@hasna/mementos 0.15.2 → 0.16.0

package/dist/mcp/profile.d.ts

@@ -0,0 +1,23 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ToolRegistry } from "./tools/tool-registry.js";
+export declare const MEMENTOS_MCP_PROFILES: readonly ["core", "search", "graph", "automation", "admin", "storage", "hooks", "full"];
+export type MementosMcpProfile = (typeof MEMENTOS_MCP_PROFILES)[number];
+export declare const MEMENTOS_MCP_PROFILE_TOOLS: Record<Exclude<MementosMcpProfile, "full">, readonly string[]>;
+export interface McpProfileSelection {
+    raw: string;
+    profiles: MementosMcpProfile[];
+    unknown: string[];
+    full: boolean;
+    toolNames: ReadonlySet<string>;
+}
+export declare function resolveMcpProfileValue(argv?: string[], env?: NodeJS.ProcessEnv): string;
+export declare function selectMcpProfile(value: string | undefined): McpProfileSelection;
+export declare function shouldRegisterMcpTool(name: string, selection: McpProfileSelection): boolean;
+export declare function toolCategory(name: string): string;
+/**
+ * Registration-only adapter: excluded tools are never added to tools/list, while
+ * every included tool is captured in the per-server discovery registry.
+ */
+export declare function createProfiledMcpServer(server: McpServer, selection: McpProfileSelection, registry: ToolRegistry): McpServer;
+export declare function legacyResourcesEnabled(selection: McpProfileSelection): boolean;
+//# sourceMappingURL=profile.d.ts.map

package/dist/mcp/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/mcp/profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,eAAO,MAAM,qBAAqB,yFASxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAqJxE,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAQrG,CAAC;AAQF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AASD,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,MAAM,EAAiB,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAgBR;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CA8B/E;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAE3F;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBjD;AAcD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,mBAAmB,EAC9B,QAAQ,EAAE,YAAY,GACrB,SAAS,CAwBX;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAE9E"}

package/dist/mcp/tools/lock-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/lock-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqBpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+MzD"}
+{"version":3,"file":"lock-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/lock-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA6BpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0NzD"}

package/dist/mcp/tools/memory-audit.d.ts

@@ -1,3 +1,3 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 export declare function registerMemoryAuditTools(server: McpServer): void;
 //# sourceMappingURL=memory-audit.d.ts.map

package/dist/mcp/tools/memory-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-audit.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/memory-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+EhE"}
+{"version":3,"file":"memory-audit.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/memory-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuCzE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAuFhE"}

package/dist/mcp/tools/memory-crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-crud.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/memory-crud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA8BpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsa/D"}
+{"version":3,"file":"memory-crud.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/memory-crud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+FpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAub/D"}

package/dist/mcp/tools/memory-inject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-inject.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/memory-inject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAapE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwUjE"}
+{"version":3,"file":"memory-inject.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/memory-inject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAcpE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA8UjE"}

package/dist/mcp/tools/project-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/project-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuDpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6M5D"}
+{"version":3,"file":"project-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/project-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiCpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkL5D"}

package/dist/mcp/tools/session-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/session-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAepE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAgL5D"}
+{"version":3,"file":"session-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/session-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAepE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkL5D"}

