hippo-memory 1.70.0 → 1.71.0

package/dist/store/sessions.d.ts

@@ -1,3 +1,4 @@
+import type { JsonObject } from './working-memory.js';
 import { type TaskSnapshot, type SessionEvent } from './rows.js';
 /** A shared-store caller's task state bucket: its owner and every name its project's rows carry. */
 export interface ContinuityKey {
@@ -26,36 +27,11 @@ type SnapshotInput = {
 };
 export declare function saveActiveTaskSnapshot(hippoRoot: string, tenantId: string, snapshot: SnapshotInput, key?: ContinuityKey): TaskSnapshot;
 export declare function loadActiveTaskSnapshot(hippoRoot: string, tenantId: string, key?: ContinuityKey): TaskSnapshot | null;
-/**
- * Default freshness bound for AMBIENT active-task-snapshot reads: 72h, chosen over 48h so
- * a Friday-evening orphan still offers continuity on Monday morning.
- * Exported so callers can override via `loadFreshActiveTaskSnapshot`'s
- * `opts.maxAgeMs`; deliberately no env knob (Simplicity First).
- */
+/** Default freshness bound for AMBIENT active-task-snapshot reads: 72h rather than 48h so a Friday-evening orphan still offers continuity on Monday;
+ * override via `loadFreshActiveTaskSnapshot`'s `opts.maxAgeMs`; deliberately no env knob. */
 export declare const SNAPSHOT_AMBIENT_MAX_AGE_MS: number;
-/**
- * Bounded read for AMBIENT active-task-snapshot surfaces (UserPromptSubmit
- * hook context, MCP recall block), so snapshots expire. A
- * snapshot written by `hippo pre-compact` has no death path tied to the
- * session that owns it, so an orphaned row would otherwise inject into
- * every prompt of every later session forever. Wraps `loadActiveTaskSnapshot`
- * (unchanged, still the source of truth for explicit continuity surfaces),
- * then applies, in order:
- *
- * 1. Owner match — ONLY when both `opts.sessionId` and the snapshot's
- *    `session_id` are non-null, non-empty strings and strictly equal
- *    (`===`). Owner reads are unbounded: the session that owns the snapshot
- *    can always see its own working state, regardless of age.
- * 2. Age check — everything else, including absent-vs-absent ids. A
- *    null/undefined/empty id on EITHER side never counts as an owner match;
- *    it falls through here instead. (`runPreCompact` can legitimately save a
- *    snapshot with `session_id = null`; a null-equals-null "match" would
- *    reopen indefinite ambient injection for exactly those rows.) Returns
- *    the snapshot only when `age(updated_at) <= maxAgeMs` (default
- *    `SNAPSHOT_AMBIENT_MAX_AGE_MS`); otherwise null.
- *
- * No SQL change — age derives from the existing `updated_at` column.
- */
+/** Bounded read for AMBIENT snapshot surfaces so orphaned snapshots expire. The owner (both session ids non-empty and `===`) always sees its own state;
+ * all others, null ids included (null === null is no match), get it only if age(updated_at) <= maxAgeMs (default `SNAPSHOT_AMBIENT_MAX_AGE_MS`), else null. */
 export declare function loadFreshActiveTaskSnapshot(hippoRoot: string, tenantId: string, opts?: {
     maxAgeMs?: number;
     sessionId?: string | null;
@@ -66,15 +42,8 @@ export declare function freshActiveSnapshot(snapshot: TaskSnapshot | null, opts?
     sessionId?: string | null;
 }): TaskSnapshot | null;
 export declare function clearActiveTaskSnapshot(hippoRoot: string, tenantId: string, clearedStatus?: string): boolean;
-/**
- * Close the `active` task snapshot(s) owned by `sessionId`, for the
- * session-end death path.
- * Only one `active` row exists per tenant (per owner and project when keyed) in practice (supersession happens
- * at save), but the WHERE clause scopes on `session_id` too — not just
- * `status='active' AND tenant_id=?` — so an ending session can never close a
- * different, newer session's active snapshot. Returns the number of rows
- * closed (0 when no active row is owned by `sessionId`).
- */
+/** Close the `active` task snapshot(s) owned by `sessionId` at session end; the WHERE scopes on `session_id` too so an ending session can never close a
+ * newer session's snapshot. Returns the number of rows closed. */
 export declare function closeTaskSnapshotsForSession(hippoRoot: string, tenantId: string, sessionId: string, status?: string, key?: ContinuityKey): number;
 interface SessionEventInput {
     session_id: string;
@@ -83,7 +52,7 @@ interface SessionEventInput {
     task?: string | null;
     source?: string;
     scope?: string | null;
-    metadata?: Record<string, unknown>;
+    metadata?: JsonObject;
 }
 export declare function appendSessionEvent(hippoRoot: string, tenantId: string, event: SessionEventInput): SessionEvent;
 export declare function listSessionEvents(hippoRoot: string, tenantId: string, options?: {
@@ -91,17 +60,11 @@ export declare function listSessionEvents(hippoRoot: string, tenantId: string, o
     task?: string;
     limit?: number;
 }): SessionEvent[];
-/**
- * Return session_ids with a `session_complete` event newer than `sinceMs`.
- * Used by the sleep auto-promotion pass to bound scanning to a fixed window.
- */
+/** Session_ids with a `session_complete` event newer than `sinceMs`; bounds the sleep auto-promotion scan to a fixed window. */
 export declare function findPromotableSessions(hippoRoot: string, tenantId: string, sinceMs: number): Array<{
     session_id: string;
 }>;
-/**
- * Idempotency guard — true if a trace-layer memory with this source_session_id
- * already exists.
- */
+/** Idempotency guard: true if a trace-layer memory with this source_session_id already exists. */
 export declare function traceExistsForSession(hippoRoot: string, tenantId: string, session_id: string): boolean;
 /** One caller's claim on a session id. */
 export interface SessionOwnerBinding {

