hippo-memory 1.69.0 → 1.71.0

package/dist/agent-memories/sync.js

@@ -1,20 +1,20 @@
 // Runs the adapters and routes each container to its store: the project pass, the user pass and their call sites (plan designs 2, 8, 11).
-import { processEnv } from '../env.js';
+import { processEnv } from '../util/env.js';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { errorMessage } from '../log.js';
-import { loadConfig } from '../config.js';
-import { closeHippoDb, isSqliteBusy, openHippoDb, outsideRequestStores } from '../db.js';
-import { namesFoldedInto } from '../project-merge.js';
-import { isGlobalStoreRoot, originInSql, projectNames, resolveGlobalRootDir, resolveProjectIdentity } from '../project-identity.js';
-import { duplicateKey, heldTextKeys } from '../same-text.js';
+import { errorMessage } from '../util/log.js';
+import { loadConfig } from '../core/config.js';
+import { closeHippoDb, isSqliteBusy, openHippoDb, outsideRequestStores, withWriteScope } from '../db/index.js';
+import { namesFoldedInto } from '../sharing/project-merge.js';
+import { isGlobalStoreRoot, projectNames, resolveGlobalRootDir, resolveProjectIdentity } from '../core/project-identity.js';
+import { duplicateKey, heldTextKeys } from '../util/same-text.js';
 import { removeEntryMirrors } from '../store/mirrors.js';
 import { initStore, isInitialized } from '../store/open.js';
 import { writeEntryMirrors } from '../store/entry-writes.js';
-import { selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
+import { selectLiveEntriesBySourcePrefix, selectRowsOutsideSourcePrefixAt } from '../store/entry-reads.js';
 import { updateStats } from '../store/index-and-stats.js';
-import { resolveTenantId } from '../tenant.js';
+import { resolveTenantId } from '../store/tenant.js';
 import { setAsideRow, syncContainer } from './apply.js';
 import { claudeCodeAdapter, claudeTranscriptListing, transcriptNotesProject } from './claude-code.js';
 import { codexAdapter } from './codex.js';
@@ -25,7 +25,7 @@ import { openclawAdapter } from './openclaw.js';
 import { qwenCodeAdapter } from './qwen-code.js';
 import { addTally, emptyReport, mergeReports, toolReport } from './report.js';
 import { containerId, containerPrefix, splitSource } from './source.js';
-import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, isToolId, toolSourcePrefix } from './tools.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, isToolId, toolSourcePrefix } from '../core/agent-memory-tools.js';
 export const ADAPTERS = [claudeCodeAdapter, codexAdapter, geminiAdapter, copilotAdapter, openclawAdapter, qwenCodeAdapter];
 /** Overrides config because `hippo init` creates the store in the same command that imports (plan design 11). */
 export const TOOLS_ENV = 'HIPPO_AGENT_MEMORY_TOOLS';
@@ -44,29 +44,34 @@ export function importForStore(hippoRoot, opts) {
 export function importProjectMemories(hippoRoot, opts) {
     const ctx = context(opts.machine, { projectRoot: path.dirname(hippoRoot) });
     return runPass({
-        scope: 'project', target: hippoRoot, invoking: hippoRoot, list: (a) => a.list(ctx, 'project'), legacy: true, originProject: undefined, legacyOrigins: [], handover: true,
+        scope: 'project', target: hippoRoot, invoking: hippoRoot, list: (a) => a.list(ctx, 'project'), legacy: true, originProject: undefined,
+        legacyOrigins: [], handover: true,
     }, opts);
 }
 /** Every tool's user-level memory into the global store, created on demand, with no origin. */
 export function importUserMemories(invokingRoot, opts) {
     const ctx = context(opts.machine, {});
     return runPass({
-        scope: 'user', target: resolveGlobalRootDir(), invoking: invokingRoot, list: (a) => a.list(ctx, 'user'), legacy: false, originProject: '', legacyOrigins: [], handover: false,
+        scope: 'user', target: resolveGlobalRootDir(), invoking: invokingRoot, list: (a) => a.list(ctx, 'user'), legacy: false, originProject: '',
