hippo-memory 1.72.0 → 2.1.0

package/dist/server/routes/project-briefs.js

@@ -2,7 +2,7 @@
 import { briefFromReceipts, MAX_CHANGE_SUMMARY_LEN, MAX_REPO_LEN, PROJECT_BRIEF, refreshedBrief, } from '../../objects/project-briefs.js';
 import { sendJson } from '../../util/http-util.js';
 import { parseJsonBody } from '../validation.js';
-import { objectsOf, saveFor } from '../../api/objects.js';
+import { objectsOf, saveFor } from '../../api/objects/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
 const briefRoutes = {
     noun: 'project brief',
@@ -16,7 +16,8 @@ const briefRoutes = {
         return (existing, id) => ({ repo: existing.repo, summary, changeSummary, supersedesBriefId: id });
     },
 };
-// Routes: /v1/project-briefs (create, list, refresh, show, supersede, close), mirroring /v1/skills; /refresh is ordered before /:id.
+// Routes: /v1/project-briefs (create, list, refresh, show, supersede, close), mirroring /v1/skills; /refresh is ordered
+// before /:id.
 // The store validates and throws; the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
 export async function handleCreateProjectBrief(rr) {
     const { ctx } = rr;

package/dist/server/routes/recall.d.ts

@@ -2,7 +2,7 @@ import type { AuthedRouteRequest } from '../types.js';
 /** Test-only: reset the HTTP recall rings. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryHttp(): void;
 export declare function handleRecallMemories({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
-export declare function handleAssembleSession({ res, ctx, query }: AuthedRouteRequest, assembleMatch: Record<string, string>): Promise<void>;
-export declare function handleDrillRecall({ res, ctx, query }: AuthedRouteRequest, drillMatch: Record<string, string>): Promise<void>;
-export declare function handleGetContext({ res, ctx, opts, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleAssembleSession({ res, ctx, query }: AuthedRouteRequest<'dagReads'>, assembleMatch: Record<string, string>): Promise<void>;
+export declare function handleDrillRecall({ res, ctx, query }: AuthedRouteRequest<'dagReads'>, drillMatch: Record<string, string>): Promise<void>;
+export declare function handleGetContext({ res, ctx, opts, query }: AuthedRouteRequest<'contextReads'>): Promise<void>;
 //# sourceMappingURL=recall.d.ts.map

