@hasna/mementos 0.14.47 → 0.14.48

package/dist/server/index.js

@@ -70,6 +70,8 @@ import { Database } from "bun:sqlite";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
 import pg from "pg";
 function normalizeParams(params) {
   const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
@@ -132,13 +134,15 @@ class SqliteAdapter {
 function translateSql(sql) {
   let parameterIndex = 0;
   let translated = sql.replace(/\?/g, () => `$${++parameterIndex}`);
-  translated = translated.replace(/datetime\s*\(\s*'now'\s*\)/gi, "NOW()");
+  const ISO_FMT = `'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'`;
+  translated = translated.replace(/datetime\s*\(\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
   translated = translated.replace(/datetime\s*\(\s*'now'\s*,\s*'(-?\d+)\s+(minutes?|hours?|days?|seconds?)'\s*\)/gi, (_match, amount, unit) => {
     const parsed = parseInt(String(amount), 10);
     const absolute = Math.abs(parsed);
     const normalizedUnit = String(unit).toLowerCase().replace(/s$/, "");
     const pluralUnit = absolute === 1 ? normalizedUnit : `${normalizedUnit}s`;
-    return parsed < 0 ? `NOW() - INTERVAL '${absolute} ${pluralUnit}'` : `NOW() + INTERVAL '${absolute} ${pluralUnit}'`;
+    const op = parsed < 0 ? "-" : "+";
+    return `to_char((now() ${op} INTERVAL '${absolute} ${pluralUnit}') AT TIME ZONE 'UTC', ${ISO_FMT})`;
   });
   translated = translated.replace(/lower\s*\(\s*hex\s*\(\s*randomblob\s*\(\s*\d+\s*\)\s*\)\s*\)/gi, "gen_random_uuid()::text");
   translated = translated.replace(/\bIFNULL\s*\(/gi, "COALESCE(");
@@ -195,56 +199,24 @@ function makePool(connectionString) {
 class PgAdapter {
   pool;
   constructor(input) {
-    this.pool = typeof input === "string" ? makePool(input) : input;
-  }
-  runSync(fn) {
-    let result;
-    let error;
-    let done = false;
-    fn().then((value) => {
-      result = value;
-      done = true;
-    }).catch((caught) => {
-      error = caught;
-      done = true;
-    });
-    const deadline = Date.now() + 30000;
-    while (!done && Date.now() < deadline) {
-      Bun.sleepSync(1);
-    }
-    if (error) {
-      throw error;
-    }
-    if (!done) {
-      throw new Error("PostgreSQL query timed out after 30s");
-    }
-    return result;
+    this.pool = typeof input === "string" ? new PgSyncPool(input) : input;
   }
   run(sql, ...params) {
-    return this.runSync(async () => {
-      const result = await this.pool.query(translateSql(sql), normalizeParams(params));
-      return {
-        changes: result.rowCount ?? 0,
-        lastInsertRowid: result.rows?.[0]?.id ?? 0
-      };
-    });
+    const result = this.pool.query(translateSql(sql), normalizeParams(params));
+    return {
+      changes: result.rowCount ?? 0,
+      lastInsertRowid: result.rows?.[0]?.id ?? 0
+    };
   }
   get(sql, ...params) {
-    return this.runSync(async () => {
-      const result = await this.pool.query(translateSql(sql), normalizeParams(params));
-      return result.rows[0] ?? null;
-    });
+    const result = this.pool.query(translateSql(sql), normalizeParams(params));
+    return result.rows[0] ?? null;
   }
   all(sql, ...params) {
-    return this.runSync(async () => {
-      const result = await this.pool.query(translateSql(sql), normalizeParams(params));
-      return result.rows;
-    });
+    return this.pool.query(translateSql(sql), normalizeParams(params)).rows;
   }
   exec(sql) {
-    this.runSync(async () => {
-      await this.pool.query(sql);
-    });
+    this.pool.query(sql, []);
   }
   prepare(sql) {
     return {
@@ -258,28 +230,20 @@ class PgAdapter {
     return this.prepare(sql);
   }
   close() {
-    this.runSync(async () => {
-      await this.pool.end();
-    });
+    this.pool.end();
   }
   transaction(fn) {
-    return this.runSync(async () => {
-      const client = await this.pool.connect();
