Helper to convert domain.Procedure to API response.

tokenMatches compares a presented secret against the configured one in constant time.

truncate shortens a string to maxLen characters, adding "..." if truncated.

writeQuotaError emits a 402 with the structured upgrade hint the console reads.

Allow checks if a request from the given key should be allowed.

Decay

Binding lifecycle

AuditSigningKey is an optional HMAC secret used to sign audit exports so a recipient can confirm an export came from this server. Empty = unsigned exp

BillingEnabled reports whether managed-cloud billing + quota enforcement is on. Gated on a Razorpay key id + secret being configured; when unset the c

ChainEntries returns recent audit-log rows for a tenant — including the tamper-evident chain fields (seq, prev_hash, row_hash) — for visualizing the h

Cleanup evicts limiters not used within maxAge. Buckets in active use are kept, so legitimate clients never lose their limiter state to a flush.

ClearSession clears the working memory session for an agent.

Memory activations

CreateAssociation creates a memory association for spreading activation.

Associations

Schema activations

Session management

CurrentUser returns the session's user, the session, and the user's orgs.

DBMaxConnIdleTime closes a connection idle this long, returning it to Postgres. Override with DB_MAX_CONN_IDLE_SECS. Default 30m.

DBMaxConnLifetime recycles a connection after this long (guards against server-side connection state drift / load-balancer staleness). Override with D

---- Database connection pool ---- pgx's default pool maxes at 4 connections, which starves a busy server (every recall, decay pass, and background w

DBMinConns is the warm floor of connections kept open. Override with DB_MIN_CONNS. Default 2.

---- Control plane (console auth) ---- DefaultTenantID, if set, is the org that newly-signed-up users auto-join (instead of getting a fresh org). Used

DefaultTenantRole is the role new users get when auto-joining the default org. Product default is "member"; set to "admin" in a demo so signups can ma

DeleteRaw performs a DELETE and returns the raw JSON response (if any).

DetectAndApply analyzes a conversation for implicit feedback signals and applies them. Returns the detected implicit feedbacks.

EmbeddingAPIKey returns the API key for the configured embedding provider. A generic EMBEDDING_API_KEY takes precedence (for self-hosted / non-OpenAI

EnforceAgentQuota blocks agent creation once the org hits its plan's agent cap.

EnsureEmbeddingDimension reconciles the vector columns with the configured embedding dimension. It is a no-op when they already match. When they diffe

ExportByTenant returns the full audit trail for a tenant ordered by chain seq, including the hash-chain fields, for signed export.

Forget deletes a memory by ID.

GetAgentsNeedingConsolidation returns agent IDs that have unprocessed episodes.

Retrieval

Tier methods

GetLearningStats returns aggregated learning statistics for an agent. Returns (nil, nil) when no stats exist yet.

GetMemoryHealth returns statistics about the memory system health for an agent.

GetStats handles GET /v1/agents/:id/learning/stats

Guard wraps an MCP network transport with the protections a privileged local server needs. The transport holds the operator's ENGRAM_API_KEY, so reach

Handler returns an http.Handler that serves the console SPA at the site root. Static assets are served from the embedded filesystem; any unmatched pat

Handler returns an http.Handler that mounts the SSE transport.

HasPlan reports whether a self-serve Razorpay plan is configured for the tier.