@zksecurity/zkao-sdk 0.15.0-next.10 → 0.17.0-next.12

package/dist/index.d.ts

@@ -137,6 +137,34 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/projects/{projectId}/repositories/{repositoryId}/continuous-testing": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a repository's Continuous Testing schedule
+         * @description Requires scope: `read`. Continuous Testing scans one branch on a schedule paid from a monthly budget. With no schedule on the branch, `enabled` is false and the schedule fields are null. The recommended monthly budget funds a run every day at the repository's recommended per-run budget; the minimum funds a run every week at it.
+         */
+        get: operations["getContinuousTesting"];
+        /**
+         * Turn Continuous Testing on, change it, or pause it
+         * @description Requires scope: `automations:write`. Every field is optional. With no schedule on the branch, the request creates one at the recommended monthly budget unless `monthlyBudgetCredits` is given; `enabled: false` then changes nothing. A monthly budget at or above the recommended one runs every day, one at or above the minimum runs once a week with larger runs, and one below the minimum is refused with `400`. `areaKeys` replaces the audit areas runs rotate through, one per run. `enabled: false` pauses the schedule and keeps it. A change re-arms a schedule that had stopped. Each run still needs spendable credits when it launches.
+         */
+        put: operations["setContinuousTesting"];
+        post?: never;
+        /**
+         * Remove a repository's Continuous Testing schedule
+         * @description Requires scope: `automations:write`. Scans the schedule already ran stay. Responds `404` when the branch has no schedule.
+         */
+        delete: operations["removeContinuousTesting"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/projects/{projectId}/scans": {
         parameters: {
             query?: never;
@@ -269,7 +297,7 @@ interface paths {
         };
         /**
          * List advisories
-         * @description Requires scope: `read`. The project's coordinated-disclosure advisories, newest first. Optionally filter by `status`.
+         * @description Requires scope: `read`. The project's coordinated-disclosure advisories, newest first. Optionally filter by `status`. A repository-restricted token sees an advisory only when every associated repository is in its allowlist.
          */
         get: operations["listAdvisories"];
         put?: never;
@@ -289,7 +317,9 @@ interface paths {
         };
         /**
          * Get an advisory
-         * @description Requires scope: `read`. The advisory, the versions it affects, and the notices planned for it.
+         * @description Requires scope: `read`. The advisory, the software it concerns, the versions it affects, and the notices planned for it. Every associated repository must be in the token's allowlist.
+         *
+         *     `software` is what decides the audience: a contact is notified about an advisory only when they run some of it. `affected` is a separate statement about versions, and is often empty.
          *
          *     A notice the plan is holding back carries `blockedReason`. The commonest one is that no affected range names a fixed version, which only the people who shipped the release can supply; record it in the app and the notice becomes schedulable.
          */
@@ -302,6 +332,66 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/projects/{projectId}/advisories/{publicId}/affected": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Record which versions an advisory affects
+         * @description Requires scope: `advisories:write`. Replaces the whole set of affected ranges, so send what is affected now rather than a patch. Every existing and requested repository must be in the token's allowlist. This check also applies to an empty replacement.
+         *
+         *     `fixedIn` is the point of this endpoint. A patch notice stays blocked until some range names a fixed version, and only the people who shipped the release know it.
+         *
+         *     Versions only. A range may name only software already on the advisory's `software`, and anything else is a `400`. Which software an advisory concerns decides who hears about it, and that is its own statement, made in the app: a call about versions does not change it in either direction.
+         *
+         *     This call never sends anything. It records versions and recomputes the disclosure plan: a notice blocked for want of a fix becomes eligible to go, and one that loses its fix is blocked again, dropping any approval it was carrying so nobody approves wording a later fix rewrites. When an eligible notice is actually sent is governed by the programme's own settings, not by this call.
+         */
+        put: operations["replaceAdvisoryAffected"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/projects/{projectId}/advisory-contacts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the advisory contacts
+         * @description Requires scope: `contacts:read`. The programme's contact list, oldest first, which is the order to read it in when reconciling against a record kept elsewhere.
