hippo-memory 1.71.0 → 1.72.0

package/README.md

@@ -137,7 +137,7 @@ hippo init
 #    Scheduled machine-level daily runner (6:15am) via crontab
 ```
 
-To leave parts out: `--no-hooks` skips the instruction files and hooks, `--no-schedule` the daily run, and `--no-learn` the git history and agent memory import. `HIPPO_SKIP_AUTO_INTEGRATIONS=1` skips the same files and hooks that `--no-hooks` does.
+To leave parts out: `--no-hooks` skips the instruction files and hooks, `--no-schedule` the daily run, and `--no-learn` the git history and agent memory import. `HIPPO_SKIP_AUTO_INTEGRATIONS=1` skips the same files and hooks that `--no-hooks` does, and `HIPPO_SKIP_SCHEDULE=1` skips the daily run as `--no-schedule` does.
 
 ### Agent memories
 

package/dist/agent-memories/apply.d.ts

@@ -3,7 +3,6 @@ import { type MemoryEntry } from '../core/memory.js';
 import { type Tally } from './report.js';
 import type { AgentMemoryTool } from '../core/agent-memory-tools.js';
 import type { Container } from './types.js';
-export declare const SYNC_ACTOR = "agent-memories";
 export interface StoreSession {
     readonly db: DatabaseSyncLike;
     readonly hippoRoot: string;
@@ -36,14 +35,4 @@ export interface ContainerOutcome {
 }
 /** Throws SQLITE_BUSY when another writer holds the store past its busy timeout; nothing is written then. */
 export declare function syncContainer(s: StoreSession, work: ContainerWork): ContainerOutcome;
-export type SetAsideWhy = 'note-gone' | 'note-changed' | 'handover' | 'project-merge' | 'project-repair';
-export type SetAsideResult = {
-    readonly kind: 'untagged';
-    readonly entry: MemoryEntry;
-} | {
-    readonly kind: 'dormant';
-    readonly id: string;
-};
-/** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
-export declare function setAsideRow(db: DatabaseSyncLike, tag: string, row: MemoryEntry, why: SetAsideWhy): SetAsideResult;
 //# sourceMappingURL=apply.d.ts.map

package/dist/agent-memories/apply.js

@@ -1,41 +1,26 @@
 // One container's sync in one transaction on the caller's handle: lookup, plan, then every write (plan designs 6 to 8).
 import { appendAuditEvent } from '../store/audit.js';
 import { withTrialScope, withWriteScope } from '../db/index.js';
-import { deleteDormantRow, dormantSnapshotsBySourcePrefix, insertDormantRow, readDormantSnapshot, replaceDormantEntry } from '../store/dormant.js';
-import { gatedWrite } from '../trust/gated-write.js';
+import { deleteDormantRow, dormantSnapshotsBySourcePrefix, readDormantSnapshot, replaceDormantEntry } from '../store/dormant.js';
+import { gatedWrite } from '../store/gated-write.js';
+import { strengthAblation } from '../core/ablation.js';
 import { Layer, calculateStrength, createMemory } from '../core/memory.js';
 import { findRejectedValue, rejectionDigest } from '../store/rejection.js';
 import { redactSecretsStrict } from '../util/secret-detect.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { deleteEntryRowInTx, renameEntrySourceAndOriginAt, renameEntrySourceAt, setEntryTagsInTx, supersedeEntryAt } from '../store/entry-writes.js';
+import { renameEntrySourceAndOriginAt, renameEntrySourceAt, setEntryTagsInTx, supersedeEntryAt } from '../store/entry-writes.js';
+import { SYNC_ACTOR, setAsideRow } from '../store/set-aside.js';
 import { entryIdTakenAt, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
 import { markSummaryDirtyInTx } from '../store/summary-dirty.js';
 import { itemHash } from './keys.js';
 import { planContainer } from './plan.js';
 import { emptyTally } from './report.js';
 import { MIN_ITEM_CHARS, itemSource, splitSource, storedText } from './source.js';
-export const SYNC_ACTOR = 'agent-memories';
 /** Throws SQLITE_BUSY when another writer holds the store past its busy timeout; nothing is written then. */
 export function syncContainer(s, work) {
     const run = () => new ContainerRun(s, work).run();
     return s.dryRun ? withTrialScope(s.db, 'sync_container', run) : withWriteScope(s.db, 'sync_container', run);
 }
-/** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
-export function setAsideRow(db, tag, row, why) {
-    const untagged = { ...row, tags: row.tags.filter((t) => t !== tag) };
-    const audit = (metadata) => appendAuditEvent(db, { tenantId: row.tenantId, actor: SYNC_ACTOR, op: 'agent_memory_set_aside', targetId: row.id, metadata });
-    if (row.pinned) {
-        setEntryTagsInTx(db, untagged);
-        audit({ why, untagged: true });
-        return { kind: 'untagged', entry: untagged };
-    }
-    const now = new Date();
-    // Sleep's dormant move skips kept rows, so the steps are written out here without its filter.
