@shipfox/api-integration-sentry 2.0.0

package/dist/core/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import type {\n  GetIntegrationConnectionByIdFn,\n  IntegrationTx,\n  PublishIntegrationEventReceivedFn,\n  RecordDeliveryOnlyFn,\n  SentryIssuePayload,\n  UpdateIntegrationConnectionLifecycleStatusFn,\n} from '@shipfox/api-integration-core-dto';\nimport type {SentryIssueWebhookDto} from '@shipfox/api-integration-sentry-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {SentryApiClient} from '#api/client.js';\nimport {\n  SentryConnectionNotFoundError,\n  SentryInstallationDeletedError,\n  SentryInstallationNotFoundError,\n  SentryInstallationUnclaimedError,\n  SentryIntegrationProviderError,\n} from '#core/errors.js';\nimport {verifyAndPersistUnclaimedInstallation} from '#core/install.js';\nimport {\n  getSentryInstallationByInstallationUuid,\n  markSentryInstallationDeleted,\n  type SentryInstallation,\n} from '#db/installations.js';\n\nconst SENTRY_SOURCE = 'sentry';\nconst DEFAULT_ISSUE_TITLE = 'Sentry issue';\nconst DELETED_STATUS = 'deleted';\n\nexport interface HandleSentryIssueEventParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: SentryIssueWebhookDto;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\n// Publishes the mapped event for a verified issue delivery. Throws a typed\n// SentryIssueDroppedError subclass when the delivery references state we cannot\n// publish against (unknown/deleted installation, or an install not yet claimed\n// into a workspace); the webhook layer records-and-drops those. Dedup of an\n// already-seen delivery is handled inside publishIntegrationEventReceived.\nexport async function handleSentryIssueEvent(params: HandleSentryIssueEventParams): Promise<void> {\n  const installationUuid = params.payload.installation.uuid;\n\n  const installation = await getSentryInstallationByInstallationUuid(installationUuid, {\n    tx: params.tx,\n  });\n  if (!installation) {\n    throw new SentryInstallationNotFoundError(installationUuid);\n  }\n  if (installation.status === DELETED_STATUS) {\n    throw new SentryInstallationDeletedError(installationUuid);\n  }\n  // A verified-but-unclaimed install has no workspace yet, so there is nothing to\n  // publish an event against. This is the pre-claim drop window (counted/logged).\n  if (!installation.connectionId) {\n    throw new SentryInstallationUnclaimedError(installationUuid);\n  }\n\n  const connection = await params.getIntegrationConnectionById(installation.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    throw new SentryConnectionNotFoundError(installation.connectionId);\n  }\n\n  await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: SENTRY_SOURCE,\n      source: connection.slug,\n      event: `issue.${params.payload.action}`,\n      workspaceId: connection.workspaceId,\n      connectionId: connection.id,\n      connectionName: connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: new Date().toISOString(),\n      payload: normalizeIssuePayload(params.payload),\n    },\n  });\n}\n\nexport interface HandleSentryInstallationCreatedParams {\n  deliveryId: string;\n  installationUuid: string;\n  // From the signed payload; the webhook is authoritative so the slug is trusted\n  // without a getInstallation round-trip. The code is the single-use grant.\n  orgSlug: string | undefined;\n  code: string | undefined;\n  sentry: SentryApiClient;\n  verifyInstall: boolean;\n  getSentryInstallation: (input: {\n    installationUuid: string;\n  }) => Promise<SentryInstallation | undefined>;\n  // Persists the verified-unclaimed row and records the delivery in one short\n  // transaction, returning the persisted row.\n  persistUnclaimedAndRecordDelivery: (input: {\n    installationUuid: string;\n    orgSlug: string;\n    codeHash: string;\n    deliveryId: string;\n  }) => Promise<SentryInstallation>;\n  // Records the delivery for dedup without persisting an install (reconcile/no-op,\n  // missing code, or exchange failure → record-and-drop).\n  recordDelivery: (deliveryId: string) => Promise<void>;\n}\n\n/**\n * The authoritative `installation.created` path. Whichever of webhook or browser\n * arrives first exchanges the single-use code and persists a verified-unclaimed\n * row; the other reconciles. Idempotent on the installation uuid. The exchange\n * runs outside any DB transaction; a short transaction wraps only persist +\n * delivery record. On an exchange failure the delivery is record-and-dropped\n * (204) — the browser may still win, or the code expired. Never logs the raw code.