hippo-memory 1.71.0 → 2.0.0

package/dist/server/server-detect.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, unlinkSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { envHealthProbeMs } from '../util/env.js';
+import { errorCode, errorFields, errorMessage, log } from '../util/log.js';
 // Pidfile sits directly inside hippoRoot (the `.hippo` directory itself, as for openHippoDb), i.e. `${hippoRoot}/server.pid`.
 const PIDFILE = 'server.pid';
 /** How long detectServer waits for the `/health` probe before treating the pidfile as stale; short because it fires only when a pidfile exists with a live
@@ -11,6 +12,15 @@ const HEALTH_PROBE_TIMEOUT_MS = 300;
 const HEALTH_BODY_MAX_BYTES = 64 * 1024;
 /** Loopback hosts a recorded pidfile url may point at (serve() only binds these); any other host is malformed or forged and is not probed. */
 const PIDFILE_LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
+/** The pidfile names a live process on loopback that did not answer /health in time: most likely a busy server, so a caller must neither
+ * bypass it with a second writer nor start another server beside it. */
+export class ServerUnresponsiveError extends Error {
+    constructor(info, probeMs, options) {
+        super(`a hippo server (pid ${info.pid}) is recorded at ${info.url} but did not answer /health within ${probeMs} ms; it may be busy. ` +
+            'Retry shortly, raise HIPPO_HEALTH_PROBE_MS, or stop that server.', options);
+        this.name = 'ServerUnresponsiveError';
+    }
+}
 /** False when the pidfile's pid is dead or its url could not be one serve() wrote. */
 function isLiveLoopbackTarget(info) {
     // Signal 0 throws if the pid is dead or owned by another user we cannot signal; either way, treat as stale.
@@ -56,14 +66,23 @@ async function readCappedBody(body) {
     raw += decoder.decode();
     return raw;
 }
-/** True when /health on info.url reports the pidfile's started_at; unlinks the pidfile on any definitive mismatch. */
+/** True when fetch failed because nothing listens on the port (the error or its cause, or any address tried, is ECONNREFUSED). */
+function isConnectionRefused(err) {
+    if (errorCode(err) === 'ECONNREFUSED')
+        return true;
+    const cause = err instanceof Error ? err.cause : undefined;
+    if (errorCode(cause) === 'ECONNREFUSED')
+        return true;
+    return cause instanceof AggregateError && cause.errors.length > 0 && cause.errors.every((e) => errorCode(e) === 'ECONNREFUSED');
+}
+/** True when /health on info.url reports the pidfile's started_at; unlinks the pidfile on any definitive mismatch and throws ServerUnresponsiveError on a
+ * probe timeout. */
 async function healthMatchesPidfile(hippoRoot, info) {
-    // Confirm the answering process is this server by matching /health `started_at` against the pidfile; refusal, non-200 or a malformed body unlink the
-    // pidfile as stale. A probe timeout is ambiguous (a live but busy server can miss the 300ms window), so it returns null WITHOUT unlinking.
+    // Refusal, non-200 or a malformed body unlink the pidfile as stale. A timeout proves neither a dead server nor this one, so it keeps the pidfile and throws.
+    // Any other error keeps it and warns.
+    const probeMs = envHealthProbeMs() ?? HEALTH_PROBE_TIMEOUT_MS;
     try {
-        const res = await fetch(`${info.url}/health`, {
-            signal: AbortSignal.timeout(envHealthProbeMs() ?? HEALTH_PROBE_TIMEOUT_MS),
-        });
+        const res = await fetch(`${info.url}/health`, { signal: AbortSignal.timeout(probeMs) });
         if (!res.ok || !res.body) {
             removePidfile(hippoRoot);
             return false;
@@ -81,16 +100,21 @@ async function healthMatchesPidfile(hippoRoot, info) {
         return true;
     }
     catch (err) {
-        // A timeout is ambiguous (the server may be busy), so keep the pidfile; any other failure (refused, malformed body) is definitive: unlink as stale.
-        // SAFETY: err's shape is unknown (catch clause); reading an optional .name property structurally is safe regardless of the actual type.
-        if (err?.name !== 'TimeoutError') {
+        if (err instanceof Error && err.name === 'TimeoutError')
+            throw new ServerUnresponsiveError(info, probeMs, { cause: err });
+        // A refusal or a non-JSON body proves no hippo server answers there; any other failure may be a live server, so the file stays.
+        if (isConnectionRefused(err) || err instanceof SyntaxError) {
             removePidfile(hippoRoot);
         }
+        else {
+            log.warn(`server pidfile ${join(hippoRoot, PIDFILE)} kept: the /health probe failed (${errorMessage(err)})`, errorFields(err));
+        }
         return false;
     }
 }
 /** Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking of missing/stale/malformed pidfiles).
- * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live. */
+ * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live.
+ * Throws ServerUnresponsiveError when that probe times out. */
 export async function detectServer(hippoRoot) {
     const path = join(hippoRoot, PIDFILE);
     if (!existsSync(path))
@@ -99,7 +123,8 @@ export async function detectServer(hippoRoot) {
     try {
         info = JSON.parse(readFileSync(path, 'utf8'));
     }
-    catch {
+    catch (err) {
+        log.warn(`server pidfile ${path} is unreadable (${errorMessage(err)}); removing it`);
         removePidfile(hippoRoot);
         return null;
     }

