@jbarket/loomai 0.9.2 → 0.11.0

package/CHANGELOG.md

@@ -12,6 +12,72 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-10-24
+
+### Changed
+
+- **The household, phase 2b: one directory entry per person, a relationship
+  per agent.** In a household a person card is kept in two places:
+  - **The directory** (`commons/people.db`): name, handles (`where`), and
+    the facts in `how` (`tz`, `timezone`, `pronouns`, `languages`), shared
+    by every agent.
+  - **Each agent's relationship** (its own `memories.db`): the summary, the
+    rest of `how` (how *this* agent talks to them) and `may`.
+
+  How it behaves:
+  - A read merges the two halves into one card, rendered exactly as before.
+  - A write splits by field. Both halves are rehearsed in memory first, so
+    a write either half would refuse changes neither.
+  - Revisions record the agent that made them (`person_revisions.actor`),
+    and `person_history` says which half each revision came from.
+  - "Memories newer than the card" counts each agent's own memories.
+
+  Moving in:
+  - `loom household commons` and `init` split an existing agent's cards,
+    checking first that every card still renders the same text. Running it
+    again is safe.
+  - A household daemon refuses to start with cards that haven't been split.
+- **The household, phase 2a: knowledge is the commons.**
+  - In a household, every agent reads and writes `commons/knowledge.db`.
+  - `loom household init` moves the first agent's knowledge there.
+  - `loom household commons` moves it for a household made before this
+    release. It checkpoints the WAL first, and must run with every daemon
+    stopped.
+  - A household daemon refuses to start while an agent still has its own
+    `knowledge.db`, so the knowledge base can't quietly fork.
+  - A plain context dir keeps its own knowledge, as before.
+
+## [0.10.0] - 2026-10-24
+
+### Security
+
+- **`harness_init` could write any file the daemon's user can.** Its
+  `target` was a free path and the harness name could carry newlines, so any
+  MCP caller could append to another agent's `IDENTITY.md` or plant a command
+  in a shell rc file. Over HTTP the target is now refused: it names a file on
+  the server, never the caller's. Locally it must be a harness instruction
+  file (`CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, …), judged at its real path.
+  Names refuse control characters, and managed-block writes use a random,
+  exclusive temp file. Found by the security review of the household work.
+
+### Added
+
+- **The household, phase 1: one loom, several agents**
+  (docs/specs/household.md).
+  - `$LOOM_HOME/household.json` lists the agents and the default, and
+    `tokens.json` holds every token by sha256 with a label and a role.
+  - **Roles:** `agent:<name>` is MCP and `/cli` as that agent's stack only.
+    `owner` gets the default agent, another at `/agents/<name>/`, and the
+    page. `peer:<name>` gets knowledge tools only.
+  - **On every request** the daemon resolves the role and builds the
+    session's server over that agent's context dir. A session stays pinned
+    to the role and agent it opened with, and a revoke takes effect on the
+    next request.
+  - **New commands:** `loom household init|add|show` and
+    `loom token create|list|revoke`.
+  - **Nothing changes for one agent:** a plain context dir is a household of
+    one and behaves exactly as before.
+
 ## [0.9.2] - 2026-10-24
 
 ### Fixed
@@ -666,7 +732,9 @@ Initial public release.
   stack and all added external-service dependencies or operational
   overhead.
 
-[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.9.2...HEAD
+[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.11.0...HEAD
+[0.11.0]: https://github.com/sleepunit-agents/loom/compare/v0.10.0...v0.11.0
+[0.10.0]: https://github.com/sleepunit-agents/loom/compare/v0.9.2...v0.10.0
 [0.9.2]: https://github.com/sleepunit-agents/loom/compare/v0.9.1...v0.9.2
 [0.9.1]: https://github.com/sleepunit-agents/loom/compare/v0.9.0...v0.9.1
 [0.9.0]: https://github.com/sleepunit-agents/loom/compare/v0.8.0...v0.9.0

package/README.md

@@ -648,6 +648,35 @@ loom tasks ready       # → loom-tasks ready
 The rules, the dispatch details and how pieces compose:
 [`docs/extensions.md`](docs/extensions.md).
 