\n */\nexport async function handleSentryInstallationCreated(\n  params: HandleSentryInstallationCreatedParams,\n): Promise<void> {\n  const existing = await params.getSentryInstallation({installationUuid: params.installationUuid});\n  if (existing) {\n    logger().debug(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created for an existing row, reconciling',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  if (!params.code) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created without an authorization code, dropping',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  try {\n    await verifyAndPersistUnclaimedInstallation({\n      sentry: params.sentry,\n      installationUuid: params.installationUuid,\n      code: params.code,\n      orgSlug: params.orgSlug,\n      verifyInstall: params.verifyInstall,\n      persistVerifiedUnclaimedInstallation: ({installationUuid, orgSlug, codeHash}) =>\n        params.persistUnclaimedAndRecordDelivery({\n          installationUuid,\n          orgSlug,\n          codeHash,\n          deliveryId: params.deliveryId,\n        }),\n    });\n  } catch (error) {\n    if (error instanceof SentryIntegrationProviderError) {\n      // The Sentry exchange (or org-slug lookup) failed, so we never durably\n      // spent the code on a row we own. `reason` distinguishes a transient/expected\n      // drop (access-denied: the code was already spent, e.g. the browser won) from\n      // a likely misconfiguration (a bad client id/secret/slug fails every install)\n      // so log-based alerting can fire on the sustained case. Never logs the raw code.\n      logger().warn(\n        {\n          deliveryId: params.deliveryId,\n          installationUuid: params.installationUuid,\n          reason: error.reason,\n          err: error,\n        },\n        'sentry webhook: installation.created exchange failed, dropping',\n      );\n    } else {\n      // The exchange succeeded (the single-use code is now spent) but the persist\n      // transaction failed, so no row exists and Sentry will not usefully\n      // re-deliver — the install is stranded until a reinstall mints a fresh uuid.\n      // Log at error so alerting catches it; still record-and-drop because retrying\n      // a spent code cannot recover the row. Never logs the raw code.\n      logger().error(\n        {deliveryId: params.deliveryId, installationUuid: params.installationUuid, err: error},\n        'sentry webhook: installation.created persisted nothing after a successful exchange, install stranded until reinstall',\n      );\n    }\n    await params.recordDelivery(params.deliveryId);\n  }\n}\n\nexport interface HandleSentryInstallationDeletedParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  installationUuid: string;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  updateConnectionLifecycleStatus: UpdateIntegrationConnectionLifecycleStatusFn;\n}\n\n// Tombstones the install and disables its connection if one exists. An unknown\n// uuid (never installed, or reinstall mints a fresh uuid) only records the\n// delivery: there is no tombstone row to write. Runs entirely in the caller's\n// transaction — no exchange is needed.\nexport async function handleSentryInstallationDeleted(\n  params: HandleSentryInstallationDeletedParams,\n): Promise<void> {\n  const installation = await markSentryInstallationDeleted(\n    {installationUuid: params.installationUuid},\n    {tx: params.tx},\n  );\n  if (installation?.connectionId) {\n    await params.updateConnectionLifecycleStatus(\n      {id: installation.connectionId, lifecycleStatus: 'disabled'},\n      {tx: params.tx},\n    );\n  }\n\n  await params.recordDeliveryOnly({\n    tx: params.tx,\n    provider: SENTRY_SOURCE,\n    deliveryId: params.deliveryId,\n  });\n}\n\n// A raw Sentry `ignored` action is normalized to `archived` before validation,\n// so legacy ignore events still fire `issue.archived` workflows.\nexport function normalizeSentryIssueAction(parsedJson: unknown): unknown {\n  if (typeof parsedJson !== 'object' || parsedJson === null) return parsedJson;\n  const obj = parsedJson as {action?: unknown};\n  if (obj.action === 'ignored') {\n    return {...obj, action: 'archived'};\n  }\n  return parsedJson;\n}\n\nfunction normalizeIssuePayload(payload: SentryIssueWebhookDto): SentryIssuePayload {\n  const issue = payload.data.issue;\n  return {\n    action: payload.action,\n    issueId: issue.id,\n    shortId: issue.shortId ?? null,\n    title: issue.title ?? DEFAULT_ISSUE_TITLE,\n    culprit: issue.culprit ?? null,\n    level: issue.level ?? null,\n    status: issue.status ?? null,\n    platform: issue.platform ?? null,\n    webUrl: issue.web_url ?? null,\n    issueUrl: issue.url ?? null,\n    projectUrl: issue.project_url ?? null,\n    firstSeenAt: issue.firstSeen ?? null,\n    lastSeenAt: issue.lastSeen ?? null,\n  };\n}\n"],"names":["logger","SentryConnectionNotFoundError","SentryInstallationDeletedError","SentryInstallationNotFoundError","SentryInstallationUnclaimedError","SentryIntegrationProviderError","verifyAndPersistUnclaimedInstallation","getSentryInstallationByInstallationUuid","markSentryInstallationDeleted","SENTRY_SOURCE","DEFAULT_ISSUE_TITLE","DELETED_STATUS","handleSentryIssueEvent","params","installationUuid","payload","installation","uuid","tx","status","connectionId","connection","getIntegrationConnectionById","publishIntegrationEventReceived","event","provider","source","slug","action","workspaceId","id","connectionName","displayName","deliveryId","receivedAt","Date","toISOString","normalizeIssuePayload","handleSentryInstallationCreated","existing","getSentryInstallation","debug","recordDelivery","code","warn","sentry","orgSlug","verifyInstall","persistVerifiedUnclaimedInstallation","codeHash","persistUnclaimedAndRecordDelivery","error","reason","err","handleSentryInstallationDeleted","updateConnectionLifecycleStatus","lifecycleStatus","recordDeliveryOnly","normalizeSentryIssueAction","parsedJson","obj","issue","data","issueId","shortId","title","culprit","level","platform","webUrl","web_url","issueUrl","url","projectUrl","project_url","firstSeenAt","firstSeen","lastSeenAt","lastSeen"],"mappings":"AASA,SAAQA,MAAM,QAAO,8BAA8B;AAEnD,SACEC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,+BAA+B,EAC/BC,gCAAgC,EAChCC,8BAA8B,QACzB,kBAAkB;AACzB,SAAQC,qCAAqC,QAAO,mBAAmB;AACvE,SACEC,uCAAuC,EACvCC,6BAA6B,QAExB,uBAAuB;AAE9B,MAAMC,gBAAgB;AACtB,MAAMC,sBAAsB;AAC5B,MAAMC,iBAAiB;AAUvB,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,OAAO,eAAeC,uBAAuBC,MAAoC;IAC/E,MAAMC,mBAAmBD,OAAOE,OAAO,CAACC,YAAY,CAACC,IAAI;IAEzD,MAAMD,eAAe,MAAMT,wCAAwCO,kBAAkB;QACnFI,IAAIL,OAAOK,EAAE;IACf;IACA,IAAI,CAACF,cAAc;QACjB,MAAM,IAAIb,gCAAgCW;IAC5C;IACA,IAAIE,aAAaG,MAAM,KAAKR,gBAAgB;QAC1C,MAAM,IAAIT,+BAA+BY;IAC3C;IACA,gFAAgF;IAChF,gFAAgF;IAChF,IAAI,CAACE,aAAaI,YAAY,EAAE;QAC9B,MAAM,IAAIhB,iCAAiCU;IAC7C;IAEA,MAAMO,aAAa,MAAMR,OAAOS,4BAA4B,CAACN,aAAaI,YAAY,EAAE;QACtFF,IAAIL,OAAOK,EAAE;IACf;IACA,IAAI,CAACG,YAAY;QACf,MAAM,IAAIpB,8BAA8Be,aAAaI,YAAY;IACnE;IAEA,MAAMP,OAAOU,+BAA+B,CAAC;QAC3CL,IAAIL,OAAOK,EAAE;QACbM,OAAO;YACLC,UAAUhB;YACViB,QAAQL,WAAWM,IAAI;YACvBH,OAAO,CAAC,MAAM,EAAEX,OAAOE,OAAO,CAACa,MAAM,EAAE;YACvCC,aAAaR,WAAWQ,WAAW;YACnCT,cAAcC,WAAWS,EAAE;YAC3BC,gBAAgBV,WAAWW,WAAW;YACtCC,YAAYpB,OAAOoB,UAAU;YAC7BC,YAAY,IAAIC,OAAOC,WAAW;YAClCrB,SAASsB,sBAAsBxB,OAAOE,OAAO;QAC/C;IACF;AACF;AA2BA;;;;;;;CAOC,GACD,OAAO,eAAeuB,gCACpBzB,MAA6C;IAE7C,MAAM0B,WAAW,MAAM1B,OAAO2B,qBAAqB,CAAC;QAAC1B,kBAAkBD,OAAOC,gBAAgB;IAAA;IAC9F,IAAIyB,UAAU;QACZvC,SAASyC,KAAK,CACZ;YAACR,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,IAAI,CAACpB,OAAO8B,IAAI,EAAE;QAChB3C,SAAS4C,IAAI,CACX;YAACX,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,IAAI;QACF,MAAM3B,sCAAsC;YAC1CuC,QAAQhC,OAAOgC,MAAM;YACrB/B,kBAAkBD,OAAOC,gBAAgB;YACzC6B,MAAM9B,OAAO8B,IAAI;YACjBG,SAASjC,OAAOiC,OAAO;YACvBC,eAAelC,OAAOkC,aAAa;YACnCC,sCAAsC,CAAC,EAAClC,gBAAgB,EAAEgC,OAAO,EAAEG,QAAQ,EAAC,GAC1EpC,OAAOqC,iCAAiC,CAAC;oBACvCpC;oBACAgC;oBACAG;oBACAhB,YAAYpB,OAAOoB,UAAU;gBAC/B;QACJ;IACF,EAAE,OAAOkB,OAAO;QACd,IAAIA,iBAAiB9C,gCAAgC;YACnD,uEAAuE;YACvE,8EAA8E;YAC9E,8EAA8E;YAC9E,8EAA8E;YAC9E,iFAAiF;YACjFL,SAAS4C,IAAI,CACX;gBACEX,YAAYpB,OAAOoB,UAAU;gBAC7BnB,kBAAkBD,OAAOC,gBAAgB;gBACzCsC,QAAQD,MAAMC,MAAM;gBACpBC,KAAKF;YACP,GACA;QAEJ,OAAO;YACL,4EAA4E;YAC5E,oEAAoE;YACpE,6EAA6E;YAC7E,8EAA8E;YAC9E,gEAAgE;YAChEnD,SAASmD,KAAK,CACZ;gBAAClB,YAAYpB,OAAOoB,UAAU;gBAAEnB,kBAAkBD,OAAOC,gBAAgB;gBAAEuC,KAAKF;YAAK,GACrF;QAEJ;QACA,MAAMtC,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;IAC/C;AACF;AAUA,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,uCAAuC;AACvC,OAAO,eAAeqB,gCACpBzC,MAA6C;IAE7C,MAAMG,eAAe,MAAMR,8BACzB;QAACM,kBAAkBD,OAAOC,gBAAgB;IAAA,GAC1C;QAACI,IAAIL,OAAOK,EAAE;IAAA;IAEhB,IAAIF,cAAcI,cAAc;QAC9B,MAAMP,OAAO0C,+BAA+B,CAC1C;YAACzB,IAAId,aAAaI,YAAY;YAAEoC,iBAAiB;QAAU,GAC3D;YAACtC,IAAIL,OAAOK,EAAE;QAAA;IAElB;IAEA,MAAML,OAAO4C,kBAAkB,CAAC;QAC9BvC,IAAIL,OAAOK,EAAE;QACbO,UAAUhB;QACVwB,YAAYpB,OAAOoB,UAAU;IAC/B;AACF;AAEA,+EAA+E;AAC/E,iEAAiE;AACjE,OAAO,SAASyB,2BAA2BC,UAAmB;IAC5D,IAAI,OAAOA,eAAe,YAAYA,eAAe,MAAM,OAAOA;IAClE,MAAMC,MAAMD;IACZ,IAAIC,IAAIhC,MAAM,KAAK,WAAW;QAC5B,OAAO;YAAC,GAAGgC,GAAG;YAAEhC,QAAQ;QAAU;IACpC;IACA,OAAO+B;AACT;AAEA,SAAStB,sBAAsBtB,OAA8B;IAC3D,MAAM8C,QAAQ9C,QAAQ+C,IAAI,CAACD,KAAK;IAChC,OAAO;QACLjC,QAAQb,QAAQa,MAAM;QACtBmC,SAASF,MAAM/B,EAAE;QACjBkC,SAASH,MAAMG,OAAO,IAAI;QAC1BC,OAAOJ,MAAMI,KAAK,IAAIvD;QACtBwD,SAASL,MAAMK,OAAO,IAAI;QAC1BC,OAAON,MAAMM,KAAK,IAAI;QACtBhD,QAAQ0C,MAAM1C,MAAM,IAAI;QACxBiD,UAAUP,MAAMO,QAAQ,IAAI;QAC5BC,QAAQR,MAAMS,OAAO,IAAI;QACzBC,UAAUV,MAAMW,GAAG,IAAI;QACvBC,YAAYZ,MAAMa,WAAW,IAAI;QACjCC,aAAad,MAAMe,SAAS,IAAI;QAChCC,YAAYhB,MAAMiB,QAAQ,IAAI;IAChC;AACF"}

