hippo-memory 1.72.0 → 2.1.0

package/dist/api/conflicts.js

@@ -1,61 +0,0 @@
-// Conflict resolution for every front end, so the reach, status, pair and liveness checks live in one place.
-// SHORTCUT: hippo.db only, since the store port has no conflict calls; a conflicts group when a served store needs them.
-import { BadRequestError, ConflictError, NotFoundError } from '../core/api-errors.js';
-import { listMemoryConflicts, listTouchableConflicts, resolveConflict } from '../store/conflicts.js';
-import { loadEntriesByIds } from '../store/entry-reads.js';
-import { chunked } from '../util/chunked.js';
-import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
-import { classifyOriginProject } from '../core/project-identity.js';
-import { isQuarantineScope } from '../trust/quarantine.js';
-import { requireHostAdmin } from './types.js';
-function isLive(entry) {
-    return !entry.superseded_by && (entry.kind === 'raw' || entry.kind === 'distilled') && !isQuarantineScope(entry.scope);
-}
-/** Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as `ctx.actor`.
- *  NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair. */
-export function resolveMemoryConflict(ctx, conflictId, opts) {
-    // Read with every status, so a resolved conflict answers 409 while one holding another person's personal row stays a 404.
-    const conflict = listTouchableConflicts(ctx.hippoRoot, '*', ctx.tenantId, ctx.actor).find((c) => c.id === conflictId);
-    if (!conflict)
-        throw new NotFoundError(`conflict not found: ${conflictId}`);
-    if (conflict.status !== 'open')
-        throw new ConflictError(`conflict ${conflictId} is already resolved`);
-    const pair = [conflict.memory_a_id, conflict.memory_b_id];
-    if (!pair.includes(opts.keepId))
-        throw new BadRequestError(`keep must be one of the two memories in conflict ${conflictId}: ${pair.join(', ')}`);
-    if (loadEntriesByIds(ctx.hippoRoot, pair, ctx.tenantId).filter(isLive).length < pair.length) {
-        throw new NotFoundError(`conflict ${conflictId} names a memory that is superseded, archived or quarantined`);
-    }
-    const resolved = resolveConflict(ctx.hippoRoot, conflictId, opts.keepId, opts.forget === true, ctx.tenantId, {
-        rejectLoserValue: opts.rejectLoser === true,
-        reason: opts.reason,
-        rejectedBy: ctx.actor.subject,
-    });
-    // Every check passed above, so null here is another resolver getting there first.
-    if (resolved === null)
-        throw new ConflictError(`conflict ${conflictId} is already resolved`);
-    return { conflictId, keptId: opts.keepId, loserId: resolved.loserId };
-}
-/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
- *  its repo or user-global, and no scope it was not asked for. */
-export function listOpenConflicts(ctx, project) {
-    const touchable = listTouchableConflicts(ctx.hippoRoot, 'open', ctx.tenantId, ctx.actor);
-    if (!project)
-        return touchable;
-    const own = personalScopeOf(ctx.actor);
-    const ids = [...new Set(touchable.flatMap((c) => [c.memory_a_id, c.memory_b_id]))];
-    // loadEntriesByIds reads at most one chunk of ids per call.
-    const rows = new Map(chunked(ids).flatMap((chunk) => loadEntriesByIds(ctx.hippoRoot, chunk, ctx.tenantId)).map((row) => [row.id, row]));
-    const shown = (id) => {
-        const row = rows.get(id);
-        return row !== undefined && classifyOriginProject(row.origin_project, project) !== 'cross-project'
-            && passesScopeFilterForRecall(row.scope ?? null, undefined, own);
-    };
-    return touchable.filter((c) => shown(c.memory_a_id) && shown(c.memory_b_id));
-}
-/** Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only. */
-export function listConflicts(ctx, status, reach = {}) {
-    requireHostAdmin(ctx, 'Listing conflicts past the scope check');
-    return listMemoryConflicts(ctx.hippoRoot, status, reach.everyTenant ? undefined : ctx.tenantId);
-}
-//# sourceMappingURL=conflicts.js.map

