hippo-memory 1.60.0 → 1.61.0

package/dist/store/conflicts.js

@@ -0,0 +1,444 @@
+import { closeHippoDb } from '../db.js';
+import { rejectionDigest, insertRejectedValue, normalizeValueForRejection } from '../rejection.js';
+import { archiveRawMemory } from '../raw-archive.js';
+import { rowToMemoryConflict } from './rows.js';
+import { audit } from './audit-event.js';
+import { syncMirrorFiles, purgeMirrorBestEffort } from './mirrors.js';
+import { openStore } from './open.js';
+import { deleteEntryCore } from './delete-and-batch.js';
+function canonicalConflictPair(aId, bId) {
+    return aId < bId
+        ? { memory_a_id: aId, memory_b_id: bId }
+        : { memory_a_id: bId, memory_b_id: aId };
+}
+export function listMemoryConflicts(hippoRoot, status = 'open', tenantId) {
+    const db = openStore(hippoRoot);
+    try {
+        // v0.28 — '*' is a sentinel meaning "no status filter, return all rows".
+        // Pre-v0.28 callers (cli/mcp/dashboard) always passed 'open' or default,
+        // so this sentinel is purely additive. The 4 SQL branches below cover
+        // {tenanted | unscoped} × {all-statuses | specific-status}.
+        const allStatuses = status === '*';
+        let rows;
+        if (tenantId !== undefined) {
+            // Tenanted query — JOIN to memories on both conflict members and require
+            // each in-tenant, so neither a normal cross-tenant pair nor a stale
+            // pre-fix row surfaces (consistent with resolveConflict).
+            // SAFETY: both branches select the same eight mc.* columns (aliased
+            // to MemoryConflictRow's field names) from memory_conflicts.
+            rows = allStatuses
+                ? db.prepare(`
+            SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
+                   mc.status, mc.detected_at, mc.updated_at
+            FROM memory_conflicts mc
+            JOIN memories ma ON ma.id = mc.memory_a_id
+            JOIN memories mb ON mb.id = mc.memory_b_id
+            WHERE ma.tenant_id = ? AND mb.tenant_id = ?
+            ORDER BY mc.updated_at DESC, mc.id DESC
+          `).all(tenantId, tenantId)
+                : db.prepare(`
+            SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
+                   mc.status, mc.detected_at, mc.updated_at
+            FROM memory_conflicts mc
+            JOIN memories ma ON ma.id = mc.memory_a_id
+            JOIN memories mb ON mb.id = mc.memory_b_id
+            WHERE mc.status = ? AND ma.tenant_id = ? AND mb.tenant_id = ?
+            ORDER BY mc.updated_at DESC, mc.id DESC
+          `).all(status, tenantId, tenantId);
+        }
+        else {
+            // Unscoped query — legacy direct-mode (CLI, tests, consolidate).
+            // SAFETY: both branches select the same eight columns matching
+            // MemoryConflictRow's field set.
+            rows = allStatuses
+                ? db.prepare(`
+            SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+            FROM memory_conflicts
+            ORDER BY updated_at DESC, id DESC
+          `).all()
+                : db.prepare(`
+            SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+            FROM memory_conflicts
+            WHERE status = ?
+            ORDER BY updated_at DESC, id DESC
+          `).all(status);
+        }
+        return rows.map(rowToMemoryConflict);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+export function replaceDetectedConflicts(hippoRoot, detected, detectedAt = new Date().toISOString()) {
+    const db = openStore(hippoRoot);
+    try {
+        db.exec('BEGIN');
+        const sameTenant = loadSameTenantCheck(db);
+        const canonicalDetected = detected.map((conflict) => ({
+            ...canonicalConflictPair(conflict.memory_a_id, conflict.memory_b_id),
+            reason: conflict.reason,
+            score: conflict.score,
+        }));
+        resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt);
+        upsertDetectedConflicts(db, canonicalDetected, sameTenant, detectedAt);
+        rebuildConflictsWithJson(db, sameTenant);
+        db.exec('COMMIT');
+        syncMirrorFiles(hippoRoot, db);
+    }
+    catch (error) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch {
+            // Ignore nested rollback failures.
+        }
+        throw error;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function loadSameTenantCheck(db) {
+    // Tenant guard (E2): a conflict is meaningful only within one tenant.
