hippo-memory 1.69.0 → 1.71.0

package/dist/server/routes/project-briefs.js

@@ -1,137 +1,58 @@
 // /v1/project-briefs routes.
-import { assembleBriefFromReceipts, closeProjectBrief, loadProjectBriefById, loadProjectBriefs, MAX_REPO_LEN, refreshBrief, saveProjectBrief, VALID_BRIEF_STATES } from '../../project-briefs.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { briefFromReceipts, MAX_CHANGE_SUMMARY_LEN, MAX_REPO_LEN, PROJECT_BRIEF, refreshedBrief, } from '../../objects/project-briefs.js';
+import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
-// ── project_brief routes ──
-//
-// 6 routes: POST /v1/project-briefs (new; body repo + summary), GET
-// /v1/project-briefs (list; status + repo filter; shared parseListLimit), POST
-// /v1/project-briefs/refresh (body {repo, dryRun?} -> auto-assemble the brief
-// from the repo's receipts; dryRun returns {markdown} without writing; ordered
-// before /:id), GET /v1/project-briefs/:id, POST /v1/project-briefs/:id/supersede,
-// POST /v1/project-briefs/:id/close. DoS caps: repo 256, summary 8192,
-// changeSummary 4096. The store validates + throws; the boundary maps validation
-// -> 400, not-found -> 404, not-active -> 409. Mirrors /v1/skills.
-export async function handleCreateProjectBrief({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const repo = body['repo'];
-    if (!isJsonString(repo) || repo.trim().length === 0) {
-        throw new HttpError(400, 'repo is required (non-empty string)');
-    }
-    if (repo.length > MAX_REPO_LEN) {
-        throw new HttpError(400, `repo exceeds ${MAX_REPO_LEN}-character cap`);
-    }
-    const summary = body['summary'];
-    if (!isJsonString(summary) || summary.trim().length === 0) {
-        throw new HttpError(400, 'summary is required (non-empty string)');
-    }
-    if (summary.length > 8192) {
-        throw new HttpError(400, 'summary exceeds 8192-character cap');
-    }
-    const brief = saveProjectBrief(opts.hippoRoot, ctx.tenantId, {
-        repo,
-        summary,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { brief });
-    return;
+import { parseJsonBody } from '../validation.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
+const briefRoutes = {
+    noun: 'project brief',
+    field: 'brief',
+    listField: 'briefs',
+    object: PROJECT_BRIEF,
+    filterParam: 'repo',
+    revise: (body) => {
+        const summary = requiredString(body, 'summary', { max: 8192 });
+        const changeSummary = optionalString(body, 'changeSummary', MAX_CHANGE_SUMMARY_LEN);
+        return (existing, id) => ({ repo: existing.repo, summary, changeSummary, supersedesBriefId: id });
+    },
+};
+// Routes: /v1/project-briefs (create, list, refresh, show, supersede, close), mirroring /v1/skills; /refresh is ordered before /:id.
+// The store validates and throws; the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
+export async function handleCreateProjectBrief(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const brief = await saveFor(ctx, PROJECT_BRIEF, {
+        repo: requiredString(body, 'repo', { max: MAX_REPO_LEN }),
+        summary: requiredString(body, 'summary', { max: 8192 }),
+    });
+    sendJson(rr.res, 201, { brief });
 }
-export async function handleListProjectBriefs({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const repoFilter = query.get('repo');
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    const listOpts = { limit: limit + 1, after };
-    if (repoFilter !== null && repoFilter.trim().length > 0) {
-        listOpts.repo = repoFilter.trim();
-    }
-    if (status !== 'all') {
-        if (!isSetMember(VALID_BRIEF_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        listOpts.status = status;
-    }
-    const briefs = loadProjectBriefs(opts.hippoRoot, ctx.tenantId, listOpts);
-    const page = pageOf(briefs, limit, byCreatedAt);
-    sendJson(res, 200, { briefs: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListProjectBriefs(rr) {
+    return listRoute(briefRoutes, rr);
 }
 // The refresh op: must precede the /:id routes (literal 'refresh' is non-numeric
 // so the /(\d+)/ routes would not match it, but order it first).
