hippo-memory 1.11.4 → 1.12.0

package/dist/api.d.ts

@@ -13,12 +13,33 @@ import { type MemoryKind, type MemoryEntry } from './memory.js';
 import { type AuditEvent, type AuditOp } from './audit.js';
 import { type ApiKeyListItem } from './auth.js';
 import { type AmbientState } from './ambient.js';
+/**
+ * Actor identity + authorization role for a Context. v1.12.0 A5 v2 sub-1.
+ *
+ * Before v1.12.0, Context.actor was a bare string. v1.12.0 promotes it to an
+ * object carrying both the audit-log subject (formerly the string itself) and
+ * a role for /v1/sleep admin gating. Audit helpers continue accepting `string`
+ * — callers pass `ctx.actor.subject`. Role checks happen at the request
+ * boundary (e.g. /v1/sleep), not inside api functions.
+ */
+export interface Actor {
+    /** 'cli' | 'localhost:cli' | 'api_key:<key_id>' | 'mcp' | 'connector:slack' | 'connector:github' */
+    subject: string;
+    role: 'admin' | 'member';
+}
 export interface Context {
     hippoRoot: string;
     tenantId: string;
-    /** 'cli' | 'localhost:cli' | 'api_key:<key_id>' | 'mcp' */
-    actor: string;
+    actor: Actor;
 }
+/**
+ * Helper for building process-local (admin-by-default) Actor values. v1.12.0
+ * factory used by CLI / MCP / connector Context constructors so the role
+ * boilerplate isn't repeated at every site. Bearer-authed callers (HTTP
+ * /v1/*) construct Actor directly from the api_keys row's role column via
+ * buildContextWithAuth in src/server.ts.
+ */
+export declare function adminActor(subject: string): Actor;
 /**
  * Thrown by `api.recall` when a caller's options violate a recall contract
  * that has been opted into via env. Carries a stable `code` field for HTTP /
@@ -245,6 +266,16 @@ export interface RecallResult {
  * `ctx.tenantId`. The `mode` flag is accepted for forward compatibility (the
  * CLI exposes hybrid/physics paths) but Task 2 wires only the BM25 candidate
  * loader; later tasks can extend this to call the physics/hybrid scorer.
+ *
+ * **api.recall does NOT mutate `index.last_retrieval_ids`** (v1.11.5 contract
+ * lock). The CLI `cmdRecall` (cli.ts) writes `last_retrieval_ids` because the
+ * CLI is interactive (user is about to run `hippo outcome --good`). SDK callers
+ * are programmatic: they either pass explicit ids to `api.outcome` or call
+ * `api.getContext` first for the context-then-outcome workflow (getContext
+ * DOES write `last_retrieval_ids`). Adding the side-effect here would change
+ * `api.recall` from a pure read into a read+write, breaking SDK callers who
+ * batch recall calls in a row. Locked by
+ * `tests/api-recall-no-side-effects.test.ts`.
  */
 export declare function recall(ctx: Context, opts: RecallOpts): RecallResult;
 export interface AssembleOpts {
@@ -404,7 +435,7 @@ export declare function drillDown(ctx: Context, summaryId: string, opts?: DrillD
  * Tenant-scoped: ids that don't belong to ctx.tenantId are silently skipped
  * (matches the prior MCP semantics — a stale id from another tenant doesn't
  * crash the call). Each successful outcome emits one audit_log row with
- * op='outcome' tagged with ctx.actor.
+ * op='outcome' tagged with ctx.actor.subject.
  *
  * Returns `{applied, appliedIds}`. `appliedIds` is the tenant-filtered subset
  * of input ids that actually had `applyOutcome` run on them (i.e. ids whose
@@ -419,7 +450,7 @@ export declare function outcome(ctx: Context, ids: ReadonlyArray<string>, good:
     appliedIds: string[];
 };
 /**
- * Delete a memory by id. `deleteEntry` threads ctx.actor into its internal
+ * Delete a memory by id. `deleteEntry` threads ctx.actor.subject into its internal
  * audit hook, so exactly one 'forget' event lands with the supplied actor.
