@volter/twin-sentry 0.1.0

package/dist/src/sentry-twin.js

@@ -0,0 +1,1739 @@
+// Sentry twin REQUEST HANDLER — the canonical Sentry API surface for the twin. Two API
+// families share one handler:
+//   1. INGESTION (the SDK side):   POST /api/:projectId/store/  and  /api/:projectId/envelope/
+//      — `@sentry/node` POSTs captured events here; the twin groups them into issues.
+//   2. WEB API (the dashboard side, /api/0/...): issues, events, projects, project keys,
+//      releases, deploys, organizations, teams, alert rules.
+//
+// Contract: handleSentryTwinRequest({ method, path, body, headers, readOnly }) -> {status,
+// body}. State is the kernel event/action log (D1); reads are the projection. No real
+// Sentry is ever called (D4). An unmodeled operation FAILS LIKE SENTRY (4xx JSON error),
+// never a fabricated success (D2). readOnly rejects writes (D3).
+import { applyTwinWrite, projectResources, subjectHistory } from '@volter/world-core';
+import { ensureDefaultProject, envelopeAttachments, envelopeEvents, envelopeSessions, hashFingerprint, ingestEvent, parseEnvelope, persistEventAttachments, persistSessions, resolveProjectKey, resolvePublicKey, } from "./sentry-ingest.js";
+import { emitIssueAlert } from "./sentry-events.js";
+const SERVICE = 'sentry';
+// Sentry's error envelope shape: { detail: "<message>" } with the appropriate HTTP status.
+function err(detail, status = 404) {
+    return { status, body: { detail } };
+}
+function rows(type, root) {
+    return projectResources(SERVICE, root).filter((r) => r.type === type);
+}
+function getRow(type, id, root) {
+    return rows(type, root).find((r) => r.id === id);
+}
+// Project resource view: Sentry's project object (drop kernel meta + twin-internal fields).
+function projectView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+// Issue view: Sentry's issue object. `count` is a string (Sentry serializes it as one).
+function issueView(r) {
+    const { type: _t, updatedAt: _u, metadataType: _m, ...rest } = r;
+    return {
+        ...rest,
+        id: r.id,
+        count: String(r.count ?? '0'),
+        permalink: `/organizations/${r.projectSlug ?? 'org'}/issues/${r.id}/`,
+    };
+}
+function eventView(r) {
+    const { type: _t, updatedAt: _u, ...rest } = r;
+    const exception = rest['entries:exception'];
+    const { ['entries:exception']: _ex, ...flat } = rest;
+    return {
+        ...flat,
+        id: r.id,
+        entries: exception ? [{ type: 'exception', data: { values: exception } }] : [],
+    };
+}
+// ── List helpers ─────────────────────────────────────────────────────────────────
+function parseQuery(path) {
+    const i = path.indexOf('?');
+    if (i === -1)
+        return { path, params: new URLSearchParams() };
+    return { path: path.slice(0, i), params: new URLSearchParams(path.slice(i + 1)) };
+}
+// Sentry's issue `query` mini-DSL (subset): `is:unresolved|resolved|ignored`,
+// `level:error`, and free text matched against the issue title. Faithful-but-simple
+// (the full search backend is not modeled — documented in the manifest).
+function matchIssueQuery(issue, query) {
+    if (!query.trim())
+        return true;
+    for (const token of query.trim().split(/\s+/)) {
+        const colon = token.indexOf(':');
+        if (colon > 0) {
+            const facet = token.slice(0, colon);
+            const value = token.slice(colon + 1);
+            if (facet === 'is') {
+                if (value === 'unresolved' && issue.status !== 'unresolved')
+                    return false;
+                else if (value === 'resolved' && issue.status !== 'resolved')
+                    return false;
+                else if (value === 'ignored' && issue.status !== 'ignored' && issue.status !== 'muted')
+                    return false;
+                else if (value === 'assigned' && !issue.assignedTo)
+                    return false;
+                else if (value === 'unassigned' && issue.assignedTo)
+                    return false;
+            }
+            else if (facet === 'level') {
+                if (String(issue.level) !== value)
+                    return false;
+            }
+            else if (facet === 'environment') {
+                // not modeled per-issue; treat as a no-op match (faithful: no environment dimension)
+            }
+            else {
+                // free `key:value` against tags is not modeled — ignore unknown facets (lenient).
+            }
+        }
+        else {
+            // free text → title substring match (case-insensitive)
+            if (!String(issue.title ?? '').toLowerCase().includes(token.toLowerCase()))
+                return false;
+        }
+    }
+    return true;
+}
+function sortIssues(issues, sort) {
+    const by = sort || 'date';
+    return [...issues].sort((a, b) => {
+        if (by === 'freq')
+            return Number(b.count ?? 0) - Number(a.count ?? 0);
+        if (by === 'new')
+            return Date.parse(String(b.firstSeen ?? 0)) - Date.parse(String(a.firstSeen ?? 0));
+        // default 'date' = last seen, newest first
+        return Date.parse(String(b.lastSeen ?? 0)) - Date.parse(String(a.lastSeen ?? 0));
+    });
+}
+function findProjectBySlug(org, project, root) {
+    return rows('project', root).find((p) => p.slug === project && p.organizationSlug === org && !p.deleted);
+}
+async function writeResource(type, id, fields, op, root, occurredAt) {
+    const { resource } = await applyTwinWrite(SERVICE, { operation: op, subjectType: type, subjectId: id, fields, ...(occurredAt ? { occurredAt } : {}), actor: { kind: 'agent' } }, root);
+    return resource;
+}
+// ── Main entry ─────────────────────────────────────────────────────────────────
+export async function handleSentryTwinRequest(req) {
+    // Seed a default org/project/key so an out-of-the-box DSN ingests immediately.
+    await ensureDefaultProject(req.root, req.occurredAt);
+    const method = req.method.toUpperCase();
+    const { path } = parseQuery(req.path);
+    const clean = path.replace(/\/+$/, '') || '/';
+    // ── INGESTION (the SDK side) ──────────────────────────────────────────────────
+    // POST /api/:projectId/store/    — legacy JSON event
+    // POST /api/:projectId/envelope/ — modern envelope (the default @sentry/node transport)
+    const ingestMatch = /^\/api\/([^/]+)\/(store|envelope)$/.exec(clean);
+    if (ingestMatch) {
+        if (method !== 'POST')
+            return err('Method not allowed', 405);
+        if (req.readOnly)
+            return err('twin is read-only; omit readOnly to accept events', 405);
+        return ingest(ingestMatch[1], ingestMatch[2], req);
+    }
+    // ── WEB API (/api/0/...) ──────────────────────────────────────────────────────
+    if (clean.startsWith('/api/0/')) {
+        if (req.readOnly && method !== 'GET')
+            return err('twin is read-only; omit readOnly to accept writes', 405);
+        return webApi(method, clean.slice('/api/0'.length) || '/', req);
+    }
+    return err('Not found', 404);
+}
+// ── Ingestion path ───────────────────────────────────────────────────────────────
+async function ingest(projectId, kind, req) {
+    const { params } = parseQuery(req.path);
+    let events = [];
+    let envelopeDsn;
+    let attachments = [];
+    let sessions = [];
+    if (kind === 'envelope') {
+        const env = parseEnvelope(req.body ?? '');
+        envelopeDsn = typeof env.header.dsn === 'string' ? env.header.dsn : undefined;
+        events = envelopeEvents(env);
+        attachments = envelopeAttachments(env);
+        sessions = envelopeSessions(env);
+    }
+    else {
+        try {
+            events = [JSON.parse(req.body ?? '{}')];
+        }
+        catch {
+            return err('Invalid event payload', 400);
+        }
+    }
+    const publicKey = resolvePublicKey({
+        authHeader: req.headers?.['x-sentry-auth'] ?? req.headers?.['X-Sentry-Auth'],
+        query: req.path.includes('?') ? req.path.slice(req.path.indexOf('?') + 1) : '',
+        envelopeDsn,
+    });
+    const key = resolveProjectKey(publicKey, req.root);
+    // Sentry 401s an unknown/missing DSN public key.
+    if (!key)
+        return { status: 401, body: { detail: 'Invalid api key' } };
+    // The DSN's project must match the URL's projectId (Sentry rejects a mismatch).
+    if (key.projectId !== projectId)
+        return { status: 401, body: { detail: 'Invalid project for this key' } };
+    // Session items (release-health heartbeats) are persisted regardless of any event item.
+    if (sessions.length > 0)
+        await persistSessions(key.projectId, sessions, { root: req.root, ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}) });
+    // Envelope with no event item (e.g. session-only) → accept + 200 with no id, like Sentry.
+    if (events.length === 0)
+        return { status: 200, body: {} };
+    let lastId = '';
+    for (const event of events) {
+        const outcome = await ingestEvent(key, event, { root: req.root, occurredAt: req.occurredAt });
+        lastId = outcome.eventId;
+        // Fire alert webhooks on new-issue / regression (injected deliverer — offline by default).
+        if (outcome.isNew)
+            await emitIssueAlert('new-issue', outcome.issue, { root: req.root, ...(req.deliver ? { deliver: req.deliver } : {}), ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}) });
+        else if (outcome.wasResolved)
+            await emitIssueAlert('regression', outcome.issue, { root: req.root, ...(req.deliver ? { deliver: req.deliver } : {}), ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}) });
+    }
+    // Envelope attachment items attach to the (last) event in the same envelope (Sentry's model).
+    if (attachments.length > 0 && lastId)
+        await persistEventAttachments(lastId, key.projectId, attachments, { root: req.root, ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}) });
+    // Sentry's store/envelope success body is `{ id: "<event_id>" }`.
