hippo-memory 1.69.0 → 1.70.0

package/dist/{local-embedding.js → store/embeddings/local.js}

@@ -1,10 +1,10 @@
 // The local Transformers.js embedder, a leaf so embedding-provider.ts can wrap it without importing embeddings.ts.
-import { envModelCache } from './env.js';
+import { envModelCache } from '../../util/env.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { createRequire } from 'module';
-import { loadConfig } from './config.js';
-import { log } from './log.js';
+import { loadConfig } from '../../core/config.js';
+import { errorMessage, log } from '../../util/log.js';
 const _require = createRequire(import.meta.url);
 let _embeddingAvailable = null;
 // A pipeline is expensive to load, so one instance per model is kept for the process.
@@ -77,61 +77,72 @@ async function loadPipeline(model) {
         return _pipelineInstances.get(model);
     if (_pipelineLoading.has(model))
         return _pipelineLoading.get(model);
-    const loading = (async () => {
+    const loading = createPipeline(model);
+    _pipelineLoading.set(model, loading);
+    return loading;
+}
+/** The model's pipeline, or null with the reason recorded in `_pipelineErrors`. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+async function createPipeline(model) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const pkg = resolveTransformersPackage();
+    if (!pkg) {
+        _pipelineErrors.set(model, 'no transformers package is installed');
+        return null;
+    }
+    const pipelineFn = await importPipelineFactory(pkg, model);
+    if (!pipelineFn)
+        return null;
+    // The offline bundle used in egress-blocked sandboxes ships only the FP32 model, so use whichever file is on disk.
+    const cacheRoot = envModelCache();
+    const quantized = !cacheRoot
+        || fs.existsSync(path.join(cacheRoot, model, 'onnx', 'model_quantized.onnx'));
+    try {
+        const instance = await pipelineFn('feature-extraction', model, { quantized });
+        _pipelineInstances.set(model, instance);
+        return instance;
+    }
+    catch (err) {
+        const reason = `embedding pipeline load failed (${model}): ${String(err)}`;
+        log.debug(reason);
+        _pipelineErrors.set(model, reason);
+        return null;
+    }
+    finally {
+        _pipelineLoading.delete(model);
+    }
+}
+/** The package's `pipeline` function, or null with the reason recorded in `_pipelineErrors`. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+async function importPipelineFactory(pkg, model) {
+    let pipelineFn = null;
+    try {
+        // SAFETY: the resolved module's shape is untyped by design (optional peer
+        // dependency); pipelineFn/mod.env are read defensively below and any
+        // failure to find a usable pipeline falls through to `return null`.
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const pkg = resolveTransformersPackage();
-        if (!pkg) {
-            _pipelineErrors.set(model, 'no transformers package is installed');
-            return null;
-        }
-        let pipelineFn = null;
-        try {
-            // SAFETY: the resolved module's shape is untyped by design (optional peer
-            // dependency); pipelineFn/mod.env are read defensively below and any
-            // failure to find a usable pipeline falls through to `return null`.
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const mod = await _dynImport(pkg);
-            if (envModelCache()) {
-                if (mod.env) {
-                    mod.env.cacheDir = envModelCache();
-                    mod.env.localModelPath = envModelCache();
-                    mod.env.allowRemoteModels = false;
-                }
+        const mod = await _dynImport(pkg);
+        if (envModelCache()) {
+            if (mod.env) {
+                mod.env.cacheDir = envModelCache();
+                mod.env.localModelPath = envModelCache();
+                mod.env.allowRemoteModels = false;
             }
-            pipelineFn = mod.pipeline ?? mod.default?.pipeline;
-        }
-        catch (err) {
-            // String(err) keeps a Node error's [ERR_...] code, which callers match on.
-            const reason = `transformers import failed (${pkg}): ${String(err)}`;
-            log.debug(reason);
-            _pipelineErrors.set(model, reason);
-            return null;
-        }
-        if (!pipelineFn) {
-            _pipelineErrors.set(model, `${pkg} exports no pipeline function`);
-            return null;
-        }
-        // The offline bundle used in egress-blocked sandboxes ships only the FP32 model, so use whichever file is on disk.