-      const originalQuery = this.pool.query.bind(this.pool);
+    this.pool.query("BEGIN", []);
+    try {
+      const value = fn();
+      this.pool.query("COMMIT", []);
+      return value;
+    } catch (error) {
       try {
-        await client.query("BEGIN");
-        this.pool.query = client.query.bind(client);
-        const value = fn();
-        await client.query("COMMIT");
-        return value;
-      } catch (error) {
-        await client.query("ROLLBACK");
-        throw error;
-      } finally {
-        this.pool.query = originalQuery;
-        client.release();
-      }
-    });
+        this.pool.query("ROLLBACK", []);
+      } catch {}
+      throw error;
+    }
   }
   get raw() {
     return this.pool;
@@ -385,8 +349,76 @@ function getStorageConnectionString(dbName = "mementos") {
   const sslParam = ssl ? "?sslmode=require" : "";
   return `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbName}${sslParam}`;
 }
-var MEMENTOS_STORAGE_ENV, MEMENTOS_STORAGE_FALLBACK_ENV, DEFAULT_STORAGE_CONFIG, STORAGE_CONFIG_DIR, STORAGE_CONFIG_PATH, DATABASE_ENV_NAMES, MODE_ENV_NAMES, warnedDeprecatedModes;
+var PgSyncPool, MEMENTOS_STORAGE_ENV, MEMENTOS_STORAGE_FALLBACK_ENV, DEFAULT_STORAGE_CONFIG, STORAGE_CONFIG_DIR, STORAGE_CONFIG_PATH, DATABASE_ENV_NAMES, MODE_ENV_NAMES, warnedDeprecatedModes;
 var init_storage = __esm(() => {
+  PgSyncPool = class PgSyncPool {
+    worker;
+    status;
+    data;
+    closed = false;
+    lastError = null;
+    static DATA_BYTES = 128 * 1024 * 1024;
+    static QUERY_TIMEOUT_MS = 60000;
+    static resolveWorkerPath() {
+      const ext = import.meta.url.endsWith(".ts") ? ".ts" : ".js";
+      const here = fileURLToPath(new URL(".", import.meta.url));
+      const candidates = [
+        join2(here, `pg-sync-worker${ext}`),
+        join2(here, "..", `pg-sync-worker${ext}`),
+        join2(here, "..", "..", `pg-sync-worker${ext}`)
+      ];
+      for (const candidate of candidates) {
+        if (existsSync2(candidate))
+          return candidate;
+      }
+      return candidates[0];
+    }
+    constructor(connectionString) {
+      const control = new SharedArrayBuffer(8);
+      const dataSab = new SharedArrayBuffer(PgSyncPool.DATA_BYTES);
+      this.status = new Int32Array(control);
+      this.data = new Uint8Array(dataSab);
+      this.worker = new Worker(PgSyncPool.resolveWorkerPath(), {
+        workerData: {
+          dsn: stripSslParams(connectionString),
+          ssl: sslConfigFor(connectionString),
+          control,
+          data: dataSab
+        }
+      });
+      this.worker.unref();
+      this.worker.on("error", (err) => {
+        this.lastError = err;
+      });
+    }
+    query(sql, params) {
+      if (this.closed)
+        throw new Error("PgSyncPool is closed");
+      if (this.lastError)
+        throw this.lastError;
+      Atomics.store(this.status, 0, 0);
+      this.worker.postMessage({ sql, params });
+      const waitResult = Atomics.wait(this.status, 0, 0, PgSyncPool.QUERY_TIMEOUT_MS);
+      const code = Atomics.load(this.status, 0);
+      if (code === 0 || waitResult === "timed-out") {
+        if (this.lastError)
+          throw this.lastError;
+        throw new Error("PostgreSQL query timed out after 60s");
+      }
+      const len = Atomics.load(this.status, 1);
+      const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
+      if (code === 2) {
+        throw new Error(payload.message ?? "PostgreSQL error");
+      }
+      return payload;
+    }
+    end() {
+      if (this.closed)
+        return;
+      this.closed = true;
+      this.worker.terminate();
+    }
+  };
   MEMENTOS_STORAGE_ENV = {
     databaseUrl: "HASNA_MEMENTOS_DATABASE_URL",
     mode: "HASNA_MEMENTOS_STORAGE_MODE"
@@ -4799,6 +4831,51 @@ var init_contradiction = __esm(() => {
   init_registry();
 });
 