package/dist/db/db.d.ts

@@ -0,0 +1,327 @@
+import { type NodePgDatabase } from '@shipfox/node-drizzle';
+export declare const schema: {
+    sentryInstallations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "installations";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            connectionId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "connection_id";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            installationUuid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "installation_uuid";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            orgSlug: import("drizzle-orm/pg-core").PgColumn<{
+                name: "org_slug";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            status: import("drizzle-orm/pg-core").PgColumn<{
+                name: "status";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            codeHash: import("drizzle-orm/pg-core").PgColumn<{
+                name: "code_hash";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            installerUserId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "installer_user_id";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "updated_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
+};
+export declare function db(): NodePgDatabase<{
+    sentryInstallations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "installations";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            connectionId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "connection_id";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            installationUuid: import("drizzle-orm/pg-core").PgColumn<{
+                name: "installation_uuid";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            orgSlug: import("drizzle-orm/pg-core").PgColumn<{
+                name: "org_slug";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            status: import("drizzle-orm/pg-core").PgColumn<{
+                name: "status";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            codeHash: import("drizzle-orm/pg-core").PgColumn<{
+                name: "code_hash";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            installerUserId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "installer_user_id";
+                tableName: "installations";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "updated_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
+}>;
+export declare function closeDb(): void;
+//# sourceMappingURL=db.d.ts.map

package/dist/db/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAInE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAElB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/db.js

@@ -0,0 +1,18 @@
+import { drizzle } from '@shipfox/node-drizzle';
+import { pgClient } from '@shipfox/node-postgres';
+import { sentryInstallations } from './schema/installations.js';
+export const schema = {
+    sentryInstallations
+};
+let _db;
+export function db() {
+    if (!_db) _db = drizzle(pgClient(), {
+        schema
+    });
+    return _db;
+}
+export function closeDb() {
+    _db = undefined;
+}
+
+//# sourceMappingURL=db.js.map

package/dist/db/db.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {sentryInstallations} from './schema/installations.js';\n\nexport const schema = {\n  sentryInstallations,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","sentryInstallations","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,mBAAmB,QAAO,4BAA4B;AAE9D,OAAO,MAAMC,SAAS;IACpBD;AACF,EAAE;AAEF,IAAIE;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMJ,QAAQC,YAAY;QAACE;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/installations.d.ts

@@ -0,0 +1,74 @@
+export type SentryInstallationStatus = 'installed' | 'deleted';
+export interface SentryInstallation {
+    id: string;
+    connectionId: string | null;
+    installationUuid: string;
+    orgSlug: string;
+    status: string;
+    codeHash: string | null;
+    installerUserId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface UpsertSentryInstallationParams {
+    connectionId: string;
+    installationUuid: string;
+    orgSlug: string;
+    status: SentryInstallationStatus;
+    codeHash?: string | null | undefined;
+    installerUserId?: string | null | undefined;
+}
+export interface PersistVerifiedUnclaimedInstallationParams {
+    installationUuid: string;
+    orgSlug: string;
+    codeHash: string;
+}
+export declare function upsertSentryInstallation(params: UpsertSentryInstallationParams, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation>;
+/**
+ * Inserts the verified-but-unclaimed install half (`connection_id = NULL`,
+ * `status = 'installed'`) after a successful code exchange. Idempotent on the
+ * installation uuid: a conflicting row refreshes only `code_hash`/`org_slug`/
+ * `updated_at`, so a webhook that lands after a claim never clobbers the
+ * `connection_id` it set nor downgrades a `deleted` tombstone back to installed.
+ */
+export declare function persistVerifiedUnclaimedInstallation(params: PersistVerifiedUnclaimedInstallationParams, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation>;
+/**
+ * Verified installs no user has claimed yet (`connection_id IS NULL`,
+ * `status='installed'`). Tombstoned rows are excluded so the TTL cron stays
+ * idempotent and the unclaimed metric stays accurate. Pass `olderThan` to scope
+ * to stale rows for the cron.
+ */
+export declare function listUnclaimedSentryInstallations(params?: {
+    olderThan?: Date;
+}, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation[]>;
+export declare function getSentryInstallationByInstallationUuid(installationUuid: string, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation | undefined>;
+export declare function getSentryInstallationByConnectionId(connectionId: string, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation | undefined>;
+/**
+ * Tombstones verified-unclaimed installs older than `olderThan` (the TTL cleanup
+ * cron). Bounds a never-claimed install rather than leaving it pending forever.
+ * Returns how many rows were tombstoned. We hold no Sentry token for these rows
+ * (tokens are never persisted), so the Sentry-side uninstall is out of scope here.
+ */
+export declare function pruneUnclaimedSentryInstallations(params: {
+    olderThan: Date;
+}, options?: {
+    tx?: unknown;
+}): Promise<{
+    tombstoned: number;
+}>;
+export declare function markSentryInstallationDeleted(params: {
+    installationUuid: string;
+}, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation | undefined>;
+//# sourceMappingURL=installations.d.ts.map

