hippo-memory 1.72.0 → 2.1.0

package/dist/api/assemble.js

@@ -1,12 +1,12 @@
 // Session context assembly under a token budget.
-import { requireGroup, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
 import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject, projectNames } from '../core/project-identity.js';
 const DEFAULT_FRESH_TAIL_COUNT = 10;
 const DEFAULT_ROW_CAP = 5000;
 export const DEFAULT_ASSEMBLE_BUDGET = 4000;
-/** Chronological context window for a session; over budget, evicts the lowest-strength non-fresh-tail item first (fresh tail is never evicted).
+/** Chronological context window for a session; over budget, evicts the lowest-strength non-fresh-tail item first (fresh
+ *  tail is never evicted).
  * Returns `items: []` for an empty sessionId, no raws, or when every row fails the scope/tenant filter. */
 export async function assemble(ctx, sessionId, opts = {}) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
@@ -43,7 +43,7 @@ export async function assemble(ctx, sessionId, opts = {}) {
 async function loadScopedRaws(ctx, sessionId, opts, own) {
     const rowCap = opts.rowCap ?? DEFAULT_ROW_CAP;
     const origins = opts.project ? projectNames(opts.project) : undefined;
-    const dag = requireGroup(storeFor(ctx), 'dagReads');
+    const dag = ctx.store.dagReads;
     const rows = await dag.sessionRawEntries({ tenantId: ctx.tenantId, sessionId, cap: rowCap, origins });
     const truncated = rows.length === rowCap;
     // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
@@ -52,7 +52,13 @@ async function loadScopedRaws(ctx, sessionId, opts, own) {
     if (truncated) {
         // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
         // caller cannot infer private rows by comparing totalRaw to items.length.
-        totalRaw = await dag.sessionRawCount({ tenantId: ctx.tenantId, sessionId, scope: opts.scope, ownScope: own, origins });
+        totalRaw = await dag.sessionRawCount({
+            tenantId: ctx.tenantId,
+            sessionId,
+            scope: opts.scope,
+            ownScope: own,
+            origins,
+        });
     }
     else {
         totalRaw = scoped.length;
@@ -89,7 +95,7 @@ async function substituteSummaries(ctx, olderRows, scope, own, project) {
     }
     const eligibleParentIds = Array.from(olderByParent.keys()).filter((pid) => (olderByParent.get(pid)?.length ?? 0) >= 2);
     const parents = eligibleParentIds.length > 0
-        ? (await storeFor(ctx).entriesByIds(eligibleParentIds, ctx.tenantId))
+        ? (await ctx.store.entriesByIds(eligibleParentIds, ctx.tenantId))
             .filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by)
             .filter((p) => passesScopeFilterForRecall(p.scope ?? null, scope, own))
             .filter((p) => !project || classifyOriginProject(p.origin_project, project) !== 'cross-project')