package/dist/server/routes/recall.js

@@ -3,10 +3,10 @@ import { dirname, resolve } from 'node:path';
 import { assertCallerProject, resolveProjectIdentity } from '../../core/project-identity.js';
 import { isSharedStore } from '../../core/config.js';
 import { assembleCost, contextCost, drillCost } from '../../api/context-render.js';
-import { assemble, drillDown, getContext, recordTokens, retrieve } from '../../api/index.js';
-import { RECALL_RECORDING } from '../../api/recall-finish.js';
-import { httpParams, parseContextRequest, parseRecallRequest } from '../../api/recall-request.js';
-import { resetSessionRings } from '../../api/recall-record.js';
+import { assemble, drillDown, getContext, recordTokens, retrieve, } from '../../api/index.js';
+import { RECALL_RECORDING } from '../../api/recall/finish.js';
+import { httpParams, parseContextRequest, parseRecallRequest } from '../../api/recall/request.js';
+import { resetSessionRings } from '../../api/recall/finish.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { MAX_LIST_LIMIT } from '../../util/limits.js';
 import { parseListLimit, validateIdSegment } from '../validation.js';
@@ -26,7 +26,8 @@ export async function handleRecallMemories({ res, ctx, query }) {
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1: ordered AssembledContextItem[] (fresh-tail raws, summary substitutions, bio-aware
+// GET /v1/sessions/:id/assemble?budget=N&freshTail=N&summarizeOlder=0|1: ordered AssembledContextItem[] (fresh-tail
+// raws, summary substitutions, bio-aware
 // budget fit). Tenant scope from the Bearer; default-deny on private rows.
 export async function handleAssembleSession({ res, ctx, query }, assembleMatch) {
     validateIdSegment(assembleMatch.id, 'session id');
@@ -58,11 +59,16 @@ export async function handleAssembleSession({ res, ctx, query }, assembleMatch)
     if (scope !== undefined)
         assembleExtra.scope = scope;
     const result = await assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
-    await recordTokens(ctx, 'http_assemble', { items: result.items.length, tokens: result.tokens, sessionId: assembleMatch.id });
+    await recordTokens(ctx, 'http_assemble', {
+        items: result.items.length,
+        tokens: result.tokens,
+        sessionId: assembleMatch.id,
+    });
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/recall/drill/:id?limit=N&budget=N: companion to /v1/memories; the caller drills into a level-2 summary (RecallResultItem.isSummary) to recover the
+// GET /v1/recall/drill/:id?limit=N&budget=N: companion to /v1/memories; the caller drills into a level-2 summary
+// (RecallResultItem.isSummary) to recover the
 // originals. Tenant-scoped via Bearer; default-deny on private scopes for the summary and its children.
 export async function handleDrillRecall({ res, ctx, query }, drillMatch) {
     validateIdSegment(drillMatch.id, 'summary id');
@@ -109,7 +115,10 @@ export async function handleDrillRecall({ res, ctx, query }, drillMatch) {
     sendJson(res, 200, result);
     return;
 }
-/** A shared store's folder is no caller's project, so the caller names it (`project`, repeated `alias`); with none, getContext refuses. */
+/**
+ * A shared store's folder is no caller's project, so the caller names it (`project`, repeated `alias`); with none,
+ * getContext refuses.
+ */
 function contextReader(hippoRoot, query) {
     if (!isSharedStore(hippoRoot))
         return resolveProjectIdentity(dirname(resolve(hippoRoot)));
@@ -120,8 +129,10 @@ function contextReader(hippoRoot, query) {
     assertCallerProject({ name, aliases });
     return { name, legacyName: name, aliases };
 }
-// GET /v1/context: a budget-bounded ContextResult JSON, rendered by clients, not the server; tenant-scoped via the Bearer.
-// Pinned-only and '*' fallback skip the recall audit emit (as cmdContext does); a real-query hybrid search emits one 'recall' row.
+// GET /v1/context: a budget-bounded ContextResult JSON, rendered by clients, not the server; tenant-scoped via the
+// Bearer.
+// Pinned-only and '*' fallback skip the recall audit emit (as cmdContext does); a real-query hybrid search emits one
+// 'recall' row.
 export async function handleGetContext({ res, ctx, opts, query }) {
     const parsed = parseContextRequest(httpParams(query));
     const result = await getContext(ctx, {

package/dist/server/routes/skills.d.ts

@@ -1,8 +1,8 @@
 import type { AuthedRouteRequest } from '../types.js';
-export declare function handleCreateSkill(rr: AuthedRouteRequest): Promise<void>;
-export declare function handleListSkills(rr: AuthedRouteRequest): Promise<void>;
-export declare function handleExportSkills(rr: AuthedRouteRequest): Promise<void>;
-export declare function handleSupersedeSkill(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseSkill(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetSkill(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCreateSkill(rr: AuthedRouteRequest<'objects'>): Promise<void>;
+export declare function handleListSkills(rr: AuthedRouteRequest<'objects'>): Promise<void>;
+export declare function handleExportSkills(rr: AuthedRouteRequest<'objects'>): Promise<void>;
+export declare function handleSupersedeSkill(rr: AuthedRouteRequest<'objects'>, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseSkill(rr: AuthedRouteRequest<'objects'>, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetSkill(rr: AuthedRouteRequest<'objects'>, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=skills.d.ts.map

package/dist/server/routes/skills.js

@@ -2,7 +2,7 @@
 import { MAX_SKILL_NAME_LEN, SKILL, skillsMarkdown } from '../../objects/skills.js';
 import { sendJson } from '../../util/http-util.js';
 import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
-import { objectsOf, saveFor } from '../../api/objects.js';
+import { objectsOf, saveFor } from '../../api/objects/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute, } from './object-routes.js';
 const INSTRUCTIONS = { max: 8192, plural: true };
 const skillRoutes = {
@@ -14,11 +14,19 @@ const skillRoutes = {
         const instructions = requiredString(body, 'instructions', INSTRUCTIONS);
         const trigger = optionalString(body, 'trigger', 1024);
         const changeSummary = optionalString(body, 'changeSummary', MAX_SHORT_FIELD_LEN);
-        return (existing, id) => ({ skillName: existing.skillName, instructions, trigger, changeSummary, supersedesSkillId: id });
+        return (existing, id) => ({
+            skillName: existing.skillName,
+            instructions,
+            trigger,
+            changeSummary,
+            supersedesSkillId: id,
+        });
     },
 };
-// Routes: /v1/skills (create, list, export, show, supersede, close), mirroring /v1/processes; "executable" means exportable instruction (no code exec).
-// GET /v1/skills/export renders ACTIVE skills as a markdown block for AGENTS.md or CLAUDE.md and is ordered before /:id.
+// Routes: /v1/skills (create, list, export, show, supersede, close), mirroring /v1/processes; "executable" means
+// exportable instruction (no code exec).
+// GET /v1/skills/export renders ACTIVE skills as a markdown block for AGENTS.md or CLAUDE.md and is ordered before
+// /:id.
 export async function handleCreateSkill(rr) {
     const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);

