@lizard-build/sdk 0.1.73 → 0.1.75

package/dist/index.d.mts

@@ -967,7 +967,11 @@ declare class GitReposAPI {
     /** Who moved which branch, when. */
     reflog(repo: RepoRef, ref?: string): Promise<unknown[]>;
     archive(repo: RepoRef, ref: string, format?: 'zip' | 'tar.gz'): Promise<Uint8Array>;
-    /** The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works without a helper. */
+    /**
+     * The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works
+     * without a helper; git then keeps it in .git/config. For anything shared or logged, use a
+     * limited Lizard Git token (`tokens.create`) as `apiKey` instead of the account's key.
+     */
     cloneUrl(repo: RepoRef, opts?: {
         withKey?: boolean;
     }): string;
@@ -1055,10 +1059,102 @@ declare class GitSecretsAPI {
     set(repo: RepoRef, name: string, value: string): Promise<void>;
     delete(repo: RepoRef, name: string): Promise<void>;
 }
+interface Environment {
+    id: number;
+    name: string;
+    reviewers: string[];
+    preventSelfReview: boolean;
+    waitMinutes: number;
+    branchPolicy: 'all' | 'protected' | 'custom';
+    branches: string[];
+    secrets: string[];
+    variables: string[];
+    createdAt: number;
+}
+interface EnvironmentOpts {
+    /** Up to 6 people with write access; any one approves a deployment. */
+    reviewers?: string[];
+    /** Whoever started a run can't approve its deployment. */
+    preventSelfReview?: boolean;
+    /** Minutes after approval before the job starts. */
+    waitMinutes?: number;
+    /** Which branches and tags may deploy: all, protected (with a branch rule), or `branches` patterns. */
+    branchPolicy?: 'all' | 'protected' | 'custom';
+    branches?: string[];
+}
+interface Deployment {
+    jobId: number;
+    environment: string;
+    url?: string;
+    state: 'waiting' | 'timer' | 'approved' | 'rejected';
+    readyAt?: number;
+    reviewer?: string;
+    comment?: string;
+    updatedAt: number;
+    canReview: boolean;
+    reviewers?: string[];
+}
+interface Variable {
+    name: string;
+    value: string;
+    updatedAt: number;
+}
+declare class GitVariablesAPI {
+    private readonly c;
+    private readonly base;
+    constructor(c: GitClient, base: (repo: RepoRef) => string);
+    list(repo: RepoRef): Promise<{
+        variables: Variable[];
+    }>;
+    set(repo: RepoRef, name: string, value: string): Promise<{
+        name: string;
+    }>;
+    delete(repo: RepoRef, name: string): Promise<void>;
+}
+/** Environments: deployment protection rules, their secrets and variables (admins). */
+declare class GitEnvironmentsAPI {
+    private readonly c;
+    constructor(c: GitClient);
+    private path;
+    list(repo: RepoRef): Promise<{
+        environments: Environment[];
+    }>;
+    get(repo: RepoRef, env: string): Promise<Environment>;
+    /** Create it, or change its rules (fields left out stay). */
+    set(repo: RepoRef, env: string, opts?: EnvironmentOpts): Promise<Environment>;
+    delete(repo: RepoRef, env: string): Promise<void>;
+    listSecrets(repo: RepoRef, env: string): Promise<{
+        secrets: Array<{
+            name: string;
+            updatedAt: number;
+        }>;
+    }>;
+    /** Only this environment's jobs get it, after its rules pass; it wins over a repository secret of the same name. */
+    setSecret(repo: RepoRef, env: string, name: string, value: string): Promise<{
+        name: string;
+    }>;
+    deleteSecret(repo: RepoRef, env: string, name: string): Promise<void>;
+    variables(env: string): GitVariablesAPI;
+}
 declare class GitActionsAPI {
     private readonly c;
     readonly secrets: GitSecretsAPI;
+    /** Repository variables: vars.NAME in every job. */
+    readonly variables: GitVariablesAPI;
     constructor(c: GitClient);
+    /** A run's jobs that deploy to an environment, and what each waits for. */
+    deployments(repo: RepoRef, number: number): Promise<{
+        deployments: Deployment[];
+    }>;
+    /** Approve or reject the run's waiting deployments (all you may review, or those named). */
+    reviewDeployments(repo: RepoRef, number: number, opts: {
+        state: 'approved' | 'rejected';
+        environments?: string[];
+        comment?: string;
+    }): Promise<{
+        state: string;
+        environments: string[];
+    }>;
     runs(repo: RepoRef, opts?: ListRunsOpts): Promise<{
         runs: Run[];
         more: boolean;
@@ -1236,6 +1332,7 @@ declare class GitAPI {
     readonly issues: GitIssuesOnlyAPI;
     readonly pulls: GitPullsAPI;
