hippo-memory 1.63.2 → 1.64.1

package/dist/api/sleep.js

@@ -1,257 +1,10 @@
 // The sleep cycle: decay, consolidation, dedupe, graph extraction and the other maintenance passes.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { loadAllEntries } from '../store/entry-reads.js';
-import { deleteEntry, memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { appendAuditEvent, reportAuditWriteFailure, auditMemories } from '../audit.js';
-import { autoShare } from '../shared.js';
-import { consolidate } from '../consolidate/sleep.js';
-import { loadConfig } from '../config.js';
-import { deduplicateStore } from '../dedupe.js';
-import { computeAmbientState } from '../ambient.js';
-import { loadPendingExtractionTenants } from '../graph/read.js';
-import { markPendingProcessedUpTo } from '../graph/write.js';
-import { extractGraph } from '../graph-extract.js';
-const DEFAULT_SLEEP_PHASES = {
-    consolidate,
-    deduplicateStore,
-    auditMemories,
-    autoShare,
-    loadAllEntries,
-    deleteEntry,
-    computeAmbientState,
-    loadConfig,
-    loadPendingExtractionTenants,
-    extractGraph,
-};
-/** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; never auto-deletes pinned, raw, kept or object-backing rows. */
+import { runSleep } from './sleep-run.js';
+/** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; SQLite only; never auto-deletes pinned, raw, kept or object-backing rows. */
 export async function sleep(ctx, opts = {}) {
-    const dryRun = Boolean(opts.dryRun);
-    // Resolve phase dependencies, allowing test-only `__phases`
-    // override to inject deterministic throws for mid-phase failure coverage.
-    const phases = { ...DEFAULT_SLEEP_PHASES, ...(opts.__phases ?? {}) };
-    // Phase counters for the consolidate audit emit (in finally).
-    // Accumulated as each phase completes so partial-failure paths still report
-    // accurate "what got done before the failure" data.
-    const counts = { consolidation: 0, dedup: 0, auditDeleted: 0, ambient: 0 };
-    let phaseError = null;
-    try {
-        return await runSleepPhases(ctx, opts, phases, counts);
-    }
-    catch (err) {
-        // SAFETY: phaseError is read via phaseError.message / (phaseError !==
-        // null) below, both safe even if a non-Error was thrown; this mirrors
-        // the existing lenient (err as Error) pattern used throughout this catch chain.
-        phaseError = err;
-        throw err;
-    }
-    finally {
-        emitSleepAudit(ctx, opts, dryRun, counts, phaseError);
-    }
-}
-async function runSleepPhases(ctx, opts, phases, counts) {
-    const dryRun = Boolean(opts.dryRun);
-    const snapshot = snapshotDirtyTenants(ctx, phases, dryRun);
-    // Phase 1: Consolidation.
-    const consolidateResult = await phases.consolidate(ctx.hippoRoot, { dryRun });
-    counts.consolidation = consolidateResult.semanticCreated + consolidateResult.merged;
-    const result = sleepResultFrom(consolidateResult, dryRun);
-    // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
-    const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject });
-    counts.dedup = dedupResult.removed;
-    if (dedupResult.removed > 0)
-        result.deduped = dedupSummary(dedupResult);
-    // Phase 3: Quality audit (remove junk, report warnings; a dry run skips rows earlier phases would remove).
-    counts.auditDeleted = runQualityAudit(ctx, phases, dryRun, consolidateResult, dedupResult, result);
-    if (dryRun)
-        return result;
-    // Phase 4: Auto-share high-transfer-score memories to global.
-    if (!opts.noShare)
-        shareOnSleep(ctx, phases, result);
-    // Phase 5: Post-sleep ambient state summary.
-    counts.ambient = summarizeAmbient(ctx, phases, result);
-    drainGraphQueue(ctx, phases, snapshot, result);
-    return result;
-}
-// Taken before any memory-deleting phase: queue rows cascade-delete with their mirror, so a later read would miss
-// tenants dedup touched. Fail-soft: a failed read skips the graph refresh this sleep and never aborts core sleep.