  *
  * Tenant scope: deleteEntry looks up the row by id alone, so without an
@@ -465,7 +496,7 @@ export declare function supersede(ctx: Context, oldId: string, newContent: strin
  * `archiveRawMemory` audits the operation internally (op='archive_raw') using the
  * row's own tenant_id. We DO NOT emit a second audit event here to avoid double-
  * emitting the archive_raw op (unlike Task 1 remember/forget where the underlying
- * helpers hardcode actor='cli'). Instead we pass `ctx.actor` through as `who`,
+ * helpers hardcode actor='cli'). Instead we pass `ctx.actor.subject` through as `who`,
  * and raw-archive.ts uses that for the audit row.
  */
 export interface ArchiveRawOpts {

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAwBL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,WAAW,EAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAGpB,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAOnB,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEtE,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAgB,IAAI,EAChB,gCAAgC,GAChC,uBAAuB,CAAC;gBAE1B,IAAI,EACA,gCAAgC,GAChC,uBAAuB,EAC3B,OAAO,EAAE,MAAM;CAMlB;AAiBD;;;;;;;;;GASG;AACH;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAaT;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAExE;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,cAAc,CAczE;AAMD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,mBAAmB,EAAE,YAAY,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,CA8TnE;AAMD,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;kCAC8B;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB;sCACkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;kCAC8B;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;qDACiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,YAAiB,GACtB,cAAc,CA+HhB;AAMD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtH,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnG,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,WAAW,GAAG,eAAe,CAAC;CACxC;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,aAAkB,GACvB,gBAAgB,CA0DlB;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,EAC1B,IAAI,EAAE,OAAO,GACZ;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAsB3C;AAMD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAiBzE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAuClD;AAMD;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsF5C;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,KAAK,IAAI,CAAC;CACzE;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,cAAmB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAsDlC;AAMD,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAQ/E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACxB,cAAc,EAAE,CAQlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA8CjC;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,UAAU,EAAE,CAYzE;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CA4RxB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CACzB,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,OAAO,GACZ;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAMpC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAwBL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,WAAW,EAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAGpB,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAOnB,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,WAAW,KAAK;IACpB,oGAAoG;IACpG,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC1B;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAEjD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAgB,IAAI,EAChB,gCAAgC,GAChC,uBAAuB,CAAC;gBAE1B,IAAI,EACA,gCAAgC,GAChC,uBAAuB,EAC3B,OAAO,EAAE,MAAM;CAMlB;AAiBD;;;;;;;;;GASG;AACH;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAaT;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAExE;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,cAAc,CAczE;AAMD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,mBAAmB,EAAE,YAAY,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,CA8TnE;AAMD,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;kCAC8B;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB;sCACkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;kCAC8B;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;qDACiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,YAAiB,GACtB,cAAc,CA+HhB;AAMD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtH,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnG,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,WAAW,GAAG,eAAe,CAAC;CACxC;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,aAAkB,GACvB,gBAAgB,CA0DlB;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,EAC1B,IAAI,EAAE,OAAO,GACZ;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAsB3C;AAMD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAiBzE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,GACT;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAuClD;AAMD;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsF5C;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,KAAK,IAAI,CAAC;CACzE;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,cAAmB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAsDlC;AAMD,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAQ/E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACxB,cAAc,EAAE,CAQlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA8CjC;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,UAAU,EAAE,CAYzE;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CA4RxB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CACzB,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,WAAW,CAAC,CAqJtB;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,OAAO,GACZ;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAMpC"}

package/dist/api.js

@@ -21,6 +21,16 @@ import { consolidate } from './consolidate.js';
 import { loadConfig } from './config.js';
 import { deduplicateStore } from './dedupe.js';
 import { computeAmbientState } from './ambient.js';
+/**
+ * Helper for building process-local (admin-by-default) Actor values. v1.12.0
+ * factory used by CLI / MCP / connector Context constructors so the role
+ * boilerplate isn't repeated at every site. Bearer-authed callers (HTTP
+ * /v1/*) construct Actor directly from the api_keys row's role column via
+ * buildContextWithAuth in src/server.ts.
