hippo-memory 1.68.0 → 1.70.0

package/dist/api/assemble.js

@@ -1,8 +1,10 @@
 // Session context assembly under a token budget.
-import { loadEntriesByIds, loadSessionRawMemories, countSessionRawMemories } from '../store/entry-reads.js';
-import { estimateTokens } from '../token-ledger.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../recall-scope.js';
-import { classifyOriginProject, projectNames } from '../project-identity.js';
+import { requireGroup, storeFor } from '../store/index.js';
+import { estimateTokens } from '../util/token-text.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { classifyOriginProject, projectNames } from '../core/project-identity.js';
+const DEFAULT_FRESH_TAIL_COUNT = 10;
+const DEFAULT_ROW_CAP = 5000;
 export const DEFAULT_ASSEMBLE_BUDGET = 4000;
 /**
  * Build a chronologically-ordered context window for a session. Adapts the
@@ -26,30 +28,16 @@ export const DEFAULT_ASSEMBLE_BUDGET = 4000;
  *   - no raws exist for the session
  *   - all rows fail the scope/tenant filter
  */
-export function assemble(ctx, sessionId, opts = {}) {
+export async function assemble(ctx, sessionId, opts = {}) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
     const budget = opts.budget ?? DEFAULT_ASSEMBLE_BUDGET;
-    const freshTailCount = opts.freshTailCount ?? 10;
+    const freshTailCount = opts.freshTailCount ?? DEFAULT_FRESH_TAIL_COUNT;
     const summarizeOlder = opts.summarizeOlder ?? true;
-    const rowCap = opts.rowCap ?? 5000;
     const own = personalScopeOf(ctx.actor) ?? undefined;
     if (!sessionId) {
         return { sessionId, items: [], tokens: 0, totalRaw: 0, summarized: 0, evicted: 0, truncated: false };
     }
-    const origins = opts.project ? projectNames(opts.project) : undefined;
-    const rows = loadSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, rowCap, origins);
-    const truncated = rows.length === rowCap;
-    // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
-    const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope, own));
-    let totalRaw;
-    if (truncated) {
-        // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
-        // caller cannot infer private rows by comparing totalRaw to items.length.
-        totalRaw = countSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, opts.scope, own, origins);
-    }
-    else {
-        totalRaw = scoped.length;
-    }
+    const { scoped, totalRaw, truncated } = await loadScopedRaws(ctx, sessionId, opts, own);
     if (scoped.length === 0) {
         return { sessionId, items: [], tokens: 0, totalRaw, summarized: 0, evicted: 0, truncated };
     }
@@ -59,17 +47,11 @@ export function assemble(ctx, sessionId, opts = {}) {
     const tailRows = scoped.slice(tailStartIdx);
     // Substitute parent summaries for older rows that share one.
     const { olderItems, summarized } = summarizeOlder && olderRows.length > 0
-        ? substituteSummaries(ctx, olderRows, opts.scope, own, opts.project)
+        ? await substituteSummaries(ctx, olderRows, opts.scope, own, opts.project)
         : { olderItems: olderRows.map(rawItem), summarized: 0 };
-    const tailItems = tailRows.map((r) => ({
-        id: r.id,
-        content: r.content,
-        createdAt: r.created,
-        isFreshTail: true,
-        strength: r.strength,
-    }));
+    const tailItems = tailRows.map(freshTailItem);
     // Byte compare is chronological for the fixed-form UTC ISO timestamps
-    // (invariant documented in src/memory.ts above MemoryEntry).
+    // (invariant documented in src/core/memory.ts above MemoryEntry).
     const cmpIso = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
     olderItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
     tailItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
@@ -78,6 +60,25 @@ export function assemble(ctx, sessionId, opts = {}) {
     const { items, tokens, evicted } = evictToBudget([...olderItems, ...tailItems], itemCost, room);
     return { sessionId, items, tokens, totalRaw, summarized, evicted, truncated };
 }
+async function loadScopedRaws(ctx, sessionId, opts, own) {
+    const rowCap = opts.rowCap ?? DEFAULT_ROW_CAP;
+    const origins = opts.project ? projectNames(opts.project) : undefined;
+    const dag = requireGroup(storeFor(ctx), 'dagReads');
+    const rows = await dag.sessionRawEntries({ tenantId: ctx.tenantId, sessionId, cap: rowCap, origins });
+    const truncated = rows.length === rowCap;
+    // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
+    const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope, own));
+    let totalRaw;
+    if (truncated) {
+        // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
+        // caller cannot infer private rows by comparing totalRaw to items.length.
+        totalRaw = await dag.sessionRawCount({ tenantId: ctx.tenantId, sessionId, scope: opts.scope, ownScope: own, origins });
+    }
+    else {
+        totalRaw = scoped.length;
+    }
+    return { scoped, totalRaw, truncated };
+}
 function rawItem(r) {
     return {
         id: r.id,
@@ -86,7 +87,16 @@ function rawItem(r) {
         strength: r.strength,
     };
 }
-function substituteSummaries(ctx, olderRows, scope, own, project) {
+function freshTailItem(r) {
+    return {
+        id: r.id,
+        content: r.content,
+        createdAt: r.created,
+        isFreshTail: true,
+        strength: r.strength,
+    };
+}
+async function substituteSummaries(ctx, olderRows, scope, own, project) {
     const olderItems = [];
     let summarized = 0;
     const olderByParent = new Map();
@@ -99,7 +109,7 @@ function substituteSummaries(ctx, olderRows, scope, own, project) {
     }
     const eligibleParentIds = Array.from(olderByParent.keys()).filter((pid) => (olderByParent.get(pid)?.length ?? 0) >= 2);
     const parents = eligibleParentIds.length > 0
-        ? loadEntriesByIds(ctx.hippoRoot, eligibleParentIds, ctx.tenantId)
+        ? (await storeFor(ctx).entriesByIds(eligibleParentIds, ctx.tenantId))
             .filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by)
             .filter((p) => passesScopeFilterForRecall(p.scope ?? null, scope, own))
             .filter((p) => !project || classifyOriginProject(p.origin_project, project) !== 'cross-project')

