hippo-memory 1.70.0 → 1.71.0

package/dist/server/request.js

@@ -27,7 +27,8 @@ export function replyFor(err) {
 }
 // Above the 30 s body deadline and the 5 s resolver deadline, so a request those govern is answered before it is called slow.
 const SLOW_REQUEST_WARN_MS = 60_000;
-/** Logs one warn when `res` has sent nothing after `afterMs`. It never ends the request or touches the reply; the timer goes when the reply finishes or the socket closes. */
+/** Logs one warn when `res` has sent nothing after `afterMs`. It never ends the request
+ * or touches the reply; the timer goes when the reply finishes or the socket closes. */
 function watchSlowRequest(req, res, requestId, afterMs = SLOW_REQUEST_WARN_MS) {
     const startedAt = Date.now();
     const timer = setTimeout(() => {
@@ -51,6 +52,10 @@ export function noteAccess(req, note) {
     if (held)
         Object.assign(held, note);
 }
+/** The route name the request's access line carries, for a line about the same request logged after its reply. */
+export function accessRouteOf(req) {
+    return accessNotes.get(req)?.route ?? UNMATCHED_ROUTE;
+}
 /** One info line per finished request. A path id and a query string can both hold caller data, so the line carries neither. */
 function logAccessWhenFinished(req, res, requestId) {
     const note = {};
@@ -97,14 +102,7 @@ export function parseRequest(req) {
         query: url.searchParams,
     };
 }
-/**
- * Lightweight pattern matcher for /v1/memories/:id/<action>. Avoids pulling
- * in a router dependency for the half-dozen patterns we actually use.
- *
- * Returns null if `path` does not match `pattern`. Otherwise returns an object
- * mapping each :param name to its value. Path segments are exact-matched
- * except for parameter slots.
- */
+/** Pattern matcher for /v1/memories/:id/<action> (no router dependency); null if `path` does not match, else each :param name mapped to its value. */
 function decodePathSegment(segment) {
     try {
         return decodeURIComponent(segment);
@@ -135,14 +133,8 @@ export function matchPath(pattern, path) {
     }
     return params;
 }
-/**
- * Reject URL-encoded slashes in path segments BEFORE the URL parser decodes
- * them — otherwise `%2F` becomes `/`, path-split runs, and the route either
- * silently 404s or matches the wrong template.
- *
- * Only the PATHNAME is scanned (split on the first `?`), so recall queries
- * containing URLs like `?q=https%3A%2F%2Fexample.com` are not rejected.
- */
+/** Rejects URL-encoded slashes in path segments BEFORE the URL parser decodes them (`%2F` would become `/` and 404 or match the wrong template).
+ * Only the PATHNAME is scanned, so recall queries like `?q=https%3A%2F%2Fexample.com` are not rejected. */
 export function rejectEncodedSlash(rawUrl) {
     const queryIdx = rawUrl.indexOf('?');
     const pathname = queryIdx === -1 ? rawUrl : rawUrl.slice(0, queryIdx);

