hippo-memory 1.70.0 → 1.72.0

package/dist/server/routes/decisions.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateDecision(rr: RouteRequest): Promise<void>;
-export declare function handleListDecisions(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateDecision(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListDecisions(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeDecision(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseDecision(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetDecision(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=decisions.d.ts.map

package/dist/server/routes/decisions.js

@@ -3,11 +3,11 @@ import { DECISION } from '../../objects/decisions.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { NotFoundError } from '../../core/api-errors.js';
 import { isJsonNumber } from '../../util/json.js';
-import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor } from './object-routes.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
+import { saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString } from './object-routes.js';
 const decisionRoutes = { noun: 'decision', field: 'decision', listField: 'decisions', object: DECISION };
-const TEXT = { max: 4096, untrimmed: true };
+const TEXT = { max: MAX_SHORT_FIELD_LEN, untrimmed: true };
 function supersededId(body) {
     const raw = body['supersedesDecisionId'];
     if (raw === undefined || raw === null)
@@ -17,27 +17,18 @@ function supersededId(body) {
     }
     return raw;
 }
-// ── decisions (first-class object) ──
-//
-// 5 routes: POST /v1/decisions (create, optional supersedesDecisionId),
-// GET /v1/decisions (list, status filter), GET /v1/decisions/:id (show),
-// POST /v1/decisions/:id/supersede (create a successor + supersede :id),
-// POST /v1/decisions/:id/close (retire). Bearer-authed + tenant-scoped via
-// buildContextWithAuth. status validated against VALID_DECISION_STATES.
-// DoS caps: text 4096, context 4096. The HTTP surface is
-// new (no legacy --supersedes <memory-id> constraint), so it supersedes by
-// table id and never weakens a memory mirror.
+// Routes: /v1/decisions (create, list, show, supersede, close), Bearer-authed and tenant-scoped; status is validated against VALID_DECISION_STATES.
+// The HTTP surface has no legacy --supersedes <memory-id> constraint, so it supersedes by table id and never weakens a memory mirror.
 export async function handleCreateDecision(rr) {
-    const { req, res } = rr;
-    const ctx = await buildContextWithAuth(req, rr.opts);
+    const { req, res, ctx } = rr;
     const body = await parseJsonBody(req, ctx);
     const write = {
         decisionText: requiredString(body, 'text', TEXT),
-        context: optionalString(body, 'context', 4096),
+        context: optionalString(body, 'context', MAX_SHORT_FIELD_LEN),
         supersedesDecisionId: supersededId(body),
     };
     try {
-        const decision = await saveFor(rr, DECISION, ctx.tenantId, ctx.actor.subject, write);
+        const decision = await saveFor(ctx, DECISION, write);
         sendJson(res, 201, { decision });
     }
     catch (e) {
@@ -53,11 +44,11 @@ export function handleListDecisions(rr) {
 // Not on supersedeRoute: this one answers 201 and leaves the missing-row 404 to the store, where the other five answer 200 after their own lookup.
 export async function handleSupersedeDecision(rr, match) {
     const oldId = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
-    const decision = await saveFor(rr, DECISION, ctx.tenantId, ctx.actor.subject, {
+    const decision = await saveFor(ctx, DECISION, {
         decisionText: requiredString(body, 'text', TEXT),
-        context: optionalString(body, 'context', 4096),
+        context: optionalString(body, 'context', MAX_SHORT_FIELD_LEN),
         supersedesDecisionId: oldId,
     });
     sendJson(rr.res, 201, { decision });

package/dist/server/routes/incidents.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateIncident(rr: RouteRequest): Promise<void>;
-export declare function handleListIncidents(rr: RouteRequest): Promise<void>;
-export declare function handleResolveIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateIncident(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListIncidents(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleResolveIncident(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseIncident(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetIncident(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=incidents.d.ts.map