package/dist/server/sleep-child.js

@@ -1,19 +1,38 @@
-// Entry of the process that runs one POST /v1/sleep; sleep-offload.ts starts it and nothing imports it.
-// The sleep module alone: the api barrel loads far more than one sleep needs, and every sleep pays for the start.
+// Entry of the process that runs one POST /v1/sleep or MCP auto-sleep; sleep-offload.ts starts it and nothing imports it.
+// The sleep modules alone: the api barrel loads far more than one sleep needs, and every sleep pays for the start.
 import { sleep } from '../api/sleep.js';
-import { isStoreBusy, runWithRequestStores, SERVER_DB_WAIT_MS } from '../db/index.js';
-import { errorMessage } from '../util/log.js';
+import { consolidate } from '../consolidate/sleep.js';
+import { runWithRequestStores, SERVER_DB_WAIT_MS } from '../db/index.js';
+import { isStoreBusy } from '../store/sqlite/busy.js';
+import { errorFields, errorMessage, log } from '../util/log.js';
 function failed(err) {
     return { ok: false, busy: isStoreBusy(err), message: errorMessage(err), stack: err instanceof Error ? err.stack : undefined };
 }
+/** Resolves to the exit code once the channel has taken the reply, or failed to. */
+function sendReply(reply) {
+    return new Promise((resolve) => {
+        process.send?.(reply, (sendErr) => {
+            if (sendErr)
+                log.error(`sleep child: sending the reply failed: ${errorMessage(sendErr)}`, errorFields(sendErr));
+            resolve(sendErr ? 1 : 0);
+        });
+    });
+}
 process.once('message', (message) => {
     // SAFETY: sleep-offload.ts is the only writer on this channel and sends exactly one SleepJob.
     const job = message;
-    const ctx = { hippoRoot: job.hippoRoot, tenantId: job.tenantId, actor: job.actor };
+    const work = () => job.kind === 'consolidate'
+        ? consolidate(job.hippoRoot)
+        : sleep({ hippoRoot: job.hippoRoot, tenantId: job.tenantId, actor: job.actor }, job.opts);
     // The server's own request scope and lock wait, so a busy store answers as it did when sleep ran in the server.
-    runWithRequestStores(() => sleep(ctx, job.opts), { busyWaitMs: SERVER_DB_WAIT_MS })
+    runWithRequestStores(work, { busyWaitMs: SERVER_DB_WAIT_MS })
         .then((result) => ({ ok: true, result }), failed)
         // Exit only once the reply is written, or the parent could see the process end first.
-        .then((reply) => process.send?.(reply, () => process.exit(0)));
+        .then(sendReply)
+        .catch((err) => {
+        log.error(`sleep child: the reply could not be sent: ${errorMessage(err)}`, errorFields(err));
+        return 1;
+    })
+        .then((code) => process.exit(code));
 });
 //# sourceMappingURL=sleep-child.js.map

package/dist/server/sleep-offload.d.ts

@@ -1,14 +1,18 @@
 import { type Actor, type Context, type SleepOpts, type SleepResult } from '../api/index.js';
-/** What the child needs to rebuild the request's context; the store handle itself cannot cross a process boundary. */
-export interface SleepJob {
+/** What the child needs to rebuild the request's context (the store handle itself cannot cross a process boundary), or the store an auto-sleep consolidates. */
+export type SleepJob = {
+    readonly kind: 'sleep';
     readonly hippoRoot: string;
     readonly tenantId: string;
     readonly actor: Actor;
     readonly opts: SleepOpts;
-}
-export type SleepReply = {
+} | {
+    readonly kind: 'consolidate';
+    readonly hippoRoot: string;
+};
+export type SleepReply<R = SleepResult> = {
     readonly ok: true;
-    readonly result: SleepResult;
+    readonly result: R;
 } | {
     readonly ok: false;
     readonly busy: boolean;
@@ -17,4 +21,6 @@ export type SleepReply = {
 };
 /** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
 export declare function sleepInChild(ctx: Context, opts: SleepOpts): Promise<SleepResult>;
+/** The MCP auto-sleep's consolidation, in the same queue and child as POST /v1/sleep; auto-sleep only starts on a hippo.db store. */
+export declare function consolidateInChild(hippoRoot: string): Promise<void>;
 //# sourceMappingURL=sleep-offload.d.ts.map

