@agent-custody/state 0.1.9 → 0.3.0

package/dist/ledger.d.ts

@@ -155,13 +155,14 @@ export interface AsOf {
     include?: "attested" | "verified" | "all";
 }
 export declare class Ledger {
-    private readonly events;
     private readonly store;
     private readonly now;
     private readonly forgetKey;
     /**
-     * `location` is a path: JSONL by default, SQLite when it ends in .sqlite or .db; or pass a store.
-     * forgetKey: a secret kept outside the store; with it, forgotten values leave an HMAC rather than a plain hash.
+     * `location` is a path (JSONL by default, SQLite when it ends in .sqlite or .db) or a postgres:// URL; or pass a
+     * store. The ledger holds no events itself: every question is a query to the store, so a shared store means a
+     * shared ledger. forgetKey: a secret kept outside the store; with it, forgotten values leave an HMAC rather than a
+     * plain hash.
      */
     constructor(location: string | EventStore, opts?: {
         now?: () => Date;
@@ -170,37 +171,47 @@ export declare class Ledger {
     /** Where the events live, for reports. */
     get location(): string;
     /** Every event in order, for export. */
-    export(): LedgerEvent[];
-    close(): void;
-    get size(): number;
+    export(): Promise<LedgerEvent[]>;
+    close(): Promise<void>;
+    count(): Promise<number>;
+    /** Every space with at least one fact. */
+    spaces(): Promise<string[]>;
     /** The checks assert makes, without appending. For callers that must do something irreversible before the append. */
-    validateAssert(input: AssertInput): void;
-    assert(input: AssertInput): AssertEvent;
-    retract(input: RetractInput): RetractEvent;
-    confirm(input: ConfirmInput): ConfirmEvent;
-    /**
-     * Erases a fact's value from the ledger file, keeping its digest, and stops believing it. The file is rewritten in
-     * place, which is the one thing an append-only ledger must do for a deletion demand. Everything else about the fact
-     * stays: who wrote it, when, from which receipt, and now who erased it and why.
-     */
+    validateAssert(input: AssertInput): Promise<void>;
+    assert(input: AssertInput): Promise<AssertEvent>;
+    retract(input: RetractInput): Promise<RetractEvent>;
+    confirm(input: ConfirmInput): Promise<ConfirmEvent>;
     /** Whether a legal hold currently stands on the fact. */
-    held(factId: string): boolean;
-    hold(input: HoldInput): HoldEvent;
-    release(input: HoldInput): HoldEvent;
+    held(factId: string): Promise<boolean>;
+    hold(input: HoldInput): Promise<HoldEvent>;
+    release(input: HoldInput): Promise<HoldEvent>;
+    /** The facts the ledger learned of before an instant, in one space or all, that have not been forgotten: what a retention sweep decides about. */
+    learnedBefore(before: string, space?: string): Promise<Fact[]>;
     /** Retention: forgets every fact the ledger learned of before the cutoff, in one space or all, skipping held and already-forgotten facts. Returns what it forgot and what it skipped. */
-    sweep(input: SweepInput): {
+    sweep(input: SweepInput): Promise<{
         forgotten: ForgetEvent[];
         held: string[];
-    };
-    forget(input: ForgetInput): ForgetEvent;
+    }>;
+    /**
+     * Erases a fact's value from the store itself, keeping its digest, and stops believing it. The store rewrites the
+     * event in place, which is the one thing an append-only ledger must do for a deletion demand. Everything else about
+     * the fact stays: who wrote it, when, from which receipt, and now who erased it and why. With compact false the
+     * store's reclaim step is left to the caller, for a batch of forgets followed by one compact().