+         *
+         *     Its own scope, not `read`: this list is other people's work addresses and the record of who learns about a vulnerability before the public does, so a routine pipeline token does not reach it.
+         *
+         *     `software` on each row is what notices are matched on. A project with no security programme reads as an empty list.
+         */
+        get: operations["listAdvisoryContacts"];
+        put?: never;
+        /**
+         * Add an advisory contact
+         * @description Requires scope: `contacts:write`. Puts one address on the programme's contact list.
+         *
+         *     `software` says which of the project's repositories this contact runs, and is required. It is what every notice is matched on: a contact who runs nothing is told nothing.
+         *
+         *     The contact starts `PENDING_VERIFICATION`, and an unconfirmed address receives nothing embargoed. The confirmation mail is sent from the app, not by this call, so nothing is emailed to the address you send here.
+         *
+         *     There is no endpoint that reads the contact list back. It is other people's work addresses and the record of who hears about a vulnerability early.
+         */
+        post: operations["addAdvisoryContact"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/projects/{projectId}/findings": {
         parameters: {
             query?: never;
@@ -665,6 +755,11 @@ interface components {
         Scan: {
             id: string;
             status: components["schemas"]["ScanStatus"];
+            /**
+             * @description An actionable setup failure for a failed scan. Null for other statuses and internal failures. Restore a project member's GitHub access or approve the App permissions before launching again.
+             * @enum {string|null}
+             */
+            failureCode?: "NO_MEMBER_REPO_ACCESS" | "GITHUB_APP_PERMISSIONS_PENDING" | null;
             repositoryId: string;
             commitHash?: string | null;
             /** @description A diff scan's base, as the merge base SHA its change is measured from. Null for other scans. */
@@ -745,6 +840,7 @@ interface components {
         };
         FindingNote: {
             id: string;
+            /** @description Markdown. A page of the app the assistant names is an absolute link. */
             body: string;
             /** Format: date-time */
             createdAt: string;
@@ -868,9 +964,35 @@ interface components {
             description: string;
             impact: string;
             cwe?: string | null;
+            /** @description The software the advisory is about. A contact hears about it only when they run some of it. */
+            software: {
+                owner: string;
+                name: string;
+            }[];
             affected: components["schemas"]["AdvisoryAffected"][];
             notices: components["schemas"]["AdvisoryNotice"][];
         };
+        AdvisoryContact: {
+            id: string;
+            email: string;
+            organization: string;
+            tier: string;
+            /** @description `PENDING_VERIFICATION` until the contact confirms the address. An unconfirmed address receives nothing embargoed. */
+            status: string;
+            /** @description The software this contact runs, which notices are matched on. */
+            software: {
+                owner: string;
+                name: string;
+            }[];
+            /** Format: date-time */
+            createdAt: string;
+        };
+        PaginatedAdvisoryContacts: {
+            items: components["schemas"]["AdvisoryContact"][];
+            page: number;
+            limit: number;
+            total: number;
+        };
         PaginatedAdvisories: {
             items: components["schemas"]["Advisory"][];
             page: number;
@@ -987,6 +1109,59 @@ interface components {
             key: string;
             deleted: boolean;
         };
+        ContinuousTesting: {
+            repositoryId: string;
+            /** @description False when Continuous Testing is not offered. */
+            available: boolean;
+            /** @description False when there is no schedule or it is paused. */
+            enabled: boolean;
+            /**
+             * @description Why an enabled schedule is not running: `budget_reached` when the project's monthly automation cap is spent, `error` after repeated failures. Null with no schedule.
+             * @enum {string|null}
+             */
+            state: "active" | "converged" | "budget_reached" | "error" | null;
+            branch: string;
+            /** @description The per-run budget times the runs the cadence fits in a month. */
+            monthlyBudgetCredits: number | null;
+            /**
+             * @description New and re-planned schedules are daily or weekly. Older schedules may be biweekly or monthly until their budget changes.
