hippo-memory 1.69.0 → 1.70.0

package/dist/server/routes/admin.js

@@ -1,11 +1,12 @@
 // Admin routes: API keys, quarantine and the audit log.
-import { AUDIT_OPS } from '../../audit.js';
-import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api.js';
-import { HttpError, readBody, sendJson } from '../../http-util.js';
+import { AUDIT_OPS } from '../../store/audit.js';
+import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api/index.js';
+import { HttpError, readBody, sendJson } from '../../util/http-util.js';
+import { log } from '../../util/log.js';
 import { assertCrossTenantAdmin, buildContextWithAuth } from '../auth.js';
 import { pageOf, parseCursor, setNextCursorHeader } from '../cursor.js';
 import { isSetMember, parseJsonObjectText, parseListLimit, validateIdSegment } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { isJsonString } from '../../util/json.js';
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 // POST /v1/auth/keys reads its body before auth, so an unauthenticated caller can make the server buffer at most this many bytes and wait at most this many ms.
 // ServeOpts.mintBodyDeadlineMs overrides the wait for tests only, so a 408 test need not sit through it.
@@ -48,6 +49,10 @@ export async function handleCreateAuthKey({ req, res, opts }) {
         label: labelRaw,
         role,
     });
+    // The reply cannot change shape, so the server log is where a defaulted admin key gets noticed.
+    if (role === undefined && result.role === 'admin') {
+        log.warn(`auth key ${result.keyId} was minted with no role in the body, so it is an admin key, and it never expires; send "role": "member" for a narrower one`);
+    }
     sendJson(res, 200, result);
     return;
 }
@@ -99,7 +104,7 @@ export async function handleListQuarantine({ req, res, opts, query }) {
     }
     const limit = parseListLimit(query.get('limit'));
     const after = parseCursor(query.get('cursor'), 'string', 'string');
-    const page = pageOf(quarantineList(ctx, { status, limit: limit + 1, after }), limit, (q) => ({ key: q.quarantinedAt, id: q.id }));
+    const page = pageOf(await quarantineList(ctx, { status, limit: limit + 1, after }), limit, (q) => ({ key: q.quarantinedAt, id: q.id }));
     sendJson(res, 200, { quarantine: page.items, next_cursor: page.nextCursor });
     return;
 }
@@ -107,7 +112,7 @@ export async function handleListQuarantine({ req, res, opts, query }) {
 export async function handleApproveQuarantine({ req, res, opts }, quarantineApproveMatch) {
     validateIdSegment(quarantineApproveMatch.id, 'memory id');
     const ctx = await buildContextWithAuth(req, opts);
-    quarantineApprove(ctx, quarantineApproveMatch.id);
+    await quarantineApprove(ctx, quarantineApproveMatch.id);
     sendJson(res, 200, { approved: quarantineApproveMatch.id });
     return;
 }
@@ -115,7 +120,7 @@ export async function handleApproveQuarantine({ req, res, opts }, quarantineAppr
 export async function handleRejectQuarantine({ req, res, opts }, quarantineRejectMatch) {
     validateIdSegment(quarantineRejectMatch.id, 'memory id');
     const ctx = await buildContextWithAuth(req, opts);
-    quarantineReject(ctx, quarantineRejectMatch.id);
+    await quarantineReject(ctx, quarantineRejectMatch.id);
     sendJson(res, 200, { rejected: quarantineRejectMatch.id });
     return;
 }
@@ -157,7 +162,7 @@ export async function handleListAudit({ req, res, opts, query }) {
     if (crossTenant)
         assertCrossTenantAdmin(ctx, '/v1/audit?tenant= for another tenant');
     const effectiveCtx = crossTenant ? { ...ctx, tenantId: tenantOverride } : ctx;
-    const page = pageOf(auditList(effectiveCtx, { op, since, limit: limit + 1, after }), limit, (e) => ({ key: e.ts, id: e.id }));
+    const page = pageOf(await auditList(effectiveCtx, { op, since, limit: limit + 1, after }), limit, (e) => ({ key: e.ts, id: e.id }));
     setNextCursorHeader(res, page.nextCursor);
     sendJson(res, 200, page.items);
     return;

package/dist/server/routes/customer-notes.d.ts

@@ -1,7 +1,7 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateCustomerNote({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListCustomerNotes({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleSupersedeCustomerNote({ req, res, opts }: RouteRequest, noteSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseCustomerNote({ req, res, opts }: RouteRequest, noteCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetCustomerNote({ req, res, opts }: RouteRequest, noteByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateCustomerNote(rr: RouteRequest): Promise<void>;
+export declare function handleListCustomerNotes(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=customer-notes.d.ts.map