package/dist/api/{audit.d.ts → auth/audit.d.ts}

@@ -1,8 +1,8 @@
-import { type AuditEvent, type AuditOp } from '../store/audit.js';
-import { type AuditIssue, type AuditResult } from '../core/memory-audit.js';
-import { type QualityRepairResult } from '../store/quality-repair.js';
-import type { KeysetPosition } from '../util/keyset.js';
-import type { Context } from './types.js';
+import type { AuditEvent, AuditOp } from '../../store/audit.js';
+import { type AuditIssue, type AuditResult } from '../../core/memory-audit.js';
+import type { QualityRepairResult } from '../../store/quality-repair.js';
+import type { KeysetPosition } from '../../util/keyset.js';
+import type { ContextWith } from '../types.js';
 export interface AuditListOpts {
     op?: AuditOp;
     /** ISO timestamp lower bound. */
@@ -12,17 +12,19 @@ export interface AuditListOpts {
     after?: KeysetPosition;
 }
 /** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
-export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<AuditEvent[]>;
+export declare function auditList(ctx: ContextWith<'auditLog'>, opts: AuditListOpts): Promise<AuditEvent[]>;
 /** The pass that removes audit errors; it leads the reason on each forget row. */
 export type AuditPass = 'audit --fix' | 'sleep-audit';
-/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
-export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): string[];
+/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned
+ * or raw row stays. */
+export declare function removeAuditErrors(ctx: ContextWith<'auditMaintenance'>, pass: AuditPass, issues: readonly AuditIssue[]): Promise<string[]>;
 /** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
-export declare function auditMemoryQuality(ctx: Context): AuditResult;
-/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
-export declare function repairMemoryQuality(ctx: Context, apply: boolean): QualityRepairResult;
+export declare function auditMemoryQuality(ctx: ContextWith<'auditMaintenance'>): Promise<AuditResult>;
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage
+ * behind a backup. */
+export declare function repairMemoryQuality(ctx: ContextWith<'auditMaintenance'>, apply: boolean): Promise<QualityRepairResult>;
 /** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
-export declare function repairMemoryQualityOnce(ctx: Context): QualityRepairResult | null;
+export declare function repairMemoryQualityOnce(ctx: ContextWith<'auditMaintenance'>): Promise<QualityRepairResult | null>;
 export interface PruneAuditOpts {
     /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
     olderThanDays: number;
@@ -39,8 +41,8 @@ export interface PruneAuditResult {
 }
 /** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
 export declare function computeCutoff(days: number, now?: Date): string;
-/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
- *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
- *  Throws on non-positive days or an empty tenant. */
-export declare function pruneAuditLog(ctx: Context, opts: PruneAuditOpts): PruneAuditResult;
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as
+ * `ctx.actor`; opt-in, since retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call
+ * never prunes its own record. Throws on non-positive days or an empty tenant. */
+export declare function pruneAuditLog(ctx: ContextWith<'auditMaintenance'>, opts: PruneAuditOpts): Promise<PruneAuditResult>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/auth/audit.js

@@ -0,0 +1,58 @@
+// Audit log queries and retention, and the memory-quality audit with its repair passes.
+import { auditMemories } from '../../core/memory-audit.js';
+import { DAY_MS } from '../../util/time.js';
+/** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
+export async function auditList(ctx, opts) {
+    return ctx.store.auditLog.listAuditEvents({
+        tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
+    });
+}
+function maintenanceOf(ctx) {
+    return ctx.store.auditMaintenance;
+}
+/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned
+ * or raw row stays. */
+export async function removeAuditErrors(ctx, pass, issues) {
+    const removals = issues
+        .filter((issue) => issue.severity === 'error')
+        .map((issue) => ({ id: issue.memoryId, reason: `${pass}: ${issue.reason}` }));
+    if (removals.length === 0)
+        return [];
+    return maintenanceOf(ctx).deleteAutomatically(removals, ctx.actor.subject);
+}
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export async function auditMemoryQuality(ctx) {
+    const maintenance = maintenanceOf(ctx);
+    return auditMemories(await maintenance.tenantEntries(ctx.tenantId), await maintenance.objectBackedIds());
+}
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage
+ * behind a backup. */
+export async function repairMemoryQuality(ctx, apply) {
+    return maintenanceOf(ctx).repairQuality(ctx.tenantId, apply);
+}
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export async function repairMemoryQualityOnce(ctx) {
+    return maintenanceOf(ctx).repairQualityOnce(ctx.tenantId);
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export function computeCutoff(days, now = new Date()) {
+    const cutoff = new Date(now.getTime() - days * DAY_MS);
+    return cutoff.toISOString();
+}
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as
+ * `ctx.actor`; opt-in, since retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call
+ * never prunes its own record. Throws on non-positive days or an empty tenant. */
+export async function pruneAuditLog(ctx, opts) {
+    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
+        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
+    }
+    if (!ctx.tenantId) {
+        throw new Error('pruneAuditLog: tenantId is required');
+    }
+    const dryRun = opts.dryRun === true;
+    const cutoff = computeCutoff(opts.olderThanDays);
+    const prune = { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun };
+    const count = await maintenanceOf(ctx).pruneAuditRows(prune);
+    return { cutoff, count, dryRun };
+}
+//# sourceMappingURL=audit.js.map