package/dist/server/route-table.js

@@ -16,16 +16,8 @@ import { handleCloseProjectBrief, handleCreateProjectBrief, handleGetProjectBrie
 import { handleAssembleSession, handleDrillRecall, handleGetContext, handleRecallMemories } from './routes/recall.js';
 import { handleCloseSkill, handleCreateSkill, handleExportSkills, handleGetSkill, handleListSkills, handleSupersedeSkill } from './routes/skills.js';
 import { parseJsonBody } from './validation.js';
-// Review patch #2: explicit allow-list for unauthenticated /v1/* routes.
-// New unauth routes MUST be added here AND get a corresponding entry in
-// tests/server-bearer-lockdown.test.ts. Do not gate auth elsewhere by
-// `path.startsWith` — pattern-positional auth is bypass-by-accident.
-//
-// The route handlers consult `isPublicRoute` before invoking
-// `buildContextWithAuth` / `requireAuth`. Adding a route here without
-// adding the corresponding `isPublicRoute` short-circuit in a handler is
-// a no-op (auth still applies), so the failure mode is fail-closed.
-// The only other unauthenticated paths are ServeOpts.publicJson's: GET only, checked at boot by assertPublicJson.
+// Explicit allow-list for unauthenticated /v1/* routes: add a new one here AND in tests/server-bearer-lockdown.test.ts; never gate auth by `path.startsWith`.
+// Handlers check `isPublicRoute` before auth, so an entry without that check is a no-op (fail-closed); other open paths are ServeOpts.publicJson GETs.
 const PUBLIC_ROUTES = new Set([
     'POST /v1/connectors/slack/events',
     'POST /v1/connectors/github/events',
@@ -59,44 +51,44 @@ const V1_ROUTES = [
     { method: 'GET', path: '/v1/predictions/stats', storeReady: 'predictions', loop: 'off', handler: handlePredictionStats },
     { method: 'GET', regex: /^\/v1\/predictions\/(\d+)$/, storeReady: 'predictions', loop: 'off', handler: handleGetPrediction },
     { method: 'POST', regex: /^\/v1\/predictions\/(\d+)\/close$/, storeReady: 'predictions', loop: 'off', handler: handleClosePrediction },
-    { method: 'POST', path: '/v1/decisions', storeReady: 'objects', handler: handleCreateDecision },
-    { method: 'GET', path: '/v1/decisions', storeReady: 'objects', handler: handleListDecisions },
-    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeDecision },
-    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseDecision },
-    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, storeReady: 'objects', handler: handleGetDecision },
-    { method: 'POST', path: '/v1/incidents', storeReady: 'objects', handler: handleCreateIncident },
-    { method: 'GET', path: '/v1/incidents', storeReady: 'objects', handler: handleListIncidents },
-    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, storeReady: 'objects', handler: handleResolveIncident },
-    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseIncident },
-    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, storeReady: 'objects', handler: handleGetIncident },
-    { method: 'POST', path: '/v1/processes', storeReady: 'objects', handler: handleCreateProcess },
-    { method: 'GET', path: '/v1/processes', storeReady: 'objects', handler: handleListProcesses },
-    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeProcess },
-    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseProcess },
-    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, storeReady: 'objects', handler: handleGetProcess },
-    { method: 'POST', path: '/v1/policies', storeReady: 'objects', handler: handleCreatePolicy },
-    { method: 'GET', path: '/v1/policies', storeReady: 'objects', handler: handleListPolicies },
-    { method: 'GET', path: '/v1/policies/asof', storeReady: 'objects', handler: handlePoliciesAsOf },
-    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedePolicy },
-    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, storeReady: 'objects', handler: handleClosePolicy },
-    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, storeReady: 'objects', handler: handleGetPolicy },
-    { method: 'POST', path: '/v1/skills', storeReady: 'objects', handler: handleCreateSkill },
-    { method: 'GET', path: '/v1/skills', storeReady: 'objects', handler: handleListSkills },
-    { method: 'GET', path: '/v1/skills/export', storeReady: 'objects', handler: handleExportSkills },
-    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeSkill },
-    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseSkill },
-    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, storeReady: 'objects', handler: handleGetSkill },
-    { method: 'POST', path: '/v1/project-briefs', storeReady: 'objects', handler: handleCreateProjectBrief },
-    { method: 'GET', path: '/v1/project-briefs', storeReady: 'objects', handler: handleListProjectBriefs },
-    { method: 'POST', path: '/v1/project-briefs/refresh', storeReady: 'objects', handler: handleRefreshProjectBrief },
-    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeProjectBrief },
