busa-cli 0.9.12 → 0.9.14

package/dist/{chunk-DRYP6RY3.js → chunk-P4Z4SWET.js}

@@ -775,11 +775,10 @@ var BUSABASE_CLI_CLIENT_ID = "busabase-cli";
 
 // src/login.ts
 import { DEFAULT_BASE_URL, normalizeBaseUrl } from "busabase-sdk";
-var CLI_CLIENT_PLATFORM = "cli";
 var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
 var EXPIRES_AT_KEY = "BUSABASE_TOKEN_EXPIRES_AT";
-var LEGACY_SESSION_TOKEN_PREFIX = "bss_";
-var AUTO_REFRESH_THRESHOLD_MS = 2 * 24 * 60 * 60 * 1e3;
+var REFRESH_TOKEN_KEY = "BUSABASE_REFRESH_TOKEN";
+var AUTO_REFRESH_THRESHOLD_MS = 5 * 60 * 1e3;
 var DEFAULT_LOCAL_URL = "http://localhost:15419";
 var base64url = (buffer) => buffer.toString("base64url");
 var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -828,7 +827,7 @@ async function verifyAuth(baseUrl, token) {
   });
   if (res.status === 401) {
     throw new Error(
-      `The credential was rejected (401) by ${baseUrl}. If it's an API key, check it in Dashboard \u2192 Settings \u2192 API Keys; if it's a login session, run \`busabase-cli login\` again.`
+      `The credential was rejected (401) by ${baseUrl}. If it's an API key, check it in Dashboard \u2192 Settings \u2192 API Keys; if it's an OAuth login, run \`busabase-cli login\` again.`
     );
   }
   if (!res.ok) {
@@ -857,6 +856,7 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
         const error = url.searchParams.get("error");
         const returnedState = url.searchParams.get("state");
         const returnedCode = url.searchParams.get("code");
+        const returnedIssuer = url.searchParams.get("iss");
         if (error) {
           respond("Sign-in failed", "You can close this tab and return to the terminal.");
           cleanup();
@@ -869,6 +869,20 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
           reject(new Error("OAuth state mismatch \u2014 the callback did not match this request."));
           return;
         }
+        let issuerMatches = false;
+        try {
+          issuerMatches = Boolean(
+            returnedIssuer && new URL(returnedIssuer).origin === new URL(baseUrl).origin
+          );
+        } catch {
+          issuerMatches = false;
+        }
+        if (!issuerMatches) {
+          respond("Sign-in failed", "Authorization server mismatch. Close this tab and try again.");
+          cleanup();
+          reject(new Error("OAuth authorization server issuer mismatch."));
+          return;
+        }
         respond("Signed in \u2713", "You can close this tab and return to the terminal.");
         const address = server.address();
         cleanup();
@@ -892,7 +906,8 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
         const authorizeUrl = new URL(`${baseUrl}/api/oauth/authorize`);
         authorizeUrl.searchParams.set("response_type", "code");
         authorizeUrl.searchParams.set("client_id", BUSABASE_CLI_CLIENT_ID);
-        authorizeUrl.searchParams.set("client_platform", CLI_CLIENT_PLATFORM);
+        authorizeUrl.searchParams.set("resource", `${baseUrl}/api/v1`);
+        authorizeUrl.searchParams.set("scope", "api");
         authorizeUrl.searchParams.set("code_challenge", codeChallenge);
         authorizeUrl.searchParams.set("code_challenge_method", "S256");
         authorizeUrl.searchParams.set("redirect_uri", redirect);
@@ -913,15 +928,14 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
   );
