hippo-memory 1.68.0 → 1.70.0

package/dist/api/on-store.d.ts

@@ -0,0 +1,16 @@
+import type { HippoStore, StoreGroups } from '../store/port.js';
+import { type SqliteLocal } from '../store/sqlite/local.js';
+import { type SqliteSyncStore } from '../store/sqlite/store.js';
+import type { Context, StoreReply } from './types.js';
+/** What a port call answers: a Promise from a served store, the value itself from hippo.db. */
+export type Reply<T> = T | Promise<T>;
+/** The port one body is written against: a served store, or hippo.db answering the same methods at once. */
+export type StorePort = HippoStore | SqliteSyncStore;
+/** `next` on the reply's value, at once for a value, so hippo.db's path never becomes a Promise. */
+export declare function andThen<T, U>(reply: Reply<T>, next: (value: T) => Reply<U>): Reply<U>;
+/** Stands in for a group the store lacks, as `port.keyAudit ?? notPorted(port, 'keyAudit')`; it answers 501 as any unported path does. */
+export declare function notPorted(port: StorePort, group: keyof StoreGroups): never;
+/** Runs `run` on `ctx.store`, where a throw rejects, else on hippo.db under `ctx.hippoRoot`, where it throws. The store path never reads `hippoRoot`.
+ *  `local` runs what needs hippo.db's own handle or meta table; a served store refuses it, or does without where the write allows. */
+export declare function onStore<C extends Context, R>(ctx: C, run: (port: StorePort, local: SqliteLocal) => Reply<R>): StoreReply<C, R>;
+//# sourceMappingURL=on-store.d.ts.map

package/dist/api/on-store.js

@@ -0,0 +1,36 @@
+// The one place an api function picks between a served store and hippo.db, so each operation has one body.
+// Only functions published as StoreReply use this carrier (see "Sync core, async port" in docs/ARCHITECTURE.md);
+// a new operation is async and goes through storeFor(ctx).
+import { SqliteBlockedError, StoreNotPortedError } from '../util/sqlite-blocked.js';
+import { REFUSED_ON_A_STORE, sqliteLocal } from '../store/sqlite/local.js';
+import { sqliteSyncStore } from '../store/sqlite/store.js';
+/** `next` on the reply's value, at once for a value, so hippo.db's path never becomes a Promise. */
+export function andThen(reply, next) {
+    return reply instanceof Promise ? reply.then(next) : next(reply);
+}
+/** Stands in for a group the store lacks, as `port.keyAudit ?? notPorted(port, 'keyAudit')`; it answers 501 as any unported path does. */
+export function notPorted(port, group) {
+    throw new StoreNotPortedError(port.kind, group);
+}
+/** A served store's stand-in for SqliteLocal. The last recall sits in hippo.db's meta table, so only a store that is hippo.db keeps and reads it, on `hippoRoot`. */
+function servedLocal(store, hippoRoot) {
+    if (store.kind === 'sqlite')
+        return { ...sqliteLocal(hippoRoot), ...REFUSED_ON_A_STORE };
+    return {
+        ...REFUSED_ON_A_STORE,
+        applyOutcomeToLastRecall() {
+            throw new SqliteBlockedError(store.kind);
+        },
+        finishLastRecall: (writes) => store.finishRecall(writes),
+    };
+}
+/** Runs `run` on `ctx.store`, where a throw rejects, else on hippo.db under `ctx.hippoRoot`, where it throws. The store path never reads `hippoRoot`.
+ *  `local` runs what needs hippo.db's own handle or meta table; a served store refuses it, or does without where the write allows. */
+export function onStore(ctx, run) {
+    const { store } = ctx;
+    // No await before `run`: an add-on relies on the first port call starting inside this call.
+    const reply = store ? (async () => run(store, servedLocal(store, ctx.hippoRoot)))() : run(sqliteSyncStore(ctx.hippoRoot), sqliteLocal(ctx.hippoRoot));
+    // SAFETY: the store path is an async function's Promise and hippo.db's port calls answer values, so the Promise comes back exactly when ctx has a store, as StoreReply says.
+    return reply;
+}
+//# sourceMappingURL=on-store.js.map

