hippo-memory 1.69.0 → 1.71.0

package/dist/server/route-table.js

@@ -0,0 +1,202 @@
+import { withSqliteOffLoop } from '../db/index.js';
+import { hasGroup } from '../store/index.js';
+import { runsOffLoop } from '../store/sqlite/worker-store.js';
+import { HttpError, JSON_HEADERS, sendJson, STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
+import { buildContextWithAuth, requireAuth } from './auth.js';
+import { matchPath, noteAccess } from './request.js';
+import { handleApproveQuarantine, handleCreateAuthKey, handleListAudit, handleListAuthKeys, handleListQuarantine, handleRejectQuarantine, handleRevokeAuthKey } from './routes/admin.js';
+import { handleCloseCustomerNote, handleCreateCustomerNote, handleGetCustomerNote, handleListCustomerNotes, handleSupersedeCustomerNote } from './routes/customer-notes.js';
+import { handleCloseDecision, handleCreateDecision, handleGetDecision, handleListDecisions, handleSupersedeDecision } from './routes/decisions.js';
+import { handleCloseIncident, handleCreateIncident, handleGetIncident, handleListIncidents, handleResolveIncident } from './routes/incidents.js';
+import { handleApplyOutcome, handleArchiveMemory, handleCreateMemory, handleForgetMemory, handleGetGraph, handlePromoteMemory, handleSleep, handleSupersedeMemory } from './routes/memories.js';
+import { handleClosePolicy, handleCreatePolicy, handleGetPolicy, handleListPolicies, handlePoliciesAsOf, handleSupersedePolicy } from './routes/policies.js';
+import { handleClosePrediction, handleCreatePrediction, handleGetPrediction, handleListPredictions, handlePredictionStats } from './routes/predictions.js';
+import { handleCloseProcess, handleCreateProcess, handleGetProcess, handleListProcesses, handleSupersedeProcess } from './routes/processes.js';
+import { handleCloseProjectBrief, handleCreateProjectBrief, handleGetProjectBrief, handleListProjectBriefs, handleRefreshProjectBrief, handleSupersedeProjectBrief } from './routes/project-briefs.js';
+import { handleAssembleSession, handleDrillRecall, handleGetContext, handleRecallMemories } from './routes/recall.js';
+import { handleCloseSkill, handleCreateSkill, handleExportSkills, handleGetSkill, handleListSkills, handleSupersedeSkill } from './routes/skills.js';
+import { parseJsonBody } from './validation.js';
+// Explicit allow-list for unauthenticated /v1/* routes: add a new one here AND in tests/server-bearer-lockdown.test.ts; never gate auth by `path.startsWith`.
+// Handlers check `isPublicRoute` before auth, so an entry without that check is a no-op (fail-closed); other open paths are ServeOpts.publicJson GETs.
+const PUBLIC_ROUTES = new Set([
+    'POST /v1/connectors/slack/events',
+    'POST /v1/connectors/github/events',
+]);
+export function isPublicRoute(method, path) {
+    return PUBLIC_ROUTES.has(`${method} ${path}`);
+}
+/** The /v1 routes in dispatch order; the first entry whose method and path match handles the request. */
+const V1_ROUTES = [
+    { method: 'POST', path: '/v1/memories', storeReady: 'entryWrites', loop: 'off', handler: handleCreateMemory },
+    { method: 'GET', path: '/v1/graph', storeReady: 'graphReads', loop: 'off', handler: handleGetGraph },
+    { method: 'GET', path: '/v1/memories', storeReady: 'base', loop: 'off', handler: handleRecallMemories },
+    { method: 'GET', pattern: '/v1/sessions/:id/assemble', storeReady: 'dagReads', loop: 'off', handler: handleAssembleSession },
+    { method: 'GET', pattern: '/v1/recall/drill/:id', storeReady: 'dagReads', handler: handleDrillRecall },
+    { method: 'POST', pattern: '/v1/memories/:id/archive', storeReady: 'entryWrites', loop: 'off', handler: handleArchiveMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/supersede', storeReady: 'entryWrites', loop: 'off', handler: handleSupersedeMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/promote', sqliteOnly: 'copies a memory between the two local hippo.db files', handler: handlePromoteMemory },
+    { method: 'DELETE', pattern: '/v1/memories/:id', storeReady: 'entryWrites', loop: 'off', handler: handleForgetMemory },
+    { method: 'POST', path: '/v1/outcome', storeReady: 'entryWrites', handler: handleApplyOutcome },