+    return { status: 200, body: { id: lastId } };
+}
+// ── Web API path ─────────────────────────────────────────────────────────────────
+async function webApi(method, path, req) {
+    const { params } = parseQuery(req.path);
+    const seg = path.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+    const root = req.root;
+    // ---- Organizations ----
+    // GET /organizations/  (list)
+    if (seg[0] === 'organizations' && seg.length === 1 && method === 'GET') {
+        const items = rows('organization', root).filter((o) => !o.deleted).map(orgView);
+        return { status: 200, body: items };
+    }
+    // POST /organizations/  (create)
+    if (seg[0] === 'organizations' && seg.length === 1 && method === 'POST') {
+        const b = body(req);
+        if (!b.slug && !b.name)
+            return err('slug or name is required', 400);
+        const slug = String(b.slug ?? slugify(String(b.name)));
+        if (rows('organization', root).some((o) => o.slug === slug && !o.deleted))
+            return err('An organization with this slug already exists', 409);
+        const id = `org_${rows('organization', root).length + 1}`;
+        const r = await writeResource('organization', id, { slug, name: b.name ?? slug, dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z' }, 'organization.create', root, req.occurredAt);
+        return { status: 201, body: orgView(r) };
+    }
+    // GET/PUT/DELETE /organizations/:org/
+    if (seg[0] === 'organizations' && seg.length === 2) {
+        const org = rows('organization', root).find((o) => o.slug === seg[1] && !o.deleted);
+        if (!org)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: orgView(org) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const r = await writeResource('organization', org.id, { ...(b.name !== undefined ? { name: b.name } : {}), ...(b.slug !== undefined ? { slug: b.slug } : {}) }, 'organization.update', root, req.occurredAt);
+            return { status: 200, body: orgView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('organization', org.id, { deleted: true }, 'organization.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // ---- Org members: invite / list / role ----
+    // GET/POST /organizations/:org/members/
+    if (seg[0] === 'organizations' && seg[2] === 'members' && seg.length === 3) {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('org_member', root).filter((m) => m.organizationSlug === orgSlug && !m.deleted).map(memberView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const email = typeof b.email === 'string' ? b.email.trim() : '';
+            if (!email)
+                return err('email is required', 400);
+            if (rows('org_member', root).some((m) => m.organizationSlug === orgSlug && m.email === email && !m.deleted)) {
+                return err(`The user ${email} is already a member`, 409);
+            }
+            const role = ['member', 'admin', 'manager', 'owner', 'billing'].includes(String(b.role)) ? String(b.role) : 'member';
+            const teams = Array.isArray(b.teams) ? b.teams.map(String) : [];
+            const id = `member_${rows('org_member', root).length + 1}`;
+            const r = await writeResource('org_member', id, {
+                organizationSlug: orgSlug, email, role, teams, pending: true, expired: false,
+                name: b.name ?? email, dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'org_member.create', root, req.occurredAt);
+            return { status: 201, body: memberView(r) };
+        }
+    }
+    // GET/PUT/DELETE /organizations/:org/members/:id/
+    if (seg[0] === 'organizations' && seg[2] === 'members' && seg.length === 4) {
+        const orgSlug = seg[1];
+        const m = rows('org_member', root).find((x) => x.id === seg[3] && x.organizationSlug === orgSlug && !x.deleted);
+        if (!m)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: memberView(m) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = {};
+            if (b.role !== undefined) {
+                if (!['member', 'admin', 'manager', 'owner', 'billing'].includes(String(b.role)))
+                    return err('Invalid role', 400);
+                patch.role = String(b.role);
+            }
+            if (Array.isArray(b.teams))
+                patch.teams = b.teams.map(String);
+            if (Object.keys(patch).length === 0)
+                return err('No updatable fields provided', 400);
+            const r = await writeResource('org_member', m.id, patch, 'org_member.update', root, req.occurredAt);
+            return { status: 200, body: memberView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('org_member', m.id, { deleted: true }, 'org_member.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // GET /organizations/:org/stats_v2/  (event/error stats over the persisted events)
+    if (seg[0] === 'organizations' && (seg[2] === 'stats_v2' || seg[2] === 'stats') && seg.length === 3 && method === 'GET') {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        const projIds = new Set(rows('project', root).filter((p) => p.organizationSlug === orgSlug && !p.deleted).map((p) => p.id));
+        const events = rows('event', root).filter((e) => projIds.has(String(e.projectID)) && !e.deleted);
+        // Sentry's stats_v2 envelope: groups by category with a `totals` sum.
+        const total = events.length;
+        return {
+            status: 200,
+            body: {
+                start: params.get('start') ?? null, end: params.get('end') ?? null,
+                intervals: [], // time-bucketed series needs the tracing/metrics engine (a filed todo); totals are real
+                groups: [{ by: { category: 'error', outcome: 'accepted' }, totals: { 'sum(quantity)': total, 'sum(times_seen)': total } }],
+            },
+        };
+    }
+    // ---- Org integrations (GitHub/Slack/etc.) config ----
+    // GET/POST /organizations/:org/integrations/  (list installed integrations / install a new one)
+    if (seg[0] === 'organizations' && seg[2] === 'integrations' && seg.length === 3) {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const provider = params.get('provider_key') ?? params.get('providerKey');
+            let items = rows('org_integration', root).filter((i) => i.organizationSlug === orgSlug && !i.deleted);
+            if (provider)
+                items = items.filter((i) => i.provider === provider);
+            return { status: 200, body: items.map(integrationView) };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const provider = typeof b.provider === 'string' ? b.provider : '';
+            if (!provider)
+                return err('provider is required', 400);
+            if (!['github', 'gitlab', 'slack', 'pagerduty', 'jira', 'msteams', 'vsts', 'bitbucket'].includes(provider)) {
+                return err(`Unknown integration provider: ${provider}`, 400);
+            }
+            const id = `int_${rows('org_integration', root).length + 1}`;
+            const r = await writeResource('org_integration', id, {
+                organizationSlug: orgSlug, provider, name: b.name ?? provider,
+                externalId: b.externalId ?? `ext_${id}`, status: 'active',
+                domainName: b.domainName ?? null, configData: (b.configData && typeof b.configData === 'object') ? b.configData : {},
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'org_integration.create', root, req.occurredAt);
+            return { status: 201, body: integrationView(r) };
+        }
+    }
+    // GET/PUT/DELETE /organizations/:org/integrations/:id/
+    if (seg[0] === 'organizations' && seg[2] === 'integrations' && seg.length === 4) {
+        const orgSlug = seg[1];
+        const i = rows('org_integration', root).find((x) => x.id === seg[3] && x.organizationSlug === orgSlug && !x.deleted);
+        if (!i)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: integrationView(i) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = {};
+            if (b.name !== undefined)
+                patch.name = b.name;
+            if (b.domainName !== undefined)
+                patch.domainName = b.domainName;
+            if (b.configData && typeof b.configData === 'object')
+                patch.configData = { ...(i.configData ?? {}), ...b.configData };
+            if (Object.keys(patch).length === 0)
+                return err('No updatable fields provided', 400);
+            const r = await writeResource('org_integration', i.id, patch, 'org_integration.update', root, req.occurredAt);
+            return { status: 200, body: integrationView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('org_integration', i.id, { deleted: true }, 'org_integration.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // ---- Custom dashboards + widgets (config CRUD — fully reproducible offline) ----
+    // GET/POST /organizations/:org/dashboards/
+    if (seg[0] === 'organizations' && seg[2] === 'dashboards' && seg.length === 3) {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('dashboard', root).filter((d) => d.organizationSlug === orgSlug && !d.deleted).map(dashboardView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            if (!b.title || typeof b.title !== 'string')
+                return err('title is required', 400);
+            const widgets = normalizeWidgets(b.widgets);
+            if (widgets.error)
+                return err(widgets.error, 400);
+            const id = `dash_${rows('dashboard', root).length + 1}`;
+            const r = await writeResource('dashboard', id, {
+                organizationSlug: orgSlug, title: b.title, widgets: widgets.widgets,
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'dashboard.create', root, req.occurredAt);
+            return { status: 201, body: dashboardView(r) };
+        }
+    }
+    // GET/PUT/DELETE /organizations/:org/dashboards/:id/
+    if (seg[0] === 'organizations' && seg[2] === 'dashboards' && seg.length === 4) {
+        const orgSlug = seg[1];
+        const d = rows('dashboard', root).find((x) => x.id === seg[3] && x.organizationSlug === orgSlug && !x.deleted);
+        if (!d)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: dashboardView(d) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = {};
+            if (b.title !== undefined)
+                patch.title = String(b.title);
+            if (b.widgets !== undefined) {
+                const widgets = normalizeWidgets(b.widgets);
+                if (widgets.error)
+                    return err(widgets.error, 400);
+                patch.widgets = widgets.widgets;
+            }
+            if (Object.keys(patch).length === 0)
+                return err('No updatable fields provided', 400);
+            const r = await writeResource('dashboard', d.id, patch, 'dashboard.update', root, req.occurredAt);
+            return { status: 200, body: dashboardView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('dashboard', d.id, { deleted: true }, 'dashboard.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // POST /organizations/:org/discover/saved/  + GET list  (Discover saved queries — the query
+    // BUILDER config persists faithfully; live EXECUTION of an arbitrary Discover query against a
+    // columnar event store is a filed todo: it needs the data-plane query engine. Config is real.)
+    if (seg[0] === 'organizations' && seg[2] === 'discover' && seg[3] === 'saved' && seg.length === 4) {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('discover_query', root).filter((q) => q.organizationSlug === orgSlug && !q.deleted).map(discoverView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            if (!b.name || typeof b.name !== 'string')
+                return err('name is required', 400);
+            if (!Array.isArray(b.fields) || b.fields.length === 0)
+                return err('fields (a non-empty array of columns) is required', 400);
+            const id = `dq_${rows('discover_query', root).length + 1}`;
+            const r = await writeResource('discover_query', id, {
+                organizationSlug: orgSlug, name: b.name, fields: b.fields.map(String),
+                query: typeof b.query === 'string' ? b.query : '',
+                orderby: typeof b.orderby === 'string' ? b.orderby : null,
+                range: typeof b.range === 'string' ? b.range : '14d',
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'discover_query.create', root, req.occurredAt);
+            return { status: 201, body: discoverView(r) };
+        }
+    }
+    // ---- Metric alert rules (thresholds over event-count / percentage) ----
+    // GET/POST /organizations/:org/alert-rules/  (Sentry's metric alert rules: a metric/dataset +
+    // thresholds with critical/warning triggers + actions). The twin models the RULE CONFIG +
+    // response shape faithfully; the live threshold EVALUATION against a time-series metrics
+    // backend is a filed todo (it needs the metrics engine) — the config CRUD is real and failable.