-    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseProjectBrief },
-    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, storeReady: 'objects', handler: handleGetProjectBrief },
-    { method: 'POST', path: '/v1/customer-notes', storeReady: 'objects', handler: handleCreateCustomerNote },
-    { method: 'GET', path: '/v1/customer-notes', storeReady: 'objects', handler: handleListCustomerNotes },
-    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeCustomerNote },
-    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseCustomerNote },
-    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, storeReady: 'objects', handler: handleGetCustomerNote },
+    { method: 'POST', path: '/v1/decisions', storeReady: 'objects', loop: 'off', handler: handleCreateDecision },
+    { method: 'GET', path: '/v1/decisions', storeReady: 'objects', loop: 'off', handler: handleListDecisions },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeDecision },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseDecision },
+    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetDecision },
+    { method: 'POST', path: '/v1/incidents', storeReady: 'objects', loop: 'off', handler: handleCreateIncident },
+    { method: 'GET', path: '/v1/incidents', storeReady: 'objects', loop: 'off', handler: handleListIncidents },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, storeReady: 'objects', loop: 'off', handler: handleResolveIncident },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseIncident },
+    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetIncident },
+    { method: 'POST', path: '/v1/processes', storeReady: 'objects', loop: 'off', handler: handleCreateProcess },
+    { method: 'GET', path: '/v1/processes', storeReady: 'objects', loop: 'off', handler: handleListProcesses },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeProcess },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseProcess },
+    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetProcess },
+    { method: 'POST', path: '/v1/policies', storeReady: 'objects', loop: 'off', handler: handleCreatePolicy },
+    { method: 'GET', path: '/v1/policies', storeReady: 'objects', loop: 'off', handler: handleListPolicies },
+    { method: 'GET', path: '/v1/policies/asof', storeReady: 'objects', loop: 'off', handler: handlePoliciesAsOf },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedePolicy },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleClosePolicy },
+    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetPolicy },
+    { method: 'POST', path: '/v1/skills', storeReady: 'objects', loop: 'off', handler: handleCreateSkill },
+    { method: 'GET', path: '/v1/skills', storeReady: 'objects', loop: 'off', handler: handleListSkills },
+    { method: 'GET', path: '/v1/skills/export', storeReady: 'objects', loop: 'off', handler: handleExportSkills },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeSkill },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseSkill },
+    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetSkill },
+    { method: 'POST', path: '/v1/project-briefs', storeReady: 'objects', loop: 'off', handler: handleCreateProjectBrief },
+    { method: 'GET', path: '/v1/project-briefs', storeReady: 'objects', loop: 'off', handler: handleListProjectBriefs },
+    { method: 'POST', path: '/v1/project-briefs/refresh', storeReady: 'objects', loop: 'off', handler: handleRefreshProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseProjectBrief },
+    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetProjectBrief },
+    { method: 'POST', path: '/v1/customer-notes', storeReady: 'objects', loop: 'off', handler: handleCreateCustomerNote },
+    { method: 'GET', path: '/v1/customer-notes', storeReady: 'objects', loop: 'off', handler: handleListCustomerNotes },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeCustomerNote },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseCustomerNote },
+    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetCustomerNote },
 ];
 /** The route's handler bound to this request's path params, or null when method or path differ. The matcher runs before the
  *  method check, as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
@@ -199,7 +191,8 @@ export function assertSqliteStore(opts) {
     if (opts.store.kind !== 'sqlite')
         throw new HttpError(501, STORE_NOT_PORTED_MESSAGE);
 }
-/** Under another store, a route that names no group, or one the store lacks, answers 501 without running; the caller is checked first, so a bad key is still a 401. */
+/** Under another store, a route that names no group, or one the store lacks, answers
+ * 501 without running; the caller is checked first, so a bad key is still a 401. */
 async function refuseUnportedRoute(req, opts, group) {
     if (opts.store.kind === 'sqlite' || (group !== undefined && hasGroup(opts.store, group)))
         return;

