hippo-memory 1.70.0 → 1.72.0

package/dist/api/audit.js

@@ -1,4 +1,10 @@
-// Audit log queries.
+// Audit log queries and retention, and the memory-quality audit with its repair passes.
+import { pruneAuditRows } from '../store/audit.js';
+import { auditMemories } from '../core/memory-audit.js';
+import { deleteEntriesAutomatically, memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { loadAllEntries } from '../store/entry-reads.js';
+import { repairAutomaticMemories, repairQualityOnce } from '../store/quality-repair.js';
+import { DAY_MS } from '../util/time.js';
 import { requireGroup, storeFor } from '../store/index.js';
 /** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
 export async function auditList(ctx, opts) {
@@ -6,4 +12,45 @@ export async function auditList(ctx, opts) {
         tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
     });
 }
+/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
+export function removeAuditErrors(ctx, pass, issues) {
+    const removals = issues
+        .filter((issue) => issue.severity === 'error')
+        .map((issue) => ({ id: issue.memoryId, reason: `${pass}: ${issue.reason}` }));
+    return deleteEntriesAutomatically(ctx.hippoRoot, removals, ctx.actor.subject);
+}
+// SHORTCUT: hippo.db only, as the port has no whole-tenant read, backing-object read or automatic delete with a reason; another store kind
+// answers 501 at the open. Port groups for them once a served store must audit.
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export function auditMemoryQuality(ctx) {
+    return auditMemories(loadAllEntries(ctx.hippoRoot, ctx.tenantId), memoriesBackingObjects(ctx.hippoRoot));
+}
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
+export function repairMemoryQuality(ctx, apply) {
+    return repairAutomaticMemories(ctx.hippoRoot, { tenantId: ctx.tenantId, apply });
+}
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export function repairMemoryQualityOnce(ctx) {
+    return repairQualityOnce(ctx.hippoRoot, ctx.tenantId);
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export function computeCutoff(days, now = new Date()) {
+    const cutoff = new Date(now.getTime() - days * DAY_MS);
+    return cutoff.toISOString();
+}
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
+ *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
+ *  Throws on non-positive days or an empty tenant. */
+export function pruneAuditLog(ctx, opts) {
+    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
+        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
+    }
+    if (!ctx.tenantId) {
+        throw new Error('pruneAuditLog: tenantId is required');
+    }
+    const dryRun = opts.dryRun === true;
+    const cutoff = computeCutoff(opts.olderThanDays);
+    const count = pruneAuditRows(ctx.hippoRoot, { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun });
+    return { cutoff, count, dryRun };
+}
 //# sourceMappingURL=audit.js.map

