@go-labs-sg/bb 2.47.0 → 2.48.0

package/README.md

@@ -501,7 +501,11 @@ bb budget version list <budgetId> --all
 - `--all` explicitly collects all visible history through sequential bounded requests. It cannot be combined with `--cursor`; `--limit` controls each request's size. It can still be expensive and retains the complete result in memory. A failed page aborts without emitting a successful partial export.
 - Pages preserve newest-first `createdAt`/`id` ordering, role visibility, and creator/version-group metadata. They are not a point-in-time database snapshot; versions added after traversal starts require a fresh first-page read, and concurrent changes to visibility can affect traversal.
 
-The backend must expose `budgetVersion.getBudgetVersionsPage`. The legacy unbounded tRPC `getBudgetVersions` remains available but deprecated for external compatibility; unknown external clients are not silently capped. Removing that endpoint requires a separate usage/compatibility review. This change does not publish the CLI, deploy the backend, delete audit snapshots, or establish measured RU savings.
+The canonical backend procedure is `budgetVersion.getBudgetVersions`. It now accepts `{ budgetId, limit?, cursor? }` and returns `{ versions, nextCursor }`, with a default page size of 20 and maximum of 50. The former budgetId-only input remains valid, but returns the first page—not a complete-history array. **This response-shape and completeness change is breaking despite keeping the route name.** Older installed CLI builds and external scripts must consume `versions` and explicitly continue through `nextCursor`; otherwise they may fail or mistake partial history for a complete export. Deprecated MCP builds may also be incompatible, but they must not be updated or used as a rollout gate. Current CLI aliases `get-budget-versions` and `get_budget_versions` remain supported.
+
+For direct tRPC clients, call `getBudgetVersions.query({ budgetId, limit: 20, cursor })`, consume `versions`, and request the next page only when `nextCursor` is present. The intermediate `getBudgetVersionsPage` procedure is removed; migrate callers of that name to `getBudgetVersions` rather than retrying `NOT_FOUND`. A complete export must explicitly walk every page, abort on a failed page or repeated cursor, and emit success only after reaching the end; `bb budget version list <budgetId> --all` implements that traversal. Do not treat a first page as complete history. The existing missing/deleted-cursor behavior and non-snapshot traversal are unchanged; concurrent deletions or visibility changes can require restarting an export.
+
+Coordinate the backend and maintained client rollout: publish/use this CLI only against a backend with the paginated `getBudgetVersions` contract; an older backend returns an array under that same name. MCP is deprecated and frozen, so do not update or publish it. Existing builds that call `getBudgetVersionsPage` must also migrate before that route is removed, including cached web bundles. The residual requester is not yet attributed: server timing logs prove route usage but do not identify its client or installed version. Reusing the route name bounds its history result; it does not prove complete-history consumers migrated, that a periodic schedule stopped, or that measured RU savings occurred. This source change does not publish clients, deploy the backend, delete audit snapshots or change indexes.
 
 ### Link an existing QuickBooks invoice
 
@@ -602,17 +606,22 @@ A `.env` file in the **current working directory** is loaded automatically for a
 
 ## Developing in this repo
 
-From the monorepo root (after `bun install`):
+Follow the [development workflow](../../../docs/development-workflow.md#required-cli-coverage). App/API changes affecting `bb` must include CLI contracts, registry/help/docs and verification in the same change; do not update deprecated MCP.
+
+From the monorepo root, after isolated worktree setup and client generation:
 
 ```bash
-export BB_API_KEY=...
-bun run packages/budget-builder/cli/src/index.ts budget list
+bun --filter @go-labs-sg/bb typecheck
+bun --filter @go-labs-sg/bb build
+bun run packages/budget-builder/cli/src/index.ts help
 ```
 
+Use approved browser authorization or an existing automation API key for commands that access data. Help/build examples do not authorize production reads, mutations, email or financial writes.
+
 Or from `packages/budget-builder/cli`:
 
 ```bash
-bun run build          # emit dist/ via tsc
+bun run build          # generate command artifacts, then bundle dist/index.js with Bun
 bun run typecheck      # tsc --noEmit
 bun run src/index.ts budget list
 ```
@@ -624,7 +633,7 @@ bun run src/index.ts budget list
 
