@sponson/adapters 0.0.0-stage → 0.5.0

package/recipes/resend.yaml

@@ -0,0 +1,130 @@
+# yaml-language-server: $schema=../../../schema/recipe.schema.json
+# Resend API recipes. Format and checklist: docs/adr/0020-recipes.md, CONTRIBUTING.md "Adding a recipe".
+provider: resend
+title: Resend
+category: email
+verified_on: "2026-10-11"
+docs:
+  - title: Create API key
+    url: https://resend.com/docs/api-reference/api-keys/create-api-key
+  - title: List API keys
+    url: https://resend.com/docs/api-reference/api-keys/list-api-keys
+  - title: Delete API key
+    url: https://resend.com/docs/api-reference/api-keys/delete-api-key
+  - title: Create webhook
+    url: https://resend.com/docs/api-reference/webhooks/create-webhook
+  - title: Retrieve webhook
+    url: https://resend.com/docs/api-reference/webhooks/get-webhook
+  - title: List webhooks
+    url: https://resend.com/docs/api-reference/webhooks/list-webhooks
+  - title: Update webhook
+    url: https://resend.com/docs/api-reference/webhooks/update-webhook
+  - title: Delete webhook
+    url: https://resend.com/docs/api-reference/webhooks/delete-webhook
+api:
+  base_url: https://api.resend.com
+  base_url_env: RESEND_API_URL
+  auth: { bearer_env: RESEND_API_KEY }
+detect:
+  deps: [resend]
+  env: ["RESEND_*"]
+  starter:
+    - op: api_key
+      values: { name: "sponson-${ctx.env}-${ctx.scope}" }
+assumptions:
+  - id: RS1
+    verified: true
+    text: "`POST /api-keys` creates an API key from `name` (at most 50 characters), `permission` (`full_access` or `sending_access`) and `domain_id` (with `sending_access` only), answering `{ id, token }`; requests carry `Authorization: Bearer <key>`."
+    source: https://resend.com/docs/api-reference/api-keys/create-api-key
+  - id: RS2
+    verified: true
+    text: "`GET /api-keys` answers `{ object: list, has_more, data: [{ id, name, created_at, last_used_at }] }`, every key when no `limit` is sent, and never the token: the token is shown only in the create answer, so it is a once-only output."
+    source: https://resend.com/docs/api-reference/api-keys/list-api-keys
+  - id: RS3
+    verified: true
+    text: "`DELETE /api-keys/{api_key_id}` removes a key; there is no endpoint to read or change one key, so its permission and domain are sent on create and never compared."
+    source: https://resend.com/docs/api-reference/api-keys/delete-api-key
+  - id: RS4
+    verified: true
+    text: "`POST /webhooks` creates a webhook from `endpoint` and `events` (both required), answering `{ object, id, signing_secret }`."
+    source: https://resend.com/docs/api-reference/webhooks/create-webhook
+  - id: RS5
+    verified: true
+    text: "`GET /webhooks/{webhook_id}` answers the webhook with `status` (`enabled`/`disabled`), `endpoint`, `events` and `signing_secret`: the secret stays readable, so it is an ordinary sensitive output."
+    source: https://resend.com/docs/api-reference/webhooks/get-webhook
+  - id: RS6
+    verified: true
+    text: "`GET /webhooks` answers `{ object: list, has_more, data: [{ id, created_at, status, endpoint, events }] }`, every webhook when no `limit` is sent."
+    source: https://resend.com/docs/api-reference/webhooks/list-webhooks
+  - id: RS7
+    verified: true
+    text: "`PATCH /webhooks/{webhook_id}` changes `endpoint`, `events` and `status`; `DELETE` on the same path removes the webhook."
+    source: https://resend.com/docs/api-reference/webhooks/update-webhook
+  - id: RS8
+    verified: false
+    text: "Key names and webhook endpoints are not unique in Resend: the recipe takes the name (keys) and the endpoint URL (webhooks) as the identity, and refuses (PARAM_INVALID) when two match, so give each environment its own name and URL."
+  - id: RS9
+    verified: false
+    text: "Creating a key or a webhook needs a `full_access` key; a deleted object answers 404."