+    // Build id -> tenant_id once and skip cross-tenant pairs both when
+    // inserting rows and when rebuilding conflicts_with_json, so a stale
+    // cross-tenant row can neither persist nor leak a foreign id.
+    const tenantById = new Map();
+    // SAFETY: rows' shape matches the two columns named in the SELECT below.
+    for (const r of db.prepare(`SELECT id, tenant_id FROM memories`).all()) {
+        tenantById.set(r.id, r.tenant_id);
+    }
+    return (a, b) => {
+        const ta = tenantById.get(a);
+        const tb = tenantById.get(b);
+        return ta !== undefined && tb !== undefined && ta === tb;
+    };
+}
+function resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt) {
+    const detectedKeys = new Set(canonicalDetected.map((conflict) => `${conflict.memory_a_id}::${conflict.memory_b_id}`));
+    // SAFETY: openRows' shape matches the eight columns named in the SELECT
+    // above.
+    const openRows = db.prepare(`
+    SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+    FROM memory_conflicts
+    WHERE status = 'open'
+  `).all();
+    for (const row of openRows) {
+        const key = `${row.memory_a_id}::${row.memory_b_id}`;
+        const stale = !detectedKeys.has(key);
+        // v1.11.0 residue: auto-resolve any open cross-tenant row. The insert
+        // loop below (line 2089) and the refMap rebuild (line 2117) skip
+        // cross-tenant pairs, but the resolve-stale loop previously left
+        // re-detected cross-tenant rows lingering status='open'. The
+        // sameTenant() helper is already built one block up; no extra query.
+        const crossTenant = !sameTenant(row.memory_a_id, row.memory_b_id);
+        if (stale || crossTenant) {
+            db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = ? WHERE id = ?`).run(detectedAt, row.id);
+        }
+    }
+}
+function upsertDetectedConflicts(db, canonicalDetected, sameTenant, detectedAt) {
+    for (const conflict of canonicalDetected) {
+        // Skip cross-tenant pairs — never persist a conflict spanning tenants.
+        if (!sameTenant(conflict.memory_a_id, conflict.memory_b_id))
+            continue;
+        db.prepare(`
+      INSERT INTO memory_conflicts(memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at)
+      VALUES (?, ?, ?, ?, 'open', ?, ?)
+      ON CONFLICT(memory_a_id, memory_b_id) DO UPDATE SET
+        reason = excluded.reason,
+        score = excluded.score,
+        status = 'open',
+        updated_at = excluded.updated_at
+    `).run(conflict.memory_a_id, conflict.memory_b_id, conflict.reason, conflict.score, detectedAt, detectedAt);
+    }
+}
+function rebuildConflictsWithJson(db, sameTenant) {
+    // SAFETY: openConflicts' shape matches the two columns named above.
+    const openConflicts = db.prepare(`
+    SELECT memory_a_id, memory_b_id
+    FROM memory_conflicts
+    WHERE status = 'open'
+  `).all();
+    const refMap = new Map();
+    for (const row of openConflicts) {
+        // Skip cross-tenant pairs so a stale row never seeds a foreign id
+        // into conflicts_with_json.
+        if (!sameTenant(row.memory_a_id, row.memory_b_id))
+            continue;
+        if (!refMap.has(row.memory_a_id))
+            refMap.set(row.memory_a_id, new Set());
+        if (!refMap.has(row.memory_b_id))
+            refMap.set(row.memory_b_id, new Set());
+        refMap.get(row.memory_a_id).add(row.memory_b_id);
+        refMap.get(row.memory_b_id).add(row.memory_a_id);
+    }
+    // SAFETY: memoryRows' shape matches the single `id` column selected
+    // above.
+    const memoryRows = db.prepare(`SELECT id FROM memories`).all();
+    for (const memory of memoryRows) {
+        const refs = Array.from(refMap.get(memory.id) ?? []).sort();
+        db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?`).run(JSON.stringify(refs), memory.id);
+    }
+}
+/**
+ * Resolve a conflict by keeping one memory and weakening the other.
+ * Sets conflict status to 'resolved' and halves the loser's half-life.