-function snapshotDirtyTenants(ctx, phases, dryRun) {
-    const snapshot = { dirtyTenants: [], error: null };
-    if (!dryRun) {
-        try {
-            snapshot.dirtyTenants = phases.loadPendingExtractionTenants(ctx.hippoRoot);
-        }
-        catch (snapErr) {
-            // SAFETY: this is a best-effort log message only; property access on
-            // any JS value is safe (undefined if absent), preserving the existing
-            // lenient formatting even when something non-Error was thrown.
-            snapshot.error = snapErr.message;
-        }
-    }
-    return snapshot;
-}
-function sleepResultFrom(consolidateResult, dryRun) {
-    const result = {
-        active: consolidateResult.decayed,
-        removed: consolidateResult.removed,
-        mergedEpisodic: consolidateResult.merged,
-        newSemantic: consolidateResult.semanticCreated,
-        dryRun,
-        details: consolidateResult.details,
-    };
-    // Set only when non-zero, so a store without dormant memories gets a
-    // byte-identical result (HTTP /v1/sleep, the CLI render snapshot).
-    if (consolidateResult.dormant > 0) {
-        result.dormant = consolidateResult.dormant;
-    }
-    if (consolidateResult.dormantExpired > 0) {
-        result.dormantExpired = consolidateResult.dormantExpired;
-    }
-    return result;
-}
-function dedupSummary(dedupResult) {
-    const semDups = dedupResult.pairs.filter((p) => p.keptLayer === 'semantic' && p.removedLayer === 'semantic').length;
-    const epiDups = dedupResult.pairs.filter((p) => p.keptLayer === 'episodic' && p.removedLayer === 'episodic').length;
-    const crossDups = dedupResult.pairs.filter((p) => p.keptLayer !== p.removedLayer).length;
-    return {
-        removed: dedupResult.removed,
-        semDups,
-        epiDups,
-        crossDups,
-    };
-}
-/** Returns how many audit errors were deleted, or would be under dryRun. */
-function runQualityAudit(ctx, phases, dryRun, consolidateResult, dedupResult, result) {
-    const planned = new Set(dryRun ? [...(consolidateResult.removedIds ?? []), ...dedupResult.pairs.map((p) => p.removed)] : []);
-    const allEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !planned.has(e.id));
-    const auditOut = phases.auditMemories(allEntries, memoriesBackingObjects(ctx.hippoRoot));
-    if (auditOut.issues.length === 0)
-        return 0;
-    const errors = auditOut.issues.filter((i) => i.severity === 'error');
-    const warnings = auditOut.issues.filter((i) => i.severity === 'warning');
-    let removed = 0;
-    for (const issue of errors) {
-        const reason = `sleep-audit: ${issue.reason}`;
-        if (dryRun || phases.deleteEntry(ctx.hippoRoot, issue.memoryId, { actor: ctx.actor.subject, reason, automatic: true }))
-            removed++;
-    }
-    if (removed > 0 || warnings.length > 0) {
-        result.audit = {
-            errorsRemoved: removed,
-            warningCount: warnings.length,
-        };
-    }
-    return removed;
-}
-function shareOnSleep(ctx, phases, result) {
-    const sleepConfig = phases.loadConfig(ctx.hippoRoot);
-    if (!sleepConfig.autoShareOnSleep)
-        return;
-    // Both skip counters are surfaced so the secret veto and the rejection tombstone are observable, not silent.