package/dist/server/routes/customer-notes.js

@@ -1,10 +1,21 @@
 // /v1/customer-notes routes.
-import { closeCustomerNote, loadCustomerNoteById, loadCustomerNotes, MAX_CUSTOMER_LEN, saveCustomerNote, VALID_NOTE_STATES } from '../../customer-notes.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { CUSTOMER_NOTE, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
+import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { parseJsonBody } from '../validation.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+const noteRoutes = {
+    noun: 'customer note',
+    field: 'note',
+    listField: 'notes',
+    object: CUSTOMER_NOTE,
+    filterParam: 'customer',
+    revise: (body) => {
+        const note = requiredString(body, 'note', { max: 8192 });
+        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        return (existing, id) => ({ customer: existing.customer, note, changeSummary, supersedesNoteId: id });
+    },
+};
 // ── customer_note routes ──
 //
 // 5 routes (no assembler/refresh): POST /v1/customer-notes (new; body customer +
@@ -13,101 +24,25 @@ import { isJsonString } from '../../json.js';
 // POST /v1/customer-notes/:id/close. DoS caps: customer 256, note 8192,
 // changeSummary 4096. The store validates + throws; the boundary maps validation ->
 // 400, not-found -> 404, not-active -> 409. Mirrors /v1/project-briefs.
-export async function handleCreateCustomerNote({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const customer = body['customer'];
-    if (!isJsonString(customer) || customer.trim().length === 0) {
-        throw new HttpError(400, 'customer is required (non-empty string)');
-    }
-    if (customer.length > MAX_CUSTOMER_LEN) {
-        throw new HttpError(400, `customer exceeds ${MAX_CUSTOMER_LEN}-character cap`);
-    }
-    const note = body['note'];
-    if (!isJsonString(note) || note.trim().length === 0) {
-        throw new HttpError(400, 'note is required (non-empty string)');
-    }
-    if (note.length > 8192) {
-        throw new HttpError(400, 'note exceeds 8192-character cap');
-    }
-    const customerNote = saveCustomerNote(opts.hippoRoot, ctx.tenantId, {
-        customer,
-        note,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { note: customerNote });
-    return;
+export async function handleCreateCustomerNote(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const customerNote = await saveFor(rr, CUSTOMER_NOTE, ctx.tenantId, ctx.actor.subject, {
+        customer: requiredString(body, 'customer', { max: MAX_CUSTOMER_LEN }),
+        note: requiredString(body, 'note', { max: 8192 }),
+    });
+    sendJson(rr.res, 201, { note: customerNote });
 }
-export async function handleListCustomerNotes({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const customerFilter = query.get('customer');
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    const listOpts = { limit: limit + 1, after };
-    if (customerFilter !== null && customerFilter.trim().length > 0) {
-        listOpts.customer = customerFilter.trim();
-    }
-    if (status !== 'all') {
-        if (!isSetMember(VALID_NOTE_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        listOpts.status = status;
-    }
-    const notes = loadCustomerNotes(opts.hippoRoot, ctx.tenantId, listOpts);
-    const page = pageOf(notes, limit, byCreatedAt);
-    sendJson(res, 200, { notes: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListCustomerNotes(rr) {
+    return listRoute(noteRoutes, rr);
 }
-export async function handleSupersedeCustomerNote({ req, res, opts }, noteSupersedeMatch) {
-    const id = parseInt(noteSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const note = body['note'];
-    if (!isJsonString(note) || note.trim().length === 0) {
-        throw new HttpError(400, 'note is required (non-empty string)');
-    }
-    if (note.length > 8192) {
-        throw new HttpError(400, 'note exceeds 8192-character cap');
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const existing = loadCustomerNoteById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `customer note ${id} not found`);
-    }
-    const customerNote = saveCustomerNote(opts.hippoRoot, ctx.tenantId, {
-        customer: existing.customer,
-        note,
-        changeSummary,
-        supersedesNoteId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { note: customerNote });
-    return;
+export function handleSupersedeCustomerNote(rr, match) {
+    return supersedeRoute(noteRoutes, rr, match);
 }
-export async function handleCloseCustomerNote({ req, res, opts }, noteCloseMatch) {
-    const id = parseInt(noteCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const customerNote = closeCustomerNote(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { note: customerNote });
-    return;
+export function handleCloseCustomerNote(rr, match) {
+    return closeRoute(noteRoutes, rr, match);
 }
-export async function handleGetCustomerNote({ req, res, opts }, noteByIdMatch) {
-    const id = parseInt(noteByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const customerNote = loadCustomerNoteById(opts.hippoRoot, ctx.tenantId, id);
-    if (!customerNote) {
-        throw new HttpError(404, `customer note ${id} not found`);
-    }
-    sendJson(res, 200, { note: customerNote });
-    return;
+export function handleGetCustomerNote(rr, match) {
+    return getRoute(noteRoutes, rr, match);
 }
 //# sourceMappingURL=customer-notes.js.map