     readonly actions: GitActionsAPI;
+    readonly environments: GitEnvironmentsAPI;
     readonly collaborators: GitCollaboratorsAPI;
     readonly webhooks: GitWebhooksAPI;
     readonly branchRules: GitBranchRulesAPI;
@@ -3269,4 +3366,4 @@ declare class LizardCLI {
     }): Promise<CLIResult>;
 }
 
-export { type Account, type Addon, type AddonType, AddonsAPI, type ApiKey, type ApiKeyScope, ApiKeysAPI, AuthenticationError, type Balance, BillingAPI, type BranchRule, type BranchRuleOpts, type CLIOptions, type CLIResult, type CheckoutSession, type ClickOpts, type CodeContext, CodeSandbox, type CombinedStatus, type CommitFilesOpts, type CommitStatus, ConfigApplyError, type ConfigResult, ConflictError, type ConnectionOpts, type CostMetrics, type CreateAddonOpts, type CreateApiKeyOpts, type CreateContextOpts, type CreateProjectOpts, type CreatePullOpts, type CreateServiceOpts, type CreateVolumeOpts, type CreateWorkspaceOpts, type CreatedApiKey, DEFAULT_GIT_URL, type DeployEvent, DeployHandle, Desktop, type DesktopInfo, type DesktopStartOpts, type DomainInfo, type DomainStatus, DomainsAPI, Execution, ExecutionError, type ExposedPort, type FileInfo, type ForkResult, type FsEvent, type FsOpts, GitAPI, GitActionsAPI, type Artifact as GitArtifact, type Blob$1 as GitBlob, GitBranchRulesAPI, GitClient, type Collaborator as GitCollaborator, GitCollaboratorsAPI, type Commit as GitCommit, type Delivery as GitDelivery, type FileChange as GitFileChange, GitHubAPI, type Invitation as GitInvitation, type Issue as GitIssue, type IssueDetail as GitIssueDetail, type IssueList as GitIssueList, GitIssuesOnlyAPI, type Job as GitJob, type Label as GitLabel, GitLabelsAPI, type Notification as GitNotification, GitNotificationsAPI, GitPullsAPI, type Ref as GitRef, type Release as GitRelease, GitReleasesAPI, type Repo as GitRepo, type RepoMeta as GitRepoMeta, GitReposAPI, type Role as GitRole, type Run as GitRun, GitSecretsAPI, GitStatusesAPI, type Token as GitToken, GitTokensAPI, type TreeEntry as GitTreeEntry, type GitUser, type Webhook as GitWebhook, GitWebhooksAPI, type Workflow as GitWorkflow, LimitExceededError, type LineComment, type ListIssuesOpts, type ListRunsOpts, type ListTransactionsOpts, Lizard, LizardCLI, LizardError, type LizardOpts, type LogChunk, type LogLine, type MergeOpts, type MetricPoint, type MetricRange, MetricsAPI, type MouseButton, NotFoundError, PaymentRequiredError, type Plan, PlatformClient, type ProcessInfo, type ProcessOpts, type ProcessResult, type ProcessSignal, type Project, type ProjectConfig, type ProjectCost, ProjectsAPI, type PromoRedemption, type RawMetrics, type Region, RegionsAPI, type ReleaseOpts, type RepoRef, type ResaleMultipliers, type ResalePricing, type ReviewOpts, type RunCodeLanguage, type RunCodeOpts, Sandbox, type SandboxInfo, type SandboxOpts, type SandboxSnapshot, type ScaleOpts, type ScrollDirection, type Secret, SecretsAPI, type Service, type ServiceMetrics, type ServiceUpdate, ServicesAPI, type SetSecretOpts, type SnapshotOpts, type SnapshotScope, type SnapshotWaitOpts, type StartCheckoutOpts, type StartProNowResult, StorageAPI, type StreamEvent, type Subscription, type SubscriptionStatus, TimeoutError, type TokenOpts, type Transaction, type TransactionPage, type UpdateIssueOpts, Volume, type VolumeInfo, type WebhookOpts, type Workspace, type WorkspaceLimits, type WorkspaceLimitsInfo, type WorkspaceUsage, WorkspacesAPI, resolveProjectId };
+export { type Account, type Addon, type AddonType, AddonsAPI, type ApiKey, type ApiKeyScope, ApiKeysAPI, AuthenticationError, type Balance, BillingAPI, type BranchRule, type BranchRuleOpts, type CLIOptions, type CLIResult, type CheckoutSession, type ClickOpts, type CodeContext, CodeSandbox, type CombinedStatus, type CommitFilesOpts, type CommitStatus, ConfigApplyError, type ConfigResult, ConflictError, type ConnectionOpts, type CostMetrics, type CreateAddonOpts, type CreateApiKeyOpts, type CreateContextOpts, type CreateProjectOpts, type CreatePullOpts, type CreateServiceOpts, type CreateVolumeOpts, type CreateWorkspaceOpts, type CreatedApiKey, DEFAULT_GIT_URL, type DeployEvent, DeployHandle, Desktop, type DesktopInfo, type DesktopStartOpts, type DomainInfo, type DomainStatus, DomainsAPI, type EnvironmentOpts, Execution, ExecutionError, type ExposedPort, type FileInfo, type ForkResult, type FsEvent, type FsOpts, GitAPI, GitActionsAPI, type Artifact as GitArtifact, type Blob$1 as GitBlob, GitBranchRulesAPI, GitClient, type Collaborator as GitCollaborator, GitCollaboratorsAPI, type Commit as GitCommit, type Delivery as GitDelivery, type Deployment