package/dist/store/sessions.js

@@ -73,8 +73,7 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
 export function loadActiveTaskSnapshot(hippoRoot, tenantId, key) {
     assertTenantId('loadActiveTaskSnapshot', tenantId);
     const owned = key ? continuityWhere(key) : null;
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: row's shape matches the ten columns named in the SELECT above.
         const row = db.prepare(`
       SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
@@ -92,47 +91,17 @@ export function loadActiveTaskSnapshot(hippoRoot, tenantId, key) {
         if (!key)
             writeActiveTaskMirror(hippoRoot, tenantId, loaded);
         return loaded;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Default freshness bound for AMBIENT active-task-snapshot reads: 72h, chosen over 48h so
- * a Friday-evening orphan still offers continuity on Monday morning.
- * Exported so callers can override via `loadFreshActiveTaskSnapshot`'s
- * `opts.maxAgeMs`; deliberately no env knob (Simplicity First).
- */
+/** Default freshness bound for AMBIENT active-task-snapshot reads: 72h rather than 48h so a Friday-evening orphan still offers continuity on Monday;
+ * override via `loadFreshActiveTaskSnapshot`'s `opts.maxAgeMs`; deliberately no env knob. */
 export const SNAPSHOT_AMBIENT_MAX_AGE_MS = 72 * 60 * 60 * 1000;
-/** A usable session id: non-null, non-empty string. Named predicate (not an
- * inline `typeof` check) so the owner-match rule in
- * `loadFreshActiveTaskSnapshot` states its contract once. */
+/** A usable session id: non-null, non-empty string; named so the owner-match rule in `loadFreshActiveTaskSnapshot` states its contract once. */
 function isNonEmptySessionId(value) {
     return typeof value === 'string' && value.length > 0;
 }
-/**
- * Bounded read for AMBIENT active-task-snapshot surfaces (UserPromptSubmit
- * hook context, MCP recall block), so snapshots expire. A
- * snapshot written by `hippo pre-compact` has no death path tied to the
- * session that owns it, so an orphaned row would otherwise inject into
- * every prompt of every later session forever. Wraps `loadActiveTaskSnapshot`
- * (unchanged, still the source of truth for explicit continuity surfaces),
- * then applies, in order:
- *
- * 1. Owner match — ONLY when both `opts.sessionId` and the snapshot's
- *    `session_id` are non-null, non-empty strings and strictly equal
- *    (`===`). Owner reads are unbounded: the session that owns the snapshot
- *    can always see its own working state, regardless of age.
- * 2. Age check — everything else, including absent-vs-absent ids. A
- *    null/undefined/empty id on EITHER side never counts as an owner match;
- *    it falls through here instead. (`runPreCompact` can legitimately save a
- *    snapshot with `session_id = null`; a null-equals-null "match" would
- *    reopen indefinite ambient injection for exactly those rows.) Returns
- *    the snapshot only when `age(updated_at) <= maxAgeMs` (default
- *    `SNAPSHOT_AMBIENT_MAX_AGE_MS`); otherwise null.
- *
- * No SQL change — age derives from the existing `updated_at` column.
- */
+/** Bounded read for AMBIENT snapshot surfaces so orphaned snapshots expire. The owner (both session ids non-empty and `===`) always sees its own state;
+ * all others, null ids included (null === null is no match), get it only if age(updated_at) <= maxAgeMs (default `SNAPSHOT_AMBIENT_MAX_AGE_MS`), else null. */