package/dist/server/sleep-offload.js

@@ -1,8 +1,8 @@
-// POST /v1/sleep runs its consolidation in a child process, so the server keeps answering and a stuck run can be stopped.
+// POST /v1/sleep and the MCP auto-sleep run their consolidation in a child process, so the server keeps answering and a stuck run can be stopped.
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { sleep } from '../api/index.js';
-import { StoreBusyError } from '../db/index.js';
+import { hasGroup, StoreBusyError } from '../store/port.js';
 import { envSleepTimeoutMs } from '../util/env.js';
 import { HttpError } from '../util/http-util.js';
 const DEFAULT_SLEEP_DEADLINE_MS = 600_000;
@@ -32,7 +32,7 @@ function runInChild(job) {
         // SIGKILL because the child is inside synchronous SQLite work and cannot run a handler; the OS drops its write lock.
         const timer = setTimeout(() => { timedOut = true; child.kill('SIGKILL'); }, deadlineMs);
         child.once('message', (message) => {
-            // SAFETY: sleep-child.ts is the only writer on this channel and sends exactly one SleepReply.
+            // SAFETY: sleep-child.ts is the only writer on this channel and sends exactly one SleepReply for the job it was given.
             reply = message;
         });
         child.once('error', (err) => { clearTimeout(timer); reject(err); });
@@ -54,20 +54,26 @@ let turn = Promise.resolve();
 const MAX_SLEEPS_IN_LINE = 2;
 const SLEEP_RETRY_AFTER_SEC = 30;
 let inLine = 0;
-/** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
-export function sleepInChild(ctx, opts) {
-    // The child reopens the store by path, which only SQLite has; any other store keeps sleep's own refusal.
-    if (ctx.store && ctx.store.kind !== 'sqlite')
-        return sleep(ctx, opts);
+function inTurn(job) {
     if (inLine >= MAX_SLEEPS_IN_LINE) {
         return Promise.reject(new HttpError(503, 'a sleep is already running and another is waiting; retry when one has finished', SLEEP_RETRY_AFTER_SEC));
     }
     inLine += 1;
-    const job = { hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor, opts };
-    // One sleep at a time, as on the server's single thread: a second request waits its turn and does not fight the first for the write lock.
+    // One sleep at a time, as on the server's single thread: a second one waits its turn and does not fight the first for the write lock.
     const run = turn.then(() => runInChild(job));
-    // A failed sleep reaches its own request through `run`; the queue only needs to know the turn is over.
+    // A failed sleep reaches its own caller through `run`; the queue only needs to know the turn is over.
     turn = run.then(() => undefined, () => undefined).finally(() => { inLine -= 1; });
     return run;
 }
+/** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
+export function sleepInChild(ctx, opts) {
+    // The child reopens the store by path, which only a store of local files has; any other store keeps sleep's own refusal.
+    if (ctx.store && !hasGroup(ctx.store, 'localFiles'))
+        return sleep(ctx, opts);
+    return inTurn({ kind: 'sleep', hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor, opts });
+}
+/** The MCP auto-sleep's consolidation, in the same queue and child as POST /v1/sleep; auto-sleep only starts on a hippo.db store. */
+export async function consolidateInChild(hippoRoot) {
+    await inTurn({ kind: 'consolidate', hippoRoot });
+}
 //# sourceMappingURL=sleep-offload.js.map

package/dist/server/tls.d.ts

@@ -1,6 +1,11 @@
 import { type RequestListener, type Server } from 'node:http';
 import type { ServeOpts } from './types.js';
 export declare function createListener(tls: ServeOpts['tls'], onRequest: RequestListener): Server;
-/** Said once at boot: a non-loopback bind without TLS sends every key and memory over the network as plain text. */
-export declare function warnIfCleartext(host: string, tls: ServeOpts['tls'], loopbackHosts: ReadonlySet<string>): void;
+/** serve() refused a non-loopback bind without TLS: every key and memory would cross the network as plain text. */
+export declare class CleartextBindError extends Error {
+    readonly host: string;
+    constructor(host: string);
+}
+/** Throws CleartextBindError for a non-loopback bind without TLS unless the operator allowed cleartext, which is then said once at boot. */
+export declare function assertTlsOrCleartextAllowed(host: string, tls: ServeOpts['tls'], loopbackHosts: ReadonlySet<string>, allowCleartext: boolean): void;
 //# sourceMappingURL=tls.d.ts.map

