@buildinternet/releases-api-types 0.59.0 → 0.60.0

package/dist/schemas/well-known.js

@@ -0,0 +1,192 @@
+import { z } from "zod";
+const MAX_PRODUCTS = 24;
+const MAX_PRODUCT_RELEASES = 8;
+const MAX_FILE_RELEASES = 32;
+/** A single social handle/URL. Bare handles are intentionally accepted. */
+const SocialValueSchema = z.string().min(1).max(200);
+const SocialSchema = z.record(z.string().min(1).max(40), SocialValueSchema);
+// `z.url().startsWith(...)` keeps the runtime URL + https check AND serializes to
+// JSON Schema as `format: "uri"` + `pattern: "^https://"` — so the generated
+// public schema rejects non-https schemes too (a plain `.refine()` would be
+// silently dropped by z.toJSONSchema).
+const HttpsUrlSchema = z.url().startsWith("https://", "locator must be an https URL");
+/** Shared tag-array bounds — kept identical for org-level and product-level tags. */
+const TagsSchema = z.array(z.string().min(1).max(60)).max(50);
+/**
+ * Changelog file or glob inside the declared repo (Action `changelog-path` /
+ * `changelog-glob`). Relative only — no scheme, no leading slash, no `..`.
+ */
+const PublishPathSchema = z
+    .string()
+    .min(1)
+    .max(200)
+    .regex(/^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._~@%+\-/*?[\]{}]+$/, "path must be a relative changelog file or glob");
+const ReleaseLocationFields = {
+    url: HttpsUrlSchema.optional(),
+    feed: HttpsUrlSchema.optional(),
+    appstore: HttpsUrlSchema.optional(),
+    file: HttpsUrlSchema.optional(),
+    title: z.string().min(1).max(200).optional(),
+    canonical: z.boolean().optional(),
+    /**
+     * `"push"` means the owner publishes this changelog (GitHub Action / publish
+     * token) instead of us polling it. Requires `github` + `path`.
+     */
+    publish: z.literal("push").optional(),
+    /** Required with `publish: "push"`. The file or glob the Action watches. */
+    path: PublishPathSchema.optional(),
+};
+function hasLocator(value) {
+    return Boolean(value.url || value.feed || value.github || value.appstore || value.file);
+}
+/** `publish: "push"` is a mode on a github locator, not a locator by itself. */
+function pushPublishComplete(value) {
+    if (value.publish === "push")
+        return Boolean(value.github && value.path);
+    return value.path === undefined;
+}
+/** A domain manifest can name a concrete GitHub repository, but never `self`. */
+export const ReleasesJsonDomainReleaseSchema = z
+    .strictObject({
+    ...ReleaseLocationFields,
+    github: z
+        .string()
+        .regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, "github must be owner/repo")
+        .optional(),
+})
+    .refine(hasLocator, "at least one release locator is required")
+    .refine(pushPublishComplete, 'publish: "push" requires github (owner/repo) and path (changelog file or glob)');
+/** A repo manifest additionally accepts `github: "self"`. */
+export const ReleasesJsonRepoReleaseSchema = z
+    .strictObject({
+    ...ReleaseLocationFields,
+    github: z
+        .union([
+        z.literal("self"),
+        z.string().regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, "github must be owner/repo"),
+    ])
+        .optional(),
+})
+    .refine(hasLocator, "at least one release locator is required")
+    .refine(pushPublishComplete, 'publish: "push" requires github (owner/repo or "self") and path (changelog file or glob)');
+function releasesArray(item, max) {
+    return z
+        .array(item)
+        .max(max)
+        .refine((items) => items.filter((entry) => Boolean(entry.canonical)).length <= 1, "at most one canonical release location is allowed per scope");
+}
+const DomainProductReleasesSchema = releasesArray(ReleasesJsonDomainReleaseSchema, MAX_PRODUCT_RELEASES);
+const RepoReleasesSchema = releasesArray(ReleasesJsonRepoReleaseSchema, MAX_FILE_RELEASES);
+const DomainReleasesSchema = releasesArray(ReleasesJsonDomainReleaseSchema, MAX_FILE_RELEASES);
+/**
+ * Product declaration in a domain manifest. Taxonomy strings are deliberately
+ * lenient here; the reconciler resolves known values and ignores the rest.
+ */
+export const ReleasesJsonProductSchema = z.strictObject({
+    name: z.string().min(1).max(120),
+    slug: z.string().min(1).max(120).optional(),
+    kind: z.string().min(1).max(120).optional(),
+    category: z.string().min(1).max(120).optional(),
