busabase-sdk 0.19.2 → 0.20.0

package/dist/index.js

@@ -1161,6 +1161,23 @@ const userRefSchema = z.object({
 	image: z.string().nullable(),
 	role: z.string().nullable().optional()
 });
+const sourceChannelSchema = z.enum([
+	"web_ui",
+	"browser",
+	"openapi",
+	"sdk",
+	"cli",
+	"mcp",
+	"skill",
+	"webhook",
+	"automation",
+	"import"
+]);
+const sourceAttributionSchema = z.object({
+	displayName: z.string().nullable(),
+	ownerName: z.string().nullable(),
+	channel: sourceChannelSchema.nullable()
+});
 const commitSchema = z.object({
 	id: z.string(),
 	baseId: z.string().nullable(),
@@ -1252,6 +1269,7 @@ const changeRequestSchema = z.object({
 	status: changeRequestStatusSchema,
 	submittedBy: z.string(),
 	submittedByUser: userRefSchema.nullable().optional().default(null),
+	sourceAttribution: sourceAttributionSchema.nullable().optional(),
 	sourceMeta: z.record(z.string(), z.unknown()),
 	reviewPolicySnapshot: z.record(z.string(), z.unknown()),
 	mergeSummary: z.record(z.string(), z.unknown()),
@@ -1340,6 +1358,7 @@ const auditEventSchema = z.object({
 	action: auditActionSchema,
 	actorId: z.string(),
 	actor: userRefSchema.nullable().optional().default(null),
+	sourceAttribution: sourceAttributionSchema.nullable().optional(),
 	baseId: z.string().nullable(),
 	recordId: z.string().nullable(),
 	changeRequestId: z.string().nullable(),
@@ -1461,21 +1480,30 @@ const listChangeRequestsPagedInputSchema = z.object({
 	/** Opaque base64 cursor (`createdAt|id`) for keyset pagination. */
 	cursor: z.string().optional(),
 	status: z.array(changeRequestStatusSchema).optional(),
-	mine: z.boolean().optional()
+	mine: z.boolean().optional(),
+	affectsNodeId: z.string().min(1).optional()
 }).optional().default({ limit: 50 });
 const listChangeRequestsResponseSchema = z.object({
 	changeRequests: z.array(changeRequestSchema),
 	nextCursor: z.string().nullable()
 });
-const listChangeRequestsPageInputSchema = z.object({
+const changeRequestPageInputShape = {
 	page: z.coerce.number().int().min(1).optional().default(1),
 	pageSize: z.coerce.number().int().min(1).max(100).optional().default(50),
 	status: z.array(changeRequestStatusSchema).optional(),
 	mine: z.boolean().optional()
+};
+const listChangeRequestsPageInputSchema = z.object({
+	...changeRequestPageInputShape,
+	affectsNodeId: z.string().min(1).optional()
 }).optional().default({
 	page: 1,
 	pageSize: 50
 });
+const inboxSnapshotInputSchema = z.object(changeRequestPageInputShape).optional().default({
+	page: 1,
+	pageSize: 50
+});
 const listChangeRequestsPageResponseSchema = z.object({
 	changeRequests: z.array(changeRequestSchema),
 	total: z.number().int().nonnegative(),
@@ -3671,6 +3699,104 @@ const listRecordActivityInputSchema = z.object({
 	recordId: z.string().min(1),
 	limit: z.coerce.number().int().min(1).max(100).optional().default(50)
 });
+const EMBED_LINK_MAX_MINUTES = 1440;
+const EmbedNodeTypeSchema = z.enum([
+	"base",
+	"doc",
+	"file",
+	"drive",
+	"skill",
+	"folder",
+	"airapp"
+]);
+const EmbedTargetTypeSchema = z.enum([
+	"node",
+	"change-request",
+	"record-detail"
+]);
+const EmbedFrameModeSchema = z.enum([
+	"anywhere",
+	"origins",
+	"top-level-only"
+]);
+const EmbedAllowedOriginSchema = z.string().trim().min(1).superRefine((value, ctx) => {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		ctx.addIssue({
+			code: "custom",
+			message: "Allowed origins must be valid URLs"
+		});
+		return;
+	}
+	const isLocalHttp = url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]");
+	if (url.protocol !== "https:" && !isLocalHttp) ctx.addIssue({
+		code: "custom",
+		message: "Allowed origins must use HTTPS"
+	});
+	if (url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.hostname.includes("*")) ctx.addIssue({
