hippo-memory 1.60.0 → 1.61.0

package/dist/server/request.d.ts

@@ -0,0 +1,33 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** The caller's `X-Request-Id` when it is a short plain token, else a fresh UUID. */
+export declare function resolveRequestId(header: string | string[] | undefined): string;
+/** One line per failed request; 4xx is the caller's mistake, so it stays below the default level and skips the stack. */
+export declare function logRequestFailure<E>(req: IncomingMessage, err: E, requestId: string, status: number): void;
+/** The status and client message for a failed request; a held write lock is a retryable 503, never a 500. */
+export declare function replyFor<E>(err: E): {
+    status: number;
+    message: string;
+};
+export declare function sendError(res: ServerResponse, status: number, message: string): void;
+interface ParsedRoute {
+    method: string;
+    path: string;
+    query: URLSearchParams;
+}
+export declare function parseRequest(req: IncomingMessage): ParsedRoute;
+export declare function matchPath(pattern: string, path: string): Record<string, string> | null;
+export declare const requestIds: WeakMap<IncomingMessage, string>;
+/**
+ * Reject URL-encoded slashes in path segments BEFORE the URL parser decodes
+ * them — otherwise `%2F` becomes `/`, path-split runs, and the route either
+ * silently 404s or matches the wrong template.
+ *
+ * codex round 3 P2: only scan the PATHNAME portion of the raw URL, not the
+ * query string. Pre-fix, `?q=https%3A%2F%2Fexample.com` would 400 because
+ * the regex matched `%2F` anywhere in `req.url`. Recall queries containing
+ * URLs would have been rejected as bypass attempts. Splitting on the first
+ * `?` confines the check to the path.
+ */
+export declare function rejectEncodedSlash(rawUrl: string): void;
+export {};
+//# sourceMappingURL=request.d.ts.map

package/dist/server/request.js

@@ -0,0 +1,103 @@
+import { randomUUID } from 'node:crypto';
+import { isSqliteBusy, STORE_BUSY_MESSAGE } from '../db.js';
+import { errorFields, log } from '../log.js';
+import { HttpError, mapApiError, sendJson } from '../http-util.js';
+// The caller's id lands in a response header and in logs, so only a short plain token is echoed back.
+const REQUEST_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+/** The caller's `X-Request-Id` when it is a short plain token, else a fresh UUID. */
+export function resolveRequestId(header) {
+    const value = Array.isArray(header) ? undefined : header;
+    return value && REQUEST_ID_RE.test(value) ? value : randomUUID();
+}
+/** One line per failed request; 4xx is the caller's mistake, so it stays below the default level and skips the stack. */
+export function logRequestFailure(req, err, requestId, status) {
+    const message = err instanceof Error ? err.message : String(err);
+    const line = `${req.method ?? 'GET'} ${(req.url ?? '/').split('?')[0]} failed: ${message}`;
+    if (status >= 500)
+        log.error(line, { requestId, status, ...errorFields(err) });
+    else
+        log.info(line, { requestId, status });
+}
+/** The status and client message for a failed request; a held write lock is a retryable 503, never a 500. */
+export function replyFor(err) {
+    return isSqliteBusy(err) ? { status: 503, message: STORE_BUSY_MESSAGE } : mapApiError(err);
+}
+export function sendError(res, status, message) {
+    sendJson(res, status, { error: message });
+}
+export function parseRequest(req) {
+    let url;
+    try {
+        url = new URL(req.url ?? '/', 'http://placeholder');
+    }
+    catch (e) {
+        // A request target the URL parser rejects is the caller's fault, not a server failure.
+        if (e instanceof TypeError)
+            throw new HttpError(400, e.message);
+        throw e;
+    }
+    return {
+        method: req.method ?? 'GET',
+        path: url.pathname,
+        query: url.searchParams,
+    };
+}
+/**
+ * Lightweight pattern matcher for /v1/memories/:id/<action>. Avoids pulling
+ * in a router dependency for the half-dozen patterns we actually use.
+ *
+ * Returns null if `path` does not match `pattern`. Otherwise returns an object
+ * mapping each :param name to its value. Path segments are exact-matched
+ * except for parameter slots.
+ */
+function decodePathSegment(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch (e) {
+        if (e instanceof URIError)
+            throw new HttpError(400, e.message);
+        throw e;
+    }
+}
+export function matchPath(pattern, path) {
+    const patternParts = pattern.split('/');
+    const pathParts = path.split('/');
+    if (patternParts.length !== pathParts.length)
+        return null;
+    const params = {};
+    for (let i = 0; i < patternParts.length; i++) {
+        const pp = patternParts[i];
+        const ap = pathParts[i];
+        if (pp.startsWith(':')) {
+            if (ap.length === 0)
+                return null;
+            params[pp.slice(1)] = decodePathSegment(ap);
+        }
+        else if (pp !== ap) {
+            return null;
+        }
+    }
+    return params;
+}
+// The auth helpers only see the request, so its id rides here for their log lines.
+export const requestIds = new WeakMap();
+/**
+ * Reject URL-encoded slashes in path segments BEFORE the URL parser decodes
+ * them — otherwise `%2F` becomes `/`, path-split runs, and the route either
+ * silently 404s or matches the wrong template.
+ *
+ * codex round 3 P2: only scan the PATHNAME portion of the raw URL, not the
+ * query string. Pre-fix, `?q=https%3A%2F%2Fexample.com` would 400 because
+ * the regex matched `%2F` anywhere in `req.url`. Recall queries containing
+ * URLs would have been rejected as bypass attempts. Splitting on the first
+ * `?` confines the check to the path.
+ */
+export function rejectEncodedSlash(rawUrl) {
+    const queryIdx = rawUrl.indexOf('?');
+    const pathname = queryIdx === -1 ? rawUrl : rawUrl.slice(0, queryIdx);
+    if (/%2[Ff]/.test(pathname)) {
+        throw new HttpError(400, 'URL-encoded slash (%2F) not allowed in path segments');
+    }
+}
+//# sourceMappingURL=request.js.map