package/dist/api/dormant.d.ts

@@ -1,14 +0,0 @@
-import { type DormantMemory, type ListDormantOpts } from '../store/dormant.js';
-import { type MemoryEntry } from '../core/memory.js';
-import type { Context } from './types.js';
-/** A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of active memory when `dormant.enabled` is on. Newest first;
- * `opts.query` keeps rows containing every term (case-insensitive). */
-export declare function listDormant(ctx: Context, opts?: ListDormantOpts): DormantMemory[];
-/** Restores a dormant memory as if just recalled, with a full half-life; a row set aside by audit repair returns `verified`.
- * Throws if the tenant has no such dormant id or a live memory holds it, and RejectedValueError if the value was since rejected (the dormant copy stays). */
-export declare function restoreDormant(ctx: Context, id: string): MemoryEntry;
-/** Permanently deletes a dormant memory, the explicit "forget it for good"; throws when the tenant has no dormant memory with that id. */
-export declare function forgetDormant(ctx: Context, id: string): void;
-/** Whether the tenant holds a dormant memory with this id that the caller may touch (for "not found" hints). */
-export declare function isDormant(ctx: Context, id: string): boolean;
-//# sourceMappingURL=dormant.d.ts.map

package/dist/api/dormant.js

@@ -1,58 +0,0 @@
-// Dormant memories: list, restore, forget and check.
-import { ConflictError, NotFoundError } from '../core/api-errors.js';
-import { stampOriginProject } from '../store/entry-row.js';
-import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
-import { loadDormantMemories, holdsDormantMemory, restoreDormantMemory, forgetDormantMemory, } from '../store/dormant.js';
-import { strengthAblation } from '../core/ablation.js';
-import { createMemory, calculateStrength } from '../core/memory.js';
-import { loadConfig } from '../core/config.js';
-import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
-import { touchableScopeSql } from '../store/rule-sql.js';
-const touchable = (ctx) => touchableScopeSql('', personalScopeOf(ctx.actor));
-/** A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of active memory when `dormant.enabled` is on. Newest first;
- * `opts.query` keeps rows containing every term (case-insensitive). */
-export function listDormant(ctx, opts = {}) {
-    return loadDormantMemories(ctx.hippoRoot, ctx.tenantId, opts, touchable(ctx));
-}
-/** Restores a dormant memory as if just recalled, with a full half-life; a row set aside by audit repair returns `verified`.
- * Throws if the tenant has no such dormant id or a live memory holds it, and RejectedValueError if the value was since rejected (the dormant copy stays). */
-export function restoreDormant(ctx, id) {
-    const outcome = restoreDormantMemory(ctx.hippoRoot, {
-        tenantId: ctx.tenantId,
-        id,
-        actor: ctx.actor.subject,
-        inReach: (scope) => canTouchScope(ctx.actor, scope),
-        revive: (snapshot, now) => reviveSnapshot(ctx, snapshot, now),
-    });
-    if (outcome.status === 'missing')
-        throw new NotFoundError(`dormant memory not found: ${id}`);
-    if (outcome.status === 'active') {
-        throw new ConflictError(`memory ${id} is already active; forget it before restoring its dormant copy`);
-    }
-    return outcome.entry;
-}
-function reviveSnapshot(ctx, dormant, now) {
-    // A snapshot can predate a field added later: createMemory supplies defaults, then the snapshot overrides every field it carries.
-    // The placeholder content only meets createMemory's minimum length, so a legacy row under 3 chars still restores.
-    const revived = {
-        ...createMemory('dormant snapshot defaults', { baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays }),
-        ...dormant.entry,
-        last_retrieved: now.toISOString(),
-    };
-    if (dormant.reason === 'quality-repair')
-        revived.confidence = 'verified';
-    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now, { ablation: strengthAblation() }) });
-}
-/** Permanently deletes a dormant memory, the explicit "forget it for good"; throws when the tenant has no dormant memory with that id. */
-export function forgetDormant(ctx, id) {
-    const forgotten = forgetDormantMemory(ctx.hippoRoot, { tenantId: ctx.tenantId, id, actor: ctx.actor.subject, admit: touchable(ctx) });
-    if (!forgotten)
-        throw new NotFoundError(`dormant memory not found: ${id}`);
-    // Counted like every other permanent removal (forget, archiveRaw).
-    updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
-}
-/** Whether the tenant holds a dormant memory with this id that the caller may touch (for "not found" hints). */
-export function isDormant(ctx, id) {
-    return holdsDormantMemory(ctx.hippoRoot, ctx.tenantId, id, touchable(ctx));
-}
-//# sourceMappingURL=dormant.js.map

