdBy`, `--gstRegistered`, `--status`, `--supplierTags`, `--active false` for archived suppliers), `create-supplier` (`--payload`; when supplier status is `PENDING_APPROVAL`, also runs `supplier.createSupplierApproval` and `email.sendSupplierApprovalRequestEmail`), `update-supplier` (`--payload`; when supplier status is `PENDING_APPROVAL`, also runs `supplier.createSupplierApproval` and `email.sendSupplierApprovalRequestEmail`), `delete-suppliers` (`--ids` CSV; admin; archives/deactivates related items), `reactivate-suppliers` (`--ids` CSV; admin; reactivates related items), `create-certification` / `create-payment-method` / `create-supplier-role` / `create-supplier-tag` (`--name`), `get-supplier-details` (includes `supplierApprovalSummary` for pending approvers, superseded approvers, and the actual responder/respondedAt metadata), `get-supplier-analytics`, `list-items`, `create-item` (`--payload`), `update-item` (`--payload`), `delete-item`, `get-item`, `list-item-categories`, `create-item-category`, `update-item-category`, `delete-item-categories` (`--ids` CSV; admin) |
 | **Dashboard & users** | `list-users`, `get-user-performance`, `get-dashboard`, `get-monthly-metrics`, `get-system-overview`, `get-estimate-performance`, `get-financial-overview` |

package/dist/commands.js

@@ -1,14 +1,18 @@
+import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
+import { createInterface } from "node:readline/promises";
 import { contentType } from "mime-types";
 import { api } from "./api-client.js";
 import { BudgetRole, Deals, ExtendedApprovalStatus, ExtendedApprovalType, ExtendedBudgetStatus, TimeFrame, } from "./filter-enums.js";
 import { billStatusesForApi, } from "./parse-cli-enums.js";
 import { parseBudgetDiscountPayload, parseCompanyUpdatePayload, parseContactCreatePayload, parseContactUpdatePayload, parseCreateBillPayload, parseCreateBudgetPayload, parseItemCreatePayload, parseItemUpdatePayload, parseSupplierCreatePayload, parseSupplierUpdatePayload, parseUpdateBillPayload, parseUpdateBudgetCommissionPayload, parseUpdateBudgetPayload, parseUpdateProjectPayload, } from "./parse-mutation-payload.js";
+import { BudgetStatus, } from "./prisma-enums.js";
 import { createRichTextFromPlainText } from "./rich-text.js";
 const BUDGET = "BUDGET";
 const BILL = "BILL";
 const SUPPLIER = "SUPPLIER";
+const QUOTATION = "QUOTATION";
 function isPendingRequest(n) {
     return n.notificationType === "request" && n.status === "PENDING_APPROVAL";
 }
@@ -25,6 +29,82 @@ const contentTypeHeaderForFileName = (fileName) => {
     const ct = contentType(fileName);
     return typeof ct === "string" ? ct : "application/octet-stream";
 };
+const LOCKED_BUDGET_STATUSES_REQUIRING_CONFIRMATION = new Set([
+    BudgetStatus.ESTIMATE_CREATED,
+    BudgetStatus.ESTIMATE_SENT,
+    BudgetStatus.ESTIMATE_ACCEPTED,
+    BudgetStatus.ESTIMATE_REJECTED,
+    BudgetStatus.ESTIMATE_CLOSED,
+]);
+const lockedBudgetStatusLabels = {
+    ESTIMATE_CREATED: "Estimate Created",
+    ESTIMATE_SENT: "Estimate Sent",
+    ESTIMATE_ACCEPTED: "Estimate Accepted",
+    ESTIMATE_REJECTED: "Estimate Rejected",
+    ESTIMATE_CLOSED: "Estimate Closed",
+};
+const lockedBudgetStatusLabel = (status) => status in lockedBudgetStatusLabels
+    ? lockedBudgetStatusLabels[status]
+    : status;
+const assertSensitiveWorkflowConfirmed = async ({ action, entity, details, }) => {
+    const expected = "CONFIRM";
+    const detailText = details ? ` ${details}` : "";
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error(`${action} on ${entity}${detailText} is a sensitive Budget Builder workflow change. Run this command in an interactive terminal after the user explicitly confirms the exact action, then type "${expected}" to continue.`);
+    }
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        const answer = await rl.question(`${action} on ${entity}${detailText} may change workflow status, approvals, or send notification emails. Confirm the user explicitly approved this exact action, then type "${expected}" to continue: `);
+        if (answer.trim() !== expected) {
+            throw new Error("Aborted.");
