busabase-sdk 0.16.1 → 0.17.0

package/dist/index.js

@@ -557,7 +557,13 @@ var htmlNodeType = {
   label: "HTML",
   icon: "code-xml",
   capabilities: { hasDetail: true, creatable: true },
-  operations: []
+  operations: [
+    {
+      kind: "html_document_update",
+      label: "Update HTML",
+      tone: "border-blue-200 bg-blue-50 text-blue-800"
+    }
+  ]
 };
 
 // ../../packages/busabase-contract/src/domains/skill/definition.ts
@@ -572,7 +578,13 @@ var whiteboardNodeType = {
   label: "Whiteboard",
   icon: "pen-tool",
   capabilities: { hasDetail: true, creatable: true },
-  operations: []
+  operations: [
+    {
+      kind: "whiteboard_document_update",
+      label: "Update whiteboard",
+      tone: "border-blue-200 bg-blue-50 text-blue-800"
+    }
+  ]
 };
 
 // ../../packages/busabase-contract/src/domains/workflow/definition.ts
@@ -581,7 +593,13 @@ var workflowNodeType = {
   label: "Workflow",
   icon: "workflow",
   capabilities: { hasDetail: true, creatable: true },
-  operations: []
+  operations: [
+    {
+      kind: "workflow_document_update",
+      label: "Update workflow",
+      tone: "border-blue-200 bg-blue-50 text-blue-800"
+    }
+  ]
 };
 
 // ../../packages/busabase-contract/src/domains/registry.ts
@@ -650,12 +668,8 @@ var nodeSchema = z.lazy(
     slug: z.string(),
     name: z.string(),
     description: z.string(),
-    metadata: z.object({
-      entryFile: z.string().optional(),
-      visibility: z.enum(["private", "workspace", "public"]).optional(),
-      version: z.string().optional(),
-      assetId: z.string().optional()
-    }).catchall(z.unknown()).default({}),
+    metadata: z.object({ version: z.string().optional() }).catchall(z.unknown()).default({}),
+    explicitVisibility: z.enum(["private", "workspace", "public"]).nullable().default(null),
     position: z.number(),
     createdAt: z.string(),
     updatedAt: z.string(),
@@ -762,7 +776,17 @@ var commitSchema = z.object({
   nodeId: z.string().nullable(),
   operationId: z.string().nullable(),
   parentCommitId: z.string().nullable(),
-  fields: z.record(z.string(), z.unknown()),
+  // Deliberately loose (`z.record`), NOT a discriminated union keyed on `operation`.
+  //
+  // Do not "tighten" this. Commits already in the database were written before
+  // per-operation payload validation existed, so their shapes carry no guarantee.
+  // The write path (`insertCommit`) and the merge path (`parseCommitPayload`) are
+  // strict precisely because they only ever touch freshly-written payloads; this VO
+  // is also used to render *history* and approval detail pages, which read arbitrarily
+  // old commits. Making it strict would turn any legacy-shaped row into a 500 on a
+  // read-only screen. This is not a compatibility shim — it is the requirement not to
+  // break reading data that already exists.
+  payload: z.record(z.string(), z.unknown()),
   operation: z.enum(OPERATION_KINDS),
   message: z.string(),
   author: z.string(),
@@ -1333,6 +1357,14 @@ var airAppRunLocalNodeInputSchema = z.object({
   /** Text files to mount into the sandbox workdir before installing, keyed by
    *  path (same shape `RunPanel` already assembles for `NodepodRunner.mount`). */
   files: z.record(z.string(), z.string()),
+  /** Binary (asset-backed) files — images, fonts, sample data — keyed by the
+   *  same path, base64-encoded because this input crosses a JSON boundary that
+   *  `Uint8Array` cannot. Separate from `files` rather than a tagged union so
+   *  an older client that sends only `files` keeps working unchanged.
