mergen-server 1.4.0

package/dist/sensor/sqlite-store.js

@@ -0,0 +1,205 @@
+import initSqlJs from "sql.js";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import { createRequire } from "module";
+import { DATA_DIR, HISTORY_DB } from "./paths.js";
+import logger from "./logger.js";
+const ONE_HOUR_MS = (() => {
+  const h = parseFloat(process.env.MERGEN_RETENTION_HOURS ?? "72");
+  return (Number.isFinite(h) && h > 0 ? Math.min(h, 72) : 72) * 60 * 60 * 1e3;
+})();
+const FLUSH_EVERY = 50;
+class SqliteHistoryStore {
+  db = null;
+  writeCount = 0;
+  wasmPath;
+  constructor() {
+    this.wasmPath = SqliteHistoryStore.resolveWasmPath();
+  }
+  /**
+   * Locate sql-wasm.wasm using multiple strategies so the server works
+   * regardless of where the binary is installed or run from.
+   *
+   * Priority:
+   *   1. MERGEN_WASM_PATH env var (explicit override for Docker / custom installs)
+   *   2. Relative to this compiled module (standard npm install layout)
+   *   3. Node module resolution via createRequire — works for monorepos and
+   *      global installs where the relative path doesn't exist
+   */
+  static resolveWasmPath() {
+    if (process.env.MERGEN_WASM_PATH) return process.env.MERGEN_WASM_PATH;
+    const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+    const fromModule = path.resolve(moduleDir, "../../node_modules/sql.js/dist/sql-wasm.wasm");
+    if (fs.existsSync(fromModule)) return fromModule;
+    try {
+      const req = createRequire(import.meta.url);
+      const sqlJsEntry = req.resolve("sql.js");
+      const resolved = path.join(path.dirname(sqlJsEntry), "sql-wasm.wasm");
+      if (fs.existsSync(resolved)) return resolved;
+    } catch {
+    }
+    return fromModule;
+  }
+  async init() {
+    try {
+      const wasmBinary = fs.readFileSync(this.wasmPath);
+      const SQL = await initSqlJs({ wasmBinary });
+      fs.mkdirSync(DATA_DIR, { recursive: true });
+      let fileBuffer;
+      if (fs.existsSync(HISTORY_DB)) {
+        try {
+          fileBuffer = fs.readFileSync(HISTORY_DB);
+        } catch {
+          logger.warn("history.db unreadable, starting fresh");
+        }
+      }
+      this.db = fileBuffer ? new SQL.Database(fileBuffer) : new SQL.Database();
+      this.db.run(`
+        CREATE TABLE IF NOT EXISTS events (
+          id         INTEGER PRIMARY KEY AUTOINCREMENT,
+          type       TEXT    NOT NULL,
+          level      TEXT,
+          data       TEXT    NOT NULL,
+          timestamp  INTEGER NOT NULL,
+          inserted_at INTEGER NOT NULL,
+          tenant_id  TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_timestamp ON events(timestamp);
+        CREATE INDEX IF NOT EXISTS idx_inserted_at ON events(inserted_at);
+        CREATE INDEX IF NOT EXISTS idx_tenant_id ON events(tenant_id);
+      `);
+      this.flush();
+      logger.info({ path: HISTORY_DB }, "SQLite history store initialised");
+    } catch (err) {
+      logger.warn(
+        { err, wasmPath: this.wasmPath },
+        "SQLite history store failed to initialise \u2014 replay unavailable. Set MERGEN_WASM_PATH to override the wasm location."