+### The household — several agents on one loom
+
+One loom can serve several agents, with a shared commons
+([`docs/specs/household.md`](docs/specs/household.md)). A household is a
+directory (`$LOOM_HOME`, default `~/.config/loom`) with a `household.json`,
+a `tokens.json`, and one context dir per agent under `agents/`. A plain
+context dir with no household around it is a household of one and works
+exactly as before.
+
+```bash
+loom household init art             # ~/.config/loom/art → agents/art (a symlink stays)
+loom household add mark             # an agent whose dir already exists under agents/
+loom household commons              # once, daemons stopped: knowledge.db → commons/ (shared by every agent)
+loom token create --agent art --label "Art · house on wunder"   # printed once
+loom token create --owner --label "Jonathan · page"
+loom token list
+loom token revoke "Art · house on wunder"
+```
+
+Every token has a role. **`agent:<name>`** is MCP and `/cli` as that agent:
+its own stack only. **`owner`** gets the default agent, or another at
+`/agents/<name>/` on the daemon, and the page. **`peer:<name>`** gets
+knowledge tools only. The daemon resolves the role on every request; no tool
+takes an agent argument, so a body can only be the agent its token names.
+`LOOM_BEARER_TOKEN`, when set, is an owner token too. A daemon whose context
+dir is `<home>/agents/<name>` next to a `household.json` serves the whole
+household. A process with `LOOM_HOME` set and no context dir uses
+`LOOM_AGENT`, or the household's default.
+
 ### Harness manifests and self-describe
 
 A **harness** is the MCP-capable runtime the agent runs in (Claude Code,

package/dist/backends/migrations.js

@@ -337,6 +337,15 @@ export const MIGRATIONS = [
             }).immediate();
         },
     },
+    {
+        id: 'person_revisions_actor',
+        description: 'Add person_revisions.actor: which agent made the change a revision records, so a ' +
+            'shared directory entry shows who changed what (docs/specs/household.md)',
+        pending: (db) => hasTable(db, 'person_revisions') && !hasColumn(db, 'person_revisions', 'actor'),
+        run: (db) => {
+            db.prepare('ALTER TABLE person_revisions ADD COLUMN actor TEXT').run();
+        },
+    },
 ];
 /**
  * Apply pending migrations to a database.

package/dist/backends/people-household.d.ts

@@ -0,0 +1,77 @@
+import { PeopleStore, type MutationResult, type PersonCard, type PersonListEntry, type PersonReadResult, type PersonRevisionMeta, type PersonRow, type PersonWriteInput } from './people.js';
+import { type Household } from '../household.js';
+/** `how` fields that are facts about the person, not how one agent talks to them. */
+export declare const FACT_KEYS: ReadonlySet<string>;
+export declare function commonsPeoplePath(h: Household): string;
+/** The directory half and the relationship half of a whole card. */
+export declare function splitCard(card: PersonCard): {
+    directory: PersonCard;
+    relationship: PersonCard;
+};
+/** One card from its two halves. */
+export declare function mergeCard(d: PersonCard, r: PersonCard | null): PersonCard;
+export declare class HouseholdPeople {
+    private readonly directory;
+    private readonly relationship;
+    private readonly now;
+    constructor(directory: PeopleStore, relationship: PeopleStore, now?: () => number);
+    close(): void;
+    getRow(slug: string): PersonRow | null;
+    read(slug: string, includeArchived?: boolean): PersonReadResult;
+    list(includeArchived?: boolean): PersonListEntry[];
+    /**
+     * Split a write by field: name, `where` and the fact keys of `how` go to the
+     * directory; summary, the rest of `how` and `may` to this agent's
+     * relationship. Both halves are rehearsed against in-memory copies first,
+     * so a write either half would refuse changes neither.
+     */
+    write(input: PersonWriteInput): MutationResult;
+    verify(input: {
+        slug: string;
+        fields: string[];
+        verified_at?: string;
+        source?: string;
+    }): MutationResult;
+    archive(input: {
+        slug: string;
+        reason: string;
+        actor: string;
+    }): MutationResult;
+    restore(input: {
+        slug: string;
+    }): MutationResult;
+    /** Revisions from both halves, newest first, each saying which half and which agent. */
+    history(slug: string): PersonRevisionMeta[];
+    /**
+     * Restore one half to a revision: `store` says which (the relationship,
+     * unless named). A relationship revision from before the split holds the
+     * whole old card; only its relationship half comes back, so handles and
+     * facts never return to the agent's own store.
+     */
+    revisionRestore(input: {
+        slug: string;
+        revision_id: number;
+        store?: 'directory' | 'relationship';
+    }): MutationResult;
+    private mutation;
+}
+/**
+ * Open the people for a household agent: the commons directory plus the
+ * agent's relationships, both attributing revisions to the agent. A
+ * read-only open returns null when the directory doesn't exist yet.
+ */
+export declare function openHouseholdPeople(h: Household, agent: string, contextDir: string, opts?: {
+    readonly?: boolean;
+    now?: () => number;
+}): HouseholdPeople | null;
+/**
+ * Move an agent's whole cards into the household split: the directory half
+ * to the commons, the relationship half back in place (timestamps and
+ * archive state kept). Every card is checked first: merged back together it
+ * must render the same text it does today, or nothing is written. Refuses a
+ * slug the directory already has (merging a second agent's people is a later
+ * step). Returns how many cards moved.
+ */
+export declare function splitPeopleIntoCommons(h: Household, agent: string, contextDir: string, nowMs?: number): number;
+/** Whether an agent still holds directory fields (handles, facts) in its own cards: an unsplit store. */
+export declare function hasUnsplitPeople(contextDir: string): boolean;