package/dist/server/routes/decisions.d.ts

@@ -1,7 +1,7 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateDecision({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListDecisions({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleSupersedeDecision({ req, res, opts }: RouteRequest, decisionSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseDecision({ req, res, opts }: RouteRequest, decisionCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetDecision({ req, res, opts }: RouteRequest, decisionByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateDecision(rr: RouteRequest): Promise<void>;
+export declare function handleListDecisions(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=decisions.d.ts.map

package/dist/server/routes/decisions.js

@@ -1,11 +1,22 @@
 // /v1/decisions routes.
-import { closeDecision, loadDecisionById, loadDecisions, saveDecision, VALID_DECISION_STATES } from '../../decisions.js';
-import { HttpError, sendJson } from '../../http-util.js';
-import { NotFoundError } from '../../api-errors.js';
+import { DECISION } from '../../objects/decisions.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
+import { NotFoundError } from '../../core/api-errors.js';
+import { isJsonNumber } from '../../util/json.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isJsonNumber, isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { parseJsonBody } from '../validation.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor } from './object-routes.js';
+const decisionRoutes = { noun: 'decision', field: 'decision', listField: 'decisions', object: DECISION };
+const TEXT = { max: 4096, untrimmed: true };
+function supersededId(body) {
+    const raw = body['supersedesDecisionId'];
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!isJsonNumber(raw) || !Number.isInteger(raw) || raw <= 0) {
+        throw new HttpError(400, 'supersedesDecisionId must be a positive integer');
+    }
+    return raw;
+}
 // ── decisions (first-class object) ──
 //
 // 5 routes: POST /v1/decisions (create, optional supersedesDecisionId),
@@ -16,41 +27,17 @@ import { isJsonString } from '../../json.js';
 // DoS caps: text 4096, context 4096. The HTTP surface is
 // new (no legacy --supersedes <memory-id> constraint), so it supersedes by
 // table id and never weakens a memory mirror.
-export async function handleCreateDecision({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
+export async function handleCreateDecision(rr) {
+    const { req, res } = rr;
+    const ctx = await buildContextWithAuth(req, rr.opts);
     const body = await parseJsonBody(req, ctx);
-    const text = body['text'];
-    if (!isJsonString(text) || text.length === 0) {
-        throw new HttpError(400, 'text is required (non-empty string)');
-    }
-    if (text.length > 4096) {
-        throw new HttpError(400, 'text exceeds 4096-character cap');
-    }
-    const contextRaw = body['context'];
-    let context;
-    if (contextRaw !== undefined && contextRaw !== null) {
-        if (!isJsonString(contextRaw)) {
-            throw new HttpError(400, 'context must be a string');
-        }
-        if (contextRaw.length > 4096) {
-            throw new HttpError(400, 'context exceeds 4096-character cap');
-        }
-        context = contextRaw;
-    }
-    const supRaw = body['supersedesDecisionId'];
-    let supersedesDecisionId;
-    if (supRaw !== undefined && supRaw !== null) {
-        if (!isJsonNumber(supRaw) || !Number.isInteger(supRaw) || supRaw <= 0) {
-            throw new HttpError(400, 'supersedesDecisionId must be a positive integer');
-        }
-        supersedesDecisionId = supRaw;
-    }
+    const write = {
+        decisionText: requiredString(body, 'text', TEXT),
+        context: optionalString(body, 'context', 4096),
+        supersedesDecisionId: supersededId(body),
+    };
     try {
-        const decision = saveDecision(opts.hippoRoot, ctx.tenantId, {
-            decisionText: text,
-            context,
-            supersedesDecisionId,
-        }, ctx.actor.subject);
+        const decision = await saveFor(rr, DECISION, ctx.tenantId, ctx.actor.subject, write);
         sendJson(res, 201, { decision });
     }
     catch (e) {
@@ -59,76 +46,26 @@ export async function handleCreateDecision({ req, res, opts }) {
             throw new HttpError(409, e.message);
         throw e;
     }
-    return;
 }
-export async function handleListDecisions({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    let decisions;
-    if (status === 'all') {
-        decisions = loadDecisions(opts.hippoRoot, ctx.tenantId, { limit: limit + 1, after });
-    }
-    else {
-        if (!isSetMember(VALID_DECISION_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        decisions = loadDecisions(opts.hippoRoot, ctx.tenantId, {
-            status,
-            limit: limit + 1,
-            after,
-        });
-    }
-    const page = pageOf(decisions, limit, byCreatedAt);
-    sendJson(res, 200, { decisions: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListDecisions(rr) {
+    return listRoute(decisionRoutes, rr);
 }
-export async function handleSupersedeDecision({ req, res, opts }, decisionSupersedeMatch) {
-    const oldId = parseInt(decisionSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const text = body['text'];
-    if (!isJsonString(text) || text.length === 0) {
-        throw new HttpError(400, 'text is required (non-empty string)');
-    }
-    if (text.length > 4096) {
-        throw new HttpError(400, 'text exceeds 4096-character cap');
-    }
-    const contextRaw = body['context'];
-    let context;
-    if (contextRaw !== undefined && contextRaw !== null) {
-        if (!isJsonString(contextRaw)) {
-            throw new HttpError(400, 'context must be a string');
-        }
-        if (contextRaw.length > 4096) {
-            throw new HttpError(400, 'context exceeds 4096-character cap');
-        }
-        context = contextRaw;
-    }
-    const decision = saveDecision(opts.hippoRoot, ctx.tenantId, {
-        decisionText: text,
-        context,
+// Not on supersedeRoute: this one answers 201 and leaves the missing-row 404 to the store, where the other five answer 200 after their own lookup.
+export async function handleSupersedeDecision(rr, match) {
+    const oldId = parseInt(match[1], 10);
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const decision = await saveFor(rr, DECISION, ctx.tenantId, ctx.actor.subject, {
+        decisionText: requiredString(body, 'text', TEXT),
+        context: optionalString(body, 'context', 4096),
         supersedesDecisionId: oldId,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { decision });
-    return;
+    });
+    sendJson(rr.res, 201, { decision });
 }
-export async function handleCloseDecision({ req, res, opts }, decisionCloseMatch) {
-    const id = parseInt(decisionCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const decision = closeDecision(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { decision });
-    return;
+export function handleCloseDecision(rr, match) {
+    return closeRoute(decisionRoutes, rr, match);
 }
-export async function handleGetDecision({ req, res, opts }, decisionByIdMatch) {
-    const id = parseInt(decisionByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const decision = loadDecisionById(opts.hippoRoot, ctx.tenantId, id);
-    if (!decision) {
-        throw new HttpError(404, `decision ${id} not found`);
-    }
-    sendJson(res, 200, { decision });
-    return;
+export function handleGetDecision(rr, match) {
+    return getRoute(decisionRoutes, rr, match);
 }
 //# sourceMappingURL=decisions.js.map

