hippo-memory 1.67.0 → 1.69.0

package/dist/hooks/shared.js

@@ -2,6 +2,7 @@ import { envHomeDir, processEnv } from '../env.js';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { vscodeDataFolders } from '../agent-memories/copilot.js';
 /** JSON-value plain-object check (excludes arrays and null); `constructor` avoids the `typeof` tag banned by anti-slop/no-runtime-typeof. */
 export function isJsonObject(value) {
     return value !== undefined && value !== null && !Array.isArray(value) && value.constructor === Object;
@@ -36,9 +37,23 @@ export function claudeConfigDir(home = os.homedir(), env = processEnv()) {
 export function isCodexPresent(home = homeDir()) {
     return fs.statSync(codexHomeDir(home), { throwIfNoEntry: false })?.isDirectory() === true;
 }
-/** Copilot counts as installed only when its config folder exists, so setup never creates ~/.copilot on a machine without it. */
+/** hippo's own hooks file, in the hooks folder the Copilot CLI reads. */
+export function copilotHooksFile() {
+    return path.join(copilotHomeDir(), 'hooks', 'hippo.json');
+}
+/** Where VS Code's agent finds hippo.json: its docs name ~/.copilot/hooks as the user hooks folder, whatever COPILOT_HOME says. */
+export function vscodeUserHooksFile(home = os.homedir()) {
+    return path.join(home, '.copilot', 'hooks', 'hippo.json');
+}
+/** The VS Code User folders that exist; Stable and Insiders keep their own, and only an edition the user has run has one. */
+export function vscodeUserDirs(env = processEnv(), home = os.homedir()) {
+    return vscodeDataFolders({ env, home, platform: process.platform })
+        .map((dir) => path.join(dir, 'User'))
+        .filter((dir) => fs.statSync(dir, { throwIfNoEntry: false })?.isDirectory() === true);
+}
+/** Copilot counts as installed only when its config folder or a VS Code User folder exists, so setup never creates ~/.copilot on a machine with neither. */
 export function isCopilotPresent(home = os.homedir()) {
-    return fs.statSync(copilotHomeDir(home), { throwIfNoEntry: false })?.isDirectory() === true;
+    return fs.statSync(copilotHomeDir(home), { throwIfNoEntry: false })?.isDirectory() === true || vscodeUserDirs(processEnv(), home).length > 0;
 }
 /** Codex hashes each hook and skips new or changed ones until the user reviews them in `/hooks`, so the reminder says what they would trust. */
 export const CODEX_TRUST_LINE = "The per-prompt hook sends your pinned memories plus up to 5 that match the prompt. Codex runs hippo's hooks only after you trust them once in `/hooks`.";
@@ -76,7 +91,7 @@ export function detectInstalledTools() {
         { name: 'opencode', configDir: '~/.config/opencode', detected: exists('.config', 'opencode'), kind: 'plugin', notes: 'installs a TS plugin at ~/.config/opencode/plugins/hippo.ts' },
         { name: 'openclaw', configDir: '~/.openclaw', detected: exists('.openclaw'), kind: 'plugin', notes: 'install via `openclaw plugins install hippo-memory`' },
         { name: 'codex', configDir: '~/.codex', detected: isCodexPresent(home), kind: 'wrapper', notes: 'memory hooks in hooks.json, and wraps the detected codex launcher for session-end consolidation' },
-        { name: 'copilot', configDir: copilotHomeDir(), detected: isCopilotPresent(), kind: 'json-hook', notes: 'hooks in hooks/hippo.json, the MCP server in mcp-config.json and a block in copilot-instructions.md' },
+        { name: 'copilot', configDir: copilotHomeDir(), detected: isCopilotPresent(), kind: 'json-hook', notes: 'hooks in hooks/hippo.json, the MCP server in mcp-config.json and a block in copilot-instructions.md; for VS Code, the server in each User mcp.json and prompts/hippo.instructions.md' },
         { name: 'cursor', configDir: '~/.cursor', detected: exists('.cursor'), kind: 'markdown-instruction', notes: 'no hook API - patches AGENTS.md in the project' },
         { name: 'pi', configDir: '~/.pi', detected: exists('.pi'), kind: 'markdown-instruction', notes: 'no hook API - patches AGENTS.md in the project' },
     ];