package/dist/server/server-detect.d.ts

@@ -1,32 +1,48 @@
 export interface ServerInfo {
-    /** Pidfile schema version; absent on pidfiles written before the field existed, which detectServer treats as legacy and still accepts. */
+    /**
+     * Pidfile schema version; absent on pidfiles written before the field existed, which detectServer treats as legacy
+     * and still accepts.
+     */
     schema?: number;
     pid: number;
     port: number;
     url: string;
     started_at: string;
 }
-/** The pidfile names a live process on loopback that did not answer /health in time: most likely a busy server, so a caller must neither
+/**
+ * The pidfile names a live process on loopback that did not answer /health in time: most likely a busy server, so a
+ * caller must neither
  * bypass it with a second writer nor start another server beside it. */
 export declare class ServerUnresponsiveError extends Error {
     constructor(info: ServerInfo, probeMs: number, options?: ErrorOptions);
 }
-/** Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking of missing/stale/malformed pidfiles).
- * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live.
+/**
+ * Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking
+ * of missing/stale/malformed pidfiles).
+ * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get
+ * reused). Probes only if the pid is live.
  * Throws ServerUnresponsiveError when that probe times out. */
 export declare function detectServer(hippoRoot: string): Promise<ServerInfo | null>;
-/** Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes from the caller (`serve()`) so the
+/**
+ * Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes
+ * from the caller (`serve()`) so the
  * pidfile and GET /health carry the same timestamp, which detectServer's liveness probe compares. */
 export declare function writePidfile(hippoRoot: string, opts: {
     port: number;
     url: string;
     startedAt: string;
 }): void;
-/** Best-effort pidfile removal, silent on any error so shutdown paths can call it. Identity-blind: a shutdown that must not clobber a newer server's pidfile
+/**
+ * Best-effort pidfile removal, silent on any error so shutdown paths can call it. Identity-blind: a shutdown that must
+ * not clobber a newer server's pidfile
  * uses removePidfileIfOwned. */
 export declare function removePidfile(hippoRoot: string): void;
-/** Removes the pidfile ONLY when both `pid` and `started_at` match `owner`, so an older shutting-down server cannot orphan a newer one; never throws.
- * Anything unreadable or malformed is "not provably mine" and left alone (detectServer unlinks it). Returns true iff removed. */
+/**
+ * Removes the pidfile ONLY when both `pid` and `started_at` match `owner`, so an older shutting-down server cannot
+ * orphan a newer one; never throws.
+ * Anything unreadable or malformed is "not provably mine" and left alone (detectServer unlinks it). Returns true iff
+ * removed.
+ */
 export declare function removePidfileIfOwned(hippoRoot: string, owner: {
     pid: number;
     startedAt: string;

