@shipfox/api-integration-sentry 2.0.0

package/.turbo/turbo-build.log

@@ -0,0 +1,2 @@
+$ shipfox-swc
+Successfully compiled: 26 files with swc (156.42ms)

package/.turbo/turbo-type$colon$emit.log

@@ -0,0 +1 @@
+$ shipfox-tsc-emit

package/.turbo/turbo-type.log

@@ -0,0 +1 @@
+$ shipfox-tsc-check

package/CHANGELOG.md

@@ -0,0 +1,192 @@
+# @shipfox/api-integration-sentry
+
+## 2.0.0
+
+### Minor Changes
+
+- 1b0d344: Publishes the complete API runtime closure with packed-consumer-safe internal imports and records its exact package set in application releases.
+
+### Patch Changes
+
+- Updated dependencies [0cd6dd4]
+- Updated dependencies [1b0d344]
+- Updated dependencies [521e006]
+  - @shipfox/node-module@0.2.0
+  - @shipfox/api-auth-context@2.0.0
+  - @shipfox/api-integration-core-dto@2.0.0
+  - @shipfox/api-integration-sentry-dto@2.0.0
+  - @shipfox/config@1.2.1
+  - @shipfox/node-drizzle@0.2.1
+  - @shipfox/node-fastify@0.2.1
+  - @shipfox/node-opentelemetry@0.5.0
+  - @shipfox/node-postgres@0.4.1
+
+## 0.1.2
+
+### Patch Changes
+
+- @shipfox/node-module@0.1.2
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [ec75cd5]
+- Updated dependencies [6a1fb54]
+  - @shipfox/node-drizzle@0.2.0
+  - @shipfox/node-postgres@0.4.0
+  - @shipfox/node-module@0.1.1
+
+## 0.1.0
+
+### Minor Changes
+
+- d245be8: [api/integrations] Make the signed Sentry installation webhook authoritative.
+  - `@shipfox/api-integration-sentry-dto`: reshape `sentryInstallationWebhookSchema`
+    to read `data.installation.{uuid, organization.slug, status, code}` plus an
+    optional top-level `actor`. Only consumed fields are validated and the raw
+    `code` is never logged.
+  - `@shipfox/api-integration-sentry`: the signed `installation.created` webhook now
+    exchanges the single-use code and persists a verified-but-unclaimed installation
+    (`connection_id IS NULL`, `code_hash = sha256(code)`). The browser flow narrows
+    to a claim that binds a verified install to a workspace under unified claim auth
+    (exchange-success, same-code hash match, or a retryable
+    `verification-in-progress` while a concurrent webhook is mid-exchange), with a
+    proof-mismatch 403 closing the bare-uuid IDOR. The exchange/verify run outside
+    the DB transaction; a short transaction wraps persist + delivery record. Adds
+    `connection_id` nullable + `code_hash` to the installations table and a daily TTL
+    cron that tombstones never-claimed installs.
+  - `@shipfox/api-integration-core`: inject the Sentry client into the webhook
+    context, resolve a null `connection_id` to "no connection" for pre-claim issue
+    deliveries, and register the unclaimed-installation cleanup cron when Sentry is
+    enabled.
+  - `@shipfox/client-integrations`: treat the retryable `verification-in-progress`
+    response as a backoff-eligible failure on the connect callback.
+
+- b8e49ff: Add the client-side Sentry install/connect flow and a workspace settings
+  integrations hub.
+  - `@shipfox/client-integrations`: shared `IntegrationGallerySection` (capability
+    filter, lifecycle pills, "Added" date, external link, connected-first
+    ordering, degraded status mode), shared `RedirectInstallPage` powering the
+    GitHub and new Sentry install pages, `SentryCallbackPage` with an explicit
+    workspace confirm (sessionStorage only pre-selects), two-tier retry, and the
+    Sentry hooks (`useCreateSentryInstallMutation`, `connectSentry`,
+    `useIntegrationConnectionsQuery`).
+  - `@shipfox/client-workspace-settings`: new `/workspaces/$wid/settings/integrations`
+    page and an Integrations entry in the settings nav.
+  - `@shipfox/client-router`: routes for the Sentry install page, the root-level
+    Sentry callback, and the settings integrations page.
+  - `@shipfox/react-ui`: `sentry` icon (monochrome, theme-aware).
+  - `@shipfox/api-integration-core-dto`: optional `external_url` on the connection
+    DTO and an optional `connectionExternalUrl` method on `IntegrationProvider`.
+  - `@shipfox/api-integration-core`: `GET /integration-connections` now returns
+    connections of every lifecycle status (the active-only filter prevented
+    clients from surfacing disabled/error state) and resolves `external_url`
+    per connection best-effort.
+  - `@shipfox/api-integration-sentry` / `@shipfox/api-integration-github`:
+    implement `connectionExternalUrl` (Sentry org URL via a new
+    by-connection-id installation lookup; GitHub installation settings URL).
+
+- 5b8ed32: Add the Sentry install/connect flow so a workspace member can link a Sentry
+  installation to a Shipfox workspace, writing the connection + installation rows
+  that the webhook receiver looks up.
+  - `@shipfox/api-integration-sentry`: add a stateless `SentryApiClient`
+    (authorization-code exchange, org-slug derivation, optional verify-install),
+    `handleSentryConnect`, and two authenticated routes —
+    `POST /integrations/sentry/install` (returns the external-install URL) and
+    `POST /integrations/sentry/connect` (links the installation). Sentry has no
+    `state` param, so the workspace is taken from the request body and authorized
+    against the live session; the org slug is derived from Sentry, never trusted
+    from the body. The verify-install side effect runs after the row is persisted,
+    and no Sentry token is stored. Provider HTTP errors map to a typed
+    `SentryIntegrationProviderError` and never carry the token, code, or client
+    secret.
+  - `@shipfox/api-integration-sentry-dto`: add the install/connect request and
+    response schemas.
+  - `@shipfox/api-integration-core`: wire the `getExistingSentryConnection` and
+    `connectSentryInstallation` closures into the Sentry provider (internal
+    wiring, no public API change).
+
+  A concurrent same-install connect race (shared with GitHub) is tracked
+  separately in ENG-409.
+
+- d6d4862: Add a Sentry integration provider that ingests issue webhooks.
+  - New `@shipfox/api-integration-sentry` + `-sentry-dto` packages: a webhook
+    receiver that verifies the HMAC-SHA256 signature (keyed with the app client
+    secret), dedups on `Request-ID`, normalizes the issue payload, and publishes
+    `integrations.event.received` with `source: 'sentry'` and `event:
+issue.<action>`. A raw `ignored` action is normalized to `archived`. Malformed,
+    bad-JSON, unknown-action, and unknown-resource deliveries are recorded-and-dropped
+    with a 204 (deliberate deviation from GitHub's 400 to avoid Sentry disabling the
+    webhook).
+  - `@shipfox/api-integration-core-dto`: add the `SentryIssuePayload` contract.
+  - `@shipfox/api-integration-core`: register the Sentry provider behind
+    `INTEGRATIONS_ENABLE_SENTRY_PROVIDER`, add the
+    `updateIntegrationConnectionLifecycleStatus` helper, and pin stable
+    migration-tracking table names per provider database.
+  - `@shipfox/node-fastify`: add the shared `rawBodyPlugin` and `WEBHOOK_BODY_LIMIT`
+    exports for webhook receivers.
+  - `@shipfox/node-module`: add an optional `migrationsTableName` to `ModuleDatabase`
+    so conditionally-composed databases get a position-independent migration table.
+  - `@shipfox/api-integration-github`: consume the shared `rawBodyPlugin` instead of
+    a local copy (internal refactor, no behavior change).
+
+  Deploy note: environments with GitHub enabled must rename the existing
+  `__drizzle_migrations_integrations_1` table to
+  `__drizzle_migrations_integrations_github` as part of this release, or GitHub
+  migrations re-run against existing tables.
+
+### Patch Changes
+
+- 9f1c0ef: Harden integration connect against a concurrent same-install race. The installation upsert now only (re)points an installation at the connection that already owns it: the `onConflictDoUpdate` carries a `setWhere(connection_id = this connection)` predicate and throws `*InstallationAlreadyLinkedError` when the conflicting row belongs to a different connection. Two concurrent connects of the same provider install to different workspaces no longer leave one workspace with an active orphan connection while the install's webhooks silently route to the other; the losing transaction rolls back and surfaces a 409.
+- 857fd73: Receive Gitea push webhooks and trigger runs through the existing source-push pipeline.
+  - `@shipfox/api-integration-gitea-dto`: `giteaPushPayloadSchema` (`{ref, after, repository: {name, full_name, default_branch, owner: {username}}}`).
+  - `@shipfox/api-integration-gitea`: `POST /webhooks/integrations/gitea` (`auth: []`, `rawBodyPlugin`, standard webhook body limit). It verifies the `X-Gitea-Signature` header as hex HMAC-SHA256 of the raw body keyed by `GITEA_WEBHOOK_SECRET` (401 on mismatch), records non-`push` events for delivery dedup and returns 204, and on a `push` resolves the org (`repository.owner.username`, lower-cased to match the stored org) to its connection, drops branch deletions and unknown orgs, and publishes a normalized `SourcePushPayload` (`externalRepositoryId: gitea:<owner>/<repo>` built from `owner.username`/`repository.name` to match the source-control adapter, `refs/heads/` stripped, `headCommitSha: after`, `isDefaultBranch`). `getGiteaConnectionByOrg` gains an optional transaction executor so the lookup runs inside the publishing transaction. The webhook is registered out of band by the Gitea instance admin, so the connect flow registers nothing.
+  - `@shipfox/api-integration-core`: wire `publishSourcePush`, `recordDeliveryOnly`, `getIntegrationConnectionById`, and the core database into the Gitea provider, mirroring GitHub.
+  - `@shipfox/node-fastify`: add a shared `verifyHexHmacSignature` helper for hex HMAC-SHA256 webhook signatures.
+  - `@shipfox/api-integration-sentry`: `verifySentrySignature` now delegates to the shared helper.
+
+  A push to a connected org's repo creates a workflow run through the existing pipeline. Duplicate POSTs of the same delivery are deduped via `X-Gitea-Delivery`; note that a manual "Redeliver" in Gitea mints a new delivery id and intentionally produces a fresh run (unlike GitHub, whose redelivery reuses the original id and is suppressed).
+
+- 417f128: Move the Sentry unclaimed-installation cleanup cron out of `@shipfox/api-integration-core` into `@shipfox/api-integration-sentry`, which now owns its own Temporal maintenance worker. `core` aggregates per-integration workers from enabled providers instead of special-casing Sentry, keeping the integration dependency graph a tree (providers depend only on `*-core-dto`, never on `core`). The unclaimed-installation retention window is now configurable via `SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS` (default 7, minimum 1; startup fails on a smaller value so a misconfiguration cannot tombstone freshly created installs).
+- 82d22e4: Make the workspace-membership gate stateless. `requireWorkspaceAccess` now lives in `@shipfox/api-auth-context` and authorizes a request purely from the verified session-token claims, replacing the `requireMembership` gate in `@shipfox/api-workspaces` that read the workspace row from the database on every workspace-scoped request. Membership and role already travel in the token, so the check needs no database access.
+
+  This removes the per-request database read and severs the runtime dependency on `@shipfox/api-workspaces` from feature modules that only needed the membership gate (integration providers, secrets, projects, agent, runners). Workspace existence and `active`-status enforcement, which no code path currently exercises, moves off the hot path; enforce it at token issuance when workspace suspension is introduced.
+
+- Updated dependencies [34ba284]
+- Updated dependencies [5707d6d]
+- Updated dependencies [b9c3f32]
+- Updated dependencies [a81b68c]
+- Updated dependencies [115655e]
+- Updated dependencies [c0a883c]
+- Updated dependencies [72ce351]
+- Updated dependencies [e47f8da]
+- Updated dependencies [ce062a9]
+- Updated dependencies [7b175f5]
+- Updated dependencies [f3614ae]
+- Updated dependencies [ae7a63c]
+- Updated dependencies [d245be8]
+- Updated dependencies [f92122b]
+- Updated dependencies [f8f339a]
+- Updated dependencies [857fd73]
+- Updated dependencies [75520ff]
+- Updated dependencies [b8e49ff]
+- Updated dependencies [5b8ed32]
+- Updated dependencies [d6d4862]
+- Updated dependencies [c0a883c]
+- Updated dependencies [6077301]
+- Updated dependencies [3bea87f]
+- Updated dependencies [82d22e4]
+- Updated dependencies [01be723]
+- Updated dependencies [2933c33]
+- Updated dependencies [6181819]
