hippo-memory 1.68.0 → 1.70.0

package/dist/db/migrate.js

@@ -1,7 +1,7 @@
-import { PACKAGE_VERSION, compareSemver } from '../version.js';
-import { log } from '../log.js';
-import { importLegacyEmbeddingIndex } from '../vector-store.js';
-import { execWithBusyRetry } from './busy.js';
+import { PACKAGE_VERSION, compareSemver } from '../util/version.js';
+import { errorMessage, log } from '../util/log.js';
+import { importLegacyEmbeddingIndex } from './vector-store.js';
+import { execWithBusyRetry, withWriteScope } from './busy.js';
 import { tableExists } from './tables.js';
 import { ensureMetaTable, getMeta, getSchemaVersion, setMeta, setSchemaVersion } from './meta.js';
 import { MEMORIES_FTS_DDL, REQUIRED_SCHEMA_OBJECTS, ensureContinuityIndexes, ensureContinuityTables } from './continuity.js';
@@ -40,34 +40,40 @@ export const SCHEMA_PROBE_SQL = `SELECT
   (SELECT value FROM meta WHERE key = 'min_compatible_binary') AS min_binary,
   (SELECT value FROM meta WHERE key = 'fts5_available') AS fts5,
   (SELECT COUNT(*) FROM meta WHERE key IN (${sqlList(META_DEFAULTS.map(([key]) => key))})) AS meta_keys,
-  (SELECT COUNT(*) FROM sqlite_master WHERE type IN ('table', 'index') AND name IN (${sqlList(REQUIRED_SCHEMA_OBJECTS)})) AS objects`;
-/** True when the store is current and whole, so the open can skip every DDL statement. Runs the binary check either way. */
-function schemaIsCurrent(db) {
+  (SELECT COUNT(*) FROM sqlite_master WHERE type IN ('table', 'index') AND name IN (${sqlList(REQUIRED_SCHEMA_OBJECTS)})) AS objects,
+  (SELECT MAX(id) FROM raw_archive) AS archive_top,
+  (SELECT 1 FROM memories LIMIT 1) AS has_memories`;
+/** The probe's facts when the store is current and whole, so the open can skip every DDL statement; else null. Runs the binary check either way. */
+function currentStoreFacts(db) {
     let probe;
     try {
-        // SAFETY: the SELECT names exactly these six columns and always returns one row.
+        // SAFETY: the SELECT names exactly these eight columns and always returns one row.
         probe = db.prepare(SCHEMA_PROBE_SQL).get();
     }
     catch (err) {
-        // A store with no meta table yet is the slow path's job; anything else is a real error.
-        if (err instanceof Error && /no such table: meta/.test(err.message))
-            return false;
+        // A store missing a table the probe reads is the slow path's job; anything else is a real error.
+        if (err instanceof Error && /no such table: (meta|raw_archive|memories)\b/.test(err.message))
+            return null;
         throw err;
     }
     if (!probe)
-        return false;
+        return null;
     assertMinBinary(probe.min_binary);
-    return Number(probe.user_version) === CURRENT_SCHEMA_VERSION
+    const current = Number(probe.user_version) === CURRENT_SCHEMA_VERSION
         && Number(probe.schema_version) === CURRENT_SCHEMA_VERSION
         && Number(probe.meta_keys) === META_DEFAULTS.length
         && Number(probe.objects) === REQUIRED_SCHEMA_OBJECTS.length
         && probe.fts5 === '1';
+    return current ? { archiveTop: Number(probe.archive_top ?? 0), hasMemories: probe.has_memories !== null } : null;
 }
+/** Brings the store to the current schema; returns the probe's facts when it was current already, null after any repair. */
 export function runMigrations(db, hippoRoot, busyWaitMs) {
-    if (!schemaIsCurrent(db))
+    const facts = currentStoreFacts(db);
+    if (!facts)
         migrateAndHeal(db, hippoRoot, busyWaitMs);
     if (hippoRoot)
         importLegacyVectors(db, hippoRoot);
+    return facts;
 }
 function migrateAndHeal(db, hippoRoot, busyWaitMs) {
     ensureMetaTable(db);
@@ -88,29 +94,18 @@ function migrateAndHeal(db, hippoRoot, busyWaitMs) {
 }
 /** Applies one migration under the write lock and returns the version the store is now at. */
 function applyMigration(db, migration, hippoRoot, busyWaitMs) {
-    execWithBusyRetry(db, 'BEGIN IMMEDIATE', busyWaitMs);
-    try {
+    return withWriteScope(db, 'apply_migration', () => {
         // A newer binary may have migrated and raised the minimum while we waited for the lock.
         assertBinaryCompatible(db);
         // Re-read under the write lock: another process may have applied this
         // migration while we waited, and re-running one is not idempotent.
         const applied = getSchemaVersion(db);
-        if (applied >= migration.version) {
-            db.exec('COMMIT');
+        if (applied >= migration.version)
             return applied;
-        }
         migration.up(db, { hippoRoot });
         setSchemaVersion(db, migration.version);
-        db.exec('COMMIT');
         return migration.version;
-    }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* already rolled back; keep the original error */ }
-        throw error;
-    }
+    }, { busyWaitMs });
 }
 // The fast path requires user_version as well, and a store stamped only in meta would otherwise never reach it.
 function healUserVersion(db, version, busyWaitMs) {
@@ -126,7 +121,7 @@ function importLegacyVectors(db, hippoRoot) {
         importLegacyEmbeddingIndex(db, hippoRoot);
     }
     catch (err) {
-        log.warn(`embeddings.json import failed; the next open retries it (${err instanceof Error ? err.message : String(err)})`, { hippoRoot });
+        log.warn(`embeddings.json import failed; the next open retries it (${errorMessage(err)})`, { hippoRoot });
     }
 }
 function ensureMetaDefaults(db) {
@@ -154,7 +149,7 @@ function ensureOptionalFts(db) {
         available = true;
     }
     catch (err) {
-        log.warn(`full-text index unavailable (${err instanceof Error ? err.message : String(err)}); search falls back to slower LIKE matching`);
+        log.warn(`full-text index unavailable (${errorMessage(err)}); search falls back to slower LIKE matching`);
     }
     // Read-first: only write when the flag actually changed, so a healthy
     // store's open doesn't take a write lock for a same-value upsert.