+        }
+    }
+    finally {
+        rl.close();
+    }
+};
+const assertLockedBudgetChangeConfirmed = async ({ budget, action, }) => {
+    if (!LOCKED_BUDGET_STATUSES_REQUIRING_CONFIRMATION.has(budget.status)) {
+        return;
+    }
+    const statusLabel = lockedBudgetStatusLabel(budget.status);
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error(`${action} would change locked budget "${budget.name}" (${budget.id}) with status ${statusLabel}. Run this command in an interactive terminal and type "yes" to confirm.`);
+    }
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        const answer = await rl.question(`${action} will change locked budget "${budget.name}" (${budget.id}) with status ${statusLabel}. Type "yes" to continue: `);
+        if (answer.trim().toLowerCase() !== "yes") {
+            throw new Error("Aborted.");
+        }
+    }
+    finally {
+        rl.close();
+    }
+};
+const confirmLockedBudgetChangeByBudgetId = async (budgetId, action) => {
+    const budget = await api.budget.getBudget.query({ id: budgetId });
+    await assertLockedBudgetChangeConfirmed({
+        budget: {
+            id: budget.id,
+            name: budget.name,
+            status: budget.status,
+        },
+        action,
+    });
+};
+const confirmLockedBudgetChangeByBudgetItemId = async (budgetItemId, action) => {
+    const { budget } = await api.budgetItem.getBudgetItemContext.query({
+        budgetItemId,
+    });
+    await assertLockedBudgetChangeConfirmed({ budget, action });
+};
 export async function listBudgets(opts) {
     const input = {
         projectId: opts.projectId,
@@ -50,6 +130,12 @@ export async function getBudget(id) {
     out({ budget, items });
 }
 export async function updateBudgetStatus(budgetId, status, opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Update budget status",
+        entity: `budget ${budgetId}`,
+        details: `to ${status}`,
+    });
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Update budget status");
     const result = await api.budget.updateBudgetStatus.mutate({
         id: budgetId,
         status,
@@ -147,6 +233,11 @@ export async function listBills(opts) {
     out(result);
 }
 export async function approveBill(billId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve bill",
+        entity: `bill ${billId}`,
+        details: "and send requester reply email",
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => isPendingRequest(n) &&
         n.type === BILL &&
@@ -199,6 +290,10 @@ export async function listApprovals(opts) {
             id = n.supplier.id;
             name = n.supplier.name;
         }
+        else if (n.type === QUOTATION && n.supplierQuotation) {
+            id = n.supplierQuotation.id;
+            name = `Quotation ${n.supplierQuotation.supplier.name}`;
+        }
         else {
             id = n.id;
             name = "Unknown";
@@ -234,6 +329,11 @@ export async function listSuppliers(opts) {
 }
 // --- Bills (MCP parity) ---
 export async function createBillApproval(billId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create bill approval request",
+        entity: `bill ${billId}`,
+        details: "and send approval request emails",
+    });
     const result = await api.bill.createApproval.mutate({ billId });
     const approvalIds = (result.results ?? []).map((item) => ({ id: item.id }));
     let email;
@@ -259,6 +359,11 @@ export async function createBillApproval(billId) {
     });
 }
 export async function updateBillStatus(opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Update bill status",
+        entity: `bill ${opts.id}`,
+        details: `to ${opts.status}`,
+    });
     const result = await api.bill.updateStatus.mutate({
         id: opts.id,
         status: opts.status,
@@ -323,7 +428,35 @@ export async function uploadBillAttachmentFromPath(billId, filePath) {
     });
     out(confirmed);
 }
+export async function uploadQuotationAttachmentFromPath(projectId, filePath) {
+    const buf = await readFile(filePath);
+    const fileName = basename(filePath);
+    const ext = fileName
+        .split(".")