as GitDeployment, type Environment as GitEnvironment, GitEnvironmentsAPI, type FileChange as GitFileChange, GitHubAPI, type Invitation as GitInvitation, type Issue as GitIssue, type IssueDetail as GitIssueDetail, type IssueList as GitIssueList, GitIssuesOnlyAPI, type Job as GitJob, type Label as GitLabel, GitLabelsAPI, type Notification as GitNotification, GitNotificationsAPI, GitPullsAPI, type Ref as GitRef, type Release as GitRelease, GitReleasesAPI, type Repo as GitRepo, type RepoMeta as GitRepoMeta, GitReposAPI, type Role as GitRole, type Run as GitRun, GitSecretsAPI, GitStatusesAPI, type Token as GitToken, GitTokensAPI, type TreeEntry as GitTreeEntry, type GitUser, type Variable as GitVariable, GitVariablesAPI, type Webhook as GitWebhook, GitWebhooksAPI, type Workflow as GitWorkflow, LimitExceededError, type LineComment, type ListIssuesOpts, type ListRunsOpts, type ListTransactionsOpts, Lizard, LizardCLI, LizardError, type LizardOpts, type LogChunk, type LogLine, type MergeOpts, type MetricPoint, type MetricRange, MetricsAPI, type MouseButton, NotFoundError, PaymentRequiredError, type Plan, PlatformClient, type ProcessInfo, type ProcessOpts, type ProcessResult, type ProcessSignal, type Project, type ProjectConfig, type ProjectCost, ProjectsAPI, type PromoRedemption, type RawMetrics, type Region, RegionsAPI, type ReleaseOpts, type RepoRef, type ResaleMultipliers, type ResalePricing, type ReviewOpts, type RunCodeLanguage, type RunCodeOpts, Sandbox, type SandboxInfo, type SandboxOpts, type SandboxSnapshot, type ScaleOpts, type ScrollDirection, type Secret, SecretsAPI, type Service, type ServiceMetrics, type ServiceUpdate, ServicesAPI, type SetSecretOpts, type SnapshotOpts, type SnapshotScope, type SnapshotWaitOpts, type StartCheckoutOpts, type StartProNowResult, StorageAPI, type StreamEvent, type Subscription, type SubscriptionStatus, TimeoutError, type TokenOpts, type Transaction, type TransactionPage, type UpdateIssueOpts, Volume, type VolumeInfo, type WebhookOpts, type Workspace, type WorkspaceLimits, type WorkspaceLimitsInfo, type WorkspaceUsage, WorkspacesAPI, resolveProjectId };

package/dist/index.d.ts

@@ -967,7 +967,11 @@ declare class GitReposAPI {
     /** Who moved which branch, when. */
     reflog(repo: RepoRef, ref?: string): Promise<unknown[]>;
     archive(repo: RepoRef, ref: string, format?: 'zip' | 'tar.gz'): Promise<Uint8Array>;
-    /** The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works without a helper. */
+    /**
+     * The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works
+     * without a helper; git then keeps it in .git/config. For anything shared or logged, use a
+     * limited Lizard Git token (`tokens.create`) as `apiKey` instead of the account's key.
+     */
     cloneUrl(repo: RepoRef, opts?: {
         withKey?: boolean;
     }): string;
@@ -1055,10 +1059,102 @@ declare class GitSecretsAPI {
     set(repo: RepoRef, name: string, value: string): Promise<void>;
     delete(repo: RepoRef, name: string): Promise<void>;
 }
+interface Environment {
+    id: number;
+    name: string;
+    reviewers: string[];
+    preventSelfReview: boolean;
+    waitMinutes: number;
+    branchPolicy: 'all' | 'protected' | 'custom';
+    branches: string[];
+    secrets: string[];
+    variables: string[];
+    createdAt: number;
+}
+interface EnvironmentOpts {
+    /** Up to 6 people with write access; any one approves a deployment. */
+    reviewers?: string[];
+    /** Whoever started a run can't approve its deployment. */
+    preventSelfReview?: boolean;
+    /** Minutes after approval before the job starts. */
+    waitMinutes?: number;
+    /** Which branches and tags may deploy: all, protected (with a branch rule), or `branches` patterns. */
+    branchPolicy?: 'all' | 'protected' | 'custom';
+    branches?: string[];
+}
+interface Deployment {
+    jobId: number;
+    environment: string;
+    url?: string;
+    state: 'waiting' | 'timer' | 'approved' | 'rejected';
+    readyAt?: number;
+    reviewer?: string;
+    comment?: string;
+    updatedAt: number;
+    canReview: boolean;
+    reviewers?: string[];
+}
+interface Variable {
+    name: string;
+    value: string;
+    updatedAt: number;
+}
+declare class GitVariablesAPI {
+    private readonly c;
+    private readonly base;
+    constructor(c: GitClient, base: (repo: RepoRef) => string);
+    list(repo: RepoRef): Promise<{
+        variables: Variable[];
+    }>;
+    set(repo: RepoRef, name: string, value: string): Promise<{
+        name: string;
+    }>;
+    delete(repo: RepoRef, name: string): Promise<void>;