+    { method: 'GET', path: '/v1/context', storeReady: 'contextReads', handler: handleGetContext },
+    { method: 'POST', path: '/v1/sleep', sqliteOnly: 'consolidates every tenant under the local hippo root in this process', handler: handleSleep },
+    { method: 'POST', path: '/v1/auth/keys', storeReady: 'keyWrites', loop: 'off', handler: handleCreateAuthKey },
+    { method: 'GET', path: '/v1/auth/keys', storeReady: 'keyWrites', loop: 'off', handler: handleListAuthKeys },
+    { method: 'DELETE', pattern: '/v1/auth/keys/:keyId', storeReady: 'keyAudit', loop: 'off', handler: handleRevokeAuthKey },
+    { method: 'GET', path: '/v1/quarantine', storeReady: 'quarantine', loop: 'off', handler: handleListQuarantine },
+    { method: 'POST', pattern: '/v1/quarantine/:id/approve', storeReady: 'quarantine', loop: 'off', handler: handleApproveQuarantine },
+    { method: 'POST', pattern: '/v1/quarantine/:id/reject', storeReady: 'quarantine', loop: 'off', handler: handleRejectQuarantine },
+    { method: 'GET', path: '/v1/audit', storeReady: 'auditLog', loop: 'off', handler: handleListAudit },
+    { method: 'POST', path: '/v1/predictions', storeReady: 'predictions', loop: 'off', handler: handleCreatePrediction },
+    { method: 'GET', path: '/v1/predictions', storeReady: 'predictions', loop: 'off', handler: handleListPredictions },
+    { method: 'GET', path: '/v1/predictions/stats', storeReady: 'predictions', loop: 'off', handler: handlePredictionStats },
+    { method: 'GET', regex: /^\/v1\/predictions\/(\d+)$/, storeReady: 'predictions', loop: 'off', handler: handleGetPrediction },
+    { method: 'POST', regex: /^\/v1\/predictions\/(\d+)\/close$/, storeReady: 'predictions', loop: 'off', handler: handleClosePrediction },
+    { method: 'POST', path: '/v1/decisions', storeReady: 'objects', loop: 'off', handler: handleCreateDecision },
+    { method: 'GET', path: '/v1/decisions', storeReady: 'objects', loop: 'off', handler: handleListDecisions },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeDecision },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseDecision },
+    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetDecision },
+    { method: 'POST', path: '/v1/incidents', storeReady: 'objects', loop: 'off', handler: handleCreateIncident },
+    { method: 'GET', path: '/v1/incidents', storeReady: 'objects', loop: 'off', handler: handleListIncidents },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, storeReady: 'objects', loop: 'off', handler: handleResolveIncident },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseIncident },
+    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetIncident },
+    { method: 'POST', path: '/v1/processes', storeReady: 'objects', loop: 'off', handler: handleCreateProcess },
+    { method: 'GET', path: '/v1/processes', storeReady: 'objects', loop: 'off', handler: handleListProcesses },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeProcess },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseProcess },
+    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetProcess },
+    { method: 'POST', path: '/v1/policies', storeReady: 'objects', loop: 'off', handler: handleCreatePolicy },
+    { method: 'GET', path: '/v1/policies', storeReady: 'objects', loop: 'off', handler: handleListPolicies },
+    { method: 'GET', path: '/v1/policies/asof', storeReady: 'objects', loop: 'off', handler: handlePoliciesAsOf },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedePolicy },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleClosePolicy },
+    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetPolicy },
+    { method: 'POST', path: '/v1/skills', storeReady: 'objects', loop: 'off', handler: handleCreateSkill },
+    { method: 'GET', path: '/v1/skills', storeReady: 'objects', loop: 'off', handler: handleListSkills },
+    { method: 'GET', path: '/v1/skills/export', storeReady: 'objects', loop: 'off', handler: handleExportSkills },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeSkill },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseSkill },
+    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetSkill },
+    { method: 'POST', path: '/v1/project-briefs', storeReady: 'objects', loop: 'off', handler: handleCreateProjectBrief },