+        .pop()
+        ?.toLowerCase()
+        .replace(/[^a-z0-9]/g, "");
+    const key = `quotations/${projectId}/${randomUUID()}.${ext || "pdf"}`;
+    const uploadUrl = await api.attachment.getPresignedUrlToUpload.mutate({
+        key,
+    });
+    const res = await fetch(uploadUrl, {
+        method: "PUT",
+        body: buf,
+        headers: { "Content-Type": contentTypeHeaderForFileName(fileName) },
+    });
+    if (!res.ok) {
+        throw new Error(`S3 upload failed: HTTP ${res.status} ${(await res.text()).slice(0, 500)}`);
+    }
+    out({
+        id: randomUUID(),
+        name: fileName,
+        key,
+        size: buf.byteLength,
+    });
+}
 export async function uploadBudgetAttachmentFromPath(budgetId, filePath) {
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Upload budget attachment");
     const buf = await readFile(filePath);
     const fileName = basename(filePath);
     const size = buf.byteLength;
@@ -349,6 +482,12 @@ export async function uploadBudgetAttachmentFromPath(budgetId, filePath) {
     out(confirmed);
 }
 export async function uploadBudgetWinProofFromPath(budgetId, filePath, opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Mark budget won",
+        entity: `budget ${budgetId}`,
+        details: "by uploading proof and setting status to ESTIMATE_ACCEPTED",
+    });
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Mark budget won");
     const buf = await readFile(filePath);
     const fileName = basename(filePath);
     const size = buf.byteLength;
@@ -393,10 +532,12 @@ export async function getBudgetItemsOnly(budgetId) {
     out(items);
 }
 export async function addBudgetItems(opts) {
+    await confirmLockedBudgetChangeByBudgetId(opts.budgetId, "Add budget items");
     const result = await api.budgetItem.addBudgetItems.mutate(opts);
     out(result);
 }
 export async function updateBudgetItem(input) {
+    await confirmLockedBudgetChangeByBudgetItemId(input.id, "Update budget item");
     const result = await api.budgetItem.updateBudgetItem.mutate({
         ...input,
         ...(input.description !== undefined &&
@@ -411,6 +552,7 @@ export async function updateBudgetItem(input) {
     out(result);
 }
 export async function removeBudgetItem(budgetItemId) {
+    await confirmLockedBudgetChangeByBudgetItemId(budgetItemId, "Remove budget item");
     const result = await api.budgetItem.removeBudgetItem.mutate({
         budgetItemId,
     });
@@ -427,6 +569,12 @@ export async function getBudgetVersions(budgetId) {
     out(versions);
 }
 export async function createBudgetApproval(budgetId, preflight) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create budget approval request",
+        entity: `budget ${budgetId}`,
+        details: "and send approval request emails",
+    });
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Create budget approval");
     await runBudgetPreflight(budgetId, preflight);
     await assertBudgetActionReadiness({
         budgetId,
@@ -458,6 +606,7 @@ export async function createBudgetApproval(budgetId, preflight) {
     });
 }
 export async function createEstimate(budgetId, preflight) {
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Create estimate");
     await runBudgetPreflight(budgetId, preflight);
     await assertBudgetActionReadiness({
         budgetId,
@@ -478,10 +627,12 @@ export async function createBudgetFromPayload(raw) {
 }
 export async function updateBudgetFromPayload(raw) {
     const input = parseUpdateBudgetPayload(raw);
+    await confirmLockedBudgetChangeByBudgetId(input.id, "Update budget");
     const result = await api.budget.updateBudget.mutate(input);
     out(result);
 }
 export async function deleteBudgetById(budgetId) {
+    await confirmLockedBudgetChangeByBudgetId(budgetId, "Delete budget");
     const result = await api.budget.deleteBudget.mutate({ id: budgetId });
     out(result);
 }
@@ -494,10 +645,12 @@ export async function deleteCompanyById(companyId) {
     out(result);
 }
 export async function reorderBudgetItemsCli(opts) {
+    await confirmLockedBudgetChangeByBudgetId(opts.budgetId, "Reorder budget items");
     const result = await api.budgetItem.reorderBudgetItems.mutate(opts);
     out(result);
 }
 export async function updateBudgetItemSupplierCli(opts) {
+    await confirmLockedBudgetChangeByBudgetItemId(opts.budgetItemId, "Update budget item supplier");
     const result = await api.budgetItem.updateBudgetItemSupplier.mutate(opts);
     out(result);
