hippo-memory 1.70.0 → 1.72.0

package/dist/cli/audit.js

@@ -1,19 +1,17 @@
 // `hippo audit`: list and prune the audit log.
-import { loadAllEntries } from '../store/entry-reads.js';
-import { deleteEntry, memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { auditMemories, AUDIT_OPS } from '../store/audit.js';
+import { truncateWithEllipsis } from '../util/ellipsize.js';
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
+import { AUDIT_OPS } from '../store/audit.js';
 import * as api from '../api/index.js';
-import { resolveTenantId } from '../store/tenant.js';
-import { pruneAuditLog, parseOlderThanFlag } from './audit-prune.js';
+import { parseOlderThanFlag } from './audit-prune.js';
 import { printError } from './output.js';
-import { boolFlag, flagIsTrue, stringFlag } from './flag-values.js';
+import { cliApiContext } from './api-context.js';
+import { boolFlag, flagIsTrue, isBooleanFlag, stringFlag } from './flag-values.js';
 import { requireInit, resolveAuthRoot } from './shared.js';
-import { repairAutomaticMemories } from './quality-repair.js';
-import { getGlobalRoot } from '../sharing/shared.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
 import { errorMessage } from '../util/log.js';
-// ---------------------------------------------------------------------------
+import { CliExit } from './exit.js';
 // Audit log subcommands (`hippo audit list`)
-// ---------------------------------------------------------------------------
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 function formatAuditRow(ev) {
     const target = ev.targetId ?? '-';
@@ -22,40 +20,41 @@ function formatAuditRow(ev) {
 }
 function readAuditOp(flags) {
     const opFlag = stringFlag(flags, 'op');
+    // SAFETY: Set.has only compares by value, so a string outside the audit ops is a plain miss.
     if (opFlag && !VALID_AUDIT_OPS.has(opFlag)) {
         // Built from the Set so the message cannot drift from the valid ops.
         const expected = Array.from(VALID_AUDIT_OPS).join(' | ');
         printError(`Unknown --op value: ${opFlag}. Expected one of: ${expected}.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
+    // SAFETY: the exit above rejects every non-empty opFlag outside VALID_AUDIT_OPS, and an empty one is returned as given.
     return opFlag;
 }
 function readAuditLimit(flags) {
     const limitRaw = flags['limit'];
-    let limit = 100;
-    if (limitRaw !== undefined && typeof limitRaw !== 'boolean') {
+    let limit = DEFAULT_LIST_LIMIT;
+    if (limitRaw !== undefined && !isBooleanFlag(limitRaw)) {
         const parsed = parseInt(String(limitRaw), 10);
         if (!Number.isFinite(parsed)) {
             printError(`Invalid --limit value: ${String(limitRaw)} (expected a positive integer).`);
-            process.exit(1);
+            throw new CliExit(1);
         }
         limit = parsed;
     }
     if (limit < 1 || limit > 10000) {
         printError(`--limit must be between 1 and 10000 (got ${limit}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return limit;
 }
-async function cmdAuditList(hippoRoot, flags) {
+async function cmdAuditList(hippoRoot, tenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const asJson = boolFlag(flags, 'json');
-    const tenantId = resolveTenantId({});
     const op = readAuditOp(flags);
     const since = stringFlag(flags, 'since');
     if (since !== undefined && !Number.isFinite(new Date(since).getTime())) {
         printError(`Invalid --since: ${since} (expected an ISO timestamp like 2026-04-22 or 2026-04-22T12:00:00Z).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const limit = readAuditLimit(flags);
     const ctx = { hippoRoot: root, tenantId, actor: { subject: 'cli', role: 'admin' } };
@@ -73,11 +72,11 @@ async function cmdAuditList(hippoRoot, flags) {
         console.log(formatAuditRow(ev));
     }
 }
-function cmdAuditPrune(hippoRoot, flags) {
+function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
     const olderThanRaw = stringFlag(flags, 'older-than') ?? '';
     if (!olderThanRaw) {
         printError('Usage: hippo audit prune --older-than <Nd> [--dry-run] [--tenant <t>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     let olderThanDays;
     try {
@@ -85,12 +84,12 @@ function cmdAuditPrune(hippoRoot, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
-    const tenantId = stringFlag(flags, 'tenant')?.trim() || resolveTenantId({});