-    insertDormantRow(db, { entry: untagged, strength: calculateStrength(row, now), reason: 'source-deleted', dormantAt: now.toISOString() });
-    deleteEntryRowInTx(db, row, SYNC_ACTOR);
-    audit({ why });
-    return { kind: 'dormant', id: row.id };
-}
 class ContainerRun {
     s;
     w;
@@ -223,7 +208,7 @@ class ContainerRun {
             tags: [...tags, this.tag],
             last_retrieved: now.toISOString(),
         };
-        if (!this.gated(stampOriginProject(this.s.hippoRoot, { ...revived, strength: calculateStrength(revived, now) })))
+        if (!this.gated(stampOriginProject(this.s.hippoRoot, { ...revived, strength: calculateStrength(revived, now, { ablation: strengthAblation() }) })))
             return;
         deleteDormantRow(this.s.db, this.s.tenantId, dormantId);
         appendAuditEvent(this.s.db, {

package/dist/agent-memories/claude-code.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { resolveProjectIdentity } from '../core/project-identity.js';
 import { realpathOrResolve } from '../util/real-path.js';
 import { isStringValue } from '../core/capture-contract.js';
-import { claudeConfigDir } from '../hooks/shared.js';
+import { claudeConfigDir } from '../util/agent-homes.js';
 import { expandHome, frontmatterField, itemTime, readTextFile, splitFrontmatter } from './files.js';
 import { markdownNotes, readFolderStore, uniqueFolders } from './folder-store.js';
 import { gitLayout } from './git.js';

package/dist/agent-memories/codex.js

@@ -1,7 +1,7 @@
 // Codex CLI's memory_summary.md, the one memory file Codex puts in its prompt, read as a single text-keyed file.
 import fs from 'node:fs';
 import path from 'node:path';
-import { codexHomeDir } from '../hooks/shared.js';
+import { codexHomeDir } from '../util/agent-homes.js';
 import { readTextFile } from './files.js';
 import { textItemKeys } from './keys.js';
 import { splitMarkdownItems } from './markdown.js';

package/dist/agent-memories/copilot.d.ts

@@ -1,5 +1,3 @@
-import type { Adapter, AdapterContext } from './types.js';
-/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-export declare function vscodeDataFolders(ctx: Pick<AdapterContext, 'env' | 'home' | 'platform'>): string[];
+import type { Adapter } from './types.js';
 export declare const copilotAdapter: Adapter;
 //# sourceMappingURL=copilot.d.ts.map

package/dist/agent-memories/copilot.js

@@ -5,24 +5,8 @@ import { readTextFile } from './files.js';
 import { readFolderStore } from './folder-store.js';
 import { gitLayout } from './git.js';
 import { errorMessage } from '../util/log.js';
-const PRODUCTS = ['Code', 'Code - Insiders'];
+import { vscodeDataFolders } from '../util/agent-homes.js';
 const MEMORY_TOOL = ['github.copilot-chat', 'memory-tool', 'memories'];
-/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-export function vscodeDataFolders(ctx) {
-    const { env, home, platform } = ctx;
-    if (env.VSCODE_PORTABLE)
-        return [path.join(env.VSCODE_PORTABLE, 'user-data')];
-    let appData;
-    if (env.VSCODE_APPDATA)
-        appData = env.VSCODE_APPDATA;
-    else if (platform === 'win32')
-        appData = env.APPDATA || path.join(home, 'AppData', 'Roaming');
-    else if (platform === 'darwin')
-        appData = path.join(home, 'Library', 'Application Support');
-    else
-        appData = env.XDG_CONFIG_HOME || path.join(home, '.config');
-    return PRODUCTS.map((product) => path.join(appData, product));
-}
 /** A `file:` URI as a local path; null for any other scheme or a URI with a host part. */
 function fileUriToPath(uri, platform) {
     if (!uri.startsWith('file://'))

package/dist/agent-memories/project-folds.d.ts

@@ -0,0 +1,10 @@
+import type { ProjectTagReads } from '../store/project-tags.js';
+export interface ProjectFold {
+    readonly from: string;
+    readonly into: string;
+}
+export declare function foldEdges(store: Pick<ProjectTagReads, 'auditEvents'>): ProjectFold[];
+export declare function foldedInto(edges: readonly ProjectFold[], names: readonly string[]): string[];