package/dist/server/routes/admin.d.ts

@@ -0,0 +1,9 @@
+import type { RouteRequest } from '../types.js';
+export declare function handleCreateAuthKey({ req, res, opts }: RouteRequest): Promise<void>;
+export declare function handleListAuthKeys({ req, res, opts, query }: RouteRequest): Promise<void>;
+export declare function handleRevokeAuthKey({ req, res, opts }: RouteRequest, keyMatch: Record<string, string>): Promise<void>;
+export declare function handleListQuarantine({ req, res, opts, query }: RouteRequest): Promise<void>;
+export declare function handleApproveQuarantine({ req, res, opts }: RouteRequest, quarantineApproveMatch: Record<string, string>): Promise<void>;
+export declare function handleRejectQuarantine({ req, res, opts }: RouteRequest, quarantineRejectMatch: Record<string, string>): Promise<void>;
+export declare function handleListAudit({ req, res, opts, query }: RouteRequest): Promise<void>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/server/routes/admin.js

@@ -0,0 +1,158 @@
+// Admin routes: API keys, quarantine and the audit log.
+import { AUDIT_OPS } from '../../audit.js';
+import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api.js';
+import { HttpError, sendJson } from '../../http-util.js';
+import { assertCrossTenantAdmin, buildContextWithAuth } from '../auth.js';
+import { pageOf, parseCursor, setNextCursorHeader } from '../cursor.js';
+import { isJsonString, isSetMember, parseJsonBody, parseListLimit, validateIdSegment } from '../validation.js';
+const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
+// Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
+// enough to dump a small deployment's full audit log without paginating, but
+// small enough that a malicious client can't ask for the world.
+const MAX_AUDIT_LIMIT = 10000;
+// GET /v1/auth/keys had no limit, so its default page is the cap: a deployment below 1000 keys sees no change.
+const MAX_AUTH_KEYS_PAGE = 1000;
+// POST /v1/auth/keys — mint a new API key. Plaintext lands in the response
+// body (Task 8): the HTTP layer hands it to the client; the user-facing
+// "store this somewhere safe" warning belongs in the CLI client, not here.
+export async function handleCreateAuthKey({ req, res, opts }) {
+    const ctx = await buildContextWithAuth(req, opts);
+    const body = await parseJsonBody(req, ctx);
+    const labelRaw = body['label'];
+    if (labelRaw !== undefined && !isJsonString(labelRaw)) {
+        throw new HttpError(400, 'label must be a string');
+    }
+    // v1.12.3: optional body.role mirrors the --role CLI flag. Validated
+    // strictly — anything other than 'admin'|'member' is a 400 (no silent
+    // fallback to admin). authCreate refuses a member caller with a 403.
+    const roleRaw = body['role'];
+    let role;
+    if (roleRaw !== undefined) {
+        if (roleRaw !== 'admin' && roleRaw !== 'member') {
+            throw new HttpError(400, "role must be 'admin' or 'member'");
+        }
+        role = roleRaw;
+    }
+    // Security: any `tenantId` in the body is IGNORED. The minted key is
+    // bound to the caller's authenticated tenant (ctx.tenantId, resolved
+    // from the Bearer token). Forwarding body.tenantId here would let
+    // tenant A mint a key for tenant B — see authCreate doc comment.
+    const result = authCreate(ctx, {
+        label: labelRaw,
+        role,
+    });
+    sendJson(res, 200, result);
+    return;
+}
+// GET /v1/auth/keys?active=true&limit=&cursor=: list keys visible to ctx.tenantId.
+// `active` defaults to true so the common case (show me usable keys) is
+// a single GET; ?active=false includes revoked rows.
+export async function handleListAuthKeys({ req, res, opts, query }) {
+    const activeRaw = query.get('active');
+    let active = true;
+    if (activeRaw !== null) {
+        if (activeRaw === 'true')
+            active = true;
+        else if (activeRaw === 'false')
+            active = false;
+        else
+            throw new HttpError(400, "active must be 'true' or 'false'");
+    }
+    const limit = parseListLimit(query.get('limit'), MAX_AUTH_KEYS_PAGE, MAX_AUTH_KEYS_PAGE);
+    const after = parseCursor(query.get('cursor'), 'integer', 'integer');
+    const ctx = await buildContextWithAuth(req, opts);
+    const page = pageOf(authListRows(ctx, { active, limit: limit + 1, after }), limit, (r) => ({ key: r.rowId, id: r.rowId }));
+    setNextCursorHeader(res, page.nextCursor);
+    sendJson(res, 200, page.items.map((r) => r.key));