   const tokenRes = await fetch(`${baseUrl}/api/oauth/token`, {
     method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
       grant_type: "authorization_code",
       client_id: BUSABASE_CLI_CLIENT_ID,
-      client_platform: CLI_CLIENT_PLATFORM,
       code,
       code_verifier: codeVerifier,
       redirect_uri: redirectUri,
-      state
+      resource: `${baseUrl}/api/v1`
     })
   });
   if (!tokenRes.ok) {
@@ -929,9 +943,13 @@ async function loopbackOauthLogin(baseUrl, useBrowser) {
     throw new Error(`Token exchange failed (HTTP ${tokenRes.status})${text ? `: ${text}` : ""}`);
   }
   const payload = await tokenRes.json();
-  const token = payload.apiKey ?? payload.token ?? payload.accessToken;
+  const token = payload.access_token;
   if (!token) throw new Error("Token exchange returned no credential.");
-  return payload.apiKey ? { token, apiKeyExpiresAt: payload.expiresAt ?? void 0 } : { token, expiresAt: payload.expiresAt ?? void 0 };
+  return {
+    token,
+    refreshToken: payload.refresh_token,
+    expiresAt: typeof payload.expires_in === "number" ? new Date(Date.now() + payload.expires_in * 1e3).toISOString() : void 0
+  };
 }
 var delay = (durationMs) => new Promise((resolve) => setTimeout(resolve, durationMs));
 async function readDeviceResponse(response) {
@@ -1036,15 +1054,26 @@ async function deviceLogin(baseUrl, useBrowser) {
   }
   throw new Error("The device code expired. Run `busabase-cli login` to request a new one.");
 }
-async function refreshToken(baseUrl, token) {
-  const res = await fetch(`${baseUrl}/api/oauth/refresh`, {
+async function refreshToken(baseUrl, refreshToken2) {
+  const res = await fetch(`${baseUrl}/api/oauth/token`, {
     method: "POST",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken2,
+      client_id: BUSABASE_CLI_CLIENT_ID,
+      resource: `${baseUrl}/api/v1`
+    })
   });
-  if (res.status === 401) throw new Error("SESSION_EXPIRED");
+  if (res.status === 400 || res.status === 401) throw new Error("SESSION_EXPIRED");
   if (!res.ok) throw new Error(`Refresh failed (HTTP ${res.status}) from ${baseUrl}.`);
   const payload = await res.json();
-  return { token: payload.token ?? payload.accessToken ?? token, expiresAt: payload.expiresAt };
+  if (!payload.access_token) throw new Error("Refresh response had no access token");
+  return {
+    token: payload.access_token,
+    refreshToken: payload.refresh_token,
+    expiresAt: typeof payload.expires_in === "number" ? new Date(Date.now() + payload.expires_in * 1e3).toISOString() : void 0
+  };
 }
 async function pickSpaceId(verify, preselected) {
   if (preselected) return preselected;
@@ -1144,6 +1173,7 @@ async function runLogin(options) {
   let token;
   let expiresAt;
   let apiKeyExpiresAt;
+  let refreshTokenValue;
   if (method === "device") {
     const result = await deviceLogin(baseUrl, options.browser);
     token = result.token;
@@ -1152,6 +1182,7 @@ async function runLogin(options) {
     const result = await loopbackOauthLogin(baseUrl, options.browser);
     token = result.token;
     expiresAt = result.expiresAt;
+    refreshTokenValue = result.refreshToken;
     apiKeyExpiresAt = result.apiKeyExpiresAt;
   } else {
     if (!apiKey) {
@@ -1169,14 +1200,15 @@ async function runLogin(options) {
     BUSABASE_API_KEY: token,
     BUSABASE_SPACE_ID: spaceId ?? null,
     // Clear any stale expiry when switching to an API key.