+ops:
+  api_key:
+    kind: resource
+    title: API key
+    summary: "A restricted API key per environment, such as `sponson-preview-pr-42` allowed only to send from one domain. Its token is a once-only output: pass it to the app's environment line in the same run (`{ from: <line>.token }`); later runs keep what that line holds, and `apply --recreate <line>` issues a new one. Only its existence is compared for drift: Resend shows no permission or domain for a key."
+    covers: [resend-key-webhook]
+    params:
+      name:
+        type: string
+        required: true
+        pattern: "^.{1,50}$"
+        description: The key's name, unique among the account's keys (RS8); its identity.
+        example: "sponson-${ctx.env}-${ctx.scope}"
+      permission:
+        type: string
+        default: sending_access
+        enum: [full_access, sending_access]
+        description: What the key may do.
+      domain_id:
+        type: string
+        description: With `sending_access`, the only domain the key may send from.
+    http:
+      find:
+        path: /api-keys
+        list_path: /data
+        match: { name: { param: name } }
+      create:
+        path: /api-keys
+        body: { permission: { param: permission }, domain_id: { param: domain_id } }
+      delete: { path: "/api-keys/{id}" }
+      outputs:
+        token: { path: /token, sensitive: true, once: true }
+  webhook:
+    kind: resource
+    title: Webhook
+    summary: "A webhook delivering an environment's email events to its URL, such as the preview's `/api/resend` handler. Located by its endpoint URL; a console edit of its events is drift (its enabled/disabled status is left to the console: the create request takes none). Its signing secret is a sensitive output, readable on every run."
+    covers: [resend-key-webhook]
+    params:
+      endpoint:
+        type: string
+        required: true
+        pattern: "^https://\\S+$"
+        description: The URL events are delivered to; its identity (RS8).
+        example: "https://${ctx.scope}.preview.example.com/api/resend"
+      events:
+        type: list
+        required: true
+        description: The event types to deliver, such as `email.delivered` and `email.bounced`.
+        example: [email.delivered, email.bounced]
+    http:
+      find:
+        path: /webhooks
+        list_path: /data
+        match: { endpoint: { param: endpoint } }
+      read: { path: "/webhooks/{id}" }
+      create: { path: /webhooks }
+      update: { method: PATCH, path: "/webhooks/{id}" }
+      delete: { path: "/webhooks/{id}" }
+      fields:
+        events: { param: events }
+      outputs:
+        signing_secret: { path: /signing_secret, sensitive: true }

package/recipes/s3.yaml

@@ -0,0 +1,108 @@
+# yaml-language-server: $schema=../../../schema/recipe.schema.json
+# S3 API recipes (Amazon S3, and Cloudflare R2 through its S3-compatible endpoint): XML documents, every request
+# signed with AWS Signature Version 4. Format and checklist: docs/adr/0020-recipes.md, CONTRIBUTING.md "Adding a recipe".
+provider: s3
+title: Amazon S3 / Cloudflare R2 (S3 API)
+category: cors
+verified_on: "2026-10-11"
+docs:
+  - title: PutBucketCors
+    url: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html
+  - title: GetBucketCors
+    url: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html
+  - title: DeleteBucketCors
+    url: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketCors.html
+  - title: R2 S3 API compatibility
+    url: https://developers.cloudflare.com/r2/api/s3/api/
+base_url_example: https://assets.s3.us-east-1.amazonaws.com
+api:
+  base_url_env: S3_API_URL
+  encoding: xml
+  auth:
+    aws_sigv4: { region: us-east-1, service: s3, access_key_id_env: AWS_ACCESS_KEY_ID, secret_access_key_env: AWS_SECRET_ACCESS_KEY }
+detect:
+  deps: ["@aws-sdk/client-s3"]
+  starter:
+    - op: bucket_cors
+      preview_url: origin
+      values: { rule_id: "sponson-${ctx.scope}" }
+  where:
+    base_url: "the bucket's endpoint: `https://<bucket>.s3.<region>.amazonaws.com`, or R2's `https://<account id>.r2.cloudflarestorage.com/<bucket>`"
+assumptions:
+  - id: SS1
+    verified: true
+    text: "`PUT /?cors` on the bucket's endpoint replaces its whole CORS configuration with a `CORSConfiguration` document of up to 100 `CORSRule`s (each `ID`, `AllowedOrigin`s, `AllowedMethod`s, `AllowedHeader`s, `ExposeHeader`s, `MaxAgeSeconds`) and requires `Content-MD5`, which the SigV4 signer adds for `s3`."
