mergen-server 1.4.0

package/dist/routes/oidc-issuer.js

@@ -0,0 +1,30 @@
+import { Router } from "express";
+import { getPublicJwks, getIssuerUrl, isOidcIssuerConfigured } from "../intelligence/oidc-issuer.js";
+function createOidcIssuerRouter() {
+  const router = Router();
+  router.get("/.well-known/jwks.json", async (_req, res) => {
+    res.json(await getPublicJwks());
+  });
+  router.get("/.well-known/openid-configuration", (_req, res) => {
+    if (!isOidcIssuerConfigured()) {
+      res.status(503).json({
+        error: "oidc-issuer: MERGEN_PUBLIC_URL is not set \u2014 Mergen cannot act as an OIDC issuer for cloud credential federation until it has a reachable issuer URL configured."
+      });
+      return;
+    }
+    const issuer = getIssuerUrl();
+    res.json({
+      issuer,
+      jwks_uri: `${issuer}/.well-known/jwks.json`,
+      response_types_supported: ["id_token"],
+      subject_types_supported: ["public"],
+      id_token_signing_alg_values_supported: ["RS256"]
+      // No authorization/token endpoints — Mergen issues federation tokens
+      // programmatically (oidc-issuer.ts), not via an interactive OAuth flow.
+    });
+  });
+  return router;
+}
+export {
+  createOidcIssuerRouter
+};

package/dist/routes/onboarding.js

@@ -0,0 +1,170 @@
+import { Router } from "express";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { store } from "../sensor/buffer.js";
+import { getActivePlanId } from "../intelligence/license.js";
+import { getStores } from "../storage/store-registry.js";
+import { DATA_DIR } from "../sensor/paths.js";
+const DISMISSED_FILE = join(DATA_DIR, "onboarding-dismissed.json");
+function isDismissed() {
+  try {
+    const raw = readFileSync(DISMISSED_FILE, "utf8");
+    return JSON.parse(raw).dismissed === true;
+  } catch {
+    return false;
+  }
+}
+function ideConfigured() {
+  try {
+    const { execSync } = require("child_process");
+    const out = execSync("claude mcp list 2>&1", { encoding: "utf8" });
+    if (out.includes("mergen")) return true;
+  } catch {
+  }
+  const cursorCfg = join(homedir(), ".cursor", "mcp.json");
+  if (existsSync(cursorCfg)) {
+    try {
+      const c = JSON.parse(readFileSync(cursorCfg, "utf8"));
+      if (c?.mcpServers?.mergen) return true;
+    } catch {
+    }
+  }
+  const wsurfCfg = join(homedir(), ".codeium", "windsurf", "mcp_config.json");
+  if (existsSync(wsurfCfg)) {
+    try {
+      const c = JSON.parse(readFileSync(wsurfCfg, "utf8"));
+      if (c?.mcpServers?.mergen) return true;
+    } catch {
+    }
+  }
+  const vscodeCfg = join(homedir(), ".vscode", "settings.json");
+  if (existsSync(vscodeCfg)) {
+    try {
+      const c = JSON.parse(readFileSync(vscodeCfg, "utf8"));
+      if (c?.["mcp.servers"]?.mergen) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function hasReceivedEvents() {
+  return store.getLogs(1).length > 0 || store.getNetwork(1).length > 0;
+}
+function isSlackConfigured() {
+  return !!process.env.MERGEN_SLACK_BOT_TOKEN && !!process.env.MERGEN_SLACK_CHANNEL;
+}
+function isPagerDutyConfigured() {
+  return !!process.env.MERGEN_PAGERDUTY_SECRET;
+}
+function isGitHubConnected() {
+  const secretFile = join(homedir(), ".mergen", "github-webhook-secret");
+  return existsSync(secretFile) || !!process.env.GITHUB_WEBHOOK_SECRET;
+}
+function isOnPaidPlan() {
+  return getActivePlanId() !== "free";
+}
+const TEAM_UPGRADE_THRESHOLD = 5;
+function createOnboardingRouter() {
+  const router = Router();
+  router.get("/onboarding/status", async (req, res) => {
+    const dismissed = isDismissed();
+    const incidentCount = (await getStores().incidents.list(void 0, 200, req.tenantId)).length;
+    const nudgeUpgrade = !isOnPaidPlan() && incidentCount >= TEAM_UPGRADE_THRESHOLD;
+    const steps = [
+      {
+        id: "server_running",
+        label: "Server is running",
+        description: "Mergen HTTP server is accepting events.",
+        status: "done"
+        // if this endpoint is reachable, the server is running
+      },
+      {
+        id: "ide_configured",
+        label: "IDE connected via MCP",
