hippo-memory 1.68.0 → 1.70.0

package/dist/store/search-rows.js

@@ -1,14 +1,13 @@
-import { envForceLikePath } from '../env.js';
-import { isFtsAvailable, closeHippoDb } from '../db.js';
-import { tokenize } from '../tokenize.js';
-import { isPersonalScope, scopeAdmitSql } from '../recall-scope.js';
-import { RAREST_TERM_COUNT, rarestPromptTerms } from '../prompt-recall.js';
-import { log } from '../log.js';
-import { originInSql } from '../project-identity.js';
-import { topVectorMatches } from '../vector-store.js';
+import { isFtsAvailable, closeHippoDb } from '../db/index.js';
+import { tokenize } from '../util/tokenize.js';
+import { isPersonalScope, scopeAdmitSql } from './recall-scope.js';
+import { ftsTermParts, RAREST_TERM_COUNT, rarestFtsQuery } from '../core/prompt-recall.js';
+import { errorMessage, log } from '../util/log.js';
+import { originInSql } from '../core/project-identity.js';
+import { topVectorMatches } from '../db/vector-store.js';
 import { MEMORY_SELECT_COLUMNS, MEMORY_SEARCH_COLUMNS, DEFAULT_SEARCH_CANDIDATE_LIMIT, rowToEntry, } from './rows.js';
 import { openStore } from './open.js';
-import { escapeLike } from '../escape.js';
+import { escapeLike } from '../util/escape.js';
 /** The recall scope rule for a table column prefix (`m.` or none); `passesScopeFilterForRecall` in recall-scope.ts is its JS twin. */
 function recallScopeClause(col, scopeFilter) {
     if (scopeFilter === undefined)
@@ -36,16 +35,20 @@ export function recallScopeFilter(requestedScope, mode, ownScope) {
     return mode === 'additive' ? { mode: 'default-deny-or-exact', value: requestedScope, ownScope } : { mode: 'exact', value: requestedScope };
 }
 const FTS_QUERY_SYNTAX_RE = /fts5: syntax error|unterminated string/i;
-function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSuperseded = true, originProjects) {
+let forceLikePath = false;
+/** Sends term queries down the LIKE path on a build that has FTS. Only tests call it. */
+export function _forceLikePathForTests(on) {
+    forceLikePath = on;
+}
+function loadSearchRows(db, query, limit, tenantId, options = {}) {
+    const { scopeFilter, includeSuperseded = true, originProjects } = options;
     const p = searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjects);
     const terms = Array.from(new Set(tokenize(query)));
     if (terms.length === 0) {
         // LIMIT here too, so every candidate path honours the caller's cap.
         return selectAllCandidates(db, p, limit);
     }
-    // `HIPPO_FORCE_LIKE_PATH=1` forces the LIKE path for tests; gated at this read site so
-    // writes keep using `isFtsAvailable` and never silently skip FTS index sync.
-    const forceLikePath = envForceLikePath();
+    // The test switch is read here, not in `isFtsAvailable`, so writes never skip FTS index sync.
     if (!forceLikePath && isFtsAvailable(db)) {
         const rows = selectFtsCandidates(db, terms, p, limit);
         if (rows.length > 0)
@@ -63,13 +66,11 @@ function searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjec
     // helpers). tenantId set = strict tenant isolation, leveraging the composite
     // idx_memories_tenant_created (leading column tenant_id, O(log n) lookup).
     const tenantPredicate = tenantId !== undefined ? ` AND m.tenant_id = ?` : '';
-    const tenantPredicateNoAlias = tenantId !== undefined ? ` AND tenant_id = ?` : '';
     const tenantOnlyPredicate = tenantId !== undefined ? ` WHERE tenant_id = ?` : '';
     const tenantParams = tenantId !== undefined ? [tenantId] : [];
     // Defensive: kind='archived' is a transient sentinel inside archiveRawMemory's SAVEPOINT, so this only
     // guards against a dropped SAVEPOINT, a persisted 'archived' state, or direct-SQL writes.
     const archivedClauseAlias = ` AND m.kind != 'archived'`;
-    const archivedClauseNoAlias = ` AND kind != 'archived'`;
     // For the "tenant-only" path: if no tenant set, tenantOnlyPredicate is '',
     // so prepend WHERE; if tenant set, append AND. handled in each call site
     // by always joining `tenantOnlyPredicate + archivedClauseTenantOnly` where
@@ -81,8 +82,8 @@ function searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjec
     const currentAlias = includeSuperseded ? '' : ' AND m.superseded_by IS NULL';
     const currentNoAlias = includeSuperseded ? '' : ' AND superseded_by IS NULL';
     return {
-        tenantPredicate, tenantPredicateNoAlias, tenantOnlyPredicate, tenantParams,
-        archivedClauseAlias, archivedClauseNoAlias, archivedClauseTenantOnly,
+        tenantPredicate, tenantOnlyPredicate, tenantParams,
+        archivedClauseAlias, archivedClauseTenantOnly,
         aliasScope, plainScope, scopeParams, currentAlias, currentNoAlias,
     };
 }
@@ -113,27 +114,37 @@ function selectFtsCandidates(db, terms, p, limit) {
     }
     catch (err) {
         // A query FTS5 cannot parse is expected input; anything else means the index itself is broken.
-        const message = err instanceof Error ? err.message : String(err);
+        const message = errorMessage(err);
         if (!FTS_QUERY_SYNTAX_RE.test(message))
             log.once('fts-match-fallback', 'warn', `FTS search failed, using the slower LIKE match: ${message}`);
         return [];
     }
 }
+/** Newest admitted rows the substring match tests, so a query matching nothing costs the same in a store of any size. */
+const LIKE_WINDOW_ROWS = 2000;