+- Updated dependencies [9c149d1]
+  - @shipfox/node-fastify@0.2.0
+  - @shipfox/node-drizzle@0.1.0
+  - @shipfox/api-auth-context@0.1.0
+  - @shipfox/api-integration-core-dto@0.1.0
+  - @shipfox/node-opentelemetry@0.4.2
+  - @shipfox/node-postgres@0.3.2
+  - @shipfox/node-module@0.1.0
+  - @shipfox/api-integration-sentry-dto@0.1.0
+  - @shipfox/config@1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,145 @@
+# Shipfox API Integration Sentry
+
+Shipfox API Integration Sentry receives Sentry App webhooks and publishes
+normalized integration events for downstream modules such as triggers and
+projects. It also exposes the install/connect flow that links a Sentry
+installation to a Shipfox workspace.
+
+## Setup
+
+This package is published as part of the API runtime closure. Install it from
+the registry:
+
+```sh
+pnpm add @shipfox/api-integration-sentry
+```
+
+Enable the provider from the integrations core package with:
+
+```sh
+INTEGRATIONS_ENABLE_SENTRY_PROVIDER=true
+```
+
+Configure the Sentry App credentials in the API environment:
+
+```sh
+SENTRY_APP_CLIENT_ID=
+SENTRY_APP_CLIENT_SECRET=
+SENTRY_APP_SLUG=
+SENTRY_APP_VERIFY_INSTALL=true
+SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS=7
+```
+
+`SENTRY_APP_CLIENT_SECRET` is the shared secret used to verify inbound webhooks with HMAC-SHA256 (Sentry signs deliveries with it, the provider verifies them).
+
+`SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS` (default 7, minimum 1) is how many days a verified-but-unclaimed installation may sit before the daily cleanup cron tombstones it. Startup fails on a value below 1.
+
+## Webhook Route
+
+The provider mounts this unauthenticated webhook route:
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `POST` | `/webhooks/integrations/sentry` | Receives Sentry App webhooks. |
+
+The route verifies the request signature before parsing JSON. It deduplicates
+deliveries by Sentry's `Request-ID` header. Malformed JSON, unknown actions,
+unknown resources, and events for unknown installations are recorded and
+acknowledged with `204` so Sentry does not disable the webhook after repeated
+non-2xx responses.
+
+## Events
+
+Issue webhooks publish `INTEGRATION_EVENT_RECEIVED` with the connection slug as `source`.
+Downstream trigger payloads receive the normalized `SentryIssuePayload` in
+`triggerPayload.data`.
+
+| Event | Sentry issue action |
+| --- | --- |
+| `issue.created` | `created` |
+| `issue.resolved` | `resolved` |
+| `issue.assigned` | `assigned` |
+| `issue.archived` | `archived` |
+| `issue.unresolved` | `unresolved` |
+
+A raw Sentry `ignored` action is normalized to `issue.archived` with
+`payload.action: 'archived'`.
+
+## Install / Connect Routes
+
+The provider mounts these authenticated routes (`AUTH_USER` bearer token):
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `POST` | `/integrations/sentry/install` | Returns the Sentry external-install URL for a workspace. |
+| `POST` | `/integrations/sentry/connect` | Links a Sentry installation to a workspace after the install redirect. |
+
+Sentry has no `state` parameter in its install redirect, so the workspace is
+taken from the request body (`workspace_id`) and authorized against the live
+session. `POST /connect` accepts `{workspace_id, code, installation_id}` only —
+the organization slug is derived from Sentry after the code exchange, never
+trusted from the client. The exchanged token is used in-memory for the optional
+verify-install call and then discarded; **no Sentry token is persisted**.
+
+## Sentry App registration
+
+Configure the Sentry App (Settings → Developer Settings → your app):
+
+- **Redirect URL:** point it at the client callback route
+  `<client-origin>/integrations/sentry/callback` (for example
+  `https://app.shipfox.io/integrations/sentry/callback`, or
+  `http://localhost:5173/integrations/sentry/callback` for local development).
+  The page reads `code` and `installationId` from the redirect query, asks the
+  user to confirm the target workspace, and calls
+  `POST /integrations/sentry/connect` with `{workspace_id, code,
+  installation_id}`. A redirect `orgSlug`, if present, is used only as display
+  copy on the confirm screen; it is never sent to the API. The server derives
+  the authoritative org slug from Sentry after the code exchange (the
+  `get-installation` call), so a forged slug cannot influence the stored
+  connection. This is per-environment configuration:
+  each environment's Sentry App must point at that environment's client
+  origin, or installs end on sentry.io with nowhere to return to.
+- **Webhooks:** enable the **Issue** resource so issue webhooks are delivered.
+- **Verify Install:** when enabled, the connect flow issues a
+  `PUT /api/0/sentry-app-installations/{installation_id}/` to mark the
+  installation installed; mirror the toggle with `SENTRY_APP_VERIFY_INSTALL`.
+
+### Required permissions
+
+Set these under the app's **Permissions** tab. The installation token bakes in
+the app's permissions at install time, so **changing a permission requires
+reinstalling the app** before the new scope takes effect.
+
+| Permission | Level | Why |
+| --- | --- | --- |
+| **Organization** | Read | `POST /connect` reads the installation to derive the org slug. Without it, the org lookup returns `403 Forbidden` and connect fails with `access-denied` (422). |
+| **Issue & Event** | Read | Required for Sentry to deliver issue webhooks against the installation. |
+
+When a Sentry call is rejected, the API logs a `Sentry API request rejected`
+warning with the failing `operation` and the upstream `status` (for example
+`{operation: "get-installation", status: 403}`). The client-facing error stays
+generic to avoid leaking provider internals, so this log is where you confirm a
+missing-permission `403` versus a transient failure.
+
+## Development
+
+Run checks for this package:
+
+```sh
+turbo check --filter=@shipfox/api-integration-sentry
+turbo type --filter=@shipfox/api-integration-sentry
+turbo test --filter=@shipfox/api-integration-sentry
+```
+
+Tests use Vitest and a real PostgreSQL database. Start local services before
+running the test suite:
+
+```sh
+docker compose up -d
+```
+
+The test environment uses the `api_test` database, set in `test/env.ts`.
+
+## License
+
+MIT

