hippo-memory 1.68.0 → 1.70.0

package/dist/server/routes/processes.js

@@ -1,13 +1,13 @@
 // /v1/processes routes.
-import { closeProcess, loadProcessById, loadProcesses, saveProcess, VALID_PROCESS_STATES } from '../../processes.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { PROCESS } from '../../objects/processes.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { parseJsonBody } from '../validation.js';
+import { isJsonString } from '../../util/json.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
 // HTTP-boundary validation for a process `steps` body (untrusted). Returns the
 // step strings (saveProcess re-validates + trims, this is the fail-fast 400
-// gate). Caps mirror src/processes.ts MAX_PROCESS_STEPS / MAX_PROCESS_STEP_LEN.
+// gate). Caps mirror src/objects/processes.ts MAX_PROCESS_STEPS / MAX_PROCESS_STEP_LEN.
 function validateProcessStepsBody(raw) {
     if (raw === undefined || raw === null)
         return [];
@@ -31,6 +31,21 @@ function validateProcessStepsBody(raw) {
     // SAFETY: every item in raw was confirmed to be a string in the loop above.
     return raw;
 }
+const processRoutes = {
+    noun: 'process',
+    field: 'process',
+    listField: 'processes',
+    object: PROCESS,
+    revise: (body) => {
+        const steps = validateProcessStepsBody(body['steps']);
+        if (steps.length === 0) {
+            throw new HttpError(400, 'steps is required (at least one step) for a supersession');
+        }
+        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const description = optionalString(body, 'description', 4096);
+        return (existing, id) => ({ processName: existing.processName, steps, description, changeSummary, supersedesProcessId: id });
+    },
+};
 // ── processes (first-class object) ──
 //
 // 5 routes: POST /v1/processes (new; body processName + steps[] + description),
@@ -42,121 +57,26 @@ function validateProcessStepsBody(raw) {
 // caps: processName/description/changeSummary 4096, steps 200x2000
 // (validateProcessStepsBody). Mirrors /v1/decisions; the delta lifecycle is the
 // decision supersede path.
-export async function handleCreateProcess({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const processName = body['processName'];
-    if (!isJsonString(processName) || processName.trim().length === 0) {
-        throw new HttpError(400, 'processName is required (non-empty string)');
-    }
-    if (processName.length > 4096) {
-        throw new HttpError(400, 'processName exceeds 4096-character cap');
-    }
-    const steps = validateProcessStepsBody(body['steps']);
-    const descriptionRaw = body['description'];
-    let description;
-    if (descriptionRaw !== undefined && descriptionRaw !== null) {
-        if (!isJsonString(descriptionRaw)) {
-            throw new HttpError(400, 'description must be a string');
-        }
-        if (descriptionRaw.length > 4096) {
-            throw new HttpError(400, 'description exceeds 4096-character cap');
-        }
-        description = descriptionRaw;
-    }
-    const process = saveProcess(opts.hippoRoot, ctx.tenantId, {
-        processName,
-        steps,
-        description,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { process });
-    return;
+export async function handleCreateProcess(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const process = await saveFor(rr, PROCESS, ctx.tenantId, ctx.actor.subject, {
+        processName: requiredString(body, 'processName', { max: 4096 }),
+        steps: validateProcessStepsBody(body['steps']),
+        description: optionalString(body, 'description', 4096),
+    });
+    sendJson(rr.res, 201, { process });
 }
-export async function handleListProcesses({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    let processes;
-    if (status === 'all') {
-        processes = loadProcesses(opts.hippoRoot, ctx.tenantId, { limit: limit + 1, after });
-    }
-    else {
-        if (!isSetMember(VALID_PROCESS_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        processes = loadProcesses(opts.hippoRoot, ctx.tenantId, {
-            status,
-            limit: limit + 1,
-            after,
-        });
-    }
-    const page = pageOf(processes, limit, byCreatedAt);
-    sendJson(res, 200, { processes: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListProcesses(rr) {
+    return listRoute(processRoutes, rr);
 }
-export async function handleSupersedeProcess({ req, res, opts }, processSupersedeMatch) {
-    const id = parseInt(processSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const steps = validateProcessStepsBody(body['steps']);
-    if (steps.length === 0) {
-        throw new HttpError(400, 'steps is required (at least one step) for a supersession');
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const descRaw = body['description'];
-    let description;
-    if (descRaw !== undefined && descRaw !== null) {
-        if (!isJsonString(descRaw)) {
-            throw new HttpError(400, 'description must be a string');
-        }
-        if (descRaw.length > 4096) {
-            throw new HttpError(400, 'description exceeds 4096-character cap');
-        }
-        description = descRaw;
-    }
-    // A supersession is a new version of the SAME process: reuse the
-    // predecessor's name. 404 if the target does not exist; saveProcess's
-    // in-SAVEPOINT preflight is the authoritative active-state check (409).
-    const existing = loadProcessById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `process ${id} not found`);
-    }
-    const process = saveProcess(opts.hippoRoot, ctx.tenantId, {
-        processName: existing.processName,
-        steps,
-        description,
-        changeSummary,
-        supersedesProcessId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { process });
-    return;
+export function handleSupersedeProcess(rr, match) {
+    return supersedeRoute(processRoutes, rr, match);
 }
-export async function handleCloseProcess({ req, res, opts }, processCloseMatch) {
-    const id = parseInt(processCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const process = closeProcess(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { process });
-    return;
+export function handleCloseProcess(rr, match) {
+    return closeRoute(processRoutes, rr, match);
 }
-export async function handleGetProcess({ req, res, opts }, processByIdMatch) {
-    const id = parseInt(processByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const process = loadProcessById(opts.hippoRoot, ctx.tenantId, id);
-    if (!process) {
-        throw new HttpError(404, `process ${id} not found`);
-    }
-    sendJson(res, 200, { process });
-    return;
+export function handleGetProcess(rr, match) {
+    return getRoute(processRoutes, rr, match);
 }
 //# sourceMappingURL=processes.js.map