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export declare function namesFoldedInto(store: Pick<ProjectTagReads, 'auditEvents'>, names: readonly string[]): string[];
+//# sourceMappingURL=project-folds.d.ts.map

package/dist/agent-memories/project-folds.js

@@ -0,0 +1,34 @@
+// Project names folded into others, read from the audit trail: the sync files imports under the surviving name, and `hippo projects` repair agrees.
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
+function foldOf(value) {
+    if (!isObjectLike(value) || Array.isArray(value))
+        return [];
+    const { from, into } = value;
+    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
+}
+export function foldEdges(store) {
+    return [
+        ...store.auditEvents('project_merge').flatMap((e) => foldOf(e.metadata)),
+        ...store.auditEvents('project_repair')
+            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
+    ];
+}
+export function foldedInto(edges, names) {
+    const seen = new Set(names);
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const { from, into } of edges) {
+            if (!seen.has(into) || seen.has(from))
+                continue;
+            seen.add(from);
+            grew = true;
+        }
+    }
+    return [...seen].filter((n) => !names.includes(n));
+}
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export function namesFoldedInto(store, names) {
+    return foldedInto(foldEdges(store), names);
+}
+//# sourceMappingURL=project-folds.js.map

package/dist/agent-memories/sync.js

@@ -6,16 +6,18 @@ import path from 'node:path';
 import { errorMessage } from '../util/log.js';
 import { loadConfig } from '../core/config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb, outsideRequestStores, withWriteScope } from '../db/index.js';
-import { namesFoldedInto } from '../sharing/project-merge.js';
-import { isGlobalStoreRoot, projectNames, resolveGlobalRootDir, resolveProjectIdentity } from '../core/project-identity.js';
+import { namesFoldedInto } from './project-folds.js';
+import { projectTagReads } from '../store/project-tags.js';
+import { isGlobalStoreRoot, isInitialized, projectNames, resolveGlobalRootDir, resolveProjectIdentity, } from '../core/project-identity.js';
 import { duplicateKey, heldTextKeys } from '../util/same-text.js';
 import { removeEntryMirrors } from '../store/mirrors.js';
-import { initStore, isInitialized } from '../store/open.js';
+import { initStore } from '../store/open.js';
 import { writeEntryMirrors } from '../store/entry-writes.js';
 import { selectLiveEntriesBySourcePrefix, selectRowsOutsideSourcePrefixAt } from '../store/entry-reads.js';
 import { updateStats } from '../store/index-and-stats.js';
 import { resolveTenantId } from '../store/tenant.js';
-import { setAsideRow, syncContainer } from './apply.js';
+import { setAsideRow } from '../store/set-aside.js';
+import { syncContainer } from './apply.js';
 import { claudeCodeAdapter, claudeTranscriptListing, transcriptNotesProject } from './claude-code.js';
 import { codexAdapter } from './codex.js';
 import { copilotAdapter } from './copilot.js';
@@ -230,7 +232,7 @@ function syncStore(pass, listings, store, opts, report) {
 /** The legacy names plus every name a merge or repair folded into the project; the audit read runs once per pass. */
 function earlierNames(db, tenantId, id, legacyOrigins) {
     const names = [id, ...legacyOrigins];
-    return [...legacyOrigins, ...namesFoldedInto(db, tenantId, names)].filter((n) => n !== '' && n !== id);
+    return [...legacyOrigins, ...namesFoldedInto(projectTagReads(db, tenantId), names)].filter((n) => n !== '' && n !== id);
 }
 function containerWork(tool, container, options) {
     const { platform, legacy, origin, earlier } = options;
@@ -316,7 +318,7 @@ function handOver(synced, projectRoot, opts, report) {
         // A folder with no git and no marker wrote as '' before its store existed, and as its own name after.
