hippo-memory 2.0.0 → 2.1.0

package/dist/api/memories/conflicts.d.ts

@@ -0,0 +1,33 @@
+import type { MemoryConflict } from '../../store/rows.js';
+import type { CallerProject } from '../prompt-hook.js';
+import { type ContextWith } from '../types.js';
+import type { TenantReach } from './memories.js';
+export interface ResolveMemoryConflictOpts {
+    /** One of the conflict's two memories; the other is the loser. */
+    keepId: string;
+    /** Delete the loser instead of halving its half-life. */
+    forget?: boolean;
+    /** Tombstone the loser's value as well, which removes it whatever `forget` says. */
+    rejectLoser?: boolean;
+    /** Kept on the tombstone; a conflict-context reason when unset. */
+    reason?: string;
+}
+export interface ResolveMemoryConflictResult {
+    conflictId: number;
+    keptId: string;
+    loserId: string;
+}
+/**
+ * Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as
+ * `ctx.actor`.
+ * NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair.
+ */
+export declare function resolveMemoryConflict(ctx: ContextWith<'conflicts'>, conflictId: number, opts: ResolveMemoryConflictOpts): Promise<ResolveMemoryConflictResult>;
+/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
+ *  its repo or user-global, and no scope it was not asked for. */
+export declare function listOpenConflicts(ctx: ContextWith<'conflicts'>, project?: CallerProject): Promise<MemoryConflict[]>;
+/**
+ * Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only.
+ */
+export declare function listConflicts(ctx: ContextWith<'conflicts'>, status: string, reach?: TenantReach): Promise<MemoryConflict[]>;
+//# sourceMappingURL=conflicts.d.ts.map

package/dist/api/memories/conflicts.js

@@ -0,0 +1,67 @@
+// Conflict resolution for every front end, so the reach, status, pair and liveness checks live in one place.
+import { BadRequestError, ConflictError, NotFoundError } from '../../core/api-errors.js';
+import { chunked } from '../../util/chunked.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../../core/recall-scope.js';
+import { classifyOriginProject } from '../../core/project-identity.js';
+import { isQuarantineScope } from '../../trust/quarantine.js';
+import { requireHostAdmin } from '../types.js';
+function isLive(entry) {
+    return (!entry.superseded_by && (entry.kind === 'raw' || entry.kind === 'distilled') && !isQuarantineScope(entry.scope));
+}
+/**
+ * Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as
+ * `ctx.actor`.
+ * NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair.
+ */
+export async function resolveMemoryConflict(ctx, conflictId, opts) {
+    // Read with every status, so a resolved conflict answers 409 while one holding another person's personal row stays a
+    // 404.
+    const touchable = await ctx.store.conflicts.listTouchable(ctx.tenantId, '*', ctx.actor);
+    const conflict = touchable.find((c) => c.id === conflictId);
+    if (!conflict)
+        throw new NotFoundError(`conflict not found: ${conflictId}`);
+    if (conflict.status !== 'open')
+        throw new ConflictError(`conflict ${conflictId} is already resolved`);
+    const pair = [conflict.memory_a_id, conflict.memory_b_id];
+    if (!pair.includes(opts.keepId)) {
+        throw new BadRequestError(`keep must be one of the two memories in conflict ${conflictId}: ${pair.join(', ')}`);
+    }
+    if ((await ctx.store.entriesByIds(pair, ctx.tenantId)).filter(isLive).length < pair.length) {
+        throw new NotFoundError(`conflict ${conflictId} names a memory that is superseded, archived or quarantined`);
+    }
+    const resolved = await ctx.store.conflicts.resolve(ctx.tenantId, { conflictId, keepId: opts.keepId, forgetLoser: opts.forget === true }, {
+        rejectLoserValue: opts.rejectLoser === true,
+        reason: opts.reason,
+        rejectedBy: ctx.actor.subject,
+    });
+    // Every check passed above, so null here is another resolver getting there first.
+    if (resolved === null)
+        throw new ConflictError(`conflict ${conflictId} is already resolved`);
+    return { conflictId, keptId: opts.keepId, loserId: resolved.loserId };
+}
+/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
+ *  its repo or user-global, and no scope it was not asked for. */
+export async function listOpenConflicts(ctx, project) {
+    const touchable = await ctx.store.conflicts.listTouchable(ctx.tenantId, 'open', ctx.actor);
+    if (!project)
+        return touchable;
+    const own = personalScopeOf(ctx.actor);
+    const ids = [...new Set(touchable.flatMap((c) => [c.memory_a_id, c.memory_b_id]))];
+    // entriesByIds reads at most one chunk of ids per call.
+    const chunks = await Promise.all(chunked(ids).map((chunk) => ctx.store.entriesByIds(chunk, ctx.tenantId)));
+    const rows = new Map(chunks.flat().map((row) => [row.id, row]));
+    const shown = (id) => {
+        const row = rows.get(id);
+        return row !== undefined && classifyOriginProject(row.origin_project, project) !== 'cross-project'
+            && passesScopeFilterForRecall(row.scope ?? null, undefined, own);
+    };
+    return touchable.filter((c) => shown(c.memory_a_id) && shown(c.memory_b_id));
+}
+/**
+ * Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only.
+ */
+export async function listConflicts(ctx, status, reach = {}) {
+    requireHostAdmin(ctx, 'Listing conflicts past the scope check');
+    return ctx.store.conflicts.list(reach.everyTenant ? null : ctx.tenantId, status);
+}
+//# sourceMappingURL=conflicts.js.map