package/dist/api/auth.d.ts

@@ -1,15 +1,14 @@
-import { type ApiKeyListRow } from '../store/auth.js';
+import { DEFAULT_KEY_TTL_DAYS, type ApiKeyListItem, type ApiKeyListRow } from '../store/auth.js';
 import type { KeysetPosition } from '../util/keyset.js';
-import type { Context, StoreReply } from './types.js';
+import { type Context, type StoreReply } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
-    /**
-     * Authorization role for the new key. Defaults to `'admin'` for
-     * back-compat with keys minted before roles existed (the api_keys.role column DEFAULT also
-     * resolves to 'admin' if omitted from the INSERT). Member keys are
-     * 403-blocked from admin-gated routes (e.g. `POST /v1/sleep`).
-     */
+    /** Defaults to `'member'`, which admin-gated routes such as `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
     role?: 'admin' | 'member';
+    /** Days until the key expires: above 0 and at most 3650. Defaults to 90. */
+    ttlDays?: number;
+    /** True mints a key that never expires, which has to be asked for by name; refused together with `ttlDays`. */
+    noExpiry?: boolean;
 }
 export interface AuthCreateResult {
     keyId: string;
@@ -17,19 +16,14 @@ export interface AuthCreateResult {
     tenantId: string;
     /** The role bound to the new key (admin | member). */
     role: 'admin' | 'member';
+    /** ISO time the key stops working; null for a key that never expires. */
+    expiresAt: string | null;
 }
-/**
- * Mint a new API key. The new key is ALWAYS bound to `ctx.tenantId`. Callers
- * cannot override the tenant via the opts bag — a previous `tenantId` field
- * was removed because the HTTP layer would happily forward `body.tenantId`,
- * letting tenant A mint a key for tenant B. The HTTP route handler at
- * `src/server.ts` POST /v1/auth/keys mirrors this: it ignores any body
- * `tenantId` and uses the resolved Bearer's tenant exclusively.
- *
- * Only an admin actor can mint (ForbiddenError otherwise), and a key never
- * outranks its minter: a resolver admin is tenant-only, so it mints members.
- */
+/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
+ * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
 export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
+export { DEFAULT_KEY_TTL_DAYS };
+export declare const MAX_TTL_DAYS = 3650;
 export interface AuthCreateSelfOpts {
     label?: string;
     /** Days until the new key expires. */
@@ -41,7 +35,8 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
     /** ISO time the key stops working. */
     expiresAt: string;
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
+ * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
 export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
 type KeyListOpts = {
     active: boolean;
@@ -50,6 +45,8 @@ type KeyListOpts = {
 };
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
 export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
+/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export declare function authListAllTenants(ctx: Context, active: boolean): ApiKeyListItem[];
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
@@ -58,11 +55,9 @@ export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
 export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
-/**
- * The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
- * so the local CLI can run revoke and grant in the key's own tenant.
- */
-export declare function authKeyTenant(ctx: Context, keyId: string): string | undefined;
+/** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
+ * so the local CLI can run revoke and grant in the key's own tenant. */
+export declare function authKeyTenant(ctx: Context, keyId: string): Promise<string | undefined>;
 /** Shared result shape for authGrant/authUngrant, named per the file's oxlint anti-slop rule. */
 export interface AuthGrantResult {
     ok: true;
@@ -71,5 +66,4 @@ export interface AuthGrantResult {
 export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
-export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.js