+ */
+export function adminActor(subject) {
+    return { subject, role: 'admin' };
+}
 /**
  * Thrown by `api.recall` when a caller's options violate a recall contract
  * that has been opted into via env. Carries a stable `code` field for HTTP /
@@ -105,9 +115,9 @@ export function remember(ctx, opts) {
         tags: opts.tags,
         tenantId: ctx.tenantId,
     });
-    // writeEntry threads ctx.actor into its internal audit hook, so exactly
+    // writeEntry threads ctx.actor.subject into its internal audit hook, so exactly
     // one 'remember' event lands in the log with the supplied actor.
-    writeEntry(ctx.hippoRoot, entry, { actor: ctx.actor, afterWrite: opts.afterWrite });
+    writeEntry(ctx.hippoRoot, entry, { actor: ctx.actor.subject, afterWrite: opts.afterWrite });
     return { id: entry.id, kind: entry.kind, tenantId: ctx.tenantId };
 }
 /**
@@ -115,6 +125,16 @@ export function remember(ctx, opts) {
  * `ctx.tenantId`. The `mode` flag is accepted for forward compatibility (the
  * CLI exposes hybrid/physics paths) but Task 2 wires only the BM25 candidate
  * loader; later tasks can extend this to call the physics/hybrid scorer.
+ *
+ * **api.recall does NOT mutate `index.last_retrieval_ids`** (v1.11.5 contract
+ * lock). The CLI `cmdRecall` (cli.ts) writes `last_retrieval_ids` because the
+ * CLI is interactive (user is about to run `hippo outcome --good`). SDK callers
+ * are programmatic: they either pass explicit ids to `api.outcome` or call
+ * `api.getContext` first for the context-then-outcome workflow (getContext
+ * DOES write `last_retrieval_ids`). Adding the side-effect here would change
+ * `api.recall` from a pure read into a read+write, breaking SDK callers who
+ * batch recall calls in a row. Locked by
+ * `tests/api-recall-no-side-effects.test.ts`.
  */
 export function recall(ctx, opts) {
     const limit = opts.limit ?? 10;
@@ -332,7 +352,7 @@ export function recall(ctx, opts) {
         // long-prompt patterns and compliance metrics.
         appendAuditEvent(db, {
             tenantId: ctx.tenantId,
-            actor: ctx.actor,
+            actor: ctx.actor.subject,
             op: 'recall',
             metadata: {
                 query_hash: createHash('sha256').update(opts.query).digest('hex').slice(0, 16),
@@ -634,7 +654,7 @@ export function drillDown(ctx, summaryId, opts = {}) {
  * Tenant-scoped: ids that don't belong to ctx.tenantId are silently skipped
  * (matches the prior MCP semantics — a stale id from another tenant doesn't
  * crash the call). Each successful outcome emits one audit_log row with
- * op='outcome' tagged with ctx.actor.
+ * op='outcome' tagged with ctx.actor.subject.
  *
  * Returns `{applied, appliedIds}`. `appliedIds` is the tenant-filtered subset
  * of input ids that actually had `applyOutcome` run on them (i.e. ids whose
@@ -653,10 +673,10 @@ export function outcome(ctx, ids, good) {
             if (!entry)
                 continue;
             const updated = applyOutcome(entry, good);
-            writeEntry(ctx.hippoRoot, updated, { actor: ctx.actor });
+            writeEntry(ctx.hippoRoot, updated, { actor: ctx.actor.subject });
             appendAuditEvent(db, {
                 tenantId: ctx.tenantId,
-                actor: ctx.actor,
+                actor: ctx.actor.subject,
                 op: 'outcome',
                 targetId: id,
                 metadata: { good },
@@ -673,7 +693,7 @@ export function outcome(ctx, ids, good) {
 // forget
 // ---------------------------------------------------------------------------
 /**
- * Delete a memory by id. `deleteEntry` threads ctx.actor into its internal
+ * Delete a memory by id. `deleteEntry` threads ctx.actor.subject into its internal
  * audit hook, so exactly one 'forget' event lands with the supplied actor.