+    { method: 'GET', path: '/v1/project-briefs', storeReady: 'objects', loop: 'off', handler: handleListProjectBriefs },
+    { method: 'POST', path: '/v1/project-briefs/refresh', storeReady: 'objects', loop: 'off', handler: handleRefreshProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseProjectBrief },
+    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetProjectBrief },
+    { method: 'POST', path: '/v1/customer-notes', storeReady: 'objects', loop: 'off', handler: handleCreateCustomerNote },
+    { method: 'GET', path: '/v1/customer-notes', storeReady: 'objects', loop: 'off', handler: handleListCustomerNotes },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeCustomerNote },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseCustomerNote },
+    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetCustomerNote },
+];
+/** The route's handler bound to this request's path params, or null when method or path differ. The matcher runs before the
+ *  method check, as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
+function routeMatches(route, method, path) {
+    if ('path' in route)
+        return method === route.method && path === route.path ? route.handler : null;
+    if ('pattern' in route) {
+        const params = matchPath(route.pattern, path);
+        return method === route.method && params ? (r) => route.handler(r, params) : null;
+    }
+    const match = path.match(route.regex);
+    return method === route.method && match ? (r) => route.handler(r, match) : null;
+}
+/** The route as the access line names it; a regex route reads as its pattern would, so no line carries a caller's id. */
+function routeLabel(route) {
+    if ('path' in route)
+        return route.path;
+    if ('pattern' in route)
+        return route.pattern;
+    return route.regex.source.replace(/^\^|\$$/g, '').replaceAll('\\/', '/').replaceAll('(\\d+)', ':id');
+}
+/** Run the first /v1 route whose method and path match. */
+export async function dispatchV1Route(r, method, path) {
+    for (const route of V1_ROUTES) {
+        const run = routeMatches(route, method, path);
+        if (run === null)
+            continue;
+        noteAccess(r.req, { route: routeLabel(route) });
+        await refuseUnportedRoute(r.req, r.opts, route.storeReady);
+        // Only a store with worker threads has moved the route's SQLite work; under any other the handler still opens hippo.db itself.
+        await (route.loop === 'off' && runsOffLoop(r.opts.store) ? withSqliteOffLoop(() => run(r)) : run(r));
+        return true;
+    }
+    return false;
+}
+const PLAIN_SEGMENT_RE = /^[A-Za-z0-9._~-]+$/;
+function isPlainV1Path(path) {
+    return path.startsWith('/v1/') && new URL(path, 'http://h').pathname === path
+        && path.slice('/v1/'.length).split('/').every((segment) => PLAIN_SEGMENT_RE.test(segment));
+}
+// A plain path never holds a `%`, so matchPath cannot throw here.
+function isCorePath(method, path) {
+    return PUBLIC_ROUTES.has(`${method} ${path}`) || V1_ROUTES.some((route) => routeMatches(route, method, path) !== null);
+}
+/** Boot-time check: an add-on path must be plain, unique and not one core serves, so no add-on shadows a core route or hides from dispatch. */
+export function assertAddonRoutes(routes) {
+    const seen = new Set();
+    for (const { path } of routes) {
+        if (!isPlainV1Path(path))
+            throw new Error(`add-on route '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
+        if (seen.has(path))
+            throw new Error(`add-on route '${path}' is registered twice`);
+        if (isCorePath('POST', path))
+            throw new Error(`add-on route '${path}' is already served by core`);
+        seen.add(path);
+    }
+}
+const PUBLIC_JSON_MAX_BYTES = 64 * 1024;
+/** Boot-time check and serialization: a public path that a core GET route serves would open that route to anyone. */
+export function assertPublicJson(publicJson) {
+    const bodies = new Map();
+    for (const [path, value] of Object.entries(publicJson)) {
+        if (!isPlainV1Path(path))
+            throw new Error(`public JSON path '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