-export async function handleRefreshProjectBrief({ req, res, opts }) {
+export async function handleRefreshProjectBrief(rr) {
+    const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
-    const repo = body['repo'];
-    if (!isJsonString(repo) || repo.trim().length === 0) {
-        throw new HttpError(400, 'repo is required (non-empty string)');
-    }
-    if (repo.length > MAX_REPO_LEN) {
-        throw new HttpError(400, `repo exceeds ${MAX_REPO_LEN}-character cap`);
-    }
-    const dryRun = body['dryRun'] === true;
-    if (dryRun) {
-        const { markdown, receiptCount } = assembleBriefFromReceipts(opts.hippoRoot, ctx.tenantId, repo);
+    const repo = requiredString(body, 'repo', { max: MAX_REPO_LEN });
+    if (body['dryRun'] === true) {
+        const { markdown, receiptCount } = await briefFromReceipts(objectsOf(ctx), ctx.tenantId, repo);
         sendJson(res, 200, { markdown, receiptCount });
         return;
     }
-    const brief = refreshBrief(opts.hippoRoot, ctx.tenantId, repo, ctx.actor.subject);
+    const brief = await refreshedBrief(objectsOf(ctx), { hippoRoot: opts.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, repo);
     sendJson(res, 200, { brief });
-    return;
 }
-export async function handleSupersedeProjectBrief({ req, res, opts }, briefSupersedeMatch) {
-    const id = parseInt(briefSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const summary = body['summary'];
-    if (!isJsonString(summary) || summary.trim().length === 0) {
-        throw new HttpError(400, 'summary is required (non-empty string)');
-    }
-    if (summary.length > 8192) {
-        throw new HttpError(400, 'summary exceeds 8192-character cap');
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const existing = loadProjectBriefById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `project brief ${id} not found`);
-    }
-    const brief = saveProjectBrief(opts.hippoRoot, ctx.tenantId, {
-        repo: existing.repo,
-        summary,
-        changeSummary,
-        supersedesBriefId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { brief });
-    return;
+export function handleSupersedeProjectBrief(rr, match) {
+    return supersedeRoute(briefRoutes, rr, match);
 }
-export async function handleCloseProjectBrief({ req, res, opts }, briefCloseMatch) {
-    const id = parseInt(briefCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const brief = closeProjectBrief(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { brief });
-    return;
+export function handleCloseProjectBrief(rr, match) {
+    return closeRoute(briefRoutes, rr, match);
 }
-export async function handleGetProjectBrief({ req, res, opts }, briefByIdMatch) {
-    const id = parseInt(briefByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const brief = loadProjectBriefById(opts.hippoRoot, ctx.tenantId, id);
-    if (!brief) {
-        throw new HttpError(404, `project brief ${id} not found`);
-    }
-    sendJson(res, 200, { brief });
-    return;
+export function handleGetProjectBrief(rr, match) {
+    return getRoute(briefRoutes, rr, match);
 }
 //# sourceMappingURL=project-briefs.js.map

package/dist/server/routes/recall.js

@@ -1,53 +1,34 @@
 // Recall routes: /v1/memories search, assemble, drill and /v1/context.
 import { dirname, resolve } from 'node:path';
-import { assertCallerProject, resolveProjectIdentity } from '../../project-identity.js';
-import { isSharedStore } from '../../config.js';
-import { assembleCost, contextCost, drillCost } from '../../context-render.js';
-import { storeFor } from '../../store-port.js';
-import { biasHintEnabled } from '../../recall-history.js';
-import { assemble, drillDown, getContext, recordTokens, retrieve } from '../../api.js';
+import { assertCallerProject, resolveProjectIdentity } from '../../core/project-identity.js';
+import { isSharedStore } from '../../core/config.js';
+import { assembleCost, contextCost, drillCost } from '../../api/context-render.js';
+import { assemble, drillDown, getContext, recordTokens, retrieve } from '../../api/index.js';
+import { RECALL_RECORDING } from '../../api/recall-finish.js';
 import { httpParams, parseContextRequest, parseRecallRequest } from '../../api/recall-request.js';
-import { anchorSkippedRows, noteRecall, peekSessionRing, resetSessionRings, sessionRing } from '../../api/recall-record.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { resetSessionRings } from '../../api/recall-record.js';
+import { HttpError, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { validateIdSegment } from '../validation.js';
+import { MAX_LIST_LIMIT, parseListLimit, validateIdSegment } from '../validation.js';
 /** Test-only: reset the HTTP recall rings. Call from beforeEach. */
 export function __resetSessionRecallHistoryHttp() {
     resetSessionRings('http');
 }
-// HTTP threads the ring through opts.recallHistory, so the hint retrieve() returns is the one the caller sees.