package/dist/server/server-detect.js

@@ -2,21 +2,32 @@ import { existsSync, readFileSync, writeFileSync, unlinkSync, renameSync } from
 import { join } from 'node:path';
 import { envHealthProbeMs } from '../util/env.js';
 import { errorCode, errorFields, errorMessage, log } from '../util/log.js';
-// Pidfile sits directly inside hippoRoot (the `.hippo` directory itself, as for openHippoDb), i.e. `${hippoRoot}/server.pid`.
+// Pidfile sits directly inside hippoRoot (the `.hippo` directory itself, as for openHippoDb), i.e.
+// `${hippoRoot}/server.pid`.
 const PIDFILE = 'server.pid';
-/** How long detectServer waits for the `/health` probe before treating the pidfile as stale; short because it fires only when a pidfile exists with a live
+/**
+ * How long detectServer waits for the `/health` probe before treating the pidfile as stale; short because it fires only
+ * when a pidfile exists with a live
  * pid on loopback. HIPPO_HEALTH_PROBE_MS overrides it. */
 const HEALTH_PROBE_TIMEOUT_MS = 300;
-/** Hard cap on the /health body detectServer buffers: a real payload is well under 1 KB, so a larger body means the process on the recorded port is not
+/**
+ * Hard cap on the /health body detectServer buffers: a real payload is well under 1 KB, so a larger body means the
+ * process on the recorded port is not
  * hippo. */
 const HEALTH_BODY_MAX_BYTES = 64 * 1024;
-/** Loopback hosts a recorded pidfile url may point at (serve() only binds these); any other host is malformed or forged and is not probed. */
+/**
+ * Loopback hosts a recorded pidfile url may point at (serve() only binds these); any other host is malformed or forged
+ * and is not probed.
+ */
 const PIDFILE_LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
-/** The pidfile names a live process on loopback that did not answer /health in time: most likely a busy server, so a caller must neither
+/**
+ * The pidfile names a live process on loopback that did not answer /health in time: most likely a busy server, so a
+ * caller must neither
  * bypass it with a second writer nor start another server beside it. */
 export class ServerUnresponsiveError extends Error {
     constructor(info, probeMs, options) {
-        super(`a hippo server (pid ${info.pid}) is recorded at ${info.url} but did not answer /health within ${probeMs} ms; it may be busy. ` +
+        super(`a hippo server (pid ${info.pid}) is recorded at ${info.url} but did not answer /health within ${probeMs} ms; ` +
+            `it may be busy. ` +
             'Retry shortly, raise HIPPO_HEALTH_PROBE_MS, or stop that server.', options);
         this.name = 'ServerUnresponsiveError';
     }
@@ -31,8 +42,10 @@ function isLiveLoopbackTarget(info) {
     catch {
         return false;
     }
-    // The pid may have been reused and the recorded url is read from a forgeable file; serve() only binds loopback, so a url that is not http on a loopback
-    // host and the recorded port is malformed or forged. Reject it before probing, since the probe and any routed request can carry HIPPO_API_KEY.
+    // The pid may have been reused and the recorded url is read from a forgeable file; serve() only binds loopback, so a
+    // url that is not http on a loopback
+    // host and the recorded port is malformed or forged. Reject it before probing, since the probe and any routed request
+    // can carry HIPPO_API_KEY.
     let probeUrl;
     try {
         probeUrl = new URL(info.url);
@@ -46,7 +59,8 @@ function isLiveLoopbackTarget(info) {
 }
 /** The whole body as text, or null once it passes HEALTH_BODY_MAX_BYTES (the stream is then cancelled). */
 async function readCappedBody(body) {
-    // Read the body under a hard byte cap: the process on info.url may not be hippo (pid reuse), so its response is untrusted and never goes unbounded into a
+    // Read the body under a hard byte cap: the process on info.url may not be hippo (pid reuse), so its response is
+    // untrusted and never goes unbounded into a
     // parser.
     const reader = body.getReader();
     const decoder = new TextDecoder();
@@ -66,19 +80,27 @@ async function readCappedBody(body) {
     raw += decoder.decode();
     return raw;
 }
-/** True when fetch failed because nothing listens on the port (the error or its cause, or any address tried, is ECONNREFUSED). */
+/**
+ * True when fetch failed because nothing listens on the port (the error or its cause, or any address tried, is
+ * ECONNREFUSED).
+ */
 function isConnectionRefused(err) {
     if (errorCode(err) === 'ECONNREFUSED')
         return true;
     const cause = err instanceof Error ? err.cause : undefined;
     if (errorCode(cause) === 'ECONNREFUSED')
         return true;
-    return cause instanceof AggregateError && cause.errors.length > 0 && cause.errors.every((e) => errorCode(e) === 'ECONNREFUSED');
+    return (cause instanceof AggregateError &&
+        cause.errors.length > 0 &&