+      );
+      this.db = null;
+    }
+  }
+  push(event, tenantId) {
+    if (!this.db) return;
+    try {
+      const level = event.type === "console" ? event.level : event.type === "network" ? String(event.status) : null;
+      this.db.run(
+        "INSERT INTO events (type, level, data, timestamp, inserted_at, tenant_id) VALUES (?,?,?,?,?,?)",
+        [event.type, level, JSON.stringify(event), event.timestamp, Date.now(), tenantId ?? null]
+      );
+      this.writeCount++;
+      if (this.writeCount % FLUSH_EVERY === 0) {
+        this.flush();
+      }
+    } catch (err) {
+      logger.warn({ err }, "SQLite push failed");
+    }
+  }
+  query(opts) {
+    if (!this.db) return [];
+    try {
+      const { since = 0, limit = 500, level, type, tenantId } = opts;
+      const conditions = ["timestamp >= ?"];
+      const params = [since];
+      if (level) {
+        conditions.push("level = ?");
+        params.push(level);
+      }
+      if (type) {
+        conditions.push("type = ?");
+        params.push(type);
+      }
+      if (tenantId) {
+        conditions.push("tenant_id = ?");
+        params.push(tenantId);
+      }
+      const sql = `SELECT data FROM events WHERE ${conditions.join(" AND ")} ORDER BY timestamp ASC LIMIT ?`;
+      params.push(limit);
+      const stmt = this.db.prepare(sql);
+      stmt.bind(params);
+      const rows = [];
+      while (stmt.step()) {
+        try {
+          rows.push(JSON.parse(stmt.getAsObject()["data"]));
+        } catch {
+        }
+      }
+      stmt.free();
+      return rows;
+    } catch (err) {
+      logger.warn({ err }, "SQLite query failed");
+      return [];
+    }
+  }
+  size() {
+    if (!this.db) return 0;
+    try {
+      const result = this.db.exec("SELECT COUNT(*) FROM events");
+      return result[0]?.values[0]?.[0] ?? 0;
+    } catch {
+      return 0;
+    }
+  }
+  clear() {
+    if (!this.db) return;
+    try {
+      this.db.run("DELETE FROM events");
+      this.flush();
+    } catch (err) {
+      logger.warn({ err }, "SQLite clear failed");
+    }
+  }
+  pruneOld() {
+    if (!this.db) return;
+    const cutoff = Date.now() - ONE_HOUR_MS;
+    this.db.run("DELETE FROM events WHERE inserted_at < ?", [cutoff]);
+  }
+  isWriting = false;
+  pendingWrite = false;
+  nextBuffer = null;
+  flush() {
+    if (!this.db) return;
+    try {
+      const data = this.db.export();
+      this.writeBufferAsync(Buffer.from(data.buffer, data.byteOffset, data.byteLength));
+    } catch (err) {
+      logger.warn({ err }, "SQLite flush failed");
+    }
+  }
+  writeBufferAsync(buf) {
+    if (this.isWriting) {
+      this.pendingWrite = true;
+      this.nextBuffer = buf;
+      return;
+    }
+    this.isWriting = true;
+    const tmp = `${HISTORY_DB}.tmp.${process.pid}`;
+    fs.writeFile(tmp, buf, (err) => {
+      if (err) {
+        logger.warn({ err }, "SQLite async write failed");
+        this.isWriting = false;
+        this.processPendingWrite();
+        return;
+      }
+      fs.rename(tmp, HISTORY_DB, (renameErr) => {
+        if (renameErr) {
+          logger.warn({ err: renameErr }, "SQLite async rename failed");
+        }
+        this.isWriting = false;
+        this.processPendingWrite();
+      });
+    });
+  }
+  processPendingWrite() {
+    if (this.pendingWrite && this.nextBuffer) {
+      this.pendingWrite = false;
+      const buf = this.nextBuffer;
+      this.nextBuffer = null;
+      this.writeBufferAsync(buf);
+    }
+  }
+}
+const historyStore = new SqliteHistoryStore();
+export {
+  historyStore
+};

package/dist/sensor/sso.js

@@ -0,0 +1,164 @@
+import { timingSafeSecretEqual } from "./security-utils.js";
+import { upsertMember } from "./rbac.js";
+import logger from "./logger.js";
+const SSO_REQUIRED = process.env.MERGEN_SSO_REQUIRED === "true";
+const SSO_TOKEN = process.env.MERGEN_SSO_TOKEN ?? "";
+const SSO_ALLOWED_EMAILS = process.env.MERGEN_SSO_ALLOWED_EMAILS ? new Set(process.env.MERGEN_SSO_ALLOWED_EMAILS.split(",").map((e) => e.trim().toLowerCase())) : null;
+const OIDC_ISSUER_URL = process.env.MERGEN_OIDC_ISSUER_URL ?? "";
+const OIDC_CLIENT_ID = process.env.MERGEN_OIDC_CLIENT_ID ?? "";
+const OIDC_JWKS_URL = process.env.MERGEN_OIDC_JWKS_URL ?? "";
+const OIDC_CONFIGURED = !!(OIDC_ISSUER_URL && OIDC_CLIENT_ID);
+const OIDC_GROUP_ROLE_MAP = new Map(
+  (process.env.MERGEN_OIDC_GROUP_ROLE_MAP ?? "").split(",").map((s) => s.trim()).filter(Boolean).map((s) => {
+    const idx = s.lastIndexOf(":");
+    return idx === -1 ? null : [s.slice(0, idx).trim(), s.slice(idx + 1).trim()];
+  }).filter((e) => e !== null)
+);
+const SSO_METHOD_CONFIGURED = SSO_TOKEN.length > 0 || OIDC_CONFIGURED;
+if (OIDC_JWKS_URL && !OIDC_CONFIGURED) {
+  logger.warn(
+    "MERGEN_OIDC_JWKS_URL is set but MERGEN_OIDC_ISSUER_URL and MERGEN_OIDC_CLIENT_ID are not \u2014 OIDC is NOT configured. A JWKS URL alone only tells Mergen where to fetch signing keys from; without an expected issuer and audience there is nothing to stop a token signed by a different application on the same identity-provider tenant from being accepted. Set both to enable OIDC."