package/dist/mcp/tools/tool-registry.d.ts

@@ -1,21 +1,19 @@
-/**
- * Shared tool registry for MCP tools.
- * Each tool module exports its schemas here. Used by search_tools and describe_tools
- * for tool discovery and documentation.
- */
-export interface ToolSchema {
+/** Per-server MCP tool discovery registry used by search_tools/describe_tools. */
+export interface ToolParamSchema {
+    type: string;
     description: string;
-    category: string;
-    params: Record<string, {
+    required?: boolean;
+    enum?: string[];
+    items?: {
         type: string;
-        description: string;
-        required?: boolean;
         enum?: string[];
-        items?: {
-            type: string;
-            enum?: string[];
-        };
-    }>;
+    };
+}
+export interface ToolSchema {
+    name?: string;
+    description: string;
+    category: string;
+    params: Record<string, ToolParamSchema>;
     example?: string;
 }
 export interface ToolEntry {
@@ -23,8 +21,13 @@ export interface ToolEntry {
     description: string;
     category: string;
 }
-export declare function registerToolSchemas(schemas: Record<string, ToolSchema>): void;
-export declare function getAllToolEntries(): ToolEntry[];
-export declare function getToolSchema(name: string): ToolSchema | undefined;
-export declare function searchToolEntries(query: string, category?: string): ToolEntry[];
+export declare class ToolRegistry {
+    private readonly registry;
+    registerToolSchemas(schemas: Record<string, ToolSchema>): void;
+    registerDiscoveredTool(name: string, description: string, category: string, inputShape?: Record<string, unknown>): void;
+    retain(names: ReadonlySet<string>): void;
+    getAllToolEntries(): ToolEntry[];
+    getToolSchema(name: string): ToolSchema | undefined;
+    searchToolEntries(query: string, category?: string): ToolEntry[];
+}
 //# sourceMappingURL=tool-registry.d.ts.map

package/dist/mcp/tools/tool-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/tool-registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,CAI7E;AAED,wBAAgB,iBAAiB,IAAI,SAAS,EAAE,CAM/C;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAElE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAa/E"}
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/tool-registry.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAuCD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAE1D,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI;IAM9D,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,IAAI;IAeP,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAMxC,iBAAiB,IAAI,SAAS,EAAE;IAMhC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAInD,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE;CAOjE"}

package/dist/mcp/tools/utility-tools.d.ts

@@ -1,3 +1,4 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function registerUtilityTools(server: McpServer): void;
+import { ToolRegistry } from "./tool-registry.js";
+export declare function registerUtilityTools(server: McpServer, registry: ToolRegistry): void;
 //# sourceMappingURL=utility-tools.d.ts.map

package/dist/mcp/tools/utility-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utility-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/utility-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmGpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA8S5D"}
+{"version":3,"file":"utility-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/utility-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiBpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoFlD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,CAqUpF"}