+    return;
+}
+// DELETE /v1/auth/keys/:keyId — revoke. Missing or cross-tenant keys are 404
+// (no info leak); a member key targeting any key but its own is 403.
+// 200 with the body rather than 204 so the caller sees revokedAt.
+export async function handleRevokeAuthKey({ req, res, opts }, keyMatch) {
+    validateIdSegment(keyMatch.keyId, 'key id');
+    const ctx = await buildContextWithAuth(req, opts);
+    const result = authRevoke(ctx, keyMatch.keyId);
+    sendJson(res, 200, result);
+    return;
+}
+// GET /v1/quarantine?status=&limit=&cursor=: CD5 review queue. quarantineList carries no role gate itself, so it's checked here.
+export async function handleListQuarantine({ req, res, opts, query }) {
+    const ctx = await buildContextWithAuth(req, opts);
+    if (ctx.actor.role !== 'admin') {
+        throw new HttpError(403, '/v1/quarantine requires admin role');
+    }
+    const statusRaw = query.get('status');
+    let status = 'pending';
+    if (statusRaw !== null) {
+        if (statusRaw !== 'pending' && statusRaw !== 'approved' && statusRaw !== 'rejected' && statusRaw !== 'all') {
+            throw new HttpError(400, 'status must be one of: pending | approved | rejected | all');
+        }
+        status = statusRaw;
+    }
+    const limit = parseListLimit(query.get('limit'));
+    const after = parseCursor(query.get('cursor'), 'string', 'string');
+    const page = pageOf(quarantineList(ctx, { status, limit: limit + 1, after }), limit, (q) => ({ key: q.quarantinedAt, id: q.id }));
+    sendJson(res, 200, { quarantine: page.items, next_cursor: page.nextCursor });
+    return;
+}
+// POST /v1/quarantine/:id/approve: admin only; ForbiddenError falls through to mapApiError's 403.
+export async function handleApproveQuarantine({ req, res, opts }, quarantineApproveMatch) {
+    validateIdSegment(quarantineApproveMatch.id, 'memory id');
+    const ctx = await buildContextWithAuth(req, opts);
+    quarantineApprove(ctx, quarantineApproveMatch.id);
+    sendJson(res, 200, { approved: quarantineApproveMatch.id });
+    return;
+}
+// POST /v1/quarantine/:id/reject: admin only; ForbiddenError falls through to mapApiError's 403.
+export async function handleRejectQuarantine({ req, res, opts }, quarantineRejectMatch) {
+    validateIdSegment(quarantineRejectMatch.id, 'memory id');
+    const ctx = await buildContextWithAuth(req, opts);
+    quarantineReject(ctx, quarantineRejectMatch.id);
+    sendJson(res, 200, { rejected: quarantineRejectMatch.id });
+    return;
+}
+// GET /v1/audit?op=&since=&limit=&cursor=: read audit events. All three filters
+// validated at the route boundary so an invalid value lands a 400 before
+// we hit the DB.
+export async function handleListAudit({ req, res, opts, query }) {
+    const opRaw = query.get('op');
+    let op;
+    if (opRaw !== null) {
+        if (!isSetMember(VALID_AUDIT_OPS, opRaw)) {
+            throw new HttpError(400, `invalid op: ${opRaw}`);
+        }
+        op = opRaw;
+    }
+    const sinceRaw = query.get('since');
+    let since;
+    if (sinceRaw !== null) {
+        const parsed = Date.parse(sinceRaw);
+        if (!Number.isFinite(parsed)) {
+            throw new HttpError(400, `invalid since: ${sinceRaw}`);
+        }
+        since = sinceRaw;
+    }
+    const limitRaw = query.get('limit');
+    let limit = 100;
+    if (limitRaw !== null) {
+        const parsed = Number(limitRaw);
+        if (!Number.isFinite(parsed) || !Number.isInteger(parsed) || parsed < 1 || parsed > MAX_AUDIT_LIMIT) {
+            throw new HttpError(400, `limit must be an integer between 1 and ${MAX_AUDIT_LIMIT}`);
+        }
+        limit = parsed;
+    }
+    const after = parseCursor(query.get('cursor'), 'string', 'integer');
+    const ctx = await buildContextWithAuth(req, opts);
+    // ?tenant=<t> reads another tenant (e.g. '__host__' for consolidate rows); admin only.
+    const tenantOverride = query.get('tenant');
+    const crossTenant = tenantOverride !== null && tenantOverride !== '' && tenantOverride !== ctx.tenantId;
+    if (crossTenant)
+        assertCrossTenantAdmin(ctx, '/v1/audit?tenant= for another tenant');
+    const effectiveCtx = crossTenant ? { ...ctx, tenantId: tenantOverride } : ctx;
+    const page = pageOf(auditList(effectiveCtx, { op, since, limit: limit + 1, after }), limit, (e) => ({ key: e.ts, id: e.id }));
+    setNextCursorHeader(res, page.nextCursor);
+    sendJson(res, 200, page.items);
+    return;
+}
+//# sourceMappingURL=admin.js.map