package/dist/api/client.d.ts

@@ -0,0 +1,24 @@
+export interface SentryAuthorization {
+    token: string;
+    refreshToken: string;
+    expiresAt: string;
+}
+export interface SentryInstallationDetails {
+    orgSlug: string;
+}
+export interface SentryApiClient {
+    exchangeAuthorizationCode(input: {
+        installationUuid: string;
+        code: string;
+    }): Promise<SentryAuthorization>;
+    getInstallation(input: {
+        installationUuid: string;
+        token: string;
+    }): Promise<SentryInstallationDetails>;
+    verifyInstallation(input: {
+        installationUuid: string;
+        token: string;
+    }): Promise<void>;
+}
+export declare function createSentryApiClient(): SentryApiClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,yBAAyB,CAAC,KAAK,EAAE;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEjC,eAAe,CAAC,KAAK,EAAE;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,kBAAkB,CAAC,KAAK,EAAE;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,wBAAgB,qBAAqB,IAAI,eAAe,CAuEvD"}

package/dist/api/client.js

@@ -0,0 +1,101 @@
+import { logger } from '@shipfox/node-opentelemetry';
+import ky, { HTTPError, TimeoutError } from 'ky';
+import { config } from '#config.js';
+import { SentryIntegrationProviderError } from '#core/errors.js';
+const SENTRY_API_BASE = 'https://sentry.io/api/0';
+export function createSentryApiClient() {
+    return {
+        async exchangeAuthorizationCode (input) {
+            // Encode the uuid: it originates from the request body / webhook payload, so
+            // a path separator in it must not be able to alter the request path (the host
+            // is already pinned to SENTRY_API_BASE).
+            const body = await mapSentryError('exchange-authorization-code', ()=>ky.post(`${SENTRY_API_BASE}/sentry-app-installations/${encodeURIComponent(input.installationUuid)}/authorizations/`, {
+                    json: {
+                        grant_type: 'authorization_code',
+                        client_id: config.SENTRY_APP_CLIENT_ID,
+                        client_secret: config.SENTRY_APP_CLIENT_SECRET,
+                        code: input.code
+                    }
+                }).json());
+            if (typeof body.token !== 'string' || typeof body.refreshToken !== 'string' || typeof body.expiresAt !== 'string') {
+                throw new SentryIntegrationProviderError('malformed-provider-response', 'Sentry authorization response did not include a token');
+            }
+            return {
+                token: body.token,
+                refreshToken: body.refreshToken,
+                expiresAt: body.expiresAt
+            };
+        },
+        async getInstallation (input) {
+            const body = await mapSentryError('get-installation', ()=>ky.get(`${SENTRY_API_BASE}/sentry-app-installations/${encodeURIComponent(input.installationUuid)}/`, {
+                    headers: {
+                        authorization: `Bearer ${input.token}`
+                    }
+                }).json());
+            const slug = body.organization?.slug;
+            if (typeof slug !== 'string' || slug.length === 0) {
+                throw new SentryIntegrationProviderError('malformed-provider-response', 'Sentry installation response did not include an organization slug');
+            }
+            return {
+                orgSlug: slug
+            };
+        },
+        async verifyInstallation (input) {
+            await mapSentryError('verify-installation', ()=>ky.put(`${SENTRY_API_BASE}/sentry-app-installations/${encodeURIComponent(input.installationUuid)}/`, {
+                    headers: {
+                        authorization: `Bearer ${input.token}`
+                    },
+                    json: {
+                        status: 'installed'
+                    }
+                }).json());
+        }
+    };
+}
+// The typed error deliberately drops Sentry's status and body so no token, code,
+// or client secret can leak to the client or the logged error chain. That also
+// strips the one detail a self-hoster needs to fix a misconfigured Sentry app —
+// e.g. a 403 on `get-installation` means the app is missing "Organization: Read"
+// (see README "Required permissions"). So we log the upstream status
+// here, the only place it survives, keyed by the operation that failed.
+async function mapSentryError(operation, request) {
+    try {
+        return await request();
+    } catch (error) {
+        if (error instanceof SentryIntegrationProviderError) throw error;
+        if (error instanceof HTTPError) {
+            const { status, statusText, headers } = error.response;
+            logger().warn({
+                operation,
+                status,
+                statusText
+            }, 'Sentry API request rejected');
+            if (status === 429) {