-    [EXPIRES_AT_KEY]: expiresAt ?? null
+    [EXPIRES_AT_KEY]: expiresAt ?? null,
+    [REFRESH_TOKEN_KEY]: refreshTokenValue ?? null
   });
   say("");
   say(`\u2713 Signed in and saved to ${dotEnvPath()}`);
   return {
     status: "signed in",
     method: method === "loopback-oauth" ? "oauth" : method,
-    credentialType: method === "device" ? "api_key" : expiresAt ? "session" : "api_key",
+    credentialType: method === "device" ? "api_key" : expiresAt ? "oauth" : "api_key",
     user: verify.user?.email ?? verify.user?.name ?? verify.user?.id ?? "(unknown)",
     space: spaceId ?? "(server default)",
     createdSpace: String(Boolean(verify.createdSpace)),
@@ -1191,29 +1223,34 @@ async function runRefresh(options) {
   const token = options.apiKey;
   if (!token) throw new Error("Not signed in \u2014 run `busabase-cli login` first.");
   const file = loadDotEnvFile();
-  const isSavedExpiringSession = file.BUSABASE_API_KEY === token && Boolean(file.BUSABASE_TOKEN_EXPIRES_AT);
-  if (!token.startsWith(LEGACY_SESSION_TOKEN_PREFIX) && !isSavedExpiringSession) {
+  const isSavedExpiringOAuthToken = file.BUSABASE_API_KEY === token && Boolean(file.BUSABASE_TOKEN_EXPIRES_AT);
+  if (!isSavedExpiringOAuthToken) {
     return {
       status: "nothing to refresh",
-      detail: "This credential is an API key and cannot be refreshed. Only OAuth sessions refresh."
+      detail: "This credential is an API key and cannot be refreshed. Only OAuth token sets refresh."
     };
   }
+  const savedRefreshToken = file[REFRESH_TOKEN_KEY];
+  if (!savedRefreshToken) throw new Error("OAuth refresh token is missing \u2014 sign in again.");
   let refreshed;
   try {
-    refreshed = await refreshToken(baseUrl, token);
+    refreshed = await refreshToken(baseUrl, savedRefreshToken);
   } catch (error) {
     if (error instanceof Error && error.message === "SESSION_EXPIRED") {
       throw new Error(
-        "Your login session has expired \u2014 run `busabase-cli login` to sign in again."
+        "Your OAuth authorization has expired \u2014 run `busabase-cli login` to sign in again."
       );
     }
     throw error;
   }
   writeDotEnvFile({
     BUSABASE_API_KEY: refreshed.token,
-    [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null
+    [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null,
+    [REFRESH_TOKEN_KEY]: refreshed.refreshToken ?? null
   });
-  say(`\u2713 Session refreshed${refreshed.expiresAt ? ` \u2014 valid until ${refreshed.expiresAt}` : ""}`);
+  say(
+    `\u2713 OAuth token refreshed${refreshed.expiresAt ? ` \u2014 valid until ${refreshed.expiresAt}` : ""}`
+  );
   return {
     status: "refreshed",
     expiresAt: refreshed.expiresAt ?? "(unknown)",
@@ -1221,22 +1258,26 @@ async function runRefresh(options) {
   };
 }
 async function maybeAutoRefresh(baseUrl, apiKey) {
-  if (!apiKey) return;
+  if (!apiKey) return void 0;
   const file = loadDotEnvFile();
-  if (file.BUSABASE_API_KEY !== apiKey) return;
+  if (file.BUSABASE_API_KEY !== apiKey) return void 0;
   const expiresRaw = file[EXPIRES_AT_KEY];
-  if (!expiresRaw) return;
+  if (!expiresRaw) return void 0;
   const expiresAt = Date.parse(expiresRaw);
-  if (Number.isNaN(expiresAt)) return;
-  if (expiresAt <= Date.now()) return;
-  if (expiresAt - Date.now() > AUTO_REFRESH_THRESHOLD_MS) return;
+  if (Number.isNaN(expiresAt)) return void 0;
+  if (expiresAt - Date.now() > AUTO_REFRESH_THRESHOLD_MS) return void 0;
   try {
-    const refreshed = await refreshToken(normalizeBaseUrl(baseUrl), apiKey);
+    const savedRefreshToken = file[REFRESH_TOKEN_KEY];
+    if (!savedRefreshToken) return void 0;
+    const refreshed = await refreshToken(normalizeBaseUrl(baseUrl), savedRefreshToken);
     writeDotEnvFile({
       BUSABASE_API_KEY: refreshed.token,
-      [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null
+      [EXPIRES_AT_KEY]: refreshed.expiresAt ?? null,
+      [REFRESH_TOKEN_KEY]: refreshed.refreshToken ?? null
     });
+    return refreshed.token;
   } catch {
+    return void 0;
   }
 }
 function assertCredentialNotExpired(apiKey) {
@@ -1248,29 +1289,36 @@ function assertCredentialNotExpired(apiKey) {
   const expiresAt = Date.parse(expiresRaw);
   if (!Number.isNaN(expiresAt) && expiresAt <= Date.now()) {
     throw new Error(
-      "Your saved device login has expired. Run `busabase-cli login --device-code` to authorize this CLI again."