+        cause.errors.every((e) => errorCode(e) === 'ECONNREFUSED'));
 }
-/** True when /health on info.url reports the pidfile's started_at; unlinks the pidfile on any definitive mismatch and throws ServerUnresponsiveError on a
+/**
+ * True when /health on info.url reports the pidfile's started_at; unlinks the pidfile on any definitive mismatch and
+ * throws ServerUnresponsiveError on a
  * probe timeout. */
 async function healthMatchesPidfile(hippoRoot, info) {
-    // Refusal, non-200 or a malformed body unlink the pidfile as stale. A timeout proves neither a dead server nor this one, so it keeps the pidfile and throws.
+    // Refusal, non-200 or a malformed body unlink the pidfile as stale. A timeout proves neither a dead server nor this
+    // one, so it keeps the pidfile and throws.
     // Any other error keeps it and warns.
     const probeMs = envHealthProbeMs() ?? HEALTH_PROBE_TIMEOUT_MS;
     try {
@@ -100,9 +122,11 @@ async function healthMatchesPidfile(hippoRoot, info) {
         return true;
     }
     catch (err) {
-        if (err instanceof Error && err.name === 'TimeoutError')
+        if (err instanceof Error && err.name === 'TimeoutError') {
             throw new ServerUnresponsiveError(info, probeMs, { cause: err });
-        // A refusal or a non-JSON body proves no hippo server answers there; any other failure may be a live server, so the file stays.
+        }
+        // A refusal or a non-JSON body proves no hippo server answers there; any other failure may be a live server, so the
+        // file stays.
         if (isConnectionRefused(err) || err instanceof SyntaxError) {
             removePidfile(hippoRoot);
         }
@@ -112,8 +136,11 @@ async function healthMatchesPidfile(hippoRoot, info) {
         return false;
     }
 }
-/** Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking of missing/stale/malformed pidfiles).
- * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get reused). Probes only if the pid is live.
+/**
+ * Returns the pidfile's ServerInfo if a live hippo server answers on the recorded url, else null (best-effort unlinking
+ * of missing/stale/malformed pidfiles).
+ * `process.kill(pid, 0)` rules out dead pids; GET /health must then return the pidfile's `started_at` (pids get
+ * reused). Probes only if the pid is live.
  * Throws ServerUnresponsiveError when that probe times out. */
 export async function detectServer(hippoRoot) {
     const path = join(hippoRoot, PIDFILE);
@@ -124,7 +151,7 @@ export async function detectServer(hippoRoot) {
         info = JSON.parse(readFileSync(path, 'utf8'));
     }
     catch (err) {
-        log.warn(`server pidfile ${path} is unreadable (${errorMessage(err)}); removing it`);
+        log.warn(`server pidfile ${path} is unreadable (${errorMessage(err)}); removing it`, errorFields(err));
         removePidfile(hippoRoot);
         return null;
     }
@@ -134,7 +161,9 @@ export async function detectServer(hippoRoot) {
     }
     return (await healthMatchesPidfile(hippoRoot, info)) ? info : null;
 }
-/** Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes from the caller (`serve()`) so the
+/**
+ * Atomically writes the pidfile (process-scoped temp file, then rename; atomic on POSIX and NTFS). `startedAt` comes
+ * from the caller (`serve()`) so the
  * pidfile and GET /health carry the same timestamp, which detectServer's liveness probe compares. */
 export function writePidfile(hippoRoot, opts) {
     const path = join(hippoRoot, PIDFILE);
@@ -149,7 +178,9 @@ export function writePidfile(hippoRoot, opts) {
     writeFileSync(tmp, JSON.stringify(info));
     renameSync(tmp, path);
 }
-/** Best-effort pidfile removal, silent on any error so shutdown paths can call it. Identity-blind: a shutdown that must not clobber a newer server's pidfile
+/**
+ * Best-effort pidfile removal, silent on any error so shutdown paths can call it. Identity-blind: a shutdown that must
+ * not clobber a newer server's pidfile
  * uses removePidfileIfOwned. */
 export function removePidfile(hippoRoot) {
     const path = join(hippoRoot, PIDFILE);
@@ -158,8 +189,12 @@ export function removePidfile(hippoRoot) {
     }
     catch { /* already gone or undeletable; the next detectServer probe re-checks */ }
 }
-/** Removes the pidfile ONLY when both `pid` and `started_at` match `owner`, so an older shutting-down server cannot orphan a newer one; never throws.
- * Anything unreadable or malformed is "not provably mine" and left alone (detectServer unlinks it). Returns true iff removed. */
+/**
+ * Removes the pidfile ONLY when both `pid` and `started_at` match `owner`, so an older shutting-down server cannot
+ * orphan a newer one; never throws.
+ * Anything unreadable or malformed is "not provably mine" and left alone (detectServer unlinks it). Returns true iff
+ * removed.
+ */
 export function removePidfileIfOwned(hippoRoot, owner) {
     const path = join(hippoRoot, PIDFILE);
     try {

