hippo-memory 1.71.0 → 2.0.0

package/README.md

@@ -137,7 +137,7 @@ hippo init
 #    Scheduled machine-level daily runner (6:15am) via crontab
 ```
 
-To leave parts out: `--no-hooks` skips the instruction files and hooks, `--no-schedule` the daily run, and `--no-learn` the git history and agent memory import. `HIPPO_SKIP_AUTO_INTEGRATIONS=1` skips the same files and hooks that `--no-hooks` does.
+To leave parts out: `--no-hooks` skips the instruction files and hooks, `--no-schedule` the daily run, and `--no-learn` the git history and agent memory import. `HIPPO_SKIP_AUTO_INTEGRATIONS=1` skips the same files and hooks that `--no-hooks` does, and `HIPPO_SKIP_SCHEDULE=1` skips the daily run as `--no-schedule` does.
 
 ### Agent memories
 
@@ -675,11 +675,13 @@ hippo sleep
 Wrap any command with `hippo watch` to auto-learn from failures:
 
 ```bash
-hippo watch "npm run build"
+hippo watch -- npm run build
 # if it fails, Hippo captures the error automatically
 # next time an agent asks about build issues, the memory is there
 ```
 
+The command runs with no shell, so each argument reaches the program as written. To run a shell line with pipes or `&&`, pass it as one string after `--shell`: `hippo watch --shell "npm test && npm run build"`.
+
 ---
 
 ## CLI Reference
@@ -736,7 +738,7 @@ hippo watch "npm run build"
 | `hippo failures [--days n]` | Failed tool calls the capture-error hook saw, by outcome, and how many errors first happened in another session |
 | `hippo embed` | Embed all memories for semantic search |
 | `hippo embed --status` | Show embedding coverage |
-| `hippo watch "<command>"` | Run command, auto-learn from failures |
+| `hippo watch -- <command> [args...]` | Run command with no shell, auto-learn from failures (`--shell "<line>"` runs one line through the shell) |
 | `hippo learn --git` | Scan recent git commits for lessons |
 | `hippo learn --git --days <n>` | Scan N days back (default: 7) |
 | `hippo learn --git --repos <paths>` | Scan multiple repos (comma-separated) |
@@ -784,8 +786,8 @@ hippo watch "npm run build"
 | `hippo dashboard` | Open web dashboard at localhost:3333 (memory health by project, and the card board); open the printed URL, which carries a per-start access token |
 | `hippo dashboard --port <n>` | Use custom port |
 | `hippo mcp` | Start MCP server (stdio transport) |
-| `hippo serve` | Start the HTTP API server for this store on `127.0.0.1:6789` (`--port <n>` or `HIPPO_PORT`; `--host <host>`, which off loopback needs `HIPPO_REQUIRE_AUTH=1`). Every request needs an API key (`hippo auth create`, then `Authorization: Bearer <key>`; the hippo CLI reads `HIPPO_API_KEY`). `HIPPO_ALLOW_KEYLESS_LOCAL=1` lets requests from this machine in without one, as host admin; `HIPPO_REQUIRE_AUTH=1` wins over it |
-| `hippo serve --tls-cert <file> --tls-key <file>` | Serve HTTPS with that PEM certificate and key (or set `HIPPO_TLS_CERT` and `HIPPO_TLS_KEY`). Without them a network bind still starts, and warns once that API keys and memory text travel in cleartext unless a TLS-terminating proxy sits in front |
+| `hippo serve` | Start the HTTP API server for this store on `127.0.0.1:6789` (`--port <n>` or `HIPPO_PORT`; `--host <host>`, which off loopback needs `HIPPO_REQUIRE_AUTH=1`). Every request needs an API key (`hippo auth create`, then `Authorization: Bearer <key>`; the hippo CLI reads `HIPPO_API_KEY`). `HIPPO_ALLOW_KEYLESS_LOCAL=1` lets requests from this machine in without one, as a member (`HIPPO_KEYLESS_LOCAL_ROLE=admin` makes them host admin, for sleep and the quarantine routes); `HIPPO_REQUIRE_AUTH=1` wins over it. Each caller gets 20 requests a second, burst 40 (`HIPPO_CALLER_RPS`; `0` turns it off). See [Security defaults](docs/UPGRADING-2.0.md#security-defaults) |
+| `hippo serve --tls-cert <file> --tls-key <file>` | Serve HTTPS with that PEM certificate and key (or set `HIPPO_TLS_CERT` and `HIPPO_TLS_KEY`). Without them a network bind refuses to start, since API keys and memory text would travel in cleartext; behind a TLS-terminating proxy, pass `--allow-cleartext` (or set `HIPPO_ALLOW_CLEARTEXT=1`) |
 
 On `heartbeat`, `block`, `review` and `complete`, a given `--run` is checked against the card's live run and the command is refused, unchanged, if the two do not match.
