@shipfox/api-integration-gitea 2.0.0

package/dist/core/connect.js

@@ -0,0 +1,32 @@
+import { GiteaOrgAlreadyLinkedError, GiteaOrganizationNotFoundError } from './errors.js';
+export async function handleGiteaConnect(params) {
+    // Gitea resolves org names case-insensitively, but the ownership lookup and the
+    // unique indexes that back the cross-tenant guard compare the stored `org`
+    // case-sensitively. Canonicalize once here so a case variant ("Acme" vs "acme")
+    // cannot slip past getExistingGiteaConnection and link an org another workspace
+    // already owns. The source-control scope guard already lowercases both sides.
+    const org = params.org.toLowerCase();
+    if (!await params.gitea.organizationExists({
+        org
+    })) {
+        throw new GiteaOrganizationNotFoundError(org);
+    }
+    const existing = await params.getExistingGiteaConnection({
+        org
+    });
+    if (existing && existing.workspaceId !== params.workspaceId) {
+        throw new GiteaOrgAlreadyLinkedError(org);
+    }
+    if (existing && existing.lifecycleStatus === 'active') {
+        return existing;
+    }
+    // The read-only service account cannot manage org hooks; the instance admin
+    // provisions push delivery out of band.
+    return await params.connectGiteaConnection({
+        workspaceId: params.workspaceId,
+        org,
+        displayName: `Gitea ${org}`
+    });
+}
+
+//# sourceMappingURL=connect.js.map

package/dist/core/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/connect.ts"],"sourcesContent":["import type {IntegrationConnection} from '@shipfox/api-integration-core-dto';\nimport type {GiteaApiClient} from '#api/client.js';\nimport {GiteaOrgAlreadyLinkedError, GiteaOrganizationNotFoundError} from './errors.js';\n\nexport interface ConnectGiteaConnectionInput {\n  workspaceId: string;\n  org: string;\n  displayName: string;\n}\n\nexport interface HandleGiteaConnectParams {\n  gitea: GiteaApiClient;\n  workspaceId: string;\n  org: string;\n  getExistingGiteaConnection: (input: {\n    org: string;\n  }) => Promise<IntegrationConnection<'gitea'> | undefined>;\n  connectGiteaConnection: (\n    input: ConnectGiteaConnectionInput,\n  ) => Promise<IntegrationConnection<'gitea'>>;\n}\n\nexport async function handleGiteaConnect(\n  params: HandleGiteaConnectParams,\n): Promise<IntegrationConnection<'gitea'>> {\n  // Gitea resolves org names case-insensitively, but the ownership lookup and the\n  // unique indexes that back the cross-tenant guard compare the stored `org`\n  // case-sensitively. Canonicalize once here so a case variant (\"Acme\" vs \"acme\")\n  // cannot slip past getExistingGiteaConnection and link an org another workspace\n  // already owns. The source-control scope guard already lowercases both sides.\n  const org = params.org.toLowerCase();\n\n  if (!(await params.gitea.organizationExists({org}))) {\n    throw new GiteaOrganizationNotFoundError(org);\n  }\n\n  const existing = await params.getExistingGiteaConnection({org});\n  if (existing && existing.workspaceId !== params.workspaceId) {\n    throw new GiteaOrgAlreadyLinkedError(org);\n  }\n  if (existing && existing.lifecycleStatus === 'active') {\n    return existing;\n  }\n\n  // The read-only service account cannot manage org hooks; the instance admin\n  // provisions push delivery out of band.\n  return await params.connectGiteaConnection({\n    workspaceId: params.workspaceId,\n    org,\n    displayName: `Gitea ${org}`,\n  });\n}\n"],"names":["GiteaOrgAlreadyLinkedError","GiteaOrganizationNotFoundError","handleGiteaConnect","params","org","toLowerCase","gitea","organizationExists","existing","getExistingGiteaConnection","workspaceId","lifecycleStatus","connectGiteaConnection","displayName"],"mappings":"AAEA,SAAQA,0BAA0B,EAAEC,8BAA8B,QAAO,cAAc;AAoBvF,OAAO,eAAeC,mBACpBC,MAAgC;IAEhC,gFAAgF;IAChF,2EAA2E;IAC3E,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,MAAMC,MAAMD,OAAOC,GAAG,CAACC,WAAW;IAElC,IAAI,CAAE,MAAMF,OAAOG,KAAK,CAACC,kBAAkB,CAAC;QAACH;IAAG,IAAK;QACnD,MAAM,IAAIH,+BAA+BG;IAC3C;IAEA,MAAMI,WAAW,MAAML,OAAOM,0BAA0B,CAAC;QAACL;IAAG;IAC7D,IAAII,YAAYA,SAASE,WAAW,KAAKP,OAAOO,WAAW,EAAE;QAC3D,MAAM,IAAIV,2BAA2BI;IACvC;IACA,IAAII,YAAYA,SAASG,eAAe,KAAK,UAAU;QACrD,OAAOH;IACT;IAEA,4EAA4E;IAC5E,wCAAwC;IACxC,OAAO,MAAML,OAAOS,sBAAsB,CAAC;QACzCF,aAAaP,OAAOO,WAAW;QAC/BN;QACAS,aAAa,CAAC,MAAM,EAAET,KAAK;IAC7B;AACF"}

package/dist/core/connection-url.d.ts

@@ -0,0 +1,2 @@
+export declare function giteaConnectionExternalUrl(externalAccountId: string): string;
+//# sourceMappingURL=connection-url.d.ts.map

package/dist/core/connection-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-url.d.ts","sourceRoot":"","sources":["../../src/core/connection-url.ts"],"names":[],"mappings":"AAIA,wBAAgB,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAG5E"}

package/dist/core/connection-url.js

@@ -0,0 +1,8 @@
+import { config } from '#config.js';
+const TRAILING_SLASHES_RE = /\/+$/;
+export function giteaConnectionExternalUrl(externalAccountId) {
+    const base = config.GITEA_BASE_URL.replace(TRAILING_SLASHES_RE, '');
+    return `${base}/${encodeURIComponent(externalAccountId)}`;
+}
+
+//# sourceMappingURL=connection-url.js.map

package/dist/core/connection-url.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/connection-url.ts"],"sourcesContent":["import {config} from '#config.js';\n\nconst TRAILING_SLASHES_RE = /\\/+$/;\n\nexport function giteaConnectionExternalUrl(externalAccountId: string): string {\n  const base = config.GITEA_BASE_URL.replace(TRAILING_SLASHES_RE, '');\n  return `${base}/${encodeURIComponent(externalAccountId)}`;\n}\n"],"names":["config","TRAILING_SLASHES_RE","giteaConnectionExternalUrl","externalAccountId","base","GITEA_BASE_URL","replace","encodeURIComponent"],"mappings":"AAAA,SAAQA,MAAM,QAAO,aAAa;AAElC,MAAMC,sBAAsB;AAE5B,OAAO,SAASC,2BAA2BC,iBAAyB;IAClE,MAAMC,OAAOJ,OAAOK,cAAc,CAACC,OAAO,CAACL,qBAAqB;IAChE,OAAO,GAAGG,KAAK,CAAC,EAAEG,mBAAmBJ,oBAAoB;AAC3D"}

package/dist/core/errors.d.ts

@@ -0,0 +1,10 @@
+import { IntegrationProviderError } from '@shipfox/api-integration-core-dto';
+export declare class GiteaIntegrationProviderError extends IntegrationProviderError {
+}
+export declare class GiteaOrganizationNotFoundError extends Error {
+    constructor(org: string);
+}
+export declare class GiteaOrgAlreadyLinkedError extends Error {
+    constructor(org: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,wBAAwB,EAAC,MAAM,mCAAmC,CAAC;AAE3E,qBAAa,6BAA8B,SAAQ,wBAAwB;CAAG;AAE9E,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,GAAG,EAAE,MAAM;CAIxB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,GAAG,EAAE,MAAM;CAIxB"}