+		code: "custom",
+		message: "Allowed origins must be exact origins"
+	});
+}).transform((value) => new URL(value).origin);
+const EmbedFramePolicyInputSchema = z.discriminatedUnion("mode", [
+	z.object({
+		mode: z.literal("anywhere"),
+		allowedOrigins: z.array(EmbedAllowedOriginSchema).max(0).optional()
+	}),
+	z.object({
+		mode: z.literal("origins"),
+		allowedOrigins: z.array(EmbedAllowedOriginSchema).min(1).max(20)
+	}),
+	z.object({
+		mode: z.literal("top-level-only"),
+		allowedOrigins: z.array(EmbedAllowedOriginSchema).max(0).optional()
+	})
+]).transform((policy) => ({
+	mode: policy.mode,
+	allowedOrigins: [...new Set(policy.allowedOrigins ?? [])]
+}));
+const EmbedFramePolicyVOSchema = z.object({
+	mode: EmbedFrameModeSchema,
+	allowedOrigins: z.array(z.string().url())
+}).superRefine((policy, ctx) => {
+	if (!(policy.mode === "origins" ? policy.allowedOrigins.length > 0 : policy.allowedOrigins.length === 0)) ctx.addIssue({
+		code: "custom",
+		message: "Stored frame policy is invalid"
+	});
+});
+const CreateEmbedLinkInputSchema = z.object({
+	type: EmbedTargetTypeSchema,
+	typeId: z.string().min(1),
+	expiresInMinutes: z.number().int().min(1).max(EMBED_LINK_MAX_MINUTES).optional().default(15),
+	framePolicy: EmbedFramePolicyInputSchema.optional().default({
+		mode: "anywhere",
+		allowedOrigins: []
+	})
+});
+const ListEmbedLinksInputSchema = z.object({
+	type: EmbedTargetTypeSchema.optional(),
+	typeId: z.string().min(1).optional()
+}).optional().default({});
+const RevokeEmbedLinkInputSchema = z.object({ id: z.string().min(1) });
+const EmbedLinkVOSchema = z.object({
+	id: z.string(),
+	type: EmbedTargetTypeSchema,
+	typeId: z.string(),
+	targetName: z.string(),
+	nodeType: EmbedNodeTypeSchema.nullable(),
+	createdAt: z.string().datetime(),
+	expiresAt: z.string().datetime(),
+	revokedAt: z.string().datetime().nullable(),
+	active: z.boolean(),
+	framePolicy: EmbedFramePolicyVOSchema
+});
+const CreatedEmbedLinkVOSchema = EmbedLinkVOSchema.extend({
+	url: z.string().url(),
+	iframeUrl: z.string().url()
+});
+const RevokeEmbedLinkVOSchema = z.object({ revoked: z.literal(true) });
 //#endregion
 //#region ../../packages/busabase-contract/src/contract/grep-schemas.ts
 /**
@@ -4134,6 +4260,29 @@ const changeRequestBatchFailureSchema = z.object({
 	code: z.string().optional(),
 	data: z.unknown().optional()
 });
+const embedLinkErrorResponseSchema = z.object({ error: z.string() });
+const embedLinkErrors = {
+	BAD_REQUEST: {
+		status: 400,
+		message: "Bad Request",
+		data: embedLinkErrorResponseSchema
+	},
+	UNAUTHORIZED: {
+		status: 401,
+		message: "Unauthorized",
+		data: embedLinkErrorResponseSchema
+	},
+	FORBIDDEN: {
+		status: 403,
+		message: "Forbidden",
+		data: embedLinkErrorResponseSchema
+	},
+	NOT_FOUND: {
+		status: 404,
+		message: "Not Found",
+		data: embedLinkErrorResponseSchema
+	}
+};
 const changeRequestReviewBatchResultSchema = z.object({ results: z.array(z.discriminatedUnion("ok", [z.object({
 	changeRequestId: z.string(),
 	ok: z.literal(true),
@@ -4170,6 +4319,29 @@ const busabaseContractRoutes = {
 		summary: "Search files, Docs, and Base records with one pattern (unified grep)",
 		successDescription: "Streaming regex/literal matches across every in-scope source — Drive/Skill files, Doc bodies, and Base records (canonical headCommit.payload, never the truncated search projection) — with one shared pattern, one shared maxMatches/deadline budget (files scanned first, then docs, then whatever budget remains goes to records), and a per-source honest coverage report (files keeps its existing missing/stale/unsearchable/errored/notReached; docs and records report scanned/errored/notReached). truncated is set when any source truncated or has notReached > 0."