+        legacyOrigins: [], handover: false,
     }, opts);
 }
-/** Session end in a folder with no store of its own: the session's project into the global store with its origin, the session folder's notes, then the user pass. */
+/** Session end in a folder with no store of its own: the session's project into the
+ * global store with its origin, the session folder's notes, then the user pass. */
 export function importAtSessionEnd(cwd, transcriptPath, opts) {
     const globalRoot = resolveGlobalRootDir();
     const ctx = context(opts.machine, { projectRoot: cwd });
     const report = runPass({
-        scope: 'project', target: globalRoot, invoking: globalRoot, list: (a) => a.list(ctx, 'project'), legacy: false, ...projectOrigins(resolveProjectIdentity(cwd)), handover: false,
+        scope: 'project', target: globalRoot, invoking: globalRoot, list: (a) => a.list(ctx, 'project'), legacy: false,
+        ...projectOrigins(resolveProjectIdentity(cwd)), handover: false,
     }, opts);
     if (transcriptPath !== undefined)
         mergeReports(report, importSessionFolder(globalRoot, transcriptPath, cwd, opts));
     mergeReports(report, importUserMemories(globalRoot, opts));
     return report;
 }
-/** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
+/** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at
+ * home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
 export function importSessionFolder(hippoRoot, transcriptPath, cwd, opts) {
     const project = transcriptNotesProject(transcriptPath, cwd, opts.machine);
     if (project === null)
@@ -204,7 +209,7 @@ function syncStore(pass, listings, store, opts, report) {
                 out.tally.unreadable++;
                 continue;
             }
-            const work = containerWork(tool, container, opts.machine.platform, legacy, partition ?? '', earlier);
+            const work = containerWork(tool, container, { platform: opts.machine.platform, legacy, origin: partition ?? '', earlier });
             const outcome = syncOne(session, work, out, report);
             if (outcome === null)
                 continue;
@@ -214,7 +219,9 @@ function syncStore(pass, listings, store, opts, report) {
                 afterCommit(store.root, outcome, report);
         }
         if (session.dryRun)
-            out.unlisted += unlistedRows(store.db, tenantId, tool, pass.scope, listing, opts.machine.platform, partition === null ? null : [partition, ...earlier]);
+            out.unlisted += unlistedRows(store.db, tenantId, {
+                tool, scope: pass.scope, listing, platform: opts.machine.platform, partition: partition === null ? null : [partition, ...earlier],
+            });
     }
     if (remembered > 0 && !session.dryRun)
         bumpRemembered(store.root, remembered, report);
@@ -225,7 +232,8 @@ function earlierNames(db, tenantId, id, legacyOrigins) {
     const names = [id, ...legacyOrigins];
     return [...legacyOrigins, ...namesFoldedInto(db, tenantId, names)].filter((n) => n !== '' && n !== id);
 }
-function containerWork(tool, container, platform, legacy, origin, earlier) {
+function containerWork(tool, container, options) {
+    const { platform, legacy, origin, earlier } = options;
     const none = new Map();
     const own = tool.id === 'claude-code' ? legacy?.byContainer.get(container.path) : undefined;
     const prefixOf = (name) => containerPrefix(tool.id, containerId(container.path, container.scope, platform, name));
@@ -286,15 +294,11 @@ function duplicateCheck(store, tenantId, origins, adopted) {
     };
 }
 function otherPathKeys(store, tenantId, origins, adopted) {
-    const visible = store.global ? ` AND (origin_project = '' OR ${originInSql(origins)})` : '';
-    const params = store.global ? [tenantId, AGENT_MEMORY_SOURCE_PREFIX, ...origins] : [tenantId, AGENT_MEMORY_SOURCE_PREFIX];
-    // SAFETY: the SELECT names the three columns of the row type.
