busabase-sdk 0.70.0 → 0.72.0

package/dist/airapp.d.ts

@@ -1,4 +1,4 @@
-import { t as BusabaseClient } from "./client-RSU_7-Nn.js";
+import { t as BusabaseClient } from "./client-CZPoK0Uk.js";
 //#region src/airapp.d.ts
 type NodeChangeRequestInput = Parameters<BusabaseClient["nodes"]["createChangeRequest"]>[0];
 type NodeOperationInput = NodeChangeRequestInput["operations"][number];
@@ -215,13 +215,37 @@ declare function inspectProvisionedResources(client: AirAppProvisioningClient, c
  */
 declare function provisionDeclaredResources(client: AirAppProvisioningClient, config: AirAppResourceConfig): Promise<AirAppResources>;
 /** The client surface `publishAirApp` needs, on top of provisioning. */
-type AirAppPublishClient = AirAppProvisioningClient & Pick<BusabaseClient, "fileTrees" | "changeRequests">;
-/** One file of the app's built AirApp bundle, as `publishAirApp` receives it. */
-interface AirAppFileInput {
+type AirAppPublishClient = AirAppProvisioningClient & Pick<BusabaseClient, "fileTrees" | "changeRequests" | "assets">;
+/**
+ * One file of the app's built AirApp bundle, as `publishAirApp` receives it.
+ *
+ * A file tree holds text inline but binaries as Assets — the server never
+ * stores image bytes in a file operation, it stores an `assetId` pointing at
+ * the Asset library. So a bundle that ships a favicon or an empty-state
+ * illustration needs a shape that can say "these are bytes", and until now
+ * this type could only say `content: string`. Callers did the only thing that
+ * type allowed: read the PNG as UTF-8 and publish the mojibake. That fails
+ * silently — the publish succeeds and the image is simply broken.
+ *
+ * `bytes` is resolved to an `assetId` by `resolveAirAppFileAssets`, which
+ * `publishAirApp` calls for you.
+ */
+type AirAppFileInput = {
   path: string;
-  content: string;
   mimeType?: string;
-}
+} & ({
+  content: string;
+  bytes?: never;
+  assetId?: never;
+} | {
+  bytes: Uint8Array;
+  content?: never;
+  assetId?: never;
+} | {
+  assetId: string;
+  content?: never;
+  bytes?: never;
+});
 /**
  * What one publish did. `merged` is the question a caller actually has — did
  * this bundle go live, or is it waiting for someone?
@@ -258,6 +282,16 @@ type AirAppPublishResult = {
  * makes for a Base's fields (`additiveFieldsFor` only ever appends).
  */
 declare function buildAirAppFileOperations(localFiles: AirAppFileInput[], deployedPaths: Iterable<string>): FileTreeCreateOrUpdateOperation[];
+/**
+ * Upload every `bytes` file in a bundle and hand back the same list with
+ * `assetId` in their place. Text files pass through untouched — a bundle with
+ * no binaries makes no upload calls at all.
+ *
+ * Separate from `buildAirAppFileOperations` so that function can stay pure and
+ * directly testable; separate from `publishAirApp` so a caller assembling its
+ * own file operations (a Skill or Drive sync, say) can reuse it.
+ */
+declare function resolveAirAppFileAssets(client: AirAppPublishClient, files: AirAppFileInput[], fetchImpl?: typeof fetch): Promise<AirAppFileInput[]>;
 /**
  * Publish the app's own AirApp bundle: create it under the Folder when this
  * Space has never had it, or propose the local files as an update when it
@@ -280,4 +314,4 @@ declare function buildAirAppFileOperations(localFiles: AirAppFileInput[], deploy
  */
 declare function publishAirApp(client: AirAppPublishClient, config: AirAppResourceConfig, files: AirAppFileInput[]): Promise<AirAppPublishResult>;
 //#endregion
-export { AirAppBaseDeclaration, AirAppFieldDeclaration, AirAppFileInput, AirAppFolderDeclaration, AirAppNodeDeclaration, AirAppOwnershipRepair, AirAppProvisionedBase, AirAppProvisioningClient, AirAppPublishClient, AirAppPublishResult, AirAppResourceConfig, AirAppResourceOwnership, AirAppResources, AirAppSetupCode, AirAppSetupError, buildAirAppFileOperations, buildProvisionOperations, inspectProvisionedResources, isNotFound, provisionDeclaredResources, publishAirApp, resolveProvisionedFolder };
+export { AirAppBaseDeclaration, AirAppFieldDeclaration, AirAppFileInput, AirAppFolderDeclaration, AirAppNodeDeclaration, AirAppOwnershipRepair, AirAppProvisionedBase, AirAppProvisioningClient, AirAppPublishClient, AirAppPublishResult, AirAppResourceConfig, AirAppResourceOwnership, AirAppResources, AirAppSetupCode, AirAppSetupError, buildAirAppFileOperations, buildProvisionOperations, inspectProvisionedResources, isNotFound, provisionDeclaredResources, publishAirApp, resolveAirAppFileAssets, resolveProvisionedFolder };

package/dist/airapp.js

@@ -1,4 +1,4 @@
-import { t as APP_ROOT_RESOURCE_KEY } from "./template-D10kjpd-.js";
+import { i as uploadAsset, t as APP_ROOT_RESOURCE_KEY } from "./template-DRMp6tKv.js";
 //#region src/airapp.ts
 /**
 * AirApp resource provisioning — how an app claims (or creates) the Folder and
@@ -402,12 +402,50 @@ function provisionDeclaredResources(client, config) {
 */
 function buildAirAppFileOperations(localFiles, deployedPaths) {
 	const deployed = new Set(deployedPaths);
-	return localFiles.map((file) => ({
-		kind: deployed.has(file.path) ? "update" : "create",
-		path: file.path,
-		content: file.content,
-		...file.mimeType ? { mimeType: file.mimeType } : {}
-	}));
+	return localFiles.map((file) => {
+		if (file.bytes) throw new Error(`buildAirAppFileOperations: ${file.path} carries bytes — run resolveAirAppFileAssets first to turn them into an assetId`);
+		return {
+			kind: deployed.has(file.path) ? "update" : "create",
+			path: file.path,
+			...file.assetId ? { assetId: file.assetId } : { content: file.content },
+			...file.mimeType ? { mimeType: file.mimeType } : {}
+		};
+	});
+}
+/**
+* Upload every `bytes` file in a bundle and hand back the same list with
+* `assetId` in their place. Text files pass through untouched — a bundle with
+* no binaries makes no upload calls at all.