package/dist/mcp/memory-tools.d.ts

@@ -1,5 +1,5 @@
 import { type ToolCall } from './protocol.js';
-export declare function runRememberTool({ args, ctx, hippoRoot, config, tenantId }: ToolCall): string;
-export declare function runOutcomeTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
+export declare function runRememberTool({ args, ctx, hippoRoot, config, tenantId }: ToolCall): Promise<string>;
+export declare function runOutcomeTool({ args, ctx, hippoRoot, tenantId }: ToolCall): Promise<string>;
 export declare function runLearnTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
 //# sourceMappingURL=memory-tools.d.ts.map

package/dist/mcp/memory-tools.js

@@ -1,6 +1,6 @@
 // Write-side tool handlers: hippo_remember, hippo_outcome and hippo_learn.
 import { log } from '../log.js';
-import { readEntry } from '../store/entry-reads.js';
+import { storeFor } from '../store-port.js';
 import { countCreatedSinceLastSleep } from '../store/index-and-stats.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { outsideRequestStores, runWithRequestStores, scopedBusyWait } from '../db.js';
@@ -8,7 +8,7 @@ import { resolveTenantId } from '../tenant.js';
 import { remember as apiRemember, outcome as apiOutcome, learn as apiLearn, MCP_LEARN } from '../api.js';
 import { mcpActor } from './protocol.js';
 import { lastRecalledIds, autoSleepInFlight, resolveClientKey } from './session-state.js';
-export function runRememberTool({ args, ctx, hippoRoot, config, tenantId }) {
+export async function runRememberTool({ args, ctx, hippoRoot, config, tenantId }) {
     const text = String(args.text || '');
     if (!text)
         return 'No text provided.';
@@ -28,16 +28,17 @@ export function runRememberTool({ args, ctx, hippoRoot, config, tenantId }) {
         actor: mcpActor(ctx),
         store: ctx?.store,
     };
-    const result = apiRemember(apiCtx, {
+    const result = await apiRemember(apiCtx, {
         content: text,
         tags,
         personal: args.personal === true,
         project: ctx?.project,
     });
-    const entry = readEntry(hippoRoot, result.id, tenantId);
+    const [entry] = await storeFor(apiCtx).entriesByIds([result.id], tenantId);
     // Auto-sleep: one run per store at a time, triggered by what arrived since the last one.
-    // Consolidation is host-wide, so only the host tenant's writes may start it.
-    if (ctx?.autoSleep !== false &&
+    // Consolidation is host-wide, so only the host tenant's writes may start it. It runs on hippo.db, so another store skips it.
+    if ((ctx?.store === undefined || ctx.store.kind === 'sqlite') &&
+        ctx?.autoSleep !== false &&
         config.autoSleep.enabled &&
         tenantId === resolveTenantId({}) &&
         !autoSleepInFlight.has(hippoRoot) &&
@@ -57,7 +58,7 @@ export function runRememberTool({ args, ctx, hippoRoot, config, tenantId }) {
     const warnings = (result.warnings ?? []).map((w) => `\nWarning: ${w}`).join('');
     return `Remembered [${result.id}] (half-life: ${halfLife}d, tags: ${tagStr})${warnings}`;
 }
-export function runOutcomeTool({ args, ctx, hippoRoot, tenantId }) {
+export async function runOutcomeTool({ args, ctx, hippoRoot, tenantId }) {
     const good = Boolean(args.good);
     const clientKey = resolveClientKey(ctx);
     const ids = lastRecalledIds.get(clientKey) ?? [];
@@ -73,7 +74,7 @@ export function runOutcomeTool({ args, ctx, hippoRoot, tenantId }) {
         actor: mcpActor(ctx),
         store: ctx?.store,
     };
-    const { applied } = apiOutcome(apiCtx, ids, good);
+    const { applied } = await apiOutcome(apiCtx, ids, good);
     return `Applied ${good ? 'positive' : 'negative'} outcome to ${applied} memories`;
 }
 export function runLearnTool({ args, ctx, hippoRoot, tenantId }) {