+  );
+}
+if (SSO_REQUIRED && !SSO_TOKEN && !OIDC_CONFIGURED) {
+  logger.warn(
+    "MERGEN_SSO_REQUIRED=true but neither MERGEN_SSO_TOKEN nor OIDC (MERGEN_OIDC_ISSUER_URL + MERGEN_OIDC_CLIENT_ID, optionally with MERGEN_OIDC_JWKS_URL to override where keys are fetched from) is configured \u2014 SSO enforcement is disabled."
+  );
+}
+let _jwks = null;
+let _jwksInitPromise = null;
+async function _ensureJwks() {
+  if (_jwks) return _jwks;
+  if (!OIDC_CONFIGURED) return null;
+  if (!_jwksInitPromise) {
+    _jwksInitPromise = (async () => {
+      try {
+        const { createRemoteJWKSet } = await import("jose");
+        let jwksUri = OIDC_JWKS_URL;
+        if (!jwksUri) {
+          const { discovery } = await import("openid-client");
+          const config = await discovery(new URL(OIDC_ISSUER_URL), OIDC_CLIENT_ID);
+          const meta = config.serverMetadata();
+          if (!meta.jwks_uri) throw new Error("OIDC issuer metadata has no jwks_uri");
+          jwksUri = meta.jwks_uri;
+        }
+        _jwks = createRemoteJWKSet(new URL(jwksUri));
+        logger.info({ jwksUri }, "sso: OIDC JWKS resolved");
+      } catch (err) {
+        logger.error({ err }, "sso: OIDC discovery/JWKS setup failed \u2014 will retry on next request");
+        _jwksInitPromise = null;
+      }
+    })();
+  }
+  await _jwksInitPromise;
+  return _jwks;
+}
+async function _verifyOidcToken(token) {
+  const jwks = await _ensureJwks();
+  if (!jwks) return null;
+  try {
+    const { jwtVerify } = await import("jose");
+    const { payload } = await jwtVerify(token, jwks, {
+      issuer: OIDC_ISSUER_URL || void 0,
+      audience: OIDC_CLIENT_ID || void 0
+    });
+    const email = payload.email ?? payload.preferred_username;
+    if (!email) return null;
+    const groups = Array.isArray(payload.groups) ? payload.groups : [];
+    return { email, groups };
+  } catch {
+    return null;
+  }
+}
+function _applyOidcGroupRole(email, groups) {
+  if (OIDC_GROUP_ROLE_MAP.size === 0 || groups.length === 0) return;
+  const RANK = { viewer: 0, responder: 1, admin: 2 };
+  let best = null;
+  for (const g of groups) {
+    const role = OIDC_GROUP_ROLE_MAP.get(g);
+    if (role && (!best || RANK[role] > RANK[best])) best = role;
+  }
+  if (best) upsertMember(email, best, "oidc-sync");
+}
+async function ssoMiddleware(req, res, next) {
+  if (!SSO_REQUIRED) {
+    next();
+    return;
+  }
+  if (req.method === "GET" || req.method === "OPTIONS") {
+    next();
+    return;
+  }
+  if (!SSO_METHOD_CONFIGURED) {
+    logger.error(
+      { path: req.path },
+      "SSO: MERGEN_SSO_REQUIRED=true but neither MERGEN_SSO_TOKEN nor OIDC is configured \u2014 rejecting all writes until fixed."