+   *
+   *  The in-browser Nodepod engine never uses this field: it hands raw bytes to
+   *  `Nodepod.boot({ files })` directly and skips the base64 round trip. */
+  binaryFiles: z.record(z.string(), z.string()).optional().default({}),
   /** Server-side execution mode. `"local-node"` spawns a bare host Node.js
    *  process (previewable, data bridge via reverse proxy, NOT OS-isolated);
    *  `"srt"` wraps the same commands in the OS sandbox (isolated execution,
@@ -2167,21 +2199,6 @@ var createDocInputSchema = z.object({
   // force review even with write access.
   autoMerge: z.boolean().optional()
 });
-var updateDocInputSchema = z.object({
-  body: z.string()
-});
-var createDocChangeRequestInputSchema = z.object({
-  body: z.string(),
-  message: z.string().optional().default("Update doc").describe(
-    'Explanation shown to the human reviewer. Write a conventional-commit style subject \u2014 imperative verb + what + why, e.g. "Add rollback steps to the deploy runbook".'
-  ),
-  submittedBy: z.string().optional().default("local-producer"),
-  // A Doc body update is the Doc-domain twin of a record `update`, which has taken
-  // the permission-aware default since #5712 — and this node type already has a
-  // direct-write bypass (`PUT /docs/{nodeId}/body`), so review-first here was never
-  // an actual guarantee, just a slower path to the same place.
-  autoMerge: z.boolean().optional()
-});
 var docContract = {
   create: oc.route({
     method: "POST",
@@ -2201,21 +2218,7 @@ var docContract = {
     tags: ["Docs"],
     summary: "Read an exact line range from a Doc body",
     successDescription: "Lines [startLine, endLine] (range capped at 2000 lines / ~2MB response) sliced from the Doc's full body \u2014 Docs are KB-scale, so the whole body is read in memory; no byte-range/checkpoint machinery like assets.readTextLines uses for potentially multi-GB files. The Doc-domain follow-up to a Unified Grep match with `source: \"docs\"`, so an agent can read just the lines around a match instead of `nodes.get`'s entire body."
-  }).input(ReadDocLinesInputSchema).output(ReadLinesVOSchema),
-  updateBody: oc.route({
-    method: "PUT",
-    path: "/docs/{nodeId}/body",
-    tags: ["Docs"],
-    summary: "Update Doc body",
-    successDescription: "Updated the Doc body."
-  }).input(updateDocInputSchema.extend({ nodeId: z.string() })).output(docSchema),
-  createChangeRequest: oc.route({
-    method: "POST",
-    path: "/docs/{nodeId}/change-requests",
-    tags: ["Docs", "Change Requests"],
-    summary: "Create Doc change request",
-    successDescription: "Created a change request that proposes a new Doc body."
-  }).input(createDocChangeRequestInputSchema.extend({ nodeId: z.string() })).output(changeRequestSchema)
+  }).input(ReadDocLinesInputSchema).output(ReadLinesVOSchema)
 };
 var DumpTableSchema = z.enum([
   "nodes",
@@ -3039,6 +3042,125 @@ var UnifiedGrepResultVOSchema = z.object({
   /** True when any source truncated, or any source has `notReached > 0`. */
   truncated: z.boolean()
 });
+var positionSchema = z.object({
+  x: z.number().finite(),
+  y: z.number().finite()
+});
+var WhiteboardDocumentSchema = z.object({
+  version: z.literal(1),
+  elements: z.array(z.unknown()).default([]),
+  appState: z.record(z.string(), z.unknown()).default({})
+});
+var workflowNodeBase = {
+  id: z.string().min(1),
+  position: positionSchema,
+  label: z.string().min(1).max(120),
+  description: z.string().max(500).default("")
+};
+var WorkflowNodeSchema = z.discriminatedUnion("kind", [
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("trigger"),