-        const cacheRoot = envModelCache();
-        const quantized = !cacheRoot
-            || fs.existsSync(path.join(cacheRoot, model, 'onnx', 'model_quantized.onnx'));
-        try {
-            const instance = await pipelineFn('feature-extraction', model, { quantized });
-            _pipelineInstances.set(model, instance);
-            return instance;
-        }
-        catch (err) {
-            const reason = `embedding pipeline load failed (${model}): ${String(err)}`;
-            log.debug(reason);
-            _pipelineErrors.set(model, reason);
-            return null;
-        }
-        finally {
-            _pipelineLoading.delete(model);
         }
-    })();
-    _pipelineLoading.set(model, loading);
-    return loading;
+        pipelineFn = mod.pipeline ?? mod.default?.pipeline;
+    }
+    catch (err) {
+        // String(err) keeps a Node error's [ERR_...] code, which callers match on.
+        const reason = `transformers import failed (${pkg}): ${String(err)}`;
+        log.debug(reason);
+        _pipelineErrors.set(model, reason);
+        return null;
+    }
+    if (!pipelineFn) {
+        _pipelineErrors.set(model, `${pkg} exports no pipeline function`);
+        return null;
+    }
+    return pipelineFn;
 }
 /** Throws, with the reason, when the model's pipeline cannot load: a provider-level failure, not a per-item skip. */
 export async function requireLocalPipeline(model) {
@@ -174,8 +185,8 @@ export async function getEmbedding(text, model = DEFAULT_EMBEDDING_MODEL, role)
     }
     catch (err) {
         // The caller sees `[]` and names the memory; the reason only shows at debug.
-        log.debug(`local embedding failed: ${err instanceof Error ? err.message : String(err)}`);
+        log.debug(`local embedding failed: ${errorMessage(err)}`);
         return [];
     }
 }
-//# sourceMappingURL=local-embedding.js.map
+//# sourceMappingURL=local.js.map

package/dist/{embedding-provider.d.ts → store/embeddings/provider.d.ts}

@@ -26,7 +26,7 @@
  * `fetch` and are integration-verified in Workstream C (real API calls are
  * egress-blocked in the build sandbox).
  */
-import { type EmbeddingRole } from './local-embedding.js';
+import { type EmbeddingRole } from './local.js';
 export type EmbeddingProviderKind = 'local' | 'openai' | 'voyage' | 'cohere';
 export declare const API_PROVIDER_KINDS: readonly EmbeddingProviderKind[];
 export interface EmbeddingProvider {
@@ -74,4 +74,4 @@ export declare function resolveEmbeddingIdentity(hippoRoot: string, opts?: Resol
  * api -> key present. Use at the call sites that decide whether to embed.
  */
 export declare function isEmbeddingConfigured(hippoRoot: string): boolean;
-//# sourceMappingURL=embedding-provider.d.ts.map
+//# sourceMappingURL=provider.d.ts.map

package/dist/{embedding-provider.js → store/embeddings/provider.js}

@@ -26,11 +26,13 @@
  * `fetch` and are integration-verified in Workstream C (real API calls are
  * egress-blocked in the build sandbox).
