@volter/twin-sentry 1.0.0 → 1.0.1

package/README.md

@@ -9,8 +9,9 @@ The API and ingest share one vendor store.
 | `sentry.io`, `us.sentry.io`, `de.sentry.io` | sentry-cli release creation, finalization, commits and previous-release lookup, repository listing and source-map chunk/artifact uploads; account project creation and client-key reads; declared vendor refresh reads. | [api/spec](./api/spec/SOURCE.md), Sentry's pinned OpenAPI document and evidenced patches |
 
 The application's SDK authenticates ingestion with its public DSN key. API calls use scoped personal tokens or
-organization CI tokens, stored by their hash. The credential door is bootstrap signup: it creates the account,
-first token, project and client key named by the environment, returning the same credentials at every boot.
+organization CI tokens, stored by their hash. The credential door retains the selected organization and each
+deployment's project, client key and scoped personal token. It returns the same DSN and token on later issuance,
+with the API's native bearer authorization and origin.
 Additional projects are created through `createOrganizationProject`; their DSNs are read through `listProjectKeys`.
 
 World account doors:

package/api/spec/SOURCE.md

@@ -2,7 +2,7 @@
 
 - **Why this document:** Sentry's own OpenAPI document for its web API, as it publishes it for its API reference:
   getsentry/sentry-api-schema at `98ec014705fbecf18c2650097e4630afe51ffd85` (2026-09-29), `openapi-derefed.json`,
-  vendored gzipped and unchanged (`openapi.json.gz`).
+  vendored gzipped (`openapi.json.gz`); packaged public sample changes are listed below.
 - **Servers:** `https://{region}.sentry.io` (us, de); sentry-cli and the applications call `https://sentry.io/api/0/`.
 - **Corrections** (`patches.json`, each with its evidence): the chunk upload (`/chunk-upload/`) and artifact bundle assembly
   (`/artifactbundle/assemble/`) that sentry-cli uploads source maps through; and a single project's release paths
@@ -11,5 +11,22 @@
 
 - **Resource normalization:** the five refresh reads reference named copies of their unchanged inline response schemas. The patches cite each operation in the pinned upstream document; no wire field is added or removed.
 
-- **Vendored document SHA-256** (openapi.json.gz, decompressed bytes where gzipped): `bb07d2bb747b10b31c14722066cd1d11bd0bb76eea8dcfb5f341b4c421c1c1f9`.
+- **Original upstream document SHA-256** (openapi.json.gz, decompressed bytes where gzipped): `bb07d2bb747b10b31c14722066cd1d11bd0bb76eea8dcfb5f341b4c421c1c1f9`.
 - **Read by:** Codex contributor.
+
+## Packaged public example scalars
+
+`api/spec/openapi.json.gz` retains the pinned source above with only the string-scalar replacements listed below. Original inputs are retained outside the package at `/Volumes/PeakSSD/peak-floor/state/prod-ops/releases/vo3818-source-captures/sentry/api/spec/openapi.json.gz` and `/Volumes/PeakSSD/peak-floor/state/prod-ops/releases/vo3818-source-captures/sentry/api/spec/openapi.json`. Original uncompressed SHA-256: `bb07d2bb747b10b31c14722066cd1d11bd0bb76eea8dcfb5f341b4c421c1c1f9`; packaged uncompressed SHA-256: `e39f236da03e6162bc1fcee602a0865b04f7642fd00eb362cb256bd1cfb01d80`. Every byte outside the listed JSON string values is unchanged. These public samples are inert; runtime credentials are issued through the existing doors.
+
+| JSON pointer | Packaged value | Reason |
+| --- | --- | --- |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1latest-base~1/get/responses/200/content/application~1json/examples/LatestBaseSnapshot/value/images/0/image_url` | `/api/0/projects/org-slug/my-project/files/images/000000000000/` | Preserves the image key component of the public example URL. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1latest-base~1/get/responses/200/content/application~1json/examples/LatestBaseSnapshot/value/images/0/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1/get/responses/200/content/application~1json/examples/SnapshotWithComparison(Diff)/value/changed/0/head_image/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1/get/responses/200/content/application~1json/examples/SnapshotWithoutComparison(Solo)/value/images/0/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1images~1{image_identifier}~1/get/responses/200/content/application~1json/examples/ChangedImage/value/head_image/image_url` | `/api/0/projects/org-slug/project-slug/files/images/000000000000/` | Preserves the image key component of the public example URL. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1images~1{image_identifier}~1/get/responses/200/content/application~1json/examples/ChangedImage/value/head_image/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1/get/responses/200/content/application~1json/example/0/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1/post/responses/201/content/application~1json/example/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1{hook_id}~1/get/responses/200/content/application~1json/example/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1{hook_id}~1/put/responses/200/content/application~1json/example/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |

package/api/src/generated/ui.gen.json

@@ -1 +1 @@
-{"generatedBy":"scripts/derive-pack.ts","resources":{"organization":{"actions":[],"states":{},"embeds":{}},"project":{"list":"/api/0/organizations/{organization_id_or_slug}/projects/","actions":[],"states":{},"embeds":{}},"project_key":{"actions":[],"states":{},"embeds":{}},"event":{"retrieve":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/events/{event_id}/","actions":[],"states":{},"embeds":{}},"issue":{"retrieve":"/api/0/organizations/{organization_id_or_slug}/issues/{issue_id}/","actions":[],"states":{},"embeds":{}},"release":{"actions":[],"states":{},"embeds":{}},"monitor":{"list":"/api/0/organizations/{organization_id_or_slug}/monitors/","actions":[],"states":{},"embeds":{}},"check_in":{"list":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/monitors/{monitor_id_or_slug}/checkins/","actions":[],"states":{"status":["error","in_progress","ok"]},"embeds":{}},"_seq_token":{"actions":[],"states":{},"embeds":{}},"_seq_event":{"actions":[],"states":{},"embeds":{}},"_seq_envelope":{"actions":[],"states":{},"embeds":{}}}}
+{"generatedBy":"scripts/derive-pack.ts","resources":{"organization":{"actions":[],"states":{},"embeds":{}},"project":{"list":"/api/0/organizations/{organization_id_or_slug}/projects/","actions":[],"states":{},"embeds":{}},"project_key":{"actions":[],"states":{},"embeds":{}},"event":{"retrieve":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/events/{event_id}/","actions":[],"states":{},"embeds":{}},"issue":{"retrieve":"/api/0/organizations/{organization_id_or_slug}/issues/{issue_id}/","actions":[],"states":{},"embeds":{}},"release":{"actions":[],"states":{},"embeds":{}},"monitor":{"list":"/api/0/organizations/{organization_id_or_slug}/monitors/","actions":[],"states":{},"embeds":{}},"check_in":{"list":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/monitors/{monitor_id_or_slug}/checkins/","actions":[],"states":{"status":["error","in_progress","ok"]},"embeds":{}},"_seq_token":{"actions":[],"states":{},"embeds":{}},"_seq_event":{"actions":[],"states":{},"embeds":{}},"_seq_envelope":{"actions":[],"states":{},"embeds":{}},"_seq_project_key":{"actions":[],"states":{},"embeds":{}}}}

