feat(integrations): add sentry Stripe catalog provider

crates/stackless-integrations/src/providers/mod.rs

@@ -1,18 +1,14 @@
 pub mod clerk;
 pub mod cloudflare;
+pub mod sentry;
 
 #[cfg(test)]
 mod tests {
     use stackless_provider_sdk::CatalogResource;
     use stackless_provider_sdk::Hostable;
 
-    use crate::providers::cloudflare;
+    use crate::providers::{cloudflare, sentry};
 
-    /// `Hostable::OUTPUTS` (the names referenceable as `${integrations.*.<out>}`)
-    /// must stay in lockstep with the names column of `OUTPUT_FIELDS` — the two
-    /// are co-located but hand-written, so this makes drift a test failure rather
-    /// than a silent validation bug. Bespoke providers (Clerk) aren't
-    /// `CatalogResource`, so they're out of scope here by construction.
     fn assert_outputs_match<T: CatalogResource>() {
         let fields: Vec<&str> = T::OUTPUT_FIELDS.iter().map(|(_, name, _)| *name).collect();
         let outputs: Vec<&str> = <T as Hostable>::OUTPUTS.to_vec();
@@ -34,5 +30,7 @@ mod tests {
         assert_outputs_match::<cloudflare::workers::CloudflareWorkers>();
         assert_outputs_match::<cloudflare::workers_ai::CloudflareWorkersAi>();
         assert_outputs_match::<cloudflare::browser_run::CloudflareBrowserRun>();
+        assert_outputs_match::<sentry::project::SentryProject>();
+        assert_outputs_match::<sentry::seer::SentrySeer>();
     }
 }

crates/stackless-integrations/src/providers/sentry/mod.rs

@@ -0,0 +1,12 @@
+//! Sentry catalog resources via Stripe Projects.
+//!
+//! Output envelopes are provisional until pinned by `xtask discover`.
+
+pub mod project;
+pub mod seer;
+
+#[allow(unused_imports)]
+pub(crate) use crate::resource::{
+    CatalogResource as FamilyResource, bool_optional, bool_required, int_optional, int_required,
+    integration_config, interp_optional, interp_required,
+};

crates/stackless-integrations/src/providers/sentry/project.rs

@@ -0,0 +1,144 @@
+//! `sentry/project` integration.
+
+use std::collections::BTreeMap;
+
+use serde::Serialize;
+use stackless_stripe_projects::catalog::verify::CatalogService;
+use stackless_stripe_projects::provision::ProvisionContext;
+
+use super::FamilyResource;
+use crate::error::IntegrationError;
+use crate::hostable::{ConfigScope, Hostable, IntegrationHosting};
+
+pub const RESOURCE_KIND: &str = "integration-sentry";
+
+#[derive(Debug, Serialize)]
+pub struct SentryProjectConfig {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub platform: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_name: Option<String>,
+}
+
+impl CatalogService for SentryProjectConfig {
+    const REFERENCE: &'static str = "sentry/project";
+}
+
+#[derive(Debug)]
+pub struct SentryProject;
+
+impl Hostable for SentryProject {
+    const PROVIDER: &'static str = "sentry";
+    const HOSTING: IntegrationHosting = IntegrationHosting::Managed;
+    const CONFIG_SCOPE: ConfigScope = ConfigScope::GlobalOnly;
+    const RESOURCE_KIND: &'static str = RESOURCE_KIND;
+    const OUTPUTS: &'static [&'static str] = &["dsn"];
+}
+
+impl FamilyResource for SentryProject {
+    type Config = SentryProjectConfig;
+    const PROVIDER_PREFIX: &'static str = "SENTRY";
+    // Provisional until pinned by `mise run discover sentry/project`.
+    const OUTPUT_FIELDS: &'static [(&'static str, &'static str, bool)] = &[("DSN", "dsn", true)];
+
+    fn build_config(ctx: &ProvisionContext<'_>) -> Result<SentryProjectConfig, IntegrationError> {
+        let config = super::integration_config(ctx)?;
+        Ok(SentryProjectConfig {
+            platform: super::interp_optional(ctx, &config, "platform")?,
+            project_name: super::interp_optional(ctx, &config, "project_name")?,
+        })
+    }
+}
+
+pub fn validate_config(
+    name: &str,
+    config: &BTreeMap<String, toml::Value>,
+) -> Result<(), IntegrationError> {
+    let _ = (name, config);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ProviderOps;
+    use crate::resource::ResourcePayload;
+    use stackless_core::def::StackDef;
+    use stackless_stripe_projects::stripe::StripeProjects;
+    use stackless_stripe_projects::test_support;
+
+    #[test]
+    fn config_matches_catalog() {
+        const FIXTURE: &str = include_str!(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/../stackless-stripe-projects/tests/fixtures/catalog.json"
+        ));
+        let catalog = stackless_stripe_projects::Catalog::from_json_envelope(FIXTURE).unwrap();
+        let failures = stackless_stripe_projects::verify_service(
+            &catalog,
+            &SentryProjectConfig {
+                platform: None,
+                project_name: None,
+            },
+        );
+        assert!(
+            failures.is_empty(),
+            "sentry/project catalog gaps:\n{}",
+            failures.join("\n")
+        );
+    }
+
+    const CATALOG_ENVELOPE: &str = r##"{"ok":true,"command":"projects catalog","data":{"last_updated":"2026-07-11T00:00:00Z","services":[{"id":"prvsvc_project","object":"v2.provisioning.provider_service_detail","provider_id":"prvdr_sentry","provider_name":"Sentry","service_id":"project","categories":["database"],"kind":"deployable","scope":"project","availability":"available","development":false,"livemode":true,"pricing":{"type":"component"},"configuration_schema":{"properties":{"platform":{"description":"Platform/language (e.g. python, javascript, node, react)","type":"string"},"project_name":{"description":"Name for the Sentry project","type":"string"}},"type":"object"}}]}}"##;
+
+    fn test_def() -> StackDef {
+        StackDef::parse(
+            r#"
+[stack]
+name = "atto"
+[stack.projects.stripe]
+project = "project_1"
+[integrations.res]
+provider = "sentry"
+[services.api]
+source = { repo = "r", ref = "main" }
+env = { OUT = "${integrations.res.dsn}" }
+health = { path = "/health" }
+[services.api.local]
+run = "true"
+"#,
+        )
+        .unwrap()
+    }
+
+    #[tokio::test]
+    async fn provision_records_outputs() {
+        let runner = test_support::provision_script(
+            CATALOG_ENVELOPE,
+            serde_json::json!({"SENTRY_DSN": "val_dsn"}),
+            0,
+        );
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("stackless.toml"),
+            "[stack]\nname=\"atto\"\n",
+        )
+        .unwrap();
+        let stripe = StripeProjects::new(&runner, dir.path());
+
+        let resource = SentryProject
+            .provision(
+                &stripe.as_dyn(),
+                &test_def(),
+                dir.path(),
+                "demo",
+                "res",
+                "local",
+                false,
+            )
+            .await
+            .unwrap();
+        assert_eq!(resource.resource_kind, "integration-sentry");
+        let payload: ResourcePayload = serde_json::from_str(&resource.payload).unwrap();
+        assert_eq!(payload.outputs["dsn"], "val_dsn");
+    }
+}