  */
-import { envByName } from './env.js';
-import { getEmbedding, isEmbeddingAvailable, requireLocalPipeline, resolveEmbeddingModel, DEFAULT_EMBEDDING_MODEL, } from './local-embedding.js';
-import { loadConfig } from './config.js';
-import { redactSecretsStrict } from './secret-detect.js';
-import { fetchWithRetry } from './http-retry.js';
+import { envByName } from '../../util/env.js';
+import { getEmbedding, isEmbeddingAvailable, requireLocalPipeline, resolveEmbeddingModel, DEFAULT_EMBEDDING_MODEL, } from './local.js';
+import { loadConfig } from '../../core/config.js';
+import { errorMessage, log } from '../../util/log.js';
+import { redactSecretsStrict } from '../../util/secret-detect.js';
+import { fetchWithRetry } from '../../util/http-retry.js';
+const ERROR_DETAIL_CHARS = 300;
 export const API_PROVIDER_KINDS = ['openai', 'voyage', 'cohere'];
 function isApiProviderKind(x) {
     return x === 'openai' || x === 'voyage' || x === 'cohere';
@@ -129,6 +131,13 @@ function redact(text, secret) {
         return text;
     return text.split(secret).join('***');
 }
+/** A cause with the key cut out: the caught error's own text or cause chain can echo the Authorization header. */
+function redactedCause(err, key) {
+    const copy = new Error(redact(errorMessage(err), key));
+    if (err instanceof Error)
+        copy.name = err.name;
+    return copy;
+}
 function l2normalize(v) {
     let norm = 0;
     for (const x of v)
@@ -179,11 +188,29 @@ class ApiEmbeddingProvider {
         return out;
     }
     async embedChunk(chunk, key, role) {
+        const spec = API_PROVIDER_SPECS[this.kind];
+        const resp = await this.postChunk(chunk, key, role);
+        const json = await this.responseJson(resp, key);
+        const vectors = spec.extractVectors(json);
+        // A 200 response with the wrong number of vectors (or any empty/malformed
+        // vector) is a provider/proxy contract violation, NOT a per-item miss. Throw
+        // so a reindex aborts atomically (preserving the prior usable index) and the
+        // explicit backfill surfaces it, instead of silently saving []-padded rows.
+        if (vectors.length !== chunk.length) {
+            throw new Error(redact(`${this.kind} embeddings returned ${vectors.length} vectors for ${chunk.length} inputs`, key));
+        }
+        for (let i = 0; i < vectors.length; i++) {
+            if (!vectors[i] || vectors[i].length === 0) {
+                throw new Error(redact(`${this.kind} embeddings returned an empty vector at index ${i}`, key));
+            }
+        }
+        return vectors;
+    }
+    async postChunk(chunk, key, role) {
         const spec = API_PROVIDER_SPECS[this.kind];
         const url = `${this.baseUrl.replace(/\/$/, '')}/${spec.path}`;
-        let resp;
         try {
-            resp = await fetchWithRetry(url, {
+            return await fetchWithRetry(url, {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
@@ -193,9 +220,12 @@ class ApiEmbeddingProvider {
             }, { timeoutMs: REQUEST_TIMEOUT_MS });
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            throw new Error(redact(`embedding request to ${this.kind} failed: ${msg}`, key));
+            const msg = errorMessage(err);
+            throw new Error(redact(`embedding request to ${this.kind} failed: ${msg}`, key), { cause: redactedCause(err, key) });
         }
+    }
+    /** The body of an OK reply; any other status, or a body that is not JSON, throws with the key cut out. */
+    async responseJson(resp, key) {
         if (!resp.ok) {
             let detail = '';
             try {
@@ -204,30 +234,15 @@ class ApiEmbeddingProvider {
             catch {
                 /* ignore body read error */
             }
-            throw new Error(redact(`${this.kind} embeddings HTTP ${resp.status}: ${detail.slice(0, 300)}`, key));
+            throw new Error(redact(`${this.kind} embeddings HTTP ${resp.status}: ${detail.slice(0, ERROR_DETAIL_CHARS)}`, key));
         }
-        let json;
         try {
-            json = await resp.json();
+            return await resp.json();
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            throw new Error(redact(`${this.kind} embeddings returned invalid JSON: ${msg}`, key));
-        }
-        const vectors = spec.extractVectors(json);
-        // A 200 response with the wrong number of vectors (or any empty/malformed
-        // vector) is a provider/proxy contract violation, NOT a per-item miss. Throw
-        // so a reindex aborts atomically (preserving the prior usable index) and the
-        // explicit backfill surfaces it, instead of silently saving []-padded rows.
