hippo-memory 1.71.0 → 2.0.0

package/dist/server/routes/memories.d.ts

@@ -1,10 +1,10 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateMemory({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleGetGraph({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleArchiveMemory({ req, res, opts }: RouteRequest, archiveMatch: Record<string, string>): Promise<void>;
-export declare function handleSupersedeMemory({ req, res, opts }: RouteRequest, supersedeMatch: Record<string, string>): Promise<void>;
-export declare function handlePromoteMemory({ req, res, opts }: RouteRequest, promoteMatch: Record<string, string>): Promise<void>;
-export declare function handleForgetMemory({ req, res, opts }: RouteRequest, idMatch: Record<string, string>): Promise<void>;
-export declare function handleApplyOutcome({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleSleep({ req, res, opts }: RouteRequest): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateMemory({ req, res, ctx }: AuthedRouteRequest): Promise<void>;
+export declare function handleGetGraph({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleArchiveMemory({ req, res, ctx }: AuthedRouteRequest, archiveMatch: Record<string, string>): Promise<void>;
+export declare function handleSupersedeMemory({ req, res, ctx }: AuthedRouteRequest, supersedeMatch: Record<string, string>): Promise<void>;
+export declare function handlePromoteMemory({ res, ctx }: AuthedRouteRequest, promoteMatch: Record<string, string>): Promise<void>;
+export declare function handleForgetMemory({ res, ctx }: AuthedRouteRequest, idMatch: Record<string, string>): Promise<void>;
+export declare function handleApplyOutcome({ req, res, ctx }: AuthedRouteRequest): Promise<void>;
+export declare function handleSleep({ req, res, ctx }: AuthedRouteRequest): Promise<void>;
 //# sourceMappingURL=memories.d.ts.map

