mergen-server 1.4.0

package/dist/routes/agent-blunders.js

@@ -0,0 +1,163 @@
+import { createHmac } from "crypto";
+import { Router } from "express";
+import { getStores } from "../storage/store-registry.js";
+import { getRefinementCandidates, getBypassStats } from "../sensor/bypass-tracker.js";
+import { getGateCoverageSummary } from "../intelligence/enterprise-policy-engine.js";
+import { buildReport, renderMarkdown } from "../intelligence/case-study-generator.js";
+import { loadEnterprisePolicy } from "../intelligence/enterprise-policy-engine.js";
+import { computeBlastRadius } from "../intelligence/blast-radius.js";
+function createAgentBlundersRouter(localSecret) {
+  const router = Router();
+  router.get("/agent-blunders", async (req, res) => {
+    const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 20)));
+    const agentId = typeof req.query.agentId === "string" ? req.query.agentId : void 0;
+    const store = getStores().blunders;
+    const [stats, all] = await Promise.all([store.getStats(), store.list()]);
+    const filtered = agentId ? all.filter((b) => b.agentId === agentId) : all;
+    const recent = filtered.slice(-limit).reverse();
+    const policyRefinementCandidates = getRefinementCandidates();
+    const bypassStats = getBypassStats();
+    const gateCovers = getGateCoverageSummary();
+    res.json({
+      ok: true,
+      prevented: stats.total,
+      ...stats,
+      gateCovers,
+      recentBlunders: recent,
+      bypassStats,
+      policyRefinementCandidates
+    });
+  });
+  router.get("/agent-blunders/verify", async (_req, res) => {
+    const result = await getStores().blunders.verifyChain();
+    let checkpoints;
+    try {
+      const { verifyCheckpoints } = await import("../sensor/agent-blunder-store.js");
+      checkpoints = verifyCheckpoints();
+    } catch {
+    }
+    res.json({ ok: true, ...result, ...checkpoints ? { checkpoints } : {} });
+  });
+  router.get("/agent-blunders/clusters", async (req, res) => {
+    const windowDays = Math.min(365, Math.max(1, Number(req.query.windowDays ?? 30)));
+    const minCount = Math.min(100, Math.max(1, Number(req.query.minCount ?? 2)));
+    const store = getStores().blunders;
+    const all = await store.list();
+    const cutoff = Date.now() - windowDays * 24 * 60 * 60 * 1e3;
+    const recent = all.filter((b) => b.recordedAt >= cutoff);
+    const clusterMap = /* @__PURE__ */ new Map();
+    for (const b of recent) {
+      const template = _commandTemplate(b.command ?? b.blockReason);
+      const key = `${b.blunderType}::${template}`;
+      let cluster = clusterMap.get(key);
+      if (!cluster) {
+        cluster = {
+          key,
+          blunderType: b.blunderType,
+          template,
+          count: 0,
+          agents: /* @__PURE__ */ new Set(),
+          services: /* @__PURE__ */ new Set(),
+          firstSeen: b.recordedAt,
+          lastSeen: b.recordedAt,
+          examples: [],
+          triggeredRules: []
+        };
+        clusterMap.set(key, cluster);
+      }
+      cluster.count++;
+      if (b.agentId) cluster.agents.add(b.agentId);
+      if (b.actor) cluster.agents.add(b.actor);
+      if (b.service) cluster.services.add(b.service);
+      if (b.recordedAt < cluster.firstSeen) cluster.firstSeen = b.recordedAt;
+      if (b.recordedAt > cluster.lastSeen) cluster.lastSeen = b.recordedAt;
+      if (cluster.examples.length < 3 && b.command) cluster.examples.push(b.command.slice(0, 120));
+      for (const r of b.triggeredRules ?? []) {
+        if (!cluster.triggeredRules.includes(r)) cluster.triggeredRules.push(r);
+      }
+    }
+    const clusters = [...clusterMap.values()].filter((c) => c.count >= minCount).sort((a, b) => b.count - a.count).map((c) => ({
+      key: c.key,
+      blunderType: c.blunderType,
+      template: c.template,
+      count: c.count,
+      uniqueAgents: c.agents.size,
+      uniqueServices: c.services.size,
+      firstSeen: c.firstSeen,
+      lastSeen: c.lastSeen,
+      examples: c.examples,