package/dist/server/routes/customer-notes.d.ts

@@ -0,0 +1,7 @@
+import type { RouteRequest } from '../types.js';
+export declare function handleCreateCustomerNote({ req, res, opts }: RouteRequest): Promise<void>;
+export declare function handleListCustomerNotes({ req, res, opts, query }: RouteRequest): Promise<void>;
+export declare function handleSupersedeCustomerNote({ req, res, opts }: RouteRequest, noteSupersedeMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCloseCustomerNote({ req, res, opts }: RouteRequest, noteCloseMatch: RegExpMatchArray): Promise<void>;
+export declare function handleGetCustomerNote({ req, res, opts }: RouteRequest, noteByIdMatch: RegExpMatchArray): Promise<void>;
+//# sourceMappingURL=customer-notes.d.ts.map

package/dist/server/routes/customer-notes.js

@@ -0,0 +1,112 @@
+// /v1/customer-notes routes.
+import { closeCustomerNote, loadCustomerNoteById, loadCustomerNotes, saveCustomerNote, VALID_NOTE_STATES } from '../../customer-notes.js';
+import { HttpError, sendJson } from '../../http-util.js';
+import { buildContextWithAuth } from '../auth.js';
+import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
+import { isJsonString, isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
+// ── E2 customer_note routes ──
+//
+// 5 routes (no assembler/refresh): POST /v1/customer-notes (new; body customer +
+// note), GET /v1/customer-notes (list; status + customer filter; shared
+// parseListLimit), GET /v1/customer-notes/:id, POST /v1/customer-notes/:id/supersede,
+// POST /v1/customer-notes/:id/close. DoS caps: customer 256, note 8192,
+// changeSummary 4096. The store validates + throws; the boundary maps validation ->
+// 400, not-found -> 404, not-active -> 409. Mirrors /v1/project-briefs.
+export async function handleCreateCustomerNote({ req, res, opts }) {
+    const ctx = await buildContextWithAuth(req, opts);
+    const body = await parseJsonBody(req, ctx);
+    const customer = body['customer'];
+    if (!isJsonString(customer) || customer.trim().length === 0) {
+        throw new HttpError(400, 'customer is required (non-empty string)');
+    }
+    if (customer.length > 256) {
+        throw new HttpError(400, 'customer exceeds 256-character cap');
+    }
+    const note = body['note'];
+    if (!isJsonString(note) || note.trim().length === 0) {
+        throw new HttpError(400, 'note is required (non-empty string)');
+    }
+    if (note.length > 8192) {
+        throw new HttpError(400, 'note exceeds 8192-character cap');
+    }
+    const customerNote = saveCustomerNote(opts.hippoRoot, ctx.tenantId, {
+        customer,
+        note,
+    }, ctx.actor.subject);
+    sendJson(res, 201, { note: customerNote });
+    return;
+}
+export async function handleListCustomerNotes({ req, res, opts, query }) {
+    const status = query.get('status') ?? 'all';
+    const customerFilter = query.get('customer');
+    const limit = parseListLimit(query.get('limit'));