+}
+/** Environments: deployment protection rules, their secrets and variables (admins). */
+declare class GitEnvironmentsAPI {
+    private readonly c;
+    constructor(c: GitClient);
+    private path;
+    list(repo: RepoRef): Promise<{
+        environments: Environment[];
+    }>;
+    get(repo: RepoRef, env: string): Promise<Environment>;
+    /** Create it, or change its rules (fields left out stay). */
+    set(repo: RepoRef, env: string, opts?: EnvironmentOpts): Promise<Environment>;
+    delete(repo: RepoRef, env: string): Promise<void>;
+    listSecrets(repo: RepoRef, env: string): Promise<{
+        secrets: Array<{
+            name: string;
+            updatedAt: number;
+        }>;
+    }>;
+    /** Only this environment's jobs get it, after its rules pass; it wins over a repository secret of the same name. */
+    setSecret(repo: RepoRef, env: string, name: string, value: string): Promise<{
+        name: string;
+    }>;
+    deleteSecret(repo: RepoRef, env: string, name: string): Promise<void>;
+    variables(env: string): GitVariablesAPI;
+}
 declare class GitActionsAPI {
     private readonly c;
     readonly secrets: GitSecretsAPI;
+    /** Repository variables: vars.NAME in every job. */
+    readonly variables: GitVariablesAPI;
     constructor(c: GitClient);
+    /** A run's jobs that deploy to an environment, and what each waits for. */
+    deployments(repo: RepoRef, number: number): Promise<{
+        deployments: Deployment[];
+    }>;
+    /** Approve or reject the run's waiting deployments (all you may review, or those named). */
+    reviewDeployments(repo: RepoRef, number: number, opts: {
+        state: 'approved' | 'rejected';
+        environments?: string[];
+        comment?: string;
+    }): Promise<{
+        state: string;
+        environments: string[];
+    }>;
     runs(repo: RepoRef, opts?: ListRunsOpts): Promise<{
         runs: Run[];
         more: boolean;
@@ -1236,6 +1332,7 @@ declare class GitAPI {
     readonly issues: GitIssuesOnlyAPI;
     readonly pulls: GitPullsAPI;
     readonly actions: GitActionsAPI;
+    readonly environments: GitEnvironmentsAPI;
     readonly collaborators: GitCollaboratorsAPI;
     readonly webhooks: GitWebhooksAPI;
     readonly branchRules: GitBranchRulesAPI;
@@ -3269,4 +3366,4 @@ declare class LizardCLI {
     }): Promise<CLIResult>;
 }
 
-export { type Account, type Addon, type AddonType, AddonsAPI, type ApiKey, type ApiKeyScope, ApiKeysAPI, AuthenticationError, type Balance, BillingAPI, type BranchRule, type BranchRuleOpts, type CLIOptions, type CLIResult, type CheckoutSession, type ClickOpts, type CodeContext, CodeSandbox, type CombinedStatus, type CommitFilesOpts, type CommitStatus, ConfigApplyError, type ConfigResult, ConflictError, type ConnectionOpts, type CostMetrics, type CreateAddonOpts, type CreateApiKeyOpts, type CreateContextOpts, type CreateProjectOpts, type CreatePullOpts, type CreateServiceOpts, type CreateVolumeOpts, type CreateWorkspaceOpts, type CreatedApiKey, DEFAULT_GIT_URL, type DeployEvent, DeployHandle, Desktop, type DesktopInfo, type DesktopStartOpts, type DomainInfo, type DomainStatus, DomainsAPI, Execution, ExecutionError, type ExposedPort, type FileInfo, type ForkResult, type FsEvent, type FsOpts, GitAPI, GitActionsAPI, type Artifact as GitArtifact, type Blob$1 as GitBlob, GitBranchRulesAPI, GitClient, type Collaborator as GitCollaborator, GitCollaboratorsAPI, type Commit as GitCommit, type Delivery as GitDelivery, type FileChange as GitFileChange, GitHubAPI, type Invitation as GitInvitation, type Issue as GitIssue, type IssueDetail as GitIssueDetail, type IssueList as GitIssueList, GitIssuesOnlyAPI, type Job as GitJob, type Label as GitLabel, GitLabelsAPI, type Notification as GitNotification, GitNotificationsAPI, GitPullsAPI, type Ref as GitRef, type Release as GitRelease, GitReleasesAPI, type Repo as GitRepo, type RepoMeta as GitRepoMeta, GitReposAPI, type Role as GitRole, type Run as GitRun, GitSecretsAPI, GitStatusesAPI, type Token as GitToken, GitTokensAPI, type TreeEntry as GitTreeEntry, type GitUser, type Webhook as GitWebhook, GitWebhooksAPI, type Workflow as GitWorkflow, LimitExceededError, type LineComment, type ListIssuesOpts, type ListRunsOpts, type ListTransactionsOpts, Lizard, LizardCLI, LizardError, type LizardOpts, type LogChunk, type LogLine, type MergeOpts, type MetricPoint, type MetricRange, MetricsAPI, type MouseButton, NotFoundError, PaymentRequiredError, type Plan, PlatformClient, type ProcessInfo, type ProcessOpts, type ProcessResult, type