+        description: "Your AI IDE (Claude Code, Cursor, VS Code, Windsurf) is configured to use Mergen.",
+        status: ideConfigured() ? "done" : "pending",
+        command: "mergen-server setup",
+        docsUrl: "https://github.com/omertt27/Mergen/blob/main/QUICKSTART.md"
+      },
+      {
+        id: "first_event",
+        label: "First telemetry event received",
+        description: "Mergen has received at least one event from your application.",
+        status: hasReceivedEvents() ? "done" : "pending",
+        command: "mergen-server watch npm start",
+        docsUrl: "https://github.com/omertt27/Mergen#backend-instrumentation"
+      },
+      {
+        id: "slack_configured",
+        label: "Slack connected",
+        description: "Mergen can post incident alerts and thread replies to Slack.",
+        status: isSlackConfigured() ? "done" : "pending",
+        command: "export MERGEN_SLACK_BOT_TOKEN=xoxb-...",
+        docsUrl: "https://github.com/omertt27/Mergen#environment-variables"
+      },
+      {
+        id: "pagerduty_configured",
+        label: "PagerDuty webhook registered",
+        description: "Mergen receives PagerDuty incident triggers for autonomous triage.",
+        status: isPagerDutyConfigured() ? "done" : "pending",
+        command: "export MERGEN_PAGERDUTY_SECRET=...",
+        docsUrl: "https://github.com/omertt27/Mergen#environment-variables"
+      },
+      {
+        id: "github_connected",
+        label: "GitHub intent archive connected",
+        description: 'Mergen populates the PR history that powers "why was this changed?" answers.',
+        status: isGitHubConnected() ? "done" : "pending",
+        command: "mergen-server connect github --repo owner/repo",
+        docsUrl: "https://github.com/omertt27/Mergen#mcp-tools-reference"
+      },
+      {
+        id: "paid_plan",
+        label: "Upgraded to a paid plan",
+        description: "Unlock backend observability, more analysis credits, and autonomous execution.",
+        status: isOnPaidPlan() ? "done" : "pending",
+        docsUrl: "https://mergen.app/pricing"
+      },
+      ...nudgeUpgrade ? [{
+        id: "team_upgrade_prompt",
+        label: `You've analyzed ${incidentCount} incidents \u2014 share with your team`,
+        description: `The override corpus you've built on ${incidentCount} incidents is your team's most valuable asset. Team plan ($2,500/mo) shares it across your on-call rotation, adds incident replay, and unlocks the shadow analytics PDF your CISO needs for autopilot sign-off.`,
+        status: "pending",
+        docsUrl: "https://mergen.app/pricing",
+        command: "open https://mergen.app/pricing"
+      }] : []
+    ];
+    const done = steps.filter((s) => s.status === "done").length;
+    const total = steps.length;
+    const pct = Math.round(done / total * 100);
+    const nextStep = steps.find((s) => s.status === "pending") ?? null;
+    res.json({
+      ok: true,
+      dismissed,
+      percentComplete: pct,
+      stepsComplete: done,
+      stepsTotal: total,
+      nextStep: nextStep ? {
+        id: nextStep.id,
+        label: nextStep.label,
+        command: nextStep.command ?? null,
+        docsUrl: nextStep.docsUrl ?? null
+      } : null,
+      steps
+    });
+  });
+  router.post("/onboarding/dismiss", (_req, res) => {
+    try {
+      mkdirSync(DATA_DIR, { recursive: true });
+      writeFileSync(DISMISSED_FILE, JSON.stringify({ dismissed: true, dismissedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ ok: false, error: err instanceof Error ? err.message : "write failed" });
+    }
+  });
+  return router;
+}
+export {
+  createOnboardingRouter
+};

package/dist/routes/otel.js

@@ -0,0 +1,67 @@
+import { Router } from "express";
+import {
+  configureOtel,
+  disableOtel,
+  getOtelConfig
+} from "../sensor/otel-exporter.js";
+import { getActivePlanId } from "../intelligence/license.js";
+import { getPlan } from "../intelligence/plans.js";
+import logger from "../sensor/logger.js";
+const otelRouter = Router();
+function isOtelPlan() {
+  return getPlan(getActivePlanId()).backendObservability;
+}