-    const rows = store.db.prepare(`SELECT id, content, source FROM memories
-      WHERE tenant_id = ? AND superseded_by IS NULL AND substr(source, 1, ${AGENT_MEMORY_SOURCE_PREFIX.length}) != ?${visible}`).all(...params);
+    const rows = selectRowsOutsideSourcePrefixAt(store.db, tenantId, AGENT_MEMORY_SOURCE_PREFIX, store.global ? origins : null);
     return new Set(rows.filter((r) => !adopted.has(r.id)).flatMap(heldTextKeys));
 }
-/** Dry run only: kept rows of this scope in containers this run did not list (a moved project's old folder); `partition` limits it to one project's names. */
-function unlistedRows(db, tenantId, tool, scope, listing, platform, partition) {
+function unlistedRows(db, tenantId, options) {
+    const { tool, scope, listing, platform, partition } = options;
     const listed = listing.containers.flatMap((c) => (partition ?? ['']).map((name) => containerPrefix(tool.id, containerId(c.path, c.scope, platform, name))));
     return selectLiveEntriesBySourcePrefix(db, tenantId, `${toolSourcePrefix(tool.id)}${scope === 'project' ? 'p' : 'u'}-`)
         .filter((row) => row.tags.includes(tool.tag) && !listed.some((p) => row.source.startsWith(p)))
@@ -314,7 +318,7 @@ function handOver(synced, projectRoot, opts, report) {
         const names = projectNames(resolveProjectIdentity(projectRoot));
         const origins = [...new Set([...names, ...namesFoldedInto(db, tenantId, names), ''])];
         for (const work of synced)
-            handOverContainer(db, globalRoot, tenantId, work, origins, opts.machine.platform, report);
+            handOverContainer(db, globalRoot, tenantId, work, { origins, platform: opts.machine.platform, report });
     }
     catch (err) {
         report.warnings.push(`global copies not handed over: ${isSqliteBusy(err) ? 'the global store was busy' : errorMessage(err)}`);
@@ -324,13 +328,13 @@ function handOver(synced, projectRoot, opts, report) {
             closeHippoDb(db);
     }
 }
-function handOverContainer(db, root, tenantId, work, origins, platform, report) {
+function handOverContainer(db, root, tenantId, work, options) {
+    const { origins, platform, report } = options;
     // A note the local pass could not read has no local row yet, so its global copy stays until it does.
     const unread = new Set(work.container.skipped);
     const mirror = [];
     const purge = [];
-    db.exec('BEGIN IMMEDIATE');
-    try {
+    withWriteScope(db, 'hand_over_container', () => {
         for (const origin of origins) {
             const prefix = containerPrefix(work.tool.id, containerId(work.container.path, work.container.scope, platform, origin));
             for (const row of selectLiveEntriesBySourcePrefix(db, tenantId, prefix)) {
@@ -343,15 +347,7 @@ function handOverContainer(db, root, tenantId, work, origins, platform, report)
                     purge.push(result.id);
             }
         }
-        db.exec('COMMIT');
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* already rolled back; keep the original error */ }
-        throw err;
-    }
+    });
     toolReport(report, work.tool.id).tally.handedOver += mirror.length + purge.length;
     afterCommit(root, { mirror, purge }, report);
 }

package/dist/agent-memories/types.d.ts

@@ -1,4 +1,4 @@
-import type { ToolId } from './tools.js';
+import type { ToolId } from '../core/agent-memory-tools.js';
 export type Scope = 'project' | 'user';
 /** All an adapter may know about the machine; it reads nothing else from the process, so tests can fake it all. */
 export interface AdapterContext {

package/dist/api/assemble.d.ts

@@ -1,4 +1,4 @@
-import type { CallerProject } from '../prompt-hook.js';
+import type { CallerProject } from './prompt-hook.js';
 import type { Context } from './types.js';
 export declare const DEFAULT_ASSEMBLE_BUDGET = 4000;
 export interface AssembleOpts {
@@ -9,19 +9,10 @@ export interface AssembleOpts {
     /** Substitute parent summaries for older raws when ≥2 share a level-2
      *  ancestor. Default true. */
     summarizeOlder?: boolean;
-    /**
-     * Restrict to a specific scope, same rule as
-     * `recall`: when set, exact match required (so an authorised caller can
-     * assemble a `slack:private:CSEC` session by passing scope explicitly).