+      "Your saved OAuth login has expired. Run `busabase-cli login` to sign in again."
     );
   }
 }
 async function runLogout(options) {
   const baseUrl = normalizeBaseUrl(options.baseUrl);
   const token = options.apiKey;
-  let revoked = "no session to revoke";
+  let revoked = "no OAuth token to revoke";
   const file = loadDotEnvFile();
-  if (token && (token.startsWith(LEGACY_SESSION_TOKEN_PREFIX) || file.BUSABASE_API_KEY === token && file[EXPIRES_AT_KEY])) {
+  if (token && file.BUSABASE_API_KEY === token && file[EXPIRES_AT_KEY]) {
     try {
+      const tokenToRevoke = file[REFRESH_TOKEN_KEY] ?? token;
       const res = await fetch(`${baseUrl}/api/oauth/revoke`, {
         method: "POST",
-        headers: { authorization: `Bearer ${token}` }
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token: tokenToRevoke })
       });
-      revoked = res.ok ? "session revoked" : `revoke returned HTTP ${res.status}`;
+      revoked = res.ok ? "OAuth token family revoked" : `revoke returned HTTP ${res.status}`;
     } catch {
       revoked = "revoke request failed (cleared locally anyway)";
     }
   } else if (token) {
     revoked = "API key cleared locally (revoke it in the dashboard to disable it)";
   }
-  writeDotEnvFile({ BUSABASE_API_KEY: null, BUSABASE_SPACE_ID: null, [EXPIRES_AT_KEY]: null });
+  writeDotEnvFile({
+    BUSABASE_API_KEY: null,
+    BUSABASE_SPACE_ID: null,
+    [EXPIRES_AT_KEY]: null,
+    [REFRESH_TOKEN_KEY]: null
+  });
   say(`\u2713 Cleared the saved credential from ${dotEnvPath()}`);
   return { status: "signed out", detail: revoked, config: dotEnvPath() };
 }
@@ -1416,11 +1464,11 @@ var createBaseInputSchema = z5.object({
       options: fieldOptionsSchema.optional().default({})
     })
   ).default([]),
-  // Review-first by default: without `autoMerge: true`, this proposes the Base
-  // as a pending ChangeRequest (status "in_review") instead of creating it
-  // immediately. Pass `autoMerge: true` only for callers that don't need human
-  // review (seed/migration scripts, an explicit no-review agent task).
-  autoMerge: z5.boolean().optional().default(false)
+  // Permission-aware default: omitted merges immediately if the actor has
+  // write access on the parent node, otherwise falls back to a pending
+  // ChangeRequest (status "in_review"). Pass explicit `autoMerge: false` to
+  // force review even with write access.