package/dist/api/outcome.d.ts

@@ -1,56 +1,19 @@
-import type { Context } from './types.js';
-/**
- * Apply a positive/negative outcome to a list of recently-recalled memory ids.
- * Used by the MCP `hippo_outcome` tool and the HTTP `POST /v1/outcome` route.
- * Tenant-scoped: ids outside ctx.tenantId, or in someone else's personal scope, are silently skipped
- * (matches the prior MCP semantics — a stale id from another tenant doesn't
- * crash the call). Each successful outcome emits one audit_log row with
- * op='outcome' tagged with ctx.actor.subject.
- *
- * Returns `{applied, appliedIds}`. `appliedIds` is the tenant-filtered subset
- * of input ids that actually had `applyOutcome` run on them (i.e. ids found
- * in ctx.tenantId). Callers that surface the id list
- * over a multi-tenant boundary (HTTP /v1/outcome last-recall path, Python SDK)
- * MUST return `appliedIds` instead of the raw input list — otherwise the
- * non-applied (cross-tenant) ids leak to the caller.
- *
- * `opts.traceId`:
- * OPTIONAL additive opt so a programmatic caller can link this outcome to
- * the recall_traces row it judges. NOT applied unconditionally — an SDK
- * caller passing explicit ids with no preceding CLI/context recall would
- * otherwise get linked to a stale, unrelated trace. `outcomeForLastRecall`
- * supplies this automatically from `last_trace_id`; every other caller
- * (server.ts explicit-ids path, MCP hippo_outcome) omits it and gets no
- * linkage, which is correct.
- */
+import type { Context, StoreReply } from './types.js';
+/** An id outside ctx.tenantId, or in someone else's personal scope, is skipped, so a stale id never fails the call.
+ *  `appliedIds` holds only the ids applied: a caller that answers across tenants returns it, never the ids it was sent. */
 export interface OutcomeResult {
     applied: number;
     appliedIds: string[];
 }
-export declare function outcome(ctx: Context, ids: ReadonlyArray<string>, good: boolean, opts?: {
+/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
+export declare function outcome<C extends Context>(ctx: C, ids: ReadonlyArray<string>, good: boolean, opts?: {
     traceId?: number;
-}): OutcomeResult;
-/**
- * Apply an outcome to the ids most recently returned by `recall()`.
- *
- * Reads `loadIndex(ctx.hippoRoot).last_retrieval_ids` (per-hippoRoot local
- * state; not tenant-scoped at the index layer) and forwards to `outcome()`,
- * which DOES tenant-filter its read by `ctx.tenantId`. Cross-tenant
- * ids in `last_retrieval_ids` are silently skipped, matching the MCP
- * `hippo_outcome` semantics.
- *
- * **Tenant-safe response shape:** the returned `ids`
- * field contains ONLY the tenant-filtered subset that actually had outcomes
- * applied (i.e. `appliedIds` from the inner `outcome()` call). It lives in this
- * helper so every caller (CLI, HTTP /v1/outcome, MCP) inherits the contract.
- *
- * Do NOT tighten `loadIndex` with `tenantId` inside this helper — doing so
- * would break the (correct) cross-tenant-silent-skip behavior covered by
- * the test in `tests/api-outcome-for-last-recall.test.ts`.
- */
+}): StoreReply<C, OutcomeResult>;
+/** The last recall's ids and its trace sit in hippo.db's meta table, which only the CLI and context write, so a store of another kind is refused.
+ *  `ids` holds only the ids applied in ctx.tenantId: the index is not tenant-scoped, so the ids read from it are never returned. */
 export interface OutcomeForLastRecallResult {
     applied: number;
     ids: string[];
 }
-export declare function outcomeForLastRecall(ctx: Context, good: boolean): OutcomeForLastRecallResult;
+export declare function outcomeForLastRecall<C extends Context>(ctx: C, good: boolean): StoreReply<C, OutcomeForLastRecallResult>;
 //# sourceMappingURL=outcome.d.ts.map