+/** Substring matches in content or tags among the newest admitted rows: the lexical path without FTS5, and the catch for a part-word that FTS5 tokens miss. */
 function selectLikeCandidates(db, terms, p, limit) {
     const where = terms.map(() => `(LOWER(content) LIKE ? ESCAPE '\\' OR LOWER(tags_json) LIKE ? ESCAPE '\\')`).join(' OR ');
     const params = terms.flatMap((term) => {
         const like = `%${escapeLike(term)}%`;
         return [like, like];
     });
-    // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-    // MemoryRow's field set.
+    // idx_memories_tenant_created serves a tenant's newest rows; with no tenant only the table's own order needs no sort.
+    const newestFirst = p.tenantParams.length > 0 ? 'created DESC' : 'rowid DESC';
+    // SHORTCUT: no index serves a substring, so a match older than the window is missed; an FTS5 trigram index is the upgrade.
+    // SAFETY: the outer query selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
     return db.prepare(`
     SELECT ${MEMORY_SELECT_COLUMNS}
-    FROM memories
-    WHERE (${where})${p.tenantPredicateNoAlias}${p.archivedClauseNoAlias}${p.plainScope.sql}${p.currentNoAlias}
+    FROM (
+      SELECT ${MEMORY_SELECT_COLUMNS}, updated_at
+      FROM memories${p.tenantOnlyPredicate}${p.archivedClauseTenantOnly}${p.plainScope.sql}${p.currentNoAlias}
+      ORDER BY ${newestFirst}
+      LIMIT ?
+    )
+    WHERE (${where})
     ORDER BY updated_at DESC, created DESC, content ASC, id ASC
     LIMIT ?
-  `).all(...params, ...p.tenantParams, ...p.scopeParams, limit);
+  `).all(...p.tenantParams, ...p.scopeParams, Math.max(limit, LIKE_WINDOW_ROWS), ...params, limit);
 }
 /**
  * Load likely search candidates directly from SQLite.
@@ -171,7 +182,7 @@ export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDI
 export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope) {
     const db = openStore(hippoRoot);
     try {
-        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects, ownScope);
+        return loadRecallSearchEntriesFromDb(db, query, { limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects, ownScope });
     }
     finally {
         closeHippoDb(db);
@@ -179,18 +190,20 @@ export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH
 }
 // Split out so callers with an already-open db (the prompt-recall path) skip
 // the initStore+open/close cycle per store per call.
-export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope) {
-    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode, ownScope), includeSuperseded, originProjects).map(rowToEntry);
+export function loadRecallSearchEntriesFromDb(db, query, options = {}) {
+    const { limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope } = options;
+    const scopeFilter = recallScopeFilter(requestedScope, explicitScopeMode, ownScope);
+    return loadSearchRows(db, query, limit, tenantId, { scopeFilter, includeSuperseded, originProjects }).map(rowToEntry);
 }
 /** The rows nearest `queryVector` that pass `spec`, nearest first. */
-export function loadVectorCandidateEntries(hippoRoot, queryVector, spec) {
+export async function loadVectorCandidateEntries(hippoRoot, queryVector, spec) {
     const scope = withProject(recallScopeClause('m.', spec.scope), 'm.', spec.origin);
     const tenant = spec.tenantId !== undefined ? ' AND m.tenant_id = ?' : '';
     const current = spec.includeSuperseded ? '' : ' AND m.superseded_by IS NULL';
     const params = [...(spec.tenantId !== undefined ? [spec.tenantId] : []), ...scope.params];
     const db = openStore(hippoRoot);
     try {
-        const matches = topVectorMatches(db, queryVector, spec.limit ?? 50, `${tenant} AND m.kind != 'archived'${scope.sql}${current}`, params);
+        const matches = await topVectorMatches(db, queryVector, spec.limit ?? 50, `${tenant} AND m.kind != 'archived'${scope.sql}${current}`, params);
         if (matches.length === 0)
             return [];
         // SAFETY: the SELECT names exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
@@ -210,9 +223,7 @@ export function pickRarestFtsQuery(db, terms, maxTerms = RAREST_TERM_COUNT) {
     if (!isFtsAvailable(db))
         return terms.slice(0, 32).join(' ');
     db.exec(`CREATE VIRTUAL TABLE IF NOT EXISTS temp.z1_rarest_vocab USING fts5vocab(main, 'memories_fts', 'row')`);
-    // unicode61 splits `journal_mode` into two vocab terms; a term's count is its rarest part's (an upper bound).
-    const partsOf = (t) => t.split(/[^\p{L}\p{N}]+/u).filter(Boolean);
-    const vocab = Array.from(new Set(terms.flatMap(partsOf)));
+    const vocab = Array.from(new Set(terms.flatMap(ftsTermParts)));
     if (vocab.length === 0)
         return '';
     // SAFETY: rows' shape matches the two columns named in the SELECT.
@@ -220,10 +231,6 @@ export function pickRarestFtsQuery(db, terms, maxTerms = RAREST_TERM_COUNT) {
         .prepare(`SELECT term, doc FROM temp.z1_rarest_vocab WHERE term IN (${vocab.map(() => '?').join(', ')})`)
         .all(...vocab);
     const counts = new Map(rows.map((r) => [r.term, r.doc]));
-    const docCount = (t) => {
-        const parts = partsOf(t);
-        return parts.length === 0 ? 0 : Math.min(...parts.map((x) => counts.get(x) ?? 0));
-    };
-    return rarestPromptTerms(terms, docCount, maxTerms).join(' ');
+    return rarestFtsQuery(terms, (part) => counts.get(part) ?? 0, maxTerms);
 }
 //# sourceMappingURL=search-rows.js.map