+             * @enum {string|null}
+             */
+            cadence: "daily" | "weekly" | "biweekly" | "monthly" | null;
+            perRunBudgetCredits: number | null;
+            /** @description Audit areas the runs rotate through, one per run, least recently scanned first. Empty means every run scans the whole repository. */
+            areaKeys: string[];
+            /** @description Net credits the schedule's runs spent since the UTC month began. */
+            spentThisMonthCredits: number;
+            /** @description Runs the schedule launched since the UTC month began. */
+            runsThisMonth: number;
+            /** Format: date-time */
+            lastRunAt: string | null;
+            /**
+             * Format: date-time
+             * @description When the next run becomes due. A past time means within the hour. Null when paused or stopped.
+             */
+            nextRunAt: string | null;
+            /** @description A month that funds a daily run at the recommended per-run budget. */
+            recommendedMonthlyCredits: number | null;
+            /** @description A month that funds a weekly run at that budget. Less is refused. */
+            minimumMonthlyCredits: number | null;
+        };
+        SetContinuousTestingRequest: {
+            /** @description False pauses the schedule; true turns it on or resumes it. */
+            enabled?: boolean;
+            /** @description Re-plans the cadence and the per-run budget. */
+            monthlyBudgetCredits?: number;
+            /** @description Replaces the rotation set. An empty array scans the whole repository every run. */
+            areaKeys?: string[];
+            /** @description The scheduled branch. Defaults to the repository's default branch. */
+            branch?: string;
+        };
+        RemoveContinuousTestingResult: {
+            repositoryId: string;
+            branch: string;
+            removed: boolean;
+        };
         CancelScanResult: {
             scanId: string;
             /** @description Terminal status after cancellation (always CANCELLED). */
@@ -1036,18 +1211,18 @@ interface components {
         PublishFindingRequest: {
             /** @description A note id on the finding to pin as the published note. */
             noteId?: string;
-            /** @description Generate a password to gate access to the public artifact. */
+            /** @description True generates a new access password. False removes password protection. Omission preserves an existing password. */
             withPassword?: boolean;
         };
         PublishScanRequest: {
-            /** @description Generate a password to gate access to the public artifact. */
+            /** @description True generates a new access password. False removes password protection. Omission preserves an existing password. */
             withPassword?: boolean;
         };
         PublishArtifactResult: {
             artifactId: string;
             /** @description Slug in /public/{scans,findings}/<publicId>. */
             publicId: string;
-            /** @description The generated access password when withPassword was requested; otherwise null. */
+            /** @description The artifact's current access password, or null when it has no password. */
             accessPassword?: string | null;
         };
     };
@@ -1142,6 +1317,8 @@ interface components {
         /** @description The finding id, or the `ZK-` label shown on the finding page (the id's last eight characters, prefix optional). A label that matches more than one finding in the project is refused with `409 conflict`; use the full id. */
         FindingId: string;
         RepositoryId: string;
+        /** @description The scheduled branch. Defaults to the repository's default branch. */
+        ContinuousTestingBranch: string;
         Page: number;
         Limit: number;
     };
@@ -1347,6 +1524,97 @@ interface operations {
             409: components["responses"]["Conflict"];
         };
     };
+    getContinuousTesting: {
+        parameters: {
+            query?: {
+                /** @description The scheduled branch. Defaults to the repository's default branch. */
+                branch?: components["parameters"]["ContinuousTestingBranch"];
+            };
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                repositoryId: components["parameters"]["RepositoryId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContinuousTesting"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setContinuousTesting: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                repositoryId: components["parameters"]["RepositoryId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetContinuousTestingRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContinuousTesting"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    removeContinuousTesting: {
+        parameters: {
+            query?: {
+                /** @description The scheduled branch. Defaults to the repository's default branch. */
+                branch?: components["parameters"]["ContinuousTestingBranch"];
+            };
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                repositoryId: components["parameters"]["RepositoryId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RemoveContinuousTestingResult"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     listScans: {
         parameters: {
             query?: {
@@ -1589,6 +1857,141 @@ interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    replaceAdvisoryAffected: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                /** @description The advisory's readable identifier. */
+                publicId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    affected: {
+                        repository: {
+                            owner: string;
+                            name: string;
+                        };
+                        /** @description First version carrying the defect. */
+                        introducedIn: string;
+                        /** @description Version that closes the range, or null. */
+                        fixedIn?: string | null;
+                    }[];
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        advisory: components["schemas"]["AdvisoryDetail"];
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+        };
+    };
+    listAdvisoryContacts: {
+        parameters: {
+            query?: {
+                page?: components["parameters"]["Page"];
+                limit?: components["parameters"]["Limit"];
+                tier?: "EMBARGO" | "DOWNSTREAM" | "ANNOUNCE";
+                status?: "ACTIVE" | "PENDING_VERIFICATION" | "BOUNCED" | "UNSUBSCRIBED";
+            };
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PaginatedAdvisoryContacts"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    addAdvisoryContact: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    email: string;
+                    /** @description The organisation this contact speaks for. */
+                    organization: string;
+                    /**
+                     * @description How early this contact is told. `EMBARGO` hears first and alone, `DOWNSTREAM` joins once a patch exists, `ANNOUNCE` learns at public disclosure.
