@go-labs-sg/bb 2.20.0 → 2.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/bb",
-  "version": "2.20.0",
+  "version": "2.23.0",
   "description": "Budget Builder CLI for AI agents — manage budgets, bills, claims, quotations, and customer invoices with explicit workflow previews for sensitive changes.",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,7 +25,7 @@
     "superjson": "^2.2.6"
   },
   "engines": {
-    "node": ">=24"
+    "bun": ">=1.4.0"
   },
   "publishConfig": {
     "access": "public"

package/role-aware-agent-guide.md

@@ -1,10 +1,10 @@
 # Role-aware Budget Builder CLI guide for agents
 
-This guide explains how an AI agent should choose Budget Builder CLI commands for the identity behind `BB_API_KEY`. It complements [`bb help`](./README.md#command-overview), which lists commands and arguments but intentionally does not decide authorization on the client. Version 2 documents grouped resource commands (for example, `bb budget get <budget-id>`); flat and `snake_case` commands remain compatibility aliases during the v2 transition.
+This guide explains how an AI agent should choose Budget Builder CLI commands for the current browser-authorized identity or automation identity behind `BB_API_KEY`. It complements [`bb help`](./README.md#command-overview), which lists commands and arguments but intentionally does not decide authorization on the client. Version 2 documents grouped resource commands (for example, `bb budget get <budget-id>`); flat and `snake_case` commands remain compatibility aliases during the v2 transition.
 