 

package/dist/agent-memories/apply.d.ts

@@ -3,7 +3,6 @@ import { type MemoryEntry } from '../core/memory.js';
 import { type Tally } from './report.js';
 import type { AgentMemoryTool } from '../core/agent-memory-tools.js';
 import type { Container } from './types.js';
-export declare const SYNC_ACTOR = "agent-memories";
 export interface StoreSession {
     readonly db: DatabaseSyncLike;
     readonly hippoRoot: string;
@@ -36,14 +35,4 @@ export interface ContainerOutcome {
 }
 /** Throws SQLITE_BUSY when another writer holds the store past its busy timeout; nothing is written then. */
 export declare function syncContainer(s: StoreSession, work: ContainerWork): ContainerOutcome;
-export type SetAsideWhy = 'note-gone' | 'note-changed' | 'handover' | 'project-merge' | 'project-repair';
-export type SetAsideResult = {
-    readonly kind: 'untagged';
-    readonly entry: MemoryEntry;
-} | {
-    readonly kind: 'dormant';
-    readonly id: string;
-};
-/** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
-export declare function setAsideRow(db: DatabaseSyncLike, tag: string, row: MemoryEntry, why: SetAsideWhy): SetAsideResult;
 //# sourceMappingURL=apply.d.ts.map

package/dist/agent-memories/apply.js

@@ -1,41 +1,26 @@
 // One container's sync in one transaction on the caller's handle: lookup, plan, then every write (plan designs 6 to 8).
 import { appendAuditEvent } from '../store/audit.js';
 import { withTrialScope, withWriteScope } from '../db/index.js';
-import { deleteDormantRow, dormantSnapshotsBySourcePrefix, insertDormantRow, readDormantSnapshot, replaceDormantEntry } from '../store/dormant.js';
-import { gatedWrite } from '../trust/gated-write.js';
+import { deleteDormantRow, dormantSnapshotsBySourcePrefix, readDormantSnapshot, replaceDormantEntry } from '../store/dormant.js';
+import { gatedWrite } from '../store/gated-write.js';
+import { strengthAblation } from '../core/ablation.js';
 import { Layer, calculateStrength, createMemory } from '../core/memory.js';
 import { findRejectedValue, rejectionDigest } from '../store/rejection.js';
 import { redactSecretsStrict } from '../util/secret-detect.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { deleteEntryRowInTx, renameEntrySourceAndOriginAt, renameEntrySourceAt, setEntryTagsInTx, supersedeEntryAt } from '../store/entry-writes.js';
+import { renameEntrySourceAndOriginAt, renameEntrySourceAt, setEntryTagsInTx, supersedeEntryAt } from '../store/entry-writes.js';
+import { SYNC_ACTOR, setAsideRow } from '../store/set-aside.js';
 import { entryIdTakenAt, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
 import { markSummaryDirtyInTx } from '../store/summary-dirty.js';
 import { itemHash } from './keys.js';
 import { planContainer } from './plan.js';
 import { emptyTally } from './report.js';
 import { MIN_ITEM_CHARS, itemSource, splitSource, storedText } from './source.js';
-export const SYNC_ACTOR = 'agent-memories';
 /** Throws SQLITE_BUSY when another writer holds the store past its busy timeout; nothing is written then. */
 export function syncContainer(s, work) {
     const run = () => new ContainerRun(s, work).run();
     return s.dryRun ? withTrialScope(s.db, 'sync_container', run) : withWriteScope(s.db, 'sync_container', run);
 }
-/** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
-export function setAsideRow(db, tag, row, why) {
-    const untagged = { ...row, tags: row.tags.filter((t) => t !== tag) };
-    const audit = (metadata) => appendAuditEvent(db, { tenantId: row.tenantId, actor: SYNC_ACTOR, op: 'agent_memory_set_aside', targetId: row.id, metadata });
-    if (row.pinned) {
-        setEntryTagsInTx(db, untagged);
-        audit({ why, untagged: true });
-        return { kind: 'untagged', entry: untagged };
-    }
-    const now = new Date();
-    // Sleep's dormant move skips kept rows, so the steps are written out here without its filter.