package/dist/core/errors.js

@@ -0,0 +1,17 @@
+import { IntegrationProviderError } from '@shipfox/api-integration-core-dto';
+export class GiteaIntegrationProviderError extends IntegrationProviderError {
+}
+export class GiteaOrganizationNotFoundError extends Error {
+    constructor(org){
+        super(`Gitea organization not found: ${org}`);
+        this.name = 'GiteaOrganizationNotFoundError';
+    }
+}
+export class GiteaOrgAlreadyLinkedError extends Error {
+    constructor(org){
+        super(`Gitea organization is already linked to another Shipfox workspace: ${org}`);
+        this.name = 'GiteaOrgAlreadyLinkedError';
+    }
+}
+
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["import {IntegrationProviderError} from '@shipfox/api-integration-core-dto';\n\nexport class GiteaIntegrationProviderError extends IntegrationProviderError {}\n\nexport class GiteaOrganizationNotFoundError extends Error {\n  constructor(org: string) {\n    super(`Gitea organization not found: ${org}`);\n    this.name = 'GiteaOrganizationNotFoundError';\n  }\n}\n\nexport class GiteaOrgAlreadyLinkedError extends Error {\n  constructor(org: string) {\n    super(`Gitea organization is already linked to another Shipfox workspace: ${org}`);\n    this.name = 'GiteaOrgAlreadyLinkedError';\n  }\n}\n"],"names":["IntegrationProviderError","GiteaIntegrationProviderError","GiteaOrganizationNotFoundError","Error","org","name","GiteaOrgAlreadyLinkedError"],"mappings":"AAAA,SAAQA,wBAAwB,QAAO,oCAAoC;AAE3E,OAAO,MAAMC,sCAAsCD;AAA0B;AAE7E,OAAO,MAAME,uCAAuCC;IAClD,YAAYC,GAAW,CAAE;QACvB,KAAK,CAAC,CAAC,8BAA8B,EAAEA,KAAK;QAC5C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,mCAAmCH;IAC9C,YAAYC,GAAW,CAAE;QACvB,KAAK,CAAC,CAAC,mEAAmE,EAAEA,KAAK;QACjF,IAAI,CAACC,IAAI,GAAG;IACd;AACF"}

package/dist/core/source-control.d.ts

@@ -0,0 +1,14 @@
+import { type CheckoutSpec, type CreateCheckoutSpecInput, type FetchFileInput, type FilePage, type FileSnapshot, type IntegrationConnection, type ListFilesInput, type ListRepositoriesInput, type RepositoryPage, type RepositorySnapshot, type ResolveRepositoryInput, type SourceControlProvider } from '@shipfox/api-integration-core-dto';
+import type { GiteaApiClient } from '#api/client.js';
+type GiteaIntegrationConnection = IntegrationConnection<'gitea'>;
+export declare class GiteaSourceControlProvider implements SourceControlProvider<GiteaIntegrationConnection> {
+    private readonly gitea;
+    constructor(gitea: GiteaApiClient);
+    listRepositories(input: ListRepositoriesInput<GiteaIntegrationConnection>): Promise<RepositoryPage>;
+    resolveRepository(input: ResolveRepositoryInput<GiteaIntegrationConnection>): Promise<RepositorySnapshot>;
+    listFiles(input: ListFilesInput<GiteaIntegrationConnection>): Promise<FilePage>;
+    fetchFile(input: FetchFileInput<GiteaIntegrationConnection>): Promise<FileSnapshot>;
+    createCheckoutSpec(input: CreateCheckoutSpecInput<GiteaIntegrationConnection>): Promise<CheckoutSpec>;
+}
+export {};
+//# sourceMappingURL=source-control.d.ts.map

package/dist/core/source-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-control.d.ts","sourceRoot":"","sources":["../../src/core/source-control.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAG1B,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAC,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AAIpE,KAAK,0BAA0B,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAMjE,qBAAa,0BACX,YAAW,qBAAqB,CAAC,0BAA0B,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,cAAc;IAE5C,gBAAgB,CACpB,KAAK,EAAE,qBAAqB,CAAC,0BAA0B,CAAC,GACvD,OAAO,CAAC,cAAc,CAAC;IAqCpB,iBAAiB,CACrB,KAAK,EAAE,sBAAsB,CAAC,0BAA0B,CAAC,GACxD,OAAO,CAAC,kBAAkB,CAAC;IAQxB,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,0BAA0B,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4B/E,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,0BAA0B,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBnF,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,CAAC,0BAA0B,CAAC,GACzD,OAAO,CAAC,YAAY,CAAC;CAsBzB"}

package/dist/core/source-control.js

@@ -0,0 +1,177 @@
+import { Buffer } from 'node:buffer';
+import { buildProviderRepositoryId, MAX_REPOSITORY_FILE_BYTES, parseProviderRepositoryId } from '@shipfox/api-integration-core-dto';
+import { giteaProviderKind } from '@shipfox/api-integration-gitea-dto';
+import { config, giteaCloneBaseOrigin } from '#config.js';
+import { GiteaIntegrationProviderError } from './errors.js';
+const TRAILING_SLASHES_RE = /\/+$/;
+const SEARCH_PAGE_SIZE = 100;
+const SEARCH_MAX_PAGES_PER_REQUEST = 5;
+export class GiteaSourceControlProvider {
+    constructor(gitea){
+        this.gitea = gitea;
+    }
+    async listRepositories(input) {
+        const org = input.connection.externalAccountId;
+        const needle = input.search?.trim().toLowerCase();
+        if (!needle) {
+            const page = await this.gitea.listOrgRepositories({
+                org,
+                limit: input.limit,
+                cursor: input.cursor
+            });
+            return {
+                repositories: page.repositories.map(toRepositorySnapshot),
+                nextCursor: page.nextCursor
+            };
+        }
+        const matches = [];
+        let cursor = input.cursor;
+        let pagesScanned = 0;
+        while(matches.length < input.limit && pagesScanned < SEARCH_MAX_PAGES_PER_REQUEST){
+            const page = await this.gitea.listOrgRepositories({
+                org,
+                limit: SEARCH_PAGE_SIZE,
+                cursor
+            });
+            pagesScanned += 1;
+            for (const repo of page.repositories){
+                if (repo.fullName.toLowerCase().includes(needle)) {
+                    matches.push(toRepositorySnapshot(repo));
+                }
+            }
+            cursor = page.nextCursor ?? undefined;
+            if (!cursor) break;
+        }
+        return {
+            repositories: matches.slice(0, input.limit),
+            nextCursor: cursor ?? null
+        };
+    }
+    async resolveRepository(input) {
+        const { owner, repo } = parseGiteaRepositoryLocator(input.externalRepositoryId, input.connection.externalAccountId);
+        return toRepositorySnapshot(await this.gitea.getRepository({
+            owner,
+            repo
+        }));
+    }
+    async listFiles(input) {
+        const { owner, repo } = parseGiteaRepositoryLocator(input.externalRepositoryId, input.connection.externalAccountId);
+        const sha = await this.gitea.resolveRef({
+            owner,
+            repo,
+            ref: input.ref
+        });
+        const tree = await this.gitea.listTree({
+            owner,
+            repo,
+            sha
+        });
+        if (tree.truncated) {
+            throw new GiteaIntegrationProviderError('too-many-files', `Gitea repository tree for ${input.externalRepositoryId} is too large to enumerate`);
+        }
+        const prefix = input.prefix.replace(TRAILING_SLASHES_RE, '');
+        const matched = tree.blobs.filter((blob)=>prefixMatches(blob.path, prefix)).sort((a, b)=>a.path.localeCompare(b.path));
+        const offset = parseOffset(input.cursor);
+        const page = matched.slice(offset, offset + input.limit);
+        const consumed = offset + page.length;
+        return {
+            files: page.map((blob)=>({
+                    path: blob.path,
+                    type: 'file',
+                    size: blob.size
+                })),
+            nextCursor: consumed < matched.length ? String(consumed) : null
+        };
+    }
+    async fetchFile(input) {
+        const { owner, repo } = parseGiteaRepositoryLocator(input.externalRepositoryId, input.connection.externalAccountId);
+        const file = await this.gitea.fetchFileContent({
+            owner,
+            repo,
+            path: input.path,
+            ref: input.ref
+        });
+        if (file.size > MAX_REPOSITORY_FILE_BYTES || Buffer.byteLength(file.content, 'utf8') > MAX_REPOSITORY_FILE_BYTES) {
+            throw new GiteaIntegrationProviderError('content-too-large', 'Gitea file content is larger than the supported limit');
+        }
+        return {
+            path: file.path,
+            ref: input.ref,
+            content: file.content
+        };
+    }
+    async createCheckoutSpec(input) {
+        const { owner, repo } = parseGiteaRepositoryLocator(input.externalRepositoryId, input.connection.externalAccountId);
+        const repository = await this.gitea.getRepository({
+            owner,
+            repo
+        });
+        const ref = input.ref?.trim() || repository.defaultBranch;
+        return {
+            repositoryUrl: createCheckoutRepositoryUrl(repository.cloneUrl),
+            ref,
+            // Gitea has no per-repo, auto-expiring token like a GitHub App installation
+            // token, so checkout reuses the long-lived service credential. `expiresAt`
+            // is the runner's lease/refresh window, not the token's real expiry: this
+            // credential does not actually expire and stays valid if it leaks.
+            credentials: {
+                username: config.GITEA_SERVICE_USERNAME,
+                token: config.GITEA_SERVICE_TOKEN,
+                expiresAt: new Date(Date.now() + config.GITEA_CHECKOUT_TTL_SECONDS * 1000)
+            }
+        };
+    }
+}
+function createCheckoutRepositoryUrl(cloneUrl) {
+    if (!giteaCloneBaseOrigin) return cloneUrl;
+    const repositoryUrl = new URL(cloneUrl);
+    repositoryUrl.protocol = giteaCloneBaseOrigin.protocol;
+    repositoryUrl.host = giteaCloneBaseOrigin.host;
+    return repositoryUrl.toString();
+}
+function toRepositorySnapshot(repository) {
+    return {
+        externalRepositoryId: buildProviderRepositoryId(giteaProviderKind, `${repository.ownerLogin}/${repository.name}`),
+        owner: repository.ownerLogin,
+        name: repository.name,
+        fullName: repository.fullName,
+        defaultBranch: repository.defaultBranch,
+        visibility: toRepositoryVisibility(repository),
+        cloneUrl: repository.cloneUrl,
+        htmlUrl: repository.htmlUrl
+    };
+}
+function toRepositoryVisibility(repository) {
+    return repository.private ? 'private' : 'public';
+}
+function parseGiteaRepositoryLocator(externalRepositoryId, expectedOwner) {
+    const value = parseProviderRepositoryId(externalRepositoryId, giteaProviderKind);
+    const separatorIndex = value.indexOf('/');
+    const owner = separatorIndex > 0 ? value.slice(0, separatorIndex) : '';
+    const repo = separatorIndex > 0 ? value.slice(separatorIndex + 1) : '';
+    if (!owner || !repo || repo.includes('/')) {
+        throw new GiteaIntegrationProviderError('repository-not-found', `Gitea repository id ${externalRepositoryId} must follow the form ${giteaProviderKind}:<owner>/<repo>`);
+    }
+    // The service token is instance-wide, so the adapter must scope every request
+    // to the connection's own account itself; without this an external id naming
+    // another org would read its private repos and mint checkout credentials for
+    // them. Reported as not-found so it does not confirm an out-of-scope repo.
+    if (owner.toLowerCase() !== expectedOwner.toLowerCase()) {
+        throw new GiteaIntegrationProviderError('repository-not-found', `Gitea repository id ${externalRepositoryId} is not in the ${expectedOwner} account`);
+    }
+    return {
+        owner,
+        repo
+    };
+}
+function prefixMatches(path, prefix) {
+    if (!prefix) return true;
+    return path === prefix || path.startsWith(`${prefix}/`);
+}
+function parseOffset(cursor) {
+    if (!cursor) return 0;
+    const offset = Number.parseInt(cursor, 10);
+    return Number.isNaN(offset) || offset < 0 ? 0 : offset;
+}
+
+//# sourceMappingURL=source-control.js.map