-function recallHistoryFor(ctx, sessionId) {
-    return sessionId && biasHintEnabled('anchoring') ? peekSessionRing('http', ctx.tenantId, sessionId) : undefined;
-}
 // GET /v1/memories?q=...&limit=...&mode=...&scope=...&include_continuity=1
 export async function handleRecallMemories({ req, res, opts, query }) {
     const { opts: recallOpts, limit, mode, explain } = parseRecallRequest(httpParams(query));
-    const { query: q, includeContinuity, sessionId } = recallOpts;
     const ctx = await buildContextWithAuth(req, opts);
-    const recallHistory = recallHistoryFor(ctx, sessionId);
-    // Written first in the recall's own write, so a recall that fails leaves no row.
-    const leadingAudit = sessionId ? [] : anchorSkippedRows({ tenantId: ctx.tenantId, actor: ctx.actor.subject }, q);
-    const result = await retrieve(ctx, { ...recallOpts, limit, mode, explain, recallHistory, leadingAudit });
-    // The ring is created only after recall succeeds, so a 400 cannot LRU-evict a live session.
-    const ring = sessionRing('http', ctx.tenantId, sessionId);
-    if (ring)
-        noteRecall(ring, q, result.results[0]?.id ?? null, result.anchoringHint?.memoryId);
-    // Each recall surface counts its own hits; api.recall is no chokepoint,
-    // since the CLI never calls it and MCP shows the user a different band.
-    await storeFor(ctx).bumpRecallStats(result.results.length);
+    const result = await retrieve(ctx, { ...recallOpts, limit, mode, explain, recordAs: RECALL_RECORDING.http });
     // Continuity payloads should never be cached. The caller is asking for
     // session-state-aware data; intermediaries must not reuse it across users.
-    if (includeContinuity) {
+    if (recallOpts.includeContinuity) {
         res.setHeader('Cache-Control', 'no-store');
     }
-    await recordTokens(ctx, 'http_recall', { items: result.results.length, tokens: result.tokens + (result.continuityTokens ?? 0), sessionId: sessionId ?? null });
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1
-// Phase 2 context-engine API. Returns ordered AssembledContextItem[]
-// with fresh-tail raws + summary substitutions + bio-aware budget fit.
-// Tenant scope from Bearer; default-deny on private rows.
+// GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1: ordered AssembledContextItem[] (fresh-tail raws, summary substitutions, bio-aware
+// budget fit). Tenant scope from the Bearer; default-deny on private rows.
 export async function handleAssembleSession({ req, res, opts, query }, assembleMatch) {
     validateIdSegment(assembleMatch.id, 'session id');
     const budgetRaw = query.get('budget');
@@ -78,17 +59,13 @@ export async function handleAssembleSession({ req, res, opts, query }, assembleM
         assembleExtra.summarizeOlder = summarizeOlder;
     if (scope !== undefined)
         assembleExtra.scope = scope;
-    const result = assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
+    const result = await assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
     await recordTokens(ctx, 'http_assemble', { items: result.items.length, tokens: result.tokens, sessionId: assembleMatch.id });
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/recall/drill/:id?limit=N&budget=N
-// Companion to /v1/memories. When recall surfaces a level-2 summary in
-// place of overflowed children (RecallResultItem.isSummary === true), the
-// caller drills into the summary id to recover the originals. Tenant
-// scoped via Bearer; default-deny on private scopes for both summary
-// and children.
+// GET /v1/recall/drill/:id?limit=N&budget=N: companion to /v1/memories; the caller drills into a level-2 summary (RecallResultItem.isSummary) to recover the
+// originals. Tenant-scoped via Bearer; default-deny on private scopes for the summary and its children.
 export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
     validateIdSegment(drillMatch.id, 'summary id');
     const limitRaw = query.get('limit');
@@ -96,6 +73,9 @@ export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
     if (limit !== undefined && (!Number.isFinite(limit) || limit <= 0)) {
         throw new HttpError(400, 'limit must be a positive number');
     }
+    // Past the list ceiling the shared parser refuses, so the reply is the one every other list route gives.