+// src/server/router.ts
+function computeSpecificity(path) {
+  return path.split("/").filter(Boolean).reduce((score, segment) => score + (segment.startsWith(":") ? 1 : 10), 0);
+}
+function addRoute(method, path, handler) {
+  const paramNames = [];
+  const patternStr = path.replace(/:(\w+)/g, (_match, name) => {
+    paramNames.push(name);
+    return "([^/]+)";
+  });
+  routes.push({
+    method,
+    path,
+    pattern: new RegExp(`^${patternStr}$`),
+    paramNames,
+    specificity: computeSpecificity(path),
+    order: nextRouteOrder++,
+    handler
+  });
+}
+function matchRoute(method, pathname) {
+  let bestMatch = null;
+  for (const route of routes) {
+    if (route.method !== method)
+      continue;
+    const match = pathname.match(route.pattern);
+    if (match) {
+      const params = {};
+      route.paramNames.forEach((name, i) => {
+        params[name] = match[i + 1];
+      });
+      if (!bestMatch || route.specificity > bestMatch.route.specificity || route.specificity === bestMatch.route.specificity && route.order < bestMatch.route.order) {
+        bestMatch = { route, params };
+      }
+    }
+  }
+  if (!bestMatch)
+    return null;
+  return { handler: bestMatch.route.handler, params: bestMatch.params };
+}
+var routes, nextRouteOrder = 0;
+var init_router = __esm(() => {
+  routes = [];
+});
+
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
@@ -52391,8 +52468,88 @@ var init_dist8 = __esm(() => {
   };
 });
 
+// src/server/openapi.ts
+var exports_openapi = {};
+__export(exports_openapi, {
+  buildOpenApiDocument: () => buildOpenApiDocument
+});
+function toV1Path(path) {
+  return path.replace(/^\/api/, "/v1").replace(/:(\w+)/g, "{$1}");
+}
+function buildOpenApiDocument(version2) {
+  const paths = {};
+  for (const p of ["/health", "/ready", "/version"]) {
+    paths[p] = {
+      get: {
+        summary: `Service ${p.slice(1)} probe`,
+        security: [],
+        responses: {
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    status: { type: "string" },
+                    version: { type: "string" },
+                    mode: { type: "string", enum: ["local", "cloud"] }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+  for (const route of routes) {
+    const p = toV1Path(route.path);
+    const method = route.method.toLowerCase();
+    const params = route.paramNames.map((name24) => ({
+      name: name24,
+      in: "path",
+      required: true,
+      schema: { type: "string" }
+    }));
+    paths[p] = paths[p] ?? {};
+    paths[p][method] = {
+      summary: `${route.method} ${p}`,
+      operationId: `${method}_${p.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_|_$/g, "")}`,
+      ...params.length ? { parameters: params } : {},
+      responses: {
+        "200": { description: "OK" },
+        "401": { description: "Unauthorized" },
+        "403": { description: "Forbidden" },
+        "404": { description: "Not found" }
+      }
+    };
+  }
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "@hasna/mementos serve API",
+      version: version2,
+      description: "Universal memory system for AI agents \u2014 REST API (self_hosted)."
+    },
+    servers: [{ url: "/v1" }, { url: "/api" }],
+    components: {
+      securitySchemes: {
+        bearerAuth: { type: "http", scheme: "bearer" },
+        apiKeyAuth: { type: "apiKey", in: "header", name: "x-api-key" }
+      }
+    },
+    security: [{ bearerAuth: [] }, { apiKeyAuth: [] }],
+    paths
+  };
+}
+var init_openapi = __esm(() => {
+  init_router();
+});
+
 // src/server/index.ts
 import { existsSync as existsSync5 } from "fs";
+import { createRequire } from "module";
 import { join as join5, resolve as resolve4, sep } from "path";
 
