hippo-memory 1.69.0 → 1.71.0

package/dist/api/outcome.js

@@ -1,86 +1,21 @@
 // Outcome feedback on recalled memories.
-import { closeHippoDb } from '../db.js';
-import { openStore } from '../store/open.js';
-import { writeEntryOn } from '../store/entry-writes.js';
-import { selectEntriesByIds } from '../store/entry-reads.js';
-import { loadIndex } from '../store/index-and-stats.js';
-import { entryAfterOutcome } from '../memory.js';
-import { appendAuditEvent } from '../audit.js';
-import { recordTraceOutcome } from '../recall-trace.js';
-import { canTouchScope, personalScopeOf } from '../recall-scope.js';
-import { SqliteBlockedError } from '../db/sqlite-blocked.js';
-import { requireGroup } from '../store-port.js';
+import { personalScopeOf } from '../store/recall-scope.js';
+import { andThen, notPorted, onStore } from './on-store.js';
+/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
 export function outcome(ctx, ids, good, opts) {
-    const reply = ctx.store ? outcomeThroughStore(ctx, ctx.store, ids, good, opts) : outcomeOnHippoDb(ctx, ids, good, opts);
-    // SAFETY: a C typed with a store gets the promise its path returns; a wide C is typed as the union, which a caller has to await anyway.
-    return reply;
-}
-/** The rows and their audit rows commit together here; the trace link has no store method, since only the last-recall path sends one. */
-async function outcomeThroughStore(ctx, store, ids, good, opts) {
-    const entryWrites = requireGroup(store, 'entryWrites');
-    if (opts?.traceId !== undefined)
-        throw new Error('an outcome links its recall trace on hippo.db only, never through a store');
-    const appliedIds = await entryWrites.applyOutcome({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good });
-    return { applied: appliedIds.length, appliedIds };
-}
-function outcomeOnHippoDb(ctx, ids, good, opts) {
-    const appliedIds = [];
-    const db = openStore(ctx.hippoRoot);
-    try {
-        const live = selectEntriesByIds(db, ids, ctx.tenantId);
-        for (const id of ids) {
-            const entry = live.get(id);
-            if (!entry || !canTouchScope(ctx.actor, entry.scope ?? null))
-                continue;
-            const updated = entryAfterOutcome(entry, good);
-            writeEntryOn(db, ctx.hippoRoot, updated, { actor: ctx.actor.subject });
-            live.set(id, updated); // a repeated id builds on its first outcome, as a fresh read would
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'outcome',
-                targetId: id,
-                metadata: { good },
-            });
-            appliedIds.push(id);
-        }
-        // Link the outcome to its trace, recording only the ids actually
-        // credited (post tenant-filtering, matches appliedIds). Lives in its own
-        // append-only table so audit_log pruning can never erase training data.
-        if (opts?.traceId !== undefined && appliedIds.length > 0) {
-            recordTraceOutcome(db, {
-                traceId: opts.traceId,
-                tenantId: ctx.tenantId,
-                outcome: good ? 'positive' : 'negative',
-                memoryIds: appliedIds,
-            });
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    return { applied: appliedIds.length, appliedIds };
+    return onStore(ctx, (port, local) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
+        const traceId = opts?.traceId;
+        // The trace link is written on hippo.db's own handle after the commit, so a served store refuses a traceId.
+        const applied = traceId === undefined ? entryWrites.applyOutcome(write) : local.applyOutcome(write, traceId);
+        return andThen(applied, (appliedIds) => ({ applied: appliedIds.length, appliedIds }));
+    });
 }
 export function outcomeForLastRecall(ctx, good) {
-    const reply = ctx.store ? lastRecallUnderStore(ctx, ctx.store, good) : outcomeForLastRecallOnHippoDb({ ...ctx, store: undefined }, good);
-    // SAFETY: a C typed with a store gets the promise its path returns; a wide C is typed as the union, which a caller has to await anyway.
-    return reply;
-}
-/** The last recall's ids and trace sit in hippo.db's meta table, which only the CLI and context write, so no other store holds them. */
-async function lastRecallUnderStore(ctx, store, good) {
-    if (store.kind !== 'sqlite')
-        throw new SqliteBlockedError(store.kind);
-    return outcomeForLastRecallOnHippoDb({ ...ctx, store: undefined }, good);
-}
-function outcomeForLastRecallOnHippoDb(ctx, good) {
-    const idx = loadIndex(ctx.hippoRoot);
-    const ids = idx.last_retrieval_ids;
-    if (ids.length === 0)
-        return { applied: 0, ids: [] };
-    // Same `loadIndex` snapshot as the ids; buildIndexFromDb already strict-parses it to a
-    // positive-integer string or null, so no trace_id=0/NaN reaches outcome().
-    const traceId = idx.last_trace_id !== null ? Number(idx.last_trace_id) : null;
-    const { applied, appliedIds } = outcome(ctx, ids, good, traceId !== null ? { traceId } : undefined);
-    return { applied, ids: appliedIds };
+    return onStore(ctx, (_port, local) => {
+        const ids = local.applyOutcomeToLastRecall({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
+        return { applied: ids.length, ids };
+    });
 }
 //# sourceMappingURL=outcome.js.map

