busa-cli 0.9.12 → 0.9.13

package/dist/{chunk-DRYP6RY3.js → chunk-LRUXSAKS.js}

@@ -775,11 +775,10 @@ var BUSABASE_CLI_CLIENT_ID = "busabase-cli";
 
 // src/login.ts
 import { DEFAULT_BASE_URL, normalizeBaseUrl } from "busabase-sdk";
-var CLI_CLIENT_PLATFORM = "cli";
 var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
 var EXPIRES_AT_KEY = "BUSABASE_TOKEN_EXPIRES_AT";
-var LEGACY_SESSION_TOKEN_PREFIX = "bss_";
-var AUTO_REFRESH_THRESHOLD_MS = 2 * 24 * 60 * 60 * 1e3;
+var REFRESH_TOKEN_KEY = "BUSABASE_REFRESH_TOKEN";
+var AUTO_REFRESH_THRESHOLD_MS = 5 * 60 * 1e3;
 var DEFAULT_LOCAL_URL = "http://localhost:15419";
 var base64url = (buffer) => buffer.toString("base64url");
 var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -828,7 +827,7 @@ async function verifyAuth(baseUrl, token) {
   });
   if (res.status === 401) {
     throw new Error(
-      `The credential was rejected (401) by ${baseUrl}. If it's an API key, check it in Dashboard \u2192 Settings \u2192 API Keys; if it's a login session, run \`busabase-cli login\` again.`
+      `The credential was rejected (401) by ${baseUrl}. If it's an API key, check it in Dashboard \u2192 Settings \u2192 API Keys; if it's an OAuth login, run \`busabase-cli login\` again.`
     );
   }
   if (!res.ok) {
@@ -857,6 +856,7 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
         const error = url.searchParams.get("error");
         const returnedState = url.searchParams.get("state");
         const returnedCode = url.searchParams.get("code");
+        const returnedIssuer = url.searchParams.get("iss");
         if (error) {
           respond("Sign-in failed", "You can close this tab and return to the terminal.");
           cleanup();
@@ -869,6 +869,20 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
           reject(new Error("OAuth state mismatch \u2014 the callback did not match this request."));
           return;
         }
+        let issuerMatches = false;
+        try {
+          issuerMatches = Boolean(
+            returnedIssuer && new URL(returnedIssuer).origin === new URL(baseUrl).origin
+          );
+        } catch {
+          issuerMatches = false;
+        }
+        if (!issuerMatches) {
+          respond("Sign-in failed", "Authorization server mismatch. Close this tab and try again.");
+          cleanup();
+          reject(new Error("OAuth authorization server issuer mismatch."));
+          return;
+        }
         respond("Signed in \u2713", "You can close this tab and return to the terminal.");
         const address = server.address();
         cleanup();
@@ -892,7 +906,8 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
         const authorizeUrl = new URL(`${baseUrl}/api/oauth/authorize`);
         authorizeUrl.searchParams.set("response_type", "code");
         authorizeUrl.searchParams.set("client_id", BUSABASE_CLI_CLIENT_ID);
-        authorizeUrl.searchParams.set("client_platform", CLI_CLIENT_PLATFORM);
+        authorizeUrl.searchParams.set("resource", `${baseUrl}/api/v1`);
+        authorizeUrl.searchParams.set("scope", "api");
         authorizeUrl.searchParams.set("code_challenge", codeChallenge);
         authorizeUrl.searchParams.set("code_challenge_method", "S256");
         authorizeUrl.searchParams.set("redirect_uri", redirect);
@@ -913,15 +928,14 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
   );
   const tokenRes = await fetch(`${baseUrl}/api/oauth/token`, {
     method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
       grant_type: "authorization_code",
       client_id: BUSABASE_CLI_CLIENT_ID,
-      client_platform: CLI_CLIENT_PLATFORM,
       code,
       code_verifier: codeVerifier,
       redirect_uri: redirectUri,
-      state
+      resource: `${baseUrl}/api/v1`
     })
   });
   if (!tokenRes.ok) {
@@ -929,9 +943,13 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
     throw new Error(`Token exchange failed (HTTP ${tokenRes.status})${text ? `: ${text}` : ""}`);
   }
   const payload = await tokenRes.json();
-  const token = payload.apiKey ?? payload.token ?? payload.accessToken;