+    );
+    res.status(503).json({
+      error: "SSO: required but not configured",
+      detail: "MERGEN_SSO_REQUIRED=true but neither MERGEN_SSO_TOKEN nor MERGEN_OIDC_ISSUER_URL+MERGEN_OIDC_CLIENT_ID is set on the server."
+    });
+    return;
+  }
+  const auth = req.headers["authorization"];
+  if (!auth?.startsWith("Bearer ")) {
+    res.status(401).json({
+      error: "SSO required",
+      detail: 'Provide "Authorization: Bearer <token>" on all write requests.'
+    });
+    return;
+  }
+  const presented = auth.slice(7).trim();
+  if (OIDC_CONFIGURED) {
+    const verified = await _verifyOidcToken(presented);
+    if (verified) {
+      const emailLower = verified.email.toLowerCase();
+      if (SSO_ALLOWED_EMAILS && !SSO_ALLOWED_EMAILS.has(emailLower)) {
+        logger.warn({ email: verified.email, path: req.path }, "SSO: OIDC identity verified but email not in allowlist");
+        res.status(401).json({ error: "SSO: unauthorized" });
+        return;
+      }
+      req.headers["x-mergen-member"] = verified.email;
+      _applyOidcGroupRole(verified.email, verified.groups);
+      logger.info({ email: verified.email, path: req.path }, "SSO: authenticated via OIDC");
+      next();
+      return;
+    }
+  }
+  if (!SSO_TOKEN) {
+    res.status(401).json({ error: "SSO: OIDC verification failed and no shared bearer token is configured" });
+    return;
+  }
+  if (SSO_ALLOWED_EMAILS) {
+    const colonIdx = presented.indexOf(":");
+    if (colonIdx < 0) {
+      res.status(401).json({ error: 'SSO: token must be "<email>:<secret>"' });
+      return;
+    }
+    const email = presented.slice(0, colonIdx).toLowerCase();
+    const secret = presented.slice(colonIdx + 1);
+    if (!SSO_ALLOWED_EMAILS.has(email) || !timingSafeSecretEqual(secret, SSO_TOKEN)) {
+      logger.warn({ email, path: req.path }, "SSO: rejected \u2014 email not in allowlist or wrong secret");
+      res.status(401).json({ error: "SSO: unauthorized" });
+      return;
+    }
+    req.headers["x-mergen-member"] = email;
+    logger.info({ email, path: req.path }, "SSO: authenticated via shared bearer token");
+    next();
+    return;
+  }
+  if (!timingSafeSecretEqual(presented, SSO_TOKEN)) {
+    logger.warn({ path: req.path }, "SSO: invalid bearer token");
+    res.status(401).json({ error: "SSO: invalid bearer token" });
+    return;
+  }
+  next();
+}
+function _resetSsoForTesting() {
+  _jwks = null;
+  _jwksInitPromise = null;
+}
+export {
+  _resetSsoForTesting,
+  ssoMiddleware
+};

package/dist/sensor/vitest-reporter.js

@@ -0,0 +1,65 @@
+import http from "http";
+const DEFAULT_PORT = 3e3;
+const MERGEN_PORT = parseInt(process.env.MERGEN_PORT ?? String(DEFAULT_PORT), 10);
+function postEvent(payload) {
+  const body = JSON.stringify(payload);
+  const req = http.request(
+    {
+      hostname: "127.0.0.1",
+      port: MERGEN_PORT,
+      path: "/ingest",
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body)
+      }
+    },
+    (res) => res.resume()
+  );
+  req.on("error", () => {
+  });
+  req.write(body);
+  req.end();
+}
+class MergenReporter {
+  _warned = false;
+  onTestCaseResult(testCase) {
+    try {
+      this._reportTestCase(testCase);
+    } catch (err) {
+      if (!this._warned) {
+        this._warned = true;
+        process.stderr.write(`[mergen] vitest-reporter error (results will not be sent): ${err}
+`);
+      }
+    }
+  }
+  _reportTestCase(testCase) {
+    const result = testCase.result();
+    if (!result) return;
+    const stateMap = {
+      passed: "pass",
+      failed: "fail",
