hippo-memory 1.60.0 → 1.61.0

package/dist/store/entry-row.d.ts

@@ -0,0 +1,67 @@
+import type { MemoryEntry } from '../memory.js';
+import { openHippoDb } from '../db.js';
+/**
+ * `bypassRejectionGuard` (AT1, plan §3): ONLY `batchWriteAndDelete`'s call
+ * site passes `true`. Consolidation merges are DETERMINISTIC CONCATENATION
+ * (mergeContents, consolidate.ts:736-751), not LLM paraphrase — the bypass
+ * is safe because the producer (consolidate.ts's merge pass) now checks the
+ * merged content's rejection digest against the tenant's tombstones BEFORE
+ * ever assembling a batch to write, and skips the merge entirely on a hit.
+ * Every other caller (writeEntryDbOnly, bootstrapLegacyStore, rebuildIndex)
+ * leaves this false and the guard runs live.
+ *
+ * AT1 P1 fix (codex, batch-transaction rejection race): the producer check
+ * above runs on a DIFFERENT connection BEFORE this transaction opens — a
+ * `hippo reject X` that commits in that window is invisible to it. This
+ * parameter's contract is UNCHANGED (still the sole bypass, still trusted
+ * by the producer-side check for the common case); what changed is that
+ * `batchWriteAndDelete` no longer trusts it BLINDLY. It now runs its own
+ * in-transaction point-probe (same connection, same digest lookup this
+ * function's guard would have done) immediately before each upsert and
+ * skips — rather than writes — any entry whose content matches a tombstone
+ * that landed after the producer's check. See batchWriteAndDelete for the
+ * skip logic.
+ */
+export declare function upsertEntryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, bypassRejectionGuard?: boolean): void;
+export declare function syncFtsRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, isNewRow?: boolean): void;
+export declare function deleteFtsRow(db: ReturnType<typeof openHippoDb>, id: string): void;
+/**
+ * Write a memory entry to SQLite and refresh compatibility mirrors.
+ *
+ * `opts.actor` defaults to 'cli' so unauthenticated direct-CLI callers still
+ * get the right audit attribution. The HTTP server (A1) and api.* layer pass
+ * the resolved actor (`api_key:<key_id>` / `localhost:cli`) so audit events
+ * land with one row per write, no double-emit.
+ *
+ * `opts.afterWrite` is invoked inside the same SAVEPOINT as the memories
+ * INSERT (mirrors archiveRawMemory's shape in raw-archive.ts). On callback
+ * throw, the SAVEPOINT rolls back — the memory row never lands, and the
+ * filesystem mirrors / audit emit never run. Used by E1.3+ connectors to
+ * stamp idempotency rows atomically with the memory write.
+ */
+/**
+ * Stamp origin_project from the store's own location when the entry has
+ * never been stamped (v39 memory scope isolation). The store dir is
+ * `<project>/.hippo`, so its parent resolves to the owning project; the
+ * home/global store resolves to '' (user-global). Callers that know a better
+ * origin (shareMemory, syncGlobalToLocal) set entry.origin_project before
+ * writing and this is a no-op. Returns a stamped copy; never mutates.
+ *
+ * NULL is deliberately PRESERVED, not re-stamped: null means "legacy row the
+ * v39 migration found no evidence for" and is deny-by-default in ambient
+ * context. A writeback (e.g. markRetrieved on a crossProject-included row)
+ * must not launder it into an injectable origin - the migration is the only
+ * evidence-based NULL converter (codex gating round 2 P1).
+ */
+export declare function stampOriginProject(hippoRoot: string, entry: MemoryEntry): MemoryEntry;
+/**
+ * Import-time variant for a mirror with no origin field (an explicit null stays null): used only where evidence exists
+ * for rows that predate the origin column - the legacy-markdown bootstrap and
+ * rebuildIndex import, which are the markdown-store equivalent of the v39 SQL
+ * backfill. Same evidence order as the migration: the provenance source
+ * (`shared:<project>:` / `promoted:<localRoot>`) wins over the destination
+ * store's location, so a shared row imported into the global store keeps its
+ * owning project instead of becoming user-global (codex gating round 3 P1).