package/dist/server/routes/admin.js

@@ -2,25 +2,20 @@
 import { AUDIT_OPS } from '../../store/audit.js';
 import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api/index.js';
 import { HttpError, readBody, sendJson } from '../../util/http-util.js';
-import { log } from '../../util/log.js';
 import { assertCrossTenantAdmin, buildContextWithAuth } from '../auth.js';
 import { pageOf, parseCursor, setNextCursorHeader } from '../cursor.js';
 import { isSetMember, parseJsonObjectText, parseListLimit, validateIdSegment } from '../validation.js';
-import { isJsonString } from '../../util/json.js';
+import { isJsonBoolean, isJsonNumber, isJsonString } from '../../util/json.js';
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 // POST /v1/auth/keys reads its body before auth, so an unauthenticated caller can make the server buffer at most this many bytes and wait at most this many ms.
 // ServeOpts.mintBodyDeadlineMs overrides the wait for tests only, so a 408 test need not sit through it.
 const MINT_BODY_MAX_BYTES = 4 * 1024;
 const MINT_BODY_DEADLINE_MS = 10_000;
-// Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
-// enough to dump a small deployment's full audit log without paginating, but
-// small enough that a malicious client can't ask for the world.
+// Cap on GET /v1/audit?limit=: large enough to dump a small deployment's audit log unpaginated, small enough that a client cannot ask for the world.
 const MAX_AUDIT_LIMIT = 10000;
 // GET /v1/auth/keys had no limit, so its default page is the cap: a deployment below 1000 keys sees no change.
 const MAX_AUTH_KEYS_PAGE = 1000;
-// POST /v1/auth/keys — mint a new API key. Plaintext lands in the response
-// body: the HTTP layer hands it to the client; the user-facing
-// "store this somewhere safe" warning belongs in the CLI client, not here.
+// POST /v1/auth/keys: mints a key; plaintext is in the response body (the CLI client, not this layer, carries the "store this somewhere safe" warning).
 export async function handleCreateAuthKey({ req, res, opts }) {
     // Body first, so the resolver's check (and any gate in it) runs right before the mint with no wait between.
     const raw = await readBody(req, { maxBytes: MINT_BODY_MAX_BYTES, deadlineMs: opts.mintBodyDeadlineMs ?? MINT_BODY_DEADLINE_MS });
@@ -30,9 +25,8 @@ export async function handleCreateAuthKey({ req, res, opts }) {
     if (labelRaw !== undefined && !isJsonString(labelRaw)) {
         throw new HttpError(400, 'label must be a string');
     }
-    // Optional body.role mirrors the --role CLI flag. Validated
-    // strictly — anything other than 'admin'|'member' is a 400 (no silent
-    // fallback to admin). authCreate refuses a member caller with a 403.
+    // Optional body.role mirrors the --role CLI flag and is validated strictly: anything but 'admin'|'member' is a 400; authCreate refuses a member caller
+    // with a 403.
     const roleRaw = body['role'];
     let role;
     if (roleRaw !== undefined) {
@@ -41,24 +35,27 @@ export async function handleCreateAuthKey({ req, res, opts }) {
         }
         role = roleRaw;
     }
-    // Security: any `tenantId` in the body is IGNORED. The minted key is
-    // bound to the caller's authenticated tenant (ctx.tenantId, resolved
-    // from the Bearer token). Forwarding body.tenantId here would let
-    // tenant A mint a key for tenant B — see authCreate doc comment.
+    // A null is a 400 too: a client that serialises an unset field as null must not get a key that never expires.
+    const ttlDays = body['ttlDays'];
+    if (ttlDays !== undefined && !isJsonNumber(ttlDays)) {
+        throw new HttpError(400, 'ttlDays must be a number');
+    }
+    const noExpiry = body['noExpiry'];
+    if (noExpiry !== undefined && !isJsonBoolean(noExpiry)) {
+        throw new HttpError(400, 'noExpiry must be true or false');
+    }
+    // Security: any body `tenantId` is IGNORED; the key is bound to the caller's authenticated tenant, or tenant A could mint a key for tenant B (see
+    // authCreate).
     const result = await authCreate(ctx, {
         label: labelRaw,
         role,
+        ttlDays,
+        noExpiry,
     });
-    // The reply cannot change shape, so the server log is where a defaulted admin key gets noticed.
-    if (role === undefined && result.role === 'admin') {
-        log.warn(`auth key ${result.keyId} was minted with no role in the body, so it is an admin key, and it never expires; send "role": "member" for a narrower one`);
-    }
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/auth/keys?active=true&limit=&cursor=: list keys visible to ctx.tenantId.
-// `active` defaults to true so the common case (show me usable keys) is
-// a single GET; ?active=false includes revoked and expired rows.
+// GET /v1/auth/keys?active=true&limit=&cursor=: lists keys visible to ctx.tenantId; `active` defaults to true, ?active=false includes revoked and expired rows.
 export async function handleListAuthKeys({ req, res, opts, query }) {
     const activeRaw = query.get('active');
     let active = true;
@@ -78,9 +75,8 @@ export async function handleListAuthKeys({ req, res, opts, query }) {
     sendJson(res, 200, page.items.map((r) => r.key));
     return;
 }
-// DELETE /v1/auth/keys/:keyId — revoke. Missing or cross-tenant keys are 404 (no info leak); a member
-// is 403 on any key but its own key or, signed in through the resolver, the keys it minted.
-// 200 with the body rather than 204 so the caller sees revokedAt.
+// DELETE /v1/auth/keys/:keyId revokes: missing or cross-tenant keys are 404 (no leak); a member is 403 on any key but its own or, via the resolver, those it
+// minted. Returns 200 with the body rather than 204 so the caller sees revokedAt.
 export async function handleRevokeAuthKey({ req, res, opts }, keyMatch) {
     validateIdSegment(keyMatch.keyId, 'key id');
     const ctx = await buildContextWithAuth(req, opts);
@@ -124,9 +120,7 @@ export async function handleRejectQuarantine({ req, res, opts }, quarantineRejec
     sendJson(res, 200, { rejected: quarantineRejectMatch.id });
     return;
 }
-// GET /v1/audit?op=&since=&limit=&cursor=: read audit events. All three filters
-// validated at the route boundary so an invalid value lands a 400 before
-// we hit the DB.
+// GET /v1/audit?op=&since=&limit=&cursor=: all three filters are validated at the route boundary so an invalid value is a 400 before the DB is hit.
 export async function handleListAudit({ req, res, opts, query }) {
     const opRaw = query.get('op');
     let op;