package/dist/server/routes/incidents.js

@@ -2,10 +2,10 @@
 import { INCIDENT, openIncident, resolveOpenIncident } from '../../objects/incidents.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { NotFoundError } from '../../core/api-errors.js';
-import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { isJsonString } from '../../util/json.js';
-import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString } from './object-routes.js';
+import { objectsOf } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString } from './object-routes.js';
 const MAX_LINKED_MEMORY_IDS = 256;
 const incidentRoutes = { noun: 'incident', field: 'incident', listField: 'incidents', object: INCIDENT };
 function linkedMemoryIds(body) {
@@ -18,34 +18,24 @@ function linkedMemoryIds(body) {
     if (raw.length > MAX_LINKED_MEMORY_IDS) {
         throw new HttpError(400, `linkedMemoryIds exceeds ${MAX_LINKED_MEMORY_IDS}-item cap`);
     }
-    const isValidMemoryId = (item) => isJsonString(item) && item.length > 0 && item.length <= 4096;
+    const isValidMemoryId = (item) => isJsonString(item) && item.length > 0 && item.length <= MAX_SHORT_FIELD_LEN;
     if (!raw.every(isValidMemoryId)) {
-        throw new HttpError(400, 'each linkedMemoryIds entry must be a non-empty string <= 4096 chars');
+        throw new HttpError(400, `each linkedMemoryIds entry must be a non-empty string <= ${MAX_SHORT_FIELD_LEN} chars`);
     }
     return raw;
 }
-// ── incidents (first-class object) ──
-//
-// 5 routes: POST /v1/incidents (open; body text + context + linkedMemoryIds[]),
-// GET /v1/incidents (list, status filter), GET /v1/incidents/:id (show),
-// POST /v1/incidents/:id/resolve (open -> resolved; body resolutionText),
-// POST /v1/incidents/:id/close (open|resolved -> closed). Bearer-authed +
-// tenant-scoped via buildContextWithAuth. status validated against
-// VALID_INCIDENT_STATES. DoS caps: text 4096, context 4096, resolutionText
-// 4096. Mirrors /v1/decisions; lifecycle is
-// open->resolved->closed (no supersede), so linkedMemoryIds replaces
-// supersedesDecisionId on create.
+// Routes: /v1/incidents (open, list, show, resolve, close), mirroring /v1/decisions; status is validated against VALID_INCIDENT_STATES.
+// Lifecycle is open->resolved->closed (no supersede), so linkedMemoryIds replaces supersedesDecisionId on create.
 export async function handleCreateIncident(rr) {
-    const { req, res, opts } = rr;
-    const ctx = await buildContextWithAuth(req, opts);
+    const { req, res, opts, ctx } = rr;
     const body = await parseJsonBody(req, ctx);
     const write = {
-        incidentText: requiredString(body, 'text', { max: 4096, untrimmed: true }),
-        context: optionalString(body, 'context', 4096),
+        incidentText: requiredString(body, 'text', { max: MAX_SHORT_FIELD_LEN, untrimmed: true }),
+        context: optionalString(body, 'context', MAX_SHORT_FIELD_LEN),
         linkedMemoryIds: linkedMemoryIds(body),
     };
     try {
-        const incident = await openIncident(objectsOf(rr), opts.hippoRoot, ctx.tenantId, write, ctx.actor.subject);
+        const incident = await openIncident(objectsOf(ctx), opts.hippoRoot, ctx.tenantId, write, ctx.actor.subject);
         sendJson(res, 201, { incident });
     }
     catch (e) {
@@ -59,11 +49,10 @@ export function handleListIncidents(rr) {
     return listRoute(incidentRoutes, rr);
 }
 export async function handleResolveIncident(rr, match) {
-    const { req, res, opts } = rr;
+    const { req, res, ctx } = rr;
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const resolutionText = requiredString(await parseJsonBody(req, ctx), 'resolutionText', { max: 4096 });
-    const incident = await resolveOpenIncident(objectsOf(rr), ctx.tenantId, id, resolutionText, ctx.actor.subject);
+    const resolutionText = requiredString(await parseJsonBody(req, ctx), 'resolutionText', { max: MAX_SHORT_FIELD_LEN });
+    const incident = await resolveOpenIncident(objectsOf(ctx), ctx.tenantId, id, resolutionText, ctx.actor.subject);
     sendJson(res, 200, { incident });
 }
 export function handleCloseIncident(rr, match) {