+      triggeredRules: c.triggeredRules,
+      threatSignal: _threatSignal(c.count, c.agents.size, windowDays)
+    }));
+    res.json({
+      ok: true,
+      windowDays,
+      totalBlunders: recent.length,
+      clustersFound: clusters.length,
+      clusters
+    });
+  });
+  router.get("/agent-blunders/evidence-pack", async (req, res) => {
+    const now = Date.now();
+    const from = Number(req.query.from ?? now - 30 * 24 * 60 * 60 * 1e3);
+    const to = Number(req.query.to ?? now);
+    const agentId = typeof req.query.agentId === "string" ? req.query.agentId : void 0;
+    const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId : void 0;
+    const store = getStores().blunders;
+    const all = await store.list();
+    let entries = all.filter((b) => b.recordedAt >= from && b.recordedAt <= to);
+    if (agentId) entries = entries.filter((b) => b.agentId === agentId);
+    if (sessionId) entries = entries.filter((b) => b.sessionId === sessionId);
+    const policy = loadEnterprisePolicy();
+    const blastRadiusScores = entries.map((b) => ({
+      id: b.id,
+      blastRadius: b.command ? computeBlastRadius(b.command) : null
+    }));
+    const chainVerification = await store.verifyChain();
+    const pack = {
+      generatedAt: now,
+      rangeFrom: from,
+      rangeTo: to,
+      filters: { agentId: agentId ?? null, sessionId: sessionId ?? null },
+      entryCount: entries.length,
+      entries,
+      policySnapshot: policy,
+      blastRadiusScores,
+      chainVerification
+    };
+    const packJson = JSON.stringify(pack);
+    const hmacKey = process.env.MERGEN_SECRET || localSecret;
+    const signature = createHmac("sha256", hmacKey).update(packJson).digest("hex");
+    res.setHeader("Content-Type", "application/json; charset=utf-8");
+    res.setHeader("Content-Disposition", `attachment; filename="mergen-evidence-pack-${now}.json"`);
+    res.json({ ok: true, pack, signature });
+  });
+  router.get("/agent-blunders/case-study-export", async (req, res) => {
+    const format = req.query.format === "md" ? "md" : "json";
+    const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 20)));
+    const blunders = await getStores().blunders.list();
+    const report = buildReport(blunders);
+    report.cases = report.cases.slice(0, limit);
+    if (format === "md") {
+      res.setHeader("Content-Type", "text/markdown; charset=utf-8");
+      res.setHeader("Content-Disposition", 'attachment; filename="mergen-case-studies.md"');
+      res.send(renderMarkdown(report));
+      return;
+    }
+    res.json({ ok: true, ...report });
+  });
+  return router;
+}
+function _commandTemplate(raw) {
+  return raw.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "<uuid>").replace(/\b[0-9a-f]{32,64}\b/gi, "<hash>").replace(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, "<ip>").replace(/:\d{2,5}\b/g, ":<port>").replace(/\/[^\s"']{5,}/g, "/<path>").replace(/\b\d+\b/g, "<n>").replace(/\s+/g, " ").slice(0, 200).trim();
+}
+function _threatSignal(count, uniqueAgents, windowDays) {
+  const dailyRate = count / windowDays;
+  if (dailyRate >= 5 || uniqueAgents >= 4) return "critical";
+  if (dailyRate >= 2 || uniqueAgents >= 2) return "high";
+  if (count >= 3) return "medium";
+  return "low";
+}
+export {
+  createAgentBlundersRouter
+};

package/dist/routes/agents.js

@@ -0,0 +1,175 @@
+import { Router } from "express";
+import { z } from "zod";
+import {
+  listProfiles,
+  getProfile,
+  saveProfile,
+  deleteProfile
+} from "../intelligence/agent-profiles.js";
+import { detectCredentialMisuse } from "../intelligence/credential-misuse.js";
+import { getBaseline } from "../intelligence/behavior-baseline.js";
+import { getAgentScrutinyTier } from "../intelligence/session-threat-tracker.js";
+import { getStores } from "../storage/store-registry.js";
+const ProfileSchema = z.object({
+  id: z.string().min(1).max(60).regex(/^[a-z0-9_-]+$/, "id must be lowercase alphanumeric, hyphens, underscores"),
+  name: z.string().min(1).max(80),