package/dist/api/{forget.d.ts → memories/forget.d.ts}

@@ -1,12 +1,12 @@
-import { type RejectFlowResult } from '../trust/reject-flow.js';
-import { type Context } from './types.js';
+import { type RejectFlowResult } from '../../trust/reject-flow.js';
+import { type Context, type ContextWith, type StoreContext } from '../types.js';
 /** Delete a memory by id. Reach is checked inside the delete's write scope, and a
  * row out of reach answers as not found, so a caller learns nothing about it. */
 export interface ForgetResult {
     ok: true;
     id: string;
 }
-export declare function forget(ctx: Context, id: string): Promise<ForgetResult>;
+export declare function forget(ctx: ContextWith<'entryWrites'>, id: string): Promise<ForgetResult>;
 export interface RejectOpts {
     /** By-id form: reject the CURRENT content of an existing memory. */
     memoryId?: string;
@@ -19,13 +19,15 @@ export interface RejectResult {
     digest: string;
     removedIds: string[];
 }
-/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
- * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
-export declare function reject(ctx: Context, opts: RejectOpts): Promise<RejectResult>;
-/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
- *  personal refusal rather than reject's not-found, as the operator can see that row. */
+/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one
+ * of `memoryId` or `value`. `memoryId` also removes every live tenant row with that digest (not others' personal rows);
+ * `reason` is required. Throws on an unknown id or both/neither. */
+export declare function reject(ctx: StoreContext, opts: RejectOpts): Promise<RejectResult>;
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id
+ * answers with the personal refusal rather than reject's not-found, as the operator can see that row. */
 export declare function rejectOnHost(ctx: Context, opts: RejectOpts): RejectFlowResult;
-/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
+/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws
+ * on blank, no match or several. */
 export declare function unreject(ctx: Context, digestOrPrefix: string): {
     ok: boolean;
     digest: string;