package/dist/server/routes/memories.d.ts

@@ -1,10 +1,10 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateMemory({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleGetGraph({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleArchiveMemory({ req, res, opts }: RouteRequest, archiveMatch: Record<string, string>): Promise<void>;
-export declare function handleSupersedeMemory({ req, res, opts }: RouteRequest, supersedeMatch: Record<string, string>): Promise<void>;
-export declare function handlePromoteMemory({ req, res, opts }: RouteRequest, promoteMatch: Record<string, string>): Promise<void>;
-export declare function handleForgetMemory({ req, res, opts }: RouteRequest, idMatch: Record<string, string>): Promise<void>;
-export declare function handleApplyOutcome({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleSleep({ req, res, opts }: RouteRequest): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateMemory({ req, res, ctx }: AuthedRouteRequest): Promise<void>;
+export declare function handleGetGraph({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleArchiveMemory({ req, res, ctx }: AuthedRouteRequest, archiveMatch: Record<string, string>): Promise<void>;
+export declare function handleSupersedeMemory({ req, res, ctx }: AuthedRouteRequest, supersedeMatch: Record<string, string>): Promise<void>;
+export declare function handlePromoteMemory({ res, ctx }: AuthedRouteRequest, promoteMatch: Record<string, string>): Promise<void>;
+export declare function handleForgetMemory({ res, ctx }: AuthedRouteRequest, idMatch: Record<string, string>): Promise<void>;
+export declare function handleApplyOutcome({ req, res, ctx }: AuthedRouteRequest): Promise<void>;
+export declare function handleSleep({ req, res, ctx }: AuthedRouteRequest): Promise<void>;
 //# sourceMappingURL=memories.d.ts.map

