@buildinternet/releases-api-types 0.58.3 → 0.60.0

package/src/schemas/stats.ts

@@ -1,62 +0,0 @@
-import { z } from "zod";
-import { StatsSchema } from "./shared.js";
-
-/**
- * Per-source activity row in `GET /v1/stats`. `orgName` is nullable because
- * the source-to-org JOIN is left-joined (legacy orphan sources still exist).
- */
-export const StatsSourceActivitySchema = z.object({
-  sourceName: z.string(),
-  sourceSlug: z.string(),
-  sourceType: z.string(),
-  orgName: z.string().nullable(),
-  lastFetchedAt: z.string().nullable(),
-  totalReleases: z.number(),
-  recentReleases: z.number(),
-});
-
-/**
- * Recent fetch-log row, joined with source + org for display. `durationMs`
- * and `error` are nullable on the underlying table; `orgName` is nullable
- * for the same orphan-source reason as above.
- */
-export const StatsRecentActivitySchema = z.object({
-  sourceName: z.string(),
-  sourceSlug: z.string(),
-  orgName: z.string().nullable(),
-  releasesFound: z.number(),
-  releasesInserted: z.number(),
-  totalReleases: z.number(),
-  status: z.string(),
-  durationMs: z.number().nullable(),
-  error: z.string().nullable(),
-  createdAt: z.string(),
-});
-
-/**
- * Response shape for `GET /v1/stats`. The handler returns a hybrid payload —
- * the flat `Stats` counts (legacy `orgs/sources/releases/products` fields used
- * by the web homepage banner) merged with the richer `StatsSummary` shape
- * (period window + totals + sourceHealth + sourceActivity + recentActivity).
- * Modelled with `z.object` over the union of both shapes; consumers may
- * pick either subset.
- */
-export const StatsResponseSchema = StatsSchema.extend({
-  period: z.object({
-    days: z.number().int().min(1),
-    cutoff: z.string(),
-  }),
-  totals: z.object({
-    organizations: z.number().int().min(0),
-    sources: z.number().int().min(0),
-    releases: z.number().int().min(0),
-    releasesInPeriod: z.number().int().min(0),
-  }),
-  sourceHealth: z.object({
-    upToDate: z.number().int().min(0),
-    stale: z.number().int().min(0),
-    neverFetched: z.number().int().min(0),
-  }),
-  sourceActivity: z.array(StatsSourceActivitySchema),
-  recentActivity: z.array(StatsRecentActivitySchema),
-});

package/src/schemas/well-known.test.ts

@@ -1,264 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import {
-  ReleasesJsonConfigSchema,
-  ReleasesJsonDomainSchema,
-  ReleasesJsonRepoSchema,
-} from "./well-known.js";
-
-const location = (n: number) => ({ url: `https://acme.com/releases/${n}` });
-
-describe("releases.json v2 schemas", () => {
-  it("accepts the minimal domain manifest", () => {
-    expect(
-      ReleasesJsonDomainSchema.parse({
-        version: 2,
-        releases: [{ url: "https://acme.com/updates", feed: "https://acme.com/updates.xml" }],
-      }),
-    ).toEqual({
-      version: 2,
-      releases: [{ url: "https://acme.com/updates", feed: "https://acme.com/updates.xml" }],
-    });
-  });
-
-  it("accepts the full domain shape with advisory taxonomy", () => {
-    const parsed = ReleasesJsonDomainSchema.parse({
-      $schema: "https://releases.sh/schemas/releases.json",
-      version: 2,
-      name: "Acme",
-      description: "CI for teams.",
-      category: "future-category",
-      avatar: "https://acme.com/logo.png",
-      tags: ["future-tag"],
-      social: { twitter: "acmehq", github: "acme" },
-      products: [
-        {
-          name: "Acme Cloud",
-          slug: "acme-cloud",
-          kind: "future-kind",
-          category: "future-category",
-          description: "Managed CI runners.",
-          website: "https://acme.com/cloud",
-          docs: "https://docs.acme.com/cloud",
-          support: "https://acme.com/support",
-          social: { twitter: "acmecloud" },
-          tags: ["ci", "cloud"],
-          archived: true,
-          releases: [{ github: "acme/cloud", canonical: true }],
