hippo-memory 1.69.0 → 1.70.0

package/dist/mcp/stdio.js

@@ -1,9 +1,12 @@
 // Stdio transport: newline-delimited JSON-RPC frames in on stdin, replies out on stdout.
-import { errorFields, log } from '../log.js';
+import { exitAfterFlush, installCrashHandlers } from '../util/crash-handlers.js';
+import { errorMessage, log } from '../util/log.js';
 import { parseFrame } from './framing.js';
-import { mcpErrorResponse, isJsonObjectRecord } from './protocol.js';
+import { mcpErrorResponse } from './protocol.js';
 import { handleMcpRequest } from './request.js';
-import { isJsonString } from '../json.js';
+import { isJsonNumber, isJsonString, isJsonObject } from '../util/json.js';
+import { randomUUID } from 'node:crypto';
+import { runWithRequestId } from '../util/request-scope.js';
 // MCP stdio transport spec: messages are newline-delimited JSON-RPC, no embedded newlines.
 // https://modelcontextprotocol.io/specification/.../basic/transports#stdio
 function send(msg) {
@@ -11,9 +14,52 @@ function send(msg) {
 }
 // ── Stdio transport ──
 let buffer = Buffer.alloc(0);
+// The part of a refused frame still on its way, dropped as it arrives so it is never buffered or read as a new frame.
+let refused = 0;
+function withoutRefused(chunk) {
+    if (refused === 'line') {
+        const newline = chunk.indexOf(0x0a);
+        if (newline === -1)
+            return chunk.subarray(chunk.length);
+        refused = 0;
+        return chunk.subarray(newline + 1);
+    }
+    const dropped = Math.min(refused, chunk.length);
+    refused -= dropped;
+    return chunk.subarray(dropped);
+}
 // Only method is checked: handleMcpRequest narrows params where it reads them, as the HTTP transport does.
 function isRoutableRequest(v) {
-    return isJsonObjectRecord(v) && isJsonString(v.method);
+    return isJsonObject(v) && isJsonString(v.method);
+}
+/** A frame that parsed but names no method: with an id it is a request owed an answer; without one it is a notification, which JSON-RPC forbids answering. */
+function answerUnroutable(frame) {
+    const id = isJsonObject(frame) ? frame.id : undefined;
+    if (isJsonString(id) || isJsonNumber(id)) {
+        send({ jsonrpc: '2.0', id, error: { code: -32600, message: 'Invalid Request: method must be a string' } });
+        return;
+    }
+    log.warn('mcp: dropped a frame with no method and no id; it cannot be routed or answered');
+}
+/** How long stdin's end waits for calls still running, so a client that closes right after its last request still gets the reply. */
+const STDIN_END_DRAIN_MS = 5000;
+// Calls dispatched and not yet answered, each with the method the drain names if it is still running at the bound.
+const inFlight = new Map();
+function track(method, call) {
+    inFlight.set(call, method);
+    void call.finally(() => inFlight.delete(call));
+}
+async function exitWhenDrained() {
+    if (inFlight.size > 0) {
+        let bound;
+        const timedOut = new Promise((resolve) => { bound = setTimeout(resolve, STDIN_END_DRAIN_MS); });
+        await Promise.race([Promise.allSettled(inFlight.keys()), timedOut]);
+        clearTimeout(bound);
+    }
+    for (const method of inFlight.values()) {
+        log.warn(`mcp: ${method} was still running ${STDIN_END_DRAIN_MS} ms after stdin closed; exiting without its reply`, { method });
+    }
+    exitAfterFlush(0);
 }
 function dispatch(body) {
     let parsed;
@@ -25,20 +71,21 @@ function dispatch(body) {
         send({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } });
         return;
     }
-    // A frame without a string method cannot be routed; dropping it keeps a stray value from crashing the process.
-    if (!isRoutableRequest(parsed))
+    if (!isRoutableRequest(parsed)) {
+        answerUnroutable(parsed);
         return;
+    }
     const req = parsed;
     if (req.method.startsWith('notifications/')) {
-        handleMcpRequest(req).catch((err) => {
-            log.error(`mcp notification ${req.method} failed: ${err instanceof Error ? err.message : String(err)}`);
-        });
+        track(req.method, handleMcpRequest(req).then(() => { }).catch((err) => {
+            log.error(`mcp notification ${req.method} failed: ${errorMessage(err)}`);
+        }));
         return;
     }
-    handleMcpRequest(req).then((resp) => { if (resp)
+    track(req.method, handleMcpRequest(req).then((resp) => { if (resp)
         send(resp); }).catch((err) => {
         send(mcpErrorResponse(req.id, err));
-    });
+    }));
 }
 /**
  * Wire stdin/stdout to the dispatcher. Idempotent — only the entrypoint
@@ -48,33 +95,24 @@ function dispatch(body) {
  */
 export function startStdioLoop() {
     process.stdin.on('data', (chunk) => {
-        buffer = Buffer.concat([buffer, chunk]);
+        buffer = Buffer.concat([buffer, withoutRefused(chunk)]);
         while (true) {
             const result = parseFrame(buffer);
             if (result.kind === 'incomplete')
                 break;
             buffer = result.rest;
+            if (result.kind === 'oversize') {
+                refused = result.remainder;
+                log.warn('mcp: refused a frame over the size cap with a parse error');
+                send({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error: frame exceeds 1MB' } });
+                continue;
+            }
+            // One id per frame, so the error reply and every line logged for the call name the same request.
             if (result.kind === 'message')
-                dispatch(result.body);
+                runWithRequestId(randomUUID(), () => dispatch(result.body));
         }
     });
-    process.stdin.on('end', () => process.exit(0));
-    // After an uncaught throw the process state is unknown, so log the cause and exit for the client to restart the server.
-    const crash = (kind, err) => {
-        log.error(`mcp ${kind}: ${err instanceof Error ? err.message : String(err)}`, errorFields(err));
-        exitAfterFlush(1);
-    };
-    process.on('uncaughtException', (err) => crash('uncaught exception', err));
-    process.on('unhandledRejection', (err) => crash('unhandled rejection', err));
-}
-/** Exit once stdout and stderr have drained, so the last reply and the crash log reach the client; capped at 1 s. */
-function exitAfterFlush(code) {
-    process.exitCode = code;
-    let pending = 2;
-    const done = () => { if (--pending === 0)
-        process.exit(code); };
-    process.stdout.write('', done);
-    process.stderr.write('', done);
-    setTimeout(() => process.exit(code), 1000).unref();
+    process.stdin.on('end', () => { void exitWhenDrained(); });
+    installCrashHandlers('mcp');
 }
 //# sourceMappingURL=stdio.js.map

