hippo-memory 1.70.0 → 1.71.0

package/dist/capture/transcript.d.ts

@@ -28,16 +28,8 @@ export declare function sessionTail(turns: readonly SessionTurn[]): {
     assistants: string[];
 };
 export declare function summariseSessionTurns(turns: readonly SessionTurn[]): string;
-/**
- * Resolve a transcript path for `--last-session`.
- *
- * Priority, where the first source present is the only one tried:
- *   1. Explicit `transcriptPath` option (from `--transcript <path>`)
- *   2. Stdin JSON payload (Claude Code / OpenCode SessionEnd hook shape)
- *   3. Most recent `.jsonl` under `<claude config dir>/projects/<any>/` (`~/.claude` unless CLAUDE_CONFIG_DIR is set), only when the caller passes `mayScan` (only the caller knows it is not a hook) and there is no path and no stdin text, because this scan spans every project on the box
- *
- * Returns null when nothing resolves, a named transcript or payload whose file is missing included. Never throws.
- */
+/** Resolve a transcript path for `--last-session`: `transcriptPath`, then the stdin JSON payload, then the newest `.jsonl` in the Claude config dir.
+ *  The scan runs only with `mayScan` (it spans every project on the box); returns null when nothing resolves, never throws. */
 export declare function resolveLastSessionTranscript(explicit: string | undefined, stdinText: string | undefined, opts: {
     mayScan: boolean;
 }): string | null;

package/dist/capture/transcript.js

@@ -6,14 +6,8 @@ import { isObjectLike, isStringValue, readSessionEnd } from '../core/capture-con
 import { copilotTurn } from './copilot-transcript.js';
 const RECENT_USER_TURNS = 20;
 const RECENT_ASSISTANT_TURNS = 10;
-/**
- * Build a compact text summary from a Claude Code / OpenCode / Copilot JSONL transcript.
- * Keeps plain user messages and the final chunk of assistant text, drops
- * thinking blocks, tool_use, and tool_result noise. Capture reads the same
- * turns through `sessionTail`, one text per turn.
- *
- * Exported for tests.
- */
+/** Build a compact text summary from a Claude Code / OpenCode / Copilot JSONL transcript: plain user messages and the final assistant text chunk,
+ *  without thinking, tool_use and tool_result noise. Exported for tests. */
 /** Leading markers of the command lines Claude Code writes with type 'user'. */
 const CLAUDE_CODE_COMMAND_PREFIXES = ['<local-command-', '<command-name>', '<command-message>', '<command-args>'];
 function isNonHumanUserLine(entry, content) {
@@ -145,16 +139,8 @@ export function summariseSessionTurns(turns) {
         tailAssistants.join('\n\n'),
     ].join('\n');
 }
-/**
- * Resolve a transcript path for `--last-session`.
- *
- * Priority, where the first source present is the only one tried:
- *   1. Explicit `transcriptPath` option (from `--transcript <path>`)
- *   2. Stdin JSON payload (Claude Code / OpenCode SessionEnd hook shape)
- *   3. Most recent `.jsonl` under `<claude config dir>/projects/<any>/` (`~/.claude` unless CLAUDE_CONFIG_DIR is set), only when the caller passes `mayScan` (only the caller knows it is not a hook) and there is no path and no stdin text, because this scan spans every project on the box
- *
- * Returns null when nothing resolves, a named transcript or payload whose file is missing included. Never throws.
- */
+/** Resolve a transcript path for `--last-session`: `transcriptPath`, then the stdin JSON payload, then the newest `.jsonl` in the Claude config dir.
+ *  The scan runs only with `mayScan` (it spans every project on the box); returns null when nothing resolves, never throws. */
 export function resolveLastSessionTranscript(explicit, stdinText, opts) {
     if (explicit)
         return fs.existsSync(explicit) ? explicit : null;

package/dist/cli/api-context.d.ts

@@ -0,0 +1,3 @@
+import { type HippoDbContext } from '../api/index.js';
+export declare function cliApiContext(hippoRoot: string, tenantId: string): HippoDbContext;
+//# sourceMappingURL=api-context.d.ts.map