package/dist/api/outcome.js

@@ -1,63 +1,21 @@
 // Outcome feedback on recalled memories.
-import { closeHippoDb } from '../db.js';
-import { openStore } from '../store/open.js';
-import { writeEntryOn } from '../store/entry-writes.js';
-import { selectEntriesByIds } from '../store/entry-reads.js';
-import { loadIndex } from '../store/index-and-stats.js';
-import { applyOutcome, CHURN_STALE_TAG } from '../memory.js';
-import { appendAuditEvent } from '../audit.js';
-import { recordTraceOutcome } from '../recall-trace.js';
-import { canTouchScope } from '../recall-scope.js';
+import { personalScopeOf } from '../store/recall-scope.js';
+import { andThen, notPorted, onStore } from './on-store.js';
+/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
 export function outcome(ctx, ids, good, opts) {
-    const appliedIds = [];
-    const db = openStore(ctx.hippoRoot);
-    try {
-        const live = selectEntriesByIds(db, ids, ctx.tenantId);
-        for (const id of ids) {
-            const entry = live.get(id);
-            if (!entry || !canTouchScope(ctx.actor, entry.scope ?? null))
-                continue;
-            let updated = applyOutcome(entry, good);
-            if (good && updated.tags.includes(CHURN_STALE_TAG)) { // a good outcome reconfirms the entry
-                updated = { ...updated, tags: updated.tags.filter((t) => t !== CHURN_STALE_TAG) };
-            }
-            writeEntryOn(db, ctx.hippoRoot, updated, { actor: ctx.actor.subject });
-            live.set(id, updated); // a repeated id builds on its first outcome, as a fresh read would
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'outcome',
-                targetId: id,
-                metadata: { good },
-            });
-            appliedIds.push(id);
-        }
-        // Link the outcome to its trace, recording only the ids actually
-        // credited (post tenant-filtering, matches appliedIds). Lives in its own
-        // append-only table so audit_log pruning can never erase training data.
-        if (opts?.traceId !== undefined && appliedIds.length > 0) {
-            recordTraceOutcome(db, {
-                traceId: opts.traceId,
-                tenantId: ctx.tenantId,
-                outcome: good ? 'positive' : 'negative',
-                memoryIds: appliedIds,
-            });
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    return { applied: appliedIds.length, appliedIds };
+    return onStore(ctx, (port, local) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
+        const traceId = opts?.traceId;
+        // The trace link is written on hippo.db's own handle after the commit, so a served store refuses a traceId.
+        const applied = traceId === undefined ? entryWrites.applyOutcome(write) : local.applyOutcome(write, traceId);
+        return andThen(applied, (appliedIds) => ({ applied: appliedIds.length, appliedIds }));
+    });
 }
 export function outcomeForLastRecall(ctx, good) {
-    const idx = loadIndex(ctx.hippoRoot);
-    const ids = idx.last_retrieval_ids;
-    if (ids.length === 0)
-        return { applied: 0, ids: [] };
-    // Same `loadIndex` snapshot as the ids; buildIndexFromDb already strict-parses it to a
-    // positive-integer string or null, so no trace_id=0/NaN reaches outcome().
-    const traceId = idx.last_trace_id !== null ? Number(idx.last_trace_id) : null;
-    const { applied, appliedIds } = outcome(ctx, ids, good, traceId !== null ? { traceId } : undefined);
-    return { applied, ids: appliedIds };
+    return onStore(ctx, (_port, local) => {
+        const ids = local.applyOutcomeToLastRecall({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
+        return { applied: ids.length, ids };
+    });
 }
 //# sourceMappingURL=outcome.js.map

package/dist/{pilot-arm.d.ts → api/pilot-arm.d.ts}

@@ -1,4 +1,4 @@
-import { type DatabaseSyncLike } from './db.js';
+import { type DatabaseSyncLike } from '../db/index.js';
 import { type LedgerRootOpts } from './ledger-db.js';
 export type PilotArm = 'hippo' | 'holdout';
 export interface SessionArmOpts extends LedgerRootOpts {

