@wayai/cli 0.3.148 → 0.3.150

package/dist/index.js

@@ -18503,13 +18503,20 @@ var init_terminal_output = __esm({
 
 // src/lib/base-id.ts
 function isValidBaseId(id) {
-  return BASE_ID_RE.test(id);
+  return id.length > 0 && id.length <= BASE_ID_MAX_LENGTH && BASE_ID_RE.test(id);
 }
-var BASE_ID_RE;
+function isPathSafeId(id) {
+  return PATH_SAFE_ID_RE.test(id);
+}
+var BASE_ID_MAX_LENGTH, BASE_ID_RE, BASE_ID_RULE, PATH_SAFE_ID_RE, PATH_SAFE_ID_RULE;
 var init_base_id = __esm({
   "src/lib/base-id.ts"() {
     "use strict";
-    BASE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
+    BASE_ID_MAX_LENGTH = 128;
+    BASE_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+    BASE_ID_RULE = `letters, digits, \`-\` and \`_\`, starting with a letter, digit or \`_\`, ${BASE_ID_MAX_LENGTH} characters or fewer`;
+    PATH_SAFE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
+    PATH_SAFE_ID_RULE = "letters, digits, dot, dash and underscore, with no path separators, not `.` or `..` alone, 256 characters or fewer";
   }
 });
 
