@zksecurity/zkao-sdk 0.16.0-next.11 → 0.18.0-next.13

package/dist/index.d.ts

@@ -137,6 +137,34 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/projects/{projectId}/repositories/{repositoryId}/continuous-testing": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a repository's Continuous Testing schedule
+         * @description Requires scope: `read`. Continuous Testing scans one branch on a schedule paid from a monthly budget. With no schedule on the branch, `enabled` is false and the schedule fields are null. The recommended monthly budget funds a run about every three days at the repository's recommended per-run budget; the minimum funds a run every week at it.
+         */
+        get: operations["getContinuousTesting"];
+        /**
+         * Turn Continuous Testing on, change it, or pause it
+         * @description Requires scope: `automations:write`. Every field is optional. With no schedule on the branch, the request creates one at the recommended monthly budget unless `monthlyBudgetCredits` is given; `enabled: false` then changes nothing. The budget sets the interval smoothly from once a week to twice a day. The recommended budget funds a run about every three days. A budget outside the returned minimum and maximum is refused with `400`. Administrators can raise the maximum monthly budget. `areaKeys` replaces the audit areas runs rotate through, one per run. `enabled: false` pauses the schedule and keeps it. A change re-arms a schedule that had stopped. Each run still needs spendable credits when it launches.
+         */
+        put: operations["setContinuousTesting"];
+        post?: never;
+        /**
+         * Remove a repository's Continuous Testing schedule
+         * @description Requires scope: `automations:write`. Scans the schedule already ran stay. Responds `404` when the branch has no schedule.
+         */
+        delete: operations["removeContinuousTesting"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/projects/{projectId}/scans": {
         parameters: {
             query?: never;
@@ -269,7 +297,7 @@ interface paths {
         };
         /**
          * List advisories
-         * @description Requires scope: `read`. The project's coordinated-disclosure advisories, newest first. Optionally filter by `status`.
+         * @description Requires scope: `read`. The project's coordinated-disclosure advisories, newest first. Optionally filter by `status`. A repository-restricted token sees an advisory only when every associated repository is in its allowlist.
          */
         get: operations["listAdvisories"];
         put?: never;
@@ -289,7 +317,7 @@ interface paths {
         };
         /**
          * Get an advisory
-         * @description Requires scope: `read`. The advisory, the software it concerns, the versions it affects, and the notices planned for it.
+         * @description Requires scope: `read`. The advisory, the software it concerns, the versions it affects, and the notices planned for it. Every associated repository must be in the token's allowlist.
          *
          *     `software` is what decides the audience: a contact is notified about an advisory only when they run some of it. `affected` is a separate statement about versions, and is often empty.
          *
@@ -314,7 +342,7 @@ interface paths {
         get?: never;
         /**
          * Record which versions an advisory affects
-         * @description Requires scope: `advisories:write`. Replaces the whole set of affected ranges, so send what is affected now rather than a patch.
+         * @description Requires scope: `advisories:write`. Replaces the whole set of affected ranges, so send what is affected now rather than a patch. Every existing and requested repository must be in the token's allowlist. This check also applies to an empty replacement.
          *
          *     `fixedIn` is the point of this endpoint. A patch notice stays blocked until some range names a fixed version, and only the people who shipped the release know it.
          *
@@ -727,6 +755,11 @@ interface components {
         Scan: {
             id: string;
             status: components["schemas"]["ScanStatus"];
+            /**
+             * @description An actionable setup failure for a failed scan. Null for other statuses and internal failures. Restore a project member's GitHub access or approve the App permissions before launching again.
+             * @enum {string|null}
+             */
+            failureCode?: "NO_MEMBER_REPO_ACCESS" | "GITHUB_APP_PERMISSIONS_PENDING" | null;
             repositoryId: string;
             commitHash?: string | null;
             /** @description A diff scan's base, as the merge base SHA its change is measured from. Null for other scans. */
@@ -807,6 +840,7 @@ interface components {
         };
         FindingNote: {
             id: string;
+            /** @description Markdown. A page of the app the assistant names is an absolute link. */
             body: string;
             /** Format: date-time */
             createdAt: string;
@@ -1075,6 +1109,63 @@ interface components {
             key: string;
             deleted: boolean;
         };
+        ContinuousTesting: {
+            repositoryId: string;
+            /** @description False when Continuous Testing is not offered. */
+            available: boolean;
+            /** @description False when there is no schedule or it is paused. */
+            enabled: boolean;
+            /**
+             * @description Why an enabled schedule is not running: `budget_reached` when the schedule's or project's monthly automation cap is reached, `error` after repeated failures. Null with no schedule.
