busabase-sdk 0.9.17 → 0.10.0

package/dist/index.d.ts

@@ -586,6 +586,10 @@ declare const cloudContract: {
                 name: z.ZodString;
                 slug: z.ZodNullable<z.ZodString>;
                 plan: z.ZodNullable<z.ZodString>;
+                nodeVisibilityMode: z.ZodOptional<z.ZodEnum<{
+                    open: "open";
+                    restricted: "restricted";
+                }>>;
             }, z.core.$strip>;
             user: z.ZodObject<{
                 id: z.ZodString;
@@ -603,6 +607,10 @@ declare const cloudContract: {
                 name: z.ZodString;
                 slug: z.ZodNullable<z.ZodString>;
                 plan: z.ZodNullable<z.ZodString>;
+                nodeVisibilityMode: z.ZodOptional<z.ZodEnum<{
+                    open: "open";
+                    restricted: "restricted";
+                }>>;
             }, z.core.$strip>>;
             createdSpace: z.ZodOptional<z.ZodBoolean>;
             bootstrapRequired: z.ZodOptional<z.ZodBoolean>;
@@ -23445,8 +23453,11 @@ interface BusabaseConfig {
      */
     baseUrl?: string;
     /**
-     * Bearer token. Only Busabase Cloud requires it; a local OSS server is open.
-     * Falls back to `BUSABASE_API_KEY`.
+     * Bearer token. Falls back to `BUSABASE_API_KEY`. Omit it in the two cases
+     * where the server authenticates you some other way: a local OSS server
+     * (`apps/busabase`) is open, and a *same-origin browser* call (e.g. from an
+     * AirApp running inside Busabase) authenticates as the logged-in user via
+     * the ambient session cookie.
      */
     apiKey?: string;
     /**
@@ -23484,43 +23495,25 @@ declare function resolveConfig(config?: BusabaseConfig): ResolvedConfig;
  * Config fields default from `BUSABASE_BASE_URL` / `BUSABASE_API_KEY` /
  * `BUSABASE_SPACE_ID` when omitted.
  *
+ * This is the *only* client the SDK ships. Browser code (an AirApp) and
+ * server/CLI code use the same one — they differ only in where `baseUrl` and
+ * the credential come from: an AirApp running inside Busabase passes
+ * `baseUrl: window.location.origin` and no key (the ambient session cookie
+ * authenticates it), while the same app run locally against a dev server
+ * passes that server's URL and, for Busabase Cloud, an API key.
+ *
  * @example
  * ```ts
+ * // Server / CLI, against Busabase Cloud:
  * const client = createBusabaseClient({ apiKey: process.env.BUSABASE_API_KEY });
  * const bases = await client.bases.list();
  * const record = await client.records.get({ recordId });
+ *
+ * // Browser (AirApp), same-origin — no key, the session cookie authenticates:
+ * const client = createBusabaseClient({ baseUrl: window.location.origin });
  * ```
  */
 declare function createBusabaseClient(config?: BusabaseConfig): BusabaseClient;
-/** Options for {@link createBusabaseRpcClient}. No `apiKey`/`spaceId` — this
- * transport authenticates purely via the browser's ambient session cookie. */
-interface BusabaseRpcConfig {
-    /**
-     * Path to the internal RPC endpoint: either a full URL, or a path resolved
-     * against `window.location.origin` (browser only — there is no ambient
-     * session outside one).
-     *
-     * **The default (`/api/rpc`) only matches `apps/busabase` (the OSS app)**,
-     * which mounts busabase's procedures unnamespaced. `apps/busabase-cloud`
-     * mounts the *same* procedures under a `core` prefix instead — pass
-     * `apiBasePath: "/api/rpc/core"` there, or this client will 404 on every
-     * call. There is no single default that works for both; which one you're
-     * targeting is something the caller has to know (this SDK doesn't probe
-     * for it).
-     *
-     * From inside an AirApp running via Nodepod, prepend
-     * `/__busabase_api__` to whichever of the above applies, to route through
-     * the service-worker bridge instead of the sandboxed virtual server — e.g.
-     * `/__busabase_api__/api/rpc/core` for busabase-cloud. See
-     * apps/busabase/docs/node-types.md.
-     */
-    apiBasePath?: string;
-    /** Extra headers merged into every request. Static object or a (possibly async) factory. */
-    headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);
-    /** Custom `fetch` implementation (e.g. a proxy-aware or instrumented fetch). */
-    fetch?: typeof fetch;
-}
-declare function createBusabaseRpcClient(config?: BusabaseRpcConfig): BusabaseClient;
 
 /**
  * Attachments — DTO/VO Zod schemas + inferred types (the contract's type source
@@ -25834,4 +25827,4 @@ declare class Busabase {
     }>>>>;
 }
 