         // Names folded into this project's in the global store were its rows too.
         const names = projectNames(resolveProjectIdentity(projectRoot));
-        const origins = [...new Set([...names, ...namesFoldedInto(db, tenantId, names), ''])];
+        const origins = [...new Set([...names, ...namesFoldedInto(projectTagReads(db, tenantId), names), ''])];
         for (const work of synced)
             handOverContainer(db, globalRoot, tenantId, work, { origins, platform: opts.machine.platform, report });
     }

package/dist/api/assemble.js

@@ -1,7 +1,7 @@
 // Session context assembly under a token budget.
 import { requireGroup, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject, projectNames } from '../core/project-identity.js';
 const DEFAULT_FRESH_TAIL_COUNT = 10;
 const DEFAULT_ROW_CAP = 5000;

package/dist/api/audit.d.ts

@@ -1,4 +1,6 @@
-import type { AuditEvent, AuditIssue, AuditOp } from '../store/audit.js';
+import { type AuditEvent, type AuditOp } from '../store/audit.js';
+import { type AuditIssue, type AuditResult } from '../core/memory-audit.js';
+import { type QualityRepairResult } from '../store/quality-repair.js';
 import type { KeysetPosition } from '../util/keyset.js';
 import type { Context } from './types.js';
 export interface AuditListOpts {
@@ -15,4 +17,30 @@ export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<Au
 export type AuditPass = 'audit --fix' | 'sleep-audit';
 /** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
 export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): string[];
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export declare function auditMemoryQuality(ctx: Context): AuditResult;
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
+export declare function repairMemoryQuality(ctx: Context, apply: boolean): QualityRepairResult;
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export declare function repairMemoryQualityOnce(ctx: Context): QualityRepairResult | null;
+export interface PruneAuditOpts {
+    /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
+    olderThanDays: number;
+    /** When true, count matching rows but do NOT delete. Default false. */
+    dryRun?: boolean;
+}
+export interface PruneAuditResult {
+    /** ISO timestamp of the cutoff. Rows with ts strictly less than this were deleted. */
+    cutoff: string;
+    /** Number of audit_log rows deleted (or that would be deleted, if dryRun). */
+    count: number;
+    /** Echo back whether this was a dry run. */
+    dryRun: boolean;
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export declare function computeCutoff(days: number, now?: Date): string;
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
+ *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
+ *  Throws on non-positive days or an empty tenant. */
+export declare function pruneAuditLog(ctx: Context, opts: PruneAuditOpts): PruneAuditResult;
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -1,5 +1,10 @@
-// Audit log queries, and the removal of the memories a quality audit marks as errors.
-import { deleteEntry } from '../store/delete-and-batch.js';
+// Audit log queries and retention, and the memory-quality audit with its repair passes.
+import { pruneAuditRows } from '../store/audit.js';
+import { auditMemories } from '../core/memory-audit.js';
+import { deleteEntriesAutomatically, memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { loadAllEntries } from '../store/entry-reads.js';
+import { repairAutomaticMemories, repairQualityOnce } from '../store/quality-repair.js';
+import { DAY_MS } from '../util/time.js';
 import { requireGroup, storeFor } from '../store/index.js';
 /** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
 export async function auditList(ctx, opts) {
@@ -9,9 +14,43 @@ export async function auditList(ctx, opts) {
 }
 /** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
 export function removeAuditErrors(ctx, pass, issues) {
-    return issues
+    const removals = issues
         .filter((issue) => issue.severity === 'error')
-        .filter((issue) => deleteEntry(ctx.hippoRoot, issue.memoryId, { actor: ctx.actor.subject, reason: `${pass}: ${issue.reason}`, automatic: true }))
-        .map((issue) => issue.memoryId);
+        .map((issue) => ({ id: issue.memoryId, reason: `${pass}: ${issue.reason}` }));
+    return deleteEntriesAutomatically(ctx.hippoRoot, removals, ctx.actor.subject);
+}
+// SHORTCUT: hippo.db only, as the port has no whole-tenant read, backing-object read or automatic delete with a reason; another store kind
+// answers 501 at the open. Port groups for them once a served store must audit.