package/dist/server/routes/incidents.d.ts

@@ -1,7 +1,7 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateIncident({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListIncidents({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleResolveIncident({ req, res, opts }: RouteRequest, incidentResolveMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseIncident({ req, res, opts }: RouteRequest, incidentCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetIncident({ req, res, opts }: RouteRequest, incidentByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateIncident(rr: RouteRequest): Promise<void>;
+export declare function handleListIncidents(rr: RouteRequest): Promise<void>;
+export declare function handleResolveIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=incidents.d.ts.map

package/dist/server/routes/incidents.js

@@ -1,12 +1,29 @@
 // /v1/incidents routes.
-import { closeIncident, loadIncidentById, loadIncidents, resolveIncident, saveIncident, VALID_INCIDENT_STATES } from '../../incidents.js';
-import { HttpError, sendJson } from '../../http-util.js';
-import { NotFoundError } from '../../api-errors.js';
+import { INCIDENT, openIncident, resolveOpenIncident } from '../../objects/incidents.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
+import { NotFoundError } from '../../core/api-errors.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { parseJsonBody } from '../validation.js';
+import { isJsonString } from '../../util/json.js';
+import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString } from './object-routes.js';
 const MAX_LINKED_MEMORY_IDS = 256;
+const incidentRoutes = { noun: 'incident', field: 'incident', listField: 'incidents', object: INCIDENT };
+function linkedMemoryIds(body) {
+    const raw = body['linkedMemoryIds'];
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        throw new HttpError(400, 'linkedMemoryIds must be an array of memory ids');
+    }
+    if (raw.length > MAX_LINKED_MEMORY_IDS) {
+        throw new HttpError(400, `linkedMemoryIds exceeds ${MAX_LINKED_MEMORY_IDS}-item cap`);
+    }
+    const isValidMemoryId = (item) => isJsonString(item) && item.length > 0 && item.length <= 4096;
+    if (!raw.every(isValidMemoryId)) {
+        throw new HttpError(400, 'each linkedMemoryIds entry must be a non-empty string <= 4096 chars');
+    }
+    return raw;
+}
 // ── incidents (first-class object) ──
 //
 // 5 routes: POST /v1/incidents (open; body text + context + linkedMemoryIds[]),
@@ -18,48 +35,17 @@ const MAX_LINKED_MEMORY_IDS = 256;
 // 4096. Mirrors /v1/decisions; lifecycle is
 // open->resolved->closed (no supersede), so linkedMemoryIds replaces
 // supersedesDecisionId on create.
-export async function handleCreateIncident({ req, res, opts }) {
+export async function handleCreateIncident(rr) {
+    const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
-    const text = body['text'];
-    if (!isJsonString(text) || text.length === 0) {
-        throw new HttpError(400, 'text is required (non-empty string)');
-    }
-    if (text.length > 4096) {
-        throw new HttpError(400, 'text exceeds 4096-character cap');
-    }
-    const contextRaw = body['context'];
-    let context;
-    if (contextRaw !== undefined && contextRaw !== null) {
-        if (!isJsonString(contextRaw)) {
-            throw new HttpError(400, 'context must be a string');
-        }
-        if (contextRaw.length > 4096) {
-            throw new HttpError(400, 'context exceeds 4096-character cap');
-        }
-        context = contextRaw;
-    }
-    const linkedRaw = body['linkedMemoryIds'];
-    let linkedMemoryIds;
-    if (linkedRaw !== undefined && linkedRaw !== null) {
-        if (!Array.isArray(linkedRaw)) {
-            throw new HttpError(400, 'linkedMemoryIds must be an array of memory ids');
-        }
-        if (linkedRaw.length > MAX_LINKED_MEMORY_IDS) {
-            throw new HttpError(400, `linkedMemoryIds exceeds ${MAX_LINKED_MEMORY_IDS}-item cap`);