package/dist/server/routes/project-briefs.d.ts

@@ -1,8 +1,8 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateProjectBrief({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListProjectBriefs({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleRefreshProjectBrief({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleSupersedeProjectBrief({ req, res, opts }: RouteRequest, briefSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseProjectBrief({ req, res, opts }: RouteRequest, briefCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetProjectBrief({ req, res, opts }: RouteRequest, briefByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateProjectBrief(rr: RouteRequest): Promise<void>;
+export declare function handleListProjectBriefs(rr: RouteRequest): Promise<void>;
+export declare function handleRefreshProjectBrief(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeProjectBrief(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseProjectBrief(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetProjectBrief(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=project-briefs.d.ts.map

package/dist/server/routes/project-briefs.js

@@ -1,10 +1,21 @@
 // /v1/project-briefs routes.
-import { assembleBriefFromReceipts, closeProjectBrief, loadProjectBriefById, loadProjectBriefs, MAX_REPO_LEN, refreshBrief, saveProjectBrief, VALID_BRIEF_STATES } from '../../project-briefs.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { briefFromReceipts, MAX_REPO_LEN, PROJECT_BRIEF, refreshedBrief } from '../../objects/project-briefs.js';
+import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { parseJsonBody } from '../validation.js';
+import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+const briefRoutes = {
+    noun: 'project brief',
+    field: 'brief',
+    listField: 'briefs',
+    object: PROJECT_BRIEF,
+    filterParam: 'repo',
+    revise: (body) => {
+        const summary = requiredString(body, 'summary', { max: 8192 });
+        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        return (existing, id) => ({ repo: existing.repo, summary, changeSummary, supersedesBriefId: id });
+    },
+};
 // ── project_brief routes ──
 //
 // 6 routes: POST /v1/project-briefs (new; body repo + summary), GET
@@ -15,123 +26,40 @@ import { isJsonString } from '../../json.js';
 // POST /v1/project-briefs/:id/close. DoS caps: repo 256, summary 8192,
 // changeSummary 4096. The store validates + throws; the boundary maps validation
 // -> 400, not-found -> 404, not-active -> 409. Mirrors /v1/skills.
-export async function handleCreateProjectBrief({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const repo = body['repo'];
-    if (!isJsonString(repo) || repo.trim().length === 0) {
-        throw new HttpError(400, 'repo is required (non-empty string)');
-    }
-    if (repo.length > MAX_REPO_LEN) {
-        throw new HttpError(400, `repo exceeds ${MAX_REPO_LEN}-character cap`);
-    }
-    const summary = body['summary'];
-    if (!isJsonString(summary) || summary.trim().length === 0) {
-        throw new HttpError(400, 'summary is required (non-empty string)');
-    }
-    if (summary.length > 8192) {
-        throw new HttpError(400, 'summary exceeds 8192-character cap');
-    }
-    const brief = saveProjectBrief(opts.hippoRoot, ctx.tenantId, {
-        repo,
-        summary,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { brief });
-    return;
+export async function handleCreateProjectBrief(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const brief = await saveFor(rr, PROJECT_BRIEF, ctx.tenantId, ctx.actor.subject, {
+        repo: requiredString(body, 'repo', { max: MAX_REPO_LEN }),
+        summary: requiredString(body, 'summary', { max: 8192 }),
+    });
+    sendJson(rr.res, 201, { brief });
 }
-export async function handleListProjectBriefs({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const repoFilter = query.get('repo');