package/api/src/manifest.ts

@@ -8,6 +8,7 @@ export const manifest: DerivedManifest = {
   // both lanes are one service, so one store: the ingest lane writes events the API lane reads, and the doors' accounts
   // are the ingest lane's too (aws's lanes likewise)
   service: 'sentry',
+  hosts: [{ host: 'sentry.io' }, { host: 'us.sentry.io' }, { host: 'de.sentry.io' }],
   body: { json: 'always' },
   ids: { template: '{uuid}' },
   time: 'iso',
@@ -25,10 +26,10 @@ export const manifest: DerivedManifest = {
   // source: https://docs.sentry.io/api/pagination/ "Pagination in the API is handled via the Link header standard:"
   resources: {
     // source: https://docs.sentry.io/api/projects/create-a-new-project/ "6758470122493650"
-    organization: { idPrefix: '', alternateKeys: ['slug'], ids: '{digits:16}', refresh: { list: 'listOrganizations', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
+    organization: { idPrefix: '', unique: [{ fields: ['slug'], refusal: { status: 409, message: 'An organization with this slug already exists.' } }], alternateKeys: ['slug'], ids: '{digits:16}', refresh: { list: 'listOrganizations', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
     // source: spec:listOrganizationProjects "Return a list of projects bound to a organization"
     // source: https://docs.sentry.io/api/projects/create-a-new-project/ "6758470122493650"
-    project: { idPrefix: '', alternateKeys: ['slug'], ids: '{digits:16}', parent: { param: 'organization_id_or_slug', field: '_organization', resource: 'organization' }, refresh: { list: 'listOrganizationProjects', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
+    project: { idPrefix: '', unique: [{ fields: ['_organization', 'slug'], refusal: { status: 409, message: 'A project with this slug already exists.' } }], alternateKeys: ['slug'], ids: '{digits:16}', parent: { param: 'organization_id_or_slug', field: '_organization', resource: 'organization' }, refresh: { list: 'listOrganizationProjects', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
     project_key: { idPrefix: '', ids: '{hex:32}', refresh: { none: 'Client keys contain credential secrets. Credential custody keeps their secret-bearing reads out of refresh.' } },
     // source: spec:listProjectEvents "Return a list of events bound to a project."
     event: { idPrefix: '', ids: '{hex:32}', key: '{project_id_or_slug}:{event_id}', vendorUnderscored: ['_meta'], ...states.event,
@@ -43,7 +44,7 @@ export const manifest: DerivedManifest = {
     // source: spec:listProjectMonitorCheckins "Retrieve Check-Ins for a Monitor by Project"
     // source: https://raw.githubusercontent.com/getsentry/sentry/2efdd4760a75a3d395e3534b7f66a7fbb0c3f22e/src/sentry/monitors/serializers.py "str(obj.guid)"
     check_in: { ...states.check_in, idPrefix: '', ids: '{uuid}', parent: { params: ['organization_id_or_slug', 'project_id_or_slug', 'monitor_id_or_slug'], value: '{monitor_id_or_slug}', field: '_monitor', resource: 'monitor', where: { _organization: '{organization_id_or_slug}', 'project.id': '{project_id_or_slug}', id: '{monitor_id_or_slug}' } }, refresh: { list: 'listProjectMonitorCheckins', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
-    _seq_token: { idPrefix: '', ids: '{n}' }, _seq_event: { idPrefix: '', ids: '{n}' }, _seq_envelope: { idPrefix: '', ids: '{n}' },
+    _seq_token: { idPrefix: '', ids: '{n}' }, _seq_event: { idPrefix: '', ids: '{n}' }, _seq_envelope: { idPrefix: '', ids: '{n}' }, _seq_project_key: { idPrefix: '', ids: '{n}' },
   },
   unmodeled: [
     'getOrganization', 'listProjectEvents', 'getProjectRelease', 'getProjectMonitor',

package/api/src/semantics/api.ts

@@ -1,5 +1,5 @@
 import { gunzip, type HandlerContext } from '@volter/world-core';
-import { bearerToken, detail, EVENT, forbidden, grants, keyOf, makeProject, notFound, orgFor, PROJECT, projectFor, projectOf, projectView, type Row, wire } from './shared.ts';
+import { bearerToken, detail, EVENT, forbidden, grants, keyOf, makeProject, notFound, orgFor, PROJECT, projectFor, projectOf, type Row, wire } from './shared.ts';
 
 // Releases, as sentry-cli makes, finalizes and associates commits with them (`releases new`, `releases finalize`,
 // `releases set-commits`), for one project at its path or for the organization; and the organization's repositories the
@@ -199,8 +199,9 @@ export async function createOrganizationProject(ctx: HandlerContext): Promise<Re
   if (!/^(?![0-9]+$)[a-z0-9_-]+$/.test(slug)) return Response.json({ slug: ['Enter a valid slug.'] }, { status: 400 });
   if (projectOf(ctx, org, slug)) return Response.json({ slug: ['A project with this slug already exists.'] }, { status: 409 });
   const project = await makeProject(ctx, org, slug, typeof b.platform === 'string' ? b.platform : null);
+  if (project instanceof Response) return project;
   await ctx.write(PROJECT, String(project.id), { name: b.name }, 'project.update');
-  return Response.json(projectView(ctx, ctx.row(PROJECT, String(project.id))!, org), { status: 201 });
+  return Response.json(wire(ctx, ctx.row(PROJECT, String(project.id))!), { status: 201 });
 }
 
 // source: spec:listProjectKeys "Return a list of client keys bound to a project."

package/api/src/semantics/doors.ts

@@ -8,31 +8,61 @@
 //                                                   an organization auth token (Settings > Auth Tokens), or with kind
 //                                                   personal a personal token with its scopes, shown once
 import type { HandlerContext } from '@volter/world-core';
-import { dsnOf, heldOrgToken, keyOf, makeOrg, makeOrgToken, makePersonalToken, makeProject, orgBySlug, TOKEN } from './shared.ts';
+import { CLIENT_KEY, dsnOf, keyOf, makeClientKey, makeOrg, makeOrgToken, makePersonalToken, makeProject, orgBySlug, ORG, PROJECT, readToken, TOKEN } from './shared.ts';
 
 const bad = (error: string): Response => Response.json({ error }, { status: 400 });
 const bodyOf = (ctx: HandlerContext): Record<string, unknown> => (ctx.body && typeof ctx.body === 'object' ? ctx.body : {}) as Record<string, unknown>;
 const SLUG = /^[a-z0-9][a-z0-9_-]{0,49}$/;
 