+*
+* Separate from `buildAirAppFileOperations` so that function can stay pure and
+* directly testable; separate from `publishAirApp` so a caller assembling its
+* own file operations (a Skill or Drive sync, say) can reuse it.
+*/
+async function resolveAirAppFileAssets(client, files, fetchImpl) {
+	const resolved = [];
+	for (const file of files) {
+		if (!file.bytes) {
+			resolved.push(file);
+			continue;
+		}
+		const mimeType = file.mimeType ?? "application/octet-stream";
+		const asset = await uploadAsset(client, file.bytes, {
+			fileName: basenameOf(file.path),
+			mimeType
+		}, fetchImpl);
+		if (!asset.assetId) throw new Error(`resolveAirAppFileAssets: ${file.path} uploaded but this host returned no assetId, so no file can reference it`);
+		resolved.push({
+			path: file.path,
+			assetId: asset.assetId,
+			mimeType
+		});
+	}
+	return resolved;
+}
+/** Last path segment — file trees always use POSIX separators. */
+function basenameOf(filePath) {
+	const segments = filePath.split("/");
+	return segments[segments.length - 1] || filePath;
 }
 /**
 * Find a still-pending ChangeRequest that already proposes creating this
@@ -461,6 +499,7 @@ async function publishAirApp(client, config, files) {
 	if (!airApp) throw setupError("SETUP_CONFLICT", "This app does not declare an airApp to publish");
 	const current = await inspectProvisionedResources(client, config);
 	if (!current.folder) throw setupError("SETUP_REQUIRED", "Provision the Folder and Bases with provisionDeclaredResources before publishing the AirApp");
+	const resolvedFiles = await resolveAirAppFileAssets(client, files);
 	if (!current.airApp) {
 		const pendingChangeRequestId = await findPendingAirAppCreate(client, airApp.slug);
 		if (pendingChangeRequestId) return {
@@ -474,7 +513,7 @@ async function publishAirApp(client, config, files) {
 			slug: airApp.slug,
 			name: airApp.name,
 			description: airApp.description ?? "",
-			files,
+			files: resolvedFiles,
 			mergeMode: "replace"
 		});
 		return result.materialized ? {
@@ -487,7 +526,7 @@ async function publishAirApp(client, config, files) {
 			changeRequestId: result.id
 		};
 	}
-	const operations = buildAirAppFileOperations(files, (await client.fileTrees.listFiles({
+	const operations = buildAirAppFileOperations(resolvedFiles, (await client.fileTrees.listFiles({
 		nodeId: current.airApp.nodeId,
 		type: "airapp"
 	})).map((file) => file.path));
@@ -505,4 +544,4 @@ async function publishAirApp(client, config, files) {
 	};
 }
 //#endregion
-export { AirAppSetupError, buildAirAppFileOperations, buildProvisionOperations, inspectProvisionedResources, isNotFound, provisionDeclaredResources, publishAirApp, resolveProvisionedFolder };
+export { AirAppSetupError, buildAirAppFileOperations, buildProvisionOperations, inspectProvisionedResources, isNotFound, provisionDeclaredResources, publishAirApp, resolveAirAppFileAssets, resolveProvisionedFolder };

package/dist/{client-RSU_7-Nn.d.ts → client-CZPoK0Uk.d.ts}

@@ -2855,6 +2855,36 @@ declare const cloudContract: {
       }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     };
     share: {
+      list: import("@orpc/contract").ContractProcedure<import("@orpc/contract").Schema<unknown, unknown>, z.ZodArray<z.ZodObject<{
+        nodeId: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodString;
+        type: z.ZodEnum<{
+          [x: string]: string;
+        }>;
+        icon: z.ZodDefault<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          type: z.ZodLiteral<"emoji">;
+          value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+          type: z.ZodLiteral<"attachment">;
+          url: z.ZodString;
+          attachmentId: z.ZodString;
+          originalUrl: z.ZodOptional<z.ZodString>;
+          originalAttachmentId: z.ZodOptional<z.ZodString>;
+          crop: z.ZodOptional<z.ZodObject<{
+            x: z.ZodNumber;
+            y: z.ZodNumber;
+            zoom: z.ZodNumber;
+          }, z.core.$strip>>;
+        }, z.core.$strip>], "type">>>;
+        capability: z.ZodEnum<{
+          read: "read";
+          submit: "submit";
+        }>;
+        hasPassword: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+      }, z.core.$strip>>, import("@orpc/contract").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