package/dist/core/source-control.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/source-control.ts"],"sourcesContent":["import {Buffer} from 'node:buffer';\nimport {\n  buildProviderRepositoryId,\n  type CheckoutSpec,\n  type CreateCheckoutSpecInput,\n  type FetchFileInput,\n  type FilePage,\n  type FileSnapshot,\n  type IntegrationConnection,\n  type ListFilesInput,\n  type ListRepositoriesInput,\n  MAX_REPOSITORY_FILE_BYTES,\n  parseProviderRepositoryId,\n  type RepositoryPage,\n  type RepositorySnapshot,\n  type RepositoryVisibility,\n  type ResolveRepositoryInput,\n  type SourceControlProvider,\n} from '@shipfox/api-integration-core-dto';\nimport {giteaProviderKind} from '@shipfox/api-integration-gitea-dto';\nimport type {GiteaApiClient, GiteaRepository} from '#api/client.js';\nimport {config, giteaCloneBaseOrigin} from '#config.js';\nimport {GiteaIntegrationProviderError} from './errors.js';\n\ntype GiteaIntegrationConnection = IntegrationConnection<'gitea'>;\n\nconst TRAILING_SLASHES_RE = /\\/+$/;\nconst SEARCH_PAGE_SIZE = 100;\nconst SEARCH_MAX_PAGES_PER_REQUEST = 5;\n\nexport class GiteaSourceControlProvider\n  implements SourceControlProvider<GiteaIntegrationConnection>\n{\n  constructor(private readonly gitea: GiteaApiClient) {}\n\n  async listRepositories(\n    input: ListRepositoriesInput<GiteaIntegrationConnection>,\n  ): Promise<RepositoryPage> {\n    const org = input.connection.externalAccountId;\n    const needle = input.search?.trim().toLowerCase();\n\n    if (!needle) {\n      const page = await this.gitea.listOrgRepositories({\n        org,\n        limit: input.limit,\n        cursor: input.cursor,\n      });\n      return {\n        repositories: page.repositories.map(toRepositorySnapshot),\n        nextCursor: page.nextCursor,\n      };\n    }\n\n    const matches: RepositorySnapshot[] = [];\n    let cursor = input.cursor;\n    let pagesScanned = 0;\n    while (matches.length < input.limit && pagesScanned < SEARCH_MAX_PAGES_PER_REQUEST) {\n      const page = await this.gitea.listOrgRepositories({org, limit: SEARCH_PAGE_SIZE, cursor});\n      pagesScanned += 1;\n      for (const repo of page.repositories) {\n        if (repo.fullName.toLowerCase().includes(needle)) {\n          matches.push(toRepositorySnapshot(repo));\n        }\n      }\n      cursor = page.nextCursor ?? undefined;\n      if (!cursor) break;\n    }\n\n    return {\n      repositories: matches.slice(0, input.limit),\n      nextCursor: cursor ?? null,\n    };\n  }\n\n  async resolveRepository(\n    input: ResolveRepositoryInput<GiteaIntegrationConnection>,\n  ): Promise<RepositorySnapshot> {\n    const {owner, repo} = parseGiteaRepositoryLocator(\n      input.externalRepositoryId,\n      input.connection.externalAccountId,\n    );\n    return toRepositorySnapshot(await this.gitea.getRepository({owner, repo}));\n  }\n\n  async listFiles(input: ListFilesInput<GiteaIntegrationConnection>): Promise<FilePage> {\n    const {owner, repo} = parseGiteaRepositoryLocator(\n      input.externalRepositoryId,\n      input.connection.externalAccountId,\n    );\n    const sha = await this.gitea.resolveRef({owner, repo, ref: input.ref});\n    const tree = await this.gitea.listTree({owner, repo, sha});\n    if (tree.truncated) {\n      throw new GiteaIntegrationProviderError(\n        'too-many-files',\n        `Gitea repository tree for ${input.externalRepositoryId} is too large to enumerate`,\n      );\n    }\n\n    const prefix = input.prefix.replace(TRAILING_SLASHES_RE, '');\n    const matched = tree.blobs\n      .filter((blob) => prefixMatches(blob.path, prefix))\n      .sort((a, b) => a.path.localeCompare(b.path));\n    const offset = parseOffset(input.cursor);\n    const page = matched.slice(offset, offset + input.limit);\n    const consumed = offset + page.length;\n\n    return {\n      files: page.map((blob) => ({path: blob.path, type: 'file', size: blob.size})),\n      nextCursor: consumed < matched.length ? String(consumed) : null,\n    };\n  }\n\n  async fetchFile(input: FetchFileInput<GiteaIntegrationConnection>): Promise<FileSnapshot> {\n    const {owner, repo} = parseGiteaRepositoryLocator(\n      input.externalRepositoryId,\n      input.connection.externalAccountId,\n    );\n    const file = await this.gitea.fetchFileContent({owner, repo, path: input.path, ref: input.ref});\n\n    if (\n      file.size > MAX_REPOSITORY_FILE_BYTES ||\n      Buffer.byteLength(file.content, 'utf8') > MAX_REPOSITORY_FILE_BYTES\n    ) {\n      throw new GiteaIntegrationProviderError(\n        'content-too-large',\n        'Gitea file content is larger than the supported limit',\n      );\n    }\n\n    return {\n      path: file.path,\n      ref: input.ref,\n      content: file.content,\n    };\n  }\n\n  async createCheckoutSpec(\n    input: CreateCheckoutSpecInput<GiteaIntegrationConnection>,\n  ): Promise<CheckoutSpec> {\n    const {owner, repo} = parseGiteaRepositoryLocator(\n      input.externalRepositoryId,\n      input.connection.externalAccountId,\n    );\n    const repository = await this.gitea.getRepository({owner, repo});\n    const ref = input.ref?.trim() || repository.defaultBranch;\n\n    return {\n      repositoryUrl: createCheckoutRepositoryUrl(repository.cloneUrl),\n      ref,\n      // Gitea has no per-repo, auto-expiring token like a GitHub App installation\n      // token, so checkout reuses the long-lived service credential. `expiresAt`\n      // is the runner's lease/refresh window, not the token's real expiry: this\n      // credential does not actually expire and stays valid if it leaks.\n      credentials: {\n        username: config.GITEA_SERVICE_USERNAME,\n        token: config.GITEA_SERVICE_TOKEN,\n        expiresAt: new Date(Date.now() + config.GITEA_CHECKOUT_TTL_SECONDS * 1000),\n      },\n    };\n  }\n}\n\nfunction createCheckoutRepositoryUrl(cloneUrl: string): string {\n  if (!giteaCloneBaseOrigin) return cloneUrl;\n\n  const repositoryUrl = new URL(cloneUrl);\n\n  repositoryUrl.protocol = giteaCloneBaseOrigin.protocol;\n  repositoryUrl.host = giteaCloneBaseOrigin.host;\n\n  return repositoryUrl.toString();\n}\n\nfunction toRepositorySnapshot(repository: GiteaRepository): RepositorySnapshot {\n  return {\n    externalRepositoryId: buildProviderRepositoryId(\n      giteaProviderKind,\n      `${repository.ownerLogin}/${repository.name}`,\n    ),\n    owner: repository.ownerLogin,\n    name: repository.name,\n    fullName: repository.fullName,\n    defaultBranch: repository.defaultBranch,\n    visibility: toRepositoryVisibility(repository),\n    cloneUrl: repository.cloneUrl,\n    htmlUrl: repository.htmlUrl,\n  };\n}\n\nfunction toRepositoryVisibility(repository: GiteaRepository): RepositoryVisibility {\n  return repository.private ? 'private' : 'public';\n}\n\nfunction parseGiteaRepositoryLocator(\n  externalRepositoryId: string,\n  expectedOwner: string,\n): {owner: string; repo: string} {\n  const value = parseProviderRepositoryId(externalRepositoryId, giteaProviderKind);\n  const separatorIndex = value.indexOf('/');\n  const owner = separatorIndex > 0 ? value.slice(0, separatorIndex) : '';\n  const repo = separatorIndex > 0 ? value.slice(separatorIndex + 1) : '';\n  if (!owner || !repo || repo.includes('/')) {\n    throw new GiteaIntegrationProviderError(\n      'repository-not-found',\n      `Gitea repository id ${externalRepositoryId} must follow the form ${giteaProviderKind}:<owner>/<repo>`,\n    );\n  }\n  // The service token is instance-wide, so the adapter must scope every request\n  // to the connection's own account itself; without this an external id naming\n  // another org would read its private repos and mint checkout credentials for\n  // them. Reported as not-found so it does not confirm an out-of-scope repo.