-/** Bootstrap (RECIPE, State): the account's sign-up creates its first credential and env-named project/key.
- *  The World's application: the organization `world`, its project `app`, the project's DSN and a token of the
- *  organization's, made the first time and answered the same at every boot: the token is re-derived from its secret and
- *  answered while it matches its hash; one revoked is not made again. */
+/** The deployment's project client key and an independently issued auth token in its organization. */
 export async function appCredentials(ctx: HandlerContext): Promise<Response> {
-  const b = bodyOf(ctx);
-  const org = await makeOrg(ctx, String(b.organization ?? 'world'), String(b.name ?? 'World'));
-  const project = await makeProject(ctx, org, String(b.project ?? 'app'), String(b.platform ?? 'javascript'));
-  const key = keyOf(ctx, project)!;
-  const revoked = ctx.rowsRaw(TOKEN, { withDeleted: true }).some((t) => t.deleted === true && t.organization === org.id && t.name === 'world-app');
-  if (revoked) return Response.json({ error: 'the application token was revoked' }, { status: 409 });
-  const token = (await heldOrgToken(ctx, org, 'world-app')) ?? await makePersonalToken(ctx, org, 'world-app', ['org:read', 'project:read', 'project:write', 'project:releases', 'event:read', 'alerts:read']);
-  return Response.json({ dsn: dsnOf(org, project, key), auth_token: token, org: org.slug, org_id: org.id, project: project.slug }, { status: 201 });
+  try {
+    const b = bodyOf(ctx);
+    const organizationId = await ctx.account();
+    const org = await ctx.tenant(ORG, async (organization) => {
+      const label = typeof b.organization === 'string' ? b.organization : organization.id === 'default' ? 'world' : organization.id;
+      const rule = { max: 50, lower: true, allowed: /[a-z0-9_-]/, first: /[a-z0-9]/ };
+      const name = typeof b.name === 'string' ? b.name : organization.label;
+      let made = await makeOrg(ctx, ctx.vendorName(label, rule, { identity: organization.id }), name, organization.members[0]!);
+      if (made instanceof Response) made = await makeOrg(ctx, ctx.vendorName(label, rule, { suffixed: true, identity: organization.id }), name, organization.members[0]!);
+      if (made instanceof Response) throw await duplicate(made, organization.id);
+      return String(made.id);
+    });
+    const project = await ctx.deploymentObject(`project:${String(org.id)}`, PROJECT, async (deployment) => {
+      const label = typeof b.project === 'string' ? b.project : deployment || 'app';
+      const identity = deployment === '' ? organizationId : `${organizationId}/${deployment}`;
+      const rule = { max: Number.MAX_SAFE_INTEGER, lower: true, allowed: /[a-z0-9_-]/, first: /[a-z_-]/ };
+      const platform = typeof b.platform === 'string' ? b.platform : 'javascript';
+      let made = await makeProject(ctx, org, ctx.vendorName(label, rule, { identity }), platform);
+      if (made instanceof Response) made = await makeProject(ctx, org, ctx.vendorName(label, rule, { suffixed: true, identity }), platform);
+      if (made instanceof Response) throw await duplicate(made, identity);
+      return String(made.id);
+    });
+    const key = await ctx.accountKey('client-key', CLIENT_KEY, {
+      make: async () => String((keyOf(ctx, project) ?? await makeClientKey(ctx, org, project)).id),
+      read: async (row) => row._project === project.id && row.isActive !== false && typeof row.public === 'string' ? row.public : undefined,
+    });
+    const token = await ctx.accountKey('auth-token', TOKEN, {
+      make: async () => ctx.crypto.sha256(await makePersonalToken(ctx, org, ctx.deployment() || 'world-app', ['org:read', 'project:read', 'project:write', 'project:releases', 'event:read', 'alerts:read'])),
+      read: (row) => readToken(ctx, org, row),
+    });
+    return Response.json({ dsn: dsnOf(org, project, { public: key.secret }), auth_token: token.secret, authorization: `Bearer ${token.secret}`, url: 'https://sentry.io', org: org.slug, org_id: org.id, project: project.slug }, { status: 201 });
+  } catch (error) {
+    if (error instanceof Response) return error;
+    throw error;
+  }
+}
+
+async function duplicate(response: Response, identity: string): Promise<Response> {
+  const body = await response.json() as { slug: string[] };
+  return Response.json({ slug: body.slug.map((message) => `${message} (${identity})`) }, { status: response.status });
 }
 
 export async function organizations(ctx: HandlerContext): Promise<Response> {
   const b = bodyOf(ctx);
   if (typeof b.slug !== 'string' || !SLUG.test(b.slug)) return bad('a slug (lowercase letters, digits, - and _) is required');
-  const org = await makeOrg(ctx, b.slug, typeof b.name === 'string' ? b.name : b.slug);
+  const org = await makeOrg(ctx, b.slug, typeof b.name === 'string' ? b.name : b.slug, (await ctx.organization()).members[0]!);
+  if (org instanceof Response) return org;
   return Response.json({ id: org.id, slug: org.slug }, { status: 201 });
 }
 
@@ -42,9 +72,5 @@ export async function authTokens(ctx: HandlerContext): Promise<Response> {
   if (!org) return bad('organization must name an organization the World holds');
   if (typeof b.name !== 'string' || !b.name) return bad('a name is required');
   const scopes = Array.isArray(b.scopes) ? b.scopes.map(String) : ['org:read', 'project:read', 'event:read'];
-  return b.kind === 'personal' ? Response.json({ token: await makePersonalToken(ctx, org, String(b.name), scopes) }, { status: 201 }) : issueOrganizationToken(ctx, org, String(b.name));
-}
-
-async function issueOrganizationToken(ctx: HandlerContext, org: Record<string, unknown>, name: string): Promise<Response> {
-  return Response.json({ token: await makeOrgToken(ctx, org, name) }, { status: 201 });
+  return b.kind === 'personal' ? Response.json({ token: await makePersonalToken(ctx, org, String(b.name), scopes) }, { status: 201 }) : Response.json({ token: await makeOrgToken(ctx, org, String(b.name)) }, { status: 201 });
 }

package/api/src/semantics/shared.ts

@@ -1,7 +1,7 @@
 // What every family of Sentry's API shares: who is calling (an auth token the World issued), the organization a request
 // names and whether the token may act on it, and the API's answers (Django REST framework's `{"detail": ...}`).
 import type { HandlerContext } from '@volter/world-core';
-import { bearerToken, grants, orgBySlug, projectOf, type Row, wire } from '../../../src/semantics/shared.ts';
+import { bearerToken, grants, orgBySlug, projectOf, type Row } from '../../../src/semantics/shared.ts';
 
 export * from '../../../src/semantics/shared.ts';
 