-     * When undefined, default-deny applies to ANY `<source>:private:*` and
-     * `unknown:legacy` rows.
-     */
+    /** Exact scope match when set, so an authorised caller can assemble a private session.
+     * When undefined, default-deny applies to every `<source>:private:*` and `unknown:legacy` row. */
     scope?: string;
-    /**
-     * Hard row cap on the SELECT that loads session raws. Default 5000 to
-     * protect against degenerate sessions. When the cap is hit, `truncated`
-     * is set on the result so the caller knows to widen.
-     */
+    /** Hard row cap on the SELECT that loads session raws (default 5000); `truncated` is set when it is hit. */
     rowCap?: number;
     cost?: AssembleCost;
     project?: CallerProject;
@@ -51,42 +42,14 @@ export interface AssembleResult {
     sessionId: string;
     items: AssembledContextItem[];
     tokens: number;
-    /**
-     * Tenant + scope-filtered raw row count for the session, uncapped by `rowCap`, so
-     * "session has N msgs" stays accurate when items[] is the windowed view.
-     */
+    /** Tenant + scope-filtered raw row count, uncapped by `rowCap`, so "session has N msgs" stays accurate for a windowed items[]. */
     totalRaw: number;
     summarized: number;
     evicted: number;
-    /**
-     * True when `rowCap` truncated the loaded window. The cap keeps the NEWEST
-     * rows, so the items[] array represents the freshest tail of the session;
-     * older rows beyond the cap are silently absent. Use `totalRaw - items.length
-     * - summarized + ...` to estimate how much you didn't see, or widen `rowCap`.
-     */
+    /** True when `rowCap` truncated the window; the cap keeps the NEWEST rows, so older rows beyond it are absent. */
     truncated: boolean;
 }
-/**
- * Build a chronologically-ordered context window for a session. Adapts the
- * lossless-claw context-engine pattern to Hippo's score-ranked memory store.
- *
- * Algorithm:
- *   1. Load all kind='raw' rows for the session, tenant + scope filtered.
- *   2. Split: newest `freshTailCount` are protected (fresh tail).
- *   3. For older rows, when ≥2 share a level-2 parent, substitute the
- *      summary; everything else passes through as raw.
- *   4. Hippo-additive eviction: when over-budget, drop the lowest-strength
- *      non-fresh-tail item first. Fresh-tail rows are never evicted.
- *
- * Strength-weighted eviction is the differentiator from lossless-claw,
- * which evicts oldest-first. A high-strength older row (high retrieval
- * count, slow decay) survives; a low-strength recent row (newer but
- * unimportant) goes first.
- *
- * Returns `items: []` cleanly when:
- *   - sessionId is empty
- *   - no raws exist for the session
- *   - all rows fail the scope/tenant filter
- */
-export declare function assemble(ctx: Context, sessionId: string, opts?: AssembleOpts): AssembleResult;
+/** Chronological context window for a session; over budget, evicts the lowest-strength non-fresh-tail item first (fresh tail is never evicted).
+ * Returns `items: []` for an empty sessionId, no raws, or when every row fails the scope/tenant filter. */
+export declare function assemble(ctx: Context, sessionId: string, opts?: AssembleOpts): Promise<AssembleResult>;
 //# sourceMappingURL=assemble.d.ts.map

package/dist/api/assemble.js

@@ -1,55 +1,23 @@
 // Session context assembly under a token budget.
-import { loadEntriesByIds, loadSessionRawMemories, countSessionRawMemories } from '../store/entry-reads.js';
-import { estimateTokens } from '../token-ledger.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../recall-scope.js';
-import { classifyOriginProject, projectNames } from '../project-identity.js';
+import { requireGroup, storeFor } from '../store/index.js';
+import { estimateTokens } from '../util/token-text.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { classifyOriginProject, projectNames } from '../core/project-identity.js';
+const DEFAULT_FRESH_TAIL_COUNT = 10;
+const DEFAULT_ROW_CAP = 5000;
 export const DEFAULT_ASSEMBLE_BUDGET = 4000;
-/**
- * Build a chronologically-ordered context window for a session. Adapts the
- * lossless-claw context-engine pattern to Hippo's score-ranked memory store.