       get: import("@orpc/contract").ContractProcedure<z.ZodObject<{
         nodeId: z.ZodString;
       }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
@@ -22941,6 +22971,78 @@ declare const cloudContract: {
         }, z.core.$strip>;
       };
     }>>, Record<never, never>>;
+    listPaged: import("@orpc/contract").ContractProcedure<z.ZodObject<{
+      status: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        all: "all";
+        expired: "expired";
+        revoked: "revoked";
+      }>>>;
+      limit: z.ZodDefault<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
+      cursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+      items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+          "change-request": "change-request";
+          node: "node";
+          "record-detail": "record-detail";
+        }>;
+        typeId: z.ZodString;
+        targetName: z.ZodString;
+        nodeType: z.ZodNullable<z.ZodEnum<{
+          airapp: "airapp";
+          base: "base";
+          doc: "doc";
+          drive: "drive";
+          file: "file";
+          folder: "folder";
+          skill: "skill";
+        }>>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        active: z.ZodBoolean;
+        framePolicy: z.ZodObject<{
+          mode: z.ZodEnum<{
+            anywhere: "anywhere";
+            origins: "origins";
+            "top-level-only": "top-level-only";
+          }>;
+          allowedOrigins: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+      }, z.core.$strip>>;
+      nextCursor: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+      BAD_REQUEST: {
+        status: number;
+        message: string;
+        data: z.ZodObject<{
+          error: z.ZodString;
+        }, z.core.$strip>;
+      };
+      UNAUTHORIZED: {
+        status: number;
+        message: string;
+        data: z.ZodObject<{
+          error: z.ZodString;
+        }, z.core.$strip>;
+      };
+      FORBIDDEN: {
+        status: number;
+        message: string;
+        data: z.ZodObject<{
+          error: z.ZodString;
+        }, z.core.$strip>;
+      };
+      NOT_FOUND: {
+        status: number;
+        message: string;
+        data: z.ZodObject<{
+          error: z.ZodString;
+        }, z.core.$strip>;
+      };
+    }>>, Record<never, never>>;
     revoke: import("@orpc/contract").ContractProcedure<z.ZodObject<{
       id: z.ZodString;
     }, z.core.$strip>, z.ZodObject<{

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as AssetTextStatus, A as NodeVO, At as GalleryCardSize, B as UpdatePreviewFileCredentialDTO, Bt as ViewSortVO, C as CommentVO, Ct as ListFormsDTO, D as MentionInboxItemVO, Dt as AssetAttachmentRef, E as LookupRollup, Et as UpdateFormDTO, F as SearchResponseVO, Ft as VIEW_FIELD_MAX_WIDTH, G as VaultItemKind, Gt as cloudContract, H as VaultAccessPolicy, Ht as ViewVO, I as SearchResultKind, It as VIEW_FIELD_MIN_WIDTH, J as VaultScopeType, Jt as CREATABLE_NODE_TYPES, K as VaultItemVO, Kt as NodeIcon, L as SearchResultVO, Lt as ViewConfigVO, M as OperationVO, Mt as GanttScale, N as ReviewVO, Nt as RecordLinkVO, O as MentionInboxPageVO, Ot as BaseFieldVO, P as ReviewVerdict, Pt as RecordVO, Q as AssetDetailVO, R as SourceAttributionVO, Rt as ViewFilterOperator, S as CommentSubjectType, St as FormVO, T as FieldType, Tt as SubmitFormDTO, U as VaultEnvironment, Ut as AttachmentRef, V as UpdateVaultSettingsDTO, Vt as ViewType, W as VaultItemInput, Wt as CloudContract, X as FileNodeMetadata, Xt as NodeType, Y as VaultSettingsVO, Yt as CreatableNodeType, Z as FileNodeVO, Zt as OperationKind, _ as ChangeRequestVO, _t as FormFieldBindingVO, a as createBusabaseClient, at as FilePreviewConfigurationStatus, b as CommentMentionTargetType, bt as FormSubmitResultVO, c as AuditAction, ct as FilePreviewUnavailableReason, d as ChangeRequestBatchFailureVO, dt as FileTreeNodeVO, et as AssetUsageVO, f as ChangeRequestCountsVO, ft as FileTreeReadFileVO, g as ChangeRequestTargetType, gt as FormBoundFieldVO, h as ChangeRequestStatus, ht as CreateFormDTO, i as ResolvedConfig, it as FilePreviewConfigVO, j as OperationStatus, jt as GalleryCoverFit, k as NodeSearchResultVO, kt as BaseVO, l as AuditEventVO, lt as FilePreviewVO, m as ChangeRequestReviewBatchResultVO, mt as ActivityItemVO, n as BusabaseConfig, nt as GrepInputDTO, o as resolveConfig, ot as FilePreviewCredentialSource, p as ChangeRequestMergeBatchResultVO, pt as NodeDetailVO, q as VaultRuntimeEnv, qt as NodeIconSchema, r as DEFAULT_BASE_URL, rt as GrepResultVO, s as AgentTaskVO, st as FilePreviewProvider, t as BusabaseClient, tt as AssetVO, u as BusabaseSourceChannel, ut as FileTreeFileVO, v as CommentMentionDispatchStatus, vt as FormPageSourceVO, w as CommitVO, wt as ListFormsVO, x as CommentMentionVO, xt as FormThemeVO, y as CommentMentionInputDTO, yt as FormShareVO, z as UserRefVO, zt as ViewFilterVO } from "./client-RSU_7-Nn.js";