+  const token = payload.access_token;
   if (!token) throw new Error("Token exchange returned no credential.");
-  return payload.apiKey ? { token, apiKeyExpiresAt: payload.expiresAt ?? void 0 } : { token, expiresAt: payload.expiresAt ?? void 0 };
+  return {
+    token,
+    refreshToken: payload.refresh_token,
+    expiresAt: typeof payload.expires_in === "number" ? new Date(Date.now() + payload.expires_in * 1e3).toISOString() : void 0
+  };
 }
 var delay = (durationMs) => new Promise((resolve) => setTimeout(resolve, durationMs));
 async function readDeviceResponse(response) {
@@ -1036,15 +1054,26 @@ async function deviceLogin(baseUrl, useBrowser) {
   }
   throw new Error("The device code expired. Run `busabase-cli login` to request a new one.");
 }
-async function refreshToken(baseUrl, token) {
-  const res = await fetch(`${baseUrl}/api/oauth/refresh`, {
+async function refreshToken(baseUrl, refreshToken2) {
+  const res = await fetch(`${baseUrl}/api/oauth/token`, {
     method: "POST",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken2,
+      client_id: BUSABASE_CLI_CLIENT_ID,
+      resource: `${baseUrl}/api/v1`
+    })
   });
-  if (res.status === 401) throw new Error("SESSION_EXPIRED");
+  if (res.status === 400 || res.status === 401) throw new Error("SESSION_EXPIRED");
   if (!res.ok) throw new Error(`Refresh failed (HTTP ${res.status}) from ${baseUrl}.`);
   const payload = await res.json();
-  return { token: payload.token ?? payload.accessToken ?? token, expiresAt: payload.expiresAt };
+  if (!payload.access_token) throw new Error("Refresh response had no access token");
+  return {
+    token: payload.access_token,
+    refreshToken: payload.refresh_token,
+    expiresAt: typeof payload.expires_in === "number" ? new Date(Date.now() + payload.expires_in * 1e3).toISOString() : void 0
+  };
 }
 async function pickSpaceId(verify, preselected) {
   if (preselected) return preselected;
@@ -1144,6 +1173,7 @@ async function runLogin(options) {
   let token;
   let expiresAt;
   let apiKeyExpiresAt;
+  let refreshTokenValue;
   if (method === "device") {
     const result = await deviceLogin(baseUrl, options.browser);
     token = result.token;
@@ -1152,6 +1182,7 @@ async function runLogin(options) {
     const result = await loopbackOauthLogin(baseUrl, options.browser);
     token = result.token;
     expiresAt = result.expiresAt;
+    refreshTokenValue = result.refreshToken;
     apiKeyExpiresAt = result.apiKeyExpiresAt;
   } else {
     if (!apiKey) {
@@ -1169,14 +1200,15 @@ async function runLogin(options) {
     BUSABASE_API_KEY: token,
     BUSABASE_SPACE_ID: spaceId ?? null,
     // Clear any stale expiry when switching to an API key.
-    [EXPIRES_AT_KEY]: expiresAt ?? null
+    [EXPIRES_AT_KEY]: expiresAt ?? null,
+    [REFRESH_TOKEN_KEY]: refreshTokenValue ?? null
   });
   say("");
   say(`\u2713 Signed in and saved to ${dotEnvPath()}`);
   return {
     status: "signed in",
     method: method === "loopback-oauth" ? "oauth" : method,
-    credentialType: method === "device" ? "api_key" : expiresAt ? "session" : "api_key",
+    credentialType: method === "device" ? "api_key" : expiresAt ? "oauth" : "api_key",
     user: verify.user?.email ?? verify.user?.name ?? verify.user?.id ?? "(unknown)",
     space: spaceId ?? "(server default)",
     createdSpace: String(Boolean(verify.createdSpace)),
@@ -1191,29 +1223,34 @@ async function runRefresh(options) {
   const token = options.apiKey;
   if (!token) throw new Error("Not signed in \u2014 run `busabase-cli login` first.");
   const file = loadDotEnvFile();
-  const isSavedExpiringSession = file.BUSABASE_API_KEY === token && Boolean(file.BUSABASE_TOKEN_EXPIRES_AT);
-  if (!token.startsWith(LEGACY_SESSION_TOKEN_PREFIX) && !isSavedExpiringSession) {
+  const isSavedExpiringOAuthToken = file.BUSABASE_API_KEY === token && Boolean(file.BUSABASE_TOKEN_EXPIRES_AT);
+  if (!isSavedExpiringOAuthToken) {
     return {
       status: "nothing to refresh",
-      detail: "This credential is an API key and cannot be refreshed. Only OAuth sessions refresh."