+    source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html
+  - id: SS2
+    verified: true
+    text: "`GET /?cors` answers the configuration as XML."
+    source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html
+  - id: SS3
+    verified: true
+    text: "`DELETE /?cors` removes the configuration (the way to leave a bucket with no rule)."
+    source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketCors.html
+  - id: SS4
+    verified: true
+    text: "R2 implements PutBucketCors, GetBucketCors and DeleteBucketCors at `https://<ACCOUNT_ID>.r2.cloudflarestorage.com`; its SigV4 region is `auto`, and `us-east-1` is accepted as an alias, so the recipe's region works for R2 unchanged."
+    source: https://developers.cloudflare.com/r2/api/s3/api/
+  - id: SS5
+    verified: false
+    text: "A bucket without a CORS configuration answers 404 `NoSuchCORSConfiguration` (read as an empty list, `parent.if_missing: empty`), and an empty configuration is refused as `MalformedXML` (so the last rule is removed with DELETE, `parent.when_empty: delete`)."
+  - id: SS6
+    verified: false
+    text: "R2 accepts path-style requests (`https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<bucket>/?cors`), so its base URL names the bucket in the path."
+  - id: SS7
+    verified: false
+    text: "S3 answers a rule's elements as they were written; a rule's `ID` identifies it among the bucket's rules (IDs are not required to be unique by S3, so other writers must not reuse the recipe's)."
+ops:
+  bucket_cors:
+    kind: list_item
+    title: CORS rule of a bucket
+    summary: "A CORS rule of an S3 or R2 bucket allowing the preview's origin, identified by its `ID` (such as `sponson-pr-42`); every other rule is left as it is. The base URL names the bucket: `https://<bucket>.s3.<region>.amazonaws.com` (set `auth.aws_sigv4.region` to the bucket's region), or `https://<account>.r2.cloudflarestorage.com/<bucket>` for R2. A console edit of the rule is drift; destroy removes only this rule (the whole configuration when it was the last one)."
+    covers: [s3-r2-cors]
+    params:
+      rule_id:
+        type: string
+        required: true
+        pattern: "^.{1,255}$"
+        description: The rule's `ID`, at most 255 characters; its identity (SS7).
+        example: "sponson-${ctx.scope}"
+      origin:
+        type: string
+        required: true
+        pattern: "^(https?://\\S+|\\*)$"
+        description: The origin allowed (the preview's URL, without a path).
+        example: "https://${ctx.scope}.preview.example.app"
+      methods:
+        type: list
+        default: [GET]
+        description: "The methods allowed: `GET`, `PUT`, `POST`, `DELETE`, `HEAD`."
+      allowed_headers:
+        type: list
+        description: "Request headers a preflight may ask for (`*` for any); absent: none."
+      expose_headers:
+        type: list
+        description: Response headers the browser may read; absent, none.
+      max_age_seconds:
+        type: string
+        default: "3000"
+        pattern: "^[0-9]+$"
+        description: How long a preflight answer may be cached, in seconds (a string, as XML carries it).
+    http:
+      parent: { path: "/?cors", method: PUT, if_missing: empty, when_empty: delete }
+      list_path: /CORSConfiguration/CORSRule
+      key_field: ID
+      item:
+        AllowedHeader: { param: allowed_headers }
+        AllowedMethod: { param: methods }
+        AllowedOrigin: { param: origin }
+        ExposeHeader: { param: expose_headers }
+        ID: { param: rule_id }
+        MaxAgeSeconds: { param: max_age_seconds }
+    sim:
+      provider: aws
+      base_path: /aws/s3/assets
+      seed: { buckets: { assets: { cors: null } } }
+      present: /buckets/assets/cors/0
+      drift:
+        missing: { s3.assets.cors: "remove:sponson-pr-42" }

package/recipes/sendgrid.yaml

@@ -0,0 +1,165 @@
+# yaml-language-server: $schema=../../../schema/recipe.schema.json
+# Twilio SendGrid v3 API recipes. Format and checklist: docs/adr/0020-recipes.md, CONTRIBUTING.md "Adding a recipe".