- *
- * Algorithm:
- *   1. Load all kind='raw' rows for the session, tenant + scope filtered.
- *   2. Split: newest `freshTailCount` are protected (fresh tail).
- *   3. For older rows, when ≥2 share a level-2 parent, substitute the
- *      summary; everything else passes through as raw.
- *   4. Hippo-additive eviction: when over-budget, drop the lowest-strength
- *      non-fresh-tail item first. Fresh-tail rows are never evicted.
- *
- * Strength-weighted eviction is the differentiator from lossless-claw,
- * which evicts oldest-first. A high-strength older row (high retrieval
- * count, slow decay) survives; a low-strength recent row (newer but
- * unimportant) goes first.
- *
- * Returns `items: []` cleanly when:
- *   - sessionId is empty
- *   - no raws exist for the session
- *   - all rows fail the scope/tenant filter
- */
-export function assemble(ctx, sessionId, opts = {}) {
+/** Chronological context window for a session; over budget, evicts the lowest-strength non-fresh-tail item first (fresh tail is never evicted).
+ * Returns `items: []` for an empty sessionId, no raws, or when every row fails the scope/tenant filter. */
+export async function assemble(ctx, sessionId, opts = {}) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
     const budget = opts.budget ?? DEFAULT_ASSEMBLE_BUDGET;
-    const freshTailCount = opts.freshTailCount ?? 10;
+    const freshTailCount = opts.freshTailCount ?? DEFAULT_FRESH_TAIL_COUNT;
     const summarizeOlder = opts.summarizeOlder ?? true;
-    const rowCap = opts.rowCap ?? 5000;
     const own = personalScopeOf(ctx.actor) ?? undefined;
     if (!sessionId) {
         return { sessionId, items: [], tokens: 0, totalRaw: 0, summarized: 0, evicted: 0, truncated: false };
     }
-    const origins = opts.project ? projectNames(opts.project) : undefined;
-    const rows = loadSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, rowCap, origins);
-    const truncated = rows.length === rowCap;
-    // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
-    const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope, own));
-    let totalRaw;
-    if (truncated) {
-        // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
-        // caller cannot infer private rows by comparing totalRaw to items.length.
-        totalRaw = countSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, opts.scope, own, origins);
-    }
-    else {
-        totalRaw = scoped.length;
-    }
+    const { scoped, totalRaw, truncated } = await loadScopedRaws(ctx, sessionId, opts, own);
     if (scoped.length === 0) {
         return { sessionId, items: [], tokens: 0, totalRaw, summarized: 0, evicted: 0, truncated };
     }
@@ -59,17 +27,11 @@ export function assemble(ctx, sessionId, opts = {}) {
     const tailRows = scoped.slice(tailStartIdx);
     // Substitute parent summaries for older rows that share one.
     const { olderItems, summarized } = summarizeOlder && olderRows.length > 0
-        ? substituteSummaries(ctx, olderRows, opts.scope, own, opts.project)
+        ? await substituteSummaries(ctx, olderRows, opts.scope, own, opts.project)
         : { olderItems: olderRows.map(rawItem), summarized: 0 };
-    const tailItems = tailRows.map((r) => ({
-        id: r.id,
-        content: r.content,
-        createdAt: r.created,
-        isFreshTail: true,
-        strength: r.strength,
-    }));
+    const tailItems = tailRows.map(freshTailItem);
     // Byte compare is chronological for the fixed-form UTC ISO timestamps
-    // (invariant documented in src/memory.ts above MemoryEntry).