package/dist/api/goals.d.ts

@@ -1,18 +0,0 @@
-import { type CompleteGoalOpts, type Goal, type PushGoalOpts } from '../store/goals.js';
-import { type Context } from './types.js';
-/** What a new goal carries; its tenant is always the caller's. */
-export type GoalPushOpts = Omit<PushGoalOpts, 'tenantId'>;
-/** Push a goal onto `sessionId`'s stack in the caller's tenant. */
-export declare function goalPush(ctx: Context, opts: GoalPushOpts): Goal;
-/** The caller's goals for `sessionId`: active ones, or every status when `all` is set. */
-export declare function goalList(ctx: Context, opts: {
-    sessionId: string;
-    all: boolean;
-}): Goal[];
-/** Complete a goal by id; a no-op for an unknown or already completed goal. Host admin only. */
-export declare function goalComplete(ctx: Context, goalId: string, opts: CompleteGoalOpts): void;
-/** Suspend an active goal by id. Host admin only. */
-export declare function goalSuspend(ctx: Context, goalId: string): void;
-/** Resume a suspended goal by id, suspending the oldest active one past the depth cap. Host admin only. */
-export declare function goalResume(ctx: Context, goalId: string): void;
-//# sourceMappingURL=goals.d.ts.map

package/dist/api/graph.d.ts

@@ -1,8 +0,0 @@
-import type { GraphRows } from '../store/port.js';
-import type { Context } from './types.js';
-/** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
-export declare function graphRows(ctx: Context, query: {
-    entity?: string;
-    limit: number;
-}): Promise<GraphRows>;
-//# sourceMappingURL=graph.d.ts.map

package/dist/api/graph.js

@@ -1,7 +0,0 @@
-import { requireGroup, storeFor } from '../store/index.js';
-/** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
-export async function graphRows(ctx, query) {
-    const { role, scopes, owner } = ctx.actor;
-    return requireGroup(storeFor(ctx), 'graphReads').graphRows(ctx.tenantId, { ...query, reader: { role, scopes, owner } });
-}
-//# sourceMappingURL=graph.js.map