package/dist/{pilot-arm.d.ts → api/pilot-arm.d.ts}

@@ -1,4 +1,4 @@
-import { type DatabaseSyncLike } from './db.js';
+import { type DatabaseSyncLike } from '../db/index.js';
 import { type LedgerRootOpts } from './ledger-db.js';
 export type PilotArm = 'hippo' | 'holdout';
 export interface SessionArmOpts extends LedgerRootOpts {

package/dist/{pilot-arm.js → api/pilot-arm.js}

@@ -1,10 +1,12 @@
 // Pilot arm: one token_ledger row per session names its arm, `hippo` or `holdout`, so a pilot can compare them.
 // `items` holds the holdout rate in basis points; readers outside this repo depend on these rows, so their shape is fixed.
 import { createHash } from 'node:crypto';
-import { loadConfig } from './config.js';
-import { execWithBusyRetry, HOOK_DB_WAIT_MS, scopedBusyWait } from './db.js';
+import { loadConfig } from '../core/config.js';
+import { HOOK_DB_WAIT_MS, scopedBusyWait, withWriteScope } from '../db/index.js';
 import { ledgerRoot, withLedgerDb } from './ledger-db.js';
-import { recordTokenUse } from './token-ledger.js';
+import { errorMessage, log } from '../util/log.js';
+import { firstPilotArmHash } from '../store/token-ledger-rows.js';
+import { recordTokenUse } from '../store/token-ledger.js';
 /** Deterministic split: the same session and rate always land in the same arm. */
 export function hashArm(sessionId, rateBp) {
     const bucket = parseInt(createHash('sha256').update(sessionId).digest('hex').slice(0, 8), 16) % 10000;
@@ -12,10 +14,7 @@ export function hashArm(sessionId, rateBp) {
 }
 /** The session's first stored arm, or null; never writes. Without `tenantId` any tenant's row counts, since on one machine a session has one arm. */
 export function readPilotArm(db, sessionId, tenantId) {
-    const params = tenantId === undefined ? [sessionId] : [sessionId, tenantId];
-    // SAFETY: the SELECT names exactly this one column.
-    const row = db.prepare(`SELECT block_hash FROM token_ledger WHERE session_id = ?${tenantId === undefined ? '' : ' AND tenant_id = ?'}
-     AND surface = 'pilot' AND event = 'arm' ORDER BY id LIMIT 1`).get(...params);
+    const row = firstPilotArmHash(db, sessionId, tenantId);
     return row?.block_hash === 'holdout' || row?.block_hash === 'hippo' ? row.block_hash : null;
 }
 /** The stored arm, else the hash arm written once; on any error the hash arm comes back unrecorded. */
@@ -23,29 +22,22 @@ export function readPilotArm(db, sessionId, tenantId) {
 export function ensurePilotArm(db, tenantId, sessionId, rateBp, opts = {}) {
     const hashed = hashArm(sessionId, rateBp);
     const readTenant = opts.ownTenantOnly ? tenantId : undefined;
-    let began = false;
     try {
         // A stored row is the common case after the first prompt, so it must not take the write lock.
         const existing = readPilotArm(db, sessionId, readTenant);
         if (existing !== null)
             return existing;
-        execWithBusyRetry(db, 'BEGIN IMMEDIATE', scopedBusyWait() ?? HOOK_DB_WAIT_MS);
-        began = true;
-        const stored = readPilotArm(db, sessionId, readTenant);
-        if (stored === null) {
-            recordTokenUse(db, { tenantId, sessionId, surface: 'pilot', event: 'arm', items: rateBp, tokens: 0, hash: hashed, now: opts.now });
-        }
-        db.exec('COMMIT');
-        return stored ?? hashed;
+        return withWriteScope(db, 'pilot_arm', () => {
+            const stored = readPilotArm(db, sessionId, readTenant);
+            if (stored === null) {
+                recordTokenUse(db, { tenantId, sessionId, surface: 'pilot', event: 'arm', items: rateBp, tokens: 0, hash: hashed, now: opts.now });
+            }
+            return stored ?? hashed;
+        }, { busyWaitMs: scopedBusyWait() ?? HOOK_DB_WAIT_MS });
     }
-    catch {
+    catch (err) {
         // A prompt hook must not fail on pilot bookkeeping; concurrent callers still agree on the hash arm.
-        if (began) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* keep the hash arm */ }
-        }
+        log.debug(`pilot arm not stored, using the hash arm: ${errorMessage(err)}`);
         return hashed;
     }
 }