package/dist/api/{auth.d.ts → auth/auth.d.ts}

@@ -1,9 +1,10 @@
-import { DEFAULT_KEY_TTL_DAYS, type ApiKeyListItem, type ApiKeyListRow } from '../store/auth.js';
-import type { KeysetPosition } from '../util/keyset.js';
-import { type Context, type StoreReply } from './types.js';
+import { DEFAULT_KEY_TTL_DAYS, type ApiKeyListItem, type ApiKeyListRow } from '../../store/auth.js';
+import type { KeysetPosition } from '../../util/keyset.js';
+import { type Context, type ContextWith, type StoreContext } from '../types.js';
 export interface AuthCreateOpts {
     label?: string;
-    /** Defaults to `'member'`, which admin-gated routes such as `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
+    /** Defaults to `'member'`, which admin-gated routes such as
+     * `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
     role?: 'admin' | 'member';
     /** Days until the key expires: above 0 and at most 3650. Defaults to 90. */
     ttlDays?: number;
@@ -19,9 +20,10 @@ export interface AuthCreateResult {
     /** ISO time the key stops working; null for a key that never expires. */
     expiresAt: string | null;
 }
-/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
- * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
-export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
+/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or
+ * tenant A could mint a key for tenant B. Admin only (ForbiddenError otherwise), and a
+ * key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
+export declare function authCreate(ctx: ContextWith<'keyWrites'>, opts: AuthCreateOpts): Promise<AuthCreateResult>;
 export { DEFAULT_KEY_TTL_DAYS };
 export declare const MAX_TTL_DAYS = 3650;
 export interface AuthCreateSelfOpts {
@@ -37,33 +39,34 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
 }
 /** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
  * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
+export declare function authCreateSelf(ctx: ContextWith<'keyWrites'>, opts: AuthCreateSelfOpts): Promise<AuthCreateSelfResult>;
 type KeyListOpts = {
     active: boolean;
     limit?: number;
     after?: KeysetPosition;
 };
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
-/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+export declare function authListRows(ctx: ContextWith<'keyWrites'>, opts: KeyListOpts): Promise<ApiKeyListRow[]>;
+/** Every tenant's keys in the store, live ones only unless
+ * `active` is false; the host's own view, so the host admin only. */
 export declare function authListAllTenants(ctx: Context, active: boolean): ApiKeyListItem[];
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
 }
-export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>;
-/** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
+/** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it
+ *  minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
-export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
+export declare function authRevoke(ctx: ContextWith<'keyAudit'>, keyId: string): Promise<AuthRevokeResult>;
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
-export declare function authKeyTenant(ctx: Context, keyId: string): Promise<string | undefined>;
+export declare function authKeyTenant(ctx: StoreContext, keyId: string): Promise<string | undefined>;
 /** Shared result shape for authGrant/authUngrant, named per the file's oxlint anti-slop rule. */
 export interface AuthGrantResult {
     ok: true;
 }
 /** Grant `keyId` read access to one restricted `scope`. Admin only. */
-export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
+export declare function authGrant(ctx: ContextWith<'keyGrants'>, keyId: string, scope: string): Promise<AuthGrantResult>;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
-export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
+export declare function authUngrant(ctx: ContextWith<'keyGrants'>, keyId: string, scope: string): Promise<AuthGrantResult>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/api/{auth.js → auth/auth.js}

