@shipfox/api-integration-sentry 5.0.0 → 7.1.0

package/dist/core/webhook.js

@@ -1,7 +1,7 @@
 import { logger } from '@shipfox/node-opentelemetry';
 import { SentryConnectionNotFoundError, SentryInstallationDeletedError, SentryInstallationNotFoundError, SentryInstallationUnclaimedError, SentryIntegrationProviderError } from '#core/errors.js';
-import { verifyAndPersistUnclaimedInstallation } from '#core/install.js';
-import { getSentryInstallationByInstallationUuid, markSentryInstallationDeleted } from '#db/installations.js';
+import { hashAuthorizationCode, verifySentryInstallationBestEffort } from '#core/install.js';
+import { claimSentryInstallationVerification, getSentryInstallationByInstallationUuid, markSentryInstallationDeleted, markSentryInstallationExchangeSucceeded } from '#db/installations.js';
 const SENTRY_SOURCE = 'sentry';
 const DEFAULT_ISSUE_TITLE = 'Sentry issue';
 const DELETED_STATUS = 'deleted';
@@ -50,15 +50,15 @@ export async function handleSentryIssueEvent(params) {
 /**
  * The authoritative `installation.created` path. Whichever of webhook or browser
  * arrives first exchanges the single-use code and persists a verified-unclaimed
- * row; the other reconciles. Idempotent on the installation uuid. The exchange
- * runs outside any DB transaction; a short transaction wraps only persist +
- * delivery record. On an exchange failure the delivery is record-and-dropped
- * (204) — the browser may still win, or the code expired. Never logs the raw code.
+ * row; the other reconciles. The webhook writes a pending claim before the
+ * exchange and a durable checkpoint after it succeeds. Only that checkpoint can
+ * bypass the single-use exchange on retry. The installed transition and delivery
+ * record commit in one transaction. Never logs the raw code.
  */ export async function handleSentryInstallationCreated(params) {
     const existing = await params.getSentryInstallation({
         installationUuid: params.installationUuid
     });
-    if (existing) {
+    if (existing && (existing.status === 'installed' || existing.status === 'deleted')) {
         logger().debug({
             deliveryId: params.deliveryId,
             installationUuid: params.installationUuid
@@ -66,60 +66,74 @@ export async function handleSentryIssueEvent(params) {
         await params.recordDelivery(params.deliveryId);
         return;
     }
-    if (!params.code) {
+    if (!params.code || !params.orgSlug) {
         logger().warn({
             deliveryId: params.deliveryId,
             installationUuid: params.installationUuid
-        }, 'sentry webhook: installation.created without an authorization code, dropping');
+        }, 'sentry webhook: installation.created without claim input, dropping');
         await params.recordDelivery(params.deliveryId);
         return;
     }
-    try {
-        await verifyAndPersistUnclaimedInstallation({
-            sentry: params.sentry,
-            installationUuid: params.installationUuid,
-            code: params.code,
-            orgSlug: params.orgSlug,
-            verifyInstall: params.verifyInstall,
-            persistVerifiedUnclaimedInstallation: ({ installationUuid, orgSlug, codeHash })=>params.persistUnclaimedAndRecordDelivery({
-                    installationUuid,
-                    orgSlug,
-                    codeHash,
-                    deliveryId: params.deliveryId
-                })
-        });
-    } catch (error) {
-        if (error instanceof SentryIntegrationProviderError) {
-            // The Sentry exchange (or org-slug lookup) failed, so we never durably
-            // spent the code on a row we own. `reason` distinguishes a transient/expected
-            // drop (access-denied: the code was already spent, e.g. the browser won) from
-            // a likely misconfiguration (a bad client id/secret/slug fails every install)
-            // so log-based alerting can fire on the sustained case. Never logs the raw code.
-            logger().warn({
-                deliveryId: params.deliveryId,
+    const codeHash = hashAuthorizationCode(params.code);
+    let claimed = existing ?? await claimSentryInstallationVerification({
+        installationUuid: params.installationUuid,
+        orgSlug: params.orgSlug,
+        codeHash
+    });
+    if (claimed.status === 'installed' || claimed.status === 'deleted') {
+        await params.recordDelivery(params.deliveryId);
+        return;
+    }
+    if (claimed.codeHash !== codeHash) {
+        logger().warn({
+            deliveryId: params.deliveryId,
+            installationUuid: params.installationUuid
+        }, 'sentry webhook: installation.created does not match the pending claim, dropping');
+        await params.recordDelivery(params.deliveryId);
+        return;
+    }
+    let authorization;
+    if (claimed.status === 'pending') {
+        try {
+            authorization = await params.sentry.exchangeAuthorizationCode({
                 installationUuid: params.installationUuid,
-                reason: error.reason,
-                err: error
-            }, 'sentry webhook: installation.created exchange failed, dropping');
-        } else {
-            // The exchange succeeded (the single-use code is now spent) but the persist
-            // transaction failed, so no row exists and Sentry will not usefully
-            // re-deliver — the install is stranded until a reinstall mints a fresh uuid.
-            // Log at error so alerting catches it; still record-and-drop because retrying
-            // a spent code cannot recover the row. Never logs the raw code.
-            logger().error({
-                deliveryId: params.deliveryId,
+                code: params.code
+            });
+        } catch (error) {
+            if (!(error instanceof SentryIntegrationProviderError) || error.reason !== 'access-denied') {
+                throw error;
+            }
+            const current = await params.getSentryInstallation({
+                installationUuid: params.installationUuid
+            });
+            const concurrentAttemptSucceeded = current?.codeHash === codeHash && (current.status === 'exchange-succeeded' || current.status === 'installed');
+            if (!current || !concurrentAttemptSucceeded) throw error;
+            claimed = current;
+        }
+        if (authorization) {
+            await markSentryInstallationExchangeSucceeded({
                 installationUuid: params.installationUuid,
-                err: error
-            }, 'sentry webhook: installation.created persisted nothing after a successful exchange, install stranded until reinstall');
+                codeHash
+            });
         }
-        await params.recordDelivery(params.deliveryId);
+    }
+    const completed = await params.persistUnclaimedAndRecordDelivery({
+        installationUuid: params.installationUuid,
+        orgSlug: claimed.orgSlug,
+        codeHash,
+        deliveryId: params.deliveryId
+    });
+    if (authorization && completed.status === 'installed' && params.verifyInstall) {
+        await verifySentryInstallationBestEffort({
+            sentry: params.sentry,
+            installationUuid: params.installationUuid,
+            token: authorization.token
+        });
     }
 }
 // Tombstones the install and disables its connection if one exists. An unknown
-// uuid (never installed, or reinstall mints a fresh uuid) only records the
-// delivery: there is no tombstone row to write. Runs entirely in the caller's
-// transaction — no exchange is needed.