package/dist/api/predictions.d.ts

@@ -0,0 +1,9 @@
+import type { Prediction, PredictionBaserate } from '../store/predictions.js';
+import type { PredictionClose, PredictionSave, Predictions } from '../store/port.js';
+import type { Context } from './types.js';
+export declare function savePrediction(ctx: Context, input: PredictionSave): Promise<Prediction>;
+export declare function listPredictions(ctx: Context, query: Parameters<Predictions['listPredictions']>[1]): Promise<Prediction[]>;
+export declare function predictionBaserate(ctx: Context, classTag: string): Promise<PredictionBaserate>;
+export declare function predictionById(ctx: Context, id: number): Promise<Prediction | null>;
+export declare function closePrediction(ctx: Context, id: number, close: PredictionClose): Promise<Prediction>;
+//# sourceMappingURL=predictions.d.ts.map

package/dist/api/predictions.js

@@ -0,0 +1,18 @@
+import { requireGroup, storeFor } from '../store/index.js';
+const predictionsOf = (ctx) => requireGroup(storeFor(ctx), 'predictions');
+export async function savePrediction(ctx, input) {
+    return predictionsOf(ctx).savePrediction(ctx.tenantId, input, ctx.actor.subject);
+}
+export async function listPredictions(ctx, query) {
+    return predictionsOf(ctx).listPredictions(ctx.tenantId, query);
+}
+export async function predictionBaserate(ctx, classTag) {
+    return predictionsOf(ctx).predictionBaserate(ctx.tenantId, classTag, ctx.actor.subject);
+}
+export async function predictionById(ctx, id) {
+    return predictionsOf(ctx).predictionById(ctx.tenantId, id);
+}
+export async function closePrediction(ctx, id, close) {
+    return predictionsOf(ctx).closePrediction(ctx.tenantId, id, close, ctx.actor.subject);
+}
+//# sourceMappingURL=predictions.js.map

