@shipfox/api-integration-gitea-dto 2.0.0

package/.turbo/turbo-build.log

@@ -0,0 +1,2 @@
+$ shipfox-swc
+Successfully compiled: 4 files with swc (28.4ms)

package/.turbo/turbo-type$colon$emit.log

@@ -0,0 +1 @@
+$ shipfox-tsc-emit

package/.turbo/turbo-type.log

@@ -0,0 +1 @@
+$ shipfox-tsc-check

package/CHANGELOG.md

@@ -0,0 +1,46 @@
+# @shipfox/api-integration-gitea-dto
+
+## 2.0.0
+
+### Minor Changes
+
+- 1b0d344: Publishes the complete API runtime closure with packed-consumer-safe internal imports and records its exact package set in application releases.
+
+### Patch Changes
+
+- Updated dependencies [1b0d344]
+  - @shipfox/api-integration-core-dto@2.0.0
+
+## 0.0.1
+
+### Patch Changes
+
+- 58f51bd: Scaffold an empty `gitea` integration provider that mirrors the `github` package structure, ahead of any behavior.
+  - New `@shipfox/api-integration-gitea` + `@shipfox/api-integration-gitea-dto` packages: `createGiteaIntegrationProvider()` returns an empty provider (`{provider: 'gitea', displayName: 'Gitea', adapters: {}, routes: []}`), plus a `src/config.ts` documenting the self-hoster variables (`GITEA_BASE_URL`, `GITEA_SERVICE_USERNAME`, `GITEA_SERVICE_TOKEN`, `GITEA_WEBHOOK_SECRET`, `GITEA_WEBHOOK_TARGET_URL`, `GITEA_CHECKOUT_TTL_SECONDS`) and an empty provider database wired with the stable migrations table `__drizzle_migrations_integrations_gitea`.
+  - `@shipfox/api-integration-core`: register the Gitea provider behind `INTEGRATIONS_ENABLE_GITEA_PROVIDER` (default false). With the flag enabled, `gitea` appears in `GET /integration-providers`. Dormant scaffold; no runtime behavior yet.
+
+- 570ac69: Add the Gitea connection flow so a workspace member can link a Gitea org with a single authenticated request (no OAuth, no redirect).
+  - `@shipfox/api-integration-gitea-dto`: `createGiteaConnectionBodySchema` (`{workspace_id, org}`); the response reuses the shared `integrationConnectionDtoSchema`.
+  - `@shipfox/api-integration-gitea`: `POST /integrations/gitea/connections` (`AUTH_USER`, workspace membership) canonicalizes the org to lower case (Gitea routes org names case-insensitively, so this keeps the case-sensitive ownership lookup and unique indexes from being bypassed by a case variant), validates the org via the API, rejects an org already linked to another workspace (409), registers an org-level push webhook (`POST /orgs/{org}/hooks` with `GITEA_WEBHOOK_SECRET`/`GITEA_WEBHOOK_TARGET_URL`), and in one transaction upserts the core connection (`provider: 'gitea'`, `externalAccountId: org`) and a new `integrations_gitea_connections` row (`connection_id`/`org` unique, stored `webhook_id`). Re-connecting an already-active org is idempotent and skips a second webhook. Webhook registration itself is idempotent (an existing org hook for the target URL is reused) and compensated (a hook created before a transaction that then rolls back is deleted), so concurrent or retried connects do not leave orphaned hooks. The `GiteaApiClient` gains `organizationExists`, `createOrgPushWebhook`, and `deleteOrgWebhook`, and the provider exposes `connectionExternalUrl` pointing at the org on the Gitea instance.