-    const autoShareStats = { secretSkipped: 0, rejectedSkipped: 0 };
-    const shared = phases.autoShare(ctx.hippoRoot, { minScore: 0.6, stats: autoShareStats });
-    if (shared.length > 0) {
-        result.shared = shared.length;
-    }
-    if (autoShareStats.secretSkipped > 0) {
-        result.secretSkipped = autoShareStats.secretSkipped;
-    }
-    if (autoShareStats.rejectedSkipped > 0) {
-        result.rejectedSkipped = autoShareStats.rejectedSkipped;
-    }
-}
-/** Returns the ambient total the audit row reports: 0 when ambient is off or no current row is left. */
-function summarizeAmbient(ctx, phases, result) {
-    const postSleepConfig = phases.loadConfig(ctx.hippoRoot);
-    if (!postSleepConfig.ambient.enabled)
-        return 0;
-    const postSleepEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !e.superseded_by);
-    if (postSleepEntries.length === 0)
-        return 0;
-    result.ambient = phases.computeAmbientState(postSleepEntries);
-    return result.ambient.totalMemories;
-}
-// Phase 6: rebuild the graph of every tenant marked dirty since the last sleep, so graph recall runs on fresh data.
-// Fault-isolated: consolidation has already committed, so no failure here aborts sleep; a failed tenant stays pending.
-function drainGraphQueue(ctx, phases, snapshot, result) {
-    try {
-        if (snapshot.error) {
-            // Core sleep already succeeded; surface the skipped graph refresh as a detail.
-            result.details = [
-                ...(result.details ?? []),
-                `graph: dirty-tenant snapshot failed (skipped graph refresh): ${snapshot.error}`,
-            ];
-        }
-        let gTenants = 0;
-        let gEntities = 0;
-        let gRelations = 0;
-        // dirtyTenants was snapshotted before the memory-deleting phases above.
-        for (const { tenantId, maxPendingId } of snapshot.dirtyTenants) {
-            try {
-                const ext = phases.extractGraph(ctx.hippoRoot, tenantId);
-                // Count the rebuild as soon as it succeeds — it happened regardless of
-                // the drain-mark below.
-                gTenants += 1;
-                gEntities += ext.entities;
-                gRelations += ext.relations;
-                // Watermark drain: only items enqueued before this rebuild started are marked; later arrivals stay pending.
-                markPendingProcessedUpTo(ctx.hippoRoot, tenantId, maxPendingId);
-            }
-            catch (tenantErr) {
-                // SAFETY: this is a best-effort log message only; property access
-                // on any JS value is safe (undefined if absent), preserving the
-                // existing lenient formatting even when something non-Error was thrown.
-                result.details = [
-                    ...(result.details ?? []),
-                    `graph: extract failed for a dirty tenant (left pending): ${tenantErr.message}`,
-                ];
-            }
-        }
-        if (gTenants > 0) {
-            result.graph = { tenants: gTenants, entities: gEntities, relations: gRelations };
-        }
-    }
-    catch (graphErr) {
-        // SAFETY: this is a best-effort log message only; property access on
-        // any JS value is safe (undefined if absent), preserving the existing
-        // lenient formatting even when something non-Error was thrown.
-        result.details = [
-            ...(result.details ?? []),
-            `graph: drain phase failed (skipped): ${graphErr.message}`,
-        ];
-    }
-}
-// One 'consolidate' row per sleep, emitted from finally so a partial failure still reports what got done.
-// Its own handle; an audit failure is logged and never replaces the original phase error.
-function emitSleepAudit(ctx, opts, dryRun, counts, phaseError) {
-    try {
-        const db = openHippoDb(ctx.hippoRoot);
-        try {
-            const sleepAuditMetadata = {
-                consolidationCount: counts.consolidation,
-                dedupCount: counts.dedup,
-                auditDeletedCount: counts.auditDeleted,
-                ambientTotal: counts.ambient,
-                dryRun,
-                noShare: opts.noShare ?? false,
-                partial: phaseError !== null,
-                triggeredByTenant: ctx.tenantId, // preserve for audit forensics
-            };
-            if (phaseError)
-                sleepAuditMetadata.errorMessage = phaseError.message;
-            appendAuditEvent(db, {
-                tenantId: '__host__',
-                actor: ctx.actor.subject,
-                op: 'consolidate',
-                metadata: { ...sleepAuditMetadata },
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-    }
-    catch (auditErr) {
-        // Logged, never thrown: a second failure must not mask the original phaseError.