+  description: z.string().max(300).default(""),
+  allowedTools: z.array(z.string()).default([]),
+  blockedTools: z.array(z.string()).default([]),
+  allowedServices: z.array(z.string()).default([]),
+  maxRiskTier: z.enum(["read", "restart", "deploy", "full"]).default("restart")
+});
+function createAgentsRouter() {
+  const router = Router();
+  router.get("/agents", (_req, res) => {
+    const profiles = listProfiles();
+    const activeId = process.env.MERGEN_AGENT_ID ?? null;
+    res.json({ ok: true, profiles, activeId });
+  });
+  router.get("/agents/active", (_req, res) => {
+    const agentId = process.env.MERGEN_AGENT_ID;
+    if (!agentId) {
+      res.json({ ok: true, active: null, note: "MERGEN_AGENT_ID not set \u2014 no agent profile active" });
+      return;
+    }
+    const profile = getProfile(agentId);
+    res.json({ ok: true, activeId: agentId, active: profile ?? null, registered: !!profile });
+  });
+  router.get("/agents/:id", (req, res) => {
+    const profile = getProfile(req.params.id);
+    if (!profile) {
+      res.status(404).json({ error: "Agent profile not found" });
+      return;
+    }
+    res.json({ ok: true, profile });
+  });
+  router.post("/agents", (req, res) => {
+    const parsed = ProfileSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: parsed.error.issues });
+      return;
+    }
+    if (getProfile(parsed.data.id)) {
+      res.status(409).json({ error: `Agent '${parsed.data.id}' already exists` });
+      return;
+    }
+    const profile = { ...parsed.data, createdAt: Date.now() };
+    saveProfile(profile);
+    res.status(201).json({ ok: true, profile });
+  });
+  router.patch("/agents/:id", (req, res) => {
+    const existing = getProfile(req.params.id);
+    if (!existing) {
+      res.status(404).json({ error: "Agent profile not found" });
+      return;
+    }
+    const UpdateSchema = ProfileSchema.partial().omit({ id: true });
+    const parsed = UpdateSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: parsed.error.issues });
+      return;
+    }
+    const updated = { ...existing, ...parsed.data };
+    saveProfile(updated);
+    res.json({ ok: true, profile: updated });
+  });
+  router.delete("/agents/:id", (req, res) => {
+    if (!deleteProfile(req.params.id)) {
+      res.status(404).json({ error: "Agent profile not found" });
+      return;
+    }
+    res.json({ ok: true });
+  });
+  router.get("/agents/:id/timeline", async (req, res) => {
+    const agentId = req.params.id;
+    const now = Date.now();
+    const from = Number(req.query.from ?? now - 24 * 60 * 60 * 1e3);
+    const to = Number(req.query.to ?? now);
+    const limit = Math.min(500, Math.max(1, Number(req.query.limit ?? 100)));
+    const gateEntries = (await getStores().actionLedger.query({ agentId, from, to, limit })).map((e) => ({
+      type: "gate",
+      ts: e.ts,
+      toolName: e.tool,
+      command: e.command,
+      verdict: e.verdict,
+      triggeredRules: e.policyMatched,
+      guidedAlternative: e.reason,
+      resource: e.resource,
+      credentialIssued: e.credentialIssued,
+      service: "mcp",
+      environment: e.environment
+    }));
+    const blunderEntries = (await getStores().blunders.list()).filter((b) => b.actor === agentId && b.recordedAt >= from && b.recordedAt <= to).map((b) => ({
+      type: "blunder",
+      ts: b.recordedAt,
+      toolName: null,
+      command: b.command,
+      verdict: "block",
+      blunderType: b.blunderType,
+      blockReason: b.blockReason,
+      service: b.service,
+      hash: b.hash
+    }));
+    const timeline = [...gateEntries, ...blunderEntries].sort((a, b) => b.ts - a.ts).slice(0, limit);
+    const profile = getProfile(agentId);
+    res.json({
+      ok: true,
+      agentId,
+      profile: profile ?? null,
+      from,
+      to,
+      total: timeline.length,
+      timeline
+    });
+  });
+  router.get("/agents/:id/ledger", async (req, res) => {
+    const agentId = req.params.id;
+    const verdict = req.query.verdict;
+    const tool = req.query.tool;