+ * If --forget is used, the loser is removed entirely (kind-aware: raw rows
+ * are archived via archiveRawMemory, others deleted via deleteEntryCore —
+ * AT1 fix for the pre-existing crash where a raw loser aborted the whole
+ * resolve transaction against the append-only trigger). `opts.rejectLoserValue`
+ * additionally tombstones the loser's normalized digest so it cannot be
+ * re-asserted later.
+ *
+ * Every resolution path (weaken / forget / reject) emits a `conflict_resolve`
+ * audit row (AT1 — previously resolveConflict wrote zero audit rows on any path).
+ *
+ * Returns the resolved conflict, or null if not found.
+ */
+export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = false, tenantId, opts) {
+    const db = openStore(hippoRoot);
+    // When tenantId is set, the conflict lookup requires BOTH members in-tenant
+    // and every memories mutation carries AND tenant_id = ?. A cross-tenant probe
+    // then returns null, indistinguishable from a bad id. Omitted tenantId =
+    // legacy unscoped behaviour (CLI direct mode, tests, consolidate.ts).
+    const scope = {
+        memScope: tenantId !== undefined ? ' AND tenant_id = ?' : '',
+        memArgs: tenantId !== undefined ? [tenantId] : [],
+    };
+    try {
+        const row = selectConflictRow(db, conflictId, tenantId);
+        if (!row)
+            return null;
+        const conflict = rowToMemoryConflict(row);
+        if (conflict.status !== 'open')
+            return null;
+        const loserId = keepId === conflict.memory_a_id
+            ? conflict.memory_b_id
+            : keepId === conflict.memory_b_id
+                ? conflict.memory_a_id
+                : null;
+        if (!loserId)
+            return null;
+        db.exec('BEGIN');
+        // Mark conflict as resolved
+        db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = datetime('now') WHERE id = ?`)
+            .run(conflictId);
+        const target = { conflictId, keepId, loserId, scope, opts };
+        const removeLoser = forgetLoser || opts?.rejectLoserValue === true;
+        const removal = removeLoser ? removeConflictLoser(db, target) : weakenConflictLoser(db, target);
+        stripConflictRefs(db, target, removal.loserRemoved);
+        auditConflictResolve(db, target, removal, tenantId);
+        db.exec('COMMIT');
+        syncMirrorFiles(hippoRoot, db);
+        if (removal.loserRemoved)
+            purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal);
+        return { conflict: { ...conflict, status: 'resolved' }, loserId };
+    }
+    catch (error) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { /* ignore */ }
+        throw error;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function selectConflictRow(db, conflictId, tenantId) {
+    // SAFETY: both branches select the same eight columns (aliased in the
+    // tenanted branch) matching MemoryConflictRow's field set.
+    return (tenantId !== undefined
+        ? db.prepare(`
+        SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
+               mc.status, mc.detected_at, mc.updated_at
+        FROM memory_conflicts mc
+        JOIN memories ma ON ma.id = mc.memory_a_id
+        JOIN memories mb ON mb.id = mc.memory_b_id
+        WHERE mc.id = ? AND ma.tenant_id = ? AND mb.tenant_id = ?
+      `).get(conflictId, tenantId, tenantId)
+        : db.prepare(`
+        SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+        FROM memory_conflicts WHERE id = ?
+      `).get(conflictId));
+}
+function weakenConflictLoser(db, t) {
+    // Halve the loser's half-life (weakens it over time)
+    db.prepare(`UPDATE memories SET half_life_days = MAX(1, half_life_days / 2), updated_at = datetime('now') WHERE id = ?${t.scope.memScope}`)
+        .run(t.loserId, ...t.scope.memArgs);
+    return { loserRemoved: false, loserWasRaw: false, rejectedDigest: undefined, extraRemovedIds: [], extraRemovedRawIds: [] };
+}
+function removeConflictLoser(db, t) {
+    // AT1 (plan §5): removal (forgetLoser OR rejectLoserValue — a tombstoned
+    // value cannot be left live) is now kind-aware. The old bare
+    // `DELETE FROM memories WHERE id = ?` aborted the whole transaction when
+    // the loser was kind='raw' (append-only trigger fires); route through
+    // the same helpers the reject verb uses (both db-scoped, both compose
+    // inside this BEGIN/COMMIT). loserRemoved / loserWasRaw drive both the
+    // conflicts_with_json skip below and the post-commit mirror purge.