package/dist/server/routes/memories.js

@@ -1,22 +1,16 @@
 // Memory write routes: create, graph, archive, supersede, promote, forget, outcome, sleep.
+import { graphRows } from '../../api/graph.js';
 import { archiveRaw, forget, outcome, outcomeForLastRecall, promote, remember, supersede } from '../../api/index.js';
+import { MEMORY_KINDS } from '../../core/memory.js';
 import { graphModelOf } from '../../graph/view.js';
 import { MAX_ENTITY_NAME_LEN } from '../../store/graph-rows.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { requireGroup } from '../../store/port.js';
-import { assertCrossTenantAdmin, buildContextWithAuth, isLoopback } from '../auth.js';
 import { sleepInChild } from '../sleep-offload.js';
 import { getCallerProject, getString, getStringArray, isSetMember, parseJsonBody, parseListLimit, validateIdSegment } from '../validation.js';
 import { isJsonString, isJsonBoolean } from '../../util/json.js';
-const VALID_KINDS = new Set([
-    'raw',
-    'distilled',
-    'superseded',
-    'archived',
-]);
+const VALID_KINDS = new Set(MEMORY_KINDS);
 // POST /v1/memories
-export async function handleCreateMemory({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
+export async function handleCreateMemory({ req, res, ctx }) {
     const body = await parseJsonBody(req, ctx);
     const content = getString(body, 'content');
     if (!content) {
@@ -44,7 +38,7 @@ export async function handleCreateMemory({ req, res, opts }) {
     return;
 }
 // GET /v1/graph?entity=NAME&limit=N — read-only entity/relation graph (tenant-scoped)
-export async function handleGetGraph({ req, res, opts, query }) {
+export async function handleGetGraph({ res, ctx, query }) {
     const entityRaw = query.get('entity');
     // Cap at the graph entity-name cap (512), not the id-shaped 256, so a valid
     // long decision/policy name remains focusable over HTTP.
@@ -52,16 +46,13 @@ export async function handleGetGraph({ req, res, opts, query }) {
         throw new HttpError(400, `entity exceeds the ${MAX_ENTITY_NAME_LEN}-character cap`);
     }
     const limit = parseListLimit(query.get('limit'));
-    const ctx = await buildContextWithAuth(req, opts);
-    const { role, scopes, owner } = ctx.actor;
-    const rows = await requireGroup(opts.store, 'graphReads').graphRows(ctx.tenantId, { entity: entityRaw ?? undefined, limit, reader: { role, scopes, owner } });
+    const rows = await graphRows(ctx, { entity: entityRaw ?? undefined, limit });
     sendJson(res, 200, graphModelOf(rows));
     return;
 }
 // /v1/memories/:id/* and DELETE /v1/memories/:id
-export async function handleArchiveMemory({ req, res, opts }, archiveMatch) {
+export async function handleArchiveMemory({ req, res, ctx }, archiveMatch) {
     validateIdSegment(archiveMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
     const reason = getString(body, 'reason');
     if (!reason) {
@@ -71,9 +62,8 @@ export async function handleArchiveMemory({ req, res, opts }, archiveMatch) {
     sendJson(res, 200, result);
     return;
 }
-export async function handleSupersedeMemory({ req, res, opts }, supersedeMatch) {
+export async function handleSupersedeMemory({ req, res, ctx }, supersedeMatch) {
     validateIdSegment(supersedeMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
     const content = getString(body, 'content');
     if (!content) {
@@ -83,28 +73,21 @@ export async function handleSupersedeMemory({ req, res, opts }, supersedeMatch)
     sendJson(res, 200, result);
     return;
 }
-export async function handlePromoteMemory({ req, res, opts }, promoteMatch) {
+export async function handlePromoteMemory({ res, ctx }, promoteMatch) {
     validateIdSegment(promoteMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const result = promote(ctx, promoteMatch.id);
     sendJson(res, 200, result);
     return;
 }
-export async function handleForgetMemory({ req, res, opts }, idMatch) {
+export async function handleForgetMemory({ res, ctx }, idMatch) {
     validateIdSegment(idMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const result = await forget(ctx, idMatch.id);
     sendJson(res, 200, result);
     return;
 }
-// POST /v1/outcome — apply a positive/negative outcome to memory ids.
-// Body: {ids?: string[], good: boolean}. If ids omitted, falls back to
-// the last-recall path (api.outcomeForLastRecall); returned shape is
-// {applied, ids} in that case so callers can disambiguate "no recent
-// recall" from "all ids skipped". Each applied id writes one audit_log
-// row (op='outcome', actor from Bearer).
-export async function handleApplyOutcome({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
+// POST /v1/outcome: applies a positive/negative outcome to memory ids; without ids it falls back to the last-recall path (api.outcomeForLastRecall)
+// and returns {applied, ids}, so callers can tell "no recent recall" from "all ids skipped". Each applied id writes one audit_log row (op='outcome').
+export async function handleApplyOutcome({ req, res, ctx }) {
     const body = await parseJsonBody(req, ctx);
     const good = body['good'];
     if (!isJsonBoolean(good)) {
@@ -120,10 +103,8 @@ export async function handleApplyOutcome({ req, res, opts }) {
         if (!idsRaw.every(isNonEmptyId)) {
             throw new HttpError(400, 'ids must be an array of non-empty strings');
         }
-        // DoS cap on ids.length. Each id triggers ~3 DB ops (readEntry +
-        // writeEntry + appendAuditEvent). N=1000 keeps per-request work bounded
-        // to sub-second wall time on SQLite hot path. Cap BEFORE buildContextWithAuth
-        // so attack traffic doesn't pay the api-key lookup cost.
+        // DoS cap on ids.length (each id costs ~3 DB ops): N=1000 keeps per-request work sub-second on SQLite. Auth runs first, so only a caller with a key
+        // reaches it.
         if (idsRaw.length > 1000) {
             throw new HttpError(400, 'ids exceeds 1000-id cap');
         }
@@ -142,33 +123,10 @@ export async function handleApplyOutcome({ req, res, opts }) {
     }
     return;
 }
-// POST /v1/sleep — host-wide consolidation pipeline (consolidate + dedup +
-// audit + share + ambient). serve() refuses non-loopback hosts at boot, AND
-// this per-request loopback assertion makes the host-wide semantic fail-
-// closed regardless of any future serve() boot-config change. Body:
-// {dry_run?, no_share?}. Returns SleepResult JSON.
-//
-// Tenant scope (Episode A follow-up tracked in TODOS.md): api.sleep operates
-// on the WHOLE hippoRoot (cross-tenant by design, matching CLI cmdSleep).
-// The loopback-only guard is the trust boundary today. Future non-loopback
-// serving must also zero the cross-tenant counters for other tenants.
-export async function handleSleep({ req, res, opts }) {
-    // Defensive per-request loopback guard. Uses the canonical isLoopback()
-    // helper above so any future extension (additional mapped/IPv6 forms,
-    // NAT64 prefixes) flows through without drift. serve()'s boot-time host
-    // check is the primary trust boundary; this is belt-and-suspenders.
-    if (!isLoopback(req.socket.remoteAddress)) {
-        throw new HttpError(403, '/v1/sleep is loopback-only (host-wide consolidation; see CHANGELOG v1.11.4)');
-    }
-    // Admin-role gate. Forward-defensive: exists today
-    // under loopback-only enforcement (loopback fallback is admin by default;
-    // any Bearer-authed caller now carries an explicit role from the api_keys
-    // row). When non-loopback serving lands, this gate is the actual auth
-    // boundary on host-wide sleep.
-    const sleepCtx = await buildContextWithAuth(req, opts);
-    // Sleep consolidates every tenant under hippoRoot, so it is a cross-tenant action.
-    assertCrossTenantAdmin(sleepCtx, '/v1/sleep');
-    const body = await parseJsonBody(req, sleepCtx);
+// POST /v1/sleep: host-wide consolidation (consolidate, dedup, audit, share, ambient); api.sleep spans the WHOLE hippoRoot, cross-tenant by design, so the
+// row's host-admin-local gate is the trust boundary. Body {dry_run?, no_share?}; returns SleepResult JSON.
+export async function handleSleep({ req, res, ctx }) {
+    const body = await parseJsonBody(req, ctx);
     const dryRunRaw = body['dry_run'];
     if (dryRunRaw !== undefined && !isJsonBoolean(dryRunRaw)) {
         throw new HttpError(400, 'dry_run must be a boolean');
@@ -177,8 +135,7 @@ export async function handleSleep({ req, res, opts }) {
     if (noShareRaw !== undefined && !isJsonBoolean(noShareRaw)) {
         throw new HttpError(400, 'no_share must be a boolean');
     }
-    // sleepCtx already built above for the admin-role gate; reuse.
-    const result = await sleepInChild(sleepCtx, {
+    const result = await sleepInChild(ctx, {
         dryRun: dryRunRaw === true,
         noShare: noShareRaw === true,
     });

