hippo-memory 1.60.0 → 1.61.0

package/dist/session-digest.d.ts

@@ -1,4 +1,4 @@
-import { type SessionTurn } from './capture.js';
+import { type SessionTurn } from './capture/transcript.js';
 import { type MemoryEntry } from './memory.js';
 export declare const SESSION_DIGEST_TAG = "session-digest";
 /** Five-word runs are stock phrases; six in a row is a copied clause. */

package/dist/session-digest.js

@@ -2,15 +2,22 @@
 import { createHash } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
-import { collectSessionTurns, errorMessage, readTranscriptTail, splitSentences, } from './capture.js';
+import { collectSessionTurns } from './capture/transcript.js';
+import { splitSentences } from './capture/extract.js';
 import { isObjectLike, isStringValue } from './capture-contract.js';
 import { PATCH_SUCCESS_LINE, patchPaths, shellPatch } from './codex-patch.js';
 import { loadConfig } from './config.js';
+import { errorMessage } from './log.js';
 import { createMemory, Layer } from './memory.js';
 import { RejectedValueError } from './rejection.js';
 import { maskEmails, redactSecretsStrict } from './secret-detect.js';
-import { SNAPSHOT_AMBIENT_MAX_AGE_MS, isInitialized, loadAllEntries, loadLatestHandoff, writeEntry } from './store.js';
+import { isInitialized } from './store/open.js';
+import { writeEntry } from './store/entry-writes.js';
+import { loadAllEntries } from './store/entry-reads.js';
+import { SNAPSHOT_AMBIENT_MAX_AGE_MS } from './store/sessions.js';
+import { loadLatestHandoff } from './store/handoffs.js';
 import { isSyntheticMessage } from './token-ledger.js';
+import { readTranscriptTail } from './transcript-tail.js';
 export const SESSION_DIGEST_TAG = 'session-digest';
 /** Five-word runs are stock phrases; six in a row is a copied clause. */
 export const ECHO_WINDOW = 6;

package/dist/shared.d.ts

@@ -5,7 +5,8 @@
  * Local .hippo/ stores are per-project.
  */
 import { MemoryEntry } from './memory.js';
-import { SearchResult, type ResultCost } from './search.js';
+import type { SearchResult, ResultCost } from './search/types.js';
+import type { DatabaseSyncLike } from './db.js';
 /**
  * Returns the path to the global Hippo store.
  * Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/
@@ -23,6 +24,7 @@ export declare function initGlobal(): void;
 export declare function promoteToGlobal(localRoot: string, id: string, opts?: {
     actor?: string;
     tenantId?: string;
+    afterWrite?: (db: DatabaseSyncLike, globalId: string) => void;
 }): MemoryEntry;
 export interface SearchOptions {
     budget?: number;