  *
  * Tenant scope: deleteEntry looks up the row by id alone, so without an
@@ -695,7 +715,7 @@ export function forget(ctx, id) {
     finally {
         closeHippoDb(db);
     }
-    const removed = deleteEntry(ctx.hippoRoot, id, { actor: ctx.actor });
+    const removed = deleteEntry(ctx.hippoRoot, id, { actor: ctx.actor.subject });
     if (!removed) {
         throw new Error(`memory not found: ${id}`);
     }
@@ -734,16 +754,16 @@ export function promote(ctx, id) {
     finally {
         closeHippoDb(ownerDb);
     }
-    // promoteToGlobal threads ctx.actor into the writeEntry call on the global
+    // promoteToGlobal threads ctx.actor.subject into the writeEntry call on the global
     // db, which emits a 'remember' audit row. We then add the user-facing
     // 'promote' event on the global db so the audit trail keeps the intent
     // distinct from the underlying upsert.
-    const globalEntry = promoteToGlobal(ctx.hippoRoot, id, { actor: ctx.actor, tenantId: ctx.tenantId });
+    const globalEntry = promoteToGlobal(ctx.hippoRoot, id, { actor: ctx.actor.subject, tenantId: ctx.tenantId });
     const db = openHippoDb(getGlobalRoot());
     try {
         appendAuditEvent(db, {
             tenantId: ctx.tenantId,
-            actor: ctx.actor,
+            actor: ctx.actor.subject,
             op: 'promote',
             targetId: globalEntry.id,
             metadata: { sourceId: id },
@@ -812,12 +832,12 @@ export function supersede(ctx, oldId, newContent) {
             // 2. Write new memory inside same tx via writeEntryDbOnly (DB-only
             //    path). This emits its OWN 'remember' audit row for the new
             //    memory inside the SAVEPOINT — atomic with the row INSERT.
-            writeEntryDbOnly(db, newEntry, { actor: ctx.actor });
+            writeEntryDbOnly(db, newEntry, { actor: ctx.actor.subject });
             // 3. User-facing 'supersede' audit row inside the same tx so the
             //    chain pointer + audit trail commit atomically.
             appendAuditEvent(db, {
                 tenantId: ctx.tenantId,
-                actor: ctx.actor,
+                actor: ctx.actor.subject,
                 op: 'supersede',
                 targetId: oldId,
                 metadata: { newId: newEntry.id },
@@ -865,7 +885,7 @@ export function archiveRaw(ctx, id, reason, opts = {}) {
         }
         archiveRawMemory(db, id, {
             reason,
-            who: ctx.actor,
+            who: ctx.actor.subject,
             afterArchive: opts.afterArchive,
         });
         // archiveRawMemory deletes the memories row but leaves any legacy markdown
@@ -980,7 +1000,7 @@ export function authRevoke(ctx, keyId) {
             try {
                 appendAuditEvent(db, {
                     tenantId: row.tenant_id, // M1: KEY's tenant, not ctx.tenantId.
-                    actor: ctx.actor,
+                    actor: ctx.actor.subject,
                     op: 'auth_revoke',
                     targetId: keyId,
                 });
@@ -1226,7 +1246,7 @@ export async function getContext(ctx, opts = {}) {
             try {
                 appendAuditEvent(localDb, {
                     tenantId: ctx.tenantId,
-                    actor: ctx.actor,
+                    actor: ctx.actor.subject,
                     op: 'recall',
                     metadata: ctxRecallMetadata,
                 });
@@ -1240,7 +1260,7 @@ export async function getContext(ctx, opts = {}) {
             try {
                 appendAuditEvent(globalDb, {
                     tenantId: ctx.tenantId,
-                    actor: ctx.actor,
+                    actor: ctx.actor.subject,
                     op: 'recall',
                     metadata: ctxRecallMetadata,
                 });
@@ -1312,68 +1332,139 @@ export async function getContext(ctx, opts = {}) {
  */
 export async function sleep(ctx, opts = {}) {
     const dryRun = Boolean(opts.dryRun);
-    // Phase 1: Consolidation.