+// uuid also gets a tombstone, so a reordered creation cannot restore it. The
+// state change and delivery record share the caller's transaction.
 export async function handleSentryInstallationDeleted(params) {
     const installation = await markSentryInstallationDeleted({
         installationUuid: params.installationUuid

package/dist/core/webhook.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import type {\n  GetIntegrationConnectionByIdFn,\n  IntegrationTx,\n  PublishIntegrationEventReceivedFn,\n  RecordDeliveryOnlyFn,\n  SentryIssuePayload,\n  UpdateIntegrationConnectionLifecycleStatusFn,\n} from '@shipfox/api-integration-core-dto';\nimport type {SentryIssueWebhookDto} from '@shipfox/api-integration-sentry-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {SentryApiClient} from '#api/client.js';\nimport {\n  SentryConnectionNotFoundError,\n  SentryInstallationDeletedError,\n  SentryInstallationNotFoundError,\n  SentryInstallationUnclaimedError,\n  SentryIntegrationProviderError,\n} from '#core/errors.js';\nimport {verifyAndPersistUnclaimedInstallation} from '#core/install.js';\nimport {\n  getSentryInstallationByInstallationUuid,\n  markSentryInstallationDeleted,\n  type SentryInstallation,\n} from '#db/installations.js';\n\nconst SENTRY_SOURCE = 'sentry';\nconst DEFAULT_ISSUE_TITLE = 'Sentry issue';\nconst DELETED_STATUS = 'deleted';\n\nexport interface HandleSentryIssueEventParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: SentryIssueWebhookDto;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\n// Publishes the mapped event for a verified issue delivery. Throws a typed\n// SentryIssueDroppedError subclass when the delivery references state we cannot\n// publish against (unknown/deleted installation, or an install not yet claimed\n// into a workspace); the webhook layer records-and-drops those. Dedup of an\n// already-seen delivery is handled inside publishIntegrationEventReceived.\nexport async function handleSentryIssueEvent(params: HandleSentryIssueEventParams): Promise<void> {\n  const installationUuid = params.payload.installation.uuid;\n\n  const installation = await getSentryInstallationByInstallationUuid(installationUuid, {\n    tx: params.tx,\n  });\n  if (!installation) {\n    throw new SentryInstallationNotFoundError(installationUuid);\n  }\n  if (installation.status === DELETED_STATUS) {\n    throw new SentryInstallationDeletedError(installationUuid);\n  }\n  // A verified-but-unclaimed install has no workspace yet, so there is nothing to\n  // publish an event against. This is the pre-claim drop window (counted/logged).\n  if (!installation.connectionId) {\n    throw new SentryInstallationUnclaimedError(installationUuid);\n  }\n\n  const connection = await params.getIntegrationConnectionById(installation.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    throw new SentryConnectionNotFoundError(installation.connectionId);\n  }\n\n  await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: SENTRY_SOURCE,\n      source: connection.slug,\n      event: `issue.${params.payload.action}`,\n      workspaceId: connection.workspaceId,\n      connectionId: connection.id,\n      connectionName: connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: new Date().toISOString(),\n      payload: normalizeIssuePayload(params.payload),\n    },\n  });\n}\n\nexport interface HandleSentryInstallationCreatedParams {\n  deliveryId: string;\n  installationUuid: string;\n  // From the signed payload; the webhook is authoritative so the slug is trusted\n  // without a getInstallation round-trip. The code is the single-use grant.\n  orgSlug: string | undefined;\n  code: string | undefined;\n  sentry: SentryApiClient;\n  verifyInstall: boolean;\n  getSentryInstallation: (input: {\n    installationUuid: string;\n  }) => Promise<SentryInstallation | undefined>;\n  // Persists the verified-unclaimed row and records the delivery in one short\n  // transaction, returning the persisted row.\n  persistUnclaimedAndRecordDelivery: (input: {\n    installationUuid: string;\n    orgSlug: string;\n    codeHash: string;\n    deliveryId: string;\n  }) => Promise<SentryInstallation>;\n  // Records the delivery for dedup without persisting an install (reconcile/no-op,\n  // missing code, or exchange failure → record-and-drop).\n  recordDelivery: (deliveryId: string) => Promise<void>;\n}\n\n/**\n * The authoritative `installation.created` path. Whichever of webhook or browser\n * arrives first exchanges the single-use code and persists a verified-unclaimed\n * row; the other reconciles. Idempotent on the installation uuid. The exchange\n * runs outside any DB transaction; a short transaction wraps only persist +\n * delivery record. On an exchange failure the delivery is record-and-dropped\n * (204) — the browser may still win, or the code expired. Never logs the raw code.\n */\nexport async function handleSentryInstallationCreated(\n  params: HandleSentryInstallationCreatedParams,\n): Promise<void> {\n  const existing = await params.getSentryInstallation({installationUuid: params.installationUuid});\n  if (existing) {\n    logger().debug(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created for an existing row, reconciling',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  if (!params.code) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created without an authorization code, dropping',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  try {\n    await verifyAndPersistUnclaimedInstallation({\n      sentry: params.sentry,\n      installationUuid: params.installationUuid,\n      code: params.code,\n      orgSlug: params.orgSlug,\n      verifyInstall: params.verifyInstall,\n      persistVerifiedUnclaimedInstallation: ({installationUuid, orgSlug, codeHash}) =>\n        params.persistUnclaimedAndRecordDelivery({\n          installationUuid,\n          orgSlug,\n          codeHash,\n          deliveryId: params.deliveryId,\n        }),\n    });\n  } catch (error) {\n    if (error instanceof SentryIntegrationProviderError) {\n      // The Sentry exchange (or org-slug lookup) failed, so we never durably\n      // spent the code on a row we own. `reason` distinguishes a transient/expected\n      // drop (access-denied: the code was already spent, e.g. the browser won) from\n      // a likely misconfiguration (a bad client id/secret/slug fails every install)\n      // so log-based alerting can fire on the sustained case. Never logs the raw code.