package/dist/shared.js

@@ -9,9 +9,16 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { generateId, COMPACTION_MEMORY_TAG } from './memory.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from './agent-memories/tools.js';
-import { initStore, loadAllEntries, loadIndex, loadSearchEntries, loadRecallSearchEntries, tallySources, writeEntry, readEntry, } from './store.js';
+import { initStore } from './store/open.js';
+import { writeEntry } from './store/entry-writes.js';
+import { loadAllEntries, readEntry } from './store/entry-reads.js';
+import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from './store/search-rows.js';
+import { tallySources } from './store/candidates.js';
+import { loadIndex } from './store/index-and-stats.js';
 import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from './recall-scope.js';
-import { search, hybridSearch, fitBudget } from './search.js';
+import { search } from './search/bm25-search.js';
+import { hybridSearch } from './search/hybrid.js';
+import { fitBudget } from './search/finalize.js';
 import { evalNow } from './ablation.js';
 import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir } from './project-identity.js';
 import { detectSecret } from './secret-detect.js';
@@ -77,7 +84,7 @@ export function promoteToGlobal(localRoot, id, opts) {
         source: `promoted:${localRoot}`,
         origin_project: entry.origin_project ?? deriveOriginProject(path.dirname(path.resolve(localRoot))),
     };
-    writeEntry(globalRoot, globalEntry, { actor: opts?.actor });
+    writeEntry(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: opts?.afterWrite });
     // Fire-and-forget: embedMemory gates on availability and never rejects.
     void embedMemory(globalRoot, globalEntry);
     return globalEntry;
@@ -166,27 +173,24 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
             ? loadRecallSearchEntries(root, query, searchWindow, tenantId, recallScope.requested, recallScope.additive ? 'additive' : 'exact', Boolean(includeSuperseded) || Boolean(asOf))
             : loadSearchEntries(root, query, searchWindow, tenantId);
     };
-    let localEntries = loadEntries(localRoot);
-    let globalEntries = loadEntries(globalRoot);
-    if (recallScope) {
-        const passes = (e) => recallScope.additive
-            ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested)
-            : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested);
-        localEntries = localEntries.filter(passes);
-        globalEntries = globalEntries.filter(passes);
-    }
-    if (entryFilter) {
-        localEntries = localEntries.filter(entryFilter);
-        globalEntries = globalEntries.filter(entryFilter);
-    }
+    const passesScope = (e) => !recallScope || (recallScope.additive
+        ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested)
+        : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested));
+    const admit = (e) => passesScope(e) && (!entryFilter || entryFilter(e));
+    const localEntries = loadEntries(localRoot).filter(admit);
+    const globalEntries = loadEntries(globalRoot).filter(admit);
     if (localEntries.length === 0 && globalEntries.length === 0)
         return [];
-    const localResults = await hybridSearch(query, localEntries, {
-        budget, now, hippoRoot: localRoot, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness,
-    });
-    const globalResults = await hybridSearch(query, globalEntries, {
-        budget, now, hippoRoot: globalRoot, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness,
-    });
+    // The vector arm loads under the same SQL rules as loadEntries, then the same JS admission.
+    const vectorCandidates = {
+        tenantId,
+        scope: recallScope ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact') : undefined,
+        includeSuperseded: !recallScope || Boolean(includeSuperseded) || Boolean(asOf),
+        admit,
+    };
+    const shared = { budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness, vectorCandidates };
+    const localResults = await hybridSearch(query, localEntries, { ...shared, hippoRoot: localRoot });
+    const globalResults = await hybridSearch(query, globalEntries, { ...shared, hippoRoot: globalRoot });
     // Tag global results. Local memories get a configurable priority bump.
     const tagged = [
         ...localResults.map((r) => ({

package/dist/skills.d.ts

@@ -21,6 +21,7 @@
  * Lifecycle: active -> superseded (a newer version replaces it) or active ->
  * closed (retired). Export renders ACTIVE skills only.
  */
+import { type KeysetPosition } from './keyset.js';
 export type SkillStatus = 'active' | 'superseded' | 'closed';
 export declare const VALID_SKILL_STATES: ReadonlySet<SkillStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). instructions is a body, so a
@@ -66,6 +67,8 @@ export interface SaveSkillOpts {
 export interface ListSkillsOpts {
     status?: SkillStatus;
     limit?: number;
+    /** Resume after this row: the position the previous page ended on. */
+    after?: KeysetPosition;
 }
 /**
  * Create a skill (or a new version that supersedes an existing one). Writes the

package/dist/skills.js

@@ -23,11 +23,12 @@
  */
 import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
 import { assertTenantId } from './tenant.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
+import { keysetAfter } from './keyset.js';
 export const VALID_SKILL_STATES = new Set([
     'active',
     'superseded',
@@ -278,6 +279,7 @@ export function loadSkillById(hippoRoot, tenantId, id) {
 export function loadSkills(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadSkills', tenantId);
     const limit = opts.limit ?? 100;
+    const after = keysetAfter('created_at', 'id', opts.after);
     const db = openHippoDb(hippoRoot);
     try {
         let rows;
@@ -288,19 +290,19 @@ export function loadSkills(hippoRoot, tenantId, opts = {}) {
             // SAFETY: rows' shape matches the columns named in SKILL_COLS above.
             rows = db.prepare(`
         SELECT ${SKILL_COLS} FROM skills
-        WHERE tenant_id = ? AND status = ?
+        WHERE tenant_id = ? AND status = ?${after.sql}
         ORDER BY created_at DESC, id DESC
         LIMIT ?
-      `).all(tenantId, opts.status, limit);
+      `).all(tenantId, opts.status, ...after.params, limit);
         }
         else {
             // SAFETY: rows' shape matches the columns named in SKILL_COLS above.
             rows = db.prepare(`
         SELECT ${SKILL_COLS} FROM skills
-        WHERE tenant_id = ?
+        WHERE tenant_id = ?${after.sql}
         ORDER BY created_at DESC, id DESC
         LIMIT ?
-      `).all(tenantId, limit);
+      `).all(tenantId, ...after.params, limit);
         }
         return rows.map(rowToSkill);
     }