-        if (vectors.length !== chunk.length) {
-            throw new Error(redact(`${this.kind} embeddings returned ${vectors.length} vectors for ${chunk.length} inputs`, key));
-        }
-        for (let i = 0; i < vectors.length; i++) {
-            if (!vectors[i] || vectors[i].length === 0) {
-                throw new Error(redact(`${this.kind} embeddings returned an empty vector at index ${i}`, key));
-            }
+            const msg = errorMessage(err);
+            throw new Error(redact(`${this.kind} embeddings returned invalid JSON: ${msg}`, key), { cause: redactedCause(err, key) });
         }
-        return vectors;
     }
 }
 function readEmbeddingsConfig(hippoRoot) {
@@ -306,10 +321,10 @@ export function isEmbeddingConfigured(hippoRoot) {
     try {
         return resolveEmbeddingProvider(hippoRoot).isAvailable();
     }
-    catch {
-        // Invalid embedding config (e.g. an insecure apiBaseUrl) must not crash the
-        // best-effort ingestion guard — treat it as "not configured" and skip.
+    catch (err) {
+        // An invalid embedding config must not crash the best-effort ingestion guard, so it reads as not configured.
+        log.debug(`embedding config unusable: ${errorMessage(err)}`);
         return false;
     }
 }
-//# sourceMappingURL=embedding-provider.js.map
+//# sourceMappingURL=provider.js.map

package/dist/store/entry-reads.d.ts

@@ -1,5 +1,6 @@
-import type { MemoryEntry } from '../memory.js';
-import { type DatabaseSyncLike } from '../db.js';
+import type { MemoryEntry } from '../core/memory.js';
+import { type DatabaseSyncLike } from '../db/index.js';
+export declare const TENANT_IS = "+tenant_id = ?";
 /**
  * Read a memory entry by ID.
  *
@@ -12,6 +13,8 @@ export declare function readEntry(hippoRoot: string, id: string, tenantId?: stri
 export declare const ID_CHUNK = 500;
 /** `items` in consecutive slices of at most `size`. */
 export declare function chunked<T>(items: readonly T[], size?: number): T[][];
+/** Answers whether a tenant's rows in this store hold an id: `ids` are looked up now, one query per chunk, and any other id on its first ask. */
+export declare function heldIdLookup(hippoRoot: string, tenantId: string, ids: readonly string[]): (id: string) => boolean;
 /** Rows by id on the caller's handle, one query per chunk; an id missing or in another tenant is absent from the map. */
 export declare function selectEntriesByIds(db: DatabaseSyncLike, ids: readonly string[], tenantId?: string): Map<string, MemoryEntry>;
 /** Direct children of each parent, one query per chunk; each list is in `created ASC, id ASC` order. */
@@ -62,11 +65,6 @@ export declare function countSessionRawMemories(hippoRoot: string, sessionId: st
  * `RecallContractError` for it when `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set.
  */
 export declare function loadFreshRawMemories(hippoRoot: string, count: number, tenantId?: string, sessionId?: string, origins?: readonly string[]): MemoryEntry[];
-/**
- * Direct DAG children of a parent summary. Tenant scoped. Returns only rows
- * whose `dag_parent_id` matches `parentId`; does NOT walk recursively.
- */
-export declare function loadChildrenOf(hippoRoot: string, parentId: string, tenantId?: string): MemoryEntry[];
 /**
  * Load all entries from SQLite.