package/dist/mcp/tool-args.js

@@ -1,4 +1,5 @@
 // Hand-written for the JSON Schema subset the hippo tool definitions use, so the MCP server needs no validator dependency.
+const ARG_PREVIEW_CHARS = 40;
 function isArgString(v) {
     return typeof v === 'string';
 }
@@ -23,7 +24,7 @@ function describeValue(v) {
     if (Array.isArray(v))
         return 'array';
     if (isArgString(v))
-        return JSON.stringify(v.length > 40 ? `${v.slice(0, 40)}...` : v);
+        return JSON.stringify(v.length > ARG_PREVIEW_CHARS ? `${v.slice(0, ARG_PREVIEW_CHARS)}...` : v);
     if (isArgNumber(v) || isArgBoolean(v))
         return String(v);
     return 'object';

package/dist/mcp/tools.js

@@ -1,7 +1,7 @@
 // Tool definitions and input schemas served by tools/list.
-import { DEFAULT_RECALL_BUDGET } from '../search/types.js';
+import { DEFAULT_RECALL_BUDGET } from '../core/search-types.js';
 import { DEFAULT_ASSEMBLE_BUDGET } from '../api/assemble.js';
-import { MAX_ID_LEN } from '../http-util.js';
+import { MAX_ID_LEN } from '../util/http-util.js';
 // ── Tool definitions ──
 // HTTP sets no budget cap; 25x the recall default leaves room for large-context clients while bounding one call's work.
 const MAX_BUDGET_TOKENS = 25 * DEFAULT_RECALL_BUDGET;