@@ -1,25 +1,22 @@
 // API key management: create, list, revoke, and grant or ungrant restricted scopes.
-import { BadRequestError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { DEFAULT_KEY_TTL_DAYS, listApiKeys, mintApiKey, } from '../store/auth.js';
-import { storeFor } from '../store/index.js';
-import { changeScopeGrant } from '../store/sqlite/local.js';
-import { DAY_MS } from '../util/time.js';
-import { andThen, notPorted, onStore } from './on-store.js';
-import { requireHostAdmin } from './types.js';
+import { BadRequestError, ForbiddenError, NotFoundError } from '../../core/api-errors.js';
+import { DEFAULT_KEY_TTL_DAYS, listApiKeys, mintApiKey, } from '../../store/auth.js';
+import { DAY_MS } from '../../util/time.js';
+import { requireHostAdmin } from '../types.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
 function keyIdOfSubject(subject) {
     return subject.startsWith(API_KEY_SUBJECT) ? subject.slice(API_KEY_SUBJECT.length) : null;
 }
-/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
- * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
-export function authCreate(ctx, opts) {
-    // The key and its auth_create row commit together on either store, so a failed audit write leaves no key.
-    return onStore(ctx, (port) => {
-        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
-        const { plaintext, mint } = adminKeyMint(ctx, opts);
-        return andThen(keyWrites.createApiKey(mint), () => createResult(mint, plaintext));
-    });
+/** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or
+ * tenant A could mint a key for tenant B. Admin only (ForbiddenError otherwise), and a
+ * key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
+export async function authCreate(ctx, opts) {
+    // The key and its auth_create row commit together on every store, so a failed audit write leaves no key.
+    const keyWrites = ctx.store.keyWrites;
+    const { plaintext, mint } = adminKeyMint(ctx, opts);
+    await keyWrites.createApiKey(mint);
+    return createResult(mint, plaintext);
 }
 /** A key row in the caller's tenant, made here so only its hash ever reaches a store. */
 function newKey(ctx, fields) {
@@ -59,7 +56,8 @@ function adminKeyMint(ctx, opts) {
 function createResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: key.role, expiresAt: key.expiresAt };
 }
-/** A RangeError, not a 4xx, since the operator's config sets these; the ttl ceiling keeps toISOString in range and a departed user's key short-lived. */
+/** A RangeError, not a 4xx, since the operator's config sets these; the ttl ceiling keeps toISOString in range and a
+ * departed user's key short-lived. */
 function assertSelfMintOpts({ ttlDays, perSubject }) {
     if (!Number.isFinite(ttlDays) || ttlDays <= 0 || ttlDays > MAX_TTL_DAYS) {
         throw new RangeError(`authCreateSelf: ttlDays must be above 0 and at most ${MAX_TTL_DAYS}, got ${String(ttlDays)}`);
@@ -70,12 +68,11 @@ function assertSelfMintOpts({ ttlDays, perSubject }) {
 }
 /** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
  * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export function authCreateSelf(ctx, opts) {
-    return onStore(ctx, (port) => {
-        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
-        const { plaintext, mint } = selfKeyMint(ctx, opts);
-        return andThen(keyWrites.createSelfApiKey(mint), () => selfResult(mint, plaintext));
-    });
+export async function authCreateSelf(ctx, opts) {
+    const keyWrites = ctx.store.keyWrites;
+    const { plaintext, mint } = selfKeyMint(ctx, opts);
+    await keyWrites.createSelfApiKey(mint);
+    return selfResult(mint, plaintext);
 }
 function selfKeyMint(ctx, opts) {
     if (!ctx.actor.viaAuthResolver) {
@@ -90,34 +87,40 @@ function selfKeyMint(ctx, opts) {
     // Same op and actor as an admin mint, so a lookup by audit row finds this key too.
     return {
         plaintext: made.plaintext,
-        mint: { key: made.key, actor: subject, metadata: { label, role: 'member', self: true, expiresAt }, perSubject: opts.perSubject }
+        mint: {
+            key: made.key,
+            actor: subject,
+            metadata: { label, role: 'member', self: true, expiresAt },
+            perSubject: opts.perSubject,
+        },
     };
 }
 function selfResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: 'member', expiresAt: key.expiresAt };
 }
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export function authListRows(ctx, opts) {
-    return onStore(ctx, (port) => listRows(ctx, port, opts));
+export async function authListRows(ctx, opts) {
+    return listRows(ctx, ctx.store, opts);
 }
-/** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
+/** Every tenant's keys in the store, live ones only unless
+ * `active` is false; the host's own view, so the host admin only. */
 export function authListAllTenants(ctx, active) {
     requireHostAdmin(ctx, "Listing every tenant's keys");
     return listApiKeys(ctx.hippoRoot, { active });
 }
-function listRows(ctx, port, opts) {
-    const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
+async function listRows(ctx, store, opts) {
+    const keyWrites = store.keyWrites;
     const keyId = memberKeyIdOf(ctx.actor);
-    return andThen(keyId === null ? undefined : port.findApiKey(keyId), (record) => {
-        const filter = memberListFilter(ctx.actor, record?.ownerSubject);