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    const listOpts = { limit: limit + 1, after };
-    if (repoFilter !== null && repoFilter.trim().length > 0) {
-        listOpts.repo = repoFilter.trim();
-    }
-    if (status !== 'all') {
-        if (!isSetMember(VALID_BRIEF_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        listOpts.status = status;
-    }
-    const briefs = loadProjectBriefs(opts.hippoRoot, ctx.tenantId, listOpts);
-    const page = pageOf(briefs, limit, byCreatedAt);
-    sendJson(res, 200, { briefs: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListProjectBriefs(rr) {
+    return listRoute(briefRoutes, rr);
 }
 // The refresh op: must precede the /:id routes (literal 'refresh' is non-numeric
 // so the /(\d+)/ routes would not match it, but order it first).
-export async function handleRefreshProjectBrief({ req, res, opts }) {
+export async function handleRefreshProjectBrief(rr) {
+    const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
-    const repo = body['repo'];
-    if (!isJsonString(repo) || repo.trim().length === 0) {
-        throw new HttpError(400, 'repo is required (non-empty string)');
-    }
-    if (repo.length > MAX_REPO_LEN) {
-        throw new HttpError(400, `repo exceeds ${MAX_REPO_LEN}-character cap`);
-    }
-    const dryRun = body['dryRun'] === true;
-    if (dryRun) {
-        const { markdown, receiptCount } = assembleBriefFromReceipts(opts.hippoRoot, ctx.tenantId, repo);
+    const repo = requiredString(body, 'repo', { max: MAX_REPO_LEN });
+    if (body['dryRun'] === true) {
+        const { markdown, receiptCount } = await briefFromReceipts(objectsOf(rr), ctx.tenantId, repo);
         sendJson(res, 200, { markdown, receiptCount });
         return;
     }
-    const brief = refreshBrief(opts.hippoRoot, ctx.tenantId, repo, ctx.actor.subject);
+    const brief = await refreshedBrief(objectsOf(rr), { hippoRoot: opts.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, repo);
     sendJson(res, 200, { brief });
-    return;
 }
-export async function handleSupersedeProjectBrief({ req, res, opts }, briefSupersedeMatch) {
-    const id = parseInt(briefSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const summary = body['summary'];
-    if (!isJsonString(summary) || summary.trim().length === 0) {
-        throw new HttpError(400, 'summary is required (non-empty string)');
-    }
-    if (summary.length > 8192) {
-        throw new HttpError(400, 'summary exceeds 8192-character cap');
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const existing = loadProjectBriefById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `project brief ${id} not found`);
-    }
-    const brief = saveProjectBrief(opts.hippoRoot, ctx.tenantId, {
-        repo: existing.repo,
-        summary,
-        changeSummary,
-        supersedesBriefId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { brief });
-    return;
+export function handleSupersedeProjectBrief(rr, match) {
+    return supersedeRoute(briefRoutes, rr, match);
 }
-export async function handleCloseProjectBrief({ req, res, opts }, briefCloseMatch) {
-    const id = parseInt(briefCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const brief = closeProjectBrief(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { brief });
-    return;
+export function handleCloseProjectBrief(rr, match) {
+    return closeRoute(briefRoutes, rr, match);
 }
-export async function handleGetProjectBrief({ req, res, opts }, briefByIdMatch) {
-    const id = parseInt(briefByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const brief = loadProjectBriefById(opts.hippoRoot, ctx.tenantId, id);
-    if (!brief) {
-        throw new HttpError(404, `project brief ${id} not found`);
-    }
-    sendJson(res, 200, { brief });
-    return;
+export function handleGetProjectBrief(rr, match) {
+    return getRoute(briefRoutes, rr, match);
 }
 //# sourceMappingURL=project-briefs.js.map

