hippo-memory 1.70.0 → 1.72.0

package/dist/api/learn.js

@@ -3,16 +3,16 @@ import { ForbiddenError } from '../core/api-errors.js';
 import { fetchGitLog, extractLessons, partitionLessons, isGitRepo } from '../learn/autolearn.js';
 import { loadConfig } from '../core/config.js';
 import { withRequestStoresSync } from '../db/request-stores.js';
-import { embedMemory } from '../store/embeddings/index.js';
-import { extractInvalidationTarget, invalidateMatchingAmong } from '../learn/invalidation.js';
-import { computeSchemaFit, createMemory, Layer } from '../core/memory.js';
+import { embedMemory } from '../search/embed-memories.js';
+import { extractInvalidationTarget, invalidateMatching, invalidateMatchingAmong, } from '../learn/invalidation.js';
+import { createMemory, Layer, schemaFitFrom, schemaFitSourceOf } from '../core/memory.js';
 import { extractPathTags } from '../search/path-context.js';
-import { canReadScope, personalScopeOf, touchableScopeSql } from '../store/recall-scope.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { canReadScope, personalScopeOf } from '../core/recall-scope.js';
+import { touchableScopeSql } from '../store/rule-sql.js';
 import { duplicateKey, longestWord, storedTextKeys } from '../util/same-text.js';
 import { loadTextsHoldingWords } from '../store/candidates.js';
 import { loadAllEntries } from '../store/entry-reads.js';
-import { writeEntry } from '../store/entry-writes.js';
+import { writeEntriesSkippingRejected } from '../store/entry-writes.js';
 import { updateStats } from '../store/index-and-stats.js';
 // SHORTCUT: two profiles keep each surface's rows as they were; fold MCP onto the CLI profile once it may invalidate.
 export const CLI_LEARN = Object.freeze({ tags: Object.freeze(['error', 'git-learned']), source: 'git-learn', full: true });
@@ -36,6 +36,34 @@ export function learn(ctx, opts) {
     const { kept, dropped } = partitionLessons(parsed);
     return { status: 'scanned', lowInfo: dropped.length, ...writeLessons(ctx, kept, opts, config) };
 }
+/** Writes `batch` in one transaction; a refused lesson is dropped from `live` and `keys` and must not abort the rest of the git-log scan. */
+function landLessons(ctx, batch, live, keys, counts, full) {
+    if (batch.length === 0)
+        return;
+    // SHORTCUT: hippo.db only, as the port has no batch write, stats bump or whole-tenant read, so another store kind answers 501 at the
+    // open; port groups for them once a served store must learn.
+    const landed = [];
+    writeEntriesSkippingRejected(ctx.hippoRoot, (put) => {
+        for (const { entry, key } of batch) {
+            if (put(entry)) {
+                landed.push(entry);
+                continue;
+            }
+            counts.rejected++;
+            keys.delete(key);
+            const at = live.indexOf(entry);
+            if (at !== -1)
+                live.splice(at, 1);
+        }
+    }, ctx.actor.subject);
+    counts.added += landed.length;
+    if (!full)
+        return;
+    if (landed.length > 0)
+        updateStats(ctx.hippoRoot, { remembered: landed.length });
+    for (const entry of landed)
+        void embedMemory(ctx.hippoRoot, entry);
+}
 function writeLessons(ctx, lessons, opts, config) {
     const { hippoRoot, tenantId } = ctx;
     const { profile } = opts;
@@ -43,19 +71,27 @@ function writeLessons(ctx, lessons, opts, config) {
     return withRequestStoresSync(() => {
         // One read serves the batch: invalidation matches against `live`, which follows every write below, as a reload per lesson did.
         const live = profile.full ? loadAllEntries(hippoRoot, tenantId) : [];
-        // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so both read what an admin can.
+        // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so
+        // both read what an admin can.
         const existing = profile.full ? live.filter((e) => e.scope == null || canReadScope(ctx.actor, e.scope)) : undefined;
+        // Each lesson is scored against `existing` as it was before the batch, so its tag counts and texts are read once.
+        const fitSource = existing && schemaFitSourceOf(existing);
         const readable = touchableScopeSql('', personalScopeOf(ctx.actor));
         const keys = storedTextKeys(existing ?? loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord), undefined, readable));
         const pathTags = profile.full ? extractPathTags(opts.repoPath) : [];
         const counts = { added: 0, skipped: 0, rejected: 0, invalidations: [] };
+        // Lessons queue and land in one transaction; an invalidation reads the store, so it flushes the queue first.
+        const queue = [];
+        const flush = () => landLessons(ctx, queue.splice(0), live, keys, counts, profile.full);
         for (const lesson of lessons) {
-            if (keys.has(duplicateKey(lesson))) {
+            const key = duplicateKey(lesson);
+            if (keys.has(key)) {
                 counts.skipped++;
                 continue;
             }
             const target = profile.full ? extractInvalidationTarget(lesson) : null;
             if (target) {
+                flush();
                 const { invalidated } = invalidateMatchingAmong(hippoRoot, live, target, tenantId);
                 if (invalidated > 0)
                     counts.invalidations.push({ from: target.from, count: invalidated });
@@ -65,34 +101,24 @@ function writeLessons(ctx, lessons, opts, config) {
                 tags: [...profile.tags],
                 source: profile.source,
                 confidence: 'observed',
-                schema_fit: existing && computeSchemaFit(lesson, [...profile.tags], existing),
+                schema_fit: fitSource && schemaFitFrom(lesson, [...profile.tags], fitSource),
                 tenantId,
                 baseHalfLifeDays: config.defaultHalfLifeDays,
             });
             for (const tag of pathTags)
                 if (!entry.tags.includes(tag))
                     entry.tags.push(tag);
-            // A refused lesson must not abort the rest of the git-log scan.
-            try {
-                writeEntry(hippoRoot, entry, { actor: ctx.actor.subject });
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    counts.rejected++;
-                    continue;
-                }
-                throw err;
-            }
-            if (profile.full) {
-                updateStats(hippoRoot, { remembered: 1 });
-                live.push(entry);
-            }
-            keys.add(duplicateKey(lesson));
+            queue.push({ entry, key });
             if (profile.full)
-                void embedMemory(hippoRoot, entry);
-            counts.added++;
+                live.push(entry);
+            keys.add(key);
         }
+        flush();
         return counts;
     });
 }
+/** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */
+export function invalidateMemories(ctx, target, options) {
+    return invalidateMatching(ctx.hippoRoot, target, ctx.tenantId, options);
+}
 //# sourceMappingURL=learn.js.map