package/dist/db/migrations/v08.js

@@ -1,4 +1,4 @@
-import { createPhysicsTable } from '../../physics-state.js';
+import { createPhysicsTable } from '../physics-state.js';
 export const v08 = {
     version: 8,
     up: (db) => {

package/dist/db/migrations/v14.js

@@ -1,4 +1,38 @@
 import { tableHasColumn } from '../tables.js';
+const CREATE_TABLE_RAW_ARCHIVE_SQL = `
+        CREATE TABLE IF NOT EXISTS raw_archive (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          memory_id TEXT NOT NULL,
+          archived_at TEXT NOT NULL,
+          reason TEXT NOT NULL,
+          archived_by TEXT,
+          payload_json TEXT NOT NULL
+        )
+      `;
+const CREATE_TRIGGER_TRG_MEMORIES_RAW_APPEND_ONLY_SQL = `
+        CREATE TRIGGER IF NOT EXISTS trg_memories_raw_append_only
+        BEFORE DELETE ON memories
+        WHEN OLD.kind = 'raw'
+        BEGIN
+          SELECT RAISE(ABORT, 'raw is append-only');
+        END
+      `;
+const CREATE_TRIGGER_TRG_MEMORIES_KIND_CHECK_INSERT_SQL = `
+        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_insert
+        BEFORE INSERT ON memories
+        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
+        BEGIN
+          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
+        END
+      `;
+const CREATE_TRIGGER_TRG_MEMORIES_KIND_CHECK_UPDATE_SQL = `
+        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_update
+        BEFORE UPDATE ON memories
+        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
+        BEGIN
+          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
+        END
+      `;
 export const v14 = {
     version: 14,
     up: (db) => {
@@ -22,45 +56,15 @@ export const v14 = {
         db.exec(`UPDATE memories SET kind = 'superseded' WHERE kind IS NULL AND superseded_by IS NOT NULL`);
         db.exec(`UPDATE memories SET kind = 'distilled' WHERE kind IS NULL`);
         // raw_archive: legitimate path for kind='raw' removal (used by archiveRawMemory).
-        db.exec(`
-        CREATE TABLE IF NOT EXISTS raw_archive (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          memory_id TEXT NOT NULL,
-          archived_at TEXT NOT NULL,
-          reason TEXT NOT NULL,
-          archived_by TEXT,
-          payload_json TEXT NOT NULL
-        )
-      `);
+        db.exec(CREATE_TABLE_RAW_ARCHIVE_SQL);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_raw_archive_memory_id ON raw_archive(memory_id)`);
         // Append-only invariant: kind='raw' rows cannot be deleted directly.
-        // Use raw_archive flow: archive-then-update-then-delete (see src/raw-archive.ts).
-        db.exec(`
-        CREATE TRIGGER IF NOT EXISTS trg_memories_raw_append_only
-        BEFORE DELETE ON memories
-        WHEN OLD.kind = 'raw'
-        BEGIN
-          SELECT RAISE(ABORT, 'raw is append-only');
-        END
-      `);
+        // Use raw_archive flow: archive-then-update-then-delete (see src/store/raw-archive.ts).
+        db.exec(CREATE_TRIGGER_TRG_MEMORIES_RAW_APPEND_ONLY_SQL);
         // CHECK substitute: ALTER TABLE cannot add CHECK, so enforce kind allowed-set
         // via INSERT/UPDATE triggers.
-        db.exec(`
-        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_insert
-        BEFORE INSERT ON memories
-        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
-        BEGIN
-          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
-        END
-      `);
-        db.exec(`
-        CREATE TRIGGER IF NOT EXISTS trg_memories_kind_check_update
-        BEFORE UPDATE ON memories
-        WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN ('raw','distilled','superseded','archived')
-        BEGIN
-          SELECT RAISE(ABORT, 'invalid kind: must be raw|distilled|superseded|archived');
-        END
-      `);
+        db.exec(CREATE_TRIGGER_TRG_MEMORIES_KIND_CHECK_INSERT_SQL);
+        db.exec(CREATE_TRIGGER_TRG_MEMORIES_KIND_CHECK_UPDATE_SQL);
     },
 };
 //# sourceMappingURL=v14.js.map

