mergen-server 1.4.0

package/dist/storage/pg/pg-approval-store.js

@@ -0,0 +1,107 @@
+import { getSql } from "./pg-client.js";
+const DEFAULT_TENANT = "local";
+function rowToPending(row) {
+  return {
+    pid: String(row.pid ?? ""),
+    command: String(row.command ?? ""),
+    tier: row.tier ?? "restart",
+    service: String(row.service ?? ""),
+    remediationConfidence: Number(row.remediation_confidence ?? 0),
+    requestedAt: row.requested_at instanceof Date ? row.requested_at.getTime() : new Date(String(row.requested_at ?? 0)).getTime(),
+    expiresAt: row.expires_at instanceof Date ? row.expires_at.getTime() : new Date(String(row.expires_at ?? 0)).getTime(),
+    cwd: row.cwd ? String(row.cwd) : void 0,
+    blastRadius: row.blast_radius ? row.blast_radius : void 0
+  };
+}
+class PgApprovalStore {
+  async add(token, execution, tenantId = DEFAULT_TENANT) {
+    const sql = getSql();
+    const lastRows = await sql`
+      SELECT hash FROM pending_approvals
+      WHERE tenant_id = ${tenantId}
+      ORDER BY requested_at DESC, token DESC
+      LIMIT 1
+    `;
+    const prevHash = lastRows.length > 0 && lastRows[0].hash ? String(lastRows[0].hash) : "genesis_approvals";
+    const crypto = await import("crypto");
+    const payload = [
+      token,
+      execution.pid,
+      execution.command,
+      execution.tier,
+      execution.service,
+      String(execution.remediationConfidence),
+      String(execution.requestedAt)
+    ].join("|");
+    const hash = crypto.createHash("sha256").update(payload + prevHash).digest("hex");
+    await sql`
+      INSERT INTO pending_approvals (
+        token, tenant_id, pid, command, tier, service,
+        remediation_confidence, requested_at, expires_at, cwd, blast_radius,
+        hash, prev_hash
+      ) VALUES (
+        ${token},
+        ${tenantId},
+        ${execution.pid},
+        ${execution.command},
+        ${execution.tier},
+        ${execution.service},
+        ${execution.remediationConfidence},
+        ${new Date(execution.requestedAt)},
+        ${new Date(execution.expiresAt)},
+        ${execution.cwd ?? null},
+        ${execution.blastRadius ? sql.json(execution.blastRadius) : null},
+        ${hash},
+        ${prevHash}
+      )
+      ON CONFLICT (token) DO NOTHING
+    `;
+  }
+  async get(token) {
+    const sql = getSql();
+    const rows = await sql`
+      SELECT * FROM pending_approvals
+      WHERE token = ${token}
+        AND resolved_at IS NULL
+        AND expires_at > NOW()
+    `;
+    if (rows.length === 0) return null;
+    return rowToPending(rows[0]);
+  }
+  async resolve(token) {
+    const sql = getSql();
+    const rows = await sql`
+      UPDATE pending_approvals
+      SET resolved_at = NOW(), resolution = 'resolved'
+      WHERE token = ${token} AND resolved_at IS NULL
+      RETURNING 1
+    `;
+    return rows.length > 0;
+  }
+  async listPending(tenantId = DEFAULT_TENANT) {
+    const sql = getSql();
+    const rows = await sql`
+      SELECT * FROM pending_approvals
+      WHERE tenant_id = ${tenantId} AND resolved_at IS NULL AND expires_at > NOW()
+      ORDER BY requested_at ASC
+    `;
+    return rows.map((r) => [
+      String(r.token ?? ""),
+      rowToPending(r)
+    ]);
+  }
+  async pruneExpired() {
+    const sql = getSql();
+    await sql`
+      UPDATE pending_approvals
+      SET resolved_at = NOW(), resolution = 'expired'
+      WHERE expires_at < NOW() AND resolved_at IS NULL
+    `;
+  }
+  async flush() {
+    return Promise.resolve();
+  }
+}
+export {
+  PgApprovalStore
+};