 export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}, key) {
     return freshActiveSnapshot(loadActiveTaskSnapshot(hippoRoot, tenantId, key), opts);
 }
@@ -170,15 +139,8 @@ export function clearActiveTaskSnapshot(hippoRoot, tenantId, clearedStatus = 'cl
         closeHippoDb(db);
     }
 }
-/**
- * Close the `active` task snapshot(s) owned by `sessionId`, for the
- * session-end death path.
- * Only one `active` row exists per tenant (per owner and project when keyed) in practice (supersession happens
- * at save), but the WHERE clause scopes on `session_id` too — not just
- * `status='active' AND tenant_id=?` — so an ending session can never close a
- * different, newer session's active snapshot. Returns the number of rows
- * closed (0 when no active row is owned by `sessionId`).
- */
+/** Close the `active` task snapshot(s) owned by `sessionId` at session end; the WHERE scopes on `session_id` too so an ending session can never close a
+ * newer session's snapshot. Returns the number of rows closed. */
 export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, status = 'session-ended', key) {
     assertTenantId('closeTaskSnapshotsForSession', tenantId);
     if (key)
@@ -242,8 +204,7 @@ export function appendSessionEvent(hippoRoot, tenantId, event) {
 }
 export function listSessionEvents(hippoRoot, tenantId, options = {}) {
     assertTenantId('listSessionEvents', tenantId);
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const clauses = ['tenant_id = ?'];
         const params = [tenantId];
         if (options.session_id) {
@@ -267,19 +228,12 @@ export function listSessionEvents(hippoRoot, tenantId, options = {}) {
       LIMIT ?
     `).all(...params);
         return rows.map(rowToSessionEvent).reverse();
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Return session_ids with a `session_complete` event newer than `sinceMs`.
- * Used by the sleep auto-promotion pass to bound scanning to a fixed window.
- */
+/** Session_ids with a `session_complete` event newer than `sinceMs`; bounds the sleep auto-promotion scan to a fixed window. */
 export function findPromotableSessions(hippoRoot, tenantId, sinceMs) {
     assertTenantId('findPromotableSessions', tenantId);
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: rows' shape matches the single `session_id` column selected
         // above.
         const rows = db.prepare(`
@@ -287,29 +241,19 @@ export function findPromotableSessions(hippoRoot, tenantId, sinceMs) {
       WHERE event_type = 'session_complete' AND created_at >= ? AND tenant_id = ?
     `).all(new Date(sinceMs).toISOString(), tenantId);
         return rows;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Idempotency guard — true if a trace-layer memory with this source_session_id
- * already exists.
- */
+/** Idempotency guard: true if a trace-layer memory with this source_session_id already exists. */
 export function traceExistsForSession(hippoRoot, tenantId, session_id) {
     assertTenantId('traceExistsForSession', tenantId);
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const row = db.prepare(`
       SELECT 1 FROM memories
       WHERE source_session_id = ? AND layer = 'trace' AND tenant_id = ?
       LIMIT 1
     `).get(session_id, tenantId);
         return !!row;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** The owner a session id is bound to, or null. */
 function selectSessionOwnerAt(db, tenantId, sessionId) {