+import { $ as AssetTextStatus, A as NodeVO, At as GalleryCardSize, B as UpdatePreviewFileCredentialDTO, Bt as ViewSortVO, C as CommentVO, Ct as ListFormsDTO, D as MentionInboxItemVO, Dt as AssetAttachmentRef, E as LookupRollup, Et as UpdateFormDTO, F as SearchResponseVO, Ft as VIEW_FIELD_MAX_WIDTH, G as VaultItemKind, Gt as cloudContract, H as VaultAccessPolicy, Ht as ViewVO, I as SearchResultKind, It as VIEW_FIELD_MIN_WIDTH, J as VaultScopeType, Jt as CREATABLE_NODE_TYPES, K as VaultItemVO, Kt as NodeIcon, L as SearchResultVO, Lt as ViewConfigVO, M as OperationVO, Mt as GanttScale, N as ReviewVO, Nt as RecordLinkVO, O as MentionInboxPageVO, Ot as BaseFieldVO, P as ReviewVerdict, Pt as RecordVO, Q as AssetDetailVO, R as SourceAttributionVO, Rt as ViewFilterOperator, S as CommentSubjectType, St as FormVO, T as FieldType, Tt as SubmitFormDTO, U as VaultEnvironment, Ut as AttachmentRef, V as UpdateVaultSettingsDTO, Vt as ViewType, W as VaultItemInput, Wt as CloudContract, X as FileNodeMetadata, Xt as NodeType, Y as VaultSettingsVO, Yt as CreatableNodeType, Z as FileNodeVO, Zt as OperationKind, _ as ChangeRequestVO, _t as FormFieldBindingVO, a as createBusabaseClient, at as FilePreviewConfigurationStatus, b as CommentMentionTargetType, bt as FormSubmitResultVO, c as AuditAction, ct as FilePreviewUnavailableReason, d as ChangeRequestBatchFailureVO, dt as FileTreeNodeVO, et as AssetUsageVO, f as ChangeRequestCountsVO, ft as FileTreeReadFileVO, g as ChangeRequestTargetType, gt as FormBoundFieldVO, h as ChangeRequestStatus, ht as CreateFormDTO, i as ResolvedConfig, it as FilePreviewConfigVO, j as OperationStatus, jt as GalleryCoverFit, k as NodeSearchResultVO, kt as BaseVO, l as AuditEventVO, lt as FilePreviewVO, m as ChangeRequestReviewBatchResultVO, mt as ActivityItemVO, n as BusabaseConfig, nt as GrepInputDTO, o as resolveConfig, ot as FilePreviewCredentialSource, p as ChangeRequestMergeBatchResultVO, pt as NodeDetailVO, q as VaultRuntimeEnv, qt as NodeIconSchema, r as DEFAULT_BASE_URL, rt as GrepResultVO, s as AgentTaskVO, st as FilePreviewProvider, t as BusabaseClient, tt as AssetVO, u as BusabaseSourceChannel, ut as FileTreeFileVO, v as CommentMentionDispatchStatus, vt as FormPageSourceVO, w as CommitVO, wt as ListFormsVO, x as CommentMentionVO, xt as FormThemeVO, y as CommentMentionInputDTO, yt as FormShareVO, z as UserRefVO, zt as ViewFilterVO } from "./client-CZPoK0Uk.js";
 import { z } from "zod";
 //#region src/url.d.ts
 /**
@@ -114,6 +114,53 @@ declare const toFilesOnlyGrepResult: (result: UnifiedGrepResultVO) => GrepResult
 /** Call unified grep as files-only while preserving the former asset helper result shape. */
 declare const grepAssets: (client: Pick<BusabaseClient, "grep">, input: GrepInputDTO) => Promise<GrepResultVO>;
 //#endregion
+//#region src/asset-upload.d.ts
+/** An uploaded file, as the rest of the SDK needs to refer to it. */
+interface BusabaseUploadedAsset {
+  /** What a file-tree operation references. Absent on hosts with no Asset library. */
+  assetId?: string;
+  /** What a record's attachment cell references. */
+  attachmentId: string;
+  /** Publicly resolvable URL — safe to embed in Markdown. */
+  url: string;
+  fileName: string;
+  mimeType: string;
+  size: number;
+  /** `sha256:<hex>`, when this runtime could compute one. */
+  contentHash?: string;
+}
+interface UploadAssetOptions {
+  fileName: string;
+  mimeType: string;
+  /** Optional grouping hint the server records alongside the asset. */
+  context?: string;
+  spaceId?: string;
+}
+/** The slice of the client an upload needs — keeps this testable with a stub. */
+type AssetUploadClient = Pick<BusabaseClient, "assets">;
+/**
+ * SHA-256 of the bytes, or `undefined` where WebCrypto is unavailable.