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export function auditMemoryQuality(ctx) {
+    return auditMemories(loadAllEntries(ctx.hippoRoot, ctx.tenantId), memoriesBackingObjects(ctx.hippoRoot));
+}
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
+export function repairMemoryQuality(ctx, apply) {
+    return repairAutomaticMemories(ctx.hippoRoot, { tenantId: ctx.tenantId, apply });
+}
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export function repairMemoryQualityOnce(ctx) {
+    return repairQualityOnce(ctx.hippoRoot, ctx.tenantId);
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export function computeCutoff(days, now = new Date()) {
+    const cutoff = new Date(now.getTime() - days * DAY_MS);
+    return cutoff.toISOString();
+}
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
+ *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
+ *  Throws on non-positive days or an empty tenant. */
+export function pruneAuditLog(ctx, opts) {
+    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
+        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
+    }
+    if (!ctx.tenantId) {
+        throw new Error('pruneAuditLog: tenantId is required');
+    }
+    const dryRun = opts.dryRun === true;
+    const cutoff = computeCutoff(opts.olderThanDays);
+    const count = pruneAuditRows(ctx.hippoRoot, { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun });
+    return { cutoff, count, dryRun };
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/auth.d.ts

@@ -1,6 +1,6 @@
-import { type ApiKeyListRow } from '../store/auth.js';
+import { DEFAULT_KEY_TTL_DAYS, type ApiKeyListItem, type ApiKeyListRow } from '../store/auth.js';
 import type { KeysetPosition } from '../util/keyset.js';
-import type { Context, StoreReply } from './types.js';
+import { type Context, type StoreReply } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
     /** Defaults to `'member'`, which admin-gated routes such as `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
@@ -22,6 +22,8 @@ export interface AuthCreateResult {
 /** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
  * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
 export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
+export { DEFAULT_KEY_TTL_DAYS };
+export declare const MAX_TTL_DAYS = 3650;
 export interface AuthCreateSelfOpts {
     label?: string;
     /** Days until the new key expires. */
@@ -43,6 +45,8 @@ type KeyListOpts = {
 };
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
 export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
+/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export declare function authListAllTenants(ctx: Context, active: boolean): ApiKeyListItem[];
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
@@ -53,7 +57,7 @@ export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>
 export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
-export declare function authKeyTenant(ctx: Context, keyId: string): string | undefined;
+export declare function authKeyTenant(ctx: Context, keyId: string): Promise<string | undefined>;
 /** Shared result shape for authGrant/authUngrant, named per the file's oxlint anti-slop rule. */
 export interface AuthGrantResult {
     ok: true;
@@ -62,5 +66,4 @@ export interface AuthGrantResult {
 export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
-export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.js

@@ -1,10 +1,11 @@
 // API key management: create, list, revoke, and grant or ungrant restricted scopes.
 import { BadRequestError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { mintApiKey, } from '../store/auth.js';
+import { DEFAULT_KEY_TTL_DAYS, listApiKeys, mintApiKey, } from '../store/auth.js';
+import { storeFor } from '../store/index.js';
 import { changeScopeGrant } from '../store/sqlite/local.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
 import { DAY_MS } from '../util/time.js';
 import { andThen, notPorted, onStore } from './on-store.js';
+import { requireHostAdmin } from './types.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
 function keyIdOfSubject(subject) {
@@ -25,10 +26,9 @@ function newKey(ctx, fields) {
     const { keyId, plaintext, keyHash } = mintApiKey();
     return { plaintext, key: { ...fields, keyId, keyHash, tenantId: ctx.tenantId, createdAt: new Date().toISOString() } };
 }
-/** Days a key lives when its mint names no expiry, so a key nobody remembers stops working by itself. */
-const DEFAULT_KEY_TTL_DAYS = 90;
+export { DEFAULT_KEY_TTL_DAYS };
 // The ceiling keeps toISOString in range.