-    insertDormantRow(db, { entry: untagged, strength: calculateStrength(row, now), reason: 'source-deleted', dormantAt: now.toISOString() });
-    deleteEntryRowInTx(db, row, SYNC_ACTOR);
-    audit({ why });
-    return { kind: 'dormant', id: row.id };
-}
 class ContainerRun {
     s;
     w;
@@ -99,7 +84,7 @@ class ContainerRun {
                 continue;
             const source = itemSource(this.w.prefix, key, item.text);
             for (const row of rows) {
-                if (renameEntrySourceAt(this.s.db, row.tenantId, row.id, row.source, source) === 0)
+                if (renameEntrySourceAt(this.s.db, row.tenant_id, row.id, row.source, source) === 0)
                     continue;
                 this.tally.adopted++;
                 this.mirror.push({ ...row, source });
@@ -112,7 +97,7 @@ class ContainerRun {
         let moved = 0;
         for (const row of selectLiveEntriesBySourcePrefix(this.s.db, this.s.tenantId, old)) {
             const source = this.w.prefix + row.source.slice(old.length);
-            if (renameEntrySourceAndOriginAt(this.s.db, row.tenantId, row.id, { from: row.source, to: source, origin }) === 0)
+            if (renameEntrySourceAndOriginAt(this.s.db, row.tenant_id, row.id, { from: row.source, to: source, origin }) === 0)
                 continue;
             moved++;
             this.mirror.push({ ...row, source, origin_project: origin ?? row.origin_project });
@@ -165,11 +150,11 @@ class ContainerRun {
     }
     /** api.supersede's steps on this transaction; false when another writer superseded the row first. */
     supersede(old, newId) {
-        if (!supersedeEntryAt(this.s.db, old.tenantId, old.id, newId))
+        if (!supersedeEntryAt(this.s.db, old.tenant_id, old.id, newId))
             return false;
         if (old.dag_parent_id)
-            markSummaryDirtyInTx(this.s.db, old.dag_parent_id, old.tenantId, SYNC_ACTOR);
-        appendAuditEvent(this.s.db, { tenantId: old.tenantId, actor: SYNC_ACTOR, op: 'supersede', targetId: old.id, metadata: { newId } });
+            markSummaryDirtyInTx(this.s.db, old.dag_parent_id, old.tenant_id, SYNC_ACTOR);
+        appendAuditEvent(this.s.db, { tenantId: old.tenant_id, actor: SYNC_ACTOR, op: 'supersede', targetId: old.id, metadata: { newId } });
         this.mirror.push({ ...old, superseded_by: newId });
         return true;
     }
@@ -223,7 +208,7 @@ class ContainerRun {
             tags: [...tags, this.tag],
             last_retrieved: now.toISOString(),
         };
-        if (!this.gated(stampOriginProject(this.s.hippoRoot, { ...revived, strength: calculateStrength(revived, now) })))
+        if (!this.gated(stampOriginProject(this.s.hippoRoot, { ...revived, strength: calculateStrength(revived, now, { ablation: strengthAblation() }) })))
             return;
         deleteDormantRow(this.s.db, this.s.tenantId, dormantId);
         appendAuditEvent(this.s.db, {

package/dist/agent-memories/claude-code.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { resolveProjectIdentity } from '../core/project-identity.js';
 import { realpathOrResolve } from '../util/real-path.js';
 import { isStringValue } from '../core/capture-contract.js';
-import { claudeConfigDir } from '../hooks/shared.js';
+import { claudeConfigDir } from '../util/agent-homes.js';
 import { expandHome, frontmatterField, itemTime, readTextFile, splitFrontmatter } from './files.js';
 import { markdownNotes, readFolderStore, uniqueFolders } from './folder-store.js';
 import { gitLayout } from './git.js';

package/dist/agent-memories/codex.js

@@ -1,7 +1,7 @@
 // Codex CLI's memory_summary.md, the one memory file Codex puts in its prompt, read as a single text-keyed file.
