hippo-memory 1.70.0 → 1.71.0

package/dist/server/routes/policies.js

@@ -2,8 +2,9 @@
 import { policiesAsOf, POLICY } from '../../objects/policies.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
 // The date fields get a type and length check only: the store parses the date, and the cap bounds a junk string before it reaches the Date parser.
 const MAX_DATE_LEN = 64;
 const policyRoutes = {
@@ -12,28 +13,20 @@ const policyRoutes = {
     listField: 'policies',
     object: POLICY,
     revise: (body) => {
-        const policyText = requiredString(body, 'policyText', { max: 4096 });
+        const policyText = requiredString(body, 'policyText', { max: MAX_SHORT_FIELD_LEN });
         const validFrom = optionalString(body, 'validFrom', MAX_DATE_LEN);
         const validTo = optionalString(body, 'validTo', MAX_DATE_LEN);
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_SHORT_FIELD_LEN);
         return (existing, id) => ({ policyName: existing.policyName, policyText, validFrom, validTo, changeSummary, supersedesPolicyId: id });
     },
 };
-// ── policies (first-class object, bi-temporal-first) ──
-//
-// 6 routes: POST /v1/policies (new; processName-style body policyName +
-// policyText + validFrom? + validTo?), GET /v1/policies (list, status filter),
-// GET /v1/policies/asof (date + optional name; the bi-temporal as-of query;
-// placed BEFORE the /:id GET so the literal 'asof' is matched first), GET
-// /v1/policies/:id, POST /v1/policies/:id/supersede, POST /v1/policies/:id/close.
-// Date inputs are normalized + range-validated in the store; an invalid/inverted
-// date throws -> 400. DoS caps: policyName/policyText/changeSummary 4096.
+// The as-of route is registered BEFORE /:id so the literal 'asof' is matched first; date errors surface as 400.
 export async function handleCreatePolicy(rr) {
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const body = await parseJsonBody(rr.req, ctx);
-    const policy = await saveFor(rr, POLICY, ctx.tenantId, ctx.actor.subject, {
-        policyName: requiredString(body, 'policyName', { max: 4096 }),
-        policyText: requiredString(body, 'policyText', { max: 4096 }),
+    const policy = await saveFor(ctx, POLICY, {
+        policyName: requiredString(body, 'policyName', { max: MAX_SHORT_FIELD_LEN }),
+        policyText: requiredString(body, 'policyText', { max: MAX_SHORT_FIELD_LEN }),
         validFrom: optionalString(body, 'validFrom', MAX_DATE_LEN),
         validTo: optionalString(body, 'validTo', MAX_DATE_LEN),
     });
@@ -52,9 +45,8 @@ export async function handlePoliciesAsOf(rr) {
     }
     const name = query.get('name') ?? undefined;
     const ctx = await buildContextWithAuth(req, opts);
-    const policies = await policiesAsOf(objectsOf(rr), ctx.tenantId, date, { name });
+    const policies = await policiesAsOf(objectsOf(ctx), ctx.tenantId, date, { name });
     sendJson(res, 200, { policies });
-    return;
 }
 export function handleSupersedePolicy(rr, match) {
     return supersedeRoute(policyRoutes, rr, match);