+provider: sendgrid
+title: SendGrid
+category: email
+verified_on: "2026-10-11"
+docs:
+  - title: Create an Event Webhook
+    url: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/create-an-event-webhook
+  - title: Get all Event Webhooks
+    url: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/get-all-event-webhooks
+  - title: Get an Event Webhook
+    url: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/get-an-event-webhook
+  - title: Update an Event Webhook
+    url: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/update-an-event-webhook
+  - title: Delete an Event Webhook
+    url: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/delete-an-event-webhook
+  - title: Create a parse setting
+    url: https://www.twilio.com/docs/sendgrid/api-reference/settings-inbound-parse/create-a-parse-setting
+  - title: Retrieve a specific parse setting
+    url: https://www.twilio.com/docs/sendgrid/api-reference/settings-inbound-parse/retrieve-a-specific-parse-setting
+  - title: Update a parse setting
+    url: https://www.twilio.com/docs/sendgrid/api-reference/settings-inbound-parse/update-a-parse-setting
+  - title: Delete a parse setting
+    url: https://www.twilio.com/docs/sendgrid/api-reference/settings-inbound-parse/delete-a-parse-setting
+api:
+  base_url: https://api.sendgrid.com
+  base_url_env: SENDGRID_API_URL
+  auth: { bearer_env: SENDGRID_API_KEY }
+detect:
+  deps: ["@sendgrid/"]
+  env: ["SENDGRID_*"]
+  starter:
+    - op: event_webhook
+  where:
+    url: "the preview's event handler: its URL plus the handler's path (a `{ from }` reference cannot carry a path)"
+assumptions:
+  - id: SG1
+    verified: true
+    text: "`POST /v3/user/webhooks/event/settings` creates an Event Webhook from `url` (required), `enabled`, one boolean per event type (`processed`, `delivered`, `dropped`, `deferred`, `bounce`, `open`, `click`, `spam_report`, `unsubscribe`, `group_unsubscribe`, `group_resubscribe`) and `friendly_name`, answering 201 with the webhook and its string `id`; requests carry the API key as `Authorization: Bearer`. EU regional subusers use `https://api.eu.sendgrid.com`."
+    source: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/create-an-event-webhook
+  - id: SG2
+    verified: true
+    text: "Each URL can be used by only one Event Webhook (a second create answers 400 naming the existing id), so the URL identifies the webhook; the number of webhooks is limited by the plan (400 beyond it)."
+    source: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/create-an-event-webhook
+  - id: SG3
+    verified: true
+    text: "`GET /v3/user/webhooks/event/settings/all` answers `{ max_allowed, webhooks: [...] }` with every webhook's settings and `id`."
+    source: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/get-all-event-webhooks
+  - id: SG4
+    verified: true
+    text: "`PATCH /v3/user/webhooks/event/settings/{id}` requires `url` and updates the fields sent; `DELETE` on the same path answers 204, and 404 for an unknown id. Without an id these paths act on the oldest webhook, which the recipe never does (its paths always carry the id)."
+    source: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/update-an-event-webhook
+  - id: SG5
+    verified: true
+    text: "Signature verification and its public key are set through a separate endpoint and are not part of the webhook's create or update; this recipe does not manage them."
+    source: https://www.twilio.com/docs/sendgrid/api-reference/webhooks/create-an-event-webhook
+  - id: SG6
+    verified: true
+    text: "`POST /v3/user/webhooks/parse/settings` creates an Inbound Parse setting from `url`, `hostname`, `spam_check` and `send_raw`, answering 201 with those four fields bare; `GET`, `PATCH` and `DELETE` (204) `/v3/user/webhooks/parse/settings/{hostname}` read, update and remove it. The hostname must be on a domain authenticated in SendGrid, with an MX record pointing at SendGrid."
+    source: https://www.twilio.com/docs/sendgrid/api-reference/settings-inbound-parse/create-a-parse-setting
+  - id: SG7
+    verified: false
+    text: "A PATCH that leaves out an event flag keeps its current value (the documentation's examples send only `url`); the recipe sends every flag it compares anyway."