 }
@@ -515,11 +668,13 @@ export async function deleteBudgetCategory(id) {
 }
 export async function updateBudgetCommissionFromPayload(raw) {
     const input = parseUpdateBudgetCommissionPayload(raw);
+    await confirmLockedBudgetChangeByBudgetId(input.budgetId, "Update budget commission");
     const result = await api.budget.updateBudgetCommission.mutate(input);
     out(result);
 }
 export async function updateBudgetDiscountFromPayload(raw) {
     const input = parseBudgetDiscountPayload(raw);
+    await confirmLockedBudgetChangeByBudgetId(input.budgetId, "Update budget discount");
     const result = await api.budget.updateBudgetDiscount.mutate(input);
     out(result);
 }
@@ -568,6 +723,33 @@ export async function createBillFromPayload(raw) {
     const result = await api.bill.create.mutate(input);
     out(result);
 }
+export async function listQuotations(opts) {
+    const result = await api.quotation.list.query(opts);
+    out(result);
+}
+export async function getQuotationDetails(id) {
+    const result = await api.quotation.getById.query({ id });
+    out(result);
+}
+export async function createQuotationFromPayload(raw) {
+    const result = await api.quotation.createDraft.mutate(raw);
+    out(result);
+}
+export async function submitQuotation(id) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Submit quotation for approval",
+        entity: `quotation ${id}`,
+    });
+    const result = await api.quotation.submitForApproval.mutate({ id });
+    out(result);
+}
+export async function downloadQuotationPdf(id, fileRole) {
+    const result = await api.quotation.getSignedDownloadUrl.query({
+        id,
+        fileRole,
+    });
+    out(result);
+}
 export async function updateBillFromPayload(raw) {
     const input = parseUpdateBillPayload(raw);
     const result = await api.bill.update.mutate(input);
@@ -585,6 +767,11 @@ export async function createSupplierFromPayload(raw) {
         out(created);
         return;
     }
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create supplier approval request",
+        entity: `supplier ${supplier.id}`,
+        details: "and send approval request emails",
+    });
     const approval = await api.supplier.createSupplierApproval.mutate({
         supplierId: supplier.id,
     });
@@ -623,6 +810,11 @@ export async function updateSupplierFromPayload(raw) {
         out(updated);
         return;
     }
+    await assertSensitiveWorkflowConfirmed({
+        action: "Create supplier approval request",
+        entity: `supplier ${supplier.id}`,
+        details: "and send approval request emails",
+    });
     let approvalResult;
     try {
         const approval = await api.supplier.createSupplierApproval.mutate({
@@ -703,6 +895,11 @@ export async function updateCompanyFromPayload(raw) {
 }
 // --- Approvals: budgets / suppliers / bills (MCP parity) ---
 export async function approveBudget(budgetId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve budget",
+        entity: `budget ${budgetId}`,
+        details: "and send requester reply email",
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -734,6 +931,11 @@ export async function approveBudget(budgetId) {
     });
 }
 export async function rejectBudget(budgetId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject budget",
+        entity: `budget ${budgetId}`,
+        details: `with reason "${reason}" and send requester reply email`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -827,6 +1029,11 @@ export async function getSupplierDetails(supplierId) {
     });
 }
 export async function approveSupplier(supplierId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve supplier",
+        entity: `supplier ${supplierId}`,
+        details: "and send requester reply email",
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -860,6 +1067,11 @@ export async function approveSupplier(supplierId) {
     });
 }
 export async function rejectSupplier(supplierId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject supplier",
+        entity: `supplier ${supplierId}`,
+        details: `with reason "${reason}" and send requester reply email`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -894,6 +1106,11 @@ export async function rejectSupplier(supplierId, reason) {
     });
 }
 export async function rejectBill(billId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject bill",
+        entity: `bill ${billId}`,
+        details: `with reason "${reason}" and send requester reply email`,