-        }
-        const isValidMemoryId = (item) => isJsonString(item) && item.length > 0 && item.length <= 4096;
-        if (!linkedRaw.every(isValidMemoryId)) {
-            throw new HttpError(400, 'each linkedMemoryIds entry must be a non-empty string <= 4096 chars');
-        }
-        linkedMemoryIds = linkedRaw;
-    }
+    const write = {
+        incidentText: requiredString(body, 'text', { max: 4096, untrimmed: true }),
+        context: optionalString(body, 'context', 4096),
+        linkedMemoryIds: linkedMemoryIds(body),
+    };
     try {
-        const incident = saveIncident(opts.hippoRoot, ctx.tenantId, {
-            incidentText: text,
-            context,
-            linkedMemoryIds,
-        }, ctx.actor.subject);
+        const incident = await openIncident(objectsOf(rr), opts.hippoRoot, ctx.tenantId, write, ctx.actor.subject);
         sendJson(res, 201, { incident });
     }
     catch (e) {
@@ -68,61 +54,22 @@ export async function handleCreateIncident({ req, res, opts }) {
             throw new HttpError(409, e.message);
         throw e;
     }
-    return;
 }
-export async function handleListIncidents({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    let incidents;
-    if (status === 'all') {
-        incidents = loadIncidents(opts.hippoRoot, ctx.tenantId, { limit: limit + 1, after });
-    }
-    else {
-        if (!isSetMember(VALID_INCIDENT_STATES, status)) {
-            throw new HttpError(400, `status must be one of: open | resolved | closed | all (got "${status}")`);
-        }
-        incidents = loadIncidents(opts.hippoRoot, ctx.tenantId, {
-            status,
-            limit: limit + 1,
-            after,
-        });
-    }
-    const page = pageOf(incidents, limit, byCreatedAt);
-    sendJson(res, 200, { incidents: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListIncidents(rr) {
+    return listRoute(incidentRoutes, rr);
 }
-export async function handleResolveIncident({ req, res, opts }, incidentResolveMatch) {
-    const id = parseInt(incidentResolveMatch[1], 10);
+export async function handleResolveIncident(rr, match) {
+    const { req, res, opts } = rr;
+    const id = parseInt(match[1], 10);
     const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const resolutionText = body['resolutionText'];
-    if (!isJsonString(resolutionText) || resolutionText.trim().length === 0) {
-        throw new HttpError(400, 'resolutionText is required (non-empty string)');
-    }
-    if (resolutionText.length > 4096) {
-        throw new HttpError(400, 'resolutionText exceeds 4096-character cap');
-    }
-    const incident = resolveIncident(opts.hippoRoot, ctx.tenantId, id, resolutionText, ctx.actor.subject);
+    const resolutionText = requiredString(await parseJsonBody(req, ctx), 'resolutionText', { max: 4096 });
+    const incident = await resolveOpenIncident(objectsOf(rr), ctx.tenantId, id, resolutionText, ctx.actor.subject);
     sendJson(res, 200, { incident });
-    return;
 }
-export async function handleCloseIncident({ req, res, opts }, incidentCloseMatch) {
-    const id = parseInt(incidentCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const incident = closeIncident(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { incident });
-    return;
+export function handleCloseIncident(rr, match) {
+    return closeRoute(incidentRoutes, rr, match);
 }
-export async function handleGetIncident({ req, res, opts }, incidentByIdMatch) {
-    const id = parseInt(incidentByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const incident = loadIncidentById(opts.hippoRoot, ctx.tenantId, id);
-    if (!incident) {
-        throw new HttpError(404, `incident ${id} not found`);
-    }
-    sendJson(res, 200, { incident });
-    return;
+export function handleGetIncident(rr, match) {
+    return getRoute(incidentRoutes, rr, match);
 }
 //# sourceMappingURL=incidents.js.map