package/dist/server/routes/recall.js

@@ -1,16 +1,16 @@
 // Recall routes: /v1/memories search, assemble, drill and /v1/context.
 import { dirname, resolve } from 'node:path';
-import { assertCallerProject, resolveProjectIdentity } from '../../project-identity.js';
-import { isSharedStore } from '../../config.js';
-import { assembleCost, contextCost, drillCost } from '../../context-render.js';
-import { storeFor } from '../../store-port.js';
-import { biasHintEnabled } from '../../recall-history.js';
-import { assemble, drillDown, getContext, recordTokens, retrieve } from '../../api.js';
+import { assertCallerProject, resolveProjectIdentity } from '../../core/project-identity.js';
+import { isSharedStore } from '../../core/config.js';
+import { assembleCost, contextCost, drillCost } from '../../api/context-render.js';
+import { storeFor } from '../../store/index.js';
+import { biasHintEnabled } from '../../api/recall-history.js';
+import { assemble, drillDown, getContext, recordTokens, retrieve } from '../../api/index.js';
 import { httpParams, parseContextRequest, parseRecallRequest } from '../../api/recall-request.js';
 import { anchorSkippedRows, noteRecall, peekSessionRing, resetSessionRings, sessionRing } from '../../api/recall-record.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { validateIdSegment } from '../validation.js';
+import { MAX_LIST_LIMIT, parseListLimit, validateIdSegment } from '../validation.js';
 /** Test-only: reset the HTTP recall rings. Call from beforeEach. */
 export function __resetSessionRecallHistoryHttp() {
     resetSessionRings('http');
@@ -32,8 +32,7 @@ export async function handleRecallMemories({ req, res, opts, query }) {
     const ring = sessionRing('http', ctx.tenantId, sessionId);
     if (ring)
         noteRecall(ring, q, result.results[0]?.id ?? null, result.anchoringHint?.memoryId);
-    // Each recall surface counts its own hits; api.recall is no chokepoint,
-    // since the CLI never calls it and MCP shows the user a different band.
+    // HTTP counts the rows it returns here; `retrieve` cannot count for every ranker, since MCP shows a different band and counts none.
     await storeFor(ctx).bumpRecallStats(result.results.length);
     // Continuity payloads should never be cached. The caller is asking for
     // session-state-aware data; intermediaries must not reuse it across users.
@@ -78,7 +77,7 @@ export async function handleAssembleSession({ req, res, opts, query }, assembleM
         assembleExtra.summarizeOlder = summarizeOlder;
     if (scope !== undefined)
         assembleExtra.scope = scope;
-    const result = assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
+    const result = await assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
     await recordTokens(ctx, 'http_assemble', { items: result.items.length, tokens: result.tokens, sessionId: assembleMatch.id });
     sendJson(res, 200, result);
     return;
@@ -96,6 +95,9 @@ export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
     if (limit !== undefined && (!Number.isFinite(limit) || limit <= 0)) {
         throw new HttpError(400, 'limit must be a positive number');
     }
+    // Past the list ceiling the shared parser refuses, so the reply is the one every other list route gives.
+    if (limit !== undefined && limit > MAX_LIST_LIMIT)
+        parseListLimit(limitRaw);
     const budgetRaw = query.get('budget');
     const budget = budgetRaw === null ? undefined : Number(budgetRaw);
     if (budget !== undefined && (!Number.isFinite(budget) || budget <= 0)) {
@@ -120,7 +122,7 @@ export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
         drillExtra.budget = budget;
     if (depth !== undefined)
         drillExtra.depth = depth;
-    const result = drillDown(ctx, drillMatch.id, { ...drillExtra, cost: drillCost });
+    const result = await drillDown(ctx, drillMatch.id, { ...drillExtra, cost: drillCost });
     if ('failure' in result) {
         // Leaf id maps to 422 (caller-actionable). Other cases stay
         // as 404 to avoid leaking cross-tenant existence or scope grants.