-        reportAuditWriteFailure('consolidate', String(auditErr));
+    if (ctx.store && ctx.store.kind !== 'sqlite') {
+        throw new Error(`sleep supports only the sqlite store, not '${ctx.store.kind}'`);
     }
+    return runSleep(ctx, opts);
 }
 //# sourceMappingURL=sleep.js.map

package/dist/api/types.d.ts

@@ -1,4 +1,5 @@
 import { BadRequestError } from '../api-errors.js';
+import type { HippoStore } from '../store-port.js';
 /**
  * Actor identity + authorization role for a Context.
  *
@@ -16,11 +17,13 @@ export interface Actor {
     viaAuthResolver?: true;
     /** The host's operator (CLI, stdio MCP, keyless loopback, host-tenant admin key): may act beyond its tenant. */
     hostAdmin?: true;
+    owner?: string;
 }
 export interface Context {
     hippoRoot: string;
     tenantId: string;
     actor: Actor;
+    store?: HippoStore;
 }
 /**
  * Helper for building process-local Actor values (admin and host admin),
@@ -30,6 +33,8 @@ export interface Context {
  * buildContextWithAuth in src/server.ts.
  */
 export declare function adminActor(subject: string): Actor;
+/** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
+export declare function ownerOrSubject(actor: Actor): string;
 /**
  * Thrown by `api.recall` when a caller's options violate a recall contract
  * that has been opted into via env. Carries a stable `code` field for HTTP /

package/dist/api/types.js

@@ -10,6 +10,10 @@ import { BadRequestError } from '../api-errors.js';
 export function adminActor(subject) {
     return { subject, role: 'admin', hostAdmin: true };
 }
+/** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
+export function ownerOrSubject(actor) {
+    return actor.owner ?? actor.subject;
+}
 /**
  * Thrown by `api.recall` when a caller's options violate a recall contract
  * that has been opted into via env. Carries a stable `code` field for HTTP /

package/dist/audit-prune.js

@@ -63,7 +63,7 @@ export function pruneAuditLog(db, opts) {
         count = Number(row.c);
     }
     else {
-        db.exec('BEGIN');
+        db.exec('BEGIN IMMEDIATE');
         try {
             const result = db
                 .prepare(`DELETE FROM audit_log WHERE tenant_id = ? AND ts < ?`)

package/dist/audit.d.ts

@@ -14,12 +14,10 @@ export interface AuditResult {
     issues: AuditIssue[];
     clean: number;
 }
-export declare const STOP_WORDS: Set<string>;
 export declare function auditMemory(entry: MemoryEntry, backsObject?: boolean): AuditIssue | null;
 /** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
 export declare function auditMemories(entries: MemoryEntry[], backing: ReadonlySet<string>): AuditResult;
-export declare function isContentWorthStoring(content: string): boolean;
-export declare const AUDIT_OPS: readonly ["remember", "recall", "promote", "supersede", "forget", "archive_raw", "auth_revoke", "auth_create", "outcome", "consolidate", "audit_prune", "summary_marked_dirty", "summary_marked_clean", "summary_rebuilt", "predict_create", "predict_close", "predict_baserate", "recall_autodebias_hint", "recall_autodebias_hint_no_class_match", "recall_autodebias_hint_tiebreak", "recall_anchor_detected_query_repeat", "recall_anchor_detected_memory_dominance", "recall_anchor_skipped_no_session", "recall_availability_detected", "decision_create", "decision_supersede", "decision_close", "incident_open", "incident_resolve", "incident_close", "process_create", "process_supersede", "process_close", "policy_create", "policy_supersede", "policy_close", "skill_create", "skill_supersede", "skill_close", "project_brief_create", "project_brief_supersede", "project_brief_close", "customer_note_create", "customer_note_supersede", "customer_note_close", "mv_rescue", "reject_value", "reject_refusal", "unreject_value", "conflict_resolve", "half_life_migrate", "dormant_restore", "auth_grant", "auth_ungrant", "quarantine", "quarantine_approve", "quarantine_reject", "agent_memory_restore", "agent_memory_set_aside", "project_merge", "project_repair"];