+    if (seg[0] === 'organizations' && seg[2] === 'alert-rules' && seg.length === 3) {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('metric_alert', root).filter((r) => r.organizationSlug === orgSlug && !r.deleted).map(metricAlertView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const v = validateMetricAlert(b);
+            if (v.error || !v.fields)
+                return err(v.error ?? 'invalid metric alert', 400);
+            const id = `mar_${rows('metric_alert', root).length + 1}`;
+            const r = await writeResource('metric_alert', id, { organizationSlug: orgSlug, ...v.fields, dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z' }, 'metric_alert.create', root, req.occurredAt);
+            return { status: 201, body: metricAlertView(r) };
+        }
+    }
+    // GET/PUT/DELETE /organizations/:org/alert-rules/:id/
+    if (seg[0] === 'organizations' && seg[2] === 'alert-rules' && seg.length === 4) {
+        const orgSlug = seg[1];
+        const rule = rows('metric_alert', root).find((r) => r.id === seg[3] && r.organizationSlug === orgSlug && !r.deleted);
+        if (!rule)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: metricAlertView(rule) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const v = validateMetricAlert({ ...rule, ...b }, true);
+            if (v.error || !v.fields)
+                return err(v.error ?? 'invalid metric alert', 400);
+            const r = await writeResource('metric_alert', rule.id, v.fields, 'metric_alert.update', root, req.occurredAt);
+            return { status: 200, body: metricAlertView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('metric_alert', rule.id, { deleted: true }, 'metric_alert.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // GET /organizations/:org/sessions/  (release-health session metrics — crash-free counts)
+    // Aggregated EXACTLY over the persisted session resources (each session's final status).
+    // This is a real tally, not a simulated metrics engine: sum(session), crash-free rate, and
+    // the per-release/per-status breakdown are all derived from stored data. The time-bucketed
+    // SERIES (intervals) is left empty (a time-series rollup engine is a filed todo).
+    if (seg[0] === 'organizations' && seg[2] === 'sessions' && seg.length === 3 && method === 'GET') {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        const projIds = new Set(rows('project', root).filter((p) => p.organizationSlug === orgSlug && !p.deleted).map((p) => p.id));
+        const sessions = rows('session', root).filter((s) => projIds.has(String(s.projectID)) && !s.deleted);
+        return { status: 200, body: sessionMetrics(sessions, params) };
+    }
+    // ---- Teams: GET/POST /organizations/:org/teams/ ----
+    if (seg[0] === 'organizations' && seg[2] === 'teams' && seg.length === 3) {
+        const orgSlug = seg[1];
+        if (method === 'GET') {
+            const items = rows('team', root).filter((t) => t.organizationSlug === orgSlug && !t.deleted).map(teamView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const slug = String(b.slug ?? slugify(String(b.name ?? '')));
+            if (!slug)
+                return err('slug or name is required', 400);
+            const id = `team_${rows('team', root).length + 1}`;
+            const r = await writeResource('team', id, { slug, name: b.name ?? slug, organizationSlug: orgSlug, dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z' }, 'team.create', root, req.occurredAt);
+            return { status: 201, body: teamView(r) };
+        }
+    }
+    // ---- SCIM 2.0 provisioning: /organizations/:org/scim/v2/{Users,Groups} ----
+    if (seg[0] === 'organizations' && seg[2] === 'scim' && seg[3] === 'v2') {
+        return scimApi(method, seg, req);
+    }
+    // ---- Releases: /organizations/:org/releases/ ----
+    if (seg[0] === 'organizations' && seg[2] === 'releases') {
+        return releasesApi(method, seg, req);
+    }
+    // ---- Projects ----
+    // GET /projects/  (list all)
+    if (seg[0] === 'projects' && seg.length === 1 && method === 'GET') {
+        const items = rows('project', root).filter((p) => !p.deleted).map(projectView);
+        return { status: 200, body: items };
+    }
+    // GET /projects/:org/:project/  (retrieve)
+    if (seg[0] === 'projects' && seg.length === 3 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        return p ? { status: 200, body: projectView(p) } : err('The requested resource does not exist', 404);
+    }
+    // PUT /projects/:org/:project/  (update)
+    if (seg[0] === 'projects' && seg.length === 3 && method === 'PUT') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const b = body(req);
+        const r = await writeResource('project', p.id, { ...(b.name !== undefined ? { name: b.name } : {}), ...(b.slug !== undefined ? { slug: b.slug } : {}), ...(b.platform !== undefined ? { platform: b.platform } : {}) }, 'project.update', root, req.occurredAt);
+        return { status: 200, body: projectView(r) };
+    }
+    // DELETE /projects/:org/:project/
+    if (seg[0] === 'projects' && seg.length === 3 && method === 'DELETE') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        await writeResource('project', p.id, { deleted: true }, 'project.delete', root, req.occurredAt);
+        return { status: 204, body: null };
+    }
+    // POST /teams/:org/:team/projects/  (create project under a team) — Sentry's create path
+    if (seg[0] === 'teams' && seg[3] === 'projects' && seg.length === 4 && method === 'POST') {
+        const orgSlug = seg[1];
+        const b = body(req);
+        const slug = String(b.slug ?? slugify(String(b.name ?? '')));
+        if (!slug)
+            return err('name is required', 400);
+        if (findProjectBySlug(orgSlug, slug, root))
+            return err('A project with this slug already exists', 409);
+        const id = String(rows('project', root).length + 1);
+        const r = await writeResource('project', id, { slug, name: b.name ?? slug, platform: b.platform ?? null, organizationSlug: orgSlug, team: seg[2], dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z' }, 'project.create', root, req.occurredAt);
+        return { status: 201, body: projectView(r) };
+    }
+    // ---- Team membership: GET/POST /teams/:org/:team/members/ + DELETE .../:memberId/ ----
+    if (seg[0] === 'teams' && seg[3] === 'members') {
+        const orgSlug = seg[1];
+        const teamSlug = seg[2];
+        const team = rows('team', root).find((t) => t.slug === teamSlug && t.organizationSlug === orgSlug && !t.deleted);
+        if (!team)
+            return err('The requested resource does not exist', 404);
+        if (seg.length === 4 && method === 'GET') {
+            const items = rows('org_member', root)
+                .filter((m) => m.organizationSlug === orgSlug && !m.deleted && Array.isArray(m.teams) && m.teams.includes(teamSlug))
+                .map(memberView);
+            return { status: 200, body: items };
+        }
+        if (seg.length === 5 && (method === 'POST' || method === 'DELETE')) {
+            const m = rows('org_member', root).find((x) => x.id === seg[4] && x.organizationSlug === orgSlug && !x.deleted);
+            if (!m)
+                return err('The requested resource does not exist', 404);
+            const teams = new Set(Array.isArray(m.teams) ? m.teams : []);
+            if (method === 'POST')
+                teams.add(teamSlug);
+            else
+                teams.delete(teamSlug);
+            const r = await writeResource('org_member', m.id, { teams: [...teams] }, 'org_member.update', root, req.occurredAt);
+            return method === 'POST' ? { status: 201, body: memberView(r) } : { status: 204, body: null };
+        }
+    }
+    // ---- Project keys (DSN) ----
+    // GET/POST /projects/:org/:project/keys/
+    if (seg[0] === 'projects' && seg[3] === 'keys' && seg.length === 4) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('project_key', root).filter((k) => k.projectId === p.id && !k.deleted).map((k) => keyView(k, req));
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const idx = rows('project_key', root).length + 1;
+            const publicKey = `twinkey${String(idx).padStart(25, '0')}`;
+            const r = await writeResource('project_key', `key_${idx}`, {
+                public: publicKey, secret: `twinsecret${String(idx).padStart(22, '0')}`,
+                projectId: p.id, projectSlug: p.slug, organizationSlug: p.organizationSlug,
+                name: b.name ?? 'Default', isActive: true, dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'project_key.create', root, req.occurredAt);
+            return { status: 201, body: keyView(r, req) };
+        }
+    }
+    // PUT/DELETE /projects/:org/:project/keys/:keyId/  (toggle active / revoke DSN)
+    if (seg[0] === 'projects' && seg[3] === 'keys' && seg.length === 5) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const key = rows('project_key', root).find((k) => k.id === seg[4] && k.projectId === p.id && !k.deleted)
+            ?? rows('project_key', root).find((k) => k.public === seg[4] && k.projectId === p.id && !k.deleted);
+        if (!key)
+            return err('The requested resource does not exist', 404);
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = {};
+            if (b.isActive !== undefined)
+                patch.isActive = !!b.isActive;
+            if (b.name !== undefined)
+                patch.name = b.name;
+            // Per-key rate limit: { window: <seconds>, count: <events> } or null to clear.