package/dist/{customer-notes.d.ts → objects/customer-notes.d.ts}

@@ -18,34 +18,16 @@
  *
  * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
  */
-import { type KeysetPosition } from './keyset.js';
-export type NoteStatus = 'active' | 'superseded' | 'closed';
+import type { KeysetPosition } from '../util/keyset.js';
+import type { SavableDescriptor } from './descriptor.js';
+import type { CustomerNote, NoteStatus } from '../store/object-types.js';
+export type { CustomerNote, NoteStatus } from '../store/object-types.js';
 export declare const VALID_NOTE_STATES: ReadonlySet<NoteStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). note is a body, so a larger cap
  *  than the 4096 short-field convention. */
 export declare const MAX_CUSTOMER_LEN = 256;
 export declare const MAX_NOTE_LEN = 8192;
 export declare const MAX_CHANGE_SUMMARY_LEN = 4096;
-export interface CustomerNote {
-    id: number;
-    /** Nullable: ON DELETE SET NULL lets memory deletion proceed without breaking
-     *  the note row. */
-    memoryId: string | null;
-    tenantId: string;
-    /** The account/customer entity this note is scoped to (free-form identifier). */
-    customer: string;
-    /** The note body. */
-    note: string;
-    /** Server-derived: 1 on a fresh create, predecessor.version + 1 on supersede. */
-    version: number;
-    status: NoteStatus;
-    supersededBy: number | null;
-    supersededAt: string | null;
-    /** The per-version delta note; set on a successor row only (NULL on a v1). */
-    changeSummary: string | null;
-    closedAt: string | null;
-    createdAt: string;
-}
 export interface SaveCustomerNoteOpts {
     customer: string;
     note: string;
@@ -64,11 +46,12 @@ export interface ListCustomerNotesOpts {
     /** Resume after this row: the position the previous page ended on. */
     after?: KeysetPosition;
 }
+export declare const CUSTOMER_NOTE: SavableDescriptor<'customer_note', SaveCustomerNoteOpts>;
 /**
  * Create a customer_note (or a new version that supersedes an existing one). Writes
- * the memory mirror + the customer_notes row atomically inside writeEntry's SAVEPOINT.
+ * the memory mirror + the customer_notes row in the `objects` store group's one transaction.
  * When supersedesNoteId is given, the referenced ACTIVE row is preflighted (status +
- * version) BEFORE the INSERT, then CAS-UPDATEd -> superseded in the same SAVEPOINT;
+ * version) BEFORE the INSERT, then CAS-UPDATEd -> superseded in the same transaction;
  * the new version = predecessor.version + 1 (server-derived).
  *
  * The memory mirror carries a `customer:<lc>` tag (in addition to ['customer_note']