package/dist/server/routes/memories.js

@@ -1,22 +1,17 @@
 // Memory write routes: create, graph, archive, supersede, promote, forget, outcome, sleep.
 import { graphRows } from '../../api/graph.js';
 import { archiveRaw, forget, outcome, outcomeForLastRecall, promote, remember, supersede } from '../../api/index.js';
+import { MEMORY_KINDS } from '../../core/memory.js';
 import { graphModelOf } from '../../graph/view.js';
 import { MAX_ENTITY_NAME_LEN } from '../../store/graph-rows.js';
+import { hasGroup } from '../../store/index.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { assertCrossTenantAdmin, buildContextWithAuth, isLoopback } from '../auth.js';
 import { sleepInChild } from '../sleep-offload.js';
 import { getCallerProject, getString, getStringArray, isSetMember, parseJsonBody, parseListLimit, validateIdSegment } from '../validation.js';
 import { isJsonString, isJsonBoolean } from '../../util/json.js';
-const VALID_KINDS = new Set([
-    'raw',
-    'distilled',
-    'superseded',
-    'archived',
-]);
+const VALID_KINDS = new Set(MEMORY_KINDS);
 // POST /v1/memories
-export async function handleCreateMemory({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
+export async function handleCreateMemory({ req, res, ctx }) {
     const body = await parseJsonBody(req, ctx);
     const content = getString(body, 'content');
     if (!content) {
@@ -44,7 +39,7 @@ export async function handleCreateMemory({ req, res, opts }) {
     return;
 }
 // GET /v1/graph?entity=NAME&limit=N — read-only entity/relation graph (tenant-scoped)
-export async function handleGetGraph({ req, res, opts, query }) {
+export async function handleGetGraph({ res, ctx, query }) {
     const entityRaw = query.get('entity');
     // Cap at the graph entity-name cap (512), not the id-shaped 256, so a valid
     // long decision/policy name remains focusable over HTTP.
@@ -52,15 +47,13 @@ export async function handleGetGraph({ req, res, opts, query }) {
         throw new HttpError(400, `entity exceeds the ${MAX_ENTITY_NAME_LEN}-character cap`);
     }
     const limit = parseListLimit(query.get('limit'));
-    const ctx = await buildContextWithAuth(req, opts);
     const rows = await graphRows(ctx, { entity: entityRaw ?? undefined, limit });
     sendJson(res, 200, graphModelOf(rows));
     return;
 }
 // /v1/memories/:id/* and DELETE /v1/memories/:id
-export async function handleArchiveMemory({ req, res, opts }, archiveMatch) {
+export async function handleArchiveMemory({ req, res, ctx }, archiveMatch) {
     validateIdSegment(archiveMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
     const reason = getString(body, 'reason');
     if (!reason) {
@@ -70,9 +63,8 @@ export async function handleArchiveMemory({ req, res, opts }, archiveMatch) {
     sendJson(res, 200, result);
     return;
 }
-export async function handleSupersedeMemory({ req, res, opts }, supersedeMatch) {
+export async function handleSupersedeMemory({ req, res, ctx }, supersedeMatch) {
     validateIdSegment(supersedeMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
     const content = getString(body, 'content');
     if (!content) {
@@ -82,24 +74,21 @@ export async function handleSupersedeMemory({ req, res, opts }, supersedeMatch)
     sendJson(res, 200, result);
     return;
 }
-export async function handlePromoteMemory({ req, res, opts }, promoteMatch) {
+export async function handlePromoteMemory({ res, ctx }, promoteMatch) {
     validateIdSegment(promoteMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const result = promote(ctx, promoteMatch.id);
     sendJson(res, 200, result);
     return;
 }
-export async function handleForgetMemory({ req, res, opts }, idMatch) {
+export async function handleForgetMemory({ res, ctx }, idMatch) {
     validateIdSegment(idMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     const result = await forget(ctx, idMatch.id);
     sendJson(res, 200, result);
     return;
 }
 // POST /v1/outcome: applies a positive/negative outcome to memory ids; without ids it falls back to the last-recall path (api.outcomeForLastRecall)
 // and returns {applied, ids}, so callers can tell "no recent recall" from "all ids skipped". Each applied id writes one audit_log row (op='outcome').
-export async function handleApplyOutcome({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
+export async function handleApplyOutcome({ req, res, ctx }) {
     const body = await parseJsonBody(req, ctx);
     const good = body['good'];
     if (!isJsonBoolean(good)) {
@@ -115,8 +104,8 @@ export async function handleApplyOutcome({ req, res, opts }) {
         if (!idsRaw.every(isNonEmptyId)) {
             throw new HttpError(400, 'ids must be an array of non-empty strings');
         }
-        // DoS cap on ids.length (each id costs ~3 DB ops): N=1000 keeps per-request work sub-second on SQLite.
-        // Checked BEFORE buildContextWithAuth so attack traffic does not pay the api-key lookup.
+        // DoS cap on ids.length (each id costs ~3 DB ops): N=1000 keeps per-request work sub-second on SQLite. Auth runs first, so only a caller with a key
+        // reaches it.
         if (idsRaw.length > 1000) {
             throw new HttpError(400, 'ids exceeds 1000-id cap');
         }
@@ -127,28 +116,19 @@ export async function handleApplyOutcome({ req, res, opts }) {
         sendJson(res, 200, { applied });
     }
     else {
-        // The last recall's ids live in hippo.db alone, so a client of another store must send the ids its recall returned.
-        if (ctx.store !== undefined && ctx.store.kind !== 'sqlite')
+        // A store without the group keeps no last recall, so its client must send the ids its recall returned.
+        if (ctx.store !== undefined && !hasGroup(ctx.store, 'lastRecall')) {
             throw new HttpError(501, 'this store keeps no last recall: send the ids your recall returned');
+        }
         const result = await outcomeForLastRecall(ctx, good);
         sendJson(res, 200, result);
     }
     return;
 }
 // POST /v1/sleep: host-wide consolidation (consolidate, dedup, audit, share, ambient); api.sleep spans the WHOLE hippoRoot, cross-tenant by design, so the
-// loopback-only guard is the trust boundary; non-loopback serving must also zero cross-tenant counters. Body {dry_run?, no_share?}; returns SleepResult JSON.
-export async function handleSleep({ req, res, opts }) {
-    // Defensive per-request loopback guard using isLoopback(), so future mapped/IPv6/NAT64 forms flow through without drift;
-    // serve()'s boot-time host check is the primary trust boundary.
-    if (!isLoopback(req.socket.remoteAddress)) {
-        throw new HttpError(403, '/v1/sleep is loopback-only (host-wide consolidation; see CHANGELOG v1.11.4)');
-    }
-    // Admin-role gate, forward-defensive: loopback fallback is admin by default and Bearer callers carry an explicit role from the api_keys row;
-    // when non-loopback serving lands, this gate is the real auth boundary on host-wide sleep.
-    const sleepCtx = await buildContextWithAuth(req, opts);
-    // Sleep consolidates every tenant under hippoRoot, so it is a cross-tenant action.
-    assertCrossTenantAdmin(sleepCtx, '/v1/sleep');
-    const body = await parseJsonBody(req, sleepCtx);
+// row's host-admin-local gate is the trust boundary. Body {dry_run?, no_share?}; returns SleepResult JSON.
+export async function handleSleep({ req, res, ctx }) {
+    const body = await parseJsonBody(req, ctx);
     const dryRunRaw = body['dry_run'];
     if (dryRunRaw !== undefined && !isJsonBoolean(dryRunRaw)) {
         throw new HttpError(400, 'dry_run must be a boolean');
@@ -157,8 +137,7 @@ export async function handleSleep({ req, res, opts }) {
     if (noShareRaw !== undefined && !isJsonBoolean(noShareRaw)) {
         throw new HttpError(400, 'no_share must be a boolean');
     }
-    // sleepCtx already built above for the admin-role gate; reuse.
-    const result = await sleepInChild(sleepCtx, {
+    const result = await sleepInChild(ctx, {
         dryRun: dryRunRaw === true,
         noShare: noShareRaw === true,
     });

