hippo-memory 1.61.0 → 1.62.0

package/dist/api/drill-down.js

@@ -42,16 +42,40 @@ export function drillDown(ctx, summaryId, opts = {}) {
         // already preventing. Match the HTTP behaviour at the API level.
         return { failure: 'not_found' };
     }
-    // v0.30 / E5: BFS walk levels 1..depth with visited-Set dedup. Defensive
-    // against shared-child data anomalies (dag_parent_id has no uniqueness
-    // constraint, so a misconfigured tree could double-emit at depth > 1).
-    // Each level uses loadChildrenOf which is tenant-scoped via ctx.tenantId.
+    const { collected, level0DirectCount } = collectDescendants(ctx, summaryId, depth);
+    const summaryOut = {
+        id: summary.id,
+        content: summary.content,
+        // v0.30 / E5: the STORED direct-child count; the legacy fallback counts
+        // level-0 children, never the BFS-depth-N total (independent-review MED #4).
+        descendantCount: summary.descendant_count ?? level0DirectCount,
+        earliestAt: summary.earliest_at ?? null,
+        latestAt: summary.latest_at ?? null,
+    };
+    const all = collected.map((c) => ({
+        id: c.id,
+        content: c.content,
+        layer: c.layer,
+        dagLevel: c.dag_level ?? 0,
+        created: c.created,
+    }));
+    const { children, truncated } = capChildren(all, summaryOut, opts, limit);
+    return {
+        summary: summaryOut,
+        children,
+        // v0.30 / E5: totalChildren = BFS-collected count (depth-aware). For
+        // depth=1 this equals the eligible direct-children count (backward
+        // compat). For depth>1 it is the cumulative count across levels.
+        totalChildren: collected.length,
+        truncated,
+    };
+}
+// BFS with a visited set: dag_parent_id is not unique, so a misconfigured tree could emit a child twice past depth 1.
+// The level-0 count is kept apart so a legacy summary's descendantCount fallback counts direct children only.
+function collectDescendants(ctx, summaryId, depth) {
     const collected = [];
     const visited = new Set([summaryId]);
     let frontier = [summaryId];
-    // independent-review MED #4 fold: track level-0 direct-children count
-    // separately so the descendantCount fallback (for legacy summaries with
-    // null descendant_count) reflects DIRECT children, not BFS-collected total.
     let level0DirectCount = 0;
     for (let level = 0; level < depth; level++) {
         const nextFrontier = [];
@@ -72,23 +96,10 @@ export function drillDown(ctx, summaryId, opts = {}) {
             break;
         frontier = nextFrontier;
     }
-    const summaryOut = {
-        id: summary.id,
-        content: summary.content,
-        // v0.30 / E5: the STORED direct-child count; the legacy fallback counts
-        // level-0 children, never the BFS-depth-N total (independent-review MED #4).
-        descendantCount: summary.descendant_count ?? level0DirectCount,
-        earliestAt: summary.earliest_at ?? null,
-        latestAt: summary.latest_at ?? null,
-    };
-    const all = collected.map((c) => ({
-        id: c.id,
-        content: c.content,
-        layer: c.layer,
-        dagLevel: c.dag_level ?? 0,
-        created: c.created,
-    }));
-    // Apply global cumulative token budget + limit cap on collected.
+    return { collected, level0DirectCount };
+}
+/** Global cumulative token budget first, then the `limit` cap. */
+function capChildren(all, summaryOut, opts, limit) {
     let children = all;
     let truncated = false;
     if (opts.budget !== undefined) {
@@ -110,14 +121,6 @@ export function drillDown(ctx, summaryId, opts = {}) {
         children = children.slice(0, limit);
         truncated = true;
     }
-    return {
-        summary: summaryOut,
-        children,
-        // v0.30 / E5: totalChildren = BFS-collected count (depth-aware). For
-        // depth=1 this equals the eligible direct-children count (backward
-        // compat). For depth>1 it is the cumulative count across levels.
-        totalChildren: collected.length,
-        truncated,
-    };
+    return { children, truncated };
 }
 //# sourceMappingURL=drill-down.js.map