-const MAX_TTL_DAYS = 3650;
+export const MAX_TTL_DAYS = 3650;
 /** A 400, not a RangeError, since the caller of the mint chose these. */
 function mintExpiry({ ttlDays, noExpiry }) {
     if (noExpiry && ttlDays !== undefined) {
@@ -100,6 +100,11 @@ function selfResult({ key }, plaintext) {
 export function authListRows(ctx, opts) {
     return onStore(ctx, (port) => listRows(ctx, port, opts));
 }
+/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export function authListAllTenants(ctx, active) {
+    requireHostAdmin(ctx, "Listing every tenant's keys");
+    return listApiKeys(ctx.hippoRoot, { active });
+}
 function listRows(ctx, port, opts) {
     const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
     const keyId = memberKeyIdOf(ctx.actor);
@@ -160,12 +165,11 @@ function keyOwnerOf(record) {
 }
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
-export function authKeyTenant(ctx, keyId) {
+export async function authKeyTenant(ctx, keyId) {
     if (!ctx.actor.hostAdmin) {
         throw new ForbiddenError('Only the host admin can look up a key across tenants');
     }
-    // Synchronous for the CLI, so it reads hippo.db whatever store ctx names.
-    return sqliteSyncStore(ctx.hippoRoot).findApiKey(keyId)?.tenantId;
+    return (await storeFor(ctx).findApiKey(keyId))?.tenantId;
 }
 /** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export function authGrant(ctx, keyId, scope) {

package/dist/api/auto-sleep.d.ts

@@ -1,5 +1,7 @@
 import type { HippoConfig } from '../core/config.js';
 export declare const autoSleepInFlight: Set<string>;
+/** Runs one auto-sleep consolidation of `hippoRoot`: the HTTP server passes one that runs it off its event loop, in a child process. */
+export type AutoSleepRunner = (hippoRoot: string) => Promise<void>;
 export interface AutoSleepDue {
     enabled: boolean;
     count: number;
@@ -8,6 +10,7 @@ export interface AutoSleepDue {
 }
 /** Counts only when enabled: the count opens the store. */
 export declare function autoSleepDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep']): AutoSleepDue;
-/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it. */
-export declare function startAutoSleepIfDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep'], allowed: boolean): void;
+/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it.
+ * Without `run`, it runs in process. */
+export declare function startAutoSleepIfDue(hippoRoot: string, tenantId: string, config: HippoConfig['autoSleep'], allowed: boolean, run?: AutoSleepRunner): void;
 //# sourceMappingURL=auto-sleep.d.ts.map

package/dist/api/auto-sleep.js

@@ -11,8 +11,9 @@ export function autoSleepDue(hippoRoot, tenantId, config) {
     const count = enabled ? countCreatedSinceLastSleep(hippoRoot, tenantId) : 0;
     return { enabled, count, threshold, due: enabled && count >= threshold };
 }
-/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it. */
-export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed) {
+/** One run per store at a time; `allowed` is the caller's own gate. Consolidation is host-wide, so only the host tenant may start it.
+ * Without `run`, it runs in process. */
+export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed, run) {
     if (!allowed ||
         !config.enabled ||
         tenantId !== resolveTenantId({}) ||
@@ -23,7 +24,10 @@ export function startAutoSleepIfDue(hippoRoot, tenantId, config, allowed) {
     // Fire-and-forget (never block the response); an unhandled rejection would kill the server, so log it.