package/dist/server/routes/skills.d.ts

@@ -1,8 +1,8 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateSkill({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListSkills({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleExportSkills({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleSupersedeSkill({ req, res, opts }: RouteRequest, skillSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseSkill({ req, res, opts }: RouteRequest, skillCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetSkill({ req, res, opts }: RouteRequest, skillByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateSkill(rr: RouteRequest): Promise<void>;
+export declare function handleListSkills(rr: RouteRequest): Promise<void>;
+export declare function handleExportSkills(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=skills.d.ts.map

package/dist/server/routes/skills.js

@@ -1,10 +1,22 @@
 // /v1/skills routes.
-import { closeSkill, exportSkills, loadSkillById, loadSkills, MAX_SKILL_NAME_LEN, saveSkill, VALID_SKILL_STATES } from '../../skills.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { MAX_SKILL_NAME_LEN, SKILL, skillsMarkdown } from '../../objects/skills.js';
+import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { parseJsonBody } from '../validation.js';
+import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+const INSTRUCTIONS = { max: 8192, plural: true };
+const skillRoutes = {
+    noun: 'skill',
+    field: 'skill',
+    listField: 'skills',
+    object: SKILL,
+    revise: (body) => {
+        const instructions = requiredString(body, 'instructions', INSTRUCTIONS);
+        const trigger = optionalString(body, 'trigger', 1024);
+        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        return (existing, id) => ({ skillName: existing.skillName, instructions, trigger, changeSummary, supersedesSkillId: id });
+    },
+};
 // ── skills (first-class object, executable/exportable) ──
 //
 // 6 routes: POST /v1/skills (new; body skillName + instructions + trigger?),
@@ -17,135 +29,35 @@ import { isJsonString } from '../../json.js';
 // validates + throws; the boundary maps validation -> 400, not-found -> 404,
 // not-active -> 409. Mirrors /v1/processes; "executable" = exportable
 // instruction (no code exec).
-export async function handleCreateSkill({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const skillName = body['skillName'];
-    if (!isJsonString(skillName) || skillName.trim().length === 0) {
-        throw new HttpError(400, 'skillName is required (non-empty string)');
-    }
-    if (skillName.length > MAX_SKILL_NAME_LEN) {
-        throw new HttpError(400, `skillName exceeds ${MAX_SKILL_NAME_LEN}-character cap`);
-    }
-    const instructions = body['instructions'];
-    if (!isJsonString(instructions) || instructions.trim().length === 0) {
-        throw new HttpError(400, 'instructions are required (non-empty string)');
-    }
-    if (instructions.length > 8192) {
-        throw new HttpError(400, 'instructions exceed 8192-character cap');
-    }
-    const triggerRaw = body['trigger'];
-    let trigger;
-    if (triggerRaw !== undefined && triggerRaw !== null) {
-        if (!isJsonString(triggerRaw)) {
-            throw new HttpError(400, 'trigger must be a string');
-        }
-        if (triggerRaw.length > 1024) {
-            throw new HttpError(400, 'trigger exceeds 1024-character cap');
-        }
-        trigger = triggerRaw;
-    }
-    const skill = saveSkill(opts.hippoRoot, ctx.tenantId, {
-        skillName,
-        instructions,
-        trigger,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { skill });
-    return;
+export async function handleCreateSkill(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const skill = await saveFor(rr, SKILL, ctx.tenantId, ctx.actor.subject, {