package/dist/backends/people-household.js

@@ -0,0 +1,305 @@
+/**
+ * Person cards in a household (docs/specs/household.md, "The commons"): one
+ * card a reader sees, kept in two places.
+ *
+ *   directory     commons/people.db, one entry per human, shared by every
+ *                 agent: name, `where` (handles), and the facts in `how`
+ *                 that don't depend on who's asking (FACT_KEYS)
+ *   relationship  the agent's own memories.db: summary, the rest of `how`
+ *                 (how *this* agent talks to them), `may`
+ *
+ * A read merges the two into one card, rendered exactly as before. A write
+ * splits by field. Every revision names the agent that made it. No agent
+ * reads another's relationship: there's no API for it here.
+ *
+ * Same surface as PeopleStore, so the person tools don't care which they got.
+ */
+import { join } from 'node:path';
+import { existsSync, mkdirSync } from 'node:fs';
+import { PeopleStore, PersonCardError, renderCard, } from './people.js';
+import { resolveSqliteDbPath } from '../config.js';
+import { commonsDir } from '../household.js';
+/** `how` fields that are facts about the person, not how one agent talks to them. */
+export const FACT_KEYS = new Set(['tz', 'timezone', 'pronouns', 'languages']);
+export function commonsPeoplePath(h) {
+    return join(commonsDir(h), 'people.db');
+}
+function canonicalJson(v) {
+    if (Array.isArray(v))
+        return `[${v.map(canonicalJson).join(',')}]`;
+    if (v && typeof v === 'object')
+        return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(v[k])}`).join(',')}}`;
+    return JSON.stringify(v);
+}
+function splitHow(how) {
+    const facts = {};
+    const rest = {};
+    for (const [k, v] of Object.entries(how ?? {}))
+        (FACT_KEYS.has(k) ? facts : rest)[k] = v;
+    return { facts, rest };
+}
+/** The directory half and the relationship half of a whole card. */
+export function splitCard(card) {
+    const { facts, rest } = splitHow(card.how);
+    return {
+        directory: { slug: card.slug, name: card.name, where: card.where ?? {}, how: facts, may: [] },
+        relationship: {
+            slug: card.slug, name: card.name, ...(card.summary !== undefined ? { summary: card.summary } : {}),
+            where: {}, how: rest, may: card.may ?? [],
+        },
+    };
+}
+/** One card from its two halves. */
+export function mergeCard(d, r) {
+    return {
+        slug: d.slug,
+        name: d.name,
+        ...(r?.summary !== undefined ? { summary: r.summary } : {}),
+        where: d.where ?? {},
+        how: { ...(r?.how ?? {}), ...(d.how ?? {}) },
+        may: r?.may ?? [],
+    };
+}
+/** Try a write against an in-memory copy of the current row; throws exactly what the real write would. */
+function rehearse(row, input, now) {
+    if (!input)
+        return;
+    const mem = new PeopleStore({ dbPath: ':memory:', now });
+    try {
+        if (row) {
+            mem.replaceCard(row.slug, row.card, {
+                updated: row.updated, synthesized_at: row.synthesized_at,
+                archived_at: row.archived_at, archived_by: row.archived_by, archive_reason: row.archive_reason,
+            });
+        }
+        mem.write(input);
+    }
+    finally {
+        mem.close();
+    }
+}
+export class HouseholdPeople {
+    directory;
+    relationship;
+    now;
+    constructor(directory, relationship, now = Date.now) {
+        this.directory = directory;
+        this.relationship = relationship;
+        this.now = now;
+    }
+    close() {
+        this.directory.close();
+        this.relationship.close();
+    }
+    getRow(slug) {
+        const d = this.directory.getRow(slug);
+        if (!d)
+            return null;
+        const r = this.relationship.getRow(slug);
+        return {
+            ...d,
+            card: mergeCard(d.card, r?.card ?? null),
+            updated: r && r.updated > d.updated ? r.updated : d.updated,
+            synthesized_at: r?.synthesized_at ?? null,
+        };
+    }
+    read(slug, includeArchived = false) {
+        const row = this.getRow(slug);
+        if (!row)
+            return this.directory.read(slug, includeArchived);
+        const archived = row.archived_at !== null;
+        if (archived && !includeArchived)
+            return { found: true, archived: true };
+        return {
+            found: true,
+            rendered: renderCard(row.card, this.now()) + (archived ? `\n_(archived ${row.archived_at} by ${row.archived_by}: ${row.archive_reason})_` : ''),
+            card: row.card,
+            archived,
+            updated: row.updated,
+            synthesized_at: row.synthesized_at,