     // Its own scope: the call's closes a handle the sleep still holds across its pauses, but the caller's lock wait carries over.
     const busyWaitMs = scopedBusyWait();
-    outsideRequestStores(() => runWithRequestStores(() => consolidate(hippoRoot), { busyWaitMs }))
+    const started = run
+        ? run(hippoRoot)
+        : outsideRequestStores(() => runWithRequestStores(() => consolidate(hippoRoot), { busyWaitMs }));
+    started
         .catch((err) => {
         log.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${errorMessage(err)}`, errorFields(err));
     })

package/dist/api/availability.js

@@ -1,10 +1,9 @@
-import { DAY_MS } from '../util/time.js';
+import { DAY_MS, HOUR_MS } from '../util/time.js';
 export const DEFAULT_RECENCY_WINDOW_MS = DAY_MS;
 export const DEFAULT_RECENT_FRACTION_THRESHOLD = 0.7;
 export const DEFAULT_MIN_RETURNED = 3;
 export const DEFAULT_MIN_POOL = 10;
 export const DEFAULT_MIN_OLDER_PASSED_OVER = 3;
-const MS_PER_HOUR = 60 * 60 * 1000;
 function median(nums) {
     if (nums.length === 0)
         return 0;
@@ -43,7 +42,7 @@ export function detectAvailabilityBias(opts) {
     if (olderCandidatesPassedOver < minOlderPassedOver)
         return null;
     const pct = Math.round(recentFraction * 100);
-    const windowHours = Math.round(recencyWindowMs / MS_PER_HOUR);
+    const windowHours = Math.round(recencyWindowMs / HOUR_MS);
     const summary = `Availability bias risk: ${recentCount} of ${topK.length} returned results are from the ` +
         `last ${windowHours}h (${pct}%), but ${olderCandidatesPassedOver} older matched memories ` +
         `were passed over. Returned median age ${topKMedianAgeDays.toFixed(1)}d vs pool median ` +

package/dist/api/cards.d.ts

@@ -0,0 +1,42 @@
+import type { Card, CardComment, CardRun, CardStatus } from '../core/card.js';
+import type { HandoffOutcome } from '../core/handoff.js';
+import { type CardDetail } from '../store/card-detail.js';
+import type { Context } from './types.js';
+/** Create a card in the caller's tenant. Throws on an empty title or an unknown dependency. */
+export declare function cardCreate(ctx: Context, input: {
+    title: string;
+    repo?: string;
+    contract?: string;
+    budget?: number;
+    dependsOn?: string[];
+}): Card;
+/** One card by id, or null when the caller's tenant has none. */
+export declare function cardLoad(ctx: Context, id: string): Card | null;
+/** The card with its dependencies, runs, comments and latest handoff, or null when unknown. */
+export declare function cardDetail(ctx: Context, id: string): CardDetail | null;
+/** The caller's cards, newest-updated first, optionally filtered to one status. */
+export declare function cardList(ctx: Context, opts?: {
+    status?: CardStatus;
+}): Card[];
+/** Every run of a card, newest first. */
+export declare function cardRuns(ctx: Context, id: string): CardRun[];
+/** Claim a ready or blocked card for a runtime; null when it cannot be claimed. */
+export declare function cardClaim(ctx: Context, id: string, runtime: string, sessionId?: string): (Card & {
+    runId: number;
+}) | null;
+/** Extend a live run's lease; null when the run is not live. */
+export declare function cardHeartbeat(ctx: Context, id: string, runId: number): Card | null;
+/** Block a running card with a reason; null when it is not running. */
+export declare function cardBlock(ctx: Context, id: string, reason: string, runId?: number): Card | null;
+/** Move a running card to review; null when it is not running. */
+export declare function cardReview(ctx: Context, id: string, runId?: number): Card | null;
+/** Complete a card in review and promote the children it unblocks; null when not in review. */
+export declare function cardComplete(ctx: Context, id: string, outcome: HandoffOutcome, runId?: number): {
+    card: Card;
+    promotedChildren: string[];
+} | null;
+/** Return every card with an expired lease to ready; yields the reclaimed ids. */
+export declare function cardReclaimExpired(ctx: Context): string[];
+/** Add a comment to a card. Throws on an empty body. */
+export declare function cardComment(ctx: Context, cardId: string, author: string, body: string): CardComment;
+//# sourceMappingURL=cards.d.ts.map

package/dist/api/cards.js

@@ -0,0 +1,52 @@
+// The agent work board: create, claim, review and complete cards, scoped to the caller's tenant.