package/dist/server/tls.js

@@ -1,4 +1,4 @@
-// The serve() listener: node:https when a certificate is given, else node:http and a boot warning off loopback.
+// The serve() listener: node:https when a certificate is given, else node:http, which a non-loopback bind must opt into.
 import { createServer as createHttpServer } from 'node:http';
 import { createServer as createHttpsServer } from 'node:https';
 import { errorMessage, log } from '../util/log.js';
@@ -14,11 +14,23 @@ export function createListener(tls, onRequest) {
         throw new Error(`hippo serve: the TLS certificate or key was refused: ${errorMessage(err)}`, { cause: err });
     }
 }
-/** Said once at boot: a non-loopback bind without TLS sends every key and memory over the network as plain text. */
-export function warnIfCleartext(host, tls, loopbackHosts) {
+/** serve() refused a non-loopback bind without TLS: every key and memory would cross the network as plain text. */
+export class CleartextBindError extends Error {
+    host;
+    constructor(host) {
+        super(`hippo serve: refusing to listen on ${host} without TLS, since API keys and memory text would travel in cleartext. ` +
+            'Pass --tls-cert and --tls-key (or set HIPPO_TLS_CERT and HIPPO_TLS_KEY) to serve HTTPS. If a TLS-terminating proxy sits in front, ' +
+            'start with --allow-cleartext, set HIPPO_ALLOW_CLEARTEXT=1, or pass allowCleartext: true to serve().');
+        this.host = host;
+        this.name = 'CleartextBindError';
+    }
+}
+/** Throws CleartextBindError for a non-loopback bind without TLS unless the operator allowed cleartext, which is then said once at boot. */
+export function assertTlsOrCleartextAllowed(host, tls, loopbackHosts, allowCleartext) {
     if (tls || loopbackHosts.has(host))
         return;
-    log.warn(`serve: listening on ${host} without TLS, so API keys and memory text travel in cleartext unless a TLS-terminating proxy sits in front. ` +
-        'To serve HTTPS directly, pass --tls-cert and --tls-key (or set HIPPO_TLS_CERT and HIPPO_TLS_KEY).');
+    if (!allowCleartext)
+        throw new CleartextBindError(host);
+    log.warn(`serve: listening on ${host} without TLS, as allowed; API keys and memory text are cleartext until the proxy in front adds TLS.`);
 }
 //# sourceMappingURL=tls.js.map