+    const removal = {
+        loserRemoved: false,
+        loserWasRaw: false,
+        rejectedDigest: undefined,
+        // AT1 P1 fix (codex): same-tenant duplicates of the loser's content that
+        // rejectLoserValue also removes (see below) — separate from loserId so
+        // the audit + post-commit mirror purge can cover ALL of them, not just
+        // loserId.
+        extraRemovedIds: [],
+        extraRemovedRawIds: [],
+    };
+    const { loserId, opts } = t;
+    // SAFETY: loserRow's shape matches the three columns named in the
+    // SELECT above.
+    const loserRow = db
+        .prepare(`SELECT kind, content, tenant_id FROM memories WHERE id = ?${t.scope.memScope}`)
+        .get(loserId, ...t.scope.memArgs);
+    if (loserRow) {
+        const actor = opts?.rejectedBy ?? 'cli';
+        const reason = opts?.reason ?? `resolveConflict ${t.conflictId}: kept ${t.keepId}`;
+        if (opts?.rejectLoserValue) {
+            removal.rejectedDigest = tombstoneLoserValue(db, t, loserRow, { actor, reason }, removal);
+        }
+        if (loserRow.kind === 'raw') {
+            archiveRawMemory(db, loserId, { reason, who: actor });
+            removal.loserWasRaw = true;
+        }
+        else {
+            deleteEntryCore(db, loserId, { actor, suppressForgetAudit: true });
+        }
+        removal.loserRemoved = true;
+    }
+    // loserRow undefined = tenant-scope mismatch (or already gone); matches
+    // the old tenant-scoped DELETE's silent 0-rows-affected behavior.
+    return removal;
+}
+/** Tombstones the loser's digest and removes its same-tenant duplicates into `removal`; returns the digest. */
+function tombstoneLoserValue(db, t, loserRow, who, removal) {
+    const { actor, reason } = who;
+    const rejectedDigest = rejectionDigest(loserRow.content);
+    insertRejectedValue(db, {
+        tenantId: loserRow.tenant_id ?? 'default',
+        digest: rejectedDigest,
+        reason,
+        rejectedBy: actor,
+        rejectedAt: new Date().toISOString(),
+        sourceMemoryId: t.loserId,
+        normalizedChars: normalizeValueForRejection(loserRow.content).length,
+    });
+    // AT1 P1 fix (codex): reject-flow.ts's `rejectValue` removes ALL
+    // live same-tenant rows whose normalized digest matches, not just
+    // the one id passed — but this branch only ever removed loserId,
+    // leaving same-TENANT duplicates live while their shared content
+    // was tombstoned. Same O(N) scan pattern as reject-flow.ts (human-
+    // triggered command, tenant's row count is human-scale). CRITICAL
+    // BOUNDARY: tenant-scoped ONLY — tombstones are tenant-scoped by
+    // design, so a same-content row in ANOTHER tenant is legitimately
+    // live and must NOT be touched here. `keepId` is excluded even if
+    // its content coincidentally matches: the human explicitly chose
+    // to keep it in this same resolution, and this branch must not
+    // undo that choice in the same transaction.
+    const loserTenantId = loserRow.tenant_id ?? 'default';
+    // SAFETY: dupRows' shape matches the three columns named in the
+    // SELECT above.
+    const dupRows = db
+        .prepare(`SELECT id, kind, content FROM memories WHERE tenant_id = ? AND id != ? AND id != ?`)
+        .all(loserTenantId, t.loserId, t.keepId);
+    for (const dup of dupRows) {
+        if (rejectionDigest(dup.content) !== rejectedDigest)
+            continue;
+        if (dup.kind === 'raw') {
+            archiveRawMemory(db, dup.id, { reason, who: actor });
+            removal.extraRemovedRawIds.push(dup.id);
+        }
+        else {
+            deleteEntryCore(db, dup.id, { actor, suppressForgetAudit: true });
+        }
+        removal.extraRemovedIds.push(dup.id);
+    }
+    return rejectedDigest;
+}
+function stripConflictRefs(db, t, loserRemoved) {
+    const { memScope, memArgs } = t.scope;
+    const { keepId, loserId } = t;
+    // Clean up conflicts_with references
+    // SAFETY: keepRow's shape matches the single `conflicts_with_json`
+    // column selected above.