+      detail: "This credential is an API key and cannot be refreshed. Only OAuth token sets refresh."
     };
   }
+  const savedRefreshToken = file[REFRESH_TOKEN_KEY];
+  if (!savedRefreshToken) throw new Error("OAuth refresh token is missing \u2014 sign in again.");
   let refreshed;
   try {
-    refreshed = await refreshToken(baseUrl, token);
+    refreshed = await refreshToken(baseUrl, savedRefreshToken);
   } catch (error) {
     if (error instanceof Error && error.message === "SESSION_EXPIRED") {
       throw new Error(
-        "Your login session has expired \u2014 run `busabase-cli login` to sign in again."
+        "Your OAuth authorization has expired \u2014 run `busabase-cli login` to sign in again."
       );
     }
     throw error;
   }
   writeDotEnvFile({
     BUSABASE_API_KEY: refreshed.token,
-    [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null
+    [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null,
+    [REFRESH_TOKEN_KEY]: refreshed.refreshToken ?? null
   });
-  say(`\u2713 Session refreshed${refreshed.expiresAt ? ` \u2014 valid until ${refreshed.expiresAt}` : ""}`);
+  say(
+    `\u2713 OAuth token refreshed${refreshed.expiresAt ? ` \u2014 valid until ${refreshed.expiresAt}` : ""}`
+  );
   return {
     status: "refreshed",
     expiresAt: refreshed.expiresAt ?? "(unknown)",
@@ -1221,22 +1258,26 @@ async function runRefresh(options) {
   };
 }
 async function maybeAutoRefresh(baseUrl, apiKey) {
-  if (!apiKey) return;
+  if (!apiKey) return void 0;
   const file = loadDotEnvFile();
-  if (file.BUSABASE_API_KEY !== apiKey) return;
+  if (file.BUSABASE_API_KEY !== apiKey) return void 0;
   const expiresRaw = file[EXPIRES_AT_KEY];
-  if (!expiresRaw) return;
+  if (!expiresRaw) return void 0;
   const expiresAt = Date.parse(expiresRaw);
-  if (Number.isNaN(expiresAt)) return;
-  if (expiresAt <= Date.now()) return;
-  if (expiresAt - Date.now() > AUTO_REFRESH_THRESHOLD_MS) return;
+  if (Number.isNaN(expiresAt)) return void 0;
+  if (expiresAt - Date.now() > AUTO_REFRESH_THRESHOLD_MS) return void 0;
   try {
-    const refreshed = await refreshToken(normalizeBaseUrl(baseUrl), apiKey);
+    const savedRefreshToken = file[REFRESH_TOKEN_KEY];
+    if (!savedRefreshToken) return void 0;
+    const refreshed = await refreshToken(normalizeBaseUrl(baseUrl), savedRefreshToken);
     writeDotEnvFile({
       BUSABASE_API_KEY: refreshed.token,
-      [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null
+      [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null,
+      [REFRESH_TOKEN_KEY]: refreshed.refreshToken ?? null
     });
+    return refreshed.token;
   } catch {
+    return void 0;
   }
 }
 function assertCredentialNotExpired(apiKey) {
@@ -1248,29 +1289,36 @@ function assertCredentialNotExpired(apiKey) {
   const expiresAt = Date.parse(expiresRaw);
   if (!Number.isNaN(expiresAt) && expiresAt <= Date.now()) {
     throw new Error(
-      "Your saved device login has expired. Run `busabase-cli login --device-code` to authorize this CLI again."
+      "Your saved OAuth login has expired. Run `busabase-cli login` to sign in again."