package/dist/api/{forget.js → memories/forget.js}

@@ -1,21 +1,26 @@
 // Forget a memory, and reject or unreject a value so it cannot be stored again.
-import { BadRequestError, NotFoundError } from '../core/api-errors.js';
-import { rejectValue, unrejectValue } from '../trust/reject-flow.js';
-import { requireGroup } from '../store/index.js';
-import { storeFor } from '../store/sqlite/store.js';
-import { requireHostAdmin } from './types.js';
+import { BadRequestError, NotFoundError } from '../../core/api-errors.js';
+import { rejectValue, unrejectValue } from '../../trust/reject-flow.js';
+import { requireHostAdmin } from '../types.js';
 import { getMemory } from './memories.js';
-import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
+import { canTouchScope, personalScopeOf } from '../../core/recall-scope.js';
 export async function forget(ctx, id) {
-    const entryWrites = requireGroup(storeFor(ctx), 'entryWrites');
-    await entryWrites.forget({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id });
+    const entryWrites = ctx.store.entryWrites;
+    await entryWrites.forget({
+        tenantId: ctx.tenantId,
+        actor: ctx.actor.subject,
+        ownScope: personalScopeOf(ctx.actor),
+        id,
+    });
     return { ok: true, id };
 }
-/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
- * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
+/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one
+ * of `memoryId` or `value`. `memoryId` also removes every live tenant row with that digest (not others' personal rows);
+ * `reason` is required. Throws on an unknown id or both/neither. */
 export async function reject(ctx, opts) {
     if (opts.memoryId !== undefined) {
-        // Tenant scope: same not-found-shaped denial as forget/promote; rejectValue tenant-checks too, but pre-checking keeps the error message consistent.
+        // Tenant scope: same not-found-shaped denial as forget/promote; rejectValue tenant-checks too, but pre-checking
+        // keeps the error message consistent.
         const entry = await getMemory(ctx, opts.memoryId);
         if (entry === null || !canTouchScope(ctx.actor, entry.scope)) {
             throw new NotFoundError(`memory not found: ${opts.memoryId}`);
@@ -24,14 +29,15 @@ export async function reject(ctx, opts) {
     const result = applyReject(ctx, opts);
     return { digest: result.digest, removedIds: result.removedIds };
 }
-/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
- *  personal refusal rather than reject's not-found, as the operator can see that row. */
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id
+ * answers with the personal refusal rather than reject's not-found, as the operator can see that row. */
 export function rejectOnHost(ctx, opts) {
     requireHostAdmin(ctx, 'Rejecting with the removal report');
     return applyReject(ctx, opts);
 }
 function applyReject(ctx, opts) {
-    // SHORTCUT: the tombstone write is hippo.db only, as the port has no rejection group; one when a served store needs reject.
+    // SHORTCUT: the tombstone write is hippo.db only, as the port has no rejection group; one when a served store needs
+    // reject.
     return rejectValue({
         hippoRoot: ctx.hippoRoot,
         tenantId: ctx.tenantId,
@@ -42,7 +48,8 @@ function applyReject(ctx, opts) {
         ownScope: personalScopeOf(ctx.actor) ?? undefined,
     });
 }
-/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
+/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws
+ * on blank, no match or several. */
 export function unreject(ctx, digestOrPrefix) {
     const outcome = unrejectValue(ctx.hippoRoot, ctx.tenantId, digestOrPrefix, ctx.actor.subject);
     if (outcome.status === 'not_found') {