package/dist/api/ledger-db.d.ts

@@ -1,4 +1,3 @@
-import { type openHippoDb } from '../db/index.js';
 import { type LedgerTurn } from '../store/ledger-turn.js';
 import type { LastSent, TokenSurface, TokenUse } from '../store/token-ledger.js';
 export interface LedgerRootOpts {
@@ -7,14 +6,12 @@ export interface LedgerRootOpts {
 }
 /** `hippoRoot` when it holds a store, else the global store (the prompt hook fires where no local one exists), else null. */
 export declare function ledgerRoot(hippoRoot: string, opts?: LedgerRootOpts): string | null;
-/** Says why a ledger row did not land, at the level its class earns: busy warns once through noteStoreBusy, absent is debug with no stack, unexpected warns once with the error class and stack. */
-export declare function noteLedgerRowSkipped<E>(error: E): void;
+/** Runs `call` on ledgerRoot's store root. Best-effort: undefined on any failure, because a ledger failure must not break context or recall. */
+export declare function onLedgerRoot<T>(hippoRoot: string, opts: LedgerRootOpts | undefined, call: (root: string) => T): T | undefined;
 /** Books one row in ledgerRoot's store, best-effort. */
 export declare function bookTokenUse(hippoRoot: string, use: TokenUse, opts?: LedgerRootOpts): void;
 /** Books a turn's rows and then its delivery event on one connection of ledgerRoot's store, best-effort. */
 export declare function bookLedgerTurn(hippoRoot: string, turn: LedgerTurn, opts?: LedgerRootOpts): void;
 /** What the session last sent on `surface` in ledgerRoot's store; undefined with no ledger or a failed read. */
 export declare function ledgerLastSent(hippoRoot: string, tenantId: string, sessionId: string | null | undefined, surface: TokenSurface, opts?: LedgerRootOpts): LastSent | null | undefined;
-/** Runs `fn` on a handle of ledgerRoot's store, best-effort as the calls above. */
-export declare function withLedgerDb<T>(hippoRoot: string, fn: (db: ReturnType<typeof openHippoDb>) => T, opts?: LedgerRootOpts): T | undefined;
 //# sourceMappingURL=ledger-db.d.ts.map