+    description: z.string().max(2000).optional(),
+    website: z.url().optional(),
+    docs: z.url().optional(),
+    support: z.url().optional(),
+    social: SocialSchema.optional(),
+    tags: TagsSchema.optional(),
+    archived: z.boolean().optional(),
+    releases: DomainProductReleasesSchema.optional(),
+});
+/** Repo-scope product binding. Slug is only a creation suggestion. */
+export const ReleasesJsonRepoProductSchema = z.strictObject({
+    name: z.string().min(1).max(120),
+    slug: z.string().min(1).max(120).optional(),
+});
+const ReleasesRegistrySchema = z
+    .object({
+    org: z
+        .string()
+        .regex(/^org_[A-Za-z0-9]+$/)
+        .optional(),
+    product: z
+        .string()
+        .regex(/^prd_[A-Za-z0-9]+$/)
+        .optional(),
+    verification: z.string().min(1).max(500).optional(),
+})
+    .catchall(z.unknown());
+/** Registry-specific extensions are forward-compatible by design. */
+export const ReleasesJsonRegistriesSchema = z
+    .object({
+    "releases.sh": ReleasesRegistrySchema.optional(),
+})
+    .catchall(z.unknown());
+/** Top-level fields shared by every manifest scope. */
+const BaseFields = {
+    $schema: z.url().optional(),
+    version: z.literal(2),
+    registries: ReleasesJsonRegistriesSchema.optional(),
+};
+const CommonFields = {
+    ...BaseFields,
+    releases: DomainReleasesSchema.optional(),
+};
+/** Domain-hosted variant: flat org identity plus product and release declarations. */
+export const ReleasesJsonDomainSchema = z
+    .strictObject({
+    ...CommonFields,
+    name: z.string().min(1).max(120).optional(),
+    description: z.string().max(2000).optional(),
+    category: z.string().min(1).max(120).optional(),
+    avatar: HttpsUrlSchema.optional(),
+    tags: TagsSchema.optional(),
+    social: SocialSchema.optional(),
+    products: z.array(ReleasesJsonProductSchema).max(MAX_PRODUCTS).optional(),
+})
+    .refine((manifest) => (manifest.releases?.length ?? 0) +
+    (manifest.products?.reduce((sum, product) => sum + (product.releases?.length ?? 0), 0) ??
+        0) <=
+    MAX_FILE_RELEASES, `at most ${MAX_FILE_RELEASES} release locations are allowed per file`);
+/** Repo-root variant: product binding plus repo-scoped release declarations. */
+export const ReleasesJsonRepoSchema = z.strictObject({
+    ...BaseFields,
+    product: ReleasesJsonRepoProductSchema.optional(),
+    releases: RepoReleasesSchema.optional(),
+});
+/** Public schema accepts either hosting scope; reconcilers use the scoped schema. */
+export const ReleasesJsonConfigSchema = z.union([ReleasesJsonDomainSchema, ReleasesJsonRepoSchema]);
+/**
+ * Body for `POST /v1/orgs/stub` — curator-authored stub org (#1947). Mirrors
+ * the domain-manifest identity + product + locator shape (so a curator can hand
+ * the same declaration a manifest would carry), minus manifest-transport fields
+ * (`version`/`$schema`/`registries`) and plus the registry-identity fields a
+ * stub org needs to be resolvable (`slug`/`domain`). Locators are optional — an
+ * identity-only stub (locations TBD) is valid. `category`/taxonomy strings stay
+ * lenient; the route resolves them and ignores the rest, same as the reconciler.
+ */
+export const CreateStubOrgBodySchema = z.strictObject({
+    name: z.string().min(1).max(120),
+    slug: z.string().min(1).max(120).optional(),
+    domain: z.string().min(1).max(255).optional(),
+    description: z.string().max(2000).optional(),
+    category: z.string().min(1).max(120).optional(),
+    avatar: HttpsUrlSchema.optional(),
+    tags: TagsSchema.optional(),
+    social: SocialSchema.optional(),
+    products: z.array(ReleasesJsonProductSchema).max(MAX_PRODUCTS).optional(),
+    releases: DomainReleasesSchema.optional(),
+});
+/**
+ * Body for `POST /v1/orgs/stub-from-domain` (#1947) — the unlisted-domain path.
+ * The worker fetches https://{domain}/.well-known/releases.json and, if valid
+ * and the domain has no org yet, creates a stub org + declared locators.
+ */
+export const StubFromDomainBodySchema = z.strictObject({
+    domain: z.string().min(1).max(255),
+});
+/** Response shape of POST /v1/orgs/:slug/sync-well-known. */
+export const SyncWellKnownResponseSchema = z.object({
+    fetched: z.boolean(),
+    applied: z.boolean(),
+    skippedReason: z.string().optional(),
+    plan: z.unknown().optional(),
+});