 	}).input(UnifiedGrepInputSchema).output(UnifiedGrepResultVOSchema),
+	embedLinks: {
+		create: oc.route({
+			method: "POST",
+			path: "/embed-links",
+			tags: ["Embed Links"],
+			summary: "Create a polymorphic read-only embed link",
+			successDescription: "The capability URL is returned once; only its secret hash is stored."
+		}).errors(embedLinkErrors).input(CreateEmbedLinkInputSchema).output(CreatedEmbedLinkVOSchema),
+		list: oc.route({
+			method: "GET",
+			path: "/embed-links",
+			tags: ["Embed Links"],
+			summary: "List embed links the caller can manage",
+			successDescription: "Embed link metadata without capability secrets."
+		}).errors(embedLinkErrors).input(ListEmbedLinksInputSchema).output(z.array(EmbedLinkVOSchema)),
+		revoke: oc.route({
+			method: "DELETE",
+			path: "/embed-links/{id}",
+			tags: ["Embed Links"],
+			summary: "Revoke an embed link",
+			successDescription: "The capability stops resolving immediately."
+		}).errors(embedLinkErrors).input(RevokeEmbedLinkInputSchema).output(RevokeEmbedLinkVOSchema)
+	},
 	nodes: {
 		list: oc.route({
 			method: "GET",
@@ -4435,16 +4607,16 @@ const busabaseContractRoutes = {
 			path: "/change-requests",
 			tags: ["Change Requests"],
 			summary: "List change requests",
-			successDescription: "A page of change requests plus an opaque nextCursor (null at the end). Filter with `status` and/or `mine`."
+			successDescription: "A page of change requests plus an opaque nextCursor (null at the end). Filter with `status`, `mine`, and/or `affectsNodeId`."
 		}).input(listChangeRequestsPagedInputSchema).output(listChangeRequestsResponseSchema),
 		listPage: oc.route({
 			method: "GET",
 			path: "/change-requests/page",
 			tags: ["Change Requests"],
 			summary: "List a numbered change request page",
-			successDescription: "A random-access page of change requests plus the total across the whole filter. Same `status` / `mine` filters as the cursor listing."
+			successDescription: "A random-access page of change requests plus the total across the whole filter. Same `status`, `mine`, and `affectsNodeId` filters as the cursor listing."