package/dist/server/routes/customer-notes.js

@@ -1,9 +1,10 @@
 // /v1/customer-notes routes.
-import { CUSTOMER_NOTE, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
+import { CUSTOMER_NOTE, MAX_CHANGE_SUMMARY_LEN, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
 import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
 import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+import { saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute } from './object-routes.js';
 const noteRoutes = {
     noun: 'customer note',
     field: 'note',
@@ -12,22 +13,16 @@ const noteRoutes = {
     filterParam: 'customer',
     revise: (body) => {
         const note = requiredString(body, 'note', { max: 8192 });
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_CHANGE_SUMMARY_LEN);
         return (existing, id) => ({ customer: existing.customer, note, changeSummary, supersedesNoteId: id });
     },
 };
-// ── customer_note routes ──
-//
-// 5 routes (no assembler/refresh): POST /v1/customer-notes (new; body customer +
-// note), GET /v1/customer-notes (list; status + customer filter; shared
-// parseListLimit), GET /v1/customer-notes/:id, POST /v1/customer-notes/:id/supersede,
-// POST /v1/customer-notes/:id/close. DoS caps: customer 256, note 8192,
-// changeSummary 4096. The store validates + throws; the boundary maps validation ->
-// 400, not-found -> 404, not-active -> 409. Mirrors /v1/project-briefs.
+// Routes: customer notes under /v1/customer-notes (create, list, show, supersede, close), mirroring /v1/project-briefs. The store validates and throws;
+// the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
 export async function handleCreateCustomerNote(rr) {
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const body = await parseJsonBody(rr.req, ctx);
-    const customerNote = await saveFor(rr, CUSTOMER_NOTE, ctx.tenantId, ctx.actor.subject, {
+    const customerNote = await saveFor(ctx, CUSTOMER_NOTE, {
         customer: requiredString(body, 'customer', { max: MAX_CUSTOMER_LEN }),
         note: requiredString(body, 'note', { max: 8192 }),
     });

package/dist/server/routes/decisions.js

@@ -4,10 +4,11 @@ import { HttpError, sendJson } from '../../util/http-util.js';
 import { NotFoundError } from '../../core/api-errors.js';
 import { isJsonNumber } from '../../util/json.js';
 import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor } from './object-routes.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
+import { saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString } from './object-routes.js';
 const decisionRoutes = { noun: 'decision', field: 'decision', listField: 'decisions', object: DECISION };
-const TEXT = { max: 4096, untrimmed: true };
+const TEXT = { max: MAX_SHORT_FIELD_LEN, untrimmed: true };
 function supersededId(body) {
     const raw = body['supersedesDecisionId'];
     if (raw === undefined || raw === null)
@@ -17,27 +18,19 @@ function supersededId(body) {
     }
     return raw;
 }
-// ── decisions (first-class object) ──
-//
-// 5 routes: POST /v1/decisions (create, optional supersedesDecisionId),
-// GET /v1/decisions (list, status filter), GET /v1/decisions/:id (show),
-// POST /v1/decisions/:id/supersede (create a successor + supersede :id),
-// POST /v1/decisions/:id/close (retire). Bearer-authed + tenant-scoped via
-// buildContextWithAuth. status validated against VALID_DECISION_STATES.
-// DoS caps: text 4096, context 4096. The HTTP surface is
-// new (no legacy --supersedes <memory-id> constraint), so it supersedes by
-// table id and never weakens a memory mirror.
+// Routes: /v1/decisions (create, list, show, supersede, close), Bearer-authed and tenant-scoped; status is validated against VALID_DECISION_STATES.
+// The HTTP surface has no legacy --supersedes <memory-id> constraint, so it supersedes by table id and never weakens a memory mirror.
 export async function handleCreateDecision(rr) {
     const { req, res } = rr;
     const ctx = await buildContextWithAuth(req, rr.opts);
     const body = await parseJsonBody(req, ctx);
     const write = {
         decisionText: requiredString(body, 'text', TEXT),
-        context: optionalString(body, 'context', 4096),
+        context: optionalString(body, 'context', MAX_SHORT_FIELD_LEN),
         supersedesDecisionId: supersededId(body),
     };
     try {
-        const decision = await saveFor(rr, DECISION, ctx.tenantId, ctx.actor.subject, write);
+        const decision = await saveFor(ctx, DECISION, write);
         sendJson(res, 201, { decision });
     }
     catch (e) {
@@ -55,9 +48,9 @@ export async function handleSupersedeDecision(rr, match) {
     const oldId = parseInt(match[1], 10);
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const body = await parseJsonBody(rr.req, ctx);
-    const decision = await saveFor(rr, DECISION, ctx.tenantId, ctx.actor.subject, {
+    const decision = await saveFor(ctx, DECISION, {
         decisionText: requiredString(body, 'text', TEXT),
-        context: optionalString(body, 'context', 4096),
+        context: optionalString(body, 'context', MAX_SHORT_FIELD_LEN),
         supersedesDecisionId: oldId,
     });
     sendJson(rr.res, 201, { decision });