-    const consolidateResult = await consolidate(ctx.hippoRoot, { dryRun });
-    const result = {
-        active: consolidateResult.decayed,
-        removed: consolidateResult.removed,
-        mergedEpisodic: consolidateResult.merged,
-        newSemantic: consolidateResult.semanticCreated,
-        dryRun,
-        details: consolidateResult.details,
-    };
-    if (dryRun)
-        return result;
-    // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
-    const dedupResult = deduplicateStore(ctx.hippoRoot);
-    if (dedupResult.removed > 0) {
-        const semDups = dedupResult.pairs.filter((p) => p.keptLayer === 'semantic' && p.removedLayer === 'semantic').length;
-        const epiDups = dedupResult.pairs.filter((p) => p.keptLayer === 'episodic' && p.removedLayer === 'episodic').length;
-        const crossDups = dedupResult.pairs.filter((p) => p.keptLayer !== p.removedLayer).length;
-        result.deduped = {
-            removed: dedupResult.removed,
-            semDups,
-            epiDups,
-            crossDups,
+    // v1.11.5: phase counters for the consolidate audit emit (in finally).
+    // Accumulated as each phase completes so partial-failure paths still report
+    // accurate "what got done before the failure" data.
+    let consolidationCount = 0;
+    let dedupCount = 0;
+    let auditDeletedCount = 0;
+    let ambientTotal = 0;
+    let phaseError = null;
+    let result = null;
+    try {
+        // Phase 1: Consolidation.
+        const consolidateResult = await consolidate(ctx.hippoRoot, { dryRun });
+        consolidationCount = consolidateResult.semanticCreated + consolidateResult.merged;
+        result = {
+            active: consolidateResult.decayed,
+            removed: consolidateResult.removed,
+            mergedEpisodic: consolidateResult.merged,
+            newSemantic: consolidateResult.semanticCreated,
+            dryRun,
+            details: consolidateResult.details,
         };
-    }
-    // Phase 3: Quality audit (remove junk, report warnings).
-    const allEntries = loadAllEntries(ctx.hippoRoot);
-    const auditOut = auditMemories(allEntries);
-    if (auditOut.issues.length > 0) {
-        const errors = auditOut.issues.filter((i) => i.severity === 'error');
-        const warnings = auditOut.issues.filter((i) => i.severity === 'warning');
-        if (errors.length > 0) {
-            for (const issue of errors) {
-                deleteEntry(ctx.hippoRoot, issue.memoryId);
+        if (dryRun)
+            return result;
+        // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
+        const dedupResult = deduplicateStore(ctx.hippoRoot);
+        dedupCount = dedupResult.removed;
+        if (dedupResult.removed > 0) {
+            const semDups = dedupResult.pairs.filter((p) => p.keptLayer === 'semantic' && p.removedLayer === 'semantic').length;
+            const epiDups = dedupResult.pairs.filter((p) => p.keptLayer === 'episodic' && p.removedLayer === 'episodic').length;
+            const crossDups = dedupResult.pairs.filter((p) => p.keptLayer !== p.removedLayer).length;
+            result.deduped = {
+                removed: dedupResult.removed,
+                semDups,
+                epiDups,
+                crossDups,
+            };
+        }
+        // Phase 3: Quality audit (remove junk, report warnings).
+        const allEntries = loadAllEntries(ctx.hippoRoot);
+        const auditOut = auditMemories(allEntries);
+        if (auditOut.issues.length > 0) {
+            const errors = auditOut.issues.filter((i) => i.severity === 'error');
+            const warnings = auditOut.issues.filter((i) => i.severity === 'warning');
+            if (errors.length > 0) {
+                for (const issue of errors) {
+                    deleteEntry(ctx.hippoRoot, issue.memoryId);
+                }
+            }
+            auditDeletedCount = errors.length;
+            if (errors.length > 0 || warnings.length > 0) {
+                result.audit = {
+                    errorsRemoved: errors.length,
+                    warningCount: warnings.length,
+                };
             }
         }
-        if (errors.length > 0 || warnings.length > 0) {
-            result.audit = {
-                errorsRemoved: errors.length,
-                warningCount: warnings.length,
-            };
+        // Phase 4: Auto-share high-transfer-score memories to global.