package/dist/db/migrations/v16.js

@@ -1,4 +1,30 @@
 import { tableHasColumn } from '../tables.js';
+const CREATE_TABLE_API_KEYS_SQL = `
+        CREATE TABLE IF NOT EXISTS api_keys (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          key_id TEXT UNIQUE NOT NULL,
+          key_hash TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          label TEXT,
+          created_at TEXT NOT NULL,
+          revoked_at TEXT
+        )
+      `;
+const CREATE_INDEX_IDX_API_KEYS_TENANT_ACTIVE_SQL = `
+        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
+        ON api_keys(tenant_id) WHERE revoked_at IS NULL
+      `;
+const CREATE_TABLE_AUDIT_LOG_SQL = `
+        CREATE TABLE IF NOT EXISTS audit_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          actor TEXT NOT NULL,
+          op TEXT NOT NULL,
+          target_id TEXT,
+          metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
+      `;
 export const v16 = {
     version: 16,
     up: (db) => {
@@ -28,32 +54,9 @@ export const v16 = {
         // Stub auth: api_keys (scrypt-hashed; plaintext returned to caller exactly once)
         // and audit_log (append-only mutation trail). Both carry tenant_id from day 1 so
         // future multi-tenant enforcement is a config flip, not a re-migration.
-        db.exec(`
-        CREATE TABLE IF NOT EXISTS api_keys (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          key_id TEXT UNIQUE NOT NULL,
-          key_hash TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          label TEXT,
-          created_at TEXT NOT NULL,
-          revoked_at TEXT
-        )
-      `);
-        db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_api_keys_tenant_active
-        ON api_keys(tenant_id) WHERE revoked_at IS NULL
-      `);
-        db.exec(`
-        CREATE TABLE IF NOT EXISTS audit_log (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          ts TEXT NOT NULL,
-          tenant_id TEXT NOT NULL DEFAULT 'default',
-          actor TEXT NOT NULL,
-          op TEXT NOT NULL,
-          target_id TEXT,
-          metadata_json TEXT NOT NULL DEFAULT '{}'
-        )
-      `);
+        db.exec(CREATE_TABLE_API_KEYS_SQL);
+        db.exec(CREATE_INDEX_IDX_API_KEYS_TENANT_ACTIVE_SQL);
+        db.exec(CREATE_TABLE_AUDIT_LOG_SQL);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_ts ON audit_log(tenant_id, ts DESC)`);
     },
 };