package/dist/api/promote.d.ts

@@ -1,47 +1,32 @@
-import { type DatabaseSyncLike } from '../db.js';
+import type { ConnectorEvent } from '../store/port.js';
+import { type Layer } from '../core/memory.js';
 import type { Context, StoreReply } from './types.js';
-/**
- * Copy a local memory into the global store. Mirrors `cmdPromote` in cli.ts:
- * the `writeEntry` inside `promoteToGlobal` emits a 'remember' on the global
- * db; we add a 'promote' audit event on the global db so the user-facing
- * intent stays distinct from the underlying upsert.
- *
- * Note: `promoteToGlobal` does not currently take a tenantId override — it
- * reads the entry from the local root via `readEntry` (no tenant filter) and
- * preserves the entry's existing tenantId on the global side.
- */
+/** Copies a local memory into the global store; the inner writeEntry emits 'remember' there, and we add a 'promote' audit event so intent stays distinct.
+ * promoteToGlobal reads via `readEntry` with no tenant filter and keeps the entry's existing tenantId on the global side. */
 export interface PromoteResult {
     ok: true;
     sourceId: string;
     globalId: string;
 }
 export declare function promote(ctx: Context, id: string): PromoteResult;
-/**
- * Replace an old memory with new content, chaining old.superseded_by = new.id.
- * Mirrors `cmdSupersede` in cli.ts minus the flag-driven layer/tag/pin
- * overrides: the CLI handler resolves those so the API stays minimal.
- */
+/** Replace an old memory with new content, chaining old.superseded_by = new.id; the store commits both rows and the audit row together. */
 export interface SupersedeResult {
     ok: true;
     oldId: string;
     newId: string;
 }
-export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string): StoreReply<C, SupersedeResult>;
-/**
- * Archive a kind='raw' memory: snapshot into raw_archive, mark archived, delete.
- *
- * `archiveRawMemory` audits the operation internally (op='archive_raw') using the
- * row's own tenant_id. We DO NOT emit a second audit event here to avoid double-
- * emitting the archive_raw op. Instead we pass `ctx.actor.subject` through as `who`,
- * and raw-archive.ts uses that for the audit row.
- */
+/** What the successor takes instead of the old row's value. Never set from a request body: the CLI fills it from its flags. */
+export interface SupersedeOverrides {
+    layer?: Layer;
+    tags?: string[];
+    pinned?: boolean;
+}
+export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string, overrides?: SupersedeOverrides): StoreReply<C, SupersedeResult>;
+/** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is
+ * deleted. The store writes the one archive_raw audit row, under the caller's subject. */
 export interface ArchiveRawOpts {
-    /**
-     * Connector idempotency hook. Runs inside the same
-     * SAVEPOINT as the archive — throwing rolls the archive back. Used by the
-     * Slack deletion connector to mark the deletion event seen atomically.
-     */
-    afterArchive?: (db: DatabaseSyncLike, archivedMemoryId: string) => void;
+    /** The connector event this archive answers. The store logs it in the archive's own transaction, so a redelivery finds it logged. */
+    event?: ConnectorEvent;
 }
 export interface ArchiveRawResult {
     ok: true;