package/dist/api/audit.d.ts

@@ -1,5 +1,5 @@
-import { type AuditEvent, type AuditOp } from '../audit.js';
-import type { KeysetPosition } from '../keyset.js';
+import type { AuditEvent, AuditOp } from '../store/audit.js';
+import type { KeysetPosition } from '../util/keyset.js';
 import type { Context } from './types.js';
 export interface AuditListOpts {
     op?: AuditOp;
@@ -9,9 +9,6 @@ export interface AuditListOpts {
     /** Resume after this row: the (ts, id) position the previous page ended on. */
     after?: KeysetPosition;
 }
-/**
- * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
- * cmdAuditList, which does not record a 'recall'-style read event).
- */
-export declare function auditList(ctx: Context, opts: AuditListOpts): AuditEvent[];
+/** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
+export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<AuditEvent[]>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -1,23 +1,9 @@
 // Audit log queries.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { queryAuditEvents } from '../audit.js';
-/**
- * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
- * cmdAuditList, which does not record a 'recall'-style read event).
- */
-export function auditList(ctx, opts) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return queryAuditEvents(db, {
-            tenantId: ctx.tenantId,
-            op: opts.op,
-            since: opts.since,
-            limit: opts.limit,
-            after: opts.after,
-        });
-    }
-    finally {
-        closeHippoDb(db);
-    }
+import { requireGroup, storeFor } from '../store/index.js';
+/** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
+export async function auditList(ctx, opts) {
+    return requireGroup(storeFor(ctx), 'auditLog').listAuditEvents({
+        tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
+    });
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/auth.d.ts

@@ -1,5 +1,5 @@
-import { type ApiKeyListItem, type ApiKeyListRow } from '../auth.js';
-import type { KeysetPosition } from '../keyset.js';
+import { type ApiKeyListRow } from '../store/auth.js';
+import type { KeysetPosition } from '../util/keyset.js';
 import type { Context, StoreReply } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
@@ -41,27 +41,14 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
     /** ISO time the key stops working. */
     expiresAt: string;
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together.
- *  With `ctx.store`, its keyWrites group runs that transaction; hippo.db is opened only when there is no store. */
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
 export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
-/**
- * List API keys visible to the calling tenant.
- *
- * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
- * regardless of tenant (single-tenant deployments). The API surface is tenant-
- * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only, so no audit emit.
- */
-export declare function authList<C extends Context>(ctx: C, opts: {
-    active: boolean;
-}): StoreReply<C, ApiKeyListItem[]>;
 type KeyListOpts = {
     active: boolean;
     limit?: number;
     after?: KeysetPosition;
 };
-/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from.
- *  With `ctx.store`, its keyWrites group reads them; hippo.db is opened only when there is no store. */
+/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
 export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
 export interface AuthRevokeResult {
     ok: true;
@@ -69,7 +56,7 @@ export interface AuthRevokeResult {
 }
 export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>;
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
- *  With `ctx.store`, its keyAudit group revokes and writes the auth_revoke row; hippo.db is opened only when there is no store. */
+ *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
 export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
 /**
  * The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,