+    const keepRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(keepId, ...memArgs);
+    if (keepRow) {
+        const refs = JSON.parse(keepRow.conflicts_with_json || '[]');
+        const cleaned = refs.filter((r) => r !== loserId);
+        db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
+            .run(JSON.stringify(cleaned), keepId, ...memArgs);
+    }
+    if (!loserRemoved) {
+        // SAFETY: loserRow's shape matches the single `conflicts_with_json`
+        // column named in the SELECT below.
+        const loserRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(loserId, ...memArgs);
+        if (loserRow) {
+            const refs = JSON.parse(loserRow.conflicts_with_json || '[]');
+            const cleaned = refs.filter((r) => r !== keepId);
+            db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
+                .run(JSON.stringify(cleaned), loserId, ...memArgs);
+        }
+    }
+}
+function auditConflictResolve(db, t, removal, tenantId) {
+    const { loserRemoved, loserWasRaw, rejectedDigest, extraRemovedIds } = removal;
+    // AT1: the missing audit (plan §5 — resolveConflict wrote ZERO audit_log
+    // rows on any path before this). Every path — weaken, forget, reject —
+    // lands exactly one conflict_resolve row.
+    const conflictResolveMeta = {
+        conflictId: t.conflictId,
+        keepId: t.keepId,
+        loserId: t.loserId,
+        disposition: loserRemoved ? (loserWasRaw ? 'archived_raw' : 'deleted') : 'weakened',
+        rejected: Boolean(t.opts?.rejectLoserValue),
+        // AT1 P1 fix: every row this call removed, not just loserId — the
+        // same-tenant duplicate sweep above (extraRemovedIds) needs an
+        // audit trail too.
+        removedIds: loserRemoved ? [t.loserId, ...extraRemovedIds] : [],
+    };
+    // Assigned only when present so the serialized audit payload keeps
+    // omitting the key, exactly as the pre-migration object literal did.
+    if (rejectedDigest !== undefined)
+        conflictResolveMeta.rejectedDigest = rejectedDigest;
+    // Fresh spread literal: ConflictResolveMeta is a closed interface (no
+    // index signature) and isn't directly assignable to audit()'s
+    // Record<string, JsonValue> metadata param; a spread into a fresh
+    // object literal satisfies it without widening the declared type above.
+    audit(db, 'conflict_resolve', t.keepId, { ...conflictResolveMeta }, t.opts?.rejectedBy ?? 'cli', tenantId);
+}
+function purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal) {
+    // AT1 P1b fix: mirror purge + reaper stamp for EVERY removed loser, not
+    // just the rejectLoserValue path. Pre-AT1, the plain forgetLoser path on
+    // a raw loser crashed outright (bare DELETE FROM memories hit the
+    // append-only trigger) — there is no legacy "successful forget, no
+    // purge" behavior to preserve for that case. Post-AT1's kind-aware
+    // removal (archiveRawMemory / deleteEntryCore above) makes plain
+    // --forget succeed on every kind, but until this fix the mirror was
+    // only purged when rejectLoserValue was ALSO set: a plain raw --forget
+    // left its markdown mirror orphaned (the reaper still catches it
+    // eventually, since archiveRawMemory's own raw_archive insert leaves
+    // mirror_cleaned_at NULL) and a plain non-raw --forget left its mirror
+    // orphaned FOREVER (no reaper exists for non-raw rows). Same post-commit
+    // purge+reaper pattern as the reject verb (src/reject-flow.ts) and
+    // api.archiveRaw — reusing removeEntryMirrors + raw_archive bookkeeping.
+    // AT1 P1 fix: loop over loserId AND every same-tenant duplicate the
+    // rejectLoserValue sweep above removed (extraRemovedIds) — previously
+    // only loserId's mirror was purged, leaving duplicate mirrors orphaned
+    // despite their rows being gone.
+    for (const removedId of [loserId, ...removal.extraRemovedIds]) {
+        const isRaw = removedId === loserId ? removal.loserWasRaw : removal.extraRemovedRawIds.includes(removedId);
+        // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
+        // which cleanupArchivedMirrors' reaper never scans — reports the
+        // EXPLICIT leftover path(s) instead of the false "will retry via
+        // reaper" claim. See its own doc comment (store.ts, near
+        // removeEntryMirrors) for the full rationale.