package/dist/storage/pg/pg-blunder-store.js

@@ -0,0 +1,193 @@
+import { createHash, randomUUID } from "crypto";
+import { getSql } from "./pg-client.js";
+import { MAX_BLUNDERS, NON_BLOCKING_BLUNDER_TYPES } from "../../sensor/agent-blunder-store.js";
+const DEFAULT_TENANT = "local";
+const GENESIS_HASH = "0".repeat(64);
+function _hashableContent(event, previousHash) {
+  const content = {
+    id: event.id,
+    recordedAt: event.recordedAt,
+    blunderType: event.blunderType,
+    command: event.command,
+    blockReason: event.blockReason,
+    service: event.service,
+    tag: event.tag,
+    actor: event.actor,
+    pid: event.pid,
+    confidenceScore: event.confidenceScore
+  };
+  if (event.triggeredRules !== void 0) content.triggeredRules = event.triggeredRules;
+  return previousHash + JSON.stringify(content);
+}
+function _computeHash(event, previousHash) {
+  return createHash("sha256").update(_hashableContent(event, previousHash)).digest("hex");
+}
+function rowToBlunder(row) {
+  const triggeredRaw = row.triggered_rules;
+  let triggeredRules;
+  if (triggeredRaw === null || triggeredRaw === void 0) {
+    triggeredRules = null;
+  } else if (Array.isArray(triggeredRaw)) {
+    triggeredRules = triggeredRaw;
+  } else {
+    try {
+      triggeredRules = JSON.parse(String(triggeredRaw));
+    } catch {
+      triggeredRules = null;
+    }
+  }
+  return {
+    id: String(row.id ?? ""),
+    recordedAt: Number(row.recorded_at ?? 0),
+    blunderType: row.blunder_type ?? "allowlist_block",
+    command: row.command ? String(row.command) : null,
+    blockReason: String(row.block_reason ?? ""),
+    service: row.service ? String(row.service) : null,
+    tag: row.tag ? String(row.tag) : null,
+    actor: row.actor ? String(row.actor) : null,
+    pid: row.pid ? String(row.pid) : null,
+    confidenceScore: row.confidence_score != null ? Number(row.confidence_score) : null,
+    triggeredRules,
+    previousHash: String(row.previous_hash ?? ""),
+    hash: String(row.hash ?? "")
+  };
+}
+class PgBlunderStore {
+  async record(event, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    await sql.begin("SERIALIZABLE", async (tx) => {
+      const id = event.id ?? randomUUID();
+      const existing = await tx`SELECT 1 FROM agent_blunders WHERE id = ${id} AND tenant_id = ${tid} LIMIT 1`;
+      if (existing.length > 0) return;
+      const lastRows = await tx`
+        SELECT hash FROM agent_blunders
+        WHERE tenant_id = ${tid}
+        ORDER BY recorded_at ASC, id ASC
+        OFFSET (SELECT GREATEST(COUNT(*) - 1, 0) FROM agent_blunders WHERE tenant_id = ${tid})
+        LIMIT 1
+      `;
+      const previousHash = lastRows.length > 0 ? String(lastRows[0].hash) : GENESIS_HASH;
+      const recordedAt = event.recordedAt ?? Date.now();
+      const triggeredRules = event.triggeredRules !== void 0 ? event.triggeredRules : null;
+      const base = { ...event, id, recordedAt, triggeredRules };
+      const hash = _computeHash(base, previousHash);
+      await tx`
+        INSERT INTO agent_blunders (
+          id, tenant_id, recorded_at, blunder_type, command, block_reason,
+          service, tag, actor, pid, confidence_score, triggered_rules,
+          previous_hash, hash
+        ) VALUES (
+          ${id}, ${tid}, ${recordedAt},
+          ${event.blunderType}, ${event.command ?? null}, ${event.blockReason},
+          ${event.service ?? null}, ${event.tag ?? null}, ${event.actor ?? null},
+          ${event.pid ?? null}, ${event.confidenceScore ?? null},
+          ${triggeredRules != null ? JSON.stringify(triggeredRules) : null},
+          ${previousHash}, ${hash}
+        )
+        ON CONFLICT (id, tenant_id) DO NOTHING
+      `;
+      await tx`
+        DELETE FROM agent_blunders
+        WHERE tenant_id = ${tid}
+          AND recorded_at = (
+            SELECT recorded_at FROM agent_blunders
+            WHERE tenant_id = ${tid}