package/dist/server/routes/predictions.js

@@ -1,19 +1,14 @@
 // /v1/predictions routes.
+import { closePrediction, listPredictions, predictionBaserate, predictionById, savePrediction } from '../../api/predictions.js';
 import { loadConfig } from '../../core/config.js';
 import { predictionMirror, VALID_CLOSURE_STATES } from '../../store/predictions.js';
-import { requireGroup } from '../../store/port.js';
 import { HttpError, MAX_ID_LEN, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
 import { byCreatedAt, pageOf, parseCursor } from '../cursor.js';
-import { isSetMember, parseJsonBody, parseListLimit } from '../validation.js';
+import { isSetMember, MAX_SHORT_FIELD_LEN, parseJsonBody, parseListLimit } from '../validation.js';
 import { isJsonString, isJsonNumber } from '../../util/json.js';
-// ── prediction first-class object ──
-//
-// 4 routes: POST /v1/predictions (create), GET /v1/predictions (list),
-// GET /v1/predictions/:id (show), POST /v1/predictions/:id/close (close).
-// All Bearer-authed + tenant-scoped via buildContextWithAuth. closure_state
-// validated against VALID_CLOSURE_STATES (3 states). DoS caps on claim
-// (4096 chars) + closureNote (2048 chars).
+// Routes: /v1/predictions (create, list, show, close), Bearer-authed and tenant-scoped; closure_state is validated against VALID_CLOSURE_STATES.
+// DoS caps: claim MAX_SHORT_FIELD_LEN chars, closureNote 2048.
 export async function handleCreatePrediction({ req, res, opts }) {
     const ctx = await buildContextWithAuth(req, opts);
     const body = await parseJsonBody(req, ctx);
@@ -21,8 +16,8 @@ export async function handleCreatePrediction({ req, res, opts }) {
     if (!isJsonString(claim) || claim.length === 0) {
         throw new HttpError(400, 'claim is required (non-empty string)');
     }
-    if (claim.length > 4096) {
-        throw new HttpError(400, 'claim exceeds 4096-character cap');
+    if (claim.length > MAX_SHORT_FIELD_LEN) {
+        throw new HttpError(400, `claim exceeds ${MAX_SHORT_FIELD_LEN}-character cap`);
     }
     const classTag = body['classTag'];
     if (!isJsonString(classTag) || classTag.length === 0) {
@@ -54,9 +49,8 @@ export async function handleCreatePrediction({ req, res, opts }) {
     }
     const claimed = { classTag, claimText: claim, estimateValue, estimateUnit, targetDate: targetDateValue };
     const mirror = predictionMirror(ctx.tenantId, claimed, loadConfig(opts.hippoRoot).defaultHalfLifeDays);
-    const prediction = await requireGroup(opts.store, 'predictions').savePrediction(ctx.tenantId, { ...claimed, mirror }, ctx.actor.subject);
+    const prediction = await savePrediction(ctx, { ...claimed, mirror });
     sendJson(res, 201, { prediction });
-    return;
 }
 /** Which rows a list reads; a status other than all or open needs a class, as no store reads one closed state across classes. */
 function listFilter(classTag, status) {
@@ -78,15 +72,12 @@ export async function handleListPredictions({ req, res, opts, query }) {
     const limit = parseListLimit(query.get('limit'));
     const after = parseCursor(query.get('cursor'), 'string', 'integer');
     const ctx = await buildContextWithAuth(req, opts);
-    const predictions = await requireGroup(opts.store, 'predictions').listPredictions(ctx.tenantId, { ...listFilter(classTag, status), limit: limit + 1, after });
+    const predictions = await listPredictions(ctx, { ...listFilter(classTag, status), limit: limit + 1, after });
     const page = pageOf(predictions, limit, byCreatedAt);
     sendJson(res, 200, { predictions: page.items, next_cursor: page.nextCursor });
-    return;
 }
-// Reference-class / planning-fallacy detector.
-// Order matters: this must match BEFORE /v1/predictions/:id since 'stats'
-// is not a number — the :id regex requires \d+ so they don't conflict,
-// but routing this first avoids the dispatch order risk.
+// Reference-class / planning-fallacy detector; registered BEFORE /v1/predictions/:id so dispatch order cannot matter ('stats' is not a number, but routing
+// it first is safer).
 export async function handlePredictionStats({ req, res, opts, query }) {
     const classTag = query.get('class');
     if (!classTag || classTag.length === 0) {
@@ -96,19 +87,17 @@ export async function handlePredictionStats({ req, res, opts, query }) {
         throw new HttpError(400, `class exceeds ${MAX_ID_LEN}-character cap`);
     }
     const ctx = await buildContextWithAuth(req, opts);
-    const baserate = await requireGroup(opts.store, 'predictions').predictionBaserate(ctx.tenantId, classTag, ctx.actor.subject);
+    const baserate = await predictionBaserate(ctx, classTag);
     sendJson(res, 200, { baserate });
-    return;
 }
 export async function handleGetPrediction({ req, res, opts }, predictionByIdMatch) {
     const id = parseInt(predictionByIdMatch[1], 10);
     const ctx = await buildContextWithAuth(req, opts);
-    const prediction = await requireGroup(opts.store, 'predictions').predictionById(ctx.tenantId, id);
+    const prediction = await predictionById(ctx, id);
     if (!prediction) {
         throw new HttpError(404, `prediction ${id} not found`);
     }
     sendJson(res, 200, { prediction });
-    return;
 }
 export async function handleClosePrediction({ req, res, opts }, predictionCloseMatch) {
     const id = parseInt(predictionCloseMatch[1], 10);
@@ -138,8 +127,7 @@ export async function handleClosePrediction({ req, res, opts }, predictionCloseM
         closureNote = note;
     }
     const close = { closureState: state, actualValue, closureNote };
-    const prediction = await requireGroup(opts.store, 'predictions').closePrediction(ctx.tenantId, id, close, ctx.actor.subject);
+    const prediction = await closePrediction(ctx, id, close);
     sendJson(res, 200, { prediction });
-    return;
 }
 //# sourceMappingURL=predictions.js.map