package/dist/project-registration.js

@@ -1239,6 +1239,8 @@ function getApiConfig(env2 = process.env, options = {}) {
 function isApiMode() {
   if (hasDatabaseUrl())
     return false;
+  if (isServerContext())
+    return false;
   return getApiConfig() !== null;
 }
 function assertClientStoreConfigured(env2 = process.env, options = {}) {
@@ -1285,7 +1287,14 @@ x-api-key: ${cfg.apiKey}
   let bodyFile;
   if (hasBody) {
     bodyFile = join3(tmpdir(), `mem-req-${process.pid}-${randomUUID()}.json`);
-    writeFileSync2(bodyFile, JSON.stringify(body), { mode: 384 });
+    try {
+      writeFileSync2(bodyFile, JSON.stringify(body), { mode: 384 });
+    } catch (error) {
+      try {
+        unlinkSync(bodyFile);
+      } catch {}
+      throw error;
+    }
     args.push("--data-binary", `@${bodyFile}`);
   }
   args.push(url);
@@ -1333,7 +1342,7 @@ function apiJson(method, path, body, options) {
       try {
         data = JSON.parse(raw.body);
       } catch (e) {
-        throw new ApiRequestError(`mementos cloud ${method} ${path} returned status ${raw.status} with a body that is not valid JSON (${e instanceof Error ? e.message : String(e)}) \u2014 the response is truncated or the server is unhealthy`, raw.status, raw.body.slice(0, 500));
+        throw new ApiRequestError(`mementos cloud ${method} ${path} returned status ${raw.status} with a body that is not valid JSON (${e instanceof Error ? e.message : String(e)}) \u2014 the response is truncated or the server is unhealthy`, raw.status, "");
       }
     } else {
       data = undefined;
@@ -1375,6 +1384,7 @@ function toQuery(params) {
 var API_URL_ENV_KEYS, API_KEY_ENV_KEYS, DATABASE_URL_ENV_KEYS, DB_PATH_ENV_KEYS, ALLOW_REMOTE_API_IN_TESTS_ENV = "MEMENTOS_ALLOW_REMOTE_API_IN_TESTS", MementosStoreConfigError, ApiRequestError, DEFAULT_TIMEOUT_S = "45";
 var init_api_mode = __esm(() => {
   init_local_opt_in();
+  init_storage();
   API_URL_ENV_KEYS = clientTransportEnvKeys2("mementos").apiUrlKeys;
   API_KEY_ENV_KEYS = clientTransportEnvKeys2("mementos").apiKeyKeys;
   DATABASE_URL_ENV_KEYS = ["HASNA_MEMENTOS_DATABASE_URL", "MEMENTOS_DATABASE_URL"];
@@ -2787,6 +2797,220 @@ INSERT OR IGNORE INTO _migrations (id) VALUES (38);
     `
 ${sqliteMementosMemoryProjectLinkSchemaSql()}
 INSERT OR IGNORE INTO _migrations (id) VALUES (40);
+`,
+    `
+DROP TABLE IF EXISTS temp.mementos_m41_machine_preflight;
+CREATE TEMP TABLE mementos_m41_machine_preflight (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL CHECK(
+    length(name) BETWEEN 1 AND 128
+    AND instr(name, char(0)) = 0
+    AND instr(name, char(1)) = 0
+    AND instr(name, char(2)) = 0
+    AND instr(name, char(3)) = 0
+    AND instr(name, char(4)) = 0
+    AND instr(name, char(5)) = 0
+    AND instr(name, char(6)) = 0
+    AND instr(name, char(7)) = 0
+    AND instr(name, char(8)) = 0
+    AND instr(name, char(9)) = 0
+    AND instr(name, char(10)) = 0
+    AND instr(name, char(11)) = 0
+    AND instr(name, char(12)) = 0
+    AND instr(name, char(13)) = 0
+    AND instr(name, char(14)) = 0
+    AND instr(name, char(15)) = 0
+    AND instr(name, char(16)) = 0
+    AND instr(name, char(17)) = 0
+    AND instr(name, char(18)) = 0
+    AND instr(name, char(19)) = 0
+    AND instr(name, char(20)) = 0
+    AND instr(name, char(21)) = 0
+    AND instr(name, char(22)) = 0
+    AND instr(name, char(23)) = 0
+    AND instr(name, char(24)) = 0
+    AND instr(name, char(25)) = 0
+    AND instr(name, char(26)) = 0
+    AND instr(name, char(27)) = 0
+    AND instr(name, char(28)) = 0
+    AND instr(name, char(29)) = 0
+    AND instr(name, char(30)) = 0
+    AND instr(name, char(31)) = 0
+    AND instr(name, char(127)) = 0
+  ),