@@ -18572,9 +18579,9 @@ function folderForSelector(basesDir, selector) {
   return path17.join(basesDir, selector);
 }
 function assertValidBaseSelector(selector, source = "base") {
-  if (!isValidBaseId(selector)) {
+  if (!isPathSafeId(selector)) {
     throw expected(
-      `Invalid ${source} "${selector}". Base ids are slugs \u2014 letters, digits, dot, dash and underscore only, with no path separators.`
+      `Invalid ${source} "${selector}". A base selector is one folder name \u2014 ${PATH_SAFE_ID_RULE}.`
     );
   }
 }
@@ -18942,9 +18949,16 @@ var init_base_binding = __esm({
     init_worktree_binding();
     binding2 = createWorktreeBinding({
       filename: "wayai-base-binding",
-      isValidId: isValidBaseId,
+      // `isPathSafeId`, not the API's base-id rule. The tripwire's duty is that a
+      // garbled or multi-line file read as unbound, which this grammar delivers;
+      // applying the mint rule instead would refuse to bind a base whose stored id
+      // predates it — a base the API still serves — and so lock the CLI out of the
+      // one workflow that could migrate off it.
+      isValidId: isPathSafeId,
       noun: "base",
-      idLabel: "base id (must be a slug)",
+      // States what is actually checked. "must be a slug" described no rule the
+      // reader could act on, and naming the API's rule here would name the wrong one.
+      idLabel: `base id (${PATH_SAFE_ID_RULE})`,
       unbindCommand: "wayai bases unbind",
       useCommand: "wayai bases use"
     });
@@ -18961,10 +18975,14 @@ var init_base_binding = __esm({
 // src/data/helpers.ts
 import { readFileSync as readFileSync16 } from "fs";
 function pathSegment(id, label = "id") {
+  if (!isPathSafeId(id)) {
+    throw expected(`Invalid ${label}: ${JSON.stringify(id)}. An id may use ${PATH_SAFE_ID_RULE}.`);
+  }
+  return encodeURIComponent(id);
+}
+function basePathSegment(id, label = "base id") {
   if (!isValidBaseId(id)) {
-    throw expected(
-      `Invalid ${label}: ${JSON.stringify(id)}. Ids are slugs \u2014 letters, digits, dot, dash and underscore only.`
-    );
+    throw expected(`Invalid ${label}: ${JSON.stringify(id)}. Base ids are slugs \u2014 ${BASE_ID_RULE}.`);
   }
   return encodeURIComponent(id);
 }
@@ -19178,7 +19196,7 @@ function writeBaseFolder(folder, meta, config) {
     for (const raw of entities) {
       const entity = raw;
       const id = String(entity.id);
-      if (!isValidBaseId(id)) {
+      if (!isPathSafeId(id)) {
         console.warn(`  Warning: skipping ${kind} entity with unusable id ${JSON.stringify(id)}.`);
         continue;
       }
@@ -19502,7 +19520,7 @@ function requireGitRoot(gitRoot) {
   return gitRoot;
 }
 async function writeProductionMirror(client, basesDir, prodId, record) {
-  if (!isValidBaseId(prodId)) {
+  if (!isPathSafeId(prodId)) {
     throw expected(`Refusing to mirror base ${JSON.stringify(prodId)}: not a usable base id.`);
   }
   const config = await getConfig(client, prodId);
@@ -28135,18 +28153,19 @@ function buildBasesCommand() {
     "Default IANA timezone for datetime canonicalization (e.g. America/Sao_Paulo); a record type's own timezone overrides it"
   ).option(
     "--environment <env>",
-    "production (default) | preview. Fixed at creation, and no id can change environment later. For a base you intend to keep, take the default so the durable id belongs to production, then get a linked preview with create-preview and promote from it. Pass preview only for an ephemeral or eval base under a derived id: a preview created here has no production origin, cannot be given one later, and so can never be promoted directly"
+    "production (default) | preview. Fixed for the life of a base and not changeable on one that exists \u2014 but not welded to the id: once a base is permanently deleted and that deletion completes, the id is free and can be created again in either environment, so a preview you prototyped on can become the production base under the same slug. For a base you intend to keep, take the default so the durable id belongs to production, then get a linked preview with create-preview and promote from it. Pass preview for an ephemeral or eval base under a derived id: a preview created here has no production origin, cannot be given one later, and so can never be promoted directly"
   ).action(async function(id, opts) {
     const environment = parseEnum("--environment", opts.environment, [
       "production",
       "preview"
     ]);
+    const target = basePathSegment(id);
     const client = await createDataClient();
     const body = { name: opts.name, description: opts.description };
     if (environment) body.environment = environment;
     if (opts.tags) body.tags = await resolveBaseTags(opts.tags, client);
     if (opts.timezone) body.settings = { timezone: opts.timezone };
-    printOutput(await client.request("PUT", `/v1/bases/${pathSegment(id)}`, body), outputFormat(this));
+    printOutput(await client.request("PUT", `/v1/bases/${target}`, body), outputFormat(this));
   });
   bases.command("update <id>").description(
     "Update a base's mutable config (display name, description, tags, default timezone/settings). The id/slug is immutable."
@@ -28169,6 +28188,7 @@ function buildBasesCommand() {
         "Nothing to update. Provide at least one of --name, --description, --tags, --timezone, --settings, --integrations."
       );
     }
+    const target = basePathSegment(id);
     const client = await createDataClient();
     const body = {};
     if (opts.name !== void 0) body.name = opts.name;
@@ -28189,20 +28209,21 @@ function buildBasesCommand() {
         }
         settings = parsed;
       } else {
-        const existing = await client.request("GET", `/v1/bases/${pathSegment(id)}`);
+        const existing = await client.request("GET", `/v1/bases/${target}`);
         settings = { ...existing?.settings ?? {} };
       }
       if (opts.timezone !== void 0) settings.timezone = opts.timezone;
       body.settings = settings;
     }
-    printOutput(await client.request("PUT", `/v1/bases/${pathSegment(id)}`, body), outputFormat(this));
+    printOutput(await client.request("PUT", `/v1/bases/${target}`, body), outputFormat(this));
   });
   bases.command("rename <id>").description(
     "Rename a base's display name (the id/slug is immutable \u2014 it scopes token grants, MCP endpoints, and references)"
   ).requiredOption("--name <name>", "New display name").action(async function(id, opts) {
+    const target = basePathSegment(id);
     const client = await createDataClient();
     printOutput(
-      await client.request("PUT", `/v1/bases/${pathSegment(id)}`, { name: opts.name }),
+      await client.request("PUT", `/v1/bases/${target}`, { name: opts.name }),
       outputFormat(this)
     );
   });
@@ -28210,10 +28231,11 @@ function buildBasesCommand() {
     "--tags <tags>",
     "Comma-separated organization tag names (e.g. clinica-medica,billing). An empty value clears them"
   ).action(async function(id, opts) {
+    const target = basePathSegment(id);
     const client = await createDataClient();
     const tags = await resolveBaseTags(opts.tags, client);
     printOutput(
-      await client.request("PUT", `/v1/bases/${pathSegment(id)}`, { tags }),
+      await client.request("PUT", `/v1/bases/${target}`, { tags }),
       outputFormat(this)
     );
   });
@@ -28244,6 +28266,11 @@ function buildBasesCommand() {
     const integrations = parseEnum("--integrations", opts.integrations, ["enabled", "disabled"]);
     const client = await createDataClient();
     printOutput(
+      // `pathSegment`, not `basePathSegment`: the id at fault here is the
+      // ORIGIN's, which is immutable and not the caller's to re-spell. The API's
+      // `assertDerivablePreviewId` answers that case with the remedy instead of
+      // the charset, and refusing locally would replace it with a rule the
+      // caller cannot act on.
       await client.request("POST", `/v1/${pathSegment(originId, "origin base id")}/preview`, {
         name: opts.name,
         description: opts.description,
@@ -28357,9 +28384,9 @@ function buildBasesCommand() {
 function resolveSelectorToBaseId(selector) {
   const gitRoot = findGitRoot();
   if (!gitRoot || selector.includes("/") || selector.includes(path35.sep)) return selector;
-  if (!isValidBaseId(selector)) return selector;
+  if (!isPathSafeId(selector)) return selector;
   const id = readBaseMeta(path35.join(resolveBasesDir(gitRoot), selector))?.base_id;
-  return typeof id === "string" && isValidBaseId(id) ? id : selector;
+  return typeof id === "string" && isPathSafeId(id) ? id : selector;
 }
 var init_bases = __esm({
   "src/data/commands/bases.ts"() {