+                throw new SentryIntegrationProviderError('rate-limited', 'Sentry request was rate limited', retryAfterSeconds(headers));
+            }
+            if (status >= 500) {
+                throw new SentryIntegrationProviderError('provider-unavailable', 'Sentry request failed');
+            }
+            throw new SentryIntegrationProviderError('access-denied', 'Sentry request was rejected');
+        }
+        if (error instanceof TimeoutError) {
+            logger().warn({
+                operation
+            }, 'Sentry API request timed out');
+            throw new SentryIntegrationProviderError('timeout', 'Sentry request timed out');
+        }
+        logger().warn({
+            operation,
+            errName: error instanceof Error ? error.name : typeof error
+        }, 'Sentry API request failed');
+        throw new SentryIntegrationProviderError('provider-unavailable', 'Sentry request failed');
+    }
+}
+function retryAfterSeconds(headers) {
+    const retryAfter = headers.get('retry-after');
+    if (!retryAfter) return undefined;
+    const parsed = Number.parseInt(retryAfter, 10);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
+
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/client.ts"],"sourcesContent":["import {logger} from '@shipfox/node-opentelemetry';\nimport ky, {HTTPError, TimeoutError} from 'ky';\nimport {config} from '#config.js';\nimport {SentryIntegrationProviderError} from '#core/errors.js';\n\nconst SENTRY_API_BASE = 'https://sentry.io/api/0';\n\nexport interface SentryAuthorization {\n  token: string;\n  refreshToken: string;\n  expiresAt: string;\n}\n\nexport interface SentryInstallationDetails {\n  orgSlug: string;\n}\n\nexport interface SentryApiClient {\n  exchangeAuthorizationCode(input: {\n    installationUuid: string;\n    code: string;\n  }): Promise<SentryAuthorization>;\n  // Derived from Sentry so the org slug is never trusted from the client body.\n  getInstallation(input: {\n    installationUuid: string;\n    token: string;\n  }): Promise<SentryInstallationDetails>;\n  verifyInstallation(input: {installationUuid: string; token: string}): Promise<void>;\n}\n\nexport function createSentryApiClient(): SentryApiClient {\n  return {\n    async exchangeAuthorizationCode(input) {\n      // Encode the uuid: it originates from the request body / webhook payload, so\n      // a path separator in it must not be able to alter the request path (the host\n      // is already pinned to SENTRY_API_BASE).\n      const body = await mapSentryError('exchange-authorization-code', () =>\n        ky\n          .post(\n            `${SENTRY_API_BASE}/sentry-app-installations/${encodeURIComponent(input.installationUuid)}/authorizations/`,\n            {\n              json: {\n                grant_type: 'authorization_code',\n                client_id: config.SENTRY_APP_CLIENT_ID,\n                client_secret: config.SENTRY_APP_CLIENT_SECRET,\n                code: input.code,\n              },\n            },\n          )\n          .json<{token?: unknown; refreshToken?: unknown; expiresAt?: unknown}>(),\n      );\n\n      if (\n        typeof body.token !== 'string' ||\n        typeof body.refreshToken !== 'string' ||\n        typeof body.expiresAt !== 'string'\n      ) {\n        throw new SentryIntegrationProviderError(\n          'malformed-provider-response',\n          'Sentry authorization response did not include a token',\n        );\n      }\n      return {token: body.token, refreshToken: body.refreshToken, expiresAt: body.expiresAt};\n    },\n\n    async getInstallation(input) {\n      const body = await mapSentryError('get-installation', () =>\n        ky\n          .get(\n            `${SENTRY_API_BASE}/sentry-app-installations/${encodeURIComponent(input.installationUuid)}/`,\n            {\n              headers: {authorization: `Bearer ${input.token}`},\n            },\n          )\n          .json<{organization?: {slug?: unknown}}>(),\n      );\n\n      const slug = body.organization?.slug;\n      if (typeof slug !== 'string' || slug.length === 0) {\n        throw new SentryIntegrationProviderError(\n          'malformed-provider-response',\n          'Sentry installation response did not include an organization slug',\n        );\n      }\n      return {orgSlug: slug};\n    },\n\n    async verifyInstallation(input) {\n      await mapSentryError('verify-installation', () =>\n        ky\n          .put(\n            `${SENTRY_API_BASE}/sentry-app-installations/${encodeURIComponent(input.installationUuid)}/`,\n            {\n              headers: {authorization: `Bearer ${input.token}`},\n              json: {status: 'installed'},\n            },\n          )\n          .json<unknown>(),\n      );\n    },\n  };\n}\n\n// The typed error deliberately drops Sentry's status and body so no token, code,\n// or client secret can leak to the client or the logged error chain. That also\n// strips the one detail a self-hoster needs to fix a misconfigured Sentry app —\n// e.g. a 403 on `get-installation` means the app is missing \"Organization: Read\"\n// (see README \"Required permissions\"). So we log the upstream status\n// here, the only place it survives, keyed by the operation that failed.