+    const after = parseCursor(query.get('cursor'), 'string', 'integer');
+    const ctx = await buildContextWithAuth(req, opts);
+    const listOpts = { limit: limit + 1, after };
+    if (customerFilter !== null && customerFilter.trim().length > 0) {
+        listOpts.customer = customerFilter.trim();
+    }
+    if (status !== 'all') {
+        if (!isSetMember(VALID_NOTE_STATES, status)) {
+            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
+        }
+        listOpts.status = status;
+    }
+    const notes = loadCustomerNotes(opts.hippoRoot, ctx.tenantId, listOpts);
+    const page = pageOf(notes, limit, byCreatedAt);
+    sendJson(res, 200, { notes: page.items, next_cursor: page.nextCursor });
+    return;
+}
+export async function handleSupersedeCustomerNote({ req, res, opts }, noteSupersedeMatch) {
+    const id = parseInt(noteSupersedeMatch[1], 10);
+    const ctx = await buildContextWithAuth(req, opts);
+    const body = await parseJsonBody(req, ctx);
+    const note = body['note'];
+    if (!isJsonString(note) || note.trim().length === 0) {
+        throw new HttpError(400, 'note is required (non-empty string)');
+    }
+    if (note.length > 8192) {
+        throw new HttpError(400, 'note exceeds 8192-character cap');
+    }
+    const changeRaw = body['changeSummary'];
+    let changeSummary;
+    if (changeRaw !== undefined && changeRaw !== null) {
+        if (!isJsonString(changeRaw)) {
+            throw new HttpError(400, 'changeSummary must be a string');
+        }
+        if (changeRaw.length > 4096) {
+            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
+        }
+        changeSummary = changeRaw;
+    }
+    const existing = loadCustomerNoteById(opts.hippoRoot, ctx.tenantId, id);
+    if (!existing) {
+        throw new HttpError(404, `customer note ${id} not found`);
+    }
+    const customerNote = saveCustomerNote(opts.hippoRoot, ctx.tenantId, {
+        customer: existing.customer,
+        note,
+        changeSummary,
+        supersedesNoteId: id,
+    }, ctx.actor.subject);
+    sendJson(res, 200, { note: customerNote });
+    return;
+}
+export async function handleCloseCustomerNote({ req, res, opts }, noteCloseMatch) {
+    const id = parseInt(noteCloseMatch[1], 10);
+    const ctx = await buildContextWithAuth(req, opts);
+    const customerNote = closeCustomerNote(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
+    sendJson(res, 200, { note: customerNote });
+    return;
+}
+export async function handleGetCustomerNote({ req, res, opts }, noteByIdMatch) {
+    const id = parseInt(noteByIdMatch[1], 10);
+    const ctx = await buildContextWithAuth(req, opts);
+    const customerNote = loadCustomerNoteById(opts.hippoRoot, ctx.tenantId, id);
+    if (!customerNote) {
+        throw new HttpError(404, `customer note ${id} not found`);
+    }
+    sendJson(res, 200, { note: customerNote });
+    return;
+}
+//# sourceMappingURL=customer-notes.js.map

