Skip to content

refactor(api): extend #206 type-safety to sbom (#359 batch 5) #381

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brandonrc merged 1 commit into from
May 9, 2026
+544 −84
Merged

refactor(api): extend #206 type-safety to sbom (#359 batch 5) #381

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- **`release/1.1.x` maintenance branch + `:1.1-dev` Docker tag rule** (#331) - mirrors `artifact-keeper#890`; pushes to `release/1.1.x` now publish `ghcr.io/artifact-keeper/artifact-keeper-web:1.1-dev` so the v1.1.x release-gate can test a true v1.1.x web/backend pair.

### Changed
- **Type-safe API layer — extend #206 hardening to sbom** (#359 batch 5) - replaced all 21 `as never` casts in `src/lib/api/sbom.ts` with adapter functions, `assertData` guards, and exported `narrowCveStatus` / `narrowPolicyAction` helpers for callers that want a typed status. Multiple SDK shape mismatches are now explicit and documented: `LicenseCheckResult` is synthesized (SDK returns `violations: string[]` with no `action`; adapter coerces to `{license, reason}` rows and derives `action: "block"|"allow"` from `compliant`); `getByArtifact` no longer accepts a `format` query param (the SDK has no query and the backend ignored it pre-#359). No app consumer surfaces these endpoints today, so the synthesis is best-effort and documented inline. Other endpoints (generate/list/get/getComponents/convert/getCveHistory/updateCveStatus/getCveTrends/list-get-upsert-deletePolicy) round-trip pages unchanged.
- **Type-safe API layer — extend #206 hardening to replication** (#359 batch 4) - replaced all 11 `as never` casts in `src/lib/api/replication.ts` with adapter functions, `assertData` guards, and `narrowEnum` for the `PeerStatus` union. Dropped three dead fields from `PeerInstance` (`api_key`/`sync_filter`/`updated_at`) and one from `PeerConnection` (`source_peer_id`) — all four were declared on the local types but never populated by the SDK and never read by any consumer (verified via grep). The peers list and connections table render unchanged.
- **Type-safe API layer — extend #206 hardening to telemetry** (#359 batch 3) - replaced all 9 `as never` casts in `src/lib/api/telemetry.ts` with adapter functions, `assertData` guards, and explicit body forwarding. CrashReport's optional+nullable fields (`stack_trace`, `os_info`, `uptime_seconds`, `submitted_at`, `submission_error`) now normalize undefined → null. Pages that consume this API are unchanged.
- **Type-safe API layer — extend #206 hardening to webhooks + analytics** (#359 batch 2) - replaced all 9 `as never` casts in `src/lib/api/webhooks.ts` and all 11 in `src/lib/api/analytics.ts` with adapter functions, `assertData` guards, and `narrowEnum` for the `WebhookEvent` string-to-union narrowing. Webhook events that the web doesn't model yet now fall back to `artifact_uploaded` with a console warning instead of crashing render code expecting a known event. Pages that consume these APIs are unchanged.
Expand Down
Loading
Loading