package/dist/store/sessions.d.ts

@@ -60,6 +60,11 @@ export declare function loadFreshActiveTaskSnapshot(hippoRoot: string, tenantId:
     maxAgeMs?: number;
     sessionId?: string | null;
 }, key?: ContinuityKey): TaskSnapshot | null;
+/** `loadFreshActiveTaskSnapshot`'s owner-match-or-age rule, for a snapshot a store read. */
+export declare function freshActiveSnapshot(snapshot: TaskSnapshot | null, opts?: {
+    maxAgeMs?: number;
+    sessionId?: string | null;
+}): TaskSnapshot | null;
 export declare function clearActiveTaskSnapshot(hippoRoot: string, tenantId: string, clearedStatus?: string): boolean;
 /**
  * Close the `active` task snapshot(s) owned by `sessionId`, for the
@@ -71,7 +76,7 @@ export declare function clearActiveTaskSnapshot(hippoRoot: string, tenantId: str
  * closed (0 when no active row is owned by `sessionId`).
  */
 export declare function closeTaskSnapshotsForSession(hippoRoot: string, tenantId: string, sessionId: string, status?: string, key?: ContinuityKey): number;
-export declare function appendSessionEvent(hippoRoot: string, tenantId: string, event: {
+interface SessionEventInput {
     session_id: string;
     event_type: string;
     content: string;
@@ -79,7 +84,8 @@ export declare function appendSessionEvent(hippoRoot: string, tenantId: string,
     source?: string;
     scope?: string | null;
     metadata?: Record<string, unknown>;
-}): SessionEvent;
+}
+export declare function appendSessionEvent(hippoRoot: string, tenantId: string, event: SessionEventInput): SessionEvent;
 export declare function listSessionEvents(hippoRoot: string, tenantId: string, options?: {
     session_id?: string;
     task?: string;
@@ -97,5 +103,15 @@ export declare function findPromotableSessions(hippoRoot: string, tenantId: stri
  * already exists.
  */
 export declare function traceExistsForSession(hippoRoot: string, tenantId: string, session_id: string): boolean;
+/** One caller's claim on a session id. */
+export interface SessionOwnerBinding {
+    readonly tenantId: string;
+    readonly sessionId: string;
+    readonly owner: string;
+    /** Bindings older than this are pruned in the write that adds a new one. */
+    readonly retentionMs: number;
+}
+/** The owner stored for the session id, binding `binding.owner` first when none is stored. */
+export declare function sessionOwnerOrBind(hippoRoot: string, binding: SessionOwnerBinding): string | null;
 export {};
 //# sourceMappingURL=sessions.d.ts.map