-export { type ActivityItemVO, type AgentTaskVO, type FileTreeFileVO as AirAppFileVO, type FileTreeReadFileVO as AirAppReadFileVO, type FileTreeNodeVO as AirAppVO, type AssetAttachmentRef, type AssetDetailVO, type AssetTextStatus, type AssetUsageVO, type AssetVO, type AttachmentRef, type AuditAction, type AuditEventVO, type BaseFieldVO, type BaseVO, Busabase, type BusabaseClient, type BusabaseConfig, type BusabaseRpcConfig, CREATABLE_NODE_TYPES, type ChangeRequestBatchResultVO, type ChangeRequestCountsVO, type ChangeRequestStatus, type ChangeRequestTargetType, type ChangeRequestVO, type CloudContract, type CommentSubjectType, type CommentVO, type CommitVO, type CreatableNodeType, type CreateFormDTO, DEFAULT_BASE_URL, type FileTreeFileVO as DriveFileVO, type FileTreeReadFileVO as DriveReadFileVO, type FileTreeNodeVO as DriveVO, type FieldType, type FileNodeMetadata, type FileNodeVO, type FileTreeFileVO, type FileTreeNodeVO, type FileTreeReadFileVO, type FormFieldBindingVO, type FormPageSourceVO, type FormShareVO, type FormSubmitResultVO, type FormThemeVO, type FormVO, type GalleryCardSize, type GalleryCoverFit, type GanttScale, type LookupRollup, type NodeSearchResultVO, type NodeType, type NodeVO, type OperationKind, type OperationStatus, type OperationVO, type RecordLinkVO, type RecordVO, type ResolvedConfig, type ReviewVO, type ReviewVerdict, type SearchResponseVO, type SearchResultKind, type SearchResultVO, type FileTreeFileVO as SkillFileVO, type FileTreeReadFileVO as SkillReadFileVO, type FileTreeNodeVO as SkillVO, type SubmitFormDTO, type UpdateFormDTO, type UpdateVaultSettingsDTO, type UserRefVO, VIEW_FIELD_MAX_WIDTH, VIEW_FIELD_MIN_WIDTH, type VaultAccessPolicy, type VaultEnvironment, type VaultItemInput, type VaultItemKind, type VaultItemVO, type VaultRuntimeEnv, type VaultScopeType, type VaultSettingsVO, type ViewConfigVO, type ViewFilterOperator, type ViewFilterVO, type ViewSortVO, type ViewType, type ViewVO, cloudContract, createBusabaseClient, createBusabaseRpcClient, normalizeBaseUrl, resolveConfig };
+export { type ActivityItemVO, type AgentTaskVO, type FileTreeFileVO as AirAppFileVO, type FileTreeReadFileVO as AirAppReadFileVO, type FileTreeNodeVO as AirAppVO, type AssetAttachmentRef, type AssetDetailVO, type AssetTextStatus, type AssetUsageVO, type AssetVO, type AttachmentRef, type AuditAction, type AuditEventVO, type BaseFieldVO, type BaseVO, Busabase, type BusabaseClient, type BusabaseConfig, CREATABLE_NODE_TYPES, type ChangeRequestBatchResultVO, type ChangeRequestCountsVO, type ChangeRequestStatus, type ChangeRequestTargetType, type ChangeRequestVO, type CloudContract, type CommentSubjectType, type CommentVO, type CommitVO, type CreatableNodeType, type CreateFormDTO, DEFAULT_BASE_URL, type FileTreeFileVO as DriveFileVO, type FileTreeReadFileVO as DriveReadFileVO, type FileTreeNodeVO as DriveVO, type FieldType, type FileNodeMetadata, type FileNodeVO, type FileTreeFileVO, type FileTreeNodeVO, type FileTreeReadFileVO, type FormFieldBindingVO, type FormPageSourceVO, type FormShareVO, type FormSubmitResultVO, type FormThemeVO, type FormVO, type GalleryCardSize, type GalleryCoverFit, type GanttScale, type LookupRollup, type NodeSearchResultVO, type NodeType, type NodeVO, type OperationKind, type OperationStatus, type OperationVO, type RecordLinkVO, type RecordVO, type ResolvedConfig, type ReviewVO, type ReviewVerdict, type SearchResponseVO, type SearchResultKind, type SearchResultVO, type FileTreeFileVO as SkillFileVO, type FileTreeReadFileVO as SkillReadFileVO, type FileTreeNodeVO as SkillVO, type SubmitFormDTO, type UpdateFormDTO, type UpdateVaultSettingsDTO, type UserRefVO, VIEW_FIELD_MAX_WIDTH, VIEW_FIELD_MIN_WIDTH, type VaultAccessPolicy, type VaultEnvironment, type VaultItemInput, type VaultItemKind, type VaultItemVO, type VaultRuntimeEnv, type VaultScopeType, type VaultSettingsVO, type ViewConfigVO, type ViewFilterOperator, type ViewFilterVO, type ViewSortVO, type ViewType, type ViewVO, cloudContract, createBusabaseClient, normalizeBaseUrl, resolveConfig };