\n      logger().warn(\n        {\n          deliveryId: params.deliveryId,\n          installationUuid: params.installationUuid,\n          reason: error.reason,\n          err: error,\n        },\n        'sentry webhook: installation.created exchange failed, dropping',\n      );\n    } else {\n      // The exchange succeeded (the single-use code is now spent) but the persist\n      // transaction failed, so no row exists and Sentry will not usefully\n      // re-deliver — the install is stranded until a reinstall mints a fresh uuid.\n      // Log at error so alerting catches it; still record-and-drop because retrying\n      // a spent code cannot recover the row. Never logs the raw code.\n      logger().error(\n        {deliveryId: params.deliveryId, installationUuid: params.installationUuid, err: error},\n        'sentry webhook: installation.created persisted nothing after a successful exchange, install stranded until reinstall',\n      );\n    }\n    await params.recordDelivery(params.deliveryId);\n  }\n}\n\nexport interface HandleSentryInstallationDeletedParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  installationUuid: string;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  updateConnectionLifecycleStatus: UpdateIntegrationConnectionLifecycleStatusFn;\n}\n\n// Tombstones the install and disables its connection if one exists. An unknown\n// uuid (never installed, or reinstall mints a fresh uuid) only records the\n// delivery: there is no tombstone row to write. Runs entirely in the caller's\n// transaction — no exchange is needed.\nexport async function handleSentryInstallationDeleted(\n  params: HandleSentryInstallationDeletedParams,\n): Promise<void> {\n  const installation = await markSentryInstallationDeleted(\n    {installationUuid: params.installationUuid},\n    {tx: params.tx},\n  );\n  if (installation?.connectionId) {\n    await params.updateConnectionLifecycleStatus(\n      {id: installation.connectionId, lifecycleStatus: 'disabled'},\n      {tx: params.tx},\n    );\n  }\n\n  await params.recordDeliveryOnly({\n    tx: params.tx,\n    provider: SENTRY_SOURCE,\n    deliveryId: params.deliveryId,\n  });\n}\n\n// A raw Sentry `ignored` action is normalized to `archived` before validation,\n// so legacy ignore events still fire `issue.archived` workflows.\nexport function normalizeSentryIssueAction(parsedJson: unknown): unknown {\n  if (typeof parsedJson !== 'object' || parsedJson === null) return parsedJson;\n  const obj = parsedJson as {action?: unknown};\n  if (obj.action === 'ignored') {\n    return {...obj, action: 'archived'};\n  }\n  return parsedJson;\n}\n\nfunction normalizeIssuePayload(payload: SentryIssueWebhookDto): SentryIssuePayload {\n  const issue = payload.data.issue;\n  return {\n    action: payload.action,\n    issueId: issue.id,\n    shortId: issue.shortId ?? null,\n    title: issue.title ?? DEFAULT_ISSUE_TITLE,\n    culprit: issue.culprit ?? null,\n    level: issue.level ?? null,\n    status: issue.status ?? null,\n    platform: issue.platform ?? null,\n    webUrl: issue.web_url ?? null,\n    issueUrl: issue.url ?? null,\n    projectUrl: issue.project_url ?? null,\n    firstSeenAt: issue.firstSeen ?? null,\n    lastSeenAt: issue.lastSeen ?? null,\n  };\n}\n"],"names":["logger","SentryConnectionNotFoundError","SentryInstallationDeletedError","SentryInstallationNotFoundError","SentryInstallationUnclaimedError","SentryIntegrationProviderError","verifyAndPersistUnclaimedInstallation","getSentryInstallationByInstallationUuid","markSentryInstallationDeleted","SENTRY_SOURCE","DEFAULT_ISSUE_TITLE","DELETED_STATUS","handleSentryIssueEvent","params","installationUuid","payload","installation","uuid","tx","status","connectionId","connection","getIntegrationConnectionById","publishIntegrationEventReceived","event","provider","source","slug","action","workspaceId","id","connectionName","displayName","deliveryId","receivedAt","Date","toISOString","normalizeIssuePayload","handleSentryInstallationCreated","existing","getSentryInstallation","debug","recordDelivery","code","warn","sentry","orgSlug","verifyInstall","persistVerifiedUnclaimedInstallation","codeHash","persistUnclaimedAndRecordDelivery","error","reason","err","handleSentryInstallationDeleted","updateConnectionLifecycleStatus","lifecycleStatus","recordDeliveryOnly","normalizeSentryIssueAction","parsedJson","obj","issue","data","issueId","shortId","title","culprit","level","platform","webUrl","web_url","issueUrl","url","projectUrl","project_url","firstSeenAt","firstSeen","lastSeenAt","lastSeen"],"mappings":"AASA,SAAQA,MAAM,QAAO,8BAA8B;AAEnD,SACEC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,+BAA+B,EAC/BC,gCAAgC,EAChCC,8BAA8B,QACzB,kBAAkB;AACzB,SAAQC,qCAAqC,QAAO,mBAAmB;AACvE,SACEC,uCAAuC,EACvCC,6BAA6B,QAExB,uBAAuB;AAE9B,MAAMC,gBAAgB;AACtB,MAAMC,sBAAsB;AAC5B,MAAMC,iBAAiB;AAUvB,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,OAAO,eAAeC,uBAAuBC,MAAoC;IAC/E,MAAMC,mBAAmBD,OAAOE,OAAO,CAACC,YAAY,CAACC,IAAI;IAEzD,MAAMD,eAAe,MAAMT,wCAAwCO,kBAAkB;QACnFI,IAAIL,OAAOK,EAAE;IACf;IACA,IAAI,CAACF,cAAc;QACjB,MAAM,IAAIb,gCAAgCW;IAC5C;IACA,IAAIE,aAAaG,MAAM,KAAKR,gBAAgB;QAC1C,MAAM,IAAIT,+BAA+BY;IAC3C;IACA,gFAAgF;IAChF,gFAAgF;IAChF,IAAI,CAACE,aAAaI,YAAY,EAAE;QAC9B,MAAM,IAAIhB,iCAAiCU;IAC7C;IAEA,MAAMO,aAAa,MAAMR,OAAOS,4BAA4B,CAACN,aAAaI,YAAY,EAAE;QACtFF,IAAIL,OAAOK,EAAE;IACf;IACA,IAAI,CAACG,YAAY;QACf,MAAM,IAAIpB,8BAA8Be,aAAaI,YAAY;IACnE;IAEA,MAAMP,OAAOU,+BAA+B,CAAC;QAC3CL,IAAIL,OAAOK,EAAE;QACbM,OAAO;YACLC,UAAUhB;YACViB,QAAQL,WAAWM,IAAI;YACvBH,OAAO,CAAC,MAAM,EAAEX,OAAOE,OAAO,CAACa,MAAM,EAAE;YACvCC,aAAaR,WAAWQ,WAAW;YACnCT,cAAcC,WAAWS,EAAE;YAC3BC,gBAAgBV,WAAWW,WAAW;YACtCC,YAAYpB,OAAOoB,UAAU;YAC7BC,YAAY,IAAIC,OAAOC,WAAW;YAClCrB,SAASsB,sBAAsBxB,OAAOE,OAAO;QAC/C;IACF;AACF;AA2BA;;;;;;;CAOC,GACD,OAAO,eAAeuB,gCACpBzB,MAA6C;IAE7C,MAAM0B,WAAW,MAAM1B,OAAO2B,qBAAqB,CAAC;QAAC1B,kBAAkBD,OAAOC,gBAAgB;IAAA;IAC9F,IAAIyB,UAAU;QACZvC,SAASyC,KAAK,CACZ;YAACR,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,IAAI,CAACpB,OAAO8B,IAAI,EAAE;QAChB3C,SAAS4C,IAAI,CACX;YAACX,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,IAAI;QACF,MAAM3B,sCAAsC;YAC1CuC,QAAQhC,OAAOgC,MAAM;YACrB/B,kBAAkBD,OAAOC,gBAAgB;YACzC6B,MAAM9B,OAAO8B,IAAI;YACjBG,SAASjC,OAAOiC,OAAO;YACvBC,eAAelC,OAAOkC,aAAa;YACnCC,sCAAsC,CAAC,EAAClC,gBAAgB,EAAEgC,OAAO,EAAEG,QAAQ,EAAC,GAC1EpC,OAAOqC,iCAAiC,CAAC;oBACvCpC;oBACAgC;oBACAG;oBACAhB,YAAYpB,OAAOoB,UAAU;gBAC/B;QACJ;IACF,EAAE,OAAOkB,OAAO;QACd,IAAIA,iBAAiB9C,gCAAgC;YACnD,uEAAuE;YACvE,8EAA8E;YAC9E,8EAA8E;YAC9E,8EAA8E;YAC9E,iFAAiF;YACjFL,SAAS4C,IAAI,CACX;gBACEX,YAAYpB,OAAOoB,UAAU;gBAC7BnB,kBAAkBD,OAAOC,gBAAgB;gBACzCsC,QAAQD,MAAMC,MAAM;gBACpBC,KAAKF;YACP,GACA;QAEJ,OAAO;YACL,4EAA4E;YAC5E,oEAAoE;YACpE,6EAA6E;YAC7E,8EAA8E;YAC9E,gEAAgE;YAChEnD,SAASmD,KAAK,CACZ;gBAAClB,YAAYpB,OAAOoB,UAAU;gBAAEnB,kBAAkBD,OAAOC,gBAAgB;gBAAEuC,KAAKF;YAAK,GACrF;QAEJ;QACA,MAAMtC,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;IAC/C;AACF;AAUA,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,uCAAuC;AACvC,OAAO,eAAeqB,gCACpBzC,MAA6C;IAE7C,MAAMG,eAAe,MAAMR,8BACzB;QAACM,kBAAkBD,OAAOC,gBAAgB;IAAA,GAC1C;QAACI,IAAIL,OAAOK,EAAE;IAAA;IAEhB,IAAIF,cAAcI,cAAc;QAC9B,MAAMP,OAAO0C,+BAA+B,CAC1C;YAACzB,IAAId,aAAaI,YAAY;YAAEoC,iBAAiB;QAAU,GAC3D;YAACtC,IAAIL,OAAOK,EAAE;QAAA;IAElB;IAEA,MAAML,OAAO4C,kBAAkB,CAAC;QAC9BvC,IAAIL,OAAOK,EAAE;QACbO,UAAUhB;QACVwB,YAAYpB,OAAOoB,UAAU;IAC/B;AACF;AAEA,+EAA+E;AAC/E,iEAAiE;AACjE,OAAO,SAASyB,2BAA2BC,UAAmB;IAC5D,IAAI,OAAOA,eAAe,YAAYA,eAAe,MAAM,OAAOA;IAClE,MAAMC,MAAMD;IACZ,IAAIC,IAAIhC,MAAM,KAAK,WAAW;QAC5B,OAAO;YAAC,GAAGgC,GAAG;YAAEhC,QAAQ;QAAU;IACpC;IACA,OAAO+B;AACT;AAEA,SAAStB,sBAAsBtB,OAA8B;IAC3D,MAAM8C,QAAQ9C,QAAQ+C,IAAI,CAACD,KAAK;IAChC,OAAO;QACLjC,QAAQb,QAAQa,MAAM;QACtBmC,SAASF,MAAM/B,EAAE;QACjBkC,SAASH,MAAMG,OAAO,IAAI;QAC1BC,OAAOJ,MAAMI,KAAK,IAAIvD;QACtBwD,SAASL,MAAMK,OAAO,IAAI;QAC1BC,OAAON,MAAMM,KAAK,IAAI;QACtBhD,QAAQ0C,MAAM1C,MAAM,IAAI;QACxBiD,UAAUP,MAAMO,QAAQ,IAAI;QAC5BC,QAAQR,MAAMS,OAAO,IAAI;QACzBC,UAAUV,MAAMW,GAAG,IAAI;QACvBC,YAAYZ,MAAMa,WAAW,IAAI;QACjCC,aAAad,MAAMe,SAAS,IAAI;QAChCC,YAAYhB,MAAMiB,QAAQ,IAAI;IAChC;AACF"}
+{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import type {\n  GetIntegrationConnectionByIdFn,\n  IntegrationTx,\n  PublishIntegrationEventReceivedFn,\n  RecordDeliveryOnlyFn,\n  SentryIssuePayload,\n  UpdateIntegrationConnectionLifecycleStatusFn,\n} from '@shipfox/api-integration-core-dto';\nimport type {SentryIssueWebhookDto} from '@shipfox/api-integration-sentry-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {SentryApiClient} from '#api/client.js';\nimport {\n  SentryConnectionNotFoundError,\n  SentryInstallationDeletedError,\n  SentryInstallationNotFoundError,\n  SentryInstallationUnclaimedError,\n  SentryIntegrationProviderError,\n} from '#core/errors.js';\nimport {hashAuthorizationCode, verifySentryInstallationBestEffort} from '#core/install.js';\nimport {\n  claimSentryInstallationVerification,\n  getSentryInstallationByInstallationUuid,\n  markSentryInstallationDeleted,\n  markSentryInstallationExchangeSucceeded,\n  type SentryInstallation,\n} from '#db/installations.js';\n\nconst SENTRY_SOURCE = 'sentry';\nconst DEFAULT_ISSUE_TITLE = 'Sentry issue';\nconst DELETED_STATUS = 'deleted';\n\nexport interface HandleSentryIssueEventParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: SentryIssueWebhookDto;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\n// Publishes the mapped event for a verified issue delivery. Throws a typed\n// SentryIssueDroppedError subclass when the delivery references state we cannot\n// publish against (unknown/deleted installation, or an install not yet claimed\n// into a workspace); the webhook layer records-and-drops those. Dedup of an\n// already-seen delivery is handled inside publishIntegrationEventReceived.\nexport async function handleSentryIssueEvent(params: HandleSentryIssueEventParams): Promise<void> {\n  const installationUuid = params.payload.installation.uuid;\n\n  const installation = await getSentryInstallationByInstallationUuid(installationUuid, {\n    tx: params.tx,\n  });\n  if (!installation) {\n    throw new SentryInstallationNotFoundError(installationUuid);\n  }\n  if (installation.status === DELETED_STATUS) {\n    throw new SentryInstallationDeletedError(installationUuid);\n  }\n  // A verified-but-unclaimed install has no workspace yet, so there is nothing to\n  // publish an event against. This is the pre-claim drop window (counted/logged).\n  if (!installation.connectionId) {\n    throw new SentryInstallationUnclaimedError(installationUuid);\n  }\n\n  const connection = await params.getIntegrationConnectionById(installation.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    throw new SentryConnectionNotFoundError(installation.connectionId);\n  }\n\n  await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: SENTRY_SOURCE,\n      source: connection.slug,\n      event: `issue.${params.payload.action}`,\n      workspaceId: connection.workspaceId,\n      connectionId: connection.id,\n      connectionName: connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: new Date().toISOString(),\n      payload: normalizeIssuePayload(params.payload),\n    },\n  });\n}\n\nexport interface HandleSentryInstallationCreatedParams {\n  deliveryId: string;\n  installationUuid: string;\n  // From the signed payload; the webhook is authoritative so the slug is trusted\n  // without a getInstallation round-trip. The code is the single-use grant.\n  orgSlug: string | undefined;\n  code: string | undefined;\n  sentry: SentryApiClient;\n  verifyInstall: boolean;\n  getSentryInstallation: (input: {\n    installationUuid: string;\n  }) => Promise<SentryInstallation | undefined>;\n  // Persists the verified-unclaimed row and records the delivery in one short\n  // transaction, returning the persisted row.\n  persistUnclaimedAndRecordDelivery: (input: {\n    installationUuid: string;\n    orgSlug: string;\n    codeHash: string;\n    deliveryId: string;\n  }) => Promise<SentryInstallation>;\n  // Records the delivery for dedup without persisting an install (reconcile/no-op\n  // or missing claim input).\n  recordDelivery: (deliveryId: string) => Promise<void>;\n}\n\n/**\n * The authoritative `installation.created` path. Whichever of webhook or browser\n * arrives first exchanges the single-use code and persists a verified-unclaimed\n * row; the other reconciles. The webhook writes a pending claim before the\n * exchange and a durable checkpoint after it succeeds. Only that checkpoint can\n * bypass the single-use exchange on retry. The installed transition and delivery\n * record commit in one transaction. Never logs the raw code.\n */\nexport async function handleSentryInstallationCreated(\n  params: HandleSentryInstallationCreatedParams,\n): Promise<void> {\n  const existing = await params.getSentryInstallation({installationUuid: params.installationUuid});\n  if (existing && (existing.status === 'installed' || existing.status === 'deleted')) {\n    logger().debug(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created for an existing row, reconciling',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  if (!params.code || !params.orgSlug) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created without claim input, dropping',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  const codeHash = hashAuthorizationCode(params.code);\n  let claimed =\n    existing ??