hippo-memory 1.69.0 → 1.71.0

package/dist/cli/audit-prune.js

@@ -0,0 +1,40 @@
+/** Audit log retention pruning: opt-in per tenant because retention floors (HIPAA, SOX, GDPR) apply.
+ * The audit_prune row is written after the DELETE, so a call never prunes its own record. */
+import { pruneAuditRows } from '../store/audit.js';
+import { DAY_MS } from '../util/time.js';
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export function computeCutoff(days, now = new Date()) {
+    const cutoff = new Date(now.getTime() - days * DAY_MS);
+    return cutoff.toISOString();
+}
+function isTenantIdString(value) {
+    return typeof value === 'string';
+}
+/** Delete audit_log rows older than `olderThanDays` for `tenantId`, emitting an `audit_prune` event.
+ * Throws on non-positive days or a missing tenantId. */
+export function pruneAuditLog(hippoRoot, opts) {
+    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
+        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
+    }
+    if (!opts.tenantId || !isTenantIdString(opts.tenantId)) {
+        throw new Error('pruneAuditLog: tenantId is required');
+    }
+    const dryRun = opts.dryRun === true;
+    const actor = opts.actor ?? 'cli';
+    const cutoff = computeCutoff(opts.olderThanDays);
+    const count = pruneAuditRows(hippoRoot, { tenantId: opts.tenantId, cutoff, actor, olderThanDays: opts.olderThanDays, dryRun });
+    return { cutoff, count, dryRun };
+}
+/** Parse `--older-than`: bare integer days (`30`) or with a `d` suffix (`30d`); throws on any other format. */
+export function parseOlderThanFlag(raw) {
+    const m = raw.match(/^(\d+)(d)?$/i);
+    if (!m) {
+        throw new Error(`Invalid --older-than value: "${raw}". Expected integer days (e.g. "30") or with d suffix ("30d").`);
+    }
+    const n = parseInt(m[1], 10);
+    if (!Number.isFinite(n) || n <= 0) {
+        throw new Error(`Invalid --older-than value: "${raw}". Must be a positive integer.`);
+    }
+    return n;
+}
+//# sourceMappingURL=audit-prune.js.map

package/dist/cli/audit.d.ts

@@ -1,3 +1,3 @@
-import { type CommandContext } from './shared.js';
-export declare function handleAudit({ hippoRoot, args, flags }: CommandContext): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleAudit({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/cli/audit.js

@@ -1,57 +1,65 @@
 // `hippo audit`: list and prune the audit log.
 import { loadAllEntries } from '../store/entry-reads.js';
-import { deleteEntry, memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { auditMemories, AUDIT_OPS } from '../audit.js';
-import * as api from '../api.js';
-import { resolveTenantId } from '../tenant.js';
-import { pruneAuditLog, parseOlderThanFlag } from '../audit-prune.js';
+import { memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { auditMemories, AUDIT_OPS } from '../store/audit.js';
+import * as api from '../api/index.js';
+import { pruneAuditLog, parseOlderThanFlag } from './audit-prune.js';
 import { printError } from './output.js';
+import { cliApiContext } from './api-context.js';
+import { boolFlag, flagIsTrue, isBooleanFlag, stringFlag } from './flag-values.js';
 import { requireInit, resolveAuthRoot } from './shared.js';
-import { repairAutomaticMemories } from '../quality-repair.js';
-import { getGlobalRoot } from '../shared.js';
-// ---------------------------------------------------------------------------
+import { repairAutomaticMemories } from '../store/quality-repair.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
+import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 // Audit log subcommands (`hippo audit list`)
-// ---------------------------------------------------------------------------
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 function formatAuditRow(ev) {
     const target = ev.targetId ?? '-';
     const meta = JSON.stringify(ev.metadata ?? {});
     return `${ev.ts}  ${ev.actor}  ${ev.op}  ${target}  ${meta}`;
 }
-function cmdAuditList(hippoRoot, flags) {
-    const root = resolveAuthRoot(hippoRoot, flags);
-    const asJson = Boolean(flags['json']);
-    const tenantId = resolveTenantId({});
-    const opFlag = typeof flags['op'] === 'string' ? flags['op'] : undefined;
+function readAuditOp(flags) {
+    const opFlag = stringFlag(flags, 'op');
+    // SAFETY: Set.has only compares by value, so a string outside the audit ops is a plain miss.