+export declare const AUDIT_OPS: readonly ["remember", "recall", "promote", "supersede", "forget", "archive_raw", "auth_revoke", "auth_create", "outcome", "consolidate", "audit_prune", "summary_marked_dirty", "summary_marked_clean", "summary_rebuilt", "predict_create", "predict_close", "predict_baserate", "recall_autodebias_hint", "recall_autodebias_hint_no_class_match", "recall_autodebias_hint_tiebreak", "recall_anchor_detected_query_repeat", "recall_anchor_detected_memory_dominance", "recall_anchor_skipped_no_session", "recall_availability_detected", "decision_create", "decision_supersede", "decision_close", "incident_open", "incident_resolve", "incident_close", "process_create", "process_supersede", "process_close", "policy_create", "policy_supersede", "policy_close", "skill_create", "skill_supersede", "skill_close", "project_brief_create", "project_brief_supersede", "project_brief_close", "customer_note_create", "customer_note_supersede", "customer_note_close", "mv_rescue", "reject_value", "reject_refusal", "unreject_value", "conflict_resolve", "half_life_migrate", "dormant_restore", "auth_grant", "auth_ungrant", "quarantine", "quarantine_approve", "quarantine_reject", "agent_memory_restore", "agent_memory_set_aside", "project_merge", "project_repair", "quality_repair"];
 export type AuditOp = (typeof AUDIT_OPS)[number];
 export interface AppendAuditOpts {
     tenantId: string;

package/dist/audit.js

@@ -2,94 +2,7 @@ import { createHash } from 'node:crypto';
 import { canAutoDelete } from './memory.js';
 import { log } from './log.js';
 import { keysetAfter } from './keyset.js';
-export const STOP_WORDS = new Set([
-    'the', 'a', 'an', 'is', 'was', 'are', 'were', 'be', 'been', 'being',
-    'to', 'of', 'in', 'for', 'on', 'with', 'at', 'by', 'from', 'it',
-    'this', 'that', 'and', 'or', 'but', 'not', 'no', 'so', 'if', 'do',
-    'did', 'does', 'has', 'had', 'have', 'will', 'would', 'could', 'should',
-    'may', 'might', 'can', 'shall', 'we', 'i', 'you', 'they', 'he', 'she',
-    'my', 'our', 'your', 'its', 'his', 'her', 'their', 'up', 'out', 'just',
-    'also', 'then', 'than', 'some', 'all', 'any', 'each', 'very', 'too',
-]);
-const VAGUE_ONLY = /^[\w\s,.'"-]+$/;
-// Han, Hiragana and Katakana carry no whitespace word boundaries, so a plain
-// \s+ split scores
-// an entire sentence as one "word" and the gate rejects real sentences as junk.
-// CJK words average ~2 characters, so approximate substantive units as one per
-// 2 CJK LETTERS.
-//
-// Two properties this must hold:
-//  1. Letters only, enforced by construction: a Katakana BLOCK range counts the
-//     middle dot and prolonged sound mark, and `\p{Script=Han}` alone counts
-//     Han NON-letters (Kangxi radicals), so the `(?=\p{L})` lookahead makes
-//     "letters only" true by definition; tests/df3-cjk-quality-floor.test.ts sweeps it.
-//
-// SCOPE, stated precisely because the constant name says "CJK": this covers
-// Han, Hiragana and Katakana only. Hangul is absent (Korean largely survives
-// the whitespace split already) and other spaceless scripts - Thai, Khmer,
-// Burmese, Lao - still hit the original one-word failure.