package/dist/server/routes/memories.js

@@ -1,12 +1,13 @@
 // Memory write routes: create, graph, archive, supersede, promote, forget, outcome, sleep.
-import { archiveRaw, forget, outcome, outcomeForLastRecall, promote, remember, sleep, supersede } from '../../api.js';
-import { buildGraphModel } from '../../graph-view.js';
-import { MAX_ENTITY_NAME_LEN } from '../../graph/types.js';
-import { HttpError, sendJson } from '../../http-util.js';
-import { canReadScope } from '../../recall-scope.js';
+import { archiveRaw, forget, outcome, outcomeForLastRecall, promote, remember, supersede } from '../../api/index.js';
+import { graphModelOf } from '../../graph/view.js';
+import { MAX_ENTITY_NAME_LEN } from '../../store/graph-rows.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
+import { requireGroup } from '../../store/port.js';
 import { assertCrossTenantAdmin, buildContextWithAuth, isLoopback } from '../auth.js';
-import { getCallerProject, getString, getStringArray, isJsonBoolean, isSetMember, parseJsonBody, parseListLimit, validateIdSegment } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { sleepInChild } from '../sleep-offload.js';
+import { getCallerProject, getString, getStringArray, isSetMember, parseJsonBody, parseListLimit, validateIdSegment } from '../validation.js';
+import { isJsonString, isJsonBoolean } from '../../util/json.js';
 const VALID_KINDS = new Set([
     'raw',
     'distilled',
@@ -52,12 +53,9 @@ export async function handleGetGraph({ req, res, opts, query }) {
     }
     const limit = parseListLimit(query.get('limit'));
     const ctx = await buildContextWithAuth(req, opts);
-    const model = buildGraphModel(ctx.hippoRoot, ctx.tenantId, {
-        entity: entityRaw ?? undefined,
-        limit,
-        canRead: (s) => s === null || canReadScope(ctx.actor, s),
-    });
-    sendJson(res, 200, model);
+    const { role, scopes, owner } = ctx.actor;
+    const rows = await requireGroup(opts.store, 'graphReads').graphRows(ctx.tenantId, { entity: entityRaw ?? undefined, limit, reader: { role, scopes, owner } });
+    sendJson(res, 200, graphModelOf(rows));
     return;
 }
 // /v1/memories/:id/* and DELETE /v1/memories/:id
@@ -180,7 +178,7 @@ export async function handleSleep({ req, res, opts }) {
         throw new HttpError(400, 'no_share must be a boolean');
     }
     // sleepCtx already built above for the admin-role gate; reuse.
-    const result = await sleep(sleepCtx, {
+    const result = await sleepInChild(sleepCtx, {
         dryRun: dryRunRaw === true,
         noShare: noShareRaw === true,
     });