package/dist/db/installations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,0CAA0C;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED;;;;;;GAMG;AACH,wBAAsB,oCAAoC,CACxD,MAAM,EAAE,0CAA0C,EAClD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAwB7B;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,MAAM,GAAE;IAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAAM,EAC/B,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAc/B;AAED,wBAAsB,uCAAuC,CAC3D,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAUzC;AAED,wBAAsB,mCAAmC,CACvD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAUzC;AAED;;;;;GAKG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,EACzB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAC,CAa/B;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,EAClC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CASzC"}

package/dist/db/installations.js

@@ -0,0 +1,120 @@
+import { and, eq, isNull, lt, sql } from 'drizzle-orm';
+import { SentryInstallationAlreadyLinkedError } from '#core/errors.js';
+import { db } from './db.js';
+import { sentryInstallations, toSentryInstallation } from './schema/installations.js';
+export async function upsertSentryInstallation(params, options = {}) {
+    const executor = options.tx ?? db();
+    const now = new Date();
+    const [row] = await executor.insert(sentryInstallations).values({
+        connectionId: params.connectionId,
+        installationUuid: params.installationUuid,
+        orgSlug: params.orgSlug,
+        status: params.status,
+        codeHash: params.codeHash ?? null,
+        installerUserId: params.installerUserId ?? null
+    }).onConflictDoUpdate({
+        target: sentryInstallations.installationUuid,
+        // TOCTOU guard: allow the update only when this installation is unclaimed
+        // (connection_id IS NULL, the first claim of a verified-unclaimed row) or
+        // already owned by this same connection (idempotent reconnect). A concurrent
+        // claim of the same installation to a different workspace commits its own
+        // connection_id first; this losing transaction then sees a different non-null
+        // connection_id, the predicate is false, Postgres updates nothing, and the
+        // empty RETURNING below rolls it back instead of silently repointing the
+        // installation (cross-tenant event misroute).
+        setWhere: sql`${sentryInstallations.connectionId} is null or ${sentryInstallations.connectionId} = ${params.connectionId}`,
+        set: {
+            connectionId: params.connectionId,
+            orgSlug: params.orgSlug,
+            status: params.status,
+            codeHash: params.codeHash ?? null,
+            installerUserId: params.installerUserId ?? null,
+            updatedAt: now
+        }
+    }).returning();
+    if (!row) throw new SentryInstallationAlreadyLinkedError(params.installationUuid);
+    return toSentryInstallation(row);
+}
+/**
+ * Inserts the verified-but-unclaimed install half (`connection_id = NULL`,
+ * `status = 'installed'`) after a successful code exchange. Idempotent on the
+ * installation uuid: a conflicting row refreshes only `code_hash`/`org_slug`/
+ * `updated_at`, so a webhook that lands after a claim never clobbers the
+ * `connection_id` it set nor downgrades a `deleted` tombstone back to installed.
+ */ export async function persistVerifiedUnclaimedInstallation(params, options = {}) {
+    const executor = options.tx ?? db();
+    const now = new Date();
+    const [row] = await executor.insert(sentryInstallations).values({
+        connectionId: null,
+        installationUuid: params.installationUuid,
+        orgSlug: params.orgSlug,
+        status: 'installed',
+        codeHash: params.codeHash
+    }).onConflictDoUpdate({
+        target: sentryInstallations.installationUuid,
+        set: {
+            orgSlug: params.orgSlug,
+            codeHash: params.codeHash,
+            updatedAt: now
+        }
+    }).returning();
+    if (!row) throw new Error('Sentry installation persist returned no rows');
+    return toSentryInstallation(row);
+}
+/**
+ * Verified installs no user has claimed yet (`connection_id IS NULL`,
+ * `status='installed'`). Tombstoned rows are excluded so the TTL cron stays
+ * idempotent and the unclaimed metric stays accurate. Pass `olderThan` to scope
+ * to stale rows for the cron.
+ */ export async function listUnclaimedSentryInstallations(params = {}, options = {}) {
+    const executor = options.tx ?? db();
+    const conditions = [
+        isNull(sentryInstallations.connectionId),
+        eq(sentryInstallations.status, 'installed')
+    ];
+    if (params.olderThan) {
+        conditions.push(lt(sentryInstallations.createdAt, params.olderThan));
+    }
+    const rows = await executor.select().from(sentryInstallations).where(and(...conditions));
+    return rows.map(toSentryInstallation);
+}
+export async function getSentryInstallationByInstallationUuid(installationUuid, options = {}) {
+    const executor = options.tx ?? db();
+    const rows = await executor.select().from(sentryInstallations).where(eq(sentryInstallations.installationUuid, installationUuid)).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toSentryInstallation(row);
+}
+export async function getSentryInstallationByConnectionId(connectionId, options = {}) {
+    const executor = options.tx ?? db();
+    const rows = await executor.select().from(sentryInstallations).where(eq(sentryInstallations.connectionId, connectionId)).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toSentryInstallation(row);
+}
+/**
+ * Tombstones verified-unclaimed installs older than `olderThan` (the TTL cleanup
+ * cron). Bounds a never-claimed install rather than leaving it pending forever.
+ * Returns how many rows were tombstoned. We hold no Sentry token for these rows
+ * (tokens are never persisted), so the Sentry-side uninstall is out of scope here.
+ */ export async function pruneUnclaimedSentryInstallations(params, options = {}) {
+    const executor = options.tx ?? db();
+    const result = await executor.update(sentryInstallations).set({
+        status: 'deleted',
+        updatedAt: new Date()
+    }).where(and(isNull(sentryInstallations.connectionId), eq(sentryInstallations.status, 'installed'), lt(sentryInstallations.createdAt, params.olderThan)));
+    return {
+        tombstoned: result.rowCount ?? 0
+    };
+}
+export async function markSentryInstallationDeleted(params, options = {}) {
+    const executor = options.tx ?? db();
+    const [row] = await executor.update(sentryInstallations).set({
+        status: 'deleted',
+        updatedAt: new Date()
+    }).where(eq(sentryInstallations.installationUuid, params.installationUuid)).returning();
+    if (!row) return undefined;
+    return toSentryInstallation(row);
+}
+
+//# sourceMappingURL=installations.js.map