+ */
+export declare function stampOriginProjectForImport(hippoRoot: string, entry: MemoryEntry): MemoryEntry;
+//# sourceMappingURL=entry-row.d.ts.map

package/dist/store/entry-row.js

@@ -0,0 +1,208 @@
+import * as path from 'path';
+import { isFtsAvailable } from '../db.js';
+import { deriveOriginProject, originFromSource } from '../project-identity.js';
+import { checkRejectionGuard } from '../rejection.js';
+import { log } from '../log.js';
+/**
+ * `bypassRejectionGuard` (AT1, plan §3): ONLY `batchWriteAndDelete`'s call
+ * site passes `true`. Consolidation merges are DETERMINISTIC CONCATENATION
+ * (mergeContents, consolidate.ts:736-751), not LLM paraphrase — the bypass
+ * is safe because the producer (consolidate.ts's merge pass) now checks the
+ * merged content's rejection digest against the tenant's tombstones BEFORE
+ * ever assembling a batch to write, and skips the merge entirely on a hit.
+ * Every other caller (writeEntryDbOnly, bootstrapLegacyStore, rebuildIndex)
+ * leaves this false and the guard runs live.
+ *
+ * AT1 P1 fix (codex, batch-transaction rejection race): the producer check
+ * above runs on a DIFFERENT connection BEFORE this transaction opens — a
+ * `hippo reject X` that commits in that window is invisible to it. This
+ * parameter's contract is UNCHANGED (still the sole bypass, still trusted
+ * by the producer-side check for the common case); what changed is that
+ * `batchWriteAndDelete` no longer trusts it BLINDLY. It now runs its own
+ * in-transaction point-probe (same connection, same digest lookup this
+ * function's guard would have done) immediately before each upsert and
+ * skips — rather than writes — any entry whose content matches a tombstone
+ * that landed after the producer's check. See batchWriteAndDelete for the
+ * skip logic.
+ */
+export function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
+    if (!bypassRejectionGuard) {
+        checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
+    }
+    const isNewRow = db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(entry.id) === undefined;
+    db.prepare(UPSERT_MEMORY_SQL).run(...memoryRowValues(entry));
+    syncFtsRow(db, entry, isNewRow);
+}
+const UPSERT_MEMORY_SQL = `
+    INSERT INTO memories(
+      id, created, last_retrieved, retrieval_count, strength, half_life_days, layer,
+      tags_json, emotional_valence, schema_fit, source, outcome_score,
+      outcome_positive, outcome_negative,
+      conflicts_with_json, pinned, confidence, content,
+      parents_json, starred,
+      trace_outcome, source_session_id,
+      valid_from, superseded_by,
+      extracted_from,
+      dag_level, dag_parent_id,
+      kind, scope, owner, artifact_ref,
+      tenant_id, origin_project,
+      descendant_count, earliest_at, latest_at,
+      dag_level_3_built_at,
+      updated_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
+    ON CONFLICT(id) DO UPDATE SET
+      created = excluded.created,
+      last_retrieved = excluded.last_retrieved,
+      retrieval_count = excluded.retrieval_count,
+      strength = excluded.strength,
+      half_life_days = excluded.half_life_days,
+      layer = excluded.layer,
+      tags_json = excluded.tags_json,
+      emotional_valence = excluded.emotional_valence,
+      schema_fit = excluded.schema_fit,
+      source = excluded.source,
+      outcome_score = excluded.outcome_score,
+      outcome_positive = excluded.outcome_positive,
+      outcome_negative = excluded.outcome_negative,
+      conflicts_with_json = excluded.conflicts_with_json,
+      pinned = excluded.pinned,
+      confidence = excluded.confidence,
+      content = excluded.content,
+      parents_json = excluded.parents_json,
+      starred = excluded.starred,
+      trace_outcome = excluded.trace_outcome,
+      source_session_id = excluded.source_session_id,
+      valid_from = excluded.valid_from,
+      superseded_by = excluded.superseded_by,
+      extracted_from = excluded.extracted_from,
+      dag_level = excluded.dag_level,
+      dag_parent_id = excluded.dag_parent_id,
+      kind = excluded.kind,
+      scope = excluded.scope,
+      owner = excluded.owner,
+      artifact_ref = excluded.artifact_ref,
+      tenant_id = excluded.tenant_id,
