busa-cli 0.41.0 → 0.50.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as runCli, r as pkgVersion, t as checkForUpdate } from "./update-check-BR-m6M4r.js";
+import { i as runCli, r as pkgVersion, t as checkForUpdate } from "./update-check-Cq2ouWym.js";
 //#region src/cli.ts
 const exitCode = await runCli(process.argv.slice(2));
 const notice = await checkForUpdate("busabase-cli", pkgVersion());

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as render, i as runCli, n as HELP, r as pkgVersion, t as checkForUpdate } from "./update-check-BR-m6M4r.js";
+import { a as render, i as runCli, n as HELP, r as pkgVersion, t as checkForUpdate } from "./update-check-Cq2ouWym.js";
 import { DEFAULT_BASE_URL, createBusabaseClient, normalizeBaseUrl } from "busabase-sdk";
 export { DEFAULT_BASE_URL, HELP, checkForUpdate, createBusabaseClient, normalizeBaseUrl, pkgVersion, render, runCli };

package/dist/{update-check-BR-m6M4r.js → update-check-Cq2ouWym.js}

@@ -5614,6 +5614,26 @@ const TemplateManifestSchema = z.object({
 	secrets: z.array(TemplateSecretSchema).default([]),
 	requires: z.object({ airapp: z.boolean().optional() }).default({})
 });
+const TemplateRiskLevelSchema = z.enum([
+	"gated-write",
+	"local-write",
+	"read-only",
+	"sandbox"
+]);
+/**
+* Normalize a declared `risk` string to a known level, or `undefined`.
+*
+* Deliberately never throws. The frontmatter field stays a free-form string
+* (see `SkillBusabaseMetadataSchema` below) so an author's typo or an
+* already-published package using a since-retired term (`"review-first"`, from
+* before this enum existed) fails soft — the card shows "undeclared" instead of
+* guessing, and the package still installs. Only `busabase-cli check` should
+* ever turn an unrecognized value into something the author sees and fixes.
+*/
+const parseTemplateRisk = (raw) => {
+	const result = TemplateRiskLevelSchema.safeParse(raw);
+	return result.success ? result.data : void 0;
+};
 /**
 * `metadata.busabase` inside the root `SKILL.md`'s YAML frontmatter.
 *
@@ -5627,6 +5647,12 @@ const SkillBusabaseMetadataSchema = z.object({
 	folderSlug: z.string().optional(),
 	/** Resource keys the manual talks about; each must exist under `content/`. */
 	resources: z.array(z.string()).default([]),
+	/**
+	* Free-form on purpose — see `parseTemplateRisk`. Validating this to the enum
+	* here would turn a stranger's typo or a retired term into a hard parse
+	* failure for the whole frontmatter, which is a worse outcome than a card
+	* that cannot show a risk badge.
+	*/
 	risk: z.string().optional()
 });
 /**
@@ -6291,12 +6317,7 @@ z.object({
 z.object({
 	parentId: z.string().nullable().optional().describe("Node to start from. Omit or null to start from the space root."),
 	depth: z.coerce.number().int().min(1).max(5).optional().describe("How many levels beneath the start point to eagerly include (default 2 once either field is set). Capped at 5."),
-	/**
-	* `active` (default) walks the live tree. `archived` returns the flat set of
-	* soft-archived nodes for the Trash view — no `parentId`/`depth` walk, since
-	* archived nodes are shown as a list, not a tree.
-	*/
-	status: z.enum(["active", "archived"]).optional().default("active"),
+	status: z.enum(["active", "archived"]).optional().default("active").describe("`active` walks the live TREE. `archived` returns a FLAT list of soft-archived nodes (the Trash view) with no parent/depth walk — so the response shape you can rely on differs between the two, not just the rows."),
 	/**
 	* Narrow to specific node types and return a FLAT list of lightweight node
 	* summaries (`children: []`) instead of walking the tree. This is what
@@ -6323,8 +6344,8 @@ z.object({
 	types: z.union([z.array(z.enum(NODE_TYPES)), z.enum(NODE_TYPES)]).transform((value) => Array.isArray(value) ? value : [value]).optional().describe("Return a flat list of lightweight summaries for these node types instead of the tree. Read one node's full detail with GET /nodes/{nodeId}.")