+    });
     const notifications = await api.budget.getNotifications.query();
     const pending = notifications.filter((n) => n.notificationType === "request" &&
         n.status === ExtendedApprovalStatus.PENDING_APPROVAL &&
@@ -924,6 +1141,46 @@ export async function rejectBill(billId, reason) {
         email,
     });
 }
+export async function approveQuotation(quotationId) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Approve quotation",
+        entity: `quotation ${quotationId}`,
+    });
+    const notifications = await api.budget.getNotifications.query();
+    const pending = notifications.filter((n) => isPendingRequest(n) &&
+        n.type === QUOTATION &&
+        (n.supplierQuotationId === quotationId ||
+            n.supplierQuotation?.id === quotationId));
+    const approval = pending[0];
+    if (!approval) {
+        throw new Error("No pending quotation approval found.");
+    }
+    const result = await api.quotation.approve.mutate({
+        quotationApprovalId: approval.id,
+    });
+    out(result);
+}
+export async function rejectQuotation(quotationId, reason) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Reject quotation",
+        entity: `quotation ${quotationId}`,
+        details: `with reason "${reason}"`,
+    });
+    const notifications = await api.budget.getNotifications.query();
+    const pending = notifications.filter((n) => isPendingRequest(n) &&
+        n.type === QUOTATION &&
+        (n.supplierQuotationId === quotationId ||
+            n.supplierQuotation?.id === quotationId));
+    const approval = pending[0];
+    if (!approval) {
+        throw new Error("No pending quotation approval found.");
+    }
+    const result = await api.quotation.reject.mutate({
+        quotationApprovalId: approval.id,
+        rejectionReason: reason,
+    });
+    out(result);
+}
 // --- Companies & projects ---
 export async function listCompanies(opts) {
     const result = await api.company.getCompanies.query({
@@ -980,13 +1237,15 @@ export async function createProject(opts) {
             from: new Date(opts.startDate),
             to: opts.endDate ? new Date(opts.endDate) : undefined,
         },
-        ...(opts.requestQboAccountantNotification !== undefined && {
-            requestQboAccountantNotification: opts.requestQboAccountantNotification,
-        }),
     });
     out(result);
 }
 export async function updateProjectStatus(id, status, opts) {
+    await assertSensitiveWorkflowConfirmed({
+        action: "Update project status",
+        entity: `project ${id}`,
+        details: `to ${status}`,
+    });
     const result = await api.project.updateProjectStatus.mutate({
         id,
         status,

package/dist/index.js

@@ -2,7 +2,7 @@
 import "./load-env.js";
 import { requireApiKey } from "./api-client.js";
 import { consumeCliQuietFlags, logCliAction, sanitizeFlagsForTrace, setCliQuiet, shouldLogCliActions, } from "./cli-trace.js";
-import { addBudgetItems, approveBill, approveBudget, approveSupplier, createBillApproval, createBillFromPayload, createBudgetApproval, createBudgetCategory, createBudgetFromPayload, createCompany, createContactPersonFromPayload, createEstimate, createItemCategory, createItemFromPayload, createProject, createSupplierCertification, createSupplierFromPayload, createSupplierPaymentMethod, createSupplierRoleOption, createSupplierTagOption, deleteBillById, deleteBudgetById, deleteBudgetCategory, deleteCompanyById, deleteItemById, deleteItemCategoriesByIds, deleteProjectById, deleteSuppliersByIds, getApprovedBudgets, getBillAttachments, getBillDetails, getBudget, getBudgetCategories, getBudgetCategoryBenchmarks, getBudgetDetails, getBudgetItemsOnly, getBudgetVersions, getCompany, getDashboard, getErrorMetrics, getEstimatePerformance, getFinancialOverview, getItem, getItemPricingHistory, getMonthlyMetrics, getProject, getRecentErrors, getSupplierAnalytics, getSupplierDetails, getSupplierPricingHistory, getSystemOverview, getUserPerformance, listApprovals, listBills, listBudgets, listCompanies, listContacts, listItemCategories, listItems, listProjects, listSuppliers, listUsers, markBudgetWonWithProof, patchBillInvoiceNumber, patchBillPayment, reactivateSuppliersByIds, rejectBill, rejectBudget, rejectSupplier, removeBudgetItem, reorderBudgetItemsCli, updateBillFromPayload, updateBillStatus, updateBudgetCategory, updateBudgetCommissionFromPayload, updateBudgetDiscountFromPayload, updateBudgetFromPayload, updateBudgetItem, updateBudgetItemSupplierCli, updateBudgetStatus, updateCompanyFromPayload, updateContactPersonFromPayload, updateItemCategory, updateItemFromPayload, updateProjectFromPayload, updateProjectStatus, updateSupplierFromPayload, uploadBillAttachmentFromPath, uploadBudgetAttachmentFromPath, } from "./commands.js";