package/dist/server/sleep-child.js

@@ -1,12 +1,18 @@
-// Entry of the process that runs one POST /v1/sleep or MCP auto-sleep; sleep-offload.ts starts it and nothing imports it.
-// The sleep modules alone: the api barrel loads far more than one sleep needs, and every sleep pays for the start.
-import { sleep } from '../api/sleep.js';
-import { consolidate } from '../consolidate/sleep.js';
-import { runWithRequestStores, SERVER_DB_WAIT_MS } from '../db/index.js';
-import { isStoreBusy } from '../store/sqlite/busy.js';
+// Entry of the process that runs one POST /v1/sleep or MCP auto-sleep; sleep-offload.ts starts it and nothing imports
+// it. The sleep modules alone: the api barrel loads far more than one sleep needs, and every sleep pays for the start.
+import { sleep } from '../api/sleep/sleep.js';
+import { runConsolidation } from '../consolidate/sleep.js';
+import { isStoreBusy } from '../api/busy.js';
+import { runSqliteRequest } from '../store/sqlite/request-scope.js';
+import { sqliteStore, sqliteSyncStore } from '../store/sqlite/store.js';
 import { errorFields, errorMessage, log } from '../util/log.js';
 function failed(err) {
-    return { ok: false, busy: isStoreBusy(err), message: errorMessage(err), stack: err instanceof Error ? err.stack : undefined };
+    return {
+        ok: false,
+        busy: isStoreBusy(err),
+        message: errorMessage(err),
+        stack: err instanceof Error ? err.stack : undefined,
+    };
 }
 /** Resolves to the exit code once the channel has taken the reply, or failed to. */
 function sendReply(reply) {
@@ -22,10 +28,10 @@ process.once('message', (message) => {
     // SAFETY: sleep-offload.ts is the only writer on this channel and sends exactly one SleepJob.
     const job = message;
     const work = () => job.kind === 'consolidate'
-        ? consolidate(job.hippoRoot)
-        : sleep({ hippoRoot: job.hippoRoot, tenantId: job.tenantId, actor: job.actor }, job.opts);
+        ? runConsolidation(sqliteSyncStore(job.hippoRoot).localFiles)
+        : sleep({ hippoRoot: job.hippoRoot, tenantId: job.tenantId, actor: job.actor, store: sqliteStore(job.hippoRoot) }, job.opts);
     // The server's own request scope and lock wait, so a busy store answers as it did when sleep ran in the server.
-    runWithRequestStores(work, { busyWaitMs: SERVER_DB_WAIT_MS })
+    runSqliteRequest(work, 'server')
         .then((result) => ({ ok: true, result }), failed)
         // Exit only once the reply is written, or the parent could see the process end first.
         .then(sendReply)

package/dist/server/sleep-offload.d.ts

@@ -1,5 +1,6 @@
-import { type Actor, type Context, type SleepOpts, type SleepResult } from '../api/index.js';
-/** What the child needs to rebuild the request's context (the store handle itself cannot cross a process boundary), or the store an auto-sleep consolidates. */
+import { type Actor, type SleepOpts, type SleepResult, type ContextWith } from '../api/index.js';
+/** What the child needs to rebuild the request's context (the store handle itself cannot cross a process boundary),
+ * or the store an auto-sleep consolidates. */
 export type SleepJob = {
     readonly kind: 'sleep';
     readonly hippoRoot: string;
@@ -19,8 +20,10 @@ export type SleepReply<R = SleepResult> = {
     readonly message: string;
     readonly stack?: string;
 };
-/** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
-export declare function sleepInChild(ctx: Context, opts: SleepOpts): Promise<SleepResult>;
-/** The MCP auto-sleep's consolidation, in the same queue and child as POST /v1/sleep; auto-sleep only starts on a hippo.db store. */
+/** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline
+ * (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
+export declare function sleepInChild(ctx: ContextWith<'localFiles'>, opts: SleepOpts): Promise<SleepResult>;
+/** The MCP auto-sleep's consolidation, in the same queue and child
+ * as POST /v1/sleep; auto-sleep only starts on a hippo.db store. */
 export declare function consolidateInChild(hippoRoot: string): Promise<void>;
 //# sourceMappingURL=sleep-offload.d.ts.map