+    // (invariant documented in src/core/memory.ts above MemoryEntry).
     const cmpIso = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
     olderItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
     tailItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
@@ -78,6 +40,25 @@ export function assemble(ctx, sessionId, opts = {}) {
     const { items, tokens, evicted } = evictToBudget([...olderItems, ...tailItems], itemCost, room);
     return { sessionId, items, tokens, totalRaw, summarized, evicted, truncated };
 }
+async function loadScopedRaws(ctx, sessionId, opts, own) {
+    const rowCap = opts.rowCap ?? DEFAULT_ROW_CAP;
+    const origins = opts.project ? projectNames(opts.project) : undefined;
+    const dag = requireGroup(storeFor(ctx), 'dagReads');
+    const rows = await dag.sessionRawEntries({ tenantId: ctx.tenantId, sessionId, cap: rowCap, origins });
+    const truncated = rows.length === rowCap;
+    // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
+    const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope, own));
+    let totalRaw;
+    if (truncated) {
+        // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
+        // caller cannot infer private rows by comparing totalRaw to items.length.
+        totalRaw = await dag.sessionRawCount({ tenantId: ctx.tenantId, sessionId, scope: opts.scope, ownScope: own, origins });
+    }
+    else {
+        totalRaw = scoped.length;
+    }
+    return { scoped, totalRaw, truncated };
+}
 function rawItem(r) {
     return {
         id: r.id,
@@ -86,7 +67,16 @@ function rawItem(r) {
         strength: r.strength,
     };
 }
-function substituteSummaries(ctx, olderRows, scope, own, project) {
+function freshTailItem(r) {
+    return {
+        id: r.id,
+        content: r.content,
+        createdAt: r.created,
+        isFreshTail: true,
+        strength: r.strength,
+    };
+}
+async function substituteSummaries(ctx, olderRows, scope, own, project) {
     const olderItems = [];
     let summarized = 0;
     const olderByParent = new Map();
@@ -99,7 +89,7 @@ function substituteSummaries(ctx, olderRows, scope, own, project) {
     }
     const eligibleParentIds = Array.from(olderByParent.keys()).filter((pid) => (olderByParent.get(pid)?.length ?? 0) >= 2);
     const parents = eligibleParentIds.length > 0
-        ? loadEntriesByIds(ctx.hippoRoot, eligibleParentIds, ctx.tenantId)
+        ? (await storeFor(ctx).entriesByIds(eligibleParentIds, ctx.tenantId))
             .filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by)
             .filter((p) => passesScopeFilterForRecall(p.scope ?? null, scope, own))
             .filter((p) => !project || classifyOriginProject(p.origin_project, project) !== 'cross-project')

package/dist/api/audit.d.ts

@@ -1,5 +1,5 @@
-import { type AuditEvent, type AuditOp } from '../audit.js';
-import type { KeysetPosition } from '../keyset.js';
+import type { AuditEvent, AuditIssue, AuditOp } from '../store/audit.js';
+import type { KeysetPosition } from '../util/keyset.js';
 import type { Context } from './types.js';
 export interface AuditListOpts {
     op?: AuditOp;
@@ -9,9 +9,10 @@ export interface AuditListOpts {
     /** Resume after this row: the (ts, id) position the previous page ended on. */
     after?: KeysetPosition;
 }
-/**
- * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
- * cmdAuditList, which does not record a 'recall'-style read event).
- */
-export declare function auditList(ctx: Context, opts: AuditListOpts): AuditEvent[];
+/** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
+export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<AuditEvent[]>;
+/** The pass that removes audit errors; it leads the reason on each forget row. */
+export type AuditPass = 'audit --fix' | 'sleep-audit';
+/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
+export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): string[];
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -1,23 +1,17 @@
-// Audit log queries.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { queryAuditEvents } from '../audit.js';
-/**
- * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
- * cmdAuditList, which does not record a 'recall'-style read event).
- */
-export function auditList(ctx, opts) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return queryAuditEvents(db, {
-            tenantId: ctx.tenantId,
-            op: opts.op,
-            since: opts.since,
-            limit: opts.limit,
-            after: opts.after,
-        });
-    }
-    finally {
-        closeHippoDb(db);
-    }
+// Audit log queries, and the removal of the memories a quality audit marks as errors.