+import { addBudgetItems, approveBill, approveBudget, approveQuotation, approveSupplier, createBillApproval, createBillFromPayload, createBudgetApproval, createBudgetCategory, createBudgetFromPayload, createCompany, createContactPersonFromPayload, createEstimate, createItemCategory, createItemFromPayload, createProject, createQuotationFromPayload, createSupplierCertification, createSupplierFromPayload, createSupplierPaymentMethod, createSupplierRoleOption, createSupplierTagOption, deleteBillById, deleteBudgetById, deleteBudgetCategory, deleteCompanyById, deleteItemById, deleteItemCategoriesByIds, deleteProjectById, deleteSuppliersByIds, downloadQuotationPdf, getApprovedBudgets, getBillAttachments, getBillDetails, getBudget, getBudgetCategories, getBudgetCategoryBenchmarks, getBudgetDetails, getBudgetItemsOnly, getBudgetVersions, getCompany, getDashboard, getErrorMetrics, getEstimatePerformance, getFinancialOverview, getItem, getItemPricingHistory, getMonthlyMetrics, getProject, getQuotationDetails, getRecentErrors, getSupplierAnalytics, getSupplierDetails, getSupplierPricingHistory, getSystemOverview, getUserPerformance, listApprovals, listBills, listBudgets, listCompanies, listContacts, listItemCategories, listItems, listProjects, listQuotations, listSuppliers, listUsers, markBudgetWonWithProof, patchBillInvoiceNumber, patchBillPayment, reactivateSuppliersByIds, rejectBill, rejectBudget, rejectQuotation, rejectSupplier, removeBudgetItem, reorderBudgetItemsCli, submitQuotation, updateBillFromPayload, updateBillStatus, updateBudgetCategory, updateBudgetCommissionFromPayload, updateBudgetDiscountFromPayload, updateBudgetFromPayload, updateBudgetItem, updateBudgetItemSupplierCli, updateBudgetStatus, updateCompanyFromPayload, updateContactPersonFromPayload, updateItemCategory, updateItemFromPayload, updateProjectFromPayload, updateProjectStatus, updateSupplierFromPayload, uploadBillAttachmentFromPath, uploadBudgetAttachmentFromPath, uploadQuotationAttachmentFromPath, } from "./commands.js";
 import { getFlag, parseArgs } from "./parse-args.js";
 import { billStatusesForUpdateHelp, budgetStatusesForHelp, isBudgetStatusUpdate, parseApprovalTypeFlag, parseBillStatusForUpdate, parseCommaSeparatedBillStatuses, parseCommaSeparatedBudgetStatuses, parseCommaSeparatedIds, parseCommaSeparatedSupplierStatuses, parseOptionalBillListSortBy, parseOptionalBillListSortDir, parseOptionalDashboardRole, parseOptionalDeals, parseOptionalErrorSeverity, parseOptionalErrorStatus, parseOptionalExtendedProjectStatus, parseOptionalFinancialRole, parseOptionalSupplierAnalyticsTimeFrame, parseOptionalTimeFrame, parseProjectStatusForUpdate, projectStatusesForHelp, } from "./parse-cli-enums.js";
 import { parseJsonFlag, parseOptionalNumber as parseOptNum, } from "./parse-json-flag.js";
@@ -119,6 +119,13 @@ Global: --quiet | -q | BB_CLI_QUIET=1 — hide action logs (default: log command
 
 Auth: Set BB_API_KEY in the environment (same API key as MCP / Goracle).
 
+Sensitive workflow changes: approval decisions/requests, entity status updates,
+mark-budget-won, submit-quotation, and supplier approval request side effects
+require an interactive CONFIRM prompt and abort in non-interactive shells.
+AI agents must inspect the entity first, summarize the exact entity, target
+state, and side effects, then wait for explicit user confirmation before running
+the sensitive command.
+
 Budgets
   list-budgets              [--projectId] [--name] [--status CSV] [--createdBy] [--dateFrom] [--dateTo] [--sortBy] [--sortDir] [--page] [--perPage] [--summary]
   get-budget <id>            Budget + line items
@@ -127,6 +134,7 @@ Budgets
   get-budget-categories
   get-budget-versions <budgetId>
   update-budget-status <id> <status> [--markProjectWon true|false] [--projectStatusOnCommercialRejection PITCH|LOST]
+    Budget-changing commands require interactive "yes" confirmation when the current budget is ESTIMATE_CREATED, ESTIMATE_SENT, ESTIMATE_ACCEPTED, ESTIMATE_REJECTED, or ESTIMATE_CLOSED.
     ESTIMATE_ACCEPTED requires win proof, auto-marks PITCH or LOST projects WON, and auto-creates the Asana project/section when enabled.