+        const mirrorOk = purgeMirrorBestEffort(hippoRoot, removedId, isRaw, 'resolveConflict');
+        if (mirrorOk && isRaw) {
+            db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), removedId);
+        }
+    }
+}
+//# sourceMappingURL=conflicts.js.map

package/dist/store/delete-and-batch.d.ts

@@ -0,0 +1,63 @@
+import { type MemoryEntry } from '../memory.js';
+import { openHippoDb } from '../db.js';
+import { type DormantMove } from '../dormant.js';
+/** Tables whose rows keep a first-class object's backing memory in `memory_id` (ON DELETE SET NULL); tests/dormant-memories.test.ts pins it to the schema. */
+export declare const MEMORY_BACKED_TABLES: readonly ["predictions", "decisions", "incidents", "processes", "policies", "skills", "project_briefs", "customer_notes"];
+/** Ids of memories that back a first-class object, for passes that plan deletes before making them. A table missing from an older schema is skipped. */
+export declare function memoriesBackingObjects(hippoRoot: string): Set<string>;
+/**
+ * AT1 (plan §4, round-2 fix, designed from source): db-scoped delete core.
+ * `deleteEntry` used to open+close its OWN connection, which meant it could
+ * never compose inside a caller's transaction (unlike writeEntry/
+ * writeEntryDbOnly, which already split this way). Split identically: row-
+ * meta SELECT, `DELETE FROM memories`, FTS delete, `forget` audit, DAG
+ * dirty-mark. NO filesystem I/O — the caller's own transaction may still be
+ * rolled back, and mirror writes must only happen post-commit.
+ *
+ * `opts.suppressForgetAudit` (default false, off): two AT1 callers set this
+ * so a removed non-raw row does NOT ALSO emit a `forget` row, because each
+ * already writes its own aggregate audit trail — `src/reject-flow.ts`'s
+ * `rejectValue` (single `reject_value` row covering every same-digest row
+ * removed) and `resolveConflict` (`conflict_resolve` row per resolution).
+ * Default keeps `deleteEntry` byte-identical to its pre-split behavior.
+ *
+ * Returns `{tenantId, dagParentId}` for the removed row, or `null` if no row with `id`
+ * existed or `automatic` refused it (pinned, raw, kept for good or backing an object at DELETE time, so a late pin wins).
+ */
+export declare function deleteEntryCore(db: ReturnType<typeof openHippoDb>, id: string, opts?: {
+    actor?: string;
+    suppressForgetAudit?: boolean;
+    reason?: string;
+    automatic?: boolean;
+}): {
+    tenantId: string;
+    dagParentId: string | null;
+} | null;
+/**
+ * Delete an entry from SQLite and mirrors.
+ *
+ * `opts.actor` defaults to 'cli'. The api.* layer threads `ctx.actor` so HTTP
+ * callers land with `api_key:<key_id>` in the audit log without a duplicate
+ * emit from the api wrapper.
+ *
+ * Thin wrapper over `deleteEntryCore` (open → core → mirrors → close);
+ * behavior is byte-identical to the pre-split implementation for every
+ * existing caller.
+ */
+export declare function deleteEntry(hippoRoot: string, id: string, opts?: {
+    actor?: string;
+    reason?: string;
+    automatic?: boolean;
+}): boolean;
+/** Consolidation's flush, one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
+ *  the fields the caller changed, takes the rest from the live row, and never resurrects a row that is gone.
+ *
+ *  `dormant` (src/dormant.ts): each move's snapshot is inserted into `dormant_memories` and its `memories` row
+ *  leaves exactly like a delete (FTS row, DAG parent dirty-mark, mirrors), in the same transaction, so a memory
+ *  is never in both places or in neither. Deletes and moves both skip rows that are no longer auto-deletable
+ *  (pinned, raw, kept for good or backing an object since the caller decided). Returns the ids that left `memories`, deleted or moved. */
+export declare function batchWriteAndDelete(hippoRoot: string, toWrite: MemoryEntry[], toDeleteIds: string[], opts?: {
+    snapshot?: ReadonlyMap<string, MemoryEntry>;
+    dormant?: DormantMove[];
+}): string[];
+//# sourceMappingURL=delete-and-batch.d.ts.map