+            ORDER BY recorded_at ASC, id ASC
+            LIMIT 1
+          )
+          AND (SELECT COUNT(*) FROM agent_blunders WHERE tenant_id = ${tid}) > ${MAX_BLUNDERS}
+      `;
+    });
+  }
+  async list(tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM agent_blunders
+      WHERE tenant_id = ${tid}
+      ORDER BY recorded_at ASC, id ASC
+    `;
+    return rows.map((r) => rowToBlunder(r));
+  }
+  async getStats(tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const now = Date.now();
+    const ms7 = 7 * 24 * 60 * 60 * 1e3;
+    const ms30 = 30 * 24 * 60 * 60 * 1e3;
+    const nonBlockingTypes = [...NON_BLOCKING_BLUNDER_TYPES];
+    const [totalRows, typeRows, recent7Rows, recent30Rows] = await Promise.all([
+      sql`SELECT COUNT(*) AS cnt FROM agent_blunders WHERE tenant_id = ${tid} AND blunder_type != ALL(${nonBlockingTypes})`,
+      sql`SELECT blunder_type, COUNT(*) AS cnt FROM agent_blunders WHERE tenant_id = ${tid} GROUP BY blunder_type`,
+      sql`SELECT COUNT(*) AS cnt FROM agent_blunders WHERE tenant_id = ${tid} AND recorded_at >= ${now - ms7} AND blunder_type != ALL(${nonBlockingTypes})`,
+      sql`SELECT COUNT(*) AS cnt FROM agent_blunders WHERE tenant_id = ${tid} AND recorded_at >= ${now - ms30} AND blunder_type != ALL(${nonBlockingTypes})`
+    ]);
+    const byType = {};
+    for (const row of typeRows) {
+      byType[String(row.blunder_type)] = Number(row.cnt);
+    }
+    return {
+      total: Number(totalRows[0].cnt),
+      byType,
+      last7Days: Number(recent7Rows[0].cnt),
+      last30Days: Number(recent30Rows[0].cnt)
+    };
+  }
+  async verifyChain(tenantId) {
+    const hmacProtected = false;
+    const blunders = await this.list(tenantId);
+    if (blunders.length === 0) {
+      return { valid: true, verified: 0, note: "Log is empty \u2014 nothing to verify", tamperEvidenceLevel: "none", hmacProtected };
+    }
+    const firstV2Idx = blunders.findIndex((b) => !!b.hash);
+    if (firstV2Idx === -1) {
+      return {
+        valid: true,
+        verified: 0,
+        truncated: false,
+        note: "No cryptographically-verified entries \u2014 all entries predate hash-chain migration. Chain integrity cannot be confirmed.",
+        tamperEvidenceLevel: "none",
+        hmacProtected
+      };
+    }
+    const anchor = blunders[firstV2Idx];
+    const truncated = anchor.previousHash !== GENESIS_HASH;
+    let expectedPrev = anchor.previousHash;
+    let seenFirstV2 = false;
+    for (let i = firstV2Idx; i < blunders.length; i++) {
+      const b = blunders[i];
+      if (!b.hash) {
+        return { valid: false, firstInvalidIdx: i, reason: `entry at index ${i} (id=${b.id}) is missing hash field after v2 section began \u2014 possible injection`, tamperEvidenceLevel: "hash-chain", hmacProtected };
+      }
+      if (!seenFirstV2) {
+        seenFirstV2 = true;
+      } else {
+        if (b.previousHash !== expectedPrev) {
+          return { valid: false, firstInvalidIdx: i, reason: `previousHash mismatch at index ${i}: expected ${expectedPrev.slice(0, 8)}\u2026 got ${b.previousHash.slice(0, 8)}\u2026`, tamperEvidenceLevel: "hash-chain", hmacProtected };
+        }
+      }
+      const { hash: _h, previousHash: _p, ...rest } = b;
+      const recomputed = _computeHash(rest, b.previousHash);
+      if (recomputed !== b.hash) {
+        return { valid: false, firstInvalidIdx: i, reason: `hash mismatch at index ${i} (id=${b.id}): content was modified after recording`, tamperEvidenceLevel: "hash-chain", hmacProtected };
+      }
+      expectedPrev = b.hash;
+    }
+    return {
+      valid: true,
+      truncated,
+      verifiedFrom: anchor.id,
+      verified: blunders.length - firstV2Idx,
+      tamperEvidenceLevel: "hash-chain",
+      hmacProtected
+    };
+  }
+  /** Always false in Postgres mode — DB integrity mechanisms replace the HMAC sidecar. */
+  isIntegrityViolated() {
+    return false;
+  }
+}
+export {
+  PgBlunderStore
+};