package/dist/mcp/request.js

@@ -64,9 +64,9 @@ const TOOL_HANDLERS = new Map([
     ['hippo_assemble', { handler: runAssembleTool }],
     ['hippo_drill', { handler: runDrillTool }],
     ['hippo_predict_baserate', { handler: runPredictBaserateTool }],
-    ['hippo_remember', { handler: runRememberTool }],
-    ['hippo_outcome', { handler: runOutcomeTool }],
-    ['hippo_context', { handler: runContextTool }],
+    ['hippo_remember', { handler: runRememberTool, storeReady: 'entryWrites' }],
+    ['hippo_outcome', { handler: runOutcomeTool, storeReady: 'entryWrites' }],
+    ['hippo_context', { handler: runContextTool, storeReady: 'contextReads' }],
     ['hippo_status', { handler: runStatusTool }],
     ['hippo_learn', { handler: runLearnTool }],
     ['hippo_conflicts', { handler: runConflictsTool }],

package/dist/memory.d.ts

@@ -190,6 +190,8 @@ export declare function deriveHalfLife(base: number, entry: Partial<MemoryEntry>
  * cumulative reward signal, inspired by R-STDP in spiking networks.
  */
 export declare function applyOutcome(entry: MemoryEntry, good: boolean): MemoryEntry;
+/** applyOutcome as a served outcome applies it: a good outcome reconfirms the entry, so its churn-stale tag goes. */
+export declare function entryAfterOutcome(entry: MemoryEntry, good: boolean): MemoryEntry;
 /**
  * Generate a random memory ID using crypto.randomUUID().
  */

package/dist/memory.js

@@ -277,6 +277,13 @@ export function applyOutcome(entry, good) {
     updated.strength = calculateStrength(updated);
     return updated;
 }
+/** applyOutcome as a served outcome applies it: a good outcome reconfirms the entry, so its churn-stale tag goes. */
+export function entryAfterOutcome(entry, good) {
+    const updated = applyOutcome(entry, good);
+    if (!good || !updated.tags.includes(CHURN_STALE_TAG))
+        return updated;
+    return { ...updated, tags: updated.tags.filter((t) => t !== CHURN_STALE_TAG) };
+}
 /**
  * Generate a random memory ID using crypto.randomUUID().
  */

package/dist/prompt-recall.d.ts

@@ -30,4 +30,9 @@ export declare const RAREST_TERM_COUNT = 8;
 /** Terms sorted by ascending FTS doc count (rarest first), zero-count terms dropped, ties by term.
  *  Pure: `docCount` (an FTS lookup in the caller) does the only I/O. */
 export declare function rarestPromptTerms(terms: Iterable<string>, docCount: (term: string) => number, maxTerms?: number): string[];
+/** The pieces FTS5's unicode61 tokenizer indexes a term as, so `journal_mode` is `journal` and `mode`. */
+export declare function ftsTermParts(term: string): string[];
+/** The rarest terms as a space-joined FTS query, given each part's document count; a term counts as its rarest part,
+ *  an upper bound on rows holding the whole term, and a term with no parts counts 0, so it is dropped. */
+export declare function rarestFtsQuery(terms: readonly string[], docCount: (part: string) => number, maxTerms?: number): string;
 //# sourceMappingURL=prompt-recall.d.ts.map

package/dist/prompt-recall.js

@@ -64,4 +64,17 @@ export function rarestPromptTerms(terms, docCount, maxTerms = RAREST_TERM_COUNT)
         .slice(0, maxTerms)
         .map((x) => x.t);
 }
+/** The pieces FTS5's unicode61 tokenizer indexes a term as, so `journal_mode` is `journal` and `mode`. */
+export function ftsTermParts(term) {
+    return term.split(/[^\p{L}\p{N}]+/u).filter(Boolean);
+}
+/** The rarest terms as a space-joined FTS query, given each part's document count; a term counts as its rarest part,
+ *  an upper bound on rows holding the whole term, and a term with no parts counts 0, so it is dropped. */
+export function rarestFtsQuery(terms, docCount, maxTerms = RAREST_TERM_COUNT) {
+    const termCount = (t) => {
+        const parts = ftsTermParts(t);
+        return parts.length === 0 ? 0 : Math.min(...parts.map(docCount));
+    };
+    return rarestPromptTerms(terms, termCount, maxTerms).join(' ');
+}
 //# sourceMappingURL=prompt-recall.js.map