package/dist/{pilot-arm.js → api/pilot-arm.js}

@@ -1,10 +1,12 @@
 // Pilot arm: one token_ledger row per session names its arm, `hippo` or `holdout`, so a pilot can compare them.
 // `items` holds the holdout rate in basis points; readers outside this repo depend on these rows, so their shape is fixed.
 import { createHash } from 'node:crypto';
-import { loadConfig } from './config.js';
-import { execWithBusyRetry, HOOK_DB_WAIT_MS, scopedBusyWait } from './db.js';
+import { loadConfig } from '../core/config.js';
+import { HOOK_DB_WAIT_MS, scopedBusyWait, withWriteScope } from '../db/index.js';
 import { ledgerRoot, withLedgerDb } from './ledger-db.js';
-import { recordTokenUse } from './token-ledger.js';
+import { errorMessage, log } from '../util/log.js';
+import { firstPilotArmHash } from '../store/token-ledger-rows.js';
+import { recordTokenUse } from '../store/token-ledger.js';
 /** Deterministic split: the same session and rate always land in the same arm. */
 export function hashArm(sessionId, rateBp) {
     const bucket = parseInt(createHash('sha256').update(sessionId).digest('hex').slice(0, 8), 16) % 10000;
@@ -12,10 +14,7 @@ export function hashArm(sessionId, rateBp) {
 }
 /** The session's first stored arm, or null; never writes. Without `tenantId` any tenant's row counts, since on one machine a session has one arm. */
 export function readPilotArm(db, sessionId, tenantId) {
-    const params = tenantId === undefined ? [sessionId] : [sessionId, tenantId];
-    // SAFETY: the SELECT names exactly this one column.
-    const row = db.prepare(`SELECT block_hash FROM token_ledger WHERE session_id = ?${tenantId === undefined ? '' : ' AND tenant_id = ?'}
-     AND surface = 'pilot' AND event = 'arm' ORDER BY id LIMIT 1`).get(...params);
+    const row = firstPilotArmHash(db, sessionId, tenantId);
     return row?.block_hash === 'holdout' || row?.block_hash === 'hippo' ? row.block_hash : null;
 }
 /** The stored arm, else the hash arm written once; on any error the hash arm comes back unrecorded. */
@@ -23,29 +22,22 @@ export function readPilotArm(db, sessionId, tenantId) {
 export function ensurePilotArm(db, tenantId, sessionId, rateBp, opts = {}) {
     const hashed = hashArm(sessionId, rateBp);
     const readTenant = opts.ownTenantOnly ? tenantId : undefined;
-    let began = false;
     try {
         // A stored row is the common case after the first prompt, so it must not take the write lock.
         const existing = readPilotArm(db, sessionId, readTenant);
         if (existing !== null)
             return existing;
-        execWithBusyRetry(db, 'BEGIN IMMEDIATE', scopedBusyWait() ?? HOOK_DB_WAIT_MS);
-        began = true;
-        const stored = readPilotArm(db, sessionId, readTenant);
-        if (stored === null) {
-            recordTokenUse(db, { tenantId, sessionId, surface: 'pilot', event: 'arm', items: rateBp, tokens: 0, hash: hashed, now: opts.now });
-        }
-        db.exec('COMMIT');
-        return stored ?? hashed;
+        return withWriteScope(db, 'pilot_arm', () => {
+            const stored = readPilotArm(db, sessionId, readTenant);
+            if (stored === null) {
+                recordTokenUse(db, { tenantId, sessionId, surface: 'pilot', event: 'arm', items: rateBp, tokens: 0, hash: hashed, now: opts.now });
+            }
+            return stored ?? hashed;
+        }, { busyWaitMs: scopedBusyWait() ?? HOOK_DB_WAIT_MS });
     }
-    catch {
+    catch (err) {
         // A prompt hook must not fail on pilot bookkeeping; concurrent callers still agree on the hash arm.
-        if (began) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* keep the hash arm */ }
-        }
+        log.debug(`pilot arm not stored, using the hash arm: ${errorMessage(err)}`);
         return hashed;
     }
 }