+     */
+    forget(input: ForgetInput & {
+        compact?: boolean;
+    }): Promise<ForgetEvent>;
+    /** Reclaims whatever the store may still hold of erased values; forget and sweep do this themselves unless told not to. */
+    compact(): Promise<void>;
     /** The facts believed at a moment. Valid time answers "was it true then"; transaction time answers "did the ledger know it then". */
-    asOf(q?: AsOf): Fact[];
+    asOf(q?: AsOf): Promise<Fact[]>;
+    /** One fact by id, whatever its state, with supersession applied; undefined when the ledger never held it. */
+    get(factId: string): Promise<Fact | undefined>;
     /** Every fact ever asserted, with supersession applied and retracted ones included, for audits that must see everything. */
-    facts(): Fact[];
+    facts(): Promise<Fact[]>;
     /** Every event that touched a fact, oldest first: its assert, the assert that superseded it, its confirmation, its retraction. */
-    history(factId: string): LedgerEvent[];
+    history(factId: string): Promise<LedgerEvent[]>;
     private confirmedAt;
     private factById;
     private retractedAt;
-    private append;
 }

package/dist/ledger.js

@@ -1,4 +1,4 @@
-// The fact ledger: an append-only JSONL log of events about what an agent believes.
+// The fact ledger: an append-only log of events about what an agent believes, in a JSONL file, SQLite, or Postgres.
 // Bitemporal. Valid time is when a fact was true in the world; transaction time is when the ledger learned of it.
 // Nothing is ever edited in place. Correcting a belief is a new event, so "what did the agent believe at T" is always answerable.
 import { randomUUID } from "node:crypto";
@@ -6,19 +6,19 @@ import { createHash, createHmac } from "node:crypto";
 import { openStore } from "./storage.js";
 const RANK = { claimed: 0, attested: 1, verified: 2 };
 export class Ledger {
-    events;
     store;
     now;
     forgetKey;
     /**
-     * `location` is a path: JSONL by default, SQLite when it ends in .sqlite or .db; or pass a store.
-     * forgetKey: a secret kept outside the store; with it, forgotten values leave an HMAC rather than a plain hash.
+     * `location` is a path (JSONL by default, SQLite when it ends in .sqlite or .db) or a postgres:// URL; or pass a
+     * store. The ledger holds no events itself: every question is a query to the store, so a shared store means a
+     * shared ledger. forgetKey: a secret kept outside the store; with it, forgotten values leave an HMAC rather than a
+     * plain hash.
      */
     constructor(location, opts = {}) {
         this.store = typeof location === "string" ? openStore(location) : location;
         this.now = opts.now ?? (() => new Date());
         this.forgetKey = opts.forgetKey ? Buffer.from(opts.forgetKey) : null;
-        this.events = this.store.load();
     }
     /** Where the events live, for reports. */
     get location() {
@@ -26,31 +26,35 @@ export class Ledger {
     }
     /** Every event in order, for export. */
     export() {
-        return [...this.events];
+        return this.store.events();
     }
     close() {
-        this.store.close();
+        return this.store.close();
     }
-    get size() {
-        return this.events.length;
+    count() {
+        return this.store.count();
+    }
+    /** Every space with at least one fact. */
+    spaces() {
+        return this.store.spaces();
     }
     /** The checks assert makes, without appending. For callers that must do something irreversible before the append. */
-    validateAssert(input) {
+    async validateAssert(input) {
         const validFrom = input.validFrom ?? this.now().toISOString();
         if (input.supersedes !== undefined) {
-            const prior = this.factById(input.supersedes);
+            const prior = await this.factById(input.supersedes);
             if (!prior)
                 throw new Error(`cannot supersede unknown fact ${input.supersedes}`);
             if (prior.fact.validTo !== null)
                 throw new Error(`fact ${input.supersedes} is already superseded`);
-            if (this.retractedAt(input.supersedes))
+            if (await this.retractedAt(input.supersedes))
                 throw new Error(`fact ${input.supersedes} is retracted`);
             if (validFrom < prior.fact.validFrom)
                 throw new Error(`replacement cannot start before the fact it supersedes`);