package/dist/server/routes/object-routes.d.ts

@@ -1,7 +1,7 @@
 import { type JsonValue } from '../../util/json.js';
 import type { ObjectDescriptor, SavableDescriptor } from '../../objects/descriptor.js';
-import type { ObjectByKind, ObjectKind, SavableKind } from '../../store/object-types.js';
-import type { RouteRequest } from '../types.js';
+import type { ObjectByKind, ObjectKind, SavableKind } from '../../core/object-types.js';
+import type { AuthedRouteRequest } from '../types.js';
 export interface ObjectRouteConfig<K extends ObjectKind> {
     /** Names the object in the 404 text, e.g. "customer note". */
     readonly noun: string;
@@ -28,8 +28,8 @@ export interface RequiredStringRule {
 }
 export declare function requiredString(body: Record<string, JsonValue>, key: string, rule: RequiredStringRule): string;
 export declare function optionalString(body: Record<string, JsonValue>, key: string, max: number): string | undefined;
-export declare function listRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest): Promise<void>;
-export declare function getRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function closeRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function supersedeRoute<K extends SavableKind, W>(cfg: VersionedRouteConfig<K, W>, rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function listRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: AuthedRouteRequest): Promise<void>;
+export declare function getRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function closeRoute<K extends ObjectKind>(cfg: ObjectRouteConfig<K>, rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function supersedeRoute<K extends SavableKind, W>(cfg: VersionedRouteConfig<K, W>, rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=object-routes.d.ts.map

package/dist/server/routes/object-routes.js

@@ -3,7 +3,6 @@ import { HttpError, sendJson } from '../../util/http-util.js';
 import { isJsonString } from '../../util/json.js';
 import { objectsOf, saveFor } from '../../api/objects.js';
 import { closeObject, listObjects, objectById } from '../../objects/lifecycle.js';
-import { buildContextWithAuth } from '../auth.js';
 import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
 import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
 export function requiredString(body, key, rule) {
@@ -32,14 +31,12 @@ async function found(cfg, objects, tenantId, id) {
         throw new HttpError(404, `${cfg.noun} ${id} not found`);
     return row;
 }
-// Limit and cursor are checked before auth and status after it, so a keyless caller gets 400 for the first two and 401 for a bad status.
 export async function listRoute(cfg, rr) {
-    const { req, res, opts, query } = rr;
+    const { res, query, ctx } = rr;
     const status = query.get('status') ?? 'all';
     const filter = cfg.filterParam === undefined ? null : query.get(cfg.filterParam);
     const limit = parseListLimit(query.get('limit'));
     const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     const listOpts = { limit: limit + 1, after, filter: filter?.trim() || undefined };
     if (status !== 'all') {
         const states = cfg.object.states;
@@ -53,17 +50,17 @@ export async function listRoute(cfg, rr) {
 }
 export async function getRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     sendJson(rr.res, 200, { [cfg.field]: await found(cfg, objectsOf(ctx), ctx.tenantId, id) });
 }
 export async function closeRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     sendJson(rr.res, 200, { [cfg.field]: await closeObject(objectsOf(ctx), cfg.object, ctx.tenantId, id, ctx.actor.subject) });
 }
 export async function supersedeRoute(cfg, rr, match) {
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const successor = cfg.revise(await parseJsonBody(rr.req, ctx));
     const existing = await found(cfg, objectsOf(ctx), ctx.tenantId, id);
     const saved = await saveFor(ctx, cfg.object, successor(existing, id));