package/dist/api/auth.js

@@ -1,13 +1,10 @@
 // API key management: create, list, revoke, and grant or ungrant restricted scopes.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../api-errors.js';
-import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { forgetVerifiedKey, insertApiKey, listApiKeyRows, mintApiKey, revokeApiKey, grantScope, ungrantScope, } from '../auth.js';
-import { DAY_MS } from '../dashboard-snapshot.js';
-import { isRestrictedScope } from '../recall-scope.js';
-import { requireGroup } from '../store-port.js';
-import { createAuditOf, createKeyAt, createSelfKeyAt } from '../store/key-writes.js';
-import { selectApiKeyOwner } from '../store/tenant-lookup.js';
+import { ForbiddenError, NotFoundError } from '../core/api-errors.js';
+import { mintApiKey, } from '../store/auth.js';
+import { changeScopeGrant } from '../store/sqlite/local.js';
+import { sqliteSyncStore } from '../store/sqlite/store.js';
+import { DAY_MS } from '../util/time.js';
+import { andThen, notPorted, onStore } from './on-store.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
 function keyIdOfSubject(subject) {
@@ -25,10 +22,12 @@ function keyIdOfSubject(subject) {
  * outranks its minter: a resolver admin is tenant-only, so it mints members.
  */
 export function authCreate(ctx, opts) {
-    // With a store, its keyWrites group stores the key and its auth_create row together, and hippo.db is never opened.
-    const reply = ctx.store ? createThroughStore(ctx, ctx.store, opts) : createOnHippoDb(ctx, opts);
-    // SAFETY: as in authRevoke, a C typed with a store gets the promise its path returns and a C that hides one gets the union.
-    return reply;
+    // The key and its auth_create row commit together on either store, so a failed audit write leaves no key.
+    return onStore(ctx, (port) => {
+        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
+        const { plaintext, mint } = adminKeyMint(ctx, opts);
+        return andThen(keyWrites.createApiKey(mint), () => createResult(mint, plaintext));
+    });
 }
 /** A key row in the caller's tenant, made here so only its hash ever reaches a store. */
 function newKey(ctx, fields) {
@@ -51,35 +50,6 @@ function adminKeyMint(ctx, opts) {
 function createResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: key.role };
 }
-async function createThroughStore(ctx, store, opts) {
-    const keyWrites = requireGroup(store, 'keyWrites');
-    const { plaintext, mint } = adminKeyMint(ctx, opts);
-    await keyWrites.createApiKey(mint);
-    return createResult(mint, plaintext);
-}
-function createOnHippoDb(ctx, opts) {
-    const { plaintext, mint } = adminKeyMint(ctx, opts);
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        // A resolver admin's keys are found again only through their audit rows, so the key and its row commit together.
-        if (ctx.actor.viaAuthResolver) {
-            createKeyAt(db, mint);
-            return createResult(mint, plaintext);
-        }
-        insertApiKey(db, mint.key);
-        try {
-            appendAuditEvent(db, createAuditOf(mint));
-        }
-        catch (error) {
-            // Audit must not crash a successful mint.
-            reportAuditWriteFailure('auth_create', String(error), mint.key.keyId);
-        }
-        return createResult(mint, plaintext);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 const MAX_TTL_DAYS = 3650;
 /** A RangeError, not a 4xx, since the operator's config sets these; the ttl ceiling keeps toISOString in range and a departed user's key short-lived. */
 function assertSelfMintOpts({ ttlDays, perSubject }) {
@@ -90,12 +60,13 @@ function assertSelfMintOpts({ ttlDays, perSubject }) {
         throw new RangeError(`authCreateSelf: perSubject must be a whole number of at least 1, got ${String(perSubject)}`);
     }
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together.
- *  With `ctx.store`, its keyWrites group runs that transaction; hippo.db is opened only when there is no store. */
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
 export function authCreateSelf(ctx, opts) {
-    const reply = ctx.store ? createSelfThroughStore(ctx, ctx.store, opts) : createSelfOnHippoDb(ctx, opts);
-    // SAFETY: as in authRevoke, a C typed with a store gets the promise its path returns and a C that hides one gets the union.
-    return reply;
+    return onStore(ctx, (port) => {
+        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
+        const { plaintext, mint } = selfKeyMint(ctx, opts);
+        return andThen(keyWrites.createSelfApiKey(mint), () => selfResult(mint, plaintext));
+    });
 }
 function selfKeyMint(ctx, opts) {
     if (!ctx.actor.viaAuthResolver) {
@@ -113,64 +84,17 @@ function selfKeyMint(ctx, opts) {