package/dist/db/installations.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/installations.ts"],"sourcesContent":["import {and, eq, isNull, lt, sql} from 'drizzle-orm';\nimport {SentryInstallationAlreadyLinkedError} from '#core/errors.js';\nimport {db} from './db.js';\nimport {sentryInstallations, toSentryInstallation} from './schema/installations.js';\n\nexport type SentryInstallationStatus = 'installed' | 'deleted';\n\nexport interface SentryInstallation {\n  id: string;\n  connectionId: string | null;\n  installationUuid: string;\n  orgSlug: string;\n  status: string;\n  codeHash: string | null;\n  installerUserId: string | null;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nexport interface UpsertSentryInstallationParams {\n  connectionId: string;\n  installationUuid: string;\n  orgSlug: string;\n  status: SentryInstallationStatus;\n  codeHash?: string | null | undefined;\n  installerUserId?: string | null | undefined;\n}\n\nexport interface PersistVerifiedUnclaimedInstallationParams {\n  installationUuid: string;\n  orgSlug: string;\n  codeHash: string;\n}\n\ntype SentryDb = ReturnType<typeof db>;\ntype SentryTx = Parameters<Parameters<SentryDb['transaction']>[0]>[0];\n\nexport async function upsertSentryInstallation(\n  params: UpsertSentryInstallationParams,\n  options: {tx?: unknown} = {},\n): Promise<SentryInstallation> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const now = new Date();\n  const [row] = await executor\n    .insert(sentryInstallations)\n    .values({\n      connectionId: params.connectionId,\n      installationUuid: params.installationUuid,\n      orgSlug: params.orgSlug,\n      status: params.status,\n      codeHash: params.codeHash ?? null,\n      installerUserId: params.installerUserId ?? null,\n    })\n    .onConflictDoUpdate({\n      target: sentryInstallations.installationUuid,\n      // TOCTOU guard: allow the update only when this installation is unclaimed\n      // (connection_id IS NULL, the first claim of a verified-unclaimed row) or\n      // already owned by this same connection (idempotent reconnect). A concurrent\n      // claim of the same installation to a different workspace commits its own\n      // connection_id first; this losing transaction then sees a different non-null\n      // connection_id, the predicate is false, Postgres updates nothing, and the\n      // empty RETURNING below rolls it back instead of silently repointing the\n      // installation (cross-tenant event misroute).\n      setWhere: sql`${sentryInstallations.connectionId} is null or ${sentryInstallations.connectionId} = ${params.connectionId}`,\n      set: {\n        connectionId: params.connectionId,\n        orgSlug: params.orgSlug,\n        status: params.status,\n        codeHash: params.codeHash ?? null,\n        installerUserId: params.installerUserId ?? null,\n        updatedAt: now,\n      },\n    })\n    .returning();\n\n  if (!row) throw new SentryInstallationAlreadyLinkedError(params.installationUuid);\n  return toSentryInstallation(row);\n}\n\n/**\n * Inserts the verified-but-unclaimed install half (`connection_id = NULL`,\n * `status = 'installed'`) after a successful code exchange. Idempotent on the\n * installation uuid: a conflicting row refreshes only `code_hash`/`org_slug`/\n * `updated_at`, so a webhook that lands after a claim never clobbers the\n * `connection_id` it set nor downgrades a `deleted` tombstone back to installed.\n */\nexport async function persistVerifiedUnclaimedInstallation(\n  params: PersistVerifiedUnclaimedInstallationParams,\n  options: {tx?: unknown} = {},\n): Promise<SentryInstallation> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const now = new Date();\n  const [row] = await executor\n    .insert(sentryInstallations)\n    .values({\n      connectionId: null,\n      installationUuid: params.installationUuid,\n      orgSlug: params.orgSlug,\n      status: 'installed',\n      codeHash: params.codeHash,\n    })\n    .onConflictDoUpdate({\n      target: sentryInstallations.installationUuid,\n      set: {\n        orgSlug: params.orgSlug,\n        codeHash: params.codeHash,\n        updatedAt: now,\n      },\n    })\n    .returning();\n\n  if (!row) throw new Error('Sentry installation persist returned no rows');\n  return toSentryInstallation(row);\n}\n\n/**\n * Verified installs no user has claimed yet (`connection_id IS NULL`,\n * `status='installed'`). Tombstoned rows are excluded so the TTL cron stays\n * idempotent and the unclaimed metric stays accurate. Pass `olderThan` to scope\n * to stale rows for the cron.\n */\nexport async function listUnclaimedSentryInstallations(\n  params: {olderThan?: Date} = {},\n  options: {tx?: unknown} = {},\n): Promise<SentryInstallation[]> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const conditions = [\n    isNull(sentryInstallations.connectionId),\n    eq(sentryInstallations.status, 'installed'),\n  ];\n  if (params.olderThan) {\n    conditions.push(lt(sentryInstallations.createdAt, params.olderThan));\n  }\n  const rows = await executor\n    .select()\n    .from(sentryInstallations)\n    .where(and(...conditions));\n  return rows.map(toSentryInstallation);\n}\n\nexport async function getSentryInstallationByInstallationUuid(\n  installationUuid: string,\n  options: {tx?: unknown} = {},\n): Promise<SentryInstallation | undefined> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const rows = await executor\n    .select()\n    .from(sentryInstallations)\n    .where(eq(sentryInstallations.installationUuid, installationUuid))\n    .limit(1);\n  const row = rows[0];\n  if (!row) return undefined;\n  return toSentryInstallation(row);\n}\n\nexport async function getSentryInstallationByConnectionId(\n  connectionId: string,\n  options: {tx?: unknown} = {},\n): Promise<SentryInstallation | undefined> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const rows = await executor\n    .select()\n    .from(sentryInstallations)\n    .where(eq(sentryInstallations.connectionId, connectionId))\n    .limit(1);\n  const row = rows[0];\n  if (!row) return undefined;\n  return toSentryInstallation(row);\n}\n\n/**\n * Tombstones verified-unclaimed installs older than `olderThan` (the TTL cleanup\n * cron). Bounds a never-claimed install rather than leaving it pending forever.