package/dist/storage/pg/pg-ci-gate-history.js

@@ -0,0 +1,83 @@
+import { randomUUID } from "crypto";
+import { getSql } from "./pg-client.js";
+import { MAX_GATE_HISTORY } from "../../sensor/ci-gate-history.js";
+import logger from "../../sensor/logger.js";
+const DEFAULT_TENANT = "local";
+function rowToEntry(row) {
+  const reasonsRaw = row.reasons;
+  let reasons = [];
+  if (Array.isArray(reasonsRaw)) {
+    reasons = reasonsRaw;
+  } else if (typeof reasonsRaw === "string") {
+    try {
+      reasons = JSON.parse(reasonsRaw);
+    } catch {
+      reasons = [];
+    }
+  }
+  return {
+    id: String(row.id ?? ""),
+    recordedAt: Number(row.recorded_at ?? 0),
+    prNumber: row.pr_number != null ? Number(row.pr_number) : null,
+    repo: row.repo ? String(row.repo) : null,
+    service: row.service ? String(row.service) : null,
+    actor: row.actor ? String(row.actor) : null,
+    verdict: row.verdict ?? "pass",
+    riskScore: Number(row.risk_score ?? 0),
+    reasons,
+    sha: row.sha ? String(row.sha) : null
+  };
+}
+class PgGateHistoryStore {
+  async record(entry, tenantId) {
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const id = entry.id ?? randomUUID();
+    const recordedAt = entry.recordedAt ?? Date.now();
+    try {
+      const sql = getSql();
+      await sql.begin(async (tx) => {
+        const existing = await tx`SELECT 1 FROM ci_gate_history WHERE id = ${id} AND tenant_id = ${tid} LIMIT 1`;
+        if (existing.length > 0) return;
+        await tx`
+          INSERT INTO ci_gate_history (
+            id, tenant_id, recorded_at, pr_number, repo, service, actor, verdict, risk_score, reasons, sha
+          ) VALUES (
+            ${id}, ${tid}, ${recordedAt},
+            ${entry.prNumber ?? null}, ${entry.repo ?? null}, ${entry.service ?? null}, ${entry.actor ?? null},
+            ${entry.verdict}, ${entry.riskScore ?? 0}, ${JSON.stringify(entry.reasons ?? [])}, ${entry.sha ?? null}
+          )
+          ON CONFLICT (id, tenant_id) DO NOTHING
+        `;
+        await tx`
+          DELETE FROM ci_gate_history
+          WHERE tenant_id = ${tid}
+            AND recorded_at = (
+              SELECT recorded_at FROM ci_gate_history
+              WHERE tenant_id = ${tid}
+              ORDER BY recorded_at ASC, id ASC
+              LIMIT 1
+            )
+            AND (SELECT COUNT(*) FROM ci_gate_history WHERE tenant_id = ${tid}) > ${MAX_GATE_HISTORY}
+        `;
+      });
+    } catch (err) {
+      logger.warn({ err }, "pg-ci-gate-history: record failed (non-fatal)");
+    }
+  }
+  async listForPR(prNumber, repo, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = repo ? await sql`SELECT * FROM ci_gate_history WHERE tenant_id = ${tid} AND pr_number = ${prNumber} AND repo = ${repo} ORDER BY recorded_at ASC` : await sql`SELECT * FROM ci_gate_history WHERE tenant_id = ${tid} AND pr_number = ${prNumber} ORDER BY recorded_at ASC`;
+    return rows.map((r) => rowToEntry(r));
+  }
+  async list(opts, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const limit = opts?.limit ?? 100;
+    const rows = await sql`SELECT * FROM ci_gate_history WHERE tenant_id = ${tid} ORDER BY recorded_at DESC LIMIT ${limit}`;
+    return rows.map((r) => rowToEntry(r));
+  }
+}
+export {
+  PgGateHistoryStore
+};