         }
     }
-    assert(input) {
-        this.validateAssert(input);
+    async assert(input) {
+        await this.validateAssert(input);
         const txTime = this.now().toISOString();
         const validFrom = input.validFrom ?? txTime;
         const event = {
@@ -73,13 +77,13 @@ export class Ledger {
             },
             supersedes: input.supersedes ?? null,
         };
-        this.append(event);
+        await this.store.append(event);
         return event;
     }
-    retract(input) {
-        if (!this.factById(input.factId))
+    async retract(input) {
+        if (!(await this.factById(input.factId)))
             throw new Error(`cannot retract unknown fact ${input.factId}`);
-        if (this.retractedAt(input.factId))
+        if (await this.retractedAt(input.factId))
             throw new Error(`fact ${input.factId} is already retracted`);
         const event = {
             eventId: randomUUID(),
@@ -90,95 +94,106 @@ export class Ledger {
             reason: input.reason,
             source: input.source ?? { receiptId: null },
         };
-        this.append(event);
+        await this.store.append(event);
         return event;
     }
-    confirm(input) {
-        const prior = this.factById(input.factId);
+    async confirm(input) {
+        const prior = await this.factById(input.factId);
         if (!prior)
             throw new Error(`cannot confirm unknown fact ${input.factId}`);
-        if (this.retractedAt(input.factId))
+        if (await this.retractedAt(input.factId))
             throw new Error(`fact ${input.factId} is retracted`);
-        if (prior.fact.provenance !== "claimed" || this.confirmedAt(input.factId))
+        if (prior.fact.provenance !== "claimed" || (await this.confirmedAt(input.factId)))
             throw new Error(`fact ${input.factId} is already attested`);
         const event = { eventId: randomUUID(), kind: "confirm", txTime: this.now().toISOString(), factId: input.factId, actor: input.actor, source: input.source ?? { receiptId: null } };
-        this.append(event);
+        await this.store.append(event);
         return event;
     }
-    /**
-     * Erases a fact's value from the ledger file, keeping its digest, and stops believing it. The file is rewritten in
-     * place, which is the one thing an append-only ledger must do for a deletion demand. Everything else about the fact
-     * stays: who wrote it, when, from which receipt, and now who erased it and why.
-     */
     /** Whether a legal hold currently stands on the fact. */
-    held(factId) {
+    async held(factId) {
         let held = false;
-        for (const e of this.events)
+        for (const e of await this.store.eventsFor(factId))
             if ((e.kind === "hold" || e.kind === "release") && e.factId === factId)
                 held = e.kind === "hold";
         return held;
     }
-    hold(input) {
-        const prior = this.factById(input.factId);
+    async hold(input) {
+        const prior = await this.factById(input.factId);
         if (!prior)
             throw new Error(`cannot hold unknown fact ${input.factId}`);
         if (prior.fact.forgotten)
             throw new Error(`fact ${input.factId} is already forgotten`);
-        if (this.held(input.factId))
+        if (await this.held(input.factId))
             throw new Error(`fact ${input.factId} is already on hold`);
         const event = { eventId: randomUUID(), kind: "hold", txTime: this.now().toISOString(), factId: input.factId, actor: input.actor, reason: input.reason, source: input.source ?? { receiptId: null } };
-        this.append(event);
+        await this.store.append(event);
         return event;
     }
-    release(input) {
-        if (!this.held(input.factId))
+    async release(input) {
+        if (!(await this.held(input.factId)))
             throw new Error(`fact ${input.factId} is not on hold`);
         const event = { eventId: randomUUID(), kind: "release", txTime: this.now().toISOString(), factId: input.factId, actor: input.actor, reason: input.reason, source: input.source ?? { receiptId: null } };
-        this.append(event);
+        await this.store.append(event);
         return event;
     }
+    /** The facts the ledger learned of before an instant, in one space or all, that have not been forgotten: what a retention sweep decides about. */
+    async learnedBefore(before, space) {