package/dist/server/types.d.ts

@@ -66,11 +66,16 @@ export interface ServeOpts {
         cert: string | Buffer;
         key: string | Buffer;
     };
+    /** Lets a non-loopback bind start without `tls`, for TLS that ends at a proxy in front; else serve() refuses it. Also HIPPO_ALLOW_CLEARTEXT=1. */
+    allowCleartext?: boolean;
+    /** The role a keyless local request (HIPPO_ALLOW_KEYLESS_LOCAL=1) gets; defaults to HIPPO_KEYLESS_LOCAL_ROLE, else 'member'. Only 'admin' is host admin. */
+    keylessLocalRole?: 'member' | 'admin';
     /** Static JSON served to anyone at GET <path>; built once at boot and never authenticated, so it must hold nothing secret. */
     publicJson?: Readonly<Record<string, JsonValue>>;
-    /** Request limits: perCaller after auth; perAddress replaces HIPPO_V1_RPS when set, 'off' disables it; failedAuthPerAddress guards scrypt. */
+    /** Request limits: perCaller after auth, on by default (HIPPO_CALLER_RPS, else 20 per second, burst 40); perAddress replaces HIPPO_V1_RPS when set;
+     * 'off' disables either; failedAuthPerAddress guards scrypt. */
     rateLimits?: {
-        perCaller?: RateLimitSpec;
+        perCaller?: RateLimitSpec | 'off';
         perAddress?: RateLimitSpec | 'off';
         failedAuthPerAddress?: RateLimitSpec;
     };
@@ -88,6 +93,10 @@ export interface RouteRequest {
     opts: ResolvedServeOpts;
     query: URLSearchParams;
 }
+/** A request past the dispatch gate, carrying the caller the gate authenticated. */
+export interface AuthedRouteRequest extends RouteRequest {
+    ctx: Context;
+}
 /** A route's store status: a `storeReady` group, a `sqliteOnly` reason, or neither while it waits for a group; never both. */
 type StoreStatus = {
     storeReady?: StoreGroup;
@@ -96,20 +105,28 @@ type StoreStatus = {
     sqliteOnly: string;
     storeReady?: never;
 };
-/** One /v1 route: an exact path, a matchPath pattern, or a regex, each paired with one method's handler. Under another store it runs only with its
- * store's `storeReady` group; `loop: 'off'` runs its SQLite work on a worker thread, so the handler opens no hippo.db on the server thread. */
-export type Route = {
-    method: string;
-    loop?: 'off';
-} & StoreStatus & ({
+/** What the dispatch gate proves before a handler runs: any caller, an admin, a host admin on loopback, or nothing, for a route
+ * whose handler checks the sender's signature itself. */
+export type RouteAuth = 'caller' | 'admin' | 'host-admin-local' | 'webhook-signature';
+export type RouteEndpoint<R> = {
     path: string;
-    handler: (r: RouteRequest) => Promise<void>;
+    handler: (r: R) => Promise<void>;
 } | {
     pattern: string;
-    handler: (r: RouteRequest, params: Record<string, string>) => Promise<void>;
+    handler: (r: R, params: Record<string, string>) => Promise<void>;
 } | {
     regex: RegExp;
-    handler: (r: RouteRequest, match: RegExpMatchArray) => Promise<void>;
-});
+    handler: (r: R, match: RegExpMatchArray) => Promise<void>;
+};
+/** One /v1 route: an exact path, a matchPath pattern, or a regex, each paired with one method's handler. Under another store it runs only with its
+ * store's `storeReady` group; `loop: 'off'` runs its SQLite work on a worker thread, so the handler opens no hippo.db on the server thread. */
+export type Route = {
+    method: string;
+    loop?: 'off';
+} & StoreStatus & (({
+    auth: Exclude<RouteAuth, 'webhook-signature'>;
+} & RouteEndpoint<AuthedRouteRequest>) | ({
+    auth: 'webhook-signature';
+} & RouteEndpoint<RouteRequest>));
 export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/server/validation.d.ts

@@ -3,10 +3,9 @@ import type { Context, RememberOpts } from '../api/index.js';
 import { type JsonValue } from '../util/json.js';
 export declare function isSetMember<T extends string>(set: ReadonlySet<T>, value: string): value is T;
 export declare const MAX_SHORT_FIELD_LEN = 4096;
-export declare const MAX_LIST_LIMIT = 1000;
 export declare function parseListLimit(limitRaw: string | null, defaultLimit?: number, maxLimit?: number): number;
 /** `_authed` is proof the caller passed auth, so a full-size body is read only for
- * an authenticated caller; the key mint reads first under its own small cap. */
+ * an authenticated caller; the key mint reads under its own small cap. */
 export declare function parseJsonBody(req: IncomingMessage, _authed: Context): Promise<Record<string, JsonValue>>;
 export declare function parseJsonObjectText(raw: string): Record<string, JsonValue>;
 export declare function getString(obj: Record<string, JsonValue>, key: string): string | undefined;

package/dist/server/validation.js

@@ -1,4 +1,5 @@
-import { HttpError, MAX_ID_LEN, readBody } from '../util/http-util.js';
+import { HttpError, readBody } from '../util/http-util.js';
+import { DEFAULT_LIST_LIMIT, MAX_ID_LEN, MAX_LIST_LIMIT, resolveListLimit } from '../util/limits.js';
 import { isJsonString, isJsonObject } from '../util/json.js';
 // Runtime membership check for a `ReadonlySet<T>` of string-literal members: Set<T>.has gives no narrowing, so this is the one place the `as T` assertion lives
 // and callers narrow via the `value is T` return.
@@ -8,20 +9,14 @@ export function isSetMember(set, value) {
 }
 // Cap for short free-text HTTP fields (names, text, context, change summaries) on the object routes.
 export const MAX_SHORT_FIELD_LEN = 4096;
-// Number.isInteger, not isFinite: SQLite `LIMIT ?` rejects "1.5" with a 500.
-// Shared by every first-class-object list route so the guard cannot drift.
-export const MAX_LIST_LIMIT = 1000;
-export function parseListLimit(limitRaw, defaultLimit = 100, maxLimit = MAX_LIST_LIMIT) {
-    if (limitRaw === null)
-        return defaultLimit;
-    const limit = Number(limitRaw);
-    if (!Number.isInteger(limit) || limit <= 0 || limit > maxLimit) {
+export function parseListLimit(limitRaw, defaultLimit = DEFAULT_LIST_LIMIT, maxLimit = MAX_LIST_LIMIT) {
+    const limit = resolveListLimit(limitRaw === null ? undefined : Number(limitRaw), defaultLimit, maxLimit);
+    if (limit === undefined)
         throw new HttpError(400, `limit must be a positive integer <= ${maxLimit}`);
-    }
     return limit;
 }
 /** `_authed` is proof the caller passed auth, so a full-size body is read only for
- * an authenticated caller; the key mint reads first under its own small cap. */
+ * an authenticated caller; the key mint reads under its own small cap. */
 export async function parseJsonBody(req, _authed) {
     return parseJsonObjectText(await readBody(req));
 }