package/dist/api/ledger-db.js

@@ -1,9 +1,8 @@
 // The store the token ledger writes to for a caller's root; context, recall and the session hooks share it.
-import { isSqliteBusy, noteStoreBusy } from '../db/index.js';
-import { errorFields, errorMessage, log } from '../util/log.js';
-import { getGlobalRoot } from '../sharing/shared.js';
-import { lastSentOnSurface, recordLedgerTurn } from '../store/ledger-turn.js';
-import { isInitialized, onHandle } from '../store/open.js';
+import { errorMessage, log } from '../util/log.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
+import { lastSentOnSurface, noteLedgerRowSkipped, recordLedgerTurn } from '../store/ledger-turn.js';
+import { isInitialized } from '../core/project-identity.js';
 import { sqliteSyncStore } from '../store/sqlite/store.js';
 /** `hippoRoot` when it holds a store, else the global store (the prompt hook fires where no local one exists), else null. */
 export function ledgerRoot(hippoRoot, opts) {
@@ -14,33 +13,8 @@ export function ledgerRoot(hippoRoot, opts) {
     const globalRoot = getGlobalRoot();
     return isInitialized(globalRoot) ? globalRoot : null;
 }
-// SQLite's result codes for a hippo.db it cannot read: a corrupt image, and a file that is no database.
-const SQLITE_CORRUPT = 11;
-const SQLITE_NOTADB = 26;
-/** The one rule for a skipped ledger row. `absent` is a store with no token_ledger table or a hippo.db SQLite cannot read; the command that owns the store reports that, and a hook must stay quiet about it. */
-function ledgerSkipClass(error) {
-    if (isSqliteBusy(error))
-        return 'busy';
-    const code = error instanceof Error && 'errcode' in error ? error.errcode : undefined;
-    if (code === SQLITE_CORRUPT || code === SQLITE_NOTADB)
-        return 'absent';
-    return errorMessage(error).includes('no such table: token_ledger') ? 'absent' : 'unexpected';
-}
-/** Says why a ledger row did not land, at the level its class earns: busy warns once through noteStoreBusy, absent is debug with no stack, unexpected warns once with the error class and stack. */
-export function noteLedgerRowSkipped(error) {
-    const skip = ledgerSkipClass(error);
-    if (skip === 'busy') {
-        noteStoreBusy('token ledger row skipped');
-        return;
-    }
-    const message = `token ledger row skipped: ${errorMessage(error)}`;
-    if (skip === 'absent')
-        log.debug(message);
-    else
-        log.warnThenDebug('token-ledger-row', message, errorFields(error));
-}
 /** Runs `call` on ledgerRoot's store root. Best-effort: undefined on any failure, because a ledger failure must not break context or recall. */
-function onLedgerRoot(hippoRoot, opts, call) {
+export function onLedgerRoot(hippoRoot, opts, call) {
     let root = null;
     try {
         root = ledgerRoot(hippoRoot, opts);
@@ -72,8 +46,4 @@ export function bookLedgerTurn(hippoRoot, turn, opts) {
 export function ledgerLastSent(hippoRoot, tenantId, sessionId, surface, opts) {
     return onLedgerRoot(hippoRoot, opts, (root) => lastSentOnSurface(root, tenantId, sessionId, surface));
 }
-/** Runs `fn` on a handle of ledgerRoot's store, best-effort as the calls above. */
-export function withLedgerDb(hippoRoot, fn, opts) {
-    return onLedgerRoot(hippoRoot, opts, (root) => onHandle(root, fn));
-}
 //# sourceMappingURL=ledger-db.js.map

package/dist/api/memories.d.ts

@@ -0,0 +1,23 @@
+import type { MemoryEntry } from '../core/memory.js';
+import { type StrengthTallies } from '../store/candidates.js';
+import { type Context } from './types.js';
+/** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
+export declare function getMemory(ctx: Context, id: string): Promise<MemoryEntry | null>;
+/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
+export declare function getTouchableMemory(ctx: Context, id: string): Promise<MemoryEntry | null>;
+export interface MemoryStatus extends StrengthTallies {
+    openConflicts: number;
+}
+/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
+export declare function getMemoryStatus(ctx: Context, now: Date, atRiskBelow: number): MemoryStatus;
+/** Which rows a read covers: the caller's tenant, or with `everyTenant` the whole store. */
+export interface TenantReach {
+    everyTenant?: boolean;
+}
+/** Every memory row in reach, oldest first. */
+export declare function listMemories(ctx: Context, reach?: TenantReach): MemoryEntry[];
+/** How many memory rows the whole store holds, counted in SQL. */
+export declare function countAllMemories(ctx: Context): number;
+/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
+export declare function listMemoriesByIds(ctx: Context, ids: readonly string[], reach?: TenantReach): MemoryEntry[];
+//# sourceMappingURL=memories.d.ts.map