package/dist/cli/api-context.js

@@ -0,0 +1,6 @@
+import { adminActor } from '../api/index.js';
+// The one place the CLI names its audit actor; root is a parameter because some verbs target the global store.
+export function cliApiContext(hippoRoot, tenantId) {
+    return { hippoRoot, tenantId, actor: adminActor('cli') };
+}
+//# sourceMappingURL=api-context.js.map

package/dist/cli/audit-prune.d.ts

@@ -1,28 +1,5 @@
-/**
- * Audit log retention pruning.
- *
- * The `audit_log` table grows unbounded by default — every recall, write,
- * outcome, sleep, supersede, promote, forget, archive_raw, auth_revoke,
- * and auth_create emits a row. On a long-running deployment, this can
- * accumulate to millions of rows and slow down both audit queries and
- * incremental SQLite VACUUMs.
- *
- * Regulatory retention floors (HIPAA, SOX, GDPR) are why the prune is opt-in
- * per tenant and emits its own audit trail event.
- *
- * Design notes:
- *   - Per-tenant by default (matches existing audit CLI conventions).
- *   - The prune itself emits an `audit_prune` audit row with metadata
- *     `{cutoff, count, dryRun}`, recursively recording the maintenance op
- *     in the audit trail. Operators investigating "where did old rows go"
- *     have one row left to find regardless of retention floor.
- *   - Dry-run mode returns the count without deleting — first-time
- *     operator safety.
- *   - DELETE is wrapped in a transaction so a mid-operation crash leaves
- *     audit_log in a consistent state.
- *   - The audit_prune row itself is NEVER pruned by the same call (it's
- *     written AFTER the DELETE WHERE ts < cutoff, so ts > cutoff).
- */
+/** Audit log retention pruning: opt-in per tenant because retention floors (HIPAA, SOX, GDPR) apply.
+ * The audit_prune row is written after the DELETE, so a call never prunes its own record. */
 export interface PruneAuditOpts {
     /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
     olderThanDays: number;
@@ -41,21 +18,11 @@ export interface PruneAuditResult {
     /** Echo back whether this was a dry run. */
     dryRun: boolean;
 }
-/**
- * Compute the cutoff ISO timestamp for an N-days-ago cutoff. Exported for
- * testability so tests can pin "now" without mocking Date.
- */
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
 export declare function computeCutoff(days: number, now?: Date): string;
-/**
- * Delete audit_log rows older than `olderThanDays` days for `tenantId`.
- * Emits an `audit_prune` event with metadata `{cutoff, count, dryRun}`.
- *
- * Throws on invalid inputs (non-positive days, missing tenantId).
- */
+/** Delete audit_log rows older than `olderThanDays` for `tenantId`, emitting an `audit_prune` event.
+ * Throws on non-positive days or a missing tenantId. */
 export declare function pruneAuditLog(hippoRoot: string, opts: PruneAuditOpts): PruneAuditResult;
-/**
- * Parse the `--older-than <value>` flag. Accepts either bare integer days
- * (`30`) or integer with `d` suffix (`30d`). Throws on invalid format.
- */
+/** Parse `--older-than`: bare integer days (`30`) or with a `d` suffix (`30d`); throws on any other format. */
 export declare function parseOlderThanFlag(raw: string): number;
 //# sourceMappingURL=audit-prune.d.ts.map