package/dist/server.d.ts

@@ -1,53 +1,17 @@
-import { type Actor, authCreateSelf, type AuthCreateSelfOpts, type AuthCreateSelfResult, authRevoke, type AuthRevokeReply, type AuthRevokeResult, type Context } from './api/index.js';
-import { ForbiddenError, NotFoundError } from './core/api-errors.js';
+import { type Actor, authCreateSelf, type AuthCreateSelfOpts, type AuthCreateSelfResult, authRevoke, type AuthRevokeResult, type Context } from './api/index.js';
+import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from './core/api-errors.js';
 export { serve } from './server/boot.js';
-export { authCreateSelf, authRevoke, ForbiddenError, NotFoundError, type AuthCreateSelfOpts, type AuthCreateSelfResult, type AuthRevokeReply, type AuthRevokeResult, type Context, type Actor, };
+export { authCreateSelf, authRevoke, BadRequestError, ConflictError, ForbiddenError, NotFoundError, type AuthCreateSelfOpts, type AuthCreateSelfResult, type AuthRevokeResult, type Context, type Actor, };
 export { isCrossSite, LOOPBACK_HOST_HEADER } from './util/http-util.js';
-export { __resetSessionRecallHistoryHttp } from './server/routes/recall.js';
 export { clientIpForRateLimit } from './server/client-ip.js';
 export { isLoopback, isReservedActor } from './server/auth.js';
 export type { AddonCall, AddonRoute, AuthResolver, RateLimitSpec, ResolvedBearer, ServeOpts, ServerHandle } from './server/types.js';
+export type { HippoStore } from './store/index.js';
 export { HttpError } from './util/http-util.js';
 export { promptHookContext, type CallerProject } from './api/prompt-hook.js';
 export type { JsonValue } from './util/json.js';
 export { captureSessionTexts, type SessionCaptureRequest, type SessionCaptureResult } from './capture/session-texts.js';
-export { hasGroup, sqliteStore, type AmbientCandidateRequest, type ContextReads, type EntryRemoval, type EntryTarget, type EntryWrite, type EntryWrites, type HippoStore, type KeyAudit, type KeyListQuery, type KeyMint, type KeyRevoke, type KeyWrites, type OutcomeWrite, type RawArchive, type RecallSearchArgs, type RecallWrites, type SelfKeyMint, type StoreGroup, type StoreGroups, type SupersedeWrite, type VectorReads, type VectorBackfillQuery, type VectorRowWrite, type VectorWrite, type VectorWriteResult, type VectorWrites, } from './store/index.js';
-export { entryAfterOutcome } from './core/memory.js';
-export { rejectionDigest, RejectedValueError } from './store/rejection.js';
-export { ownScopeTouches } from './store/recall-scope.js';
-export { BadRequestError, ConflictError } from './core/api-errors.js';
-export type { HippoDbContext, StoreReply } from './api/types.js';
-export type { ApiKeyListItem, ApiKeyListRow, ApiKeyRecord, ListApiKeysOpts, NewApiKey } from './store/auth.js';
-export type { KeysetPosition } from './util/keyset.js';
-export type { AppendAuditOpts, AuditEvent, ListAuditAfterOpts } from './store/audit.js';
-export type { ContinuityBlock } from './api/recall-types.js';
-export type { ActiveGoals, GetActiveGoalsOpts, Goal, GoalRecallLogRow, RetrievalPolicy } from './store/goals.js';
-export type { MemoryEntry } from './core/memory.js';
-export type { ClassResolution, PlanningFallacyEvidence } from './store/planning-fallacy-evidence.js';
-export type { PredictionBaserate } from './store/predictions.js';
-export type { RecallTraceInput } from './store/recall-trace.js';
-export type { StrengthenOptions } from './store/entry-writes.js';
-export type { OriginFilter, RecallScopeFilter, VectorCandidateSpec } from './store/search-rows.js';
-export type { ContinuityKey } from './store/sessions.js';
-export type { SessionEvent, TaskSnapshot } from './store/rows.js';
-export type { SessionHandoff } from './core/handoff.js';
-export type { AmbientLoadResult, AmbientRecallRequest, ContextCandidateFilter, RecentOrigins } from './store/candidates.js';
-export type { AmbientStoreFilter } from './store/ambient.js';
-export type { AmbientTallies } from './core/ambient.js';
-export type { TokenUse } from './store/token-ledger.js';
-export type { EmbeddingIndexState } from './store/vector-index.js';
-export type { PhysicsParticle } from './core/physics.js';
-export { StoreBusyError } from './db/index.js';
-export { decodeVector, EMBEDDING_MODEL_META_KEY, encodeVector, rankVectorRows, type VectorMatch, type VectorRow } from './db/vector-store.js';
-export { bufferToFloat32, float32ToBuffer } from './db/physics-state.js';
-export { replacesIndex } from './store/vector-index.js';
-export { passesScopeFilterForRecall, RECALL_DEFAULT_DENY_SCOPES } from './store/recall-scope.js';
-export { SECRET_TAGS } from './util/secret-detect.js';
-export { tallyAmbientEntries } from './core/ambient.js';
-export { ftsTermParts, rarestFtsQuery } from './core/prompt-recall.js';
-export { OTHER_STORE_MARKER, OtherStoreFolderError, withSqliteAllowed } from './db/index.js';
 export { authCreate, type AuthCreateOpts, type AuthCreateResult } from './api/index.js';
-export { isSharedStore } from './core/config.js';
 export { ownerOrSubject } from './api/index.js';
 export { bindSessionOwner } from './api/session-owners.js';
 export { preCompactForCaller, type CallerHookOutput, type CallerPreCompactRequest } from './capture/pre-compact-caller.js';