package/dist/api/memories.js

@@ -0,0 +1,46 @@
+import { loadStrengthTallies } from '../store/candidates.js';
+import { countOpenConflicts } from '../store/conflicts.js';
+import { NotFoundError } from '../core/api-errors.js';
+import { canTouchScope } from '../core/recall-scope.js';
+import { storeFor } from '../store/index.js';
+import { countAllEntries, loadAllEntries, loadEntriesByIds } from '../store/entry-reads.js';
+import { requireHostAdmin } from './types.js';
+/** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
+export async function getMemory(ctx, id) {
+    const [entry] = await storeFor(ctx).entriesByIds([id], ctx.tenantId);
+    return entry ?? null;
+}
+/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
+export async function getTouchableMemory(ctx, id) {
+    const entry = await getMemory(ctx, id);
+    if (!canTouchScope(ctx.actor, entry?.scope ?? null))
+        throw new NotFoundError(`Memory not found: ${id}`);
+    return entry;
+}
+/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
+export function getMemoryStatus(ctx, now, atRiskBelow) {
+    return {
+        ...loadStrengthTallies(ctx.hippoRoot, ctx.tenantId, now, atRiskBelow),
+        openConflicts: countOpenConflicts(ctx.hippoRoot, ctx.tenantId),
+    };
+}
+function tenantFilter(ctx, reach) {
+    if (!reach.everyTenant)
+        return ctx.tenantId;
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return undefined;
+}
+/** Every memory row in reach, oldest first. */
+export function listMemories(ctx, reach = {}) {
+    return loadAllEntries(ctx.hippoRoot, tenantFilter(ctx, reach));
+}
+/** How many memory rows the whole store holds, counted in SQL. */
+export function countAllMemories(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return countAllEntries(ctx.hippoRoot);
+}
+/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
+export function listMemoriesByIds(ctx, ids, reach = {}) {
+    return loadEntriesByIds(ctx.hippoRoot, ids, tenantFilter(ctx, reach));
+}
+//# sourceMappingURL=memories.js.map

package/dist/api/objects.d.ts

@@ -0,0 +1,9 @@
+import type { SavableDescriptor } from '../objects/descriptor.js';
+import type { ObjectByKind, SavableKind } from '../core/object-types.js';
+import type { Objects } from '../store/port.js';
+import type { Context } from './types.js';
+/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
+export declare function objectsOf(ctx: Context): Objects;
+/** Saves through the request's store as the authenticated caller. */
+export declare function saveFor<K extends SavableKind, W>(ctx: Context, d: SavableDescriptor<K, W>, write: W): Promise<ObjectByKind[K]>;
+//# sourceMappingURL=objects.d.ts.map

package/dist/api/objects.js

@@ -0,0 +1,11 @@
+import { saveObject } from '../objects/lifecycle.js';
+import { requireGroup, storeFor } from '../store/index.js';
+/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
+export function objectsOf(ctx) {
+    return requireGroup(storeFor(ctx), 'objects');
+}
+/** Saves through the request's store as the authenticated caller. */
+export function saveFor(ctx, d, write) {
+    return saveObject(objectsOf(ctx), d, { hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, write);
+}
+//# sourceMappingURL=objects.js.map