 function selfResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: 'member', expiresAt: key.expiresAt };
 }
-/** The store revokes the replaced keys without this process's verified-key cache, so they leave it here once the mint commits. */
-async function createSelfThroughStore(ctx, store, opts) {
-    const keyWrites = requireGroup(store, 'keyWrites');
-    const { plaintext, mint } = selfKeyMint(ctx, opts);
-    for (const keyId of await keyWrites.createSelfApiKey(mint))
-        forgetVerifiedKey(keyId);
-    return selfResult(mint, plaintext);
-}
-function createSelfOnHippoDb(ctx, opts) {
-    const { plaintext, mint } = selfKeyMint(ctx, opts);
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        createSelfKeyAt(db, mint);
-        return selfResult(mint, plaintext);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * List API keys visible to the calling tenant.
- *
- * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
- * regardless of tenant (single-tenant deployments). The API surface is tenant-
- * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only, so no audit emit.
- */
-export function authList(ctx, opts) {
-    const keysOf = (rows) => rows.map((r) => r.key);
-    const rows = listRows(ctx, opts);
-    // SAFETY: the promise comes back exactly when ctx has a store, as StoreReply says.
-    return (rows instanceof Promise ? rows.then(keysOf) : keysOf(rows));
-}
-/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from.
- *  With `ctx.store`, its keyWrites group reads them; hippo.db is opened only when there is no store. */
+/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
 export function authListRows(ctx, opts) {
-    // SAFETY: the promise comes back exactly when ctx has a store, as StoreReply says.
-    return listRows(ctx, opts);
+    return onStore(ctx, (port) => listRows(ctx, port, opts));
 }
-function listRows(ctx, opts) {
-    return ctx.store ? listThroughStore(ctx, ctx.store, opts) : listOnHippoDb(ctx, opts);
-}
-async function listThroughStore(ctx, store, opts) {
-    const keyWrites = requireGroup(store, 'keyWrites');
+function listRows(ctx, port, opts) {
+    const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
     const keyId = memberKeyIdOf(ctx.actor);
-    const filter = memberListFilter(ctx.actor, keyId === null ? undefined : (await store.findApiKey(keyId))?.ownerSubject);
-    return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
-}
-function listOnHippoDb(ctx, opts) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        const keyId = memberKeyIdOf(ctx.actor);
-        const filter = memberListFilter(ctx.actor, keyId === null ? undefined : selectApiKeyOwner(db, keyId)?.ownerSubject);
-        return filter === null ? [] : listApiKeyRows(db, { ...opts, tenantId: ctx.tenantId, ...filter });
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return andThen(keyId === null ? undefined : port.findApiKey(keyId), (record) => {
+        const filter = memberListFilter(ctx.actor, record?.ownerSubject);
+        return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
+    });
 }
 /** The key id of a member API key caller, whose owner decides what it lists; null for any other caller. */
 function memberKeyIdOf(actor) {
@@ -202,12 +126,17 @@ function assertMayRevoke(ctx, keyId, row) {
     }
 }
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
- *  With `ctx.store`, its keyAudit group revokes and writes the auth_revoke row; hippo.db is opened only when there is no store. */
+ *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
 export function authRevoke(ctx, keyId) {
-    const reply = ctx.store ? revokeThroughStore(ctx, ctx.store, keyId) : revokeOnHippoDb(ctx, keyId);
-    // SAFETY: a C typed with a store gets the promise its path returns; a C whose type hides a runtime store (a Pick of
-    // Context) is typed as the union, which a caller has to await anyway.
-    return reply;
+    return onStore(ctx, (port) => {
+        const keyAudit = port.keyAudit ?? notPorted(port, 'keyAudit');
+        assertMemberKeyRevokesSelf(ctx, keyId);
+        return andThen(port.findApiKey(keyId), (record) => {
+            assertMayRevoke(ctx, keyId, keyOwnerOf(record));
+            const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
+            return andThen(keyAudit.revokeApiKey(revoke), (revokedAt) => ({ ok: true, revokedAt }));
+        });
+    });
 }
 function assertMemberKeyRevokesSelf(ctx, keyId) {
     if (ctx.actor.role !== 'admin' && !ctx.actor.viaAuthResolver && keyIdOfSubject(ctx.actor.subject) !== keyId) {
@@ -217,52 +146,6 @@ function assertMemberKeyRevokesSelf(ctx, keyId) {
 function keyOwnerOf(record) {
     return record ? { tenantId: record.tenantId, revokedAt: record.revokedAt, role: record.role, ownerSubject: record.ownerSubject ?? null } : undefined;