+ *
+ * Undefined is a real answer, not a failure: the hash only buys deduplication,
+ * so a runtime without WebCrypto uploads the bytes it would otherwise have
+ * skipped. Failing the upload over a missing optimization would be worse.
+ */
+declare function hashBytes(bytes: Uint8Array): Promise<string | undefined>;
+/**
+ * Upload bytes and get back every id the rest of the SDK might need.
+ *
+ * @example
+ * ```ts
+ * const asset = await uploadAsset(client, png, {
+ *   fileName: "user-journey.png",
+ *   mimeType: "image/png",
+ * });
+ * // asset.assetId  -> reference it from a Skill/Drive/AirApp file operation
+ * // asset.url      -> embed it in Markdown
+ * ```
+ */
+declare function uploadAsset(client: AssetUploadClient, bytes: Uint8Array, options: UploadAssetOptions, fetchImpl?: typeof fetch): Promise<BusabaseUploadedAsset>;
+//#endregion
 //#region src/record-get.d.ts
 interface RecordByFieldInput {
   baseId: string;
@@ -403,6 +450,25 @@ declare class Busabase {
    * ```
    */
   putText(assetId: string, text: string): Promise<Awaited<ReturnType<BusabaseClient["assets"]["putText"]>>>;
+  /**
+   * Put a file into this Space's Asset library in one call, and get back every
+   * id the rest of the SDK asks for: `assetId` for a file-tree entry,
+   * `attachmentId` for a record's attachment cell, `url` to embed in Markdown.
+   *
+   * Hides the three-step flow (`assets.createUploadUrl` → PUT →
+   * `assets.confirm`) and its dedup short-circuit, the same way `putText`
+   * does for text slots.
+   *
+   * @example
+   * ```ts
+   * const shot = await bb.uploadAsset(png, {
+   *   fileName: "user-journey.png",
+   *   mimeType: "image/png",
+   * });
+   * body += `![user journey](${shot.url})`;
+   * ```
+   */
+  uploadAsset(bytes: Uint8Array, options: UploadAssetOptions): Promise<BusabaseUploadedAsset>;
   /** Service health — reaches the server without requiring auth. */
   health(): import("@orpc/client").ClientPromiseResult<{
     status: string;
@@ -427,4 +493,4 @@ declare class Busabase {
   }>>>>;
 }
 //#endregion
-export { type ActivityItemVO, type AgentTaskVO, type FileTreeFileVO as AirAppFileVO, type FileTreeFileVO as DriveFileVO, type FileTreeFileVO, type FileTreeFileVO as SkillFileVO, type FileTreeReadFileVO as AirAppReadFileVO, type FileTreeReadFileVO as DriveReadFileVO, type FileTreeReadFileVO, type FileTreeReadFileVO as SkillReadFileVO, type FileTreeNodeVO as AirAppVO, type FileTreeNodeVO as DriveVO, type FileTreeNodeVO, type FileTreeNodeVO as SkillVO, type AssetAttachmentRef, type AssetDetailVO, type AssetTextStatus, type AssetUsageVO, type AssetVO, type AttachmentRef, type AuditAction, type AuditEventVO, type BaseFieldVO, type BaseVO, Busabase, type BusabaseAssetsClient, BusabaseChangeRequestsClient, type BusabaseClient, type BusabaseConfig, type BusabaseRecordsClient, type BusabaseSourceChannel, CREATABLE_NODE_TYPES, type ChangeRequestBatchFailureVO, type ChangeRequestCountsVO, type ChangeRequestMergeBatchResultVO, type ChangeRequestReviewBatchResultVO, type ChangeRequestStatus, type ChangeRequestTargetType, type ChangeRequestVO, type CloudContract, type CommentMentionDispatchStatus, type CommentMentionInputDTO, type CommentMentionTargetType, type CommentMentionVO, type CommentSubjectType, type CommentVO, type CommitVO, type CreatableNodeType, type CreateFormDTO, DEFAULT_BASE_URL, type FieldType, type FileNodeMetadata, type FileNodeVO, type FilePreviewConfigVO, type FilePreviewConfigurationStatus, type FilePreviewCredentialSource, type FilePreviewProvider, type FilePreviewUnavailableReason, type FilePreviewVO, type FormBoundFieldVO, type FormFieldBindingVO, type FormPageSourceVO, type FormShareVO, type FormSubmitResultVO, type FormThemeVO, type FormVO, type GalleryCardSize, type GalleryCoverFit, type GanttScale, type ListFormsDTO, type ListFormsVO, type LookupRollup, type MentionInboxItemVO, type MentionInboxPageVO, type NodeDetailVO, type NodeIcon, type NodeIconSchema, type NodeSearchResultVO, type NodeType, type NodeVO, type NodeWebUrlInput, type OperationKind, type OperationStatus, type OperationVO, type RecordByFieldInput, type RecordLinkVO, type RecordVO, type ResolvedConfig, type ReviewVO, type ReviewVerdict, type SearchResponseVO, type SearchResultKind, type SearchResultVO, type SourceAttributionVO, type SubmitFormDTO, type UpdateFormDTO, type UpdatePreviewFileCredentialDTO, type UpdateVaultSettingsDTO, type UserRefVO, type VIEW_FIELD_MAX_WIDTH, type VIEW_FIELD_MIN_WIDTH, type VaultAccessPolicy, type VaultEnvironment, type VaultItemInput, type VaultItemKind, type VaultItemVO, type VaultRuntimeEnv, type VaultScopeType, type VaultSettingsVO, type ViewConfigVO, type ViewFilterOperator, type ViewFilterVO, type ViewSortVO, type ViewType, type ViewVO, cloudContract, createBusabaseClient, getRecordByField, grepAssets, nodeWebUrl, normalizeBaseUrl, resolveConfig, toFilesOnlyGrepResult, toUnifiedFilesGrepInput };