package/dist/api/on-store.js

@@ -12,7 +12,8 @@ export function andThen(reply, next) {
 export function notPorted(port, group) {
     throw new StoreNotPortedError(port.kind, group);
 }
-/** A served store's stand-in for SqliteLocal. The last recall sits in hippo.db's meta table, so only a store that is hippo.db keeps and reads it, on `hippoRoot`. */
+/** A served store's stand-in for SqliteLocal. The last recall sits in hippo.db's
+ * meta table, so only a store that is hippo.db keeps and reads it, on `hippoRoot`. */
 function servedLocal(store, hippoRoot) {
     if (store.kind === 'sqlite')
         return { ...sqliteLocal(hippoRoot), ...REFUSED_ON_A_STORE };
@@ -21,7 +22,7 @@ function servedLocal(store, hippoRoot) {
         applyOutcomeToLastRecall() {
             throw new SqliteBlockedError(store.kind);
         },
-        finishLastRecall: (writes) => store.finishRecall(writes),
+        finishLastRecall: (writes) => store.finishRecall(writes).then(() => null),
     };
 }
 /** Runs `run` on `ctx.store`, where a throw rejects, else on hippo.db under `ctx.hippoRoot`, where it throws. The store path never reads `hippoRoot`.
@@ -30,7 +31,8 @@ export function onStore(ctx, run) {
     const { store } = ctx;
     // No await before `run`: an add-on relies on the first port call starting inside this call.
     const reply = store ? (async () => run(store, servedLocal(store, ctx.hippoRoot)))() : run(sqliteSyncStore(ctx.hippoRoot), sqliteLocal(ctx.hippoRoot));
-    // SAFETY: the store path is an async function's Promise and hippo.db's port calls answer values, so the Promise comes back exactly when ctx has a store, as StoreReply says.
+    // SAFETY: the store path is an async function's Promise and hippo.db's port calls answer
+    // values, so the Promise comes back exactly when ctx has a store, as StoreReply says.
     return reply;
 }
 //# sourceMappingURL=on-store.js.map

package/dist/api/outcome.js

@@ -1,5 +1,5 @@
 // Outcome feedback on recalled memories.
-import { personalScopeOf } from '../store/recall-scope.js';
+import { personalScopeOf } from '../core/recall-scope.js';
 import { andThen, notPorted, onStore } from './on-store.js';
 /** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
 export function outcome(ctx, ids, good, opts) {

package/dist/api/pilot-arm.d.ts

@@ -1,19 +1,9 @@
-import { type DatabaseSyncLike } from '../db/index.js';
 import { type LedgerRootOpts } from './ledger-db.js';
-export type PilotArm = 'hippo' | 'holdout';
+import { type PilotArm } from '../store/pilot-arm.js';
 export interface SessionArmOpts extends LedgerRootOpts {
     /** Only the caller tenant's arm row counts, so a caller holding another tenant's session id cannot claim that session's arm. */
     readonly ownTenantOnly?: boolean;
 }
-/** Deterministic split: the same session and rate always land in the same arm. */
-export declare function hashArm(sessionId: string, rateBp: number): PilotArm;
-/** The session's first stored arm, or null; never writes. Without `tenantId` any tenant's row counts, since on one machine a session has one arm. */
-export declare function readPilotArm(db: DatabaseSyncLike, sessionId: string, tenantId?: string): PilotArm | null;
-/** The stored arm, else the hash arm written once; on any error the hash arm comes back unrecorded. */
-export declare function ensurePilotArm(db: DatabaseSyncLike, tenantId: string, sessionId: string, rateBp: number, opts?: {
-    ownTenantOnly?: boolean;
-    now?: string;
-}): PilotArm;
 /** The session's arm, or null at rate 0, with no session id, or with no store.
  *  `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash. */
 export declare function sessionPilotArm(hippoRoot: string, tenantId: string, sessionId: string | undefined, write: boolean, opts?: SessionArmOpts): PilotArm | null;