+      origin_project = excluded.origin_project,
+      descendant_count = excluded.descendant_count,
+      earliest_at = excluded.earliest_at,
+      latest_at = excluded.latest_at,
+      dag_level_3_built_at = excluded.dag_level_3_built_at,
+      updated_at = datetime('now')
+  `;
+/** Bind values for UPSERT_MEMORY_SQL, in its column order. */
+function memoryRowValues(entry) {
+    return [
+        entry.id,
+        entry.created,
+        entry.last_retrieved,
+        entry.retrieval_count,
+        entry.strength,
+        entry.half_life_days,
+        entry.layer,
+        JSON.stringify(entry.tags ?? []),
+        entry.emotional_valence,
+        entry.schema_fit,
+        entry.source,
+        entry.outcome_score,
+        entry.outcome_positive ?? 0,
+        entry.outcome_negative ?? 0,
+        JSON.stringify(entry.conflicts_with ?? []),
+        entry.pinned ? 1 : 0,
+        entry.confidence,
+        entry.content,
+        JSON.stringify(entry.parents ?? []),
+        entry.starred ? 1 : 0,
+        entry.trace_outcome ?? null,
+        entry.source_session_id ?? null,
+        entry.valid_from ?? entry.created,
+        entry.superseded_by ?? null,
+        entry.extracted_from ?? null,
+        entry.dag_level ?? 0,
+        entry.dag_parent_id ?? null,
+        entry.kind ?? 'distilled',
+        entry.scope ?? null,
+        entry.owner ?? null,
+        entry.artifact_ref ?? null,
+        entry.tenantId ?? 'default',
+        entry.origin_project ?? null,
+        entry.descendant_count ?? 0,
+        entry.earliest_at ?? null,
+        entry.latest_at ?? null,
+        entry.dag_level_3_built_at ?? null,
+    ];
+}
+export function syncFtsRow(db, entry, isNewRow = false) {
+    if (!isFtsAvailable(db))
+        return;
+    try {
+        if (!isNewRow)
+            db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(entry.id);
+        db.prepare(`INSERT INTO memories_fts(id, content, tags) VALUES (?, ?, ?)`).run(entry.id, entry.content, entry.tags.join(' '));
+    }
+    catch (err) {
+        // The memories table stays authoritative; a stale FTS row only costs recall quality, so the write goes on.
+        log.warnThenDebug('fts-sync', `FTS index update failed for ${entry.id}; keyword recall may miss it: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export function deleteFtsRow(db, id) {
+    if (!isFtsAvailable(db))
+        return;
+    try {
+        db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(id);
+    }
+    catch (err) {
+        log.warnThenDebug('fts-delete', `FTS index delete failed for ${id}; recall may return a stale hit: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Write a memory entry to SQLite and refresh compatibility mirrors.
+ *
+ * `opts.actor` defaults to 'cli' so unauthenticated direct-CLI callers still
+ * get the right audit attribution. The HTTP server (A1) and api.* layer pass
+ * the resolved actor (`api_key:<key_id>` / `localhost:cli`) so audit events
+ * land with one row per write, no double-emit.
+ *
+ * `opts.afterWrite` is invoked inside the same SAVEPOINT as the memories
+ * INSERT (mirrors archiveRawMemory's shape in raw-archive.ts). On callback
+ * throw, the SAVEPOINT rolls back — the memory row never lands, and the
+ * filesystem mirrors / audit emit never run. Used by E1.3+ connectors to
+ * stamp idempotency rows atomically with the memory write.
+ */
+/**
+ * Stamp origin_project from the store's own location when the entry has
+ * never been stamped (v39 memory scope isolation). The store dir is
+ * `<project>/.hippo`, so its parent resolves to the owning project; the
+ * home/global store resolves to '' (user-global). Callers that know a better
+ * origin (shareMemory, syncGlobalToLocal) set entry.origin_project before
+ * writing and this is a no-op. Returns a stamped copy; never mutates.
+ *
+ * NULL is deliberately PRESERVED, not re-stamped: null means "legacy row the
+ * v39 migration found no evidence for" and is deny-by-default in ambient
+ * context. A writeback (e.g. markRetrieved on a crossProject-included row)
+ * must not launder it into an injectable origin - the migration is the only
+ * evidence-based NULL converter (codex gating round 2 P1).