+                     * @enum {string}
+                     */
+                    tier: "EMBARGO" | "DOWNSTREAM" | "ANNOUNCE";
+                    /** @description The repositories this contact runs. At least one. */
+                    software: {
+                        owner: string;
+                        name: string;
+                    }[];
+                    name?: string | null;
+                    title?: string | null;
+                    notes?: string | null;
+                    tags?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        contact: components["schemas"]["AdvisoryContact"];
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description That address is already on the programme's contact list. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     listFindings: {
         parameters: {
             query?: {
@@ -2026,6 +2429,9 @@ type RepositoryGuidance = Schemas["RepositoryGuidance"];
 type AuditArea = Schemas["AuditArea"];
 type AuditAreaList = Schemas["AuditAreaList"];
 type DeleteAuditAreaResult = Schemas["DeleteAuditAreaResult"];
+type ContinuousTesting = Schemas["ContinuousTesting"];
+type SetContinuousTestingRequest = Schemas["SetContinuousTestingRequest"];
+type RemoveContinuousTestingResult = Schemas["RemoveContinuousTestingResult"];
 type SetGuidanceResult = Schemas["SetGuidanceResult"];
 type TokenInfo = Schemas["TokenInfo"];
 type BillingBalance = Schemas["BillingBalance"];
@@ -2039,6 +2445,37 @@ type Report = Schemas["Report"];
 type ReportStatus = "NEW" | "TRIAGING" | "NEEDS_INFO" | "ACCEPTED" | "DUPLICATE" | "REJECTED";
 type Advisory = Schemas["Advisory"];
 type AdvisoryDetail = Schemas["AdvisoryDetail"];
+type AdvisoryAffected = Schemas["AdvisoryAffected"];
+/** One affected version line, as a caller states it. */
+type AdvisoryAffectedInput = {
+    repository: {
+        owner: string;
+        name: string;
+    };
+    introducedIn: string;
+    fixedIn?: string | null;
+};
+type AdvisoryNotice = Schemas["AdvisoryNotice"];
+type AdvisoryContact = Schemas["AdvisoryContact"];
+/** How early a contact is told. */
+type ContactTier = "EMBARGO" | "DOWNSTREAM" | "ANNOUNCE";
+/** Whether a contact can be written to. Only ACTIVE hears anything. */
+type ContactStatus = "ACTIVE" | "PENDING_VERIFICATION" | "BOUNCED" | "UNSUBSCRIBED";
+/** A contact as a caller states it. */
+type AdvisoryContactInput = {
+    email: string;
+    organization: string;
+    tier: ContactTier;
+    /** The repositories this contact runs. At least one. */
+    software: {
+        owner: string;
+        name: string;
+    }[];
+    name?: string | null;
+    title?: string | null;
+    notes?: string | null;
+    tags?: string[];
+};
 /** The statuses an advisory moves through. */
 type AdvisoryStatus = "DRAFT" | "SCHEDULED" | "UNDER_EMBARGO" | "PUBLISHED" | "WITHDRAWN";
 type UsageMonthSummary = Schemas["UsageMonthSummary"];
@@ -2183,6 +2620,31 @@ declare class ZkaoClient {
      * a scan's map named is refused with a `409`.