 import fs from 'node:fs';
 import path from 'node:path';
-import { codexHomeDir } from '../hooks/shared.js';
+import { codexHomeDir } from '../util/agent-homes.js';
 import { readTextFile } from './files.js';
 import { textItemKeys } from './keys.js';
 import { splitMarkdownItems } from './markdown.js';

package/dist/agent-memories/copilot.d.ts

@@ -1,5 +1,3 @@
-import type { Adapter, AdapterContext } from './types.js';
-/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-export declare function vscodeDataFolders(ctx: Pick<AdapterContext, 'env' | 'home' | 'platform'>): string[];
+import type { Adapter } from './types.js';
 export declare const copilotAdapter: Adapter;
 //# sourceMappingURL=copilot.d.ts.map

package/dist/agent-memories/copilot.js

@@ -5,24 +5,8 @@ import { readTextFile } from './files.js';
 import { readFolderStore } from './folder-store.js';
 import { gitLayout } from './git.js';
 import { errorMessage } from '../util/log.js';
-const PRODUCTS = ['Code', 'Code - Insiders'];
+import { vscodeDataFolders } from '../util/agent-homes.js';
 const MEMORY_TOOL = ['github.copilot-chat', 'memory-tool', 'memories'];
-/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-export function vscodeDataFolders(ctx) {
-    const { env, home, platform } = ctx;
-    if (env.VSCODE_PORTABLE)
-        return [path.join(env.VSCODE_PORTABLE, 'user-data')];
-    let appData;
-    if (env.VSCODE_APPDATA)
-        appData = env.VSCODE_APPDATA;
-    else if (platform === 'win32')
-        appData = env.APPDATA || path.join(home, 'AppData', 'Roaming');
-    else if (platform === 'darwin')
-        appData = path.join(home, 'Library', 'Application Support');
-    else
-        appData = env.XDG_CONFIG_HOME || path.join(home, '.config');
-    return PRODUCTS.map((product) => path.join(appData, product));
-}
 /** A `file:` URI as a local path; null for any other scheme or a URI with a host part. */
 function fileUriToPath(uri, platform) {
     if (!uri.startsWith('file://'))

package/dist/agent-memories/project-folds.d.ts

@@ -0,0 +1,10 @@
+import type { ProjectTagReads } from '../store/project-tags.js';
+export interface ProjectFold {
+    readonly from: string;
+    readonly into: string;
+}
+export declare function foldEdges(store: Pick<ProjectTagReads, 'auditEvents'>): ProjectFold[];
+export declare function foldedInto(edges: readonly ProjectFold[], names: readonly string[]): string[];
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export declare function namesFoldedInto(store: Pick<ProjectTagReads, 'auditEvents'>, names: readonly string[]): string[];
+//# sourceMappingURL=project-folds.d.ts.map

package/dist/agent-memories/project-folds.js

@@ -0,0 +1,34 @@
+// Project names folded into others, read from the audit trail: the sync files imports under the surviving name, and `hippo projects` repair agrees.