+    const from = req.query.from ? Number(req.query.from) : void 0;
+    const to = req.query.to ? Number(req.query.to) : void 0;
+    const limit = Math.min(1e3, Math.max(1, Number(req.query.limit ?? 100)));
+    const records = await getStores().actionLedger.query({ agentId, verdict, tool, from, to, limit });
+    res.json({ ok: true, agentId, total: records.length, records });
+  });
+  router.get("/agents/:id/report", async (req, res) => {
+    const agentId = req.params.id;
+    const now = Date.now();
+    const windowMs = Math.max(1, Number(req.query.windowDays ?? 30)) * 24 * 60 * 60 * 1e3;
+    const from = now - windowMs;
+    const records = await getStores().actionLedger.query({ agentId, from, to: now, limit: 5e3 });
+    const byVerdict = { pass: 0, hold: 0, block: 0 };
+    const byTool = {};
+    const byResource = {};
+    for (const r of records) {
+      byVerdict[r.verdict] = (byVerdict[r.verdict] ?? 0) + 1;
+      byTool[r.tool] = (byTool[r.tool] ?? 0) + 1;
+      if (r.resource) byResource[r.resource] = (byResource[r.resource] ?? 0) + 1;
+    }
+    const topResources = Object.entries(byResource).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([resource, count]) => ({ resource, count }));
+    const credRows = await getStores().actionLedger.queryCredentialUsage({ agentId, from, to: now });
+    const credentialUsage = {};
+    for (const c of credRows) {
+      const env = c.environment ?? "unknown";
+      const scope = c.credentialScope ?? "unknown";
+      (credentialUsage[scope] ??= []).includes(env) || credentialUsage[scope].push(env);
+    }
+    res.json({
+      ok: true,
+      agentId,
+      windowDays: windowMs / 864e5,
+      totalActions: records.length,
+      byVerdict,
+      topTools: Object.entries(byTool).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([tool, count]) => ({ tool, count })),
+      topResources,
+      credentialUsage,
+      credentialMisuse: await detectCredentialMisuse({ agentId, windowMs }),
+      anomalyBaseline: getBaseline(agentId),
+      scrutinyTier: getAgentScrutinyTier(agentId)
+    });
+  });
+  return router;
+}
+export {
+  createAgentsRouter
+};

package/dist/routes/api-keys.js

@@ -0,0 +1,65 @@
+import { Router } from "express";
+import { createApiKey, listApiKeys, revokeApiKey, CLOUD_MODE } from "../sensor/cloud-auth.js";
+function resolveCaller(req) {
+  return req.headers["x-mergen-member"] ?? (req.tenantId ?? "api-admin");
+}
+function createApiKeysRouter() {
+  const router = Router();
+  router.post("/api-keys", (req, res) => {
+    if (!CLOUD_MODE) {
+      res.status(404).json({ error: "cloud mode not enabled", fix: "set MERGEN_CLOUD_MODE=true" });
+      return;
+    }
+    const { tenantId, label, rateLimit, scope, expiresAt, createdBy } = req.body ?? {};
+    if (!tenantId || typeof tenantId !== "string") {
+      res.status(400).json({ ok: false, error: "tenantId (string) is required" });
+      return;
+    }
+    if (!label || typeof label !== "string") {
+      res.status(400).json({ ok: false, error: "label (string) is required" });
+      return;
+    }
+    if (rateLimit !== void 0 && (typeof rateLimit !== "number" || rateLimit < 1)) {
+      res.status(400).json({ ok: false, error: "rateLimit must be a positive number" });
+      return;
+    }
+    if (scope !== void 0 && (!Array.isArray(scope) || scope.some((s) => typeof s !== "string"))) {
+      res.status(400).json({ ok: false, error: 'scope must be an array of strings (e.g. ["ingest", "read"])' });
+      return;
+    }
+    if (expiresAt !== void 0 && isNaN(Date.parse(expiresAt))) {
+      res.status(400).json({ ok: false, error: "expiresAt must be a valid ISO 8601 date string" });
+      return;
+    }
+    const caller = createdBy ?? resolveCaller(req);
+    const created = createApiKey({ tenantId, label, rateLimit, scope, expiresAt, createdBy: caller });
+    res.status(201).json({
+      ok: true,
+      ...created,
+      note: "Store this key securely \u2014 it will not be shown again."