package/dist/api/memories/memories.d.ts

@@ -0,0 +1,27 @@
+import type { MemoryEntry } from '../../core/memory.js';
+import type { StrengthTallies } from '../../store/candidates.js';
+import { type ContextWith, type StoreContext } from '../types.js';
+/** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
+export declare function getMemory(ctx: StoreContext, id: string): Promise<MemoryEntry | null>;
+/** getMemory, but NotFound when the row is another person's
+ * personal one, so the reply does not reveal that the id exists. */
+export declare function getTouchableMemory(ctx: StoreContext, id: string): Promise<MemoryEntry | null>;
+export interface MemoryStatus extends StrengthTallies {
+    openConflicts: number;
+}
+/** Tenant-wide counts behind the status verbs: strength tallies
+ * at `now` (at risk is under `atRiskBelow`) and open conflicts. */
+export declare function getMemoryStatus(ctx: ContextWith<'reports'>, now: Date, atRiskBelow: number): Promise<MemoryStatus>;
+/** Which rows a read covers: the caller's tenant, or with `everyTenant` the whole store. */
+export interface TenantReach {
+    everyTenant?: boolean;
+}
+/** Every memory row in reach, oldest first, read `pageSize` rows per query so no single read grows with the store. */
+export declare function listMemories(ctx: ContextWith<'reports'>, reach?: TenantReach, opts?: {
+    pageSize?: number;
+}): Promise<MemoryEntry[]>;
+/** How many memory rows the whole store holds, counted in SQL. */
+export declare function countAllMemories(ctx: ContextWith<'reports'>): Promise<number>;
+/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
+export declare function listMemoriesByIds(ctx: StoreContext, ids: readonly string[], reach?: TenantReach): Promise<MemoryEntry[]>;
+//# sourceMappingURL=memories.d.ts.map

package/dist/api/{memories.js → memories/memories.js}

@@ -1,28 +1,23 @@
-import { loadStrengthTallies } from '../store/candidates.js';
-import { countOpenConflicts } from '../store/conflicts.js';
-import { NotFoundError } from '../core/api-errors.js';
-import { canTouchScope } from '../core/recall-scope.js';
-import { storeFor } from '../store/sqlite/store.js';
-import { countAllEntries, loadEntriesByIds, loadEntriesPage } from '../store/entry-reads.js';
-import { requireHostAdmin } from './types.js';
+import { NotFoundError } from '../../core/api-errors.js';
+import { canTouchScope } from '../../core/recall-scope.js';
+import { requireHostAdmin } from '../types.js';
 /** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
 export async function getMemory(ctx, id) {
-    const [entry] = await storeFor(ctx).entriesByIds([id], ctx.tenantId);
+    const [entry] = await ctx.store.entriesByIds([id], ctx.tenantId);
     return entry ?? null;
 }
-/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
+/** getMemory, but NotFound when the row is another person's
+ * personal one, so the reply does not reveal that the id exists. */
 export async function getTouchableMemory(ctx, id) {
     const entry = await getMemory(ctx, id);
     if (!canTouchScope(ctx.actor, entry?.scope ?? null))
         throw new NotFoundError(`Memory not found: ${id}`);
     return entry;
 }
-/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
+/** Tenant-wide counts behind the status verbs: strength tallies
+ * at `now` (at risk is under `atRiskBelow`) and open conflicts. */
 export function getMemoryStatus(ctx, now, atRiskBelow) {
-    return {
-        ...loadStrengthTallies(ctx.hippoRoot, ctx.tenantId, now, atRiskBelow),
-        openConflicts: countOpenConflicts(ctx.hippoRoot, ctx.tenantId),
-    };
+    return ctx.store.reports.memoryStatus(ctx.tenantId, now, atRiskBelow);
 }
 function tenantFilter(ctx, reach) {
     if (!reach.everyTenant)
@@ -33,25 +28,25 @@ function tenantFilter(ctx, reach) {
 /** Rows a listing reads per query by default; the verbs still receive every row. */
 const LIST_PAGE_SIZE = 1000;
 /** Every memory row in reach, oldest first, read `pageSize` rows per query so no single read grows with the store. */
-export function listMemories(ctx, reach = {}, opts = {}) {
-    const tenant = tenantFilter(ctx, reach);
+export async function listMemories(ctx, reach = {}, opts = {}) {
+    const tenant = tenantFilter(ctx, reach) ?? null;
     const limit = Math.max(1, Math.trunc(opts.pageSize ?? LIST_PAGE_SIZE));
     const all = [];
     let after;
     do {
-        const page = loadEntriesPage(ctx.hippoRoot, tenant, { limit, after });
+        const page = await ctx.store.reports.entriesPage(tenant, { limit, after });
         all.push(...page.entries);
         after = page.next ?? undefined;
     } while (after);
     return all;
 }
 /** How many memory rows the whole store holds, counted in SQL. */
-export function countAllMemories(ctx) {
+export async function countAllMemories(ctx) {
     requireHostAdmin(ctx, 'Reading every tenant');
-    return countAllEntries(ctx.hippoRoot);
+    return ctx.store.reports.countEntries();
 }
 /** The rows in reach among `ids`; a missing id or one out of reach is absent. */
-export function listMemoriesByIds(ctx, ids, reach = {}) {
-    return loadEntriesByIds(ctx.hippoRoot, ids, tenantFilter(ctx, reach));
+export async function listMemoriesByIds(ctx, ids, reach = {}) {
+    return ctx.store.entriesByIds(ids, tenantFilter(ctx, reach));
 }
 //# sourceMappingURL=memories.js.map