-        return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
-    });
+    const record = keyId === null ? undefined : await store.findApiKey(keyId);
+    const filter = memberListFilter(ctx.actor, record?.ownerSubject);
+    return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
 }
 /** The key id of a member API key caller, whose owner decides what it lists; null for any other caller. */
 function memberKeyIdOf(actor) {
     return actor.role === 'admin' || actor.viaAuthResolver ? null : keyIdOfSubject(actor.subject);
 }
-/** A member sees only the keys its person minted, or just its own key when that has no owner; an admin sees the whole tenant; null means no keys. */
+/** A member sees only the keys its person minted, or just its own key when that has no owner; an admin sees the whole
+ * tenant; null means no keys. */
 function memberListFilter(actor, owner) {
     if (actor.role === 'admin')
         return {};
@@ -128,10 +131,13 @@ function memberListFilter(actor, owner) {
         return null;
     return owner ? { ownerSubject: owner } : { keyId };
 }
-/** Throws unless `ctx` may revoke `keyId`; a member gets one answer for a missing, foreign or unowned key, so it cannot probe key ids. */
+/** Throws unless `ctx` may revoke `keyId`; a member gets one answer for a missing, foreign or unowned key, so it cannot
+ * probe key ids. */
 function assertMayRevoke(ctx, keyId, row) {
     const { actor } = ctx;
-    if (actor.role !== 'admin' && actor.viaAuthResolver && (row?.tenantId !== ctx.tenantId || row.ownerSubject !== actor.subject)) {
+    if (actor.role !== 'admin' &&
+        actor.viaAuthResolver &&
+        (row?.tenantId !== ctx.tenantId || row.ownerSubject !== actor.subject)) {
         throw new ForbiddenError('A member can revoke only the keys it minted');
     }
     // Cross-tenant access denied: same message as missing key, no info leak.
@@ -142,18 +148,17 @@ function assertMayRevoke(ctx, keyId, row) {
         throw new ForbiddenError('An auth resolver admin cannot revoke an admin key, which outranks it');
     }
 }
-/** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
+/** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it
+ *  minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
-export function authRevoke(ctx, keyId) {
-    return onStore(ctx, (port) => {
-        const keyAudit = port.keyAudit ?? notPorted(port, 'keyAudit');
-        assertMemberKeyRevokesSelf(ctx, keyId);
-        return andThen(port.findApiKey(keyId), (record) => {
-            assertMayRevoke(ctx, keyId, keyOwnerOf(record));
-            const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
-            return andThen(keyAudit.revokeApiKey(revoke), (revokedAt) => ({ ok: true, revokedAt }));
-        });
-    });
+export async function authRevoke(ctx, keyId) {
+    const store = ctx.store;
+    const keyAudit = store.keyAudit;
+    assertMemberKeyRevokesSelf(ctx, keyId);
+    const record = await store.findApiKey(keyId);
+    assertMayRevoke(ctx, keyId, keyOwnerOf(record));
+    const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
+    return { ok: true, revokedAt: await keyAudit.revokeApiKey(revoke) };
 }
 function assertMemberKeyRevokesSelf(ctx, keyId) {
     if (ctx.actor.role !== 'admin' && !ctx.actor.viaAuthResolver && keyIdOfSubject(ctx.actor.subject) !== keyId) {
@@ -161,7 +166,14 @@ function assertMemberKeyRevokesSelf(ctx, keyId) {
     }
 }
 function keyOwnerOf(record) {
-    return record ? { tenantId: record.tenantId, revokedAt: record.revokedAt, role: record.role, ownerSubject: record.ownerSubject ?? null } : undefined;
+    return record
+        ? {
+            tenantId: record.tenantId,
+            revokedAt: record.revokedAt,
+            role: record.role,
+            ownerSubject: record.ownerSubject ?? null,
+        }
+        : undefined;
 }
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
@@ -169,22 +181,22 @@ export async function authKeyTenant(ctx, keyId) {
     if (!ctx.actor.hostAdmin) {
         throw new ForbiddenError('Only the host admin can look up a key across tenants');
     }
-    return (await storeFor(ctx).findApiKey(keyId))?.tenantId;
+    return (await ctx.store.findApiKey(keyId))?.tenantId;
 }
 /** Grant `keyId` read access to one restricted `scope`. Admin only. */
-export function authGrant(ctx, keyId, scope) {
+export async function authGrant(ctx, keyId, scope) {
     return changeGrant(ctx, keyId, scope, 'auth_grant');
 }
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
-export function authUngrant(ctx, keyId, scope) {
+export async function authUngrant(ctx, keyId, scope) {
     return changeGrant(ctx, keyId, scope, 'auth_ungrant');
 }
-/** hippo.db only: both callers are synchronous published functions, so no store's Promise can answer them. */
-function changeGrant(ctx, keyId, scope, op) {
+async function changeGrant(ctx, keyId, scope, op) {
     if (ctx.actor.role !== 'admin') {
         throw new ForbiddenError('Only an admin key can change scope grants');
     }
-    changeScopeGrant(ctx.hippoRoot, { tenantId: ctx.tenantId, keyId, scope, op, actor: ctx.actor.subject });
+    const change = { tenantId: ctx.tenantId, keyId, scope, op, actor: ctx.actor.subject };
+    await ctx.store.keyGrants.changeScopeGrant(change);
     return { ok: true };
 }
 //# sourceMappingURL=auth.js.map