@@ -1,26 +1,18 @@
 // API key management: create, list, revoke, and grant or ungrant restricted scopes.
-import { ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { mintApiKey, } from '../store/auth.js';
+import { BadRequestError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
+import { DEFAULT_KEY_TTL_DAYS, listApiKeys, mintApiKey, } from '../store/auth.js';
+import { storeFor } from '../store/index.js';
 import { changeScopeGrant } from '../store/sqlite/local.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
 import { DAY_MS } from '../util/time.js';
 import { andThen, notPorted, onStore } from './on-store.js';
+import { requireHostAdmin } from './types.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
 function keyIdOfSubject(subject) {
     return subject.startsWith(API_KEY_SUBJECT) ? subject.slice(API_KEY_SUBJECT.length) : null;
 }
-/**
- * Mint a new API key. The new key is ALWAYS bound to `ctx.tenantId`. Callers
- * cannot override the tenant via the opts bag — a previous `tenantId` field
- * was removed because the HTTP layer would happily forward `body.tenantId`,
- * letting tenant A mint a key for tenant B. The HTTP route handler at
- * `src/server.ts` POST /v1/auth/keys mirrors this: it ignores any body
- * `tenantId` and uses the resolved Bearer's tenant exclusively.
- *
- * Only an admin actor can mint (ForbiddenError otherwise), and a key never
- * outranks its minter: a resolver admin is tenant-only, so it mints members.
- */
+/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
+ * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
 export function authCreate(ctx, opts) {
     // The key and its auth_create row commit together on either store, so a failed audit write leaves no key.
     return onStore(ctx, (port) => {
@@ -34,6 +26,22 @@ function newKey(ctx, fields) {
     const { keyId, plaintext, keyHash } = mintApiKey();
     return { plaintext, key: { ...fields, keyId, keyHash, tenantId: ctx.tenantId, createdAt: new Date().toISOString() } };
 }
+export { DEFAULT_KEY_TTL_DAYS };
+// The ceiling keeps toISOString in range.
+export const MAX_TTL_DAYS = 3650;
+/** A 400, not a RangeError, since the caller of the mint chose these. */
+function mintExpiry({ ttlDays, noExpiry }) {
+    if (noExpiry && ttlDays !== undefined) {
+        throw new BadRequestError('send ttlDays or noExpiry, not both');
+    }
+    if (noExpiry)
+        return null;
+    const days = ttlDays ?? DEFAULT_KEY_TTL_DAYS;
+    if (!Number.isFinite(days) || days <= 0 || days > MAX_TTL_DAYS) {
+        throw new BadRequestError(`ttlDays must be above 0 and at most ${MAX_TTL_DAYS}`);
+    }
+    return new Date(Date.now() + days * DAY_MS).toISOString();
+}
 function adminKeyMint(ctx, opts) {
     if (ctx.actor.role !== 'admin') {
         throw new ForbiddenError('Only an admin key can create API keys');
@@ -41,16 +49,16 @@ function adminKeyMint(ctx, opts) {
     if (ctx.actor.viaAuthResolver && opts.role === 'admin') {
         throw new ForbiddenError('A key minted through the auth resolver can only be a member key');
     }
-    const role = opts.role ?? (ctx.actor.viaAuthResolver ? 'member' : 'admin');
+    const role = opts.role ?? 'member';
     const label = opts.label ?? null;
-    const { plaintext, key } = newKey(ctx, { label, role, ownerSubject: null, expiresAt: null });
-    // The plaintext is NEVER logged; metadata carries label + role, keyId is non-secret.
-    return { plaintext, mint: { key, actor: ctx.actor.subject, metadata: { label, role } } };
+    const expiresAt = mintExpiry(opts);
+    const { plaintext, key } = newKey(ctx, { label, role, ownerSubject: null, expiresAt });
+    // The plaintext is NEVER logged; the audit row carries what the key can do and for how long, keyId is non-secret.
+    return { plaintext, mint: { key, actor: ctx.actor.subject, metadata: { label, role, expiresAt } } };
 }
 function createResult({ key }, plaintext) {
-    return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: key.role };
+    return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: key.role, expiresAt: key.expiresAt };
 }
-const MAX_TTL_DAYS = 3650;
 /** A RangeError, not a 4xx, since the operator's config sets these; the ttl ceiling keeps toISOString in range and a departed user's key short-lived. */
 function assertSelfMintOpts({ ttlDays, perSubject }) {
     if (!Number.isFinite(ttlDays) || ttlDays <= 0 || ttlDays > MAX_TTL_DAYS) {
@@ -60,7 +68,8 @@ function assertSelfMintOpts({ ttlDays, perSubject }) {
         throw new RangeError(`authCreateSelf: perSubject must be a whole number of at least 1, got ${String(perSubject)}`);
     }
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
+ * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
 export function authCreateSelf(ctx, opts) {
     return onStore(ctx, (port) => {
         const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
@@ -79,7 +88,10 @@ function selfKeyMint(ctx, opts) {
     // Not destructured: a binding pattern makes TypeScript infer F as KeyFields and lose ownerSubject's string type.
     const made = newKey(ctx, { label, role: 'member', ownerSubject: subject, expiresAt });
     // Same op and actor as an admin mint, so a lookup by audit row finds this key too.
-    return { plaintext: made.plaintext, mint: { key: made.key, actor: subject, metadata: { label, role: 'member', self: true, expiresAt }, perSubject: opts.perSubject } };
+    return {
+        plaintext: made.plaintext,
+        mint: { key: made.key, actor: subject, metadata: { label, role: 'member', self: true, expiresAt }, perSubject: opts.perSubject }
+    };
 }
 function selfResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: 'member', expiresAt: key.expiresAt };
@@ -88,6 +100,11 @@ function selfResult({ key }, plaintext) {
 export function authListRows(ctx, opts) {
     return onStore(ctx, (port) => listRows(ctx, port, opts));
 }
+/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export function authListAllTenants(ctx, active) {
+    requireHostAdmin(ctx, "Listing every tenant's keys");
+    return listApiKeys(ctx.hippoRoot, { active });
+}
 function listRows(ctx, port, opts) {
     const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
     const keyId = memberKeyIdOf(ctx.actor);
@@ -146,16 +163,13 @@ function assertMemberKeyRevokesSelf(ctx, keyId) {
 function keyOwnerOf(record) {
     return record ? { tenantId: record.tenantId, revokedAt: record.revokedAt, role: record.role, ownerSubject: record.ownerSubject ?? null } : undefined;
 }
-/**
- * The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
- * so the local CLI can run revoke and grant in the key's own tenant.
- */
-export function authKeyTenant(ctx, keyId) {
+/** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
+ * so the local CLI can run revoke and grant in the key's own tenant. */
+export async function authKeyTenant(ctx, keyId) {
     if (!ctx.actor.hostAdmin) {
         throw new ForbiddenError('Only the host admin can look up a key across tenants');
     }
-    // Synchronous for the CLI, so it reads hippo.db whatever store ctx names.
-    return sqliteSyncStore(ctx.hippoRoot).findApiKey(keyId)?.tenantId;
+    return (await storeFor(ctx).findApiKey(keyId))?.tenantId;
 }
 /** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export function authGrant(ctx, keyId, scope) {