+  autoMerge: z5.boolean().optional()
 });
 var createBaseFieldInputSchema = z5.object({
   name: fieldNameSchema,
@@ -1656,6 +1704,15 @@ var folderNodeType = {
   operations: []
 };
 
+// ../../packages/busabase-contract/src/domains/html/definition.ts
+var htmlNodeType = {
+  type: "html",
+  label: "HTML",
+  icon: "code-xml",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
 // ../../packages/busabase-contract/src/domains/skill/definition.ts
 var skillNodeType = makeFileTreeNodeType({
   type: "skill",
@@ -1666,6 +1723,24 @@ var skillNodeType = makeFileTreeNodeType({
   entryFile: "SKILL.md"
 });
 
+// ../../packages/busabase-contract/src/domains/whiteboard/definition.ts
+var whiteboardNodeType = {
+  type: "whiteboard",
+  label: "Whiteboard",
+  icon: "pen-tool",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
+// ../../packages/busabase-contract/src/domains/workflow/definition.ts
+var workflowNodeType = {
+  type: "workflow",
+  label: "Workflow",
+  icon: "workflow",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
 // ../../packages/busabase-contract/src/domains/registry.ts
 var GENERIC_NODE_OPERATIONS = [
   {
@@ -1693,7 +1768,10 @@ var BUILTIN_NODE_TYPES = [
   driveNodeType,
   airappNodeType,
   fileNodeType,
-  docNodeType
+  docNodeType,
+  whiteboardNodeType,
+  workflowNodeType,
+  htmlNodeType
 ];
 for (const definition of BUILTIN_NODE_TYPES) {
   registerNodeType(definition);
@@ -2038,8 +2116,8 @@ var createNodeChangeRequestInputSchema = z6.object({
     'Explanation shown to the human reviewer. Write a conventional-commit style subject \u2014 imperative verb + what + why, e.g. "Reorganize marketing docs under a Campaigns folder".'
   ),
   submittedBy: z6.string().optional().default("local-producer"),
-  autoMerge: z6.boolean().optional().default(false).describe(
-    "Whether to approve and merge this structural node change immediately. Defaults to false so node Change Request creation is review-first unless explicitly requested."
+  autoMerge: z6.boolean().optional().describe(
+    "Whether to approve and merge this structural node change immediately. Omitted defaults to merging immediately if the actor has write access on every target node, otherwise falling back to a pending Change Request; pass explicit false to force review even with write access."
   ),
   operations: z6.array(nodeOperationInputSchema).min(1)
 });
@@ -4477,9 +4555,10 @@ function runAction(state, handler) {
   return async (_opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
+    const refreshedToken = await maybeAutoRefresh(config.baseUrl, config.apiKey);
+    if (refreshedToken) config.apiKey = refreshedToken;
     state.config = config;
     assertCredentialNotExpired(config.apiKey);
-    await maybeAutoRefresh(config.baseUrl, config.apiKey);
     const client = createBusabaseClient(config);
     const result = await handler(client, opts, config);
     console.log(render(result, config.output));
@@ -4489,9 +4568,10 @@ function runArgAction(state, handler) {
   return async (arg, _opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
+    const refreshedToken = await maybeAutoRefresh(config.baseUrl, config.apiKey);
+    if (refreshedToken) config.apiKey = refreshedToken;
     state.config = config;
     assertCredentialNotExpired(config.apiKey);
-    await maybeAutoRefresh(config.baseUrl, config.apiKey);
     const client = createBusabaseClient(config);
     const result = await handler(arg, client, opts, config);
     console.log(render(result, config.output));
@@ -4564,7 +4644,7 @@ function registerGeneratedCommands(program, state) {
   const getGroup = (displayName, tag) => program.commands.find((c2) => c2.name() === displayName) ?? program.command(displayName).description(tag ?? `${displayName} endpoints`);
   const addLeaf = (parent, navPath, procKey, proc) => {
     const { route, inputSchema } = proc["~orpc"];
-    const name = kebab(procKey);
+    const name = [...navPath.slice(1), procKey].map(kebab).join("-");
     if (parent.commands.some((c2) => c2.name() === name)) return;
     const fields = inputFields(inputSchema);
     const leaf = parent.command(name).description(route.summary ?? `${route.method} ${route.path}`);