ProcessSignal, type Project, type ProjectConfig, type ProjectCost, ProjectsAPI, type PromoRedemption, type RawMetrics, type Region, RegionsAPI, type ReleaseOpts, type RepoRef, type ResaleMultipliers, type ResalePricing, type ReviewOpts, type RunCodeLanguage, type RunCodeOpts, Sandbox, type SandboxInfo, type SandboxOpts, type SandboxSnapshot, type ScaleOpts, type ScrollDirection, type Secret, SecretsAPI, type Service, type ServiceMetrics, type ServiceUpdate, ServicesAPI, type SetSecretOpts, type SnapshotOpts, type SnapshotScope, type SnapshotWaitOpts, type StartCheckoutOpts, type StartProNowResult, StorageAPI, type StreamEvent, type Subscription, type SubscriptionStatus, TimeoutError, type TokenOpts, type Transaction, type TransactionPage, type UpdateIssueOpts, Volume, type VolumeInfo, type WebhookOpts, type Workspace, type WorkspaceLimits, type WorkspaceLimitsInfo, type WorkspaceUsage, WorkspacesAPI, resolveProjectId };
+export { type Account, type Addon, type AddonType, AddonsAPI, type ApiKey, type ApiKeyScope, ApiKeysAPI, AuthenticationError, type Balance, BillingAPI, type BranchRule, type BranchRuleOpts, type CLIOptions, type CLIResult, type CheckoutSession, type ClickOpts, type CodeContext, CodeSandbox, type CombinedStatus, type CommitFilesOpts, type CommitStatus, ConfigApplyError, type ConfigResult, ConflictError, type ConnectionOpts, type CostMetrics, type CreateAddonOpts, type CreateApiKeyOpts, type CreateContextOpts, type CreateProjectOpts, type CreatePullOpts, type CreateServiceOpts, type CreateVolumeOpts, type CreateWorkspaceOpts, type CreatedApiKey, DEFAULT_GIT_URL, type DeployEvent, DeployHandle, Desktop, type DesktopInfo, type DesktopStartOpts, type DomainInfo, type DomainStatus, DomainsAPI, type EnvironmentOpts, Execution, ExecutionError, type ExposedPort, type FileInfo, type ForkResult, type FsEvent, type FsOpts, GitAPI, GitActionsAPI, type Artifact as GitArtifact, type Blob$1 as GitBlob, GitBranchRulesAPI, GitClient, type Collaborator as GitCollaborator, GitCollaboratorsAPI, type Commit as GitCommit, type Delivery as GitDelivery, type Deployment as GitDeployment, type Environment as GitEnvironment, GitEnvironmentsAPI, type FileChange as GitFileChange, GitHubAPI, type Invitation as GitInvitation, type Issue as GitIssue, type IssueDetail as GitIssueDetail, type IssueList as GitIssueList, GitIssuesOnlyAPI, type Job as GitJob, type Label as GitLabel, GitLabelsAPI, type Notification as GitNotification, GitNotificationsAPI, GitPullsAPI, type Ref as GitRef, type Release as GitRelease, GitReleasesAPI, type Repo as GitRepo, type RepoMeta as GitRepoMeta, GitReposAPI, type Role as GitRole, type Run as GitRun, GitSecretsAPI, GitStatusesAPI, type Token as GitToken, GitTokensAPI, type TreeEntry as GitTreeEntry, type GitUser, type Variable as GitVariable, GitVariablesAPI, type Webhook as GitWebhook, GitWebhooksAPI, type Workflow as GitWorkflow, LimitExceededError, type LineComment, type ListIssuesOpts, type ListRunsOpts, type ListTransactionsOpts, Lizard, LizardCLI, LizardError, type LizardOpts, type LogChunk, type LogLine, type MergeOpts, type MetricPoint, type MetricRange, MetricsAPI, type MouseButton, NotFoundError, PaymentRequiredError, type Plan, PlatformClient, type ProcessInfo, type ProcessOpts, type ProcessResult, type ProcessSignal, type Project, type ProjectConfig, type ProjectCost, ProjectsAPI, type PromoRedemption, type RawMetrics, type Region, RegionsAPI, type ReleaseOpts, type RepoRef, type ResaleMultipliers, type ResalePricing, type ReviewOpts, type RunCodeLanguage, type RunCodeOpts, Sandbox, type SandboxInfo, type SandboxOpts, type SandboxSnapshot, type ScaleOpts, type ScrollDirection, type Secret, SecretsAPI, type Service, type ServiceMetrics, type ServiceUpdate, ServicesAPI, type SetSecretOpts, type SnapshotOpts, type SnapshotScope, type SnapshotWaitOpts, type StartCheckoutOpts, type StartProNowResult, StorageAPI, type StreamEvent, type Subscription, type SubscriptionStatus, TimeoutError, type TokenOpts, type Transaction, type TransactionPage, type UpdateIssueOpts, Volume, type VolumeInfo, type WebhookOpts, type Workspace, type WorkspaceLimits, type WorkspaceLimitsInfo, type WorkspaceUsage, WorkspacesAPI, resolveProjectId };

package/dist/index.js

@@ -36,6 +36,7 @@ __export(index_exports, {
   GitBranchRulesAPI: () => GitBranchRulesAPI,
   GitClient: () => GitClient,
   GitCollaboratorsAPI: () => GitCollaboratorsAPI,
+  GitEnvironmentsAPI: () => GitEnvironmentsAPI,
   GitHubAPI: () => GitHubAPI,
   GitIssuesOnlyAPI: () => GitIssuesOnlyAPI,
   GitLabelsAPI: () => GitLabelsAPI,