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
+function foldOf(value) {
+    if (!isObjectLike(value) || Array.isArray(value))
+        return [];
+    const { from, into } = value;
+    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
+}
+export function foldEdges(store) {
+    return [
+        ...store.auditEvents('project_merge').flatMap((e) => foldOf(e.metadata)),
+        ...store.auditEvents('project_repair')
+            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
+    ];
+}
+export function foldedInto(edges, names) {
+    const seen = new Set(names);
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const { from, into } of edges) {
+            if (!seen.has(into) || seen.has(from))
+                continue;
+            seen.add(from);
+            grew = true;
+        }
+    }
+    return [...seen].filter((n) => !names.includes(n));
+}
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export function namesFoldedInto(store, names) {
+    return foldedInto(foldEdges(store), names);
+}
+//# sourceMappingURL=project-folds.js.map

package/dist/agent-memories/sync.js

@@ -6,16 +6,18 @@ import path from 'node:path';
 import { errorMessage } from '../util/log.js';
 import { loadConfig } from '../core/config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb, outsideRequestStores, withWriteScope } from '../db/index.js';
-import { namesFoldedInto } from '../sharing/project-merge.js';
-import { isGlobalStoreRoot, projectNames, resolveGlobalRootDir, resolveProjectIdentity } from '../core/project-identity.js';
+import { namesFoldedInto } from './project-folds.js';
+import { projectTagReads } from '../store/project-tags.js';
+import { isGlobalStoreRoot, isInitialized, projectNames, resolveGlobalRootDir, resolveProjectIdentity, } from '../core/project-identity.js';
 import { duplicateKey, heldTextKeys } from '../util/same-text.js';
 import { removeEntryMirrors } from '../store/mirrors.js';
-import { initStore, isInitialized } from '../store/open.js';
+import { initStore } from '../store/open.js';
 import { writeEntryMirrors } from '../store/entry-writes.js';
 import { selectLiveEntriesBySourcePrefix, selectRowsOutsideSourcePrefixAt } from '../store/entry-reads.js';
 import { updateStats } from '../store/index-and-stats.js';
 import { resolveTenantId } from '../store/tenant.js';
-import { setAsideRow, syncContainer } from './apply.js';
+import { setAsideRow } from '../store/set-aside.js';
+import { syncContainer } from './apply.js';
 import { claudeCodeAdapter, claudeTranscriptListing, transcriptNotesProject } from './claude-code.js';
 import { codexAdapter } from './codex.js';
 import { copilotAdapter } from './copilot.js';
@@ -230,7 +232,7 @@ function syncStore(pass, listings, store, opts, report) {
 /** The legacy names plus every name a merge or repair folded into the project; the audit read runs once per pass. */
 function earlierNames(db, tenantId, id, legacyOrigins) {
     const names = [id, ...legacyOrigins];
-    return [...legacyOrigins, ...namesFoldedInto(db, tenantId, names)].filter((n) => n !== '' && n !== id);
+    return [...legacyOrigins, ...namesFoldedInto(projectTagReads(db, tenantId), names)].filter((n) => n !== '' && n !== id);
 }
 function containerWork(tool, container, options) {
     const { platform, legacy, origin, earlier } = options;
@@ -316,7 +318,7 @@ function handOver(synced, projectRoot, opts, report) {
         // A folder with no git and no marker wrote as '' before its store existed, and as its own name after.
         // Names folded into this project's in the global store were its rows too.
         const names = projectNames(resolveProjectIdentity(projectRoot));
-        const origins = [...new Set([...names, ...namesFoldedInto(db, tenantId, names), ''])];
+        const origins = [...new Set([...names, ...namesFoldedInto(projectTagReads(db, tenantId), names), ''])];
         for (const work of synced)
             handOverContainer(db, globalRoot, tenantId, work, { origins, platform: opts.machine.platform, report });
     }

package/dist/api/assemble.js

@@ -1,7 +1,8 @@
 // Session context assembly under a token budget.