\nasync function mapSentryError<T>(operation: string, request: () => Promise<T>): Promise<T> {\n  try {\n    return await request();\n  } catch (error) {\n    if (error instanceof SentryIntegrationProviderError) throw error;\n    if (error instanceof HTTPError) {\n      const {status, statusText, headers} = error.response;\n      logger().warn({operation, status, statusText}, 'Sentry API request rejected');\n      if (status === 429) {\n        throw new SentryIntegrationProviderError(\n          'rate-limited',\n          'Sentry request was rate limited',\n          retryAfterSeconds(headers),\n        );\n      }\n      if (status >= 500) {\n        throw new SentryIntegrationProviderError('provider-unavailable', 'Sentry request failed');\n      }\n      throw new SentryIntegrationProviderError('access-denied', 'Sentry request was rejected');\n    }\n    if (error instanceof TimeoutError) {\n      logger().warn({operation}, 'Sentry API request timed out');\n      throw new SentryIntegrationProviderError('timeout', 'Sentry request timed out');\n    }\n    logger().warn(\n      {operation, errName: error instanceof Error ? error.name : typeof error},\n      'Sentry API request failed',\n    );\n    throw new SentryIntegrationProviderError('provider-unavailable', 'Sentry request failed');\n  }\n}\n\nfunction retryAfterSeconds(headers: Headers): number | undefined {\n  const retryAfter = headers.get('retry-after');\n  if (!retryAfter) return undefined;\n  const parsed = Number.parseInt(retryAfter, 10);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n"],"names":["logger","ky","HTTPError","TimeoutError","config","SentryIntegrationProviderError","SENTRY_API_BASE","createSentryApiClient","exchangeAuthorizationCode","input","body","mapSentryError","post","encodeURIComponent","installationUuid","json","grant_type","client_id","SENTRY_APP_CLIENT_ID","client_secret","SENTRY_APP_CLIENT_SECRET","code","token","refreshToken","expiresAt","getInstallation","get","headers","authorization","slug","organization","length","orgSlug","verifyInstallation","put","status","operation","request","error","statusText","response","warn","retryAfterSeconds","errName","Error","name","retryAfter","undefined","parsed","Number","parseInt","isNaN"],"mappings":"AAAA,SAAQA,MAAM,QAAO,8BAA8B;AACnD,OAAOC,MAAKC,SAAS,EAAEC,YAAY,QAAO,KAAK;AAC/C,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,8BAA8B,QAAO,kBAAkB;AAE/D,MAAMC,kBAAkB;AAyBxB,OAAO,SAASC;IACd,OAAO;QACL,MAAMC,2BAA0BC,KAAK;YACnC,6EAA6E;YAC7E,8EAA8E;YAC9E,yCAAyC;YACzC,MAAMC,OAAO,MAAMC,eAAe,+BAA+B,IAC/DV,GACGW,IAAI,CACH,GAAGN,gBAAgB,0BAA0B,EAAEO,mBAAmBJ,MAAMK,gBAAgB,EAAE,gBAAgB,CAAC,EAC3G;oBACEC,MAAM;wBACJC,YAAY;wBACZC,WAAWb,OAAOc,oBAAoB;wBACtCC,eAAef,OAAOgB,wBAAwB;wBAC9CC,MAAMZ,MAAMY,IAAI;oBAClB;gBACF,GAEDN,IAAI;YAGT,IACE,OAAOL,KAAKY,KAAK,KAAK,YACtB,OAAOZ,KAAKa,YAAY,KAAK,YAC7B,OAAOb,KAAKc,SAAS,KAAK,UAC1B;gBACA,MAAM,IAAInB,+BACR,+BACA;YAEJ;YACA,OAAO;gBAACiB,OAAOZ,KAAKY,KAAK;gBAAEC,cAAcb,KAAKa,YAAY;gBAAEC,WAAWd,KAAKc,SAAS;YAAA;QACvF;QAEA,MAAMC,iBAAgBhB,KAAK;YACzB,MAAMC,OAAO,MAAMC,eAAe,oBAAoB,IACpDV,GACGyB,GAAG,CACF,GAAGpB,gBAAgB,0BAA0B,EAAEO,mBAAmBJ,MAAMK,gBAAgB,EAAE,CAAC,CAAC,EAC5F;oBACEa,SAAS;wBAACC,eAAe,CAAC,OAAO,EAAEnB,MAAMa,KAAK,EAAE;oBAAA;gBAClD,GAEDP,IAAI;YAGT,MAAMc,OAAOnB,KAAKoB,YAAY,EAAED;YAChC,IAAI,OAAOA,SAAS,YAAYA,KAAKE,MAAM,KAAK,GAAG;gBACjD,MAAM,IAAI1B,+BACR,+BACA;YAEJ;YACA,OAAO;gBAAC2B,SAASH;YAAI;QACvB;QAEA,MAAMI,oBAAmBxB,KAAK;YAC5B,MAAME,eAAe,uBAAuB,IAC1CV,GACGiC,GAAG,CACF,GAAG5B,gBAAgB,0BAA0B,EAAEO,mBAAmBJ,MAAMK,gBAAgB,EAAE,CAAC,CAAC,EAC5F;oBACEa,SAAS;wBAACC,eAAe,CAAC,OAAO,EAAEnB,MAAMa,KAAK,EAAE;oBAAA;oBAChDP,MAAM;wBAACoB,QAAQ;oBAAW;gBAC5B,GAEDpB,IAAI;QAEX;IACF;AACF;AAEA,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,qEAAqE;AACrE,wEAAwE;AACxE,eAAeJ,eAAkByB,SAAiB,EAAEC,OAAyB;IAC3E,IAAI;QACF,OAAO,MAAMA;IACf,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBjC,gCAAgC,MAAMiC;QAC3D,IAAIA,iBAAiBpC,WAAW;YAC9B,MAAM,EAACiC,MAAM,EAAEI,UAAU,EAAEZ,OAAO,EAAC,GAAGW,MAAME,QAAQ;YACpDxC,SAASyC,IAAI,CAAC;gBAACL;gBAAWD;gBAAQI;YAAU,GAAG;YAC/C,IAAIJ,WAAW,KAAK;gBAClB,MAAM,IAAI9B,+BACR,gBACA,mCACAqC,kBAAkBf;YAEtB;YACA,IAAIQ,UAAU,KAAK;gBACjB,MAAM,IAAI9B,+BAA+B,wBAAwB;YACnE;YACA,MAAM,IAAIA,+BAA+B,iBAAiB;QAC5D;QACA,IAAIiC,iBAAiBnC,cAAc;YACjCH,SAASyC,IAAI,CAAC;gBAACL;YAAS,GAAG;YAC3B,MAAM,IAAI/B,+BAA+B,WAAW;QACtD;QACAL,SAASyC,IAAI,CACX;YAACL;YAAWO,SAASL,iBAAiBM,QAAQN,MAAMO,IAAI,GAAG,OAAOP;QAAK,GACvE;QAEF,MAAM,IAAIjC,+BAA+B,wBAAwB;IACnE;AACF;AAEA,SAASqC,kBAAkBf,OAAgB;IACzC,MAAMmB,aAAanB,QAAQD,GAAG,CAAC;IAC/B,IAAI,CAACoB,YAAY,OAAOC;IACxB,MAAMC,SAASC,OAAOC,QAAQ,CAACJ,YAAY;IAC3C,OAAOG,OAAOE,KAAK,CAACH,UAAUD,YAAYC;AAC5C"}