package/dist/server/routes/decisions.d.ts

@@ -0,0 +1,7 @@
+import type { RouteRequest } from '../types.js';
+export declare function handleCreateDecision({ req, res, opts }: RouteRequest): Promise<void>;
+export declare function handleListDecisions({ req, res, opts, query }: RouteRequest): Promise<void>;
+export declare function handleSupersedeDecision({ req, res, opts }: RouteRequest, decisionSupersedeMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCloseDecision({ req, res, opts }: RouteRequest, decisionCloseMatch: RegExpMatchArray): Promise<void>;
+export declare function handleGetDecision({ req, res, opts }: RouteRequest, decisionByIdMatch: RegExpMatchArray): Promise<void>;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/server/routes/decisions.js

@@ -0,0 +1,133 @@
+// /v1/decisions routes.
+import { closeDecision, loadDecisionById, loadDecisions, saveDecision, VALID_DECISION_STATES } from '../../decisions.js';
+import { HttpError, sendJson } from '../../http-util.js';
+import { NotFoundError } from '../../api-errors.js';
+import { buildContextWithAuth } from '../auth.js';
+import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
+import { isJsonNumber, isJsonString, isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
+// ── decisions (E2 first-class object) ──
+//
+// 5 routes: POST /v1/decisions (create, optional supersedesDecisionId),
+// GET /v1/decisions (list, status filter), GET /v1/decisions/:id (show),
+// POST /v1/decisions/:id/supersede (create a successor + supersede :id),
+// POST /v1/decisions/:id/close (retire). Bearer-authed + tenant-scoped via
+// buildContextWithAuth. status validated against VALID_DECISION_STATES.
+// DoS caps: text 4096, context 4096 (v1.11.4 pattern). The HTTP surface is
+// new (no legacy --supersedes <memory-id> constraint), so it supersedes by
+// table id and never weakens a memory mirror.
+export async function handleCreateDecision({ req, res, opts }) {
+    const ctx = await buildContextWithAuth(req, opts);
+    const body = await parseJsonBody(req, ctx);
+    const text = body['text'];
+    if (!isJsonString(text) || text.length === 0) {
+        throw new HttpError(400, 'text is required (non-empty string)');
+    }
+    if (text.length > 4096) {
+        throw new HttpError(400, 'text exceeds 4096-character cap');
+    }
+    const contextRaw = body['context'];
+    let context;
+    if (contextRaw !== undefined && contextRaw !== null) {
+        if (!isJsonString(contextRaw)) {
+            throw new HttpError(400, 'context must be a string');
+        }
+        if (contextRaw.length > 4096) {
+            throw new HttpError(400, 'context exceeds 4096-character cap');
+        }
+        context = contextRaw;
+    }
+    const supRaw = body['supersedesDecisionId'];
+    let supersedesDecisionId;
+    if (supRaw !== undefined && supRaw !== null) {
+        if (!isJsonNumber(supRaw) || !Number.isInteger(supRaw) || supRaw <= 0) {
+            throw new HttpError(400, 'supersedesDecisionId must be a positive integer');
+        }
+        supersedesDecisionId = supRaw;
+    }
+    try {
+        const decision = saveDecision(opts.hippoRoot, ctx.tenantId, {
+            decisionText: text,
+            context,
+            supersedesDecisionId,
+        }, ctx.actor.subject);
+        sendJson(res, 201, { decision });
+    }
+    catch (e) {
+        // A missing referenced row is a conflict with the create, not a missing target.
+        if (e instanceof NotFoundError)
+            throw new HttpError(409, e.message);
+        throw e;
+    }
+    return;
+}