package/dist/server/routes/incidents.js

@@ -3,9 +3,10 @@ import { INCIDENT, openIncident, resolveOpenIncident } from '../../objects/incid
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { NotFoundError } from '../../core/api-errors.js';
 import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { isJsonString } from '../../util/json.js';
-import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString } from './object-routes.js';
+import { objectsOf } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString } from './object-routes.js';
 const MAX_LINKED_MEMORY_IDS = 256;
 const incidentRoutes = { noun: 'incident', field: 'incident', listField: 'incidents', object: INCIDENT };
 function linkedMemoryIds(body) {
@@ -18,34 +19,25 @@ function linkedMemoryIds(body) {
     if (raw.length > MAX_LINKED_MEMORY_IDS) {
         throw new HttpError(400, `linkedMemoryIds exceeds ${MAX_LINKED_MEMORY_IDS}-item cap`);
     }
-    const isValidMemoryId = (item) => isJsonString(item) && item.length > 0 && item.length <= 4096;
+    const isValidMemoryId = (item) => isJsonString(item) && item.length > 0 && item.length <= MAX_SHORT_FIELD_LEN;
     if (!raw.every(isValidMemoryId)) {
-        throw new HttpError(400, 'each linkedMemoryIds entry must be a non-empty string <= 4096 chars');
+        throw new HttpError(400, `each linkedMemoryIds entry must be a non-empty string <= ${MAX_SHORT_FIELD_LEN} chars`);
     }
     return raw;
 }
-// ── incidents (first-class object) ──
-//
-// 5 routes: POST /v1/incidents (open; body text + context + linkedMemoryIds[]),
-// GET /v1/incidents (list, status filter), GET /v1/incidents/:id (show),
-// POST /v1/incidents/:id/resolve (open -> resolved; body resolutionText),
-// POST /v1/incidents/:id/close (open|resolved -> closed). Bearer-authed +
-// tenant-scoped via buildContextWithAuth. status validated against
-// VALID_INCIDENT_STATES. DoS caps: text 4096, context 4096, resolutionText
-// 4096. Mirrors /v1/decisions; lifecycle is
-// open->resolved->closed (no supersede), so linkedMemoryIds replaces
-// supersedesDecisionId on create.
+// Routes: /v1/incidents (open, list, show, resolve, close), mirroring /v1/decisions; status is validated against VALID_INCIDENT_STATES.
+// Lifecycle is open->resolved->closed (no supersede), so linkedMemoryIds replaces supersedesDecisionId on create.
 export async function handleCreateIncident(rr) {
     const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
     const write = {
-        incidentText: requiredString(body, 'text', { max: 4096, untrimmed: true }),
-        context: optionalString(body, 'context', 4096),
+        incidentText: requiredString(body, 'text', { max: MAX_SHORT_FIELD_LEN, untrimmed: true }),
+        context: optionalString(body, 'context', MAX_SHORT_FIELD_LEN),
         linkedMemoryIds: linkedMemoryIds(body),
     };
     try {
-        const incident = await openIncident(objectsOf(rr), opts.hippoRoot, ctx.tenantId, write, ctx.actor.subject);
+        const incident = await openIncident(objectsOf(ctx), opts.hippoRoot, ctx.tenantId, write, ctx.actor.subject);
         sendJson(res, 201, { incident });
     }
     catch (e) {
@@ -62,8 +54,8 @@ export async function handleResolveIncident(rr, match) {
     const { req, res, opts } = rr;
     const id = parseInt(match[1], 10);
     const ctx = await buildContextWithAuth(req, opts);
-    const resolutionText = requiredString(await parseJsonBody(req, ctx), 'resolutionText', { max: 4096 });
-    const incident = await resolveOpenIncident(objectsOf(rr), ctx.tenantId, id, resolutionText, ctx.actor.subject);
+    const resolutionText = requiredString(await parseJsonBody(req, ctx), 'resolutionText', { max: MAX_SHORT_FIELD_LEN });
+    const incident = await resolveOpenIncident(objectsOf(ctx), ctx.tenantId, id, resolutionText, ctx.actor.subject);
     sendJson(res, 200, { incident });
 }
 export function handleCloseIncident(rr, match) {