-        },
-      ],
-      registries: {
-        "releases.sh": {
-          org: "org_abc123",
-          verification: "verification-token",
-          futureKey: true,
-        },
-        "example.com": { anything: "goes" },
-      },
-    });
-
-    expect(parsed.products?.[0]?.kind).toBe("future-kind");
-    expect(parsed.products?.[0]?.tags).toEqual(["ci", "cloud"]);
-    expect(parsed.registries?.["example.com"]).toEqual({ anything: "goes" });
-  });
-
-  it("accepts product-level tags and enforces the same bounds as org tags", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        products: [{ name: "Cloud", tags: ["analytics", "sdk"] }],
-      }).success,
-    ).toBe(true);
-    // too many tags (> 50)
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        products: [{ name: "Cloud", tags: Array.from({ length: 51 }, (_, i) => `tag-${i}`) }],
-      }).success,
-    ).toBe(false);
-    // empty tag string
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        products: [{ name: "Cloud", tags: [""] }],
-      }).success,
-    ).toBe(false);
-  });
-
-  it("accepts the repo variant including github self", () => {
-    expect(
-      ReleasesJsonRepoSchema.safeParse({
-        version: 2,
-        product: { name: "Acme Cloud", slug: "acme-cloud" },
-        releases: [{ github: "self", canonical: true }],
-        registries: { "releases.sh": { product: "prd_abc123" } },
-      }).success,
-    ).toBe(true);
-  });
-
-  it("requires https for locator URLs and avatar", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, releases: [{ url: "https://acme.com/x" }] })
-        .success,
-    ).toBe(true);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, releases: [{ url: "http://acme.com/x" }] })
-        .success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, avatar: "http://acme.com/logo.png" })
-        .success,
-    ).toBe(false);
-  });
-
-  it("requires the version 2 literal with no v1 compatibility", () => {
-    expect(ReleasesJsonConfigSchema.safeParse({ releases: [location(1)] }).success).toBe(false);
-    expect(ReleasesJsonConfigSchema.safeParse({ version: 1 }).success).toBe(false);
-    expect(ReleasesJsonConfigSchema.safeParse({ version: 3 }).success).toBe(false);
-  });
-
-  it("requires at least one locator per release location", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, releases: [{ title: "Updates" }] }).success,
-    ).toBe(false);
-  });
-
-  it("accepts a push-publish locator on github + path", () => {
-    expect(
-      ReleasesJsonDomainSchema.parse({
-        version: 2,
-        releases: [
-          { github: "acme/docs", path: "changelog/**/*.mdx", publish: "push", title: "Docs" },
-        ],
-      }),
-    ).toEqual({
-      version: 2,
-      releases: [
-        { github: "acme/docs", path: "changelog/**/*.mdx", publish: "push", title: "Docs" },
-      ],
-    });
-    expect(
-      ReleasesJsonRepoSchema.safeParse({
-        version: 2,
-        releases: [{ github: "self", path: "CHANGELOG.md", publish: "push" }],
-      }).success,
-    ).toBe(true);
-  });
-
-  it("rejects an incomplete or unsafe push-publish locator", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [{ github: "acme/docs", publish: "push" }],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [{ path: "CHANGELOG.md", publish: "push" }],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [{ github: "acme/docs", path: "CHANGELOG.md" }],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [{ github: "acme/docs", path: "CHANGELOG.md", publish: "poll" }],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [{ github: "acme/docs", path: "../secrets", publish: "push" }],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [{ github: "acme/docs", path: "/etc/passwd", publish: "push" }],
-      }).success,
-    ).toBe(false);
-  });
-