+      skipped: "skip",
+      todo: "todo"
+    };
+    const rawCase = testCase;
+    const firstError = result.errors?.[0];
+    const normalizedError = firstError ? firstError instanceof Error ? { message: firstError.message, stack: firstError.stack } : { message: String(firstError), stack: void 0 } : void 0;
+    postEvent({
+      type: "test_result",
+      runner: "vitest",
+      file: rawCase.file?.name ?? rawCase.module?.filepath ?? rawCase.module?.id ?? rawCase.moduleId ?? "",
+      name: testCase.fullName,
+      status: stateMap[result.state] ?? "skip",
+      duration: result.duration ?? void 0,
+      error: normalizedError,
+      timestamp: Date.now()
+    });
+  }
+  onTestSuiteResult(_suite) {
+  }
+}
+export {
+  MergenReporter as default
+};

package/dist/sensor/watcher.js

@@ -0,0 +1,48 @@
+import { store } from "./buffer.js";
+import logger from "./logger.js";
+let _onActivity = null;
+function registerWatcherNotifier(fn) {
+  _onActivity = fn;
+}
+const DEFAULT_INTERVAL_MS = 15e3;
+let _timer = null;
+let _lastSeenSize = 0;
+let _ticks = 0;
+function startWatcher() {
+  if (process.env.MERGEN_WATCH === "0") {
+    logger.info("background watcher disabled via MERGEN_WATCH=0");
+    return;
+  }
+  if (_timer) return;
+  const interval = Number(process.env.MERGEN_WATCH_INTERVAL_MS) || DEFAULT_INTERVAL_MS;
+  _timer = setInterval(() => {
+    try {
+      const size = store.size();
+      if (size === _lastSeenSize) return;
+      _lastSeenSize = size;
+      _ticks++;
+      _onActivity?.("periodic");
+    } catch (err) {
+      logger.warn({ err }, "background watcher tick failed (non-fatal)");
+    }
+  }, interval);
+  if (typeof _timer.unref === "function") _timer.unref();
+  logger.info({ intervalMs: interval }, "background watcher started");
+}
+function stopWatcher() {
+  if (_timer) {
+    clearInterval(_timer);
+    _timer = null;
+  }
+  _lastSeenSize = 0;
+  _ticks = 0;
+}
+function _getWatcherTickCount() {
+  return _ticks;
+}
+export {
+  _getWatcherTickCount,
+  registerWatcherNotifier,
+  startWatcher,
+  stopWatcher
+};

package/dist/storage/pg/pg-action-ledger.js

@@ -0,0 +1,138 @@
+import { getSql } from "./pg-client.js";
+import logger from "../../sensor/logger.js";
+const DEFAULT_TENANT = "local";
+const RETENTION_MS = (() => {
+  const d = parseFloat(process.env.MERGEN_LEDGER_RETENTION_DAYS ?? "90");
+  return (Number.isFinite(d) && d > 0 ? d : 90) * 24 * 60 * 60 * 1e3;
+})();
+function rowToRecord(r) {
+  let policyMatched = [];
+  const pm = r.policy_matched;
+  if (Array.isArray(pm)) policyMatched = pm;
+  else if (typeof pm === "string") {
+    try {
+      policyMatched = JSON.parse(pm);
+    } catch {
+    }
+  }
+  return {
+    id: Number(r.id ?? 0),
+    ts: Number(r.ts ?? 0),
+    agentId: r.agent_id ?? null,
+    userId: r.user_id ?? null,
+    tool: String(r.tool ?? ""),
+    command: r.command ?? null,
+    resource: r.resource ?? null,
+    verdict: r.verdict ?? "pass",
+    policyMatched,
+    reason: r.reason ?? null,
+    credentialIssued: r.credential_issued === true,
+    credentialScope: r.credential_scope ?? null,
+    environment: r.environment ?? null,
+    traceId: r.trace_id ?? null
+  };
+}
+class PgActionLedger {
+  async append(rec, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    try {
+      const rows = await sql`
+        INSERT INTO action_ledger (
+          tenant_id, ts, agent_id, user_id, tool, command, resource, verdict,
+          policy_matched, reason, credential_issued, credential_scope, environment, trace_id
+        ) VALUES (