 ## Mandatory preflight
 
-Run these commands at the beginning of every agent session and after replacing `BB_API_KEY`:
+Run these commands at the beginning of every agent session, after `bb auth login`, and after replacing `BB_API_KEY`:
 
 ```bash
 bb version

package/dist/api-client.js

@@ -1,93 +0,0 @@
-import { createTRPCProxyClient, httpBatchLink, loggerLink, } from "@trpc/client";
-import SuperJSON from "superjson";
-import { sanitizeValueForTrace, shouldLogCliActions } from "./cli-trace.js";
-export const DEFAULT_BUDGET_BUILDER_API_BASE_URL = "https://budget-builder.getout.events";
-const normalizeApiBaseUrl = (value) => {
-    const url = new URL(value);
-    const isLocalHttp = url.protocol === "http:" &&
-        (url.hostname === "localhost" || url.hostname === "127.0.0.1");
-    if (url.protocol !== "https:" && !isLocalHttp) {
-        throw new Error("Budget Builder API URL must use HTTPS, except for localhost development.");
-    }
-    url.pathname = url.pathname.replace(/\/$/, "");
-    return url.toString().replace(/\/$/, "");
-};
-export let BUDGET_BUILDER_API_BASE_URL = DEFAULT_BUDGET_BUILDER_API_BASE_URL;
-function getAuthHeader() {
-    const key = process.env.BB_API_KEY;
-    if (!key?.trim())
-        return undefined;
-    return `Bearer ${key.trim()}`;
-}
-const containsRawApiKey = (value, seen = new WeakSet()) => {
-    if (typeof value !== "object" || value === null)
-        return false;
-    if (seen.has(value))
-        return false;
-    seen.add(value);
-    return Object.entries(value).some(([key, nestedValue]) => (key.toLowerCase() === "apikey" && typeof nestedValue === "string") ||
-        containsRawApiKey(nestedValue, seen));
-};
-export const createBudgetBuilderClient = (apiBaseUrl = BUDGET_BUILDER_API_BASE_URL) => createTRPCProxyClient({
-    links: [
-        loggerLink({
-            enabled: (opts) => shouldLogCliActions() &&
-                !(opts.direction === "down" && containsRawApiKey(opts.result)),
-            colorMode: "ansi",
-            withContext: false,
-            // tRPC defaults use console.log for requests; stderr keeps stdout JSON-safe for pipes.
-            console: {
-                log: (...args) => console.error(...args.map((arg) => sanitizeValueForTrace(arg))),
-                error: (...args) => console.error(...args.map((arg) => sanitizeValueForTrace(arg))),
-            },
-        }),
-        httpBatchLink({
-            url: `${apiBaseUrl}/api/trpc`,
-            transformer: SuperJSON,
-            headers: () => {
-                const headers = {
-                    "x-trpc-source": "bb-cli",
-                };
-                const auth = getAuthHeader();
-                if (auth)
-                    headers.Authorization = auth;
-                return headers;
-            },
-        }),
-    ],
-});
-let activeClient = createBudgetBuilderClient();
-export const configureBudgetBuilderApiBaseUrl = (value) => {
-    const normalized = normalizeApiBaseUrl(value);
-    BUDGET_BUILDER_API_BASE_URL = normalized;
-    activeClient = createBudgetBuilderClient(normalized);
-    return normalized;
-};
-/**
- * Stable facade used by command handlers. Tests can replace the transport without
- * teaching commands about tRPC or process-wide authentication.
- */
-export const api = new Proxy({}, {
-    get: (_target, property, receiver) => Reflect.get(activeClient, property, receiver),
-});
-export const setBudgetBuilderClientForTesting = (client) => {
-    const previous = activeClient;
-    activeClient = client;
-    return () => {
-        activeClient = previous;
-    };
-};
-export class MissingApiKeyError extends Error {
-    code = "AUTHENTICATION";
-    constructor() {
-        super("BB_API_KEY is required. Set it in the environment.");
-        this.name = "MissingApiKeyError";
-    }
-}
-export function requireApiKey() {
-    const key = process.env.BB_API_KEY?.trim();
-    if (!key) {
-        throw new MissingApiKeyError();
-    }
-    return key;
-}

package/dist/cli-trace.js

@@ -1,86 +0,0 @@
-/**
- * Action logging for the CLI (default on).
- * - Lifecycle: `logCliAction` in index (command + timing).
- * - Per API call: tRPC `loggerLink` in api-client when `shouldLogCliActions()`.
- * Logs go to stderr so stdout stays JSON for piping. Use `--quiet` / `-q` / BB_CLI_QUIET=1 to silence.
- */
-let cliQuietSession = false;
-/** Call from main after `consumeCliQuietFlags`. */
-export const setCliQuiet = (quiet) => {
-    cliQuietSession = quiet;
-};
-export const isCliQuiet = () => cliQuietSession || process.env.BB_CLI_QUIET === "1";
-export const shouldLogCliActions = () => !isCliQuiet();
-const SENSITIVE_FLAG = new Set([
-    "payload",
-    "apikey",
-    "bb_api_key",
-    "token",
-    "password",
-    "payment-proof",
-    "paymentproof",
-    "paymentreference",
-    "receipt",
-    "secret",
-    "authorization",
-]);
-const SENSITIVE_TRACE_FIELD = new Set([
-    "paymentproof",
-    "paymentproofattachments",
-    "paymentproofpath",
-    "paymentreference",
-    "proof",
-    "receipt",
-]);
-const isPresignedUrl = (value) => typeof value === "string" &&
-    (/[?&]X-Amz-(?:Algorithm|Credential|Signature)=/i.test(value) ||
-        /[?&]X-Goog-(?:Algorithm|Credential|Signature)=/i.test(value));
-export const sanitizeValueForTrace = (value, seen = new WeakSet()) => {
-    if (typeof value !== "object" || value === null)
-        return value;
-    if (seen.has(value))
-        return "[circular]";
-    seen.add(value);
-    if (Array.isArray(value)) {
-        return value.map((item) => sanitizeValueForTrace(item, seen));
-    }
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null)
-        return value;
-    return Object.fromEntries(Object.entries(value).map(([key, nestedValue]) => [
-        key,
-        SENSITIVE_TRACE_FIELD.has(key.toLowerCase()) ||
-            isPresignedUrl(nestedValue)
-            ? "[redacted]"
-            : sanitizeValueForTrace(nestedValue, seen),
-    ]));
-};
-export const sanitizeFlagsForTrace = (flags) => {
-    const out = {};
-    for (const [k, v] of Object.entries(flags)) {
-        const lower = k.toLowerCase();
-        if (SENSITIVE_FLAG.has(lower) ||
-            lower.includes("secret") ||
-            lower.includes("password")) {
-            out[k] =
-                typeof v === "string" ? `[redacted ${v.length} chars]` : "[redacted]";
-        }
-        else {
-            out[k] = v;
-        }
-    }
-    return out;
-};
-export const consumeCliQuietFlags = (flags) => {
-    const fromEnv = process.env.BB_CLI_QUIET === "1";
-    const fromFlags = flags.quiet === true || flags.q === true;
-    delete flags.quiet;
-    delete flags.q;
-    return fromEnv || fromFlags;
-};
-/** stderr so stdout remains JSON-only for pipes (same intent as “log what the CLI is doing”). */
-export const logCliAction = (record) => {
-    if (!shouldLogCliActions())
-        return;
-    console.error("[bb]", JSON.stringify({ ...record, ts: new Date().toISOString() }));
-};