+    const tenantId = stringFlag(flags, 'tenant')?.trim() || ctxTenantId;
     const dryRun = flagIsTrue(flags, 'dry-run');
     const asJson = boolFlag(flags, 'json');
-    const result = pruneAuditLog(hippoRoot, { olderThanDays, tenantId, dryRun, actor: 'cli' });
+    const result = api.pruneAuditLog(cliApiContext(hippoRoot, tenantId), { olderThanDays, dryRun });
     if (asJson) {
         console.log(JSON.stringify(result));
         return;
@@ -101,22 +100,22 @@ function cmdAuditPrune(hippoRoot, flags) {
         console.log('(dry-run; re-run without --dry-run to actually delete)');
     }
 }
-async function cmdAuditLog(hippoRoot, args, flags) {
+async function cmdAuditLog(hippoRoot, tenantId, args, flags) {
     const sub = args[0];
     if (sub === 'list') {
-        await cmdAuditList(hippoRoot, flags);
+        await cmdAuditList(hippoRoot, tenantId, flags);
         return;
     }
     if (sub === 'prune') {
-        cmdAuditPrune(hippoRoot, flags);
+        cmdAuditPrune(hippoRoot, tenantId, flags);
         return;
     }
     printError(`Unknown audit subcommand: ${sub}. Expected: list | prune.`);
-    process.exit(1);
+    throw new CliExit(1);
 }
-function auditRepair(hippoRoot, flags) {
+function auditRepair(hippoRoot, tenantId, flags) {
     const apply = flagIsTrue(flags, 'apply') && flags['dry-run'] !== true;
-    const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId: resolveTenantId({}), apply });
+    const result = api.repairMemoryQuality(cliApiContext(flags['global'] ? getGlobalRoot() : hippoRoot, tenantId), apply);
     if (flags['json']) {
         console.log(JSON.stringify(result));
         return;
@@ -124,8 +123,10 @@ function auditRepair(hippoRoot, flags) {
     console.log(`Quality repair ${apply ? 'apply' : 'preview'}: ${result.issues.length} issue(s) across ${result.total} memories.`);
     for (const issue of result.issues)
         console.log(`  [${issue.disposition}] ${issue.id}: ${issue.reason}${issue.protection ? ` (${issue.protection})` : ''}`);
-    for (const blocker of result.blockers)
-        console.log(`  Blocked: ${blocker}. Repair never upgrades a store; any other hippo command does, then run repair again.`);
+    for (const blocker of result.blockers) {
+        console.log(`  Blocked: ${blocker}. Repair never upgrades a store; ` +
+            'any other hippo command does, then run repair again.');
+    }
     const restore = `hippo dormant restore <id>${flags['global'] ? ' --global' : ''}`;
     if (result.backup)
         console.log(`Backup: ${result.backup}\nMoved ${result.appliedIds.length} memories to dormant storage. Recovery: ${restore}.`);
@@ -136,14 +137,15 @@ function auditRepair(hippoRoot, flags) {
     if (!apply)
         console.log('Preview only. Add --apply to move set-aside memories to dormant storage. Pin a review memory to keep it.');
 }
-function fixAuditErrors(hippoRoot, result, flags) {
+function fixAuditErrors(hippoRoot, tenantId, result, flags) {
     const errors = result.issues.filter(i => i.severity === 'error');
     if (errors.length > 0 && flagIsTrue(flags, 'dry-run')) {
         console.log(`\nWould remove ${errors.length} error-severity memories (dry run, nothing deleted).`);
         console.log(`${result.issues.length - errors.length} warnings would remain (review manually).`);
     }
     else if (errors.length > 0) {
-        const removedCount = errors.filter((issue) => deleteEntry(hippoRoot, issue.memoryId, { reason: `audit --fix: ${issue.reason}`, automatic: true })).length;
+        const ctx = cliApiContext(hippoRoot, tenantId);
+        const removedCount = api.removeAuditErrors(ctx, 'audit --fix', errors).length;
         console.log(`\nRemoved ${removedCount} error-severity memories.`);
         console.log(`${result.issues.length - errors.length} warnings remain (review manually).`);
     }
@@ -151,21 +153,18 @@ function fixAuditErrors(hippoRoot, result, flags) {
         console.log(`\nNo error-severity issues. Warnings require manual review.`);
     }
 }
-export async function handleAudit({ hippoRoot, args, flags }) {
+export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
     if (args[0] === 'repair') {
-        auditRepair(hippoRoot, flags);
+        auditRepair(hippoRoot, tenantId, flags);
         return;
     }
-    // `audit list` and `audit prune` -> audit-log subcommands.
