@go-labs-sg/bb 2.25.0 → 2.27.0

package/README.md

@@ -12,6 +12,12 @@ For AI agents using this CLI: do not execute mutations until the user explicitly
 
 **Registry:** [`@go-labs-sg/bb`](https://www.npmjs.com/package/@go-labs-sg/bb)
 
+## Shared catalogue editing
+
+All active authenticated users can edit suppliers, inventory items and item categories. Normal-user supplier updates submit a revision for approval in the shared API; item/category edits apply immediately. Lead/Admin supplier edits bypass human review. `bb supplier update` returns the server-owned approval/synchronization result without issuing another approval request. New supplier usage stays on hold during review and linked QuickBooks synchronization; existing usage continues with the last approved details until the edit is approved. Creator identity and delete/archive permissions are unchanged.
+
+See the [supplier review and rollout policy](../api/docs/supplier-edit-review.md). Deploy the backend before publishing this CLI change.
+
 ## Runtime and installation
 
 The CLI requires [Bun](https://bun.com/docs/installation) 1.4.0 or newer and a Budget Builder account with any active user role.
@@ -328,6 +334,6 @@ bun run build
 bun run pack:artifact
 ```
 
-`pack:artifact` copies only the publish allowlist into a temporary staging directory and writes a sanitized publish manifest there. It never edits the source `package.json`, and the staged archive contains no workspace-only development dependencies. The release workflow packs once, validates the resulting archive, tests that exact tarball under Node and Bun, then publishes that exact tarball. Types from `@go-labs/budget-builder-api` are compile-time only (`import type`). Prisma enum **values** used at runtime live in `src/prisma-enums.ts` (kept in sync with `packages/budget-builder/db` generated enums) so npm installs do not need `@go-labs/budget-builder-db`.
+`pack:artifact` copies only the publish allowlist into a temporary staging directory and writes a sanitized publish manifest there. It never edits the source `package.json`, and the staged archive contains no workspace-only development dependencies. The release workflow packs once, validates the resulting archive, smoke-tests that exact tarball under Bun 1.4, then publishes that exact tarball. Types from `@go-labs/budget-builder-api` are compile-time only (`import type`). Prisma enum **values** used at runtime live in `src/prisma-enums.ts` (kept in sync with `packages/budget-builder/db` generated enums) so npm installs do not need `@go-labs/budget-builder-db`.
 
 The generated `command-reference.md` and `command-manifest.json` are release artifacts. Regenerate them whenever the command registry changes; the release workflow rejects a tarball that does not include both files.

package/dist/index.js

@@ -22243,57 +22243,13 @@ async function createSupplierFromPayload(raw) {
 }
 async function updateSupplierFromPayload(raw) {
   const input2 = parseSupplierUpdatePayload(raw);
-  const updated = await api2.supplier.updateSupplier.mutate(input2);
-  const supplier = updated.result;
-  if (supplier.status !== "PENDING_APPROVAL") {
-    out(updated);
-    return;
-  }
   await assertSensitiveWorkflowConfirmed({
-    action: "Create supplier approval request",
-    entity: `supplier ${supplier.id}`,
-    details: "and send approval request emails"
-  });
-  let approvalResult;
-  try {
-    const approval = await api2.supplier.createSupplierApproval.mutate({
-      supplierId: supplier.id
-    });
-    const approvalIds = (approval.results ?? []).map((item) => ({
-      id: item.id
-    }));
-    if (approvalIds.length === 0) {
-      approvalResult = {
-        requested: true,
-        approvalCount: 0,
-        email: createApprovalEmailDeliveryFailure("No approval ids returned")
-      };
-    } else {
-      try {
-        const delivery = approval.emailDelivery;
-        approvalResult = {
-          requested: true,
-          approvalCount: approvalIds.length,
-          email: createApprovalEmailDeliveryReport(delivery)
-        };
-      } catch (error61) {
-        approvalResult = {
-          requested: true,
-          approvalCount: approvalIds.length,
-          email: createApprovalEmailDeliveryFailure(error61 instanceof Error ? error61.message : String(error61))
-        };
-      }
-    }
-  } catch (error61) {
-    approvalResult = {
-      requested: false,
-      error: error61 instanceof Error ? error61.message : String(error61)
-    };
-  }
-  out({
-    ...updated,
-    supplierApproval: approvalResult
+    action: "Update supplier",
+    entity: `supplier ${input2.id}`,