package/dist/api/learn.js

@@ -1,124 +0,0 @@
-// Git auto-learn: fix/revert/bug commit subjects become memories. `hippo learn`, init, sleep and MCP hippo_learn share it.
-import { ForbiddenError } from '../core/api-errors.js';
-import { fetchGitLog, extractLessons, partitionLessons, isGitRepo } from '../learn/autolearn.js';
-import { loadConfig } from '../core/config.js';
-import { withRequestStoresSync } from '../db/request-stores.js';
-import { embedMemory } from '../search/embed-memories.js';
-import { extractInvalidationTarget, invalidateMatching, invalidateMatchingAmong, } from '../learn/invalidation.js';
-import { createMemory, Layer, schemaFitFrom, schemaFitSourceOf } from '../core/memory.js';
-import { extractPathTags } from '../search/path-context.js';
-import { canReadScope, personalScopeOf } from '../core/recall-scope.js';
-import { touchableScopeSql } from '../store/rule-sql.js';
-import { duplicateKey, longestWord, storedTextKeys } from '../util/same-text.js';
-import { loadTextsHoldingWords } from '../store/candidates.js';
-import { loadAllEntries } from '../store/entry-reads.js';
-import { writeEntriesSkippingRejected } from '../store/entry-writes.js';
-import { updateStats } from '../store/index-and-stats.js';
-// SHORTCUT: two profiles keep each surface's rows as they were; fold MCP onto the CLI profile once it may invalidate.
-export const CLI_LEARN = Object.freeze({ tags: Object.freeze(['error', 'git-learned']), source: 'git-learn', full: true });
-export const MCP_LEARN = Object.freeze({ tags: Object.freeze(['git-learned']), source: 'git', full: false });
-/** Learn from `repoPath`'s last `days` of commits into the caller's tenant. Host admin only. */
-export function learn(ctx, opts) {
-    // It reads the host's own git history, which belongs to the host, not to the caller's tenant.
-    if (!ctx.actor.hostAdmin)
-        throw new ForbiddenError('hippo_learn requires a host admin');
-    const none = { added: 0, skipped: 0, rejected: 0, lowInfo: 0, invalidations: [] };
-    if (!isGitRepo(opts.repoPath))
-        return { status: 'not-a-repo', ...none };
-    const gitLog = fetchGitLog(opts.repoPath, opts.days);
-    if (!gitLog.trim())
-        return { status: 'no-commits', ...none };
-    const config = loadConfig(ctx.hippoRoot);
-    const parsed = extractLessons(gitLog, config.gitLearnPatterns);
-    if (parsed.length === 0)
-        return { status: 'no-lessons', ...none };
-    // The gate filters the loop input, so a dropped lesson neither stores nor invalidates; docs/decisions git-learn-gate-placement says why.
-    const { kept, dropped } = partitionLessons(parsed);
-    return { status: 'scanned', lowInfo: dropped.length, ...writeLessons(ctx, kept, opts, config) };
-}
-/** Writes `batch` in one transaction; a refused lesson is dropped from `live` and `keys` and must not abort the rest of the git-log scan. */
-function landLessons(ctx, batch, live, keys, counts, full) {
-    if (batch.length === 0)
-        return;
-    // SHORTCUT: hippo.db only, as the port has no batch write, stats bump or whole-tenant read, so another store kind answers 501 at the
-    // open; port groups for them once a served store must learn.
-    const landed = [];
-    writeEntriesSkippingRejected(ctx.hippoRoot, (put) => {
-        for (const { entry, key } of batch) {
-            if (put(entry)) {
-                landed.push(entry);
-                continue;
-            }
-            counts.rejected++;
-            keys.delete(key);
-            const at = live.indexOf(entry);
-            if (at !== -1)
-                live.splice(at, 1);
-        }
-    }, ctx.actor.subject);
-    counts.added += landed.length;
-    if (!full)
-        return;
-    if (landed.length > 0)
-        updateStats(ctx.hippoRoot, { remembered: landed.length });
-    for (const entry of landed)
-        void embedMemory(ctx.hippoRoot, entry);
-}
-function writeLessons(ctx, lessons, opts, config) {
-    const { hippoRoot, tenantId } = ctx;
-    const { profile } = opts;
-    // `hippo init` calls this outside any request, so the batch brings its own scope: every read and write below shares one handle.
-    return withRequestStoresSync(() => {
-        // One read serves the batch: invalidation matches against `live`, which follows every write below, as a reload per lesson did.
-        const live = profile.full ? loadAllEntries(hippoRoot, tenantId) : [];
-        // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so
-        // both read what an admin can.
-        const existing = profile.full ? live.filter((e) => e.scope == null || canReadScope(ctx.actor, e.scope)) : undefined;
-        // Each lesson is scored against `existing` as it was before the batch, so its tag counts and texts are read once.
-        const fitSource = existing && schemaFitSourceOf(existing);
-        const readable = touchableScopeSql('', personalScopeOf(ctx.actor));
-        const keys = storedTextKeys(existing ?? loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord), undefined, readable));
-        const pathTags = profile.full ? extractPathTags(opts.repoPath) : [];
-        const counts = { added: 0, skipped: 0, rejected: 0, invalidations: [] };
-        // Lessons queue and land in one transaction; an invalidation reads the store, so it flushes the queue first.
-        const queue = [];
-        const flush = () => landLessons(ctx, queue.splice(0), live, keys, counts, profile.full);
-        for (const lesson of lessons) {
-            const key = duplicateKey(lesson);
-            if (keys.has(key)) {
-                counts.skipped++;
-                continue;
-            }
-            const target = profile.full ? extractInvalidationTarget(lesson) : null;
-            if (target) {
-                flush();
-                const { invalidated } = invalidateMatchingAmong(hippoRoot, live, target, tenantId);
-                if (invalidated > 0)
-                    counts.invalidations.push({ from: target.from, count: invalidated });
-            }
-            const entry = createMemory(lesson, {
-                layer: Layer.Episodic,
-                tags: [...profile.tags],
-                source: profile.source,
-                confidence: 'observed',
-                schema_fit: fitSource && schemaFitFrom(lesson, [...profile.tags], fitSource),
-                tenantId,
-                baseHalfLifeDays: config.defaultHalfLifeDays,
-            });
-            for (const tag of pathTags)
-                if (!entry.tags.includes(tag))
-                    entry.tags.push(tag);
-            queue.push({ entry, key });
-            if (profile.full)
-                live.push(entry);
-            keys.add(key);
-        }
-        flush();
-        return counts;
-    });
-}
-/** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */
-export function invalidateMemories(ctx, target, options) {
-    return invalidateMatching(ctx.hippoRoot, target, ctx.tenantId, options);
-}
-//# sourceMappingURL=learn.js.map