package/dist/api/memories/outcome.d.ts

@@ -0,0 +1,22 @@
+import type { ContextWith, StoreContext } from '../types.js';
+/** An id outside ctx.tenantId, or in someone else's personal scope, is skipped,
+ *  so a stale id never fails the call. `appliedIds` holds only the ids applied:
+ *  a caller that answers across tenants returns it, never the ids it was sent. */
+export interface OutcomeResult {
+    applied: number;
+    appliedIds: string[];
+}
+/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids
+ * may follow no recall at all. */
+export declare function outcome(ctx: ContextWith<'entryWrites'>, ids: ReadonlyArray<string>, good: boolean, opts?: {
+    traceId?: number;
+}): Promise<OutcomeResult>;
+/** The last recall's ids and its trace sit with the store's lastRecall group, which only the CLI and context write; a
+ * store without it is refused. `ids` holds only the ids applied in ctx.tenantId: the index is not tenant-scoped, so the
+ * ids read from it are never returned. */
+export interface OutcomeForLastRecallResult {
+    applied: number;
+    ids: string[];
+}
+export declare function outcomeForLastRecall(ctx: StoreContext, good: boolean): Promise<OutcomeForLastRecallResult>;
+//# sourceMappingURL=outcome.d.ts.map

package/dist/api/{outcome.js → memories/outcome.js}

@@ -1,21 +1,27 @@
 // Outcome feedback on recalled memories.
-import { personalScopeOf } from '../core/recall-scope.js';
-import { requireGroup } from '../store/index.js';
-import { storeFor } from '../store/sqlite/store.js';
-/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
+import { personalScopeOf } from '../../core/recall-scope.js';
+import { HttpError } from '../../util/http-util.js';
+import { narrowStore } from '../../store/index.js';
+/** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids
+ * may follow no recall at all. */
 export async function outcome(ctx, ids, good, opts) {
-    const store = storeFor(ctx);
-    const entryWrites = requireGroup(store, 'entryWrites');
+    const store = ctx.store;
+    const entryWrites = store.entryWrites;
     const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
     const traceId = opts?.traceId;
     // Recall traces live beside the last recall, so only a store with the lastRecall group can link one.
     const appliedIds = traceId === undefined
         ? await entryWrites.applyOutcome(write)
-        : await requireGroup(store, 'lastRecall').applyTracedOutcome(write, traceId);
+        : await narrowStore(store, 'lastRecall').lastRecall.applyTracedOutcome(write, traceId);
     return { applied: appliedIds.length, appliedIds };
 }
 export async function outcomeForLastRecall(ctx, good) {
-    const lastRecall = requireGroup(storeFor(ctx), 'lastRecall');
+    const lastRecall = ctx.store.lastRecall;
+    // Its own 501 text, since a client of such a store can still
+    // apply the outcome by sending the ids its recall returned.
+    if (lastRecall === undefined) {
+        throw new HttpError(501, 'this store keeps no last recall: send the ids your recall returned');
+    }
     const ids = await lastRecall.applyOutcomeToLast({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
     return { applied: ids.length, ids };
 }