+export { type ActivityItemVO, type AgentTaskVO, type FileTreeFileVO as AirAppFileVO, type FileTreeFileVO as DriveFileVO, type FileTreeFileVO, type FileTreeFileVO as SkillFileVO, type FileTreeReadFileVO as AirAppReadFileVO, type FileTreeReadFileVO as DriveReadFileVO, type FileTreeReadFileVO, type FileTreeReadFileVO as SkillReadFileVO, type FileTreeNodeVO as AirAppVO, type FileTreeNodeVO as DriveVO, type FileTreeNodeVO, type FileTreeNodeVO as SkillVO, type AssetAttachmentRef, type AssetDetailVO, type AssetTextStatus, type AssetUsageVO, type AssetVO, type AttachmentRef, type AuditAction, type AuditEventVO, type BaseFieldVO, type BaseVO, Busabase, type BusabaseAssetsClient, BusabaseChangeRequestsClient, type BusabaseClient, type BusabaseConfig, type BusabaseRecordsClient, type BusabaseSourceChannel, type BusabaseUploadedAsset, CREATABLE_NODE_TYPES, type ChangeRequestBatchFailureVO, type ChangeRequestCountsVO, type ChangeRequestMergeBatchResultVO, type ChangeRequestReviewBatchResultVO, type ChangeRequestStatus, type ChangeRequestTargetType, type ChangeRequestVO, type CloudContract, type CommentMentionDispatchStatus, type CommentMentionInputDTO, type CommentMentionTargetType, type CommentMentionVO, type CommentSubjectType, type CommentVO, type CommitVO, type CreatableNodeType, type CreateFormDTO, DEFAULT_BASE_URL, type FieldType, type FileNodeMetadata, type FileNodeVO, type FilePreviewConfigVO, type FilePreviewConfigurationStatus, type FilePreviewCredentialSource, type FilePreviewProvider, type FilePreviewUnavailableReason, type FilePreviewVO, type FormBoundFieldVO, type FormFieldBindingVO, type FormPageSourceVO, type FormShareVO, type FormSubmitResultVO, type FormThemeVO, type FormVO, type GalleryCardSize, type GalleryCoverFit, type GanttScale, type ListFormsDTO, type ListFormsVO, type LookupRollup, type MentionInboxItemVO, type MentionInboxPageVO, type NodeDetailVO, type NodeIcon, type NodeIconSchema, type NodeSearchResultVO, type NodeType, type NodeVO, type NodeWebUrlInput, type OperationKind, type OperationStatus, type OperationVO, type RecordByFieldInput, type RecordLinkVO, type RecordVO, type ResolvedConfig, type ReviewVO, type ReviewVerdict, type SearchResponseVO, type SearchResultKind, type SearchResultVO, type SourceAttributionVO, type SubmitFormDTO, type UpdateFormDTO, type UpdatePreviewFileCredentialDTO, type UpdateVaultSettingsDTO, type UploadAssetOptions, type UserRefVO, type VIEW_FIELD_MAX_WIDTH, type VIEW_FIELD_MIN_WIDTH, type VaultAccessPolicy, type VaultEnvironment, type VaultItemInput, type VaultItemKind, type VaultItemVO, type VaultRuntimeEnv, type VaultScopeType, type VaultSettingsVO, type ViewConfigVO, type ViewFilterOperator, type ViewFilterVO, type ViewSortVO, type ViewType, type ViewVO, cloudContract, createBusabaseClient, getRecordByField, grepAssets, hashBytes, nodeWebUrl, normalizeBaseUrl, resolveConfig, toFilesOnlyGrepResult, toUnifiedFilesGrepInput, uploadAsset };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { n as TemplateRiskLevelSchema } from "./template-D10kjpd-.js";
+import { i as uploadAsset, n as TemplateRiskLevelSchema, r as hashBytes } from "./template-DRMp6tKv.js";
 import { t as normalizeBaseUrl } from "./url-B8GMXalA.js";
 import { ORPCError, createORPCClient } from "@orpc/client";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
@@ -1345,6 +1345,25 @@ const nodeShareSchema = z.object({
 	expiresAt: z.string().nullable(),
 	updatedAt: z.string()
 });
+const sharedNodeSchema = z.object({
+	nodeId: z.string(),
+	name: z.string(),
+	slug: z.string(),
+	type: z.enum(NODE_TYPES),
+	icon: NodeIconSchema.nullable().default(null),
+	capability: z.enum(["read", "submit"]),
+	hasPassword: z.boolean(),
+	expiresAt: z.string().nullable(),
+	/**
+	* When this share ROW was first created — NOT "public continuously since".