+        const events = await this.store.eventsAbout({ txBefore: before, ...(space === undefined ? {} : { space }) });
+        return events.filter((e) => e.kind === "assert" && e.txTime < before && (space === undefined || e.fact.space === space) && !e.fact.forgotten).map((e) => ({ ...e.fact }));
+    }
     /** Retention: forgets every fact the ledger learned of before the cutoff, in one space or all, skipping held and already-forgotten facts. Returns what it forgot and what it skipped. */
-    sweep(input) {
+    async sweep(input) {
         const forgotten = [];
         const held = [];
-        const targets = this.events.filter((e) => e.kind === "assert" && e.txTime < input.before && (input.space === undefined || e.fact.space === input.space) && !e.fact.forgotten);
-        for (const e of targets) {
-            if (this.held(e.fact.factId)) {
-                held.push(e.fact.factId);
+        for (const f of await this.learnedBefore(input.before, input.space)) {
+            if (await this.held(f.factId)) {
+                held.push(f.factId);
                 continue;
             }
-            forgotten.push(this.forget({ factId: e.fact.factId, actor: input.actor, reason: input.reason, ...(input.source ? { source: input.source } : {}), ...(input.keepDigest === undefined ? {} : { keepDigest: input.keepDigest }) }));
+            forgotten.push(await this.forget({ factId: f.factId, actor: input.actor, reason: input.reason, ...(input.source ? { source: input.source } : {}), ...(input.keepDigest === undefined ? {} : { keepDigest: input.keepDigest }), compact: false }));
         }
+        if (forgotten.length > 0)
+            await this.store.compact();
         return { forgotten, held };
     }
-    forget(input) {
-        const prior = this.factById(input.factId);
+    /**
+     * Erases a fact's value from the store itself, keeping its digest, and stops believing it. The store rewrites the
+     * event in place, which is the one thing an append-only ledger must do for a deletion demand. Everything else about
+     * the fact stays: who wrote it, when, from which receipt, and now who erased it and why. With compact false the
+     * store's reclaim step is left to the caller, for a batch of forgets followed by one compact().
+     */
+    async forget(input) {
+        const prior = await this.factById(input.factId);
         if (!prior)
             throw new Error(`cannot forget unknown fact ${input.factId}`);
         if (prior.fact.forgotten)
             throw new Error(`fact ${input.factId} is already forgotten`);
-        if (this.held(input.factId))
+        if (await this.held(input.factId))
             throw new Error(`fact ${input.factId} is on legal hold; release it first`);
         const txTime = this.now().toISOString();
         const text = canonical(prior.fact.value);
         const digestKind = input.keepDigest === false ? "none" : this.forgetKey ? "hmac-sha256" : "sha256";
         const valueDigest = digestKind === "none" ? null : digestKind === "hmac-sha256" ? createHmac("sha256", this.forgetKey).update(text).digest("hex") : createHash("sha256").update(text).digest("hex");
-        for (const e of this.events) {
+        for (const e of await this.store.eventsFor(input.factId)) {
             if (e.kind === "assert" && e.fact.factId === input.factId) {
-                e.fact.value = null;
-                e.fact.forgotten = { valueDigest, digestKind, at: txTime };
-                this.store.replaceAssert(e);
+                await this.store.replaceAssert({ ...e, fact: { ...e.fact, value: null, forgotten: { valueDigest, digestKind, at: txTime } } });
             }
         }
         const event = { eventId: randomUUID(), kind: "forget", txTime, factId: input.factId, actor: input.actor, reason: input.reason, source: input.source ?? { receiptId: null }, valueDigest, digestKind };
-        this.append(event);
+        await this.store.append(event);
+        if (input.compact !== false)
+            await this.store.compact();
         return event;
     }
+    /** Reclaims whatever the store may still hold of erased values; forget and sweep do this themselves unless told not to. */
+    compact() {
+        return this.store.compact();
+    }
     /** The facts believed at a moment. Valid time answers "was it true then"; transaction time answers "did the ledger know it then". */
-    asOf(q = {}) {