 }
-/** The store keeps no handle on this process's verified-key cache, so the key leaves it here once the revoke commits. */
-async function revokeThroughStore(ctx, store, keyId) {
-    const keyAudit = requireGroup(store, 'keyAudit');
-    assertMemberKeyRevokesSelf(ctx, keyId);
-    assertMayRevoke(ctx, keyId, keyOwnerOf(await store.findApiKey(keyId)));
-    const revokedAt = await keyAudit.revokeApiKey({ tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() });
-    forgetVerifiedKey(keyId);
-    return { ok: true, revokedAt };
-}
-/** The auth_revoke row carries the KEY ROW's tenant, as cmdAuthRevoke does, and is skipped for an already-revoked key. */
-function revokeOnHippoDb(ctx, keyId) {
-    assertMemberKeyRevokesSelf(ctx, keyId);
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        const row = selectApiKeyOwner(db, keyId);
-        assertMayRevoke(ctx, keyId, row);
-        let revokedAt;
-        let alreadyRevoked = false;
-        if (row.revokedAt) {
-            alreadyRevoked = true;
-            revokedAt = row.revokedAt;
-        }
-        else {
-            revokeApiKey(db, keyId);
-            revokedAt = selectApiKeyOwner(db, keyId)?.revokedAt ?? new Date().toISOString();
-        }
-        if (!alreadyRevoked) {
-            try {
-                appendAuditEvent(db, {
-                    tenantId: row.tenantId, // KEY's tenant, not ctx.tenantId.
-                    actor: ctx.actor.subject,
-                    op: 'auth_revoke',
-                    targetId: keyId,
-                });
-            }
-            catch (error) {
-                // Audit must not crash a successful revoke.
-                reportAuditWriteFailure('auth_revoke', String(error), keyId);
-            }
-        }
-        return { ok: true, revokedAt };
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 /**
  * The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant.
@@ -271,56 +154,23 @@ export function authKeyTenant(ctx, keyId) {
     if (!ctx.actor.hostAdmin) {
         throw new ForbiddenError('Only the host admin can look up a key across tenants');
     }
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return selectApiKeyOwner(db, keyId)?.tenantId;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    // Synchronous for the CLI, so it reads hippo.db whatever store ctx names.
+    return sqliteSyncStore(ctx.hippoRoot).findApiKey(keyId)?.tenantId;
 }
 /** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export function authGrant(ctx, keyId, scope) {
-    return changeScopeGrant(ctx, keyId, scope, 'auth_grant');
+    return changeGrant(ctx, keyId, scope, 'auth_grant');
 }
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export function authUngrant(ctx, keyId, scope) {
-    return changeScopeGrant(ctx, keyId, scope, 'auth_ungrant');
+    return changeGrant(ctx, keyId, scope, 'auth_ungrant');
 }
-function changeScopeGrant(ctx, keyId, scope, op) {
+/** hippo.db only: both callers are synchronous published functions, so no store's Promise can answer them. */
+function changeGrant(ctx, keyId, scope, op) {
     if (ctx.actor.role !== 'admin') {
         throw new ForbiddenError('Only an admin key can change scope grants');
     }
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        const row = selectApiKeyOwner(db, keyId);
-        if (!row || row.tenantId !== ctx.tenantId) {
-            throw new NotFoundError(`Unknown key_id: ${keyId}`);
-        }
-        if (op === 'auth_grant' && row.revokedAt) {
-            throw new ConflictError(`${keyId} is revoked; a grant on it would never apply`);
-        }
-        if (op === 'auth_grant' && /^personal:/i.test(scope)) {
-            throw new BadRequestError(`${scope} is a personal scope: only its owner reads it, and no grant can change that`);
-        }
-        if (!isRestrictedScope(scope)) {
-            throw new BadRequestError(`${scope} is not a restricted scope; it is already readable by default`);
-        }
-        if (op === 'auth_grant')
-            grantScope(db, keyId, scope);
-        else
-            ungrantScope(db, keyId, scope);
-        try {
-            appendAuditEvent(db, { tenantId: ctx.tenantId, actor: ctx.actor.subject, op, targetId: keyId, metadata: { scope } });
-        }
-        catch (err) {
-            // Audit must not undo a grant change that already committed; surface it instead.
-            reportAuditWriteFailure(op, String(err), keyId);
-        }
-        return { ok: true };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    changeScopeGrant(ctx.hippoRoot, { tenantId: ctx.tenantId, keyId, scope, op, actor: ctx.actor.subject });
+    return { ok: true };
 }
 //# sourceMappingURL=auth.js.map