+    details: "Normal-user edits also request approval and queue approval emails."
   });
+  const updated = await api2.supplier.updateSupplier.mutate(input2);
+  out(updated);
 }
 async function createItemFromPayload(raw) {
   const input2 = parseItemCreatePayload(raw);
@@ -23970,7 +23926,7 @@ Suppliers & items
   list-suppliers             [--name] [--page] [--perPage] [--sortBy createdAt|updatedAt|name|email|phone|gstRegistered|status|active] [--sortDir asc|desc] [--createdBy <csv>] [--gstRegistered true|false] [--status CSV] [--supplierTags <csv>] [--active true|false]
     Defaults: --active true, --perPage 10, --sortBy createdAt, --sortDir desc (same as the web list); pass --active false for archived suppliers.
   create-supplier            --payload '<json>'  (supplier.createSupplier; auto-requests approval + emails when status is PENDING_APPROVAL)
-  update-supplier            --payload '<json>'  (supplier.updateSupplier; must include id; auto-requests approval + emails when status is PENDING_APPROVAL)
+  update-supplier            --payload '<json>'  (authenticated; normal-user edits require server-enforced approval)
   delete-suppliers           --ids <csv>  (supplier.deleteSuppliers; admin; archives/deactivates supplier items)
   reactivate-suppliers       --ids <csv>  (supplier.reactivateSuppliers; admin; reactivates supplier items)
   create-certification       --name  (supplier.createCertification)
@@ -23987,7 +23943,7 @@ Suppliers & items
   get-item <id>
   list-item-categories       [--page] [--perPage]
   create-item-category       --name  (admin)
-  update-item-category       --id --name  (admin)
+  update-item-category       --id --name  (authenticated; applies immediately)
   delete-item-categories     --ids <csv>  (itemCategory.deleteItemCategories; admin; empty categories only)
 
 Dashboard & users

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/bb",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "description": "Budget Builder CLI for AI agents — manage budgets, bills, claims, quotations, and customer invoices with explicit workflow previews for sensitive changes.",
   "type": "module",
   "main": "./dist/index.js",

package/role-aware-agent-guide.md

@@ -93,6 +93,7 @@ This table highlights the role-sensitive command groups an agent is most likely
 | Budget/project mutations, estimates, and budget attachments | `ADMIN`, budget creator, or project assignment as Business Development, Inside Sales, or Project Manager, depending on the endpoint. |
 | `bb budget item exception approve` | `LEAD` or `ADMIN`; requires an unavailable line and a specific audited reason. |
 | `bb project hub status`, `bb project hub setup`, and `bb project hub sync` | `ADMIN`, project creator, or project assignment as Business Development, Inside Sales, or Project Manager. Setup and sync also enforce Project Hub lifecycle/readiness checks. |
+| `bb supplier update`, `bb item update`, `bb item category update` | Any active authenticated role. Normal-user supplier edits are submitted for approval by the shared API; item/category edits apply immediately. Human review and provider synchronization can temporarily block further supplier edits/new usage. |
 | Edit/delete a bill or quotation | Usually creator or `ADMIN`, with a supported status. |
 | `bb budget approve`, `bb budget reject`, `bb supplier approve`, and `bb supplier reject` | Current user must be the pending approver and currently have role `LEAD` or `ADMIN`. |
 | `bb bill approve` and `bb bill reject` | Current user must be the pending approver and currently have role `ACCOUNTING_TEAM` for the finance/check stage or `ADMIN` for the final approval stage. |
@@ -103,7 +104,7 @@ This table highlights the role-sensitive command groups an agent is most likely
 | `bb customer-invoice approve` and `bb customer-invoice reject` | `ADMIN` batch operations selected by batch ID; the API resolves the internal pending Admin approval record. |
 | `bb customer-invoice pdf download` | `ADMIN` for pending-approval batches; other roles may download after pending approval. QuickBooks sync errors cannot be previewed or downloaded. |
 | Dashboard/performance, supplier analytics, errors, integration operations | `ADMIN`. |
-| `bb item category create`, `bb item category update`, `bb item category delete`, `bb supplier delete`, `bb supplier reactivate`, and `bb budget item placeholder-bill create` | `ADMIN`. |
+| `bb item category create`, `bb item category delete`, `bb supplier delete`, `bb supplier reactivate`, and `bb budget item placeholder-bill create` | `ADMIN`. |
 
 ## Command-selection rules