package/dist/api/auto-sleep.d.ts

@@ -1,5 +1,7 @@
 import type { HippoConfig } from '../core/config.js';
 export declare const autoSleepInFlight: Set<string>;
+/** Runs one auto-sleep consolidation of `hippoRoot`: the HTTP server passes one that runs it off its event loop, in a child process. */
+export type AutoSleepRunner = (hippoRoot: string) => Promise<void>;
 export interface AutoSleepDue {
     enabled: boolean;
     count: number;
@@ -8,6 +10,7 @@ export interface AutoSleepDue {
 }
 /** Counts only when enabled: the count opens the store. */
 export declare function autoSleepDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep']): AutoSleepDue;
-/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it. */
-export declare function startAutoSleepIfDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep'], allowed: boolean): void;
+/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it.
+ * Without `run`, it runs in process. */
+export declare function startAutoSleepIfDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep'], allowed: boolean, run?: AutoSleepRunner): void;
 //# sourceMappingURL=auto-sleep.d.ts.map

package/dist/api/auto-sleep.js

@@ -1,5 +1,5 @@
 // When a write starts a background sleep; the MCP remember tool and the session-close hook share it.
-import { errorMessage, log } from '../util/log.js';
+import { errorFields, errorMessage, log } from '../util/log.js';
 import { countCreatedSinceLastSleep } from '../store/index-and-stats.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { outsideRequestStores, runWithRequestStores, scopedBusyWait } from '../db/index.js';
@@ -11,8 +11,9 @@ export function autoSleepDue(hippoRoot, tenantId, config) {
     const count = enabled ? countCreatedSinceLastSleep(hippoRoot, tenantId) : 0;
     return { enabled, count, threshold, due: enabled && count >= threshold };
 }
-/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it. */
-export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed) {
+/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it.
+ * Without `run`, it runs in process. */
+export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed, run) {
     if (!allowed ||
         !config.enabled ||
         tenantId !== resolveTenantId({}) ||
@@ -23,9 +24,12 @@ export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed) {
     // Fire-and-forget (never block the response); an unhandled rejection would kill the server, so log it.
     // Its own scope: the call's closes a handle the sleep still holds across its pauses, but the caller's lock wait carries over.
     const busyWaitMs = scopedBusyWait();
-    outsideRequestStores(() => runWithRequestStores(() => consolidate(hippoRoot), { busyWaitMs }))
+    const started = run
+        ? run(hippoRoot)
+        : outsideRequestStores(() => runWithRequestStores(() => consolidate(hippoRoot), { busyWaitMs }));
+    started
         .catch((err) => {
-        log.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${errorMessage(err)}`);
+        log.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${errorMessage(err)}`, errorFields(err));
     })
         .finally(() => autoSleepInFlight.delete(hippoRoot));
 }