  *
@@ -80,4 +78,45 @@ export declare function selectAllEntries(db: DatabaseSyncLike, tenantId?: string
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export declare function selectLiveEntriesBySourcePrefix(db: DatabaseSyncLike, tenantId: string, prefix: string): MemoryEntry[];
 export declare function loadContentsWithTag(hippoRoot: string, tenantId: string, tag: string, origins?: readonly string[]): string[];
+export interface VaultRawRow {
+    id: string;
+    artifact_ref: string;
+    tags_json: string;
+    scope: string | null;
+}
+/** Live raw rows whose artifact_ref matches a LIKE pattern, for one tenant; the store is set up first when it is new. */
+export declare function loadVaultRawRows(hippoRoot: string, likeParam: string, tenantId: string): VaultRawRow[];
+export interface PreviewRow {
+    id: string;
+    content: string;
+    source: string | null;
+    confidence: MemoryEntry['confidence'] | null;
+    extracted_from: string | null;
+    dag_level: number | null;
+    tags_json: string | null;
+}
+/** Reads memories from a store whose schema may predate some columns; `columns` is the table's real column set. */
+export declare function selectPreviewRows(db: DatabaseSyncLike, columns: ReadonlySet<string>, tenantId: string): PreviewRow[];
+/** True when a memory row, of any tenant, already holds `id`. */
+export declare function entryIdTakenAt(db: DatabaseSyncLike, id: string): boolean;
+/** The text, tenant and scope of memory `id`, or undefined when no row holds it. */
+export declare function entryRejectRowAt(db: DatabaseSyncLike, id: string): {
+    content: string;
+    tenant_id: string;
+    scope: string | null;
+} | undefined;
+export declare function objectMemoryRowsAt(db: DatabaseSyncLike): Array<{
+    memory_id: string;
+    status: string;
+}>;
+/** Live rows of a tenant whose source does not start with `sourcePrefix`; `origins` (global store only) limits them to user-global rows and those projects. */
+export declare function selectRowsOutsideSourcePrefixAt(db: DatabaseSyncLike, tenantId: string, sourcePrefix: string, origins: readonly string[] | null): Array<{
+    id: string;
+    content: string;
+    source: string;
+}>;
+/** Content of a tenant's live rows written by `source` and tagged `tag` that no extraction produced, in loadAllEntries' order and in every scope; `exceptSessionId` drops one session's own rows. */
+export declare function loadLiveContentsBySourceAndTag(hippoRoot: string, tenantId: string, source: string, tag: string, exceptSessionId: string): string[];
+/** Every tenant's distilled rows nothing has superseded, in loadAllEntries' order: the rows that can be each other's duplicate. */
+export declare function loadCurrentDistilledEntries(hippoRoot: string): MemoryEntry[];
 //# sourceMappingURL=entry-reads.d.ts.map

package/dist/store/entry-reads.js

@@ -1,9 +1,12 @@
-import { closeHippoDb } from '../db.js';
+import { closeHippoDb } from '../db/index.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { openStore } from './open.js';
-import { escapeLike } from '../escape.js';
-import { originInSql } from '../project-identity.js';
-import { scopeAdmitSql } from '../recall-scope.js';
+import { escapeLike } from '../util/escape.js';
+import { originInSql } from '../core/project-identity.js';
+import { scopeAdmitSql } from './recall-scope.js';
+const MAX_IDS_PER_READ = 500;
+// The plus keeps SQLite on the primary key for an id list: with a bare tenant_id it walks every row of the tenant instead.
+export const TENANT_IS = '+tenant_id = ?';
 /**
  * Read a memory entry by ID.
  *
@@ -34,10 +37,37 @@ export function chunked(items, size = ID_CHUNK) {
         out.push(items.slice(i, i + size));
     return out;
 }
+/** Answers whether a tenant's rows in this store hold an id: `ids` are looked up now, one query per chunk, and any other id on its first ask. */
+export function heldIdLookup(hippoRoot, tenantId, ids) {
+    const held = new Map();
+    const lookUp = (asked) => {
+        const db = openStore(hippoRoot);
+        try {
+            for (const chunk of chunked([...new Set(asked)])) {
+                for (const id of chunk)
+                    held.set(id, false);
+                // SAFETY: rows' shape matches the single `id` column selected.