package/dist/cli/audit-prune.js

@@ -1,34 +1,8 @@
-/**
- * Audit log retention pruning.
- *
- * The `audit_log` table grows unbounded by default — every recall, write,
- * outcome, sleep, supersede, promote, forget, archive_raw, auth_revoke,
- * and auth_create emits a row. On a long-running deployment, this can
- * accumulate to millions of rows and slow down both audit queries and
- * incremental SQLite VACUUMs.
- *
- * Regulatory retention floors (HIPAA, SOX, GDPR) are why the prune is opt-in
- * per tenant and emits its own audit trail event.
- *
- * Design notes:
- *   - Per-tenant by default (matches existing audit CLI conventions).
- *   - The prune itself emits an `audit_prune` audit row with metadata
- *     `{cutoff, count, dryRun}`, recursively recording the maintenance op
- *     in the audit trail. Operators investigating "where did old rows go"
- *     have one row left to find regardless of retention floor.
- *   - Dry-run mode returns the count without deleting — first-time
- *     operator safety.
- *   - DELETE is wrapped in a transaction so a mid-operation crash leaves
- *     audit_log in a consistent state.
- *   - The audit_prune row itself is NEVER pruned by the same call (it's
- *     written AFTER the DELETE WHERE ts < cutoff, so ts > cutoff).
- */
+/** Audit log retention pruning: opt-in per tenant because retention floors (HIPAA, SOX, GDPR) apply.
+ * The audit_prune row is written after the DELETE, so a call never prunes its own record. */
 import { pruneAuditRows } from '../store/audit.js';
 import { DAY_MS } from '../util/time.js';
-/**
- * Compute the cutoff ISO timestamp for an N-days-ago cutoff. Exported for
- * testability so tests can pin "now" without mocking Date.
- */
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
 export function computeCutoff(days, now = new Date()) {
     const cutoff = new Date(now.getTime() - days * DAY_MS);
     return cutoff.toISOString();
@@ -36,12 +10,8 @@ export function computeCutoff(days, now = new Date()) {
 function isTenantIdString(value) {
     return typeof value === 'string';
 }
-/**
- * Delete audit_log rows older than `olderThanDays` days for `tenantId`.
- * Emits an `audit_prune` event with metadata `{cutoff, count, dryRun}`.
- *
- * Throws on invalid inputs (non-positive days, missing tenantId).
- */
+/** Delete audit_log rows older than `olderThanDays` for `tenantId`, emitting an `audit_prune` event.
+ * Throws on non-positive days or a missing tenantId. */
 export function pruneAuditLog(hippoRoot, opts) {
     if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
         throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
@@ -55,10 +25,7 @@ export function pruneAuditLog(hippoRoot, opts) {
     const count = pruneAuditRows(hippoRoot, { tenantId: opts.tenantId, cutoff, actor, olderThanDays: opts.olderThanDays, dryRun });
     return { cutoff, count, dryRun };
 }
-/**
- * Parse the `--older-than <value>` flag. Accepts either bare integer days
- * (`30`) or integer with `d` suffix (`30d`). Throws on invalid format.
- */
+/** Parse `--older-than`: bare integer days (`30`) or with a `d` suffix (`30d`); throws on any other format. */
 export function parseOlderThanFlag(raw) {
     const m = raw.match(/^(\d+)(d)?$/i);
     if (!m) {

package/dist/cli/audit.d.ts

@@ -1,3 +1,3 @@
 import { type CommandContext } from './flag-values.js';
-export declare function handleAudit({ hippoRoot, args, flags }: CommandContext): Promise<void>;
+export declare function handleAudit({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/cli/audit.js

