3.0.0 Release

.github/workflows/data-update-wqx.yml

@@ -11,24 +11,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.x
           registry-url: "https://npm.pkg.github.com"
+          cache: 'npm'
       - name: Create .npmrc
         run: |
           echo "//npm.pkg.github.com/:_authToken=${{ github.token }}" >> ~/.npmrc
-          echo "@gordonfn:registry=https://npm.pkg.github.com" >> ~/.npmrc
+          echo "@datastreamapp:registry=https://npm.pkg.github.com" >> ~/.npmrc
           echo ".npmrc" >> .gitignore
-      - name: Cache npm
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
       #      -
       #        name: Install dependencies
       #        run: |

.github/workflows/ossf-scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@babb554ede22fd5605947329c4d04d8e7a0b8155 # v3.27.7
+        uses: github/codeql-action/upload-sarif@7fc6561ed893d15cec696e062df840b21db27eb0 # v4.35.2
         with:
           sarif_file: results.sarif

.github/workflows/sec-sast-codeql.yml

@@ -27,19 +27,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@babb554ede22fd5605947329c4d04d8e7a0b8155 # v2.27.7
+        uses: github/codeql-action/init@7fc6561ed893d15cec696e062df840b21db27eb0 # v4.35.2
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@babb554ede22fd5605947329c4d04d8e7a0b8155 # v2.27.7
+        uses: github/codeql-action/autobuild@7fc6561ed893d15cec696e062df840b21db27eb0 # v4.35.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@babb554ede22fd5605947329c4d04d8e7a0b8155 # v2.27.7
+        uses: github/codeql-action/analyze@7fc6561ed893d15cec696e062df840b21db27eb0 # v4.35.2
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/sec-sast-sonarcloud.yml

@@ -14,12 +14,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
 
-      - name: SonarCloud Scan
-        uses: sonarsource/sonarcloud-github-action@02ef91109b2d589e757aefcfb2854c2783fd7b19 # 4.0.0
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/sec-secrets.yml

@@ -12,7 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: TruffleHog Scan
-        uses: edplato/trufflehog-actions-scan@6cf4d6ab0edcfee4251c8c4d214e3655b84c6cb6 # 0.9m-beta
+        uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3.95.2

.github/workflows/tests.yml

@@ -11,27 +11,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.x
           registry-url: "https://npm.pkg.github.com"
+          cache: 'npm'
       - name: Create .npmrc
         run: |
-          echo "@gordonfn:registry=https://npm.pkg.github.com" >> ~/.npmrc
+          echo "@datastreamapp:registry=https://npm.pkg.github.com" >> ~/.npmrc
           echo ".npmrc" >> .gitignore
-      - name: Cache npm
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
       - name: Install dependencies
         run: |
           npm install
 
       - name: Build and test
         run: |
-          npm test
+          npm test

.gitignore

@@ -69,5 +69,4 @@ typings/
 .DS_Store
 
 # AI
-
 CLAUDE.md

.prettierignore

@@ -0,0 +1,4 @@
+# Build-generated source — owned by the build (build-values / build-locales).
+# Keep their JSON.stringify output so Prettier and the build don't fight.
+schemas/data/src/values
+schemas/data/src/locales

.prettierrc

@@ -0,0 +1,5 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "trailingComma": "es5"
+}