\n    (await claimSentryInstallationVerification({\n      installationUuid: params.installationUuid,\n      orgSlug: params.orgSlug,\n      codeHash,\n    }));\n  if (claimed.status === 'installed' || claimed.status === 'deleted') {\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n  if (claimed.codeHash !== codeHash) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},\n      'sentry webhook: installation.created does not match the pending claim, dropping',\n    );\n    await params.recordDelivery(params.deliveryId);\n    return;\n  }\n\n  let authorization: Awaited<ReturnType<SentryApiClient['exchangeAuthorizationCode']>> | undefined;\n  if (claimed.status === 'pending') {\n    try {\n      authorization = await params.sentry.exchangeAuthorizationCode({\n        installationUuid: params.installationUuid,\n        code: params.code,\n      });\n    } catch (error) {\n      if (!(error instanceof SentryIntegrationProviderError) || error.reason !== 'access-denied') {\n        throw error;\n      }\n\n      const current = await params.getSentryInstallation({\n        installationUuid: params.installationUuid,\n      });\n      const concurrentAttemptSucceeded =\n        current?.codeHash === codeHash &&\n        (current.status === 'exchange-succeeded' || current.status === 'installed');\n      if (!current || !concurrentAttemptSucceeded) throw error;\n      claimed = current;\n    }\n\n    if (authorization) {\n      await markSentryInstallationExchangeSucceeded({\n        installationUuid: params.installationUuid,\n        codeHash,\n      });\n    }\n  }\n\n  const completed = await params.persistUnclaimedAndRecordDelivery({\n    installationUuid: params.installationUuid,\n    orgSlug: claimed.orgSlug,\n    codeHash,\n    deliveryId: params.deliveryId,\n  });\n  if (authorization && completed.status === 'installed' && params.verifyInstall) {\n    await verifySentryInstallationBestEffort({\n      sentry: params.sentry,\n      installationUuid: params.installationUuid,\n      token: authorization.token,\n    });\n  }\n}\n\nexport interface HandleSentryInstallationDeletedParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  installationUuid: string;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  updateConnectionLifecycleStatus: UpdateIntegrationConnectionLifecycleStatusFn;\n}\n\n// Tombstones the install and disables its connection if one exists. An unknown\n// uuid also gets a tombstone, so a reordered creation cannot restore it. The\n// state change and delivery record share the caller's transaction.\nexport async function handleSentryInstallationDeleted(\n  params: HandleSentryInstallationDeletedParams,\n): Promise<void> {\n  const installation = await markSentryInstallationDeleted(\n    {installationUuid: params.installationUuid},\n    {tx: params.tx},\n  );\n  if (installation?.connectionId) {\n    await params.updateConnectionLifecycleStatus(\n      {id: installation.connectionId, lifecycleStatus: 'disabled'},\n      {tx: params.tx},\n    );\n  }\n\n  await params.recordDeliveryOnly({\n    tx: params.tx,\n    provider: SENTRY_SOURCE,\n    deliveryId: params.deliveryId,\n  });\n}\n\n// A raw Sentry `ignored` action is normalized to `archived` before validation,\n// so legacy ignore events still fire `issue.archived` workflows.\nexport function normalizeSentryIssueAction(parsedJson: unknown): unknown {\n  if (typeof parsedJson !== 'object' || parsedJson === null) return parsedJson;\n  const obj = parsedJson as {action?: unknown};\n  if (obj.action === 'ignored') {\n    return {...obj, action: 'archived'};\n  }\n  return parsedJson;\n}\n\nfunction normalizeIssuePayload(payload: SentryIssueWebhookDto): SentryIssuePayload {\n  const issue = payload.data.issue;\n  return {\n    action: payload.action,\n    issueId: issue.id,\n    shortId: issue.shortId ?? null,\n    title: issue.title ?? DEFAULT_ISSUE_TITLE,\n    culprit: issue.culprit ?? null,\n    level: issue.level ?? null,\n    status: issue.status ?? null,\n    platform: issue.platform ?? null,\n    webUrl: issue.web_url ?? null,\n    issueUrl: issue.url ?? null,\n    projectUrl: issue.project_url ?? null,\n    firstSeenAt: issue.firstSeen ?? null,\n    lastSeenAt: issue.lastSeen ?? null,\n  };\n}\n"],"names":["logger","SentryConnectionNotFoundError","SentryInstallationDeletedError","SentryInstallationNotFoundError","SentryInstallationUnclaimedError","SentryIntegrationProviderError","hashAuthorizationCode","verifySentryInstallationBestEffort","claimSentryInstallationVerification","getSentryInstallationByInstallationUuid","markSentryInstallationDeleted","markSentryInstallationExchangeSucceeded","SENTRY_SOURCE","DEFAULT_ISSUE_TITLE","DELETED_STATUS","handleSentryIssueEvent","params","installationUuid","payload","installation","uuid","tx","status","connectionId","connection","getIntegrationConnectionById","publishIntegrationEventReceived","event","provider","source","slug","action","workspaceId","id","connectionName","displayName","deliveryId","receivedAt","Date","toISOString","normalizeIssuePayload","handleSentryInstallationCreated","existing","getSentryInstallation","debug","recordDelivery","code","orgSlug","warn","codeHash","claimed","authorization","sentry","exchangeAuthorizationCode","error","reason","current","concurrentAttemptSucceeded","completed","persistUnclaimedAndRecordDelivery","verifyInstall","token","handleSentryInstallationDeleted","updateConnectionLifecycleStatus","lifecycleStatus","recordDeliveryOnly","normalizeSentryIssueAction","parsedJson","obj","issue","data","issueId","shortId","title","culprit","level","platform","webUrl","web_url","issueUrl","url","projectUrl","project_url","firstSeenAt","firstSeen","lastSeenAt","lastSeen"],"mappings":"AASA,SAAQA,MAAM,QAAO,8BAA8B;AAEnD,SACEC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,+BAA+B,EAC/BC,gCAAgC,EAChCC,8BAA8B,QACzB,kBAAkB;AACzB,SAAQC,qBAAqB,EAAEC,kCAAkC,QAAO,mBAAmB;AAC3F,SACEC,mCAAmC,EACnCC,uCAAuC,EACvCC,6BAA6B,EAC7BC,uCAAuC,QAElC,uBAAuB;AAE9B,MAAMC,gBAAgB;AACtB,MAAMC,sBAAsB;AAC5B,MAAMC,iBAAiB;AAUvB,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,OAAO,eAAeC,uBAAuBC,MAAoC;IAC/E,MAAMC,mBAAmBD,OAAOE,OAAO,CAACC,YAAY,CAACC,IAAI;IAEzD,MAAMD,eAAe,MAAMV,wCAAwCQ,kBAAkB;QACnFI,IAAIL,OAAOK,EAAE;IACf;IACA,IAAI,CAACF,cAAc;QACjB,MAAM,IAAIhB,gCAAgCc;IAC5C;IACA,IAAIE,aAAaG,MAAM,KAAKR,gBAAgB;QAC1C,MAAM,IAAIZ,+BAA+Be;IAC3C;IACA,gFAAgF;IAChF,gFAAgF;IAChF,IAAI,CAACE,aAAaI,YAAY,EAAE;QAC9B,MAAM,IAAInB,iCAAiCa;IAC7C;IAEA,MAAMO,aAAa,MAAMR,OAAOS,4BAA4B,CAACN,aAAaI,YAAY,EAAE;QACtFF,IAAIL,OAAOK,EAAE;IACf;IACA,IAAI,CAACG,