package/dist/api/promote.js

@@ -47,19 +47,7 @@ export function promote(ctx, id) {
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
 export function supersede(ctx, oldId, newContent) {
-    // Read old (tenant-scoped). readEntry filters by tenantId, so a Bearer for
-    // tenant A on tenant B's id throws "Memory not found" here without any
-    // info leak.
-    const old = readEntry(ctx.hippoRoot, oldId, ctx.tenantId);
-    if (!old) {
-        throw new NotFoundError(`Memory not found: ${oldId}`);
-    }
-    // Guard: not already superseded. The CAS UPDATE below race-safely closes
-    // the window between this read and the write; this check just produces a
-    // clearer error in the common single-writer case.
-    if (old.superseded_by) {
-        throw new ConflictError(`Memory ${oldId} is already superseded by ${old.superseded_by}. Supersede that one instead.`);
-    }
+    const old = readSupersedable(ctx, oldId);
     const newEntry = createSuccessor(old, newContent, {
         tenantId: ctx.tenantId,
         baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
@@ -72,59 +60,7 @@ export function supersede(ctx, oldId, newContent) {
     // the old.superseded_by pointer.
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            // 1. CAS update: only succeed if old.superseded_by IS NULL AND the
-            //    row still belongs to ctx.tenantId. Tenant filter is belt-and-
-            //    braces with the readEntry above — it costs nothing and closes
-            //    a hypothetical window where ownership changes between read and
-            //    update.
-            const result = db.prepare(`
-        UPDATE memories
-        SET superseded_by = ?
-        WHERE id = ? AND tenant_id = ? AND superseded_by IS NULL
-      `).run(newEntry.id, oldId, ctx.tenantId);
-            if ((result.changes ?? 0) === 0) {
-                db.exec('ROLLBACK');
-                throw new ConflictError(`Memory ${oldId} already superseded by another writer`);
-            }
-            // v0.30 / E2 — DAG live-coupling: OLD entry just transitioned to
-            // superseded. Its parent (if any) needs rebuild. Lands strictly
-            // between the rollback guard above and the writeEntryDbOnly(NEW)
-            // below so a failed CAS hits throw before this hook. The NEW
-            // entry's parent (typically same parent) is auto-marked by the
-            // writeEntryDbOnly hook (same parent → idempotent, audits once).
-            if (old.dag_parent_id) {
-                markSummaryDirtyInTx(db, old.dag_parent_id, ctx.tenantId, ctx.actor.subject);
-            }
-            // 2. Write new memory inside same tx via writeEntryDbOnly (DB-only
-            //    path). This emits its OWN 'remember' audit row for the new
-            //    memory inside the SAVEPOINT — atomic with the row INSERT.
-            writeEntryDbOnly(db, stampOriginProject(ctx.hippoRoot, newEntry), { actor: ctx.actor.subject });
-            // 3. User-facing 'supersede' audit row inside the same tx so the
-            //    chain pointer + audit trail commit atomically.
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'supersede',
-                targetId: oldId,
-                metadata: { newId: newEntry.id },
-            });
-            db.exec('COMMIT');
-        }
-        catch (err) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* already rolled back */ }
-            // AT1 (plan §3): refusal audit lands post-ROLLBACK, in a fresh
-            // implicit transaction the aborted outer one cannot claw back — then
-            // rethrow so the caller sees the refusal.
-            if (err instanceof RejectedValueError) {
-                auditRejectionRefusal(db, err, ctx.actor.subject);
-            }
-            throw err;
-        }
+        commitSupersede(db, ctx, oldId, old, newEntry);
         // Mirrors after COMMIT, while the db handle is still open. Same
         // invariant as the original writeEntry: a mirror failure leaves disk
         // MISSING the markdown for the new memory (rebuildIndex rewrites every
@@ -142,6 +78,59 @@ export function supersede(ctx, oldId, newContent) {
     }
     return { ok: true, oldId, newId: newEntry.id };
 }
+/** The tenant-scoped row to supersede; readEntry's tenant filter makes another tenant's id read as not found. */
+function readSupersedable(ctx, oldId) {
+    const old = readEntry(ctx.hippoRoot, oldId, ctx.tenantId);
+    if (!old) {
+        throw new NotFoundError(`Memory not found: ${oldId}`);
+    }
+    // The CAS UPDATE closes the race; this check only gives a clearer error in the common single-writer case.
+    if (old.superseded_by) {
+        throw new ConflictError(`Memory ${oldId} is already superseded by ${old.superseded_by}. Supersede that one instead.`);
+    }
+    return old;
+}
+/** CAS on the old row, the successor's insert and the 'supersede' audit row, in one BEGIN IMMEDIATE transaction. */
+function commitSupersede(db, ctx, oldId, old, newEntry) {
+    db.exec('BEGIN IMMEDIATE');
+    try {
+        // The tenant filter repeats readEntry's check at no cost, closing an ownership change between read and update.
+        const result = db.prepare(`
+      UPDATE memories
+      SET superseded_by = ?
+      WHERE id = ? AND tenant_id = ? AND superseded_by IS NULL
+    `).run(newEntry.id, oldId, ctx.tenantId);
+        if ((result.changes ?? 0) === 0) {
+            db.exec('ROLLBACK');
+            throw new ConflictError(`Memory ${oldId} already superseded by another writer`);
+        }
+        // After the CAS guard, so a lost race throws before the old parent is marked for rebuild.
+        if (old.dag_parent_id) {
+            markSummaryDirtyInTx(db, old.dag_parent_id, ctx.tenantId, ctx.actor.subject);
+        }
+        // Emits its own 'remember' audit row inside the same transaction.
+        writeEntryDbOnly(db, stampOriginProject(ctx.hippoRoot, newEntry), { actor: ctx.actor.subject });
+        appendAuditEvent(db, {
+            tenantId: ctx.tenantId,
+            actor: ctx.actor.subject,
+            op: 'supersede',
+            targetId: oldId,
+            metadata: { newId: newEntry.id },
+        });
+        db.exec('COMMIT');
+    }
+    catch (err) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { /* already rolled back */ }
+        // The refusal audit lands after ROLLBACK, in a fresh implicit transaction the aborted one cannot undo.
+        if (err instanceof RejectedValueError) {
+            auditRejectionRefusal(db, err, ctx.actor.subject);
+        }
+        throw err;
+    }
+}
 export function archiveRaw(ctx, id, reason, opts = {}) {
     const db = openHippoDb(ctx.hippoRoot);
     let mirrorOk = false;