+    async asOf(q = {}) {
         const validAt = q.validAt ?? this.now().toISOString();
         const txAt = q.txAt ?? this.now().toISOString();
-        const known = this.events.filter((e) => e.txTime <= txAt);
+        const known = await this.store.eventsAbout({ txAtMost: txAt, ...(q.space === undefined ? {} : { space: q.space }), ...(q.subject === undefined ? {} : { subject: q.subject }), ...(q.predicate === undefined ? {} : { predicate: q.predicate }) });
         const retracted = new Set(known.filter((e) => e.kind === "retract" || e.kind === "forget").map((e) => e.factId));
         const confirmed = new Set(known.filter((e) => e.kind === "confirm").map((e) => e.factId));
         const facts = new Map();
@@ -198,41 +213,43 @@ export class Ledger {
             (q.predicate === undefined || f.predicate === q.predicate) &&
             (q.include === undefined || q.include === "all" || RANK[f.provenance] >= RANK[q.include]));
     }
+    /** One fact by id, whatever its state, with supersession applied; undefined when the ledger never held it. */
+    async get(factId) {
+        return (await this.factById(factId))?.fact;
+    }
     /** Every fact ever asserted, with supersession applied and retracted ones included, for audits that must see everything. */
-    facts() {
+    async facts() {
+        const events = await this.store.events();
+        const retracted = new Set(events.filter((e) => e.kind === "retract" || e.kind === "forget").map((e) => e.factId));
         const out = new Map();
-        for (const e of this.events) {
+        for (const e of events) {
             if (e.kind !== "assert")
                 continue;
             out.set(e.fact.factId, { ...e.fact });
-            if (e.supersedes && out.has(e.supersedes) && !this.retractedAt(e.fact.factId))
+            if (e.supersedes && out.has(e.supersedes) && !retracted.has(e.fact.factId))
                 out.get(e.supersedes).validTo = e.fact.validFrom;
         }
         return [...out.values()];
     }
     /** Every event that touched a fact, oldest first: its assert, the assert that superseded it, its confirmation, its retraction. */
     history(factId) {
-        return this.events.filter((e) => (e.kind === "assert" ? e.fact.factId === factId || e.supersedes === factId : e.factId === factId));
+        return this.store.eventsFor(factId);
     }
-    confirmedAt(factId) {
-        return this.events.some((e) => e.kind === "confirm" && e.factId === factId);
+    async confirmedAt(factId) {
+        return (await this.store.eventsFor(factId)).some((e) => e.kind === "confirm" && e.factId === factId);
     }
-    factById(factId) {
+    async factById(factId) {
         let found;
-        for (const e of this.events) {
+        for (const e of await this.store.eventsFor(factId)) {
             if (e.kind === "assert" && e.fact.factId === factId)
                 found = { ...e, fact: { ...e.fact } };
-            else if (e.kind === "assert" && e.supersedes === factId && found && !this.retractedAt(e.fact.factId))
+            else if (e.kind === "assert" && e.supersedes === factId && found && !(await this.retractedAt(e.fact.factId)))
                 found.fact.validTo = e.fact.validFrom;
         }
         return found;
     }
-    retractedAt(factId) {
-        return this.events.some((e) => (e.kind === "retract" || e.kind === "forget") && e.factId === factId);
-    }
-    append(event) {
-        this.store.append(event);
-        this.events.push(event);
+    async retractedAt(factId) {
+        return (await this.store.eventsFor(factId)).some((e) => (e.kind === "retract" || e.kind === "forget") && e.factId === factId);
     }
 }
 /** Canonical JSON: sorted keys, no whitespace, undefined dropped. The same encoding the receipts package uses. */

package/dist/pack.d.ts

@@ -24,7 +24,7 @@ export interface CustodyPack {
     /** hold and release events, in order */
     holds: LedgerEvent[];
 }
-export declare function buildPack(ledger: Ledger, receiptsDir: string, factId: string): CustodyPack;
+export declare function buildPack(ledger: Ledger, receiptsDir: string, factId: string): Promise<CustodyPack>;
 export declare function signPack(pack: CustodyPack, key: KeyPair): Envelope;
 export interface PackCheck {
     name: string;

package/dist/pack.js

@@ -41,10 +41,10 @@ function receiptResult(bundle) {
         return null; // a damaged bundle; the receipt check reports it