     );
   }
 }
 async function runLogout(options) {
   const baseUrl = normalizeBaseUrl(options.baseUrl);
   const token = options.apiKey;
-  let revoked = "no session to revoke";
+  let revoked = "no OAuth token to revoke";
   const file = loadDotEnvFile();
-  if (token && (token.startsWith(LEGACY_SESSION_TOKEN_PREFIX) || file.BUSABASE_API_KEY === token && file[EXPIRES_AT_KEY])) {
+  if (token && file.BUSABASE_API_KEY === token && file[EXPIRES_AT_KEY]) {
     try {
+      const tokenToRevoke = file[REFRESH_TOKEN_KEY] ?? token;
       const res = await fetch(`${baseUrl}/api/oauth/revoke`, {
         method: "POST",
-        headers: { authorization: `Bearer ${token}` }
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token: tokenToRevoke })
       });
-      revoked = res.ok ? "session revoked" : `revoke returned HTTP ${res.status}`;
+      revoked = res.ok ? "OAuth token family revoked" : `revoke returned HTTP ${res.status}`;
     } catch {
       revoked = "revoke request failed (cleared locally anyway)";
     }
   } else if (token) {
     revoked = "API key cleared locally (revoke it in the dashboard to disable it)";
   }
-  writeDotEnvFile({ BUSABASE_API_KEY: null, BUSABASE_SPACE_ID: null, [EXPIRES_AT_KEY]: null });
+  writeDotEnvFile({
+    BUSABASE_API_KEY: null,
+    BUSABASE_SPACE_ID: null,
+    [EXPIRES_AT_KEY]: null,
+    [REFRESH_TOKEN_KEY]: null
+  });
   say(`\u2713 Cleared the saved credential from ${dotEnvPath()}`);
   return { status: "signed out", detail: revoked, config: dotEnvPath() };
 }
@@ -1656,6 +1704,15 @@ var folderNodeType = {
   operations: []
 };
 
+// ../../packages/busabase-contract/src/domains/html/definition.ts
+var htmlNodeType = {
+  type: "html",
+  label: "HTML",
+  icon: "code-xml",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
 // ../../packages/busabase-contract/src/domains/skill/definition.ts
 var skillNodeType = makeFileTreeNodeType({
   type: "skill",
@@ -1666,6 +1723,24 @@ var skillNodeType = makeFileTreeNodeType({
   entryFile: "SKILL.md"
 });
 
+// ../../packages/busabase-contract/src/domains/whiteboard/definition.ts
+var whiteboardNodeType = {
+  type: "whiteboard",
+  label: "Whiteboard",
+  icon: "pen-tool",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
+// ../../packages/busabase-contract/src/domains/workflow/definition.ts
+var workflowNodeType = {
+  type: "workflow",
+  label: "Workflow",
+  icon: "workflow",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
 // ../../packages/busabase-contract/src/domains/registry.ts
 var GENERIC_NODE_OPERATIONS = [
   {
@@ -1693,7 +1768,10 @@ var BUILTIN_NODE_TYPES = [
   driveNodeType,
   airappNodeType,
   fileNodeType,
-  docNodeType
+  docNodeType,
+  whiteboardNodeType,
+  workflowNodeType,
+  htmlNodeType
 ];
 for (const definition of BUILTIN_NODE_TYPES) {
   registerNodeType(definition);
@@ -4477,9 +4555,10 @@ function runAction(state, handler) {
   return async (_opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
+    const refreshedToken = await maybeAutoRefresh(config.baseUrl, config.apiKey);
+    if (refreshedToken) config.apiKey = refreshedToken;
     state.config = config;
     assertCredentialNotExpired(config.apiKey);
-    await maybeAutoRefresh(config.baseUrl, config.apiKey);
     const client = createBusabaseClient(config);
     const result = await handler(client, opts, config);
     console.log(render(result, config.output));
@@ -4489,9 +4568,10 @@ function runArgAction(state, handler) {
   return async (arg, _opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
+    const refreshedToken = await maybeAutoRefresh(config.baseUrl, config.apiKey);
+    if (refreshedToken) config.apiKey = refreshedToken;
     state.config = config;
     assertCredentialNotExpired(config.apiKey);
-    await maybeAutoRefresh(config.baseUrl, config.apiKey);
     const client = createBusabaseClient(config);
     const result = await handler(arg, client, opts, config);
     console.log(render(result, config.output));
@@ -4564,7 +4644,7 @@ function registerGeneratedCommands(program, state) {
   const getGroup = (displayName, tag) => program.commands.find((c2) => c2.name() === displayName) ?? program.command(displayName).description(tag ?? `${displayName} endpoints`);