package/dist/api/auto-sleep.d.ts

@@ -0,0 +1,13 @@
+import type { HippoConfig } from '../core/config.js';
+export declare const autoSleepInFlight: Set<string>;
+export interface AutoSleepDue {
+    enabled: boolean;
+    count: number;
+    threshold: number;
+    due: boolean;
+}
+/** Counts only when enabled: the count opens the store. */
+export declare function autoSleepDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep']): AutoSleepDue;
+/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it. */
+export declare function startAutoSleepIfDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep'], allowed: boolean): void;
+//# sourceMappingURL=auto-sleep.d.ts.map

package/dist/api/auto-sleep.js

@@ -0,0 +1,32 @@
+// When a write starts a background sleep; the MCP remember tool and the session-close hook share it.
+import { errorMessage, log } from '../util/log.js';
+import { countCreatedSinceLastSleep } from '../store/index-and-stats.js';
+import { consolidate } from '../consolidate/sleep.js';
+import { outsideRequestStores, runWithRequestStores, scopedBusyWait } from '../db/index.js';
+import { resolveTenantId } from '../store/tenant.js';
+export const autoSleepInFlight = new Set();
+/** Counts only when enabled: the count opens the store. */
+export function autoSleepDue(hippoRoot, tenantId, config) {
+    const { enabled, threshold } = config;
+    const count = enabled ? countCreatedSinceLastSleep(hippoRoot, tenantId) : 0;
+    return { enabled, count, threshold, due: enabled && count >= threshold };
+}
+/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it. */
+export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed) {
+    if (!allowed ||
+        !config.enabled ||
+        tenantId !== resolveTenantId({}) ||
+        autoSleepInFlight.has(hippoRoot) ||
+        !autoSleepDue(hippoRoot, tenantId, config).due)
+        return;
+    autoSleepInFlight.add(hippoRoot);
+    // Fire-and-forget (never block the response); an unhandled rejection would kill the server, so log it.
+    // Its own scope: the call's closes a handle the sleep still holds across its pauses, but the caller's lock wait carries over.
+    const busyWaitMs = scopedBusyWait();
+    outsideRequestStores(() => runWithRequestStores(() => consolidate(hippoRoot), { busyWaitMs }))
+        .catch((err) => {
+        log.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${errorMessage(err)}`);
+    })
+        .finally(() => autoSleepInFlight.delete(hippoRoot));
+}
+//# sourceMappingURL=auto-sleep.js.map

package/dist/{availability.d.ts → api/availability.d.ts}

@@ -1,5 +1,5 @@
 /** A minimal age reference: a memory id plus its ISO-8601 creation timestamp
- *  (MemoryEntry.created, canonical ISO per the src/memory.ts invariant). */
+ *  (MemoryEntry.created, canonical ISO per the src/core/memory.ts invariant). */
 export interface AgeRef {
     id: string;
     created: string;
@@ -41,7 +41,7 @@ export interface DetectAvailabilityBiasOpts {
     /** Minimum older-passed-over count required to fire. Default 3. */
     minOlderPassedOver?: number;
 }
-export declare const DEFAULT_RECENCY_WINDOW_MS: number;
+export declare const DEFAULT_RECENCY_WINDOW_MS = 86400000;
 export declare const DEFAULT_RECENT_FRACTION_THRESHOLD = 0.7;
 export declare const DEFAULT_MIN_RETURNED = 3;
 export declare const DEFAULT_MIN_POOL = 10;