package/dist/api/availability.d.ts

@@ -46,20 +46,7 @@ export declare const DEFAULT_RECENT_FRACTION_THRESHOLD = 0.7;
 export declare const DEFAULT_MIN_RETURNED = 3;
 export declare const DEFAULT_MIN_POOL = 10;
 export declare const DEFAULT_MIN_OLDER_PASSED_OVER = 3;
-/**
- * Detect availability/recency bias in a recall result.
- *
- * Returns an AvailabilityHint when ALL of the following hold:
- *   1. topK.length >= minReturned AND pool.length >= minPool (enough signal);
- *   2. recentFraction > recentFractionThreshold (returned slice is recency-dominated);
- *   3. poolMedianAgeDays > topKMedianAgeDays (the pool genuinely skews older,
- *      so recency is not just the corpus being young);
- *   4. olderCandidatesPassedOver >= minOlderPassedOver (older matched memories
- *      actually existed and were not returned).
- * Otherwise returns null.
- *
- * Entries with an unparseable `created` are dropped defensively so a malformed
- * row cannot poison the medians with NaN.
- */
+/** Returns an AvailabilityHint when the returned slice is recency-dominated, the pool skews older and older matches were passed over; else null.
+ * Entries with an unparseable `created` are dropped so a malformed row cannot poison the medians with NaN. */
 export declare function detectAvailabilityBias(opts: DetectAvailabilityBiasOpts): AvailabilityHint | null;
 //# sourceMappingURL=availability.d.ts.map

package/dist/api/availability.js

@@ -1,10 +1,9 @@
-import { DAY_MS } from '../util/time.js';
+import { DAY_MS, HOUR_MS } from '../util/time.js';
 export const DEFAULT_RECENCY_WINDOW_MS = DAY_MS;
 export const DEFAULT_RECENT_FRACTION_THRESHOLD = 0.7;
 export const DEFAULT_MIN_RETURNED = 3;
 export const DEFAULT_MIN_POOL = 10;
 export const DEFAULT_MIN_OLDER_PASSED_OVER = 3;
-const MS_PER_HOUR = 60 * 60 * 1000;
 function median(nums) {
     if (nums.length === 0)
         return 0;
@@ -17,21 +16,8 @@ function parseTimestamps(refs) {
         .map((e) => ({ id: e.id, ts: Date.parse(e.created) }))
         .filter((e) => Number.isFinite(e.ts));
 }
-/**
- * Detect availability/recency bias in a recall result.
- *
- * Returns an AvailabilityHint when ALL of the following hold:
- *   1. topK.length >= minReturned AND pool.length >= minPool (enough signal);
- *   2. recentFraction > recentFractionThreshold (returned slice is recency-dominated);
- *   3. poolMedianAgeDays > topKMedianAgeDays (the pool genuinely skews older,
- *      so recency is not just the corpus being young);
- *   4. olderCandidatesPassedOver >= minOlderPassedOver (older matched memories
- *      actually existed and were not returned).
- * Otherwise returns null.
- *
- * Entries with an unparseable `created` are dropped defensively so a malformed
- * row cannot poison the medians with NaN.
- */
+/** Returns an AvailabilityHint when the returned slice is recency-dominated, the pool skews older and older matches were passed over; else null.
+ * Entries with an unparseable `created` are dropped so a malformed row cannot poison the medians with NaN. */
 export function detectAvailabilityBias(opts) {
     const now = opts.now ?? Date.now();
     const recencyWindowMs = opts.recencyWindowMs ?? DEFAULT_RECENCY_WINDOW_MS;
@@ -56,7 +42,7 @@ export function detectAvailabilityBias(opts) {
     if (olderCandidatesPassedOver < minOlderPassedOver)
         return null;
     const pct = Math.round(recentFraction * 100);
-    const windowHours = Math.round(recencyWindowMs / MS_PER_HOUR);
+    const windowHours = Math.round(recencyWindowMs / HOUR_MS);
     const summary = `Availability bias risk: ${recentCount} of ${topK.length} returned results are from the ` +
         `last ${windowHours}h (${pct}%), but ${olderCandidatesPassedOver} older matched memories ` +
         `were passed over. Returned median age ${topKMedianAgeDays.toFixed(1)}d vs pool median ` +