+             * @enum {string|null}
+             */
+            state: "active" | "converged" | "budget_reached" | "error" | null;
+            branch: string;
+            /** @description The configured monthly spending cap. Legacy schedules derive the budget from their cadence and per-run budget. */
+            monthlyBudgetCredits: number | null;
+            /**
+             * @description Legacy fixed cadence. Null for a custom interval or no schedule. Use intervalHours for the actual interval.
+             * @enum {string|null}
+             */
+            cadence: "daily" | "weekly" | "biweekly" | "monthly" | null;
+            /** @description Hours between scheduled runs. Null when no schedule exists. */
+            intervalHours: number | null;
+            perRunBudgetCredits: number | null;
+            /** @description Audit areas the runs rotate through, one per run, least recently scanned first. Empty means every run scans the whole repository. */
+            areaKeys: string[];
+            /** @description Net credits the schedule's runs spent since the UTC month began. */
+            spentThisMonthCredits: number;
+            /** @description Runs the schedule launched since the UTC month began. */
+            runsThisMonth: number;
+            /** Format: date-time */
+            lastRunAt: string | null;
+            /**
+             * Format: date-time
+             * @description When the next run becomes due. A past time means within the hour. Null when paused or stopped.
+             */
+            nextRunAt: string | null;
+            /** @description A month that funds a run about every three days at the recommended per-run budget. */
+            recommendedMonthlyCredits: number | null;
+            /** @description A month that funds a weekly run at that budget. Less is refused. */
+            minimumMonthlyCredits: number | null;
+            /** @description The largest monthly budget currently allowed for the repository. Administrators can raise it. */
+            maximumMonthlyCredits: number | null;
+        };
+        SetContinuousTestingRequest: {
+            /** @description False pauses the schedule; true turns it on or resumes it. */
+            enabled?: boolean;
+            /** @description Re-plans the interval and the per-run budget within the returned minimum and maximum. */
+            monthlyBudgetCredits?: number;
+            /** @description Replaces the rotation set. An empty array scans the whole repository every run. */
+            areaKeys?: string[];
+            /** @description The scheduled branch. Defaults to the repository's default branch. */
+            branch?: string;
+        };
+        RemoveContinuousTestingResult: {
+            repositoryId: string;
+            branch: string;
+            removed: boolean;
+        };
         CancelScanResult: {
             scanId: string;
             /** @description Terminal status after cancellation (always CANCELLED). */
@@ -1124,18 +1215,18 @@ interface components {
         PublishFindingRequest: {
             /** @description A note id on the finding to pin as the published note. */
             noteId?: string;
-            /** @description Generate a password to gate access to the public artifact. */
+            /** @description True generates a new access password. False removes password protection. Omission preserves an existing password. */
             withPassword?: boolean;
         };
         PublishScanRequest: {
-            /** @description Generate a password to gate access to the public artifact. */
+            /** @description True generates a new access password. False removes password protection. Omission preserves an existing password. */
             withPassword?: boolean;
         };
         PublishArtifactResult: {
             artifactId: string;
             /** @description Slug in /public/{scans,findings}/<publicId>. */
             publicId: string;
-            /** @description The generated access password when withPassword was requested; otherwise null. */
+            /** @description The artifact's current access password, or null when it has no password. */
