Function handleReplay

apps/api/src/controllers/track.controller.ts:337–356

(
  payload: IReplayPayload,
  { projectId, sessionId }: { projectId: string; sessionId: string | undefined }
)

// Replay only needs the server-issued session id (the SDK echoes it back). Trust
// it — scoped to the authed project, unguessable, same trust level as event data.
export async function handleReplay(
  payload: IReplayPayload,
  { projectId, sessionId }: { projectId: string; sessionId: string | undefined }
): Promise<void> {
  if (!sessionId) {
    throw new HttpError('Session ID is required for replay', { status: 400 });
  }

  const row = {
    project_id: projectId,
    session_id: sessionId,
    chunk_index: payload.chunk_index,
    started_at: payload.started_at,
    ended_at: payload.ended_at,
    events_count: payload.events_count,
    is_full_snapshot: payload.is_full_snapshot,
    payload: payload.payload,
  };
  await replayBuffer.add(row);
}

async function handleGroup(
  payload: IGroupPayload,