 // src/lib/config.ts
@@ -53979,53 +54136,14 @@ async function _tick() {
   }
 }
 
-// src/server/router.ts
-var routes = [];
-var nextRouteOrder = 0;
-function computeSpecificity(path) {
-  return path.split("/").filter(Boolean).reduce((score, segment) => score + (segment.startsWith(":") ? 1 : 10), 0);
-}
-function addRoute(method, path, handler) {
-  const paramNames = [];
-  const patternStr = path.replace(/:(\w+)/g, (_match, name) => {
-    paramNames.push(name);
-    return "([^/]+)";
-  });
-  routes.push({
-    method,
-    path,
-    pattern: new RegExp(`^${patternStr}$`),
-    paramNames,
-    specificity: computeSpecificity(path),
-    order: nextRouteOrder++,
-    handler
-  });
-}
-function matchRoute(method, pathname) {
-  let bestMatch = null;
-  for (const route of routes) {
-    if (route.method !== method)
-      continue;
-    const match = pathname.match(route.pattern);
-    if (match) {
-      const params = {};
-      route.paramNames.forEach((name, i) => {
-        params[name] = match[i + 1];
-      });
-      if (!bestMatch || route.specificity > bestMatch.route.specificity || route.specificity === bestMatch.route.specificity && route.order < bestMatch.route.order) {
-        bestMatch = { route, params };
-      }
-    }
-  }
-  if (!bestMatch)
-    return null;
-  return { handler: bestMatch.route.handler, params: bestMatch.params };
-}
+// src/server/index.ts
+init_storage();
+init_router();
 
 // src/server/helpers.ts
 import { existsSync as existsSync4 } from "fs";
 import { dirname as dirname3, extname, join as join4 } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var CORS_HEADERS = {
   "Access-Control-Allow-Origin": process.env["MEMENTOS_CORS_ORIGIN"] ?? "http://localhost:19428",
   "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
@@ -54108,7 +54226,7 @@ function getSearchParams(url) {
 function resolveDashboardDir() {
   const candidates = [];
   try {
-    const scriptDir = dirname3(fileURLToPath(import.meta.url));
+    const scriptDir = dirname3(fileURLToPath2(import.meta.url));
     candidates.push(join4(scriptDir, "..", "dashboard", "dist"));
     candidates.push(join4(scriptDir, "..", "..", "dashboard", "dist"));
   } catch {}
@@ -54133,6 +54251,80 @@ function serveStaticFile(filePath) {
   });
 }
 