@@ -29,7 +29,3 @@ export function projectFor(ctx: HandlerContext, scope: string): { org: Row; proj
   const project = projectOf(ctx, org, String(ctx.call.params.project_id_or_slug ?? ''));
   return project ? { org, project } : notFound();
 }
-
-
-
-export function projectView(ctx: HandlerContext, p: Row, _org: Row): Row { return wire(ctx, p); }

package/dist/api/spec/SOURCE.md

@@ -2,7 +2,7 @@
 
 - **Why this document:** Sentry's own OpenAPI document for its web API, as it publishes it for its API reference:
   getsentry/sentry-api-schema at `98ec014705fbecf18c2650097e4630afe51ffd85` (2026-09-29), `openapi-derefed.json`,
-  vendored gzipped and unchanged (`openapi.json.gz`).
+  vendored gzipped (`openapi.json.gz`); packaged public sample changes are listed below.
 - **Servers:** `https://{region}.sentry.io` (us, de); sentry-cli and the applications call `https://sentry.io/api/0/`.
 - **Corrections** (`patches.json`, each with its evidence): the chunk upload (`/chunk-upload/`) and artifact bundle assembly
   (`/artifactbundle/assemble/`) that sentry-cli uploads source maps through; and a single project's release paths
@@ -11,5 +11,22 @@
 
 - **Resource normalization:** the five refresh reads reference named copies of their unchanged inline response schemas. The patches cite each operation in the pinned upstream document; no wire field is added or removed.
 
-- **Vendored document SHA-256** (openapi.json.gz, decompressed bytes where gzipped): `bb07d2bb747b10b31c14722066cd1d11bd0bb76eea8dcfb5f341b4c421c1c1f9`.
+- **Original upstream document SHA-256** (openapi.json.gz, decompressed bytes where gzipped): `bb07d2bb747b10b31c14722066cd1d11bd0bb76eea8dcfb5f341b4c421c1c1f9`.
 - **Read by:** Codex contributor.
+
+## Packaged public example scalars
+
+`api/spec/openapi.json.gz` retains the pinned source above with only the string-scalar replacements listed below. Original inputs are retained outside the package at `/Volumes/PeakSSD/peak-floor/state/prod-ops/releases/vo3818-source-captures/sentry/api/spec/openapi.json.gz` and `/Volumes/PeakSSD/peak-floor/state/prod-ops/releases/vo3818-source-captures/sentry/api/spec/openapi.json`. Original uncompressed SHA-256: `bb07d2bb747b10b31c14722066cd1d11bd0bb76eea8dcfb5f341b4c421c1c1f9`; packaged uncompressed SHA-256: `e39f236da03e6162bc1fcee602a0865b04f7642fd00eb362cb256bd1cfb01d80`. Every byte outside the listed JSON string values is unchanged. These public samples are inert; runtime credentials are issued through the existing doors.
+
+| JSON pointer | Packaged value | Reason |
+| --- | --- | --- |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1latest-base~1/get/responses/200/content/application~1json/examples/LatestBaseSnapshot/value/images/0/image_url` | `/api/0/projects/org-slug/my-project/files/images/000000000000/` | Preserves the image key component of the public example URL. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1latest-base~1/get/responses/200/content/application~1json/examples/LatestBaseSnapshot/value/images/0/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1/get/responses/200/content/application~1json/examples/SnapshotWithComparison(Diff)/value/changed/0/head_image/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1/get/responses/200/content/application~1json/examples/SnapshotWithoutComparison(Solo)/value/images/0/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1images~1{image_identifier}~1/get/responses/200/content/application~1json/examples/ChangedImage/value/head_image/image_url` | `/api/0/projects/org-slug/project-slug/files/images/000000000000/` | Preserves the image key component of the public example URL. |
+| `/paths/~1api~10~1organizations~1{organization_id_or_slug}~1preprodartifacts~1snapshots~1{snapshot_id}~1images~1{image_identifier}~1/get/responses/200/content/application~1json/examples/ChangedImage/value/head_image/key` | `000000000000` | Inert fixed-width image identifier; matching image URL uses the same identifier. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1/get/responses/200/content/application~1json/example/0/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1/post/responses/201/content/application~1json/example/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1{hook_id}~1/get/responses/200/content/application~1json/example/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |
+| `/paths/~1api~10~1projects~1{organization_id_or_slug}~1{project_id_or_slug}~1hooks~1{hook_id}~1/put/responses/200/content/application~1json/example/secret` | `0000000000000000000000000000000000000000000000000000000000000000` | Inert fixed-width webhook secret sample, shared across hook read/create/update examples. |

package/dist/api/src/generated/ui.gen.json

@@ -1 +1 @@
-{"generatedBy":"scripts/derive-pack.ts","resources":{"organization":{"actions":[],"states":{},"embeds":{}},"project":{"list":"/api/0/organizations/{organization_id_or_slug}/projects/","actions":[],"states":{},"embeds":{}},"project_key":{"actions":[],"states":{},"embeds":{}},"event":{"retrieve":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/events/{event_id}/","actions":[],"states":{},"embeds":{}},"issue":{"retrieve":"/api/0/organizations/{organization_id_or_slug}/issues/{issue_id}/","actions":[],"states":{},"embeds":{}},"release":{"actions":[],"states":{},"embeds":{}},"monitor":{"list":"/api/0/organizations/{organization_id_or_slug}/monitors/","actions":[],"states":{},"embeds":{}},"check_in":{"list":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/monitors/{monitor_id_or_slug}/checkins/","actions":[],"states":{"status":["error","in_progress","ok"]},"embeds":{}},"_seq_token":{"actions":[],"states":{},"embeds":{}},"_seq_event":{"actions":[],"states":{},"embeds":{}},"_seq_envelope":{"actions":[],"states":{},"embeds":{}}}}
+{"generatedBy":"scripts/derive-pack.ts","resources":{"organization":{"actions":[],"states":{},"embeds":{}},"project":{"list":"/api/0/organizations/{organization_id_or_slug}/projects/","actions":[],"states":{},"embeds":{}},"project_key":{"actions":[],"states":{},"embeds":{}},"event":{"retrieve":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/events/{event_id}/","actions":[],"states":{},"embeds":{}},"issue":{"retrieve":"/api/0/organizations/{organization_id_or_slug}/issues/{issue_id}/","actions":[],"states":{},"embeds":{}},"release":{"actions":[],"states":{},"embeds":{}},"monitor":{"list":"/api/0/organizations/{organization_id_or_slug}/monitors/","actions":[],"states":{},"embeds":{}},"check_in":{"list":"/api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/monitors/{monitor_id_or_slug}/checkins/","actions":[],"states":{"status":["error","in_progress","ok"]},"embeds":{}},"_seq_token":{"actions":[],"states":{},"embeds":{}},"_seq_event":{"actions":[],"states":{},"embeds":{}},"_seq_envelope":{"actions":[],"states":{},"embeds":{}},"_seq_project_key":{"actions":[],"states":{},"embeds":{}}}}