package/dist/server/routes/memories.js

@@ -1,9 +1,9 @@
 // Memory write routes: create, graph, archive, supersede, promote, forget, outcome, sleep.
+import { graphRows } from '../../api/graph.js';
 import { archiveRaw, forget, outcome, outcomeForLastRecall, promote, remember, supersede } from '../../api/index.js';
 import { graphModelOf } from '../../graph/view.js';
 import { MAX_ENTITY_NAME_LEN } from '../../store/graph-rows.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { requireGroup } from '../../store/port.js';
 import { assertCrossTenantAdmin, buildContextWithAuth, isLoopback } from '../auth.js';
 import { sleepInChild } from '../sleep-offload.js';
 import { getCallerProject, getString, getStringArray, isSetMember, parseJsonBody, parseListLimit, validateIdSegment } from '../validation.js';
@@ -53,8 +53,7 @@ export async function handleGetGraph({ req, res, opts, query }) {
     }
     const limit = parseListLimit(query.get('limit'));
     const ctx = await buildContextWithAuth(req, opts);
-    const { role, scopes, owner } = ctx.actor;
-    const rows = await requireGroup(opts.store, 'graphReads').graphRows(ctx.tenantId, { entity: entityRaw ?? undefined, limit, reader: { role, scopes, owner } });
+    const rows = await graphRows(ctx, { entity: entityRaw ?? undefined, limit });
     sendJson(res, 200, graphModelOf(rows));
     return;
 }
@@ -97,12 +96,8 @@ export async function handleForgetMemory({ req, res, opts }, idMatch) {
     sendJson(res, 200, result);
     return;
 }
-// POST /v1/outcome — apply a positive/negative outcome to memory ids.
-// Body: {ids?: string[], good: boolean}. If ids omitted, falls back to
-// the last-recall path (api.outcomeForLastRecall); returned shape is
-// {applied, ids} in that case so callers can disambiguate "no recent
-// recall" from "all ids skipped". Each applied id writes one audit_log
-// row (op='outcome', actor from Bearer).
+// POST /v1/outcome: applies a positive/negative outcome to memory ids; without ids it falls back to the last-recall path (api.outcomeForLastRecall)
+// and returns {applied, ids}, so callers can tell "no recent recall" from "all ids skipped". Each applied id writes one audit_log row (op='outcome').
 export async function handleApplyOutcome({ req, res, opts }) {
     const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
@@ -120,10 +115,8 @@ export async function handleApplyOutcome({ req, res, opts }) {
         if (!idsRaw.every(isNonEmptyId)) {
             throw new HttpError(400, 'ids must be an array of non-empty strings');
         }
-        // DoS cap on ids.length. Each id triggers ~3 DB ops (readEntry +
-        // writeEntry + appendAuditEvent). N=1000 keeps per-request work bounded
-        // to sub-second wall time on SQLite hot path. Cap BEFORE buildContextWithAuth
-        // so attack traffic doesn't pay the api-key lookup cost.
+        // DoS cap on ids.length (each id costs ~3 DB ops): N=1000 keeps per-request work sub-second on SQLite.
+        // Checked BEFORE buildContextWithAuth so attack traffic does not pay the api-key lookup.
         if (idsRaw.length > 1000) {
             throw new HttpError(400, 'ids exceeds 1000-id cap');
         }
@@ -142,29 +135,16 @@ export async function handleApplyOutcome({ req, res, opts }) {
     }
     return;
 }
-// POST /v1/sleep — host-wide consolidation pipeline (consolidate + dedup +
-// audit + share + ambient). serve() refuses non-loopback hosts at boot, AND
-// this per-request loopback assertion makes the host-wide semantic fail-
-// closed regardless of any future serve() boot-config change. Body:
-// {dry_run?, no_share?}. Returns SleepResult JSON.
-//
-// Tenant scope (Episode A follow-up tracked in TODOS.md): api.sleep operates
-// on the WHOLE hippoRoot (cross-tenant by design, matching CLI cmdSleep).
-// The loopback-only guard is the trust boundary today. Future non-loopback
-// serving must also zero the cross-tenant counters for other tenants.
+// POST /v1/sleep: host-wide consolidation (consolidate, dedup, audit, share, ambient); api.sleep spans the WHOLE hippoRoot, cross-tenant by design, so the
+// loopback-only guard is the trust boundary; non-loopback serving must also zero cross-tenant counters. Body {dry_run?, no_share?}; returns SleepResult JSON.
 export async function handleSleep({ req, res, opts }) {
-    // Defensive per-request loopback guard. Uses the canonical isLoopback()
-    // helper above so any future extension (additional mapped/IPv6 forms,
-    // NAT64 prefixes) flows through without drift. serve()'s boot-time host
-    // check is the primary trust boundary; this is belt-and-suspenders.
+    // Defensive per-request loopback guard using isLoopback(), so future mapped/IPv6/NAT64 forms flow through without drift;
+    // serve()'s boot-time host check is the primary trust boundary.
     if (!isLoopback(req.socket.remoteAddress)) {
         throw new HttpError(403, '/v1/sleep is loopback-only (host-wide consolidation; see CHANGELOG v1.11.4)');
     }
-    // Admin-role gate. Forward-defensive: exists today
-    // under loopback-only enforcement (loopback fallback is admin by default;
-    // any Bearer-authed caller now carries an explicit role from the api_keys
-    // row). When non-loopback serving lands, this gate is the actual auth
-    // boundary on host-wide sleep.
+    // Admin-role gate, forward-defensive: loopback fallback is admin by default and Bearer callers carry an explicit role from the api_keys row;
+    // when non-loopback serving lands, this gate is the real auth boundary on host-wide sleep.
     const sleepCtx = await buildContextWithAuth(req, opts);
     // Sleep consolidates every tenant under hippoRoot, so it is a cross-tenant action.
     assertCrossTenantAdmin(sleepCtx, '/v1/sleep');