package/dist/server/routes/policies.d.ts

@@ -1,8 +1,8 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreatePolicy(rr: RouteRequest): Promise<void>;
-export declare function handleListPolicies(rr: RouteRequest): Promise<void>;
-export declare function handlePoliciesAsOf(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedePolicy(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleClosePolicy(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetPolicy(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreatePolicy(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListPolicies(rr: AuthedRouteRequest): Promise<void>;
+export declare function handlePoliciesAsOf(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedePolicy(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleClosePolicy(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetPolicy(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=policies.d.ts.map

package/dist/server/routes/policies.js

@@ -1,7 +1,6 @@
 // /v1/policies routes.
 import { policiesAsOf, POLICY } from '../../objects/policies.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
 import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { objectsOf, saveFor } from '../../api/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
@@ -22,7 +21,7 @@ const policyRoutes = {
 };
 // The as-of route is registered BEFORE /:id so the literal 'asof' is matched first; date errors surface as 400.
 export async function handleCreatePolicy(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
     const policy = await saveFor(ctx, POLICY, {
         policyName: requiredString(body, 'policyName', { max: MAX_SHORT_FIELD_LEN }),
@@ -38,13 +37,12 @@ export function handleListPolicies(rr) {
 // The as-of query: must precede the /:id GET (literal 'asof' is non-numeric so
 // the /(\d+)/ route would not match it, but order it first for clarity).
 export async function handlePoliciesAsOf(rr) {
-    const { req, res, opts, query } = rr;
+    const { res, query, ctx } = rr;
     const date = query.get('date');
     if (date === null || date.length === 0) {
         throw new HttpError(400, 'date is required (ISO-8601 valid-time)');
     }
     const name = query.get('name') ?? undefined;
-    const ctx = await buildContextWithAuth(req, opts);
     const policies = await policiesAsOf(objectsOf(ctx), ctx.tenantId, date, { name });
     sendJson(res, 200, { policies });
 }

package/dist/server/routes/predictions.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreatePrediction({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListPredictions({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handlePredictionStats({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleGetPrediction({ req, res, opts }: RouteRequest, predictionByIdMatch: RegExpMatchArray): Promise<void>;
-export declare function handleClosePrediction({ req, res, opts }: RouteRequest, predictionCloseMatch: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreatePrediction({ req, res, ctx, opts }: AuthedRouteRequest): Promise<void>;
+export declare function handleListPredictions({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handlePredictionStats({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleGetPrediction({ res, ctx }: AuthedRouteRequest, predictionByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleClosePrediction({ req, res, ctx }: AuthedRouteRequest, predictionCloseMatch: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=predictions.d.ts.map