+otelRouter.get("/otel-config", (_req, res) => {
+  const cfg = getOtelConfig();
+  if (!cfg) {
+    res.json({ enabled: false });
+    return;
+  }
+  res.json({
+    enabled: cfg.enabled,
+    endpoint: cfg.endpoint,
+    serviceName: cfg.serviceName ?? "mergen",
+    configuredAt: cfg.configuredAt,
+    headerCount: Object.keys(cfg.headers ?? {}).length
+  });
+});
+otelRouter.post("/otel-config", async (req, res) => {
+  if (!isOtelPlan()) {
+    res.status(403).json({
+      error: "OpenTelemetry export requires Solo Pro or Team plan",
+      upgradeUrl: "https://mergen.app/pricing"
+    });
+    return;
+  }
+  const { endpoint, headers, serviceName } = req.body;
+  if (!endpoint || typeof endpoint !== "string" || !endpoint.startsWith("http")) {
+    res.status(400).json({ error: "endpoint must be a valid HTTP(S) URL" });
+    return;
+  }
+  if (headers !== void 0 && (typeof headers !== "object" || Array.isArray(headers))) {
+    res.status(400).json({ error: "headers must be a flat object of string values" });
+    return;
+  }
+  const cfg = {
+    endpoint: endpoint.trim(),
+    headers: headers ?? {},
+    serviceName: (serviceName ?? "mergen").trim(),
+    enabled: true,
+    configuredAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    await configureOtel(cfg);
+    logger.info({ endpoint: cfg.endpoint }, "OTel config updated via API");
+    res.json({ ok: true, endpoint: cfg.endpoint, serviceName: cfg.serviceName });
+  } catch (err) {
+    logger.error({ err }, "OTel provider setup failed");
+    res.status(500).json({ error: "Failed to initialize OTLP exporter", detail: String(err) });
+  }
+});
+otelRouter.delete("/otel-config", async (_req, res) => {
+  await disableOtel();
+  res.json({ ok: true });
+});
+export {
+  otelRouter
+};

package/dist/routes/otlp-receiver.js

@@ -0,0 +1,179 @@
+import { Router } from "express";
+import { store } from "../sensor/buffer.js";
+import { historyStore } from "../sensor/sqlite-store.js";
+import { serviceGraph, extractCalleeService } from "../sensor/service-graph.js";
+import { routeReachability } from "../sensor/route-reachability.js";
+import logger from "../sensor/logger.js";
+const otlpReceiverRouter = Router();
+function anyStr(v) {
+  if (!v) return "";
+  if (typeof v.stringValue === "string") return v.stringValue;
+  if (typeof v.intValue !== "undefined") return String(v.intValue);
+  if (typeof v.doubleValue !== "undefined") return String(v.doubleValue);
+  if (typeof v.boolValue !== "undefined") return String(v.boolValue);
+  return "";
+}
+function anyNum(v) {
+  if (!v) return 0;
+  if (typeof v.intValue !== "undefined") return Number(v.intValue);
+  if (typeof v.doubleValue !== "undefined") return Number(v.doubleValue);
+  return 0;
+}
+function attrMap(attrs) {
+  const out = {};
+  for (const kv of attrs ?? []) {
+    if (kv.key) out[kv.key] = anyStr(kv.value);
+  }
+  return out;
+}
+function nanoToMs(nano) {
+  if (!nano) return Date.now();
+  const n = typeof nano === "string" ? BigInt(nano) : BigInt(Math.round(Number(nano)));
+  return Number(n / 1000000n);
+}
+function normalizeId(id, expectedHexLen) {
+  if (!id) return "0".repeat(expectedHexLen);
+  if (/^[0-9a-f]+$/i.test(id) && id.length === expectedHexLen) return id.toLowerCase();
+  try {
+    const buf = Buffer.from(id, "base64");
+    return buf.toString("hex").padStart(expectedHexLen, "0").slice(0, expectedHexLen);
+  } catch {
+    return id.slice(0, expectedHexLen).toLowerCase();
+  }
+}
+const SPAN_KIND_SERVER = 2;
+const SPAN_KIND_CLIENT = 3;
+function severityToLevel(n, text) {
+  const t = (text ?? "").toLowerCase();
+  if (n !== void 0) {
+    if (n >= 17) return "error";
+    if (n >= 13) return "warn";
+  }
+  if (t.includes("error") || t.includes("fatal") || t.includes("crit")) return "error";
+  if (t.includes("warn")) return "warn";
+  return "log";
+}
+otlpReceiverRouter.post("/v1/traces", (req, res) => {
+  if (req.headers["content-type"]?.includes("application/x-protobuf")) {
+    res.status(415).json({
+      error: "Mergen OTLP receiver accepts JSON only. Set OTEL_EXPORTER_OTLP_PROTOCOL=http/json in your service."