package/dist/store/sqlite/connector-events-group.js

@@ -1,5 +1,5 @@
 // hippo.db's half of the ConnectorEvents store group: each call on a handle of its own.
-import { archiveDeletedArtifact, eventSeenAt, githubRouting, insertDlq, logEvent, seenEvent } from '../connectors/github.js';
+import { archiveDeletedArtifact, eventSeenAt, githubRouting, insertGitHubDlq, logEvent, seenEvent } from '../connectors/github.js';
 import { insertSlackDlq, markSlackEventSeen, rawMemoryIdForArtifactAt, slackEventRecord, slackEventSeenAt, slackTeamRoute } from '../connectors/slack.js';
 import { onHandle } from '../open.js';
 function eventRecord(hippoRoot, event) {
@@ -32,7 +32,7 @@ export function sqliteConnectorEvents(hippoRoot) {
         archiveDeletedArtifact: (archive) => archiveArtifact(hippoRoot, archive),
         slackTeamRoute: (teamId) => slackTeamRoute(hippoRoot, teamId),
         githubRouting: (query) => githubRouting(hippoRoot, query),
-        parkDeadLetter: (letter) => (letter.connector === 'slack' ? insertSlackDlq(hippoRoot, letter) : insertDlq(hippoRoot, letter)),
+        parkDeadLetter: (letter) => (letter.connector === 'slack' ? insertSlackDlq(hippoRoot, letter) : insertGitHubDlq(hippoRoot, letter)),
     };
 }
 /** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */

package/dist/store/sqlite/entry-writes-group.js

@@ -2,7 +2,7 @@
 import { ConflictError, NotFoundError } from '../../core/api-errors.js';
 import { appendAuditEvent } from '../audit.js';
 import { isSqliteBusy, withWriteScope } from '../../db/index.js';
-import { errorMessage, log } from '../../util/log.js';
+import { errorFields, errorMessage, log } from '../../util/log.js';
 import { entryAfterOutcome } from '../../core/memory.js';
 import { archiveRawMemory } from '../raw-archive.js';
 import { ownScopeTouches } from '../recall-scope.js';
@@ -155,7 +155,7 @@ function cleanArchivedMirrors(db, hippoRoot, id) {
         removeEntryMirrors(hippoRoot, id);
     }
     catch (mirrorErr) {
-        log.error(`archiveRaw: mirror cleanup failed for ${id} (will retry via reaper on next openHippoDb): ${errorMessage(mirrorErr)}`);
+        log.error(`archiveRaw: mirror cleanup failed for ${id} (will retry via reaper on next openHippoDb): ${errorMessage(mirrorErr)}`, errorFields(mirrorErr));
         return;
     }
     try {

package/dist/store/sqlite/error-codec.js

@@ -1,5 +1,7 @@
-// A thrown error crosses the worker boundary as plain data and arrives as an instance of its class: the server's mappers test `instanceof`, `errcode` and fields.
+// A thrown error crosses the worker boundary as plain data and arrives as an instance
+// of its class: the server's mappers test `instanceof`, `errcode` and fields.
 import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../../core/api-errors.js';
+import { RawAppendOnlyError } from '../../core/raw-append-only.js';
 import { IncompatibleBinaryError, StoreBusyError } from '../../db/index.js';
 import { BodyTimeoutError, BodyTooLargeError, HttpError } from '../../util/http-util.js';
 import { errorMessage, log } from '../../util/log.js';
@@ -10,7 +12,7 @@ import { OtherStoreFolderError, SqliteBlockedError, StoreNotPortedError } from '
 const CLASSES = [
     Error, TypeError, RangeError, SyntaxError, ReferenceError, EvalError, URIError,
     HttpError, BodyTooLargeError, BodyTimeoutError,
-    BadRequestError, ForbiddenError, NotFoundError, ConflictError, RejectedValueError, ScopeForbiddenError,
+    BadRequestError, ForbiddenError, NotFoundError, ConflictError, RejectedValueError, ScopeForbiddenError, RawAppendOnlyError,
     SqliteBlockedError, StoreNotPortedError, OtherStoreFolderError,
     StoreBusyError, IncompatibleBinaryError,
 ];