package/dist/server/sleep-offload.js

@@ -1,7 +1,7 @@
-// POST /v1/sleep and the MCP auto-sleep run their consolidation in a child process, so the server keeps answering and a stuck run can be stopped.
+// POST /v1/sleep and the MCP auto-sleep run their consolidation in a child process, so the server keeps answering and a
+// stuck run can be stopped.
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { sleep } from '../api/index.js';
 import { StoreBusyError } from '../store/port.js';
 import { envSleepTimeoutMs } from '../util/env.js';
 import { HttpError } from '../util/http-util.js';
@@ -25,22 +25,32 @@ function runInChild(job) {
         // The child's stderr is the server's log, so Node's SQLite notice would repeat there on every sleep.
         const child = spawn(process.execPath, ['--disable-warning=ExperimentalWarning', CHILD_ENTRY], {
             stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
-            windowsHide: true
+            windowsHide: true,
         });
         let reply;
         let timedOut = false;
-        // SIGKILL because the child is inside synchronous SQLite work and cannot run a handler; the OS drops its write lock.
-        const timer = setTimeout(() => { timedOut = true; child.kill('SIGKILL'); }, deadlineMs);
+        // SIGKILL because the child is inside synchronous SQLite work
+        // and cannot run a handler; the OS drops its write lock.
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGKILL');
+        }, deadlineMs);
         child.once('message', (message) => {
-            // SAFETY: sleep-child.ts is the only writer on this channel and sends exactly one SleepReply for the job it was given.
+            // SAFETY: sleep-child.ts is the only writer on this channel and sends exactly one SleepReply for the job it was
+            // given.
             reply = message;
         });
-        child.once('error', (err) => { clearTimeout(timer); reject(err); });
-        // 'close' and not 'exit': it waits for the channel to drain, so the reply is in hand and the child's store handles are gone.
+        child.once('error', (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+        // 'close' and not 'exit': it waits for the channel to drain, so
+        // the reply is in hand and the child's store handles are gone.
         child.once('close', (code, signal) => {
             clearTimeout(timer);
-            if (timedOut)
+            if (timedOut) {
                 reject(new HttpError(504, `sleep did not finish within ${deadlineMs} ms and was stopped; the next sleep carries on from there`));
+            }
             else if (reply?.ok)
                 resolve(reply.result);
             else
@@ -50,7 +60,8 @@ function runInChild(job) {
     });
 }
 let turn = Promise.resolve();
-// One running and one waiting: each further sleep would only hold a request open behind work the waiting one already covers.
+// One running and one waiting: each further sleep would only hold
+// a request open behind work the waiting one already covers.
 const MAX_SLEEPS_IN_LINE = 2;
 const SLEEP_RETRY_AFTER_SEC = 30;
 let inLine = 0;
@@ -59,20 +70,31 @@ function inTurn(job) {
         return Promise.reject(new HttpError(503, 'a sleep is already running and another is waiting; retry when one has finished', SLEEP_RETRY_AFTER_SEC));
     }
     inLine += 1;
-    // One sleep at a time, as on the server's single thread: a second one waits its turn and does not fight the first for the write lock.
+    // One sleep at a time, as on the server's single thread: a second one waits its turn and does not fight the first for
+    // the write lock.
     const run = turn.then(() => runInChild(job));
     // A failed sleep reaches its own caller through `run`; the queue only needs to know the turn is over.
-    turn = run.then(() => undefined, () => undefined).finally(() => { inLine -= 1; });
+    turn = run
+        .then(() => undefined, () => undefined)
+        .finally(() => {
+        inLine -= 1;
+    });
     return run;
 }
-/** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
+/** `sleep` for the HTTP route: same result and errors, run outside the serving process and stopped at the deadline
+ * (10 minutes, or HIPPO_SLEEP_TIMEOUT_MS). */
 export function sleepInChild(ctx, opts) {
-    // The child reopens the store by path, which only SQLite has; any other store keeps sleep's own refusal.
-    if (ctx.store && ctx.store.kind !== 'sqlite')
-        return sleep(ctx, opts);
-    return inTurn({ kind: 'sleep', hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor, opts });
+    return inTurn({
+        kind: 'sleep',
+        // The child reopens the folder the served store owns.
+        hippoRoot: ctx.store.localFiles.hippoRoot,
+        tenantId: ctx.tenantId,
+        actor: ctx.actor,
+        opts,
+    });
 }
-/** The MCP auto-sleep's consolidation, in the same queue and child as POST /v1/sleep; auto-sleep only starts on a hippo.db store. */
+/** The MCP auto-sleep's consolidation, in the same queue and child
+ * as POST /v1/sleep; auto-sleep only starts on a hippo.db store. */
 export async function consolidateInChild(hippoRoot) {
     await inTurn({ kind: 'consolidate', hippoRoot });
 }