 }).optional();
 z.object({
-	nodeId: z.string(),
-	potentialAncestorId: z.string()
+	nodeId: z.string().describe("The node walked UPWARDS from — the possible descendant."),
+	potentialAncestorId: z.string().describe("The node looked for on the way up. Answers \"is `nodeId` inside this one?\", not the reverse — swapping the two silently returns the wrong answer rather than an error.")
 });
 z.object({ isDescendant: z.boolean() });
 z.object({
@@ -6379,8 +6400,8 @@ z.object({
 	agentPrompts: customAgentPromptsSchema.nullable()
 });
 z.object({
-	query: z.string().min(1),
-	limit: z.coerce.number().int().min(1).max(50).optional().default(20)
+	query: z.string().min(1).describe("Matched against node NAMES only. Use `/api/v1/search` to search content."),
+	limit: z.coerce.number().int().min(1).max(50).optional().default(20).describe("Results to return. Capped at 50 here, unlike most listings' 100.")
 });
 z.object({
 	id: z.string(),
@@ -6571,8 +6592,8 @@ z.object({
 	unreadCount: z.number().int()
 });
 z.object({
-	page: z.number().int().min(1).optional().default(1),
-	pageSize: z.number().int().min(1).max(100).optional().default(50)
+	page: z.number().int().min(1).optional().default(1).describe("1-indexed, not 0-indexed."),
+	pageSize: z.number().int().min(1).max(100).optional().default(50).describe("Mentions per page. Capped at 100.")
 });
 z.object({ 
 /** Stamps every unread mention row this caller has on that comment. */
@@ -6810,8 +6831,8 @@ z.object({
 	reason: z.string().optional()
 });
 z.object({
-	subjectType: commentSubjectTypeSchema,
-	subjectId: z.string().min(1)
+	subjectType: commentSubjectTypeSchema.describe("What the comment thread hangs off, which decides how `subjectId` is interpreted."),
+	subjectId: z.string().min(1).describe("The subject's id, interpreted according to `subjectType`.")
 }).extend({
 	authorId: z.string().optional().default("local-admin"),
 	body: z.string().trim().min(1),
@@ -6822,29 +6843,28 @@ z.object({
 	*/
 	mentions: z.array(commentMentionInputSchema).optional().default([])
 });
-z.object({ limit: z.coerce.number().int().min(1).max(100).optional().default(50) }).optional().default({ limit: 50 });
-z.object({ status: z.enum(["active", "archived"]).optional().default("active") });
+z.object({ limit: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Rows to return, most recent first. Capped at 100; this listing has no cursor.") }).optional().default({ limit: 50 });
+z.object({ status: z.enum(["active", "archived"]).optional().default("active").describe("`active` (default) or the soft-archived set. Archived rows have the SAME shape as live ones — this is a predicate, not a different resource.") });
 z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(50),
-	/** Opaque base64 cursor (`createdAt|id`) for keyset pagination. */
-	cursor: z.string().optional(),
-	status: z.array(changeRequestStatusSchema).optional(),
-	mine: z.boolean().optional(),
-	affectsNodeId: z.string().min(1).optional()
+	limit: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Change requests per page. Capped at 100; ask for the next page with `cursor`."),
+	cursor: z.string().optional().describe("Opaque page cursor: pass back the `nextCursor` from the previous response. Do not construct or parse it."),
+	status: z.array(changeRequestStatusSchema).optional().describe("Keep only these statuses. Omitting it returns every status, not just open ones."),
+	mine: z.boolean().optional().describe("Only change requests CREATED by the acting user — not ones awaiting their review."),
+	affectsNodeId: z.string().min(1).optional().describe("Only change requests whose target, or any of their operations, touches this node — including Base-backed nodes. To ask whether a resource already has an unfinished change request, pass this with `limit: 1` rather than paging the space: an empty result is conclusive.")