package/dist/api/memories.d.ts

@@ -1,23 +0,0 @@
-import type { MemoryEntry } from '../core/memory.js';
-import { type StrengthTallies } from '../store/candidates.js';
-import { type Context } from './types.js';
-/** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
-export declare function getMemory(ctx: Context, id: string): Promise<MemoryEntry | null>;
-/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
-export declare function getTouchableMemory(ctx: Context, id: string): Promise<MemoryEntry | null>;
-export interface MemoryStatus extends StrengthTallies {
-    openConflicts: number;
-}
-/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
-export declare function getMemoryStatus(ctx: Context, now: Date, atRiskBelow: number): MemoryStatus;
-/** Which rows a read covers: the caller's tenant, or with `everyTenant` the whole store. */
-export interface TenantReach {
-    everyTenant?: boolean;
-}
-/** Every memory row in reach, oldest first. */
-export declare function listMemories(ctx: Context, reach?: TenantReach): MemoryEntry[];
-/** How many memory rows the whole store holds, counted in SQL. */
-export declare function countAllMemories(ctx: Context): number;
-/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
-export declare function listMemoriesByIds(ctx: Context, ids: readonly string[], reach?: TenantReach): MemoryEntry[];
-//# sourceMappingURL=memories.d.ts.map

package/dist/api/memories.js

@@ -1,46 +0,0 @@
-import { loadStrengthTallies } from '../store/candidates.js';
-import { countOpenConflicts } from '../store/conflicts.js';
-import { NotFoundError } from '../core/api-errors.js';
-import { canTouchScope } from '../core/recall-scope.js';
-import { storeFor } from '../store/index.js';
-import { countAllEntries, loadAllEntries, loadEntriesByIds } from '../store/entry-reads.js';
-import { requireHostAdmin } from './types.js';
-/** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
-export async function getMemory(ctx, id) {
-    const [entry] = await storeFor(ctx).entriesByIds([id], ctx.tenantId);
-    return entry ?? null;
-}
-/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
-export async function getTouchableMemory(ctx, id) {
-    const entry = await getMemory(ctx, id);
-    if (!canTouchScope(ctx.actor, entry?.scope ?? null))
-        throw new NotFoundError(`Memory not found: ${id}`);
-    return entry;
-}
-/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
-export function getMemoryStatus(ctx, now, atRiskBelow) {
-    return {
-        ...loadStrengthTallies(ctx.hippoRoot, ctx.tenantId, now, atRiskBelow),
-        openConflicts: countOpenConflicts(ctx.hippoRoot, ctx.tenantId),
-    };
-}
-function tenantFilter(ctx, reach) {
-    if (!reach.everyTenant)
-        return ctx.tenantId;
-    requireHostAdmin(ctx, 'Reading every tenant');
-    return undefined;
-}
-/** Every memory row in reach, oldest first. */
-export function listMemories(ctx, reach = {}) {
-    return loadAllEntries(ctx.hippoRoot, tenantFilter(ctx, reach));
-}
-/** How many memory rows the whole store holds, counted in SQL. */
-export function countAllMemories(ctx) {
-    requireHostAdmin(ctx, 'Reading every tenant');
-    return countAllEntries(ctx.hippoRoot);
-}
-/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
-export function listMemoriesByIds(ctx, ids, reach = {}) {
-    return loadEntriesByIds(ctx.hippoRoot, ids, tenantFilter(ctx, reach));
-}
-//# sourceMappingURL=memories.js.map

package/dist/api/objects.d.ts

@@ -1,9 +0,0 @@
-import type { SavableDescriptor } from '../objects/descriptor.js';
-import type { ObjectByKind, SavableKind } from '../core/object-types.js';
-import type { Objects } from '../store/port.js';
-import type { Context } from './types.js';
-/** The request store's object group; the dispatcher has already answered 501 for a store without it. */
-export declare function objectsOf(ctx: Context): Objects;
-/** Saves through the request's store as the authenticated caller. */
-export declare function saveFor<K extends SavableKind, W>(ctx: Context, d: SavableDescriptor<K, W>, write: W): Promise<ObjectByKind[K]>;
-//# sourceMappingURL=objects.d.ts.map