YAAY;QACf,MAAM,IAAIvB,8BAA8BkB,aAAaI,YAAY;IACnE;IAEA,MAAMP,OAAOU,+BAA+B,CAAC;QAC3CL,IAAIL,OAAOK,EAAE;QACbM,OAAO;YACLC,UAAUhB;YACViB,QAAQL,WAAWM,IAAI;YACvBH,OAAO,CAAC,MAAM,EAAEX,OAAOE,OAAO,CAACa,MAAM,EAAE;YACvCC,aAAaR,WAAWQ,WAAW;YACnCT,cAAcC,WAAWS,EAAE;YAC3BC,gBAAgBV,WAAWW,WAAW;YACtCC,YAAYpB,OAAOoB,UAAU;YAC7BC,YAAY,IAAIC,OAAOC,WAAW;YAClCrB,SAASsB,sBAAsBxB,OAAOE,OAAO;QAC/C;IACF;AACF;AA2BA;;;;;;;CAOC,GACD,OAAO,eAAeuB,gCACpBzB,MAA6C;IAE7C,MAAM0B,WAAW,MAAM1B,OAAO2B,qBAAqB,CAAC;QAAC1B,kBAAkBD,OAAOC,gBAAgB;IAAA;IAC9F,IAAIyB,YAAaA,CAAAA,SAASpB,MAAM,KAAK,eAAeoB,SAASpB,MAAM,KAAK,SAAQ,GAAI;QAClFtB,SAAS4C,KAAK,CACZ;YAACR,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,IAAI,CAACpB,OAAO8B,IAAI,IAAI,CAAC9B,OAAO+B,OAAO,EAAE;QACnC/C,SAASgD,IAAI,CACX;YAACZ,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,MAAMa,WAAW3C,sBAAsBU,OAAO8B,IAAI;IAClD,IAAII,UACFR,YACC,MAAMlC,oCAAoC;QACzCS,kBAAkBD,OAAOC,gBAAgB;QACzC8B,SAAS/B,OAAO+B,OAAO;QACvBE;IACF;IACF,IAAIC,QAAQ5B,MAAM,KAAK,eAAe4B,QAAQ5B,MAAM,KAAK,WAAW;QAClE,MAAMN,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IACA,IAAIc,QAAQD,QAAQ,KAAKA,UAAU;QACjCjD,SAASgD,IAAI,CACX;YAACZ,YAAYpB,OAAOoB,UAAU;YAAEnB,kBAAkBD,OAAOC,gBAAgB;QAAA,GACzE;QAEF,MAAMD,OAAO6B,cAAc,CAAC7B,OAAOoB,UAAU;QAC7C;IACF;IAEA,IAAIe;IACJ,IAAID,QAAQ5B,MAAM,KAAK,WAAW;QAChC,IAAI;YACF6B,gBAAgB,MAAMnC,OAAOoC,MAAM,CAACC,yBAAyB,CAAC;gBAC5DpC,kBAAkBD,OAAOC,gBAAgB;gBACzC6B,MAAM9B,OAAO8B,IAAI;YACnB;QACF,EAAE,OAAOQ,OAAO;YACd,IAAI,CAAEA,CAAAA,iBAAiBjD,8BAA6B,KAAMiD,MAAMC,MAAM,KAAK,iBAAiB;gBAC1F,MAAMD;YACR;YAEA,MAAME,UAAU,MAAMxC,OAAO2B,qBAAqB,CAAC;gBACjD1B,kBAAkBD,OAAOC,gBAAgB;YAC3C;YACA,MAAMwC,6BACJD,SAASP,aAAaA,YACrBO,CAAAA,QAAQlC,MAAM,KAAK,wBAAwBkC,QAAQlC,MAAM,KAAK,WAAU;YAC3E,IAAI,CAACkC,WAAW,CAACC,4BAA4B,MAAMH;YACnDJ,UAAUM;QACZ;QAEA,IAAIL,eAAe;YACjB,MAAMxC,wCAAwC;gBAC5CM,kBAAkBD,OAAOC,gBAAgB;gBACzCgC;YACF;QACF;IACF;IAEA,MAAMS,YAAY,MAAM1C,OAAO2C,iCAAiC,CAAC;QAC/D1C,kBAAkBD,OAAOC,gBAAgB;QACzC8B,SAASG,QAAQH,OAAO;QACxBE;QACAb,YAAYpB,OAAOoB,UAAU;IAC/B;IACA,IAAIe,iBAAiBO,UAAUpC,MAAM,KAAK,eAAeN,OAAO4C,aAAa,EAAE;QAC7E,MAAMrD,mCAAmC;YACvC6C,QAAQpC,OAAOoC,MAAM;YACrBnC,kBAAkBD,OAAOC,gBAAgB;YACzC4C,OAAOV,cAAcU,KAAK;QAC5B;IACF;AACF;AAUA,+EAA+E;AAC/E,6EAA6E;AAC7E,mEAAmE;AACnE,OAAO,eAAeC,gCACpB9C,MAA6C;IAE7C,MAAMG,eAAe,MAAMT,8BACzB;QAACO,kBAAkBD,OAAOC,gBAAgB;IAAA,GAC1C;QAACI,IAAIL,OAAOK,EAAE;IAAA;IAEhB,IAAIF,cAAcI,cAAc;QAC9B,MAAMP,OAAO+C,+BAA+B,CAC1C;YAAC9B,IAAId,aAAaI,YAAY;YAAEyC,iBAAiB;QAAU,GAC3D;YAAC3C,IAAIL,OAAOK,EAAE;QAAA;IAElB;IAEA,MAAML,OAAOiD,kBAAkB,CAAC;QAC9B5C,IAAIL,OAAOK,EAAE;QACbO,UAAUhB;QACVwB,YAAYpB,OAAOoB,UAAU;IAC/B;AACF;AAEA,+EAA+E;AAC/E,iEAAiE;AACjE,OAAO,SAAS8B,2BAA2BC,UAAmB;IAC5D,IAAI,OAAOA,eAAe,YAAYA,eAAe,MAAM,OAAOA;IAClE,MAAMC,MAAMD;IACZ,IAAIC,IAAIrC,MAAM,KAAK,WAAW;QAC5B,OAAO;YAAC,GAAGqC,GAAG;YAAErC,QAAQ;QAAU;IACpC;IACA,OAAOoC;AACT;AAEA,SAAS3B,sBAAsBtB,OAA8B;IAC3D,MAAMmD,QAAQnD,QAAQoD,IAAI,CAACD,KAAK;IAChC,OAAO;QACLtC,QAAQb,QAAQa,MAAM;QACtBwC,SAASF,MAAMpC,EAAE;QACjBuC,SAASH,MAAMG,OAAO,IAAI;QAC1BC,OAAOJ,MAAMI,KAAK,IAAI5D;QACtB6D,SAASL,MAAMK,OAAO,IAAI;QAC1BC,OAAON,MAAMM,KAAK,IAAI;QACtBrD,QAAQ+C,MAAM/C,MAAM,IAAI;QACxBsD,UAAUP,MAAMO,QAAQ,IAAI;QAC5BC,QAAQR,MAAMS,OAAO,IAAI;QACzBC,UAAUV,MAAMW,GAAG,IAAI;QACvBC,YAAYZ,MAAMa,WAAW,IAAI;QACjCC,aAAad,MAAMe,SAAS,IAAI;QAChCC,YAAYhB,MAAMiB,QAAQ,IAAI;IAChC;AACF"}

package/dist/db/db.d.ts

@@ -77,7 +77,7 @@ export declare const schema: {
                 tableName: "installations";
                 dataType: "string";
                 columnType: "PgText";
-                data: string;
+                data: import("./installations.js").SentryInstallationRowStatus;
                 driverParam: string;
                 notNull: true;
                 hasDefault: false;
@@ -88,7 +88,9 @@ export declare const schema: {
                 baseColumn: never;
                 identity: undefined;
                 generated: undefined;
-            }, {}, {}>;
+            }, {}, {
+                $type: import("./installations.js").SentryInstallationRowStatus;
+            }>;
             codeHash: import("drizzle-orm/pg-core").PgColumn<{
                 name: "code_hash";
                 tableName: "installations";
@@ -239,7 +241,7 @@ export declare function db(): NodePgDatabase<{
                 tableName: "installations";
                 dataType: "string";
                 columnType: "PgText";
-                data: string;
+                data: import("./installations.js").SentryInstallationRowStatus;
                 driverParam: string;
                 notNull: true;
                 hasDefault: false;
@@ -250,7 +252,9 @@ export declare function db(): NodePgDatabase<{
                 baseColumn: never;
                 identity: undefined;
                 generated: undefined;
-            }, {}, {}>;
+            }, {}, {
+                $type: import("./installations.js").SentryInstallationRowStatus;
+            }>;
             codeHash: import("drizzle-orm/pg-core").PgColumn<{
                 name: "code_hash";
                 tableName: "installations";

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAInE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAElB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAInE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAElB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/installations.d.ts

@@ -1,10 +1,11 @@
 export type SentryInstallationStatus = 'installed' | 'deleted';
+export type SentryInstallationRowStatus = 'pending' | 'exchange-succeeded' | SentryInstallationStatus;
 export interface SentryInstallation {
     id: string;
     connectionId: string | null;
     installationUuid: string;
     orgSlug: string;
-    status: string;
+    status: SentryInstallationRowStatus;
     codeHash: string | null;
     installerUserId: string | null;
     createdAt: Date;
@@ -23,24 +24,43 @@ export interface PersistVerifiedUnclaimedInstallationParams {
     orgSlug: string;
     codeHash: string;
 }
+export interface ClaimSentryInstallationVerificationParams {
+    installationUuid: string;
+    orgSlug: string;
+    codeHash: string;
+}
 export declare function upsertSentryInstallation(params: UpsertSentryInstallationParams, options?: {
     tx?: unknown;
 }): Promise<SentryInstallation>;
 /**
  * Inserts the verified-but-unclaimed install half (`connection_id = NULL`,
  * `status = 'installed'`) after a successful code exchange. Idempotent on the
- * installation uuid: a conflicting row refreshes only `code_hash`/`org_slug`/
- * `updated_at`, so a webhook that lands after a claim never clobbers the
- * `connection_id` it set nor downgrades a `deleted` tombstone back to installed.