package/dist/server.js

@@ -1,44 +1,18 @@
 import { authCreateSelf, authRevoke, } from './api/index.js';
-import { ForbiddenError, NotFoundError } from './core/api-errors.js';
+import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from './core/api-errors.js';
 export { serve } from './server/boot.js';
 // Add-on packages mint and revoke keys through these without importing the whole api surface.
-export { authCreateSelf, authRevoke, ForbiddenError, NotFoundError, };
-// Published on the hippo-memory/server subpath before they moved to http-util.ts, so they stay exported here.
+export { authCreateSelf, authRevoke, BadRequestError, ConflictError, ForbiddenError, NotFoundError, };
 export { isCrossSite, LOOPBACK_HOST_HEADER } from './util/http-util.js';
-// The code behind these lives in src/server/; this subpath keeps exporting them.
-export { __resetSessionRecallHistoryHttp } from './server/routes/recall.js';
 export { clientIpForRateLimit } from './server/client-ip.js';
 export { isLoopback, isReservedActor } from './server/auth.js';
-// What an add-on route handler needs: HttpError for its 4xx replies, promptHookContext
-// for a caller that renders the prompt hook elsewhere, JsonValue for its body.
+// An add-on route replies 4xx with HttpError, renders the prompt hook elsewhere with promptHookContext, and types its body as JsonValue.
 export { HttpError } from './util/http-util.js';
 export { promptHookContext } from './api/prompt-hook.js';
 // A session-end route stores the turns its caller read from a transcript on the caller's own machine.
 export { captureSessionTexts } from './capture/session-texts.js';
-// An add-on serves from another database by passing serve() its own HippoStore.
-export { hasGroup, sqliteStore, } from './store/index.js';
-// An add-on store's entry writes apply an outcome, guard tombstones and check reach exactly as hippo.db does.
-export { entryAfterOutcome } from './core/memory.js';
-export { rejectionDigest, RejectedValueError } from './store/rejection.js';
-export { ownScopeTouches } from './store/recall-scope.js';
-export { BadRequestError, ConflictError } from './core/api-errors.js';
-export { StoreBusyError } from './db/index.js';
-// An add-on store encodes, decodes and ranks vectors and particles with hippo.db's own code, and drops the index by its rule,
-// so both stores keep the same bytes and return the same ids in the same order.
-export { decodeVector, EMBEDDING_MODEL_META_KEY, encodeVector, rankVectorRows } from './db/vector-store.js';
-export { bufferToFloat32, float32ToBuffer } from './db/physics-state.js';
-export { replacesIndex } from './store/vector-index.js';
-// An add-on's ContextReads applies hippo.db's scope, secret, tally and rarest-term rules with the same code.
-export { passesScopeFilterForRecall, RECALL_DEFAULT_DENY_SCOPES } from './store/recall-scope.js';
-export { SECRET_TAGS } from './util/secret-detect.js';
-export { tallyAmbientEntries } from './core/ambient.js';
-export { ftsTermParts, rarestFtsQuery } from './core/prompt-recall.js';
-// store copy --db writes the marker and reads the old hippo.db under the waiver.
-export { OTHER_STORE_MARKER, OtherStoreFolderError, withSqliteAllowed } from './db/index.js';
 // An add-on's install step mints the first admin key into a store folder it names, which `hippo auth create` cannot reach.
 export { authCreate } from './api/index.js';
-// An add-on that serves a team store checks the flag before it starts.
-export { isSharedStore } from './core/config.js';
 export { ownerOrSubject } from './api/index.js';
 // A route that writes for a session binds it to the caller's owner first.
 export { bindSessionOwner } from './api/session-owners.js';