+    if (limit !== undefined && limit > MAX_LIST_LIMIT)
+        parseListLimit(limitRaw);
     const budgetRaw = query.get('budget');
     const budget = budgetRaw === null ? undefined : Number(budgetRaw);
     if (budget !== undefined && (!Number.isFinite(budget) || budget <= 0)) {
@@ -120,7 +100,7 @@ export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
         drillExtra.budget = budget;
     if (depth !== undefined)
         drillExtra.depth = depth;
-    const result = drillDown(ctx, drillMatch.id, { ...drillExtra, cost: drillCost });
+    const result = await drillDown(ctx, drillMatch.id, { ...drillExtra, cost: drillCost });
     if ('failure' in result) {
         // Leaf id maps to 422 (caller-actionable). Other cases stay
         // as 404 to avoid leaking cross-tenant existence or scope grants.
@@ -143,11 +123,8 @@ function contextReader(hippoRoot, query) {
     assertCallerProject({ name, aliases });
     return { name, legacyName: name, aliases };
 }
-// GET /v1/context — assemble a budget-bounded context bundle. Returns
-// ContextResult JSON (entries + tokens + activeSnapshot + sessionHandoff
-// + recentEvents). No server-side rendering; clients render. Tenant-scoped
-// via the Bearer. Pinned-only + '*' fallback skip the recall audit emit
-// (matches cmdContext); real-query hybrid search emits one 'recall' row.
+// GET /v1/context: a budget-bounded ContextResult JSON, rendered by clients, not the server; tenant-scoped via the Bearer.
+// Pinned-only and '*' fallback skip the recall audit emit (as cmdContext does); a real-query hybrid search emits one 'recall' row.
 export async function handleGetContext({ req, res, opts, query }) {
     const parsed = parseContextRequest(httpParams(query));
     const ctx = await buildContextWithAuth(req, opts);

package/dist/server/routes/skills.d.ts

@@ -1,8 +1,8 @@
 import type { RouteRequest } from '../types.js';
-export declare function handleCreateSkill({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListSkills({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleExportSkills({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleSupersedeSkill({ req, res, opts }: RouteRequest, skillSupersedeMatch: RegExpMatchArray): Promise<void>;
-export declare function handleCloseSkill({ req, res, opts }: RouteRequest, skillCloseMatch: RegExpMatchArray): Promise<void>;
-export declare function handleGetSkill({ req, res, opts }: RouteRequest, skillByIdMatch: RegExpMatchArray): Promise<void>;
+export declare function handleCreateSkill(rr: RouteRequest): Promise<void>;
+export declare function handleListSkills(rr: RouteRequest): Promise<void>;
+export declare function handleExportSkills(rr: RouteRequest): Promise<void>;
+export declare function handleSupersedeSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetSkill(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=skills.d.ts.map

package/dist/server/routes/skills.js

@@ -1,151 +1,53 @@
 // /v1/skills routes.
-import { closeSkill, exportSkills, loadSkillById, loadSkills, MAX_SKILL_NAME_LEN, saveSkill, VALID_SKILL_STATES } from '../../skills.js';
-import { HttpError, sendJson } from '../../http-util.js';
+import { MAX_SKILL_NAME_LEN, SKILL, skillsMarkdown } from '../../objects/skills.js';
+import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
-import { isJsonString } from '../../json.js';
-// ── skills (first-class object, executable/exportable) ──
-//
-// 6 routes: POST /v1/skills (new; body skillName + instructions + trigger?),
-// GET /v1/skills (list, status filter; shared parseListLimit), GET
-// /v1/skills/export (renders ACTIVE skills as an AGENTS.md/CLAUDE.md markdown
-// block -> {markdown}; literal 'export' is non-numeric so the /:id (\d+) route
-// cannot capture it, but it is ordered first regardless), GET /v1/skills/:id,
-// POST /v1/skills/:id/supersede, POST /v1/skills/:id/close. DoS caps:
-// skillName 256, instructions 8192, trigger 1024, changeSummary 4096. The store
-// validates + throws; the boundary maps validation -> 400, not-found -> 404,
-// not-active -> 409. Mirrors /v1/processes; "executable" = exportable
-// instruction (no code exec).