+// src/server/auth.ts
+init_storage();
+import {
+  verifyApiKey,
+  ApiKeyStore
+} from "@hasna/contracts/auth";
+var APP = "mementos";
+var _verifier;
+var _store = null;
+var _schemaReady = null;
+function signingSecret() {
+  return process.env["API_KEY_SIGNING_SECRET"]?.trim() || process.env["HASNA_MEMENTOS_API_SIGNING_KEY"]?.trim() || process.env["HASNA_API_SIGNING_KEY"]?.trim() || undefined;
+}
+function makeAuthClient() {
+  let dsn;
+  try {
+    dsn = getStorageConnectionString(APP);
+  } catch {
+    return null;
+  }
+  let pool;
+  try {
+    pool = makePool(dsn);
+  } catch {
+    return null;
+  }
+  return {
+    many: async (sql, params = []) => (await pool.query(sql, params)).rows,
+    get: async (sql, params = []) => (await pool.query(sql, params)).rows[0] ?? null,
+    execute: async (sql, params = []) => {
+      await pool.query(sql, params);
+    }
+  };
+}
+function getApiKeyVerifier() {
+  if (_verifier !== undefined)
+    return _verifier;
+  const secret = signingSecret();
+  if (!secret) {
+    _verifier = null;
+    return null;
+  }
+  const client = makeAuthClient();
+  if (client) {
+    _store = new ApiKeyStore(client);
+    _schemaReady = _store.ensureSchema().catch((e) => {
+      console.warn(`[mementos-serve] api_keys ensureSchema failed: ${e instanceof Error ? e.message : e}`);
+    });
+  }
+  _verifier = verifyApiKey({
+    app: APP,
+    signingSecret: secret,
+    isRevoked: _store ? _store.isRevoked : undefined,
+    audit: (e) => {
+      if (e.outcome === "deny") {
+        console.warn(`[mementos-serve] auth deny kid=${e.kid ?? "-"} reason=${e.reason} ${e.method ?? ""} ${e.path ?? ""}`);
+      }
+    }
+  });
+  return _verifier;
+}
+async function checkApiKey(req, method, path, requiredScopes) {
+  const verifier = getApiKeyVerifier();
+  if (!verifier) {
+    return authenticateRequest(req);
+  }
+  if (_schemaReady)
+    await _schemaReady;
+  const decision = await verifier.authenticate(req.headers, { method, path, requiredScopes });
+  if (decision.ok)
+    return null;
+  return json({ error: decision.message, reason: decision.reason }, decision.status);
+}
+
 // src/server/routes/memories-crud.ts
 init_memories();
 
@@ -54180,6 +54372,7 @@ var FORMAT_UNITS = [
 ];
 
 // src/server/routes/memories-crud.ts
+init_router();
 init_types();
 addRoute("GET", "/api/memories", (_req, url) => {
   const q = getSearchParams(url);
@@ -54290,6 +54483,7 @@ addRoute("DELETE", "/api/memories/:id", (_req, _url, params) => {
 
 // src/server/routes/memories-stats.ts
 init_database();
+init_router();
 addRoute("GET", "/api/memories/stats", (_req) => {
   const db = getDatabase();
   const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
@@ -54449,6 +54643,7 @@ addRoute("GET", "/api/report", (_req, url) => {
 
 // src/server/routes/memories-search.ts
 init_search();
+init_router();
 addRoute("POST", "/api/memories/search", async (req) => {
   const body = await readJson(req);
   if (!body || typeof body["query"] !== "string") {
@@ -54525,6 +54720,7 @@ addRoute("POST", "/api/memories/search/bm25", async (req) => {
 
 // src/server/routes/memories-bulk.ts
 init_memories();
+init_router();
 addRoute("POST", "/api/memories/bulk-forget", async (req) => {
   const body = await readJson(req);
   if (!body || !Array.isArray(body["ids"])) {
@@ -54567,6 +54763,7 @@ addRoute("POST", "/api/memories/bulk-update", async (req) => {
 
 // src/server/routes/memories-io.ts
 init_memories();
+init_router();
 addRoute("POST", "/api/memories/export", async (req) => {
   const body = await readJson(req) || {};
   const filter = {};
@@ -54629,6 +54826,7 @@ function visibleToMachineFilter(machineId, db) {
 }
 
 // src/server/routes/memories-misc.ts
+init_router();
 addRoute("GET", "/api/health", () => {
   return json({ ok: true, version: "1", db: getDbPath() });
 });
@@ -55007,6 +55205,7 @@ function cleanExpiredLocks(db) {
 }
 
 // src/server/routes/agents.ts
+init_router();
 addRoute("GET", "/api/agents", (_req, url) => {
   const q = getSearchParams(url);
   const agents = q["project_id"] ? listAgentsByProject(q["project_id"]) : listAgents();
@@ -55148,6 +55347,7 @@ function listProjects(db) {
 }
 