     if (opFlag && !VALID_AUDIT_OPS.has(opFlag)) {
         // Built from the Set so the message cannot drift from the valid ops.
         const expected = Array.from(VALID_AUDIT_OPS).join(' | ');
         printError(`Unknown --op value: ${opFlag}. Expected one of: ${expected}.`);
-        process.exit(1);
-    }
-    const op = opFlag;
-    const since = typeof flags['since'] === 'string' ? flags['since'] : undefined;
-    if (since !== undefined && !Number.isFinite(new Date(since).getTime())) {
-        printError(`Invalid --since: ${since} (expected an ISO timestamp like 2026-04-22 or 2026-04-22T12:00:00Z).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
+    // SAFETY: the exit above rejects every non-empty opFlag outside VALID_AUDIT_OPS, and an empty one is returned as given.
+    return opFlag;
+}
+function readAuditLimit(flags) {
     const limitRaw = flags['limit'];
     let limit = 100;
-    if (limitRaw !== undefined && typeof limitRaw !== 'boolean') {
+    if (limitRaw !== undefined && !isBooleanFlag(limitRaw)) {
         const parsed = parseInt(String(limitRaw), 10);
         if (!Number.isFinite(parsed)) {
             printError(`Invalid --limit value: ${String(limitRaw)} (expected a positive integer).`);
-            process.exit(1);
+            throw new CliExit(1);
         }
         limit = parsed;
     }
     if (limit < 1 || limit > 10000) {
         printError(`--limit must be between 1 and 10000 (got ${limit}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
+    return limit;
+}
+async function cmdAuditList(hippoRoot, tenantId, flags) {
+    const root = resolveAuthRoot(hippoRoot, flags);
+    const asJson = boolFlag(flags, 'json');
+    const op = readAuditOp(flags);
+    const since = stringFlag(flags, 'since');
+    if (since !== undefined && !Number.isFinite(new Date(since).getTime())) {
+        printError(`Invalid --since: ${since} (expected an ISO timestamp like 2026-04-22 or 2026-04-22T12:00:00Z).`);
+        throw new CliExit(1);
+    }
+    const limit = readAuditLimit(flags);
     const ctx = { hippoRoot: root, tenantId, actor: { subject: 'cli', role: 'admin' } };
-    const events = api.auditList(ctx, { op, since, limit });
+    const events = await api.auditList(ctx, { op, since, limit });
     if (asJson) {
         console.log(JSON.stringify(events));
         return;
@@ -65,33 +73,24 @@ function cmdAuditList(hippoRoot, flags) {
         console.log(formatAuditRow(ev));
     }
 }
-function cmdAuditPrune(hippoRoot, flags) {
-    const olderThanRaw = typeof flags['older-than'] === 'string' ? flags['older-than'] : '';
+function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
+    const olderThanRaw = stringFlag(flags, 'older-than') ?? '';
     if (!olderThanRaw) {
         printError('Usage: hippo audit prune --older-than <Nd> [--dry-run] [--tenant <t>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     let olderThanDays;
     try {
         olderThanDays = parseOlderThanFlag(olderThanRaw);
     }
     catch (e) {
-        printError(e.message);
-        process.exit(1);
-    }
-    const tenantId = typeof flags['tenant'] === 'string'
-        ? flags['tenant'].trim() || resolveTenantId({})
-        : resolveTenantId({});
-    const dryRun = flags['dry-run'] === true;
-    const asJson = Boolean(flags['json']);
-    const db = openHippoDb(hippoRoot);
-    let result;
-    try {
-        result = pruneAuditLog(db, { olderThanDays, tenantId, dryRun, actor: 'cli' });
-    }
-    finally {
-        closeHippoDb(db);
+        printError(errorMessage(e));
+        throw new CliExit(1);
     }
+    const tenantId = stringFlag(flags, 'tenant')?.trim() || ctxTenantId;
+    const dryRun = flagIsTrue(flags, 'dry-run');
+    const asJson = boolFlag(flags, 'json');
+    const result = pruneAuditLog(hippoRoot, { olderThanDays, tenantId, dryRun, actor: 'cli' });
     if (asJson) {
         console.log(JSON.stringify(result));
         return;
@@ -102,54 +101,71 @@ function cmdAuditPrune(hippoRoot, flags) {
         console.log('(dry-run; re-run without --dry-run to actually delete)');
     }
 }
-function cmdAuditLog(hippoRoot, args, flags) {
+async function cmdAuditLog(hippoRoot, tenantId, args, flags) {
     const sub = args[0];
     if (sub === 'list') {
-        cmdAuditList(hippoRoot, flags);