package/dist/api/promote.d.ts

@@ -1,5 +1,5 @@
-import { type DatabaseSyncLike } from '../db.js';
-import type { Context } from './types.js';
+import type { ConnectorEvent } from '../store/port.js';
+import type { Context, StoreReply } from './types.js';
 /**
  * Copy a local memory into the global store. Mirrors `cmdPromote` in cli.ts:
  * the `writeEntry` inside `promoteToGlobal` emits a 'remember' on the global
@@ -26,26 +26,15 @@ export interface SupersedeResult {
     oldId: string;
     newId: string;
 }
-export declare function supersede(ctx: Context, oldId: string, newContent: string): SupersedeResult;
-/**
- * Archive a kind='raw' memory: snapshot into raw_archive, mark archived, delete.
- *
- * `archiveRawMemory` audits the operation internally (op='archive_raw') using the
- * row's own tenant_id. We DO NOT emit a second audit event here to avoid double-
- * emitting the archive_raw op. Instead we pass `ctx.actor.subject` through as `who`,
- * and raw-archive.ts uses that for the audit row.
- */
+export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string): StoreReply<C, SupersedeResult>;
+/** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is deleted. The store writes the one archive_raw audit row, under the caller's subject. */
 export interface ArchiveRawOpts {
-    /**
-     * Connector idempotency hook. Runs inside the same
-     * SAVEPOINT as the archive — throwing rolls the archive back. Used by the
-     * Slack deletion connector to mark the deletion event seen atomically.
-     */
-    afterArchive?: (db: DatabaseSyncLike, archivedMemoryId: string) => void;
+    /** The connector event this archive answers. The store logs it in the archive's own transaction, so a redelivery finds it logged. */
+    event?: ConnectorEvent;
 }
 export interface ArchiveRawResult {
     ok: true;
     archivedAt: string;
 }
-export declare function archiveRaw(ctx: Context, id: string, reason: string, opts?: ArchiveRawOpts): ArchiveRawResult;
+export declare function archiveRaw<C extends Context>(ctx: C, id: string, reason: string, opts?: ArchiveRawOpts): StoreReply<C, ArchiveRawResult>;
 //# sourceMappingURL=promote.d.ts.map

