busabase-sdk 0.9.13 → 0.9.15

package/dist/index.js

@@ -44,8 +44,12 @@ var fieldTypeSchema = z.enum([
   "ai_tags",
   "code",
   "json",
-  "yaml"
+  "yaml",
+  "formula",
+  "lookup",
+  "whiteboard"
 ]);
+var lookupRollupSchema = z.enum(["values", "count", "sum", "average", "min", "max", "concatenate"]).default("values");
 var fieldOptionsSchema = z.object({
   ai: z.object({
     model: z.string().optional(),
@@ -75,7 +79,26 @@ var fieldOptionsSchema = z.object({
     height: z.number().int().positive().max(1200).optional(),
     providers: z.array(z.string()).optional()
   }).optional(),
+  // `formula` fields are server-computed (like the other computed types) from
+  // `expression` at record write time — see packages/busabase-core's
+  // domains/base/formula/ engine. `{slug}` references a sibling field, including
+  // another `formula` field (chained formulas) — a dependency graph orders
+  // computation and rejects cycles at field create/edit time.
+  formula: z.object({
+    expression: z.string().min(1)
+  }).optional(),
   inverseFieldId: z.string().optional(),
+  // `lookup` fields pull a field's values across a `relation` field on the same
+  // Base, optionally rolling them up into one scalar. Unlike every other computed
+  // type they are NOT stored on the commit: a lookup's value depends on OTHER
+  // records, which can change without this record ever being written, so it is
+  // resolved at read time (see busabase-core's domains/base/logic/lookup-values.ts).
+  lookup: z.object({
+    relationFieldSlug: z.string().min(1).describe("Slug of a `relation` field on THIS Base \u2014 the hop to follow."),
+    targetFieldSlug: z.string().min(1).describe("Slug of the field on the related Base whose values are pulled over."),
+    rollup: lookupRollupSchema.optional(),
+    limit: z.enum(["all", "first"]).optional().describe("`first` looks at only the first linked record; default `all`.")
+  }).optional(),
   multiple: z.boolean().optional(),
   // Display formatting for `number` columns (Notion-style: one number type,
   // a format option). `currency` renders via Intl.NumberFormat.
@@ -128,11 +151,11 @@ var createBaseInputSchema = z.object({
       options: fieldOptionsSchema.optional().default({})
     })
   ).default([]),
-  // Review-first by default: without `autoMerge: true`, this proposes the Base
-  // as a pending ChangeRequest (status "in_review") instead of creating it
-  // immediately. Pass `autoMerge: true` only for callers that don't need human
-  // review (seed/migration scripts, an explicit no-review agent task).
-  autoMerge: z.boolean().optional().default(false)
+  // Permission-aware default: omitted merges immediately if the actor has
+  // write access on the parent node, otherwise falls back to a pending
+  // ChangeRequest (status "in_review"). Pass explicit `autoMerge: false` to
+  // force review even with write access.
+  autoMerge: z.boolean().optional()
 });
 var createBaseFieldInputSchema = z.object({
   name: fieldNameSchema,
@@ -354,6 +377,15 @@ var folderNodeType = {
   operations: []
 };
 
+// ../../packages/busabase-contract/src/domains/form/definition.ts
+var formNodeType = {
+  type: "form",
+  label: "Form",
+  icon: "clipboard-list",
+  capabilities: { hasDetail: true, creatable: true },
+  operations: []
+};
+
 // ../../packages/busabase-contract/src/domains/html/definition.ts
 var htmlNodeType = {
   type: "html",
@@ -415,6 +447,7 @@ var BUILTIN_NODE_TYPES = [
   airappNodeType,
   fileNodeType,
   docNodeType,
+  formNodeType,
   whiteboardNodeType,
   workflowNodeType,
   htmlNodeType
@@ -476,6 +509,15 @@ var nodePrincipalSchema = z.object({
   createdAt: z.string(),
   updatedAt: z.string()
 });
+var nodeShareSchema = z.object({
+  nodeId: z.string(),
+  scope: z.enum(["none", "public"]),
+  capability: z.enum(["read", "submit"]),
+  // Derived from `passwordHash != null` — the hash itself is never serialized.