+ */
+export function stampOriginProject(hippoRoot, entry) {
+    if (entry.origin_project !== undefined)
+        return entry;
+    return { ...entry, origin_project: deriveOriginProject(path.dirname(hippoRoot)) };
+}
+/**
+ * Import-time variant for a mirror with no origin field (an explicit null stays null): used only where evidence exists
+ * for rows that predate the origin column - the legacy-markdown bootstrap and
+ * rebuildIndex import, which are the markdown-store equivalent of the v39 SQL
+ * backfill. Same evidence order as the migration: the provenance source
+ * (`shared:<project>:` / `promoted:<localRoot>`) wins over the destination
+ * store's location, so a shared row imported into the global store keeps its
+ * owning project instead of becoming user-global (codex gating round 3 P1).
+ */
+export function stampOriginProjectForImport(hippoRoot, entry) {
+    if (entry.origin_project !== undefined)
+        return entry;
+    const fromSource = originFromSource(entry.source);
+    return {
+        ...entry,
+        origin_project: fromSource ?? deriveOriginProject(path.dirname(hippoRoot)),
+    };
+}
+//# sourceMappingURL=entry-row.js.map

package/dist/store/entry-writes.d.ts

@@ -0,0 +1,46 @@
+import { type MemoryEntry } from '../memory.js';
+import { type DatabaseSyncLike } from '../db.js';
+export declare function writeEntry(hippoRoot: string, entry: MemoryEntry, opts?: {
+    actor?: string;
+    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+    /** Runs AFTER the DB row commits (RELEASE SAVEPOINT in writeEntryDbOnly) but
+     *  BEFORE the markdown mirrors are written. Lets a caller perform a post-commit
+     *  side effect (e.g. mark the graph dirty) that must still happen even if a
+     *  mirror write then throws. Keep it best-effort — it runs on a committed,
+     *  idle connection, so opening another handle inside it is safe. */
+    afterCommit?: () => void;
+}): void;
+/**
+ * DB-only write path. Caller owns the open `db` handle. Runs SAVEPOINT +
+ * upsert + afterWrite hook + audit row inside the SAVEPOINT scope. Caller
+ * is responsible for opening `db`, optionally wrapping in a larger BEGIN/
+ * COMMIT (e.g. supersede's BEGIN IMMEDIATE), closing `db`, AND calling
+ * `writeEntryMirrors` after the larger tx commits — mirrors must run
+ * post-commit so a rolled-back tx never leaves orphan markdown.
+ *
+ * Audit-order note: the audit row is emitted INSIDE the SAVEPOINT, so audit
+ * commits atomically with the row INSERT. A subsequent mirror failure cannot
+ * leave a recorded audit entry without its corresponding DB row. This is a
+ * documented hardening over the prior writeEntry-as-monolith ordering.
+ */
+export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntry, opts?: {
+    actor?: string;
+    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+}): void;
+/** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
+export declare function writeEntryMirrors(hippoRoot: string, entry: MemoryEntry): void;
+/** The caller passes the eval-only recall-boost ablation switch, so the store never reads experiment config itself. */
+export interface StrengthenOptions {
+    readonly tenantId?: string;
+    readonly recallBoostAblated: boolean;
+}
+/** Strengthen what a read returned: update only the four retrieval columns on the live row, never a stale copy.
+ *  Best effort: a failure logs and never fails the read. Returns the ids found in this store. */
+export declare function strengthenRetrieved(hippoRoot: string, ids: readonly string[], opts: StrengthenOptions): Set<string>;
+/** strengthenRetrieved on the caller's handle, inside the caller's transaction. Throws; the caller decides. */
+export declare function strengthenRetrievedOn(db: DatabaseSyncLike, ids: readonly string[], opts: StrengthenOptions): Set<string>;
+/** Rewrites a live row's tags and its full-text row on the caller's transaction, with no audit row. */
+export declare function setEntryTagsInTx(db: DatabaseSyncLike, entry: MemoryEntry): void;
+/** Removes a row from `memories` and full-text search on the caller's transaction, as sleep's dormant move does, and marks its summary parent dirty. */
+export declare function deleteEntryRowInTx(db: DatabaseSyncLike, entry: MemoryEntry, actor: string): void;
+//# sourceMappingURL=entry-writes.d.ts.map

package/dist/store/entry-writes.js

@@ -0,0 +1,148 @@
+import { markRetrieved } from '../memory.js';
+import { closeHippoDb, openHippoDb } from '../db.js';
+import { RejectedValueError } from '../rejection.js';
+import { markSummaryDirtyInTx } from '../summary-dirty.js';
+import { log } from '../log.js';
+import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
+import { auditRejectionRefusal, audit } from './audit-event.js';
+import { stampOriginProject, upsertEntryRow, syncFtsRow, deleteFtsRow } from './entry-row.js';
+import { mirrorBestEffort, writeMarkdownMirror } from './mirrors.js';
+import { openStore } from './open.js';
+export function writeEntry(hippoRoot, entry, opts) {
+    const db = openStore(hippoRoot);
+    try {
+        const stamped = stampOriginProject(hippoRoot, entry);
+        writeEntryDbOnly(db, stamped, opts);
+        opts?.afterCommit?.();
+        writeEntryMirrors(hippoRoot, stamped);
+    }
+    catch (error) {
+        // AT1 (plan §3): writeEntryDbOnly's own SAVEPOINT has already unwound by
+        // the time this catch runs, so the refusal audit lands post-rollback in
+        // a fresh implicit transaction — then rethrow so the caller sees the
+        // refusal.