package/dist/objects/customer-notes.js

@@ -0,0 +1,112 @@
+/**
+ * customer_note first-class object.
+ *
+ * A `customer_note` is a discrete note recorded against an account/customer entity:
+ * a `note` body scoped to a `customer`, evolving via the supersede delta lifecycle.
+ * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt,
+ * so an FK is deferred). Unlike project_brief's one-summary-per-repo,
+ * a customer accrues MANY discrete notes over time, each with its own supersede chain
+ * (correct a note -> a new version preserving history; close retires it).
+ *
+ * Reuses the project_brief/skill supersede machinery verbatim (superseded_by self-FK
+ * + CAS + INSERT-preflight + server-derived version + change_summary + supersede
+ * tenant-match trigger). It has NO assembler/renderer (the simplest first-class object): the
+ * contribution is purely the entity-scoping dimension.
+ *
+ * The `customer_notes` table is the source of truth (survives memory decay); the
+ * memory mirror is for recall. memory_id is NULLABLE with ON DELETE SET NULL.
+ *
+ * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
+ */
+import { checkText, requireLine } from './fields.js';
+import { closeObjectAt, listObjectsAt, objectByIdAt, saveObjectAt } from './lifecycle.js';
+// ---------------------------------------------------------------------------
+// Domain types
+// ---------------------------------------------------------------------------
+export const VALID_NOTE_STATES = new Set([
+    'active',
+    'superseded',
+    'closed',
+]);
+/** Field caps (untrusted at the HTTP/SDK boundary). note is a body, so a larger cap
+ *  than the 4096 short-field convention. */
+export const MAX_CUSTOMER_LEN = 256;
+export const MAX_NOTE_LEN = 8192;
+export const MAX_CHANGE_SUMMARY_LEN = 4096;
+/** Recall-surface content for the memory mirror: customer + note. Named (mirrors
+ *  buildBriefContent) so the recall surface is deterministic + unit-testable. */
+function buildNoteContent(customer, note) {
+    return `${customer}\n\n${note}`;
+}
+export const CUSTOMER_NOTE = {
+    kind: 'customer_note',
+    label: 'note',
+    plural: 'notes',
+    fn: { get: 'loadCustomerNoteById', close: 'closeCustomerNote', list: 'loadCustomerNotes', save: 'saveCustomerNote' },
+    states: VALID_NOTE_STATES,
+    closableFrom: ['active'],
+    draft(opts) {
+        // The customer becomes a `customer:<lc>` recall tag and an identifier, so it must be one line.
+        const customer = requireLine(opts.customer, MAX_CUSTOMER_LEN, {
+            required: 'saveCustomerNote: customer is required',
+            singleLine: 'saveCustomerNote: customer must be a single line (no newlines)',
+            tooLong: `saveCustomerNote: customer exceeds the ${MAX_CUSTOMER_LEN}-char cap`,
+        });
+        checkText(opts.note, MAX_NOTE_LEN, {
+            required: 'saveCustomerNote: note is required',
+            tooLong: `saveCustomerNote: note exceeds the ${MAX_NOTE_LEN}-char cap`,
+        });
+        checkText(opts.changeSummary, MAX_CHANGE_SUMMARY_LEN, {
+            tooLong: `saveCustomerNote: changeSummary exceeds the ${MAX_CHANGE_SUMMARY_LEN}-char cap`,
+        });
+        return {
+            fields: { customer, note: opts.note },
+            content: buildNoteContent(customer, opts.note),
+            tags: [`customer:${customer.toLowerCase()}`, ...(opts.extraTags ?? [])],
+            supersedesId: opts.supersedesNoteId,
+            changeSummary: opts.changeSummary,
+            at: new Date().toISOString(),
+        };
+    },
+};
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Create a customer_note (or a new version that supersedes an existing one). Writes
+ * the memory mirror + the customer_notes row in the `objects` store group's one transaction.
+ * When supersedesNoteId is given, the referenced ACTIVE row is preflighted (status +
+ * version) BEFORE the INSERT, then CAS-UPDATEd -> superseded in the same transaction;
+ * the new version = predecessor.version + 1 (server-derived).
+ *
+ * The memory mirror carries a `customer:<lc>` tag (in addition to ['customer_note']
+ * + caller extraTags) so scope-aware recall treats the note as entity-local. There is
+ * no self-recursion path (customer_note has no receipt-query/refresh).
+ */
+export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
+    return saveObjectAt(CUSTOMER_NOTE, { hippoRoot, tenantId, actor }, opts);
+}
+/**
+ * Close (retire) an active note. CAS guard WHERE status='active'; 0 changes
+ * distinguishes not-found from not-active. A superseded row is terminal.
+ */
+export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
+    return closeObjectAt(hippoRoot, CUSTOMER_NOTE, tenantId, id, actor);
+}
+export function loadCustomerNoteById(hippoRoot, tenantId, id) {
+    return objectByIdAt(hippoRoot, CUSTOMER_NOTE, tenantId, id);
+}
+export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
+    return listObjectsAt(hippoRoot, CUSTOMER_NOTE, tenantId, { status: opts.status, filter: opts.customer, limit: opts.limit, after: opts.after });
+}
+/**
+ * All ACTIVE notes for a customer, newest first. Returns a LIST (a customer accrues
+ * MANY notes) - this deliberately DIVERGES from project_brief's
+ * loadActiveBriefForRepo, which returns a single brief-or-null because a repo has one
+ * evolving summary. A future caller cloning the project_brief shape by analogy must
+ * not assume a single-return here; the plural name signals the list contract.
+ */
+export function loadActiveNotesForCustomer(hippoRoot, tenantId, customer, opts = {}) {
+    return loadCustomerNotes(hippoRoot, tenantId, { customer, status: 'active', limit: opts.limit });
+}
+//# sourceMappingURL=customer-notes.js.map