+  hasPassword: z.boolean(),
+  expiresAt: z.string().nullable(),
+  updatedAt: z.string()
+});
 var listNodesInputSchema = z.object({
   parentId: z.string().nullable().optional().describe("Node to start from. Omit or null to start from the space root."),
   depth: z.coerce.number().int().min(1).max(5).optional().describe(
@@ -762,8 +804,8 @@ var createNodeChangeRequestInputSchema = z.object({
     'Explanation shown to the human reviewer. Write a conventional-commit style subject \u2014 imperative verb + what + why, e.g. "Reorganize marketing docs under a Campaigns folder".'
   ),
   submittedBy: z.string().optional().default("local-producer"),
-  autoMerge: z.boolean().optional().default(false).describe(
-    "Whether to approve and merge this structural node change immediately. Defaults to false so node Change Request creation is review-first unless explicitly requested."
+  autoMerge: z.boolean().optional().describe(
+    "Whether to approve and merge this structural node change immediately. Omitted defaults to merging immediately if the actor has write access on every target node, otherwise falling back to a pending Change Request; pass explicit false to force review even with write access."
   ),
   operations: z.array(nodeOperationInputSchema).min(1)
 });
@@ -936,11 +978,11 @@ var createFileTreeInputSchema = z.object({
   visibility: z.enum(["private", "workspace", "public"]).optional().default("private"),
   version: z.string().optional().default("0.1.0"),
   files: z.array(z.union([assetFileInputSchema, textFileInputSchema])).optional().default([]),
-  // Review-first by default: without `autoMerge: true`, this proposes the node
-  // as a pending ChangeRequest (status "in_review") instead of creating it
-  // immediately. Pass `autoMerge: true` only for callers that don't need human
-  // review (seed/migration scripts, an explicit no-review agent task).
-  autoMerge: z.boolean().optional().default(false),
+  // Permission-aware default: omitted merges immediately if the actor has
+  // write access on the parent node, otherwise falls back to a pending
+  // ChangeRequest (status "in_review"). Pass explicit `autoMerge: false` to
+  // force review even with write access.
+  autoMerge: z.boolean().optional(),
   // "merge" (default): `files` is layered on top of the config's default seed
   // files by path — a caller supplying just a couple of extra files (e.g. a
   // Skill's own reference doc) still gets the default scaffold (SKILL.md,
@@ -1540,12 +1582,14 @@ var createChangeRequestInputSchema = z.object({
   idempotencyKey: z.string().optional().describe(
     "Optional client-supplied key that dedupes retries. Scoped per base + submitter: calling this endpoint again with the SAME idempotencyKey (e.g. after a timeout or a 5xx where you couldn't tell if the first call succeeded) returns the change request created by the first call instead of creating a duplicate. Omit for normal one-shot calls; only set it when you might retry."
   ),
-  // Review-first by default: without `autoMerge: true`, this proposes the record
-  // as a pending ChangeRequest (status "in_review") instead of creating it
-  // immediately. Pass `autoMerge: true` only for callers that don't need human
-  // review — approves and merges the change request right away, returning the
-  // materialized record instead of the pending ChangeRequest.
-  autoMerge: z.boolean().optional().default(false)
+  // Permission-aware default: omitted merges immediately if the actor has
+  // write access on the Base's node, otherwise falls back to a pending
+  // ChangeRequest (status "in_review"). Pass explicit `autoMerge: false` to
+  // force review even with write access; `autoMerge: true` approves and
+  // merges right away, returning the materialized record instead of the
+  // pending ChangeRequest (gracefully falls back to a pending CR if the
+  // actor doesn't actually have write access).
+  autoMerge: z.boolean().optional()
 });
 var createBulkChangeRequestInputSchema = z.object({
   records: z.array(z.record(z.string(), z.unknown())).min(1).max(1e3).describe(
@@ -1565,6 +1609,11 @@ var recordFieldFilterInputSchema = z.object({
   valueText: z.string().min(1),
   limit: z.coerce.number().int().min(1).max(100).optional().default(50)
 });
+var recordFieldGetInputSchema = z.object({
+  baseId: z.string(),
+  fieldSlug: z.string().min(1),
+  valueText: z.string().min(1)
+});
 var restoreRecordInputSchema = z.object({
   message: z.string().optional(),
   submittedBy: z.string().optional().default("local-editor")
@@ -1784,6 +1833,13 @@ var recordContract = {
     summary: "Filter records by field text",
     successDescription: "Canonical records matching a field text filter."