 ### Publish
 
-Build the package first, then create its publishable archive with Bun:
+Only prepare publication when authorized; building or packing is not permission to publish. From `packages/budget-builder/cli`, build the package first, then create its publishable archive with Bun:
 
 ```bash
 bun run build

package/dist/index.js

@@ -35,16 +35,16 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../../node_modules/.bun/dotenv@18.0.5/node_modules/dotenv/dist/index.cjs
+// ../../../node_modules/.bun/dotenv@18.0.6/node_modules/dotenv/dist/index.cjs
 var require_dist = __commonJS(function(exports, module) {
-  var I = (e, o) => () => {
+  var S = (e, o) => () => {
     try {
       return o || e((o = { exports: {} }).exports, o), o.exports;
     } catch (t) {
       throw o = 0, t;
     }
   };
-  var S = I((xe, U) => {
+  var j = S((xe, U) => {
     function G(e) {
       return typeof e == "string" ? !["false", "0", "no", "off", ""].includes(e.toLowerCase()) : !!e;
     }
@@ -58,8 +58,8 @@ var require_dist = __commonJS(function(exports, module) {
     }
     U.exports = { parseBoolean: G, optionsFromEnv: X };
   });
-  var N = I((ye, x) => {
-    var Y = __require("fs"), j = __require("path"), z = __require("os"), { URL: Z, fileURLToPath: ee } = __require("url"), { parseBoolean: k, optionsFromEnv: B } = S(), te = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
+  var N = S((ye, x) => {
+    var Y = __require("fs"), k = __require("path"), z = __require("os"), { URL: Z, fileURLToPath: ee } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = j(), te = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
     for (let e = 48;e <= 57; e++)
       b[e] = 1;
     for (let e = 65;e <= 90; e++)
@@ -185,7 +185,7 @@ var require_dist = __commonJS(function(exports, module) {
       return o;
     }
     function ne(e, o) {
-      return o && k(o.fast) ? oe(e) : re(e);
+      return o && $(o.fast) ? oe(e) : re(e);
     }
     function T(e) {
       console.log(`\u2506 ${e}`);
@@ -194,16 +194,16 @@ var require_dist = __commonJS(function(exports, module) {
       console.error(`\u25C7 ${e}`);
     }
     function V(e) {
-      return e[0] === "~" ? j.join(z.homedir(), e.slice(1)) : e;
+      return e[0] === "~" ? k.join(z.homedir(), e.slice(1)) : e;
     }
     function ie(e = {}) {
       return { ...B(), ...e };
     }
     function ce(e) {
       e = ie(e);
-      let o = j.resolve(process.cwd(), ".env"), t = "utf8", n = process.env;
+      let o = k.resolve(process.cwd(), ".env"), t = "utf8", n = process.env;
       e && e.processEnv != null && (n = e.processEnv);
-      let r = k(e && e.debug);
+      let r = $(e && e.debug);
       e && e.encoding ? t = e.encoding : r && T("no encoding is specified (UTF-8 is used by default)");
       let s = [o];
       if (e && e.path)
@@ -222,12 +222,12 @@ var require_dist = __commonJS(function(exports, module) {
         } catch (a) {
           r && T(`failed to load ${c} ${a.message}`), i = a;
         }
-      let p = A.populate(n, l, e), f = k(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(n).quiet);
+      let p = A.populate(n, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(n).quiet);
       if (r || !f) {
         let c = Object.keys(p).length, a = [];
         for (let g of s)
           try {
-            let h = j.relative(process.cwd(), g instanceof Z ? ee(g) : g);
+            let h = k.relative(process.cwd(), g instanceof Z ? ee(g) : g);
             a.push(h);
           } catch (h) {
             r && T(`failed to load ${g} ${h.message}`), i = h;
@@ -240,7 +240,7 @@ var require_dist = __commonJS(function(exports, module) {
       return A.configDotenv(e);
     }
     function le(e, o, t = {}) {
-      let n = !!(t && t.debug), r = !!(t && t.override), s = {};
+      let n = $(t && t.debug), r = $(t && t.override), s = {};
       if (e === null || typeof e != "object" || o === null || typeof o != "object") {
         let i = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