package/dist/raw-archive.d.ts

@@ -18,7 +18,7 @@ export interface ArchiveOpts {
  * append-only trigger lets the delete through, then deletes the row. All in one
  * write scope, which nests inside an outer transaction (e.g. batchWriteAndDelete).
  *
- * Throws if the row does not exist or is not `kind='raw'`.
+ * Throws if the row does not exist or is not `kind='raw'`. Returns the archived_at it wrote.
  */
-export declare function archiveRawMemory(db: DatabaseSyncLike, id: string, opts: ArchiveOpts): void;
+export declare function archiveRawMemory(db: DatabaseSyncLike, id: string, opts: ArchiveOpts): string;
 //# sourceMappingURL=raw-archive.d.ts.map

package/dist/raw-archive.js

@@ -34,6 +34,7 @@ function moveRowToArchive(db, id, row, opts) {
     // Archived text must be unsearchable at commit, so a failed purge fails (and rolls back) the whole archive.
     if (isFtsAvailable(db))
         db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(id);
+    return archivedAt;
 }
 // Emit the archive_raw audit event inside the SAVEPOINT so the audit row is
 // committed atomically with the row deletion. Use the row's own tenant_id
@@ -62,14 +63,14 @@ function auditArchive(db, id, row, opts) {
  * append-only trigger lets the delete through, then deletes the row. All in one
  * write scope, which nests inside an outer transaction (e.g. batchWriteAndDelete).
  *
- * Throws if the row does not exist or is not `kind='raw'`.
+ * Throws if the row does not exist or is not `kind='raw'`. Returns the archived_at it wrote.
  */
 export function archiveRawMemory(db, id, opts) {
     const row = loadRawRow(db, id);
     // A SAVEPOINT when already inside a transaction (e.g. batchWriteAndDelete), so a throw here
     // rolls back only this archive.
-    withWriteScope(db, 'archive_raw', () => {
-        moveRowToArchive(db, id, row, opts);
+    return withWriteScope(db, 'archive_raw', () => {
+        const archivedAt = moveRowToArchive(db, id, row, opts);
         auditArchive(db, id, row, opts);
         // Archiving a child under a level-2 summary marks the parent dirty, inside the
         // SAVEPOINT so the dirty-mark commits atomically with the archive.
@@ -84,6 +85,7 @@ export function archiveRawMemory(db, id, opts) {
         if (opts.afterArchive) {
             opts.afterArchive(db, id);
         }
+        return archivedAt;
     });
 }
 //# sourceMappingURL=raw-archive.js.map

package/dist/recall-scope.d.ts

@@ -60,6 +60,8 @@ export declare function assertClientScope(scope: string | null | undefined): voi
 export declare function canTouchScope(actor: {
     owner?: string;
 }, scope: string | null): boolean;
+/** canTouchScope for a caller known by its own personal scope, as a store method receives it. */
+export declare function ownScopeTouches(ownScope: string | null, scope: string | null): boolean;
 /**
  * Recall-side scope filter — the canonical JS half of the recall default-deny
  * rule (the SQL half lives in `loadSearchRows` via `loadRecallSearchEntries`).
@@ -68,11 +70,6 @@ export declare function canTouchScope(actor: {
  * - When `requested` is undefined/empty: default-deny on any
  *   `<source>:private:*` scope and on the `RECALL_DEFAULT_DENY_SCOPES`
  *   quarantine buckets. `null` and public scopes pass, and so does `ownScope`, the caller's own personal scope.
- *
- * @internal Exported for test parity with
- * `RECALL_DEFAULT_DENY_SCOPES` (single-source-of-truth verification). NOT part
- * of the public API surface; not re-exported from `src/index.ts`. Subject to
- * change without semver bump.
  */
 export declare function passesScopeFilterForRecall(scope: string | null, requested: string | undefined, ownScope?: string | null): boolean;
 export interface SqlFragment {