+        if (error instanceof RejectedValueError) {
+            auditRejectionRefusal(db, error, opts?.actor ?? 'cli');
+        }
+        throw error;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/**
+ * DB-only write path. Caller owns the open `db` handle. Runs SAVEPOINT +
+ * upsert + afterWrite hook + audit row inside the SAVEPOINT scope. Caller
+ * is responsible for opening `db`, optionally wrapping in a larger BEGIN/
+ * COMMIT (e.g. supersede's BEGIN IMMEDIATE), closing `db`, AND calling
+ * `writeEntryMirrors` after the larger tx commits — mirrors must run
+ * post-commit so a rolled-back tx never leaves orphan markdown.
+ *
+ * Audit-order note: the audit row is emitted INSIDE the SAVEPOINT, so audit
+ * commits atomically with the row INSERT. A subsequent mirror failure cannot
+ * leave a recorded audit entry without its corresponding DB row. This is a
+ * documented hardening over the prior writeEntry-as-monolith ordering.
+ */
+export function writeEntryDbOnly(db, entry, opts) {
+    // SAVEPOINT (not BEGIN) so this nests safely inside any outer transaction
+    // a caller might hold (e.g. supersede's BEGIN IMMEDIATE). SQLite refuses
+    // BEGIN within a transaction; SAVEPOINT is the only way to scope rollback
+    // without disturbing outers.
+    db.exec('SAVEPOINT write_entry');
+    try {
+        upsertEntryRow(db, entry);
+        if (opts?.afterWrite) {
+            opts.afterWrite(db, entry.id);
+        }
+        audit(db, 'remember', entry.id, {
+            kind: entry.kind ?? 'distilled',
+            scope: entry.scope ?? null,
+        }, opts?.actor ?? 'cli', entry.tenantId);
+        // v0.30 / E2 — DAG live-coupling: child write under a level-2 summary
+        // marks the parent dirty for E3 sleep-cycle rebuild. Early-exit on
+        // null dag_parent_id (vast majority of writes); cost is one null check
+        // on the hot path.
+        if (entry.dag_parent_id) {
+            markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenantId, opts?.actor ?? 'cli');
+        }
+        db.exec('RELEASE SAVEPOINT write_entry');
+    }
+    catch (e) {
+        try {
+            db.exec('ROLLBACK TO SAVEPOINT write_entry');
+            db.exec('RELEASE SAVEPOINT write_entry');
+        }
+        catch {
+            // Ignore rollback failures — the throw below is what matters.
+        }
+        throw e;
+    }
+}
+/** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
+export function writeEntryMirrors(hippoRoot, entry) {
+    mirrorBestEffort(`${entry.id}.md`, () => writeMarkdownMirror(hippoRoot, entry));
+}
+/** Strengthen what a read returned: update only the four retrieval columns on the live row, never a stale copy.