package/dist/api/pilot-arm.js

@@ -1,46 +1,8 @@
-// Pilot arm: one token_ledger row per session names its arm, `hippo` or `holdout`, so a pilot can compare them.
-// `items` holds the holdout rate in basis points; readers outside this repo depend on these rows, so their shape is fixed.
-import { createHash } from 'node:crypto';
+// Which pilot arm a session is in: the rate comes from the ledger store's config, the arm row from src/store/pilot-arm.ts.
 import { loadConfig } from '../core/config.js';
-import { HOOK_DB_WAIT_MS, scopedBusyWait, withWriteScope } from '../db/index.js';
-import { ledgerRoot, withLedgerDb } from './ledger-db.js';
-import { errorMessage, log } from '../util/log.js';
-import { firstPilotArmHash } from '../store/token-ledger-rows.js';
-import { recordTokenUse } from '../store/token-ledger.js';
-/** Deterministic split: the same session and rate always land in the same arm. */
-export function hashArm(sessionId, rateBp) {
-    const bucket = parseInt(createHash('sha256').update(sessionId).digest('hex').slice(0, 8), 16) % 10000;
-    return bucket < rateBp ? 'holdout' : 'hippo';
-}
-/** The session's first stored arm, or null; never writes. Without `tenantId` any tenant's row counts, since on one machine a session has one arm. */
-export function readPilotArm(db, sessionId, tenantId) {
-    const row = firstPilotArmHash(db, sessionId, tenantId);
-    return row?.block_hash === 'holdout' || row?.block_hash === 'hippo' ? row.block_hash : null;
-}
-/** The stored arm, else the hash arm written once; on any error the hash arm comes back unrecorded. */
-// The wait is the caller's lock-wait scope (a hook's 1 s, a server request's 250 ms); it holds on a handle opened in that scope.
-export function ensurePilotArm(db, tenantId, sessionId, rateBp, opts = {}) {
-    const hashed = hashArm(sessionId, rateBp);
-    const readTenant = opts.ownTenantOnly ? tenantId : undefined;
-    try {
-        // A stored row is the common case after the first prompt, so it must not take the write lock.
-        const existing = readPilotArm(db, sessionId, readTenant);
-        if (existing !== null)
-            return existing;
-        return withWriteScope(db, 'pilot_arm', () => {
-            const stored = readPilotArm(db, sessionId, readTenant);
-            if (stored === null) {
-                recordTokenUse(db, { tenantId, sessionId, surface: 'pilot', event: 'arm', items: rateBp, tokens: 0, hash: hashed, now: opts.now });
-            }
-            return stored ?? hashed;
-        }, { busyWaitMs: scopedBusyWait() ?? HOOK_DB_WAIT_MS });
-    }
-    catch (err) {
-        // A prompt hook must not fail on pilot bookkeeping; concurrent callers still agree on the hash arm.
-        log.debug(`pilot arm not stored, using the hash arm: ${errorMessage(err)}`);
-        return hashed;
-    }
-}
+import { ledgerRoot, onLedgerRoot } from './ledger-db.js';
+import { pilotArmOnRoot } from '../store/ledger-turn.js';
+import { hashArm } from '../store/pilot-arm.js';
 /** The session's arm, or null at rate 0, with no session id, or with no store.
  *  `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash. */
 export function sessionPilotArm(hippoRoot, tenantId, sessionId, write, opts = {}) {
@@ -53,9 +15,7 @@ export function sessionPilotArm(hippoRoot, tenantId, sessionId, write, opts = {}
     if (rate <= 0)
         return null;
     const { ownTenantOnly } = opts;
-    const arm = withLedgerDb(hippoRoot, (db) => write
-        ? ensurePilotArm(db, tenantId, sessionId, rate, { ownTenantOnly })
-        : readPilotArm(db, sessionId, ownTenantOnly ? tenantId : undefined) ?? hashArm(sessionId, rate), opts);
+    const arm = onLedgerRoot(hippoRoot, opts, (at) => pilotArmOnRoot(at, tenantId, sessionId, rate, { write, ownTenantOnly }));
     return arm ?? hashArm(sessionId, rate);
 }
 //# sourceMappingURL=pilot-arm.js.map

package/dist/api/predictions.d.ts

@@ -0,0 +1,11 @@
+import { type Prediction, type PredictionBaserate, type SavePredictionOpts } from '../store/predictions.js';
+import type { PredictionClose, PredictionSave, Predictions } from '../store/port.js';
+import type { Context } from './types.js';
+export declare function savePrediction(ctx: Context, input: PredictionSave): Promise<Prediction>;
+/** A claim saved with its recall mirror, built under the store root's half-life as the HTTP create route builds it. */
+export declare function recordPrediction(ctx: Context, claim: SavePredictionOpts): Promise<Prediction>;
+export declare function listPredictions(ctx: Context, query: Parameters<Predictions['listPredictions']>[1]): Promise<Prediction[]>;
+export declare function predictionBaserate(ctx: Context, classTag: string): Promise<PredictionBaserate>;
+export declare function predictionById(ctx: Context, id: number): Promise<Prediction | null>;
+export declare function closePrediction(ctx: Context, id: number, close: PredictionClose): Promise<Prediction>;
+//# sourceMappingURL=predictions.d.ts.map