             accessPassword?: string | null;
         };
     };
@@ -1230,6 +1321,8 @@ interface components {
         /** @description The finding id, or the `ZK-` label shown on the finding page (the id's last eight characters, prefix optional). A label that matches more than one finding in the project is refused with `409 conflict`; use the full id. */
         FindingId: string;
         RepositoryId: string;
+        /** @description The scheduled branch. Defaults to the repository's default branch. */
+        ContinuousTestingBranch: string;
         Page: number;
         Limit: number;
     };
@@ -1435,6 +1528,97 @@ interface operations {
             409: components["responses"]["Conflict"];
         };
     };
+    getContinuousTesting: {
+        parameters: {
+            query?: {
+                /** @description The scheduled branch. Defaults to the repository's default branch. */
+                branch?: components["parameters"]["ContinuousTestingBranch"];
+            };
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                repositoryId: components["parameters"]["RepositoryId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContinuousTesting"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setContinuousTesting: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                repositoryId: components["parameters"]["RepositoryId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetContinuousTestingRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContinuousTesting"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    removeContinuousTesting: {
+        parameters: {
+            query?: {
+                /** @description The scheduled branch. Defaults to the repository's default branch. */
+                branch?: components["parameters"]["ContinuousTestingBranch"];
+            };
+            header?: never;
+            path: {
+                projectId: components["parameters"]["ProjectId"];
+                repositoryId: components["parameters"]["RepositoryId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RemoveContinuousTestingResult"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     listScans: {
         parameters: {
             query?: {
@@ -2249,6 +2433,9 @@ type RepositoryGuidance = Schemas["RepositoryGuidance"];
 type AuditArea = Schemas["AuditArea"];
 type AuditAreaList = Schemas["AuditAreaList"];
 type DeleteAuditAreaResult = Schemas["DeleteAuditAreaResult"];
+type ContinuousTesting = Schemas["ContinuousTesting"];
+type SetContinuousTestingRequest = Schemas["SetContinuousTestingRequest"];
+type RemoveContinuousTestingResult = Schemas["RemoveContinuousTestingResult"];
 type SetGuidanceResult = Schemas["SetGuidanceResult"];
 type TokenInfo = Schemas["TokenInfo"];
 type BillingBalance = Schemas["BillingBalance"];
@@ -2437,6 +2624,31 @@ declare class ZkaoClient {
      * a scan's map named is refused with a `409`.
      */
     deleteAuditArea(repositoryId: string, areaKey: string): Promise<DeleteAuditAreaResult>;
+    /**
+     * Read a repository's Continuous Testing schedule for one branch (requires
+     * the `read` scope). Defaults to the repository's default branch. With no
+     * schedule, `enabled` is false and the budget fields are null; the
+     * recommended and minimum monthly budgets are still returned.
+     */
+    getContinuousTesting(repositoryId: string, opts?: {
+        branch?: string;
+    }): Promise<ContinuousTesting>;
+    /**
+     * Turn Continuous Testing on or off, set its monthly budget, or choose the
+     * audit areas it rotates through (requires the `automations:write` scope).
+     * Every field is optional. Turning it on with no schedule creates one at
+     * the recommended monthly budget, funding a run about every three days. The
+     * budget sets the interval from weekly to twice daily. A budget outside the
+     * returned minimum and maximum is refused with a `400`.
+     */
+    setContinuousTesting(repositoryId: string, body: SetContinuousTestingRequest): Promise<ContinuousTesting>;
+    /**
+     * Remove a repository's Continuous Testing schedule for one branch
+     * (requires the `automations:write` scope). Scans it already ran are kept.