         throw i.code = "OBJECT_REQUIRED", i;
@@ -256,7 +256,7 @@ var require_dist = __commonJS(function(exports, module) {
     x.exports.populate = A.populate;
     x.exports = A;
   });
-  var M = I((Te, W) => {
+  var M = S((Te, W) => {
     var _ = __require("child_process"), fe = __require("fs"), L = __require("path");
     function ue(e) {
       let o = ['"'], t = 0;
@@ -309,9 +309,9 @@ var require_dist = __commonJS(function(exports, module) {
     }
     W.exports = pe;
   });
-  var K = I(($e, F) => {
-    var he = __require("fs"), ge = __require("os"), Q = __require("path"), me = __require("child_process"), ve = M(), R = N(), { optionsFromEnv: Ce } = S();
-    function $() {
+  var K = S(($e, F) => {
+    var he = __require("fs"), ge = __require("os"), Q = __require("path"), me = __require("child_process"), ve = M(), R = N(), { optionsFromEnv: Ce } = j();
+    function D() {
       console.log(["Usage: dotenv run [--help] [-q|--quiet] [--debug] [--override] [--fast] [-f|--file <paths>] [--] <command> [args...]", "", "Run a command with environment variables from a .env file.", "Place dotenv options before the command; all following arguments go to the command.", "", "Options:", "  -f, --file <paths>  .env paths, comma-separated or repeated (default: .env)", "  -q, --quiet suppress the injected env message", "  --debug     enable debug logging", "  --override  override existing environment variables", "  --fast      use the faster character-scanner parser", "", "Environment variables (DOTENV_CONFIG_* names remain as fallbacks):", "  DOTENV_PATH, DOTENV_ENCODING, DOTENV_QUIET,", "  DOTENV_DEBUG, DOTENV_OVERRIDE,", "  DOTENV_FAST"].join(`
 `));
     }
@@ -383,24 +383,24 @@ var require_dist = __commonJS(function(exports, module) {
     function J(e) {
       let o = e[0];
       if (o === "--help" || o === "-h") {
-        $();
+        D();
         return;
       }
       if (o !== "run") {
-        $(), process.exitCode = 1;
+        D(), process.exitCode = 1;
         return;
       }
       let t = we(e.slice(1));
       if (t.help) {
-        $();
+        D();
         return;
       }
       if (t.error) {
-        console.error(`dotenv: ${t.error}`), $(), process.exitCode = 1;
+        console.error(`dotenv: ${t.error}`), D(), process.exitCode = 1;
         return;
       }
       if (t.command.length === 0) {
-        $(), process.exitCode = 1;
+        D(), process.exitCode = 1;
         return;
       }
       let n = Ee(t);
@@ -456,13 +456,13 @@ var require_dist = __commonJS(function(exports, module) {
     F.exports = J;
     F === __require.main && J(process.argv.slice(2));
   });
-  var D = N();
+  var I = N();
   var Oe = K();
-  module.exports = D;
-  module.exports.config = D.config;
-  module.exports.configDotenv = D.configDotenv;
-  module.exports.parse = D.parse;
-  module.exports.populate = D.populate;
+  module.exports = I;
+  module.exports.config = I.config;
+  module.exports.configDotenv = I.configDotenv;
+  module.exports.parse = I.parse;
+  module.exports.populate = I.populate;
 });
 
 // src/load-env.ts
@@ -9576,7 +9576,7 @@ var getBudgetVersions = async (budgetId, options = {}) => {
   const seenCursors = new Set;
   let cursor = options.cursor;
   do {
-    const page = await api2.budgetVersion.getBudgetVersionsPage.query({
+    const page = await api2.budgetVersion.getBudgetVersions.query({
       budgetId,
       limit: options.limit,
       cursor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/bb",
-  "version": "2.47.0",
+  "version": "2.48.0",
   "description": "Budget Builder CLI for AI agents — manage budgets, bills, claims, quotations, and customer invoices with explicit workflow previews for sensitive changes.",
   "type": "module",
   "main": "./dist/index.js",
@@ -20,7 +20,7 @@
   ],
   "dependencies": {
     "@trpc/client": "^11.19.0",
-    "dotenv": "^18.0.1",
+    "dotenv": "^18.0.6",
     "mime-types": "^3.0.2",
     "superjson": "^2.2.6"
   },