+        if (!opts.noShare) {
+            const sleepConfig = loadConfig(ctx.hippoRoot);
+            if (sleepConfig.autoShareOnSleep) {
+                const shared = autoShare(ctx.hippoRoot, { minScore: 0.6 });
+                if (shared.length > 0) {
+                    result.shared = shared.length;
+                }
+            }
         }
-    }
-    // Phase 4: Auto-share high-transfer-score memories to global.
-    if (!opts.noShare) {
-        const sleepConfig = loadConfig(ctx.hippoRoot);
-        if (sleepConfig.autoShareOnSleep) {
-            const shared = autoShare(ctx.hippoRoot, { minScore: 0.6 });
-            if (shared.length > 0) {
-                result.shared = shared.length;
+        // Phase 5: Post-sleep ambient state summary.
+        const postSleepConfig = loadConfig(ctx.hippoRoot);
+        if (postSleepConfig.ambient.enabled) {
+            const postSleepEntries = loadAllEntries(ctx.hippoRoot).filter((e) => !e.superseded_by);
+            if (postSleepEntries.length > 0) {
+                result.ambient = computeAmbientState(postSleepEntries);
+                ambientTotal = result.ambient.totalMemories;
             }
         }
+        return result;
+    }
+    catch (err) {
+        phaseError = err;
+        throw err;
     }
-    // Phase 5: Post-sleep ambient state summary.
-    const postSleepConfig = loadConfig(ctx.hippoRoot);
-    if (postSleepConfig.ambient.enabled) {
-        const postSleepEntries = loadAllEntries(ctx.hippoRoot).filter((e) => !e.superseded_by);
-        if (postSleepEntries.length > 0) {
-            result.ambient = computeAmbientState(postSleepEntries);
+    finally {
+        // v1.11.5: emit one 'consolidate' audit_log row per api.sleep invocation,
+        // with phase counters in metadata. Closes the CLI/MCP parity gap that T6
+        // fixed for cmdOutcome (Episode A follow-up). In finally so partial-failure
+        // paths still emit; `partial: true` + errorMessage flag the failure.
+        // Dedicated handle for this emit only (phase helpers above each open their
+        // own handle via hippoRoot — SQLite single-writer makes parallel handles
+        // safe for the read-heavy phases).
+        //
+        // TODO(v1.12.0 + A5 v2): the audit row is tagged with ctx.tenantId but
+        // api.sleep is host-wide (cross-tenant dedup is intentional). When
+        // /v1/sleep moves off loopback-only, either tag with a synthetic "host"
+        // tenant or scope api.sleep per-tenant. Independent-review-critic flag,
+        // v1.11.5 ship.
+        //
+        // Error preservation: if openHippoDb or appendAuditEvent throws here, we
+        // do NOT let it replace the original phaseError (independent-review HIGH:
+        // would mask the underlying consolidation failure). Audit emit failure
+        // is logged to stderr but the original throw wins.
+        try {
+            const db = openHippoDb(ctx.hippoRoot);
+            try {
+                appendAuditEvent(db, {
+                    tenantId: ctx.tenantId,
+                    actor: ctx.actor.subject,
+                    op: 'consolidate',
+                    metadata: {
+                        consolidationCount,
+                        dedupCount,
+                        auditDeletedCount,
+                        ambientTotal,
+                        dryRun,
+                        noShare: opts.noShare ?? false,
+                        partial: phaseError !== null,
+                        ...(phaseError ? { errorMessage: phaseError.message } : {}),
+                    },
+                });
+            }
+            finally {
+                closeHippoDb(db);
+            }
+        }
+        catch (auditErr) {
+            // Audit emit failure must NOT mask the original phaseError. Log to
+            // stderr so the secondary failure is observable but does not throw.
+            // This guards the case where consolidation AND audit-emit fail in the
+            // same invocation against the same DB (correlated: same disk, same
+            // schema state) — losing the original error makes diagnosis much harder.
+            // eslint-disable-next-line no-console
+            console.error(`[hippo] api.sleep audit emit failed: ${auditErr.message}`);
         }
     }
-    return result;
 }
 // ---------------------------------------------------------------------------
 // outcomeForLastRecall (last-recall wrapper around outcome — Task 3)