package/dist/api/src/manifest.js

@@ -6,6 +6,7 @@ export const manifest = {
     // both lanes are one service, so one store: the ingest lane writes events the API lane reads, and the doors' accounts
     // are the ingest lane's too (aws's lanes likewise)
     service: 'sentry',
+    hosts: [{ host: 'sentry.io' }, { host: 'us.sentry.io' }, { host: 'de.sentry.io' }],
     body: { json: 'always' },
     ids: { template: '{uuid}' },
     time: 'iso',
@@ -23,10 +24,10 @@ export const manifest = {
     // source: https://docs.sentry.io/api/pagination/ "Pagination in the API is handled via the Link header standard:"
     resources: {
         // source: https://docs.sentry.io/api/projects/create-a-new-project/ "6758470122493650"
-        organization: { idPrefix: '', alternateKeys: ['slug'], ids: '{digits:16}', refresh: { list: 'listOrganizations', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
+        organization: { idPrefix: '', unique: [{ fields: ['slug'], refusal: { status: 409, message: 'An organization with this slug already exists.' } }], alternateKeys: ['slug'], ids: '{digits:16}', refresh: { list: 'listOrganizations', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
         // source: spec:listOrganizationProjects "Return a list of projects bound to a organization"
         // source: https://docs.sentry.io/api/projects/create-a-new-project/ "6758470122493650"
-        project: { idPrefix: '', alternateKeys: ['slug'], ids: '{digits:16}', parent: { param: 'organization_id_or_slug', field: '_organization', resource: 'organization' }, refresh: { list: 'listOrganizationProjects', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
+        project: { idPrefix: '', unique: [{ fields: ['_organization', 'slug'], refusal: { status: 409, message: 'A project with this slug already exists.' } }], alternateKeys: ['slug'], ids: '{digits:16}', parent: { param: 'organization_id_or_slug', field: '_organization', resource: 'organization' }, refresh: { list: 'listOrganizationProjects', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
         project_key: { idPrefix: '', ids: '{hex:32}', refresh: { none: 'Client keys contain credential secrets. Credential custody keeps their secret-bearing reads out of refresh.' } },
         // source: spec:listProjectEvents "Return a list of events bound to a project."
         event: { idPrefix: '', ids: '{hex:32}', key: '{project_id_or_slug}:{event_id}', vendorUnderscored: ['_meta'], ...states.event,
@@ -41,7 +42,7 @@ export const manifest = {
         // source: spec:listProjectMonitorCheckins "Retrieve Check-Ins for a Monitor by Project"
         // source: https://raw.githubusercontent.com/getsentry/sentry/2efdd4760a75a3d395e3534b7f66a7fbb0c3f22e/src/sentry/monitors/serializers.py "str(obj.guid)"
         check_in: { ...states.check_in, idPrefix: '', ids: '{uuid}', parent: { params: ['organization_id_or_slug', 'project_id_or_slug', 'monitor_id_or_slug'], value: '{monitor_id_or_slug}', field: '_monitor', resource: 'monitor', where: { _organization: '{organization_id_or_slug}', 'project.id': '{project_id_or_slug}', id: '{monitor_id_or_slug}' } }, refresh: { list: 'listProjectMonitorCheckins', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
-        _seq_token: { idPrefix: '', ids: '{n}' }, _seq_event: { idPrefix: '', ids: '{n}' }, _seq_envelope: { idPrefix: '', ids: '{n}' },
+        _seq_token: { idPrefix: '', ids: '{n}' }, _seq_event: { idPrefix: '', ids: '{n}' }, _seq_envelope: { idPrefix: '', ids: '{n}' }, _seq_project_key: { idPrefix: '', ids: '{n}' },
     },
     unmodeled: [
         'getOrganization', 'listProjectEvents', 'getProjectRelease', 'getProjectMonitor',

package/dist/api/src/manifest.ts

@@ -8,6 +8,7 @@ export const manifest: DerivedManifest = {
   // both lanes are one service, so one store: the ingest lane writes events the API lane reads, and the doors' accounts
   // are the ingest lane's too (aws's lanes likewise)
   service: 'sentry',
+  hosts: [{ host: 'sentry.io' }, { host: 'us.sentry.io' }, { host: 'de.sentry.io' }],
   body: { json: 'always' },
   ids: { template: '{uuid}' },
   time: 'iso',
@@ -25,10 +26,10 @@ export const manifest: DerivedManifest = {
   // source: https://docs.sentry.io/api/pagination/ "Pagination in the API is handled via the Link header standard:"
   resources: {
     // source: https://docs.sentry.io/api/projects/create-a-new-project/ "6758470122493650"
-    organization: { idPrefix: '', alternateKeys: ['slug'], ids: '{digits:16}', refresh: { list: 'listOrganizations', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
+    organization: { idPrefix: '', unique: [{ fields: ['slug'], refusal: { status: 409, message: 'An organization with this slug already exists.' } }], alternateKeys: ['slug'], ids: '{digits:16}', refresh: { list: 'listOrganizations', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
     // source: spec:listOrganizationProjects "Return a list of projects bound to a organization"
     // source: https://docs.sentry.io/api/projects/create-a-new-project/ "6758470122493650"
-    project: { idPrefix: '', alternateKeys: ['slug'], ids: '{digits:16}', parent: { param: 'organization_id_or_slug', field: '_organization', resource: 'organization' }, refresh: { list: 'listOrganizationProjects', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
+    project: { idPrefix: '', unique: [{ fields: ['_organization', 'slug'], refusal: { status: 409, message: 'A project with this slug already exists.' } }], alternateKeys: ['slug'], ids: '{digits:16}', parent: { param: 'organization_id_or_slug', field: '_organization', resource: 'organization' }, refresh: { list: 'listOrganizationProjects', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
     project_key: { idPrefix: '', ids: '{hex:32}', refresh: { none: 'Client keys contain credential secrets. Credential custody keeps their secret-bearing reads out of refresh.' } },
     // source: spec:listProjectEvents "Return a list of events bound to a project."
     event: { idPrefix: '', ids: '{hex:32}', key: '{project_id_or_slug}:{event_id}', vendorUnderscored: ['_meta'], ...states.event,
@@ -43,7 +44,7 @@ export const manifest: DerivedManifest = {
     // source: spec:listProjectMonitorCheckins "Retrieve Check-Ins for a Monitor by Project"
     // source: https://raw.githubusercontent.com/getsentry/sentry/2efdd4760a75a3d395e3534b7f66a7fbb0c3f22e/src/sentry/monitors/serializers.py "str(obj.guid)"
     check_in: { ...states.check_in, idPrefix: '', ids: '{uuid}', parent: { params: ['organization_id_or_slug', 'project_id_or_slug', 'monitor_id_or_slug'], value: '{monitor_id_or_slug}', field: '_monitor', resource: 'monitor', where: { _organization: '{organization_id_or_slug}', 'project.id': '{project_id_or_slug}', id: '{monitor_id_or_slug}' } }, refresh: { list: 'listProjectMonitorCheckins', items: '$body', nextLink: { header: 'link', rel: 'next', query: 'cursor', when: { results: 'true' } } } },
-    _seq_token: { idPrefix: '', ids: '{n}' }, _seq_event: { idPrefix: '', ids: '{n}' }, _seq_envelope: { idPrefix: '', ids: '{n}' },
+    _seq_token: { idPrefix: '', ids: '{n}' }, _seq_event: { idPrefix: '', ids: '{n}' }, _seq_envelope: { idPrefix: '', ids: '{n}' }, _seq_project_key: { idPrefix: '', ids: '{n}' },
   },
   unmodeled: [
     'getOrganization', 'listProjectEvents', 'getProjectRelease', 'getProjectMonitor',