@@ -1,19 +1,18 @@
 // `hippo audit`: list and prune the audit log.
 import { loadAllEntries } from '../store/entry-reads.js';
-import { deleteEntry, memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { memoriesBackingObjects } from '../store/delete-and-batch.js';
 import { auditMemories, AUDIT_OPS } from '../store/audit.js';
 import * as api from '../api/index.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { pruneAuditLog, parseOlderThanFlag } from './audit-prune.js';
 import { printError } from './output.js';
-import { boolFlag, flagIsTrue, stringFlag } from './flag-values.js';
+import { cliApiContext } from './api-context.js';
+import { boolFlag, flagIsTrue, isBooleanFlag, stringFlag } from './flag-values.js';
 import { requireInit, resolveAuthRoot } from './shared.js';
-import { repairAutomaticMemories } from './quality-repair.js';
-import { getGlobalRoot } from '../sharing/shared.js';
+import { repairAutomaticMemories } from '../store/quality-repair.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
 import { errorMessage } from '../util/log.js';
-// ---------------------------------------------------------------------------
+import { CliExit } from './exit.js';
 // Audit log subcommands (`hippo audit list`)
-// ---------------------------------------------------------------------------
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 function formatAuditRow(ev) {
     const target = ev.targetId ?? '-';
@@ -22,40 +21,41 @@ function formatAuditRow(ev) {
 }
 function readAuditOp(flags) {
     const opFlag = stringFlag(flags, 'op');
+    // SAFETY: Set.has only compares by value, so a string outside the audit ops is a plain miss.
     if (opFlag && !VALID_AUDIT_OPS.has(opFlag)) {
         // Built from the Set so the message cannot drift from the valid ops.
         const expected = Array.from(VALID_AUDIT_OPS).join(' | ');
         printError(`Unknown --op value: ${opFlag}. Expected one of: ${expected}.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
+    // SAFETY: the exit above rejects every non-empty opFlag outside VALID_AUDIT_OPS, and an empty one is returned as given.
     return opFlag;
 }
 function readAuditLimit(flags) {
     const limitRaw = flags['limit'];
     let limit = 100;
-    if (limitRaw !== undefined && typeof limitRaw !== 'boolean') {
+    if (limitRaw !== undefined && !isBooleanFlag(limitRaw)) {
         const parsed = parseInt(String(limitRaw), 10);
         if (!Number.isFinite(parsed)) {
             printError(`Invalid --limit value: ${String(limitRaw)} (expected a positive integer).`);
-            process.exit(1);
+            throw new CliExit(1);
         }
         limit = parsed;
     }
     if (limit < 1 || limit > 10000) {
         printError(`--limit must be between 1 and 10000 (got ${limit}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return limit;
 }
-async function cmdAuditList(hippoRoot, flags) {
+async function cmdAuditList(hippoRoot, tenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const asJson = boolFlag(flags, 'json');
-    const tenantId = resolveTenantId({});
     const op = readAuditOp(flags);
     const since = stringFlag(flags, 'since');
     if (since !== undefined && !Number.isFinite(new Date(since).getTime())) {
         printError(`Invalid --since: ${since} (expected an ISO timestamp like 2026-04-22 or 2026-04-22T12:00:00Z).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const limit = readAuditLimit(flags);
     const ctx = { hippoRoot: root, tenantId, actor: { subject: 'cli', role: 'admin' } };
@@ -73,11 +73,11 @@ async function cmdAuditList(hippoRoot, flags) {
         console.log(formatAuditRow(ev));
     }
 }
-function cmdAuditPrune(hippoRoot, flags) {
+function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
     const olderThanRaw = stringFlag(flags, 'older-than') ?? '';
     if (!olderThanRaw) {
         printError('Usage: hippo audit prune --older-than <Nd> [--dry-run] [--tenant <t>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     let olderThanDays;
     try {
@@ -85,9 +85,9 @@ function cmdAuditPrune(hippoRoot, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
-    const tenantId = stringFlag(flags, 'tenant')?.trim() || resolveTenantId({});
+    const tenantId = stringFlag(flags, 'tenant')?.trim() || ctxTenantId;