+  - id: SG8
+    verified: false
+    text: "A parse setting for a hostname that exists already is refused with an error status (not documented which); the next run then finds it by its hostname."
+ops:
+  event_webhook:
+    kind: resource
+    title: Event Webhook
+    summary: An Event Webhook delivering an environment's email events to its URL, such as the preview's `/api/sendgrid/events` handler. Located by its URL (unique in SendGrid); a console edit of its enabled flag, an event flag or its friendly name is drift.
+    covers: [sendgrid-webhook]
+    params:
+      url:
+        type: string
+        required: true
+        pattern: "^https?://\\S+$"
+        description: The URL events are posted to; its identity (SG2).
+        example: "https://${ctx.scope}.preview.example.com/api/sendgrid/events"
+      enabled:
+        type: boolean
+        default: true
+        description: Whether events are posted.
+      friendly_name:
+        type: string
+        description: A label for the webhook (not unique).
+        example: "sponson ${ctx.env} ${ctx.scope}"
+      processed: { type: boolean, default: false, description: Post `processed` events. }
+      delivered: { type: boolean, default: true, description: Post `delivered` events. }
+      dropped: { type: boolean, default: true, description: Post `dropped` events. }
+      deferred: { type: boolean, default: false, description: Post `deferred` events. }
+      bounce: { type: boolean, default: true, description: Post `bounce` events. }
+      open: { type: boolean, default: false, description: Post `open` events. }
+      click: { type: boolean, default: false, description: Post `click` events. }
+      spam_report: { type: boolean, default: true, description: Post `spam_report` events. }
+      unsubscribe: { type: boolean, default: false, description: Post `unsubscribe` events. }
+      group_unsubscribe: { type: boolean, default: false, description: Post `group_unsubscribe` events. }
+      group_resubscribe: { type: boolean, default: false, description: Post `group_resubscribe` events. }
+    http:
+      find:
+        path: /v3/user/webhooks/event/settings/all
+        list_path: /webhooks
+        match: { url: { param: url } }
+      create: { path: /v3/user/webhooks/event/settings }
+      update:
+        method: PATCH
+        path: "/v3/user/webhooks/event/settings/{id}"
+        body: { url: { param: url } }
+      delete: { path: "/v3/user/webhooks/event/settings/{id}" }
+      fields:
+        enabled: { param: enabled }
+        friendly_name: { param: friendly_name }
+        processed: { param: processed }
+        delivered: { param: delivered }
+        dropped: { param: dropped }
+        deferred: { param: deferred }
+        bounce: { param: bounce }
+        open: { param: open }
+        click: { param: click }
+        spam_report: { param: spam_report }
+        unsubscribe: { param: unsubscribe }
+        group_unsubscribe: { param: group_unsubscribe }
+        group_resubscribe: { param: group_resubscribe }
+  parse_setting:
+    kind: resource
+    title: Inbound Parse setting
+    summary: An Inbound Parse host per environment, such as `pr-42.parse.example.com`, posting the mail it receives to the environment's URL. Named by its hostname; a console edit of its URL, spam check or raw flag is drift. The hostname's domain must be authenticated in SendGrid and its MX record point at SendGrid (a wildcard record serves every environment).
+    covers: [sendgrid-webhook]
+    params:
+      hostname:
+        type: string
+        required: true
+        pattern: "^[a-z0-9.-]+$"
+        description: The host mail is received for, lower-case; its identity.
+        example: "${ctx.scope}.parse.example.com"
+      url:
+        type: string
+        required: true
+        pattern: "^https?://\\S+$"
+        description: The URL parsed mail is posted to.
+        example: "https://${ctx.scope}.preview.example.com/api/sendgrid/inbound"
+      spam_check:
+        type: boolean
+        default: false
+        description: Check mail for spam before posting it.
+      send_raw:
+        type: boolean
+        default: false
+        description: Post the original MIME message.