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { estimateTokens } from '../util/token-text.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject, projectNames } from '../core/project-identity.js';
 const DEFAULT_FRESH_TAIL_COUNT = 10;
 const DEFAULT_ROW_CAP = 5000;

package/dist/api/audit.d.ts

@@ -1,4 +1,6 @@
-import type { AuditEvent, AuditIssue, AuditOp } from '../store/audit.js';
+import type { AuditEvent, AuditOp } from '../store/audit.js';
+import { type AuditIssue, type AuditResult } from '../core/memory-audit.js';
+import type { QualityRepairResult } from '../store/quality-repair.js';
 import type { KeysetPosition } from '../util/keyset.js';
 import type { Context } from './types.js';
 export interface AuditListOpts {
@@ -14,5 +16,31 @@ export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<Au
 /** The pass that removes audit errors; it leads the reason on each forget row. */
 export type AuditPass = 'audit --fix' | 'sleep-audit';
 /** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
-export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): string[];
+export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): Promise<string[]>;
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export declare function auditMemoryQuality(ctx: Context): Promise<AuditResult>;
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
+export declare function repairMemoryQuality(ctx: Context, apply: boolean): Promise<QualityRepairResult>;
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export declare function repairMemoryQualityOnce(ctx: Context): Promise<QualityRepairResult | null>;
+export interface PruneAuditOpts {
+    /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
+    olderThanDays: number;
+    /** When true, count matching rows but do NOT delete. Default false. */
+    dryRun?: boolean;
+}
+export interface PruneAuditResult {
+    /** ISO timestamp of the cutoff. Rows with ts strictly less than this were deleted. */
+    cutoff: string;
+    /** Number of audit_log rows deleted (or that would be deleted, if dryRun). */
+    count: number;
+    /** Echo back whether this was a dry run. */
+    dryRun: boolean;
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export declare function computeCutoff(days: number, now?: Date): string;
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
+ *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
+ *  Throws on non-positive days or an empty tenant. */
+export declare function pruneAuditLog(ctx: Context, opts: PruneAuditOpts): Promise<PruneAuditResult>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -1,17 +1,58 @@
-// Audit log queries, and the removal of the memories a quality audit marks as errors.
-import { deleteEntry } from '../store/delete-and-batch.js';
-import { requireGroup, storeFor } from '../store/index.js';
+// Audit log queries and retention, and the memory-quality audit with its repair passes.
+import { auditMemories } from '../core/memory-audit.js';
+import { DAY_MS } from '../util/time.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
 export async function auditList(ctx, opts) {
     return requireGroup(storeFor(ctx), 'auditLog').listAuditEvents({
         tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
     });
 }
+function maintenanceOf(ctx) {
+    return requireGroup(storeFor(ctx), 'auditMaintenance');
+}
 /** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
-export function removeAuditErrors(ctx, pass, issues) {
-    return issues
+export async function removeAuditErrors(ctx, pass, issues) {
+    const removals = issues
         .filter((issue) => issue.severity === 'error')
-        .filter((issue) => deleteEntry(ctx.hippoRoot, issue.memoryId, { actor: ctx.actor.subject, reason: `${pass}: ${issue.reason}`, automatic: true }))
-        .map((issue) => issue.memoryId);
+        .map((issue) => ({ id: issue.memoryId, reason: `${pass}: ${issue.reason}` }));
+    if (removals.length === 0)
+        return [];
+    return maintenanceOf(ctx).deleteAutomatically(removals, ctx.actor.subject);
+}
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export async function auditMemoryQuality(ctx) {
+    const maintenance = maintenanceOf(ctx);
+    return auditMemories(await maintenance.tenantEntries(ctx.tenantId), await maintenance.objectBackedIds());
+}
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
+export async function repairMemoryQuality(ctx, apply) {
+    return maintenanceOf(ctx).repairQuality(ctx.tenantId, apply);
+}
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export async function repairMemoryQualityOnce(ctx) {
+    return maintenanceOf(ctx).repairQualityOnce(ctx.tenantId);
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export function computeCutoff(days, now = new Date()) {
+    const cutoff = new Date(now.getTime() - days * DAY_MS);
+    return cutoff.toISOString();
+}
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
+ *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
+ *  Throws on non-positive days or an empty tenant. */
+export async function pruneAuditLog(ctx, opts) {
+    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
+        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