+        if (isCorePath('GET', path))
+            throw new Error(`public JSON path '${path}' is already served by core`);
+        const text = JSON.stringify(value);
+        if (text === undefined)
+            throw new Error(`public JSON at '${path}' is not JSON`);
+        if (Buffer.byteLength(text) > PUBLIC_JSON_MAX_BYTES)
+            throw new Error(`public JSON at '${path}' is over 64 KiB`);
+        bodies.set(path, text);
+    }
+    return bodies;
+}
+/** Core authenticates and parses before the handler runs, so an add-on route gets the same 401, 400 and 501 as a core one. */
+export async function dispatchAddonRoute({ req, res, opts }, method, path) {
+    const route = method === 'POST' ? opts.routes?.find((r) => r.path === path) : undefined;
+    if (!route)
+        return false;
+    noteAccess(req, { route: route.path });
+    await refuseUnportedRoute(req, opts, route.storeReady);
+    const ctx = await buildContextWithAuth(req, opts);
+    noteAccess(req, { tenant: ctx.tenantId });
+    const body = await parseJsonBody(req, ctx);
+    sendJson(res, 200, await route.handler({ ctx, body }));
+    return true;
+}
+/** No auth, body read or store access, so a caller with no key gets it under any store. */
+export function dispatchPublicJson({ req, res, opts }, method, path) {
+    const text = method === 'GET' ? opts.publicJsonBodies.get(path) : undefined;
+    if (text === undefined)
+        return false;
+    noteAccess(req, { route: path });
+    res.writeHead(200, { ...JSON_HEADERS, 'cache-control': 'no-store' });
+    res.end(text);
+    return true;
+}
+export function assertSqliteStore(opts) {
+    if (opts.store.kind !== 'sqlite')
+        throw new HttpError(501, STORE_NOT_PORTED_MESSAGE);
+}
+/** Under another store, a route that names no group, or one the store lacks, answers
+ * 501 without running; the caller is checked first, so a bad key is still a 401. */
+async function refuseUnportedRoute(req, opts, group) {
+    if (opts.store.kind === 'sqlite' || (group !== undefined && hasGroup(opts.store, group)))
+        return;
+    await requireAuth(req, opts);
+    assertSqliteStore(opts);
+}
+//# sourceMappingURL=route-table.js.map

package/dist/server/routes/admin.js

@@ -1,25 +1,21 @@
 // Admin routes: API keys, quarantine and the audit log.
-import { AUDIT_OPS } from '../../audit.js';
-import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api.js';
-import { HttpError, readBody, sendJson } from '../../http-util.js';
+import { AUDIT_OPS } from '../../store/audit.js';
+import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api/index.js';
+import { HttpError, readBody, sendJson } from '../../util/http-util.js';
 import { assertCrossTenantAdmin, buildContextWithAuth } from '../auth.js';
 import { pageOf, parseCursor, setNextCursorHeader } from '../cursor.js';
 import { isSetMember, parseJsonObjectText, parseListLimit, validateIdSegment } from '../validation.js';
-import { isJsonString } from '../../json.js';
+import { isJsonBoolean, isJsonNumber, isJsonString } from '../../util/json.js';
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 // POST /v1/auth/keys reads its body before auth, so an unauthenticated caller can make the server buffer at most this many bytes and wait at most this many ms.
 // ServeOpts.mintBodyDeadlineMs overrides the wait for tests only, so a 408 test need not sit through it.
 const MINT_BODY_MAX_BYTES = 4 * 1024;
 const MINT_BODY_DEADLINE_MS = 10_000;
-// Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
-// enough to dump a small deployment's full audit log without paginating, but
-// small enough that a malicious client can't ask for the world.
+// Cap on GET /v1/audit?limit=: large enough to dump a small deployment's audit log unpaginated, small enough that a client cannot ask for the world.
 const MAX_AUDIT_LIMIT = 10000;
 // GET /v1/auth/keys had no limit, so its default page is the cap: a deployment below 1000 keys sees no change.
 const MAX_AUTH_KEYS_PAGE = 1000;
-// POST /v1/auth/keys — mint a new API key. Plaintext lands in the response
-// body: the HTTP layer hands it to the client; the user-facing
-// "store this somewhere safe" warning belongs in the CLI client, not here.