\n * Returns how many rows were tombstoned. We hold no Sentry token for these rows\n * (tokens are never persisted), so the Sentry-side uninstall is out of scope here.\n */\nexport async function pruneUnclaimedSentryInstallations(\n  params: {olderThan: Date},\n  options: {tx?: unknown} = {},\n): Promise<{tombstoned: number}> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const result = await executor\n    .update(sentryInstallations)\n    .set({status: 'deleted', updatedAt: new Date()})\n    .where(\n      and(\n        isNull(sentryInstallations.connectionId),\n        eq(sentryInstallations.status, 'installed'),\n        lt(sentryInstallations.createdAt, params.olderThan),\n      ),\n    );\n  return {tombstoned: result.rowCount ?? 0};\n}\n\nexport async function markSentryInstallationDeleted(\n  params: {installationUuid: string},\n  options: {tx?: unknown} = {},\n): Promise<SentryInstallation | undefined> {\n  const executor = (options.tx ?? db()) as SentryDb | SentryTx;\n  const [row] = await executor\n    .update(sentryInstallations)\n    .set({status: 'deleted', updatedAt: new Date()})\n    .where(eq(sentryInstallations.installationUuid, params.installationUuid))\n    .returning();\n  if (!row) return undefined;\n  return toSentryInstallation(row);\n}\n"],"names":["and","eq","isNull","lt","sql","SentryInstallationAlreadyLinkedError","db","sentryInstallations","toSentryInstallation","upsertSentryInstallation","params","options","executor","tx","now","Date","row","insert","values","connectionId","installationUuid","orgSlug","status","codeHash","installerUserId","onConflictDoUpdate","target","setWhere","set","updatedAt","returning","persistVerifiedUnclaimedInstallation","Error","listUnclaimedSentryInstallations","conditions","olderThan","push","createdAt","rows","select","from","where","map","getSentryInstallationByInstallationUuid","limit","undefined","getSentryInstallationByConnectionId","pruneUnclaimedSentryInstallations","result","update","tombstoned","rowCount","markSentryInstallationDeleted"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AACrD,SAAQC,oCAAoC,QAAO,kBAAkB;AACrE,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,mBAAmB,EAAEC,oBAAoB,QAAO,4BAA4B;AAkCpF,OAAO,eAAeC,yBACpBC,MAAsC,EACtCC,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAMQ,MAAM,IAAIC;IAChB,MAAM,CAACC,IAAI,GAAG,MAAMJ,SACjBK,MAAM,CAACV,qBACPW,MAAM,CAAC;QACNC,cAAcT,OAAOS,YAAY;QACjCC,kBAAkBV,OAAOU,gBAAgB;QACzCC,SAASX,OAAOW,OAAO;QACvBC,QAAQZ,OAAOY,MAAM;QACrBC,UAAUb,OAAOa,QAAQ,IAAI;QAC7BC,iBAAiBd,OAAOc,eAAe,IAAI;IAC7C,GACCC,kBAAkB,CAAC;QAClBC,QAAQnB,oBAAoBa,gBAAgB;QAC5C,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9CO,UAAUvB,GAAG,CAAC,EAAEG,oBAAoBY,YAAY,CAAC,YAAY,EAAEZ,oBAAoBY,YAAY,CAAC,GAAG,EAAET,OAAOS,YAAY,CAAC,CAAC;QAC1HS,KAAK;YACHT,cAAcT,OAAOS,YAAY;YACjCE,SAASX,OAAOW,OAAO;YACvBC,QAAQZ,OAAOY,MAAM;YACrBC,UAAUb,OAAOa,QAAQ,IAAI;YAC7BC,iBAAiBd,OAAOc,eAAe,IAAI;YAC3CK,WAAWf;QACb;IACF,GACCgB,SAAS;IAEZ,IAAI,CAACd,KAAK,MAAM,IAAIX,qCAAqCK,OAAOU,gBAAgB;IAChF,OAAOZ,qBAAqBQ;AAC9B;AAEA;;;;;;CAMC,GACD,OAAO,eAAee,qCACpBrB,MAAkD,EAClDC,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAMQ,MAAM,IAAIC;IAChB,MAAM,CAACC,IAAI,GAAG,MAAMJ,SACjBK,MAAM,CAACV,qBACPW,MAAM,CAAC;QACNC,cAAc;QACdC,kBAAkBV,OAAOU,gBAAgB;QACzCC,SAASX,OAAOW,OAAO;QACvBC,QAAQ;QACRC,UAAUb,OAAOa,QAAQ;IAC3B,GACCE,kBAAkB,CAAC;QAClBC,QAAQnB,oBAAoBa,gBAAgB;QAC5CQ,KAAK;YACHP,SAASX,OAAOW,OAAO;YACvBE,UAAUb,OAAOa,QAAQ;YACzBM,WAAWf;QACb;IACF,GACCgB,SAAS;IAEZ,IAAI,CAACd,KAAK,MAAM,IAAIgB,MAAM;IAC1B,OAAOxB,qBAAqBQ;AAC9B;AAEA;;;;;CAKC,GACD,OAAO,eAAeiB,iCACpBvB,SAA6B,CAAC,CAAC,EAC/BC,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAM4B,aAAa;QACjBhC,OAAOK,oBAAoBY,YAAY;QACvClB,GAAGM,oBAAoBe,MAAM,EAAE;KAChC;IACD,IAAIZ,OAAOyB,SAAS,EAAE;QACpBD,WAAWE,IAAI,CAACjC,GAAGI,oBAAoB8B,SAAS,EAAE3B,OAAOyB,SAAS;IACpE;IACA,MAAMG,OAAO,MAAM1B,SAChB2B,MAAM,GACNC,IAAI,CAACjC,qBACLkC,KAAK,CAACzC,OAAOkC;IAChB,OAAOI,KAAKI,GAAG,CAAClC;AAClB;AAEA,OAAO,eAAemC,wCACpBvB,gBAAwB,EACxBT,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAMgC,OAAO,MAAM1B,SAChB2B,MAAM,GACNC,IAAI,CAACjC,qBACLkC,KAAK,CAACxC,GAAGM,oBAAoBa,gBAAgB,EAAEA,mBAC/CwB,KAAK,CAAC;IACT,MAAM5B,MAAMsB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACtB,KAAK,OAAO6B;IACjB,OAAOrC,qBAAqBQ;AAC9B;AAEA,OAAO,eAAe8B,oCACpB3B,YAAoB,EACpBR,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAMgC,OAAO,MAAM1B,SAChB2B,MAAM,GACNC,IAAI,CAACjC,qBACLkC,KAAK,CAACxC,GAAGM,oBAAoBY,YAAY,EAAEA,eAC3CyB,KAAK,CAAC;IACT,MAAM5B,MAAMsB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACtB,KAAK,OAAO6B;IACjB,OAAOrC,qBAAqBQ;AAC9B;AAEA;;;;;CAKC,GACD,OAAO,eAAe+B,kCACpBrC,MAAyB,EACzBC,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAM0C,SAAS,MAAMpC,SAClBqC,MAAM,CAAC1C,qBACPqB,GAAG,CAAC;QAACN,QAAQ;QAAWO,WAAW,IAAId;IAAM,GAC7C0B,KAAK,CACJzC,IACEE,OAAOK,oBAAoBY,YAAY,GACvClB,GAAGM,oBAAoBe,MAAM,EAAE,cAC/BnB,GAAGI,oBAAoB8B,SAAS,EAAE3B,OAAOyB,SAAS;IAGxD,OAAO;QAACe,YAAYF,OAAOG,QAAQ,IAAI;IAAC;AAC1C;AAEA,OAAO,eAAeC,8BACpB1C,MAAkC,EAClCC,UAA0B,CAAC,CAAC;IAE5B,MAAMC,WAAYD,QAAQE,EAAE,IAAIP;IAChC,MAAM,CAACU,IAAI,GAAG,MAAMJ,SACjBqC,MAAM,CAAC1C,qBACPqB,GAAG,CAAC;QAACN,QAAQ;QAAWO,WAAW,IAAId;IAAM,GAC7C0B,KAAK,CAACxC,GAAGM,oBAAoBa,gBAAgB,EAAEV,OAAOU,gBAAgB,GACtEU,SAAS;IACZ,IAAI,CAACd,KAAK,OAAO6B;IACjB,OAAOrC,qBAAqBQ;AAC9B"}