package/dist/api/memories/promote.d.ts

@@ -0,0 +1,40 @@
+import type { ConnectorEvent } from '../../store/port.js';
+import { type Layer } from '../../core/memory.js';
+import type { ContextWith } from '../types.js';
+/** Copies a local memory into the global store; the inner writeEntry emits 'remember' there, and we add a 'promote'
+ * audit event so intent stays distinct. promoteToGlobal reads via `readEntry` with no tenant filter and keeps the
+ * entry's existing tenantId on the global side. */
+export interface PromoteResult {
+    ok: true;
+    sourceId: string;
+    globalId: string;
+}
+export declare function promote(ctx: ContextWith<'localFiles'>, id: string): PromoteResult;
+/** Replace an old memory with new content, chaining old.superseded_by = new.id; the store commits both rows and the
+ * audit row together. */
+export interface SupersedeResult {
+    ok: true;
+    oldId: string;
+    newId: string;
+}
+/** What the successor takes instead of the old row's value. Never
+ * set from a request body: the CLI fills it from its flags. */
+export interface SupersedeOverrides {
+    layer?: Layer;
+    tags?: string[];
+    pinned?: boolean;
+}
+export declare function supersede(ctx: ContextWith<'entryWrites'>, oldId: string, newContent: string, overrides?: SupersedeOverrides): Promise<SupersedeResult>;
+/** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is
+ * deleted. The store writes the one archive_raw audit row, under the caller's subject. */
+export interface ArchiveRawOpts {
+    /** The connector event this archive answers. The store logs it in the archive's own transaction, so a redelivery
+     * finds it logged. */
+    event?: ConnectorEvent;
+}
+export interface ArchiveRawResult {
+    ok: true;
+    archivedAt: string;
+}
+export declare function archiveRaw(ctx: ContextWith<'entryWrites'>, id: string, reason: string, opts?: ArchiveRawOpts): Promise<ArchiveRawResult>;
+//# sourceMappingURL=promote.d.ts.map