package/dist/api/promote.js

@@ -1,99 +1,44 @@
 // Promote to the global store, supersede with a successor, and archive raw memories.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { ConflictError, NotFoundError } from '../api-errors.js';
+import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { writeEntryMirrors } from '../store/entry-writes.js';
-import { cleanArchivedMirrors, commitSupersede } from '../store/entry-writes-group.js';
-import { readEntry } from '../store/entry-reads.js';
-import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
-import { requireGroup } from '../store-port.js';
-import { log } from '../log.js';
-import { createSuccessor } from '../memory.js';
-import { appendAuditEvent } from '../audit.js';
-import { promoteToGlobal } from '../shared.js';
-import { archiveRawMemory } from '../raw-archive.js';
-import { loadConfig } from '../config.js';
-import { selectMemoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope, personalScopeOf } from '../recall-scope.js';
+import { createSuccessor } from '../core/memory.js';
+import { promoteToGlobal } from '../sharing/global-store.js';
+import { loadConfig } from '../core/config.js';
+import { andThen, notPorted, onStore } from './on-store.js';
+import { memoryReach } from '../store/tenant-lookup.js';
+import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
 export function promote(ctx, id) {
-    // Tenant scope: promoteToGlobal reads the entry from the local root via
-    // readEntry without a tenant filter, so a Bearer for tenant A could
-    // promote tenant B's row by guessing or leaking the id. Pre-check the
-    // row's tenant_id and deny cross-tenant access with the same not-found
-    // wording archiveRaw uses (no info leak about whether the id exists in
-    // another tenant).
-    const ownerDb = openHippoDb(ctx.hippoRoot);
-    try {
-        const reach = selectMemoryReach(ownerDb, id);
-        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-            throw new NotFoundError(`memory not found: ${id}`);
-        }
-    }
-    finally {
-        closeHippoDb(ownerDb);
+    // promoteToGlobal reads without a tenant filter, so pre-check the row's tenant_id and deny cross-tenant access with archiveRaw's not-found wording
+    // (no leak about whether the id exists in another tenant).
+    const reach = memoryReach(ctx.hippoRoot, id);
+    if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
+        throw new NotFoundError(`memory not found: ${id}`);
     }
     // The 'promote' row commits with the global copy, so no write follows the commit and a busy store fails the whole promote.
     const globalEntry = promoteToGlobal(ctx.hippoRoot, id, {
         actor: ctx.actor.subject,
         tenantId: ctx.tenantId,
-        afterWrite: (db, globalId) => appendAuditEvent(db, {
-            tenantId: ctx.tenantId,
-            actor: ctx.actor.subject,
-            op: 'promote',
-            targetId: globalId,
-            metadata: { sourceId: id },
-        }),
+        auditAs: { tenantId: ctx.tenantId, actor: ctx.actor.subject },
     });
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
-export function supersede(ctx, oldId, newContent) {
-    const reply = ctx.store ? supersedeThroughStore(ctx, ctx.store, oldId, newContent) : supersedeOnHippoDb(ctx, oldId, newContent);
-    // SAFETY: a C typed with a store gets the promise its path returns; a wide C is typed as the union, which a caller has to await anyway.
-    return reply;
-}
-async function supersedeThroughStore(ctx, store, oldId, newContent) {
-    const entryWrites = requireGroup(store, 'entryWrites');
-    const [old] = await store.entriesByIds([oldId], ctx.tenantId);
-    const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
-        tenantId: ctx.tenantId,
-        baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+export function supersede(ctx, oldId, newContent, overrides = {}) {
+    return onStore(ctx, (port) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        return andThen(port.entriesByIds([oldId], ctx.tenantId), ([old]) => {
+            const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
+                tenantId: ctx.tenantId,
+                baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+                layer: overrides.layer,
+                tags: overrides.tags,
+                pinned: overrides.pinned,
+            });
+            // A store writes origin_project as given, so the served folder's fallback is stamped here.
+            const successor = stampOriginProject(ctx.hippoRoot, newEntry);
+            const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor };
+            return andThen(entryWrites.supersede(write), () => ({ ok: true, oldId, newId: successor.id }));
+        });
     });
-    // The store writes origin_project as given, so the served folder's fallback is stamped here.
-    const successor = stampOriginProject(ctx.hippoRoot, newEntry);
-    await entryWrites.supersede({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor });
-    return { ok: true, oldId, newId: successor.id };
-}
-function supersedeOnHippoDb(ctx, oldId, newContent) {
-    const old = assertSupersedable(ctx, oldId, readEntry(ctx.hippoRoot, oldId, ctx.tenantId));
-    const successor = stampOriginProject(ctx.hippoRoot, createSuccessor(old, newContent, {
-        tenantId: ctx.tenantId,
-        baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
-    }));
-    // Race-safe transition: open a fresh db handle, BEGIN IMMEDIATE, run all
-    // three steps (CAS on old + writeEntryDbOnly(new) + supersede audit row)
-    // inside the same transaction. Two concurrent supersedes: exactly one CAS
-    // wins (changes=1), the other gets changes=0 and throws CONFLICT. No
-    // dangling-pointer window: the new memory's row commits atomically with
-    // the old.superseded_by pointer.
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        commitSupersede(db, { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor });
-        // Mirrors after COMMIT, while the db handle is still open. Same
-        // invariant as the original writeEntry: a mirror failure leaves disk
-        // MISSING the markdown for the new memory (rebuildIndex rewrites every
-        // markdown mirror from the DB) but DOES NOT desync the DB or
-        // roll back the supersede. Logged + swallowed, non-fatal.
-        try {
-            writeEntryMirrors(ctx.hippoRoot, successor);
-        }
-        catch (mirrorErr) {
-            log.error(`supersede: mirror write failed (non-fatal, will self-heal): ${mirrorErr instanceof Error ? mirrorErr.message : String(mirrorErr)}`);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    return { ok: true, oldId, newId: successor.id };
 }
 /** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
 function assertSupersedable(ctx, oldId, old) {
@@ -107,44 +52,14 @@ function assertSupersedable(ctx, oldId, old) {
     return old;
 }
 export function archiveRaw(ctx, id, reason, opts = {}) {
-    const reply = ctx.store ? archiveRawThroughStore(ctx, ctx.store, id, reason, opts) : archiveRawOnHippoDb(ctx, id, reason, opts);
-    // SAFETY: a C typed with a store gets the promise its path returns; a wide C is typed as the union, which a caller has to await anyway.
-    return reply;
-}
-/** afterArchive writes on hippo.db's own handle, and only connectors send it, so a store refuses it. */
-async function archiveRawThroughStore(ctx, store, id, reason, opts) {
-    const entryWrites = requireGroup(store, 'entryWrites');
-    if (opts.afterArchive)
-        throw new Error('afterArchive runs on hippo.db only, never through a store');
-    const archivedAt = await entryWrites.archiveRaw({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason });
-    return { ok: true, archivedAt };
-}
-function archiveRawOnHippoDb(ctx, id, reason, opts) {
-    const db = openHippoDb(ctx.hippoRoot);
-    let archivedAt;
-    try {
-        // Tenant scope: archiveRawMemory looks up the row by id alone, so a
-        // Bearer for tenant A could archive tenant B's raw row without this
-        // pre-check. Deny cross-tenant access with the same not-found message
-        // archiveRawMemory itself would throw on a missing row, so we don't
-        // leak whether the id exists in another tenant.
-        const reach = selectMemoryReach(db, id);
-        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-            throw new NotFoundError(`memory not found: ${id}`);
-        }
-        archivedAt = archiveRawMemory(db, id, {
-            reason,
-            who: ctx.actor.subject,
-            afterArchive: opts.afterArchive,
-        });
-        cleanArchivedMirrors(db, ctx.hippoRoot, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    // Counted here rather than in the CLI: the HTTP archive route calls this too,
-    // so a routed archive would otherwise never reach the forgotten counter.
-    updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
-    return { ok: true, archivedAt };
+    return onStore(ctx, (port) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
+        const { event } = opts;
+        const archived = event
+            ? (port.connectorWrites ?? notPorted(port, 'connectorWrites')).archiveConnectorEntry({ ...archive, event })
+            : entryWrites.archiveRaw(archive);
+        return andThen(archived, (archivedAt) => ({ ok: true, archivedAt }));
+    });
 }
 //# sourceMappingURL=promote.js.map