package/dist/stdin.js

@@ -1,6 +1,6 @@
+import { envStdinWaitMs } from './env.js';
 function defaultWaitMs() {
-    const parsed = Number.parseInt(process.env.HIPPO_STDIN_WAIT_MS ?? '', 10);
-    return parsed > 0 ? parsed : 1000;
+    return envStdinWaitMs() ?? 1000;
 }
 /** Never blocks: a TTY resolves at once, otherwise waits up to `waitMs` of
  * idle (default 1000ms, or `HIPPO_STDIN_WAIT_MS`), refreshed on each chunk

package/dist/store/audit-event.d.ts

@@ -0,0 +1,19 @@
+import { openHippoDb } from '../db.js';
+import { type AuditOp } from '../audit.js';
+import { RejectedValueError } from '../rejection.js';
+import type { JsonValue } from './rows.js';
+/**
+ * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
+ * log can never crash the surrounding mutation — the SQLite store is still the
+ * source of truth and audit failures are diagnosable from the missing rows.
+ */
+export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, targetId?: string, metadata?: Record<string, JsonValue>, actor?: string, tenantId?: string): void;
+/**
+ * Refusal audit for the AT1 rejection guard (plan §3). Written by the
+ * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
+ * there, so this lands in a fresh implicit transaction) and api.supersede's
+ * catch (after its own ROLLBACK) — never inside a scope the caller's own
+ * rollback could claw back. Best-effort `audit()` semantics: never throws.
+ */
+export declare function auditRejectionRefusal(db: ReturnType<typeof openHippoDb>, err: RejectedValueError, actor: string): void;
+//# sourceMappingURL=audit-event.d.ts.map

package/dist/store/audit-event.js

@@ -0,0 +1,33 @@
+import { resolveTenantId } from '../tenant.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
+/**
+ * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
+ * log can never crash the surrounding mutation — the SQLite store is still the
+ * source of truth and audit failures are diagnosable from the missing rows.
+ */
+export function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
+    try {
+        appendAuditEvent(db, {
+            tenantId: tenantId ?? resolveTenantId({}),
+            actor,
+            op,
+            targetId,
+            metadata,
+        });
+    }
+    catch (error) {
+        // The mutation has already succeeded; a broken audit table must not undo it.
+        reportAuditWriteFailure(op, String(error), targetId);
+    }
+}
+/**
+ * Refusal audit for the AT1 rejection guard (plan §3). Written by the
+ * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
+ * there, so this lands in a fresh implicit transaction) and api.supersede's
+ * catch (after its own ROLLBACK) — never inside a scope the caller's own
+ * rollback could claw back. Best-effort `audit()` semantics: never throws.
+ */
+export function auditRejectionRefusal(db, err, actor) {
+    audit(db, 'reject_refusal', err.entryId, { digest: err.digest, reason: err.reason }, actor, err.tenantId);
+}
+//# sourceMappingURL=audit-event.js.map