package/dist/storage/pg/pg-client.js

@@ -0,0 +1,24 @@
+import postgres from "postgres";
+let _sql = null;
+function getSql() {
+  if (!_sql) {
+    const url = process.env.MERGEN_PG_URL;
+    if (!url) throw new Error("MERGEN_PG_URL is not set");
+    _sql = postgres(url, {
+      max: 10,
+      idle_timeout: 30,
+      connect_timeout: 10
+    });
+  }
+  return _sql;
+}
+async function closeSql() {
+  if (_sql) {
+    await _sql.end();
+    _sql = null;
+  }
+}
+export {
+  closeSql,
+  getSql
+};

package/dist/storage/pg/pg-event-store.js

@@ -0,0 +1,63 @@
+import { getSql } from "./pg-client.js";
+const DEFAULT_TENANT = "local";
+const DEFAULT_RETENTION_HOURS = 72;
+class PgEventStore {
+  async init() {
+  }
+  async push(event, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const type = event.type;
+    const ts = event.timestamp ?? Date.now();
+    let level = null;
+    if (event.type === "console") {
+      level = event.level ?? null;
+    } else if (event.type === "network") {
+      const status = event.status;
+      level = status != null ? String(status) : null;
+    }
+    await sql`
+      INSERT INTO events (tenant_id, type, level, data, ts)
+      VALUES (${tid}, ${type}, ${level}, ${sql.json(event)}, ${ts})
+    `;
+  }
+  async query(opts) {
+    const sql = getSql();
+    const tid = opts.tenantId ?? DEFAULT_TENANT;
+    const limit = opts.limit ?? 500;
+    const rows = await sql`
+      SELECT data FROM events
+      WHERE tenant_id = ${tid}
+        ${opts.since != null ? sql`AND ts >= ${opts.since}` : sql``}
+        ${opts.level != null ? sql`AND level = ${opts.level}` : sql``}
+        ${opts.type != null ? sql`AND type = ${opts.type}` : sql``}
+      ORDER BY ts DESC
+      LIMIT ${limit}
+    `;
+    return rows.map((r) => r.data);
+  }
+  async size() {
+    const sql = getSql();
+    const rows = await sql`SELECT COUNT(*)::int AS cnt FROM events`;
+    return rows[0]?.cnt ?? 0;
+  }
+  async clear(tenantId) {
+    const sql = getSql();
+    if (tenantId) {
+      await sql`DELETE FROM events WHERE tenant_id = ${tenantId}`;
+    } else {
+      await sql`DELETE FROM events`;
+    }
+  }
+  async pruneOld() {
+    const sql = getSql();
+    const hours = Number(process.env.MERGEN_RETENTION_HOURS ?? DEFAULT_RETENTION_HOURS);
+    await sql`
+      DELETE FROM events
+      WHERE inserted_at < NOW() - (${hours} || ' hours')::interval
+    `;
+  }
+}
+export {
+  PgEventStore
+};