package/dist/server/routes/processes.js

@@ -1,21 +1,20 @@
 // /v1/processes routes.
-import { PROCESS } from '../../objects/processes.js';
+import { MAX_PROCESS_STEP_LEN, MAX_PROCESS_STEPS, PROCESS } from '../../objects/processes.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { isJsonString } from '../../util/json.js';
-import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
-// HTTP-boundary validation for a process `steps` body (untrusted). Returns the
-// step strings (saveProcess re-validates + trims, this is the fail-fast 400
-// gate). Caps mirror src/objects/processes.ts MAX_PROCESS_STEPS / MAX_PROCESS_STEP_LEN.
+import { saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute } from './object-routes.js';
+// HTTP-boundary validation for an untrusted process `steps` body; saveProcess re-validates and trims, this is the fail-fast 400 gate.
 function validateProcessStepsBody(raw) {
     if (raw === undefined || raw === null)
         return [];
     if (!Array.isArray(raw)) {
         throw new HttpError(400, 'steps must be an array of strings');
     }
-    if (raw.length > 200) {
-        throw new HttpError(400, 'steps exceeds 200-step cap');
+    if (raw.length > MAX_PROCESS_STEPS) {
+        throw new HttpError(400, `steps exceeds ${MAX_PROCESS_STEPS}-step cap`);
     }
     for (const item of raw) {
         if (!isJsonString(item)) {
@@ -24,8 +23,8 @@ function validateProcessStepsBody(raw) {
         if (item.trim().length === 0) {
             throw new HttpError(400, 'a step is empty');
         }
-        if (item.length > 2000) {
-            throw new HttpError(400, 'a step exceeds the 2000-character cap');
+        if (item.length > MAX_PROCESS_STEP_LEN) {
+            throw new HttpError(400, `a step exceeds the ${MAX_PROCESS_STEP_LEN}-character cap`);
         }
     }
     // SAFETY: every item in raw was confirmed to be a string in the loop above.
@@ -41,29 +40,20 @@ const processRoutes = {
         if (steps.length === 0) {
             throw new HttpError(400, 'steps is required (at least one step) for a supersession');
         }
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
-        const description = optionalString(body, 'description', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_SHORT_FIELD_LEN);
+        const description = optionalString(body, 'description', MAX_SHORT_FIELD_LEN);
         return (existing, id) => ({ processName: existing.processName, steps, description, changeSummary, supersedesProcessId: id });
     },
 };
-// ── processes (first-class object) ──
-//
-// 5 routes: POST /v1/processes (new; body processName + steps[] + description),
-// GET /v1/processes (list, status filter), GET /v1/processes/:id (show),
-// POST /v1/processes/:id/supersede (active -> superseded by a new version; body
-// steps[] + changeSummary + description; reuses the predecessor's name),
-// POST /v1/processes/:id/close (active -> closed). Bearer-authed + tenant-scoped
-// via buildContextWithAuth. status validated against VALID_PROCESS_STATES. DoS
-// caps: processName/description/changeSummary 4096, steps 200x2000
-// (validateProcessStepsBody). Mirrors /v1/decisions; the delta lifecycle is the
-// decision supersede path.
+// Routes: /v1/processes (create, list, show, supersede, close), mirroring /v1/decisions; supersede creates a new version that reuses the predecessor's name.
+// DoS caps: processName/description/changeSummary MAX_SHORT_FIELD_LEN, steps MAX_PROCESS_STEPS x MAX_PROCESS_STEP_LEN (validateProcessStepsBody).
 export async function handleCreateProcess(rr) {
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const body = await parseJsonBody(rr.req, ctx);
-    const process = await saveFor(rr, PROCESS, ctx.tenantId, ctx.actor.subject, {
-        processName: requiredString(body, 'processName', { max: 4096 }),
+    const process = await saveFor(ctx, PROCESS, {
+        processName: requiredString(body, 'processName', { max: MAX_SHORT_FIELD_LEN }),
         steps: validateProcessStepsBody(body['steps']),
-        description: optionalString(body, 'description', 4096),
+        description: optionalString(body, 'description', MAX_SHORT_FIELD_LEN),
     });
     sendJson(rr.res, 201, { process });
 }