package/dist/config.d.ts

@@ -0,0 +1,9 @@
+export declare const config: Readonly<{
+    SENTRY_APP_CLIENT_ID: string;
+    SENTRY_APP_CLIENT_SECRET: string;
+    SENTRY_APP_SLUG: string;
+    SENTRY_APP_VERIFY_INSTALL: boolean;
+    SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS: number;
+} & import("@shipfox/config").CleanedEnvAccessors>;
+export declare function assertRetentionDaysWithinBounds(days: number): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM;;;;;;kDAkBjB,CAAC;AAMH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMlE"}

package/dist/config.js

@@ -0,0 +1,32 @@
+import { bool, createConfig, num, str } from '@shipfox/config';
+export const config = createConfig({
+    SENTRY_APP_CLIENT_ID: str({
+        desc: 'OAuth client ID of the Sentry app. Reserved for the install and app-token-exchange flow; the webhook receiver does not read it yet. Required.'
+    }),
+    SENTRY_APP_CLIENT_SECRET: str({
+        desc: 'Shared secret used to verify the HMAC-SHA256 signature on inbound Sentry webhooks. Must match the value set on the Sentry app. Required.'
+    }),
+    SENTRY_APP_SLUG: str({
+        desc: 'URL slug of the Sentry app, used to build install and callback links. Required.'
+    }),
+    SENTRY_APP_VERIFY_INSTALL: bool({
+        desc: 'Verifies the signature on Sentry app installation requests. Keep it true; turn it off only for local testing.',
+        default: true
+    }),
+    SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS: num({
+        desc: 'How many days a verified-but-unclaimed Sentry installation may sit before the daily cleanup cron tombstones it. Must be at least 1; a smaller value moves the cutoff to now or the future and would tombstone freshly created, still-unclaimed installs. A reinstall always mints a fresh uuid, so a tombstone is never revived. Defaults to 7.',
+        default: 7
+    })
+});
+// The daily cleanup cron tombstones every unclaimed install older than
+// `now - SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS`. A value below 1 moves that
+// cutoff to now or the future, which would wipe freshly created installs nobody has
+// claimed yet. Reject it at startup rather than let the 04:00 cron fail silently.
+export function assertRetentionDaysWithinBounds(days) {
+    if (!Number.isFinite(days) || days < 1) {
+        throw new Error(`SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS must be a finite number of at least 1, received ${days}.`);
+    }
+}
+assertRetentionDaysWithinBounds(config.SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS);
+
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {bool, createConfig, num, str} from '@shipfox/config';\n\nexport const config = createConfig({\n  SENTRY_APP_CLIENT_ID: str({\n    desc: 'OAuth client ID of the Sentry app. Reserved for the install and app-token-exchange flow; the webhook receiver does not read it yet. Required.',\n  }),\n  SENTRY_APP_CLIENT_SECRET: str({\n    desc: 'Shared secret used to verify the HMAC-SHA256 signature on inbound Sentry webhooks. Must match the value set on the Sentry app. Required.',\n  }),\n  SENTRY_APP_SLUG: str({\n    desc: 'URL slug of the Sentry app, used to build install and callback links. Required.',\n  }),\n  SENTRY_APP_VERIFY_INSTALL: bool({\n    desc: 'Verifies the signature on Sentry app installation requests. Keep it true; turn it off only for local testing.',\n    default: true,\n  }),\n  SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS: num({\n    desc: 'How many days a verified-but-unclaimed Sentry installation may sit before the daily cleanup cron tombstones it. Must be at least 1; a smaller value moves the cutoff to now or the future and would tombstone freshly created, still-unclaimed installs. A reinstall always mints a fresh uuid, so a tombstone is never revived. Defaults to 7.',\n    default: 7,\n  }),\n});\n\n// The daily cleanup cron tombstones every unclaimed install older than\n// `now - SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS`. A value below 1 moves that\n// cutoff to now or the future, which would wipe freshly created installs nobody has\n// claimed yet. Reject it at startup rather than let the 04:00 cron fail silently.\nexport function assertRetentionDaysWithinBounds(days: number): void {\n  if (!Number.isFinite(days) || days < 1) {\n    throw new Error(\n      `SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS must be a finite number of at least 1, received ${days}.`,\n    );\n  }\n}\n\nassertRetentionDaysWithinBounds(config.SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS);\n"],"names":["bool","createConfig","num","str","config","SENTRY_APP_CLIENT_ID","desc","SENTRY_APP_CLIENT_SECRET","SENTRY_APP_SLUG","SENTRY_APP_VERIFY_INSTALL","default","SENTRY_UNCLAIMED_INSTALLATION_RETENTION_DAYS","assertRetentionDaysWithinBounds","days","Number","isFinite","Error"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAE7D,OAAO,MAAMC,SAASH,aAAa;IACjCI,sBAAsBF,IAAI;QACxBG,MAAM;IACR;IACAC,0BAA0BJ,IAAI;QAC5BG,MAAM;IACR;IACAE,iBAAiBL,IAAI;QACnBG,MAAM;IACR;IACAG,2BAA2BT,KAAK;QAC9BM,MAAM;QACNI,SAAS;IACX;IACAC,8CAA8CT,IAAI;QAChDI,MAAM;QACNI,SAAS;IACX;AACF,GAAG;AAEH,uEAAuE;AACvE,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,OAAO,SAASE,gCAAgCC,IAAY;IAC1D,IAAI,CAACC,OAAOC,QAAQ,CAACF,SAASA,OAAO,GAAG;QACtC,MAAM,IAAIG,MACR,CAAC,6FAA6F,EAAEH,KAAK,CAAC,CAAC;IAE3G;AACF;AAEAD,gCAAgCR,OAAOO,4CAA4C"}