-  it("allows github self only in repo files", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, releases: [{ github: "self" }] }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonRepoSchema.safeParse({ version: 2, releases: [{ github: "self" }] }).success,
-    ).toBe(true);
-  });
-
-  it("enforces product and release-location caps", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        products: Array.from({ length: 25 }, (_, i) => ({ name: `Product ${i}` })),
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        products: [{ name: "Cloud", releases: Array.from({ length: 9 }, (_, i) => location(i)) }],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: Array.from({ length: 33 }, (_, i) => location(i)),
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: Array.from({ length: 25 }, (_, i) => location(i)),
-        products: [
-          { name: "Cloud", releases: Array.from({ length: 8 }, (_, i) => location(i + 25)) },
-        ],
-      }).success,
-    ).toBe(false);
-  });
-
-  it("allows at most one canonical location per scope", () => {
-    const canonical = (n: number) => ({ ...location(n), canonical: true });
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        releases: [canonical(1), canonical(2)],
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        products: [{ name: "Cloud", releases: [canonical(1), canonical(2)] }],
-      }).success,
-    ).toBe(false);
-  });
-
-  it("rejects removed v1 identity fields", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, website: "https://acme.com" }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonDomainSchema.safeParse({ version: 2, notice: { message: "Moved" } }).success,
-    ).toBe(false);
-  });
-
-  it("requires typed stable ids for the releases.sh registry", () => {
-    expect(
-      ReleasesJsonDomainSchema.safeParse({
-        version: 2,
-        registries: { "releases.sh": { org: "prd_wrong" } },
-      }).success,
-    ).toBe(false);
-    expect(
-      ReleasesJsonRepoSchema.safeParse({
-        version: 2,
-        registries: { "releases.sh": { product: "org_wrong" } },
-      }).success,
-    ).toBe(false);
-  });
-});

package/src/schemas/well-known.ts

@@ -1,252 +0,0 @@
-import { z } from "zod";
-
-const MAX_PRODUCTS = 24;
-const MAX_PRODUCT_RELEASES = 8;
-const MAX_FILE_RELEASES = 32;
-
-/** A single social handle/URL. Bare handles are intentionally accepted. */
-const SocialValueSchema = z.string().min(1).max(200);
-const SocialSchema = z.record(z.string().min(1).max(40), SocialValueSchema);
-
-// `z.url().startsWith(...)` keeps the runtime URL + https check AND serializes to
-// JSON Schema as `format: "uri"` + `pattern: "^https://"` — so the generated
-// public schema rejects non-https schemes too (a plain `.refine()` would be
-// silently dropped by z.toJSONSchema).
-const HttpsUrlSchema = z.url().startsWith("https://", "locator must be an https URL");
-
-/** Shared tag-array bounds — kept identical for org-level and product-level tags. */
-const TagsSchema = z.array(z.string().min(1).max(60)).max(50);
-
-/**
- * Changelog file or glob inside the declared repo (Action `changelog-path` /
- * `changelog-glob`). Relative only — no scheme, no leading slash, no `..`.
- */
-const PublishPathSchema = z
-  .string()
-  .min(1)
-  .max(200)
-  .regex(
-    /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._~@%+\-/*?[\]{}]+$/,
-    "path must be a relative changelog file or glob",
-  );
-
-const ReleaseLocationFields = {
-  url: HttpsUrlSchema.optional(),
-  feed: HttpsUrlSchema.optional(),
-  appstore: HttpsUrlSchema.optional(),
-  file: HttpsUrlSchema.optional(),
-  title: z.string().min(1).max(200).optional(),
-  canonical: z.boolean().optional(),
-  /**
-   * `"push"` means the owner publishes this changelog (GitHub Action / publish
-   * token) instead of us polling it. Requires `github` + `path`.