+        await cmdAuditList(hippoRoot, tenantId, flags);
         return;
     }
     if (sub === 'prune') {
-        cmdAuditPrune(hippoRoot, flags);
+        cmdAuditPrune(hippoRoot, tenantId, flags);
         return;
     }
     printError(`Unknown audit subcommand: ${sub}. Expected: list | prune.`);
-    process.exit(1);
+    throw new CliExit(1);
+}
+function auditRepair(hippoRoot, tenantId, flags) {
+    const apply = flagIsTrue(flags, 'apply') && flags['dry-run'] !== true;
+    const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId, apply });
+    if (flags['json']) {
+        console.log(JSON.stringify(result));
+        return;
+    }
+    console.log(`Quality repair ${apply ? 'apply' : 'preview'}: ${result.issues.length} issue(s) across ${result.total} memories.`);
+    for (const issue of result.issues)
+        console.log(`  [${issue.disposition}] ${issue.id}: ${issue.reason}${issue.protection ? ` (${issue.protection})` : ''}`);
+    for (const blocker of result.blockers)
+        console.log(`  Blocked: ${blocker}. Repair never upgrades a store; any other hippo command does, then run repair again.`);
+    const restore = `hippo dormant restore <id>${flags['global'] ? ' --global' : ''}`;
+    if (result.backup)
+        console.log(`Backup: ${result.backup}\nMoved ${result.appliedIds.length} memories to dormant storage. Recovery: ${restore}.`);
+    else if (apply && result.supported)
+        console.log('Nothing moved: no unprotected memory has a certain defect.');
+    for (const warning of result.warnings)
+        console.log(`Warning: ${warning}`);
+    if (!apply)
+        console.log('Preview only. Add --apply to move set-aside memories to dormant storage. Pin a review memory to keep it.');
 }
-export function handleAudit({ hippoRoot, args, flags }) {
+function fixAuditErrors(hippoRoot, tenantId, result, flags) {
+    const errors = result.issues.filter(i => i.severity === 'error');
+    if (errors.length > 0 && flagIsTrue(flags, 'dry-run')) {
+        console.log(`\nWould remove ${errors.length} error-severity memories (dry run, nothing deleted).`);
+        console.log(`${result.issues.length - errors.length} warnings would remain (review manually).`);
+    }
+    else if (errors.length > 0) {
+        const ctx = cliApiContext(hippoRoot, tenantId);
+        const removedCount = api.removeAuditErrors(ctx, 'audit --fix', errors).length;
+        console.log(`\nRemoved ${removedCount} error-severity memories.`);
+        console.log(`${result.issues.length - errors.length} warnings remain (review manually).`);
+    }
+    else {
+        console.log(`\nNo error-severity issues. Warnings require manual review.`);
+    }
+}
+export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
     if (args[0] === 'repair') {
-        const apply = flags['apply'] === true && flags['dry-run'] !== true;
-        const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId: resolveTenantId({}), apply });
-        if (flags['json']) {
-            console.log(JSON.stringify(result));
-            return;
-        }
-        console.log(`Quality repair ${apply ? 'apply' : 'preview'}: ${result.issues.length} issue(s) across ${result.total} memories.`);
-        for (const issue of result.issues)
-            console.log(`  [${issue.disposition}] ${issue.id}: ${issue.reason}${issue.protection ? ` (${issue.protection})` : ''}`);
-        for (const blocker of result.blockers)
-            console.log(`  Blocked: ${blocker}. Repair never upgrades a store; any other hippo command does, then run repair again.`);
-        const restore = `hippo dormant restore <id>${flags['global'] ? ' --global' : ''}`;
-        if (result.backup)
-            console.log(`Backup: ${result.backup}\nMoved ${result.appliedIds.length} memories to dormant storage. Recovery: ${restore}.`);
-        else if (apply && result.supported)
-            console.log('Nothing moved: no unprotected memory has a certain defect.');
-        for (const warning of result.warnings)
-            console.log(`Warning: ${warning}`);
-        if (!apply)
-            console.log('Preview only. Add --apply to move set-aside memories to dormant storage. Pin a review memory to keep it.');
+        auditRepair(hippoRoot, tenantId, flags);
         return;
     }
-    // `audit list` and `audit prune` -> audit-log subcommands.