 		}).input(listChangeRequestsPageInputSchema).output(listChangeRequestsPageResponseSchema),
-		inboxSnapshot: oc.input(listChangeRequestsPageInputSchema).output(inboxSnapshotResponseSchema),
+		inboxSnapshot: oc.input(inboxSnapshotInputSchema).output(inboxSnapshotResponseSchema),
 		counts: oc.route({
 			method: "GET",
 			path: "/change-requests/counts",
@@ -4495,94 +4667,6 @@ const busabaseContractRoutes = {
 	views: viewContract
 };
 oc.prefix("/api/v1").router(busabaseContractRoutes);
-const EMBED_LINK_MAX_MINUTES = 1440;
-const EmbedNodeTypeSchema = z.enum([
-	"base",
-	"doc",
-	"file",
-	"drive",
-	"skill",
-	"folder",
-	"airapp"
-]);
-const EmbedFrameModeSchema = z.enum([
-	"anywhere",
-	"origins",
-	"top-level-only"
-]);
-const EmbedAllowedOriginSchema = z.string().trim().min(1).superRefine((value, ctx) => {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		ctx.addIssue({
-			code: "custom",
-			message: "Allowed origins must be valid URLs"
-		});
-		return;
-	}
-	const isLocalHttp = url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]");
-	if (url.protocol !== "https:" && !isLocalHttp) ctx.addIssue({
-		code: "custom",
-		message: "Allowed origins must use HTTPS"
-	});
-	if (url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.hostname.includes("*")) ctx.addIssue({
-		code: "custom",
-		message: "Allowed origins must be exact origins"
-	});
-}).transform((value) => new URL(value).origin);
-const EmbedFramePolicyInputSchema = z.discriminatedUnion("mode", [
-	z.object({
-		mode: z.literal("anywhere"),
-		allowedOrigins: z.array(EmbedAllowedOriginSchema).max(0).optional()
-	}),
-	z.object({
-		mode: z.literal("origins"),
-		allowedOrigins: z.array(EmbedAllowedOriginSchema).min(1).max(20)
-	}),
-	z.object({
-		mode: z.literal("top-level-only"),
-		allowedOrigins: z.array(EmbedAllowedOriginSchema).max(0).optional()
-	})
-]).transform((policy) => ({
-	mode: policy.mode,
-	allowedOrigins: [...new Set(policy.allowedOrigins ?? [])]
-}));
-const EmbedFramePolicyVOSchema = z.object({
-	mode: EmbedFrameModeSchema,
-	allowedOrigins: z.array(z.string().url())
-}).superRefine((policy, ctx) => {
-	if (!(policy.mode === "origins" ? policy.allowedOrigins.length > 0 : policy.allowedOrigins.length === 0)) ctx.addIssue({
-		code: "custom",
-		message: "Stored frame policy is invalid"
-	});
-});
-const CreateEmbedLinkInputSchema = z.object({
-	nodeId: z.string().min(1),
-	expiresInMinutes: z.number().int().min(1).max(EMBED_LINK_MAX_MINUTES).optional().default(15),
-	framePolicy: EmbedFramePolicyInputSchema.optional().default({
-		mode: "anywhere",
-		allowedOrigins: []
-	})
-});
-const ListEmbedLinksInputSchema = z.object({ nodeId: z.string().min(1).optional() }).optional().default({});
-const RevokeEmbedLinkInputSchema = z.object({ id: z.string().min(1) });
-const EmbedLinkVOSchema = z.object({
-	id: z.string(),
-	nodeId: z.string(),
-	nodeName: z.string(),
-	nodeType: EmbedNodeTypeSchema,
-	createdAt: z.string().datetime(),
-	expiresAt: z.string().datetime(),
-	revokedAt: z.string().datetime().nullable(),
-	active: z.boolean(),
-	framePolicy: EmbedFramePolicyVOSchema
-});
-const CreatedEmbedLinkVOSchema = EmbedLinkVOSchema.extend({
-	url: z.string().url(),
-	iframeUrl: z.string().url()
-});
-const RevokeEmbedLinkVOSchema = z.object({ revoked: z.literal(true) });
 //#endregion
 //#region ../../packages/busabase-contract/src/contract/cloud.ts
 /**
@@ -4638,25 +4722,7 @@ const notFoundErrors = { NOT_FOUND: {
 	message: "Not Found",
 	data: ErrorResponseSchema
 } };
-const embedLinksErrors = {
-	BAD_REQUEST: {
-		status: 400,
-		message: "Bad Request",
-		data: ErrorResponseSchema