\n  if (owner.toLowerCase() !== expectedOwner.toLowerCase()) {\n    throw new GiteaIntegrationProviderError(\n      'repository-not-found',\n      `Gitea repository id ${externalRepositoryId} is not in the ${expectedOwner} account`,\n    );\n  }\n\n  return {owner, repo};\n}\n\nfunction prefixMatches(path: string, prefix: string): boolean {\n  if (!prefix) return true;\n  return path === prefix || path.startsWith(`${prefix}/`);\n}\n\nfunction parseOffset(cursor: string | undefined): number {\n  if (!cursor) return 0;\n  const offset = Number.parseInt(cursor, 10);\n  return Number.isNaN(offset) || offset < 0 ? 0 : offset;\n}\n"],"names":["Buffer","buildProviderRepositoryId","MAX_REPOSITORY_FILE_BYTES","parseProviderRepositoryId","giteaProviderKind","config","giteaCloneBaseOrigin","GiteaIntegrationProviderError","TRAILING_SLASHES_RE","SEARCH_PAGE_SIZE","SEARCH_MAX_PAGES_PER_REQUEST","GiteaSourceControlProvider","gitea","listRepositories","input","org","connection","externalAccountId","needle","search","trim","toLowerCase","page","listOrgRepositories","limit","cursor","repositories","map","toRepositorySnapshot","nextCursor","matches","pagesScanned","length","repo","fullName","includes","push","undefined","slice","resolveRepository","owner","parseGiteaRepositoryLocator","externalRepositoryId","getRepository","listFiles","sha","resolveRef","ref","tree","listTree","truncated","prefix","replace","matched","blobs","filter","blob","prefixMatches","path","sort","a","b","localeCompare","offset","parseOffset","consumed","files","type","size","String","fetchFile","file","fetchFileContent","byteLength","content","createCheckoutSpec","repository","defaultBranch","repositoryUrl","createCheckoutRepositoryUrl","cloneUrl","credentials","username","GITEA_SERVICE_USERNAME","token","GITEA_SERVICE_TOKEN","expiresAt","Date","now","GITEA_CHECKOUT_TTL_SECONDS","URL","protocol","host","toString","ownerLogin","name","visibility","toRepositoryVisibility","htmlUrl","private","expectedOwner","value","separatorIndex","indexOf","startsWith","Number","parseInt","isNaN"],"mappings":"AAAA,SAAQA,MAAM,QAAO,cAAc;AACnC,SACEC,yBAAyB,EASzBC,yBAAyB,EACzBC,yBAAyB,QAMpB,oCAAoC;AAC3C,SAAQC,iBAAiB,QAAO,qCAAqC;AAErE,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,aAAa;AACxD,SAAQC,6BAA6B,QAAO,cAAc;AAI1D,MAAMC,sBAAsB;AAC5B,MAAMC,mBAAmB;AACzB,MAAMC,+BAA+B;AAErC,OAAO,MAAMC;IAGX,YAAY,AAAiBC,KAAqB,CAAE;aAAvBA,QAAAA;IAAwB;IAErD,MAAMC,iBACJC,KAAwD,EAC/B;QACzB,MAAMC,MAAMD,MAAME,UAAU,CAACC,iBAAiB;QAC9C,MAAMC,SAASJ,MAAMK,MAAM,EAAEC,OAAOC;QAEpC,IAAI,CAACH,QAAQ;YACX,MAAMI,OAAO,MAAM,IAAI,CAACV,KAAK,CAACW,mBAAmB,CAAC;gBAChDR;gBACAS,OAAOV,MAAMU,KAAK;gBAClBC,QAAQX,MAAMW,MAAM;YACtB;YACA,OAAO;gBACLC,cAAcJ,KAAKI,YAAY,CAACC,GAAG,CAACC;gBACpCC,YAAYP,KAAKO,UAAU;YAC7B;QACF;QAEA,MAAMC,UAAgC,EAAE;QACxC,IAAIL,SAASX,MAAMW,MAAM;QACzB,IAAIM,eAAe;QACnB,MAAOD,QAAQE,MAAM,GAAGlB,MAAMU,KAAK,IAAIO,eAAerB,6BAA8B;YAClF,MAAMY,OAAO,MAAM,IAAI,CAACV,KAAK,CAACW,mBAAmB,CAAC;gBAACR;gBAAKS,OAAOf;gBAAkBgB;YAAM;YACvFM,gBAAgB;YAChB,KAAK,MAAME,QAAQX,KAAKI,YAAY,CAAE;gBACpC,IAAIO,KAAKC,QAAQ,CAACb,WAAW,GAAGc,QAAQ,CAACjB,SAAS;oBAChDY,QAAQM,IAAI,CAACR,qBAAqBK;gBACpC;YACF;YACAR,SAASH,KAAKO,UAAU,IAAIQ;YAC5B,IAAI,CAACZ,QAAQ;QACf;QAEA,OAAO;YACLC,cAAcI,QAAQQ,KAAK,CAAC,GAAGxB,MAAMU,KAAK;YAC1CK,YAAYJ,UAAU;QACxB;IACF;IAEA,MAAMc,kBACJzB,KAAyD,EAC5B;QAC7B,MAAM,EAAC0B,KAAK,EAAEP,IAAI,EAAC,GAAGQ,4BACpB3B,MAAM4B,oBAAoB,EAC1B5B,MAAME,UAAU,CAACC,iBAAiB;QAEpC,OAAOW,qBAAqB,MAAM,IAAI,CAAChB,KAAK,CAAC+B,aAAa,CAAC;YAACH;YAAOP;QAAI;IACzE;IAEA,MAAMW,UAAU9B,KAAiD,EAAqB;QACpF,MAAM,EAAC0B,KAAK,EAAEP,IAAI,EAAC,GAAGQ,4BACpB3B,MAAM4B,oBAAoB,EAC1B5B,MAAME,UAAU,CAACC,iBAAiB;QAEpC,MAAM4B,MAAM,MAAM,IAAI,CAACjC,KAAK,CAACkC,UAAU,CAAC;YAACN;YAAOP;YAAMc,KAAKjC,MAAMiC,GAAG;QAAA;QACpE,MAAMC,OAAO,MAAM,IAAI,CAACpC,KAAK,CAACqC,QAAQ,CAAC;YAACT;YAAOP;YAAMY;QAAG;QACxD,IAAIG,KAAKE,SAAS,EAAE;YAClB,MAAM,IAAI3C,8BACR,kBACA,CAAC,0BAA0B,EAAEO,MAAM4B,oBAAoB,CAAC,0BAA0B,CAAC;QAEvF;QAEA,MAAMS,SAASrC,MAAMqC,MAAM,CAACC,OAAO,CAAC5C,qBAAqB;QACzD,MAAM6C,UAAUL,KAAKM,KAAK,CACvBC,MAAM,CAAC,CAACC,OAASC,cAAcD,KAAKE,IAAI,EAAEP,SAC1CQ,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEF,IAAI,CAACI,aAAa,CAACD,EAAEH,IAAI;QAC7C,MAAMK,SAASC,YAAYlD,MAAMW,MAAM;QACvC,MAAMH,OAAO+B,QAAQf,KAAK,CAACyB,QAAQA,SAASjD,MAAMU,KAAK;QACvD,MAAMyC,WAAWF,SAASzC,KAAKU,MAAM;QAErC,OAAO;YACLkC,OAAO5C,KAAKK,GAAG,CAAC,CAAC6B,OAAU,CAAA;oBAACE,MAAMF,KAAKE,IAAI;oBAAES,MAAM;oBAAQC,MAAMZ,KAAKY,IAAI;gBAAA,CAAA;YAC1EvC,YAAYoC,WAAWZ,QAAQrB,MAAM,GAAGqC,OAAOJ,YAAY;QAC7D;IACF;IAEA,MAAMK,UAAUxD,KAAiD,EAAyB;QACxF,MAAM,EAAC0B,KAAK,EAAEP,IAAI,EAAC,GAAGQ,4BACpB3B,MAAM4B,oBAAoB,EAC1B5B,MAAME,UAAU,CAACC,iBAAiB;QAEpC,MAAMsD,OAAO,MAAM,IAAI,CAAC3D,KAAK,CAAC4D,gBAAgB,CAAC;YAAChC;YAAOP;YAAMyB,MAAM5C,MAAM4C,IAAI;YAAEX,KAAKjC,MAAMiC,GAAG;QAAA;QAE7F,IACEwB,KAAKH,IAAI,GAAGlE,6BACZF,OAAOyE,UAAU,CAACF,KAAKG,OAAO,EAAE,UAAUxE,2BAC1C;YACA,MAAM,IAAIK,8BACR,qBACA;QAEJ;QAEA,OAAO;YACLmD,MAAMa,KAAKb,IAAI;YACfX,KAAKjC,MAAMiC,GAAG;YACd2B,SAASH,KAAKG,OAAO;QACvB;IACF;IAEA,MAAMC,mBACJ7D,KAA0D,EACnC;QACvB,MAAM,EAAC0B,KAAK,EAAEP,IAAI,EAAC,GAAGQ,4BACpB3B,MAAM4B,oBAAoB,EAC1B5B,MAAME,UAAU,CAACC,iBAAiB;QAEpC,MAAM2D,aAAa,MAAM,IAAI,CAAChE,KAAK,CAAC+B,aAAa,CAAC;YAACH;YAAOP;QAAI;QAC9D,MAAMc,MAAMjC,MAAMiC,GAAG,EAAE3B,UAAUwD,WAAWC,aAAa;QAEzD,OAAO;YACLC,eAAeC,4BAA4BH,WAAWI,QAAQ;YAC9DjC;YACA,4EAA4E;YAC5E,2EAA2E;YAC3E,0EAA0E;YAC1E,mEAAmE;YACnEkC,aAAa;gBACXC,UAAU7E,OAAO8E,sBAAsB;gBACvCC,OAAO/E,OAAOgF,mBAAmB;gBACjCC,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAKnF,OAAOoF,0BAA0B,GAAG;YACvE;QACF;IACF;AACF;AAEA,SAASV,4BAA4BC,QAAgB;IACnD,IAAI,CAAC1E,sBAAsB,OAAO0E;IAElC,MAAMF,gBAAgB,IAAIY,IAAIV;IAE9BF,cAAca,QAAQ,GAAGrF,qBAAqBqF,QAAQ;IACtDb,cAAcc,IAAI,GAAGtF,qBAAqBsF,IAAI;IAE9C,OAAOd,cAAce,QAAQ;AAC/B;AAEA,SAASjE,qBAAqBgD,UAA2B;IACvD,OAAO;QACLlC,sBAAsBzC,0BACpBG,mBACA,GAAGwE,WAAWkB,UAAU,CAAC,CAAC,EAAElB,WAAWmB,IAAI,EAAE;QAE/CvD,OAAOoC,WAAWkB,UAAU;QAC5BC,MAAMnB,WAAWmB,IAAI;QACrB7D,UAAU0C,WAAW1C,QAAQ;QAC7B2C,eAAeD,WAAWC,aAAa;QACvCmB,YAAYC,uBAAuBrB;QACnCI,UAAUJ,WAAWI,QAAQ;QAC7BkB,SAAStB,WAAWsB,OAAO;IAC7B;AACF;AAEA,SAASD,uBAAuBrB,UAA2B;IACzD,OAAOA,WAAWuB,OAAO,GAAG,YAAY;AAC1C;AAEA,SAAS1D,4BACPC,oBAA4B,EAC5B0D,aAAqB;IAErB,MAAMC,QAAQlG,0BAA0BuC,sBAAsBtC;IAC9D,MAAMkG,iBAAiBD,MAAME,OAAO,CAAC;IACrC,MAAM/D,QAAQ8D,iBAAiB,IAAID,MAAM/D,KAAK,CAAC,GAAGgE,kBAAkB;IACpE,MAAMrE,OAAOqE,iBAAiB,IAAID,MAAM/D,KAAK,CAACgE,iBAAiB,KAAK;IACpE,IAAI,CAAC9D,SAAS,CAACP,QAAQA,KAAKE,QAAQ,CAAC,MAAM;QACzC,MAAM,IAAI5B,8BACR,wBACA,CAAC,oBAAoB,EAAEmC,qBAAqB,sBAAsB,EAAEtC,kBAAkB,eAAe,CAAC;IAE1G;IACA,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAIoC,MAAMnB,WAAW,OAAO+E,cAAc/E,WAAW,IAAI;QACvD,MAAM,IAAId,8BACR,wBACA,CAAC,oBAAoB,EAAEmC,qBAAqB,eAAe,EAAE0D,cAAc,QAAQ,CAAC;IAExF;IAEA,OAAO;QAAC5D;QAAOP;IAAI;AACrB;AAEA,SAASwB,cAAcC,IAAY,EAAEP,MAAc;IACjD,IAAI,CAACA,QAAQ,OAAO;IACpB,OAAOO,SAASP,UAAUO,KAAK8C,UAAU,CAAC,GAAGrD,OAAO,CAAC,CAAC;AACxD;AAEA,SAASa,YAAYvC,MAA0B;IAC7C,IAAI,CAACA,QAAQ,OAAO;IACpB,MAAMsC,SAAS0C,OAAOC,QAAQ,CAACjF,QAAQ;IACvC,OAAOgF,OAAOE,KAAK,CAAC5C,WAAWA,SAAS,IAAI,IAAIA;AAClD"}