package/dist/store/sessions.js

@@ -1,13 +1,13 @@
-import { isSharedStore } from '../config.js';
-import { closeHippoDb } from '../db.js';
+import { isSharedStore } from '../core/config.js';
+import { closeHippoDb, HOOK_DB_WAIT_MS, scopedBusyWait, withWriteScope } from '../db/index.js';
 import { raiseMinBinary } from '../db/meta.js';
-import { originInSql } from '../project-identity.js';
-import { assertTenantId } from '../tenant.js';
-import { redactSecretsStrict } from '../secret-detect.js';
-import { TASK_OWNER_MIN_BINARY } from '../version.js';
+import { originInSql } from '../core/project-identity.js';
+import { assertTenantId } from './tenant.js';
+import { redactSecretsStrict } from '../util/secret-detect.js';
+import { TASK_OWNER_MIN_BINARY } from '../util/version.js';
 import { rowToTaskSnapshot, rowToSessionEvent, } from './rows.js';
 import { writeActiveTaskMirror, removeActiveTaskMirror, writeRecentSessionMirror } from './mirrors.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 /** All or nothing: a key missing its owner or every project name matches no row, never the tenant's newest. */
 export function continuityWhere(key) {
     const names = key.project.filter((n) => n !== '');
@@ -42,14 +42,15 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
     try {
-        db.exec('BEGIN IMMEDIATE');
-        db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?${owned ? ` AND ${owned.sql}` : ''}`)
-            .run(now, tenantId, ...(owned?.params ?? []));
-        const id = insertSnapshot(db, tenantId, snapshot, now, stamp);
-        // An older binary's tenant-wide supersede would close other owners' rows, so the first owner row shuts it out.
-        if (stamp)
-            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
-        db.exec('COMMIT');
+        const id = withWriteScope(db, 'save_active_task', () => {
+            db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?${owned ? ` AND ${owned.sql}` : ''}`)
+                .run(now, tenantId, ...(owned?.params ?? []));
+            const inserted = insertSnapshot(db, tenantId, snapshot, now, stamp);
+            // An older binary's tenant-wide supersede would close other owners' rows, so the first owner row shuts it out.
+            if (stamp)
+                raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
+            return inserted;
+        });
         // SAFETY: row's shape matches the ten columns named in the SELECT above.
         const row = db.prepare(`
       SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
@@ -65,15 +66,6 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
             writeActiveTaskMirror(hippoRoot, tenantId, loaded);
         return loaded;
     }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch {
-            // Ignore nested rollback failures.
-        }
-        throw error;
-    }
     finally {
         closeHippoDb(db);
     }
@@ -142,7 +134,10 @@ function isNonEmptySessionId(value) {
  * No SQL change — age derives from the existing `updated_at` column.
  */
 export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}, key) {
-    const snapshot = loadActiveTaskSnapshot(hippoRoot, tenantId, key);
+    return freshActiveSnapshot(loadActiveTaskSnapshot(hippoRoot, tenantId, key), opts);
+}
+/** `loadFreshActiveTaskSnapshot`'s owner-match-or-age rule, for a snapshot a store read. */
+export function freshActiveSnapshot(snapshot, opts = {}) {
     if (!snapshot)
         return null;
     const callerSessionId = opts.sessionId;
@@ -199,39 +194,45 @@ export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, sta
         closeHippoDb(db);
     }
 }
-export function appendSessionEvent(hippoRoot, tenantId, event) {
-    assertTenantId('appendSessionEvent', tenantId);
-    const db = openStore(hippoRoot);
-    const now = new Date().toISOString();
-    // Scope is stored as given; default-deny in api.recall + cmdRecall
-    // continuity reads applies to slack:private:* and 'unknown:legacy' rows.
-    try {
-        const result = db.prepare(`
+function insertSessionEventRow(db, tenantId, event, now) {
+    const result = db.prepare(`
       INSERT INTO session_events(session_id, task, event_type, content, source, scope, metadata_json, tenant_id, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
     `).run(event.session_id, event.task ?? null, event.event_type, event.content, event.source ?? 'cli', event.scope ?? null, JSON.stringify(event.metadata ?? {}), tenantId, now);
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches the nine columns named in the SELECT
-        // above.
-        const row = db.prepare(`