+    http:
+      read: { path: "/v3/user/webhooks/parse/settings/{hostname}" }
+      create:
+        path: /v3/user/webhooks/parse/settings
+        body: { hostname: { param: hostname } }
+      update: { method: PATCH }
+      id_path: /hostname
+      fields:
+        url: { param: url }
+        spam_check: { param: spam_check }
+        send_raw: { param: send_raw }
+    sim:
+      id_from: hostname
+    live:
+      params: { hostname: SPONSON_LIVE_SENDGRID_PARSE_HOSTNAME }

package/recipes/sentry.yaml

@@ -0,0 +1,158 @@
+# yaml-language-server: $schema=../../../schema/recipe.schema.json
+# Sentry Web API recipes. Format and checklist: docs/adr/0020-recipes.md, CONTRIBUTING.md "Adding a recipe".
+provider: sentry
+title: Sentry
+category: observability
+verified_on: "2026-10-11"
+docs:
+  - title: Create a New Release for an Organization
+    url: https://docs.sentry.io/api/releases/create-a-new-release-for-an-organization/
+  - title: Retrieve an Organization's Release
+    url: https://docs.sentry.io/api/releases/retrieve-an-organizations-release/
+  - title: Update an Organization's Release
+    url: https://docs.sentry.io/api/releases/update-an-organizations-release/
+  - title: Delete an Organization's Release
+    url: https://docs.sentry.io/api/releases/delete-an-organizations-release/
+  - title: Create a Deploy
+    url: https://docs.sentry.io/api/releases/create-a-deploy/
+  - title: List a Release's Deploys
+    url: https://docs.sentry.io/api/releases/list-a-releases-deploys/
+  - title: Release Management (sentry-cli)
+    url: https://docs.sentry.io/cli/releases/
+api:
+  base_url: https://sentry.io/api/0
+  base_url_env: SENTRY_API_URL
+  auth: { bearer_env: SENTRY_AUTH_TOKEN }
+detect:
+  deps: ["@sentry/"]
+  env: ["SENTRY_*"]
+  files: [sentry.client.config.ts, sentry.client.config.js, sentry.server.config.ts, sentry.server.config.js, sentry.properties, .sentryclirc]
+  starter:
+    - op: release
+      values: { version: "app@${ctx.git.sha}" }
+  where:
+    organization: "Sentry → Settings → Organization Settings → Organization Slug"
+    project: "Sentry → Settings → Projects: the project's slug"
+assumptions:
+  - id: SE1
+    verified: true
+    text: "`POST /api/0/organizations/{organization_id_or_slug}/releases/` creates a release from `version` and `projects` (both required), `ref`, `url`, `dateReleased` and commit data, with a bearer token holding `project:releases`, `project:write`, `project:admin` or `org:ci`; it answers 201 (or 208)."
+    source: https://docs.sentry.io/api/releases/create-a-new-release-for-an-organization/
+  - id: SE2
+    verified: true
+    text: "A version is one release across the organization's projects, and `GET /api/0/organizations/{org}/releases/{version}/` answers it (404 when there is none), so the version names the release."
+    source: https://docs.sentry.io/api/releases/retrieve-an-organizations-release/
+  - id: SE3
+    verified: true
+    text: "`PUT /api/0/organizations/{org}/releases/{version}/` updates `ref`, `url`, `dateReleased` and commit data (the documentation says an omitted `dateReleased` is the current time), and answers the release."
+    source: https://docs.sentry.io/api/releases/update-an-organizations-release/
+  - id: SE4
+    verified: true
+    text: "`DELETE /api/0/organizations/{org}/releases/{version}/` permanently removes a release and its files (`project:releases` or `project:admin`). The recipe keeps releases on destroy: one version is shared by every environment it is deployed to."
+    source: https://docs.sentry.io/api/releases/delete-an-organizations-release/
+  - id: SE5
+    verified: true
+    text: "`POST /api/0/organizations/{org}/releases/{version}/deploys/` records a deploy of the release from `environment` (required), `name`, `url`, `dateStarted`, `dateFinished` (default now) and `projects` (default: all of the release's)."
+    source: https://docs.sentry.io/api/releases/create-a-deploy/
+  - id: SE6
+    verified: true
+    text: "`GET /api/0/organizations/{org}/releases/{version}/deploys/` lists the release's deploys; deploys cannot be deleted, so the deploy op never deletes (`destroy: never`)."