     }
 }
-export function buildPack(ledger, receiptsDir, factId) {
+export async function buildPack(ledger, receiptsDir, factId) {
     const bundles = loadBundles(receiptsDir);
-    const history = ledger.history(factId);
-    const blast = blastRadius(ledger, loadReceipts(receiptsDir), factId);
+    const history = await ledger.history(factId);
+    const blast = await blastRadius(ledger, loadReceipts(receiptsDir), factId);
     const wanted = new Set();
     for (const e of history) {
         const src = e.kind === "assert" ? e.fact.source.receiptId : e.source.receiptId;

package/dist/server.js

@@ -164,9 +164,9 @@ export function createMemoryServer(ledger, opts = {}) {
         }
         return { removedFrom, stillHeld, verification };
     }
-    async function forgetOne(factId, reason, keepDigest) {
-        const fact = ledger.facts().find((f) => f.factId === factId);
-        const ev = ledger.forget({ factId, actor: currentActor, reason, source: { receiptId: currentReceipt }, ...(keepDigest === undefined ? {} : { keepDigest }) });
+    async function forgetOne(factId, reason, keepDigest, compact = true) {
+        const fact = await ledger.get(factId);
+        const ev = await ledger.forget({ factId, actor: currentActor, reason, source: { receiptId: currentReceipt }, ...(keepDigest === undefined ? {} : { keepDigest }), compact });
         const { removedFrom, stillHeld, verification } = await removeFromStores(fact);
         return { factId: ev.factId, valueDigest: ev.valueDigest, digestKind: ev.digestKind, txTime: ev.txTime, actor: ev.actor, reason: ev.reason, source: ev.source, erasedFromLedger: true, removedFrom, stillHeld, verification };
     }
@@ -201,23 +201,23 @@ export function createMemoryServer(ledger, opts = {}) {
                     const input = { subject: a.subject, predicate: a.predicate, value: a.value ?? null, space: a.space, actor: actorFor(a.actor), source: { receiptId }, provenance: writeProvenance, ...(a.validFrom ? { validFrom: a.validFrom } : {}), ...(a.confidence !== undefined ? { confidence: a.confidence } : {}), ...(a.supersedes ? { supersedes: a.supersedes } : {}) };
                     // The stores are written first, so their ids can be recorded on the fact; the ledger's checks run beforehand
                     // so a write the ledger would refuse never reaches a store.
-                    ledger.validateAssert(input);
+                    await ledger.validateAssert(input);
                     const external = {};
                     const preview = { ...input, factId: "pending", validFrom: input.validFrom ?? new Date().toISOString(), validTo: null, confidence: input.confidence ?? null };
                     for (const store of opts.stores ?? [])
                         external[store.name] = await store.put(preview);
-                    const ev = ledger.assert({ ...input, external });
+                    const ev = await ledger.assert({ ...input, external });
                     return json({ fact: ev.fact, eventId: ev.eventId, txTime: ev.txTime, supersedes: ev.supersedes });
                 }
                 case "memory.read": {
                     const { includeClaimed, requireVerified, ...q } = Read.parse(args);
-                    const facts = ledger.asOf({ ...q, include: requireVerified ? "verified" : includeClaimed ? "all" : "attested" });
+                    const facts = await ledger.asOf({ ...q, include: requireVerified ? "verified" : includeClaimed ? "all" : "attested" });
                     return { ...json({ facts }), _meta: { [FACTS_META_KEY]: facts.map((f) => f.factId) } };
                 }
                 case "memory.retract": {
                     const a = Retract.parse(args);
-                    const fact = ledger.history(a.factId).find((e) => e.kind === "assert" && e.fact.factId === a.factId)?.fact;
-                    const ev = ledger.retract({ factId: a.factId, actor: actorFor(a.actor), reason: a.reason, source: { receiptId } });
+                    const fact = await ledger.get(a.factId);
+                    const ev = await ledger.retract({ factId: a.factId, actor: actorFor(a.actor), reason: a.reason, source: { receiptId } });
                     // The ledger is retracted first: custody must not depend on a store being up. A store that fails to remove
                     // is reported, so the caller knows recall may still serve the value.