+    return Number(result.lastInsertRowid ?? 0);
+}
+function reloadSessionEvent(db, id) {
+    // SAFETY: row's shape matches the nine columns named in the SELECT below.
+    const row = db.prepare(`
       SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
       FROM session_events
       WHERE id = ?
     `).get(id);
-        if (!row) {
-            throw new Error('Failed to reload saved session event');
-        }
-        const loaded = rowToSessionEvent(row);
-        // SAFETY: recentRows' shape matches the nine columns named in the
-        // SELECT above.
-        const recentRows = db.prepare(`
+    if (!row) {
+        throw new Error('Failed to reload saved session event');
+    }
+    return rowToSessionEvent(row);
+}
+function recentSessionEventsOldestFirst(db, tenantId, sessionId, limit) {
+    // SAFETY: recentRows' shape matches the nine columns named in the SELECT below.
+    const recentRows = db.prepare(`
       SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
       FROM session_events
       WHERE session_id = ? AND tenant_id = ?
       ORDER BY created_at DESC, id DESC
       LIMIT ?
-    `).all(loaded.session_id, tenantId, 20);
-        const recent = recentRows.map(rowToSessionEvent).reverse();
+    `).all(sessionId, tenantId, limit);
+    return recentRows.map(rowToSessionEvent).reverse();
+}
+export function appendSessionEvent(hippoRoot, tenantId, event) {
+    assertTenantId('appendSessionEvent', tenantId);
+    const db = openStore(hippoRoot);
+    const now = new Date().toISOString();
+    // Scope is stored as given; default-deny in api.recall + cmdRecall
+    // continuity reads applies to slack:private:* and 'unknown:legacy' rows.
+    try {
+        const loaded = reloadSessionEvent(db, insertSessionEventRow(db, tenantId, event, now));
+        const recent = recentSessionEventsOldestFirst(db, tenantId, loaded.session_id, 20);
         writeRecentSessionMirror(hippoRoot, tenantId, recent);
         return loaded;
     }
@@ -310,4 +311,40 @@ export function traceExistsForSession(hippoRoot, tenantId, session_id) {
         closeHippoDb(db);
     }
 }
+/** The owner a session id is bound to, or null. */
+function selectSessionOwnerAt(db, tenantId, sessionId) {
+    // SAFETY: the SELECT names exactly this one TEXT column.
+    const row = db.prepare(`SELECT owner_subject FROM session_owners WHERE tenant_id = ? AND session_id = ?`).get(tenantId, sessionId);
+    return row?.owner_subject ?? null;
+}
+/** Binds `sessionId` to `owner` unless a binding exists; the count is 1 when this call bound it. */
+function insertSessionOwnerAt(db, tenantId, sessionId, owner, createdAt) {
+    const result = db.prepare(`INSERT OR IGNORE INTO session_owners(tenant_id, session_id, owner_subject, created_at) VALUES (?, ?, ?, ?)`)
+        .run(tenantId, sessionId, owner, createdAt);
+    return Number(result.changes ?? 0);
+}
+// SHORTCUT: no created_at index, so each first bind scans the table; add one past a few hundred thousand rows.
+/** Drops bindings created before `cutoffIso`. */
+function deleteSessionOwnersBeforeAt(db, cutoffIso) {
+    db.prepare(`DELETE FROM session_owners WHERE created_at < ?`).run(cutoffIso);
+}
+/** Binds under the write lock and returns the stored owner, which is not `owner` when a concurrent first bind won. */
+function insertSessionOwner(db, binding) {
+    const { tenantId, sessionId, owner, retentionMs } = binding;
+    withWriteScope(db, 'bind_session_owner', () => {
+        const bound = insertSessionOwnerAt(db, tenantId, sessionId, owner, new Date().toISOString());
+        // An older binary supersedes across owners, so the first binding shuts it out in the same transaction.
+        if (bound === 1)
+            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
+        // Pruned on write, as the failure log is; a pruned session id is a UUID no other caller knows.
+        deleteSessionOwnersBeforeAt(db, new Date(Date.now() - retentionMs).toISOString());
+    }, { busyWaitMs: scopedBusyWait() ?? HOOK_DB_WAIT_MS });
+    // Re-read, since a concurrent first bind may have won the INSERT OR IGNORE.
+    return selectSessionOwnerAt(db, tenantId, sessionId);
+}
+/** The owner stored for the session id, binding `binding.owner` first when none is stored. */
+export function sessionOwnerOrBind(hippoRoot, binding) {
+    // A bound session is the common case after the first prompt, so it must not take the write lock.
+    return onHandle(hippoRoot, (db) => selectSessionOwnerAt(db, binding.tenantId, binding.sessionId) ?? insertSessionOwner(db, binding));
+}
 //# sourceMappingURL=sessions.js.map