package/dist/server/routes/project-briefs.js

@@ -1,9 +1,10 @@
 // /v1/project-briefs routes.
-import { briefFromReceipts, MAX_REPO_LEN, PROJECT_BRIEF, refreshedBrief } from '../../objects/project-briefs.js';
+import { briefFromReceipts, MAX_CHANGE_SUMMARY_LEN, MAX_REPO_LEN, PROJECT_BRIEF, refreshedBrief, } from '../../objects/project-briefs.js';
 import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
 import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
 const briefRoutes = {
     noun: 'project brief',
     field: 'brief',
@@ -12,24 +13,16 @@ const briefRoutes = {
     filterParam: 'repo',
     revise: (body) => {
         const summary = requiredString(body, 'summary', { max: 8192 });
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_CHANGE_SUMMARY_LEN);
         return (existing, id) => ({ repo: existing.repo, summary, changeSummary, supersedesBriefId: id });
     },
 };
-// ── project_brief routes ──
-//
-// 6 routes: POST /v1/project-briefs (new; body repo + summary), GET
-// /v1/project-briefs (list; status + repo filter; shared parseListLimit), POST
-// /v1/project-briefs/refresh (body {repo, dryRun?} -> auto-assemble the brief
-// from the repo's receipts; dryRun returns {markdown} without writing; ordered
-// before /:id), GET /v1/project-briefs/:id, POST /v1/project-briefs/:id/supersede,
-// POST /v1/project-briefs/:id/close. DoS caps: repo 256, summary 8192,
-// changeSummary 4096. The store validates + throws; the boundary maps validation
-// -> 400, not-found -> 404, not-active -> 409. Mirrors /v1/skills.
+// Routes: /v1/project-briefs (create, list, refresh, show, supersede, close), mirroring /v1/skills; /refresh is ordered before /:id.
+// The store validates and throws; the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
 export async function handleCreateProjectBrief(rr) {
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const body = await parseJsonBody(rr.req, ctx);
-    const brief = await saveFor(rr, PROJECT_BRIEF, ctx.tenantId, ctx.actor.subject, {
+    const brief = await saveFor(ctx, PROJECT_BRIEF, {
         repo: requiredString(body, 'repo', { max: MAX_REPO_LEN }),
         summary: requiredString(body, 'summary', { max: 8192 }),
     });
@@ -46,11 +39,11 @@ export async function handleRefreshProjectBrief(rr) {
     const body = await parseJsonBody(req, ctx);
     const repo = requiredString(body, 'repo', { max: MAX_REPO_LEN });
     if (body['dryRun'] === true) {
-        const { markdown, receiptCount } = await briefFromReceipts(objectsOf(rr), ctx.tenantId, repo);
+        const { markdown, receiptCount } = await briefFromReceipts(objectsOf(ctx), ctx.tenantId, repo);
         sendJson(res, 200, { markdown, receiptCount });
         return;
     }
-    const brief = await refreshedBrief(objectsOf(rr), { hippoRoot: opts.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, repo);
+    const brief = await refreshedBrief(objectsOf(ctx), { hippoRoot: opts.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, repo);
     sendJson(res, 200, { brief });
 }
 export function handleSupersedeProjectBrief(rr, match) {