-export async function handleCreateSkill({ req, res, opts }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const skillName = body['skillName'];
-    if (!isJsonString(skillName) || skillName.trim().length === 0) {
-        throw new HttpError(400, 'skillName is required (non-empty string)');
-    }
-    if (skillName.length > MAX_SKILL_NAME_LEN) {
-        throw new HttpError(400, `skillName exceeds ${MAX_SKILL_NAME_LEN}-character cap`);
-    }
-    const instructions = body['instructions'];
-    if (!isJsonString(instructions) || instructions.trim().length === 0) {
-        throw new HttpError(400, 'instructions are required (non-empty string)');
-    }
-    if (instructions.length > 8192) {
-        throw new HttpError(400, 'instructions exceed 8192-character cap');
-    }
-    const triggerRaw = body['trigger'];
-    let trigger;
-    if (triggerRaw !== undefined && triggerRaw !== null) {
-        if (!isJsonString(triggerRaw)) {
-            throw new HttpError(400, 'trigger must be a string');
-        }
-        if (triggerRaw.length > 1024) {
-            throw new HttpError(400, 'trigger exceeds 1024-character cap');
-        }
-        trigger = triggerRaw;
-    }
-    const skill = saveSkill(opts.hippoRoot, ctx.tenantId, {
-        skillName,
-        instructions,
-        trigger,
-    }, ctx.actor.subject);
-    sendJson(res, 201, { skill });
-    return;
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
+const INSTRUCTIONS = { max: 8192, plural: true };
+const skillRoutes = {
+    noun: 'skill',
+    field: 'skill',
+    listField: 'skills',
+    object: SKILL,
+    revise: (body) => {
+        const instructions = requiredString(body, 'instructions', INSTRUCTIONS);
+        const trigger = optionalString(body, 'trigger', 1024);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_SHORT_FIELD_LEN);
+        return (existing, id) => ({ skillName: existing.skillName, instructions, trigger, changeSummary, supersedesSkillId: id });
+    },
+};
+// Routes: /v1/skills (create, list, export, show, supersede, close), mirroring /v1/processes; "executable" means exportable instruction (no code exec).
+// GET /v1/skills/export renders ACTIVE skills as a markdown block for AGENTS.md or CLAUDE.md and is ordered before /:id.
+export async function handleCreateSkill(rr) {
+    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const body = await parseJsonBody(rr.req, ctx);
+    const skill = await saveFor(ctx, SKILL, {
+        skillName: requiredString(body, 'skillName', { max: MAX_SKILL_NAME_LEN }),
+        instructions: requiredString(body, 'instructions', INSTRUCTIONS),
+        trigger: optionalString(body, 'trigger', 1024),
+    });
+    sendJson(rr.res, 201, { skill });
 }
-export async function handleListSkills({ req, res, opts, query }) {
-    const status = query.get('status') ?? 'all';
-    const limit = parseListLimit(query.get('limit'));
-    const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
-    let skills;
-    if (status === 'all') {
-        skills = loadSkills(opts.hippoRoot, ctx.tenantId, { limit: limit + 1, after });
-    }
-    else {
-        if (!isSetMember(VALID_SKILL_STATES, status)) {
-            throw new HttpError(400, `status must be one of: active | superseded | closed | all (got "${status}")`);
-        }
-        skills = loadSkills(opts.hippoRoot, ctx.tenantId, {
-            status,
-            limit: limit + 1,
-            after,
-        });
-    }
-    const page = pageOf(skills, limit, byCreatedAt);
-    sendJson(res, 200, { skills: page.items, next_cursor: page.nextCursor });
-    return;
+export function handleListSkills(rr) {
+    return listRoute(skillRoutes, rr);
 }
 // The export renderer: must precede the /:id GET (literal 'export' is
 // non-numeric so the /(\d+)/ route would not match it, but order it first).