package/dist/store/candidates.d.ts

@@ -0,0 +1,42 @@
+import type { MemoryEntry, StrengthInputs } from '../memory.js';
+export interface AmbientRecallRequest {
+    terms: string[];
+    limit: number;
+}
+export interface AmbientLoadResult {
+    entries: MemoryEntry[];
+    recall?: MemoryEntry[];
+}
+/** Exported so the plan test runs the exact SQL; idx_memories_pinned (db.ts v51) serves it. */
+export declare const AMBIENT_PINNED_WHERE = "pinned = 1 AND superseded_by IS NULL AND tenant_id = ? ORDER BY created ASC, id ASC";
+/** Exported so the plan test runs the exact SQL; idx_memories_created_drift (db.ts v51) serves it. */
+export declare const AMBIENT_DRIFT_SQL = "SELECT 1 FROM memories WHERE superseded_by IS NULL AND tenant_id = ? AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1";
+export declare function loadAmbientCandidates(hippoRoot: string, tenantId: string, recentNeeded: number, admit: (e: MemoryEntry) => boolean, recall?: AmbientRecallRequest): AmbientLoadResult;
+/** The rows a non-pinned context read may admit; each predicate is one getContext's admission applies again in JS. */
+export interface ContextCandidateFilter {
+    /** Envelope scope asked for by name; absent applies recall's default deny. */
+    exactScope?: string;
+    /** Rows of this project and user-global rows pass; absent admits every origin. */
+    project?: string;
+    /** Most rows returned; past it, the rows decay has worn least win. */
+    cap: number;
+    now: Date;
+}
+/** Live tenant rows passing `filter`, at most `filter.cap`, in loadAllEntries' order; below the cap, every such row. */
+export declare function loadContextCandidates(hippoRoot: string, tenantId: string, filter: ContextCandidateFilter): MemoryEntry[];
+/** A row's strength inputs and tags, without its text or the JSON lists a full row parses. */
+export type StrengthRow = StrengthInputs & Pick<MemoryEntry, 'tags'>;
+/** Every tenant row as a StrengthRow, for whole-store health numbers; defaults match rowToEntry's. */
+export declare function loadStrengthRows(hippoRoot: string, tenantId: string): StrengthRow[];
+/** Text and source of tenant rows holding any of `words`; a row equal to a text apart from spacing holds its every word. */
+export declare function loadTextsHoldingWords(hippoRoot: string, tenantId: string, words: readonly string[]): Array<Pick<MemoryEntry, 'content' | 'source'>>;
+export interface SourceTally {
+    source: string;
+    count: number;
+    latest: string;
+    /** `created`, a unit separator, then `id` of the source's first row in loadAllEntries' order. */
+    first: string;
+}
+/** Row count and newest `created` per source, for peer listings that need no row; all tenants when `tenantId` is absent. */
+export declare function tallySources(hippoRoot: string, tenantId?: string): SourceTally[];
+//# sourceMappingURL=candidates.d.ts.map