package/dist/api/cards.d.ts

@@ -0,0 +1,42 @@
+import type { Card, CardComment, CardRun, CardStatus } from '../core/card.js';
+import type { HandoffOutcome } from '../core/handoff.js';
+import { type CardDetail } from '../store/card-detail.js';
+import type { Context } from './types.js';
+/** Create a card in the caller's tenant. Throws on an empty title or an unknown dependency. */
+export declare function cardCreate(ctx: Context, input: {
+    title: string;
+    repo?: string;
+    contract?: string;
+    budget?: number;
+    dependsOn?: string[];
+}): Card;
+/** One card by id, or null when the caller's tenant has none. */
+export declare function cardLoad(ctx: Context, id: string): Card | null;
+/** The card with its dependencies, runs, comments and latest handoff, or null when unknown. */
+export declare function cardDetail(ctx: Context, id: string): CardDetail | null;
+/** The caller's cards, newest-updated first, optionally filtered to one status. */
+export declare function cardList(ctx: Context, opts?: {
+    status?: CardStatus;
+}): Card[];
+/** Every run of a card, newest first. */
+export declare function cardRuns(ctx: Context, id: string): CardRun[];
+/** Claim a ready or blocked card for a runtime; null when it cannot be claimed. */
+export declare function cardClaim(ctx: Context, id: string, runtime: string, sessionId?: string): (Card & {
+    runId: number;
+}) | null;
+/** Extend a live run's lease; null when the run is not live. */
+export declare function cardHeartbeat(ctx: Context, id: string, runId: number): Card | null;
+/** Block a running card with a reason; null when it is not running. */
+export declare function cardBlock(ctx: Context, id: string, reason: string, runId?: number): Card | null;
+/** Move a running card to review; null when it is not running. */
+export declare function cardReview(ctx: Context, id: string, runId?: number): Card | null;
+/** Complete a card in review and promote the children it unblocks; null when not in review. */
+export declare function cardComplete(ctx: Context, id: string, outcome: HandoffOutcome, runId?: number): {
+    card: Card;
+    promotedChildren: string[];
+} | null;
+/** Return every card with an expired lease to ready; yields the reclaimed ids. */
+export declare function cardReclaimExpired(ctx: Context): string[];
+/** Add a comment to a card. Throws on an empty body. */
+export declare function cardComment(ctx: Context, cardId: string, author: string, body: string): CardComment;
+//# sourceMappingURL=cards.d.ts.map

package/dist/api/cards.js

@@ -0,0 +1,52 @@
+// The agent work board: create, claim, review and complete cards, scoped to the caller's tenant.
+import { addCardComment, blockCard, claimCard, completeCard, createCard, heartbeatCard, listCards, loadCard, loadCardRuns, reclaimExpiredCards, reviewCard, } from '../store/cards.js';
+import { loadCardDetail } from '../store/card-detail.js';
+/** Create a card in the caller's tenant. Throws on an empty title or an unknown dependency. */
+export function cardCreate(ctx, input) {
+    return createCard(ctx.hippoRoot, ctx.tenantId, input);
+}
+/** One card by id, or null when the caller's tenant has none. */
+export function cardLoad(ctx, id) {
+    return loadCard(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** The card with its dependencies, runs, comments and latest handoff, or null when unknown. */
+export function cardDetail(ctx, id) {
+    return loadCardDetail(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** The caller's cards, newest-updated first, optionally filtered to one status. */
+export function cardList(ctx, opts = {}) {
+    return listCards(ctx.hippoRoot, ctx.tenantId, opts);
+}
+/** Every run of a card, newest first. */
+export function cardRuns(ctx, id) {
+    return loadCardRuns(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** Claim a ready or blocked card for a runtime; null when it cannot be claimed. */
+export function cardClaim(ctx, id, runtime, sessionId) {
+    return claimCard(ctx.hippoRoot, ctx.tenantId, id, runtime, sessionId);
+}
+/** Extend a live run's lease; null when the run is not live. */
+export function cardHeartbeat(ctx, id, runId) {
+    return heartbeatCard(ctx.hippoRoot, ctx.tenantId, id, runId);
+}
+/** Block a running card with a reason; null when it is not running. */
+export function cardBlock(ctx, id, reason, runId) {
+    return blockCard(ctx.hippoRoot, ctx.tenantId, id, reason, runId);
+}
+/** Move a running card to review; null when it is not running. */
+export function cardReview(ctx, id, runId) {
+    return reviewCard(ctx.hippoRoot, ctx.tenantId, id, runId);
+}
+/** Complete a card in review and promote the children it unblocks; null when not in review. */
+export function cardComplete(ctx, id, outcome, runId) {
+    return completeCard(ctx.hippoRoot, ctx.tenantId, id, outcome, runId);
+}
+/** Return every card with an expired lease to ready; yields the reclaimed ids. */
+export function cardReclaimExpired(ctx) {
+    return reclaimExpiredCards(ctx.hippoRoot, ctx.tenantId);
+}
+/** Add a comment to a card. Throws on an empty body. */
+export function cardComment(ctx, cardId, author, body) {
+    return addCardComment(ctx.hippoRoot, ctx.tenantId, cardId, author, body);
+}
+//# sourceMappingURL=cards.js.map