package/dist/core/errors.d.ts

@@ -0,0 +1,57 @@
+import { IntegrationProviderError } from '@shipfox/api-integration-core-dto';
+export declare class SentryIntegrationProviderError extends IntegrationProviderError {
+}
+export declare class SentryInstallationAlreadyLinkedError extends Error {
+    readonly installationUuid: string;
+    constructor(installationUuid: string);
+}
+/**
+ * The claim could not prove control of the named install: the presented code
+ * neither exchanged successfully nor matched the stored `code_hash`. Surfaced as
+ * a 403 so a forged or leaked bare uuid cannot bind someone else's install.
+ */
+export declare class SentryClaimProofMismatchError extends Error {
+    readonly installationUuid: string;
+    constructor(installationUuid: string);
+}
+/**
+ * A concurrent path (the signed webhook) is mid-exchange for this install, so the
+ * verified row is not visible to the claim yet. Retryable: the existing client
+ * backoff re-calls and finds the now-persisted row.
+ */
+export declare class SentryVerificationInProgressError extends Error {
+    readonly installationUuid: string;
+    readonly retryAfterSeconds: number;
+    constructor(installationUuid: string, retryAfterSeconds?: number);
+}
+/**
+ * Base for issue deliveries we received and authenticated but deliberately do
+ * not publish. The webhook layer records them for dedup and acknowledges with a
+ * 204 rather than treating them as failures — a sustained non-2xx can make Sentry
+ * disable the webhook. Carries no HTTP concerns so workers/jobs can reuse it.
+ */
+export declare class SentryIssueDroppedError extends Error {
+}
+export declare class SentryInstallationNotFoundError extends SentryIssueDroppedError {
+    readonly installationUuid: string;
+    constructor(installationUuid: string);
+}
+export declare class SentryInstallationDeletedError extends SentryIssueDroppedError {
+    readonly installationUuid: string;
+    constructor(installationUuid: string);
+}
+export declare class SentryConnectionNotFoundError extends SentryIssueDroppedError {
+    readonly connectionId: string;
+    constructor(connectionId: string);
+}
+/**
+ * A verified install that no workspace has claimed yet (`connection_id IS NULL`),
+ * so an issue delivery has no workspace to publish against. Dropped (204) like the
+ * other pre-publish cases; kept distinct from SentryConnectionNotFoundError so the
+ * carried identifier is unambiguously an installation uuid, not a connection id.
+ */
+export declare class SentryInstallationUnclaimedError extends SentryIssueDroppedError {
+    readonly installationUuid: string;
+    constructor(installationUuid: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,wBAAwB,EAAC,MAAM,mCAAmC,CAAC;AAE3E,qBAAa,8BAA+B,SAAQ,wBAAwB;CAAG;AAE/E,qBAAa,oCAAqC,SAAQ,KAAK;aACjC,gBAAgB,EAAE,MAAM;gBAAxB,gBAAgB,EAAE,MAAM;CAMrD;AAED;;;;GAIG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;aAC1B,gBAAgB,EAAE,MAAM;gBAAxB,gBAAgB,EAAE,MAAM;CAIrD;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAExC,gBAAgB,EAAE,MAAM;aACxB,iBAAiB;gBADjB,gBAAgB,EAAE,MAAM,EACxB,iBAAiB,SAAI;CAKxC;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AAErD,qBAAa,+BAAgC,SAAQ,uBAAuB;aAC9C,gBAAgB,EAAE,MAAM;gBAAxB,gBAAgB,EAAE,MAAM;CAIrD;AAED,qBAAa,8BAA+B,SAAQ,uBAAuB;aAC7C,gBAAgB,EAAE,MAAM;gBAAxB,gBAAgB,EAAE,MAAM;CAIrD;AAED,qBAAa,6BAA8B,SAAQ,uBAAuB;aAC5C,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAIjD;AAED;;;;;GAKG;AACH,qBAAa,gCAAiC,SAAQ,uBAAuB;aAC/C,gBAAgB,EAAE,MAAM;gBAAxB,gBAAgB,EAAE,MAAM;CAIrD"}