+export async function handleListDecisions({ req, res, opts, query }) {
+    const status = query.get('status') ?? 'all';
+    const limit = parseListLimit(query.get('limit'));
+    const after = parseCursor(query.get('cursor'), 'string', 'integer');
+    const ctx = await buildContextWithAuth(req, opts);
+    let decisions;
+    if (status === 'all') {
+        decisions = loadDecisions(opts.hippoRoot, ctx.tenantId, { limit: limit + 1, after });
+    }
+    else {
+        if (!isSetMember(VALID_DECISION_STATES, status)) {
+            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
+        }
+        decisions = loadDecisions(opts.hippoRoot, ctx.tenantId, {
+            status,
+            limit: limit + 1,
+            after,
+        });
+    }
+    const page = pageOf(decisions, limit, byCreatedAt);
+    sendJson(res, 200, { decisions: page.items, next_cursor: page.nextCursor });
+    return;
+}
+export async function handleSupersedeDecision({ req, res, opts }, decisionSupersedeMatch) {
+    const oldId = parseInt(decisionSupersedeMatch[1], 10);
+    const ctx = await buildContextWithAuth(req, opts);
+    const body = await parseJsonBody(req, ctx);
+    const text = body['text'];
+    if (!isJsonString(text) || text.length === 0) {
+        throw new HttpError(400, 'text is required (non-empty string)');
+    }
+    if (text.length > 4096) {
+        throw new HttpError(400, 'text exceeds 4096-character cap');
+    }
+    const contextRaw = body['context'];
+    let context;
+    if (contextRaw !== undefined && contextRaw !== null) {
+        if (!isJsonString(contextRaw)) {
+            throw new HttpError(400, 'context must be a string');
+        }
+        if (contextRaw.length > 4096) {
+            throw new HttpError(400, 'context exceeds 4096-character cap');
+        }
+        context = contextRaw;
+    }
+    const decision = saveDecision(opts.hippoRoot, ctx.tenantId, {
+        decisionText: text,
+        context,
+        supersedesDecisionId: oldId,
+    }, ctx.actor.subject);
+    sendJson(res, 201, { decision });
+    return;
+}
+export async function handleCloseDecision({ req, res, opts }, decisionCloseMatch) {
+    const id = parseInt(decisionCloseMatch[1], 10);
+    const ctx = await buildContextWithAuth(req, opts);
+    const decision = closeDecision(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
+    sendJson(res, 200, { decision });
+    return;
+}
+export async function handleGetDecision({ req, res, opts }, decisionByIdMatch) {
+    const id = parseInt(decisionByIdMatch[1], 10);
+    const ctx = await buildContextWithAuth(req, opts);
+    const decision = loadDecisionById(opts.hippoRoot, ctx.tenantId, id);
+    if (!decision) {
+        throw new HttpError(404, `decision ${id} not found`);
+    }
+    sendJson(res, 200, { decision });
+    return;
+}
+//# sourceMappingURL=decisions.js.map

package/dist/server/routes/incidents.d.ts

@@ -0,0 +1,7 @@
+import type { RouteRequest } from '../types.js';
+export declare function handleCreateIncident({ req, res, opts }: RouteRequest): Promise<void>;
+export declare function handleListIncidents({ req, res, opts, query }: RouteRequest): Promise<void>;
+export declare function handleResolveIncident({ req, res, opts }: RouteRequest, incidentResolveMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCloseIncident({ req, res, opts }: RouteRequest, incidentCloseMatch: RegExpMatchArray): Promise<void>;
+export declare function handleGetIncident({ req, res, opts }: RouteRequest, incidentByIdMatch: RegExpMatchArray): Promise<void>;
+//# sourceMappingURL=incidents.d.ts.map