package/dist/db/migrations/v18.js

@@ -1,7 +1,4 @@
-export const v18 = {
-    version: 18,
-    up: (db) => {
-        db.exec(`
+const GOAL_STACK_SCHEMA_SQL = `
         CREATE TABLE IF NOT EXISTS goal_stack (
           id TEXT PRIMARY KEY,
           session_id TEXT NOT NULL,
@@ -54,7 +51,11 @@ export const v18 = {
           ON goal_recall_log(goal_id);
         CREATE UNIQUE INDEX IF NOT EXISTS uniq_goal_recall_log_memory_goal
           ON goal_recall_log(memory_id, goal_id);
-      `);
+      `;
+export const v18 = {
+    version: 18,
+    up: (db) => {
+        db.exec(GOAL_STACK_SCHEMA_SQL);
     },
 };
 //# sourceMappingURL=v18.js.map

package/dist/db/migrations/v20.js

@@ -1,9 +1,10 @@
+import { warnDamagedColumn } from '../../util/stored-json.js';
 export const v20 = {
     version: 20,
     up: (db) => {
         // GDPR Path A backfill: redact every existing
         // raw_archive.payload_json so historical archives match the new
-        // metadata-only contract from src/raw-archive.ts. Read each row, parse
+        // metadata-only contract from src/store/raw-archive.ts. Read each row, parse
         // the existing JSON to extract tenant_id and kind (best effort), then
         // UPDATE with the redacted shape. Rows with unparseable legacy JSON get
         // redacted with tenant_id='unknown', kind='unknown'. The audit_log
@@ -25,7 +26,8 @@ export const v20 = {
                 kind = parsed.kind ?? 'unknown';
             }
             catch {
-                // Unparseable legacy payload — redact with unknowns.
+                // The row is still redacted, with unknowns; the line says which one lost its tenant and kind.
+                warnDamagedColumn({ table: 'raw_archive', id: row.id, column: 'payload_json' }, 'not valid JSON');
             }
             const redacted = JSON.stringify({
                 redacted: true,

package/dist/db/migrations/v22.js

@@ -1,19 +1,5 @@
 import { tableHasColumn } from '../tables.js';
-export const v22 = {
-    version: 22,
-    up: (db) => {
-        // session_events and session_handoffs predate the v16 tenant migration and were
-        // never added to it: a cross-tenant leak whenever continuity primitives are used.
-        // Adds tenant_id (NOT NULL DEFAULT 'default') with smart backfill from
-        // task_snapshots.session_id when unambiguous, plus an optional scope
-        // column so a private-channel-derived handoff can default-deny via the
-        // same rule recall already enforces.
-        //
-        // Self-heal partial-init stores: re-run the v4/v5 CREATE TABLE IF NOT
-        // EXISTS bodies before ALTERing. A silent skip would otherwise stamp
-        // schema_version=22 on a DB missing the underlying tables, leaving
-        // them permanently absent.
-        db.exec(`
+const CREATE_TABLE_SESSION_EVENTS_SQL = `
         CREATE TABLE IF NOT EXISTS session_events (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           session_id TEXT NOT NULL,
@@ -34,7 +20,42 @@ export const v22 = {
           artifacts_json TEXT NOT NULL DEFAULT '[]',
           created_at TEXT NOT NULL
         );
-      `);
+      `;
+const BACKFILL_SESSION_EVENTS_TENANT_SQL = `
+        UPDATE session_events
+           SET tenant_id = (
+             SELECT MAX(t.tenant_id) FROM task_snapshots t
+              WHERE t.session_id = session_events.session_id
+           )
+         WHERE tenant_id = 'default'
+           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
+                 WHERE t.session_id = session_events.session_id) = 1
+      `;
+const BACKFILL_SESSION_HANDOFFS_TENANT_SQL = `
+        UPDATE session_handoffs
+           SET tenant_id = (
+             SELECT MAX(t.tenant_id) FROM task_snapshots t
+              WHERE t.session_id = session_handoffs.session_id
+           )
+         WHERE tenant_id = 'default'
+           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
+                 WHERE t.session_id = session_handoffs.session_id) = 1
+      `;
+export const v22 = {
+    version: 22,
+    up: (db) => {
+        // session_events and session_handoffs predate the v16 tenant migration and were
+        // never added to it: a cross-tenant leak whenever continuity primitives are used.
+        // Adds tenant_id (NOT NULL DEFAULT 'default') with smart backfill from
+        // task_snapshots.session_id when unambiguous, plus an optional scope
+        // column so a private-channel-derived handoff can default-deny via the
+        // same rule recall already enforces.
+        //
+        // Self-heal partial-init stores: re-run the v4/v5 CREATE TABLE IF NOT
+        // EXISTS bodies before ALTERing. A silent skip would otherwise stamp
+        // schema_version=22 on a DB missing the underlying tables, leaving
+        // them permanently absent.
+        db.exec(CREATE_TABLE_SESSION_EVENTS_SQL);
         if (!tableHasColumn(db, 'session_events', 'tenant_id')) {
             db.exec(`ALTER TABLE session_events ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
         }
@@ -53,26 +74,8 @@ export const v22 = {
         // tenant boundaries on guesses. The COUNT(DISTINCT) gate is the load-
         // bearing check; without it, rows with multiple tenants under the same
         // session_id would silently pick whichever group came first.
-        db.exec(`
-        UPDATE session_events
-           SET tenant_id = (
-             SELECT MAX(t.tenant_id) FROM task_snapshots t
-              WHERE t.session_id = session_events.session_id
-           )
-         WHERE tenant_id = 'default'
-           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
-                 WHERE t.session_id = session_events.session_id) = 1
-      `);
-        db.exec(`
-        UPDATE session_handoffs
-           SET tenant_id = (
-             SELECT MAX(t.tenant_id) FROM task_snapshots t
-              WHERE t.session_id = session_handoffs.session_id
-           )
-         WHERE tenant_id = 'default'
-           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
-                 WHERE t.session_id = session_handoffs.session_id) = 1
-      `);
+        db.exec(BACKFILL_SESSION_EVENTS_TENANT_SQL);
+        db.exec(BACKFILL_SESSION_HANDOFFS_TENANT_SQL);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`);
     },