package/dist/{decisions.d.ts → objects/decisions.d.ts}

@@ -18,29 +18,15 @@
  * superseded_by same-tenant trigger makes cross-tenant supersession
  * unrepresentable. Mirrors the predictions pattern (src/predictions.ts).
  *
- * Dual-write atomicity: `saveDecision` writes the memory + decisions row (and,
- * when superseding, the old row's UPDATE) inside writeEntry's SAVEPOINT
- * 'write_entry' (store/entry-writes.ts) via the afterWrite hook, so a failure in any
- * step rolls all of them back. Pattern matches savePrediction (predictions.ts).
+ * Dual-write atomicity: `saveDecision` hands the memory and the decision to the
+ * `objects` store group, which commits them (and, when superseding, the old
+ * row's UPDATE) together, so a failure in any step rolls all of them back.
  */
-import { type KeysetPosition } from './keyset.js';
-export type DecisionStatus = 'active' | 'superseded' | 'closed';
+import type { KeysetPosition } from '../util/keyset.js';
+import type { SavableDescriptor } from './descriptor.js';
+import type { Decision, DecisionStatus } from '../store/object-types.js';
+export type { Decision, DecisionStatus } from '../store/object-types.js';
 export declare const VALID_DECISION_STATES: ReadonlySet<DecisionStatus>;
-export interface Decision {
-    id: number;
-    /** Nullable: ON DELETE SET NULL lets memory deletion (forget / consolidate /
-     *  archive) proceed without breaking the decision row. */
-    memoryId: string | null;
-    tenantId: string;
-    decisionText: string;
-    context: string | null;
-    status: DecisionStatus;
-    /** Successor decision id; set only when status === 'superseded'. */
-    supersededBy: number | null;
-    supersededAt: string | null;
-    closedAt: string | null;
-    createdAt: string;
-}
 export interface SaveDecisionOpts {
     decisionText: string;
     context?: string;
@@ -58,24 +44,23 @@ export interface ListDecisionsOpts {
     /** Resume after this row: the position the previous page ended on. */
     after?: KeysetPosition;
 }
+export declare const DECISION: SavableDescriptor<'decision', SaveDecisionOpts>;
 /**
- * Create a decision. Writes the memory mirror + the decisions row atomically
- * inside writeEntry's SAVEPOINT 'write_entry'. When supersedesDecisionId is
+ * Create a decision. The memory mirror and the decisions row are written in
+ * one transaction by the `objects` store group. When supersedesDecisionId is
  * given, the referenced ACTIVE row is UPDATEd -> superseded in the SAME
- * SAVEPOINT (CAS: WHERE status='active'; throws on changes===0 so a duplicate
+ * transaction (CAS: WHERE status='active'; zero rows changed means a duplicate
  * supersede aborts the whole write rather than orphaning a successor).
  *
  * The memory mirror preserves the legacy `hippo decide` shape: tags
  * ['decision', ...extraTags], source 'decision', confidence 'verified',
- * the half-life objectHalfLifeDays picks, content = "<text>\n\nContext: <context>"
+ * the configured default half-life, content = "<text>\n\nContext: <context>"
  * when context is given (so existing recall output is unchanged).
  */
 export declare function saveDecision(hippoRoot: string, tenantId: string, opts: SaveDecisionOpts, actor?: string): Decision;
 /**
  * Close (retire) an active decision with no successor. Updates the decisions
- * row only; the memory mirror is not mutated. CAS guard mirrors closePrediction
- * (predictions.ts): WHERE status='active'; 0 changes distinguishes not-found
- * from not-active so callers surface the right error.
+ * row only; the memory mirror is not mutated.
  */
 export declare function closeDecision(hippoRoot: string, tenantId: string, id: number, actor?: string): Decision;
 export declare function loadDecisionById(hippoRoot: string, tenantId: string, id: number): Decision | null;