   }).input(recordFieldFilterInputSchema).output(z.array(recordSchema)),
+  getByField: oc.route({
+    method: "GET",
+    path: "/records/by-field",
+    tags: ["Records"],
+    summary: "Get record by field value",
+    successDescription: "Single canonical record whose field value exactly matches, or null when none does \u2014 a scoped point lookup (e.g. by a unique slug or path field), not a list."
+  }).input(recordFieldGetInputSchema).output(recordSchema.nullable()),
   updateChangeRequest: oc.route({
     method: "PUT",
     path: "/records/{recordId}/change-requests",
@@ -1863,11 +1919,11 @@ var createDocInputSchema = z.object({
   name: z.string().min(1),
   description: z.string().optional().default(""),
   body: z.string().optional().default(""),
-  // Review-first by default: without `autoMerge: true`, this proposes the Doc
-  // as a pending ChangeRequest (status "in_review") instead of creating it
-  // immediately. Pass `autoMerge: true` only for callers that don't need human
-  // review (seed/migration scripts, an explicit no-review agent task).
-  autoMerge: z.boolean().optional().default(false)
+  // Permission-aware default: omitted merges immediately if the actor has
+  // write access on the parent node, otherwise falls back to a pending
+  // ChangeRequest (status "in_review"). Pass explicit `autoMerge: false` to
+  // force review even with write access.
+  autoMerge: z.boolean().optional()
 });
 var updateDocInputSchema = z.object({
   body: z.string()
@@ -2073,11 +2129,11 @@ var createFileNodeInputSchema = z.object({
   name: z.string().min(1),
   description: z.string().optional().default(""),
   assetId: z.string().min(1),
-  // Review-first by default: without `autoMerge: true`, this proposes the File
-  // node as a pending ChangeRequest (status "in_review") instead of creating it
-  // immediately. Pass `autoMerge: true` only for callers that don't need human
-  // review (seed/migration scripts, an explicit no-review agent task).
-  autoMerge: z.boolean().optional().default(false)
+  // Permission-aware default: omitted merges immediately if the actor has
+  // write access on the parent node, otherwise falls back to a pending
+  // ChangeRequest (status "in_review"). Pass explicit `autoMerge: false` to
+  // force review even with write access.
+  autoMerge: z.boolean().optional()
 });
 var fileContract = {
   list: oc.route({
@@ -2127,6 +2183,102 @@ var folderContract = {
     successDescription: "Folder node and its direct children."
   }).input(z.object({ nodeId: z.string() })).output(folderSchema)
 };
+var FormFieldBindingSchema = z.object({
+  inputName: z.string().min(1),
+  fieldSlug: z.string().min(1),
+  required: z.boolean().optional(),
+  label: z.string().optional(),
+  help: z.string().optional()
+});
+var FormThemeSchema = z.object({
+  logoUrl: z.string().optional(),
+  coverUrl: z.string().optional(),
+  brandColor: z.string().optional(),
+  hideBranding: z.boolean().optional()
+});
+var FormPageSourceSchema = z.object({
+  code: z.string().optional(),
+  theme: FormThemeSchema.optional()
+});
+var FormShareSchema = z.object({
+  isPublic: z.boolean().default(false),
+  anonymousSubmit: z.boolean().default(false),
+  submitLimit: z.number().int().positive().optional(),
+  requireCaptcha: z.boolean().optional()
+});
+var FormVOSchema = z.object({
+  id: z.string(),
+  nodeId: z.string(),
+  spaceId: z.string(),
+  targetBaseId: z.string(),
+  name: z.string(),
+  description: z.string(),
+  bindings: z.array(FormFieldBindingSchema),
+  page: FormPageSourceSchema,
+  share: FormShareSchema,
+  /** Accepted submissions so far — backs server-side `share.submitLimit`. */
+  submissionCount: z.number().int().nonnegative().default(0),
+  status: z.enum(["active", "archived"]),
+  createdBy: z.string(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var CreateFormInputSchema = z.object({
+  nodeId: z.string().min(1),
+  targetBaseId: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional().default(""),
+  bindings: z.array(FormFieldBindingSchema).optional().default([]),
+  page: FormPageSourceSchema.optional().default({}),
+  share: FormShareSchema.optional().default({ isPublic: false, anonymousSubmit: false })
+});
+var UpdateFormInputSchema = z.object({
+  name: z.string().min(1).optional(),
+  description: z.string().optional(),
+  bindings: z.array(FormFieldBindingSchema).optional(),
+  page: FormPageSourceSchema.optional(),
+  share: FormShareSchema.optional()
+});
+var SubmitFormInputSchema = z.object({
+  values: z.record(z.string(), z.unknown()),
+  captchaToken: z.string().optional()
+});
+var FormSubmitResultSchema = z.object({
+  changeRequestId: z.string(),
+  status: z.literal("pending_review")
+});
+
+// ../../packages/busabase-contract/src/domains/form/contract.ts
+var formContract = {
+  getByNode: oc.route({
+    method: "GET",
+    path: "/forms/{nodeId}",
+    tags: ["Forms"],
+    summary: "Get a form by its node id",
+    successDescription: "The form bound to this node, or 404."