+  - `@shipfox/api-integration-core`: wire the Gitea connect closure (`connectGiteaConnection`) and the cross-tenant lookup (`getExistingGiteaConnection`) into the provider, mirroring `connectGithubInstallation`.
+
+  Connecting an org creates an active connection visible in `GET /integration-connections` and registers a Gitea webhook whose id is stored.
+
+- 857fd73: Receive Gitea push webhooks and trigger runs through the existing source-push pipeline.
+  - `@shipfox/api-integration-gitea-dto`: `giteaPushPayloadSchema` (`{ref, after, repository: {name, full_name, default_branch, owner: {username}}}`).
+  - `@shipfox/api-integration-gitea`: `POST /webhooks/integrations/gitea` (`auth: []`, `rawBodyPlugin`, standard webhook body limit). It verifies the `X-Gitea-Signature` header as hex HMAC-SHA256 of the raw body keyed by `GITEA_WEBHOOK_SECRET` (401 on mismatch), records non-`push` events for delivery dedup and returns 204, and on a `push` resolves the org (`repository.owner.username`, lower-cased to match the stored org) to its connection, drops branch deletions and unknown orgs, and publishes a normalized `SourcePushPayload` (`externalRepositoryId: gitea:<owner>/<repo>` built from `owner.username`/`repository.name` to match the source-control adapter, `refs/heads/` stripped, `headCommitSha: after`, `isDefaultBranch`). `getGiteaConnectionByOrg` gains an optional transaction executor so the lookup runs inside the publishing transaction. The webhook is registered out of band by the Gitea instance admin, so the connect flow registers nothing.
+  - `@shipfox/api-integration-core`: wire `publishSourcePush`, `recordDeliveryOnly`, `getIntegrationConnectionById`, and the core database into the Gitea provider, mirroring GitHub.
+  - `@shipfox/node-fastify`: add a shared `verifyHexHmacSignature` helper for hex HMAC-SHA256 webhook signatures.
+  - `@shipfox/api-integration-sentry`: `verifySentrySignature` now delegates to the shared helper.
+
+  A push to a connected org's repo creates a workflow run through the existing pipeline. Duplicate POSTs of the same delivery are deduped via `X-Gitea-Delivery`; note that a manual "Redeliver" in Gitea mints a new delivery id and intentionally produces a fresh run (unlike GitHub, whose redelivery reuses the original id and is suppressed).
+
+- Updated dependencies [115655e]
+- Updated dependencies [ce062a9]
+- Updated dependencies [f3614ae]
+- Updated dependencies [f8f339a]
+- Updated dependencies [b8e49ff]
+- Updated dependencies [d6d4862]
+- Updated dependencies [01be723]
+- Updated dependencies [2933c33]
+  - @shipfox/api-integration-core-dto@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './schemas/index.js';
+export declare const giteaProviderKind = "gitea";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AAEnC,eAAO,MAAM,iBAAiB,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from './schemas/index.js';
+export const giteaProviderKind = 'gitea';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './schemas/index.js';\n\nexport const giteaProviderKind = 'gitea';\n"],"names":["giteaProviderKind"],"mappings":"AAAA,cAAc,qBAAqB;AAEnC,OAAO,MAAMA,oBAAoB,QAAQ"}