package/dist/core/webhook.d.ts

@@ -0,0 +1,38 @@
+import { type GetIntegrationConnectionByIdFn, type IntegrationTx, type PublishSourcePushFn, type RecordDeliveryOnlyFn } from '@shipfox/api-integration-core-dto';
+import { type GiteaPushPayloadDto } from '@shipfox/api-integration-gitea-dto';
+export declare class GiteaWebhookMalformedJsonError extends Error {
+    constructor(options: {
+        cause: unknown;
+    });
+}
+export declare class GiteaWebhookMalformedPushPayloadError extends Error {
+    readonly issues: unknown;
+    constructor(issues: unknown);
+}
+export interface HandleGiteaWebhookParams {
+    tx: IntegrationTx;
+    deliveryId: string;
+    event: string;
+    rawBody: string;
+    publishSourcePush: PublishSourcePushFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+export interface HandleGiteaPushParams {
+    tx: IntegrationTx;
+    deliveryId: string;
+    payload: GiteaPushPayloadDto;
+    rawPayload: unknown;
+    publishSourcePush: PublishSourcePushFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+export type HandleGiteaPushOutcome = 'published' | 'duplicate' | 'deleted' | 'unknown-org' | 'inactive-connection';
+export type HandleGiteaWebhookOutcome = HandleGiteaPushOutcome | 'recorded-only';
+export declare function handleGiteaWebhook(params: HandleGiteaWebhookParams): Promise<{
+    outcome: HandleGiteaWebhookOutcome;
+}>;
+export declare function handleGiteaPush(params: HandleGiteaPushParams): Promise<{
+    outcome: HandleGiteaPushOutcome;
+}>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/core/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/core/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,mBAAmB,EAGzB,MAAM,oCAAoC,CAAC;AAQ5C,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,OAAO,EAAE;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC;CAItC;AAED,qBAAa,qCAAsC,SAAQ,KAAK;aAClC,MAAM,EAAE,OAAO;gBAAf,MAAM,EAAE,OAAO;CAI5C;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,MAAM,MAAM,sBAAsB,GAC9B,WAAW,GACX,WAAW,GACX,SAAS,GACT,aAAa,GACb,qBAAqB,CAAC;AAC1B,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG,eAAe,CAAC;AAMjF,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC;IAAC,OAAO,EAAE,yBAAyB,CAAA;CAAC,CAAC,CAoB/C;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAAC,CAAC,CAuF5C"}

package/dist/core/webhook.js

@@ -0,0 +1,162 @@
+import { buildProviderRepositoryId } from '@shipfox/api-integration-core-dto';
+import { giteaProviderKind, giteaPushPayloadSchema } from '@shipfox/api-integration-gitea-dto';
+import { logger } from '@shipfox/node-opentelemetry';
+import { getGiteaConnectionByOrg } from '#db/connections.js';
+const REFS_HEADS_PREFIX = 'refs/heads/';
+// Gitea sends a `push` webhook for a branch deletion with `after` set to this all-zero SHA.
+const DELETED_BRANCH_SHA = '0'.repeat(40);
+export class GiteaWebhookMalformedJsonError extends Error {
+    constructor(options){
+        super('Gitea webhook payload is not valid JSON', {
+            cause: options.cause
+        });
+        this.name = 'GiteaWebhookMalformedJsonError';
+    }
+}
+export class GiteaWebhookMalformedPushPayloadError extends Error {
+    constructor(issues){
+        super('Gitea webhook push payload failed schema validation'), this.issues = issues;
+        this.name = 'GiteaWebhookMalformedPushPayloadError';
+    }
+}
+function isBranchDeletion(after) {
+    return after === DELETED_BRANCH_SHA;
+}
+export async function handleGiteaWebhook(params) {
+    if (params.event !== 'push') {
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: giteaProviderKind,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'recorded-only'
+        };
+    }
+    const { payload, rawPayload } = parseGiteaPushPayload(params.rawBody);
+    return handleGiteaPush({
+        tx: params.tx,
+        deliveryId: params.deliveryId,
+        payload,
+        rawPayload,
+        publishSourcePush: params.publishSourcePush,
+        recordDeliveryOnly: params.recordDeliveryOnly,
+        getIntegrationConnectionById: params.getIntegrationConnectionById
+    });
+}
+export async function handleGiteaPush(params) {
+    // Dropping deletes before `publishSourcePush` avoids project and trigger fan-out.
+    if (isBranchDeletion(params.payload.after)) {
+        return {
+            outcome: 'deleted'
+        };
+    }
+    const owner = params.payload.repository.owner.username;
+    // Gitea org routes are case-insensitive, and the connect flow stores them lower-cased.
+    const giteaConnection = await getGiteaConnectionByOrg(owner.toLowerCase(), {
+        tx: params.tx
+    });
+    if (!giteaConnection) {
+        logger().warn({
+            deliveryId: params.deliveryId,
+            org: owner
+        }, 'gitea webhook: unknown org, dropping');
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: giteaProviderKind,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'unknown-org'
+        };
+    }
+    const connection = await params.getIntegrationConnectionById(giteaConnection.connectionId, {
+        tx: params.tx
+    });
+    if (!connection) {
+        logger().warn({
+            deliveryId: params.deliveryId,
+            org: owner,
+            connectionId: giteaConnection.connectionId
+        }, 'gitea webhook: org has no connection, dropping');
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: giteaProviderKind,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'unknown-org'
+        };
+    }
+    if (connection.lifecycleStatus !== 'active') {
+        const logContext = {
+            deliveryId: params.deliveryId,
+            org: owner,
+            connectionId: connection.id,
+            workspaceId: connection.workspaceId,
+            lifecycleStatus: connection.lifecycleStatus
+        };
+        // `disabled` is an expected steady state; only `error` is anomalous.
+        if (connection.lifecycleStatus === 'error') {
+            logger().warn(logContext, 'gitea webhook: connection in error state, dropping');
+        } else {
+            logger().info(logContext, 'gitea webhook: connection disabled, dropping');
+        }
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: giteaProviderKind,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'inactive-connection'
+        };
+    }
+    const ref = stripRefsHeads(params.payload.ref);
+    const defaultBranch = params.payload.repository.default_branch;
+    const push = {
+        // Match the source-control adapter's owner/name repository id.
+        externalRepositoryId: buildProviderRepositoryId(giteaProviderKind, `${owner}/${params.payload.repository.name}`),
+        ref,
+        headCommitSha: params.payload.after,
+        defaultBranch,
+        isDefaultBranch: ref === defaultBranch
+    };
+    const result = await params.publishSourcePush({
+        tx: params.tx,
+        provider: giteaProviderKind,
+        source: connection.slug,
+        workspaceId: connection.workspaceId,
+        connectionId: connection.id,
+        connectionName: connection.displayName,
+        deliveryId: params.deliveryId,
+        receivedAt: new Date().toISOString(),
+        rawPayload: params.rawPayload,
+        push
+    });
+    return {
+        outcome: result.published ? 'published' : 'duplicate'
+    };
+}
+function stripRefsHeads(ref) {
+    return ref.startsWith(REFS_HEADS_PREFIX) ? ref.slice(REFS_HEADS_PREFIX.length) : ref;
+}
+function parseGiteaPushPayload(rawBody) {
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(rawBody);
+    } catch (error) {
+        throw new GiteaWebhookMalformedJsonError({
+            cause: error
+        });
+    }
+    const validated = giteaPushPayloadSchema.safeParse(parsedJson);
+    if (!validated.success) {
+        throw new GiteaWebhookMalformedPushPayloadError(validated.error.issues);
+    }
+    return {
+        payload: validated.data,
+        rawPayload: parsedJson
+    };
+}
+
+//# sourceMappingURL=webhook.js.map