package/dist/api/predictions.js

@@ -0,0 +1,24 @@
+import { predictionMirror } from '../store/predictions.js';
+import { loadConfig } from '../core/config.js';
+import { requireGroup, storeFor } from '../store/index.js';
+const predictionsOf = (ctx) => requireGroup(storeFor(ctx), 'predictions');
+export async function savePrediction(ctx, input) {
+    return predictionsOf(ctx).savePrediction(ctx.tenantId, input, ctx.actor.subject);
+}
+/** A claim saved with its recall mirror, built under the store root's half-life as the HTTP create route builds it. */
+export async function recordPrediction(ctx, claim) {
+    return savePrediction(ctx, { ...claim, mirror: predictionMirror(ctx.tenantId, claim, loadConfig(ctx.hippoRoot).defaultHalfLifeDays) });
+}
+export async function listPredictions(ctx, query) {
+    return predictionsOf(ctx).listPredictions(ctx.tenantId, query);
+}
+export async function predictionBaserate(ctx, classTag) {
+    return predictionsOf(ctx).predictionBaserate(ctx.tenantId, classTag, ctx.actor.subject);
+}
+export async function predictionById(ctx, id) {
+    return predictionsOf(ctx).predictionById(ctx.tenantId, id);
+}
+export async function closePrediction(ctx, id, close) {
+    return predictionsOf(ctx).closePrediction(ctx.tenantId, id, close, ctx.actor.subject);
+}
+//# sourceMappingURL=predictions.js.map

package/dist/api/projects.d.ts

@@ -0,0 +1,21 @@
+import { type MergeResult, type ProjectSummary, type RepairResult } from '../sharing/project-merge.js';
+import type { Context } from './types.js';
+export type { MergeResult, ProjectCollision, ProjectSummary, RepairResult } from '../sharing/project-merge.js';
+export type { ProjectFold } from '../agent-memories/project-folds.js';
+export interface MergeProjectNamesOpts {
+    from: string;
+    into: string;
+    /** Plans in a transaction that rolls back: nothing is written, mirrors and backup included. */
+    dryRun: boolean;
+}
+/** Live rows per project name in the caller's tenant, newest write first. */
+export declare function listProjectNames(ctx: Context): ProjectSummary[];
+/** Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal names. */
+export declare function mergeProjectNames(ctx: Context, opts: MergeProjectNamesOpts): MergeResult;
+/** Sets aside stray imports, folds renamed projects and re-tags sleep's user-global merges; a dry run only plans. */
+export declare function repairProjectNames(ctx: Context, opts: {
+    dryRun: boolean;
+}): RepairResult;
+/** The repair sleep runs once per store; null when it already ran. */
+export declare function repairProjectNamesOnce(ctx: Context): RepairResult | null;
+//# sourceMappingURL=projects.d.ts.map

package/dist/api/projects.js

@@ -0,0 +1,24 @@
+// Project names for every front end: list them, fold one into another, and repair old tags; the store opens hippo.db and owns each transaction.
+// SHORTCUT: hippo.db only, since the store port has no project calls; a projects group when a served store needs them.
+import { listProjects, mergeProjects, repairOnceOnSleep, repairProjects, } from '../sharing/project-merge.js';
+import { onProjectTags } from '../store/project-tags.js';
+function onProjects(ctx, fn) {
+    return onProjectTags({ hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, fn);
+}
+/** Live rows per project name in the caller's tenant, newest write first. */
+export function listProjectNames(ctx) {
+    return onProjects(ctx, listProjects);
+}
+/** Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal names. */
+export function mergeProjectNames(ctx, opts) {
+    return onProjects(ctx, (store) => mergeProjects(store, opts));
+}
+/** Sets aside stray imports, folds renamed projects and re-tags sleep's user-global merges; a dry run only plans. */
+export function repairProjectNames(ctx, opts) {
+    return onProjects(ctx, (store) => repairProjects(store, opts));
+}
+/** The repair sleep runs once per store; null when it already ran. */
+export function repairProjectNamesOnce(ctx) {
+    return onProjects(ctx, repairOnceOnSleep);
+}
+//# sourceMappingURL=projects.js.map