-    // Other forms (no sub, --fix) keep the existing memory-quality auditor
-    // for backwards compatibility.
+    // `audit list` and `audit prune` are the audit-log subcommands; other forms (no sub, --fix) keep the memory-quality auditor.
     if (args[0] === 'list' || args[0] === 'prune') {
-        cmdAuditLog(hippoRoot, args, flags);
+        await cmdAuditLog(hippoRoot, tenantId, args, flags);
         return;
     }
     requireInit(hippoRoot);
-    const entries = loadAllEntries(hippoRoot, resolveTenantId({}));
+    const entries = loadAllEntries(hippoRoot, tenantId);
     const result = auditMemories(entries, memoriesBackingObjects(hippoRoot));
-    const shouldFix = Boolean(flags['fix']);
+    const shouldFix = boolFlag(flags, 'fix');
     if (result.issues.length === 0) {
         console.log(`All ${result.total} memories passed quality checks.`);
     }
@@ -161,19 +177,7 @@ export function handleAudit({ hippoRoot, args, flags }) {
             console.log(`         "${issue.content.slice(0, 80)}${issue.content.length > 80 ? '...' : ''}"`);
         }
         if (shouldFix) {
-            const errors = result.issues.filter(i => i.severity === 'error');
-            if (errors.length > 0 && flags['dry-run'] === true) {
-                console.log(`\nWould remove ${errors.length} error-severity memories (dry run, nothing deleted).`);
-                console.log(`${result.issues.length - errors.length} warnings would remain (review manually).`);
-            }
-            else if (errors.length > 0) {
-                const removedCount = errors.filter((issue) => deleteEntry(hippoRoot, issue.memoryId, { reason: `audit --fix: ${issue.reason}`, automatic: true })).length;
-                console.log(`\nRemoved ${removedCount} error-severity memories.`);
-                console.log(`${result.issues.length - errors.length} warnings remain (review manually).`);
-            }
-            else {
-                console.log(`\nNo error-severity issues. Warnings require manual review.`);
-            }
+            fixAuditErrors(hippoRoot, tenantId, result, flags);
         }
         else {
             console.log(`\nRun with --fix to auto-remove error-severity issues.`);

package/dist/cli/auth.d.ts

@@ -1,2 +1,3 @@
-export declare function cmdAuth(hippoRoot: string, args: string[], flags: Record<string, string | boolean | string[]>): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleAuth({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/auth.js

@@ -1,39 +1,60 @@
 // `hippo auth`: create, list, revoke and scope API keys.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { listApiKeys } from '../auth.js';
-import * as api from '../api.js';
-import { resolveTenantId } from '../tenant.js';
+import { listApiKeys } from '../store/auth.js';
+import * as api from '../api/index.js';
+import { cliApiContext } from './api-context.js';
 import { printError } from './output.js';
+import { boolFlag, stringFlag } from './flag-values.js';
 import { resolveAuthRoot } from './shared.js';
+import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 // ---------------------------------------------------------------------------
 // Auth subcommands
 // ---------------------------------------------------------------------------
-function cmdAuthCreate(hippoRoot, flags) {
+/** --role as given, or undefined for the default; anything else exits 1, so a typo never picks a role. */
+function roleFlagOrExit(flags) {
+    const roleFlag = stringFlag(flags, 'role');
+    if (roleFlag !== undefined && roleFlag !== 'admin' && roleFlag !== 'member') {
+        printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
+        throw new CliExit(1);
+    }
+    return roleFlag;
+}
+/** Says which defaults a mint took and how to ask for the wider key. Stderr keeps --json output clean. */
+function noteMintDefaults(roleGiven, expiryGiven) {
+    const notes = [];
+    if (!roleGiven)
+        notes.push('no --role given, so this is a member key (pass --role admin for an admin key)');
+    if (!expiryGiven)
+        notes.push('no --ttl-days or --no-expiry given, so it expires in 90 days');
+    if (notes.length > 0)
+        printError(`hippo auth create: ${notes.join('; ')}.`);
+}
+function cmdAuthCreate(hippoRoot, defaultTenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const tenantFlag = typeof flags['tenant'] === 'string' ? flags['tenant'] : undefined;
-    const labelFlag = typeof flags['label'] === 'string' ? flags['label'] : undefined;
-    const asJson = Boolean(flags['json']);
-    // Accepts 'admin' | 'member' only; anything else exits 1 so a typo doesn't silently default to admin.