+    });
+  });
+  router.get("/api-keys", (_req, res) => {
+    if (!CLOUD_MODE) {
+      res.status(404).json({ error: "cloud mode not enabled" });
+      return;
+    }
+    res.json({ ok: true, keys: listApiKeys() });
+  });
+  router.delete("/api-keys/:id", (req, res) => {
+    if (!CLOUD_MODE) {
+      res.status(404).json({ error: "cloud mode not enabled" });
+      return;
+    }
+    const deleted = revokeApiKey(req.params.id);
+    if (!deleted) {
+      res.status(404).json({ ok: false, error: `no key with id: ${req.params.id}` });
+      return;
+    }
+    res.json({ ok: true });
+  });
+  return router;
+}
+export {
+  createApiKeysRouter
+};

package/dist/routes/arch.js

@@ -0,0 +1,75 @@
+import { Router } from "express";
+import { z } from "zod";
+import path from "path";
+import { existsSync } from "node:fs";
+import { checkBoundaries } from "../intelligence/arch-boundaries.js";
+import { scoreChangeRisk } from "../intelligence/change-risk.js";
+import { buildGraph, getZone } from "../intelligence/arch-graph.js";
+import { critiqueImplementation } from "../intelligence/impl-critic.js";
+function defaultSrcDir() {
+  const cwd = process.cwd();
+  const candidates = [path.resolve(cwd, "src"), path.resolve(cwd, "server/src")];
+  for (const c of candidates) if (existsSync(c)) return c;
+  return path.resolve(cwd, "src");
+}
+const RiskBodySchema = z.object({
+  files: z.array(z.string()).min(1),
+  srcDir: z.string().optional()
+});
+const CritiqueBodySchema = z.object({
+  files: z.array(z.string()).min(1),
+  srcDir: z.string().optional()
+});
+function createArchRouter() {
+  const router = Router();
+  router.get("/arch/violations", (req, res) => {
+    const srcDir = typeof req.query.srcDir === "string" ? req.query.srcDir : defaultSrcDir();
+    const result = checkBoundaries({ srcDir });
+    res.json({ ok: true, violations: result.violations, filesChecked: result.filesChecked, cleanFiles: result.cleanFiles });
+  });
+  router.post("/arch/risk", (req, res) => {
+    const parsed = RiskBodySchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const { files, srcDir = defaultSrcDir() } = parsed.data;
+    const absoluteFiles = files.map((f) => path.isAbsolute(f) ? f : path.resolve(srcDir, f));
+    const report = scoreChangeRisk(absoluteFiles, srcDir);
+    res.json({ ok: true, report });
+  });
+  router.get("/arch/graph", (req, res) => {
+    const srcDir = typeof req.query.srcDir === "string" ? req.query.srcDir : defaultSrcDir();
+    const graph = buildGraph(srcDir);
+    const zonePairs = /* @__PURE__ */ new Map();
+    for (const [file, imports] of graph.forward) {
+      const fromZone = getZone(file);
+      for (const imp of imports) {
+        const toZone = getZone(imp);
+        const key = `${fromZone}\u2192${toZone}`;
+        zonePairs.set(key, (zonePairs.get(key) ?? 0) + 1);
+      }
+    }
+    res.json({
+      ok: true,
+      files: graph.files.length,
+      builtAt: new Date(graph.builtAt).toISOString(),
+      zoneSummary: Object.fromEntries(zonePairs)
+    });
+  });
+  router.post("/arch/critique", (req, res) => {
+    const parsed = CritiqueBodySchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const { files, srcDir = defaultSrcDir() } = parsed.data;
+    const absoluteFiles = files.map((f) => path.isAbsolute(f) ? f : path.resolve(srcDir, f));
+    const report = critiqueImplementation({ files: absoluteFiles, srcDir });
+    res.json({ ok: true, report });
+  });
+  return router;
+}
+export {
+  createArchRouter
+};

package/dist/routes/audit-export.js

@@ -0,0 +1,93 @@
+import { Router } from "express";
+import { fetchBlunderEntries, fetchHttpAuditEntries, fetchChainVerification } from "../sensor/audit-fetch.js";
+function createAuditExportRouter() {
+  const router = Router();
+  router.get("/audit/export", async (req, res) => {
+    const now = Date.now();
+    const format = (req.query.format ?? "ndjson").toLowerCase();