package/dist/server/routes/predictions.js

@@ -1,16 +1,16 @@
 // /v1/predictions routes.
 import { closePrediction, listPredictions, predictionBaserate, predictionById, savePrediction } from '../../api/predictions.js';
 import { loadConfig } from '../../core/config.js';
-import { predictionMirror, VALID_CLOSURE_STATES } from '../../store/predictions.js';
-import { HttpError, MAX_ID_LEN, sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
+import { predictionMirror } from '../../store/predictions.js';
+import { VALID_CLOSURE_STATES } from '../../core/prediction.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
+import { MAX_ID_LEN } from '../../util/limits.js';
 import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
 import { isSetMember, MAX_SHORT_FIELD_LEN, parseJsonBody, parseListLimit } from '../validation.js';
 import { isJsonString, isJsonNumber } from '../../util/json.js';
 // Routes: /v1/predictions (create, list, show, close), Bearer-authed and tenant-scoped; closure_state is validated against VALID_CLOSURE_STATES.
 // DoS caps: claim MAX_SHORT_FIELD_LEN chars, closureNote 2048.
-export async function handleCreatePrediction({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
+export async function handleCreatePrediction({ req, res, ctx, opts }) {
     const body = await parseJsonBody(req, ctx);
     const claim = body['claim'];
     if (!isJsonString(claim) || claim.length === 0) {
@@ -66,19 +66,18 @@ function listFilter(classTag, status) {
     }
     return { classTag, closureState: status };
 }
-export async function handleListPredictions({ req, res, opts, query }) {
+export async function handleListPredictions({ res, ctx, query }) {
     const classTag = query.get('class') || undefined;
     const status = query.get('status') ?? 'all';
     const limit = parseListLimit(query.get('limit'));
     const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     const predictions = await listPredictions(ctx, { ...listFilter(classTag, status), limit: limit + 1, after });
     const page = pageOf(predictions, limit, byCreatedAt);
     sendJson(res, 200, { predictions: page.items, next_cursor: page.nextCursor });
 }
 // Reference-class / planning-fallacy detector; registered BEFORE /v1/predictions/:id so dispatch order cannot matter ('stats' is not a number, but routing
 // it first is safer).
-export async function handlePredictionStats({ req, res, opts, query }) {
+export async function handlePredictionStats({ res, ctx, query }) {
     const classTag = query.get('class');
     if (!classTag || classTag.length === 0) {
         throw new HttpError(400, 'class param is required');
@@ -86,22 +85,19 @@ export async function handlePredictionStats({ req, res, opts, query }) {
     if (classTag.length > MAX_ID_LEN) {
         throw new HttpError(400, `class exceeds ${MAX_ID_LEN}-character cap`);
     }
-    const ctx = await buildContextWithAuth(req, opts);
     const baserate = await predictionBaserate(ctx, classTag);
     sendJson(res, 200, { baserate });
 }
-export async function handleGetPrediction({ req, res, opts }, predictionByIdMatch) {
+export async function handleGetPrediction({ res, ctx }, predictionByIdMatch) {
     const id = parseInt(predictionByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
     const prediction = await predictionById(ctx, id);
     if (!prediction) {
         throw new HttpError(404, `prediction ${id} not found`);
     }
     sendJson(res, 200, { prediction });
 }
-export async function handleClosePrediction({ req, res, opts }, predictionCloseMatch) {
+export async function handleClosePrediction({ req, res, ctx }, predictionCloseMatch) {
     const id = parseInt(predictionCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
     const state = body['state'];
     if (!isJsonString(state) || !isSetMember(VALID_CLOSURE_STATES, state) || state === 'open') {

package/dist/server/routes/processes.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateProcess(rr: RouteRequest): Promise<void>;
-export declare function handleListProcesses(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeProcess(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseProcess(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetProcess(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateProcess(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListProcesses(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeProcess(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseProcess(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetProcess(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=processes.d.ts.map

package/dist/server/routes/processes.js

@@ -1,7 +1,6 @@
 // /v1/processes routes.
 import { MAX_PROCESS_STEP_LEN, MAX_PROCESS_STEPS, PROCESS } from '../../objects/processes.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
 import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { isJsonString } from '../../util/json.js';
 import { saveFor } from '../../api/objects.js';
@@ -48,7 +47,7 @@ const processRoutes = {
 // Routes: /v1/processes (create, list, show, supersede, close), mirroring /v1/decisions; supersede creates a new version that reuses the predecessor's name.
 // DoS caps: processName/description/changeSummary MAX_SHORT_FIELD_LEN, steps MAX_PROCESS_STEPS x MAX_PROCESS_STEP_LEN (validateProcessStepsBody).
 export async function handleCreateProcess(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
     const process = await saveFor(ctx, PROCESS, {
         processName: requiredString(body, 'processName', { max: MAX_SHORT_FIELD_LEN }),

package/dist/server/routes/project-briefs.d.ts

@@ -1,8 +1,8 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateProjectBrief(rr: RouteRequest): Promise<void>;
-export declare function handleListProjectBriefs(rr: RouteRequest): Promise<void>;
-export declare function handleRefreshProjectBrief(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeProjectBrief(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseProjectBrief(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetProjectBrief(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateProjectBrief(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListProjectBriefs(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleRefreshProjectBrief(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeProjectBrief(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseProjectBrief(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetProjectBrief(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=project-briefs.d.ts.map