-   */
-  publish: z.literal("push").optional(),
-  /** Required with `publish: "push"`. The file or glob the Action watches. */
-  path: PublishPathSchema.optional(),
-};
-
-function hasLocator(value: {
-  url?: string;
-  feed?: string;
-  github?: string;
-  appstore?: string;
-  file?: string;
-}): boolean {
-  return Boolean(value.url || value.feed || value.github || value.appstore || value.file);
-}
-
-/** `publish: "push"` is a mode on a github locator, not a locator by itself. */
-function pushPublishComplete(value: { github?: string; publish?: "push"; path?: string }): boolean {
-  if (value.publish === "push") return Boolean(value.github && value.path);
-  return value.path === undefined;
-}
-
-/** A domain manifest can name a concrete GitHub repository, but never `self`. */
-export const ReleasesJsonDomainReleaseSchema = z
-  .strictObject({
-    ...ReleaseLocationFields,
-    github: z
-      .string()
-      .regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, "github must be owner/repo")
-      .optional(),
-  })
-  .refine(hasLocator, "at least one release locator is required")
-  .refine(
-    pushPublishComplete,
-    'publish: "push" requires github (owner/repo) and path (changelog file or glob)',
-  );
-
-/** A repo manifest additionally accepts `github: "self"`. */
-export const ReleasesJsonRepoReleaseSchema = z
-  .strictObject({
-    ...ReleaseLocationFields,
-    github: z
-      .union([
-        z.literal("self"),
-        z.string().regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, "github must be owner/repo"),
-      ])
-      .optional(),
-  })
-  .refine(hasLocator, "at least one release locator is required")
-  .refine(
-    pushPublishComplete,
-    'publish: "push" requires github (owner/repo or "self") and path (changelog file or glob)',
-  );
-
-function releasesArray<T extends z.ZodType>(item: T, max: number) {
-  return z
-    .array(item)
-    .max(max)
-    .refine(
-      (items) =>
-        items.filter((entry) => Boolean((entry as { canonical?: boolean }).canonical)).length <= 1,
-      "at most one canonical release location is allowed per scope",
-    );
-}
-
-const DomainProductReleasesSchema = releasesArray(
-  ReleasesJsonDomainReleaseSchema,
-  MAX_PRODUCT_RELEASES,
-);
-const RepoReleasesSchema = releasesArray(ReleasesJsonRepoReleaseSchema, MAX_FILE_RELEASES);
-const DomainReleasesSchema = releasesArray(ReleasesJsonDomainReleaseSchema, MAX_FILE_RELEASES);
-
-/**
- * Product declaration in a domain manifest. Taxonomy strings are deliberately
- * lenient here; the reconciler resolves known values and ignores the rest.
- */
-export const ReleasesJsonProductSchema = z.strictObject({
-  name: z.string().min(1).max(120),
-  slug: z.string().min(1).max(120).optional(),
-  kind: z.string().min(1).max(120).optional(),
-  category: z.string().min(1).max(120).optional(),
-  description: z.string().max(2000).optional(),
-  website: z.url().optional(),
-  docs: z.url().optional(),
-  support: z.url().optional(),
-  social: SocialSchema.optional(),
-  tags: TagsSchema.optional(),
-  archived: z.boolean().optional(),
-  releases: DomainProductReleasesSchema.optional(),
-});
-
-/** Repo-scope product binding. Slug is only a creation suggestion. */
-export const ReleasesJsonRepoProductSchema = z.strictObject({
-  name: z.string().min(1).max(120),
-  slug: z.string().min(1).max(120).optional(),
-});
-
-const ReleasesRegistrySchema = z
-  .object({
-    org: z
-      .string()
-      .regex(/^org_[A-Za-z0-9]+$/)
-      .optional(),
-    product: z
-      .string()
-      .regex(/^prd_[A-Za-z0-9]+$/)
-      .optional(),
-    verification: z.string().min(1).max(500).optional(),
-  })
-  .catchall(z.unknown());
-
-/** Registry-specific extensions are forward-compatible by design. */
-export const ReleasesJsonRegistriesSchema = z
-  .object({
-    "releases.sh": ReleasesRegistrySchema.optional(),
-  })
-  .catchall(z.unknown());
-
-/** Top-level fields shared by every manifest scope. */
-const BaseFields = {
-  $schema: z.url().optional(),
-  version: z.literal(2),
-  registries: ReleasesJsonRegistriesSchema.optional(),
-};
-
-const CommonFields = {
-  ...BaseFields,
-  releases: DomainReleasesSchema.optional(),
-};
-
-/** Domain-hosted variant: flat org identity plus product and release declarations. */
-export const ReleasesJsonDomainSchema = z
-  .strictObject({
-    ...CommonFields,
-    name: z.string().min(1).max(120).optional(),
-    description: z.string().max(2000).optional(),
-    category: z.string().min(1).max(120).optional(),
-    avatar: HttpsUrlSchema.optional(),
-    tags: TagsSchema.optional(),
-    social: SocialSchema.optional(),
-    products: z.array(ReleasesJsonProductSchema).max(MAX_PRODUCTS).optional(),
-  })
-  .refine(
-    (manifest) =>
-      (manifest.releases?.length ?? 0) +
-        (manifest.products?.reduce((sum, product) => sum + (product.releases?.length ?? 0), 0) ??