package/dist/api/{quarantine.d.ts → auth/quarantine.d.ts}

@@ -1,6 +1,6 @@
-import type { QuarantineStatus } from '../store/quarantine.js';
-import type { KeysetPosition } from '../util/keyset.js';
-import type { Context } from './types.js';
+import type { QuarantineStatus } from '../../store/quarantine.js';
+import type { KeysetPosition } from '../../util/keyset.js';
+import type { ContextWith } from '../types.js';
 export interface QuarantineListItem {
     id: string;
     originalScope: string | null;
@@ -12,13 +12,14 @@ export interface QuarantineListItem {
     contentPreview: string;
 }
 /** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
-export declare function quarantineList(ctx: Context, opts?: {
+export declare function quarantineList(ctx: ContextWith<'quarantine'>, opts?: {
     status?: QuarantineStatus | 'all';
     limit?: number;
     after?: KeysetPosition;
 }): Promise<QuarantineListItem[]>;
-/** Release a quarantined memory to its original scope. Admin only; the scope guard refuses a row moved since (mirrors restoreDormant). */
-export declare function quarantineApprove(ctx: Context, id: string): Promise<void>;
+/** Release a quarantined memory to its original scope. Admin only; the
+ * scope guard refuses a row moved since (mirrors restoreDormant). */
+export declare function quarantineApprove(ctx: ContextWith<'quarantine'>, id: string): Promise<void>;
 /** Keep a quarantined memory hidden for good. Admin only; the raw row is untouched (append-only). */
-export declare function quarantineReject(ctx: Context, id: string): Promise<void>;
+export declare function quarantineReject(ctx: ContextWith<'quarantine'>, id: string): Promise<void>;
 //# sourceMappingURL=quarantine.d.ts.map