@@ -46,6 +47,7 @@ __export(index_exports, {
   GitSecretsAPI: () => GitSecretsAPI,
   GitStatusesAPI: () => GitStatusesAPI,
   GitTokensAPI: () => GitTokensAPI,
+  GitVariablesAPI: () => GitVariablesAPI,
   GitWebhooksAPI: () => GitWebhooksAPI,
   LimitExceededError: () => LimitExceededError,
   Lizard: () => Lizard,
@@ -559,9 +561,14 @@ function qs(path, values) {
   for (const [k, v] of Object.entries(values)) if (v !== void 0 && v !== "") q.set(k, String(v));
   return q.size ? `${path}?${q}` : path;
 }
+function segs(p) {
+  const parts = p.split("/");
+  if (parts.some((x) => x === "" || x === "." || x === "..")) throw new Error(`bad path: "${p}"`);
+  return parts.map(seg).join("/");
+}
 function repoPath(repo) {
   const m = /^([^/\s]+)\/([^/\s]+?)(\.git)?$/.exec(repo);
-  if (!m) throw new Error(`repository must be "owner/name", got "${repo}"`);
+  if (!m || [m[1], m[2]].some((x) => x === "." || x === "..")) throw new Error(`repository must be "owner/name", got "${repo}"`);
   return `/api/repos/${seg(m[1])}/${seg(m[2])}`;
 }
 var GitClient = class {
@@ -574,6 +581,8 @@ var GitClient = class {
       method,
       body,
       headers: { "X-API-Key": this.config.apiKey, ...headers },
+      redirect: "error",
+      // a redirect would carry the key to wherever it points
       signal: AbortSignal.timeout(this.config.requestTimeoutMs)
     });
     if (!res.ok) await handleApiError(res);
@@ -650,7 +659,7 @@ var GitReposAPI = class {
     return this.c.post(`${repoPath(repo)}/branches`, { name, from });
   }
   deleteBranch(repo, name) {
-    return this.c.delete(`${repoPath(repo)}/branches/${name.split("/").map(seg).join("/")}`);
+    return this.c.delete(`${repoPath(repo)}/branches/${segs(name)}`);
   }
   tree(repo, opts = {}) {
     return this.c.get(qs(`${repoPath(repo)}/tree`, opts));
@@ -661,8 +670,9 @@ var GitReposAPI = class {
   }
   /** A file's bytes, whatever its size or type. */
   raw(repo, path, ref) {
+    repoPath(repo);
     const [owner, name] = repo.split("/");
-    return this.c.bytes(`/raw/${seg(owner)}/${seg(name)}/${ref.split("/").map(seg).join("/")}/${path.split("/").map(seg).join("/")}`);
+    return this.c.bytes(`/raw/${seg(owner)}/${seg(name)}/${segs(ref)}/${segs(path)}`);
   }
   /** Every file path at a ref. */
   files(repo, ref) {
@@ -696,7 +706,11 @@ var GitReposAPI = class {
   archive(repo, ref, format = "tar.gz") {
     return this.c.bytes(`${repoPath(repo)}/archive/${seg(ref)}.${format}`);
   }
-  /** The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works without a helper. */
+  /**
+   * The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works
+   * without a helper; git then keeps it in .git/config. For anything shared or logged, use a
+   * limited Lizard Git token (`tokens.create`) as `apiKey` instead of the account's key.
+   */
   cloneUrl(repo, opts = {}) {
     repoPath(repo);
     const u = new URL(`${this.c.url}/${repo.replace(/\.git$/, "")}.git`);
@@ -801,10 +815,68 @@ var GitSecretsAPI = class {
     return this.c.delete(`${repoPath(repo)}/actions/secrets/${seg(name)}`);
   }
 };
+var GitVariablesAPI = class {
+  constructor(c, base) {
+    this.c = c;
+    this.base = base;
+  }
+  list(repo) {
+    return this.c.get(`${this.base(repo)}/variables`);
+  }
+  set(repo, name, value) {
+    return this.c.put(`${this.base(repo)}/variables/${seg(name)}`, { value });
+  }
+  delete(repo, name) {
+    return this.c.delete(`${this.base(repo)}/variables/${seg(name)}`);
+  }
+};
+var GitEnvironmentsAPI = class {
+  constructor(c) {
+    this.c = c;
+  }
+  path(repo, env) {
+    return `${repoPath(repo)}/actions/environments/${seg(env)}`;
+  }
+  list(repo) {
+    return this.c.get(`${repoPath(repo)}/actions/environments`);
+  }
+  get(repo, env) {
+    return this.c.get(this.path(repo, env));
+  }
+  /** Create it, or change its rules (fields left out stay). */
+  set(repo, env, opts = {}) {
+    return this.c.put(this.path(repo, env), opts);
+  }
+  delete(repo, env) {
+    return this.c.delete(this.path(repo, env));
+  }
+  listSecrets(repo, env) {
+    return this.c.get(`${this.path(repo, env)}/secrets`);
+  }
+  /** Only this environment's jobs get it, after its rules pass; it wins over a repository secret of the same name. */
+  setSecret(repo, env, name, value) {
+    return this.c.put(`${this.path(repo, env)}/secrets/${seg(name)}`, { value });
+  }
+  deleteSecret(repo, env, name) {
+    return this.c.delete(`${this.path(repo, env)}/secrets/${seg(name)}`);
+  }
+  variables(env) {
+    return new GitVariablesAPI(this.c, (repo) => this.path(repo, env));