+    }
+    if (!ctx.tenantId) {
+        throw new Error('pruneAuditLog: tenantId is required');
+    }
+    const dryRun = opts.dryRun === true;
+    const cutoff = computeCutoff(opts.olderThanDays);
+    const prune = { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun };
+    const count = await maintenanceOf(ctx).pruneAuditRows(prune);
+    return { cutoff, count, dryRun };
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/auth.d.ts

@@ -1,6 +1,6 @@
-import { type ApiKeyListRow } from '../store/auth.js';
+import { DEFAULT_KEY_TTL_DAYS, type ApiKeyListItem, type ApiKeyListRow } from '../store/auth.js';
 import type { KeysetPosition } from '../util/keyset.js';
-import type { Context, StoreReply } from './types.js';
+import { type Context } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
     /** Defaults to `'member'`, which admin-gated routes such as `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
@@ -21,7 +21,9 @@ export interface AuthCreateResult {
 }
 /** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
  * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
-export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
+export declare function authCreate(ctx: Context, opts: AuthCreateOpts): Promise<AuthCreateResult>;
+export { DEFAULT_KEY_TTL_DAYS };
+export declare const MAX_TTL_DAYS = 3650;
 export interface AuthCreateSelfOpts {
     label?: string;
     /** Days until the new key expires. */
@@ -35,25 +37,26 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
 }
 /** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
  * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
+export declare function authCreateSelf(ctx: Context, opts: AuthCreateSelfOpts): Promise<AuthCreateSelfResult>;
 type KeyListOpts = {
     active: boolean;
     limit?: number;
     after?: KeysetPosition;
 };
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
+export declare function authListRows(ctx: Context, opts: KeyListOpts): Promise<ApiKeyListRow[]>;
+/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export declare function authListAllTenants(ctx: Context, active: boolean): ApiKeyListItem[];
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
 }
-export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>;
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
-export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
+export declare function authRevoke(ctx: Context, keyId: string): Promise<AuthRevokeResult>;
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
-export declare function authKeyTenant(ctx: Context, keyId: string): string | undefined;
+export declare function authKeyTenant(ctx: Context, keyId: string): Promise<string | undefined>;
 /** Shared result shape for authGrant/authUngrant, named per the file's oxlint anti-slop rule. */
 export interface AuthGrantResult {
     ok: true;
@@ -62,5 +65,4 @@ export interface AuthGrantResult {
 export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
-export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.js

@@ -1,10 +1,11 @@
 // API key management: create, list, revoke, and grant or ungrant restricted scopes.
 import { BadRequestError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { mintApiKey, } from '../store/auth.js';
+import { DEFAULT_KEY_TTL_DAYS, listApiKeys, mintApiKey, } from '../store/auth.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { changeScopeGrant } from '../store/sqlite/local.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
 import { DAY_MS } from '../util/time.js';
-import { andThen, notPorted, onStore } from './on-store.js';
+import { requireHostAdmin } from './types.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
 function keyIdOfSubject(subject) {
@@ -12,23 +13,21 @@ function keyIdOfSubject(subject) {
 }
 /** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
  * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
-export function authCreate(ctx, opts) {
-    // The key and its auth_create row commit together on either store, so a failed audit write leaves no key.
-    return onStore(ctx, (port) => {
-        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
-        const { plaintext, mint } = adminKeyMint(ctx, opts);
-        return andThen(keyWrites.createApiKey(mint), () => createResult(mint, plaintext));
-    });
+export async function authCreate(ctx, opts) {
+    // The key and its auth_create row commit together on every store, so a failed audit write leaves no key.
+    const keyWrites = requireGroup(storeFor(ctx), 'keyWrites');
+    const { plaintext, mint } = adminKeyMint(ctx, opts);
+    await keyWrites.createApiKey(mint);
+    return createResult(mint, plaintext);
 }
 /** A key row in the caller's tenant, made here so only its hash ever reaches a store. */
 function newKey(ctx, fields) {
     const { keyId, plaintext, keyHash } = mintApiKey();
     return { plaintext, key: { ...fields, keyId, keyHash, tenantId: ctx.tenantId, createdAt: new Date().toISOString() } };
 }
-/** Days a key lives when its mint names no expiry, so a key nobody remembers stops working by itself. */
-const DEFAULT_KEY_TTL_DAYS = 90;
+export { DEFAULT_KEY_TTL_DAYS };
 // The ceiling keeps toISOString in range.