+ *  Best effort: a failure logs and never fails the read. Returns the ids found in this store. */
+export function strengthenRetrieved(hippoRoot, ids, opts) {
+    const found = new Set();
+    if (ids.length === 0 || opts.recallBoostAblated)
+        return found;
+    let db;
+    try {
+        db = openHippoDb(hippoRoot);
+        db.exec('BEGIN IMMEDIATE');
+        for (const id of strengthenRetrievedOn(db, ids, opts))
+            found.add(id);
+        db.exec('COMMIT');
+    }
+    catch (error) {
+        try {
+            db?.exec('ROLLBACK');
+        }
+        catch { /* already rolled back; keep the original error */ }
+        log.warn(`retrieval stats not saved (${error instanceof Error ? error.message : String(error)})`);
+        found.clear();
+    }
+    finally {
+        if (db)
+            closeHippoDb(db);
+    }
+    return found;
+}
+/** strengthenRetrieved on the caller's handle, inside the caller's transaction. Throws; the caller decides. */
+export function strengthenRetrievedOn(db, ids, opts) {
+    const found = new Set();
+    if (ids.length === 0 || opts.recallBoostAblated)
+        return found;
+    const { tenantId } = opts;
+    const tenantClause = tenantId !== undefined ? ' AND tenant_id = ?' : '';
+    const select = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id = ?${tenantClause}`);
+    const live = [];
+    for (const id of ids) {
+        // SAFETY: the SELECT names exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const row = (tenantId !== undefined ? select.get(id, tenantId) : select.get(id));
+        if (row)
+            live.push(rowToEntry(row));
+    }
+    const update = db.prepare('UPDATE memories SET retrieval_count = ?, last_retrieved = ?, half_life_days = ?, strength = ? WHERE id = ?');
+    for (const e of markRetrieved(live)) {
+        update.run(e.retrieval_count, e.last_retrieved, e.half_life_days, e.strength, e.id);
+        found.add(e.id);
+    }
+    return found;
+}
+/** Rewrites a live row's tags and its full-text row on the caller's transaction, with no audit row. */
+export function setEntryTagsInTx(db, entry) {
+    db.prepare(`UPDATE memories SET tags_json = ?, updated_at = datetime('now') WHERE id = ? AND tenant_id = ?`)
+        .run(JSON.stringify(entry.tags), entry.id, entry.tenantId);
+    syncFtsRow(db, entry);
+}
+/** Removes a row from `memories` and full-text search on the caller's transaction, as sleep's dormant move does, and marks its summary parent dirty. */
+export function deleteEntryRowInTx(db, entry, actor) {
+    db.prepare('DELETE FROM memories WHERE id = ? AND tenant_id = ?').run(entry.id, entry.tenantId);
+    deleteFtsRow(db, entry.id);
+    if (entry.dag_parent_id)
+        markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenantId, actor);
+}
+//# sourceMappingURL=entry-writes.js.map

package/dist/store/handoffs.d.ts

@@ -0,0 +1,26 @@
+import { type SessionHandoff, type HandoffOutcome, type HandoffEvidence } from '../handoff.js';
+import type { TaskSnapshot } from './rows.js';
+/** Column list shared by every session_handoffs SELECT; store-cards.ts reuses it for the card handoff lookup. */
+export declare const HANDOFF_COLUMNS = "id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id";
+/**
+ * Save a session handoff record. Returns the persisted handoff.
+ */
+export declare function saveSessionHandoff(hippoRoot: string, tenantId: string, handoff: Omit<SessionHandoff, 'updatedAt'>): SessionHandoff;
+/** Load the most recent handoff, optionally filtered by session ID. */
+export declare function loadLatestHandoff(hippoRoot: string, tenantId: string, sessionId?: string, opts?: {
+    unfinishedOnly?: boolean;
+    maxAgeMs?: number;
+    scopeFilter?: 'default-deny';
+    excludeSessionId?: string;
+}): SessionHandoff | null;
+/**
+ * Load a specific handoff by its row ID.
+ */
+export declare function loadHandoffById(hippoRoot: string, tenantId: string, id: number): SessionHandoff | null;
+/** Stamp the outcome on a session's newest handoff, only if it has none yet. Returns rows changed. */
+export declare function stampHandoffOutcome(hippoRoot: string, tenantId: string, sessionId: string, outcome: HandoffOutcome): number;
+/** Auto-write a handoff at session-end (DF1 T3) from the session's active snapshot, else from `derived`, its transcript state.
+ * @param evidence best-effort git state; outcome comes from the newest session_complete event.
+ * @returns null when neither source is the session's, a newer handoff covers the snapshot, or the session's latest handoff was not read off its transcript. */
+export declare function writeSessionEndHandoff(hippoRoot: string, tenantId: string, sessionId: string, evidence: HandoffEvidence | null, derived?: Pick<TaskSnapshot, 'task' | 'summary' | 'next_step'> | null): SessionHandoff | null;
+//# sourceMappingURL=handoffs.d.ts.map