@@ -4622,7 +4702,6 @@ OpenAPI: ${route.method} ${route.path}`);
       const id = [...navPath, key].join(".");
       if (isProcedure(child)) {
         if (GENERATED_SKIP.has(id)) continue;
-        if (navPath.length > 1) continue;
         const parent = navPath.length ? getGroup(kebab(navPath[0]), child["~orpc"].route.tags?.[0]) : program;
         addLeaf(parent, navPath, key, child);
       } else if (child && typeof child === "object") {
@@ -4677,7 +4756,7 @@ function buildProgram(state = {}) {
     runAction(state, (_client, _opts, config) => rawFetch(config, "GET", "/api/v1/openapi.json"))
   );
   addGlobalFlags(program.command("whoami")).description("Active space, user, and membership").action(runAction(state, (client) => client.auth.verify()));
-  addGlobalFlags(program.command("login")).description("Connect the CLI to Busabase \u2014 Personal/local, Cloud, or self-hosted").option("--device-code", "force device authorization and skip the method prompt").option("--oauth", "legacy same-machine OAuth callback flow").option("--no-browser", "print the sign-in URL instead of opening a browser").option("--refresh", "slide the saved OAuth session forward (no browser, no re-login)").addHelpText(
+  addGlobalFlags(program.command("login")).description("Connect the CLI to Busabase \u2014 Personal/local, Cloud, or self-hosted").option("--device-code", "force device authorization and skip the method prompt").option("--oauth", "legacy same-machine OAuth callback flow").option("--no-browser", "print the sign-in URL instead of opening a browser").option("--refresh", "rotate the saved OAuth token set (no browser, no re-login)").addHelpText(
     "after",
     `
 Busabase is an approval-first database and knowledge base for AI agents: agents
@@ -4697,7 +4776,7 @@ The flags below skip the menu (handy for scripts / CI):
   busabase-cli login --oauth                           # legacy same-machine callback
   busabase-cli login --api-key sk_\u2026                    # Cloud API key (headless/CI)
   busabase-cli login --base-url http://localhost:15419 # connect to a local server (no auth)
-  busabase-cli login --refresh                         # extend the current session (auto-runs too)`
+  busabase-cli login --refresh                         # rotate the OAuth token set (auto-runs too)`
   ).action(async (_opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
@@ -4712,7 +4791,7 @@ The flags below skip the menu (handy for scripts / CI):
     });
     console.log(render(summary, config.output));
   });
-  addGlobalFlags(program.command("logout")).description("Revoke the saved OAuth session (if any) and clear ~/.busabase/.env").action(async (_opts, cmd) => {
+  addGlobalFlags(program.command("logout")).description("Revoke the saved OAuth token family (if any) and clear ~/.busabase/.env").action(async (_opts, cmd) => {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
     state.config = config;
@@ -4723,14 +4802,21 @@ The flags below skip the menu (handy for scripts / CI):
   addGlobalFlags(nodes.command("list")).description("Workspace node tree").action(runAction(state, (client) => client.nodes.list()));
   addGlobalFlags(nodes.command("create-change-request")).description("Propose a new node via a Change Request").addOption(
     new Option(`--type <${CREATABLE_NODE_TYPES2.join("|")}>`, "node type").choices(CREATABLE_NODE_TYPES2).makeOptionMandatory()
-  ).requiredOption("--slug <slug>", "node slug").requiredOption("--name <name>", "node name").option("--description <text>", "optional node description").option("--parent-node-id <id>", "parent folder node id; omit for root").option("--message <text>", "reviewer-facing Change Request message").option("--submitted-by <name>", "producer label").option("--field <slug:name:type...>", "base field, repeatable (for --type base)").option("--fields-json <json|@file>", "base fields as JSON array (for --type base)").option("--asset-id <id>", "backing Asset id (required for --type file)").addHelpText(