package/dist/server/routes/object-routes.d.ts

@@ -1,7 +1,6 @@
 import { type JsonValue } from '../../util/json.js';
 import type { ObjectDescriptor, SavableDescriptor } from '../../objects/descriptor.js';
 import type { ObjectByKind, ObjectKind, SavableKind } from '../../store/object-types.js';
-import { type Objects } from '../../store/port.js';
 import type { RouteRequest } from '../types.js';
 export interface ObjectRouteConfig<K extends ObjectKind> {
     /** Names the object in the 404 text, e.g. "customer note". */
@@ -29,10 +28,6 @@ export interface RequiredStringRule {
 }
 export declare function requiredString(body: Record<string, JsonValue>, key: string, rule: RequiredStringRule): string;
 export declare function optionalString(body: Record<string, JsonValue>, key: string, max: number): string | undefined;
-/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
-export declare function objectsOf({ opts }: RouteRequest): Objects;
-/** Saves through the request's store as the authenticated caller. */
-export declare function saveFor<K extends SavableKind, W>(rr: RouteRequest, d: SavableDescriptor<K, W>, tenantId: string, actor: string, write: W): Promise<ObjectByKind[K]>;
 export declare function listRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest): Promise<void>;
 export declare function getRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 export declare function closeRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;

package/dist/server/routes/object-routes.js

@@ -1,8 +1,8 @@
 // List, get, close and supersede handlers shared by the typed-object routes; each route file passes one config.
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { isJsonString } from '../../util/json.js';
-import { closeObject, listObjects, objectById, saveObject } from '../../objects/lifecycle.js';
-import { requireGroup } from '../../store/port.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeObject, listObjects, objectById } from '../../objects/lifecycle.js';
 import { buildContextWithAuth } from '../auth.js';
 import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
 import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
@@ -26,14 +26,6 @@ export function optionalString(body, key, max) {
         throw new HttpError(400, `${key} exceeds ${max}-character cap`);
     return value;
 }
-/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
-export function objectsOf({ opts }) {
-    return requireGroup(opts.store, 'objects');
-}
-/** Saves through the request's store as the authenticated caller. */
-export function saveFor(rr, d, tenantId, actor, write) {
-    return saveObject(objectsOf(rr), d, { hippoRoot: rr.opts.hippoRoot, tenantId, actor }, write);
-}
 async function found(cfg, objects, tenantId, id) {
     const row = await objectById(objects, cfg.object, tenantId, id);
     if (!row)
@@ -56,25 +48,25 @@ export async function listRoute(cfg, rr) {
         }
         listOpts.status = status;
     }
-    const page = pageOf(await listObjects(objectsOf(rr), cfg.object, ctx.tenantId, listOpts), limit, byCreatedAt);
+    const page = pageOf(await listObjects(objectsOf(ctx), cfg.object, ctx.tenantId, listOpts), limit, byCreatedAt);
     sendJson(res, 200, { [cfg.listField]: page.items, next_cursor: page.nextCursor });
 }
 export async function getRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
-    sendJson(rr.res, 200, { [cfg.field]: await found(cfg, objectsOf(rr), ctx.tenantId, id) });
+    sendJson(rr.res, 200, { [cfg.field]: await found(cfg, objectsOf(ctx), ctx.tenantId, id) });
 }
 export async function closeRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
-    sendJson(rr.res, 200, { [cfg.field]: await closeObject(objectsOf(rr), cfg.object, ctx.tenantId, id, ctx.actor.subject) });
+    sendJson(rr.res, 200, { [cfg.field]: await closeObject(objectsOf(ctx), cfg.object, ctx.tenantId, id, ctx.actor.subject) });
 }
 export async function supersedeRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const successor = cfg.revise(await parseJsonBody(rr.req, ctx));
-    const existing = await found(cfg, objectsOf(rr), ctx.tenantId, id);
-    const saved = await saveFor(rr, cfg.object, ctx.tenantId, ctx.actor.subject, successor(existing, id));
+    const existing = await found(cfg, objectsOf(ctx), ctx.tenantId, id);
+    const saved = await saveFor(ctx, cfg.object, successor(existing, id));
     sendJson(rr.res, 200, { [cfg.field]: saved });
 }
 //# sourceMappingURL=object-routes.js.map