+// POST /v1/auth/keys: mints a key; plaintext is in the response body (the CLI client, not this layer, carries the "store this somewhere safe" warning).
 export async function handleCreateAuthKey({ req, res, opts }) {
     // Body first, so the resolver's check (and any gate in it) runs right before the mint with no wait between.
     const raw = await readBody(req, { maxBytes: MINT_BODY_MAX_BYTES, deadlineMs: opts.mintBodyDeadlineMs ?? MINT_BODY_DEADLINE_MS });
@@ -29,9 +25,8 @@ export async function handleCreateAuthKey({ req, res, opts }) {
     if (labelRaw !== undefined && !isJsonString(labelRaw)) {
         throw new HttpError(400, 'label must be a string');
     }
-    // Optional body.role mirrors the --role CLI flag. Validated
-    // strictly — anything other than 'admin'|'member' is a 400 (no silent
-    // fallback to admin). authCreate refuses a member caller with a 403.
+    // Optional body.role mirrors the --role CLI flag and is validated strictly: anything but 'admin'|'member' is a 400; authCreate refuses a member caller
+    // with a 403.
     const roleRaw = body['role'];
     let role;
     if (roleRaw !== undefined) {
@@ -40,20 +35,27 @@ export async function handleCreateAuthKey({ req, res, opts }) {
         }
         role = roleRaw;
     }
-    // Security: any `tenantId` in the body is IGNORED. The minted key is
-    // bound to the caller's authenticated tenant (ctx.tenantId, resolved
-    // from the Bearer token). Forwarding body.tenantId here would let
-    // tenant A mint a key for tenant B — see authCreate doc comment.
+    // A null is a 400 too: a client that serialises an unset field as null must not get a key that never expires.
+    const ttlDays = body['ttlDays'];
+    if (ttlDays !== undefined && !isJsonNumber(ttlDays)) {
+        throw new HttpError(400, 'ttlDays must be a number');
+    }
+    const noExpiry = body['noExpiry'];
+    if (noExpiry !== undefined && !isJsonBoolean(noExpiry)) {
+        throw new HttpError(400, 'noExpiry must be true or false');
+    }
+    // Security: any body `tenantId` is IGNORED; the key is bound to the caller's authenticated tenant, or tenant A could mint a key for tenant B (see
+    // authCreate).
     const result = await authCreate(ctx, {
         label: labelRaw,
         role,
+        ttlDays,
+        noExpiry,
     });
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/auth/keys?active=true&limit=&cursor=: list keys visible to ctx.tenantId.
-// `active` defaults to true so the common case (show me usable keys) is
-// a single GET; ?active=false includes revoked and expired rows.
+// GET /v1/auth/keys?active=true&limit=&cursor=: lists keys visible to ctx.tenantId; `active` defaults to true, ?active=false includes revoked and expired rows.
 export async function handleListAuthKeys({ req, res, opts, query }) {
     const activeRaw = query.get('active');
     let active = true;
@@ -73,9 +75,8 @@ export async function handleListAuthKeys({ req, res, opts, query }) {
     sendJson(res, 200, page.items.map((r) => r.key));
     return;
 }
-// DELETE /v1/auth/keys/:keyId — revoke. Missing or cross-tenant keys are 404 (no info leak); a member
-// is 403 on any key but its own key or, signed in through the resolver, the keys it minted.
-// 200 with the body rather than 204 so the caller sees revokedAt.
+// DELETE /v1/auth/keys/:keyId revokes: missing or cross-tenant keys are 404 (no leak); a member is 403 on any key but its own or, via the resolver, those it
+// minted. Returns 200 with the body rather than 204 so the caller sees revokedAt.