package/dist/api/promote.js

@@ -1,22 +1,13 @@
 // Promote to the global store, supersede with a successor, and archive raw memories.
-import { openHippoDb, closeHippoDb, isSqliteBusy } from '../db.js';
-import { ConflictError, NotFoundError } from '../api-errors.js';
-import { auditRejectionRefusal } from '../store/audit-event.js';
+import { openHippoDb, closeHippoDb } from '../db/index.js';
+import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { removeEntryMirrors } from '../store/mirrors.js';
-import { writeEntryDbOnly, writeEntryMirrors } from '../store/entry-writes.js';
-import { readEntry } from '../store/entry-reads.js';
-import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
-import { markSummaryDirtyInTx } from '../summary-dirty.js';
-import { RejectedValueError } from '../rejection.js';
-import { log } from '../log.js';
-import { createSuccessor } from '../memory.js';
-import { appendAuditEvent } from '../audit.js';
-import { promoteToGlobal } from '../shared.js';
-import { archiveRawMemory } from '../raw-archive.js';
-import { loadConfig } from '../config.js';
+import { createSuccessor } from '../core/memory.js';
+import { promoteToGlobal } from '../sharing/shared.js';
+import { loadConfig } from '../core/config.js';
+import { andThen, notPorted, onStore } from './on-store.js';
 import { selectMemoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope } from '../recall-scope.js';
+import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
 export function promote(ctx, id) {
     // Tenant scope: promoteToGlobal reads the entry from the local root via
     // readEntry without a tenant filter, so a Bearer for tenant A could
@@ -38,51 +29,27 @@ export function promote(ctx, id) {
     const globalEntry = promoteToGlobal(ctx.hippoRoot, id, {
         actor: ctx.actor.subject,
         tenantId: ctx.tenantId,
-        afterWrite: (db, globalId) => appendAuditEvent(db, {
-            tenantId: ctx.tenantId,
-            actor: ctx.actor.subject,
-            op: 'promote',
-            targetId: globalId,
-            metadata: { sourceId: id },
-        }),
+        auditAs: { tenantId: ctx.tenantId, actor: ctx.actor.subject },
     });
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
 export function supersede(ctx, oldId, newContent) {
-    const old = readSupersedable(ctx, oldId);
-    const newEntry = createSuccessor(old, newContent, {
-        tenantId: ctx.tenantId,
-        baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+    return onStore(ctx, (port) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        return andThen(port.entriesByIds([oldId], ctx.tenantId), ([old]) => {
+            const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
+                tenantId: ctx.tenantId,
+                baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+            });
+            // A store writes origin_project as given, so the served folder's fallback is stamped here.
+            const successor = stampOriginProject(ctx.hippoRoot, newEntry);
+            const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor };
+            return andThen(entryWrites.supersede(write), () => ({ ok: true, oldId, newId: successor.id }));
+        });
     });
-    // Race-safe transition: open a fresh db handle, BEGIN IMMEDIATE, run all
-    // three steps (CAS on old + writeEntryDbOnly(new) + supersede audit row)
-    // inside the same transaction. Two concurrent supersedes: exactly one CAS
-    // wins (changes=1), the other gets changes=0 and throws CONFLICT. No
-    // dangling-pointer window: the new memory's row commits atomically with
-    // the old.superseded_by pointer.
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        commitSupersede(db, ctx, oldId, old, newEntry);
-        // Mirrors after COMMIT, while the db handle is still open. Same
-        // invariant as the original writeEntry: a mirror failure leaves disk
-        // MISSING the markdown for the new memory (rebuildIndex rewrites every
-        // markdown mirror from the DB) but DOES NOT desync the DB or
-        // roll back the supersede. Logged + swallowed, non-fatal.
-        try {
-            writeEntryMirrors(ctx.hippoRoot, newEntry);
-        }
-        catch (mirrorErr) {
-            log.error(`supersede: mirror write failed (non-fatal, will self-heal): ${mirrorErr instanceof Error ? mirrorErr.message : String(mirrorErr)}`);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    return { ok: true, oldId, newId: newEntry.id };
 }
 /** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
-function readSupersedable(ctx, oldId) {
-    const old = readEntry(ctx.hippoRoot, oldId, ctx.tenantId);
+function assertSupersedable(ctx, oldId, old) {
     if (!old || !canTouchScope(ctx.actor, old.scope ?? null)) {
         throw new NotFoundError(`Memory not found: ${oldId}`);
     }
@@ -92,104 +59,15 @@ function readSupersedable(ctx, oldId) {
     }
     return old;
 }
-/** CAS on the old row, the successor's insert and the 'supersede' audit row, in one BEGIN IMMEDIATE transaction. */
-function commitSupersede(db, ctx, oldId, old, newEntry) {
-    db.exec('BEGIN IMMEDIATE');
-    try {
-        // The tenant filter repeats readEntry's check at no cost, closing an ownership change between read and update.
-        const result = db.prepare(`
-      UPDATE memories
-      SET superseded_by = ?
-      WHERE id = ? AND tenant_id = ? AND superseded_by IS NULL
-    `).run(newEntry.id, oldId, ctx.tenantId);
-        if ((result.changes ?? 0) === 0) {
-            db.exec('ROLLBACK');
-            throw new ConflictError(`Memory ${oldId} already superseded by another writer`);
-        }
-        // After the CAS guard, so a lost race throws before the old parent is marked for rebuild.
-        if (old.dag_parent_id) {
-            markSummaryDirtyInTx(db, old.dag_parent_id, ctx.tenantId, ctx.actor.subject);
-        }
-        // Emits its own 'remember' audit row inside the same transaction.
-        writeEntryDbOnly(db, stampOriginProject(ctx.hippoRoot, newEntry), { actor: ctx.actor.subject });
-        appendAuditEvent(db, {
-            tenantId: ctx.tenantId,
-            actor: ctx.actor.subject,
-            op: 'supersede',
-            targetId: oldId,
-            metadata: { newId: newEntry.id },
-        });
-        db.exec('COMMIT');
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* already rolled back */ }
-        // The refusal audit lands after ROLLBACK, in a fresh implicit transaction the aborted one cannot undo.
-        if (err instanceof RejectedValueError) {
-            auditRejectionRefusal(db, err, ctx.actor.subject);
-        }
-        throw err;
-    }
-}
 export function archiveRaw(ctx, id, reason, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    let mirrorOk = false;
-    try {
-        // Tenant scope: archiveRawMemory looks up the row by id alone, so a
-        // Bearer for tenant A could archive tenant B's raw row without this
-        // pre-check. Deny cross-tenant access with the same not-found message
-        // archiveRawMemory itself would throw on a missing row, so we don't
-        // leak whether the id exists in another tenant.
-        const reach = selectMemoryReach(db, id);
-        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-            throw new NotFoundError(`memory not found: ${id}`);
-        }
-        archiveRawMemory(db, id, {
-            reason,
-            who: ctx.actor.subject,
-            afterArchive: opts.afterArchive,
-        });
-        // archiveRawMemory deletes the memories row but leaves any legacy markdown
-        // mirror in <root>/{buffer,episodic,semantic}/<id>.md untouched. If we left
-        // the mirror in place, a subsequent initStore() on an empty memories table
-        // would silently re-import the row via bootstrapLegacyStore — defeating the
-        // archive (and the GDPR right-to-be-forgotten promise on raw rows). Mirror
-        // forget() at src/store.ts:1046, which uses the same removeEntryMirrors call.
-        // The DB transaction has already committed; if filesystem unlink fails here
-        // we log and continue. The mirror reaper in openHippoDb will catch it on
-        // next DB open: raw_archive.mirror_cleaned_at stays NULL until every layer
-        // mirror for this id is gone, so the reaper genuinely retries.
-        try {
-            removeEntryMirrors(ctx.hippoRoot, id);
-            mirrorOk = true;
-        }
-        catch (mirrorErr) {
-            log.error(`archiveRaw: mirror cleanup failed for ${id} (will retry via reaper on next openHippoDb): ${mirrorErr instanceof Error ? mirrorErr.message : String(mirrorErr)}`);
-        }
-        if (mirrorOk) {
-            // Stamp mirror_cleaned_at now so the next openHippoDb reaper SELECT
-            // returns empty for this row. NULL stays untouched on failure -> retry.
-            try {
-                db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
-            }
-            catch (err) {
-                if (!isSqliteBusy(err))
-                    throw err;
-                log.warnThenDebug('archive-mirror-stamp-busy', `archived ${id}; the store was busy, so the mirror reaper will re-check it on the next open`);
-            }
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    // Counted here rather than in the CLI: the HTTP archive route calls this too,
-    // so a routed archive would otherwise never reach the forgotten counter.
-    updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
-    // archiveRawMemory does not return the archive_at timestamp it wrote. We
-    // emit a fresh ISO timestamp here for the API response. Within a millisecond
-    // of the actual write, fine for a server response shape.
-    return { ok: true, archivedAt: new Date().toISOString() };
+    return onStore(ctx, (port) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
+        const { event } = opts;
+        const archived = event
+            ? (port.connectorWrites ?? notPorted(port, 'connectorWrites')).archiveConnectorEntry({ ...archive, event })
+            : entryWrites.archiveRaw(archive);
+        return andThen(archived, (archivedAt) => ({ ok: true, archivedAt }));
+    });
 }
 //# sourceMappingURL=promote.js.map