+     */
+    removeContinuousTesting(repositoryId: string, opts?: {
+        branch?: string;
+    }): Promise<RemoveContinuousTestingResult>;
     listScans(opts?: {
         page?: number;
         limit?: number;
@@ -2635,4 +2847,4 @@ declare class ZkaoClient {
     }): Promise<UsageMonthSummary[]>;
 }
 
-export { type Advisory, type AdvisoryAffected, type AdvisoryAffectedInput, type AdvisoryContact, type AdvisoryContactInput, type AdvisoryDetail, type AdvisoryNotice, type AdvisoryStatus, type BillingBalance, type BillingSummary, type BillingUsage, type CancelScanResult, type ChangeNote, type ContactStatus, type ContactTier, DEFAULT_BASE_URL, type Finding, type FindingDetail, type FindingNote, type LaunchScanRequest, type LaunchScanResult, type ManualAuditRequest, type ManualAuditResult, type Paginated, type PublishArtifactResult, type Report, type ReportStatus, type Repository, type RepositoryGuidance, type ResolutionReason, type ResolutionStatus, type Scan, type ScanDetail, type ScanPreset, type ScanStatus, type SetGuidanceResult, type Severity, TERMINAL_SCAN_STATUSES, type TokenInfo, type TriageStatus, type UsageEvent, type UsageEventType, type UsageMonthSummary, type WaitForRepositoryReadyOptions, type WaitForScanOptions, ZkaoApiError, ZkaoClient, type ZkaoClientOptions, type components, getTokenInfo, isTerminalScanStatus, normalizeBaseUrl, type paths, resolveBaseUrlFromEnv };
+export { type Advisory, type AdvisoryAffected, type AdvisoryAffectedInput, type AdvisoryContact, type AdvisoryContactInput, type AdvisoryDetail, type AdvisoryNotice, type AdvisoryStatus, type BillingBalance, type BillingSummary, type BillingUsage, type CancelScanResult, type ChangeNote, type ContactStatus, type ContactTier, type ContinuousTesting, DEFAULT_BASE_URL, type Finding, type FindingDetail, type FindingNote, type LaunchScanRequest, type LaunchScanResult, type ManualAuditRequest, type ManualAuditResult, type Paginated, type PublishArtifactResult, type RemoveContinuousTestingResult, type Report, type ReportStatus, type Repository, type RepositoryGuidance, type ResolutionReason, type ResolutionStatus, type Scan, type ScanDetail, type ScanPreset, type ScanStatus, type SetContinuousTestingRequest, type SetGuidanceResult, type Severity, TERMINAL_SCAN_STATUSES, type TokenInfo, type TriageStatus, type UsageEvent, type UsageEventType, type UsageMonthSummary, type WaitForRepositoryReadyOptions, type WaitForScanOptions, ZkaoApiError, ZkaoClient, type ZkaoClientOptions, type components, getTokenInfo, isTerminalScanStatus, normalizeBaseUrl, type paths, resolveBaseUrlFromEnv };

package/dist/index.js

@@ -287,6 +287,56 @@ var ZkaoClient = class {
     );
     return unwrap(res);
   }
+  // --- Continuous Testing -------------------------------------------------
+  /**
+   * Read a repository's Continuous Testing schedule for one branch (requires
+   * the `read` scope). Defaults to the repository's default branch. With no
+   * schedule, `enabled` is false and the budget fields are null; the
+   * recommended and minimum monthly budgets are still returned.
+   */
+  async getContinuousTesting(repositoryId, opts = {}) {
+    const res = await this.http.GET(
+      "/projects/{projectId}/repositories/{repositoryId}/continuous-testing",
+      {
+        params: {
+          path: { ...this.path, repositoryId },
+          query: opts.branch === void 0 ? {} : { branch: opts.branch }
+        }
+      }
+    );
+    return unwrap(res);
+  }
+  /**
+   * Turn Continuous Testing on or off, set its monthly budget, or choose the
+   * audit areas it rotates through (requires the `automations:write` scope).
+   * Every field is optional. Turning it on with no schedule creates one at
+   * the recommended monthly budget, funding a run about every three days. The
+   * budget sets the interval from weekly to twice daily. A budget outside the
+   * returned minimum and maximum is refused with a `400`.
+   */
+  async setContinuousTesting(repositoryId, body) {
+    const res = await this.http.PUT(
+      "/projects/{projectId}/repositories/{repositoryId}/continuous-testing",
+      { params: { path: { ...this.path, repositoryId } }, body }
+    );
+    return unwrap(res);
+  }
+  /**
+   * Remove a repository's Continuous Testing schedule for one branch
+   * (requires the `automations:write` scope). Scans it already ran are kept.
+   */
+  async removeContinuousTesting(repositoryId, opts = {}) {
+    const res = await this.http.DELETE(
+      "/projects/{projectId}/repositories/{repositoryId}/continuous-testing",
+      {
+        params: {
+          path: { ...this.path, repositoryId },
+          query: opts.branch === void 0 ? {} : { branch: opts.branch }
+        }
+      }
+    );
+    return unwrap(res);
+  }
   // --- Scans --------------------------------------------------------------
   async listScans(opts = {}) {
     const res = await this.http.GET("/projects/{projectId}/scans", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zksecurity/zkao-sdk",
-  "version": "0.16.0-next.11",
+  "version": "0.18.0-next.13",
   "description": "TypeScript SDK for the zkao Project API",
   "license": "MIT",
   "author": "zkSecurity",