-    const roleFlag = typeof flags['role'] === 'string' ? flags['role'] : undefined;
-    let role = 'admin';
-    if (roleFlag !== undefined) {
-        if (roleFlag !== 'admin' && roleFlag !== 'member') {
-            printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
-            process.exit(1);
-        }
-        role = roleFlag;
-    }
+    const tenantFlag = stringFlag(flags, 'tenant');
+    const labelFlag = stringFlag(flags, 'label');
+    const asJson = boolFlag(flags, 'json');
+    const role = roleFlagOrExit(flags);
+    const ttlFlag = stringFlag(flags, 'ttl-days');
+    const ttlDays = ttlFlag === undefined ? undefined : Number(ttlFlag);
+    const noExpiry = boolFlag(flags, 'no-expiry');
     // The CLI's --tenant flag is the only legitimate cross-tenant override
     // (admin minting a key for another tenant from the local machine). It
     // flows through ctx.tenantId, NOT through opts — authCreate's opts no
     // longer accepts a tenantId field, so the HTTP layer cannot smuggle a
     // body.tenantId across.
-    const ctx = {
-        hippoRoot: root,
-        tenantId: tenantFlag ?? resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
-    const result = api.authCreate(ctx, { label: labelFlag, role });
+    const ctx = cliApiContext(root, tenantFlag ?? defaultTenantId);
+    let result;
+    try {
+        result = api.authCreate(ctx, { label: labelFlag, role, ttlDays, noExpiry: noExpiry || undefined });
+    }
+    catch (err) {
+        if (!(err instanceof api.BadRequestError))
+            throw err;
+        printError(`hippo auth create: ${err.message} (--ttl-days, --no-expiry).`);
+        throw new CliExit(1);
+    }
+    noteMintDefaults(role !== undefined, ttlFlag !== undefined || noExpiry);
     if (asJson) {
         console.log(JSON.stringify({
             keyId: result.keyId,
@@ -41,12 +62,14 @@ function cmdAuthCreate(hippoRoot, flags) {
             tenantId: result.tenantId,
             label: labelFlag ?? null,
             role: result.role,
+            expiresAt: result.expiresAt,
         }));
         return;
     }
     console.log(`key_id:    ${result.keyId}`);
     console.log(`plaintext: ${result.plaintext}`);
     console.log(`role:      ${result.role}`);
+    console.log(`expires:   ${result.expiresAt ?? 'never'}`);
     console.log('');
     console.log('!! WARNING: this is the ONLY time the plaintext key will be shown. !!');
     console.log('!! Copy it now. Hippo stores only a scrypt hash and cannot recover it. !!');
@@ -60,16 +83,9 @@ function formatKeyRow(item) {
 }
 function cmdAuthList(hippoRoot, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const includeRevoked = Boolean(flags['all']);
-    const asJson = Boolean(flags['json']);
-    const db = openHippoDb(root);
-    let items;
-    try {
-        items = listApiKeys(db, { active: !includeRevoked });
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const includeRevoked = boolFlag(flags, 'all');
+    const asJson = boolFlag(flags, 'json');
+    const items = listApiKeys(root, { active: !includeRevoked });
     if (asJson) {
         console.log(JSON.stringify(items));
         return;
@@ -84,24 +100,24 @@ function cmdAuthList(hippoRoot, flags) {
     }
 }
 // The local CLI owns every tenant, so revoke and grant run in the key's own tenant.