-export async function handleExportSkills({ req, res, opts }) {
+export async function handleExportSkills(rr) {
+    const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
-    const markdown = exportSkills(opts.hippoRoot, ctx.tenantId);
+    const markdown = await skillsMarkdown(objectsOf(ctx), ctx.tenantId);
     sendJson(res, 200, { markdown });
-    return;
 }
-export async function handleSupersedeSkill({ req, res, opts }, skillSupersedeMatch) {
-    const id = parseInt(skillSupersedeMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const body = await parseJsonBody(req, ctx);
-    const instructions = body['instructions'];
-    if (!isJsonString(instructions) || instructions.trim().length === 0) {
-        throw new HttpError(400, 'instructions are required (non-empty string)');
-    }
-    if (instructions.length > 8192) {
-        throw new HttpError(400, 'instructions exceed 8192-character cap');
-    }
-    const triggerRaw = body['trigger'];
-    let trigger;
-    if (triggerRaw !== undefined && triggerRaw !== null) {
-        if (!isJsonString(triggerRaw)) {
-            throw new HttpError(400, 'trigger must be a string');
-        }
-        if (triggerRaw.length > 1024) {
-            throw new HttpError(400, 'trigger exceeds 1024-character cap');
-        }
-        trigger = triggerRaw;
-    }
-    const changeRaw = body['changeSummary'];
-    let changeSummary;
-    if (changeRaw !== undefined && changeRaw !== null) {
-        if (!isJsonString(changeRaw)) {
-            throw new HttpError(400, 'changeSummary must be a string');
-        }
-        if (changeRaw.length > 4096) {
-            throw new HttpError(400, 'changeSummary exceeds 4096-character cap');
-        }
-        changeSummary = changeRaw;
-    }
-    const existing = loadSkillById(opts.hippoRoot, ctx.tenantId, id);
-    if (!existing) {
-        throw new HttpError(404, `skill ${id} not found`);
-    }
-    const skill = saveSkill(opts.hippoRoot, ctx.tenantId, {
-        skillName: existing.skillName,
-        instructions,
-        trigger,
-        changeSummary,
-        supersedesSkillId: id,
-    }, ctx.actor.subject);
-    sendJson(res, 200, { skill });
-    return;
+export function handleSupersedeSkill(rr, match) {
+    return supersedeRoute(skillRoutes, rr, match);
 }
-export async function handleCloseSkill({ req, res, opts }, skillCloseMatch) {
-    const id = parseInt(skillCloseMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const skill = closeSkill(opts.hippoRoot, ctx.tenantId, id, ctx.actor.subject);
-    sendJson(res, 200, { skill });
-    return;
+export function handleCloseSkill(rr, match) {
+    return closeRoute(skillRoutes, rr, match);
 }
-export async function handleGetSkill({ req, res, opts }, skillByIdMatch) {
-    const id = parseInt(skillByIdMatch[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
-    const skill = loadSkillById(opts.hippoRoot, ctx.tenantId, id);
-    if (!skill) {
-        throw new HttpError(404, `skill ${id} not found`);
-    }
-    sendJson(res, 200, { skill });
-    return;
+export function handleGetSkill(rr, match) {
+    return getRoute(skillRoutes, rr, match);
 }
 //# sourceMappingURL=skills.js.map

package/dist/server/server-detect.d.ts

@@ -0,0 +1,28 @@
+export interface ServerInfo {
+    /** Pidfile schema version; absent on pidfiles written before the field existed, which detectServer treats as legacy and still accepts. */
+    schema?: number;
+    pid: number;
+    port: number;
+    url: string;
+    started_at: string;
+}
+/** Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking of missing/stale/malformed pidfiles).
+ * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live. */
+export declare function detectServer(hippoRoot: string): Promise<ServerInfo | null>;
+/** Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes from the caller (`serve()`) so the
+ * pidfile and GET /health carry the same timestamp, which detectServer's liveness probe compares. */
+export declare function writePidfile(hippoRoot: string, opts: {
+    port: number;
+    url: string;
+    startedAt: string;
+}): void;
+/** Best-effort pidfile removal, silent on any error so shutdown paths can call it. Identity-blind: a shutdown that must not clobber a newer server's pidfile
+ * uses removePidfileIfOwned. */
+export declare function removePidfile(hippoRoot: string): void;
+/** Removes the pidfile ONLY when both `pid` and `started_at` match `owner`, so an older shutting-down server cannot orphan a newer one; never throws.
+ * Anything unreadable or malformed is "not provably mine" and left alone (detectServer unlinks it). Returns true iff removed. */
+export declare function removePidfileIfOwned(hippoRoot: string, owner: {
+    pid: number;
+    startedAt: string;
+}): boolean;
+//# sourceMappingURL=server-detect.d.ts.map