-//  2. ADD to the latin count, never strip before it. Stripping CJK first can
-//     REDUCE the count for short mixed tokens (`UI<han> DB<han> QA<han>` leaves
-//     three 2-char latin fragments that fail the `> 2` filter), which would
-//     reject content this gate previously accepted and make capture silently
-//     drop it. Adding keeps the change strictly more permissive - the property
-//     that makes it safe in a predicate shared with capture's write gate.
-const CJK_LETTERS = /(?=\p{L})(?:\p{Script=Han}|\p{Script=Hiragana}|\p{Script=Katakana})/gu;
-function substantiveWordCount(text) {
-    const cjkLetterCount = (text.match(CJK_LETTERS) ?? []).length;
-    const latinWordCount = text
-        .toLowerCase()
-        .split(/\s+/)
-        .filter(w => w.length > 2 && !STOP_WORDS.has(w))
-        .length;
-    return latinWordCount + Math.floor(cjkLetterCount / 2);
-}
-function isVersionBump(text) {
-    const t = text.trim();
-    // release/bump/prep/tag + version
-    if (/^(?:bump|release|prep|tag)\s+(?:to\s+)?v?\d+\.\d+/i.test(t))
-        return true;
-    // bare semver ("0.24.1", "v1.2.3")
-    if (/^v?\d+\.\d+\.\d+\s*$/i.test(t))
-        return true;
-    // chore: release 1.2.3 / chore(ci): bump v1.2.3
-    if (/^chore(?:\([^)]+\))?:\s*(?:release|bump|version|tag|prep)\b/i.test(t))
-        return true;
-    // Merge commits
-    if (/^(?:Merge branch|Merge pull request)\b/i.test(t))
-        return true;
-    // WIP sentinels
-    if (/^WIP\b/i.test(t))
-        return true;
-    return false;
-}
-function isFragment(text) {
-    const trimmed = text.trim();
-    if (trimmed.startsWith('to ') && trimmed.length < 50)
-        return true;
-    if (trimmed.startsWith('for ') && trimmed.length < 50)
-        return true;
-    if (trimmed.startsWith('and ') && trimmed.length < 50)
-        return true;
-    return false;
-}
-function hasNoSpecificity(text) {
-    const words = text.toLowerCase().split(/\s+/);
-    const hasNumber = /\d/.test(text);
-    const hasProperNoun = /[A-Z][a-z]{2,}/.test(text);
-    // An ACRONYM is specificity too: the proper-noun pattern needs lowercase after the capital, so
-    // "PR", "CI", "DB", "API", "S3" (the densest domain tokens in a technical memory) all read as vague.
-    // It counts only against ordinary prose (the lowercase test), else a shouted phrase bypasses the gate,
-    // and CHAT acronyms never count: the gate is shared, so "LGTM ship it" would reach recent-context slots.
-    const CHAT_ACRONYMS = /^(?:TODO|FYI|LGTM|IIRC|IMO|IMHO|FWIW|TBD|BTW|ASAP|AFAIK|WIP|NB|PS)$/;
-    const domainAcronyms = (text.match(/\b[A-Z]{2,6}\b/g) ?? []).filter(a => !CHAT_ACRONYMS.test(a));
-    const hasAcronym = domainAcronyms.length > 0 && /[a-z]/.test(text);
-    const hasPath = /[/\\.]/.test(text);
-    const hasCode = /[`_{}()\[\]]/.test(text);
-    if (hasNumber || hasProperNoun || hasPath || hasCode || hasAcronym)
-        return false;
-    return words.length < 8 && VAGUE_ONLY.test(text);
-}
+import { automaticDefect, hasNoSpecificity, isFragment, isReleaseCommitNoise, substantiveWordCount, } from './memory-quality.js';
 export function auditMemory(entry, backsObject = false) {
     const issue = classifyMemory(entry);
     // Error means "auto-remove"; a pinned, raw, kept-for-good or object-backing row is never auto-removed, so it can only warn.