-function keyContext(root, keyId) {
-    const hostCtx = { hippoRoot: root, tenantId: resolveTenantId({}), actor: api.adminActor('cli') };
+function keyContext(root, tenantId, keyId) {
+    const hostCtx = cliApiContext(root, tenantId);
     const keyTenant = api.authKeyTenant(hostCtx, keyId);
     if (keyTenant === undefined) {
         printError(`Unknown key_id: ${keyId}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return { ...hostCtx, tenantId: keyTenant };
 }
-function cmdAuthRevoke(hippoRoot, keyId, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), keyId);
+function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
+    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     let revokedAt;
     try {
         revokedAt = api.authRevoke(ctx, keyId).revokedAt;
     }
     catch (err) {
-        printError(`Error: ${err instanceof Error ? err.message : String(err)}`);
-        process.exit(1);
+        printError(`Error: ${errorMessage(err)}`);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify({ keyId, revokedAt }));
@@ -110,8 +126,8 @@ function cmdAuthRevoke(hippoRoot, keyId, flags) {
     console.log(`Revoked ${keyId} at ${revokedAt}`);
 }
 /** `hippo auth grant|ungrant <key_id> <scope>`, routed through api so the tenant, restricted-scope and audit checks live in one place. */
-function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), keyId);
+function cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, grant, flags) {
+    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     try {
         if (grant)
             api.authGrant(ctx, keyId, scope);
@@ -119,8 +135,8 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
             api.authUngrant(ctx, keyId, scope);
     }
     catch (err) {
-        printError(`Error: ${err instanceof Error ? err.message : String(err)}`);
-        process.exit(1);
+        printError(`Error: ${errorMessage(err)}`);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify({ keyId, scope, granted: grant }));
@@ -128,16 +144,16 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
     }
     console.log(grant ? `Granted ${keyId} read access to ${scope}` : `Removed ${keyId}'s grant on ${scope}`);
 }
-export function cmdAuth(hippoRoot, args, flags) {
+export function handleAuth({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0];
     if (!sub) {
         printError('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const subArgs = args.slice(1);
     switch (sub) {
         case 'create':
-            cmdAuthCreate(hippoRoot, flags);
+            cmdAuthCreate(hippoRoot, tenantId, flags);
             return;
         case 'list':
             cmdAuthList(hippoRoot, flags);
@@ -146,9 +162,9 @@ export function cmdAuth(hippoRoot, args, flags) {
             const keyId = subArgs[0];
             if (!keyId) {
                 printError('Usage: hippo auth revoke <key_id>');
-                process.exit(1);
+                throw new CliExit(1);
             }
-            cmdAuthRevoke(hippoRoot, keyId, flags);
+            cmdAuthRevoke(hippoRoot, tenantId, keyId, flags);
             return;
         }
         case 'grant':
@@ -156,14 +172,14 @@ export function cmdAuth(hippoRoot, args, flags) {
             const [keyId, scope] = subArgs;
             if (!keyId || !scope) {
                 printError(`Usage: hippo auth ${sub} <key_id> <scope>`);
-                process.exit(1);
+                throw new CliExit(1);
             }
-            cmdAuthScopeGrant(hippoRoot, keyId, scope, sub === 'grant', flags);
+            cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, sub === 'grant', flags);
             return;
         }
         default:
             printError(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke | grant | ungrant.`);
-            process.exit(1);
+            throw new CliExit(1);
     }
 }
 //# sourceMappingURL=auth.js.map

package/dist/cli/briefs.d.ts

@@ -1,4 +1,5 @@
-export declare function cmdProjectBrief(hippoRoot: string, args: string[], flags: Record<string, string | boolean | string[]>): void;
-export declare function cmdGraph(hippoRoot: string, args: string[], flags: Record<string, string | boolean | string[]>): void;
-export declare function cmdCustomerNote(hippoRoot: string, args: string[], flags: Record<string, string | boolean | string[]>): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleProjectBrief({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleGraph({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleCustomerNote({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=briefs.d.ts.map