package/dist/api/src/semantics/api.js

@@ -1,5 +1,5 @@
 import { gunzip } from '@volter/world-core';
-import { bearerToken, detail, EVENT, forbidden, grants, keyOf, makeProject, notFound, orgFor, PROJECT, projectFor, projectOf, projectView, wire } from "./shared.js";
+import { bearerToken, detail, EVENT, forbidden, grants, keyOf, makeProject, notFound, orgFor, PROJECT, projectFor, projectOf, wire } from "./shared.js";
 // Releases, as sentry-cli makes, finalizes and associates commits with them (`releases new`, `releases finalize`,
 // `releases set-commits`), for one project at its path or for the organization; and the organization's repositories the
 // commits are read against. A release is the organization's, by its version, linked to the projects it was made for.
@@ -220,8 +220,10 @@ export async function createOrganizationProject(ctx) {
     if (projectOf(ctx, org, slug))
         return Response.json({ slug: ['A project with this slug already exists.'] }, { status: 409 });
     const project = await makeProject(ctx, org, slug, typeof b.platform === 'string' ? b.platform : null);
+    if (project instanceof Response)
+        return project;
     await ctx.write(PROJECT, String(project.id), { name: b.name }, 'project.update');
-    return Response.json(projectView(ctx, ctx.row(PROJECT, String(project.id)), org), { status: 201 });
+    return Response.json(wire(ctx, ctx.row(PROJECT, String(project.id))), { status: 201 });
 }
 // source: spec:listProjectKeys "Return a list of client keys bound to a project."
 export async function listProjectKeys(ctx) {

package/dist/api/src/semantics/api.ts

@@ -1,5 +1,5 @@
 import { gunzip, type HandlerContext } from '@volter/world-core';
-import { bearerToken, detail, EVENT, forbidden, grants, keyOf, makeProject, notFound, orgFor, PROJECT, projectFor, projectOf, projectView, type Row, wire } from './shared.ts';
+import { bearerToken, detail, EVENT, forbidden, grants, keyOf, makeProject, notFound, orgFor, PROJECT, projectFor, projectOf, type Row, wire } from './shared.ts';
 
 // Releases, as sentry-cli makes, finalizes and associates commits with them (`releases new`, `releases finalize`,
 // `releases set-commits`), for one project at its path or for the organization; and the organization's repositories the
@@ -199,8 +199,9 @@ export async function createOrganizationProject(ctx: HandlerContext): Promise<Re
   if (!/^(?![0-9]+$)[a-z0-9_-]+$/.test(slug)) return Response.json({ slug: ['Enter a valid slug.'] }, { status: 400 });
   if (projectOf(ctx, org, slug)) return Response.json({ slug: ['A project with this slug already exists.'] }, { status: 409 });
   const project = await makeProject(ctx, org, slug, typeof b.platform === 'string' ? b.platform : null);
+  if (project instanceof Response) return project;
   await ctx.write(PROJECT, String(project.id), { name: b.name }, 'project.update');
-  return Response.json(projectView(ctx, ctx.row(PROJECT, String(project.id))!, org), { status: 201 });
+  return Response.json(wire(ctx, ctx.row(PROJECT, String(project.id))!), { status: 201 });
 }
 
 // source: spec:listProjectKeys "Return a list of client keys bound to a project."

package/dist/api/src/semantics/doors.d.ts

@@ -1,8 +1,5 @@
 import type { HandlerContext } from '@volter/world-core';
-/** Bootstrap (RECIPE, State): the account's sign-up creates its first credential and env-named project/key.
- *  The World's application: the organization `world`, its project `app`, the project's DSN and a token of the
- *  organization's, made the first time and answered the same at every boot: the token is re-derived from its secret and
- *  answered while it matches its hash; one revoked is not made again. */
+/** The deployment's project client key and an independently issued auth token in its organization. */
 export declare function appCredentials(ctx: HandlerContext): Promise<Response>;
 export declare function organizations(ctx: HandlerContext): Promise<Response>;
 export declare function authTokens(ctx: HandlerContext): Promise<Response>;