      */
     deleteAuditArea(repositoryId: string, areaKey: string): Promise<DeleteAuditAreaResult>;
+    /**
+     * Read a repository's Continuous Testing schedule for one branch (requires
+     * the `read` scope). Defaults to the repository's default branch. With no
+     * schedule, `enabled` is false and the budget fields are null; the
+     * recommended and minimum monthly budgets are still returned.
+     */
+    getContinuousTesting(repositoryId: string, opts?: {
+        branch?: string;
+    }): Promise<ContinuousTesting>;
+    /**
+     * Turn Continuous Testing on or off, set its monthly budget, or choose the
+     * audit areas it rotates through (requires the `automations:write` scope).
+     * Every field is optional. Turning it on with no schedule creates one at
+     * the recommended monthly budget. zkao picks the cadence from the budget: a
+     * daily run when it covers one, otherwise weekly. A budget below the weekly
+     * minimum is refused with a `400`.
+     */
+    setContinuousTesting(repositoryId: string, body: SetContinuousTestingRequest): Promise<ContinuousTesting>;
+    /**
+     * Remove a repository's Continuous Testing schedule for one branch
+     * (requires the `automations:write` scope). Scans it already ran are kept.
+     */
+    removeContinuousTesting(repositoryId: string, opts?: {
+        branch?: string;
+    }): Promise<RemoveContinuousTestingResult>;
     listScans(opts?: {
         page?: number;
         limit?: number;
@@ -2222,13 +2684,62 @@ declare class ZkaoClient {
         status?: AdvisoryStatus;
     }): Promise<Paginated<Advisory>>;
     /**
-     * One advisory, the versions it affects, and the notices planned for it.
+     * One advisory, the software it concerns, the versions it affects, and the
+     * notices planned for it.
+     *
+     * `software` is what decides the audience: a contact is notified about an
+     * advisory only when they run some of it. `affected` is a separate statement
+     * about versions, and is often empty.
      *
      * A notice the plan is holding back carries `blockedReason`. The commonest
      * one is that no affected range names a fixed version, which only the people
      * who shipped the release can supply.
      */
     getAdvisory(publicId: string): Promise<AdvisoryDetail>;
+    /**
+     * Record which versions this advisory affects.
+     *
+     * Replaces the whole set, so send what is affected now rather than a patch.
+     * `fixedIn` is the point: a patch notice stays blocked until some range
+     * names a fixed version, and only the people who shipped the release know
+     * it.
+     *
+     * Versions only. A range may name only software already on the advisory's
+     * `software`, and anything else is a 400: which software an advisory
+     * concerns decides who hears about it, and that is its own statement made
+     * in the app.
+     *
+     * This call never sends anything. It records versions and recomputes the
+     * plan; when an eligible notice is actually sent is the programme's
+     * business.
+     */
+    replaceAdvisoryAffected(publicId: string, affected: AdvisoryAffectedInput[]): Promise<AdvisoryDetail>;
+    /**
+     * The programme's advisory contacts, oldest first.
+     *
+     * Needs `contacts:read`, which is held apart from `read`: this list is other
+     * people's work addresses and the record of who learns about a vulnerability
+     * before the public does. `software` on each row is what notices are matched
+     * on. A project with no security programme reads as an empty list.
+     */
+    listAdvisoryContacts(opts?: {
+        page?: number;
+        limit?: number;
+        tier?: ContactTier;
+        status?: ContactStatus;
+    }): Promise<Paginated<AdvisoryContact>>;
+    /**
+     * Put one address on the programme's advisory contact list.
+     *
+     * `software` says which of the project's repositories this contact runs, and
+     * is required: it is what every notice is matched on, so a contact who runs
+     * nothing is told nothing.
+     *
+     * The contact starts `PENDING_VERIFICATION`, and an unconfirmed address
+     * receives nothing embargoed. Nothing is emailed by this call: the
+     * confirmation mail is sent from the app.
+     */
+    addAdvisoryContact(contact: AdvisoryContactInput): Promise<AdvisoryContact>;
     /**
      * Reports the programme has received, newest first.