package/dist/db/migrations/v24.js

@@ -1,9 +1,4 @@
-export const v24 = {
-    version: 24,
-    up: (db) => {
-        // GitHub connector schema.
-        // Six tables + a min_compatible_binary meta row for rollback safety.
-        db.exec(`
+const CREATE_TABLE_GITHUB_EVENT_LOG_SQL = `
         CREATE TABLE IF NOT EXISTS github_event_log (
           idempotency_key TEXT PRIMARY KEY,
           delivery_id TEXT NOT NULL,
@@ -11,10 +6,8 @@ export const v24 = {
           ingested_at TEXT NOT NULL,
           memory_id TEXT
         )
-      `);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_CURSORS_SQL = `
         CREATE TABLE IF NOT EXISTS github_cursors (
           tenant_id TEXT NOT NULL,
           repo_full_name TEXT NOT NULL,
@@ -24,8 +17,8 @@ export const v24 = {
           updated_at TEXT NOT NULL,
           PRIMARY KEY (tenant_id, repo_full_name)
         )
-      `);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_DLQ_SQL = `
         CREATE TABLE IF NOT EXISTS github_dlq (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           tenant_id TEXT NOT NULL,
@@ -41,27 +34,39 @@ export const v24 = {
           retried_at TEXT,
           bucket TEXT NOT NULL DEFAULT 'parse_error'
         )
-      `);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_INSTALLATIONS_SQL = `
         CREATE TABLE IF NOT EXISTS github_installations (
           installation_id TEXT PRIMARY KEY,
           tenant_id TEXT NOT NULL,
           added_at TEXT NOT NULL
         )
-      `);
-        // PAT-mode multi-tenant routing. Maps repo_full_name to
-        // tenant when the webhook envelope has no `installation` field. Composite
-        // PK so the same repo can intentionally be visible to multiple tenants
-        // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_REPOSITORIES_SQL = `
         CREATE TABLE IF NOT EXISTS github_repositories (
           repo_full_name TEXT NOT NULL,
           tenant_id TEXT NOT NULL,
           added_at TEXT NOT NULL,
           PRIMARY KEY (repo_full_name, tenant_id)
         )
-      `);
+      `;
+export const v24 = {
+    version: 24,
+    up: (db) => {
+        // GitHub connector schema.
+        // Six tables + a min_compatible_binary meta row for rollback safety.
+        db.exec(CREATE_TABLE_GITHUB_EVENT_LOG_SQL);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
+        db.exec(CREATE_TABLE_GITHUB_CURSORS_SQL);
+        db.exec(CREATE_TABLE_GITHUB_DLQ_SQL);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
+        db.exec(CREATE_TABLE_GITHUB_INSTALLATIONS_SQL);
+        // PAT-mode multi-tenant routing. Maps repo_full_name to
+        // tenant when the webhook envelope has no `installation` field. Composite
+        // PK so the same repo can intentionally be visible to multiple tenants
+        // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
+        db.exec(CREATE_TABLE_GITHUB_REPOSITORIES_SQL);
         // Rollback-safety guard: an older binary lacks the *:private:* default-deny and would leak
         // github:private:* rows; the startup guard refuses a DB whose min_compatible_binary is newer.
         db.prepare(`INSERT INTO meta(key, value) VALUES('min_compatible_binary', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run('1.2.1');