+  ).requiredOption("--slug <slug>", "node slug").requiredOption("--name <name>", "node name").option("--description <text>", "optional node description").option("--parent-node-id <id>", "parent folder node id; omit for root").option("--message <text>", "reviewer-facing Change Request message").option("--submitted-by <name>", "producer label").option("--field <slug:name:type...>", "base field, repeatable (for --type base)").option("--fields-json <json|@file>", "base fields as JSON array (for --type base)").option("--asset-id <id>", "backing Asset id (required for --type file)").option(
+    "--auto-merge",
+    "skip review and create the node immediately if you have write access (default: merge immediately if you have write access, otherwise propose a pending Change Request)"
+  ).option(
+    "--require-review",
+    "always propose a pending Change Request, even if you have write access"
+  ).addHelpText(
     "after",
     `
 Examples:
   busabase-cli nodes create-change-request --type folder --slug cms --name "\u5185\u5BB9\u7BA1\u7406 CMS"
   busabase-cli nodes create-change-request --type base --slug blog --name "\u535A\u5BA2\u6587\u7AE0 Blog Posts" --field title:Title:text --field body:Body:markdown
   busabase-cli nodes create-change-request --type base --slug products --name "\u4EA7\u54C1\u76EE\u5F55 Products" --fields-json @fields.json
-  busabase-cli nodes create-change-request --type file --slug board-plan --name "Board Plan" --asset-id ast_123`
+  busabase-cli nodes create-change-request --type file --slug board-plan --name "Board Plan" --asset-id ast_123
+  busabase-cli nodes create-change-request --type folder --slug cms --name "\u5185\u5BB9\u7BA1\u7406 CMS" --require-review   # always propose a Change Request`
   ).action(
     runAction(state, (client, opts) => {
       const nodeType = opts.type;
@@ -4744,6 +4830,7 @@ Examples:
       return client.nodes.createChangeRequest({
         message: opts.message ?? `Create ${nodeType} ${name}`,
         submittedBy: opts.submittedBy,
+        ...opts.requireReview ? { autoMerge: false } : opts.autoMerge ? { autoMerge: true } : {},
         operations: [
           {
             kind: "create",
@@ -4823,14 +4910,18 @@ Examples:
   );
   addGlobalFlags(bases.command("create")).description("Create a Base \u2014 review-first by default: returns a pending Change Request").requiredOption("--slug <slug>", "Base slug").requiredOption("--name <name>", "Base name").option("--field <slug:name:type...>", "field definition, repeatable").option("--fields-json <json|@file>", "field definitions as JSON array").option("--description <text>", "optional description").option("--parent-node-id <id>", "parent folder node id; omit for root").option(
     "--auto-merge",
-    "skip review and create the Base immediately (default: propose a pending Change Request)"
+    "skip review and create the Base immediately if you have write access (default: merge immediately if you have write access, otherwise propose a pending Change Request)"
+  ).option(
+    "--require-review",
+    "always propose a pending Change Request, even if you have write access"
   ).addHelpText(
     "after",
     `
 Examples:
   busabase-cli bases create --slug products --name "\u4EA7\u54C1\u76EE\u5F55 Products" --field product_name:"Product Name":text
   busabase-cli bases create --slug products --name "\u4EA7\u54C1\u76EE\u5F55 Products" --fields-json @fields.json
-  busabase-cli bases create --slug products --name "Products" --auto-merge   # skip review, create immediately`
+  busabase-cli bases create --slug products --name "Products" --auto-merge   # skip review, create immediately
+  busabase-cli bases create --slug products --name "Products" --require-review   # always propose a Change Request`
   ).action(
     runAction(
       state,
@@ -4840,7 +4931,7 @@ Examples:
         description: opts.description,
         parentNodeId: opts.parentNodeId,
         fields: parseFieldDefinitions(opts),
-        ...opts.autoMerge ? { autoMerge: true } : {}
+        ...opts.requireReview ? { autoMerge: false } : opts.autoMerge ? { autoMerge: true } : {}
       })
     )
   );
@@ -4897,14 +4988,18 @@ Examples:
   );