+            if (b.rateLimit !== undefined) {
+                if (b.rateLimit === null)
+                    patch.rateLimit = null;
+                else {
+                    const rl = b.rateLimit;
+                    const window = Number(rl.window);
+                    const count = Number(rl.count);
+                    if (!Number.isFinite(window) || !Number.isFinite(count) || window <= 0 || count < 0) {
+                        return err('rateLimit requires positive window (seconds) and non-negative count', 400);
+                    }
+                    patch.rateLimit = { window, count };
+                }
+            }
+            const r = await writeResource('project_key', key.id, patch, 'project_key.update', root, req.occurredAt);
+            return { status: 200, body: keyView(r, req) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('project_key', key.id, { deleted: true }, 'project_key.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // GET /projects/:org/:project/environments/  (distinct environments seen across events)
+    if (seg[0] === 'projects' && seg[3] === 'environments' && seg.length === 4 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const seen = new Set();
+        for (const ev of rows('event', root)) {
+            if (ev.projectID === p.id && typeof ev.environment === 'string' && ev.environment)
+                seen.add(ev.environment);
+        }
+        for (const d of rows('deploy', root)) {
+            if (typeof d.environment === 'string' && d.environment)
+                seen.add(d.environment);
+        }
+        const items = [...seen].sort().map((name, i) => ({ id: String(i + 1), name, displayName: name, isHidden: false }));
+        return { status: 200, body: items };
+    }
+    // ---- Issues ----
+    // GET /projects/:org/:project/issues/  (list with query/sort)
+    if (seg[0] === 'projects' && seg[3] === 'issues' && seg.length === 4 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const query = params.get('query') ?? 'is:unresolved';
+        const sort = params.get('sort') ?? 'date';
+        let issues = rows('issue', root).filter((i) => i.projectId === p.id && !i.deleted && matchIssueQuery(i, query));
+        issues = sortIssues(issues, sort);
+        return { status: 200, body: issues.map(issueView) };
+    }
+    // PUT/DELETE /projects/:org/:project/issues/  (BULK mutate) — Sentry selects targets via
+    // repeated ?id=<n> params, or ?query=<dsl> (all matching). PUT sets status/assignedTo;
+    // DELETE removes. Returns the applied patch on PUT (Sentry's shape), 204 on DELETE.
+    if (seg[0] === 'projects' && seg[3] === 'issues' && seg.length === 4 && (method === 'PUT' || method === 'DELETE')) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const ids = params.getAll('id');
+        const all = rows('issue', root).filter((i) => i.projectId === p.id && !i.deleted);
+        let targets;
+        if (ids.length > 0) {
+            targets = all.filter((i) => ids.includes(String(i.id)));
+        }
+        else {
+            const query = params.get('query');
+            if (query === null)
+                return err('Cannot apply a bulk mutation without a query or id filter', 400);
+            targets = all.filter((i) => matchIssueQuery(i, query));
+        }
+        if (method === 'DELETE') {
+            for (const t of targets)
+                await writeResource('issue', t.id, { deleted: true }, 'issue.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+        const b = body(req);
+        // MERGE: ?id=A&id=B&… + {merge:1} folds the selected groups into one primary issue.
+        // The primary is the highest-count target (Sentry merges into the most-seen group);
+        // others are tombstoned and their events are re-pointed + counts summed into the primary.
+        if (b.merge) {
+            if (targets.length < 2)
+                return err('Merging requires at least two issues', 400);
+            const ordered = [...targets].sort((a, b2) => Number(b2.count ?? 0) - Number(a.count ?? 0));
+            const primary = ordered[0];
+            const others = ordered.slice(1);
+            let mergedCount = Number(primary.count ?? 0);
+            let firstSeen = String(primary.firstSeen ?? '');
+            let lastSeen = String(primary.lastSeen ?? '');
+            for (const o of others) {
+                mergedCount += Number(o.count ?? 0);
+                if (o.firstSeen && (!firstSeen || String(o.firstSeen) < firstSeen))
+                    firstSeen = String(o.firstSeen);
+                if (o.lastSeen && (!lastSeen || String(o.lastSeen) > lastSeen))
+                    lastSeen = String(o.lastSeen);
+                // re-point the merged group's events at the primary
+                for (const ev of rows('event', root).filter((e) => e.groupID === o.id && !e.deleted)) {
+                    await writeResource('event', ev.id, { groupID: primary.id }, 'event.merge', root, req.occurredAt);
+                }
+                await writeResource('issue', o.id, { deleted: true, mergedInto: primary.id }, 'issue.merge', root, req.occurredAt);
+            }
+            await writeResource('issue', primary.id, { count: String(mergedCount), firstSeen, lastSeen }, 'issue.update', root, req.occurredAt);
+            return { status: 200, body: { merge: { parent: primary.id, children: others.map((o) => o.id) } } };
+        }
+        const patch = {};
+        if (b.status !== undefined) {
+            const status = String(b.status);
+            if (!['resolved', 'unresolved', 'ignored', 'muted'].includes(status))
+                return err('Invalid status', 400);
+            patch.status = status === 'muted' ? 'ignored' : status;
+            if (b.statusDetails !== undefined)
+                patch.statusDetails = b.statusDetails;
+        }
+        if (b.assignedTo !== undefined)
+            patch.assignedTo = b.assignedTo;
+        if (Object.keys(patch).length === 0)
+            return err('No updatable fields provided', 400);
+        for (const t of targets)
+            await writeResource('issue', t.id, patch, 'issue.update', root, req.occurredAt);
+        return { status: 200, body: patch };
+    }
+    // GET/PUT/DELETE /issues/:id/
+    if (seg[0] === 'issues' && seg.length === 2) {
+        const issue = getRow('issue', seg[1], root);
+        if (!issue || issue.deleted)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: issueView(issue) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = {};
+            if (b.status !== undefined) {
+                const status = String(b.status);
+                if (!['resolved', 'unresolved', 'ignored', 'muted'].includes(status))
+                    return err('Invalid status', 400);
+                patch.status = status === 'muted' ? 'ignored' : status;
+                if (b.statusDetails !== undefined)
+                    patch.statusDetails = b.statusDetails;
+            }
+            if (b.assignedTo !== undefined)
+                patch.assignedTo = b.assignedTo;
+            if (Object.keys(patch).length === 0)
+                return err('No updatable fields provided', 400);
+            const r = await writeResource('issue', issue.id, patch, 'issue.update', root, req.occurredAt);
+            return { status: 200, body: issueView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('issue', issue.id, { deleted: true }, 'issue.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // GET /issues/:id/events/
+    if (seg[0] === 'issues' && seg[2] === 'events' && seg.length === 3 && method === 'GET') {
+        const issue = getRow('issue', seg[1], root);
+        if (!issue || issue.deleted)
+            return err('The requested resource does not exist', 404);
+        const evs = rows('event', root).filter((e) => e.groupID === issue.id).map(eventView)
+            .sort((a, b) => Date.parse(String(b.dateCreated)) - Date.parse(String(a.dateCreated)));
+        return { status: 200, body: evs };
+    }
+    // GET /issues/:id/events/latest/
+    if (seg[0] === 'issues' && seg[2] === 'events' && seg[3] === 'latest' && seg.length === 4 && method === 'GET') {
+        const issue = getRow('issue', seg[1], root);
+        if (!issue || issue.deleted)
+            return err('The requested resource does not exist', 404);
+        const evs = rows('event', root).filter((e) => e.groupID === issue.id)
+            .sort((a, b) => Date.parse(String(b.dateCreated)) - Date.parse(String(a.dateCreated)));
+        return evs[0] ? { status: 200, body: eventView(evs[0]) } : err('The requested resource does not exist', 404);
+    }
+    // GET /issues/:id/tags/        (the issue's tag keys + per-key value distribution)
+    // GET /issues/:id/tags/:key/   (one tag key's full value distribution)
+    if (seg[0] === 'issues' && seg[2] === 'tags' && method === 'GET' && (seg.length === 3 || seg.length === 4)) {
+        const issue = getRow('issue', seg[1], root);
+        if (!issue || issue.deleted)
+            return err('The requested resource does not exist', 404);
+        const dist = issueTagDistribution(issue.id, root);
+        if (seg.length === 4) {
+            const key = seg[3];
+            const found = dist.find((d) => d.key === key);
+            return found ? { status: 200, body: found } : err('The requested resource does not exist', 404);
+        }
+        return { status: 200, body: dist };
+    }
+    // GET /issues/:id/hashes/  (the grouping hashes for the issue — the twin's fingerprint IS
+    // the issue id, so the issue has exactly one grouping hash: its own deterministic group id).
+    if (seg[0] === 'issues' && seg[2] === 'hashes' && seg.length === 3 && method === 'GET') {
+        const issue = getRow('issue', seg[1], root);
+        if (!issue || issue.deleted)
+            return err('The requested resource does not exist', 404);
+        const latest = rows('event', root).filter((e) => e.groupID === issue.id)
+            .sort((a, b) => Date.parse(String(b.dateCreated)) - Date.parse(String(a.dateCreated)))[0];
+        return { status: 200, body: [{ id: issue.id, latestEvent: latest ? eventView(latest) : null }] };
+    }
+    // GET /issues/:id/activity/  (the issue's activity feed: creation + triage from the log)
+    if (seg[0] === 'issues' && seg[2] === 'activity' && seg.length === 3 && method === 'GET') {
+        const issue = getRow('issue', seg[1], root);
+        if (!issue || issue.deleted)
+            return err('The requested resource does not exist', 404);
+        return { status: 200, body: { activity: issueActivity(issue.id, root) } };
+    }
+    // ---- Events ----
+    // GET /projects/:org/:project/events/  (list)
+    if (seg[0] === 'projects' && seg[3] === 'events' && seg.length === 4 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const evs = rows('event', root).filter((e) => e.projectID === p.id).map(eventView)
+            .sort((a, b) => Date.parse(String(b.dateCreated)) - Date.parse(String(a.dateCreated)));
+        return { status: 200, body: evs };
+    }
+    // GET /projects/:org/:project/events/:id/  (retrieve)
+    if (seg[0] === 'projects' && seg[3] === 'events' && seg.length === 5 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const ev = rows('event', root).find((e) => e.id === seg[4] && e.projectID === p.id);
+        return ev ? { status: 200, body: eventView(ev) } : err('The requested resource does not exist', 404);
+    }
+    // GET /projects/:org/:project/events/:id/attachments/  (event attachments listing)
+    // Attachments arrive on the ingest envelope as `attachment` items; the twin persists their
+    // metadata and lists them here in Sentry's attachment shape. (Binary blob download — the
+    // file body over /attachments/:attId/?download — is a filed todo: it needs a blob store; the
+    // metadata listing is real.)
+    if (seg[0] === 'projects' && seg[3] === 'events' && seg[5] === 'attachments' && seg.length === 6 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const ev = rows('event', root).find((e) => e.id === seg[4] && e.projectID === p.id);
+        if (!ev)
+            return err('The requested resource does not exist', 404);
+        const items = rows('event_attachment', root)
+            .filter((a) => a.eventId === ev.id && !a.deleted)
+            .map(attachmentView);
+        return { status: 200, body: items };
+    }
+    // ---- User feedback (crash-report dialog submissions) ----
+    // GET/POST /projects/:org/:project/user-feedback/  — submit/list user feedback for a project.