package/dist/server/routes/recall.js

@@ -3,11 +3,10 @@ import { dirname, resolve } from 'node:path';
 import { assertCallerProject, resolveProjectIdentity } from '../../core/project-identity.js';
 import { isSharedStore } from '../../core/config.js';
 import { assembleCost, contextCost, drillCost } from '../../api/context-render.js';
-import { storeFor } from '../../store/index.js';
-import { biasHintEnabled } from '../../api/recall-history.js';
 import { assemble, drillDown, getContext, recordTokens, retrieve } from '../../api/index.js';
+import { RECALL_RECORDING } from '../../api/recall-finish.js';
 import { httpParams, parseContextRequest, parseRecallRequest } from '../../api/recall-request.js';
-import { anchorSkippedRows, noteRecall, peekSessionRing, resetSessionRings, sessionRing } from '../../api/recall-record.js';
+import { resetSessionRings } from '../../api/recall-record.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
 import { MAX_LIST_LIMIT, parseListLimit, validateIdSegment } from '../validation.js';
@@ -15,38 +14,21 @@ import { MAX_LIST_LIMIT, parseListLimit, validateIdSegment } from '../validation
 export function __resetSessionRecallHistoryHttp() {
     resetSessionRings('http');
 }
-// HTTP threads the ring through opts.recallHistory, so the hint retrieve() returns is the one the caller sees.
-function recallHistoryFor(ctx, sessionId) {
-    return sessionId && biasHintEnabled('anchoring') ? peekSessionRing('http', ctx.tenantId, sessionId) : undefined;
-}
 // GET /v1/memories?q=...&limit=...&mode=...&scope=...&include_continuity=1
 export async function handleRecallMemories({ req, res, opts, query }) {
     const { opts: recallOpts, limit, mode, explain } = parseRecallRequest(httpParams(query));
-    const { query: q, includeContinuity, sessionId } = recallOpts;
     const ctx = await buildContextWithAuth(req, opts);
-    const recallHistory = recallHistoryFor(ctx, sessionId);
-    // Written first in the recall's own write, so a recall that fails leaves no row.
-    const leadingAudit = sessionId ? [] : anchorSkippedRows({ tenantId: ctx.tenantId, actor: ctx.actor.subject }, q);
-    const result = await retrieve(ctx, { ...recallOpts, limit, mode, explain, recallHistory, leadingAudit });
-    // The ring is created only after recall succeeds, so a 400 cannot LRU-evict a live session.
-    const ring = sessionRing('http', ctx.tenantId, sessionId);
-    if (ring)
-        noteRecall(ring, q, result.results[0]?.id ?? null, result.anchoringHint?.memoryId);
-    // HTTP counts the rows it returns here; `retrieve` cannot count for every ranker, since MCP shows a different band and counts none.
-    await storeFor(ctx).bumpRecallStats(result.results.length);
+    const result = await retrieve(ctx, { ...recallOpts, limit, mode, explain, recordAs: RECALL_RECORDING.http });
     // Continuity payloads should never be cached. The caller is asking for
     // session-state-aware data; intermediaries must not reuse it across users.
-    if (includeContinuity) {
+    if (recallOpts.includeContinuity) {
         res.setHeader('Cache-Control', 'no-store');
     }
-    await recordTokens(ctx, 'http_recall', { items: result.results.length, tokens: result.tokens + (result.continuityTokens ?? 0), sessionId: sessionId ?? null });
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1
-// Phase 2 context-engine API. Returns ordered AssembledContextItem[]
-// with fresh-tail raws + summary substitutions + bio-aware budget fit.
-// Tenant scope from Bearer; default-deny on private rows.
+// GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1: ordered AssembledContextItem[] (fresh-tail raws, summary substitutions, bio-aware
+// budget fit). Tenant scope from the Bearer; default-deny on private rows.
 export async function handleAssembleSession({ req, res, opts, query }, assembleMatch) {
     validateIdSegment(assembleMatch.id, 'session id');
     const budgetRaw = query.get('budget');
@@ -82,12 +64,8 @@ export async function handleAssembleSession({ req, res, opts, query }, assembleM
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/recall/drill/:id?limit=N&budget=N
-// Companion to /v1/memories. When recall surfaces a level-2 summary in
-// place of overflowed children (RecallResultItem.isSummary === true), the
-// caller drills into the summary id to recover the originals. Tenant
-// scoped via Bearer; default-deny on private scopes for both summary
-// and children.
+// GET /v1/recall/drill/:id?limit=N&budget=N: companion to /v1/memories; the caller drills into a level-2 summary (RecallResultItem.isSummary) to recover the
+// originals. Tenant-scoped via Bearer; default-deny on private scopes for the summary and its children.
 export async function handleDrillRecall({ req, res, opts, query }, drillMatch) {
     validateIdSegment(drillMatch.id, 'summary id');
     const limitRaw = query.get('limit');
@@ -145,11 +123,8 @@ function contextReader(hippoRoot, query) {
     assertCallerProject({ name, aliases });
     return { name, legacyName: name, aliases };
 }
-// GET /v1/context — assemble a budget-bounded context bundle. Returns
-// ContextResult JSON (entries + tokens + activeSnapshot + sessionHandoff
-// + recentEvents). No server-side rendering; clients render. Tenant-scoped
-// via the Bearer. Pinned-only + '*' fallback skip the recall audit emit
-// (matches cmdContext); real-query hybrid search emits one 'recall' row.
+// GET /v1/context: a budget-bounded ContextResult JSON, rendered by clients, not the server; tenant-scoped via the Bearer.
+// Pinned-only and '*' fallback skip the recall audit emit (as cmdContext does); a real-query hybrid search emits one 'recall' row.
 export async function handleGetContext({ req, res, opts, query }) {
     const parsed = parseContextRequest(httpParams(query));
     const ctx = await buildContextWithAuth(req, opts);