   addGlobalFlags(bases.command("create-change-request")).description("Propose a new record via a Change Request \u2014 review-first by default").requiredOption("--base-id <id>", "target Base id").requiredOption("--fields-json <json|@file>", "record fields as JSON, or @file.json").option("--message <text>", "reviewer-facing Change Request message").option("--submitted-by <name>", "producer label").option(
     "--auto-merge",
-    "skip review and create the record immediately (default: propose a pending Change Request)"
+    "skip review and create the record immediately if you have write access (default: merge immediately if you have write access, otherwise propose a pending Change Request)"
+  ).option(
+    "--require-review",
+    "always propose a pending Change Request, even if you have write access"
   ).addHelpText(
     "after",
     `
 Examples:
   busabase-cli bases create-change-request --base-id bse_123 --fields-json '{"title":"Hello","status":"draft"}'
   busabase-cli bases create-change-request --base-id bse_123 --fields-json @record.json
-  busabase-cli bases create-change-request --base-id bse_123 --fields-json '{"title":"Hello"}' --auto-merge   # skip review, create immediately`
+  busabase-cli bases create-change-request --base-id bse_123 --fields-json '{"title":"Hello"}' --auto-merge   # skip review, create immediately
+  busabase-cli bases create-change-request --base-id bse_123 --fields-json '{"title":"Hello"}' --require-review   # always propose a Change Request`
   ).action(
     runAction(
       state,
@@ -4913,7 +5008,7 @@ Examples:
         fields: parseJsonValue(opts.fieldsJson, "fields-json"),
         message: opts.message,
         submittedBy: opts.submittedBy,
-        ...opts.autoMerge ? { autoMerge: true } : {}
+        ...opts.requireReview ? { autoMerge: false } : opts.autoMerge ? { autoMerge: true } : {}
       })
     )
   );
@@ -4937,7 +5032,10 @@ Examples:
     ).choices(["merge", "replace"])
   ).option(
     "--auto-merge",
-    "skip review and create the AirApp immediately (default: propose a pending Change Request)"
+    "skip review and create the AirApp immediately if you have write access (default: merge immediately if you have write access, otherwise propose a pending Change Request)"
+  ).option(
+    "--require-review",
+    "always propose a pending Change Request, even if you have write access"
   ).addHelpText(
     "after",
     `
@@ -4954,7 +5052,8 @@ mergeMode explains how --files-json combines with the AirApp's default scaffold:
 Examples:
   busabase-cli airapps create --slug hello-app --name "Hello App" --files-json @files.json
   busabase-cli airapps create --slug vite-app --name "Vite App" --files-json @files.json --merge-mode replace
-  busabase-cli airapps create --slug hello-app --name "Hello App" --files-json @files.json --auto-merge   # skip review, create immediately`
+  busabase-cli airapps create --slug hello-app --name "Hello App" --files-json @files.json --auto-merge   # skip review, create immediately
+  busabase-cli airapps create --slug hello-app --name "Hello App" --files-json @files.json --require-review   # always propose a Change Request`
   ).action(
     runAction(
       state,
@@ -4967,7 +5066,7 @@ Examples:
         version: opts.version,
         files: opts.filesJson ? parseJsonValue(opts.filesJson, "files-json") : void 0,
         mergeMode: opts.mergeMode,
-        ...opts.autoMerge ? { autoMerge: true } : {}
+        ...opts.requireReview ? { autoMerge: false } : opts.autoMerge ? { autoMerge: true } : {}
       })
     )
   );

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-DRYP6RY3.js";
+} from "./chunk-P4Z4SWET.js";
 
 // src/cli.ts
 process.exit(await runCli(process.argv.slice(2)));

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   HELP,
   render,
   runCli
-} from "./chunk-DRYP6RY3.js";
+} from "./chunk-P4Z4SWET.js";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busa-cli",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-cli",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@zip.js/zip.js": "^2.8.20",
     "busabase-package": "workspace:*",
-    "busabase-sdk": "0.9.12",
+    "busabase-sdk": "0.9.14",
     "commander": "^14.0.0",
     "tar-stream": "^3.1.7",
     "yaml": "^2.9.0",