+    eventName: z.string().max(160).default("manual")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("webhook"),
+    method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).default("POST"),
+    url: z.string().max(2e3).default("")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("function"),
+    webhookRuleId: z.string().max(160).default(""),
+    functionName: z.string().max(160).default("")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("condition"),
+    expression: z.string().max(2e3).default("")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("wait"),
+    duration: z.number().int().min(0).max(525600).default(1),
+    unit: z.enum(["minutes", "hours", "days"]).default("hours")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("approval"),
+    approver: z.string().max(160).default("")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("action"),
+    actionName: z.string().max(160).default("")
+  }),
+  z.object({
+    ...workflowNodeBase,
+    kind: z.literal("end"),
+    outcome: z.string().max(160).default("completed")
+  })
+]);
+var GraphEdgeSchema = z.object({
+  id: z.string().min(1),
+  source: z.string().min(1),
+  target: z.string().min(1)
+});
+var WorkflowEdgeSchema = GraphEdgeSchema.extend({
+  label: z.string().max(120).default(""),
+  outcome: z.string().max(120).default("default")
+});
+var WorkflowSettingsSchema = z.object({
+  executionMode: z.enum(["manual", "event"]).default("manual"),
+  concurrency: z.number().int().min(1).max(50).default(1),
+  timeoutMs: z.number().int().min(1e3).max(3e5).default(3e4),
+  errorPolicy: z.enum(["stop", "continue"]).default("stop")
+});
+var WorkflowDocumentSchema = z.object({
+  version: z.literal(2),
+  nodes: z.array(WorkflowNodeSchema).default([]),
+  edges: z.array(WorkflowEdgeSchema).default([]),
+  settings: WorkflowSettingsSchema.default({
+    executionMode: "manual",
+    concurrency: 1,
+    timeoutMs: 3e4,
+    errorPolicy: "stop"
+  })
+});
+var HtmlDocumentSchema = z.object({
+  version: z.literal(1),
+  source: z.string().max(5e5)
+});
+
+// ../../packages/busabase-contract/src/contract/node-content-schemas.ts
+var NODE_CONTENT_VARIANTS = {
+  doc: z.object({ kind: z.literal("doc"), body: z.string() }),
+  whiteboard: z.object({ kind: z.literal("whiteboard"), document: WhiteboardDocumentSchema }),
+  workflow: z.object({ kind: z.literal("workflow"), document: WorkflowDocumentSchema }),
+  html: z.object({ kind: z.literal("html"), document: HtmlDocumentSchema })
+};
+var nodeContentInputSchema = z.discriminatedUnion("kind", [
+  NODE_CONTENT_VARIANTS.doc,
+  NODE_CONTENT_VARIANTS.whiteboard,
+  NODE_CONTENT_VARIANTS.workflow,
+  NODE_CONTENT_VARIANTS.html
+]);
+var updateNodeContentInputSchema = z.object({
+  nodeId: z.string(),
+  content: nodeContentInputSchema,
+  message: z.string().optional().default("Update content").describe(
+    'Explanation shown to the human reviewer. Write a conventional-commit style subject \u2014 imperative verb + what + why, e.g. "Add rollback steps to the deploy runbook".'
+  ),
+  submittedBy: z.string().optional().default("local-producer"),
+  // Server-decided, not client-decided: `shouldAutoMerge(autoMerge, hasWrite) =
+  // autoMerge !== false && hasWrite`. Omitted/true merges immediately IF the
+  // actor holds `write` on the node; otherwise (or with explicit `false`) the
+  // content lands as a pending ChangeRequest instead. A `changeRequest`-level
+  // caller passing `autoMerge: true` still lands in review — the server never
+  // lets the client escalate past its own permission.