package/dist/core/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import {\n  buildProviderRepositoryId,\n  type GetIntegrationConnectionByIdFn,\n  type IntegrationTx,\n  type PublishSourcePushFn,\n  type RecordDeliveryOnlyFn,\n  type SourcePushPayload,\n} from '@shipfox/api-integration-core-dto';\nimport {\n  type GiteaPushPayloadDto,\n  giteaProviderKind,\n  giteaPushPayloadSchema,\n} from '@shipfox/api-integration-gitea-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {getGiteaConnectionByOrg} from '#db/connections.js';\n\nconst REFS_HEADS_PREFIX = 'refs/heads/';\n// Gitea sends a `push` webhook for a branch deletion with `after` set to this all-zero SHA.\nconst DELETED_BRANCH_SHA = '0'.repeat(40);\n\nexport class GiteaWebhookMalformedJsonError extends Error {\n  constructor(options: {cause: unknown}) {\n    super('Gitea webhook payload is not valid JSON', {cause: options.cause});\n    this.name = 'GiteaWebhookMalformedJsonError';\n  }\n}\n\nexport class GiteaWebhookMalformedPushPayloadError extends Error {\n  constructor(public readonly issues: unknown) {\n    super('Gitea webhook push payload failed schema validation');\n    this.name = 'GiteaWebhookMalformedPushPayloadError';\n  }\n}\n\nexport interface HandleGiteaWebhookParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  event: string;\n  rawBody: string;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport interface HandleGiteaPushParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: GiteaPushPayloadDto;\n  rawPayload: unknown;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport type HandleGiteaPushOutcome =\n  | 'published'\n  | 'duplicate'\n  | 'deleted'\n  | 'unknown-org'\n  | 'inactive-connection';\nexport type HandleGiteaWebhookOutcome = HandleGiteaPushOutcome | 'recorded-only';\n\nfunction isBranchDeletion(after: string): boolean {\n  return after === DELETED_BRANCH_SHA;\n}\n\nexport async function handleGiteaWebhook(\n  params: HandleGiteaWebhookParams,\n): Promise<{outcome: HandleGiteaWebhookOutcome}> {\n  if (params.event !== 'push') {\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: giteaProviderKind,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'recorded-only'};\n  }\n\n  const {payload, rawPayload} = parseGiteaPushPayload(params.rawBody);\n  return handleGiteaPush({\n    tx: params.tx,\n    deliveryId: params.deliveryId,\n    payload,\n    rawPayload,\n    publishSourcePush: params.publishSourcePush,\n    recordDeliveryOnly: params.recordDeliveryOnly,\n    getIntegrationConnectionById: params.getIntegrationConnectionById,\n  });\n}\n\nexport async function handleGiteaPush(\n  params: HandleGiteaPushParams,\n): Promise<{outcome: HandleGiteaPushOutcome}> {\n  // Dropping deletes before `publishSourcePush` avoids project and trigger fan-out.\n  if (isBranchDeletion(params.payload.after)) {\n    return {outcome: 'deleted'};\n  }\n\n  const owner = params.payload.repository.owner.username;\n  // Gitea org routes are case-insensitive, and the connect flow stores them lower-cased.\n  const giteaConnection = await getGiteaConnectionByOrg(owner.toLowerCase(), {tx: params.tx});\n  if (!giteaConnection) {\n    logger().warn(\n      {deliveryId: params.deliveryId, org: owner},\n      'gitea webhook: unknown org, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: giteaProviderKind,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'unknown-org'};\n  }\n\n  const connection = await params.getIntegrationConnectionById(giteaConnection.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    logger().warn(\n      {deliveryId: params.deliveryId, org: owner, connectionId: giteaConnection.connectionId},\n      'gitea webhook: org has no connection, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: giteaProviderKind,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'unknown-org'};\n  }\n\n  if (connection.lifecycleStatus !== 'active') {\n    const logContext = {\n      deliveryId: params.deliveryId,\n      org: owner,\n      connectionId: connection.id,\n      workspaceId: connection.workspaceId,\n      lifecycleStatus: connection.lifecycleStatus,\n    };\n    // `disabled` is an expected steady state; only `error` is anomalous.\n    if (connection.lifecycleStatus === 'error') {\n      logger().warn(logContext, 'gitea webhook: connection in error state, dropping');\n    } else {\n      logger().info(logContext, 'gitea webhook: connection disabled, dropping');\n    }\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: giteaProviderKind,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'inactive-connection'};\n  }\n\n  const ref = stripRefsHeads(params.payload.ref);\n  const defaultBranch = params.payload.repository.default_branch;\n  const push: SourcePushPayload = {\n    // Match the source-control adapter's owner/name repository id.\n    externalRepositoryId: buildProviderRepositoryId(\n      giteaProviderKind,\n      `${owner}/${params.payload.repository.name}`,\n    ),\n    ref,\n    headCommitSha: params.payload.after,\n    defaultBranch,\n    isDefaultBranch: ref === defaultBranch,\n  };\n  const result = await params.publishSourcePush({\n    tx: params.tx,\n    provider: giteaProviderKind,\n    source: connection.slug,\n    workspaceId: connection.workspaceId,\n    connectionId: connection.id,\n    connectionName: connection.displayName,\n    deliveryId: params.deliveryId,\n    receivedAt: new Date().toISOString(),\n    rawPayload: params.rawPayload,\n    push,\n  });\n\n  return {outcome: result.published ? 