+  hostname TEXT NOT NULL UNIQUE CHECK(
+    length(hostname) BETWEEN 1 AND 253
+    AND hostname = lower(rtrim(trim(hostname), '.'))
+    AND instr(hostname, ' ') = 0
+    AND instr(hostname, char(9)) = 0
+    AND instr(hostname, char(10)) = 0
+    AND instr(hostname, char(13)) = 0
+    AND instr(hostname, '/') = 0
+    AND instr(hostname, char(92)) = 0
+  ),
+  platform TEXT NOT NULL CHECK(
+    length(platform) BETWEEN 1 AND 64
+    AND platform = lower(trim(platform))
+    AND platform NOT GLOB '*[^a-z0-9._-]*'
+  ),
+  is_primary INTEGER NOT NULL CHECK(is_primary IN (0, 1)),
+  created_at TEXT NOT NULL CHECK(julianday(created_at) IS NOT NULL),
+  last_seen_at TEXT NOT NULL CHECK(
+    julianday(last_seen_at) IS NOT NULL
+    AND julianday(last_seen_at) >= julianday(created_at)
+  )
+);
+INSERT INTO mementos_m41_machine_preflight
+  (id, name, hostname, platform, is_primary, created_at, last_seen_at)
+SELECT
+  id,
+  name,
+  lower(rtrim(trim(hostname), '.')),
+  platform,
+  is_primary,
+  created_at,
+  last_seen_at
+FROM machines;
+
+UPDATE machines
+SET hostname = (
+  SELECT preflight.hostname
+  FROM mementos_m41_machine_preflight preflight
+  WHERE preflight.id = machines.id
+);
+
+DROP TABLE mementos_m41_machine_preflight;
+DROP TRIGGER IF EXISTS machines_single_primary_insert;
+DROP TRIGGER IF EXISTS machines_single_primary_update;
+DROP INDEX IF EXISTS idx_machines_hostname;
+CREATE UNIQUE INDEX idx_machines_hostname ON machines(hostname);
+DROP INDEX IF EXISTS idx_machines_single_primary;
+CREATE UNIQUE INDEX idx_machines_single_primary
+  ON machines(is_primary) WHERE is_primary = 1;
+
+CREATE TRIGGER IF NOT EXISTS machines_hostname_canonical_insert
+BEFORE INSERT ON machines
+WHEN NEW.hostname != lower(rtrim(trim(NEW.hostname), '.'))
+  OR length(NEW.hostname) NOT BETWEEN 1 AND 253
+  OR instr(NEW.hostname, ' ') > 0
+  OR instr(NEW.hostname, char(9)) > 0
+  OR instr(NEW.hostname, char(10)) > 0
+  OR instr(NEW.hostname, char(13)) > 0
+  OR instr(NEW.hostname, '/') > 0
+  OR instr(NEW.hostname, char(92)) > 0
+BEGIN
+  SELECT RAISE(ABORT, 'machines.hostname must be canonical');
+END;
+
+CREATE TRIGGER IF NOT EXISTS machines_hostname_canonical_update
+BEFORE UPDATE OF hostname ON machines
+WHEN NEW.hostname != lower(rtrim(trim(NEW.hostname), '.'))
+  OR length(NEW.hostname) NOT BETWEEN 1 AND 253
+  OR instr(NEW.hostname, ' ') > 0
+  OR instr(NEW.hostname, char(9)) > 0
+  OR instr(NEW.hostname, char(10)) > 0
+  OR instr(NEW.hostname, char(13)) > 0
+  OR instr(NEW.hostname, '/') > 0
+  OR instr(NEW.hostname, char(92)) > 0
+BEGIN
+  SELECT RAISE(ABORT, 'machines.hostname must be canonical');
+END;
+
+CREATE TRIGGER IF NOT EXISTS machines_runtime_contract_insert
+BEFORE INSERT ON machines
+WHEN length(NEW.name) NOT BETWEEN 1 AND 128
+  OR instr(NEW.name, char(0)) > 0
+  OR instr(NEW.name, char(1)) > 0
+  OR instr(NEW.name, char(2)) > 0
+  OR instr(NEW.name, char(3)) > 0
+  OR instr(NEW.name, char(4)) > 0
+  OR instr(NEW.name, char(5)) > 0
+  OR instr(NEW.name, char(6)) > 0
+  OR instr(NEW.name, char(7)) > 0
+  OR instr(NEW.name, char(8)) > 0
+  OR instr(NEW.name, char(9)) > 0
+  OR instr(NEW.name, char(10)) > 0
+  OR instr(NEW.name, char(11)) > 0
+  OR instr(NEW.name, char(12)) > 0
+  OR instr(NEW.name, char(13)) > 0
+  OR instr(NEW.name, char(14)) > 0
+  OR instr(NEW.name, char(15)) > 0
+  OR instr(NEW.name, char(16)) > 0
+  OR instr(NEW.name, char(17)) > 0
+  OR instr(NEW.name, char(18)) > 0
+  OR instr(NEW.name, char(19)) > 0
+  OR instr(NEW.name, char(20)) > 0
+  OR instr(NEW.name, char(21)) > 0
+  OR instr(NEW.name, char(22)) > 0
+  OR instr(NEW.name, char(23)) > 0
+  OR instr(NEW.name, char(24)) > 0
+  OR instr(NEW.name, char(25)) > 0