+    });
+    return;
+  }
+  const payload = req.body;
+  if (!payload?.resourceSpans) {
+    res.status(400).json({ error: "missing resourceSpans" });
+    return;
+  }
+  let ingested = 0;
+  for (const rs of payload.resourceSpans ?? []) {
+    const resourceAttrs = attrMap(rs.resource?.attributes);
+    const serviceName = resourceAttrs["service.name"] ?? "unknown";
+    for (const ss of rs.scopeSpans ?? []) {
+      for (const span of ss.spans ?? []) {
+        const traceId = normalizeId(span.traceId, 32);
+        const spanId = normalizeId(span.spanId, 16);
+        const parentId = span.parentSpanId ? normalizeId(span.parentSpanId, 16) : void 0;
+        const startMs = nanoToMs(span.startTimeUnixNano);
+        const endMs = nanoToMs(span.endTimeUnixNano);
+        const durMs = Math.max(0, endMs - startMs);
+        const attrs = attrMap(span.attributes);
+        const method = attrs["http.method"] ?? attrs["rpc.method"] ?? "UNKNOWN";
+        const route = attrs["http.route"] ?? attrs["http.target"] ?? attrs["url.path"] ?? span.name ?? "/";
+        const status = parseInt(attrs["http.status_code"] ?? attrs["http.response.status_code"] ?? "0", 10) || 0;
+        const isError = span.status?.code === 2 || status >= 500;
+        if (span.kind === SPAN_KIND_SERVER || span.kind === void 0) {
+          const event = {
+            type: "backend_span",
+            service: serviceName,
+            route,
+            method: method.toUpperCase(),
+            statusCode: status || (isError ? 500 : 200),
+            durationMs: durMs,
+            traceId,
+            spanId,
+            parentSpanId: parentId,
+            sdk: "node",
+            // OTLP source — treat as node for badge display
+            timestamp: startMs,
+            ...isError || span.status?.message ? { error: span.status?.message ?? `HTTP ${status}` } : {}
+          };
+          store.push(event);
+          historyStore.push(event);
+          routeReachability.record(route, isError);
+          ingested++;
+        } else if (span.kind === SPAN_KIND_CLIENT) {
+          const url = attrs["http.url"] ?? attrs["url.full"] ?? attrs["http.target"] ?? route;
+          const event = {
+            type: "network",
+            method: method.toUpperCase(),
+            url,
+            status: status || 0,
+            statusText: isError ? "Error" : "OK",
+            duration: durMs,
+            timestamp: startMs,
+            traceId,
+            ...span.status?.message ? { error: span.status.message } : {}
+          };
+          store.push(event);
+          historyStore.push(event);
+          ingested++;
+          const callee = extractCalleeService(attrs, span.name ?? "");
+          if (callee) serviceGraph.recordCall(serviceName, callee, isError);
+        }
+      }
+    }
+  }
+  logger.debug({ ingested }, "OTLP traces ingested");
+  res.status(200).json({ partialSuccess: {} });
+});
+otlpReceiverRouter.post("/v1/logs", (req, res) => {
+  if (req.headers["content-type"]?.includes("application/x-protobuf")) {
+    res.status(415).json({
+      error: "Mergen OTLP receiver accepts JSON only. Set OTEL_EXPORTER_OTLP_PROTOCOL=http/json."