-          0) <=
-      MAX_FILE_RELEASES,
-    `at most ${MAX_FILE_RELEASES} release locations are allowed per file`,
-  );
-
-/** Repo-root variant: product binding plus repo-scoped release declarations. */
-export const ReleasesJsonRepoSchema = z.strictObject({
-  ...BaseFields,
-  product: ReleasesJsonRepoProductSchema.optional(),
-  releases: RepoReleasesSchema.optional(),
-});
-
-/** Public schema accepts either hosting scope; reconcilers use the scoped schema. */
-export const ReleasesJsonConfigSchema = z.union([ReleasesJsonDomainSchema, ReleasesJsonRepoSchema]);
-
-export type ReleasesJsonConfig = z.infer<typeof ReleasesJsonConfigSchema>;
-export type ReleasesJsonDomain = z.infer<typeof ReleasesJsonDomainSchema>;
-export type ReleasesJsonRepo = z.infer<typeof ReleasesJsonRepoSchema>;
-export type ReleasesJsonProduct = z.infer<typeof ReleasesJsonProductSchema>;
-export type ReleasesJsonDomainRelease = z.infer<typeof ReleasesJsonDomainReleaseSchema>;
-export type ReleasesJsonRepoRelease = z.infer<typeof ReleasesJsonRepoReleaseSchema>;
-
-/**
- * Body for `POST /v1/orgs/stub` — curator-authored stub org (#1947). Mirrors
- * the domain-manifest identity + product + locator shape (so a curator can hand
- * the same declaration a manifest would carry), minus manifest-transport fields
- * (`version`/`$schema`/`registries`) and plus the registry-identity fields a
- * stub org needs to be resolvable (`slug`/`domain`). Locators are optional — an
- * identity-only stub (locations TBD) is valid. `category`/taxonomy strings stay
- * lenient; the route resolves them and ignores the rest, same as the reconciler.
- */
-export const CreateStubOrgBodySchema = z.strictObject({
-  name: z.string().min(1).max(120),
-  slug: z.string().min(1).max(120).optional(),
-  domain: z.string().min(1).max(255).optional(),
-  description: z.string().max(2000).optional(),
-  category: z.string().min(1).max(120).optional(),
-  avatar: HttpsUrlSchema.optional(),
-  tags: TagsSchema.optional(),
-  social: SocialSchema.optional(),
-  products: z.array(ReleasesJsonProductSchema).max(MAX_PRODUCTS).optional(),
-  releases: DomainReleasesSchema.optional(),
-});
-
-export type CreateStubOrgBody = z.infer<typeof CreateStubOrgBodySchema>;
-
-/**
- * Body for `POST /v1/orgs/stub-from-domain` (#1947) — the unlisted-domain path.
- * The worker fetches https://{domain}/.well-known/releases.json and, if valid
- * and the domain has no org yet, creates a stub org + declared locators.
- */
-export const StubFromDomainBodySchema = z.strictObject({
-  domain: z.string().min(1).max(255),
-});
-
-export type StubFromDomainBody = z.infer<typeof StubFromDomainBodySchema>;
-
-/** Response shape of POST /v1/orgs/:slug/sync-well-known. */
-export const SyncWellKnownResponseSchema = z.object({
-  fetched: z.boolean(),
-  applied: z.boolean(),
-  skippedReason: z.string().optional(),
-  plan: z.unknown().optional(),
-});

package/src/schemas/workspace-integrations.ts

@@ -1,26 +0,0 @@
-import { z } from "zod";
-
-export const UploadsIntegrationStatusSchema = z.object({
-  provider: z.literal("uploads"),
-  connected: z.boolean(),
-  /** False when the token-encryption key is missing. */
-  configured: z.boolean(),
-  connectedAt: z.string().nullable(),
-  scope: z.string().nullable(),
-  /** uploads.sh workspace slug from the access-token JWT (`workspace`, else `workspaces[]`). */
-  uploadsWorkspace: z.string().nullable(),
-});
-
-export const UploadsOAuthConnectResponseSchema = z.object({
-  authorizeUrl: z.string(),
-  redirectUri: z.string(),
-});
-
-export const UploadsOAuthCallbackBodySchema = z.object({
-  code: z.string().min(1),
-  state: z.string().min(1),
-});
-
-export const UploadsOAuthCallbackResponseSchema = UploadsIntegrationStatusSchema.extend({
-  workspaceId: z.string(),
-});