 export async function handleRevokeAuthKey({ req, res, opts }, keyMatch) {
     validateIdSegment(keyMatch.keyId, 'key id');
     const ctx = await buildContextWithAuth(req, opts);
@@ -99,7 +100,7 @@ export async function handleListQuarantine({ req, res, opts, query }) {
     }
     const limit = parseListLimit(query.get('limit'));
     const after = parseCursor(query.get('cursor'), 'string', 'string');
-    const page = pageOf(quarantineList(ctx, { status, limit: limit + 1, after }), limit, (q) => ({ key: q.quarantinedAt, id: q.id }));
+    const page = pageOf(await quarantineList(ctx, { status, limit: limit + 1, after }), limit, (q) => ({ key: q.quarantinedAt, id: q.id }));
     sendJson(res, 200, { quarantine: page.items, next_cursor: page.nextCursor });
     return;
 }
@@ -107,7 +108,7 @@ export async function handleListQuarantine({ req, res, opts, query }) {
 export async function handleApproveQuarantine({ req, res, opts }, quarantineApproveMatch) {
     validateIdSegment(quarantineApproveMatch.id, 'memory id');
     const ctx = await buildContextWithAuth(req, opts);
-    quarantineApprove(ctx, quarantineApproveMatch.id);
+    await quarantineApprove(ctx, quarantineApproveMatch.id);
     sendJson(res, 200, { approved: quarantineApproveMatch.id });
     return;
 }
@@ -115,13 +116,11 @@ export async function handleApproveQuarantine({ req, res, opts }, quarantineAppr
 export async function handleRejectQuarantine({ req, res, opts }, quarantineRejectMatch) {
     validateIdSegment(quarantineRejectMatch.id, 'memory id');
     const ctx = await buildContextWithAuth(req, opts);
-    quarantineReject(ctx, quarantineRejectMatch.id);
+    await quarantineReject(ctx, quarantineRejectMatch.id);
     sendJson(res, 200, { rejected: quarantineRejectMatch.id });
     return;
 }
-// GET /v1/audit?op=&since=&limit=&cursor=: read audit events. All three filters
-// validated at the route boundary so an invalid value lands a 400 before
-// we hit the DB.
+// GET /v1/audit?op=&since=&limit=&cursor=: all three filters are validated at the route boundary so an invalid value is a 400 before the DB is hit.
 export async function handleListAudit({ req, res, opts, query }) {
     const opRaw = query.get('op');
     let op;
@@ -157,7 +156,7 @@ export async function handleListAudit({ req, res, opts, query }) {
     if (crossTenant)
         assertCrossTenantAdmin(ctx, '/v1/audit?tenant= for another tenant');
     const effectiveCtx = crossTenant ? { ...ctx, tenantId: tenantOverride } : ctx;
-    const page = pageOf(auditList(effectiveCtx, { op, since, limit: limit + 1, after }), limit, (e) => ({ key: e.ts, id: e.id }));
+    const page = pageOf(await auditList(effectiveCtx, { op, since, limit: limit + 1, after }), limit, (e) => ({ key: e.ts, id: e.id }));
     setNextCursorHeader(res, page.nextCursor);
     sendJson(res, 200, page.items);
     return;

package/dist/server/routes/customer-notes.d.ts

@@ -1,7 +1,7 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateCustomerNote({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListCustomerNotes({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleSupersedeCustomerNote({ req, res, opts }: RouteRequest, noteSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseCustomerNote({ req, res, opts }: RouteRequest, noteCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetCustomerNote({ req, res, opts }: RouteRequest, noteByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateCustomerNote(rr: RouteRequest): Promise<void>;
+export declare function handleListCustomerNotes(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=customer-notes.d.ts.map

package/dist/server/routes/customer-notes.js

@@ -1,113 +1,43 @@
 // /v1/customer-notes routes.
-import { closeCustomerNote, loadCustomerNoteById, loadCustomerNotes, MAX_CUSTOMER_LEN, saveCustomerNote, VALID_NOTE_STATES } from '../../customer-notes.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { CUSTOMER_NOTE, MAX_CHANGE_SUMMARY_LEN, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
+import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
-// ── customer_note routes ──
-//
-// 5 routes (no assembler/refresh): POST /v1/customer-notes (new; body customer +
-// note), GET /v1/customer-notes (list; status + customer filter; shared
-// parseListLimit), GET /v1/customer-notes/:id, POST /v1/customer-notes/:id/supersede,
-// POST /v1/customer-notes/:id/close. DoS caps: customer 256, note 8192,
-// changeSummary 4096. The store validates + throws; the boundary maps validation ->
-// 400, not-found -> 404, not-active -> 409. Mirrors /v1/project-briefs.