package/dist/recall-scope.js

@@ -83,7 +83,11 @@ export function assertClientScope(scope) {
 }
 /** True when `actor` may change or delete a row in `scope`: any non-personal scope, or its own personal one. */
 export function canTouchScope(actor, scope) {
-    return !isPersonalScope(scope) || scope === personalScopeOf(actor);
+    return ownScopeTouches(personalScopeOf(actor), scope);
+}
+/** canTouchScope for a caller known by its own personal scope, as a store method receives it. */
+export function ownScopeTouches(ownScope, scope) {
+    return !isPersonalScope(scope) || scope === ownScope;
 }
 /**
  * Recall-side scope filter — the canonical JS half of the recall default-deny
@@ -93,11 +97,6 @@ export function canTouchScope(actor, scope) {
  * - When `requested` is undefined/empty: default-deny on any
  *   `<source>:private:*` scope and on the `RECALL_DEFAULT_DENY_SCOPES`
  *   quarantine buckets. `null` and public scopes pass, and so does `ownScope`, the caller's own personal scope.
- *
- * @internal Exported for test parity with
- * `RECALL_DEFAULT_DENY_SCOPES` (single-source-of-truth verification). NOT part
- * of the public API surface; not re-exported from `src/index.ts`. Subject to
- * change without semver bump.
  */
 export function passesScopeFilterForRecall(scope, requested, ownScope) {
     if (requested !== undefined && requested !== '') {

package/dist/server/routes/admin.js

@@ -44,7 +44,7 @@ export async function handleCreateAuthKey({ req, res, opts }) {
     // bound to the caller's authenticated tenant (ctx.tenantId, resolved
     // from the Bearer token). Forwarding body.tenantId here would let
     // tenant A mint a key for tenant B — see authCreate doc comment.
-    const result = authCreate(ctx, {
+    const result = await authCreate(ctx, {
         label: labelRaw,
         role,
     });
@@ -68,7 +68,7 @@ export async function handleListAuthKeys({ req, res, opts, query }) {
     const limit = parseListLimit(query.get('limit'), MAX_AUTH_KEYS_PAGE, MAX_AUTH_KEYS_PAGE);
     const after = parseCursor(query.get('cursor'), 'integer', 'integer');
     const ctx = await buildContextWithAuth(req, opts);
-    const page = pageOf(authListRows(ctx, { active, limit: limit + 1, after }), limit, (r) => ({ key: r.rowId, id: r.rowId }));
+    const page = pageOf(await authListRows(ctx, { active, limit: limit + 1, after }), limit, (r) => ({ key: r.rowId, id: r.rowId }));
     setNextCursorHeader(res, page.nextCursor);
     sendJson(res, 200, page.items.map((r) => r.key));
     return;

package/dist/server/routes/memories.js

@@ -29,7 +29,7 @@ export async function handleCreateMemory({ req, res, opts }) {
     if (personalRaw !== undefined && !isJsonBoolean(personalRaw)) {
         throw new HttpError(400, 'personal must be a boolean');
     }
-    const result = remember(ctx, {
+    const result = await remember(ctx, {
         content,
         kind: kindRaw,
         scope: getString(body, 'scope'),
@@ -69,7 +69,7 @@ export async function handleArchiveMemory({ req, res, opts }, archiveMatch) {
     if (!reason) {
         throw new HttpError(400, 'reason is required');
     }
-    const result = archiveRaw(ctx, archiveMatch.id, reason);
+    const result = await archiveRaw(ctx, archiveMatch.id, reason);
     sendJson(res, 200, result);
     return;
 }
@@ -81,7 +81,7 @@ export async function handleSupersedeMemory({ req, res, opts }, supersedeMatch)
     if (!content) {
         throw new HttpError(400, 'content is required');
     }
-    const result = supersede(ctx, supersedeMatch.id, content);
+    const result = await supersede(ctx, supersedeMatch.id, content);
     sendJson(res, 200, result);
     return;
 }
@@ -95,7 +95,7 @@ export async function handlePromoteMemory({ req, res, opts }, promoteMatch) {
 export async function handleForgetMemory({ req, res, opts }, idMatch) {
     validateIdSegment(idMatch.id, 'memory id');
     const ctx = await buildContextWithAuth(req, opts);
-    const result = forget(ctx, idMatch.id);
+    const result = await forget(ctx, idMatch.id);
     sendJson(res, 200, result);
     return;
 }
@@ -132,11 +132,14 @@ export async function handleApplyOutcome({ req, res, opts }) {
         ids = idsRaw;
     }
     if (ids !== undefined) {
-        const { applied } = outcome(ctx, ids, good);
+        const { applied } = await outcome(ctx, ids, good);
         sendJson(res, 200, { applied });
     }
     else {
-        const result = outcomeForLastRecall(ctx, good);
+        // The last recall's ids live in hippo.db alone, so a client of another store must send the ids its recall returned.
+        if (ctx.store !== undefined && ctx.store.kind !== 'sqlite')
+            throw new HttpError(501, 'this store keeps no last recall: send the ids your recall returned');
+        const result = await outcomeForLastRecall(ctx, good);
         sendJson(res, 200, result);
     }
     return;