      *
@@ -2332,4 +2843,4 @@ declare class ZkaoClient {
     }): Promise<UsageMonthSummary[]>;
 }
 
-export { type BillingBalance, type BillingSummary, type BillingUsage, type CancelScanResult, type ChangeNote, DEFAULT_BASE_URL, type Finding, type FindingDetail, type FindingNote, type LaunchScanRequest, type LaunchScanResult, type ManualAuditRequest, type ManualAuditResult, type Paginated, type PublishArtifactResult, type Repository, type RepositoryGuidance, type ResolutionReason, type ResolutionStatus, type Scan, type ScanDetail, type ScanPreset, type ScanStatus, type SetGuidanceResult, type Severity, TERMINAL_SCAN_STATUSES, type TokenInfo, type TriageStatus, type UsageEvent, type UsageEventType, type UsageMonthSummary, type WaitForRepositoryReadyOptions, type WaitForScanOptions, ZkaoApiError, ZkaoClient, type ZkaoClientOptions, type components, getTokenInfo, isTerminalScanStatus, normalizeBaseUrl, type paths, resolveBaseUrlFromEnv };
+export { type Advisory, type AdvisoryAffected, type AdvisoryAffectedInput, type AdvisoryContact, type AdvisoryContactInput, type AdvisoryDetail, type AdvisoryNotice, type AdvisoryStatus, type BillingBalance, type BillingSummary, type BillingUsage, type CancelScanResult, type ChangeNote, type ContactStatus, type ContactTier, type ContinuousTesting, DEFAULT_BASE_URL, type Finding, type FindingDetail, type FindingNote, type LaunchScanRequest, type LaunchScanResult, type ManualAuditRequest, type ManualAuditResult, type Paginated, type PublishArtifactResult, type RemoveContinuousTestingResult, type Report, type ReportStatus, type Repository, type RepositoryGuidance, type ResolutionReason, type ResolutionStatus, type Scan, type ScanDetail, type ScanPreset, type ScanStatus, type SetContinuousTestingRequest, type SetGuidanceResult, type Severity, TERMINAL_SCAN_STATUSES, type TokenInfo, type TriageStatus, type UsageEvent, type UsageEventType, type UsageMonthSummary, type WaitForRepositoryReadyOptions, type WaitForScanOptions, ZkaoApiError, ZkaoClient, type ZkaoClientOptions, type components, getTokenInfo, isTerminalScanStatus, normalizeBaseUrl, type paths, resolveBaseUrlFromEnv };

package/dist/index.js

@@ -287,6 +287,56 @@ var ZkaoClient = class {
     );
     return unwrap(res);
   }
+  // --- Continuous Testing -------------------------------------------------
+  /**
+   * Read a repository's Continuous Testing schedule for one branch (requires
+   * the `read` scope). Defaults to the repository's default branch. With no
+   * schedule, `enabled` is false and the budget fields are null; the
+   * recommended and minimum monthly budgets are still returned.
+   */
+  async getContinuousTesting(repositoryId, opts = {}) {
+    const res = await this.http.GET(
+      "/projects/{projectId}/repositories/{repositoryId}/continuous-testing",
+      {
+        params: {
+          path: { ...this.path, repositoryId },
+          query: opts.branch === void 0 ? {} : { branch: opts.branch }
+        }
+      }
+    );
+    return unwrap(res);
+  }
+  /**
+   * Turn Continuous Testing on or off, set its monthly budget, or choose the
+   * audit areas it rotates through (requires the `automations:write` scope).
+   * Every field is optional. Turning it on with no schedule creates one at
+   * the recommended monthly budget. zkao picks the cadence from the budget: a
+   * daily run when it covers one, otherwise weekly. A budget below the weekly
+   * minimum is refused with a `400`.
+   */
+  async setContinuousTesting(repositoryId, body) {
+    const res = await this.http.PUT(
+      "/projects/{projectId}/repositories/{repositoryId}/continuous-testing",
+      { params: { path: { ...this.path, repositoryId } }, body }
+    );
+    return unwrap(res);
+  }
+  /**
+   * Remove a repository's Continuous Testing schedule for one branch
+   * (requires the `automations:write` scope). Scans it already ran are kept.