package/dist/db/migrations/v29.js

@@ -1,24 +1,5 @@
 import { tableExists } from '../tables.js';
-export const v29 = {
-    version: 29,
-    up: (db) => {
-        // Prediction first-class object: a predictions table for the reference-class /
-        // planning-fallacy detector. Predictions
-        // duplicate claim_text in the table itself so memory deletion
-        // (forget/consolidate/archive) does not lose prediction data; FK
-        // memory_id is NULLABLE with ON DELETE SET NULL.
-        //
-        // Cross-tenant safety: BEFORE INSERT + BEFORE UPDATE triggers
-        // enforce tenant_id match against the referenced memory. SQLite's
-        // ON DELETE SET NULL is incompatible with composite FK where one
-        // side is NOT NULL, so the trigger pattern replaces a composite
-        // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
-        //
-        // CHECK constraint pins closure_state to (open|closed|closed-unknown).
-        // Accuracy (clean vs regressed) is computed from (estimate_value,
-        // actual_value) at query time.
-        if (!tableExists(db, 'predictions')) {
-            db.exec(`
+const CREATE_TABLE_PREDICTIONS_SQL = `
           CREATE TABLE predictions (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             memory_id TEXT,
@@ -36,19 +17,16 @@ export const v29 = {
             created_at TEXT NOT NULL,
             FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
           )
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_PREDICTIONS_TENANT_CLASS_SQL = `
           CREATE INDEX IF NOT EXISTS idx_predictions_tenant_class
           ON predictions(tenant_id, class_tag, closure_state)
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_PREDICTIONS_MEMORY_SQL = `
           CREATE INDEX IF NOT EXISTS idx_predictions_memory
           ON predictions(memory_id) WHERE memory_id IS NOT NULL
-        `);
-            // Cross-tenant safety: tenant_id must match the referenced memory's
-            // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
-            // v14 memories.kind enforcement (db.ts:298-322).
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_INSERT_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_insert
           BEFORE INSERT ON predictions
           WHEN NEW.memory_id IS NOT NULL
@@ -58,8 +36,8 @@ export const v29 = {
               THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_UPDATE_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_update
           BEFORE UPDATE ON predictions
           WHEN NEW.memory_id IS NOT NULL
@@ -70,7 +48,34 @@ export const v29 = {
               THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
+        `;
+export const v29 = {
+    version: 29,
+    up: (db) => {
+        // Prediction first-class object: a predictions table for the reference-class /
+        // planning-fallacy detector. Predictions
+        // duplicate claim_text in the table itself so memory deletion
+        // (forget/consolidate/archive) does not lose prediction data; FK
+        // memory_id is NULLABLE with ON DELETE SET NULL.
+        //
+        // Cross-tenant safety: BEFORE INSERT + BEFORE UPDATE triggers
+        // enforce tenant_id match against the referenced memory. SQLite's
+        // ON DELETE SET NULL is incompatible with composite FK where one
+        // side is NOT NULL, so the trigger pattern replaces a composite
+        // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
+        //
+        // CHECK constraint pins closure_state to (open|closed|closed-unknown).
+        // Accuracy (clean vs regressed) is computed from (estimate_value,
+        // actual_value) at query time.
+        if (!tableExists(db, 'predictions')) {
+            db.exec(CREATE_TABLE_PREDICTIONS_SQL);
+            db.exec(CREATE_INDEX_IDX_PREDICTIONS_TENANT_CLASS_SQL);
+            db.exec(CREATE_INDEX_IDX_PREDICTIONS_MEMORY_SQL);
+            // Cross-tenant safety: tenant_id must match the referenced memory's
+            // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
+            // v14 memories.kind enforcement (db.ts:298-322).
+            db.exec(CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_INSERT_SQL);
+            db.exec(CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_UPDATE_SQL);
         }
     },
 };