package/dist/api/{quarantine.js → auth/quarantine.js}

@@ -1,10 +1,9 @@
 // Quarantine review: list, approve and reject held memories.
-import { ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { ConflictError, ForbiddenError, NotFoundError } from '../../core/api-errors.js';
 const QUARANTINE_PREVIEW_CHARS = 200;
 /** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
 export async function quarantineList(ctx, opts = {}) {
-    const rows = await requireGroup(storeFor(ctx), 'quarantine')
+    const rows = await ctx.store.quarantine
         .listQuarantined(ctx.tenantId, { status: opts.status ?? 'pending', limit: opts.limit, after: opts.after });
     return rows.map((row) => ({
         id: row.memoryId,
@@ -22,16 +21,18 @@ function refusalError(id, refusal) {
         return new NotFoundError(`not quarantined: ${id}`);
     return new ConflictError(`${id} is already ${refusal.status}`);
 }
-/** Release a quarantined memory to its original scope. Admin only; the scope guard refuses a row moved since (mirrors restoreDormant). */
+/** Release a quarantined memory to its original scope. Admin only; the
+ * scope guard refuses a row moved since (mirrors restoreDormant). */
 export async function quarantineApprove(ctx, id) {
     if (ctx.actor.role !== 'admin') {
         throw new ForbiddenError('Only an admin key can approve a quarantined memory');
     }
-    const result = await requireGroup(storeFor(ctx), 'quarantine').approveQuarantined(ctx.tenantId, id, ctx.actor.subject);
+    const result = await ctx.store.quarantine.approveQuarantined(ctx.tenantId, id, ctx.actor.subject);
     if (result.outcome === 'approved')
         return;
-    if (result.outcome === 'scope_moved')
+    if (result.outcome === 'scope_moved') {
         throw new ConflictError(`memory ${id} scope changed since quarantine; refusing to approve`);
+    }
     throw refusalError(id, result);
 }
 /** Keep a quarantined memory hidden for good. Admin only; the raw row is untouched (append-only). */
@@ -39,7 +40,7 @@ export async function quarantineReject(ctx, id) {
     if (ctx.actor.role !== 'admin') {
         throw new ForbiddenError('Only an admin key can reject a quarantined memory');
     }
-    const result = await requireGroup(storeFor(ctx), 'quarantine').rejectQuarantined(ctx.tenantId, id, ctx.actor.subject);
+    const result = await ctx.store.quarantine.rejectQuarantined(ctx.tenantId, id, ctx.actor.subject);
     if (result.outcome !== 'rejected')
         throw refusalError(id, result);
 }

package/dist/api/auth/session-owners.d.ts

@@ -0,0 +1,10 @@
+import { type Context, type ContextWith } from '../types.js';
+/**
+ * Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set
+ * it aside.
+ */
+export declare function bindSessionOwner(ctx: Context, sessionId: string): void;
+/** `bindSessionOwner` through the store's sessions group, for a caller whose store is not hippo.db; a failure rejects,
+ * never throws. */
+export declare function bindSessionOwnerOn(ctx: ContextWith<'sessions'>, sessionId: string): Promise<void>;
+//# sourceMappingURL=session-owners.d.ts.map

package/dist/api/auth/session-owners.js

@@ -0,0 +1,35 @@
+// A session id belongs to the first owner that binds it, so one developer's client cannot write into another's session.
+import { ConflictError } from '../../core/api-errors.js';
+import { ownerOrSubject } from '../types.js';
+import { sessionOwnerOrBind } from '../../store/sessions.js';
+import { assertTenantId } from '../../store/tenant.js';
+import { DAY_MS } from '../../util/time.js';
+/** Bindings older than this are pruned when a new session binds. */
+const BINDING_RETENTION_DAYS = 90;
+/**
+ * Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set
+ * it aside.
+ */
+export function bindSessionOwner(ctx, sessionId) {
+    assertTenantId('bindSessionOwner', ctx.tenantId);
+    const owner = ownerOrSubject(ctx.actor);
+    const bound = sessionOwnerOrBind(ctx.hippoRoot, {
+        tenantId: ctx.tenantId,
+        sessionId,
+        owner,
+        retentionMs: BINDING_RETENTION_DAYS * DAY_MS,
+    });
+    if (bound !== owner)
+        throw new ConflictError('session id belongs to another caller');
+}
+/** `bindSessionOwner` through the store's sessions group, for a caller whose store is not hippo.db; a failure rejects,
+ * never throws. */
+export async function bindSessionOwnerOn(ctx, sessionId) {
+    assertTenantId('bindSessionOwnerOn', ctx.tenantId);
+    const owner = ownerOrSubject(ctx.actor);
+    const retentionMs = BINDING_RETENTION_DAYS * DAY_MS;
+    const bound = await ctx.store.sessions.bindSessionOwner(ctx.tenantId, sessionId, owner, retentionMs);
+    if (bound !== owner)
+        throw new ConflictError('session id belongs to another caller');
+}
+//# sourceMappingURL=session-owners.js.map