package/dist/server/routes/skills.js

@@ -2,8 +2,9 @@
 import { MAX_SKILL_NAME_LEN, SKILL, skillsMarkdown } from '../../objects/skills.js';
 import { sendJson } from '../../util/http-util.js';
 import { buildContextWithAuth } from '../auth.js';
-import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, objectsOf, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
+import { objectsOf, saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
 const INSTRUCTIONS = { max: 8192, plural: true };
 const skillRoutes = {
     noun: 'skill',
@@ -13,26 +14,16 @@ const skillRoutes = {
     revise: (body) => {
         const instructions = requiredString(body, 'instructions', INSTRUCTIONS);
         const trigger = optionalString(body, 'trigger', 1024);
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_SHORT_FIELD_LEN);
         return (existing, id) => ({ skillName: existing.skillName, instructions, trigger, changeSummary, supersedesSkillId: id });
     },
 };
-// ── skills (first-class object, executable/exportable) ──
-//
-// 6 routes: POST /v1/skills (new; body skillName + instructions + trigger?),
-// GET /v1/skills (list, status filter; shared parseListLimit), GET
-// /v1/skills/export (renders ACTIVE skills as an AGENTS.md/CLAUDE.md markdown
-// block -> {markdown}; literal 'export' is non-numeric so the /:id (\d+) route
-// cannot capture it, but it is ordered first regardless), GET /v1/skills/:id,
-// POST /v1/skills/:id/supersede, POST /v1/skills/:id/close. DoS caps:
-// skillName 256, instructions 8192, trigger 1024, changeSummary 4096. The store
-// validates + throws; the boundary maps validation -> 400, not-found -> 404,
-// not-active -> 409. Mirrors /v1/processes; "executable" = exportable
-// instruction (no code exec).
+// Routes: /v1/skills (create, list, export, show, supersede, close), mirroring /v1/processes; "executable" means exportable instruction (no code exec).
+// GET /v1/skills/export renders ACTIVE skills as a markdown block for AGENTS.md or CLAUDE.md and is ordered before /:id.
 export async function handleCreateSkill(rr) {
     const ctx = await buildContextWithAuth(rr.req, rr.opts);
     const body = await parseJsonBody(rr.req, ctx);
-    const skill = await saveFor(rr, SKILL, ctx.tenantId, ctx.actor.subject, {
+    const skill = await saveFor(ctx, SKILL, {
         skillName: requiredString(body, 'skillName', { max: MAX_SKILL_NAME_LEN }),
         instructions: requiredString(body, 'instructions', INSTRUCTIONS),
         trigger: optionalString(body, 'trigger', 1024),
@@ -47,9 +38,8 @@ export function handleListSkills(rr) {
 export async function handleExportSkills(rr) {
     const { req, res, opts } = rr;
     const ctx = await buildContextWithAuth(req, opts);
-    const markdown = await skillsMarkdown(objectsOf(rr), ctx.tenantId);
+    const markdown = await skillsMarkdown(objectsOf(ctx), ctx.tenantId);
     sendJson(res, 200, { markdown });
-    return;
 }
 export function handleSupersedeSkill(rr, match) {
     return supersedeRoute(skillRoutes, rr, match);