'published' : 'duplicate'};\n}\n\nfunction stripRefsHeads(ref: string): string {\n  return ref.startsWith(REFS_HEADS_PREFIX) ? ref.slice(REFS_HEADS_PREFIX.length) : ref;\n}\n\nfunction parseGiteaPushPayload(rawBody: string): {\n  payload: GiteaPushPayloadDto;\n  rawPayload: unknown;\n} {\n  let parsedJson: unknown;\n  try {\n    parsedJson = JSON.parse(rawBody);\n  } catch (error) {\n    throw new GiteaWebhookMalformedJsonError({cause: error});\n  }\n\n  const validated = giteaPushPayloadSchema.safeParse(parsedJson);\n  if (!validated.success) {\n    throw new GiteaWebhookMalformedPushPayloadError(validated.error.issues);\n  }\n\n  return {payload: validated.data, rawPayload: parsedJson};\n}\n"],"names":["buildProviderRepositoryId","giteaProviderKind","giteaPushPayloadSchema","logger","getGiteaConnectionByOrg","REFS_HEADS_PREFIX","DELETED_BRANCH_SHA","repeat","GiteaWebhookMalformedJsonError","Error","options","cause","name","GiteaWebhookMalformedPushPayloadError","issues","isBranchDeletion","after","handleGiteaWebhook","params","event","recordDeliveryOnly","tx","provider","deliveryId","outcome","payload","rawPayload","parseGiteaPushPayload","rawBody","handleGiteaPush","publishSourcePush","getIntegrationConnectionById","owner","repository","username","giteaConnection","toLowerCase","warn","org","connection","connectionId","lifecycleStatus","logContext","id","workspaceId","info","ref","stripRefsHeads","defaultBranch","default_branch","push","externalRepositoryId","headCommitSha","isDefaultBranch","result","source","slug","connectionName","displayName","receivedAt","Date","toISOString","published","startsWith","slice","length","parsedJson","JSON","parse","error","validated","safeParse","success","data"],"mappings":"AAAA,SACEA,yBAAyB,QAMpB,oCAAoC;AAC3C,SAEEC,iBAAiB,EACjBC,sBAAsB,QACjB,qCAAqC;AAC5C,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,uBAAuB,QAAO,qBAAqB;AAE3D,MAAMC,oBAAoB;AAC1B,4FAA4F;AAC5F,MAAMC,qBAAqB,IAAIC,MAAM,CAAC;AAEtC,OAAO,MAAMC,uCAAuCC;IAClD,YAAYC,OAAyB,CAAE;QACrC,KAAK,CAAC,2CAA2C;YAACC,OAAOD,QAAQC,KAAK;QAAA;QACtE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,8CAA8CJ;IACzD,YAAY,AAAgBK,MAAe,CAAE;QAC3C,KAAK,CAAC,6DADoBA,SAAAA;QAE1B,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AA8BA,SAASG,iBAAiBC,KAAa;IACrC,OAAOA,UAAUV;AACnB;AAEA,OAAO,eAAeW,mBACpBC,MAAgC;IAEhC,IAAIA,OAAOC,KAAK,KAAK,QAAQ;QAC3B,MAAMD,OAAOE,kBAAkB,CAAC;YAC9BC,IAAIH,OAAOG,EAAE;YACbC,UAAUrB;YACVsB,YAAYL,OAAOK,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAe;IAClC;IAEA,MAAM,EAACC,OAAO,EAAEC,UAAU,EAAC,GAAGC,sBAAsBT,OAAOU,OAAO;IAClE,OAAOC,gBAAgB;QACrBR,IAAIH,OAAOG,EAAE;QACbE,YAAYL,OAAOK,UAAU;QAC7BE;QACAC;QACAI,mBAAmBZ,OAAOY,iBAAiB;QAC3CV,oBAAoBF,OAAOE,kBAAkB;QAC7CW,8BAA8Bb,OAAOa,4BAA4B;IACnE;AACF;AAEA,OAAO,eAAeF,gBACpBX,MAA6B;IAE7B,kFAAkF;IAClF,IAAIH,iBAAiBG,OAAOO,OAAO,CAACT,KAAK,GAAG;QAC1C,OAAO;YAACQ,SAAS;QAAS;IAC5B;IAEA,MAAMQ,QAAQd,OAAOO,OAAO,CAACQ,UAAU,CAACD,KAAK,CAACE,QAAQ;IACtD,uFAAuF;IACvF,MAAMC,kBAAkB,MAAM/B,wBAAwB4B,MAAMI,WAAW,IAAI;QAACf,IAAIH,OAAOG,EAAE;IAAA;IACzF,IAAI,CAACc,iBAAiB;QACpBhC,SAASkC,IAAI,CACX;YAACd,YAAYL,OAAOK,UAAU;YAAEe,KAAKN;QAAK,GAC1C;QAEF,MAAMd,OAAOE,kBAAkB,CAAC;YAC9BC,IAAIH,OAAOG,EAAE;YACbC,UAAUrB;YACVsB,YAAYL,OAAOK,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAa;IAChC;IAEA,MAAMe,aAAa,MAAMrB,OAAOa,4BAA4B,CAACI,gBAAgBK,YAAY,EAAE;QACzFnB,IAAIH,OAAOG,EAAE;IACf;IACA,IAAI,CAACkB,YAAY;QACfpC,SAASkC,IAAI,CACX;YAACd,YAAYL,OAAOK,UAAU;YAAEe,KAAKN;YAAOQ,cAAcL,gBAAgBK,YAAY;QAAA,GACtF;QAEF,MAAMtB,OAAOE,kBAAkB,CAAC;YAC9BC,IAAIH,OAAOG,EAAE;YACbC,UAAUrB;YACVsB,YAAYL,OAAOK,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAa;IAChC;IAEA,IAAIe,WAAWE,eAAe,KAAK,UAAU;QAC3C,MAAMC,aAAa;YACjBnB,YAAYL,OAAOK,UAAU;YAC7Be,KAAKN;YACLQ,cAAcD,WAAWI,EAAE;YAC3BC,aAAaL,WAAWK,WAAW;YACnCH,iBAAiBF,WAAWE,eAAe;QAC7C;QACA,qEAAqE;QACrE,IAAIF,WAAWE,eAAe,KAAK,SAAS;YAC1CtC,SAASkC,IAAI,CAACK,YAAY;QAC5B,OAAO;YACLvC,SAAS0C,IAAI,CAACH,YAAY;QAC5B;QACA,MAAMxB,OAAOE,kBAAkB,CAAC;YAC9BC,IAAIH,OAAOG,EAAE;YACbC,UAAUrB;YACVsB,YAAYL,OAAOK,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAqB;IACxC;IAEA,MAAMsB,MAAMC,eAAe7B,OAAOO,OAAO,CAACqB,GAAG;IAC7C,MAAME,gBAAgB9B,OAAOO,OAAO,CAACQ,UAAU,CAACgB,cAAc;IAC9D,MAAMC,OAA0B;QAC9B,+DAA+D;QAC/DC,sBAAsBnD,0BACpBC,mBACA,GAAG+B,MAAM,CAAC,EAAEd,OAAOO,OAAO,CAACQ,UAAU,CAACrB,IAAI,EAAE;QAE9CkC;QACAM,eAAelC,OAAOO,OAAO,CAACT,KAAK;QACnCgC;QACAK,iBAAiBP,QAAQE;IAC3B;IACA,MAAMM,SAAS,MAAMpC,OAAOY,iBAAiB,CAAC;QAC5CT,IAAIH,OAAOG,EAAE;QACbC,UAAUrB;QACVsD,QAAQhB,WAAWiB,IAAI;QACvBZ,aAAaL,WAAWK,WAAW;QACnCJ,cAAcD,WAAWI,EAAE;QAC3Bc,gBAAgBlB,WAAWmB,WAAW;QACtCnC,YAAYL,OAAOK,UAAU;QAC7BoC,YAAY,IAAIC,OAAOC,WAAW;QAClCnC,YAAYR,OAAOQ,UAAU;QAC7BwB;IACF;IAEA,OAAO;QAAC1B,SAAS8B,OAAOQ,SAAS,GAAG,cAAc;IAAW;AAC/D;AAEA,SAASf,eAAeD,GAAW;IACjC,OAAOA,IAAIiB,UAAU,CAAC1D,qBAAqByC,IAAIkB,KAAK,CAAC3D,kBAAkB4D,MAAM,IAAInB;AACnF;AAEA,SAASnB,sBAAsBC,OAAe;IAI5C,IAAIsC;IACJ,IAAI;QACFA,aAAaC,KAAKC,KAAK,CAACxC;IAC1B,EAAE,OAAOyC,OAAO;QACd,MAAM,IAAI7D,+BAA+B;YAACG,OAAO0D;QAAK;IACxD;IAEA,MAAMC,YAAYpE,uBAAuBqE,SAAS,CAACL;IACnD,IAAI,CAACI,UAAUE,OAAO,EAAE;QACtB,MAAM,IAAI3D,sCAAsCyD,UAAUD,KAAK,CAACvD,MAAM;IACxE;IAEA,OAAO;QAACW,SAAS6C,UAAUG,IAAI;QAAE/C,YAAYwC;IAAU;AACzD"}