package/dist/sharing/global-store.d.ts

@@ -1,19 +1,18 @@
 import { MemoryEntry } from '../core/memory.js';
-import type { DatabaseSyncLike } from '../db/index.js';
 /** Returns the path to the global Hippo store.
  *  Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/ */
 export declare function getGlobalRoot(): string;
 /** Ensure the global store exists. */
 export declare function initGlobal(): void;
-/** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
-export declare function promoteToGlobal(localRoot: string, id: string, opts?: {
+export interface PromoteOptions {
     actor?: string;
     tenantId?: string;
-    afterWrite?: (db: DatabaseSyncLike, globalId: string) => void;
     /** Also writes one `promote` audit row for the copy ({sourceId}), in the copy's own transaction. */
     auditAs?: {
         tenantId: string;
         actor: string;
     };
-}): MemoryEntry;
+}
+/** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
+export declare function promoteToGlobal(localRoot: string, id: string, opts?: PromoteOptions): MemoryEntry;
 //# sourceMappingURL=global-store.d.ts.map

package/dist/sharing/global-store.js

@@ -3,14 +3,14 @@ import { BadRequestError, NotFoundError } from '../core/api-errors.js';
 import * as fs from 'fs';
 import { generateId } from '../core/memory.js';
 import { initStore } from '../store/open.js';
-import { writeEntry } from '../store/entry-writes.js';
+import { writeEntryWithHook } from '../store/entry-writes.js';
 import { readEntry } from '../store/entry-reads.js';
-import { isPersonalScope } from '../store/recall-scope.js';
+import { isPersonalScope } from '../core/recall-scope.js';
 import { fallbackOrigin, resolveGlobalRootDir } from '../core/project-identity.js';
 import { isSharedStore } from '../core/config.js';
 import { detectSecret } from '../util/secret-detect.js';
 import { isQuarantineScope } from '../trust/quarantine.js';
-import { embedMemory } from '../store/embeddings/index.js';
+import { embedMemory } from '../search/embed-memories.js';
 import { appendAuditEvent } from '../store/audit.js';
 /** Returns the path to the global Hippo store.
  *  Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/ */
@@ -30,15 +30,6 @@ export function initGlobal() {
         initStore(globalRoot);
     }
 }
-/** The copy's write hook: the `promote` row when asked for, then the caller's own hook, both in the copy's transaction. */
-function promoteHook(sourceId, auditAs, afterWrite) {
-    if (!auditAs)
-        return afterWrite;
-    return (db, globalId) => {
-        appendAuditEvent(db, { tenantId: auditAs.tenantId, actor: auditAs.actor, op: 'promote', targetId: globalId, metadata: { sourceId } });
-        afterWrite?.(db, globalId);
-    };
-}
 /** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
 export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
@@ -67,7 +58,11 @@ export function promoteToGlobal(localRoot, id, opts) {
         source: isSharedStore(localRoot) ? `shared::${new Date().toISOString()}` : `promoted:${localRoot}`,
         origin_project: entry.origin_project ?? fallbackOrigin(localRoot),
     };
-    writeEntry(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: promoteHook(id, opts?.auditAs, opts?.afterWrite) });
+    const { auditAs } = opts ?? {};
+    const promoteRow = auditAs && ((db, globalId) => {
+        appendAuditEvent(db, { tenantId: auditAs.tenantId, actor: auditAs.actor, op: 'promote', targetId: globalId, metadata: { sourceId: id } });
+    });
+    writeEntryWithHook(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: promoteRow });
     // Fire-and-forget: embedMemory gates on availability and never rejects.
     void embedMemory(globalRoot, globalEntry);
     return globalEntry;