package/dist/store/sqlite/executor.d.ts

@@ -23,6 +23,7 @@ export interface SqliteExecutor {
     /** Stops the writer thread as a crash would: its running and queued calls reject, and the next write starts a fresh thread. */
     terminateWriter(): void;
 }
-/** Threads for the hippo.db under `hippoRoot`: one writer and two readers. The first call starts the writer for the store's setup; a reader starts at its own first call. */
+/** Threads for the hippo.db under `hippoRoot`: one writer and two readers. The first
+ * call starts the writer for the store's setup; a reader starts at its own first call. */
 export declare function createSqliteExecutor(hippoRoot: string, opts?: ExecutorOptions): SqliteExecutor;
 //# sourceMappingURL=executor.d.ts.map

package/dist/store/sqlite/executor.js

@@ -279,7 +279,8 @@ class WorkerPool {
             finish(pending, () => pending.fail(new StoreBusyError(WORKER_GONE, { cause })));
     }
 }
-/** Threads for the hippo.db under `hippoRoot`: one writer and two readers. The first call starts the writer for the store's setup; a reader starts at its own first call. */
+/** Threads for the hippo.db under `hippoRoot`: one writer and two readers. The first
+ * call starts the writer for the store's setup; a reader starts at its own first call. */
 export function createSqliteExecutor(hippoRoot, opts = {}) {
     return new WorkerPool(hippoRoot, opts);
 }

package/dist/store/sqlite/local.d.ts

@@ -8,9 +8,9 @@ export interface SqliteLocal {
     applyOutcome(outcome: OutcomeWrite, traceId: number): string[];
     /** applyOutcome on the ids of the last recall, which hippo.db's meta table holds with that recall's trace; answers the ids applied. */
     applyOutcomeToLastRecall(target: EntryTarget, good: boolean): string[];
-    /** finishRecall, then the ids this root lacks strengthened under `globalRoot`, then the ids and their trace saved as the last recall.
-     *  A store of another kind keeps no last recall, so its stand-in is its own finishRecall, hence the Promise. */
-    finishLastRecall(writes: LastRecallWrites, globalRoot: string | undefined): void | Promise<void>;
+    /** finishRecall, then the ids this root lacks strengthened under `globalRoot`, then the ids and their trace saved as the last recall;
+     *  answers the trace id. A store of another kind keeps no last recall, so its stand-in is its own finishRecall, answering null. */
+    finishLastRecall(writes: LastRecallWrites, globalRoot: string | undefined): number | null | Promise<number | null>;
 }
 export declare function sqliteLocal(hippoRoot: string): SqliteLocal;
 /** What a served store answers for each write that needs hippo.db's own handle: a refusal. */

package/dist/store/sqlite/local.js

@@ -22,6 +22,7 @@ export function sqliteLocal(hippoRoot) {
                 strengthenRetrieved(globalRoot, ids.filter((id) => !strengthened.has(id)), opts);
             // One write for both keys, so an outcome never pairs these ids with an older trace; a lost trace saves null.
             saveIndex(hippoRoot, { last_retrieval_ids: [...ids], last_trace_id: traceId === null ? null : String(traceId) });
+            return traceId;
         },
     };
 }

package/dist/store/sqlite/object-rows.js

@@ -52,21 +52,24 @@ function rowToIncident(row) {
         createdAt: row.created_at,
     };
 }
-/** A malformed stored steps value reads back as no steps. */
-function parseSteps(raw) {
+/** A malformed stored steps value warns and reads back as no steps. */
+function parseSteps(raw, id) {
+    const site = { table: 'processes', id, column: 'steps' };
     try {
         const parsed = JSON.parse(raw);
         if (Array.isArray(parsed) && parsed.every(isJsonString)) {
             return parsed;
         }
+        warnDamagedColumn(site, 'wrong shape');
         return [];
     }
     catch {
         // Unreadable steps read back as none instead of failing the process read.
+        warnDamagedColumn(site, 'not valid JSON');
         return [];
     }
 }
-const rowToProcess = (row) => ({ ...head(row), processName: row.process_name, description: row.description, steps: parseSteps(row.steps), ...versionedTail(row) });
+const rowToProcess = (row) => ({ ...head(row), processName: row.process_name, description: row.description, steps: parseSteps(row.steps, row.id), ...versionedTail(row) });
 const rowToPolicy = (row) => ({ ...head(row), policyName: row.policy_name, policyText: row.policy_text, validFrom: row.valid_from, validTo: row.valid_to, ...versionedTail(row) });
 const rowToSkill = (row) => ({ ...head(row), skillName: row.skill_name, instructions: row.instructions, trigger: row.trigger_text, ...versionedTail(row) });
 const rowToProjectBrief = (row) => ({ ...head(row), repo: row.repo, summary: row.summary, ...versionedTail(row) });