     ESTIMATE_REJECTED requires --projectStatusOnCommercialRejection when rejecting the only accepted/closed budget on a commercial project.
     status: ${budgetStatusesForHelp.join(", ")}
@@ -152,6 +160,7 @@ Bills
   list-bills                 [--projectId] [--budgetId] [--status CSV] [--search <text>] [--isClaimable true|false] [--createdByIds <csv>] [--sortBy createdAt|amount|status] [--sortDir asc|desc] [--page] [--pageSize]
   list-claims                same flags as list-bills; only reimbursable claims (ignores --isClaimable)
     isClaimable differentiates the shared bill/claim records: false = bill, true = claim.
+    New supplier bills from 1 Jul 2026 00:00 SGT require approved quotation coverage for each non-legacy line item.
   create-bill-approval <billId>       (also sends approval request emails)
   create-bill                --payload '<json>'  (bill.create; payload.isClaimable false = bill, true = claim; use upload-bill-attachment after create to add files)
   update-bill                --payload '<json>'  (bill.update; must include id)
@@ -165,8 +174,18 @@ Bills
   upload-bill-attachment <billId> <filePath>   Presigned S3 upload + confirm (same flow as web UI)
   get-bill-details <billId>
 
+Quotations
+  list-quotations            [--projectId] [--budgetId] [--supplierId] [--status CSV] [--page] [--pageSize]
+  get-quotation <quotationId>
+  upload-quotation-attachment <projectId> <filePath>   Presigned S3 upload; returns attachment JSON for create-quotation payload
+  create-quotation           --payload '<json>'  (quotation.createDraft)
+  submit-quotation <quotationId>
+  approve-quotation <quotationId>
+  reject-quotation <quotationId> --reason <text>
+  download-quotation-pdf <quotationId> [original|staff|final]
+
 Approvals
-  list-approvals | get-pending-approvals   [--type budget|supplier|bill|all]
+  list-approvals | get-pending-approvals   [--type budget|supplier|bill|quotation|all]
   approve-bill <billId>               (also sends requester reply email)
   reject-bill <billId> --reason <text> (also sends requester reply email)
   approve-budget <budgetId>           (also sends requester reply email)
@@ -184,7 +203,7 @@ Companies & projects
   list-projects              [--companyId] [--name] [--status] [--active true|false] [--page] [--perPage]
     Omit --active to include both active and inactive projects.
   get-project <id>
-  create-project             --name --companyId --contactPersonId --insideSalesId --businessDevelopmentId --venue --asanaTaskId --slackChannelId --slackChannelUrl --slackChannelName --startDate <ISO> [--pax] [--endDate <ISO>] [--description] [--requestQboAccountantNotification false]
+  create-project             --name --companyId --contactPersonId --insideSalesId --businessDevelopmentId --venue --asanaTaskId --slackChannelId --slackChannelUrl --slackChannelName --startDate <ISO> [--pax] [--endDate <ISO>] [--description]
   update-project             --payload '<json>'  (project.updateProject; optional requestQboAccountantNotification; default notify like web)
   delete-project <id>
   update-project-status <id> <status> [--projectManagerId <id>] [--projectManagerName <name>] [--wonOverrideReason <text>]
@@ -674,6 +693,88 @@ async function main() {
                 await getBillDetails(id);
                 break;
             }
+            case "list-quotations": {
+                const statusRaw = getFlag(flags, "status");
+                await listQuotations({
+                    projectId: getFlag(flags, "projectId"),
+                    budgetId: getFlag(flags, "budgetId"),
+                    supplierId: getFlag(flags, "supplierId"),
+                    status: statusRaw !== undefined
+                        ? String(statusRaw)
+                            .split(",")
+                            .map((value) => value.trim().toUpperCase())
+                            .filter(Boolean)
+                        : undefined,
+                    page: getFlag(flags, "page") !== undefined
+                        ? Number(getFlag(flags, "page"))
+                        : undefined,
+                    pageSize: getFlag(flags, "pageSize") !== undefined
+                        ? Number(getFlag(flags, "pageSize"))
+                        : undefined,
+                });
+                break;
+            }
+            case "get-quotation": {
+                const id = positional[0];
+                if (!id)
+                    throw new Error("get-quotation requires <quotationId>");
+                await getQuotationDetails(id);
+                break;
+            }
+            case "upload-quotation-attachment": {
+                const [projectId, filePath] = positional;
+                if (!projectId || !filePath) {