-    // Other forms (no sub, --fix) keep the existing memory-quality auditor
-    // for backwards compatibility.
+    // `audit list` and `audit prune` are the audit-log subcommands; other forms (no sub, --fix) keep the memory-quality auditor.
     if (args[0] === 'list' || args[0] === 'prune') {
-        await cmdAuditLog(hippoRoot, args, flags);
+        await cmdAuditLog(hippoRoot, tenantId, args, flags);
         return;
     }
     requireInit(hippoRoot);
-    const entries = loadAllEntries(hippoRoot, resolveTenantId({}));
-    const result = auditMemories(entries, memoriesBackingObjects(hippoRoot));
+    const result = api.auditMemoryQuality(cliApiContext(hippoRoot, tenantId));
     const shouldFix = boolFlag(flags, 'fix');
     if (result.issues.length === 0) {
         console.log(`All ${result.total} memories passed quality checks.`);
@@ -175,10 +174,10 @@ export async function handleAudit({ hippoRoot, args, flags }) {
         for (const issue of result.issues) {
             const icon = issue.severity === 'error' ? 'ERR' : 'WARN';
             console.log(`  [${icon}] ${issue.memoryId}: ${issue.reason}`);
-            console.log(`         "${issue.content.slice(0, 80)}${issue.content.length > 80 ? '...' : ''}"`);
+            console.log(`         "${truncateWithEllipsis(issue.content, 80)}"`);
         }
         if (shouldFix) {
-            fixAuditErrors(hippoRoot, result, flags);
+            fixAuditErrors(hippoRoot, tenantId, result, flags);
         }
         else {
             console.log(`\nRun with --fix to auto-remove error-severity issues.`);

package/dist/cli/auth.d.ts

@@ -1,3 +1,3 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdAuth(hippoRoot: string, args: string[], flags: CliFlags): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleAuth({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/auth.js

@@ -1,44 +1,59 @@
 // `hippo auth`: create, list, revoke and scope API keys.
-import { listApiKeys } from '../store/auth.js';
 import * as api from '../api/index.js';
-import { resolveTenantId } from '../store/tenant.js';
+import { cliApiContext } from './api-context.js';
 import { printError } from './output.js';
 import { boolFlag, stringFlag } from './flag-values.js';
 import { resolveAuthRoot } from './shared.js';
 import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 // ---------------------------------------------------------------------------
 // Auth subcommands
 // ---------------------------------------------------------------------------
-function cmdAuthCreate(hippoRoot, flags) {
+/** --role as given, or undefined for the default; anything else exits 1, so a typo never picks a role. */
+function roleFlagOrExit(flags) {
+    const roleFlag = stringFlag(flags, 'role');
+    if (roleFlag !== undefined && roleFlag !== 'admin' && roleFlag !== 'member') {
+        printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
+        throw new CliExit(1);
+    }
+    return roleFlag;
+}
+/** Says which defaults a mint took and how to ask for the wider key. Stderr keeps --json output clean. */
+function noteMintDefaults(roleGiven, expiryGiven) {
+    const notes = [];
+    if (!roleGiven)
+        notes.push('no --role given, so this is a member key (pass --role admin for an admin key)');
+    if (!expiryGiven)
+        notes.push('no --ttl-days or --no-expiry given, so it expires in 90 days');
+    if (notes.length > 0)
+        printError(`hippo auth create: ${notes.join('; ')}.`);
+}
+function cmdAuthCreate(hippoRoot, defaultTenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const tenantFlag = stringFlag(flags, 'tenant');
     const labelFlag = stringFlag(flags, 'label');
     const asJson = boolFlag(flags, 'json');
-    // Accepts 'admin' | 'member' only; anything else exits 1 so a typo doesn't silently default to admin.