package/dist/server/server-detect.d.ts

@@ -1,70 +1,26 @@
 export interface ServerInfo {
-    /**
-     * Pidfile schema version (L3). Absent on pidfiles written before this
-     * field existed — detectServer treats a missing `schema` as legacy and
-     * still accepts the pidfile.
-     */
+    /** Pidfile schema version; absent on pidfiles written before the field existed, which detectServer treats as legacy and still accepts. */
     schema?: number;
     pid: number;
     port: number;
     url: string;
     started_at: string;
 }
-/**
- * Read .hippo/server.pid and return the embedded ServerInfo if a live hippo
- * server is genuinely answering on the recorded url. Returns null on missing,
- * malformed, or stale pidfiles, and best-effort unlinks the file in the
- * stale/malformed cases.
- *
- * Liveness is proven in two steps. `process.kill(pid, 0)` rules out dead
- * pids. But a pid can be reused by an unrelated process, so a GET /health
- * then confirms the process that answers is *this* hippo server: its
- * `started_at` must equal the pidfile's. A mismatch, non-200, malformed
- * body, or timeout all mean the pidfile is stale.
- *
- * The /health probe runs only when a pidfile exists and the pid is live, so
- * the common no-server path stays a single fast file existence check.
- */
+/** Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking of missing/stale/malformed pidfiles).
+ * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live. */
 export declare function detectServer(hippoRoot: string): Promise<ServerInfo | null>;
-/**
- * Atomically write the pidfile. Writes to a process-scoped temp file then
- * renames into place, which is atomic on POSIX and on NTFS via MoveFileEx.
- *
- * `startedAt` is supplied by the caller (`serve()`) rather than generated
- * here, so the pidfile and the server's GET /health response carry the same
- * timestamp — detectServer's liveness probe compares the two for equality.
- */
+/** Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes from the caller (`serve()`) so the
+ * pidfile and GET /health carry the same timestamp, which detectServer's liveness probe compares. */
 export declare function writePidfile(hippoRoot: string, opts: {
     port: number;
     url: string;
     startedAt: string;
 }): void;
-/**
- * Best-effort pidfile removal. Silent on ENOENT or any other error so the
- * caller can use this in shutdown paths without fear of throwing.
- *
- * Identity-blind: deletes whatever pidfile is on disk. A shutdown path that
- * must not clobber a newer server's pidfile should use removePidfileIfOwned.
- */
+/** Best-effort pidfile removal, silent on any error so shutdown paths can call it. Identity-blind: a shutdown that must not clobber a newer server's pidfile
+ * uses removePidfileIfOwned. */
 export declare function removePidfile(hippoRoot: string): void;
-/**
- * Remove the pidfile only if it still describes the caller's own server.
- * Reads and parses the pidfile and unlinks it ONLY when both `pid` and
- * `started_at` match `owner`. A pidfile rewritten by a newer server is left
- * intact, so a shutting-down older server cannot orphan the newer one by
- * deleting its pidfile out from under it.
- *
- * Best-effort and never throws: a missing, unreadable, malformed, or
- * non-object pidfile (including a literal JSON `null`) is "not provably mine"
- * and left alone — detectServer unlinks a malformed pidfile on its next
- * probe, so it does not leak. Returns true iff a matching pidfile was removed.
- *
- * Residual TOCTOU: the pidfile could be rewritten between the read and the
- * unlink. The window is microseconds and the shape is the same read-check-
- * unlink detectServer already uses; this narrows the clobber from an
- * unbounded window (any time between writePidfile and stop) to a negligible
- * one.
- */
+/** Removes the pidfile ONLY when both `pid` and `started_at` match `owner`, so an older shutting-down server cannot orphan a newer one; never throws.
+ * Anything unreadable or malformed is "not provably mine" and left alone (detectServer unlinks it). Returns true iff removed. */
 export declare function removePidfileIfOwned(hippoRoot: string, owner: {
     pid: number;
     startedAt: string;