     const dryRun = flagIsTrue(flags, 'dry-run');
     const asJson = boolFlag(flags, 'json');
     const result = pruneAuditLog(hippoRoot, { olderThanDays, tenantId, dryRun, actor: 'cli' });
@@ -101,22 +101,22 @@ function cmdAuditPrune(hippoRoot, flags) {
         console.log('(dry-run; re-run without --dry-run to actually delete)');
     }
 }
-async function cmdAuditLog(hippoRoot, args, flags) {
+async function cmdAuditLog(hippoRoot, tenantId, args, flags) {
     const sub = args[0];
     if (sub === 'list') {
-        await cmdAuditList(hippoRoot, flags);
+        await cmdAuditList(hippoRoot, tenantId, flags);
         return;
     }
     if (sub === 'prune') {
-        cmdAuditPrune(hippoRoot, flags);
+        cmdAuditPrune(hippoRoot, tenantId, flags);
         return;
     }
     printError(`Unknown audit subcommand: ${sub}. Expected: list | prune.`);
-    process.exit(1);
+    throw new CliExit(1);
 }
-function auditRepair(hippoRoot, flags) {
+function auditRepair(hippoRoot, tenantId, flags) {
     const apply = flagIsTrue(flags, 'apply') && flags['dry-run'] !== true;
-    const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId: resolveTenantId({}), apply });
+    const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId, apply });
     if (flags['json']) {
         console.log(JSON.stringify(result));
         return;
@@ -136,14 +136,15 @@ function auditRepair(hippoRoot, flags) {
     if (!apply)
         console.log('Preview only. Add --apply to move set-aside memories to dormant storage. Pin a review memory to keep it.');
 }
-function fixAuditErrors(hippoRoot, result, flags) {
+function fixAuditErrors(hippoRoot, tenantId, result, flags) {
     const errors = result.issues.filter(i => i.severity === 'error');
     if (errors.length > 0 && flagIsTrue(flags, 'dry-run')) {
         console.log(`\nWould remove ${errors.length} error-severity memories (dry run, nothing deleted).`);
         console.log(`${result.issues.length - errors.length} warnings would remain (review manually).`);
     }
     else if (errors.length > 0) {
-        const removedCount = errors.filter((issue) => deleteEntry(hippoRoot, issue.memoryId, { reason: `audit --fix: ${issue.reason}`, automatic: true })).length;
+        const ctx = cliApiContext(hippoRoot, tenantId);
+        const removedCount = api.removeAuditErrors(ctx, 'audit --fix', errors).length;
         console.log(`\nRemoved ${removedCount} error-severity memories.`);
         console.log(`${result.issues.length - errors.length} warnings remain (review manually).`);
     }
@@ -151,20 +152,18 @@ function fixAuditErrors(hippoRoot, result, flags) {
         console.log(`\nNo error-severity issues. Warnings require manual review.`);
     }
 }
-export async function handleAudit({ hippoRoot, args, flags }) {
+export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
     if (args[0] === 'repair') {
-        auditRepair(hippoRoot, flags);
+        auditRepair(hippoRoot, tenantId, flags);
         return;
     }
-    // `audit list` and `audit prune` -> audit-log subcommands.
-    // Other forms (no sub, --fix) keep the existing memory-quality auditor
-    // for backwards compatibility.
+    // `audit list` and `audit prune` are the audit-log subcommands; other forms (no sub, --fix) keep the memory-quality auditor.
     if (args[0] === 'list' || args[0] === 'prune') {
-        await cmdAuditLog(hippoRoot, args, flags);
+        await cmdAuditLog(hippoRoot, tenantId, args, flags);
         return;
     }
     requireInit(hippoRoot);
-    const entries = loadAllEntries(hippoRoot, resolveTenantId({}));
+    const entries = loadAllEntries(hippoRoot, tenantId);
     const result = auditMemories(entries, memoriesBackingObjects(hippoRoot));
     const shouldFix = boolFlag(flags, 'fix');
     if (result.issues.length === 0) {
@@ -178,7 +177,7 @@ export async function handleAudit({ hippoRoot, args, flags }) {
             console.log(`         "${issue.content.slice(0, 80)}${issue.content.length > 80 ? '...' : ''}"`);
         }
         if (shouldFix) {
-            fixAuditErrors(hippoRoot, result, flags);
+            fixAuditErrors(hippoRoot, tenantId, result, flags);
         }
         else {
             console.log(`\nRun with --fix to auto-remove error-severity issues.`);