+ * installation uuid: a pending row becomes installed, a claimed row keeps its
+ * `connection_id`, and a deleted tombstone never becomes installed again.
  */
 export declare function persistVerifiedUnclaimedInstallation(params: PersistVerifiedUnclaimedInstallationParams, options?: {
     tx?: unknown;
 }): Promise<SentryInstallation>;
+export declare function claimSentryInstallationVerification(params: ClaimSentryInstallationVerificationParams, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation>;
+export declare function completeSentryInstallationVerification(params: {
+    installationUuid: string;
+    codeHash: string;
+}, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation | undefined>;
+export declare function markSentryInstallationExchangeSucceeded(params: {
+    installationUuid: string;
+    codeHash: string;
+}, options?: {
+    tx?: unknown;
+}): Promise<SentryInstallation | undefined>;
 /**
- * Verified installs no user has claimed yet (`connection_id IS NULL`,
- * `status='installed'`). Tombstoned rows are excluded so the TTL cron stays
- * idempotent and the unclaimed metric stays accurate. Pass `olderThan` to scope
- * to stale rows for the cron.
+ * Install claims no user has bound to a connection yet. This includes pending
+ * and exchanged claims so abandoned verification work remains observable.
+ * Tombstoned rows are excluded. Pass `olderThan` to scope by the most recent
+ * state transition for retention work.
  */
 export declare function listUnclaimedSentryInstallations(params?: {
     olderThan?: Date;
@@ -54,21 +74,23 @@ export declare function getSentryInstallationByConnectionId(connectionId: string
     tx?: unknown;
 }): Promise<SentryInstallation | undefined>;
 /**
- * Tombstones verified-unclaimed installs older than `olderThan` (the TTL cleanup
- * cron). Bounds a never-claimed install rather than leaving it pending forever.
- * Returns how many rows were tombstoned. We hold no Sentry token for these rows
- * (tokens are never persisted), so the Sentry-side uninstall is out of scope here.
+ * Releases abandoned pending claims and tombstones verified-unclaimed installs
+ * older than `olderThan`. Pending claims have not durably completed an exchange,
+ * so deleting them allows a later signed creation to try again. Exchanged and
+ * installed rows stay terminal after expiry. We hold no Sentry token for these
+ * rows, so the Sentry-side uninstall is out of scope here.
  */
 export declare function pruneUnclaimedSentryInstallations(params: {
     olderThan: Date;
 }, options?: {
     tx?: unknown;
 }): Promise<{
+    releasedPending: number;
     tombstoned: number;
 }>;
 export declare function markSentryInstallationDeleted(params: {
     installationUuid: string;
 }, options?: {
     tx?: unknown;
-}): Promise<SentryInstallation | undefined>;
+}): Promise<SentryInstallation>;
 //# sourceMappingURL=installations.d.ts.map

package/dist/db/installations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,0CAA0C;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED;;;;;;GAMG;AACH,wBAAsB,oCAAoC,CACxD,MAAM,EAAE,0CAA0C,EAClD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAwB7B;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,MAAM,GAAE;IAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAAM,EAC/B,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAc/B;AAED,wBAAsB,uCAAuC,CAC3D,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAUzC;AAED,wBAAsB,mCAAmC,CACvD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAUzC;AAED;;;;;GAKG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,EACzB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAC,CAa/B;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,EAClC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CASzC"}
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,SAAS,CAAC;AAC/D,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,oBAAoB,GACpB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,2BAA2B,CAAC;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,0CAA0C;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yCAAyC;IACxD,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgC7B;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,MAAM,EAAE,0CAA0C,EAClD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgC7B;AAED,wBAAsB,mCAAmC,CACvD,MAAM,EAAE,yCAAyC,EACjD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,sCAAsC,CAC1D,MAAM,EAAE;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EACpD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAezC;AAED,wBAAsB,uCAAuC,CAC3D,MAAM,EAAE;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,EACpD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAezC;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,MAAM,GAAE;IAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAAM,EAC/B,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAc/B;AAED,wBAAsB,uCAAuC,CAC3D,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAUzC;AAED,wBAAsB,mCAAmC,CACvD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAUzC;AAED;;;;;;GAMG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,EACzB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAC,CAyBxD;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAC,EAClC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAmB7B"}

package/dist/db/installations.js

@@ -1,4 +1,4 @@
-import { and, eq, isNull, lt, sql } from 'drizzle-orm';
+import { and, eq, inArray, isNull, lt, ne, sql } from 'drizzle-orm';
 import { SentryInstallationAlreadyLinkedError } from '#core/errors.js';
 import { db } from './db.js';
 import { sentryInstallations, toSentryInstallation } from './schema/installations.js';
@@ -14,15 +14,10 @@ export async function upsertSentryInstallation(params, options = {}) {
         installerUserId: params.installerUserId ?? null
     }).onConflictDoUpdate({
         target: sentryInstallations.installationUuid,
-        // TOCTOU guard: allow the update only when this installation is unclaimed
-        // (connection_id IS NULL, the first claim of a verified-unclaimed row) or
-        // already owned by this same connection (idempotent reconnect). A concurrent
-        // claim of the same installation to a different workspace commits its own
-        // connection_id first; this losing transaction then sees a different non-null
-        // connection_id, the predicate is false, Postgres updates nothing, and the
-        // empty RETURNING below rolls it back instead of silently repointing the
-        // installation (cross-tenant event misroute).
-        setWhere: sql`${sentryInstallations.connectionId} is null or ${sentryInstallations.connectionId} = ${params.connectionId}`,
+        // A deleted UUID is terminal. Otherwise, allow the first claim of an
+        // unclaimed row or an idempotent reconnect by its current connection. This
+        // blocks both a concurrent cross-workspace claim and a claim racing deletion.