package/dist/api/conflicts.d.ts

@@ -0,0 +1,28 @@
+import type { MemoryConflict } from '../store/rows.js';
+import type { CallerProject } from './prompt-hook.js';
+import { type Context } from './types.js';
+import type { TenantReach } from './memories.js';
+export interface ResolveMemoryConflictOpts {
+    /** One of the conflict's two memories; the other is the loser. */
+    keepId: string;
+    /** Delete the loser instead of halving its half-life. */
+    forget?: boolean;
+    /** Tombstone the loser's value as well, which removes it whatever `forget` says. */
+    rejectLoser?: boolean;
+    /** Kept on the tombstone; a conflict-context reason when unset. */
+    reason?: string;
+}
+export interface ResolveMemoryConflictResult {
+    conflictId: number;
+    keptId: string;
+    loserId: string;
+}
+/** Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as `ctx.actor`.
+ *  NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair. */
+export declare function resolveMemoryConflict(ctx: Context, conflictId: number, opts: ResolveMemoryConflictOpts): ResolveMemoryConflictResult;
+/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
+ *  its repo or user-global, and no scope it was not asked for. */
+export declare function listOpenConflicts(ctx: Context, project?: CallerProject): MemoryConflict[];
+/** Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only. */
+export declare function listConflicts(ctx: Context, status: string, reach?: TenantReach): MemoryConflict[];
+//# sourceMappingURL=conflicts.d.ts.map