package/dist/cli/auth.d.ts

@@ -1,3 +1,3 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdAuth(hippoRoot: string, args: string[], flags: CliFlags): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleAuth({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/auth.js

@@ -1,44 +1,60 @@
 // `hippo auth`: create, list, revoke and scope API keys.
 import { listApiKeys } from '../store/auth.js';
 import * as api from '../api/index.js';
-import { resolveTenantId } from '../store/tenant.js';
+import { cliApiContext } from './api-context.js';
 import { printError } from './output.js';
 import { boolFlag, stringFlag } from './flag-values.js';
 import { resolveAuthRoot } from './shared.js';
 import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 // ---------------------------------------------------------------------------
 // Auth subcommands
 // ---------------------------------------------------------------------------
-function cmdAuthCreate(hippoRoot, flags) {
+/** --role as given, or undefined for the default; anything else exits 1, so a typo never picks a role. */
+function roleFlagOrExit(flags) {
+    const roleFlag = stringFlag(flags, 'role');
+    if (roleFlag !== undefined && roleFlag !== 'admin' && roleFlag !== 'member') {
+        printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
+        throw new CliExit(1);
+    }
+    return roleFlag;
+}
+/** Says which defaults a mint took and how to ask for the wider key. Stderr keeps --json output clean. */
+function noteMintDefaults(roleGiven, expiryGiven) {
+    const notes = [];
+    if (!roleGiven)
+        notes.push('no --role given, so this is a member key (pass --role admin for an admin key)');
+    if (!expiryGiven)
+        notes.push('no --ttl-days or --no-expiry given, so it expires in 90 days');
+    if (notes.length > 0)
+        printError(`hippo auth create: ${notes.join('; ')}.`);
+}
+function cmdAuthCreate(hippoRoot, defaultTenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const tenantFlag = stringFlag(flags, 'tenant');
     const labelFlag = stringFlag(flags, 'label');
     const asJson = boolFlag(flags, 'json');
-    // Accepts 'admin' | 'member' only; anything else exits 1 so a typo doesn't silently default to admin.
-    const roleFlag = stringFlag(flags, 'role');
-    let role = 'admin';
-    if (roleFlag !== undefined) {
-        if (roleFlag !== 'admin' && roleFlag !== 'member') {
-            printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
-            process.exit(1);
-        }
-        role = roleFlag;
-    }
-    else {
-        // The default is the widest key hippo mints, so the operator is told at the moment of choosing. Stderr keeps --json output clean.
-        printError('hippo auth create: no --role given, so this is an admin key, and it never expires. Pass --role member for a narrower key; revoke either with `hippo auth revoke <key_id>`.');
-    }
+    const role = roleFlagOrExit(flags);
+    const ttlFlag = stringFlag(flags, 'ttl-days');
+    const ttlDays = ttlFlag === undefined ? undefined : Number(ttlFlag);
+    const noExpiry = boolFlag(flags, 'no-expiry');
     // The CLI's --tenant flag is the only legitimate cross-tenant override
     // (admin minting a key for another tenant from the local machine). It
     // flows through ctx.tenantId, NOT through opts — authCreate's opts no
     // longer accepts a tenantId field, so the HTTP layer cannot smuggle a
     // body.tenantId across.
-    const ctx = {
-        hippoRoot: root,
-        tenantId: tenantFlag ?? resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
-    const result = api.authCreate(ctx, { label: labelFlag, role });
+    const ctx = cliApiContext(root, tenantFlag ?? defaultTenantId);
+    let result;
+    try {
+        result = api.authCreate(ctx, { label: labelFlag, role, ttlDays, noExpiry: noExpiry || undefined });
+    }
+    catch (err) {
+        if (!(err instanceof api.BadRequestError))
+            throw err;
+        printError(`hippo auth create: ${err.message} (--ttl-days, --no-expiry).`);
+        throw new CliExit(1);
+    }
+    noteMintDefaults(role !== undefined, ttlFlag !== undefined || noExpiry);
     if (asJson) {
         console.log(JSON.stringify({
             keyId: result.keyId,
@@ -46,12 +62,14 @@ function cmdAuthCreate(hippoRoot, flags) {
             tenantId: result.tenantId,
             label: labelFlag ?? null,
             role: result.role,
+            expiresAt: result.expiresAt,
         }));
         return;
     }
     console.log(`key_id:    ${result.keyId}`);
     console.log(`plaintext: ${result.plaintext}`);