+   */
+  async removeContinuousTesting(repositoryId, opts = {}) {
+    const res = await this.http.DELETE(
+      "/projects/{projectId}/repositories/{repositoryId}/continuous-testing",
+      {
+        params: {
+          path: { ...this.path, repositoryId },
+          query: opts.branch === void 0 ? {} : { branch: opts.branch }
+        }
+      }
+    );
+    return unwrap(res);
+  }
   // --- Scans --------------------------------------------------------------
   async listScans(opts = {}) {
     const res = await this.http.GET("/projects/{projectId}/scans", {
@@ -390,7 +440,12 @@ var ZkaoClient = class {
     return unwrap(res);
   }
   /**
-   * One advisory, the versions it affects, and the notices planned for it.
+   * One advisory, the software it concerns, the versions it affects, and the
+   * notices planned for it.
+   *
+   * `software` is what decides the audience: a contact is notified about an
+   * advisory only when they run some of it. `affected` is a separate statement
+   * about versions, and is often empty.
    *
    * A notice the plan is holding back carries `blockedReason`. The commonest
    * one is that no affected range names a fixed version, which only the people
@@ -403,6 +458,76 @@ var ZkaoClient = class {
     );
     return unwrap(res).advisory;
   }
+  /**
+   * Record which versions this advisory affects.
+   *
+   * Replaces the whole set, so send what is affected now rather than a patch.
+   * `fixedIn` is the point: a patch notice stays blocked until some range
+   * names a fixed version, and only the people who shipped the release know
+   * it.
+   *
+   * Versions only. A range may name only software already on the advisory's
+   * `software`, and anything else is a 400: which software an advisory
+   * concerns decides who hears about it, and that is its own statement made
+   * in the app.
+   *
+   * This call never sends anything. It records versions and recomputes the
+   * plan; when an eligible notice is actually sent is the programme's
+   * business.
+   */
+  async replaceAdvisoryAffected(publicId, affected) {
+    const res = await this.http.PUT(
+      "/projects/{projectId}/advisories/{publicId}/affected",
+      {
+        params: { path: { ...this.path, publicId } },
+        body: { affected }
+      }
+    );
+    return unwrap(res).advisory;
+  }
+  /**
+   * The programme's advisory contacts, oldest first.
+   *
+   * Needs `contacts:read`, which is held apart from `read`: this list is other
+   * people's work addresses and the record of who learns about a vulnerability
+   * before the public does. `software` on each row is what notices are matched
+   * on. A project with no security programme reads as an empty list.
+   */
+  async listAdvisoryContacts(opts = {}) {
+    const res = await this.http.GET(
+      "/projects/{projectId}/advisory-contacts",
+      {
+        params: {
+          path: this.path,
+          query: {
+            page: opts.page,
+            limit: opts.limit,
+            tier: opts.tier,
+            status: opts.status
+          }
+        }
+      }
+    );
+    return unwrap(res);
+  }
+  /**
+   * Put one address on the programme's advisory contact list.
+   *
+   * `software` says which of the project's repositories this contact runs, and
+   * is required: it is what every notice is matched on, so a contact who runs
+   * nothing is told nothing.
+   *
+   * The contact starts `PENDING_VERIFICATION`, and an unconfirmed address
+   * receives nothing embargoed. Nothing is emailed by this call: the
+   * confirmation mail is sent from the app.
+   */
+  async addAdvisoryContact(contact) {
+    const res = await this.http.POST("/projects/{projectId}/advisory-contacts", {
+      params: { path: this.path },
+      body: contact
+    });
+    return unwrap(res).contact;
+  }
   // --- Incoming reports ---------------------------------------------------
   /**
    * Reports the programme has received, newest first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zksecurity/zkao-sdk",
-  "version": "0.15.0-next.10",
+  "version": "0.17.0-next.12",
   "description": "TypeScript SDK for the zkao Project API",
   "license": "MIT",
   "author": "zkSecurity",