+  }
+};
 var GitActionsAPI = class {
   constructor(c) {
     this.c = c;
     this.secrets = new GitSecretsAPI(c);
+    this.variables = new GitVariablesAPI(c, (repo) => `${repoPath(repo)}/actions`);
+  }
+  /** A run's jobs that deploy to an environment, and what each waits for. */
+  deployments(repo, number) {
+    return this.c.get(`${repoPath(repo)}/actions/runs/${number}/deployments`);
+  }
+  /** Approve or reject the run's waiting deployments (all you may review, or those named). */
+  reviewDeployments(repo, number, opts) {
+    return this.c.post(`${repoPath(repo)}/actions/runs/${number}/deployments`, opts);
   }
   runs(repo, opts = {}) {
     return this.c.get(qs(`${repoPath(repo)}/actions/runs`, { ...opts }));
@@ -846,7 +918,7 @@ var GitActionsAPI = class {
     const until = Date.now() + (opts.timeoutMs ?? 30 * 6e4);
     for (; ; ) {
       const run = await this.run(repo, number);
-      if (!["queued", "running", "waiting", "pending"].includes(run.status)) return run;
+      if (!["queued", "running", "waiting", "pending", "dispatched"].includes(run.status)) return run;
       if (Date.now() > until) throw new Error(`run ${number} is still ${run.status}`);
       await new Promise((r) => setTimeout(r, opts.intervalMs ?? 3e3));
     }
@@ -1052,6 +1124,7 @@ var GitAPI = class {
     this.issues = new GitIssuesOnlyAPI(c);
     this.pulls = new GitPullsAPI(c);
     this.actions = new GitActionsAPI(c);
+    this.environments = new GitEnvironmentsAPI(c);
     this.collaborators = new GitCollaboratorsAPI(c);
     this.webhooks = new GitWebhooksAPI(c);
     this.branchRules = new GitBranchRulesAPI(c);
@@ -3248,6 +3321,7 @@ var LizardCLI = class {
   GitBranchRulesAPI,
   GitClient,
   GitCollaboratorsAPI,
+  GitEnvironmentsAPI,
   GitHubAPI,
   GitIssuesOnlyAPI,
   GitLabelsAPI,
@@ -3258,6 +3332,7 @@ var LizardCLI = class {
   GitSecretsAPI,
   GitStatusesAPI,
   GitTokensAPI,
+  GitVariablesAPI,
   GitWebhooksAPI,
   LimitExceededError,
   Lizard,

package/dist/index.mjs

@@ -489,9 +489,14 @@ function qs(path, values) {
   for (const [k, v] of Object.entries(values)) if (v !== void 0 && v !== "") q.set(k, String(v));
   return q.size ? `${path}?${q}` : path;
 }
+function segs(p) {
+  const parts = p.split("/");
+  if (parts.some((x) => x === "" || x === "." || x === "..")) throw new Error(`bad path: "${p}"`);
+  return parts.map(seg).join("/");
+}
 function repoPath(repo) {
   const m = /^([^/\s]+)\/([^/\s]+?)(\.git)?$/.exec(repo);
-  if (!m) throw new Error(`repository must be "owner/name", got "${repo}"`);
+  if (!m || [m[1], m[2]].some((x) => x === "." || x === "..")) throw new Error(`repository must be "owner/name", got "${repo}"`);
   return `/api/repos/${seg(m[1])}/${seg(m[2])}`;
 }
 var GitClient = class {
@@ -504,6 +509,8 @@ var GitClient = class {
       method,
       body,
       headers: { "X-API-Key": this.config.apiKey, ...headers },
+      redirect: "error",
+      // a redirect would carry the key to wherever it points
       signal: AbortSignal.timeout(this.config.requestTimeoutMs)
     });
     if (!res.ok) await handleApiError(res);
@@ -580,7 +587,7 @@ var GitReposAPI = class {
     return this.c.post(`${repoPath(repo)}/branches`, { name, from });
   }
   deleteBranch(repo, name) {
-    return this.c.delete(`${repoPath(repo)}/branches/${name.split("/").map(seg).join("/")}`);
+    return this.c.delete(`${repoPath(repo)}/branches/${segs(name)}`);
   }
   tree(repo, opts = {}) {
     return this.c.get(qs(`${repoPath(repo)}/tree`, opts));
@@ -591,8 +598,9 @@ var GitReposAPI = class {
   }
   /** A file's bytes, whatever its size or type. */
   raw(repo, path, ref) {
+    repoPath(repo);
     const [owner, name] = repo.split("/");
-    return this.c.bytes(`/raw/${seg(owner)}/${seg(name)}/${ref.split("/").map(seg).join("/")}/${path.split("/").map(seg).join("/")}`);
+    return this.c.bytes(`/raw/${seg(owner)}/${seg(name)}/${segs(ref)}/${segs(path)}`);
   }
   /** Every file path at a ref. */
   files(repo, ref) {
@@ -626,7 +634,11 @@ var GitReposAPI = class {
   archive(repo, ref, format = "tar.gz") {
     return this.c.bytes(`${repoPath(repo)}/archive/${seg(ref)}.${format}`);
   }
-  /** The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works without a helper. */
+  /**
+   * The HTTPS clone URL. With `withKey`, it carries the API key, so plain `git clone` works
+   * without a helper; git then keeps it in .git/config. For anything shared or logged, use a
+   * limited Lizard Git token (`tokens.create`) as `apiKey` instead of the account's key.