-    const roleFlag = stringFlag(flags, 'role');
-    let role = 'admin';
-    if (roleFlag !== undefined) {
-        if (roleFlag !== 'admin' && roleFlag !== 'member') {
-            printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
-            process.exit(1);
-        }
-        role = roleFlag;
-    }
-    else {
-        // The default is the widest key hippo mints, so the operator is told at the moment of choosing. Stderr keeps --json output clean.
-        printError('hippo auth create: no --role given, so this is an admin key, and it never expires. Pass --role member for a narrower key; revoke either with `hippo auth revoke <key_id>`.');
-    }
+    const role = roleFlagOrExit(flags);
+    const ttlFlag = stringFlag(flags, 'ttl-days');
+    const ttlDays = ttlFlag === undefined ? undefined : Number(ttlFlag);
+    const noExpiry = boolFlag(flags, 'no-expiry');
     // The CLI's --tenant flag is the only legitimate cross-tenant override
     // (admin minting a key for another tenant from the local machine). It
     // flows through ctx.tenantId, NOT through opts — authCreate's opts no
     // longer accepts a tenantId field, so the HTTP layer cannot smuggle a
     // body.tenantId across.
-    const ctx = {
-        hippoRoot: root,
-        tenantId: tenantFlag ?? resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
-    const result = api.authCreate(ctx, { label: labelFlag, role });
+    const ctx = cliApiContext(root, tenantFlag ?? defaultTenantId);
+    let result;
+    try {
+        result = api.authCreate(ctx, { label: labelFlag, role, ttlDays, noExpiry: noExpiry || undefined });
+    }
+    catch (err) {
+        if (!(err instanceof api.BadRequestError))
+            throw err;
+        printError(`hippo auth create: ${err.message} (--ttl-days, --no-expiry).`);
+        throw new CliExit(1);
+    }
+    noteMintDefaults(role !== undefined, ttlFlag !== undefined || noExpiry);
     if (asJson) {
         console.log(JSON.stringify({
             keyId: result.keyId,
@@ -46,12 +61,14 @@ function cmdAuthCreate(hippoRoot, flags) {
             tenantId: result.tenantId,
             label: labelFlag ?? null,
             role: result.role,
+            expiresAt: result.expiresAt,
         }));
         return;
     }
     console.log(`key_id:    ${result.keyId}`);
     console.log(`plaintext: ${result.plaintext}`);
     console.log(`role:      ${result.role}`);
+    console.log(`expires:   ${result.expiresAt ?? 'never'}`);
     console.log('');
     console.log('!! WARNING: this is the ONLY time the plaintext key will be shown. !!');
     console.log('!! Copy it now. Hippo stores only a scrypt hash and cannot recover it. !!');
@@ -63,11 +80,11 @@ function formatKeyRow(item) {
     const revoked = item.revokedAt ?? '-';
     return `${item.keyId}  ${item.tenantId}  ${item.role}  ${label}  ${created}  ${expires}  ${revoked}`;
 }
-function cmdAuthList(hippoRoot, flags) {
+function cmdAuthList(hippoRoot, tenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const includeRevoked = boolFlag(flags, 'all');
     const asJson = boolFlag(flags, 'json');
-    const items = listApiKeys(root, { active: !includeRevoked });
+    const items = api.authListAllTenants(cliApiContext(root, tenantId), !includeRevoked);
     if (asJson) {
         console.log(JSON.stringify(items));
         return;
@@ -82,24 +99,24 @@ function cmdAuthList(hippoRoot, flags) {
     }
 }
 // The local CLI owns every tenant, so revoke and grant run in the key's own tenant.