package/dist/objects/decisions.js

@@ -0,0 +1,101 @@
+/**
+ * Decision first-class object.
+ *
+ * `hippo decide` used to write only a tagged memory (tags ['decision'], source
+ * 'decision') with a 90-day half-life, so an in-force decision decayed out of
+ * recall even though it was never reversed. The `decisions` table is now the
+ * source of truth: a decision stays `active` regardless of memory decay, and
+ * `hippo decide list --status active` is authoritative. A memory row still
+ * mirrors the decision for recall surfaces but is NOT canonical — memory_id is
+ * NULLABLE with ON DELETE SET NULL so forget/consolidate/archive gracefully
+ * orphans the decision row.
+ *
+ * Lifecycle: active -> superseded (a newer decision replaces it; superseded_by
+ * points to the successor) or active -> closed (retired with no successor).
+ *
+ * Tenant scoping: every helper requires tenantId. BEFORE INSERT/UPDATE triggers
+ * enforce decisions.tenant_id == the referenced memory's tenant_id, and a
+ * superseded_by same-tenant trigger makes cross-tenant supersession
+ * unrepresentable. Mirrors the predictions pattern (src/predictions.ts).
+ *
+ * Dual-write atomicity: `saveDecision` hands the memory and the decision to the
+ * `objects` store group, which commits them (and, when superseding, the old
+ * row's UPDATE) together, so a failure in any step rolls all of them back.
+ */
+import { BadRequestError } from '../core/api-errors.js';
+import { assertTenantId } from '../store/tenant.js';
+import { closeObjectAt, listObjectsAt, objectByIdAt, saveObjectAt } from './lifecycle.js';
+import { objectIdByMemory } from '../store/sqlite/objects-group.js';
+// ---------------------------------------------------------------------------
+// Domain types
+// ---------------------------------------------------------------------------
+export const VALID_DECISION_STATES = new Set([
+    'active',
+    'superseded',
+    'closed',
+]);
+export const DECISION = {
+    kind: 'decision',
+    label: 'decision',
+    plural: 'decisions',
+    fn: { get: 'loadDecisionById', close: 'closeDecision', list: 'loadDecisions', save: 'saveDecision' },
+    states: VALID_DECISION_STATES,
+    closableFrom: ['active'],
+    draft(opts) {
+        if (!opts.decisionText)
+            throw new BadRequestError('saveDecision: decisionText is required');
+        return {
+            fields: { decisionText: opts.decisionText, context: opts.context },
+            content: opts.context ? `${opts.decisionText}\n\nContext: ${opts.context}` : opts.decisionText,
+            tags: opts.extraTags ?? [],
+            supersedesId: opts.supersedesDecisionId,
+            at: new Date().toISOString(),
+        };
+    },
+};
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Create a decision. The memory mirror and the decisions row are written in
+ * one transaction by the `objects` store group. When supersedesDecisionId is
+ * given, the referenced ACTIVE row is UPDATEd -> superseded in the SAME
+ * transaction (CAS: WHERE status='active'; zero rows changed means a duplicate
+ * supersede aborts the whole write rather than orphaning a successor).
+ *
+ * The memory mirror preserves the legacy `hippo decide` shape: tags
+ * ['decision', ...extraTags], source 'decision', confidence 'verified',
+ * the configured default half-life, content = "<text>\n\nContext: <context>"
+ * when context is given (so existing recall output is unchanged).
+ */
+export function saveDecision(hippoRoot, tenantId, opts, actor = 'cli') {
+    return saveObjectAt(DECISION, { hippoRoot, tenantId, actor }, opts);
+}
+/**
+ * Close (retire) an active decision with no successor. Updates the decisions
+ * row only; the memory mirror is not mutated.
+ */
+export function closeDecision(hippoRoot, tenantId, id, actor = 'cli') {
+    return closeObjectAt(hippoRoot, DECISION, tenantId, id, actor);
+}
+export function loadDecisionById(hippoRoot, tenantId, id) {
+    return objectByIdAt(hippoRoot, DECISION, tenantId, id);
+}
+export function loadDecisions(hippoRoot, tenantId, opts = {}) {
+    return listObjectsAt(hippoRoot, DECISION, tenantId, opts);
+}
+export function loadActiveDecisions(hippoRoot, tenantId, opts = {}) {
+    return loadDecisions(hippoRoot, tenantId, { status: 'active', limit: opts.limit });
+}
+/**
+ * Resolve a `--supersedes <memory-id>` (the legacy CLI contract) to the table id
+ * of the ACTIVE decision backed by that memory, or null when the memory has no
+ * active decision row (a legacy pre-episode decision-tagged memory). Extracted
+ * so the CLI's backward-compat path is unit-testable at the store layer without
+ * exporting cmdDecide.
+ */
+export function resolveActiveDecisionIdByMemory(hippoRoot, tenantId, memoryId) {
+    assertTenantId('resolveActiveDecisionIdByMemory', tenantId);
+    return objectIdByMemory(hippoRoot, tenantId, 'decision', 'active', memoryId);
+}
+//# sourceMappingURL=decisions.js.map