+import { addCardComment, blockCard, claimCard, completeCard, createCard, heartbeatCard, listCards, loadCard, loadCardRuns, reclaimExpiredCards, reviewCard, } from '../store/cards.js';
+import { loadCardDetail } from '../store/card-detail.js';
+/** Create a card in the caller's tenant. Throws on an empty title or an unknown dependency. */
+export function cardCreate(ctx, input) {
+    return createCard(ctx.hippoRoot, ctx.tenantId, input);
+}
+/** One card by id, or null when the caller's tenant has none. */
+export function cardLoad(ctx, id) {
+    return loadCard(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** The card with its dependencies, runs, comments and latest handoff, or null when unknown. */
+export function cardDetail(ctx, id) {
+    return loadCardDetail(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** The caller's cards, newest-updated first, optionally filtered to one status. */
+export function cardList(ctx, opts = {}) {
+    return listCards(ctx.hippoRoot, ctx.tenantId, opts);
+}
+/** Every run of a card, newest first. */
+export function cardRuns(ctx, id) {
+    return loadCardRuns(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** Claim a ready or blocked card for a runtime; null when it cannot be claimed. */
+export function cardClaim(ctx, id, runtime, sessionId) {
+    return claimCard(ctx.hippoRoot, ctx.tenantId, id, runtime, sessionId);
+}
+/** Extend a live run's lease; null when the run is not live. */
+export function cardHeartbeat(ctx, id, runId) {
+    return heartbeatCard(ctx.hippoRoot, ctx.tenantId, id, runId);
+}
+/** Block a running card with a reason; null when it is not running. */
+export function cardBlock(ctx, id, reason, runId) {
+    return blockCard(ctx.hippoRoot, ctx.tenantId, id, reason, runId);
+}
+/** Move a running card to review; null when it is not running. */
+export function cardReview(ctx, id, runId) {
+    return reviewCard(ctx.hippoRoot, ctx.tenantId, id, runId);
+}
+/** Complete a card in review and promote the children it unblocks; null when not in review. */
+export function cardComplete(ctx, id, outcome, runId) {
+    return completeCard(ctx.hippoRoot, ctx.tenantId, id, outcome, runId);
+}
+/** Return every card with an expired lease to ready; yields the reclaimed ids. */
+export function cardReclaimExpired(ctx) {
+    return reclaimExpiredCards(ctx.hippoRoot, ctx.tenantId);
+}
+/** Add a comment to a card. Throws on an empty body. */
+export function cardComment(ctx, cardId, author, body) {
+    return addCardComment(ctx.hippoRoot, ctx.tenantId, cardId, author, body);
+}
+//# sourceMappingURL=cards.js.map

package/dist/api/conflicts.d.ts

@@ -0,0 +1,28 @@
+import type { MemoryConflict } from '../store/rows.js';
+import type { CallerProject } from './prompt-hook.js';
+import { type Context } from './types.js';
+import type { TenantReach } from './memories.js';
+export interface ResolveMemoryConflictOpts {
+    /** One of the conflict's two memories; the other is the loser. */
+    keepId: string;
+    /** Delete the loser instead of halving its half-life. */
+    forget?: boolean;
+    /** Tombstone the loser's value as well, which removes it whatever `forget` says. */
+    rejectLoser?: boolean;
+    /** Kept on the tombstone; a conflict-context reason when unset. */
+    reason?: string;
+}
+export interface ResolveMemoryConflictResult {
+    conflictId: number;
+    keptId: string;
+    loserId: string;
+}
+/** Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as `ctx.actor`.
+ *  NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair. */
+export declare function resolveMemoryConflict(ctx: Context, conflictId: number, opts: ResolveMemoryConflictOpts): ResolveMemoryConflictResult;
+/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
+ *  its repo or user-global, and no scope it was not asked for. */
+export declare function listOpenConflicts(ctx: Context, project?: CallerProject): MemoryConflict[];
+/** Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only. */
+export declare function listConflicts(ctx: Context, status: string, reach?: TenantReach): MemoryConflict[];
+//# sourceMappingURL=conflicts.d.ts.map