package/dist/api/{promote.js → memories/promote.js}

@@ -1,42 +1,49 @@
 // Promote to the global store, supersede with a successor, and archive raw memories.
-import { ConflictError, NotFoundError } from '../core/api-errors.js';
-import { stampOriginProject } from '../store/entry-row.js';
-import { createSuccessor } from '../core/memory.js';
-import { promoteToGlobal } from '../sharing/global-store.js';
-import { loadConfig } from '../core/config.js';
-import { requireGroup } from '../store/index.js';
-import { storeFor } from '../store/sqlite/store.js';
-import { memoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
+import { ConflictError, NotFoundError } from '../../core/api-errors.js';
+import { stampOriginProject } from '../../store/entry-row.js';
+import { createSuccessor } from '../../core/memory.js';
+import { embedGlobalCopy } from '../../sharing/global-store.js';
+import { configOf } from '../config-of.js';
+import { narrowStore } from '../../store/index.js';
+import { canTouchScope, personalScopeOf } from '../../core/recall-scope.js';
 export function promote(ctx, id) {
-    // promoteToGlobal reads without a tenant filter, so pre-check the row's tenant_id and deny cross-tenant access with archiveRaw's not-found wording
-    // (no leak about whether the id exists in another tenant).
-    const reach = memoryReach(ctx.hippoRoot, id);
+    const { promotion } = ctx.store.localFiles;
+    // promoteToGlobal reads without a tenant filter, so pre-check the row's tenant_id and deny cross-tenant access with
+    // archiveRaw's not-found wording (no leak about whether the id exists in another tenant).
+    const reach = promotion.reach(id);
     if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
         throw new NotFoundError(`memory not found: ${id}`);
     }
-    // The 'promote' row commits with the global copy, so no write follows the commit and a busy store fails the whole promote.
-    const globalEntry = promoteToGlobal(ctx.hippoRoot, id, {
+    // The 'promote' row commits with the global copy, so no write
+    // follows the commit and a busy store fails the whole promote.
+    const globalEntry = promotion.copyToGlobal(id, {
         actor: ctx.actor.subject,
         tenantId: ctx.tenantId,
         auditAs: { tenantId: ctx.tenantId, actor: ctx.actor.subject },
     });
+    embedGlobalCopy(globalEntry);
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
 export async function supersede(ctx, oldId, newContent, overrides = {}) {
-    const store = storeFor(ctx);
-    const entryWrites = requireGroup(store, 'entryWrites');
+    const store = ctx.store;
+    const entryWrites = store.entryWrites;
     const [old] = await store.entriesByIds([oldId], ctx.tenantId);
     const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
         tenantId: ctx.tenantId,
-        baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+        baseHalfLifeDays: configOf(ctx).defaultHalfLifeDays,
         layer: overrides.layer,
         tags: overrides.tags,
         pinned: overrides.pinned,
     });
     // A store writes origin_project as given, so the served folder's fallback is stamped here.
     const successor = stampOriginProject(ctx.hippoRoot, newEntry);
-    await entryWrites.supersede({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor });
+    await entryWrites.supersede({
+        tenantId: ctx.tenantId,
+        actor: ctx.actor.subject,
+        ownScope: personalScopeOf(ctx.actor),
+        oldId,
+        successor,
+    });
     return { ok: true, oldId, newId: successor.id };
 }
 /** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
@@ -51,12 +58,18 @@ function assertSupersedable(ctx, oldId, old) {
     return old;
 }
 export async function archiveRaw(ctx, id, reason, opts = {}) {
-    const store = storeFor(ctx);
-    const entryWrites = requireGroup(store, 'entryWrites');
-    const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
+    const store = ctx.store;
+    const entryWrites = store.entryWrites;
+    const archive = {
+        tenantId: ctx.tenantId,
+        actor: ctx.actor.subject,
+        ownScope: personalScopeOf(ctx.actor),
+        id,
+        reason,
+    };
     const { event } = opts;
     const archivedAt = event
-        ? await requireGroup(store, 'connectorWrites').archiveConnectorEntry({ ...archive, event })
+        ? await narrowStore(store, 'connectorWrites').connectorWrites.archiveConnectorEntry({ ...archive, event })
         : await entryWrites.archiveRaw(archive);
     return { ok: true, archivedAt };
 }

package/dist/api/memories/refine.d.ts

@@ -0,0 +1,10 @@
+import type { MemoryEntry } from '../../core/memory.js';
+import type { ContextWith } from '../types.js';
+/** Marks a merged memory a model has rewritten, so a later pass skips it. */
+export declare const REFINED_TAG = "llm-refined";
+/**
+ * Store a model's rewrite of a merged memory: the new text replaces the old one, and the row gains the refined tag
+ * once.
+ */
+export declare function storeRefinement(ctx: ContextWith<'entryWrites'>, entry: MemoryEntry, refined: string): Promise<void>;
+//# sourceMappingURL=refine.d.ts.map

package/dist/api/memories/refine.js

@@ -0,0 +1,12 @@
+// The write half of `hippo refine`: the model call stays with the caller, the rewritten row is stored here.
+/** Marks a merged memory a model has rewritten, so a later pass skips it. */
+export const REFINED_TAG = 'llm-refined';
+/**
+ * Store a model's rewrite of a merged memory: the new text replaces the old one, and the row gains the refined tag
+ * once.
+ */
+export async function storeRefinement(ctx, entry, refined) {
+    const tags = entry.tags.includes(REFINED_TAG) ? entry.tags : [...entry.tags, REFINED_TAG];
+    await ctx.store.entryWrites.writeEntry({ entry: { ...entry, content: refined, tags }, actor: ctx.actor.subject });
+}
+//# sourceMappingURL=refine.js.map