CHANGELOG.md

@@ -0,0 +1,90 @@
+# Changelog
+
+All notable changes to `@datastreamapp/data-schema` are documented in this file.
+
+The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+Targets `3.0.0`. Introduces **Groundwater support** to the DataStream schema.
+
+### Added
+
+- **Groundwater media** — `Groundwater` added to `ActivityMediaName`, plus new Groundwater-related fields covering well identification, aquifer attributes, well construction depths, sample-collection method, and depth-altitude reference:
+  - `MonitoringLocationVerticalAccuracyMeasure`, `MonitoringLocationVerticalAccuracyUnit`, `MonitoringLocationVerticalCollectionMethod`, `MonitoringLocationVerticalCoordinateReferenceSystem`
+  - `WellID`, `WellIDContext`, `WellUseType`
+  - `AquiferCode`, `AquiferUnitName`, `AquiferType`, `AquiferUnitPorosityType`, `LithologyType`
+  - `BoreholeDepthMeasure` / `Unit`, `WellDepthMeasure` / `Unit`, `WellOpenIntervalTopMeasure` / `Unit`, `WellOpenIntervalBottomMeasure` / `Unit`
+  - `ActivityDepthAltitudeReferencePoint`, `ActivityDepthAltitudeReferencePointMeasure`, `ActivityDepthAltitudeReferencePointUnit`
+  - `SampleCondition`, `SampleCollectionMethodID`, `SampleCollectionMethodContext`, `SampleCollectionMethodName`
+- **Groundwater conditional logic rules** (errors block submission):
+  - `GroundwaterFields-ActivityMediaName-Groundwater` — Groundwater-only fields require `ActivityMediaName` of `Groundwater` or `Porewater`.
+  - `ActivityMediaName-Groundwater-DepthMeasure` — at least one depth measure required.
+  - `ActivityDepthHeightMeasure-ActivityDepthAltitudeReferencePoint` — reference point required when depth is reported.
+  - `CharacteristicName-WaterLevel-ActivityDepthAltitudeReferencePoint` — reference point required for water-level observations.
+  - `MonitoringLocationType-Well-WellUseType` — well/piezometer locations require `WellUseType`.
+  - `MonitoringLocationType-Well-SampleCondition` — well/piezometer locations require `SampleCondition` (except continuous time series).
+- **Groundwater-related enum additions** (forward-compatible):
+  - `MonitoringLocationType`: `Borehole`, `Dug Well`, `Multilevel Well`, `Nested Well`, `Other-Ground Water`, `Piezometer`, `Seep`, `Sump`, `Well`
+  - `MonitoringLocationHorizontalCoordinateReferenceSystem`: `OTHER`
+  - `MonitoringLocationVerticalUnit`: `ft`, `m`
+  - `SampleCollectionEquipmentName`: `Air line`, `Bailer`, `Hydrasleeve`, `Snap sampler`, `Tubing`, `Water level meter`, `Wetted tape`
+  - `CharacteristicName`: `Water level elevation`, `Water level in well, depth from a reference point`
+- **`EventID` field** — optional free-text identifier (max 255 characters) for grouping observations by field sampling event; available for all data types.
+- **Input-safety checks on new free-text ID/name fields** — `EventID`, `WellID`, `AquiferCode`, `SampleCollectionMethodID`, and `SampleCollectionMethodName` now get the same CSV-injection and leading/trailing-whitespace checks as existing text columns like `LaboratorySampleID`.
+- **`ResultStatusID` deprecation warning** — new quality-control warning `ResultStatusID-Deprecated`: `Final` and `Accepted` are flagged as no longer recommended (use `Preliminary`, `Provisional`, or `Validated`). The values remain valid in the enum; the warning does not block submission.
+- **Q2 2026 WQX update** (`wqx` `3.0.260` → `3.0.276`): new values across `CharacteristicName`, `ActivityType`, `ResultAnalyticalMethodContext`, and `SampleCollectionEquipmentName`.
+
+### Changed
+
+- **`AnalysisStartTime` / `AnalysisStartTimeZone` co-dependency relaxed** — `AnalysisStartTime` without `AnalysisStartTimeZone` is no longer an error; it is now a quality-control warning (`AnalysisStartTime-AnalysisStartTimeZone`). The reverse — `AnalysisStartTimeZone` without `AnalysisStartTime` — remains an error.
+- **`ActivityType`, `ResultSampleFraction`, and `ResultValueType` restricted to a curated subset** in the strict flavors (`primary`/`frontend`/`extract`); these now use an allowed-value list (`subset/`) rather than a removal list (`subtraction/`). Values outside the subset stay accepted by the loose `backend` import flavor.
+
+### Breaking
+
+- **New error — `ActivityDepthHeightMeasure` not allowed for depth characteristics** — new conditional logic rule `CharacteristicName-Depth-ActivityDepthHeightMeasure` (blocks submission): when `CharacteristicName` measures depth/height (e.g. `Depth of water column`, `Water level`, `Depth, Secchi disk depth`), `ActivityDepthHeightMeasure` and `ActivityDepthHeightUnit` must not be populated. Records that previously validated with a depth characteristic paired with an activity depth/height will now be rejected.