+        };
+    }
+    list(includeArchived = false) {
+        const rel = new Map(this.relationship.list(true).map((e) => [e.slug, e]));
+        return this.directory.list(includeArchived).map((e) => {
+            const r = rel.get(e.slug);
+            const since = r?.synthesized_at ?? null;
+            return {
+                ...e,
+                updated: r && r.updated > e.updated ? r.updated : e.updated,
+                synthesized_at: since,
+                memories_since_synthesis: this.relationship.memoriesSince(e.slug, since),
+            };
+        });
+    }
+    /**
+     * Split a write by field: name, `where` and the fact keys of `how` go to the
+     * directory; summary, the rest of `how` and `may` to this agent's
+     * relationship. Both halves are rehearsed against in-memory copies first,
+     * so a write either half would refuse changes neither.
+     */
+    write(input) {
+        const merge = input.merge ?? true;
+        const dirRow = this.directory.getRow(input.slug);
+        const relRow = this.relationship.getRow(input.slug);
+        const name = input.name ?? dirRow?.card.name;
+        if (name === undefined)
+            throw new PersonCardError('name: is required to create a card');
+        const { facts, rest } = splitHow(input.how);
+        const dirInput = input.name !== undefined || input.where !== undefined || Object.keys(facts).length > 0 || !dirRow || !merge
+            ? { slug: input.slug, name, merge, ...(input.where !== undefined ? { where: input.where } : {}), how: facts }
+            : null;
+        const relInput = input.summary !== undefined || Object.keys(rest).length > 0 || input.may !== undefined || !merge || !relRow || (input.name !== undefined && relRow.card.name !== input.name)
+            ? {
+                slug: input.slug, name, merge,
+                ...(input.summary !== undefined ? { summary: input.summary } : {}),
+                how: rest,
+                ...(input.may !== undefined ? { may: input.may } : {}),
+            }
+            : null;
+        rehearse(dirRow, dirInput, this.now);
+        rehearse(relRow, relInput, this.now);
+        if (dirInput)
+            this.directory.write(dirInput);
+        if (relInput)
+            this.relationship.write(relInput);
+        return this.mutation(input.slug);
+    }
+    verify(input) {
+        this.directory.verify(input);
+        return this.mutation(input.slug);
+    }
+    archive(input) {
+        this.directory.archive(input);
+        if (this.relationship.getRow(input.slug))
+            this.relationship.archive(input);
+        return this.mutation(input.slug);
+    }
+    restore(input) {
+        this.directory.restore(input);
+        if (this.relationship.getRow(input.slug))
+            this.relationship.restore(input);
+        return this.mutation(input.slug);
+    }
+    /** Revisions from both halves, newest first, each saying which half and which agent. */
+    history(slug) {
+        return [
+            ...this.directory.history(slug).map((r) => ({ ...r, store: 'directory' })),
+            ...this.relationship.history(slug).map((r) => ({ ...r, store: 'relationship' })),
+        ].sort((a, b) => (a.replaced_at < b.replaced_at ? 1 : a.replaced_at > b.replaced_at ? -1 : 0));
+    }
+    /**
+     * Restore one half to a revision: `store` says which (the relationship,
+     * unless named). A relationship revision from before the split holds the
+     * whole old card; only its relationship half comes back, so handles and
+     * facts never return to the agent's own store.
+     */
+    revisionRestore(input) {
+        if (input.store === 'directory') {
+            this.directory.revisionRestore(input);
+            return this.mutation(input.slug);
+        }
+        const snap = this.relationship.revisionSnapshot(input.revision_id);
+        if (!snap)
+            throw new PersonCardError(`revision ${input.revision_id} not found`);
+        if (snap.slug !== input.slug)
+            throw new PersonCardError(`revision ${input.revision_id} belongs to another card, not ${input.slug}`);
+        if (!holdsDirectoryFields(snap.card)) {
+            this.relationship.revisionRestore(input);
+            return this.mutation(input.slug);
+        }
+        // The same gate the plain restore path has: no restoring onto an archived card.
+        const current = this.relationship.getRow(input.slug);
+        if (!current)
+            throw new PersonCardError(`no card for ${input.slug}`);
+        const dirRow = this.directory.getRow(input.slug);
+        if (!dirRow)
+            throw new PersonCardError(`no card for ${input.slug}`);