package/dist/server/tls.d.ts

@@ -1,6 +1,14 @@
 import { type RequestListener, type Server } from 'node:http';
 import type { ServeOpts } from './types.js';
 export declare function createListener(tls: ServeOpts['tls'], onRequest: RequestListener): Server;
-/** Said once at boot: a non-loopback bind without TLS sends every key and memory over the network as plain text. */
-export declare function warnIfCleartext(host: string, tls: ServeOpts['tls'], loopbackHosts: ReadonlySet<string>): void;
+/** serve() refused a non-loopback bind without TLS: every key and memory would cross the network as plain text. */
+export declare class CleartextBindError extends Error {
+    readonly host: string;
+    constructor(host: string);
+}
+/**
+ * Throws CleartextBindError for a non-loopback bind without TLS unless the operator allowed cleartext, which is then
+ * said once at boot.
+ */
+export declare function assertTlsOrCleartextAllowed(host: string, tls: ServeOpts['tls'], loopbackHosts: ReadonlySet<string>, allowCleartext: boolean): void;
 //# sourceMappingURL=tls.d.ts.map

package/dist/server/tls.js

@@ -1,4 +1,5 @@
-// The serve() listener: node:https when a certificate is given, else node:http and a boot warning off loopback.
+// The serve() listener: node:https when a certificate is given, else node:http, which a non-loopback bind must opt
+// into.
 import { createServer as createHttpServer } from 'node:http';
 import { createServer as createHttpsServer } from 'node:https';
 import { errorMessage, log } from '../util/log.js';
@@ -14,11 +15,30 @@ export function createListener(tls, onRequest) {
         throw new Error(`hippo serve: the TLS certificate or key was refused: ${errorMessage(err)}`, { cause: err });
     }
 }
-/** Said once at boot: a non-loopback bind without TLS sends every key and memory over the network as plain text. */
-export function warnIfCleartext(host, tls, loopbackHosts) {
+/** serve() refused a non-loopback bind without TLS: every key and memory would cross the network as plain text. */
+export class CleartextBindError extends Error {
+    host;
+    constructor(host) {
+        super(`hippo serve: refusing to listen on ${host} without TLS, since API keys and memory text would travel in ` +
+            `cleartext. ` +
+            'Pass --tls-cert and --tls-key (or set HIPPO_TLS_CERT and HIPPO_TLS_KEY) to serve HTTPS. If a ' +
+            'TLS-terminating ' +
+            'proxy sits in front, ' +
+            'start with --allow-cleartext, set HIPPO_ALLOW_CLEARTEXT=1, or pass allowCleartext: true to serve().');
+        this.host = host;
+        this.name = 'CleartextBindError';
+    }
+}
+/**
+ * Throws CleartextBindError for a non-loopback bind without TLS unless the operator allowed cleartext, which is then
+ * said once at boot.
+ */
+export function assertTlsOrCleartextAllowed(host, tls, loopbackHosts, allowCleartext) {
     if (tls || loopbackHosts.has(host))
         return;
-    log.warn(`serve: listening on ${host} without TLS, so API keys and memory text travel in cleartext unless a TLS-terminating proxy sits in front. ` +
-        'To serve HTTPS directly, pass --tls-cert and --tls-key (or set HIPPO_TLS_CERT and HIPPO_TLS_KEY).');
+    if (!allowCleartext)
+        throw new CleartextBindError(host);
+    log.warn(`serve: listening on ${host} without TLS, as allowed; API keys and memory text are cleartext until the proxy in ` +
+        `front adds TLS.`);
 }
 //# sourceMappingURL=tls.js.map