   const addLeaf = (parent, navPath, procKey, proc) => {
     const { route, inputSchema } = proc["~orpc"];
-    const name = kebab(procKey);
+    const name = [...navPath.slice(1), procKey].map(kebab).join("-");
     if (parent.commands.some((c2) => c2.name() === name)) return;
     const fields = inputFields(inputSchema);
     const leaf = parent.command(name).description(route.summary ?? `${route.method} ${route.path}`);
@@ -4622,7 +4702,6 @@ OpenAPI: ${route.method} ${route.path}`);
       const id = [...navPath, key].join(".");
       if (isProcedure(child)) {
         if (GENERATED_SKIP.has(id)) continue;
-        if (navPath.length > 1) continue;
         const parent = navPath.length ? getGroup(kebab(navPath[0]), child["~orpc"].route.tags?.[0]) : program;
         addLeaf(parent, navPath, key, child);
       } else if (child && typeof child === "object") {
@@ -4677,7 +4756,7 @@ function buildProgram(state = {}) {
     runAction(state, (_client, _opts, config) => rawFetch(config, "GET", "/api/v1/openapi.json"))
   );
   addGlobalFlags(program.command("whoami")).description("Active space, user, and membership").action(runAction(state, (client) => client.auth.verify()));
-  addGlobalFlags(program.command("login")).description("Connect the CLI to Busabase \u2014 Personal/local, Cloud, or self-hosted").option("--device-code", "force device authorization and skip the method prompt").option("--oauth", "legacy same-machine OAuth callback flow").option("--no-browser", "print the sign-in URL instead of opening a browser").option("--refresh", "slide the saved OAuth session forward (no browser, no re-login)").addHelpText(
+  addGlobalFlags(program.command("login")).description("Connect the CLI to Busabase \u2014 Personal/local, Cloud, or self-hosted").option("--device-code", "force device authorization and skip the method prompt").option("--oauth", "legacy same-machine OAuth callback flow").option("--no-browser", "print the sign-in URL instead of opening a browser").option("--refresh", "rotate the saved OAuth token set (no browser, no re-login)").addHelpText(
     "after",
     `
 Busabase is an approval-first database and knowledge base for AI agents: agents
@@ -4697,7 +4776,7 @@ The flags below skip the menu (handy for scripts / CI):
   busabase-cli login --oauth                           # legacy same-machine callback
   busabase-cli login --api-key sk_\u2026                    # Cloud API key (headless/CI)
   busabase-cli login --base-url http://localhost:15419 # connect to a local server (no auth)
-  busabase-cli login --refresh                         # extend the current session (auto-runs too)`
+  busabase-cli login --refresh                         # rotate the OAuth token set (auto-runs too)`
   ).action(async (_opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
@@ -4712,7 +4791,7 @@ The flags below skip the menu (handy for scripts / CI):
     });
     console.log(render(summary, config.output));
   });
-  addGlobalFlags(program.command("logout")).description("Revoke the saved OAuth session (if any) and clear ~/.busabase/.env").action(async (_opts, cmd) => {
+  addGlobalFlags(program.command("logout")).description("Revoke the saved OAuth token family (if any) and clear ~/.busabase/.env").action(async (_opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
     state.config = config;

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-DRYP6RY3.js";
+} from "./chunk-LRUXSAKS.js";
 
 // src/cli.ts
 process.exit(await runCli(process.argv.slice(2)));

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   HELP,
   render,
   runCli
-} from "./chunk-DRYP6RY3.js";
+} from "./chunk-LRUXSAKS.js";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busa-cli",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "description": "Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-cli",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@zip.js/zip.js": "^2.8.20",
     "busabase-package": "workspace:*",
-    "busabase-sdk": "0.9.12",
+    "busabase-sdk": "0.9.13",
     "commander": "^14.0.0",
     "tar-stream": "^3.1.7",
     "yaml": "^2.9.0",