+                    throw new Error("upload-quotation-attachment requires <projectId> <filePath>");
+                }
+                await uploadQuotationAttachmentFromPath(projectId, filePath);
+                break;
+            }
+            case "create-quotation": {
+                const payloadRaw = getFlag(flags, "payload");
+                if (!payloadRaw) {
+                    throw new Error("create-quotation requires --payload '<json>'");
+                }
+                const raw = parseJsonFlag(String(payloadRaw), "--payload");
+                await createQuotationFromPayload(raw);
+                break;
+            }
+            case "submit-quotation": {
+                const id = positional[0];
+                if (!id)
+                    throw new Error("submit-quotation requires <quotationId>");
+                await submitQuotation(id);
+                break;
+            }
+            case "approve-quotation": {
+                const id = positional[0];
+                if (!id)
+                    throw new Error("approve-quotation requires <quotationId>");
+                await approveQuotation(id);
+                break;
+            }
+            case "reject-quotation": {
+                const id = positional[0];
+                const reason = getFlag(flags, "reason");
+                if (!id || reason === undefined) {
+                    throw new Error("reject-quotation requires <quotationId> --reason <text>");
+                }
+                await rejectQuotation(id, reason);
+                break;
+            }
+            case "download-quotation-pdf": {
+                const id = positional[0];
+                if (!id) {
+                    throw new Error("download-quotation-pdf requires <quotationId> [original|staff|final]");
+                }
+                const roleRaw = (positional[1] ?? "final").toLowerCase();
+                const fileRole = roleRaw === "original"
+                    ? "ORIGINAL"
+                    : roleRaw === "staff"
+                        ? "STAFF_SIGNED"
+                        : "FINAL_SIGNED";
+                await downloadQuotationPdf(id, fileRole);
+                break;
+            }
             case "list-approvals":
             case "get-pending-approvals": {
                 const typeRaw = getFlag(flags, "type");
@@ -811,6 +912,9 @@ async function main() {
                 const slackChannelUrl = getFlag(flags, "slackChannelUrl");
                 const slackChannelName = getFlag(flags, "slackChannelName");
                 const startDate = getFlag(flags, "startDate");
+                if (getFlag(flags, "requestQboAccountantNotification") !== undefined) {
+                    throw new Error("create-project does not allow --requestQboAccountantNotification; CLI project creation always requests the QuickBooks project import like the web app.");
+                }
                 if (!name ||
                     !companyId ||
                     !contactPersonId ||
@@ -839,7 +943,6 @@ async function main() {
                     startDate,
                     endDate: getFlag(flags, "endDate"),
                     description: getFlag(flags, "description"),
-                    requestQboAccountantNotification: parseOptionalBoolFlag(flags, "requestQboAccountantNotification"),
                 });
                 break;
             }

package/dist/parse-cli-enums.js

@@ -215,7 +215,7 @@ export function parseOptionalBillListSortDir(raw) {
     return raw;
 }
 function isPendingRequestType(s) {
-    return s === "BUDGET" || s === "BILL" || s === "SUPPLIER";
+    return (s === "BUDGET" || s === "BILL" || s === "SUPPLIER" || s === "QUOTATION");
 }
 export function parseApprovalTypeFlag(raw) {
     if (raw === undefined)
@@ -224,7 +224,7 @@ export function parseApprovalTypeFlag(raw) {
     if (u === "ALL")
         return "ALL";
     if (!isPendingRequestType(u)) {
-        throw new Error(`Invalid --type "${raw}". Use budget, supplier, bill, or all.`);
+        throw new Error(`Invalid --type "${raw}". Use budget, supplier, bill, quotation, or all.`);
     }
     return u;
 }

package/dist/prisma-enums.js

@@ -33,6 +33,8 @@ export const ApprovalType = {
     BUDGET: "BUDGET",
     SUPPLIER: "SUPPLIER",
     BILL: "BILL",
+    CUSTOMER_INVOICE: "CUSTOMER_INVOICE",
+    QUOTATION: "QUOTATION",
 };
 export const ErrorSeverity = {
     LOW: "LOW",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/bb",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Budget Builder CLI for AI agents — manage budgets, bills, and claims; bill records use isClaimable=false for bills and isClaimable=true for claims.",
   "type": "module",
   "main": "./dist/index.js",