package/dist/api/conflicts.js

@@ -0,0 +1,61 @@
+// Conflict resolution for every front end, so the reach, status, pair and liveness checks live in one place.
+// SHORTCUT: hippo.db only, since the store port has no conflict calls; a conflicts group when a served store needs them.
+import { BadRequestError, ConflictError, NotFoundError } from '../core/api-errors.js';
+import { listMemoryConflicts, listTouchableConflicts, resolveConflict } from '../store/conflicts.js';
+import { loadEntriesByIds } from '../store/entry-reads.js';
+import { chunked } from '../util/chunked.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
+import { classifyOriginProject } from '../core/project-identity.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { requireHostAdmin } from './types.js';
+function isLive(entry) {
+    return !entry.superseded_by && (entry.kind === 'raw' || entry.kind === 'distilled') && !isQuarantineScope(entry.scope);
+}
+/** Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as `ctx.actor`.
+ *  NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair. */
+export function resolveMemoryConflict(ctx, conflictId, opts) {
+    // Read with every status, so a resolved conflict answers 409 while one holding another person's personal row stays a 404.
+    const conflict = listTouchableConflicts(ctx.hippoRoot, '*', ctx.tenantId, ctx.actor).find((c) => c.id === conflictId);
+    if (!conflict)
+        throw new NotFoundError(`conflict not found: ${conflictId}`);
+    if (conflict.status !== 'open')
+        throw new ConflictError(`conflict ${conflictId} is already resolved`);
+    const pair = [conflict.memory_a_id, conflict.memory_b_id];
+    if (!pair.includes(opts.keepId))
+        throw new BadRequestError(`keep must be one of the two memories in conflict ${conflictId}: ${pair.join(', ')}`);
+    if (loadEntriesByIds(ctx.hippoRoot, pair, ctx.tenantId).filter(isLive).length < pair.length) {
+        throw new NotFoundError(`conflict ${conflictId} names a memory that is superseded, archived or quarantined`);
+    }
+    const resolved = resolveConflict(ctx.hippoRoot, conflictId, opts.keepId, opts.forget === true, ctx.tenantId, {
+        rejectLoserValue: opts.rejectLoser === true,
+        reason: opts.reason,
+        rejectedBy: ctx.actor.subject,
+    });
+    // Every check passed above, so null here is another resolver getting there first.
+    if (resolved === null)
+        throw new ConflictError(`conflict ${conflictId} is already resolved`);
+    return { conflictId, keptId: opts.keepId, loserId: resolved.loserId };
+}
+/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
+ *  its repo or user-global, and no scope it was not asked for. */
+export function listOpenConflicts(ctx, project) {
+    const touchable = listTouchableConflicts(ctx.hippoRoot, 'open', ctx.tenantId, ctx.actor);
+    if (!project)
+        return touchable;
+    const own = personalScopeOf(ctx.actor);
+    const ids = [...new Set(touchable.flatMap((c) => [c.memory_a_id, c.memory_b_id]))];
+    // loadEntriesByIds reads at most one chunk of ids per call.
+    const rows = new Map(chunked(ids).flatMap((chunk) => loadEntriesByIds(ctx.hippoRoot, chunk, ctx.tenantId)).map((row) => [row.id, row]));
+    const shown = (id) => {
+        const row = rows.get(id);
+        return row !== undefined && classifyOriginProject(row.origin_project, project) !== 'cross-project'
+            && passesScopeFilterForRecall(row.scope ?? null, undefined, own);
+    };
+    return touchable.filter((c) => shown(c.memory_a_id) && shown(c.memory_b_id));
+}
+/** Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only. */
+export function listConflicts(ctx, status, reach = {}) {
+    requireHostAdmin(ctx, 'Listing conflicts past the scope check');
+    return listMemoryConflicts(ctx.hippoRoot, status, reach.everyTenant ? undefined : ctx.tenantId);
+}
+//# sourceMappingURL=conflicts.js.map

package/dist/api/context-render.js

@@ -1,6 +1,7 @@
 // The strings a context block prints. The budget prices these same strings, so selection and print cannot drift.
+import { MINUTE_MS } from '../util/time.js';
 import { calculateStrength, confidenceFacets, confidenceLabel } from '../core/memory.js';
-import { evalNow } from '../core/ablation.js';
+import { evalNow, strengthAblation } from '../core/ablation.js';
 import { estimateTokens } from '../util/token-text.js';
 import { renderAmbientSummary } from '../core/ambient.js';
 import { formatHandoffEvidenceLine } from '../core/handoff.js';
@@ -56,7 +57,7 @@ export function sessionTrailText(events) {
 // Each trail event is capped only in the compact-resume block, so other trail prints keep full content.
 export const COMPACT_RESUME_EVENT_CONTENT_CAP = 400;
 // A snapshot older than this was not written for this compaction (pre-compact skipped), so restoring it is stale, not a resume.
-export const COMPACT_RESUME_MAX_AGE_MS = 15 * 60_000;
+export const COMPACT_RESUME_MAX_AGE_MS = 15 * MINUTE_MS;
 /** The block compact-resume hands the model; events arrive already capped. */
 export function compactResumeText(snapshot, events) {
     return [
@@ -71,7 +72,7 @@ export function compactResumeText(snapshot, events) {
 export function contextHeading(heading, entries, tokens) {
     return `## ${heading} (${entries} entries, ${tokens} tokens)\n`;
 }
-export function contextLine(item, framing, showStrength, now, strengthPct = Math.round(calculateStrength(item.entry) * 100)) {
+export function contextLine(item, framing, showStrength, now, strengthPct = Math.round(calculateStrength(item.entry, undefined, { ablation: strengthAblation() }) * 100)) {
     const e = item.entry;
     const tagStr = e.tags.length > 0 ? ` [${e.tags.join(', ')}]` : '';
     const strengthStr = showStrength ? ` (${strengthPct}%)` : '';