package/dist/schemas/gitea.d.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+export declare const createGiteaConnectionBodySchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    org: z.ZodString;
+}, z.core.$strip>;
+export type CreateGiteaConnectionBodyDto = z.infer<typeof createGiteaConnectionBodySchema>;
+export declare const createGiteaConnectionResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    workspace_id: z.ZodString;
+    provider: z.ZodString;
+    external_account_id: z.ZodString;
+    slug: z.ZodString;
+    display_name: z.ZodString;
+    lifecycle_status: z.ZodEnum<{
+        error: "error";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        source_control: "source_control";
+        agent_tools: "agent_tools";
+    }>>;
+    external_url: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strip>;
+export type CreateGiteaConnectionResponseDto = z.infer<typeof createGiteaConnectionResponseSchema>;
+//# sourceMappingURL=gitea.d.ts.map

package/dist/schemas/gitea.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitea.d.ts","sourceRoot":"","sources":["../../src/schemas/gitea.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE3F,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;iBAAiC,CAAC;AAClF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/schemas/gitea.js

@@ -0,0 +1,9 @@
+import { integrationConnectionDtoSchema } from '@shipfox/api-integration-core-dto';
+import { z } from 'zod';
+export const createGiteaConnectionBodySchema = z.object({
+    workspace_id: z.string().uuid(),
+    org: z.string().min(1)
+});
+export const createGiteaConnectionResponseSchema = integrationConnectionDtoSchema;
+
+//# sourceMappingURL=gitea.js.map

package/dist/schemas/gitea.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/gitea.ts"],"sourcesContent":["import {integrationConnectionDtoSchema} from '@shipfox/api-integration-core-dto';\nimport {z} from 'zod';\n\nexport const createGiteaConnectionBodySchema = z.object({\n  workspace_id: z.string().uuid(),\n  org: z.string().min(1),\n});\nexport type CreateGiteaConnectionBodyDto = z.infer<typeof createGiteaConnectionBodySchema>;\n\nexport const createGiteaConnectionResponseSchema = integrationConnectionDtoSchema;\nexport type CreateGiteaConnectionResponseDto = z.infer<typeof createGiteaConnectionResponseSchema>;\n"],"names":["integrationConnectionDtoSchema","z","createGiteaConnectionBodySchema","object","workspace_id","string","uuid","org","min","createGiteaConnectionResponseSchema"],"mappings":"AAAA,SAAQA,8BAA8B,QAAO,oCAAoC;AACjF,SAAQC,CAAC,QAAO,MAAM;AAEtB,OAAO,MAAMC,kCAAkCD,EAAEE,MAAM,CAAC;IACtDC,cAAcH,EAAEI,MAAM,GAAGC,IAAI;IAC7BC,KAAKN,EAAEI,MAAM,GAAGG,GAAG,CAAC;AACtB,GAAG;AAGH,OAAO,MAAMC,sCAAsCT,+BAA+B"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,3 @@
+export * from './gitea.js';
+export * from './webhooks.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,4 @@
+export * from './gitea.js';
+export * from './webhooks.js';
+
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/index.ts"],"sourcesContent":["export * from './gitea.js';\nexport * from './webhooks.js';\n"],"names":[],"mappings":"AAAA,cAAc,aAAa;AAC3B,cAAc,gBAAgB"}

package/dist/schemas/webhooks.d.ts

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+export declare const giteaPushPayloadSchema: z.ZodObject<{
+    ref: z.ZodString;
+    after: z.ZodString;
+    repository: z.ZodObject<{
+        name: z.ZodString;
+        full_name: z.ZodString;
+        default_branch: z.ZodString;
+        owner: z.ZodObject<{
+            username: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type GiteaPushPayloadDto = z.infer<typeof giteaPushPayloadSchema>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/schemas/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/schemas/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBASjC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/webhooks.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+export const giteaPushPayloadSchema = z.object({
+    ref: z.string().min(1),
+    after: z.string().min(1),
+    repository: z.object({
+        name: z.string().min(1),
+        full_name: z.string().min(1),
+        default_branch: z.string().min(1),
+        owner: z.object({
+            username: z.string().min(1)
+        })
+    })
+});
+
+//# sourceMappingURL=webhooks.js.map

package/dist/schemas/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/webhooks.ts"],"sourcesContent":["import {z} from 'zod';\n\nexport const giteaPushPayloadSchema = z.object({\n  ref: z.string().min(1),\n  after: z.string().min(1),\n  repository: z.object({\n    name: z.string().min(1),\n    full_name: z.string().min(1),\n    default_branch: z.string().min(1),\n    owner: z.object({username: z.string().min(1)}),\n  }),\n});\nexport type GiteaPushPayloadDto = z.infer<typeof giteaPushPayloadSchema>;\n"],"names":["z","giteaPushPayloadSchema","object","ref","string","min","after","repository","name","full_name","default_branch","owner","username"],"mappings":"AAAA,SAAQA,CAAC,QAAO,MAAM;AAEtB,OAAO,MAAMC,yBAAyBD,EAAEE,MAAM,CAAC;IAC7CC,KAAKH,EAAEI,MAAM,GAAGC,GAAG,CAAC;IACpBC,OAAON,EAAEI,MAAM,GAAGC,GAAG,CAAC;IACtBE,YAAYP,EAAEE,MAAM,CAAC;QACnBM,MAAMR,EAAEI,MAAM,GAAGC,GAAG,CAAC;QACrBI,WAAWT,EAAEI,MAAM,GAAGC,GAAG,CAAC;QAC1BK,gBAAgBV,EAAEI,MAAM,GAAGC,GAAG,CAAC;QAC/BM,OAAOX,EAAEE,MAAM,CAAC;YAACU,UAAUZ,EAAEI,MAAM,GAAGC,GAAG,CAAC;QAAE;IAC9C;AACF,GAAG"}