package/dist/api/{remember-local.d.ts → memories/remember-local.d.ts}

@@ -1,12 +1,13 @@
-import type { ConfidenceLevel, Layer, MemoryEntry, MemoryKind } from '../core/memory.js';
-import { type EmbedOutcome } from '../search/embed-memories.js';
-import type { HippoDbContext } from './types.js';
+import type { ConfidenceLevel, Layer, MemoryEntry, MemoryKind } from '../../core/memory.js';
+import { type EmbedOutcome } from '../../search/embed-memories.js';
+import type { ContextWith, StoreContext } from '../types.js';
 /** One write by a caller in this process, every field already parsed and checked by it. */
 export interface LocalRememberInput {
     readonly content: string;
     /** Every tag the row stores; the salience gate reads these. */
     readonly tags: readonly string[];
-    /** The tags schema fit is scored on, for a caller that added path and scope tags of its own to `tags`; without it, `tags`. */
+    /** The tags schema fit is scored on, for a caller that added
+     * path and scope tags of its own to `tags`; without it, `tags`. */
     readonly fitTags?: readonly string[];
     readonly kind?: MemoryKind;
     readonly scope?: string;
@@ -24,8 +25,9 @@ export interface StartedWeak {
     readonly reason: string;
     readonly strength: number;
 }
-/** `stored` carries the row as the store holds it after the write, and `embedding`, which settles with whether the row reached the vector index
- *  (a caller may ignore it; a failure is also logged). `skipped` is the gate dropping the write, with nothing stored or counted. */
+/** `stored` carries the row as the store holds it after the write, and `embedding`, which settles with whether the row
+ * reached the vector index (a caller may ignore it; a failure is also logged). `skipped` is the gate dropping the
+ * write, with nothing stored or counted. */
 export type LocalRememberOutcome = {
     readonly status: 'stored';
     readonly entry: MemoryEntry;
@@ -36,8 +38,9 @@ export type LocalRememberOutcome = {
     readonly reason: string;
     readonly score: number;
 };
-/** One local write on hippo.db: gate, write, read-back, counter, then the embedding, started and never awaited. A refused value throws as `remember` does. */
-export declare function rememberLocally(ctx: HippoDbContext, input: LocalRememberInput): Promise<LocalRememberOutcome>;
+/** One local write on hippo.db: gate, write, read-back, counter, then the embedding, started and never awaited. A
+ * refused value throws as `remember` does. */
+export declare function rememberLocally(ctx: ContextWith<'entryWrites'>, input: LocalRememberInput): Promise<LocalRememberOutcome>;
 /** What a caller asks of fact extraction. The key comes from the caller, which read it from its own environment. */
 export interface FactExtractionRequest {
     /** The caller asked for extraction (`--extract`); the store's config can turn it on without that. */
@@ -45,7 +48,8 @@ export interface FactExtractionRequest {
     readonly apiKey?: string;
     readonly fetcher?: typeof fetch;
 }
-/** `off`: nobody asked. `no_key`: asked, with no key to call the model. `ran`: the facts the model gave and each reason it gave fewer. */
+/** `off`: nobody asked. `no_key`: asked, with no key to call the model. `ran`: the facts the model gave and each reason
+ * it gave fewer. */
 export type FactExtraction = {
     readonly status: 'off';
 } | {
@@ -55,6 +59,7 @@ export type FactExtraction = {
     readonly facts: number;
     readonly failures: readonly string[];
 };
-/** Extracts facts from a row just stored and stores them beside it. Best-effort: a failure is named in the result, never thrown. */
-export declare function extractRememberedFacts(ctx: HippoDbContext, entry: MemoryEntry, request: FactExtractionRequest): Promise<FactExtraction>;
+/** Extracts facts from a row just stored and stores them beside it.
+ * Best-effort: a failure is named in the result, never thrown. */
+export declare function extractRememberedFacts(ctx: StoreContext, entry: MemoryEntry, request: FactExtractionRequest): Promise<FactExtraction>;
 //# sourceMappingURL=remember-local.d.ts.map