package/dist/store/sqlite/objects-group.js

@@ -100,7 +100,8 @@ function closeAt(hippoRoot, tenantId, kind, id, close) {
         const closed = closeRow(db, tenantId, kind, id, close);
         if (isObjectRefusal(closed) || !graphType)
             return closed;
-        // Each graph write takes its own write lock, so both wait for the commit. The rows go at once because the rebuild queue is keyed by a mirror memory that may be gone.
+        // Each graph write takes its own write lock, so both wait for the commit. The rows
+        // go at once because the rebuild queue is keyed by a mirror memory that may be gone.
         removeGraphEntitiesForObject(hippoRoot, tenantId, graphType, closed.id);
         markGraphDirty(hippoRoot, tenantId, closed.memoryId);
         return closed;
@@ -177,7 +178,8 @@ function writeObjectRow(db, tenantId, kind, memoryId, save) {
 function refusalOf(written) {
     return 'refused' in written;
 }
-/** Until the typed migration has run, a mirror goes in on the flat half-life that migration moves; the flag is read under the save's write lock, so the two cannot interleave. */
+/** Until the typed migration has run, a mirror goes in on the flat half-life that migration
+ * moves; the flag is read under the save's write lock, so the two cannot interleave. */
 function onStoreHalfLife(db, mirror) {
     if (getMeta(db, TYPED_HALF_LIFE_META_KEY, '') !== '')
         return mirror;

package/dist/store/sqlite/quarantine-group.js

@@ -1,5 +1,5 @@
 // hippo.db's half of the Quarantine store group: each method is one call on its own handle.
-import { errorMessage, log } from '../../util/log.js';
+import { errorFields, errorMessage, log } from '../../util/log.js';
 import { readEntry } from '../entry-reads.js';
 import { writeEntryMirrors } from '../entry-writes.js';
 import { onHandle } from '../open.js';
@@ -12,7 +12,7 @@ function rewriteMirror(hippoRoot, tenantId, id) {
             writeEntryMirrors(hippoRoot, restored);
     }
     catch (err) {
-        log.error(`quarantine: mirror rewrite failed for ${id}: ${errorMessage(err)}`);
+        log.error(`quarantine: mirror rewrite failed for ${id}: ${errorMessage(err)}`, errorFields(err));
     }
 }
 export function sqliteQuarantine(hippoRoot) {

package/dist/store/sqlite/store.d.ts

@@ -1,5 +1,4 @@
-import type { ContinuityBlock, HippoStore, RecallWrites, StoreGroups, Sync } from '../port.js';
-import { type ContinuityKey } from '../sessions.js';
+import type { HippoStore, RecallWrites, StoreGroups, Sync } from '../port.js';
 /** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
 export declare function storeFor(ctx: {
     readonly hippoRoot: string;
@@ -13,8 +12,6 @@ export type SqliteSyncStore = Sync<Omit<HippoStore, AsyncOnly>>;
 export declare function sqliteSyncStore(hippoRoot: string): SqliteSyncStore & Sync<Omit<StoreGroups, AsyncOnly>>;
 /** `sqliteSyncStore` as a served store: each method runs at once and answers through a Promise, so a throw rejects as another store's would. */
 export declare function sqliteStore(hippoRoot: string): HippoStore & StoreGroups;
-/** sqliteStore's continuity read, for the synchronous recall that cannot await the port. */
-export declare function continuityAt(hippoRoot: string, tenantId: string, eventLimit: number, key: ContinuityKey | null): ContinuityBlock;
 /** What a finished recall wrote after its audit rows: the trace's id, null when none was asked or its write failed, and the ids strengthened. */
 interface RecallFinish {
     readonly traceId: number | null;