 // src/server/routes/projects.ts
+init_router();
 addRoute("GET", "/api/projects", (_req, url) => {
   const q = getSearchParams(url);
   const projects = listProjects();
@@ -55186,6 +55386,7 @@ init_relations();
 init_entity_memories();
 init_database();
 init_types();
+init_router();
 addRoute("GET", "/api/entities", (_req, url) => {
   const q = getSearchParams(url);
   const filter = {};
@@ -55407,6 +55608,7 @@ addRoute("GET", "/api/graph/:entityId", (_req, url, params) => {
 
 // src/server/routes/tasks.ts
 init_database();
+init_router();
 addRoute("POST", "/api/tasks", async (req, _url) => {
   const body = await readJson(req);
   if (!body)
@@ -55483,6 +55685,7 @@ addRoute("DELETE", "/api/tasks/:id/comments/:commentId", async (_req, _url, para
 // src/server/routes/system-auto-memory.ts
 init_auto_memory();
 init_registry();
+init_router();
 function registerSystemAutoMemoryRoutes() {
   addRoute("POST", "/api/auto-memory/process", async (req) => {
     const body = await readJson(req);
@@ -55544,6 +55747,7 @@ function registerSystemAutoMemoryRoutes() {
 
 // src/server/routes/system-hooks.ts
 init_hooks();
+init_router();
 function registerSystemHookRoutes() {
   addRoute("GET", "/api/hooks", (_req, url) => {
     const type = url.searchParams.get("type") ?? undefined;
@@ -56517,6 +56721,7 @@ function getSynthesisStatus(runId, projectId, db) {
 // src/server/routes/system-synthesis.ts
 init_synthesis();
 init_profile_synthesizer();
+init_router();
 function registerSystemSynthesisRoutes() {
   addRoute("POST", "/api/synthesis/run", async (req) => {
     const body = await readJson(req) ?? {};
@@ -56638,6 +56843,7 @@ function autoResolveAgentProject(metadata, db) {
 }
 
 // src/server/routes/system-sessions.ts
+init_router();
 function registerSystemSessionRoutes() {
   addRoute("POST", "/api/sessions/ingest", async (req) => {
     const body = await readJson(req) ?? {};
@@ -56684,6 +56890,7 @@ function registerSystemSessionRoutes() {
 }
 
 // src/server/routes/system-tools.ts
+init_router();
 function registerSystemToolRoutes() {
   addRoute("POST", "/api/tool-events", async (req) => {
     const body = await readJson(req);
@@ -56728,6 +56935,7 @@ function registerSystemToolRoutes() {
 
 // src/server/routes/system-chain.ts
 init_database();
+init_router();
 function registerSystemChainRoutes() {
   addRoute("GET", "/api/chains/:sequence_group", (_req, _url, params) => {
     const db = getDatabase();
@@ -57680,6 +57888,7 @@ async function reflectOnTrajectory(options) {
 }
 
 // src/server/routes/system-consolidation.ts
+init_router();
 function numberOption(value) {
   if (value === undefined || value === null || value === "")
     return;
@@ -57743,6 +57952,10 @@ registerSystemChainRoutes();
 registerSystemConsolidationRoutes();
 