package/dist/store/candidates.js

@@ -0,0 +1,152 @@
+import { closeHippoDb } from '../db.js';
+import { RECALL_DEFAULT_DENY_SCOPES } from '../recall-scope.js';
+import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
+import { openStore } from './open.js';
+import { pickRarestFtsQuery, loadRecallSearchEntriesFromDb } from './search-rows.js';
+const AMBIENT_SCOPED = 'superseded_by IS NULL AND tenant_id = ?';
+/** Exported so the plan test runs the exact SQL; idx_memories_pinned (db.ts v51) serves it. */
+export const AMBIENT_PINNED_WHERE = `pinned = 1 AND ${AMBIENT_SCOPED} ORDER BY created ASC, id ASC`;
+/** Exported so the plan test runs the exact SQL; idx_memories_created_drift (db.ts v51) serves it. */
+export const AMBIENT_DRIFT_SQL = `SELECT 1 FROM memories WHERE ${AMBIENT_SCOPED} AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1`;
+// The pins plus the `recentNeeded` newest rows that pass `admit`, for ambient
+// injection. One connection; `recall` piggybacks the Z1 FTS query on it too.
+export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit, recall) {
+    // A SQL LIMIT takes an integer; the Array.slice this replaced truncated one,
+    // and include_recent is any non-negative finite number at the HTTP edge.
+    const needed = Math.trunc(recentNeeded);
+    const db = openStore(hippoRoot);
+    try {
+        // SAFETY: every `where` below starts from MEMORY_SELECT_COLUMNS' table.
+        const run = (where, params) => db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE ${where}`).all(...params).map(rowToEntry);
+        const byId = new Map();
+        const scoped = AMBIENT_SCOPED;
+        for (const e of run(AMBIENT_PINNED_WHERE, [tenantId])) {
+            if (admit(e))
+                byId.set(e.id, e);
+        }
+        if (needed > 0) {
+            // Text order is chronological only for canonical UTC ISO (memory.ts).
+            const drifted = db.prepare(AMBIENT_DRIFT_SQL).get(tenantId) !== undefined;
+            // `id DESC` mirrors getContext's comparator, not loadFreshRawMemories'
+            // cross-ingest-stable order: that would change what the hook injects.
+            const window = Math.max(needed * 4, 32);
+            const windowed = drifted
+                ? []
+                : run(`${scoped} ORDER BY created DESC, id DESC LIMIT ?`, [tenantId, window]);
+            let kept = windowed.filter(admit);
+            if (drifted || (kept.length < needed && windowed.length === window)) {
+                kept = run(`${scoped} ORDER BY created DESC, id DESC`, [tenantId]).filter(admit);
+            }
+            for (const e of kept)
+                byId.set(e.id, e);
+        }
+        // loadAllEntries' order: rankedPinned's comparator can tie and Array.sort
+        // is stable, so input order is load-bearing downstream.
+        const entries = [...byId.values()].sort((a, b) => {
+            const byCreated = a.created.localeCompare(b.created);
+            return byCreated !== 0 ? byCreated : a.id.localeCompare(b.id);
+        });
+        if (!recall)
+            return { entries };
+        const ftsQuery = pickRarestFtsQuery(db, recall.terms);
+        const recallEntries = ftsQuery
+            ? loadRecallSearchEntriesFromDb(db, ftsQuery, recall.limit, tenantId, undefined, 'exact', false)
+            : [];
+        return { entries, recall: recallEntries };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+// calculateStrength's decay exponent with its reward factor, pins first: the strongest rows, without scoring each one in JS.
+const DECAY_RANK_SQL = `pinned DESC,
+  CASE WHEN half_life_days > 0 THEN (julianday(?) - julianday(last_retrieved))
+    / (half_life_days * (1.0 + 0.5 * (COALESCE(outcome_positive, 0) - COALESCE(outcome_negative, 0))
+      / (COALESCE(outcome_positive, 0) + COALESCE(outcome_negative, 0) + 1.0))) END ASC NULLS LAST,
+  id ASC`;
+/** Live tenant rows passing `filter`, at most `filter.cap`, in loadAllEntries' order; below the cap, every such row. */
+export function loadContextCandidates(hippoRoot, tenantId, filter) {
+    const where = ['tenant_id = ?', `COALESCE(superseded_by, '') = ''`];
+    const params = [tenantId];
+    if (filter.exactScope) {
+        where.push('scope = ?');
+        params.push(filter.exactScope);
+    }
+    else {
+        // isRestrictedScope's rule; NOT LIKE folds ASCII case as its /:private:/i does.
+        where.push(`(scope IS NULL OR (scope NOT IN (${RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ')}) AND scope NOT LIKE '%:private:%'))`);
+        params.push(...RECALL_DEFAULT_DENY_SCOPES);
+    }
+    if (filter.project !== undefined) {
+        where.push(`(origin_project = '' OR origin_project = ?)`);
+        params.push(filter.project);
+    }
+    const db = openStore(hippoRoot);
+    try {
+        // SAFETY: the outer SELECT names exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set; the rank sort carries ids only.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (
+        SELECT id FROM memories WHERE ${where.join(' AND ')} ORDER BY ${DECAY_RANK_SQL} LIMIT ?
+      ) ORDER BY created ASC, id ASC`).all(...params, filter.now.toISOString(), Math.max(0, Math.trunc(filter.cap)));
+        return rows.map(rowToEntry);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** Every tenant row as a StrengthRow, for whole-store health numbers; defaults match rowToEntry's. */
+export function loadStrengthRows(hippoRoot, tenantId) {
+    const db = openStore(hippoRoot);
+    try {
+        // SAFETY: rows' shape matches the columns named in the SELECT below.
+        const rows = db.prepare(`SELECT pinned, created, last_retrieved, half_life_days, retrieval_count, emotional_valence, outcome_positive, outcome_negative, tags_json
+       FROM memories WHERE tenant_id = ?`).all(tenantId);
+        return rows.map((row) => ({
+            pinned: Boolean(row.pinned),
+            created: row.created,
+            last_retrieved: row.last_retrieved,
+            half_life_days: Number(row.half_life_days ?? 7),
+            retrieval_count: Number(row.retrieval_count ?? 0),
+            emotional_valence: row.emotional_valence ?? 'neutral',
+            outcome_positive: Number(row.outcome_positive ?? 0),
+            outcome_negative: Number(row.outcome_negative ?? 0),
+            tags: parseJsonArray(row.tags_json),
+        }));
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** Text and source of tenant rows holding any of `words`; a row equal to a text apart from spacing holds its every word. */
+export function loadTextsHoldingWords(hippoRoot, tenantId, words) {
+    const unique = [...new Set(words)];
+    const out = [];
+    const db = openStore(hippoRoot);
+    try {
+        // Chunked so one statement stays far under SQLite's bound-parameter limit.
+        for (let i = 0; i < unique.length; i += 200) {
+            const chunk = unique.slice(i, i + 200);
+            // SAFETY: rows' shape matches the two columns named in the SELECT below.
+            const rows = db.prepare(`SELECT content, source FROM memories WHERE tenant_id = ? AND (${chunk.map(() => 'instr(content, ?) > 0').join(' OR ')})`).all(tenantId, ...chunk);
+            for (const row of rows)
+                out.push({ content: row.content, source: row.source ?? 'cli' });
+        }
+        return out;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** Row count and newest `created` per source, for peer listings that need no row; all tenants when `tenantId` is absent. */
+export function tallySources(hippoRoot, tenantId) {
+    const db = openStore(hippoRoot);
+    try {
+        const where = tenantId !== undefined ? 'WHERE tenant_id = ?' : '';
+        // SAFETY: rows' shape matches the four aliased columns in the SELECT below.
+        return db.prepare(`SELECT COALESCE(source, 'cli') AS source, COUNT(*) AS count, MAX(created) AS latest, MIN(created || char(31) || id) AS first
+       FROM memories ${where} GROUP BY COALESCE(source, 'cli')`).all(...(tenantId !== undefined ? [tenantId] : []));
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=candidates.js.map