+  autoMerge: z.boolean().optional()
+});
 var folderSchema = z.object({
   node: nodeSchema,
   children: z.array(nodeSchema)
@@ -3049,6 +3171,11 @@ var genericNodeDetailSchema = (type) => z.object({
   type: z.literal(type),
   node: nodeSchema
 });
+var richNodeDetailSchema = (type, documentSchema) => z.object({
+  type: z.literal(type),
+  node: nodeSchema,
+  document: documentSchema
+});
 var NODE_DETAIL_VARIANTS = {
   folder: folderSchema.extend({ type: z.literal("folder") }),
   doc: docSchema.extend({ type: z.literal("doc") }),
@@ -3061,9 +3188,9 @@ var NODE_DETAIL_VARIANTS = {
   airapp: fileTreeNodeSchema.extend({ type: z.literal("airapp") }),
   base: genericNodeDetailSchema("base"),
   form: genericNodeDetailSchema("form"),
-  whiteboard: genericNodeDetailSchema("whiteboard"),
-  workflow: genericNodeDetailSchema("workflow"),
-  html: genericNodeDetailSchema("html")
+  whiteboard: richNodeDetailSchema("whiteboard", WhiteboardDocumentSchema),
+  workflow: richNodeDetailSchema("workflow", WorkflowDocumentSchema),
+  html: richNodeDetailSchema("html", HtmlDocumentSchema)
 };
 var NodeDetailVOSchema = z.discriminatedUnion("type", [
   NODE_DETAIL_VARIANTS.folder,
@@ -3146,7 +3273,7 @@ var busabaseContractRoutes = {
     path: "/grep",
     tags: ["Search"],
     summary: "Search files, Docs, and Base records with one pattern (unified grep)",
-    successDescription: "Streaming regex/literal matches across every in-scope source \u2014 Drive/Skill files, Doc bodies, and Base records (canonical headCommit.fields, never the truncated search projection) \u2014 with one shared pattern, one shared maxMatches/deadline budget (files scanned first, then docs, then whatever budget remains goes to records), and a per-source honest coverage report (files keeps its existing missing/stale/unsearchable/errored/notReached; docs and records report scanned/errored/notReached). truncated is set when any source truncated or has notReached > 0."
+    successDescription: "Streaming regex/literal matches across every in-scope source \u2014 Drive/Skill files, Doc bodies, and Base records (canonical headCommit.payload, never the truncated search projection) \u2014 with one shared pattern, one shared maxMatches/deadline budget (files scanned first, then docs, then whatever budget remains goes to records), and a per-source honest coverage report (files keeps its existing missing/stale/unsearchable/errored/notReached; docs and records report scanned/errored/notReached). truncated is set when any source truncated or has notReached > 0."
   }).input(UnifiedGrepInputSchema).output(UnifiedGrepResultVOSchema),
   nodes: {
     list: oc.route({
@@ -3189,8 +3316,15 @@ var busabaseContractRoutes = {
       path: "/nodes/{nodeId}/metadata",
       tags: ["Nodes"],
       summary: "Update node metadata",
-      successDescription: "Shallow-merged the supplied top-level keys into the active node's existing metadata. Requires write access on the node."
+      successDescription: "Shallow-merged the supplied top-level keys into the active node's existing metadata. Requires write access on the node. Node CONTENT (a Doc body, or a whiteboard/workflow/html document) does not go through here \u2014 use PUT /nodes/{nodeId}/content instead."
     }).input(updateNodeMetadataInputSchema).output(nodeSchema),
+    updateContent: oc.route({
+      method: "PUT",
+      path: "/nodes/{nodeId}/content",
+      tags: ["Nodes", "Change Requests"],
+      summary: "Update node content",
+      successDescription: "ChangeRequest carrying the proposed content. Merged immediately when the actor holds write access on the node and `autoMerge` was not explicitly `false`; otherwise left `in_review` for a human. Accepts doc, whiteboard, workflow, and html nodes \u2014 the types that own exactly one document."
+    }).input(updateNodeContentInputSchema).output(changeRequestSchema),
     purge: oc.route({
       method: "DELETE",
       path: "/nodes/{nodeId}",
@@ -3930,7 +4064,7 @@ var Busabase = class {
   /**
    * Unified grep — one regex/literal pattern scanned across every in-scope
    * source (Drive/Skill files, Doc bodies, and Base records — records read
-   * the canonical `headCommit.fields`, never the truncated search
+   * the canonical `headCommit.payload`, never the truncated search
    * projection), with a shared `maxMatches`/deadline budget and per-source
    * honest coverage. `bb.assets.grep` remains available as a files-only SDK
    * convenience and delegates here with `sources: ["files"]`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busabase-sdk",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "description": "Typed TypeScript/JavaScript SDK for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server` (or Busabase Cloud).",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-sdk",
@@ -63,9 +63,9 @@
     "tsx": "^4.20.5",
     "typescript": "^5.9.3",
     "vitest": "^2.1.8",
-    "busabase-contract": "0.16.1",
+    "open-domains": "0.0.2",
     "openlib": "0.1.1",
-    "open-domains": "0.0.2"
+    "busabase-contract": "0.17.0"
   },
   "engines": {
     "node": ">=24.18.0"