package/dist/api/src/semantics/doors.js

@@ -1,27 +1,62 @@
-import { dsnOf, heldOrgToken, keyOf, makeOrg, makeOrgToken, makePersonalToken, makeProject, orgBySlug, TOKEN } from "./shared.js";
+import { CLIENT_KEY, dsnOf, keyOf, makeClientKey, makeOrg, makeOrgToken, makePersonalToken, makeProject, orgBySlug, ORG, PROJECT, readToken, TOKEN } from "./shared.js";
 const bad = (error) => Response.json({ error }, { status: 400 });
 const bodyOf = (ctx) => (ctx.body && typeof ctx.body === 'object' ? ctx.body : {});
 const SLUG = /^[a-z0-9][a-z0-9_-]{0,49}$/;
-/** Bootstrap (RECIPE, State): the account's sign-up creates its first credential and env-named project/key.
- *  The World's application: the organization `world`, its project `app`, the project's DSN and a token of the
- *  organization's, made the first time and answered the same at every boot: the token is re-derived from its secret and
- *  answered while it matches its hash; one revoked is not made again. */
+/** The deployment's project client key and an independently issued auth token in its organization. */
 export async function appCredentials(ctx) {
-    const b = bodyOf(ctx);
-    const org = await makeOrg(ctx, String(b.organization ?? 'world'), String(b.name ?? 'World'));
-    const project = await makeProject(ctx, org, String(b.project ?? 'app'), String(b.platform ?? 'javascript'));
-    const key = keyOf(ctx, project);
-    const revoked = ctx.rowsRaw(TOKEN, { withDeleted: true }).some((t) => t.deleted === true && t.organization === org.id && t.name === 'world-app');
-    if (revoked)
-        return Response.json({ error: 'the application token was revoked' }, { status: 409 });
-    const token = (await heldOrgToken(ctx, org, 'world-app')) ?? await makePersonalToken(ctx, org, 'world-app', ['org:read', 'project:read', 'project:write', 'project:releases', 'event:read', 'alerts:read']);
-    return Response.json({ dsn: dsnOf(org, project, key), auth_token: token, org: org.slug, org_id: org.id, project: project.slug }, { status: 201 });
+    try {
+        const b = bodyOf(ctx);
+        const organizationId = await ctx.account();
+        const org = await ctx.tenant(ORG, async (organization) => {
+            const label = typeof b.organization === 'string' ? b.organization : organization.id === 'default' ? 'world' : organization.id;
+            const rule = { max: 50, lower: true, allowed: /[a-z0-9_-]/, first: /[a-z0-9]/ };
+            const name = typeof b.name === 'string' ? b.name : organization.label;
+            let made = await makeOrg(ctx, ctx.vendorName(label, rule, { identity: organization.id }), name, organization.members[0]);
+            if (made instanceof Response)
+                made = await makeOrg(ctx, ctx.vendorName(label, rule, { suffixed: true, identity: organization.id }), name, organization.members[0]);
+            if (made instanceof Response)
+                throw await duplicate(made, organization.id);
+            return String(made.id);
+        });
+        const project = await ctx.deploymentObject(`project:${String(org.id)}`, PROJECT, async (deployment) => {
+            const label = typeof b.project === 'string' ? b.project : deployment || 'app';
+            const identity = deployment === '' ? organizationId : `${organizationId}/${deployment}`;
+            const rule = { max: Number.MAX_SAFE_INTEGER, lower: true, allowed: /[a-z0-9_-]/, first: /[a-z_-]/ };
+            const platform = typeof b.platform === 'string' ? b.platform : 'javascript';
+            let made = await makeProject(ctx, org, ctx.vendorName(label, rule, { identity }), platform);
+            if (made instanceof Response)
+                made = await makeProject(ctx, org, ctx.vendorName(label, rule, { suffixed: true, identity }), platform);
+            if (made instanceof Response)
+                throw await duplicate(made, identity);
+            return String(made.id);
+        });
+        const key = await ctx.accountKey('client-key', CLIENT_KEY, {
+            make: async () => String((keyOf(ctx, project) ?? await makeClientKey(ctx, org, project)).id),
+            read: async (row) => row._project === project.id && row.isActive !== false && typeof row.public === 'string' ? row.public : undefined,
+        });
+        const token = await ctx.accountKey('auth-token', TOKEN, {
+            make: async () => ctx.crypto.sha256(await makePersonalToken(ctx, org, ctx.deployment() || 'world-app', ['org:read', 'project:read', 'project:write', 'project:releases', 'event:read', 'alerts:read'])),
+            read: (row) => readToken(ctx, org, row),
+        });
+        return Response.json({ dsn: dsnOf(org, project, { public: key.secret }), auth_token: token.secret, authorization: `Bearer ${token.secret}`, url: 'https://sentry.io', org: org.slug, org_id: org.id, project: project.slug }, { status: 201 });
+    }
+    catch (error) {
+        if (error instanceof Response)
+            return error;
+        throw error;
+    }
+}
+async function duplicate(response, identity) {
+    const body = await response.json();
+    return Response.json({ slug: body.slug.map((message) => `${message} (${identity})`) }, { status: response.status });
 }
 export async function organizations(ctx) {
     const b = bodyOf(ctx);
     if (typeof b.slug !== 'string' || !SLUG.test(b.slug))
         return bad('a slug (lowercase letters, digits, - and _) is required');
-    const org = await makeOrg(ctx, b.slug, typeof b.name === 'string' ? b.name : b.slug);
+    const org = await makeOrg(ctx, b.slug, typeof b.name === 'string' ? b.name : b.slug, (await ctx.organization()).members[0]);
+    if (org instanceof Response)
+        return org;
     return Response.json({ id: org.id, slug: org.slug }, { status: 201 });
 }
 export async function authTokens(ctx) {
@@ -32,8 +67,5 @@ export async function authTokens(ctx) {
     if (typeof b.name !== 'string' || !b.name)
         return bad('a name is required');
     const scopes = Array.isArray(b.scopes) ? b.scopes.map(String) : ['org:read', 'project:read', 'event:read'];
-    return b.kind === 'personal' ? Response.json({ token: await makePersonalToken(ctx, org, String(b.name), scopes) }, { status: 201 }) : issueOrganizationToken(ctx, org, String(b.name));
-}
-async function issueOrganizationToken(ctx, org, name) {
-    return Response.json({ token: await makeOrgToken(ctx, org, name) }, { status: 201 });
+    return b.kind === 'personal' ? Response.json({ token: await makePersonalToken(ctx, org, String(b.name), scopes) }, { status: 201 }) : Response.json({ token: await makeOrgToken(ctx, org, String(b.name)) }, { status: 201 });
 }

package/dist/api/src/semantics/doors.ts

@@ -8,31 +8,61 @@
 //                                                   an organization auth token (Settings > Auth Tokens), or with kind
 //                                                   personal a personal token with its scopes, shown once
 import type { HandlerContext } from '@volter/world-core';
-import { dsnOf, heldOrgToken, keyOf, makeOrg, makeOrgToken, makePersonalToken, makeProject, orgBySlug, TOKEN } from './shared.ts';
+import { CLIENT_KEY, dsnOf, keyOf, makeClientKey, makeOrg, makeOrgToken, makePersonalToken, makeProject, orgBySlug, ORG, PROJECT, readToken, TOKEN } from './shared.ts';
 
 const bad = (error: string): Response => Response.json({ error }, { status: 400 });
 const bodyOf = (ctx: HandlerContext): Record<string, unknown> => (ctx.body && typeof ctx.body === 'object' ? ctx.body : {}) as Record<string, unknown>;
 const SLUG = /^[a-z0-9][a-z0-9_-]{0,49}$/;
 