package/dist/objects/descriptor.d.ts

@@ -0,0 +1,52 @@
+import type { KeysetPosition } from '../util/keyset.js';
+import type { ObjectByKind, ObjectFields, ObjectKind, SavableKind } from '../store/object-types.js';
+export interface ObjectDescriptor<K extends ObjectKind> {
+    readonly kind: K;
+    /** The nouns error text uses: "brief 3 not found", "only active briefs". */
+    readonly label: string;
+    readonly plural: string;
+    /** The exported function names; each one prefixes the errors of its own call. */
+    readonly fn: {
+        readonly get: string;
+        readonly close: string;
+        readonly list: string;
+    };
+    readonly states: ReadonlySet<ObjectByKind[K]['status']>;
+    /** The statuses a close may start from. */
+    readonly closableFrom: readonly ObjectByKind[K]['status'][];
+    /** Said in place of "not <closable statuses>" when a close is refused; incidents say "already closed". */
+    readonly closeRefusal?: string;
+}
+/** One save, checked and resolved before a store is asked. */
+export interface ObjectDraft<K extends SavableKind> {
+    readonly fields: ObjectFields[K];
+    /** The mirror memory's text, and its tags after the kind's own. */
+    readonly content: string;
+    readonly tags: readonly string[];
+    /** The active object this one replaces. */
+    readonly supersedesId: number | undefined;
+    /** What changed; stored only on a versioned successor. */
+    readonly changeSummary?: string;
+    /** Read once the checks pass, so one instant stamps everything the save writes. */
+    readonly at: string;
+}
+/** A kind the shared save writes: active rows, replaced by supersede. `W` is the options its module's save takes. */
+export interface SavableDescriptor<K extends SavableKind, W> extends ObjectDescriptor<K> {
+    readonly fn: {
+        readonly get: string;
+        readonly close: string;
+        readonly list: string;
+        readonly save: string;
+    };
+    /** Throws BadRequestError for options the kind refuses. */
+    readonly draft: (opts: W) => ObjectDraft<K>;
+}
+export interface ObjectListOpts<K extends ObjectKind> {
+    status?: ObjectByKind[K]['status'];
+    /** The value the kind's one filter column must equal: a customer note's customer, a project brief's repo. */
+    filter?: string;
+    limit?: number;
+    /** Resume after this row: the position the previous page ended on. */
+    after?: KeysetPosition;
+}
+//# sourceMappingURL=descriptor.d.ts.map

package/dist/objects/descriptor.js

@@ -0,0 +1,4 @@
+// The words and rules that differ between the typed objects (decision, project brief and the rest), held as data so one lifecycle serves every kind.
+// A kind's table, columns and audit keys sit behind the `objects` store group.
+export {};
+//# sourceMappingURL=descriptor.js.map

package/dist/objects/fields.d.ts

@@ -0,0 +1,15 @@
+export interface LineMessages {
+    readonly required: string;
+    readonly singleLine: string;
+    readonly tooLong: string;
+}
+/** A one-line name such as a repo or a customer: trimmed first, because the trimmed value is what gets stored and matched. */
+export declare function requireLine(value: string, max: number, m: LineMessages): string;
+export interface TextMessages {
+    /** Leave out for an optional field. */
+    readonly required?: string;
+    readonly tooLong: string;
+}
+/** A body stored as written: blank fails a required one, and the cap counts the untrimmed length. */
+export declare function checkText(value: string | undefined, max: number, m: TextMessages): void;
+//# sourceMappingURL=fields.d.ts.map

package/dist/objects/fields.js

@@ -0,0 +1,21 @@
+// Field checks the typed objects share. The module passes each error text in full, because the wording differs per type.
+import { BadRequestError } from '../core/api-errors.js';
+/** A one-line name such as a repo or a customer: trimmed first, because the trimmed value is what gets stored and matched. */
+export function requireLine(value, max, m) {
+    const line = (value ?? '').trim();
+    if (line.length === 0)
+        throw new BadRequestError(m.required);
+    if (/[\r\n]/.test(line))
+        throw new BadRequestError(m.singleLine);
+    if (line.length > max)
+        throw new BadRequestError(m.tooLong);
+    return line;
+}
+/** A body stored as written: blank fails a required one, and the cap counts the untrimmed length. */
+export function checkText(value, max, m) {
+    if (m.required !== undefined && (!value || value.trim().length === 0))
+        throw new BadRequestError(m.required);
+    if (value !== undefined && value.length > max)
+        throw new BadRequestError(m.tooLong);
+}
+//# sourceMappingURL=fields.js.map