+        if (current.archived_at !== null || dirRow.archived_at !== null) {
+            throw new PersonCardError(`card for ${input.slug} is archived; person_restore it before restoring a revision`);
+        }
+        this.relationship.replaceCard(input.slug, splitCard(snap.card).relationship, {
+            updated: new Date(this.now()).toISOString(), synthesized_at: snap.synthesized_at ?? null,
+            archived_at: current.archived_at, archived_by: current.archived_by, archive_reason: current.archive_reason,
+        });
+        return this.mutation(input.slug);
+    }
+    mutation(slug) {
+        const row = this.getRow(slug);
+        if (!row)
+            throw new PersonCardError(`no card for ${slug}`);
+        return { card: row.card, unchanged: false, revision_id: null, archived: row.archived_at !== null, updated: row.updated, synthesized_at: row.synthesized_at };
+    }
+}
+/**
+ * Open the people for a household agent: the commons directory plus the
+ * agent's relationships, both attributing revisions to the agent. A
+ * read-only open returns null when the directory doesn't exist yet.
+ */
+export function openHouseholdPeople(h, agent, contextDir, opts = {}) {
+    const dirPath = commonsPeoplePath(h);
+    const relPath = resolveSqliteDbPath(contextDir);
+    if (opts.readonly && (!existsSync(dirPath) || !existsSync(relPath)))
+        return null;
+    if (!opts.readonly)
+        mkdirSync(commonsDir(h), { recursive: true, mode: 0o700 });
+    return new HouseholdPeople(new PeopleStore({ dbPath: dirPath, readonly: opts.readonly, now: opts.now, actor: agent }), new PeopleStore({ dbPath: relPath, readonly: opts.readonly, now: opts.now, actor: agent }), opts.now);
+}
+/**
+ * Move an agent's whole cards into the household split: the directory half
+ * to the commons, the relationship half back in place (timestamps and
+ * archive state kept). Every card is checked first: merged back together it
+ * must render the same text it does today, or nothing is written. Refuses a
+ * slug the directory already has (merging a second agent's people is a later
+ * step). Returns how many cards moved.
+ */
+export function splitPeopleIntoCommons(h, agent, contextDir, nowMs = Date.now()) {
+    if (!existsSync(resolveSqliteDbPath(contextDir)))
+        return 0;
+    mkdirSync(commonsDir(h), { recursive: true, mode: 0o700 });
+    const rel = new PeopleStore({ dbPath: resolveSqliteDbPath(contextDir), actor: agent });
+    const dir = new PeopleStore({ dbPath: commonsPeoplePath(h), actor: agent });
+    try {
+        const plan = rel.rows().flatMap((r) => {
+            const halves = splitCard(r.card);
+            const there = dir.getRow(r.slug);
+            // Already split (a re-run): the agent's card holds no handles or facts
+            // and the directory has the person.
+            if (there && !holdsDirectoryFields(r.card))
+                return [];
+            if (there && canonicalJson(there.card) !== canonicalJson(halves.directory)) {
+                throw new PersonCardError(`${r.slug} is already in the directory with different details; merging another agent's card into it isn't automatic yet`);
+            }
+            const before = renderCard(r.card, nowMs);
+            const after = renderCard(mergeCard(halves.directory, halves.relationship), nowMs);
+            if (before !== after)
+                throw new PersonCardError(`${r.slug} would render differently after the split; nothing was moved`);
+            return [{ r, halves }];
+        });
+        for (const { r, halves } of plan) {
+            const keep = { updated: r.updated, archived_at: r.archived_at, archived_by: r.archived_by, archive_reason: r.archive_reason };
+            dir.replaceCard(r.slug, halves.directory, { ...keep, synthesized_at: null });
+            rel.replaceCard(r.slug, halves.relationship, { ...keep, synthesized_at: r.synthesized_at });
+        }
+        return plan.length;
+    }
+    finally {
+        rel.close();
+        dir.close();
+    }
+}
+function holdsDirectoryFields(card) {
+    return Object.keys(card.where ?? {}).length > 0 || Object.keys(splitHow(card.how).facts).length > 0;
+}
+/** Whether an agent still holds directory fields (handles, facts) in its own cards: an unsplit store. */
+export function hasUnsplitPeople(contextDir) {
+    if (!existsSync(resolveSqliteDbPath(contextDir)))
+        return false;
+    const rel = new PeopleStore({ dbPath: resolveSqliteDbPath(contextDir), readonly: true });
+    try {
+        return rel.rows().some((r) => holdsDirectoryFields(r.card));
+    }
+    finally {
+        rel.close();
+    }
+}