+- **Top-level `$id`s now end in `.json`**, mirroring filesystem paths so JSON Schema URL resolution works without filesystem fallbacks. Consumers must update `$ref`s when upgrading:
+  - `https://datastream.org/schema/data/backend` → `…/backend.json`
+  - `…/frontend` → `…/frontend.json`
+  - `…/primary` → `…/primary.json`
+  - `…/extract` → `…/extract.json`
+  - `…/quality-control` → `…/quality-control.json`
+  - `…/definitions` → `…/definitions.json`
+- **All value-file `$id`s renamed** from `.loose.json` / `.strict.json` to `.legacy.json` / `.primary.json` (≈50 files each). Any `$ref` to a `values/*.loose.json` or `values/*.strict.json` URL must be updated.
+- **Misplaced `$id`s corrected** (drifted from their filesystem paths):
+  - `logic/ResultUnit-Salinity.json` (was `quality-control/ResultUnit-Salinity.json`)
+  - `quality-control/ResultDetectionQuantitationLimitMeasure-Minimum.json` (was `…MinimumMeasure-Minimum.json`)
+- **`ActivityGroupType` values replaced** — `ActivityGroupType` is now a DataStream-defined enum (`Continuous Data`, `Field Measure`, `Lab Sample`, `Other`, `Quality Control - Field Measure`, `Quality Control - Lab Sample`, `Unspecified`) instead of the inherited WQX set (`Field Set`, `QC Sample`, `Replicate`, `Subsample`, `Trip` dropped; `Other`/`Unspecified` kept). The published `database/ActivityGroupType.json` value list and the `ActivityType` → `ActivityGroupType` mapping (`lookup/ActivityType-ActivityGroupType.json`) change accordingly. Downstream consumers that store ActivityGroupType values or UUIDs must migrate.
+- **`ResultStatusID` value `Rejected` removed** from the allowed (strict) value set — records with `ResultStatusID` of `Rejected` are now rejected by `primary`/`frontend`/`extract` (the value remains in the loose `backend` enum for historical import).
+- **New error — `ActivityDepthHeightMeasure` must be negative for certain media** — new conditional logic rule `ActivityMediaName-ActivityDepthHeightMeasure-Maximum` (blocks submission): when `ActivityMediaName` is `Ocean Water`, `Rainwater`, `Stormwater`, `Subsurface Soil/Sediment`, `Surface Water`, or `Surface Water Sediment`, `ActivityDepthHeightMeasure` must be reported as a negative value. For `Groundwater`/`Porewater`, a positive depth instead raises the existing quality-control warning.
+
+## [2.29.0] - 2026-03-12
+
+### Added
+
+- Q1 2026 WQX update: new values across `CharacteristicName`, `CharacteristicGroup`, `ActivityType`, `MeasurementUnit`, `ResultDetectionQuantitationLimitUnit`, `ResultUnit`, `SampleCollectionEquipmentName`.
+
+## [2.0.0] - 2020-07-26
+
+- Rewrite build process to:
+  - Pull the latest version of WQX values and simplify future updates
+  - Improve maintainability and audit control
+- `MonitoringLocationID` is now required
+- `MonitoringLocationWaterbody` is now deprecated
+- `MethodSpeciation` has new conditional requirements
+- `ActivityMediaName` has new allowed values: `Ambient Air`, `Surface Water Sediment`, `Pore Water`, `Ocean Water`
+- Additional checks to prevent the common issues people run into surrounding Dissolved Oxygen, Hardness, and others. See `src/logic/ResultValue-*.json`.
+
+## [1.0.0] - 2019-10-12
+
+Starting from US EPA WQX:
+
+- `ProjectName` → `DatasetName` to be more generic.
+- `ActivityDepthHeightMeasure` — added maximum restriction due to only recording water samples.
+- `ResultAnalyticalMethodName` — added for readability.
+- `ResultAnalyticalMethodID` — removed allowed values.
+- `LaboratorySampleID` — added to improve metadata.
+- `AnalysisStartTimeZone` — changed format to follow ISO 8601 (e.g. `-0600`).
+- `ActivityStartTimeZone` / `ActivityEndTimeZone` — removed because they can be inferred from the location.
+- `State` and `County` → `MonitoringLocationRegion` to allow for a broader meaning that can be applied internationally.

commitlint.config.cjs

@@ -1,3 +1,3 @@
 module.exports = {
-  extends: ['@commitlint/config-conventional']
+  extends: ['@commitlint/config-conventional'],
 }

lint-staged.config.js

@@ -1,6 +1,6 @@
 export default {
-  '**/*.js': ['prettier --write', 'standard --fix'],
-  '**/*.json': ['prettier --write']
+  '**/*.js': ['prettier --write'],
+  '**/*.json': ['prettier --write'],
   // https://medium.com/slalom-build/pre-commit-hooks-for-terraform-9356ee6db882
   // '**/*.tf': [
   //   'terraform fmt -recursive -write',