package/dist/{prompt-hook.d.ts → api/prompt-hook.d.ts}

@@ -1,11 +1,11 @@
-import { type Context, type ContextResult, type ContextResultEntry } from './api.js';
-import { type openHippoDb } from './db.js';
-import type { DeliveryRecorder } from './delivery-recorder.js';
-import { type JsonValue } from './json.js';
-import type { MemoryEntry } from './memory.js';
+import { type Context, type ContextResult, type ContextResultEntry } from './index.js';
+import type { DeliveryRecorder } from '../store/delivery-recorder.js';
+import { type JsonValue } from '../util/json.js';
+import type { MemoryEntry } from '../core/memory.js';
 import { type PilotArm } from './pilot-arm.js';
-/** With `db`, writes on the token ledger's handle (same store); without it, opens its own. A second flush is a no-op. */
-export declare function flushDeliveryRecorder(rec: DeliveryRecorder | null, db?: ReturnType<typeof openHippoDb>): void;
+import type { DeliveryWrite } from '../store/ledger-turn.js';
+/** With `write`, stores on the token ledger's connection (same store); without it, opens its own. A second flush is a no-op. */
+export declare function flushDeliveryRecorder(rec: DeliveryRecorder | null, write?: DeliveryWrite): void;
 /** What one render needs once api.getContext has answered. */
 export interface ContextView {
     readonly hippoRoot: string;