package/dist/index.js

@@ -1,7 +1,6 @@
 import { createORPCClient, ORPCError } from '@orpc/client';
-import { RPCLink } from '@orpc/client/fetch';
-import { oc, eventIterator, inferRPCMethodFromContractRouter } from '@orpc/contract';
 import { OpenAPILink } from '@orpc/openapi-client/fetch';
+import { oc, eventIterator } from '@orpc/contract';
 import { z } from 'zod';
 
 // src/client.ts
@@ -890,7 +889,23 @@ var authSpaceSchema = z.object({
   id: z.string(),
   name: z.string(),
   slug: z.string().nullable(),
-  plan: z.string().nullable()
+  plan: z.string().nullable(),
+  /**
+   * The space's DEFAULT content visibility for its members — the same
+   * `spaces.nodeVisibilityMode` the cloud dashboard reads. `"open"` = a node
+   * with no explicit visibility anywhere in its ancestor chain is visible to
+   * every member; `"restricted"` = such a node is hidden from non-managers
+   * until it is explicitly opened (per-node visibility or a grant).
+   *
+   * Clients need it to describe a node's EFFECTIVE access truthfully ("everyone
+   * in this space can see this" is a lie in a restricted space) and to decide
+   * whether per-node grants are meaningful to show at all.
+   *
+   * OPTIONAL on purpose: it was added after this VO shipped, so an older server
+   * (or a host that doesn't model a space default at all) simply omits it.
+   * Treat an absent value as `"open"` — the historical behaviour.
+   */
+  nodeVisibilityMode: z.enum(["open", "restricted"]).optional()
 });
 var authUserSchema = z.object({
   id: z.string(),
@@ -3062,6 +3077,9 @@ var busabaseContractRoutes = {
   live: {
     // RPC-only by design: no `.route(...)`, so OpenAPI generation and MCP tool
     // discovery skip this long-lived Event Iterator while `/api/rpc` stays typed.
+    // (MCP discovery only skips it because `discoverOpenApiTools` now requires a
+    // route with a method or path — omitting `.route()` still leaves `route: {}`,
+    // which is truthy, and that used to publish this as a callable REST tool.)
     subscribe: oc.output(eventIterator(liveEventSchema))
   },
   bases: baseContract,
@@ -3481,26 +3499,6 @@ function createBusabaseClient(config = {}) {
   });
   return createORPCClient(link);
 }
-var getBrowserWindow = () => globalThis.window;
-function createBusabaseRpcClient(config = {}) {
-  const apiBasePath = config.apiBasePath ?? "/api/rpc";
-  const isAbsolute = /^https?:\/\//.test(apiBasePath);
-  if (!isAbsolute && typeof getBrowserWindow() === "undefined") {
-    throw new Error(
-      "createBusabaseRpcClient: apiBasePath must be an absolute URL (http:// or https://) outside a browser \u2014 this client authenticates via the browser's ambient session cookie, which only exists client-side."
-    );
-  }
-  const link = new RPCLink({
-    method: inferRPCMethodFromContractRouter(cloudContract),
-    url: () => isAbsolute ? apiBasePath : `${getBrowserWindow()?.location.origin}${apiBasePath}`,
-    fetch: config.fetch,
-    headers: async () => {
-      const extra = typeof config.headers === "function" ? await config.headers() : config.headers;
-      return { ...extra };
-    }
-  });
-  return createORPCClient(link);
-}
 
 // src/index.ts
 var Busabase = class {
@@ -3630,4 +3628,4 @@ var Busabase = class {
   }
 };
 
-export { Busabase, CREATABLE_NODE_TYPES, DEFAULT_BASE_URL, cloudContract, createBusabaseClient, createBusabaseRpcClient, normalizeBaseUrl, resolveConfig };
+export { Busabase, CREATABLE_NODE_TYPES, DEFAULT_BASE_URL, cloudContract, createBusabaseClient, normalizeBaseUrl, resolveConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busabase-sdk",
-  "version": "0.9.17",
+  "version": "0.10.0",
   "description": "Typed TypeScript/JavaScript SDK for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server` (or Busabase Cloud).",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-sdk",
@@ -41,8 +41,8 @@
     "tsx": "^4.20.5",
     "typescript": "^5.9.3",
     "vitest": "^2.1.8",
-    "busabase-contract": "0.9.17",
     "openlib": "0.1.1",
+    "busabase-contract": "0.10.0",
     "open-domains": "0.0.2"
   },
   "engines": {