package/dist/api/availability.d.ts

@@ -46,7 +46,9 @@ export declare const DEFAULT_RECENT_FRACTION_THRESHOLD = 0.7;
 export declare const DEFAULT_MIN_RETURNED = 3;
 export declare const DEFAULT_MIN_POOL = 10;
 export declare const DEFAULT_MIN_OLDER_PASSED_OVER = 3;
-/** Returns an AvailabilityHint when the returned slice is recency-dominated, the pool skews older and older matches were passed over; else null.
+/**
+ * Returns an AvailabilityHint when the returned slice is recency-dominated, the pool skews older and older matches were
+ * passed over; else null.
  * Entries with an unparseable `created` are dropped so a malformed row cannot poison the medians with NaN. */
 export declare function detectAvailabilityBias(opts: DetectAvailabilityBiasOpts): AvailabilityHint | null;
 //# sourceMappingURL=availability.d.ts.map

package/dist/api/availability.js

@@ -16,7 +16,9 @@ function parseTimestamps(refs) {
         .map((e) => ({ id: e.id, ts: Date.parse(e.created) }))
         .filter((e) => Number.isFinite(e.ts));
 }
-/** Returns an AvailabilityHint when the returned slice is recency-dominated, the pool skews older and older matches were passed over; else null.
+/**
+ * Returns an AvailabilityHint when the returned slice is recency-dominated, the pool skews older and older matches were
+ * passed over; else null.
  * Entries with an unparseable `created` are dropped so a malformed row cannot poison the medians with NaN. */
 export function detectAvailabilityBias(opts) {
     const now = opts.now ?? Date.now();

package/dist/api/busy.d.ts

@@ -0,0 +1,2 @@
+export { isStoreBusy } from '../store/busy.js';
+//# sourceMappingURL=busy.d.ts.map

package/dist/api/busy.js

@@ -0,0 +1,2 @@
+export { isStoreBusy } from '../store/busy.js';
+//# sourceMappingURL=busy.js.map

package/dist/api/cli-surface.d.ts

@@ -0,0 +1,6 @@
+export { hashQueryText } from './recall/finish.js';
+export { sessionRing, shownRecallRows } from './recall/finish.js';
+export { availabilityPool, cutoffClauses, detectRecallHints, shrinkToFit, suppressionSummary, tokenPurse, } from './recall/render.js';
+export { handoffText, printedTokens, sessionTrailText, settleTokens, snapshotText } from './context-render.js';
+export type { RankRecallResult, RankStage, RecallGraphHops, RecallGraphStream, RecallReranker, } from './recall/pipeline.js';
+//# sourceMappingURL=cli-surface.d.ts.map

package/dist/api/cli-surface.js

@@ -0,0 +1,6 @@
+// The api internals the recall CLI reads; off api/index.ts because server.ts publishes names from that barrel.
+export { hashQueryText } from './recall/finish.js';
+export { sessionRing, shownRecallRows } from './recall/finish.js';
+export { availabilityPool, cutoffClauses, detectRecallHints, shrinkToFit, suppressionSummary, tokenPurse, } from './recall/render.js';
+export { handoffText, printedTokens, sessionTrailText, settleTokens, snapshotText } from './context-render.js';
+//# sourceMappingURL=cli-surface.js.map

package/dist/api/config-of.d.ts

@@ -0,0 +1,5 @@
+import { type HippoConfig } from '../core/config.js';
+import type { Context } from './types.js';
+/** The config a composition root set on the Context, else the store's own file; roots set it per command or request. */
+export declare function configOf(ctx: Context): HippoConfig;
+//# sourceMappingURL=config-of.d.ts.map