-export async function handleCreateCustomerNote({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const customer = body['customer'];
-    if (!isJsonString(customer) || customer.trim().length === 0) {
-        throw new HttpError(400, 'customer is required (non-empty string)');
-    }
-    if (customer.length > MAX_CUSTOMER_LEN) {
-        throw new HttpError(400, `customer exceeds ${MAX_CUSTOMER_LEN}-character cap`);
-    }
-    const note = body['note'];
-    if (!isJsonString(note) || note.trim().length === 0) {
-        throw new HttpError(400, 'note is required (non-empty string)');
-    }
-    if (note.length > 8192) {
-        throw new HttpError(400, 'note exceeds 8192-character cap');
-    }
-    const customerNote = saveCustomerNote(opts.hippoRoot, ctx.tenantId, {
-        customer,
-        note,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { note: customerNote });
-    return;
+import { parseJsonBody } from '../validation.js';
+import { saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute } from './object-routes.js';
+const noteRoutes = {
+    noun: 'customer note',
+    field: 'note',
+    listField: 'notes',
+    object: CUSTOMER_NOTE,
+    filterParam: 'customer',
+    revise: (body) => {
+        const note = requiredString(body, 'note', { max: 8192 });
+        const changeSummary = optionalString(body, 'changeSummary', MAX_CHANGE_SUMMARY_LEN);
+        return (existing, id) => ({ customer: existing.customer, note, changeSummary, supersedesNoteId: id });
+    },
+};
+// Routes: customer notes under /v1/customer-notes (create, list, show, supersede, close), mirroring /v1/project-briefs. The store validates and throws;
+// the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
+export async function handleCreateCustomerNote(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const customerNote = await saveFor(ctx, CUSTOMER_NOTE, {
+        customer: requiredString(body, 'customer', { max: MAX_CUSTOMER_LEN }),
+        note: requiredString(body, 'note', { max: 8192 }),
+    });
+    sendJson(rr.res, 201, { note: customerNote });
 }
-export async function handleListCustomerNotes({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const customerFilter = query.get('customer');
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    const listOpts = { limit: limit + 1, after };
-    if (customerFilter !== null && customerFilter.trim().length > 0) {
-        listOpts.customer = customerFilter.trim();
-    }
-    if (status !== 'all') {
-        if (!isSetMember(VALID_NOTE_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        listOpts.status = status;
-    }
-    const notes = loadCustomerNotes(opts.hippoRoot, ctx.tenantId, listOpts);
-    const page = pageOf(notes, limit, byCreatedAt);
-    sendJson(res, 200, { notes: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListCustomerNotes(rr) {
+    return listRoute(noteRoutes, rr);
 }
-export async function handleSupersedeCustomerNote({ req, res, opts }, noteSupersedeMatch) {
-    const id = parseInt(noteSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const note = body['note'];
-    if (!isJsonString(note) || note.trim().length === 0) {
-        throw new HttpError(400, 'note is required (non-empty string)');
-    }
-    if (note.length > 8192) {
-        throw new HttpError(400, 'note exceeds 8192-character cap');
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const existing = loadCustomerNoteById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `customer note ${id} not found`);
-    }
-    const customerNote = saveCustomerNote(opts.hippoRoot, ctx.tenantId, {
-        customer: existing.customer,
-        note,
-        changeSummary,
-        supersedesNoteId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { note: customerNote });
-    return;
+export function handleSupersedeCustomerNote(rr, match) {
+    return supersedeRoute(noteRoutes, rr, match);
 }
-export async function handleCloseCustomerNote({ req, res, opts }, noteCloseMatch) {
-    const id = parseInt(noteCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const customerNote = closeCustomerNote(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { note: customerNote });
-    return;
+export function handleCloseCustomerNote(rr, match) {
+    return closeRoute(noteRoutes, rr, match);
 }
-export async function handleGetCustomerNote({ req, res, opts }, noteByIdMatch) {
-    const id = parseInt(noteByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const customerNote = loadCustomerNoteById(opts.hippoRoot, ctx.tenantId, id);
-    if (!customerNote) {
-        throw new HttpError(404, `customer note ${id} not found`);
-    }
-    sendJson(res, 200, { note: customerNote });
-    return;
+export function handleGetCustomerNote(rr, match) {
+    return getRoute(noteRoutes, rr, match);
 }
 //# sourceMappingURL=customer-notes.js.map

package/dist/server/routes/decisions.d.ts

@@ -1,7 +1,7 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateDecision({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListDecisions({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleSupersedeDecision({ req, res, opts }: RouteRequest, decisionSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseDecision({ req, res, opts }: RouteRequest, decisionCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetDecision({ req, res, opts }: RouteRequest, decisionByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateDecision(rr: RouteRequest): Promise<void>;
+export declare function handleListDecisions(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=decisions.d.ts.map