package/dist/store/sqlite/commit-watch.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseSyncLike } from '../../db/index.js';
+/** Calls `mark` before `db` is handed any statement that may commit. */
+export declare function watchCommits(db: DatabaseSyncLike, mark: () => void): void;
+//# sourceMappingURL=commit-watch.d.ts.map

package/dist/store/sqlite/commit-watch.js

@@ -0,0 +1,29 @@
+const ROLLS_BACK_PART = /^\s*ROLLBACK\s+TO\b/i;
+// After any of these the connection may be in autocommit, where a statement prepared earlier commits on its own.
+const ENDS_TRANSACTION = /^\s*(?:COMMIT|END|RELEASE|ROLLBACK)\b/i;
+// Reads, and the statements that open a transaction: none makes a change durable on its own.
+const NEVER_COMMITS = /^\s*(?:SELECT|BEGIN|SAVEPOINT|PRAGMA|EXPLAIN)\b/i;
+/** Whether running `sql` on `db` can make a change durable. Anything the patterns do not know counts as a commit. */
+function mayCommit(db, sql) {
+    if (ROLLS_BACK_PART.test(sql))
+        return false;
+    if (ENDS_TRANSACTION.test(sql))
+        return true;
+    return db.isTransaction !== true && !NEVER_COMMITS.test(sql);
+}
+/** Calls `mark` before `db` is handed any statement that may commit. */
+export function watchCommits(db, mark) {
+    const exec = db.exec.bind(db);
+    const prepare = db.prepare.bind(db);
+    db.exec = (sql) => {
+        if (mayCommit(db, sql))
+            mark();
+        exec(sql);
+    };
+    db.prepare = (sql) => {
+        if (mayCommit(db, sql))
+            mark();
+        return prepare(sql);
+    };
+}
+//# sourceMappingURL=commit-watch.js.map

package/dist/store/sqlite/connector-events-group.d.ts

@@ -0,0 +1,5 @@
+import type { ConnectorEvents, Sync } from '../port.js';
+export declare function sqliteConnectorEvents(hippoRoot: string): Sync<ConnectorEvents>;
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export declare function servedConnectorEvents(sync: Sync<ConnectorEvents>): ConnectorEvents;
+//# sourceMappingURL=connector-events-group.d.ts.map

package/dist/store/sqlite/connector-events-group.js

@@ -0,0 +1,50 @@
+// hippo.db's half of the ConnectorEvents store group: each call on a handle of its own.
+import { archiveDeletedArtifact, eventSeenAt, githubRouting, insertDlq, logEvent, seenEvent } from '../connectors/github.js';
+import { insertSlackDlq, markSlackEventSeen, rawMemoryIdForArtifactAt, slackEventRecord, slackEventSeenAt, slackTeamRoute } from '../connectors/slack.js';
+import { onHandle } from '../open.js';
+function eventRecord(hippoRoot, event) {
+    if (event.connector === 'slack')
+        return slackEventRecord(hippoRoot, event.eventId);
+    const logged = seenEvent(hippoRoot, event.idempotencyKey);
+    return logged ? { seen: true, memoryId: logged.memoryId } : { seen: false };
+}
+function markEventSeen(hippoRoot, event) {
+    if (event.connector === 'slack')
+        return markSlackEventSeen(hippoRoot, event.eventId, null);
+    const { idempotencyKey, deliveryId, eventName } = event;
+    logEvent(hippoRoot, { idempotencyKey, deliveryId, eventName, memoryId: null });
+}
+function deletionTarget(hippoRoot, { event, artifactRef, tenantId }) {
+    return onHandle(hippoRoot, (db) => {
+        const seen = event.connector === 'slack' ? slackEventSeenAt(db, event.eventId) : eventSeenAt(db, event.idempotencyKey);
+        return seen ? { seen: true } : { seen: false, memoryId: rawMemoryIdForArtifactAt(db, artifactRef, tenantId) };
+    });
+}
+function archiveArtifact(hippoRoot, { tenantId, actor, artifactRef, reason, event }) {
+    const { idempotencyKey, deliveryId, eventName } = event;
+    return archiveDeletedArtifact(hippoRoot, { tenantId, artifactRef, idempotencyKey, deliveryId, eventName, reason, who: actor });
+}
+export function sqliteConnectorEvents(hippoRoot) {
+    return {
+        eventRecord: (event) => eventRecord(hippoRoot, event),
+        markEventSeen: (event) => markEventSeen(hippoRoot, event),
+        deletionTarget: (lookup) => deletionTarget(hippoRoot, lookup),
+        archiveDeletedArtifact: (archive) => archiveArtifact(hippoRoot, archive),
+        slackTeamRoute: (teamId) => slackTeamRoute(hippoRoot, teamId),
+        githubRouting: (query) => githubRouting(hippoRoot, query),
+        parkDeadLetter: (letter) => (letter.connector === 'slack' ? insertSlackDlq(hippoRoot, letter) : insertDlq(hippoRoot, letter)),
+    };
+}
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export function servedConnectorEvents(sync) {
+    return {
+        eventRecord: async (event) => sync.eventRecord(event),
+        markEventSeen: async (event) => sync.markEventSeen(event),
+        deletionTarget: async (lookup) => sync.deletionTarget(lookup),
+        archiveDeletedArtifact: async (archive) => sync.archiveDeletedArtifact(archive),
+        slackTeamRoute: async (teamId) => sync.slackTeamRoute(teamId),
+        githubRouting: async (query) => sync.githubRouting(query),
+        parkDeadLetter: async (letter) => sync.parkDeadLetter(letter),
+    };
+}
+//# sourceMappingURL=connector-events-group.js.map