package/dist/storage/pg/pg-incident-store.js

@@ -0,0 +1,190 @@
+import { getSql } from "./pg-client.js";
+const DEFAULT_TENANT = "local";
+function toMs(value) {
+  if (!value) return 0;
+  if (value instanceof Date) return value.getTime();
+  return new Date(value).getTime();
+}
+function toMsNullable(value) {
+  if (!value) return null;
+  if (value instanceof Date) return value.getTime();
+  return new Date(value).getTime();
+}
+function rowToIncident(row) {
+  return {
+    pid: String(row.pid ?? ""),
+    hypothesis: String(row.hypothesis ?? ""),
+    tag: String(row.tag ?? ""),
+    status: row.status ?? "open",
+    assignee: row.assignee ? String(row.assignee) : null,
+    notes: Array.isArray(row.notes) ? row.notes : (() => {
+      try {
+        return JSON.parse(String(row.notes ?? "[]"));
+      } catch {
+        return [];
+      }
+    })(),
+    sha: row.sha ? String(row.sha) : null,
+    environment: row.environment ? String(row.environment) : null,
+    service: row.service ? String(row.service) : null,
+    cluster: row.cluster ? String(row.cluster) : null,
+    confidence: Number(row.confidence ?? 0),
+    createdAt: toMs(row.created_at),
+    updatedAt: toMs(row.updated_at),
+    acknowledgedBy: row.acknowledged_by ? String(row.acknowledged_by) : null,
+    resolvedAt: toMsNullable(row.resolved_at),
+    resolvedAutonomously: Boolean(row.resolved_autonomously),
+    causallyCorrect: Boolean(row.causally_correct),
+    contextBriefViewedAt: toMsNullable(row.context_brief_viewed_at)
+  };
+}
+class PgIncidentStore {
+  async init() {
+  }
+  async upsert(pid, fields, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const notes = JSON.stringify(fields.notes ?? []);
+    const rows = await sql`
+      INSERT INTO incidents (
+        pid, tenant_id, hypothesis, tag, status, assignee, notes,
+        sha, environment, service, cluster, confidence,
+        acknowledged_by, resolved_at, resolved_autonomously, causally_correct
+      ) VALUES (
+        ${pid}, ${tid},
+        ${fields.hypothesis ?? ""},
+        ${fields.tag ?? ""},
+        ${fields.status ?? "open"},
+        ${fields.assignee ?? null},
+        ${notes}::jsonb,
+        ${fields.sha ?? null},
+        ${fields.environment ?? null},
+        ${fields.service ?? null},
+        ${fields.cluster ?? null},
+        ${fields.confidence ?? 0},
+        ${fields.acknowledgedBy ?? null},
+        ${fields.resolvedAt ? new Date(fields.resolvedAt) : null},
+        ${fields.resolvedAutonomously ?? false},
+        ${fields.causallyCorrect ?? false}
+      )
+      ON CONFLICT (tenant_id, pid) DO UPDATE SET
+        hypothesis            = EXCLUDED.hypothesis,
+        tag                   = EXCLUDED.tag,
+        status                = EXCLUDED.status,
+        assignee              = EXCLUDED.assignee,
+        notes                 = EXCLUDED.notes,
+        sha                   = EXCLUDED.sha,
+        environment           = EXCLUDED.environment,
+        service               = EXCLUDED.service,
+        cluster               = EXCLUDED.cluster,
+        confidence            = EXCLUDED.confidence,
+        updated_at            = NOW(),
+        acknowledged_by       = EXCLUDED.acknowledged_by,
+        resolved_at           = EXCLUDED.resolved_at,
+        resolved_autonomously = EXCLUDED.resolved_autonomously,
+        causally_correct      = EXCLUDED.causally_correct
+      RETURNING *
+    `;
+    const incident = rowToIncident(rows[0]);
+    if (incident.service) {
+      await this.updateServiceEdges(incident.service, incident.updatedAt, void 0, tid);
+    }
+    return incident;
+  }
+  async get(pid, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM incidents WHERE tenant_id = ${tid} AND pid = ${pid}
+    `;
+    if (rows.length === 0) return null;
+    return rowToIncident(rows[0]);
+  }
+  async list(status, limit = 50, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM incidents