package/dist/server-detect.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync, writeFileSync, unlinkSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
+import { envHealthProbeMs } from './env.js';
 // Pidfile sits directly inside hippoRoot. `hippoRoot` is the `.hippo`
 // directory itself (the same convention used by api.ts / store.ts /
 // openHippoDb), so this resolves to `${hippoRoot}/server.pid`.
@@ -8,7 +9,7 @@ const PIDFILE = 'server.pid';
  * How long detectServer waits for the `/health` liveness probe before
  * treating the pidfile as stale. Short by design: the probe only fires on
  * the rare path where a pidfile exists and its pid is live, and the target
- * is always loopback, so a healthy server answers well within this bound.
+ * is always loopback, so a healthy server answers well within this bound. HIPPO_HEALTH_PROBE_MS overrides it.
  */
 const HEALTH_PROBE_TIMEOUT_MS = 300;
 /**
@@ -84,7 +85,7 @@ async function healthMatchesPidfile(hippoRoot, info) {
     // returns null WITHOUT unlinking. The pidfile survives for the next probe.
     try {
         const res = await fetch(`${info.url}/health`, {
-            signal: AbortSignal.timeout(HEALTH_PROBE_TIMEOUT_MS),
+            signal: AbortSignal.timeout(envHealthProbeMs() ?? HEALTH_PROBE_TIMEOUT_MS),
         });
         if (!res.ok || !res.body) {
             removePidfile(hippoRoot);

package/dist/server.d.ts

@@ -11,8 +11,14 @@ export { HttpError } from './http-util.js';
 export { promptHookContext, type CallerProject } from './prompt-hook.js';
 export type { JsonValue } from './json.js';
 export { captureSessionTexts, type SessionCaptureRequest, type SessionCaptureResult } from './capture/session-texts.js';
-export { hasGroup, sqliteStore, type HippoStore, type KeyAudit, type KeyRevoke, type RecallSearchArgs, type RecallWrites, type StoreGroup, type StoreGroups, type VectorReads, } from './store-port.js';
-export type { ApiKeyRecord } from './auth.js';
+export { hasGroup, sqliteStore, type AmbientCandidateRequest, type ContextReads, type EntryRemoval, type EntryTarget, type EntryWrite, type EntryWrites, type HippoStore, type KeyAudit, type KeyListQuery, type KeyMint, type KeyRevoke, type KeyWrites, type OutcomeWrite, type RawArchive, type RecallSearchArgs, type RecallWrites, type SelfKeyMint, type StoreGroup, type StoreGroups, type SupersedeWrite, type VectorReads, type VectorBackfillQuery, type VectorRowWrite, type VectorWrite, type VectorWriteResult, type VectorWrites, } from './store-port.js';
+export { entryAfterOutcome } from './memory.js';
+export { rejectionDigest, RejectedValueError } from './rejection.js';
+export { ownScopeTouches } from './recall-scope.js';
+export { BadRequestError, ConflictError } from './api-errors.js';
+export type { HippoDbContext, StoreReply } from './api/types.js';
+export type { ApiKeyListItem, ApiKeyListRow, ApiKeyRecord, ListApiKeysOpts, NewApiKey } from './auth.js';
+export type { KeysetPosition } from './keyset.js';
 export type { AppendAuditOpts, AuditEvent, ListAuditAfterOpts } from './audit.js';
 export type { ContinuityBlock } from './api/recall-types.js';
 export type { ActiveGoals, GetActiveGoalsOpts, Goal, GoalRecallLogRow, RetrievalPolicy } from './goals.js';
@@ -23,12 +29,22 @@ export type { RecallTraceInput } from './recall-trace.js';
 export type { StrengthenOptions } from './store/entry-writes.js';
 export type { OriginFilter, RecallScopeFilter, VectorCandidateSpec } from './store/search-rows.js';
 export type { ContinuityKey } from './store/sessions.js';
+export type { SessionEvent, TaskSnapshot } from './store/rows.js';
+export type { SessionHandoff } from './handoff.js';
+export type { AmbientLoadResult, AmbientRecallRequest, ContextCandidateFilter, RecentOrigins } from './store/candidates.js';
+export type { AmbientStoreFilter } from './ambient-store.js';
+export type { AmbientTallies } from './ambient.js';
 export type { TokenUse } from './token-ledger.js';
 export type { EmbeddingIndexState } from './embeddings.js';
 export type { PhysicsParticle } from './physics.js';
 export { StoreBusyError } from './db.js';
-export { decodeVector, EMBEDDING_MODEL_META_KEY, rankVectorRows, type VectorMatch, type VectorRow } from './vector-store.js';
-export { bufferToFloat32 } from './physics-state.js';
+export { decodeVector, EMBEDDING_MODEL_META_KEY, encodeVector, rankVectorRows, type VectorMatch, type VectorRow } from './vector-store.js';
+export { bufferToFloat32, float32ToBuffer } from './physics-state.js';
+export { replacesIndex } from './embeddings.js';
+export { passesScopeFilterForRecall, RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
+export { SECRET_TAGS } from './secret-detect.js';
+export { tallyAmbientEntries } from './ambient.js';
+export { ftsTermParts, rarestFtsQuery } from './prompt-recall.js';
 export { OTHER_STORE_MARKER, OtherStoreFolderError, withSqliteAllowed } from './db.js';
 export { authCreate, type AuthCreateOpts, type AuthCreateResult } from './api.js';
 export { isSharedStore } from './config.js';