+    // (Deprecated by Sentry in favor of the Feedback Widget, but still a real, modellable endpoint.)
+    if (seg[0] === 'projects' && seg[3] === 'user-feedback' && seg.length === 4) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('user_feedback', root).filter((f) => f.projectId === p.id && !f.deleted)
+                .sort((a, b) => Date.parse(String(b.dateCreated)) - Date.parse(String(a.dateCreated)))
+                .map((f) => userFeedbackView(f, root));
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const eventId = typeof b.event_id === 'string' ? b.event_id : '';
+            const email = typeof b.email === 'string' ? b.email.trim() : '';
+            const name = typeof b.name === 'string' ? b.name : '';
+            const comments = typeof b.comments === 'string' ? b.comments : '';
+            // Sentry requires event_id, name, email and comments.
+            if (!eventId || !email || !name || !comments)
+                return err('event_id, name, email and comments are required', 400);
+            const id = `feedback_${rows('user_feedback', root).length + 1}`;
+            // Link to the issue the event grouped into, if the event is known to the twin.
+            const ev = rows('event', root).find((e) => e.id === eventId && e.projectID === p.id);
+            const r = await writeResource('user_feedback', id, {
+                projectId: p.id, eventID: eventId, name, email, comments,
+                issueId: ev ? String(ev.groupID) : null,
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'user_feedback.create', root, req.occurredAt);
+            return { status: 200, body: userFeedbackView(r, root) };
+        }
+    }
+    // ---- Discover org-wide event facets (tag-value distributions) ----
+    // GET /organizations/:org/events-facets/  — tag key → topValues distribution across the org's
+    // events. Sentry's Discover facets endpoint, folded from the persisted event tags.
+    if (seg[0] === 'organizations' && seg[2] === 'events-facets' && seg.length === 3 && method === 'GET') {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        return { status: 200, body: orgEventFacets(orgSlug, root) };
+    }
+    // ---- Spike protection (org-level enable/disable per project) ----
+    // POST   /organizations/:org/spike-protections/   { projects: ["slug"] | "$all" }  — enable
+    // DELETE /organizations/:org/spike-protections/   { projects: ["slug"] | "$all" }  — disable
+    if (seg[0] === 'organizations' && seg[2] === 'spike-protections' && seg.length === 3) {
+        const orgSlug = seg[1];
+        if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('project', root).filter((p) => p.organizationSlug === orgSlug && !p.deleted)
+                .map((p) => ({ project_slug: p.slug, enabled: !!getRow('spike_protection', `sp_${p.id}`, root)?.enabled }));
+            return { status: 200, body: items };
+        }
+        if (method === 'POST' || method === 'DELETE') {
+            const b = body(req);
+            const orgProjects = rows('project', root).filter((p) => p.organizationSlug === orgSlug && !p.deleted);
+            let targets = orgProjects;
+            if (b.projects !== '$all') {
+                const want = Array.isArray(b.projects) ? b.projects.map(String) : [];
+                if (want.length === 0)
+                    return err('projects is required', 400);
+                targets = orgProjects.filter((p) => want.includes(String(p.slug)));
+                if (targets.length === 0)
+                    return err('The requested resource does not exist', 404);
+            }
+            const enabled = method === 'POST';
+            for (const p of targets) {
+                await writeResource('spike_protection', `sp_${p.id}`, { projectId: p.id, enabled }, 'spike_protection.set', root, req.occurredAt);
+            }
+            return { status: enabled ? 201 : 200, body: null };
+        }
+    }
+    // ---- Project ownership rules + code owners ----
+    // GET/PUT /projects/:org/:project/ownership/  (issue-owner rules: path/url/module → owners)
+    if (seg[0] === 'projects' && seg[3] === 'ownership' && seg.length === 4) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const existing = getRow('project_ownership', `own_${p.id}`, root);
+        if (method === 'GET')
+            return { status: 200, body: ownershipView(existing, p.id) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = { projectId: p.id };
+            if (b.raw !== undefined) {
+                if (typeof b.raw !== 'string')
+                    return err('raw must be a string', 400);
+                const parsed = parseOwnershipRaw(String(b.raw));
+                if (parsed.error)
+                    return err(parsed.error, 400);
+                patch.raw = String(b.raw);
+                patch.schema = parsed.schema;
+            }
+            if (b.fallthrough !== undefined)
+                patch.fallthrough = !!b.fallthrough;
+            if (b.autoAssignment !== undefined)
+                patch.autoAssignment = String(b.autoAssignment);
+            if (b.codeownersAutoSync !== undefined)
+                patch.codeownersAutoSync = !!b.codeownersAutoSync;
+            const r = await writeResource('project_ownership', `own_${p.id}`, patch, 'project_ownership.update', root, req.occurredAt);
+            return { status: 200, body: ownershipView(r, p.id) };
+        }
+    }
+    // GET/POST /projects/:org/:project/codeowners/  (CODEOWNERS file import)
+    if (seg[0] === 'projects' && seg[3] === 'codeowners' && seg.length === 4) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('codeowners', root).filter((c) => c.projectId === p.id && !c.deleted).map(codeownersView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            if (typeof b.raw !== 'string' || !b.raw.trim())
+                return err('raw is required', 400);
+            const parsed = parseOwnershipRaw(String(b.raw));
+            if (parsed.error)
+                return err(parsed.error, 400);
+            const id = `co_${rows('codeowners', root).length + 1}`;
+            const r = await writeResource('codeowners', id, {
+                projectId: p.id, raw: String(b.raw), schema: parsed.schema,
+                codeMappingId: b.codeMappingId ?? null, dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'codeowners.create', root, req.occurredAt);
+            return { status: 201, body: codeownersView(r) };
+        }
+    }
+    // ---- Inbound data filters config ----
+    // GET /projects/:org/:project/filters/  (list inbound filters + active state)
+    if (seg[0] === 'projects' && seg[3] === 'filters' && seg.length === 4 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        return { status: 200, body: projectFilters(p.id, root) };
+    }
+    // PUT /projects/:org/:project/filters/:filterId/  (toggle/configure a filter)
+    if (seg[0] === 'projects' && seg[3] === 'filters' && seg.length === 5 && method === 'PUT') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const filterId = seg[4];
+        if (!INBOUND_FILTERS.some((f) => f.id === filterId))
+            return err('The requested resource does not exist', 404);
+        const b = body(req);
+        const patch = { projectId: p.id, filterId };
+        if (b.active !== undefined)
+            patch.active = Array.isArray(b.active) ? b.active.map(String) : !!b.active;
+        if (Array.isArray(b.subfilters))
+            patch.active = b.subfilters.map(String);
+        await writeResource('project_filter', `filt_${p.id}_${filterId}`, patch, 'project_filter.update', root, req.occurredAt);
+        return { status: 204, body: null };
+    }
+    // ---- Per-key rate-limit config ----
+    // The key's rate-limit (window+count) is set/cleared via PUT on the key with a `rateLimit`
+    // object; the GET on the keys list already returns it (keyView). This handles the dedicated
+    // sub-resource form some clients use: PUT /projects/:org/:project/keys/:keyId/  is already
+    // routed above; here we surface the standalone GET for a single key's rate-limit.
+    if (seg[0] === 'projects' && seg[3] === 'keys' && seg[5] === 'rate-limit' && seg.length === 6 && method === 'GET') {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        const key = rows('project_key', root).find((k) => k.id === seg[4] && k.projectId === p.id && !k.deleted);
+        if (!key)
+            return err('The requested resource does not exist', 404);
+        return { status: 200, body: { rateLimit: key.rateLimit ?? null } };
+    }
+    // ---- Alert rules: GET/POST /projects/:org/:project/rules/ ----
+    if (seg[0] === 'projects' && seg[3] === 'rules' && seg.length === 4) {
+        const p = findProjectBySlug(seg[1], seg[2], root);
+        if (!p)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('alert_rule', root).filter((r) => r.projectId === p.id && !r.deleted).map(alertView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            const id = `rule_${rows('alert_rule', root).length + 1}`;
+            const triggers = Array.isArray(b.triggers) ? b.triggers : ['new-issue'];
+            const endpoints = Array.isArray(b.endpoints) ? b.endpoints : [];
+            // Alert ACTIONS beyond the webhook: email / Slack / PagerDuty / MS Teams. Each action is
+            // normalized + validated by type; actual DELIVERY of email/Slack notifications is not
+            // out (needs SMTP / a Slack app) — but the action CONFIG persists + round-trips faithfully.