package/dist/server/routes/object-routes.d.ts

@@ -1,8 +1,7 @@
 import { type JsonValue } from '../../util/json.js';
 import type { ObjectDescriptor, SavableDescriptor } from '../../objects/descriptor.js';
-import type { ObjectByKind, ObjectKind, SavableKind } from '../../store/object-types.js';
-import { type Objects } from '../../store/port.js';
-import type { RouteRequest } from '../types.js';
+import type { ObjectByKind, ObjectKind, SavableKind } from '../../core/object-types.js';
+import type { AuthedRouteRequest } from '../types.js';
 export interface ObjectRouteConfig<K extends ObjectKind> {
     /** Names the object in the 404 text, e.g. "customer note". */
     readonly noun: string;
@@ -29,12 +28,8 @@ export interface RequiredStringRule {
 }
 export declare function requiredString(body: Record<string, JsonValue>, key: string, rule: RequiredStringRule): string;
 export declare function optionalString(body: Record<string, JsonValue>, key: string, max: number): string | undefined;
-/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
-export declare function objectsOf({ opts }: RouteRequest): Objects;
-/** Saves through the request's store as the authenticated caller. */
-export declare function saveFor<K extends SavableKind, W>(rr: RouteRequest, d: SavableDescriptor<K, W>, tenantId: string, actor: string, write: W): Promise<ObjectByKind[K]>;
-export declare function listRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest): Promise<void>;
-export declare function getRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function closeRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function supersedeRoute<K extends SavableKind, W>(cfg: VersionedRouteConfig<K, W>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function listRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: AuthedRouteRequest): Promise<void>;
+export declare function getRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function closeRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function supersedeRoute<K extends SavableKind, W>(cfg: VersionedRouteConfig<K, W>, rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=object-routes.d.ts.map