+        setWhere: sql`${sentryInstallations.status} <> 'deleted' and (${sentryInstallations.connectionId} is null or ${sentryInstallations.connectionId} = ${params.connectionId})`,
         set: {
             connectionId: params.connectionId,
             orgSlug: params.orgSlug,
@@ -38,9 +33,8 @@ export async function upsertSentryInstallation(params, options = {}) {
 /**
  * Inserts the verified-but-unclaimed install half (`connection_id = NULL`,
  * `status = 'installed'`) after a successful code exchange. Idempotent on the
- * installation uuid: a conflicting row refreshes only `code_hash`/`org_slug`/
- * `updated_at`, so a webhook that lands after a claim never clobbers the
- * `connection_id` it set nor downgrades a `deleted` tombstone back to installed.
+ * installation uuid: a pending row becomes installed, a claimed row keeps its
+ * `connection_id`, and a deleted tombstone never becomes installed again.
  */ export async function persistVerifiedUnclaimedInstallation(params, options = {}) {
     const executor = options.tx ?? db();
     const now = new Date();
@@ -52,28 +46,76 @@ export async function upsertSentryInstallation(params, options = {}) {
         codeHash: params.codeHash
     }).onConflictDoUpdate({
         target: sentryInstallations.installationUuid,
+        setWhere: ne(sentryInstallations.status, 'deleted'),
         set: {
             orgSlug: params.orgSlug,
+            status: 'installed',
             codeHash: params.codeHash,
             updatedAt: now
         }
     }).returning();
-    if (!row) throw new Error('Sentry installation persist returned no rows');
+    if (!row) {
+        const existing = await getSentryInstallationByInstallationUuid(params.installationUuid, {
+            tx: executor
+        });
+        if (existing) return existing;
+        throw new Error('Sentry installation persist returned no rows');
+    }
+    return toSentryInstallation(row);
+}
+export async function claimSentryInstallationVerification(params, options = {}) {
+    const executor = options.tx ?? db();
+    const [inserted] = await executor.insert(sentryInstallations).values({
+        connectionId: null,
+        installationUuid: params.installationUuid,
+        orgSlug: params.orgSlug,
+        status: 'pending',
+        codeHash: params.codeHash
+    }).onConflictDoNothing({
+        target: sentryInstallations.installationUuid
+    }).returning();
+    if (inserted) return toSentryInstallation(inserted);
+    const existing = await getSentryInstallationByInstallationUuid(params.installationUuid, {
+        tx: executor
+    });
+    if (!existing) throw new Error('Sentry installation verification claim returned no rows');
+    return existing;
+}
+export async function completeSentryInstallationVerification(params, options = {}) {
+    const executor = options.tx ?? db();
+    const [row] = await executor.update(sentryInstallations).set({
+        status: 'installed',
+        updatedAt: new Date()
+    }).where(and(eq(sentryInstallations.installationUuid, params.installationUuid), eq(sentryInstallations.status, 'exchange-succeeded'), eq(sentryInstallations.codeHash, params.codeHash))).returning();
+    if (!row) return undefined;
+    return toSentryInstallation(row);
+}
+export async function markSentryInstallationExchangeSucceeded(params, options = {}) {
+    const executor = options.tx ?? db();
+    const [row] = await executor.update(sentryInstallations).set({
+        status: 'exchange-succeeded',
+        updatedAt: new Date()
+    }).where(and(eq(sentryInstallations.installationUuid, params.installationUuid), eq(sentryInstallations.status, 'pending'), eq(sentryInstallations.codeHash, params.codeHash))).returning();
+    if (!row) return undefined;
     return toSentryInstallation(row);
 }
 /**
- * Verified installs no user has claimed yet (`connection_id IS NULL`,
- * `status='installed'`). Tombstoned rows are excluded so the TTL cron stays
- * idempotent and the unclaimed metric stays accurate. Pass `olderThan` to scope
- * to stale rows for the cron.
+ * Install claims no user has bound to a connection yet. This includes pending
+ * and exchanged claims so abandoned verification work remains observable.
+ * Tombstoned rows are excluded. Pass `olderThan` to scope by the most recent
+ * state transition for retention work.
  */ export async function listUnclaimedSentryInstallations(params = {}, options = {}) {
     const executor = options.tx ?? db();
     const conditions = [
         isNull(sentryInstallations.connectionId),
-        eq(sentryInstallations.status, 'installed')
+        inArray(sentryInstallations.status, [
+            'pending',
+            'exchange-succeeded',
+            'installed'
+        ])
     ];
     if (params.olderThan) {
-        conditions.push(lt(sentryInstallations.createdAt, params.olderThan));
+        conditions.push(lt(sentryInstallations.updatedAt, params.olderThan));
     }
     const rows = await executor.select().from(sentryInstallations).where(and(...conditions));
     return rows.map(toSentryInstallation);
@@ -93,27 +135,43 @@ export async function getSentryInstallationByConnectionId(connectionId, options
     return toSentryInstallation(row);
 }
 /**
- * Tombstones verified-unclaimed installs older than `olderThan` (the TTL cleanup
- * cron). Bounds a never-claimed install rather than leaving it pending forever.
- * Returns how many rows were tombstoned. We hold no Sentry token for these rows
- * (tokens are never persisted), so the Sentry-side uninstall is out of scope here.
+ * Releases abandoned pending claims and tombstones verified-unclaimed installs
+ * older than `olderThan`. Pending claims have not durably completed an exchange,
+ * so deleting them allows a later signed creation to try again. Exchanged and
+ * installed rows stay terminal after expiry. We hold no Sentry token for these
+ * rows, so the Sentry-side uninstall is out of scope here.
  */ export async function pruneUnclaimedSentryInstallations(params, options = {}) {
     const executor = options.tx ?? db();
-    const result = await executor.update(sentryInstallations).set({
+    const releasedPending = await executor.delete(sentryInstallations).where(and(isNull(sentryInstallations.connectionId), eq(sentryInstallations.status, 'pending'), lt(sentryInstallations.updatedAt, params.olderThan)));
+    const tombstoned = await executor.update(sentryInstallations).set({
         status: 'deleted',
         updatedAt: new Date()
-    }).where(and(isNull(sentryInstallations.connectionId), eq(sentryInstallations.status, 'installed'), lt(sentryInstallations.createdAt, params.olderThan)));
+    }).where(and(isNull(sentryInstallations.connectionId), inArray(sentryInstallations.status, [
+        'exchange-succeeded',
+        'installed'
+    ]), lt(sentryInstallations.updatedAt, params.olderThan)));
     return {
-        tombstoned: result.rowCount ?? 0
+        releasedPending: releasedPending.rowCount ?? 0,
+        tombstoned: tombstoned.rowCount ?? 0
     };
 }
 export async function markSentryInstallationDeleted(params, options = {}) {
     const executor = options.tx ?? db();
-    const [row] = await executor.update(sentryInstallations).set({
+    const [row] = await executor.insert(sentryInstallations).values({
+        connectionId: null,
+        installationUuid: params.installationUuid,
+        // A reordered delete can arrive without organization data. Deleted rows never expose an organization URL.
+        orgSlug: '',
         status: 'deleted',
-        updatedAt: new Date()
-    }).where(eq(sentryInstallations.installationUuid, params.installationUuid)).returning();
-    if (!row) return undefined;
+        codeHash: null
+    }).onConflictDoUpdate({
+        target: sentryInstallations.installationUuid,
+        set: {
+            status: 'deleted',
+            updatedAt: new Date()
+        }
+    }).returning();
+    if (!row) throw new Error('Sentry installation deletion returned no rows');
     return toSentryInstallation(row);
 }