crates/stackless-integrations/src/providers/sentry/seer.rs

@@ -0,0 +1,131 @@
+//! `sentry/seer` integration.
+
+use std::collections::BTreeMap;
+
+use serde::Serialize;
+use stackless_stripe_projects::catalog::verify::CatalogService;
+use stackless_stripe_projects::provision::ProvisionContext;
+
+use super::FamilyResource;
+use crate::error::IntegrationError;
+use crate::hostable::{ConfigScope, Hostable, IntegrationHosting};
+
+pub const RESOURCE_KIND: &str = "integration-sentry-seer";
+
+#[derive(Debug, Serialize)]
+pub struct SentrySeerConfig {}
+
+impl CatalogService for SentrySeerConfig {
+    const REFERENCE: &'static str = "sentry/seer";
+}
+
+#[derive(Debug)]
+pub struct SentrySeer;
+
+impl Hostable for SentrySeer {
+    const PROVIDER: &'static str = "sentry-seer";
+    const HOSTING: IntegrationHosting = IntegrationHosting::Managed;
+    const CONFIG_SCOPE: ConfigScope = ConfigScope::GlobalOnly;
+    const RESOURCE_KIND: &'static str = RESOURCE_KIND;
+    const OUTPUTS: &'static [&'static str] = &["auth_token"];
+}
+
+impl FamilyResource for SentrySeer {
+    type Config = SentrySeerConfig;
+    const PROVIDER_PREFIX: &'static str = "SENTRY";
+    // Provisional until pinned by `mise run discover sentry/seer`.
+    const OUTPUT_FIELDS: &'static [(&'static str, &'static str, bool)] =
+        &[("AUTH_TOKEN", "auth_token", true)];
+
+    fn build_config(ctx: &ProvisionContext<'_>) -> Result<SentrySeerConfig, IntegrationError> {
+        let _ = super::integration_config(ctx)?;
+        Ok(SentrySeerConfig {})
+    }
+}
+
+pub fn validate_config(
+    name: &str,
+    config: &BTreeMap<String, toml::Value>,
+) -> Result<(), IntegrationError> {
+    let _ = (name, config);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ProviderOps;
+    use crate::resource::ResourcePayload;
+    use stackless_core::def::StackDef;
+    use stackless_stripe_projects::stripe::StripeProjects;
+    use stackless_stripe_projects::test_support;
+
+    #[test]
+    fn config_matches_catalog() {
+        const FIXTURE: &str = include_str!(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/../stackless-stripe-projects/tests/fixtures/catalog.json"
+        ));
+        let catalog = stackless_stripe_projects::Catalog::from_json_envelope(FIXTURE).unwrap();
+        let failures = stackless_stripe_projects::verify_service(&catalog, &SentrySeerConfig {});
+        assert!(
+            failures.is_empty(),
+            "sentry/seer catalog gaps:\n{}",
+            failures.join("\n")
+        );
+    }
+
+    const CATALOG_ENVELOPE: &str = r##"{"ok":true,"command":"projects catalog","data":{"last_updated":"2026-07-11T00:00:00Z","services":[{"id":"prvsvc_seer","object":"v2.provisioning.provider_service_detail","provider_id":"prvdr_sentry","provider_name":"Sentry","service_id":"seer","categories":["database"],"kind":"deployable","scope":"project","availability":"available","development":false,"livemode":true,"pricing":{"type":"component"},"configuration_schema":{"type":"object","required":[],"additionalProperties":false,"properties":{}}}]}}"##;
+
+    fn test_def() -> StackDef {
+        StackDef::parse(
+            r#"
+[stack]
+name = "atto"
+[stack.projects.stripe]
+project = "project_1"
+[integrations.res]
+provider = "sentry-seer"
+[services.api]
+source = { repo = "r", ref = "main" }
+env = { OUT = "${integrations.res.auth_token}" }
+health = { path = "/health" }
+[services.api.local]
+run = "true"
+"#,
+        )
+        .unwrap()
+    }
+
+    #[tokio::test]
+    async fn provision_records_outputs() {
+        let runner = test_support::provision_script(
+            CATALOG_ENVELOPE,
+            serde_json::json!({"SENTRY_AUTH_TOKEN": "val_auth_token"}),
+            0,
+        );
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("stackless.toml"),
+            "[stack]\nname=\"atto\"\n",
+        )
+        .unwrap();
+        let stripe = StripeProjects::new(&runner, dir.path());
+
+        let resource = SentrySeer
+            .provision(
+                &stripe.as_dyn(),
+                &test_def(),
+                dir.path(),
+                "demo",
+                "res",
+                "local",
+                false,
+            )
+            .await
+            .unwrap();
+        assert_eq!(resource.resource_kind, "integration-sentry-seer");
+        let payload: ResourcePayload = serde_json::from_str(&resource.payload).unwrap();
+        assert_eq!(payload.outputs["auth_token"], "val_auth_token");
+    }
+}