+    });
+    return;
+  }
+  const payload = req.body;
+  if (!payload?.resourceLogs) {
+    res.status(400).json({ error: "missing resourceLogs" });
+    return;
+  }
+  let ingested = 0;
+  for (const rl of payload.resourceLogs ?? []) {
+    const resourceAttrs = attrMap(rl.resource?.attributes);
+    const serviceName = resourceAttrs["service.name"] ?? "unknown";
+    const processUrl = `mergen://node/${serviceName}`;
+    for (const sl of rl.scopeLogs ?? []) {
+      for (const rec of sl.logRecords ?? []) {
+        const ts = nanoToMs(rec.timeUnixNano);
+        const level = severityToLevel(rec.severityNumber, rec.severityText);
+        const body = anyStr(rec.body) || "(empty log)";
+        const attrs = attrMap(rec.attributes);
+        const traceId = rec.traceId ? normalizeId(rec.traceId, 32) : void 0;
+        const stack = attrs["exception.stacktrace"] ?? attrs["error.stack"] ?? void 0;
+        const event = {
+          type: "console",
+          level,
+          args: [body],
+          stack,
+          url: processUrl,
+          timestamp: ts,
+          sdk: "node",
+          ...traceId ? { traceId } : {}
+        };
+        store.push(event);
+        historyStore.push(event);
+        ingested++;
+      }
+    }
+  }
+  logger.debug({ ingested }, "OTLP logs ingested");
+  res.status(200).json({ partialSuccess: {} });
+});
+otlpReceiverRouter.post("/v1/metrics", (_req, res) => {
+  res.status(200).json({ partialSuccess: {} });
+});
+export {
+  otlpReceiverRouter
+};

package/dist/routes/overrides.js

@@ -0,0 +1,241 @@
+import { Router } from "express";
+import { z } from "zod";
+import {
+  OVERRIDE_REASONS,
+  buildOverridePack
+} from "../intelligence/override-corpus.js";
+import { autoActivateReviewedRules } from "../intelligence/corpus-to-policy.js";
+import { getStores } from "../storage/store-registry.js";
+import logger from "../sensor/logger.js";
+const OVERRIDE_OUTCOMES = ["resolved", "escalated", "unresolved"];
+const OverrideSchema = z.object({
+  incidentTag: z.string().min(1).max(200),
+  proposedCommand: z.string().min(1).max(500),
+  overrideReason: z.enum(OVERRIDE_REASONS),
+  note: z.string().max(200).optional(),
+  rationale: z.string().max(300).optional(),
+  service: z.string().min(1).max(100),
+  environment: z.string().max(50).default("production"),
+  manualAction: z.string().max(500).optional(),
+  actor: z.string().max(200).default("unknown")
+});
+const OutcomeSchema = z.object({
+  outcome: z.enum(OVERRIDE_OUTCOMES)
+});
+const PackEntrySchema = z.object({
+  incidentTag: z.string().min(1).max(200),
+  proposedCommand: z.string().min(1).max(500),
+  overrideReason: z.enum(OVERRIDE_REASONS),
+  note: z.string().max(200).optional(),
+  rationale: z.string().max(300).optional(),
+  service: z.string().min(1).max(100),
+  environment: z.string().max(50).default("production"),
+  dayOfWeek: z.number().int().min(0).max(6),
+  hourOfDay: z.number().int().min(0).max(23),
+  manualAction: z.string().max(500).optional(),
+  outcome: z.enum(OVERRIDE_OUTCOMES).optional(),
+  expiresInDays: z.number().int().min(1).max(3650).optional()
+}).refine((e) => e.overrideReason !== "other" || !!e.note, {
+  message: 'note is required when overrideReason is "other"'
+});
+const PackSchema = z.object({
+  format: z.literal("mergen-pack"),
+  version: z.literal(1),
+  name: z.string().max(200).optional(),
+  entries: z.array(PackEntrySchema).min(1).max(500)
+});
+function createOverridesRouter() {
+  const router = Router();
+  router.post("/overrides", async (req, res) => {
+    const parsed = OverrideSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    if (parsed.data.overrideReason === "other" && !parsed.data.note) {
+      res.status(400).json({ error: 'note is required when overrideReason is "other"' });
+      return;
+    }