                     const { removedFrom, stillHeld, verification } = await removeFromStores(fact);
@@ -230,7 +230,7 @@ export function createMemoryServer(ledger, opts = {}) {
                     if (provenance !== "attested")
                         return fail("confirmation must come through the receipts gateway; a self-reported caller cannot lift a fact out of quarantine");
                     const a = Confirm.parse(args);
-                    const ev = ledger.confirm({ factId: a.factId, actor: actorFor(undefined), source: { receiptId } });
+                    const ev = await ledger.confirm({ factId: a.factId, actor: actorFor(undefined), source: { receiptId } });
                     return json({ eventId: ev.eventId, factId: ev.factId, txTime: ev.txTime, actor: ev.actor, source: ev.source });
                 }
                 case "memory.forget": {
@@ -242,34 +242,36 @@ export function createMemoryServer(ledger, opts = {}) {
                 }
                 case "memory.hold": {
                     const a = Hold.parse(args);
-                    return json(ledger.hold({ factId: a.factId, actor: actorFor(undefined), reason: a.reason, source: { receiptId } }));
+                    return json(await ledger.hold({ factId: a.factId, actor: actorFor(undefined), reason: a.reason, source: { receiptId } }));
                 }
                 case "memory.release": {
                     const a = Hold.parse(args);
-                    return json(ledger.release({ factId: a.factId, actor: actorFor(undefined), reason: a.reason, source: { receiptId } }));
+                    return json(await ledger.release({ factId: a.factId, actor: actorFor(undefined), reason: a.reason, source: { receiptId } }));
                 }
                 case "memory.sweep": {
                     const a = Sweep.parse(args);
                     if (!a.before && !opts.retention)
                         return fail("sweep needs `before`, or a server started with retention windows");
+                    // One query per space, each answered by the store's index: the facts learned before that space's cutoff.
                     const now = new Date();
-                    const cutoffFor = (space) => a.before ?? retentionCutoff(opts.retention ?? {}, space, now);
-                    const targets = ledger.facts().filter((f) => !f.forgotten && (a.space === undefined || f.space === a.space));
-                    const learnedBefore = new Set(ledger.facts().filter((f) => {
-                        const cutoff = cutoffFor(f.space);
-                        return cutoff !== null && ledger.history(f.factId).find((e) => e.kind === "assert" && e.fact.factId === f.factId).txTime < cutoff;
-                    }).map((f) => f.factId));
+                    const spaces = a.space !== undefined ? [a.space] : a.before ? [undefined] : await ledger.spaces();
+                    const targets = [];
+                    for (const space of spaces) {
+                        const cutoff = a.before ?? (space === undefined ? null : retentionCutoff(opts.retention ?? {}, space, now));
+                        if (cutoff !== null)
+                            targets.push(...(await ledger.learnedBefore(cutoff, space)));
+                    }
                     const forgotten = [];
                     const held = [];
                     for (const f of targets) {
-                        if (!learnedBefore.has(f.factId))
-                            continue;
-                        if (ledger.held(f.factId)) {
+                        if (await ledger.held(f.factId)) {
                             held.push(f.factId);
                             continue;
                         }
-                        forgotten.push(await forgetOne(f.factId, a.reason, a.keepDigest));
+                        forgotten.push(await forgetOne(f.factId, a.reason, a.keepDigest, false));
                     }
+                    if (forgotten.length > 0)
+                        await ledger.compact();
                     const stillHeld = forgotten.flatMap((o) => o.stillHeld);
                     const out = { before: a.before ?? null, retention: a.before ? null : (opts.retention ?? null), space: a.space ?? null, forgotten: forgotten.map((o) => ({ factId: o.factId, valueDigest: o.valueDigest, digestKind: o.digestKind, removedFrom: o.removedFrom, verification: o.verification })), held, stillHeld };
                     if (stillHeld.length > 0)
@@ -278,16 +280,16 @@ export function createMemoryServer(ledger, opts = {}) {
                 }
                 case "memory.get": {
                     const a = Get.parse(args);
-                    const f = ledger.facts().find((x) => x.factId === a.factId);
+                    const f = await ledger.get(a.factId);
                     if (!f)
                         return fail(`unknown fact ${a.factId}`);
-                    const retracted = ledger.history(a.factId).some((e) => e.kind === "retract");
+                    const retracted = (await ledger.history(a.factId)).some((e) => e.kind === "retract");
                     // Cedar has no null: absent fields stay absent, so a policy tests them with `has`.
                     const clean = Object.fromEntries(Object.entries({ ...f, source: f.source.receiptId ?? undefined, retracted }).filter(([, v]) => v !== null && v !== undefined));
                     return json(clean);
                 }
                 case "memory.history":
-                    return json({ events: ledger.history(History.parse(args).factId) });
+                    return json({ events: await ledger.history(History.parse(args).factId) });
                 default:
                     return fail(`unknown tool ${name}`);
             }