package/dist/server/routes/object-routes.js

@@ -1,9 +1,8 @@
 // List, get, close and supersede handlers shared by the typed-object routes; each route file passes one config.
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { isJsonString } from '../../util/json.js';
-import { closeObject, listObjects, objectById, saveObject } from '../../objects/lifecycle.js';
-import { requireGroup } from '../../store/port.js';
-import { buildContextWithAuth } from '../auth.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeObject, listObjects, objectById } from '../../objects/lifecycle.js';
 import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
 import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
 export function requiredString(body, key, rule) {
@@ -26,28 +25,18 @@ export function optionalString(body, key, max) {
         throw new HttpError(400, `${key} exceeds ${max}-character cap`);
     return value;
 }
-/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
-export function objectsOf({ opts }) {
-    return requireGroup(opts.store, 'objects');
-}
-/** Saves through the request's store as the authenticated caller. */
-export function saveFor(rr, d, tenantId, actor, write) {
-    return saveObject(objectsOf(rr), d, { hippoRoot: rr.opts.hippoRoot, tenantId, actor }, write);
-}
 async function found(cfg, objects, tenantId, id) {
     const row = await objectById(objects, cfg.object, tenantId, id);
     if (!row)
         throw new HttpError(404, `${cfg.noun} ${id} not found`);
     return row;
 }
-// Limit and cursor are checked before auth and status after it, so a keyless caller gets 400 for the first two and 401 for a bad status.
 export async function listRoute(cfg, rr) {
-    const { req, res, opts, query } = rr;
+    const { res, query, ctx } = rr;
     const status = query.get('status') ?? 'all';
     const filter = cfg.filterParam === undefined ? null : query.get(cfg.filterParam);
     const limit = parseListLimit(query.get('limit'));
     const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     const listOpts = { limit: limit + 1, after, filter: filter?.trim() || undefined };
     if (status !== 'all') {
         const states = cfg.object.states;
@@ -56,25 +45,25 @@ export async function listRoute(cfg, rr) {
         }
         listOpts.status = status;
     }
-    const page = pageOf(await listObjects(objectsOf(rr), cfg.object, ctx.tenantId, listOpts), limit, byCreatedAt);
+    const page = pageOf(await listObjects(objectsOf(ctx), cfg.object, ctx.tenantId, listOpts), limit, byCreatedAt);
     sendJson(res, 200, { [cfg.listField]: page.items, next_cursor: page.nextCursor });
 }
 export async function getRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
-    sendJson(rr.res, 200, { [cfg.field]: await found(cfg, objectsOf(rr), ctx.tenantId, id) });
+    const { ctx } = rr;
+    sendJson(rr.res, 200, { [cfg.field]: await found(cfg, objectsOf(ctx), ctx.tenantId, id) });
 }
 export async function closeRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
-    sendJson(rr.res, 200, { [cfg.field]: await closeObject(objectsOf(rr), cfg.object, ctx.tenantId, id, ctx.actor.subject) });
+    const { ctx } = rr;
+    sendJson(rr.res, 200, { [cfg.field]: await closeObject(objectsOf(ctx), cfg.object, ctx.tenantId, id, ctx.actor.subject) });
 }
 export async function supersedeRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const successor = cfg.revise(await parseJsonBody(rr.req, ctx));
-    const existing = await found(cfg, objectsOf(rr), ctx.tenantId, id);
-    const saved = await saveFor(rr, cfg.object, ctx.tenantId, ctx.actor.subject, successor(existing, id));
+    const existing = await found(cfg, objectsOf(ctx), ctx.tenantId, id);
+    const saved = await saveFor(ctx, cfg.object, successor(existing, id));
     sendJson(rr.res, 200, { [cfg.field]: saved });
 }
 //# sourceMappingURL=object-routes.js.map

package/dist/server/routes/policies.d.ts

@@ -1,8 +1,8 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreatePolicy(rr: RouteRequest): Promise<void>;
-export declare function handleListPolicies(rr: RouteRequest): Promise<void>;
-export declare function handlePoliciesAsOf(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedePolicy(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleClosePolicy(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetPolicy(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreatePolicy(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListPolicies(rr: AuthedRouteRequest): Promise<void>;
+export declare function handlePoliciesAsOf(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedePolicy(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleClosePolicy(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetPolicy(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=policies.d.ts.map