@@ -107,7 +20,7 @@ function classifyMemory(entry) {
     if (content.length < 10) {
         return { memoryId: entry.id, content, severity: 'error', reason: 'too short (< 10 chars)' };
     }
-    if (isVersionBump(content)) {
+    if (isReleaseCommitNoise(content)) {
         return { memoryId: entry.id, content, severity: 'error', reason: 'release/commit noise, not a useful memory' };
     }
     if (isFragment(content)) {
@@ -120,6 +33,10 @@ function classifyMemory(entry) {
     if (content.length < 40 && hasNoSpecificity(content)) {
         return { memoryId: entry.id, content, severity: 'warning', reason: 'no specific details (names, paths, numbers, code)' };
     }
+    const reason = automaticDefect(entry);
+    if (reason !== null) {
+        return { memoryId: entry.id, content, severity: 'warning', reason: `automatic memory defect: ${reason}` };
+    }
     return null;
 }
 /** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
@@ -136,20 +53,6 @@ export function auditMemories(entries, backing) {
         clean: entries.length - issues.length,
     };
 }
-export function isContentWorthStoring(content) {
-    const trimmed = content.trim();
-    if (trimmed.length < 10)
-        return false;
-    if (isVersionBump(trimmed))
-        return false;
-    if (isFragment(trimmed))
-        return false;
-    if (substantiveWordCount(trimmed) < 2)
-        return false;
-    if (trimmed.length < 40 && hasNoSpecificity(trimmed))
-        return false;
-    return true;
-}
 // ---------------------------------------------------------------------------
 // Audit log primitives (append-only mutation trail)
 // ---------------------------------------------------------------------------
@@ -216,6 +119,7 @@ export const AUDIT_OPS = [
     'agent_memory_set_aside', // emitted by the agent memory sync when a note is deleted or refused
     'project_merge', // emitted by `hippo projects merge --apply` with every id it touched
     'project_repair', // emitted by `hippo projects repair --apply` with every id it touched
+    'quality_repair', // emitted by `hippo audit repair --apply` for each memory it moved to dormant storage
 ];
 function isBigIntValue(value) {
     return typeof value === 'bigint';

package/dist/auth.d.ts

@@ -1,5 +1,6 @@
-import { type DatabaseSyncLike } from './db.js';
+import type { DatabaseSyncLike } from './db.js';
 import { type KeysetPosition } from './keyset.js';
+import type { HippoStore } from './store-port.js';
 /** Every minted API key starts with this, so the server can route a bearer token by shape. */
 export declare const API_KEY_PREFIX = "hk_";
 /** Counts since process start, so a flood of bad tokens shows as scrypt work, not just as 401s. */
@@ -13,6 +14,10 @@ export interface CreateApiKeyOpts {
     label?: string;
     /** 'admin' | 'member'. Defaults to 'admin' (backward-compat for callers that don't specify). */
     role?: 'admin' | 'member';
+    /** The auth-resolver subject a self-service key belongs to; unset for keys an admin or the CLI mints. */
+    ownerSubject?: string;
+    /** ISO time the key stops working; unset means it never expires. */
+    expiresAt?: string;
 }
 export interface CreateApiKeyResult {
     keyId: string;
@@ -34,6 +39,27 @@ export interface VerifiedApiKey {
     keyId: string;
     role: 'admin' | 'member';
     scopes: string[];
+    ownerSubject?: string | null;
+}
+/** One api_keys row and its scope grants as a store returns it, revoked or not; the core checks the secret, the role and the expiry. */
+export interface ApiKeyRecord {
+    keyHash: string;
+    tenantId: string;
+    revokedAt: string | null;
+    role: string;
+    scopes: string[];
+    /** ISO time the key stops working; null when it never expires. */
+    expiresAt: string | null;
+    /** Who minted the key; optional because a store that omits it fails safe to an unowned key. */
+    ownerSubject?: string | null;
+}
+/** The api_keys row for `keyId` with its scope grants; null when no row matches. */