package/dist/server.js

@@ -47,10 +47,22 @@ export { promptHookContext } from './prompt-hook.js';
 export { captureSessionTexts } from './capture/session-texts.js';
 // An add-on serves from another database by passing serve() its own HippoStore.
 export { hasGroup, sqliteStore, } from './store-port.js';
+// An add-on store's entry writes apply an outcome, guard tombstones and check reach exactly as hippo.db does.
+export { entryAfterOutcome } from './memory.js';
+export { rejectionDigest, RejectedValueError } from './rejection.js';
+export { ownScopeTouches } from './recall-scope.js';
+export { BadRequestError, ConflictError } from './api-errors.js';
 export { StoreBusyError } from './db.js';
-// An add-on store decodes and ranks with hippo.db's own code, so both return the same ids in the same order.
-export { decodeVector, EMBEDDING_MODEL_META_KEY, rankVectorRows } from './vector-store.js';
-export { bufferToFloat32 } from './physics-state.js';
+// An add-on store encodes, decodes and ranks vectors and particles with hippo.db's own code, and drops the index by its rule,
+// so both stores keep the same bytes and return the same ids in the same order.
+export { decodeVector, EMBEDDING_MODEL_META_KEY, encodeVector, rankVectorRows } from './vector-store.js';
+export { bufferToFloat32, float32ToBuffer } from './physics-state.js';
+export { replacesIndex } from './embeddings.js';
+// An add-on's ContextReads applies hippo.db's scope, secret, tally and rarest-term rules with the same code.
+export { passesScopeFilterForRecall, RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
+export { SECRET_TAGS } from './secret-detect.js';
+export { tallyAmbientEntries } from './ambient.js';
+export { ftsTermParts, rarestFtsQuery } from './prompt-recall.js';
 // store copy --db writes the marker and reads the old hippo.db under the waiver.
 export { OTHER_STORE_MARKER, OtherStoreFolderError, withSqliteAllowed } from './db.js';
 // An add-on's install step mints the first admin key into a store folder it names, which `hippo auth create` cannot reach.
@@ -96,20 +108,20 @@ const VERSION = PACKAGE_VERSION;
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
 /** The /v1 routes in dispatch order; the first entry whose method and path match handles the request. */
 const V1_ROUTES = [
-    { method: 'POST', path: '/v1/memories', handler: handleCreateMemory },
+    { method: 'POST', path: '/v1/memories', storeReady: 'entryWrites', handler: handleCreateMemory },
     { method: 'GET', path: '/v1/graph', handler: handleGetGraph },
     { method: 'GET', path: '/v1/memories', storeReady: 'base', handler: handleRecallMemories },
     { method: 'GET', pattern: '/v1/sessions/:id/assemble', handler: handleAssembleSession },
     { method: 'GET', pattern: '/v1/recall/drill/:id', handler: handleDrillRecall },
-    { method: 'POST', pattern: '/v1/memories/:id/archive', handler: handleArchiveMemory },
-    { method: 'POST', pattern: '/v1/memories/:id/supersede', handler: handleSupersedeMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/archive', storeReady: 'entryWrites', handler: handleArchiveMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/supersede', storeReady: 'entryWrites', handler: handleSupersedeMemory },