-	},
-	...authenticatedErrors,
-	FORBIDDEN: {
-		status: 403,
-		message: "Forbidden",
-		data: ErrorResponseSchema
-	},
-	...notFoundErrors
-};
-const securedRoute = (operation) => ({
-	...operation,
-	security: [{ bearerAuth: [] }]
-});
-const { vault: _localVault, ...cloudWorkbenchRoutes } = busabaseContractRoutes;
+const { embedLinks: _embedLinksAlreadyPublishedAtRoot, vault: _localVault, ...cloudWorkbenchRoutes } = busabaseContractRoutes;
 const cloudExtraRoutes = {
 	system: {
 		health: oc.route({
@@ -4721,32 +4787,7 @@ const cloudExtraRoutes = {
 			...notFoundErrors
 		}).input(z.object({ params: z.object({ id: z.string() }) })).output(AgentTaskDetailSchema)
 	},
-	embedLinks: {
-		create: oc.route({
-			method: "POST",
-			path: "/embed-links",
-			tags: ["Embed Links"],
-			summary: "Create a short-lived read-only embed link for one node",
-			successDescription: "The capability URL is returned once; only its secret hash is stored.",
-			spec: securedRoute
-		}).errors(embedLinksErrors).input(CreateEmbedLinkInputSchema).output(CreatedEmbedLinkVOSchema),
-		list: oc.route({
-			method: "GET",
-			path: "/embed-links",
-			tags: ["Embed Links"],
-			summary: "List embed links the caller can manage",
-			successDescription: "Embed link metadata without capability secrets.",
-			spec: securedRoute
-		}).errors(embedLinksErrors).input(ListEmbedLinksInputSchema).output(z.array(EmbedLinkVOSchema)),
-		revoke: oc.route({
-			method: "DELETE",
-			path: "/embed-links/{id}",
-			tags: ["Embed Links"],
-			summary: "Revoke an embed link",
-			successDescription: "The capability stops resolving immediately.",
-			spec: securedRoute
-		}).errors(embedLinksErrors).input(RevokeEmbedLinkInputSchema).output(RevokeEmbedLinkVOSchema)
-	}
+	embedLinks: busabaseContractRoutes.embedLinks
 };
 const cloudContract = oc.prefix("/api/v1").router({
 	...cloudWorkbenchRoutes,
@@ -4775,6 +4816,7 @@ function resolveConfig(config = {}) {
 		webUrl: normalizeBaseUrl(config.webUrl ?? env("BUSABASE_WEB_URL") ?? baseUrl),
 		apiKey: config.apiKey ?? env("BUSABASE_API_KEY"),
 		spaceId: config.spaceId ?? env("BUSABASE_SPACE_ID"),
+		sourceChannel: config.sourceChannel ?? "sdk",
 		headers: config.headers,
 		fetch: config.fetch
 	};
@@ -4845,6 +4887,7 @@ function createBusabaseClient(config = {}) {
 			return {
 				...resolved.apiKey ? { authorization: `Bearer ${resolved.apiKey}` } : {},
 				...resolved.spaceId ? { "x-busabase-space": resolved.spaceId } : {},
+				"x-busabase-channel": resolved.sourceChannel ?? "sdk",
 				...extra
 			};
 		}
@@ -5031,7 +5074,7 @@ var Busabase = class {
 	* This is the *authenticated*, durable link: it never expires, but the reader
 	* needs a session unless the node has public sharing enabled. For a no-login
 	* link, mint a Cloud embed link instead —
-	* `bb.embedLinks.create({ nodeId })` returns `{ url, iframeUrl }`.
+	* `bb.embedLinks.create({ type: "node", typeId: nodeId })` returns `{ url, iframeUrl }`.
 	*
 	* @example
 	* ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busabase-sdk",
-  "version": "0.19.2",
+  "version": "0.20.0",
   "description": "Typed TypeScript/JavaScript SDK for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server` (or Busabase Cloud).",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-sdk",
@@ -63,9 +63,9 @@
     "tsx": "^4.20.5",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
-    "busabase-contract": "0.19.2",
-    "openlib": "0.1.1",
-    "open-domains": "0.0.2"
+    "busabase-contract": "0.20.0",
+    "open-domains": "0.0.2",
+    "openlib": "0.1.1"
   },
   "engines": {
     "node": ">=24.18.0"