+import { deleteEntry } from '../store/delete-and-batch.js';
+import { requireGroup, storeFor } from '../store/index.js';
+/** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
+export async function auditList(ctx, opts) {
+    return requireGroup(storeFor(ctx), 'auditLog').listAuditEvents({
+        tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
+    });
+}
+/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
+export function removeAuditErrors(ctx, pass, issues) {
+    return issues
+        .filter((issue) => issue.severity === 'error')
+        .filter((issue) => deleteEntry(ctx.hippoRoot, issue.memoryId, { actor: ctx.actor.subject, reason: `${pass}: ${issue.reason}`, automatic: true }))
+        .map((issue) => issue.memoryId);
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/auth.d.ts

@@ -1,15 +1,14 @@
-import { type ApiKeyListItem, type ApiKeyListRow } from '../auth.js';
-import type { KeysetPosition } from '../keyset.js';
+import { type ApiKeyListRow } from '../store/auth.js';
+import type { KeysetPosition } from '../util/keyset.js';
 import type { Context, StoreReply } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
-    /**
-     * Authorization role for the new key. Defaults to `'admin'` for
-     * back-compat with keys minted before roles existed (the api_keys.role column DEFAULT also
-     * resolves to 'admin' if omitted from the INSERT). Member keys are
-     * 403-blocked from admin-gated routes (e.g. `POST /v1/sleep`).
-     */
+    /** Defaults to `'member'`, which admin-gated routes such as `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
     role?: 'admin' | 'member';
+    /** Days until the key expires: above 0 and at most 3650. Defaults to 90. */
+    ttlDays?: number;
+    /** True mints a key that never expires, which has to be asked for by name; refused together with `ttlDays`. */
+    noExpiry?: boolean;
 }
 export interface AuthCreateResult {
     keyId: string;
@@ -17,18 +16,11 @@ export interface AuthCreateResult {
     tenantId: string;
     /** The role bound to the new key (admin | member). */
     role: 'admin' | 'member';
+    /** ISO time the key stops working; null for a key that never expires. */
+    expiresAt: string | null;
 }
-/**
- * Mint a new API key. The new key is ALWAYS bound to `ctx.tenantId`. Callers
- * cannot override the tenant via the opts bag — a previous `tenantId` field
- * was removed because the HTTP layer would happily forward `body.tenantId`,
- * letting tenant A mint a key for tenant B. The HTTP route handler at
- * `src/server.ts` POST /v1/auth/keys mirrors this: it ignores any body
- * `tenantId` and uses the resolved Bearer's tenant exclusively.
- *
- * Only an admin actor can mint (ForbiddenError otherwise), and a key never
- * outranks its minter: a resolver admin is tenant-only, so it mints members.
- */
+/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
+ * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
 export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
 export interface AuthCreateSelfOpts {
     label?: string;
@@ -41,27 +33,15 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
     /** ISO time the key stops working. */
     expiresAt: string;
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together.
- *  With `ctx.store`, its keyWrites group runs that transaction; hippo.db is opened only when there is no store. */
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
+ * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
 export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
-/**
- * List API keys visible to the calling tenant.
- *
- * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
- * regardless of tenant (single-tenant deployments). The API surface is tenant-
- * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only, so no audit emit.
- */
-export declare function authList<C extends Context>(ctx: C, opts: {
-    active: boolean;
-}): StoreReply<C, ApiKeyListItem[]>;
 type KeyListOpts = {
     active: boolean;
     limit?: number;
     after?: KeysetPosition;
 };
-/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from.
- *  With `ctx.store`, its keyWrites group reads them; hippo.db is opened only when there is no store. */
+/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
 export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
 export interface AuthRevokeResult {
     ok: true;
@@ -69,12 +49,10 @@ export interface AuthRevokeResult {
 }
 export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>;
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
- *  With `ctx.store`, its keyAudit group revokes and writes the auth_revoke row; hippo.db is opened only when there is no store. */
+ *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
 export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
-/**
- * The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
- * so the local CLI can run revoke and grant in the key's own tenant.
- */
+/** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
+ * so the local CLI can run revoke and grant in the key's own tenant. */
 export declare function authKeyTenant(ctx: Context, keyId: string): string | undefined;
 /** Shared result shape for authGrant/authUngrant, named per the file's oxlint anti-slop rule. */
 export interface AuthGrantResult {