     { method: 'POST', pattern: '/v1/memories/:id/promote', handler: handlePromoteMemory },
-    { method: 'DELETE', pattern: '/v1/memories/:id', handler: handleForgetMemory },
-    { method: 'POST', path: '/v1/outcome', handler: handleApplyOutcome },
-    { method: 'GET', path: '/v1/context', handler: handleGetContext },
+    { method: 'DELETE', pattern: '/v1/memories/:id', storeReady: 'entryWrites', handler: handleForgetMemory },
+    { method: 'POST', path: '/v1/outcome', storeReady: 'entryWrites', handler: handleApplyOutcome },
+    { method: 'GET', path: '/v1/context', storeReady: 'contextReads', handler: handleGetContext },
     { method: 'POST', path: '/v1/sleep', handler: handleSleep },
-    { method: 'POST', path: '/v1/auth/keys', handler: handleCreateAuthKey },
-    { method: 'GET', path: '/v1/auth/keys', handler: handleListAuthKeys },
+    { method: 'POST', path: '/v1/auth/keys', storeReady: 'keyWrites', handler: handleCreateAuthKey },
+    { method: 'GET', path: '/v1/auth/keys', storeReady: 'keyWrites', handler: handleListAuthKeys },
     { method: 'DELETE', pattern: '/v1/auth/keys/:keyId', storeReady: 'keyAudit', handler: handleRevokeAuthKey },
     { method: 'GET', path: '/v1/quarantine', handler: handleListQuarantine },
     { method: 'POST', pattern: '/v1/quarantine/:id/approve', handler: handleApproveQuarantine },

package/dist/store/audit-event.d.ts

@@ -11,7 +11,7 @@ export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, t
 /**
  * Refusal audit for the rejected-value guard. Written by the
  * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and api.supersede's
+ * there, so this lands in a fresh implicit transaction) and commitSupersede's
  * catch (after its own ROLLBACK) — never inside a scope the caller's own
  * rollback could claw back. Best-effort `audit()` semantics: never throws.
  */

package/dist/store/audit-event.js

@@ -23,7 +23,7 @@ export function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
 /**
  * Refusal audit for the rejected-value guard. Written by the
  * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and api.supersede's
+ * there, so this lands in a fresh implicit transaction) and commitSupersede's
  * catch (after its own ROLLBACK) — never inside a scope the caller's own
  * rollback could claw back. Best-effort `audit()` semantics: never throws.
  */

package/dist/store/entry-writes-group.d.ts

@@ -0,0 +1,9 @@
+import { type DatabaseSyncLike } from '../db.js';
+import type { EntryWrites, SupersedeWrite } from '../store-port.js';
+/** Each call on its own handle; mirrors and the forgotten counter follow the commit, so a rolled-back write leaves neither. */
+export declare function sqliteEntryWrites(hippoRoot: string): EntryWrites;
+/** Reach, the CAS on the old row, the successor's insert and the supersede row in one BEGIN IMMEDIATE transaction. Two racing supersedes: one CAS wins. */
+export declare function commitSupersede(db: DatabaseSyncLike, write: SupersedeWrite): void;
+/** A mirror left on disk would bring the archived row back on the next import; on failure the reaper retries, as mirror_cleaned_at stays NULL. */
+export declare function cleanArchivedMirrors(db: DatabaseSyncLike, hippoRoot: string, id: string): void;
+//# sourceMappingURL=entry-writes-group.d.ts.map