+      WHERE tenant_id = ${tid}
+        ${status != null ? sql`AND status = ${status}` : sql``}
+      ORDER BY updated_at DESC
+      LIMIT ${limit}
+    `;
+    return rows.map((r) => rowToIncident(r));
+  }
+  async addNote(pid, note, author, tenantId) {
+    const inc = await this.get(pid, tenantId);
+    if (!inc) return null;
+    const entry = author ? `[${author}] ${note}` : note;
+    return this.upsert(pid, { notes: [...inc.notes, entry] }, tenantId);
+  }
+  async markContextViewed(pid, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    await sql`
+      UPDATE incidents
+      SET context_brief_viewed_at = NOW()
+      WHERE tenant_id = ${tid} AND pid = ${pid} AND context_brief_viewed_at IS NULL
+    `;
+  }
+  async coOccurringServices(service, windowMs = 10 * 60 * 1e3, limit = 4, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const intervalSec = Math.round(windowMs / 1e3);
+    const rows = await sql`
+      SELECT other.service, COUNT(*) AS cnt
+      FROM incidents AS base
+      JOIN incidents AS other
+        ON other.service != base.service
+       AND other.service IS NOT NULL
+       AND other.created_at BETWEEN base.created_at - (${intervalSec} || ' seconds')::interval
+                                 AND base.created_at + (${intervalSec} || ' seconds')::interval
+      WHERE base.tenant_id = ${tid}
+        AND other.tenant_id = ${tid}
+        AND base.service = ${service}
+      GROUP BY other.service
+      ORDER BY cnt DESC
+      LIMIT ${limit}
+    `;
+    return rows.map((r) => ({ service: String(r.service ?? ""), count: Number(r.cnt ?? 0) }));
+  }
+  async updateServiceEdges(service, at, windowMs = 10 * 60 * 1e3, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const coServices = await this.coOccurringServices(service, windowMs, 20, tid);
+    const lastAt = new Date(at);
+    for (const { service: target } of coServices) {
+      for (const [src, tgt] of [[service, target], [target, service]]) {
+        await sql`
+          INSERT INTO service_edges (tenant_id, source, target, weight, last_incident_at)
+          VALUES (${tid}, ${src}, ${tgt}, 1, ${lastAt})
+          ON CONFLICT (tenant_id, source, target)
+          DO UPDATE SET
+            weight           = service_edges.weight + 1,
+            last_incident_at = EXCLUDED.last_incident_at
+        `;
+      }
+    }
+  }
+  async getInteractionGraph(service, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT source, target, weight, last_incident_at
+      FROM service_edges
+      WHERE tenant_id = ${tid}
+        ${service != null ? sql`AND (source = ${service} OR target = ${service})` : sql``}
+      ORDER BY weight DESC
+      LIMIT ${service != null ? 100 : 200}
+    `;
+    return rows.map((r) => ({
+      source: String(r.source ?? ""),
+      target: String(r.target ?? ""),
+      weight: Number(r.weight ?? 0),
+      lastIncidentAt: toMs(r.last_incident_at)
+    }));
+  }
+}
+export {
+  PgIncidentStore
+};

package/dist/storage/pg/pg-migrations.js

@@ -0,0 +1,26 @@
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import { getSql } from "./pg-client.js";
+async function runMigrations() {
+  const sql = getSql();
+  await sql`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      id         SERIAL PRIMARY KEY,
+      name       TEXT NOT NULL UNIQUE,
+      applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `;
+  const migrationsDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "migrations");
+  const files = fs.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
+  for (const file of files) {
+    const applied = await sql`SELECT 1 FROM _migrations WHERE name = ${file}`;
+    if (applied.length > 0) continue;
+    const content = fs.readFileSync(path.join(migrationsDir, file), "utf8");
+    await sql.unsafe(content);
+    await sql`INSERT INTO _migrations (name) VALUES (${file})`;
+  }
+}
+export {
+  runMigrations
+};