package/dist/db/migrations.d.ts

@@ -0,0 +1,2 @@
+export declare const migrationsPath: string;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/db/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/db/migrations.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,QAAoE,CAAC"}

package/dist/db/migrations.js

@@ -0,0 +1,5 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');
+
+//# sourceMappingURL=migrations.js.map

package/dist/db/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/migrations.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\n\nexport const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');\n"],"names":["dirname","resolve","fileURLToPath","migrationsPath","url"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AAEvC,OAAO,MAAMC,iBAAiBF,QAAQD,QAAQE,cAAc,YAAYE,GAAG,IAAI,iBAAiB"}

package/dist/db/schema/common.d.ts

@@ -0,0 +1,2 @@
+export declare const pgTable: import("drizzle-orm/pg-core").PgTableFn<undefined>;
+//# sourceMappingURL=common.d.ts.map

package/dist/db/schema/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/db/schema/common.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,oDAA0D,CAAC"}

package/dist/db/schema/common.js

@@ -0,0 +1,4 @@
+import { pgTableCreator } from 'drizzle-orm/pg-core';
+export const pgTable = pgTableCreator((name)=>`integrations_sentry_${name}`);
+
+//# sourceMappingURL=common.js.map

package/dist/db/schema/common.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/common.ts"],"sourcesContent":["import {pgTableCreator} from 'drizzle-orm/pg-core';\n\nexport const pgTable = pgTableCreator((name) => `integrations_sentry_${name}`);\n"],"names":["pgTableCreator","pgTable","name"],"mappings":"AAAA,SAAQA,cAAc,QAAO,sBAAsB;AAEnD,OAAO,MAAMC,UAAUD,eAAe,CAACE,OAAS,CAAC,oBAAoB,EAAEA,MAAM,EAAE"}