+          ${tid}, ${rec.ts ?? Date.now()}, ${rec.agentId ?? null}, ${rec.userId ?? null},
+          ${rec.tool}, ${rec.command ?? null}, ${rec.resource ?? null}, ${rec.verdict},
+          ${JSON.stringify(rec.policyMatched ?? [])}, ${rec.reason ?? null},
+          ${rec.credentialIssued ?? false}, ${rec.credentialScope ?? null},
+          ${rec.environment ?? null}, ${rec.traceId ?? null}
+        ) RETURNING id
+      `;
+      const id = Number(rows[0]?.id ?? 0);
+      void import("../../intelligence/siem-forward.js").then(({ forwardLedgerToSiem }) => {
+        forwardLedgerToSiem({
+          id,
+          ts: rec.ts ?? Date.now(),
+          agentId: rec.agentId ?? null,
+          userId: rec.userId ?? null,
+          tool: rec.tool,
+          command: rec.command ?? null,
+          resource: rec.resource ?? null,
+          verdict: rec.verdict,
+          policyMatched: rec.policyMatched ?? [],
+          reason: rec.reason ?? null,
+          credentialIssued: rec.credentialIssued ?? false,
+          credentialScope: rec.credentialScope ?? null,
+          environment: rec.environment ?? null,
+          traceId: rec.traceId ?? null
+        });
+      }).catch(() => {
+      });
+    } catch (err) {
+      logger.warn({ err }, "pg-action-ledger: append failed");
+    }
+  }
+  async query(opts, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const { agentId, from, to, verdict, tool, limit = 100 } = opts;
+    const cap = Math.min(Math.max(1, limit), 5e3);
+    try {
+      const rows = await sql`
+        SELECT * FROM action_ledger
+        WHERE tenant_id = ${tid}
+          AND (${agentId ?? null}::text   IS NULL OR agent_id = ${agentId ?? null})
+          AND (${from ?? null}::bigint     IS NULL OR ts >= ${from ?? null})
+          AND (${to ?? null}::bigint       IS NULL OR ts <= ${to ?? null})
+          AND (${verdict ?? null}::text    IS NULL OR verdict = ${verdict ?? null})
+          AND (${tool ?? null}::text       IS NULL OR tool = ${tool ?? null})
+        ORDER BY ts DESC
+        LIMIT ${cap}
+      `;
+      return rows.map((r) => rowToRecord(r));
+    } catch (err) {
+      logger.warn({ err }, "pg-action-ledger: query failed");
+      return [];
+    }
+  }
+  async queryCredentialUsage(opts, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const { agentId, scope, from, to, limit = 1e3 } = opts;
+    const cap = Math.min(Math.max(1, limit), 1e4);
+    try {
+      const rows = await sql`
+        SELECT * FROM action_ledger
+        WHERE tenant_id = ${tid}
+          AND credential_issued = TRUE
+          AND (${agentId ?? null}::text IS NULL OR agent_id = ${agentId ?? null})
+          AND (${scope ?? null}::text   IS NULL OR credential_scope = ${scope ?? null})
+          AND (${from ?? null}::bigint  IS NULL OR ts >= ${from ?? null})
+          AND (${to ?? null}::bigint    IS NULL OR ts <= ${to ?? null})
+        ORDER BY ts DESC
+        LIMIT ${cap}
+      `;
+      return rows.map((r) => rowToRecord(r));
+    } catch (err) {
+      logger.warn({ err }, "pg-action-ledger: credential query failed");
+      return [];
+    }
+  }
+  async prune(tenantId) {
+    const sql = getSql();
+    const cutoff = Date.now() - RETENTION_MS;
+    try {
+      if (tenantId) {
+        await sql`DELETE FROM action_ledger WHERE tenant_id = ${tenantId} AND ts < ${cutoff}`;
+      } else {
+        await sql`DELETE FROM action_ledger WHERE ts < ${cutoff}`;
+      }
+    } catch (err) {
+      logger.warn({ err }, "pg-action-ledger: prune failed");
+    }
+  }
+}
+export {
+  PgActionLedger
+};