+    const event = await getStores().overrides.recordOverride(parsed.data, req.tenantId);
+    logger.info({ id: event.id, tag: event.incidentTag, conflicts: event.conflictsWith }, "override recorded via API");
+    const { conflictsWith, ...overrideData } = event;
+    res.status(201).json({
+      ok: true,
+      override: overrideData,
+      ...conflictsWith && conflictsWith.length > 0 ? {
+        warning: `This entry may conflict with ${conflictsWith.length} existing corpus entry/entries. Review IDs: ${conflictsWith.join(", ")}`,
+        conflictsWith
+      } : {}
+    });
+  });
+  router.patch("/overrides/:id/outcome", async (req, res) => {
+    const parsed = OutcomeSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const found = await getStores().overrides.updateOutcome(req.params.id, parsed.data.outcome, req.tenantId);
+    if (!found) {
+      res.status(404).json({ error: "override not found" });
+      return;
+    }
+    res.json({ ok: true });
+  });
+  router.get("/override-corpus", async (req, res) => {
+    const corpus = await getStores().overrides.getOverrideSummary(req.tenantId);
+    if (corpus.length > 0) {
+      res.json({ ok: true, corpus });
+      return;
+    }
+    res.json({
+      ok: true,
+      corpus: [],
+      demo: true,
+      demoNote: "No overrides recorded yet. The entries below show what your corpus will look like after 4-6 weeks of shadow mode.",
+      demoEntries: [
+        {
+          incidentTag: "infra_db_connection_pool",
+          service: "api",
+          environment: "production",
+          overrideReason: "batch-window",
+          note: "Friday 20-24 UTC \u2014 settlement window. Pool resize causes lock contention on the batch job.",
+          proposedCommand: "kubectl set env deployment/api DB_POOL_MAX=50",
+          manualAction: "kubectl rollout restart deployment/api",
+          appliedCount: 4,
+          lastApplied: "Friday 2026-06-14 21:30 UTC"
+        },
+        {
+          incidentTag: "infra_oom_kill",
+          service: "worker",
+          environment: "production",
+          overrideReason: "compliance-hold",
+          note: "Memory limit change requires change advisory board sign-off. Cannot increase in-place.",
+          proposedCommand: "kubectl set resources deployment/worker --limits=memory=4Gi",
+          manualAction: "Opened CAB ticket #4421. Restarted worker with heap profiling enabled.",
+          appliedCount: 2,
+          lastApplied: "Wednesday 2026-06-10 03:17 UTC"
+        },
+        {
+          incidentTag: "infra_rate_limit_cascade",
+          service: "auth",
+          environment: "production",
+          overrideReason: "wrong-fix",
+          note: "Circuit breaker was the symptom, not the cause. Root cause was upstream API key rotation.",
+          proposedCommand: "enable_circuit_breaker(auth-service)",
+          manualAction: "Rotated upstream API credentials. Verified with ops team before action.",
+          appliedCount: 1,
+          lastApplied: "Monday 2026-06-08 14:02 UTC"
+        }
+      ]
+    });
+  });
+  router.get("/override-corpus/stale", async (req, res) => {
+    const days = Math.min(365, Math.max(1, Number(req.query.days ?? 60)));
+    const stale = await getStores().overrides.getStaleOverrides(days, req.tenantId);
+    res.json({
+      ok: true,
+      staleCount: stale.length,
+      thresholdDays: days,
+      stale: stale.map((e) => ({
+        id: e.id,
+        incidentTag: e.incidentTag,
+        service: e.service,
+        overrideReason: e.overrideReason,
+        note: e.note,
+        recordedAt: e.recordedAt,
+        reviewedAt: e.reviewedAt ?? null,
+        daysSinceReview: Math.floor((Date.now() - (e.reviewedAt ?? e.recordedAt)) / 864e5)
+      }))
+    });
+  });
+  router.post("/overrides/:id/review", async (req, res) => {