 }).optional().default({ limit: 50 });
 z.object({
 	changeRequests: z.array(changeRequestSchema),
 	nextCursor: z.string().nullable()
 });
 const changeRequestPageInputShape = {
-	page: z.coerce.number().int().min(1).optional().default(1),
-	pageSize: z.coerce.number().int().min(1).max(100).optional().default(50),
-	status: z.array(changeRequestStatusSchema).optional(),
-	mine: z.boolean().optional()
+	page: z.coerce.number().int().min(1).optional().default(1).describe("1-indexed, not 0-indexed."),
+	pageSize: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Change requests per page. Capped at 100."),
+	status: z.array(changeRequestStatusSchema).optional().describe("Keep only these statuses. Omitting it returns every status, not just open ones."),
+	mine: z.boolean().optional().describe("Only change requests CREATED by the acting user — not ones awaiting their review.")
 };
 z.object({
 	...changeRequestPageInputShape,
-	affectsNodeId: z.string().min(1).optional()
+	affectsNodeId: z.string().min(1).optional().describe("Only change requests whose target, or any of their operations, touches this node — including Base-backed nodes.")
 }).optional().default({
 	page: 1,
 	pageSize: 50
@@ -6876,9 +6896,9 @@ const SEARCH_SOURCES = [
 	"nodes"
 ];
 z.object({
-	query: z.string().default(""),
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	offset: z.coerce.number().int().min(0).optional().default(0),
+	query: z.string().default("").describe("Full-text query. An empty string matches nothing."),
+	limit: z.coerce.number().int().min(1).max(100).optional().default(20).describe("Results per page. Capped at 100; note the default is 20, not 50."),
+	offset: z.coerce.number().int().min(0).optional().default(0).describe("0-indexed skip count. This endpoint pages by offset, not by cursor."),
 	/**
 	* Restrict which content this call searches. Omitted means all three
 	* (unchanged behavior for every caller before this parameter existed).
@@ -6888,7 +6908,7 @@ z.object({
 	* (`?sources=records&sources=files`) becomes an array. Accept both shapes
 	* and normalize to an array.
 	*/
-	sources: z.union([z.array(z.enum(SEARCH_SOURCES)), z.enum(SEARCH_SOURCES)]).transform((value) => Array.isArray(value) ? value : [value]).optional()
+	sources: z.union([z.array(z.enum(SEARCH_SOURCES)), z.enum(SEARCH_SOURCES)]).transform((value) => Array.isArray(value) ? value : [value]).optional().describe("Restrict which content is searched. Omitting it searches ALL sources. Repeat the parameter to pass several (`?sources=records&sources=files`); a single occurrence is accepted as a bare value.")
 });
 const authSpaceSchema = z.object({
 	id: z.string(),
@@ -7958,6 +7978,8 @@ const validateTemplate = (tree) => {
 	if (skill && skill.name !== tree.manifest.name) errors.push(`Name mismatch: ${PACKAGE_SKILL_ENTRY} declares "${skill.name}" but busabase.json declares "${tree.manifest.name}". They are the same app and must agree.`);
 	const bases = baseSlugs(tree);
 	for (const key of busabaseMeta?.resources ?? []) if (!bases.has(key)) errors.push(`${PACKAGE_SKILL_ENTRY} lists resource "${key}", but content/ has no Base with that slug. An agent told about a table that does not exist will write to the wrong one.`);
+	const risk = parseTemplateRisk(busabaseMeta?.risk);
+	if (busabaseMeta?.risk !== void 0 && risk === void 0) warnings.push(`metadata.busabase.risk is "${busabaseMeta.risk}", which is not a recognized level (gated-write, local-write, read-only, sandbox). The Template Center will show it as undeclared.`);
 	const airapps = airAppSlugs(tree);
 	const resolved = resolvePrimaryAirApp(template, airapps);
 	let primaryAirApp;
@@ -7994,7 +8016,8 @@ const validateTemplate = (tree) => {
 		errors,
 		warnings,
 		...primaryAirApp ? { primaryAirApp } : {},
-		...template ? { template } : {}
+		...template ? { template } : {},
+		...risk ? { risk } : {}
 	};
 };
 /**
@@ -10006,25 +10029,6 @@ const assertPlanIsApplicable = (plan, autoMerge) => {
 //#endregion
 //#region ../../packages/busabase-package/src/discover.ts
 /**
-* What is at the end of this URL — one package, one template, or a repository
-* full of them?