package/dist/store/sqlite/store.js

@@ -4,7 +4,6 @@ import { listApiKeyRows, readApiKeyRecord } from '../auth.js';
 import { existsSync } from 'node:fs';
 import { appendAuditEvent, listAuditEventsAfter, queryAuditEvents } from '../audit.js';
 import { getHippoDbPath, withWriteScope } from '../../db/index.js';
-import { loadStoredVectorViews } from '../embeddings/index.js';
 import { activeGoalsWithPolicies, localGoalRecallRows, writeGoalRecallLog } from '../goals.js';
 import { planningFallacyEvidenceAt } from '../planning-fallacy-evidence.js';
 import { writeRecallTrace } from '../recall-trace.js';
@@ -28,7 +27,7 @@ import { createKeyAt, createSelfKeyAt } from '../key-writes.js';
 import { onHandle } from '../open.js';
 import { loadRecallSearchEntries } from '../search-rows.js';
 import { listSessionEvents, loadActiveTaskSnapshot } from '../sessions.js';
-import { entriesWithoutVectorAt, writeVectorsAt } from '../vector-writes.js';
+import { entriesWithoutVectorAt, loadStoredVectorViews, writeVectorsAt } from '../vector-index.js';
 /** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
 export function storeFor(ctx) {
     return ctx.store ?? sqliteStore(ctx.hippoRoot);
@@ -266,7 +265,7 @@ function sqliteKeyAudit(hippoRoot) {
     };
 }
 /** sqliteStore's continuity read, for the synchronous recall that cannot await the port. */
-export function continuityAt(hippoRoot, tenantId, eventLimit, key) {
+function continuityAt(hippoRoot, tenantId, eventLimit, key) {
     const activeSnapshot = loadActiveTaskSnapshot(hippoRoot, tenantId, key ?? undefined);
     const sessionId = activeSnapshot?.session_id ?? undefined;
     return {

package/dist/store/sqlite/vector-reads-group.js

@@ -1,12 +1,12 @@
 // hippo.db's vector reads. Async only: the nearest-row scan yields between chunks, so a store worker awaits these where it runs every other method to its end.
 import { loadPhysicsState } from '../../db/physics-state.js';
-import { embeddingIndexStateAt, loadStoredVectors } from '../embeddings/index.js';
 import { onHandle } from '../open.js';
 import { loadVectorCandidateEntries } from '../search-rows.js';
+import { loadStoredVectors, storedIndexState } from '../vector-index.js';
 export function sqliteVectorReads(hippoRoot) {
     return {
         async embeddingIndexState() {
-            return embeddingIndexStateAt(hippoRoot);
+            return storedIndexState(hippoRoot);
         },
         async storedVectors(ids) {
             return loadStoredVectors(hippoRoot, ids);

package/dist/store/sqlite/worker-jobs.js

@@ -1,6 +1,6 @@
 import { auditWriteFailureCount } from '../audit.js';
 import { RequestStores } from '../../db/index.js';
-import { loadStoredVectorViews } from '../embeddings/index.js';
+import { loadStoredVectorViews } from '../vector-index.js';
 import { requestScopes } from '../../util/request-scope.js';
 import { initStore } from '../open.js';
 import { watchCommits } from './commit-watch.js';