package/dist/store/conflicts.d.ts

@@ -0,0 +1,44 @@
+import { type MemoryConflict } from './rows.js';
+export declare function listMemoryConflicts(hippoRoot: string, status?: string, tenantId?: string): MemoryConflict[];
+type DetectedConflict = {
+    memory_a_id: string;
+    memory_b_id: string;
+    reason: string;
+    score: number;
+};
+export declare function replaceDetectedConflicts(hippoRoot: string, detected: Array<DetectedConflict>, detectedAt?: string): void;
+/**
+ * AT1 (plan §5): additive-optional opts for resolveConflict.
+ * `rejectLoserValue` implies removal of the loser regardless of
+ * `forgetLoser` — you cannot tombstone a value and leave it live.
+ */
+export interface ResolveConflictOpts {
+    /** Tombstone the loser's normalized digest + kind-aware remove it. */
+    rejectLoserValue?: boolean;
+    /** Actor for the tombstone + the new conflict_resolve audit row. Defaults to 'cli'. */
+    rejectedBy?: string;
+    /** Reason recorded on the tombstone (and passed to archiveRawMemory if the
+     *  loser is kind='raw'). Defaults to a conflict-context string. */
+    reason?: string;
+}
+/**
+ * Resolve a conflict by keeping one memory and weakening the other.
+ * Sets conflict status to 'resolved' and halves the loser's half-life.
+ * If --forget is used, the loser is removed entirely (kind-aware: raw rows
+ * are archived via archiveRawMemory, others deleted via deleteEntryCore —
+ * AT1 fix for the pre-existing crash where a raw loser aborted the whole
+ * resolve transaction against the append-only trigger). `opts.rejectLoserValue`
+ * additionally tombstones the loser's normalized digest so it cannot be
+ * re-asserted later.
+ *
+ * Every resolution path (weaken / forget / reject) emits a `conflict_resolve`
+ * audit row (AT1 — previously resolveConflict wrote zero audit rows on any path).
+ *
+ * Returns the resolved conflict, or null if not found.
+ */
+export declare function resolveConflict(hippoRoot: string, conflictId: number, keepId: string, forgetLoser?: boolean, tenantId?: string, opts?: ResolveConflictOpts): {
+    conflict: MemoryConflict;
+    loserId: string;
+} | null;
+export {};
+//# sourceMappingURL=conflicts.d.ts.map