+  OR instr(NEW.name, char(26)) > 0
+  OR instr(NEW.name, char(27)) > 0
+  OR instr(NEW.name, char(28)) > 0
+  OR instr(NEW.name, char(29)) > 0
+  OR instr(NEW.name, char(30)) > 0
+  OR instr(NEW.name, char(31)) > 0
+  OR instr(NEW.name, char(127)) > 0
+  OR length(NEW.platform) NOT BETWEEN 1 AND 64
+  OR NEW.platform != lower(trim(NEW.platform))
+  OR NEW.platform GLOB '*[^a-z0-9._-]*'
+  OR NEW.is_primary NOT IN (0, 1)
+  OR julianday(NEW.created_at) IS NULL
+  OR julianday(NEW.last_seen_at) IS NULL
+  OR julianday(NEW.last_seen_at) < julianday(NEW.created_at)
+BEGIN
+  SELECT RAISE(ABORT, 'machines row violates the persisted runtime contract');
+END;
+
+CREATE TRIGGER IF NOT EXISTS machines_runtime_contract_update
+BEFORE UPDATE OF name, platform, is_primary, created_at, last_seen_at ON machines
+WHEN length(NEW.name) NOT BETWEEN 1 AND 128
+  OR instr(NEW.name, char(0)) > 0
+  OR instr(NEW.name, char(1)) > 0
+  OR instr(NEW.name, char(2)) > 0
+  OR instr(NEW.name, char(3)) > 0
+  OR instr(NEW.name, char(4)) > 0
+  OR instr(NEW.name, char(5)) > 0
+  OR instr(NEW.name, char(6)) > 0
+  OR instr(NEW.name, char(7)) > 0
+  OR instr(NEW.name, char(8)) > 0
+  OR instr(NEW.name, char(9)) > 0
+  OR instr(NEW.name, char(10)) > 0
+  OR instr(NEW.name, char(11)) > 0
+  OR instr(NEW.name, char(12)) > 0
+  OR instr(NEW.name, char(13)) > 0
+  OR instr(NEW.name, char(14)) > 0
+  OR instr(NEW.name, char(15)) > 0
+  OR instr(NEW.name, char(16)) > 0
+  OR instr(NEW.name, char(17)) > 0
+  OR instr(NEW.name, char(18)) > 0
+  OR instr(NEW.name, char(19)) > 0
+  OR instr(NEW.name, char(20)) > 0
+  OR instr(NEW.name, char(21)) > 0
+  OR instr(NEW.name, char(22)) > 0
+  OR instr(NEW.name, char(23)) > 0
+  OR instr(NEW.name, char(24)) > 0
+  OR instr(NEW.name, char(25)) > 0
+  OR instr(NEW.name, char(26)) > 0
+  OR instr(NEW.name, char(27)) > 0
+  OR instr(NEW.name, char(28)) > 0
+  OR instr(NEW.name, char(29)) > 0
+  OR instr(NEW.name, char(30)) > 0
+  OR instr(NEW.name, char(31)) > 0
+  OR instr(NEW.name, char(127)) > 0
+  OR length(NEW.platform) NOT BETWEEN 1 AND 64
+  OR NEW.platform != lower(trim(NEW.platform))
+  OR NEW.platform GLOB '*[^a-z0-9._-]*'
+  OR NEW.is_primary NOT IN (0, 1)
+  OR julianday(NEW.created_at) IS NULL
+  OR julianday(NEW.last_seen_at) IS NULL
+  OR julianday(NEW.last_seen_at) < julianday(NEW.created_at)
+BEGIN
+  SELECT RAISE(ABORT, 'machines row violates the persisted runtime contract');
+END;
+
+INSERT OR IGNORE INTO _migrations (id) VALUES (41);
 `
   ];
 });
@@ -2802,7 +3026,8 @@ __export(exports_database, {
   getDbPath: () => getDbPath,
   getDatabase: () => getDatabase,
   escapeLikePrefix: () => escapeLikePrefix,
-  closeDatabase: () => closeDatabase
+  closeDatabase: () => closeDatabase,
+  applyMachineIdentityMigration: () => applyMachineIdentityMigration
 });
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, cpSync } from "fs";
 import { dirname, join as join4, resolve as resolve2 } from "path";
@@ -2930,32 +3155,62 @@ function getDatabase(dbPath) {
   return _db;
 }
 function runMigrations(db) {
+  let currentLevel = 0;
   try {
     const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
-    const currentLevel = result?.max_id ?? 0;
-    for (let i = currentLevel;i < MIGRATIONS.length; i++) {
-      try {
-        applyMigration(db, i);
-      } catch (e) {
-        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
-      }
-    }
-  } catch {
-    for (let i = 0;i < MIGRATIONS.length; i++) {
-      try {
-        applyMigration(db, i);
-      } catch (e) {
-        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
+    currentLevel = result?.max_id ?? 0;
+  } catch {}
+  for (let i = currentLevel;i < MIGRATIONS.length; i++) {