package/dist/api/on-store.d.ts

@@ -1,16 +0,0 @@
-import type { HippoStore, StoreGroups } from '../store/port.js';
-import { type SqliteLocal } from '../store/sqlite/local.js';
-import { type SqliteSyncStore } from '../store/sqlite/store.js';
-import type { Context, StoreReply } from './types.js';
-/** What a port call answers: a Promise from a served store, the value itself from hippo.db. */
-export type Reply<T> = T | Promise<T>;
-/** The port one body is written against: a served store, or hippo.db answering the same methods at once. */
-export type StorePort = HippoStore | SqliteSyncStore;
-/** `next` on the reply's value, at once for a value, so hippo.db's path never becomes a Promise. */
-export declare function andThen<T, U>(reply: Reply<T>, next: (value: T) => Reply<U>): Reply<U>;
-/** Stands in for a group the store lacks, as `port.keyAudit ?? notPorted(port, 'keyAudit')`; it answers 501 as any unported path does. */
-export declare function notPorted(port: StorePort, group: keyof StoreGroups): never;
-/** Runs `run` on `ctx.store`, where a throw rejects, else on hippo.db under `ctx.hippoRoot`, where it throws. The store path never reads `hippoRoot`.
- *  `local` runs what needs hippo.db's own handle or meta table; a served store refuses it, or does without where the write allows. */
-export declare function onStore<C extends Context, R>(ctx: C, run: (port: StorePort, local: SqliteLocal) => Reply<R>): StoreReply<C, R>;
-//# sourceMappingURL=on-store.d.ts.map

package/dist/api/on-store.js

@@ -1,38 +0,0 @@
-// The one place an api function picks between a served store and hippo.db, so each operation has one body.
-// Only functions published as StoreReply use this carrier (see "Sync core, async port" in docs/ARCHITECTURE.md);
-// a new operation is async and goes through storeFor(ctx).
-import { SqliteBlockedError, StoreNotPortedError } from '../util/sqlite-blocked.js';
-import { REFUSED_ON_A_STORE, sqliteLocal } from '../store/sqlite/local.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
-/** `next` on the reply's value, at once for a value, so hippo.db's path never becomes a Promise. */
-export function andThen(reply, next) {
-    return reply instanceof Promise ? reply.then(next) : next(reply);
-}
-/** Stands in for a group the store lacks, as `port.keyAudit ?? notPorted(port, 'keyAudit')`; it answers 501 as any unported path does. */
-export function notPorted(port, group) {
-    throw new StoreNotPortedError(port.kind, group);
-}
-/** A served store's stand-in for SqliteLocal. The last recall sits in hippo.db's
- * meta table, so only a store that is hippo.db keeps and reads it, on `hippoRoot`. */
-function servedLocal(store, hippoRoot) {
-    if (store.kind === 'sqlite')
-        return { ...sqliteLocal(hippoRoot), ...REFUSED_ON_A_STORE };
-    return {
-        ...REFUSED_ON_A_STORE,
-        applyOutcomeToLastRecall() {
-            throw new SqliteBlockedError(store.kind);
-        },
-        finishLastRecall: (writes) => store.finishRecall(writes).then(() => null),
-    };
-}
-/** Runs `run` on `ctx.store`, where a throw rejects, else on hippo.db under `ctx.hippoRoot`, where it throws. The store path never reads `hippoRoot`.
- *  `local` runs what needs hippo.db's own handle or meta table; a served store refuses it, or does without where the write allows. */
-export function onStore(ctx, run) {
-    const { store } = ctx;
-    // No await before `run`: an add-on relies on the first port call starting inside this call.
-    const reply = store ? (async () => run(store, servedLocal(store, ctx.hippoRoot)))() : run(sqliteSyncStore(ctx.hippoRoot), sqliteLocal(ctx.hippoRoot));
-    // SAFETY: the store path is an async function's Promise and hippo.db's port calls answer
-    // values, so the Promise comes back exactly when ctx has a store, as StoreReply says.
-    return reply;
-}
-//# sourceMappingURL=on-store.js.map