+            const actions = normalizeAlertActions(b.actions);
+            if (actions.error)
+                return err(actions.error, 400);
+            const r = await writeResource('alert_rule', id, {
+                projectId: p.id, name: b.name ?? id, triggers, endpoints, actions: actions.actions,
+                conditions: Array.isArray(b.conditions) ? b.conditions : [],
+                actionMatch: ['all', 'any', 'none'].includes(String(b.actionMatch)) ? String(b.actionMatch) : 'all',
+                frequency: typeof b.frequency === 'number' ? b.frequency : 30,
+                secret: b.secret ?? 'twinhooksecret', installationUuid: b.installationUuid ?? `inst_${id}`,
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'alert_rule.create', root, req.occurredAt);
+            return { status: 201, body: alertView(r) };
+        }
+    }
+    return err('Not found', 404);
+}
+// ── Releases sub-API ──────────────────────────────────────────────────────────────
+async function releasesApi(method, seg, req) {
+    const root = req.root;
+    const orgSlug = seg[1];
+    // GET/POST /organizations/:org/releases/
+    if (seg.length === 3) {
+        if (method === 'GET') {
+            const items = rows('release', root).filter((r) => r.organizationSlug === orgSlug && !r.deleted).map(releaseView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            if (!b.version)
+                return err('version is required', 400);
+            const version = String(b.version);
+            const id = `${orgSlug}:${version}`;
+            if (getRow('release', id, root))
+                return err('A release with this version already exists', 409);
+            const projects = Array.isArray(b.projects) ? b.projects : [];
+            const r = await writeResource('release', id, {
+                version, organizationSlug: orgSlug, projects, ref: b.ref ?? null, url: b.url ?? null,
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z', dateReleased: b.dateReleased ?? null,
+                commitCount: Array.isArray(b.commits) ? b.commits.length : 0,
+                ...(Array.isArray(b.commits) ? { commits: b.commits } : {}),
+            }, 'release.create', root, req.occurredAt);
+            return { status: 201, body: releaseView(r) };
+        }
+    }
+    // GET/PUT/DELETE /organizations/:org/releases/:version/
+    if (seg.length === 4) {
+        const version = decodeURIComponent(seg[3]);
+        const id = `${orgSlug}:${version}`;
+        const rel = getRow('release', id, root);
+        if (!rel || rel.deleted)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET')
+            return { status: 200, body: releaseView(rel) };
+        if (method === 'PUT') {
+            const b = body(req);
+            const patch = {};
+            if (b.ref !== undefined)
+                patch.ref = b.ref;
+            if (b.url !== undefined)
+                patch.url = b.url;
+            if (b.dateReleased !== undefined)
+                patch.dateReleased = b.dateReleased;
+            if (Array.isArray(b.commits)) {
+                patch.commits = b.commits;
+                patch.commitCount = b.commits.length;
+            }
+            const r = await writeResource('release', id, patch, 'release.update', root, req.occurredAt);
+            return { status: 200, body: releaseView(r) };
+        }
+        if (method === 'DELETE') {
+            await writeResource('release', id, { deleted: true }, 'release.delete', root, req.occurredAt);
+            return { status: 204, body: null };
+        }
+    }
+    // GET/POST /organizations/:org/releases/:version/files/  (release artifacts: source maps etc.)
+    if (seg.length === 5 && seg[4] === 'files') {
+        const version = decodeURIComponent(seg[3]);
+        const id = `${orgSlug}:${version}`;
+        const rel = getRow('release', id, root);
+        if (!rel || rel.deleted)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('release_file', root).filter((f) => f.release === id && !f.deleted).map(releaseFileView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            // Sentry takes a multipart upload (the file + a `name`). The twin records the artifact
+            // METADATA (name, size, sha1, headers/dist) faithfully; the raw bytes / source-map
+            // de-minification depth is a filed todo (sentry.events.symbolication) but the artifact registry is real.
+            const b = body(req);
+            const name = typeof b.name === 'string' ? b.name : '';
+            if (!name)
+                return err('name is required', 400);
+            const fileId = `relfile_${rows('release_file', root).length + 1}`;
+            const size = typeof b.size === 'number' ? b.size : (typeof b.contents === 'string' ? b.contents.length : 0);
+            const r = await writeResource('release_file', fileId, {
+                release: id, name, size,
+                sha1: typeof b.sha1 === 'string' ? b.sha1 : hashFingerprint(`${id}|${name}|${size}`),
+                dist: b.dist ?? null,
+                headers: (b.headers && typeof b.headers === 'object') ? b.headers : {},
+                dateCreated: req.occurredAt ?? '1970-01-01T00:00:00.000Z',
+            }, 'release_file.create', root, req.occurredAt);
+            return { status: 201, body: releaseFileView(r) };
+        }
+    }
+    // DELETE /organizations/:org/releases/:version/files/:fileId/
+    if (seg.length === 6 && seg[4] === 'files' && method === 'DELETE') {
+        const version = decodeURIComponent(seg[3]);
+        const id = `${orgSlug}:${version}`;
+        const file = rows('release_file', root).find((f) => f.id === seg[5] && f.release === id && !f.deleted);
+        if (!file)
+            return err('The requested resource does not exist', 404);
+        await writeResource('release_file', file.id, { deleted: true }, 'release_file.delete', root, req.occurredAt);
+        return { status: 204, body: null };
+    }
+    // POST /organizations/:org/releases/:version/deploys/  (+ GET list)
+    if (seg.length === 5 && seg[4] === 'deploys') {
+        const version = decodeURIComponent(seg[3]);
+        const id = `${orgSlug}:${version}`;
+        const rel = getRow('release', id, root);
+        if (!rel || rel.deleted)
+            return err('The requested resource does not exist', 404);
+        if (method === 'GET') {
+            const items = rows('deploy', root).filter((d) => d.release === id && !d.deleted).map(deployView);
+            return { status: 200, body: items };
+        }
+        if (method === 'POST') {
+            const b = body(req);
+            if (!b.environment)
+                return err('environment is required', 400);
+            const deployId = `deploy_${rows('deploy', root).length + 1}`;
+            const r = await writeResource('deploy', deployId, {
+                release: id, environment: b.environment, name: b.name ?? null, url: b.url ?? null,
+                dateStarted: b.dateStarted ?? null, dateFinished: b.dateFinished ?? (req.occurredAt ?? '1970-01-01T00:00:00.000Z'),
+            }, 'deploy.create', root, req.occurredAt);
+            return { status: 201, body: deployView(r) };
+        }
+    }
+    // GET /organizations/:org/releases/:version/commitfiles/  — files changed across the release's
+    // commits (derived from each commit's patch_set: [{ path, type }]). Sentry's suspect-commit /
+    // file-change view reads from exactly this. A release with no commits returns [].
+    if (seg.length === 5 && seg[4] === 'commitfiles' && method === 'GET') {
+        const version = decodeURIComponent(seg[3]);
+        const id = `${orgSlug}:${version}`;
+        const rel = getRow('release', id, root);
+        if (!rel || rel.deleted)
+            return err('The requested resource does not exist', 404);
+        return { status: 200, body: releaseCommitFiles(rel, root) };
+    }
+    return err('Not found', 404);
+}
+// ── SCIM 2.0 sub-API ────────────────────────────────────────────────────────────────
+// Sentry maps SCIM Users → org members and SCIM Groups → teams. Faithful SCIM envelopes
+// (schemas/meta/ListResponse), 404 on unknown id, 409 on duplicate userName.
+const SCIM_USER_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:User';
+const SCIM_GROUP_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:Group';
+const SCIM_LIST_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:ListResponse';
+function scimError(status, detail) {
+    return { status, body: { schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'], detail, status } };
+}
+function scimUserView(r) {
+    return {
+        schemas: [SCIM_USER_SCHEMA], id: r.id, userName: r.userName,
+        emails: [{ primary: true, value: r.userName, type: 'work' }],
+        active: r.active !== false,
+        name: { givenName: r.name?.givenName ?? 'N/A', familyName: r.name?.familyName ?? 'N/A' },
+        meta: { resourceType: 'User' },
+        sentryOrgRole: r.sentryOrgRole ?? 'member',
+    };
+}
+function scimGroupView(r) {
+    return {
+        schemas: [SCIM_GROUP_SCHEMA], id: r.id, displayName: r.displayName,
+        members: Array.isArray(r.members) ? r.members : [],
+        meta: { resourceType: 'Group' },
+    };
+}
+function scimList(schemaItems) {
+    return { schemas: [SCIM_LIST_SCHEMA], totalResults: schemaItems.length, startIndex: 1, itemsPerPage: schemaItems.length, Resources: schemaItems };
+}
+async function scimApi(method, seg, req) {
+    const root = req.root;
+    const orgSlug = seg[1];
+    if (!rows('organization', root).some((o) => o.slug === orgSlug && !o.deleted))
+        return scimError(404, 'Organization not found');
+    const resource = seg[4]; // 'Users' | 'Groups'
+    // ---- Users (org members) ----
+    if (resource === 'Users') {
+        if (seg.length === 5 && method === 'GET') {
+            const items = rows('scim_user', root).filter((u) => u.organizationSlug === orgSlug && !u.deleted).map(scimUserView);
+            return { status: 200, body: scimList(items) };
+        }
+        if (seg.length === 5 && method === 'POST') {
+            const b = body(req);
+            const userName = typeof b.userName === 'string' ? b.userName.trim() : '';
+            if (!userName)
+                return scimError(400, 'userName is required');
+            if (rows('scim_user', root).some((u) => u.organizationSlug === orgSlug && u.userName === userName && !u.deleted)) {
+                return scimError(409, 'User already exists in the database.');
+            }
+            const id = `scimuser_${rows('scim_user', root).length + 1}`;
+            const r = await writeResource('scim_user', id, {
+                organizationSlug: orgSlug, userName,
+                name: (b.name && typeof b.name === 'object') ? b.name : { givenName: 'N/A', familyName: 'N/A' },
+                active: b.active !== false, sentryOrgRole: b.sentryOrgRole ?? 'member',
+            }, 'scim_user.create', root, req.occurredAt);
+            return { status: 201, body: scimUserView(r) };
+        }
+        if (seg.length === 6) {
+            const u = rows('scim_user', root).find((x) => x.id === seg[5] && x.organizationSlug === orgSlug && !x.deleted);
+            if (!u)
+                return scimError(404, 'User not found');
+            if (method === 'GET')
+                return { status: 200, body: scimUserView(u) };
+            if (method === 'PATCH') {
+                // Okta deactivation: Operations: [{ op:'replace', value:{ active:false } }]
+                const b = body(req);
+                const ops = Array.isArray(b.Operations) ? b.Operations : [];
+                let active = u.active !== false;
+                for (const op of ops) {
+                    const val = (op && typeof op === 'object') ? op.value : undefined;
+                    if (val && typeof val === 'object' && 'active' in val)
+                        active = !!val.active;
+                    else if (typeof val === 'boolean')
+                        active = val;
+                }
+                const r = await writeResource('scim_user', u.id, { active }, 'scim_user.update', root, req.occurredAt);
+                return { status: 200, body: scimUserView(r) };
+            }
+            if (method === 'DELETE') {
+                await writeResource('scim_user', u.id, { deleted: true }, 'scim_user.delete', root, req.occurredAt);
+                return { status: 204, body: null };
+            }
+        }
+    }
+    // ---- Groups (teams) ----
+    if (resource === 'Groups') {
+        if (seg.length === 5 && method === 'GET') {
+            const items = rows('scim_group', root).filter((g) => g.organizationSlug === orgSlug && !g.deleted).map(scimGroupView);
+            return { status: 200, body: scimList(items) };
+        }
+        if (seg.length === 5 && method === 'POST') {
+            const b = body(req);
+            const displayName = typeof b.displayName === 'string' ? b.displayName.trim() : '';
+            if (!displayName)
+                return scimError(400, 'displayName is required');
+            const id = `scimgroup_${rows('scim_group', root).length + 1}`;
+            const r = await writeResource('scim_group', id, {
+                organizationSlug: orgSlug, displayName, members: Array.isArray(b.members) ? b.members : [],
+            }, 'scim_group.create', root, req.occurredAt);
+            return { status: 201, body: scimGroupView(r) };
+        }
+        if (seg.length === 6) {
+            const g = rows('scim_group', root).find((x) => x.id === seg[5] && x.organizationSlug === orgSlug && !x.deleted);
+            if (!g)
+                return scimError(404, 'Group not found');
+            if (method === 'GET')
+                return { status: 200, body: scimGroupView(g) };
+            if (method === 'DELETE') {
+                await writeResource('scim_group', g.id, { deleted: true }, 'scim_group.delete', root, req.occurredAt);
+                return { status: 204, body: null };
+            }
+        }
+    }
+    return scimError(404, 'Not found');
+}
+// ── Views + helpers ────────────────────────────────────────────────────────────────
+function orgView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+function teamView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+function memberView(r) {
+    const { type: _t, updatedAt: _u, deleted, organizationSlug: _o, ...rest } = r;
+    return { ...rest, id: r.id, user: r.pending ? null : { email: r.email, username: r.email } };
+}
+function keyView(r, req) {
+    const { type: _t, updatedAt: _u, deleted, public: pub, secret, projectId, ...rest } = r;
+    // Sentry returns the DSN strings alongside the key.