+	* `disableNodeShare` flips `scope` to `"none"` and keeps the row, so a node
+	* that was shared, revoked, and shared again still reports the original
+	* date. There is no column recording when `scope` last became `"public"`,
+	* so the UI says "first shared {time}" rather than claiming an exposure
+	* window the data cannot support. Adding that column is the follow-up.
+	*/
+	createdAt: z.string()
+});
 const listNodesInputSchema = z.object({
 	parentId: z.string().nullable().optional().describe("Node to start from. Omit or null to start from the space root."),
 	depth: z.coerce.number().int().min(1).max(5).optional().describe("How many levels beneath the start point to eagerly include (default 2 once either field is set). Capped at 5."),
@@ -4726,6 +4745,17 @@ const ListEmbedLinksInputSchema = z.object({
 	type: EmbedTargetTypeSchema.optional().describe("Which kind of target the links point at. Omitting it returns links of every kind."),
 	typeId: z.string().min(1).optional().describe("The target's id, interpreted according to `type`.")
 }).optional().default({});
+const EmbedLinkAuditStatusSchema = z.enum([
+	"active",
+	"expired",
+	"revoked",
+	"all"
+]);
+const ListEmbedLinksPagedInputSchema = z.object({
+	status: EmbedLinkAuditStatusSchema.optional().default("active").describe("Filter the workspace audit to active, expired, revoked, or all embed links."),
+	limit: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Embed links per page. Capped at 100; continue with `cursor`."),
+	cursor: z.string().optional().describe("Opaque page cursor: pass back the `nextCursor` from the previous response. Do not construct or parse it.")
+});
 const RevokeEmbedLinkInputSchema = z.object({ id: z.string().min(1) });
 const EmbedLinkVOSchema = z.object({
 	id: z.string(),
@@ -4739,6 +4769,10 @@ const EmbedLinkVOSchema = z.object({
 	active: z.boolean(),
 	framePolicy: EmbedFramePolicyVOSchema
 });
+const EmbedLinksPageVOSchema = z.object({
+	items: z.array(EmbedLinkVOSchema),
+	nextCursor: z.string().nullable()
+});
 const CreatedEmbedLinkVOSchema = EmbedLinkVOSchema.extend({
 	url: z.string().url(),
 	iframeUrl: z.string().url()
@@ -5312,6 +5346,13 @@ const busabaseContractRoutes = {
 			summary: "List embed links the caller can manage",
 			successDescription: "Embed link metadata without capability secrets."
 		}).errors(embedLinkErrors).input(ListEmbedLinksInputSchema).output(z.array(EmbedLinkVOSchema)),
+		listPaged: oc.route({
+			method: "GET",
+			path: "/embed-links/paged",
+			tags: ["Embed Links"],
+			summary: "Audit workspace embed links with status filtering and keyset pagination",
+			successDescription: "A bounded page of manageable embed-link metadata without capability secrets."
+		}).errors(embedLinkErrors).input(ListEmbedLinksPagedInputSchema).output(EmbedLinksPageVOSchema),
 		revoke: oc.route({
 			method: "DELETE",
 			path: "/embed-links/{id}",
@@ -5492,6 +5533,13 @@ const busabaseContractRoutes = {
 			})).output(z.object({ removed: z.boolean() }))
 		},
 		share: {
+			list: oc.route({
+				method: "GET",
+				path: "/node-shares",
+				tags: ["Nodes", "Sharing"],
+				summary: "List every node in the space carrying its own live public share",
+				successDescription: "One row per node that someone explicitly published and that is still live — `scope: \"public\"` and unexpired — joined to just enough of the node (name, slug, type, icon) to render and open it. Rows the caller cannot see are omitted (same node-visibility ACL as `nodes.list`), and the stored share password is never returned, only a `hasPassword` flag. Deliberately does NOT include nodes that are merely reachable because an ANCESTOR is shared: this is the list of grants a person made, each revocable on its own with `nodes.share.disable`, which is the same set the workbench sidebar marks with a globe (`NodeVO.shared`)."
+			}).output(z.array(sharedNodeSchema)),
 			get: oc.route({
 				method: "GET",
 				path: "/nodes/{nodeId}/share",
@@ -6190,6 +6238,27 @@ var Busabase = class {
 			storageKey: upload.storageKey
 		});
 	}
+	/**
+	* Put a file into this Space's Asset library in one call, and get back every
+	* id the rest of the SDK asks for: `assetId` for a file-tree entry,
+	* `attachmentId` for a record's attachment cell, `url` to embed in Markdown.
+	*
+	* Hides the three-step flow (`assets.createUploadUrl` → PUT →
+	* `assets.confirm`) and its dedup short-circuit, the same way `putText`
+	* does for text slots.