package/dist/server/routes/project-briefs.js

@@ -1,7 +1,6 @@
 // /v1/project-briefs routes.
 import { briefFromReceipts, MAX_CHANGE_SUMMARY_LEN, MAX_REPO_LEN, PROJECT_BRIEF, refreshedBrief, } from '../../objects/project-briefs.js';
 import { sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
 import { parseJsonBody } from '../validation.js';
 import { objectsOf, saveFor } from '../../api/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
@@ -20,7 +19,7 @@ const briefRoutes = {
 // Routes: /v1/project-briefs (create, list, refresh, show, supersede, close), mirroring /v1/skills; /refresh is ordered before /:id.
 // The store validates and throws; the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
 export async function handleCreateProjectBrief(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
     const brief = await saveFor(ctx, PROJECT_BRIEF, {
         repo: requiredString(body, 'repo', { max: MAX_REPO_LEN }),
@@ -34,8 +33,7 @@ export function handleListProjectBriefs(rr) {
 // The refresh op: must precede the /:id routes (literal 'refresh' is non-numeric
 // so the /(\d+)/ routes would not match it, but order it first).
 export async function handleRefreshProjectBrief(rr) {
-    const { req, res, opts } = rr;
-    const ctx = await buildContextWithAuth(req, opts);
+    const { req, res, opts, ctx } = rr;
     const body = await parseJsonBody(req, ctx);
     const repo = requiredString(body, 'repo', { max: MAX_REPO_LEN });
     if (body['dryRun'] === true) {

package/dist/server/routes/recall.d.ts

@@ -1,8 +1,8 @@
-import type { RouteRequest } from '../types.js';
+import type { AuthedRouteRequest } from '../types.js';
 /** Test-only: reset the HTTP recall rings. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryHttp(): void;
-export declare function handleRecallMemories({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleAssembleSession({ req, res, opts, query }: RouteRequest, assembleMatch: Record<string, string>): Promise<void>;
-export declare function handleDrillRecall({ req, res, opts, query }: RouteRequest, drillMatch: Record<string, string>): Promise<void>;
-export declare function handleGetContext({ req, res, opts, query }: RouteRequest): Promise<void>;
+export declare function handleRecallMemories({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleAssembleSession({ res, ctx, query }: AuthedRouteRequest, assembleMatch: Record<string, string>): Promise<void>;
+export declare function handleDrillRecall({ res, ctx, query }: AuthedRouteRequest, drillMatch: Record<string, string>): Promise<void>;
+export declare function handleGetContext({ res, ctx, opts, query }: AuthedRouteRequest): Promise<void>;
 //# sourceMappingURL=recall.d.ts.map

package/dist/server/routes/recall.js

@@ -8,16 +8,15 @@ import { RECALL_RECORDING } from '../../api/recall-finish.js';
 import { httpParams, parseContextRequest, parseRecallRequest } from '../../api/recall-request.js';
 import { resetSessionRings } from '../../api/recall-record.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
-import { MAX_LIST_LIMIT, parseListLimit, validateIdSegment } from '../validation.js';
+import { MAX_LIST_LIMIT } from '../../util/limits.js';
+import { parseListLimit, validateIdSegment } from '../validation.js';
 /** Test-only: reset the HTTP recall rings. Call from beforeEach. */
 export function __resetSessionRecallHistoryHttp() {
     resetSessionRings('http');
 }
 // GET /v1/memories?q=...&limit=...&mode=...&scope=...&include_continuity=1
-export async function handleRecallMemories({ req, res, opts, query }) {
+export async function handleRecallMemories({ res, ctx, query }) {
     const { opts: recallOpts, limit, mode, explain } = parseRecallRequest(httpParams(query));
-    const ctx = await buildContextWithAuth(req, opts);
     const result = await retrieve(ctx, { ...recallOpts, limit, mode, explain, recordAs: RECALL_RECORDING.http });
     // Continuity payloads should never be cached. The caller is asking for
     // session-state-aware data; intermediaries must not reuse it across users.
@@ -29,7 +28,7 @@ export async function handleRecallMemories({ req, res, opts, query }) {
 }
 // GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1: ordered AssembledContextItem[] (fresh-tail raws, summary substitutions, bio-aware
 // budget fit). Tenant scope from the Bearer; default-deny on private rows.
-export async function handleAssembleSession({ req, res, opts, query }, assembleMatch) {
+export async function handleAssembleSession({ res, ctx, query }, assembleMatch) {
     validateIdSegment(assembleMatch.id, 'session id');
     const budgetRaw = query.get('budget');
     const budget = budgetRaw === null ? undefined : Number(budgetRaw);
@@ -49,7 +48,6 @@ export async function handleAssembleSession({ req, res, opts, query }, assembleM
         : (sumOlderRaw === '1' || sumOlderRaw === 'true');
     const scopeQ = query.get('scope');
     const scope = scopeQ !== null && scopeQ.length > 0 ? scopeQ : undefined;
-    const ctx = await buildContextWithAuth(req, opts);
     const assembleExtra = {};
     if (budget !== undefined)
         assembleExtra.budget = budget;
@@ -66,7 +64,7 @@ export async function handleAssembleSession({ req, res, opts, query }, assembleM
 }
 // GET /v1/recall/drill/:id?limit=N&budget=N: companion to /v1/memories; the caller drills into a level-2 summary (RecallResultItem.isSummary) to recover the
 // originals. Tenant-scoped via Bearer; default-deny on private scopes for the summary and its children.
-export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
+export async function handleDrillRecall({ res, ctx, query }, drillMatch) {
     validateIdSegment(drillMatch.id, 'summary id');
     const limitRaw = query.get('limit');
     const limit = limitRaw === null ? undefined : Number(limitRaw);
@@ -92,7 +90,6 @@ export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
         }
         depth = parsed;
     }
-    const ctx = await buildContextWithAuth(req, opts);
     const drillExtra = {};
     if (limit !== undefined)
         drillExtra.limit = limit;
@@ -125,9 +122,8 @@ function contextReader(hippoRoot, query) {
 }
 // GET /v1/context: a budget-bounded ContextResult JSON, rendered by clients, not the server; tenant-scoped via the Bearer.
 // Pinned-only and '*' fallback skip the recall audit emit (as cmdContext does); a real-query hybrid search emits one 'recall' row.
-export async function handleGetContext({ req, res, opts, query }) {
+export async function handleGetContext({ res, ctx, opts, query }) {
     const parsed = parseContextRequest(httpParams(query));
-    const ctx = await buildContextWithAuth(req, opts);
     const result = await getContext(ctx, {
         ...parsed,
         currentProject: contextReader(opts.hippoRoot, query),