package/dist/schemas/workspace-integrations.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const UploadsIntegrationStatusSchema: z.ZodObject<{
+    provider: z.ZodLiteral<"uploads">;
+    connected: z.ZodBoolean;
+    configured: z.ZodBoolean;
+    connectedAt: z.ZodNullable<z.ZodString>;
+    scope: z.ZodNullable<z.ZodString>;
+    uploadsWorkspace: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const UploadsOAuthConnectResponseSchema: z.ZodObject<{
+    authorizeUrl: z.ZodString;
+    redirectUri: z.ZodString;
+}, z.core.$strip>;
+export declare const UploadsOAuthCallbackBodySchema: z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodString;
+}, z.core.$strip>;
+export declare const UploadsOAuthCallbackResponseSchema: z.ZodObject<{
+    provider: z.ZodLiteral<"uploads">;
+    connected: z.ZodBoolean;
+    configured: z.ZodBoolean;
+    connectedAt: z.ZodNullable<z.ZodString>;
+    scope: z.ZodNullable<z.ZodString>;
+    uploadsWorkspace: z.ZodNullable<z.ZodString>;
+    workspaceId: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=workspace-integrations.d.ts.map

package/dist/schemas/workspace-integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-integrations.d.ts","sourceRoot":"","sources":["../../src/schemas/workspace-integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,8BAA8B;;;;;;;iBASzC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;iBAGzC,CAAC;AAEH,eAAO,MAAM,kCAAkC;;;;;;;;iBAE7C,CAAC"}

package/dist/schemas/workspace-integrations.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+export const UploadsIntegrationStatusSchema = z.object({
+    provider: z.literal("uploads"),
+    connected: z.boolean(),
+    /** False when the token-encryption key is missing. */
+    configured: z.boolean(),
+    connectedAt: z.string().nullable(),
+    scope: z.string().nullable(),
+    /** uploads.sh workspace slug from the access-token JWT (`workspace`, else `workspaces[]`). */
+    uploadsWorkspace: z.string().nullable(),
+});
+export const UploadsOAuthConnectResponseSchema = z.object({
+    authorizeUrl: z.string(),
+    redirectUri: z.string(),
+});
+export const UploadsOAuthCallbackBodySchema = z.object({
+    code: z.string().min(1),
+    state: z.string().min(1),
+});
+export const UploadsOAuthCallbackResponseSchema = UploadsIntegrationStatusSchema.extend({
+    workspaceId: z.string(),
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/releases-api-types",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "description": "Wire protocol — request/response types for the Releases Index API. Shared by web, workers, and clients.",
   "type": "module",
   "license": "MIT",
@@ -10,15 +10,26 @@
     "directory": "packages/api-types"
   },
   "exports": {
-    ".": "./src/api-types.ts",
-    "./datasets": "./src/schemas/datasets.ts"
+    ".": {
+      "types": "./dist/api-types.d.ts",
+      "default": "./dist/api-types.js"
+    },
+    "./datasets": {
+      "types": "./dist/schemas/datasets.d.ts",
+      "default": "./dist/schemas/datasets.js"
+    }
   },
   "files": [
-    "src",
+    "dist",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "bun ../../scripts/pack-dist.ts prepack ../core",
+    "postpack": "bun ../../scripts/pack-dist.ts postpack"
+  },
   "dependencies": {
-    "@buildinternet/releases-core": "^0.35.0",
+    "@buildinternet/releases-core": "^0.36.0",
     "zod": "^4.4.3"
   },
   "publishConfig": {