package/dist/api/outcome.d.ts

@@ -1,19 +0,0 @@
-import type { Context, StoreReply } from './types.js';
-/** An id outside ctx.tenantId, or in someone else's personal scope, is skipped, so a stale id never fails the call.
- *  `appliedIds` holds only the ids applied: a caller that answers across tenants returns it, never the ids it was sent. */
-export interface OutcomeResult {
-    applied: number;
-    appliedIds: string[];
-}
-/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
-export declare function outcome<C extends Context>(ctx: C, ids: ReadonlyArray<string>, good: boolean, opts?: {
-    traceId?: number;
-}): StoreReply<C, OutcomeResult>;
-/** The last recall's ids and its trace sit in hippo.db's meta table, which only the CLI and context write, so a store of another kind is refused.
- *  `ids` holds only the ids applied in ctx.tenantId: the index is not tenant-scoped, so the ids read from it are never returned. */
-export interface OutcomeForLastRecallResult {
-    applied: number;
-    ids: string[];
-}
-export declare function outcomeForLastRecall<C extends Context>(ctx: C, good: boolean): StoreReply<C, OutcomeForLastRecallResult>;
-//# sourceMappingURL=outcome.d.ts.map

package/dist/api/outcome.js

@@ -1,21 +0,0 @@
-// Outcome feedback on recalled memories.
-import { personalScopeOf } from '../core/recall-scope.js';
-import { andThen, notPorted, onStore } from './on-store.js';
-/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
-export function outcome(ctx, ids, good, opts) {
-    return onStore(ctx, (port, local) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
-        const traceId = opts?.traceId;
-        // The trace link is written on hippo.db's own handle after the commit, so a served store refuses a traceId.
-        const applied = traceId === undefined ? entryWrites.applyOutcome(write) : local.applyOutcome(write, traceId);
-        return andThen(applied, (appliedIds) => ({ applied: appliedIds.length, appliedIds }));
-    });
-}
-export function outcomeForLastRecall(ctx, good) {
-    return onStore(ctx, (_port, local) => {
-        const ids = local.applyOutcomeToLastRecall({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
-        return { applied: ids.length, ids };
-    });
-}
-//# sourceMappingURL=outcome.js.map

package/dist/api/predictions.d.ts

@@ -1,11 +0,0 @@
-import { type Prediction, type PredictionBaserate, type SavePredictionOpts } from '../store/predictions.js';
-import type { PredictionClose, PredictionSave, Predictions } from '../store/port.js';
-import type { Context } from './types.js';
-export declare function savePrediction(ctx: Context, input: PredictionSave): Promise<Prediction>;
-/** A claim saved with its recall mirror, built under the store root's half-life as the HTTP create route builds it. */
-export declare function recordPrediction(ctx: Context, claim: SavePredictionOpts): Promise<Prediction>;
-export declare function listPredictions(ctx: Context, query: Parameters<Predictions['listPredictions']>[1]): Promise<Prediction[]>;
-export declare function predictionBaserate(ctx: Context, classTag: string): Promise<PredictionBaserate>;
-export declare function predictionById(ctx: Context, id: number): Promise<Prediction | null>;
-export declare function closePrediction(ctx: Context, id: number, close: PredictionClose): Promise<Prediction>;
-//# sourceMappingURL=predictions.d.ts.map