package/dist/server/routes/skills.d.ts

@@ -1,8 +1,8 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateSkill(rr: RouteRequest): Promise<void>;
-export declare function handleListSkills(rr: RouteRequest): Promise<void>;
-export declare function handleExportSkills(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateSkill(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListSkills(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleExportSkills(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeSkill(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseSkill(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetSkill(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=skills.d.ts.map

package/dist/server/routes/skills.js

@@ -1,7 +1,6 @@
 // /v1/skills routes.
 import { MAX_SKILL_NAME_LEN, SKILL, skillsMarkdown } from '../../objects/skills.js';
 import { sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
 import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { objectsOf, saveFor } from '../../api/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
@@ -21,7 +20,7 @@ const skillRoutes = {
 // Routes: /v1/skills (create, list, export, show, supersede, close), mirroring /v1/processes; "executable" means exportable instruction (no code exec).
 // GET /v1/skills/export renders ACTIVE skills as a markdown block for AGENTS.md or CLAUDE.md and is ordered before /:id.
 export async function handleCreateSkill(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
     const skill = await saveFor(ctx, SKILL, {
         skillName: requiredString(body, 'skillName', { max: MAX_SKILL_NAME_LEN }),
@@ -36,8 +35,7 @@ export function handleListSkills(rr) {
 // The export renderer: must precede the /:id GET (literal 'export' is
 // non-numeric so the /(\d+)/ route would not match it, but order it first).
 export async function handleExportSkills(rr) {
-    const { req, res, opts } = rr;
-    const ctx = await buildContextWithAuth(req, opts);
+    const { res, ctx } = rr;
     const markdown = await skillsMarkdown(objectsOf(ctx), ctx.tenantId);
     sendJson(res, 200, { markdown });
 }

package/dist/server/server-detect.d.ts

@@ -6,8 +6,14 @@ export interface ServerInfo {
     url: string;
     started_at: string;
 }
+/** The pidfile names a live process on loopback that did not answer /health in time: most likely a busy server, so a caller must neither
+ * bypass it with a second writer nor start another server beside it. */
+export declare class ServerUnresponsiveError extends Error {
+    constructor(info: ServerInfo, probeMs: number, options?: ErrorOptions);
+}
 /** Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking of missing/stale/malformed pidfiles).
- * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live. */
+ * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live.
+ * Throws ServerUnresponsiveError when that probe times out. */
 export declare function detectServer(hippoRoot: string): Promise<ServerInfo | null>;
 /** Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes from the caller (`serve()`) so the
  * pidfile and GET /health carry the same timestamp, which detectServer's liveness probe compares. */