package/dist/{prompt-hook.d.ts → api/prompt-hook.d.ts}

@@ -1,11 +1,11 @@
-import { type Context, type ContextResult, type ContextResultEntry } from './api.js';
-import { type openHippoDb } from './db.js';
-import type { DeliveryRecorder } from './delivery-recorder.js';
-import { type JsonValue } from './json.js';
-import type { MemoryEntry } from './memory.js';
+import { type Context, type ContextResult, type ContextResultEntry } from './index.js';
+import type { DeliveryRecorder } from '../store/delivery-recorder.js';
+import { type JsonValue } from '../util/json.js';
+import type { MemoryEntry } from '../core/memory.js';
 import { type PilotArm } from './pilot-arm.js';
-/** With `db`, writes on the token ledger's handle (same store); without it, opens its own. A second flush is a no-op. */
-export declare function flushDeliveryRecorder(rec: DeliveryRecorder | null, db?: ReturnType<typeof openHippoDb>): void;
+import type { DeliveryWrite } from '../store/ledger-turn.js';
+/** With `write`, stores on the token ledger's connection (same store); without it, opens its own. A second flush is a no-op. */
+export declare function flushDeliveryRecorder(rec: DeliveryRecorder | null, write?: DeliveryWrite): void;
 /** What one render needs once api.getContext has answered. */
 export interface ContextView {
     readonly hippoRoot: string;
@@ -58,10 +58,10 @@ interface PromptHookOpts {
 }
 /** The caps on a hook caller's session id and project names, so a caller other than an HTTP route is bounded too. */
 export declare function assertCallerIds(sessionId: string, project: CallerProject): void;
-/** The text `hippo context --pinned-only --include-recent 5 --format additional-context` prints for this session, read on `ctx`'s store for the caller's project, leaving out an unchanged static block only when `printedHash` matches it.
- *  `arm` is the raw ledger arm (`hippo` or `holdout`), null at rate 0; a holdout session gets an empty stdout. `staticHash` is the hash to echo back: null with no static block, for a sub-agent or a holdout.
- *  Scope detection (HIPPO_SCOPE and skill env vars) and delivery-ledger events are CLI-only.
- *  Throws BadRequestError past the input caps, and on a shared store for a project assertCallerProject refuses, before any arm is booked. */
+/** The text `hippo context --pinned-only --include-recent 5 --format additional-context` prints for this session, read on `ctx`'s store for its project.
+ * Omits an unchanged static block only when `printedHash` matches; `arm` is the ledger arm (`hippo` or `holdout`, null at rate 0); a holdout gets empty stdout.
+ * `staticHash` is the hash to echo back (null with no static block, a sub-agent or a holdout). Scope detection and delivery-ledger events are CLI-only.
+ * Throws BadRequestError past the input caps, and on a shared store for a project assertCallerProject refuses, before any arm is booked. */
 export declare function promptHookContext(ctx: Context, req: PromptHookRequest, opts?: PromptHookOpts): Promise<{
     arm: PilotArm | null;
     stdout: string;