+    source: https://docs.sentry.io/cli/releases/
+  - id: SE7
+    verified: true
+    text: "The release's `dateReleased` defaults to the current time on create, so a release this recipe creates is finalized at once."
+    source: https://docs.sentry.io/api/releases/create-a-new-release-for-an-organization/
+  - id: SE8
+    verified: false
+    text: "A create for a version that exists answers 208 with the existing release (not an error), so a release another tool made (sentry-cli in the build) is taken over without a second write; the recipe keeps it on destroy either way."
+  - id: SE9
+    verified: false
+    text: "The deploy list answers a bare array of `{ id, environment, name, url, dateStarted, dateFinished }` with string ids, all of a release's deploys on the first page; `environment` and `name` together identify the deploy this recipe recorded."
+  - id: SE10
+    verified: false
+    text: "Release `url` is answered as sent (null when unset); organizations hosted in another region (`de.sentry.io`) or self-hosted Sentry set `base_url` in the provider block."
+ops:
+  release:
+    kind: resource
+    title: Release
+    summary: "A release for the commit, such as `app@${ctx.git.sha}`, in the given projects, finalized when created (SE7). Named by its version; a console edit of its URL is drift. Kept on destroy (shared history: preview and production deploy the same version); `destroy: delete` on the line removes it."
+    covers: [sentry-release]
+    destroy: keep
+    params:
+      organization:
+        type: string
+        required: true
+        description: The organization's slug or id.
+        example: acme
+      version:
+        type: string
+        required: true
+        pattern: "^[^/\\s]+$"
+        description: The release's version (no slashes or whitespace), such as `app@<sha>`.
+        example: "app@${ctx.git.sha}"
+      project:
+        type: string
+        required: true
+        description: The slug of the project the release belongs to (a release of several projects is a hand-written `http` line).
+        example: web
+      url:
+        type: string
+        description: A link for the release (its commit or build).
+        example: "https://github.com/acme/app/commit/${ctx.git.sha}"
+      ref:
+        type: string
+        description: A commit reference, sent on create.
+    http:
+      read: { path: "/organizations/{organization}/releases/{version}/" }
+      create:
+        path: "/organizations/{organization}/releases/"
+        body: { version: { param: version }, projects: [{ param: project }], ref: { param: ref } }
+      update: { method: PUT }
+      id_path: /version
+      fields:
+        url: { param: url }
+    sim:
+      id_from: version
+    live:
+      params: { organization: SPONSON_LIVE_SENTRY_ORG, project: SPONSON_LIVE_SENTRY_PROJECT }
+  deploy:
+    kind: resource
+    title: Deploy of a release to an environment
+    summary: "The record that a release was deployed to an environment (`preview`, named for the scope), which Sentry shows on the release and uses for deploy notifications. Located by environment and name among the release's deploys. Sentry has no way to change or delete a deploy, so nothing is compared for drift and destroy leaves it (`destroy: never`)."
+    covers: [sentry-release]
+    destroy: never
+    params:
+      organization:
+        type: string
+        required: true
+        description: The organization's slug or id.
+        example: acme
+      version:
+        type: string
+        required: true
+        pattern: "^[^/\\s]+$"
+        description: "The deployed release's version; the release must exist (`{ from: <release line>.id }` orders the lines)."
+        example: "app@${ctx.git.sha}"
+      environment:
+        type: string
+        required: true
+        description: The environment deployed to.
+        example: "${ctx.env}"
+      name:
+        type: string
+        required: true
+        description: The deploy's name, which with the environment identifies it among the release's deploys.
+        example: "sponson-${ctx.scope}"
+      url:
+        type: string
+        description: A link to the deployment (the preview URL), sent on create.
+    http:
+      find:
+        path: "/organizations/{organization}/releases/{version}/deploys/"
+        match: { environment: { param: environment }, name: { param: name } }
+      create:
+        path: "/organizations/{organization}/releases/{version}/deploys/"
+        body: { url: { param: url } }
+      delete: { path: "/organizations/{organization}/releases/{version}/deploys/{id}/" }
+    live:
+      params: { organization: SPONSON_LIVE_SENTRY_ORG, version: SPONSON_LIVE_SENTRY_VERSION }