package/dist/backends/people.d.ts

@@ -79,8 +79,12 @@ export interface PersonRevisionMeta {
     id: number;
     op: RevisionOp;
     replaced_at: string;
+    /** The agent whose change this revision records (null before households). */
+    actor?: string | null;
+    /** In a household: which half of the card this revision is from. */
+    store?: 'directory' | 'relationship';
 }
-export type RevisionOp = 'write' | 'verify' | 'archive' | 'restore' | 'revision_restore';
+export type RevisionOp = 'write' | 'verify' | 'archive' | 'restore' | 'revision_restore' | 'split';
 /** Every rejection the people surface makes. The message names the path. */
 export declare class PersonCardError extends Error {
     constructor(message: string);
@@ -112,6 +116,16 @@ export declare function fieldState(env: WhereEnvelope, nowMs: number): FieldStat
 export declare function renderCard(card: PersonCard, nowMs: number, opts?: {
     worstCase?: boolean;
 }): string;
+interface RawRow {
+    slug: string;
+    name: string;
+    card_json: string;
+    archived_at: string | null;
+    archived_by: string | null;
+    archive_reason: string | null;
+    updated: string;
+    synthesized_at: string | null;
+}
 export interface PeopleStoreConfig {
     dbPath: string;
     /** Open read-only and never migrate. Reads on an unmigrated store see no cards. */
@@ -119,6 +133,8 @@ export interface PeopleStoreConfig {
     busyTimeoutMs?: number;
     /** Clock, for tests. */
     now?: () => number;
+    /** Who is writing (an agent's name), recorded on every revision it makes. */
+    actor?: string;
 }
 /** Thrown when a stored row cannot be turned back into a card. */
 export declare class UnreadableCardError extends Error {
@@ -127,6 +143,7 @@ export declare class UnreadableCardError extends Error {
 export declare class PeopleStore {
     private db;
     private readonly now;
+    private readonly actor;
     /** False on a read-only store whose tables do not exist yet. */
     readonly migrated: boolean;
     constructor(config: PeopleStoreConfig);
@@ -163,6 +180,24 @@ export declare class PeopleStore {
     read(slug: string, includeArchived?: boolean): PersonReadResult;
     list(includeArchived?: boolean): PersonListEntry[];
     history(slug: string): PersonRevisionMeta[];
+    /**
+     * Put a card in place as is, keeping the row's timestamps and archive state
+     * (a migration, not an edit). Recorded as a 'split' revision when a row is
+     * replaced.
+     */
+    replaceCard(slug: string, card: PersonCard, keep: Pick<RawRow, 'updated' | 'synthesized_at' | 'archived_at' | 'archived_by' | 'archive_reason'>): void;
+    /** The raw stored rows (timestamps and archive state included), for a migration. */
+    rows(): Array<{
+        slug: string;
+        card: PersonCard;
+        updated: string;
+        synthesized_at: string | null;
+        archived_at: string | null;
+        archived_by: string | null;
+        archive_reason: string | null;
+    }>;
+    /** This database's `user` memories about a person, newer than `since` (all of them when null). */
+    memoriesSince(slug: string, since: string | null): number;
     /** A revision's snapshot (the whole previous row), for tests and inspection. */
     revisionSnapshot(id: number): {
         slug: string;
@@ -190,3 +225,4 @@ export interface RoomOptions {
  * block; one bad row gives that slug the unreadable line and the rest render.
  */
 export declare function roomBlock(contextDir: string, people: readonly string[] | undefined, opts?: RoomOptions): string | null;
+export {};