 // src/server/index.ts
+function pkgVersion() {
+  const req = createRequire(import.meta.url);
+  return req("../../package.json").version;
+}
 async function findFreePort(start) {
   const net = await import("net");
   return new Promise((resolve5) => {
@@ -57844,30 +58057,50 @@ function startServer(port) {
         }
         return new Response(null, { status: 204, headers: getCorsHeaders(req) });
       }
-      if (pathname === "/api/health" || pathname === "/health") {
+      const mode = getStorageMode();
+      if (pathname === "/version" || pathname === "/api/version" || pathname === "/v1/version") {
+        return json({ status: "ok", version: pkgVersion(), mode });
+      }
+      if (pathname === "/ready" || pathname === "/api/ready" || pathname === "/v1/ready") {
+        try {
+          getDatabase().query("SELECT 1 AS ok").get();
+          return json({ status: "ready", version: pkgVersion(), mode });
+        } catch (e) {
+          return json({ status: "not_ready", version: pkgVersion(), mode, error: e instanceof Error ? e.message : String(e) }, 503);
+        }
+      }
+      if (pathname === "/health" || pathname === "/api/health" || pathname === "/v1/health") {
         const profile = getActiveProfile();
-        const { createRequire } = await import("module");
-        const req2 = createRequire(import.meta.url);
-        const pkg = req2("../../package.json");
-        const db = getDatabase();
-        const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
-        const expired = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
-        const pinned = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1").get().c;
-        const agents = db.query("SELECT COUNT(*) as c FROM agents").get().c;
-        const projects = db.query("SELECT COUNT(*) as c FROM projects").get().c;
-        const status = expired > 50 ? "warn" : "ok";
-        return json({ status, version: pkg.version, profile: profile ?? "default", db_path: getDbPath(), hostname: hostname3, memories: { total, expired, pinned }, agents, projects });
-      }
-      if (pathname.startsWith("/api/") && pathname !== "/api/health") {
-        const authError = authenticateRequest(req);
+        try {
+          const db = getDatabase();
+          const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
+          const expired = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
+          const pinned = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1").get().c;
+          const agents = db.query("SELECT COUNT(*) as c FROM agents").get().c;
+          const projects = db.query("SELECT COUNT(*) as c FROM projects").get().c;
+          const status = expired > 50 ? "warn" : "ok";
+          return json({ status, version: pkgVersion(), mode, profile: profile ?? "default", db_path: getDbPath(), hostname: hostname3, memories: { total, expired, pinned }, agents, projects });
+        } catch (e) {
+          return json({ status: "error", version: pkgVersion(), mode, error: e instanceof Error ? e.message : String(e) }, 503);
+        }
+      }
+      const isV1 = pathname === "/v1" || pathname.startsWith("/v1/");
+      const routePath = isV1 ? `/api${pathname.slice(3)}` : pathname;
+      const isApi = routePath.startsWith("/api/");
+      if (pathname === "/openapi.json" || pathname === "/v1/openapi.json" || pathname === "/api/openapi.json") {
+        const { buildOpenApiDocument: buildOpenApiDocument2 } = await Promise.resolve().then(() => (init_openapi(), exports_openapi));
+        return json(buildOpenApiDocument2(pkgVersion()));
+      }
+      if (isApi) {
+        const authError = await checkApiKey(req, req.method, routePath);
         if (authError)
           return authError;
       }
-      if (pathname === "/api/profile" && req.method === "GET") {
+      if (routePath === "/api/profile" && req.method === "GET") {
         const profile = getActiveProfile();
         return json({ active: profile ?? null, profiles: listProfiles(), db_path: getDbPath() });
       }
-      if (pathname === "/api/memories/stream" && req.method === "GET") {
+      if (routePath === "/api/memories/stream" && req.method === "GET") {
         const stream = new ReadableStream({
           start(controller) {
             const encoder2 = new TextEncoder;
@@ -57903,9 +58136,9 @@ function startServer(port) {
           }
         });
       }
-      const matched = matchRoute(req.method, pathname);
+      const matched = matchRoute(req.method, routePath);
       if (!matched) {
-        if (pathname.startsWith("/api/")) {
+        if (isApi || isV1) {
           return errorResponse("Not found", 404);
         }
         const dashDir = resolveDashboardDir();
@@ -57941,8 +58174,8 @@ async function main() {
     return;
   }
   if (hasFlag("--version", "-V")) {
-    const { createRequire } = await import("module");
-    const req = createRequire(import.meta.url);
+    const { createRequire: createRequire2 } = await import("module");
+    const req = createRequire2(import.meta.url);
     const pkg = req("../../package.json");
     process.stdout.write(`${pkg.version}
 `);