+    const host = req.headers?.host ?? '127.0.0.1';
+    const dsnHost = String(host);
+    return {
+        ...rest, id: r.id, public: pub, secret, projectId, isActive: r.isActive ?? true,
+        rateLimit: r.rateLimit ?? null,
+        dsn: {
+            public: `http://${pub}@${dsnHost}/${projectId}`,
+            secret: `http://${pub}:${secret}@${dsnHost}/${projectId}`,
+            csp: `http://${dsnHost}/api/${projectId}/csp-report/?sentry_key=${pub}`,
+            security: `http://${dsnHost}/api/${projectId}/security/?sentry_key=${pub}`,
+            minidump: `http://${dsnHost}/api/${projectId}/minidump/?sentry_key=${pub}`,
+        },
+    };
+}
+function releaseView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.version, shortVersion: String(r.version).slice(0, 12) };
+}
+function deployView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+function releaseFileView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+// Aggregate persisted sessions into Sentry's session-stats envelope. Crash-free rate and the
+// status breakdown are EXACT tallies (status ∈ ok|errored|crashed|abnormal), grouped by
+// release. The series buckets (`intervals`/`series`) are left empty — a time-series rollup
+// engine is a filed todo; the totals are real.
+function sessionMetrics(sessions, params) {
+    const groupBy = params.getAll('groupBy').concat(params.getAll('groupBy[]'));
+    const tally = (subset) => {
+        const total = subset.length;
+        const crashed = subset.filter((s) => s.status === 'crashed').length;
+        const errored = subset.filter((s) => s.status === 'errored').length;
+        const abnormal = subset.filter((s) => s.status === 'abnormal').length;
+        const healthy = total - crashed - errored - abnormal;
+        return {
+            'sum(session)': total,
+            'count_unique(user)': new Set(subset.map((s) => String(s.id))).size,
+            crashed, errored, abnormal, healthy,
+            crashFreeRate: total === 0 ? 1 : 1 - crashed / total,
+        };
+    };
+    let groups;
+    if (groupBy.includes('release') || groupBy.includes('session.status')) {
+        const byRelease = new Map();
+        for (const s of sessions) {
+            const rel = String(s.release ?? '');
+            const arr = byRelease.get(rel) ?? [];
+            arr.push(s);
+            byRelease.set(rel, arr);
+        }
+        groups = [...byRelease.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([release, subset]) => {
+            const t = tally(subset);
+            return { by: { release }, totals: t, series: {} };
+        });
+    }
+    else {
+        groups = [{ by: {}, totals: tally(sessions), series: {} }];
+    }
+    return {
+        start: params.get('start') ?? null, end: params.get('end') ?? null,
+        intervals: [], // time-series rollup engine is a filed todo; totals above are real tallies
+        groups,
+    };
+}
+function alertView(r) {
+    const { type: _t, updatedAt: _u, deleted, secret, ...rest } = r;
+    return { ...rest, id: r.id }; // secret omitted from the API response (Sentry hides it)
+}
+function integrationView(r) {
+    const { type: _t, updatedAt: _u, deleted, organizationSlug: _o, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+function metricAlertView(r) {
+    const { type: _t, updatedAt: _u, deleted, organizationSlug: _o, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+function dashboardView(r) {
+    const { type: _t, updatedAt: _u, deleted, organizationSlug: _o, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+function discoverView(r) {
+    const { type: _t, updatedAt: _u, deleted, organizationSlug: _o, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+// Normalize a dashboard's widgets into Sentry's widget shape ({ title, displayType, queries }).
+const WIDGET_DISPLAY_TYPES = ['line', 'area', 'bar', 'table', 'big_number', 'top_n'];
+function normalizeWidgets(raw) {
+    if (raw === undefined)
+        return { widgets: [] };
+    if (!Array.isArray(raw))
+        return { error: 'widgets must be an array' };
+    const out = [];
+    for (const w of raw) {
+        if (!w || typeof w !== 'object')
+            return { error: 'each widget must be an object' };
+        const widget = w;
+        if (!widget.title || typeof widget.title !== 'string')
+            return { error: 'widget.title is required' };
+        const displayType = String(widget.displayType ?? 'line');
+        if (!WIDGET_DISPLAY_TYPES.includes(displayType))
+            return { error: `widget.displayType must be one of ${WIDGET_DISPLAY_TYPES.join(', ')}` };
+        out.push({
+            title: widget.title, displayType,
+            queries: Array.isArray(widget.queries) ? widget.queries : [{ name: '', fields: ['count()'], conditions: '', orderby: '' }],
+            interval: widget.interval ?? '5m',
+        });
+    }
+    return { widgets: out };
+}
+// Sentry's metric-alert action targets. DELIVERY (email/Slack/Pagerduty notification sending)
+// is a filed todo — but the action TYPE catalog + per-type required fields are validated faithfully.
+const ALERT_ACTION_TYPES = {
+    'sentry.mail.actions.NotifyEmailAction': { requires: ['targetType'] },
+    'sentry.integrations.slack.notify_action.SlackNotifyServiceAction': { requires: ['channel'] },
+    'sentry.integrations.pagerduty.notify_action.PagerDutyNotifyServiceAction': { requires: ['service'] },
+    'sentry.integrations.msteams.notify_action.MsTeamsNotifyServiceAction': { requires: ['channel'] },
+    'sentry.rules.actions.notify_event.NotifyEventAction': {},
+    'sentry.rules.actions.notify_event_service.NotifyEventServiceAction': {},
+};
+function normalizeAlertActions(raw) {
+    if (raw === undefined)
+        return { actions: [] };
+    if (!Array.isArray(raw))
+        return { error: 'actions must be an array' };
+    const out = [];
+    for (const a of raw) {
+        if (!a || typeof a !== 'object')
+            return { error: 'each action must be an object' };
+        const act = a;
+        const id = String(act.id ?? '');
+        const spec = ALERT_ACTION_TYPES[id];
+        if (!spec)
+            return { error: `Unknown alert action: ${id || '(missing id)'}` };
+        for (const req of spec.requires ?? []) {
+            if (act[req] === undefined || act[req] === null || act[req] === '')
+                return { error: `action ${id} requires ${req}` };
+        }
+        out.push(act);
+    }
+    return { actions: out };
+}
+// Validate + normalize a metric-alert rule body into the stored fields. Faithful to Sentry's
+// shape: aggregate + dataset + query + triggers[{ label, alertThreshold, actions }] +
+// thresholdType (0=above, 1=below) + a time window. Required fields are failable.
+function validateMetricAlert(b, isUpdate = false) {
+    const f = {};
+    if (!isUpdate || b.name !== undefined) {
+        if (!b.name || typeof b.name !== 'string')
+            return { error: 'name is required' };
+        f.name = b.name;
+    }
+    else
+        f.name = b.name;
+    const aggregate = b.aggregate ?? 'count()';
+    f.aggregate = String(aggregate);
+    f.dataset = ['events', 'transactions', 'metrics', 'sessions', 'generic_metrics'].includes(String(b.dataset)) ? String(b.dataset) : 'events';
+    f.query = typeof b.query === 'string' ? b.query : '';
+    const window = b.timeWindow ?? b.time_window;
+    if (window !== undefined && (!Number.isFinite(Number(window)) || Number(window) <= 0))
+        return { error: 'timeWindow must be a positive number of minutes' };
+    f.timeWindow = window !== undefined ? Number(window) : 60;
+    const thresholdType = b.thresholdType ?? b.threshold_type ?? 0;
+    if (![0, 1].includes(Number(thresholdType)))
+        return { error: 'thresholdType must be 0 (above) or 1 (below)' };
+    f.thresholdType = Number(thresholdType);
+    const triggers = b.triggers;
+    if (!Array.isArray(triggers) || triggers.length === 0) {
+        if (!isUpdate)
+            return { error: 'at least one trigger is required' };
+        f.triggers = Array.isArray(b.triggers) ? b.triggers : [];
+    }
+    else {
+        const norm = [];
+        for (const t of triggers) {
+            if (!t || typeof t !== 'object')
+                return { error: 'each trigger must be an object' };
+            const tr = t;
+            const label = String(tr.label ?? '');
+            if (!['critical', 'warning'].includes(label))
+                return { error: 'trigger.label must be "critical" or "warning"' };
+            if (tr.alertThreshold === undefined || !Number.isFinite(Number(tr.alertThreshold)))
+                return { error: 'trigger.alertThreshold (a number) is required' };
+            const acts = normalizeAlertActions(tr.actions);
+            if (acts.error)
+                return { error: acts.error };
+            norm.push({ label, alertThreshold: Number(tr.alertThreshold), actions: acts.actions });
+        }
+        if (!norm.some((t) => t.label === 'critical'))
+            return { error: 'a "critical" trigger is required' };
+        f.triggers = norm;
+    }
+    f.projects = Array.isArray(b.projects) ? b.projects.map(String) : [];
+    f.status = 0; // 0 = unresolved/active; live evaluation (firing) needs the metrics engine (a filed todo)
+    return { fields: f };
+}
+// The issue's activity feed, derived from the ENTRIES that touched that issue subject. Protocol 2: a
+// serve path takes history through `subjectHistory` — the entries the head holds for one subject, parent
+// and branch together — never by reading the v1 action log.