+    const type = format === "siem" ? "blunders" : (req.query.type ?? "all").toLowerCase();
+    const from = Number(req.query.from ?? now - 30 * 24 * 60 * 60 * 1e3);
+    const to = Number(req.query.to ?? now);
+    const limit = Math.min(5e4, Math.max(1, Number(req.query.limit ?? 5e3)));
+    const lines = [];
+    if (type === "blunders" || type === "all") {
+      const blunders = await fetchBlunderEntries(from, to);
+      for (const b of blunders) {
+        lines.push(JSON.stringify({
+          source: "blunder_log",
+          ts: new Date(b.recordedAt).toISOString(),
+          ts_ms: b.recordedAt,
+          id: b.id,
+          actor: b.actor ?? "agent",
+          blunderType: b.blunderType,
+          tool: b.command ?? null,
+          blockReason: b.blockReason,
+          service: b.service ?? null,
+          tag: b.tag ?? null,
+          pid: b.pid ?? null,
+          gateDecision: "block",
+          previousHash: b.previousHash,
+          hash: b.hash
+        }));
+      }
+    }
+    if (type === "http" || type === "all") {
+      const httpEntries = await fetchHttpAuditEntries(from, to);
+      for (const e of httpEntries) {
+        lines.push(JSON.stringify({
+          source: "http_audit",
+          ts: e.ts,
+          ts_ms: new Date(e.ts).getTime(),
+          actor: e.actor,
+          method: e.method,
+          path: e.path,
+          status: e.status,
+          durationMs: e.durationMs,
+          ip: e.ip
+        }));
+      }
+    }
+    const trimmed = lines.slice(0, limit);
+    if (format === "soc2") {
+      const chainVerification = await fetchChainVerification();
+      const header = JSON.stringify({
+        source: "__export_header__",
+        exportFormat: "mergen-soc2-v1",
+        exportedAt: new Date(now).toISOString(),
+        windowFrom: new Date(from).toISOString(),
+        windowTo: new Date(to).toISOString(),
+        entryCount: trimmed.length,
+        limitApplied: lines.length > limit,
+        chainValid: chainVerification.valid,
+        chainVerified: chainVerification.verified ?? 0,
+        chainTruncated: chainVerification.truncated ?? false,
+        // What guarantee actually applies given this deployment's configuration —
+        // not a blanket "tamper-evident" claim regardless of setup. See
+        // agent-blunder-store.ts's tamperEvidenceLevel() for the precise semantics.
+        tamperEvidenceLevel: chainVerification.tamperEvidenceLevel ?? "unknown",
+        hmacProtected: chainVerification.hmacProtected ?? false,
+        note: 'Verify blunder log integrity: SHA-256(previousHash + JSON(fields)) === hash for each entry. Chain starts from the genesis hash (64 zeros) or the oldest surviving entry when the ring buffer has wrapped. tamperEvidenceLevel "hash-chain" (not "hmac-sealed") means an attacker with the same local filesystem access as the Mergen process could re-link the chain around a deletion \u2014 set MERGEN_AUDIT_SECRET for hmac-sealed protection.'
+      });
+      res.setHeader("Content-Type", "application/x-ndjson");
+      res.setHeader("Content-Disposition", `attachment; filename="mergen-audit-soc2-${new Date(now).toISOString().slice(0, 10)}.ndjson"`);
+      res.setHeader("Cache-Control", "no-store");
+      res.send([header, ...trimmed].join("\n") + "\n");
+      return;
+    }
+    if (format === "siem") {
+      res.setHeader("Content-Type", "application/x-ndjson");
+      res.setHeader("Content-Disposition", `attachment; filename="mergen-siem-${new Date(now).toISOString().slice(0, 10)}.ndjson"`);
+      res.setHeader("Cache-Control", "no-store");
+      res.send(trimmed.join("\n") + "\n");
+      return;
+    }
+    res.setHeader("Content-Type", "application/x-ndjson");
+    res.setHeader("Content-Disposition", `attachment; filename="mergen-audit-${new Date(now).toISOString().slice(0, 10)}.ndjson"`);
+    res.setHeader("Cache-Control", "no-store");
+    res.send(trimmed.join("\n") + "\n");
+  });
+  return router;
+}
+export {
+  createAuditExportRouter
+};