-const MAX_TTL_DAYS = 3650;
+export const MAX_TTL_DAYS = 3650;
 /** A 400, not a RangeError, since the caller of the mint chose these. */
 function mintExpiry({ ttlDays, noExpiry }) {
     if (noExpiry && ttlDays !== undefined) {
@@ -70,12 +69,11 @@ function assertSelfMintOpts({ ttlDays, perSubject }) {
 }
 /** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
  * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export function authCreateSelf(ctx, opts) {
-    return onStore(ctx, (port) => {
-        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
-        const { plaintext, mint } = selfKeyMint(ctx, opts);
-        return andThen(keyWrites.createSelfApiKey(mint), () => selfResult(mint, plaintext));
-    });
+export async function authCreateSelf(ctx, opts) {
+    const keyWrites = requireGroup(storeFor(ctx), 'keyWrites');
+    const { plaintext, mint } = selfKeyMint(ctx, opts);
+    await keyWrites.createSelfApiKey(mint);
+    return selfResult(mint, plaintext);
 }
 function selfKeyMint(ctx, opts) {
     if (!ctx.actor.viaAuthResolver) {
@@ -97,16 +95,20 @@ function selfResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: 'member', expiresAt: key.expiresAt };
 }
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export function authListRows(ctx, opts) {
-    return onStore(ctx, (port) => listRows(ctx, port, opts));
+export async function authListRows(ctx, opts) {
+    return listRows(ctx, storeFor(ctx), opts);
 }
-function listRows(ctx, port, opts) {
-    const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
+/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export function authListAllTenants(ctx, active) {
+    requireHostAdmin(ctx, "Listing every tenant's keys");
+    return listApiKeys(ctx.hippoRoot, { active });
+}
+async function listRows(ctx, store, opts) {
+    const keyWrites = requireGroup(store, 'keyWrites');
     const keyId = memberKeyIdOf(ctx.actor);
-    return andThen(keyId === null ? undefined : port.findApiKey(keyId), (record) => {
-        const filter = memberListFilter(ctx.actor, record?.ownerSubject);
-        return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
-    });
+    const record = keyId === null ? undefined : await store.findApiKey(keyId);
+    const filter = memberListFilter(ctx.actor, record?.ownerSubject);
+    return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
 }
 /** The key id of a member API key caller, whose owner decides what it lists; null for any other caller. */
 function memberKeyIdOf(actor) {
@@ -139,16 +141,14 @@ function assertMayRevoke(ctx, keyId, row) {
 }
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
-export function authRevoke(ctx, keyId) {
-    return onStore(ctx, (port) => {
-        const keyAudit = port.keyAudit ?? notPorted(port, 'keyAudit');
-        assertMemberKeyRevokesSelf(ctx, keyId);
-        return andThen(port.findApiKey(keyId), (record) => {
-            assertMayRevoke(ctx, keyId, keyOwnerOf(record));
-            const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
-            return andThen(keyAudit.revokeApiKey(revoke), (revokedAt) => ({ ok: true, revokedAt }));
-        });
-    });
+export async function authRevoke(ctx, keyId) {
+    const store = storeFor(ctx);
+    const keyAudit = requireGroup(store, 'keyAudit');
+    assertMemberKeyRevokesSelf(ctx, keyId);
+    const record = await store.findApiKey(keyId);
+    assertMayRevoke(ctx, keyId, keyOwnerOf(record));
+    const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
+    return { ok: true, revokedAt: await keyAudit.revokeApiKey(revoke) };
 }
 function assertMemberKeyRevokesSelf(ctx, keyId) {
     if (ctx.actor.role !== 'admin' && !ctx.actor.viaAuthResolver && keyIdOfSubject(ctx.actor.subject) !== keyId) {
@@ -160,12 +160,11 @@ function keyOwnerOf(record) {
 }
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
-export function authKeyTenant(ctx, keyId) {
+export async function authKeyTenant(ctx, keyId) {
     if (!ctx.actor.hostAdmin) {
         throw new ForbiddenError('Only the host admin can look up a key across tenants');
     }
-    // Synchronous for the CLI, so it reads hippo.db whatever store ctx names.
-    return sqliteSyncStore(ctx.hippoRoot).findApiKey(keyId)?.tenantId;
+    return (await storeFor(ctx).findApiKey(keyId))?.tenantId;
 }
 /** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export function authGrant(ctx, keyId, scope) {