+    const found = await getStores().overrides.markOverrideReviewed(req.params.id, req.tenantId);
+    if (!found) {
+      res.status(404).json({ error: "override not found" });
+      return;
+    }
+    let activatedRules = [];
+    const event = await getStores().overrides.getOverrideById(req.params.id, req.tenantId);
+    if (event) {
+      try {
+        const activated = autoActivateReviewedRules(event.incidentTag, event.service);
+        activatedRules = activated.map((a) => ({ id: a.rule.id, name: a.rule.name, action: a.rule.action }));
+      } catch (err) {
+        logger.warn({ err, id: req.params.id }, "overrides: failed to auto-activate corpus rules after review");
+      }
+    }
+    res.json({ ok: true, reviewedAt: Date.now(), activatedRules });
+  });
+  router.get("/override-corpus/export", async (req, res) => {
+    const events = await getStores().overrides.getAllOverrides(req.tenantId);
+    const pack = buildOverridePack(events, {
+      name: typeof req.query.name === "string" ? req.query.name.slice(0, 200) : void 0,
+      includeCommunity: req.query.includeCommunity === "true"
+    });
+    res.json(pack);
+  });
+  router.post("/overrides/import", async (req, res) => {
+    const parsed = PackSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const { imported, skipped } = await getStores().overrides.importOverrides(
+      parsed.data.entries,
+      { source: "community" },
+      req.tenantId
+    );
+    logger.info({ pack: parsed.data.name, imported, skipped }, "override pack imported via API");
+    res.status(201).json({ ok: true, pack: parsed.data.name ?? null, imported, skipped });
+  });
+  router.get("/overrides/expiring-soon", async (req, res) => {
+    const windowDays = Math.min(90, Math.max(1, Number(req.query.windowDays ?? 14)));
+    const expiring = await getStores().overrides.getExpiringSoon(windowDays, req.tenantId);
+    if (req.query.notify === "true") {
+      const webhookUrl = process.env.MERGEN_HITL_WEBHOOK_URL;
+      if (webhookUrl && expiring.length > 0) {
+        const lines = expiring.slice(0, 10).map((e) => {
+          const daysLeft = Math.ceil(((e.expiresAt ?? 0) - Date.now()) / 864e5);
+          return `\u2022 \`${e.incidentTag}\` / ${e.service} \u2014 expires in ${daysLeft}d (reason: ${e.overrideReason})`;
+        });
+        void fetch(webhookUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            text: `\u{1F550} *Override corpus renewal needed*: ${expiring.length} entries expiring in ${windowDays} days.
+${lines.join("\n")}
+Review at \`GET /override-corpus/stale\` or call \`POST /overrides/:id/review\` to re-affirm.`,
+            mergen: { type: "corpus_renewal_prompt", count: expiring.length }
+          }),
+          signal: AbortSignal.timeout(5e3)
+        }).catch(() => {
+        });
+      }
+    }
+    res.json({
+      ok: true,
+      windowDays,
+      expiringCount: expiring.length,
+      expiring: expiring.map((e) => ({
+        id: e.id,
+        incidentTag: e.incidentTag,
+        service: e.service,
+        overrideReason: e.overrideReason,
+        note: e.note ?? null,
+        recordedAt: e.recordedAt,
+        expiresAt: e.expiresAt ?? null,
+        daysLeft: e.expiresAt ? Math.ceil((e.expiresAt - Date.now()) / 864e5) : null,
+        reviewUrl: `/overrides/${e.id}/review`
+      })),
+      note: expiring.length > 0 ? `${expiring.length} corpus entries expire within ${windowDays} days. Review and re-affirm or they will stop influencing gate decisions.` : `No corpus entries expiring within ${windowDays} days.`
+    });
+  });
+  router.get("/overrides/:tag", async (req, res) => {
+    const events = await getStores().overrides.getOverridesForTag(req.params.tag, req.tenantId);
+    res.json({ ok: true, tag: req.params.tag, overrides: events });
+  });
+  return router;
+}
+export {
+  createOverridesRouter
+};