-*
-* A user pasting a GitHub URL does not think in terms of "package roots". They
-* paste the repo they were looking at. Sometimes that repo IS the package;
-* sometimes it is `busabase/skills`, which holds dozens under `skills/*`. Before
-* this, the second case was only ever an error message with a list of
-* subdirectories to paste instead — correct, and a dead end for anyone who did
-* not want to edit a URL by hand.
-*
-* Discovery answers it once for every caller: the CLI turns the result into a
-* pick-one list, the dashboard's install dialog into a chooser, the Template
-* Center's index CI into the set of cards to publish. All three must agree on
-* what counts as a template, which is why the verdict comes from the same
-* `validateTemplate` they would each otherwise re-implement.
-*
-* Spec: `apps/busabase/content/spec/template-center.md` §6.2a.
-*/
-/**
 * Only one level deep, matching the `skills/<name>/` layout the skills CLI
 * already established and the Template Center reads. Walking arbitrarily deep
 * would turn one paste into an unbounded scan of a monorepo and surface vendored
@@ -10074,6 +10078,7 @@ const discoverPackages = (files) => {
 			counts: countTree(tree),
 			...validation.primaryAirApp ? { primaryAirApp: validation.primaryAirApp } : {},
 			...tree.manifest.template?.category ? { category: tree.manifest.template.category } : {},
+			...validation.risk ? { risk: validation.risk } : {},
 			screenshots: tree.manifest.template?.screenshots ?? [],
 			tags: [.../* @__PURE__ */ new Set([...tree.manifest.tags, ...tree.manifest.template?.tags ?? []])],
 			agentPrompts: tree.manifest.template?.agentPrompts ?? [],
@@ -10290,22 +10295,6 @@ const fetchGithubPackageFiles = async (repoUrl, options = {}) => {
 };
 //#endregion
 //#region ../../packages/busabase-package/src/index-build.ts
-/**
-* Build the Template Center's catalog from a directory of skills.
-*
-* The catalog is not hand-maintained. A card that says "6 tables" for a package
-* that installs five is a trust bug, not a typo — so every field here is read
-* off the package itself, and whether an entry appears at all is decided by the
-* SAME `validateTemplate` the installer uses. A skill that would install as a
-* plain package can never be listed as a template, because one function answers
-* that question for both.
-*
-* Deliberately a plain function over a file map rather than something that
-* walks a disk: the CLI hands it a checkout, and a future CI job could hand it
-* a fetched zipball, without either needing its own notion of what counts.
-*
-* Spec: `apps/busabase/content/spec/template-center.md` §6.4.
-*/
 /** Bumped when a consumer would misread an older file. */
 const TEMPLATE_INDEX_FORMAT = "busabase-template-index@1";
 const toEntry = (found, airapps) => ({
@@ -10313,6 +10302,7 @@ const toEntry = (found, airapps) => ({
 	name: found.name,
 	description: found.description,
 	category: found.category ?? "uncategorized",
+	...found.risk ? { risk: found.risk } : {},
 	tags: found.tags ?? [],
 	screenshots: found.screenshots,
 	agentPrompts: found.agentPrompts ?? [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busa-cli",
-  "version": "0.41.0",
+  "version": "0.50.0",
   "description": "Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-cli",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@zip.js/zip.js": "^2.8.20",
     "busabase-package": "workspace:*",
-    "busabase-sdk": "0.41.0",
+    "busabase-sdk": "0.50.0",
     "commander": "^14.0.0",
     "qrcode": "^1.5.4",
     "tar-stream": "^3.1.7",