package/dist/store/sqlite/connector-writes-group.d.ts

@@ -0,0 +1,6 @@
+import type { ConnectorWrites, Sync } from '../port.js';
+/** Each call on its own handle; the mirror follows the commit, so a duplicate or a rolled-back write leaves none. */
+export declare function sqliteConnectorWrites(hippoRoot: string): Sync<ConnectorWrites>;
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export declare function servedConnectorWrites(sync: Sync<ConnectorWrites>): ConnectorWrites;
+//# sourceMappingURL=connector-writes-group.d.ts.map

package/dist/store/sqlite/connector-writes-group.js

@@ -0,0 +1,65 @@
+import { eventMemoryAt, logEventAt } from '../connectors/github.js';
+import { markSlackEventSeenAt, slackEventMemoryAt } from '../connectors/slack.js';
+import { stampOriginProject } from '../entry-row.js';
+import { writeEntryMirrors } from '../entry-writes.js';
+import { onHandle, openStore } from '../open.js';
+import { recordQuarantine } from '../quarantine.js';
+import { archiveRawAt, writeInOwnTenant } from './entry-writes-group.js';
+/** Unwinds a write whose event key is already logged. Caught in this file, so no caller ever sees it. */
+class EventAlreadyLogged extends Error {
+}
+/** False when the key was logged before: the insert ignores a taken key, so the first writer's row stays. */
+function logEvent(db, event, memoryId) {
+    if (event.connector === 'slack')
+        return markSlackEventSeenAt(db, event.eventId, memoryId);
+    const { idempotencyKey, deliveryId, eventName } = event;
+    return logEventAt(db, { idempotencyKey, deliveryId, eventName, memoryId });
+}
+function loggedMemory(db, event) {
+    return event.connector === 'slack' ? slackEventMemoryAt(db, event.eventId) : eventMemoryAt(db, event.idempotencyKey);
+}
+/** The record, then the log row, go in after the memory row and ahead of its remember row, as a second store must order them. */
+function writeWithCompanions(db, { entry, actor, event, quarantine }) {
+    writeInOwnTenant(db, entry, actor, (handle, memoryId) => {
+        if (quarantine)
+            recordQuarantine(handle, { tenantId: entry.tenantId, memoryId, originalScope: quarantine.originalScope, reason: quarantine.reason, actor });
+        if (event && !logEvent(handle, event, memoryId))
+            throw new EventAlreadyLogged();
+    });
+}
+function writeOnce(db, write) {
+    try {
+        writeWithCompanions(db, write);
+        return { outcome: 'written' };
+    }
+    catch (err) {
+        if (!(err instanceof EventAlreadyLogged) || !write.event)
+            throw err;
+        // The scope has unwound, so this reads the winner's committed row.
+        return { outcome: 'duplicate', memoryId: loggedMemory(db, write.event) };
+    }
+}
+/** Each call on its own handle; the mirror follows the commit, so a duplicate or a rolled-back write leaves none. */
+export function sqliteConnectorWrites(hippoRoot) {
+    return {
+        writeConnectorEntry(write) {
+            const entry = stampOriginProject(hippoRoot, write.entry);
+            const result = onHandle(hippoRoot, (db) => writeOnce(db, { ...write, entry }), openStore);
+            if (result.outcome === 'written')
+                writeEntryMirrors(hippoRoot, entry);
+            return result;
+        },
+        archiveConnectorEntry(archive) {
+            // The log write's answer is unread: a key logged before keeps its row and the archive stands.
+            return archiveRawAt(hippoRoot, archive, (db, archivedId) => { logEvent(db, archive.event, archivedId); });
+        },
+    };
+}
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export function servedConnectorWrites(sync) {
+    return {
+        writeConnectorEntry: async (write) => sync.writeConnectorEntry(write),
+        archiveConnectorEntry: async (archive) => sync.archiveConnectorEntry(archive),
+    };
+}
+//# sourceMappingURL=connector-writes-group.js.map