package/dist/api/promote.d.ts

@@ -1,36 +0,0 @@
-import type { ConnectorEvent } from '../store/port.js';
-import { type Layer } from '../core/memory.js';
-import type { Context, StoreReply } from './types.js';
-/** Copies a local memory into the global store; the inner writeEntry emits 'remember' there, and we add a 'promote' audit event so intent stays distinct.
- * promoteToGlobal reads via `readEntry` with no tenant filter and keeps the entry's existing tenantId on the global side. */
-export interface PromoteResult {
-    ok: true;
-    sourceId: string;
-    globalId: string;
-}
-export declare function promote(ctx: Context, id: string): PromoteResult;
-/** Replace an old memory with new content, chaining old.superseded_by = new.id; the store commits both rows and the audit row together. */
-export interface SupersedeResult {
-    ok: true;
-    oldId: string;
-    newId: string;
-}
-/** What the successor takes instead of the old row's value. Never set from a request body: the CLI fills it from its flags. */
-export interface SupersedeOverrides {
-    layer?: Layer;
-    tags?: string[];
-    pinned?: boolean;
-}
-export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string, overrides?: SupersedeOverrides): StoreReply<C, SupersedeResult>;
-/** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is
- * deleted. The store writes the one archive_raw audit row, under the caller's subject. */
-export interface ArchiveRawOpts {
-    /** The connector event this archive answers. The store logs it in the archive's own transaction, so a redelivery finds it logged. */
-    event?: ConnectorEvent;
-}
-export interface ArchiveRawResult {
-    ok: true;
-    archivedAt: string;
-}
-export declare function archiveRaw<C extends Context>(ctx: C, id: string, reason: string, opts?: ArchiveRawOpts): StoreReply<C, ArchiveRawResult>;
-//# sourceMappingURL=promote.d.ts.map

package/dist/api/promote.js

@@ -1,65 +0,0 @@
-// Promote to the global store, supersede with a successor, and archive raw memories.
-import { ConflictError, NotFoundError } from '../core/api-errors.js';
-import { stampOriginProject } from '../store/entry-row.js';
-import { createSuccessor } from '../core/memory.js';
-import { promoteToGlobal } from '../sharing/global-store.js';
-import { loadConfig } from '../core/config.js';
-import { andThen, notPorted, onStore } from './on-store.js';
-import { memoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
-export function promote(ctx, id) {
-    // promoteToGlobal reads without a tenant filter, so pre-check the row's tenant_id and deny cross-tenant access with archiveRaw's not-found wording
-    // (no leak about whether the id exists in another tenant).
-    const reach = memoryReach(ctx.hippoRoot, id);
-    if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-        throw new NotFoundError(`memory not found: ${id}`);
-    }
-    // The 'promote' row commits with the global copy, so no write follows the commit and a busy store fails the whole promote.
-    const globalEntry = promoteToGlobal(ctx.hippoRoot, id, {
-        actor: ctx.actor.subject,
-        tenantId: ctx.tenantId,
-        auditAs: { tenantId: ctx.tenantId, actor: ctx.actor.subject },
-    });
-    return { ok: true, sourceId: id, globalId: globalEntry.id };
-}
-export function supersede(ctx, oldId, newContent, overrides = {}) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        return andThen(port.entriesByIds([oldId], ctx.tenantId), ([old]) => {
-            const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
-                tenantId: ctx.tenantId,
-                baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
-                layer: overrides.layer,
-                tags: overrides.tags,
-                pinned: overrides.pinned,
-            });
-            // A store writes origin_project as given, so the served folder's fallback is stamped here.
-            const successor = stampOriginProject(ctx.hippoRoot, newEntry);
-            const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor };
-            return andThen(entryWrites.supersede(write), () => ({ ok: true, oldId, newId: successor.id }));
-        });
-    });
-}
-/** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
-function assertSupersedable(ctx, oldId, old) {
-    if (!old || !canTouchScope(ctx.actor, old.scope ?? null)) {
-        throw new NotFoundError(`Memory not found: ${oldId}`);
-    }
-    // The CAS UPDATE closes the race; this check only gives a clearer error in the common single-writer case.
-    if (old.superseded_by) {
-        throw new ConflictError(`Memory ${oldId} is already superseded by ${old.superseded_by}. Supersede that one instead.`);
-    }
-    return old;
-}
-export function archiveRaw(ctx, id, reason, opts = {}) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
-        const { event } = opts;
-        const archived = event
-            ? (port.connectorWrites ?? notPorted(port, 'connectorWrites')).archiveConnectorEntry({ ...archive, event })
-            : entryWrites.archiveRaw(archive);
-        return andThen(archived, (archivedAt) => ({ ok: true, archivedAt }));
-    });
-}
-//# sourceMappingURL=promote.js.map

package/dist/api/recall-core.d.ts

@@ -1,4 +0,0 @@
-import type { CliCoreRanker, RecallOpts, RecallResult } from './recall-types.js';
-import type { Context } from './types.js';
-export declare function retrieveWithCliCore(ctx: Context, opts: RecallOpts, core: CliCoreRanker): Promise<RecallResult>;
-//# sourceMappingURL=recall-core.d.ts.map