-/** Bootstrap (RECIPE, State): the account's sign-up creates its first credential and env-named project/key.
- *  The World's application: the organization `world`, its project `app`, the project's DSN and a token of the
- *  organization's, made the first time and answered the same at every boot: the token is re-derived from its secret and
- *  answered while it matches its hash; one revoked is not made again. */
+/** The deployment's project client key and an independently issued auth token in its organization. */
 export async function appCredentials(ctx: HandlerContext): Promise<Response> {
-  const b = bodyOf(ctx);
-  const org = await makeOrg(ctx, String(b.organization ?? 'world'), String(b.name ?? 'World'));
-  const project = await makeProject(ctx, org, String(b.project ?? 'app'), String(b.platform ?? 'javascript'));
-  const key = keyOf(ctx, project)!;
-  const revoked = ctx.rowsRaw(TOKEN, { withDeleted: true }).some((t) => t.deleted === true && t.organization === org.id && t.name === 'world-app');
-  if (revoked) return Response.json({ error: 'the application token was revoked' }, { status: 409 });
-  const token = (await heldOrgToken(ctx, org, 'world-app')) ?? await makePersonalToken(ctx, org, 'world-app', ['org:read', 'project:read', 'project:write', 'project:releases', 'event:read', 'alerts:read']);
-  return Response.json({ dsn: dsnOf(org, project, key), auth_token: token, org: org.slug, org_id: org.id, project: project.slug }, { status: 201 });
+  try {
+    const b = bodyOf(ctx);
+    const organizationId = await ctx.account();
+    const org = await ctx.tenant(ORG, async (organization) => {
+      const label = typeof b.organization === 'string' ? b.organization : organization.id === 'default' ? 'world' : organization.id;
+      const rule = { max: 50, lower: true, allowed: /[a-z0-9_-]/, first: /[a-z0-9]/ };
+      const name = typeof b.name === 'string' ? b.name : organization.label;
+      let made = await makeOrg(ctx, ctx.vendorName(label, rule, { identity: organization.id }), name, organization.members[0]!);
+      if (made instanceof Response) made = await makeOrg(ctx, ctx.vendorName(label, rule, { suffixed: true, identity: organization.id }), name, organization.members[0]!);
+      if (made instanceof Response) throw await duplicate(made, organization.id);
+      return String(made.id);
+    });
+    const project = await ctx.deploymentObject(`project:${String(org.id)}`, PROJECT, async (deployment) => {
+      const label = typeof b.project === 'string' ? b.project : deployment || 'app';
+      const identity = deployment === '' ? organizationId : `${organizationId}/${deployment}`;
+      const rule = { max: Number.MAX_SAFE_INTEGER, lower: true, allowed: /[a-z0-9_-]/, first: /[a-z_-]/ };
+      const platform = typeof b.platform === 'string' ? b.platform : 'javascript';
+      let made = await makeProject(ctx, org, ctx.vendorName(label, rule, { identity }), platform);
+      if (made instanceof Response) made = await makeProject(ctx, org, ctx.vendorName(label, rule, { suffixed: true, identity }), platform);
+      if (made instanceof Response) throw await duplicate(made, identity);
+      return String(made.id);
+    });
+    const key = await ctx.accountKey('client-key', CLIENT_KEY, {
+      make: async () => String((keyOf(ctx, project) ?? await makeClientKey(ctx, org, project)).id),
+      read: async (row) => row._project === project.id && row.isActive !== false && typeof row.public === 'string' ? row.public : undefined,
+    });
+    const token = await ctx.accountKey('auth-token', TOKEN, {
+      make: async () => ctx.crypto.sha256(await makePersonalToken(ctx, org, ctx.deployment() || 'world-app', ['org:read', 'project:read', 'project:write', 'project:releases', 'event:read', 'alerts:read'])),
+      read: (row) => readToken(ctx, org, row),
+    });
+    return Response.json({ dsn: dsnOf(org, project, { public: key.secret }), auth_token: token.secret, authorization: `Bearer ${token.secret}`, url: 'https://sentry.io', org: org.slug, org_id: org.id, project: project.slug }, { status: 201 });
+  } catch (error) {
+    if (error instanceof Response) return error;
+    throw error;
+  }
+}
+
+async function duplicate(response: Response, identity: string): Promise<Response> {
+  const body = await response.json() as { slug: string[] };
+  return Response.json({ slug: body.slug.map((message) => `${message} (${identity})`) }, { status: response.status });
 }
 
 export async function organizations(ctx: HandlerContext): Promise<Response> {
   const b = bodyOf(ctx);
   if (typeof b.slug !== 'string' || !SLUG.test(b.slug)) return bad('a slug (lowercase letters, digits, - and _) is required');
-  const org = await makeOrg(ctx, b.slug, typeof b.name === 'string' ? b.name : b.slug);
+  const org = await makeOrg(ctx, b.slug, typeof b.name === 'string' ? b.name : b.slug, (await ctx.organization()).members[0]!);
+  if (org instanceof Response) return org;
   return Response.json({ id: org.id, slug: org.slug }, { status: 201 });
 }
 
@@ -42,9 +72,5 @@ export async function authTokens(ctx: HandlerContext): Promise<Response> {
   if (!org) return bad('organization must name an organization the World holds');
   if (typeof b.name !== 'string' || !b.name) return bad('a name is required');
   const scopes = Array.isArray(b.scopes) ? b.scopes.map(String) : ['org:read', 'project:read', 'event:read'];
-  return b.kind === 'personal' ? Response.json({ token: await makePersonalToken(ctx, org, String(b.name), scopes) }, { status: 201 }) : issueOrganizationToken(ctx, org, String(b.name));
-}
-
-async function issueOrganizationToken(ctx: HandlerContext, org: Record<string, unknown>, name: string): Promise<Response> {
-  return Response.json({ token: await makeOrgToken(ctx, org, name) }, { status: 201 });
+  return b.kind === 'personal' ? Response.json({ token: await makePersonalToken(ctx, org, String(b.name), scopes) }, { status: 201 }) : Response.json({ token: await makeOrgToken(ctx, org, String(b.name)) }, { status: 201 });
 }

package/dist/api/src/semantics/shared.d.ts

@@ -12,4 +12,3 @@ export declare function projectFor(ctx: HandlerContext, scope: string): {
     org: Row;
     project: Row;
 } | Response;
-export declare function projectView(ctx: HandlerContext, p: Row, _org: Row): Row;