+export declare function readApiKeyRecord(db: DatabaseSyncLike, keyId: string): ApiKeyRecord | null;
+/** A key that passed every check, with the time it stops working so a cache entry never outlives it. */
+export interface CheckedApiKey {
+    key: VerifiedApiKey;
+    expiresAtMs: number;
+    keyHash: string;
 }
 export declare function validateApiKey(db: DatabaseSyncLike, plaintext: string): ValidateResult;
 /** How long a verified key is trusted without a store read; also the ceiling on a revoke made by another process. */
@@ -43,14 +69,21 @@ export declare class VerifiedKeyCache {
     private readonly capacity;
     private readonly ttlMs;
     private readonly entries;
+    private deletes;
     constructor(capacity: number, ttlMs: number);
     get size(): number;
+    /** Moves on every delete, so a store read that straddled a revoke or grant is not cached. */
+    get epoch(): number;
+    /** The entry this exact token was verified into, fresh or lapsed. */
+    private match;
     get(hippoRoot: string, keyId: string, plaintext: string, now: number): VerifiedApiKey | undefined;
-    set(hippoRoot: string, keyId: string, plaintext: string, key: VerifiedApiKey, now: number): void;
+    /** The key hash this exact token was last verified against, kept past the TTL so a re-check can skip scrypt. */
+    verifiedHash(hippoRoot: string, keyId: string, plaintext: string): string | undefined;
+    set(hippoRoot: string, keyId: string, plaintext: string, found: CheckedApiKey, now: number): void;
     delete(keyId: string): void;
 }
-/** Verify a bearer API key for `hippoRoot`; a cache hit skips both scrypt and the DB open. Null when invalid. */
-export declare function verifyApiKeyCached(hippoRoot: string, plaintext: string): VerifiedApiKey | null;
+/** Verify a bearer API key against `store`, served at `hippoRoot`; a cache hit skips both scrypt and the store. Null when invalid. A token whose cache entry lapsed re-reads its record without scrypt; a throw from `beforeScrypt` refuses before scrypt runs. */
+export declare function verifyApiKeyCached(hippoRoot: string, plaintext: string, store: HippoStore, beforeScrypt?: () => void): Promise<VerifiedApiKey | null>;
 export declare function revokeApiKey(db: DatabaseSyncLike, keyId: string): void;
 /** Grant `keyId` read access to one restricted `scope`. Idempotent. */
 export declare function grantScope(db: DatabaseSyncLike, keyId: string, scope: string): void;
@@ -71,11 +104,20 @@ export interface ApiKeyListItem {
     role: 'admin' | 'member';
     /** Restricted scopes this key may read. */
     scopes: string[];
+    /** ISO time the key stops working; null when it never expires. */
+    expiresAt: string | null;
+    /** The auth-resolver subject that minted this key for itself; null for keys an admin or the CLI minted. */
+    ownerSubject: string | null;
 }
 export interface ListApiKeysOpts {
+    /** Only keys that still work: unrevoked and unexpired. */
     active: boolean;
     /** Only this tenant's keys; omit for every tenant (the CLI's single-tenant view). */
     tenantId?: string;
+    /** Only keys minted by this auth-resolver subject. */
+    ownerSubject?: string;
+    /** Only this one key. */
+    keyId?: string;
     /** Resume after this row: the position the previous page ended on (key and id are both the row id). */
     after?: KeysetPosition;
     limit?: number;
@@ -88,4 +130,6 @@ export interface ApiKeyListRow {
 /** Keys newest first, with their row ids, filtered and limited in SQL. */
 export declare function listApiKeyRows(db: DatabaseSyncLike, opts: ListApiKeysOpts): ApiKeyListRow[];
 export declare function listApiKeys(db: DatabaseSyncLike, opts: ListApiKeysOpts): ApiKeyListItem[];
+/** Ids of the unrevoked, unexpired keys `ownerSubject` minted in `tenantId`, oldest first. */
+export declare function listLiveOwnedKeyIds(db: DatabaseSyncLike, tenantId: string, ownerSubject: string, now: number): string[];
 //# sourceMappingURL=auth.d.ts.map