+  }).input(z.object({ nodeId: z.string() })).output(FormVOSchema),
+  create: oc.route({
+    method: "POST",
+    path: "/forms",
+    tags: ["Forms"],
+    summary: "Create a form bound to a Base",
+    successDescription: "The created form."
+  }).input(CreateFormInputSchema).output(FormVOSchema),
+  update: oc.route({
+    method: "PUT",
+    path: "/forms/{nodeId}",
+    tags: ["Forms"],
+    summary: "Update a form's config (owner-managed, not a change request)",
+    successDescription: "The updated form."
+  }).input(UpdateFormInputSchema.extend({ nodeId: z.string() })).output(FormVOSchema),
+  submit: oc.route({
+    method: "POST",
+    path: "/forms/{nodeId}/submit",
+    tags: ["Forms"],
+    summary: "Submit a filled-in form",
+    successDescription: "Creates an approval-first record-create ChangeRequest on the target Base."
+  }).input(SubmitFormInputSchema.extend({ nodeId: z.string() })).output(FormSubmitResultSchema)
+};
 var InstallPlanNodeTypeSchema = z.enum([
   "folder",
   "doc",
@@ -2824,6 +2976,37 @@ var busabaseContractRoutes = {
           principalId: z.string().min(1)
         })
       ).output(z.object({ removed: z.boolean() }))
+    },
+    share: {
+      get: oc.route({
+        method: "GET",
+        path: "/nodes/{nodeId}/share",
+        tags: ["Nodes", "Sharing"],
+        summary: "Read a node's public link-sharing settings",
+        successDescription: "The node's public-share settings, or null when the node was never shared. The stored password is never returned \u2014 only a `hasPassword` flag."
+      }).input(z.object({ nodeId: z.string() })).output(nodeShareSchema.nullable()),
+      set: oc.route({
+        method: "POST",
+        path: "/nodes/{nodeId}/share",
+        tags: ["Nodes", "Sharing"],
+        summary: "Enable or update a node's public link sharing",
+        successDescription: "Turned public sharing on (or updated its capability/password/expiry) and re-materialized the effective public scope down the subtree. Requires `manage` level on the node."
+      }).input(
+        z.object({
+          nodeId: z.string(),
+          scope: z.enum(["none", "public"]),
+          capability: z.enum(["read", "submit"]).optional(),
+          password: z.string().nullable().optional(),
+          expiresAt: z.string().datetime().nullable().optional()
+        })
+      ).output(nodeShareSchema.nullable()),
+      disable: oc.route({
+        method: "DELETE",
+        path: "/nodes/{nodeId}/share",
+        tags: ["Nodes", "Sharing"],
+        summary: "Revoke a node's public link sharing",
+        successDescription: "Flipped the share scope to none in place (the link is kept so re-enabling produces the same URL). Requires `manage` level on the node."
+      }).input(z.object({ nodeId: z.string() })).output(nodeShareSchema.nullable())
     }
   },
   auditEvents: {
@@ -2888,6 +3071,7 @@ var busabaseContractRoutes = {
   files: fileContract,
   docs: docContract,
   folders: folderContract,
+  forms: formContract,
   assets: assetsContract,
   vault: vaultContract,
   webhooks: webhookContract,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busabase-sdk",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "description": "Typed TypeScript/JavaScript SDK for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server` (or Busabase Cloud).",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-sdk",
@@ -42,8 +42,8 @@
     "typescript": "^5.9.3",
     "vitest": "^2.1.8",
     "open-domains": "0.0.2",
-    "openlib": "0.1.1",
-    "busabase-contract": "0.9.13"
+    "busabase-contract": "0.9.15",
+    "openlib": "0.1.1"
   },
   "engines": {
     "node": ">=24.18.0"