package/dist/db/connections.d.ts

@@ -0,0 +1,19 @@
+export interface GiteaConnection {
+    id: string;
+    connectionId: string;
+    org: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface UpsertGiteaConnectionParams {
+    connectionId: string;
+    org: string;
+}
+export declare function upsertGiteaConnection(params: UpsertGiteaConnectionParams, options?: {
+    tx?: unknown;
+}): Promise<GiteaConnection>;
+export declare function getGiteaConnectionByOrg(org: string, options?: {
+    tx?: unknown;
+}): Promise<GiteaConnection | undefined>;
+export declare function getGiteaConnectionByConnectionId(connectionId: string): Promise<GiteaConnection | undefined>;
+//# sourceMappingURL=connections.d.ts.map

package/dist/db/connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/db/connections.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,2BAA2B,EACnC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,eAAe,CAAC,CA2B1B;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAUtC;AAED,wBAAsB,gCAAgC,CACpD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAStC"}

package/dist/db/connections.js

@@ -0,0 +1,42 @@
+import { eq } from 'drizzle-orm';
+import { GiteaOrgAlreadyLinkedError } from '#core/errors.js';
+import { db } from './db.js';
+import { giteaConnections, toGiteaConnection } from './schema/connections.js';
+export async function upsertGiteaConnection(params, options = {}) {
+    const executor = options.tx ?? db();
+    const now = new Date();
+    const [row] = await executor.insert(giteaConnections).values({
+        connectionId: params.connectionId,
+        org: params.org
+    }).onConflictDoUpdate({
+        target: giteaConnections.org,
+        // TOCTOU guard: only (re)point this org at the connection that already
+        // owns it. A concurrent connect of the same org to a different workspace
+        // inserts its own connection row, so its connectionId differs here; the
+        // predicate is false, Postgres updates nothing, and the empty RETURNING
+        // below rolls the losing transaction back instead of silently repointing
+        // the org (cross-tenant connection takeover).
+        setWhere: eq(giteaConnections.connectionId, params.connectionId),
+        set: {
+            connectionId: params.connectionId,
+            updatedAt: now
+        }
+    }).returning();
+    if (!row) throw new GiteaOrgAlreadyLinkedError(params.org);
+    return toGiteaConnection(row);
+}
+export async function getGiteaConnectionByOrg(org, options = {}) {
+    const executor = options.tx ?? db();
+    const rows = await executor.select().from(giteaConnections).where(eq(giteaConnections.org, org)).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toGiteaConnection(row);
+}
+export async function getGiteaConnectionByConnectionId(connectionId) {
+    const rows = await db().select().from(giteaConnections).where(eq(giteaConnections.connectionId, connectionId)).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toGiteaConnection(row);
+}
+
+//# sourceMappingURL=connections.js.map