+    try {
+      applyMigration(db, i);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (i === 40) {
+        throw new Error(`Mementos migration 41 refused unsafe machine identity data: ${message}`);
       }
+      console.warn(`[mementos] Migration ${i + 1} failed: ${message}`);
     }
   }
 }
 function applyMigration(db, index) {
-  if (index === 32) {
+  if (index === 32)
     ensureMachinePrimaryColumn(db);
+  if (index === 40) {
+    applyMachineIdentityMigration(db);
+    return;
   }
   db.exec(MIGRATIONS[index]);
 }
+function applyMachineIdentityMigration(db) {
+  db.transaction(() => {
+    const rows = db.query("SELECT id, name, hostname, platform, is_primary, created_at, last_seen_at FROM machines").all();
+    const identities = new Map;
+    let primaryCount = 0;
+    for (const row of rows) {
+      const canonical = row.hostname.trim().replace(/\.+$/, "").toLowerCase();
+      const createdAt = new Date(row.created_at).getTime();
+      const lastSeenAt = new Date(row.last_seen_at).getTime();
+      const primaryValueValid = row.is_primary === 0 || row.is_primary === 1 || row.is_primary === false || row.is_primary === true;
+      if (!row.id || !row.name || row.name.length > 128 || /[\u0000-\u001f\u007f]/.test(row.name) || !canonical || canonical.length > 253 || /[\u0000-\u001f\u007f/\\\s]/.test(canonical) || !row.platform || row.platform.length > 64 || row.platform !== row.platform.trim().toLowerCase() || !/^[a-z0-9._-]+$/.test(row.platform) || !primaryValueValid || !Number.isFinite(createdAt) || !Number.isFinite(lastSeenAt) || lastSeenAt < createdAt) {
+        throw new Error(`invalid legacy machine row ${row.id || "(missing id)"}`);
+      }
+      const owner = identities.get(canonical);
+      if (owner && owner !== row.id) {
+        throw new Error(`ambiguous normalized hostname '${canonical}' belongs to both ${owner} and ${row.id}`);
+      }
+      identities.set(canonical, row.id);
+      if (Boolean(row.is_primary))
+        primaryCount += 1;
+    }
+    if (primaryCount > 1) {
+      throw new Error(`legacy machine registry contains ${primaryCount} primary rows`);
+    }
+    db.exec(MIGRATIONS[40]);
+    const receipt = db.query("SELECT id FROM _migrations WHERE id = 41").get();
+    if (receipt?.id !== 41)
+      throw new Error("machine identity migration did not record completion");
+  });
+}
 function ensureMachinePrimaryColumn(db) {
   const columns = db.query("PRAGMA table_info(machines)").all();
   if (columns.length === 0 || columns.some((column) => column.name === "is_primary")) {
@@ -5907,7 +6162,7 @@ function buildMemoryListConditions(filter) {
       conditions.push("status = 'active'");
     }
     if (filter.project_id) {
-      conditions.push("project_id = ?");
+      conditions.push(filter.include_unassigned_project === true ? "(project_id = ? OR project_id IS NULL)" : "project_id = ?");
       params.push(filter.project_id);
     }
     if (filter.agent_id) {
@@ -5987,6 +6242,7 @@ function listMemoriesPage(filter, db) {
       pinned: f.pinned,
       agent_id: f.agent_id,
       project_id: f.project_id,
+      include_unassigned_project: f.project_id && f.include_unassigned_project === true ? true : undefined,
       session_id: f.session_id,
       machine_id: f.machine_id,
       visible_to_machine_id: f.visible_to_machine_id,
@@ -6011,7 +6267,7 @@ function listMemoriesPage(filter, db) {
   if (conditions.length > 0) {
     sql += ` WHERE ${conditions.join(" AND ")}`;
   }
-  sql += " ORDER BY importance DESC, created_at DESC";
+  sql += " ORDER BY importance DESC, created_at DESC, id DESC";
   if (f.limit) {
     sql += " LIMIT ?";
     params.push(f.limit);