package/dist/server/routes/policies.js

@@ -1,9 +1,9 @@
 // /v1/policies routes.
 import { policiesAsOf, POLICY } from '../../objects/policies.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
 // The date fields get a type and length check only: the store parses the date, and the cap bounds a junk string before it reaches the Date parser.
 const MAX_DATE_LEN = 64;
 const policyRoutes = {
@@ -12,28 +12,20 @@ const policyRoutes = {
     listField: 'policies',
     object: POLICY,
     revise: (body) => {
-        const policyText = requiredString(body, 'policyText', { max: 4096 });
+        const policyText = requiredString(body, 'policyText', { max: MAX_SHORT_FIELD_LEN });
         const validFrom = optionalString(body, 'validFrom', MAX_DATE_LEN);
         const validTo = optionalString(body, 'validTo', MAX_DATE_LEN);
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_SHORT_FIELD_LEN);
         return (existing, id) => ({ policyName: existing.policyName, policyText, validFrom, validTo, changeSummary, supersedesPolicyId: id });
     },
 };
-// ── policies (first-class object, bi-temporal-first) ──
-//
-// 6 routes: POST /v1/policies (new; processName-style body policyName +
-// policyText + validFrom? + validTo?), GET /v1/policies (list, status filter),
-// GET /v1/policies/asof (date + optional name; the bi-temporal as-of query;
-// placed BEFORE the /:id GET so the literal 'asof' is matched first), GET
-// /v1/policies/:id, POST /v1/policies/:id/supersede, POST /v1/policies/:id/close.
-// Date inputs are normalized + range-validated in the store; an invalid/inverted
-// date throws -> 400. DoS caps: policyName/policyText/changeSummary 4096.
+// The as-of route is registered BEFORE /:id so the literal 'asof' is matched first; date errors surface as 400.
 export async function handleCreatePolicy(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
-    const policy = await saveFor(rr, POLICY, ctx.tenantId, ctx.actor.subject, {
-        policyName: requiredString(body, 'policyName', { max: 4096 }),
-        policyText: requiredString(body, 'policyText', { max: 4096 }),
+    const policy = await saveFor(ctx, POLICY, {
+        policyName: requiredString(body, 'policyName', { max: MAX_SHORT_FIELD_LEN }),
+        policyText: requiredString(body, 'policyText', { max: MAX_SHORT_FIELD_LEN }),
         validFrom: optionalString(body, 'validFrom', MAX_DATE_LEN),
         validTo: optionalString(body, 'validTo', MAX_DATE_LEN),
     });
@@ -45,16 +37,14 @@ export function handleListPolicies(rr) {
 // The as-of query: must precede the /:id GET (literal 'asof' is non-numeric so
 // the /(\d+)/ route would not match it, but order it first for clarity).
 export async function handlePoliciesAsOf(rr) {
-    const { req, res, opts, query } = rr;
+    const { res, query, ctx } = rr;
     const date = query.get('date');
     if (date === null || date.length === 0) {
         throw new HttpError(400, 'date is required (ISO-8601 valid-time)');
     }
     const name = query.get('name') ?? undefined;
-    const ctx = await buildContextWithAuth(req, opts);
-    const policies = await policiesAsOf(objectsOf(rr), ctx.tenantId, date, { name });
+    const policies = await policiesAsOf(objectsOf(ctx), ctx.tenantId, date, { name });
     sendJson(res, 200, { policies });
-    return;
 }
 export function handleSupersedePolicy(rr, match) {
     return supersedeRoute(policyRoutes, rr, match);

package/dist/server/routes/predictions.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreatePrediction({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListPredictions({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handlePredictionStats({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleGetPrediction({ req, res, opts }: RouteRequest, predictionByIdMatch: RegExpMatchArray): Promise<void>;
-export declare function handleClosePrediction({ req, res, opts }: RouteRequest, predictionCloseMatch: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreatePrediction({ req, res, ctx, opts }: AuthedRouteRequest): Promise<void>;
+export declare function handleListPredictions({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handlePredictionStats({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleGetPrediction({ res, ctx }: AuthedRouteRequest, predictionByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleClosePrediction({ req, res, ctx }: AuthedRouteRequest, predictionCloseMatch: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=predictions.d.ts.map