+   */
   cloneUrl(repo, opts = {}) {
     repoPath(repo);
     const u = new URL(`${this.c.url}/${repo.replace(/\.git$/, "")}.git`);
@@ -731,10 +743,68 @@ var GitSecretsAPI = class {
     return this.c.delete(`${repoPath(repo)}/actions/secrets/${seg(name)}`);
   }
 };
+var GitVariablesAPI = class {
+  constructor(c, base) {
+    this.c = c;
+    this.base = base;
+  }
+  list(repo) {
+    return this.c.get(`${this.base(repo)}/variables`);
+  }
+  set(repo, name, value) {
+    return this.c.put(`${this.base(repo)}/variables/${seg(name)}`, { value });
+  }
+  delete(repo, name) {
+    return this.c.delete(`${this.base(repo)}/variables/${seg(name)}`);
+  }
+};
+var GitEnvironmentsAPI = class {
+  constructor(c) {
+    this.c = c;
+  }
+  path(repo, env) {
+    return `${repoPath(repo)}/actions/environments/${seg(env)}`;
+  }
+  list(repo) {
+    return this.c.get(`${repoPath(repo)}/actions/environments`);
+  }
+  get(repo, env) {
+    return this.c.get(this.path(repo, env));
+  }
+  /** Create it, or change its rules (fields left out stay). */
+  set(repo, env, opts = {}) {
+    return this.c.put(this.path(repo, env), opts);
+  }
+  delete(repo, env) {
+    return this.c.delete(this.path(repo, env));
+  }
+  listSecrets(repo, env) {
+    return this.c.get(`${this.path(repo, env)}/secrets`);
+  }
+  /** Only this environment's jobs get it, after its rules pass; it wins over a repository secret of the same name. */
+  setSecret(repo, env, name, value) {
+    return this.c.put(`${this.path(repo, env)}/secrets/${seg(name)}`, { value });
+  }
+  deleteSecret(repo, env, name) {
+    return this.c.delete(`${this.path(repo, env)}/secrets/${seg(name)}`);
+  }
+  variables(env) {
+    return new GitVariablesAPI(this.c, (repo) => this.path(repo, env));
+  }
+};
 var GitActionsAPI = class {
   constructor(c) {
     this.c = c;
     this.secrets = new GitSecretsAPI(c);
+    this.variables = new GitVariablesAPI(c, (repo) => `${repoPath(repo)}/actions`);
+  }
+  /** A run's jobs that deploy to an environment, and what each waits for. */
+  deployments(repo, number) {
+    return this.c.get(`${repoPath(repo)}/actions/runs/${number}/deployments`);
+  }
+  /** Approve or reject the run's waiting deployments (all you may review, or those named). */
+  reviewDeployments(repo, number, opts) {
+    return this.c.post(`${repoPath(repo)}/actions/runs/${number}/deployments`, opts);
   }
   runs(repo, opts = {}) {
     return this.c.get(qs(`${repoPath(repo)}/actions/runs`, { ...opts }));
@@ -776,7 +846,7 @@ var GitActionsAPI = class {
     const until = Date.now() + (opts.timeoutMs ?? 30 * 6e4);
     for (; ; ) {
       const run = await this.run(repo, number);
-      if (!["queued", "running", "waiting", "pending"].includes(run.status)) return run;
+      if (!["queued", "running", "waiting", "pending", "dispatched"].includes(run.status)) return run;
       if (Date.now() > until) throw new Error(`run ${number} is still ${run.status}`);
       await new Promise((r) => setTimeout(r, opts.intervalMs ?? 3e3));
     }
@@ -982,6 +1052,7 @@ var GitAPI = class {
     this.issues = new GitIssuesOnlyAPI(c);
     this.pulls = new GitPullsAPI(c);
     this.actions = new GitActionsAPI(c);
+    this.environments = new GitEnvironmentsAPI(c);
     this.collaborators = new GitCollaboratorsAPI(c);
     this.webhooks = new GitWebhooksAPI(c);
     this.branchRules = new GitBranchRulesAPI(c);
@@ -3177,6 +3248,7 @@ export {
   GitBranchRulesAPI,
   GitClient,
   GitCollaboratorsAPI,
+  GitEnvironmentsAPI,
   GitHubAPI,
   GitIssuesOnlyAPI,
   GitLabelsAPI,
@@ -3187,6 +3259,7 @@ export {
   GitSecretsAPI,
   GitStatusesAPI,
   GitTokensAPI,
+  GitVariablesAPI,
   GitWebhooksAPI,
   LimitExceededError,
   Lizard,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lizard-build/sdk",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "description": "TypeScript SDK for Lizard: Firecracker microVM sandboxes, code execution and cloud apps.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",