-function keyContext(root, keyId) {
-    const hostCtx = { hippoRoot: root, tenantId: resolveTenantId({}), actor: api.adminActor('cli') };
-    const keyTenant = api.authKeyTenant(hostCtx, keyId);
+async function keyContext(root, tenantId, keyId) {
+    const hostCtx = cliApiContext(root, tenantId);
+    const keyTenant = await api.authKeyTenant(hostCtx, keyId);
     if (keyTenant === undefined) {
         printError(`Unknown key_id: ${keyId}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return { ...hostCtx, tenantId: keyTenant };
 }
-function cmdAuthRevoke(hippoRoot, keyId, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), keyId);
+async function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
+    const ctx = await keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     let revokedAt;
     try {
         revokedAt = api.authRevoke(ctx, keyId).revokedAt;
     }
     catch (err) {
         printError(`Error: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify({ keyId, revokedAt }));
@@ -108,8 +125,8 @@ function cmdAuthRevoke(hippoRoot, keyId, flags) {
     console.log(`Revoked ${keyId} at ${revokedAt}`);
 }
 /** `hippo auth grant|ungrant <key_id> <scope>`, routed through api so the tenant, restricted-scope and audit checks live in one place. */
-function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), keyId);
+async function cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, grant, flags) {
+    const ctx = await keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     try {
         if (grant)
             api.authGrant(ctx, keyId, scope);
@@ -118,7 +135,7 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
     }
     catch (err) {
         printError(`Error: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify({ keyId, scope, granted: grant }));
@@ -126,27 +143,27 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
     }
     console.log(grant ? `Granted ${keyId} read access to ${scope}` : `Removed ${keyId}'s grant on ${scope}`);
 }
-export function cmdAuth(hippoRoot, args, flags) {
+export async function handleAuth({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0];
     if (!sub) {
         printError('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const subArgs = args.slice(1);
     switch (sub) {
         case 'create':
-            cmdAuthCreate(hippoRoot, flags);
+            cmdAuthCreate(hippoRoot, tenantId, flags);
             return;
         case 'list':
-            cmdAuthList(hippoRoot, flags);
+            cmdAuthList(hippoRoot, tenantId, flags);
             return;
         case 'revoke': {
             const keyId = subArgs[0];
             if (!keyId) {
                 printError('Usage: hippo auth revoke <key_id>');
-                process.exit(1);
+                throw new CliExit(1);
             }
-            cmdAuthRevoke(hippoRoot, keyId, flags);
+            await cmdAuthRevoke(hippoRoot, tenantId, keyId, flags);
             return;
         }
         case 'grant':
@@ -154,14 +171,14 @@ export function cmdAuth(hippoRoot, args, flags) {
             const [keyId, scope] = subArgs;
             if (!keyId || !scope) {
                 printError(`Usage: hippo auth ${sub} <key_id> <scope>`);
-                process.exit(1);
+                throw new CliExit(1);
             }
-            cmdAuthScopeGrant(hippoRoot, keyId, scope, sub === 'grant', flags);
+            await cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, sub === 'grant', flags);
             return;
         }
         default:
             printError(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke | grant | ungrant.`);
-            process.exit(1);
+            throw new CliExit(1);
     }
 }
 //# sourceMappingURL=auth.js.map

package/dist/cli/briefs.d.ts

@@ -1,5 +1,2 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdProjectBrief(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdGraph(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdCustomerNote(hippoRoot: string, args: string[], flags: CliFlags): void;
+export declare const handleProjectBrief: (ctx: import("./flag-values.js").CommandContext) => void;
 //# sourceMappingURL=briefs.d.ts.map