crates/stackless-integrations/src/registry.rs

@@ -76,6 +76,8 @@ register_providers! {
     (cloudflare::workers, CloudflareWorkers),
     (cloudflare::workers_ai, CloudflareWorkersAi),
     (cloudflare::browser_run, CloudflareBrowserRun),
+    (sentry::project, SentryProject),
+    (sentry::seer, SentrySeer),
 }
 
 fn lookup(provider: &str) -> Option<&'static ProviderEntry> {

crates/stackless-provider-sdk/src/resource.rs

@@ -249,6 +249,48 @@ pub fn int_required(
         })
 }
 
+/// Read an optional integer field from the effective config.
+pub fn int_optional(
+    ctx: &ProvisionContext<'_>,
+    config: &BTreeMap<String, toml::Value>,
+    key: &str,
+) -> Result<Option<i64>, IntegrationError> {
+    match config.get(key) {
+        None => Ok(None),
+        Some(value) => value
+            .as_integer()
+            .map(Some)
+            .ok_or_else(|| cfg_invalid(ctx, key, format!("{key} must be an integer when set"))),
+    }
+}
+
+/// Read a required boolean field from the effective config.
+pub fn bool_required(
+    ctx: &ProvisionContext<'_>,
+    config: &BTreeMap<String, toml::Value>,
+    key: &str,
+) -> Result<bool, IntegrationError> {
+    config
+        .get(key)
+        .and_then(toml::Value::as_bool)
+        .ok_or_else(|| cfg_invalid(ctx, key, format!("{key} is required and must be a boolean")))
+}
+
+/// Read an optional boolean field from the effective config.
+pub fn bool_optional(
+    ctx: &ProvisionContext<'_>,
+    config: &BTreeMap<String, toml::Value>,
+    key: &str,
+) -> Result<Option<bool>, IntegrationError> {
+    match config.get(key) {
+        None => Ok(None),
+        Some(value) => value
+            .as_bool()
+            .map(Some)
+            .ok_or_else(|| cfg_invalid(ctx, key, format!("{key} must be a boolean when set"))),
+    }
+}
+
 fn cfg_invalid(ctx: &ProvisionContext<'_>, key: &str, detail: String) -> IntegrationError {
     IntegrationError::ConfigInvalid {
         location: format!("integrations.{}.{key}", ctx.logical_name),

docs/ADDING-A-PROVIDER.md

@@ -1,5 +1,8 @@
 # Adding a provider
 
+For parallel catalog rollouts (waves, merge gates, exclusions), see
+[PROVIDER-WAVES.md](PROVIDER-WAVES.md).
+
 stackless has two provider families. Adding one touches **exactly one
 registration site** plus the provider's own module/crate — the engine, core, and
 sibling providers stay untouched (core never names a provider).