package/dist/api/promote.d.ts

@@ -1,33 +1,29 @@
 import type { ConnectorEvent } from '../store/port.js';
+import { type Layer } from '../core/memory.js';
 import type { Context, StoreReply } from './types.js';
-/**
- * Copy a local memory into the global store. Mirrors `cmdPromote` in cli.ts:
- * the `writeEntry` inside `promoteToGlobal` emits a 'remember' on the global
- * db; we add a 'promote' audit event on the global db so the user-facing
- * intent stays distinct from the underlying upsert.
- *
- * Note: `promoteToGlobal` does not currently take a tenantId override — it
- * reads the entry from the local root via `readEntry` (no tenant filter) and
- * preserves the entry's existing tenantId on the global side.
- */
+/** Copies a local memory into the global store; the inner writeEntry emits 'remember' there, and we add a 'promote' audit event so intent stays distinct.
+ * promoteToGlobal reads via `readEntry` with no tenant filter and keeps the entry's existing tenantId on the global side. */
 export interface PromoteResult {
     ok: true;
     sourceId: string;
     globalId: string;
 }
 export declare function promote(ctx: Context, id: string): PromoteResult;
-/**
- * Replace an old memory with new content, chaining old.superseded_by = new.id.
- * Mirrors `cmdSupersede` in cli.ts minus the flag-driven layer/tag/pin
- * overrides: the CLI handler resolves those so the API stays minimal.
- */
+/** Replace an old memory with new content, chaining old.superseded_by = new.id; the store commits both rows and the audit row together. */
 export interface SupersedeResult {
     ok: true;
     oldId: string;
     newId: string;
 }
-export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string): StoreReply<C, SupersedeResult>;
-/** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is deleted. The store writes the one archive_raw audit row, under the caller's subject. */
+/** What the successor takes instead of the old row's value. Never set from a request body: the CLI fills it from its flags. */
+export interface SupersedeOverrides {
+    layer?: Layer;
+    tags?: string[];
+    pinned?: boolean;
+}
+export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string, overrides?: SupersedeOverrides): StoreReply<C, SupersedeResult>;
+/** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is
+ * deleted. The store writes the one archive_raw audit row, under the caller's subject. */
 export interface ArchiveRawOpts {
     /** The connector event this archive answers. The store logs it in the archive's own transaction, so a redelivery finds it logged. */
     event?: ConnectorEvent;

package/dist/api/promote.js

@@ -1,29 +1,18 @@
 // Promote to the global store, supersede with a successor, and archive raw memories.
-import { openHippoDb, closeHippoDb } from '../db/index.js';
 import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
 import { createSuccessor } from '../core/memory.js';
-import { promoteToGlobal } from '../sharing/shared.js';
+import { promoteToGlobal } from '../sharing/global-store.js';
 import { loadConfig } from '../core/config.js';
 import { andThen, notPorted, onStore } from './on-store.js';
-import { selectMemoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
+import { memoryReach } from '../store/tenant-lookup.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
 export function promote(ctx, id) {
-    // Tenant scope: promoteToGlobal reads the entry from the local root via
-    // readEntry without a tenant filter, so a Bearer for tenant A could
-    // promote tenant B's row by guessing or leaking the id. Pre-check the
-    // row's tenant_id and deny cross-tenant access with the same not-found
-    // wording archiveRaw uses (no info leak about whether the id exists in
-    // another tenant).
-    const ownerDb = openHippoDb(ctx.hippoRoot);
-    try {
-        const reach = selectMemoryReach(ownerDb, id);
-        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-            throw new NotFoundError(`memory not found: ${id}`);
-        }
-    }
-    finally {
-        closeHippoDb(ownerDb);
+    // promoteToGlobal reads without a tenant filter, so pre-check the row's tenant_id and deny cross-tenant access with archiveRaw's not-found wording
+    // (no leak about whether the id exists in another tenant).
+    const reach = memoryReach(ctx.hippoRoot, id);
+    if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
+        throw new NotFoundError(`memory not found: ${id}`);
     }
     // The 'promote' row commits with the global copy, so no write follows the commit and a busy store fails the whole promote.
     const globalEntry = promoteToGlobal(ctx.hippoRoot, id, {
@@ -33,13 +22,16 @@ export function promote(ctx, id) {
     });
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
-export function supersede(ctx, oldId, newContent) {
+export function supersede(ctx, oldId, newContent, overrides = {}) {
     return onStore(ctx, (port) => {
         const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
         return andThen(port.entriesByIds([oldId], ctx.tenantId), ([old]) => {
             const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
                 tenantId: ctx.tenantId,
                 baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+                layer: overrides.layer,
+                tags: overrides.tags,
+                pinned: overrides.pinned,
             });
             // A store writes origin_project as given, so the served folder's fallback is stamped here.
             const successor = stampOriginProject(ctx.hippoRoot, newEntry);