+	*
+	* @example
+	* ```ts
+	* const shot = await bb.uploadAsset(png, {
+	*   fileName: "user-journey.png",
+	*   mimeType: "image/png",
+	* });
+	* body += `![user journey](${shot.url})`;
+	* ```
+	*/
+	uploadAsset(bytes, options) {
+		return uploadAsset(this.client, bytes, options, this.config.fetch ?? fetch);
+	}
 	/** Service health — reaches the server without requiring auth. */
 	health() {
 		return this.client.system.health();
@@ -6200,4 +6269,4 @@ var Busabase = class {
 	}
 };
 //#endregion
-export { Busabase, CREATABLE_NODE_TYPES, DEFAULT_BASE_URL, cloudContract, createBusabaseClient, getRecordByField, grepAssets, nodeWebUrl, normalizeBaseUrl, resolveConfig, toFilesOnlyGrepResult, toUnifiedFilesGrepInput };
+export { Busabase, CREATABLE_NODE_TYPES, DEFAULT_BASE_URL, cloudContract, createBusabaseClient, getRecordByField, grepAssets, hashBytes, nodeWebUrl, normalizeBaseUrl, resolveConfig, toFilesOnlyGrepResult, toUnifiedFilesGrepInput, uploadAsset };

package/dist/{template-D10kjpd-.js → template-DRMp6tKv.js}

@@ -1,4 +1,82 @@
 import { z } from "zod";
+//#region src/asset-upload.ts
+/**
+* SHA-256 of the bytes, or `undefined` where WebCrypto is unavailable.
+*
+* Undefined is a real answer, not a failure: the hash only buys deduplication,
+* so a runtime without WebCrypto uploads the bytes it would otherwise have
+* skipped. Failing the upload over a missing optimization would be worse.
+*/
+async function hashBytes(bytes) {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) return void 0;
+	const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+	const digest = await subtle.digest("SHA-256", buffer);
+	return `sha256:${Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+/**
+* Upload bytes and get back every id the rest of the SDK might need.
+*
+* @example
+* ```ts
+* const asset = await uploadAsset(client, png, {
+*   fileName: "user-journey.png",
+*   mimeType: "image/png",
+* });
+* // asset.assetId  -> reference it from a Skill/Drive/AirApp file operation
+* // asset.url      -> embed it in Markdown
+* ```
+*/
+async function uploadAsset(client, bytes, options, fetchImpl = fetch) {
+	const { fileName, mimeType, context, spaceId } = options;
+	if (!bytes.byteLength) throw new Error(`uploadAsset: ${fileName} is empty — there are no bytes to upload`);
+	const contentHash = await hashBytes(bytes);
+	const upload = await client.assets.createUploadUrl({
+		fileName,
+		mimeType,
+		sizeBytes: bytes.byteLength,
+		...context ? { context } : {},
+		...spaceId ? { spaceId } : {},
+		...contentHash ? { contentHash } : {}
+	});
+	if (upload.duplicate && upload.attachmentId) return {
+		...upload.assetId ? { assetId: upload.assetId } : {},
+		attachmentId: upload.attachmentId,
+		url: upload.publicUrl,
+		fileName,
+		mimeType,
+		size: bytes.byteLength,
+		...contentHash ? { contentHash } : {}
+	};
+	const response = await fetchImpl(upload.uploadUrl, {
+		method: "PUT",
+		headers: { "content-type": mimeType },
+		body: bytes
+	});
+	if (!response.ok) {
+		const detail = await response.text().catch(() => "");
+		throw new Error(`uploadAsset: presigned upload of ${fileName} failed (${response.status} ${response.statusText})${detail ? `: ${detail}` : ""}`);
+	}
+	const confirmed = await client.assets.confirm({
+		storageKey: upload.storageKey,
+		fileName,
+		mimeType,
+		sizeBytes: bytes.byteLength,
+		...context ? { context } : {},
+		...spaceId ? { spaceId } : {},
+		...contentHash ? { contentHash } : {}
+	});
+	return {
+		...confirmed.assetId ? { assetId: confirmed.assetId } : {},
+		attachmentId: confirmed.attachmentId,
+		url: confirmed.publicUrl,
+		fileName,
+		mimeType,
+		size: bytes.byteLength,
+		...contentHash ? { contentHash } : {}
+	};
+}
+//#endregion
 //#region ../../packages/busabase-contract/src/domains/skill/frontmatter.ts
 /**
 * `SKILL.md` frontmatter — the generic shape, independent of Busabase.
@@ -157,4 +235,4 @@ z.object({
 	["isTemplateSkill"]: z.literal(true)
 });
 //#endregion
-export { TemplateRiskLevelSchema as n, APP_ROOT_RESOURCE_KEY as t };
+export { uploadAsset as i, TemplateRiskLevelSchema as n, hashBytes as r, APP_ROOT_RESOURCE_KEY as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busabase-sdk",
-  "version": "0.70.0",
+  "version": "0.72.0",
   "description": "Typed TypeScript/JavaScript SDK for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server` (or Busabase Cloud).",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-sdk",
@@ -67,9 +67,9 @@
     "tsx": "^4.20.5",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
-    "busabase-contract": "0.70.0",
-    "openlib": "0.1.1",
-    "open-domains": "0.0.2"
+    "open-domains": "0.0.2",
+    "busabase-contract": "0.72.0",
+    "openlib": "0.1.1"
   },
   "engines": {
     "node": ">=24.18.0"