package/dist/store/sqlite/worker-ops.d.ts

@@ -7,8 +7,8 @@ export type OpPlace = OpMode | 'server';
 export type OpPlaces<G> = {
     readonly [M in keyof G]: OpPlace;
 };
-/** The store methods that answer from a worker, the base ones under `base`. Tagged by effect, not by name: predictionBaserate appends an audit row and
- *  bumpRecallStats rewrites stats.json, so both are writes. A read that opens through `openStore` is a read: the writer runs that open's setup before any reader serves. */
+/** Store methods answered by a worker, base ones under `base`. Tagged by effect, not name: predictionBaserate (audit row) and bumpRecallStats
+ * (stats.json) are writes. A read that opens through `openStore` is a read: the writer runs that open's setup before any reader serves. */
 export declare const WORKER_OPS: {
     readonly base: {
         readonly findApiKey: "read";
@@ -82,6 +82,17 @@ export declare const WORKER_OPS: {
     readonly graphReads: {
         readonly graphRows: "read";
     };
+    readonly objects: {
+        readonly listObjects: "read";
+        readonly objectById: "read";
+        readonly closeObject: "write";
+        readonly saveObject: "write";
+        readonly openIncident: "write";
+        readonly resolveIncident: "write";
+        readonly policiesInForce: "read";
+        readonly activeSkillsByName: "read";
+        readonly briefReceipts: "read";
+    };
     readonly readiness: {
         readonly ping: "read";
     };

package/dist/store/sqlite/worker-ops.js

@@ -1,5 +1,5 @@
-/** The store methods that answer from a worker, the base ones under `base`. Tagged by effect, not by name: predictionBaserate appends an audit row and
- *  bumpRecallStats rewrites stats.json, so both are writes. A read that opens through `openStore` is a read: the writer runs that open's setup before any reader serves. */
+/** Store methods answered by a worker, base ones under `base`. Tagged by effect, not name: predictionBaserate (audit row) and bumpRecallStats
+ * (stats.json) are writes. A read that opens through `openStore` is a read: the writer runs that open's setup before any reader serves. */
 export const WORKER_OPS = {
     base: {
         findApiKey: 'read',
@@ -73,6 +73,17 @@ export const WORKER_OPS = {
     graphReads: {
         graphRows: 'read',
     },
+    objects: {
+        listObjects: 'read',
+        objectById: 'read',
+        closeObject: 'write',
+        saveObject: 'write',
+        openIncident: 'write',
+        resolveIncident: 'write',
+        policiesInForce: 'read',
+        activeSkillsByName: 'read',
+        briefReceipts: 'read',
+    },
     readiness: {
         ping: 'read',
     },

package/dist/store/sqlite/worker-store.js

@@ -35,7 +35,9 @@ function vectorGroups(executor, inProcess) {
             storedVectors: async (ids) => (ids.length === 0 ? new Map() : vectorCopiesOf(await pack('vectors.storedVectors', ids, vectors.storedVectors))),
         },
         vectorViews: {
-            storedVectorViews: async (ids) => (ids.length === 0 ? new Map() : vectorViewsOf(await pack('vectorViews.storedVectorViews', ids, vectorViews.storedVectorViews))),
+            storedVectorViews: async (ids) => (ids.length === 0
+                ? new Map()
+                : vectorViewsOf(await pack('vectorViews.storedVectorViews', ids, vectorViews.storedVectorViews))),
         },
     };
 }
@@ -52,7 +54,7 @@ function probing(hippoRoot, served) {
  *  `executor` defaults to threads of the store's own, with the server's lock wait. */
 export function workerSqliteStore(hippoRoot, executor = createSqliteExecutor(hippoRoot)) {
     const inProcess = sqliteStore(hippoRoot);
-    const { keyAudit, keyWrites, vectorWrites, entryWrites, contextReads, predictions, dagReads, auditLog, quarantine, graphReads } = WORKER_OPS;
+    const { keyAudit, keyWrites, vectorWrites, entryWrites, contextReads, predictions, dagReads, auditLog, quarantine, graphReads, objects } = WORKER_OPS;
     const store = {
         ...inProcess,
         ...onWorkers(executor, 'base', WORKER_OPS.base, inProcess),
@@ -67,6 +69,7 @@ export function workerSqliteStore(hippoRoot, executor = createSqliteExecutor(hip
         auditLog: onWorkers(executor, 'auditLog', auditLog, inProcess.auditLog),
         quarantine: onWorkers(executor, 'quarantine', quarantine, inProcess.quarantine),
         graphReads: onWorkers(executor, 'graphReads', graphReads, inProcess.graphReads),
+        objects: onWorkers(executor, 'objects', objects, inProcess.objects),
         readiness: probing(hippoRoot, onWorkers(executor, 'readiness', WORKER_OPS.readiness, inProcess.readiness)),
         close: () => executor.close(),
     };