package/dist/store/sqlite/dag-reads-group.d.ts

@@ -0,0 +1,3 @@
+import type { DagReads, Sync } from '../port.js';
+export declare function sqliteDagReads(hippoRoot: string): Sync<DagReads>;
+//# sourceMappingURL=dag-reads-group.d.ts.map

package/dist/store/sqlite/dag-reads-group.js

@@ -0,0 +1,45 @@
+import { pagedDescendants } from '../descendant-page.js';
+import { countSessionRawMemories, loadSessionRawMemories, selectChildrenByParent, selectEntriesByIds } from '../entry-reads.js';
+import { onHandle, openStore } from '../open.js';
+export function sqliteDagReads(hippoRoot) {
+    return {
+        sessionRawEntries({ tenantId, sessionId, cap, origins }) {
+            return loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap, origins);
+        },
+        sessionRawCount({ tenantId, sessionId, scope, ownScope, origins }) {
+            return countSessionRawMemories(hippoRoot, sessionId, tenantId, scope, ownScope, origins);
+        },
+        summaryWithDescendants(tenantId, id, walk) {
+            return onHandle(hippoRoot, (db) => summaryWithDescendantsAt(db, tenantId, id, walk), openStore);
+        },
+    };
+}
+// dag_parent_id is not unique to a tree, so `seen` keeps a mislinked row from being listed twice or walked in a loop.
+function summaryWithDescendantsAt(db, tenantId, id, { depth, admit, page }) {
+    const summary = selectEntriesByIds(db, [id], tenantId).get(id);
+    if (!summary)
+        return null;
+    if (page)
+        return pagedDescendants(db, { tenantId, summary, depth, page }, admit(summary));
+    const levels = [];
+    const seen = new Set([id]);
+    let parents = admit(summary) ? [id] : [];
+    for (let level = 0; level < depth && parents.length > 0; level++) {
+        const childrenOf = selectChildrenByParent(db, parents, tenantId);
+        const admitted = [];
+        for (const parentId of parents) {
+            for (const child of childrenOf.get(parentId) ?? []) {
+                if (seen.has(child.id) || !admit(child))
+                    continue;
+                seen.add(child.id);
+                admitted.push(child);
+            }
+        }
+        if (admitted.length === 0)
+            break;
+        levels.push(admitted);
+        parents = admitted.map((row) => row.id);
+    }
+    return { summary, levels };
+}
+//# sourceMappingURL=dag-reads-group.js.map

package/dist/store/sqlite/entry-writes-group.d.ts

@@ -0,0 +1,18 @@
+import { type DatabaseSyncLike } from '../../db/index.js';
+import { type MemoryEntry } from '../../core/memory.js';
+import { type ArchiveOpts } from '../raw-archive.js';
+import type { EntryWrite, EntryWrites, OutcomeWrite, RawArchive, Sync } from '../port.js';
+import { type WriteEntryOptions } from '../entry-writes.js';
+/** Each call on its own handle; mirrors and the forgotten counter follow the commit, so a rolled-back write leaves neither. */
+export declare function sqliteEntryWrites(hippoRoot: string): Sync<EntryWrites>;
+/** A store-side hook writes on the row's handle inside its write scope, so its throw undoes the row. */
+export declare function writeEntryAt(hippoRoot: string, { entry, actor }: EntryWrite, afterWrite?: WriteEntryOptions['afterWrite']): void;
+/** A trace link follows the commit on the same handle and names only the ids applied, so a rolled-back outcome leaves none. */
+export declare function applyOutcomeAt(hippoRoot: string, outcome: OutcomeWrite, traceId?: number): string[];
+/** Reach is checked inside the archive's write scope. A store-side hook writes on the same handle inside that scope, so its throw undoes the archive. */
+export declare function archiveRawAt(hippoRoot: string, archive: RawArchive, afterArchive?: ArchiveOpts['afterArchive']): string;
+/** The refusal row lands after `write` has rolled back, in a fresh implicit transaction the aborted one cannot undo. */
+export declare function auditingRefusal<T>(db: DatabaseSyncLike, actor: string, write: () => T): T;
+/** writeEntryAt on the caller's handle, so a sibling group can read on it after the scope has unwound. */
+export declare function writeInOwnTenant(db: DatabaseSyncLike, entry: MemoryEntry, actor: string, afterWrite?: WriteEntryOptions['afterWrite']): void;
+//# sourceMappingURL=entry-writes-group.d.ts.map