     console.log(`role:      ${result.role}`);
+    console.log(`expires:   ${result.expiresAt ?? 'never'}`);
     console.log('');
     console.log('!! WARNING: this is the ONLY time the plaintext key will be shown. !!');
     console.log('!! Copy it now. Hippo stores only a scrypt hash and cannot recover it. !!');
@@ -82,24 +100,24 @@ function cmdAuthList(hippoRoot, flags) {
     }
 }
 // The local CLI owns every tenant, so revoke and grant run in the key's own tenant.
-function keyContext(root, keyId) {
-    const hostCtx = { hippoRoot: root, tenantId: resolveTenantId({}), actor: api.adminActor('cli') };
+function keyContext(root, tenantId, keyId) {
+    const hostCtx = cliApiContext(root, tenantId);
     const keyTenant = api.authKeyTenant(hostCtx, keyId);
     if (keyTenant === undefined) {
         printError(`Unknown key_id: ${keyId}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return { ...hostCtx, tenantId: keyTenant };
 }
-function cmdAuthRevoke(hippoRoot, keyId, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), keyId);
+function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
+    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     let revokedAt;
     try {
         revokedAt = api.authRevoke(ctx, keyId).revokedAt;
     }
     catch (err) {
         printError(`Error: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify({ keyId, revokedAt }));
@@ -108,8 +126,8 @@ function cmdAuthRevoke(hippoRoot, keyId, flags) {
     console.log(`Revoked ${keyId} at ${revokedAt}`);
 }
 /** `hippo auth grant|ungrant <key_id> <scope>`, routed through api so the tenant, restricted-scope and audit checks live in one place. */
-function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), keyId);
+function cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, grant, flags) {
+    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     try {
         if (grant)
             api.authGrant(ctx, keyId, scope);
@@ -118,7 +136,7 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
     }
     catch (err) {
         printError(`Error: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify({ keyId, scope, granted: grant }));
@@ -126,16 +144,16 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
     }
     console.log(grant ? `Granted ${keyId} read access to ${scope}` : `Removed ${keyId}'s grant on ${scope}`);
 }
-export function cmdAuth(hippoRoot, args, flags) {
+export function handleAuth({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0];
     if (!sub) {
         printError('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const subArgs = args.slice(1);
     switch (sub) {
         case 'create':
-            cmdAuthCreate(hippoRoot, flags);
+            cmdAuthCreate(hippoRoot, tenantId, flags);
             return;
         case 'list':
             cmdAuthList(hippoRoot, flags);
@@ -144,9 +162,9 @@ export function cmdAuth(hippoRoot, args, flags) {
             const keyId = subArgs[0];
             if (!keyId) {
                 printError('Usage: hippo auth revoke <key_id>');
-                process.exit(1);
+                throw new CliExit(1);
             }
-            cmdAuthRevoke(hippoRoot, keyId, flags);
+            cmdAuthRevoke(hippoRoot, tenantId, keyId, flags);
             return;
         }
         case 'grant':
@@ -154,14 +172,14 @@ export function cmdAuth(hippoRoot, args, flags) {
             const [keyId, scope] = subArgs;
             if (!keyId || !scope) {
                 printError(`Usage: hippo auth ${sub} <key_id> <scope>`);
-                process.exit(1);
+                throw new CliExit(1);
             }
-            cmdAuthScopeGrant(hippoRoot, keyId, scope, sub === 'grant', flags);
+            cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, sub === 'grant', flags);
             return;
         }
         default:
             printError(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke | grant | ungrant.`);
-            process.exit(1);
+            throw new CliExit(1);
     }
 }
 //# sourceMappingURL=auth.js.map

package/dist/cli/briefs.d.ts

@@ -1,5 +1,5 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdProjectBrief(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdGraph(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdCustomerNote(hippoRoot: string, args: string[], flags: CliFlags): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleProjectBrief({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleGraph({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleCustomerNote({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=briefs.d.ts.map