+function issueActivity(issueId, root) {
+    const out = [];
+    const actions = subjectHistory(SERVICE, { type: 'issue', id: issueId }, root);
+    for (const a of actions) {
+        const f = a.fields ?? {};
+        let type;
+        const data = {};
+        if (a.operation === 'issue.create')
+            type = 'first_seen';
+        else if (a.operation === 'issue.merge') {
+            type = 'merge';
+            if (f.mergedInto)
+                data.mergedInto = f.mergedInto;
+        }
+        else if (f.status !== undefined) {
+            type = f.status === 'resolved' ? 'set_resolved' : f.status === 'ignored' ? 'set_ignored' : 'set_unresolved';
+        }
+        else if (f.assignedTo !== undefined) {
+            type = 'assigned';
+            data.assignee = f.assignedTo;
+        }
+        if (!type)
+            continue;
+        out.push({ id: a.id, type, dateCreated: a.occurredAt, user: a.actor?.kind === 'system' ? null : { id: a.actor?.id ?? null }, data });
+    }
+    // newest first (Sentry's activity feed order)
+    return out.reverse();
+}
+// Aggregate the issue's events into Sentry's tag-distribution shape:
+//   [{ key, name, uniqueValues, totalValues, topValues: [{ value, count, name }] }]
+// Computed live from the persisted events for the issue (the same events the API serves).
+function issueTagDistribution(issueId, root) {
+    const evs = rows('event', root).filter((e) => e.groupID === issueId && !e.deleted);
+    // key → (value → count)
+    const byKey = new Map();
+    for (const ev of evs) {
+        const tags = Array.isArray(ev.tags) ? ev.tags : [];
+        // an event always carries an implicit `level` tag (Sentry does this)
+        const pairs = tags
+            .filter((t) => t && t.key != null)
+            .map((t) => [String(t.key), String(t.value ?? '')]);
+        if (ev.level != null)
+            pairs.push(['level', String(ev.level)]);
+        for (const [k, v] of pairs) {
+            const m = byKey.get(k) ?? new Map();
+            m.set(v, (m.get(v) ?? 0) + 1);
+            byKey.set(k, m);
+        }
+    }
+    return [...byKey.entries()]
+        .sort((a, b) => a[0].localeCompare(b[0]))
+        .map(([key, values]) => {
+        const total = [...values.values()].reduce((s, n) => s + n, 0);
+        const topValues = [...values.entries()]
+            .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+            .map(([value, count]) => ({ value, name: value, count, key }));
+        return { key, name: key, uniqueValues: values.size, totalValues: total, topValues };
+    });
+}
+function attachmentView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+// Sentry's user-feedback object (the crash-report dialog submission shape).
+function userFeedbackView(r, root) {
+    const ev = rows('event', root).find((e) => e.id === r.eventID);
+    return {
+        id: r.id, eventID: r.eventID, name: r.name, email: r.email, comments: r.comments,
+        dateCreated: r.dateCreated,
+        event: { eventID: r.eventID, id: ev ? ev.id : null },
+        issue: r.issueId ?? null, user: null,
+    };
+}
+// Org-wide Discover event facets: each tag key → its top tag values across the org's events,
+// in Sentry's `events-facets` shape (`{ key, name, topValues: [{ name, value, count, ... }] }`).
+function orgEventFacets(orgSlug, root) {
+    const projIds = new Set(rows('project', root).filter((p) => p.organizationSlug === orgSlug && !p.deleted).map((p) => p.id));
+    const evs = rows('event', root).filter((e) => projIds.has(String(e.projectID)) && !e.deleted);
+    const byKey = new Map();
+    for (const ev of evs) {
+        const tags = Array.isArray(ev.tags) ? ev.tags : [];
+        const pairs = tags.filter((t) => t && t.key != null).map((t) => [String(t.key), String(t.value ?? '')]);
+        if (ev.level != null)
+            pairs.push(['level', String(ev.level)]);
+        for (const [k, v] of pairs) {
+            const m = byKey.get(k) ?? new Map();
+            m.set(v, (m.get(v) ?? 0) + 1);
+            byKey.set(k, m);
+        }
+    }
+    return [...byKey.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([key, values]) => {
+        const total = [...values.values()].reduce((s, n) => s + n, 0);
+        const topValues = [...values.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+            .map(([value, count]) => ({ name: value, value, count, key }));
+        return { key, name: key, totalValues: total, topValues };
+    });
+}
+// Files changed across a release's commits, in Sentry's commitfiles shape. Each modeled commit
+// may carry `patch_set: [{ path, type }]` (type ∈ A/M/D); commitfiles flattens those.
+function releaseCommitFiles(rel, _root) {
+    const commits = Array.isArray(rel.commits) ? rel.commits : [];
+    const out = [];
+    let n = 0;
+    for (const c of commits) {
+        const author = (c.author && typeof c.author === 'object') ? c.author : {};
+        const repoName = String(c.repository ?? c.repo ?? '');
+        const patchSet = Array.isArray(c.patch_set) ? c.patch_set : [];
+        for (const ps of patchSet) {
+            out.push({
+                id: `cf_${++n}`, filename: String(ps.path ?? ''), type: String(ps.type ?? 'M'),
+                repoName, author: { name: author.name ?? null, email: author.email ?? null },
+                commitMessage: c.message ?? null,
+            });
+        }
+    }
+    return out;
+}
+// Sentry's inbound data filters — the fixed set of built-in filters every project exposes.
+const INBOUND_FILTERS = [
+    { id: 'browser-extensions', name: 'Filter out errors known to be caused by browser extensions', description: 'browser-extensions' },
+    { id: 'legacy-browsers', name: 'Filter out events from legacy browsers', description: 'legacy-browsers' },
+    { id: 'localhost', name: 'Filter out events coming from localhost', description: 'localhost' },
+    { id: 'web-crawlers', name: 'Filter out known web crawlers', description: 'web-crawlers' },
+    { id: 'filtered-transaction', name: 'Filter out health check transactions', description: 'filtered-transaction' },
+];
+/** The project's inbound filters: the fixed catalog merged with persisted active state. */
+function projectFilters(projectId, root) {
+    const state = rows('project_filter', root).filter((f) => f.projectId === projectId && !f.deleted);
+    return INBOUND_FILTERS.map((f) => {
+        const s = state.find((x) => x.filterId === f.id);
+        return { id: f.id, name: f.name, description: f.description, active: s ? s.active ?? false : false };
+    });
+}
+// Project ownership rule view (and its empty default). Mirrors Sentry's ownership object.
+function ownershipView(r, projectId) {
+    return {
+        raw: r?.raw ?? null,
+        fallthrough: r?.fallthrough ?? true,
+        autoAssignment: r?.autoAssignment ?? 'Auto Assign to Suspect Commits',
+        codeownersAutoSync: r?.codeownersAutoSync ?? true,
+        schema: r?.schema ?? { $version: 1, rules: [] },
+        dateCreated: r?.dateCreated ?? null,
+        lastUpdated: r?.updatedAt ?? null,
+        isActive: !!(r?.raw),
+        projectId,
+    };
+}
+function codeownersView(r) {
+    const { type: _t, updatedAt: _u, deleted, ...rest } = r;
+    return { ...rest, id: r.id };
+}
+// Parse a Sentry ownership/CODEOWNERS `raw` block into the {$version,rules:[{matcher,owners}]}
+// schema. Each non-comment line is `<matcher-type>:<pattern> <owner> [owner...]`. Matcher types:
+// `path:`, `url:`, `module:`, `tags.<key>:`, or a bare CODEOWNERS glob (treated as codeowners).
+function parseOwnershipRaw(raw) {
+    const rules = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const parts = line.split(/\s+/);
+        const matcherToken = parts[0];
+        const owners = parts.slice(1).filter(Boolean);
+        if (owners.length === 0)
+            return { error: `Invalid rule (no owners): ${line}` };
+        let type = 'codeowners';
+        let pattern = matcherToken;
+        const colon = matcherToken.indexOf(':');
+        if (colon > 0) {
+            const t = matcherToken.slice(0, colon);
+            if (t === 'path' || t === 'url' || t === 'module' || t.startsWith('tags.')) {
+                type = t;
+                pattern = matcherToken.slice(colon + 1);
+            }
+        }
+        rules.push({
+            matcher: { type, pattern },
+            owners: owners.map((o) => ({ type: o.startsWith('#') ? 'team' : 'user', identifier: o.replace(/^[#@]/, '') })),
+        });
+    }
+    return { schema: { $version: 1, rules } };
+}
+function slugify(s) {
+    return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'untitled';
+}
+/** Parse a JSON request body into an object (Sentry's Web API is JSON). */
+function body(req) {
+    if (!req.body)
+        return {};
+    try {
+        const v = JSON.parse(req.body);
+        return v && typeof v === 'object' ? v : {};
+    }
+    catch {
+        return {};
+    }
+}