+        skillName: requiredString(body, 'skillName', { max: MAX_SKILL_NAME_LEN }),
+        instructions: requiredString(body, 'instructions', INSTRUCTIONS),
+        trigger: optionalString(body, 'trigger', 1024),
+    });
+    sendJson(rr.res, 201, { skill });
 }
-export async function handleListSkills({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    let skills;
-    if (status === 'all') {
-        skills = loadSkills(opts.hippoRoot, ctx.tenantId, { limit: limit + 1, after });
-    }
-    else {
-        if (!isSetMember(VALID_SKILL_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        skills = loadSkills(opts.hippoRoot, ctx.tenantId, {
-            status,
-            limit: limit + 1,
-            after,
-        });
-    }
-    const page = pageOf(skills, limit, byCreatedAt);
-    sendJson(res, 200, { skills: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListSkills(rr) {
+    return listRoute(skillRoutes, rr);
 }
 // The export renderer: must precede the /:id GET (literal 'export' is
 // non-numeric so the /(\d+)/ route would not match it, but order it first).
-export async function handleExportSkills({ req, res, opts }) {
+export async function handleExportSkills(rr) {
+    const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
-    const markdown = exportSkills(opts.hippoRoot, ctx.tenantId);
+    const markdown = await skillsMarkdown(objectsOf(rr), ctx.tenantId);
     sendJson(res, 200, { markdown });
     return;
 }
-export async function handleSupersedeSkill({ req, res, opts }, skillSupersedeMatch) {
-    const id = parseInt(skillSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const instructions = body['instructions'];
-    if (!isJsonString(instructions) || instructions.trim().length === 0) {
-        throw new HttpError(400, 'instructions are required (non-empty string)');
-    }
-    if (instructions.length > 8192) {
-        throw new HttpError(400, 'instructions exceed 8192-character cap');
-    }
-    const triggerRaw = body['trigger'];
-    let trigger;
-    if (triggerRaw !== undefined && triggerRaw !== null) {
-        if (!isJsonString(triggerRaw)) {
-            throw new HttpError(400, 'trigger must be a string');
-        }
-        if (triggerRaw.length > 1024) {
-            throw new HttpError(400, 'trigger exceeds 1024-character cap');
-        }
-        trigger = triggerRaw;
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const existing = loadSkillById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `skill ${id} not found`);
-    }
-    const skill = saveSkill(opts.hippoRoot, ctx.tenantId, {
-        skillName: existing.skillName,
-        instructions,
-        trigger,
-        changeSummary,
-        supersedesSkillId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { skill });
-    return;
+export function handleSupersedeSkill(rr, match) {
+    return supersedeRoute(skillRoutes, rr, match);
 }
-export async function handleCloseSkill({ req, res, opts }, skillCloseMatch) {
-    const id = parseInt(skillCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const skill = closeSkill(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { skill });
-    return;
+export function handleCloseSkill(rr, match) {
+    return closeRoute(skillRoutes, rr, match);
 }
-export async function handleGetSkill({ req, res, opts }, skillByIdMatch) {
-    const id = parseInt(skillByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const skill = loadSkillById(opts.hippoRoot, ctx.tenantId, id);
-    if (!skill) {
-        throw new HttpError(404, `skill ${id} not found`);
-    }
-    sendJson(res, 200, { skill });
-    return;
+export function handleGetSkill(rr, match) {
+    return getRoute(skillRoutes, rr, match);
 }
 //# sourceMappingURL=skills.js.map