+                const rows = db.prepare(`SELECT id FROM memories WHERE id IN (${chunk.map(() => '?').join(',')}) AND ${TENANT_IS}`).all(...chunk, tenantId);
+                for (const row of rows)
+                    held.set(row.id, true);
+            }
+        }
+        finally {
+            closeHippoDb(db);
+        }
+    };
+    if (ids.length > 0)
+        lookUp(ids);
+    return (id) => {
+        if (!held.has(id))
+            lookUp([id]);
+        return held.get(id) === true;
+    };
+}
 /** Rows by id on the caller's handle, one query per chunk; an id missing or in another tenant is absent from the map. */
 export function selectEntriesByIds(db, ids, tenantId) {
     const byId = new Map();
-    const tenantClause = tenantId !== undefined ? ' AND tenant_id = ?' : '';
+    const tenantClause = tenantId !== undefined ? ` AND ${TENANT_IS}` : '';
     const tenantArgs = tenantId !== undefined ? [tenantId] : [];
     for (const chunk of chunked([...new Set(ids)])) {
         const placeholders = chunk.map(() => '?').join(',');
@@ -51,7 +81,7 @@ export function selectEntriesByIds(db, ids, tenantId) {
 /** Direct children of each parent, one query per chunk; each list is in `created ASC, id ASC` order. */
 export function selectChildrenByParent(db, parentIds, tenantId) {
     const byParent = new Map();
-    const tenantClause = tenantId !== undefined ? ' AND tenant_id = ?' : '';
+    const tenantClause = tenantId !== undefined ? ` AND ${TENANT_IS}` : '';
     const tenantArgs = tenantId !== undefined ? [tenantId] : [];
     for (const chunk of chunked([...new Set(parentIds)])) {
         const placeholders = chunk.map(() => '?').join(',');
@@ -77,7 +107,7 @@ export function selectChildrenByParent(db, parentIds, tenantId) {
 export function loadEntriesByIds(hippoRoot, ids, tenantId) {
     if (ids.length === 0)
         return [];
-    const capped = ids.slice(0, 500);
+    const capped = ids.slice(0, MAX_IDS_PER_READ);
     const db = openStore(hippoRoot);
     try {
         const placeholders = capped.map(() => '?').join(',');
@@ -85,7 +115,7 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
         // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
         // MemoryRow's field set.
         const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) AND tenant_id = ? ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
+            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) AND ${TENANT_IS} ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
             : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) ORDER BY created ASC, content ASC, id ASC`).all(...capped);
         return rows.map(rowToEntry);
     }
@@ -224,19 +254,6 @@ export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId, orig
         closeHippoDb(db);
     }
 }
-/**
- * Direct DAG children of a parent summary. Tenant scoped. Returns only rows
- * whose `dag_parent_id` matches `parentId`; does NOT walk recursively.
- */
-export function loadChildrenOf(hippoRoot, parentId, tenantId) {
-    const db = openStore(hippoRoot);
-    try {
-        return selectChildrenByParent(db, [parentId], tenantId).get(parentId) ?? [];
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 /**
  * Load all entries from SQLite.
  *
@@ -283,4 +300,86 @@ export function loadContentsWithTag(hippoRoot, tenantId, tag, origins) {
         closeHippoDb(db);
     }
 }
+/** Live raw rows whose artifact_ref matches a LIKE pattern, for one tenant; the store is set up first when it is new. */
+export function loadVaultRawRows(hippoRoot, likeParam, tenantId) {
+    const db = openStore(hippoRoot);
+    try {
+        // SAFETY: query selects exactly the columns of VaultRawRow, in the same
+        // names, from the memories table this module owns.
+        return db
+            .prepare(`SELECT id, artifact_ref, tags_json, scope FROM memories
+           WHERE artifact_ref LIKE ? ESCAPE '\\' AND tenant_id = ? AND kind = 'raw'`)
+            .all(likeParam, tenantId);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** Reads memories from a store whose schema may predate some columns; `columns` is the table's real column set. */
+export function selectPreviewRows(db, columns, tenantId) {
+    const tenant = columns.has('tenant_id') ? ' WHERE tenant_id = ?' : '';
+    const column = (name, fallback) => (columns.has(name) ? name : `${fallback} AS ${name}`);
+    const statement = db.prepare(`SELECT id, content, ${column('source', "''")}, ${column('confidence', 'NULL')}, ${column('extracted_from', 'NULL')}, ${column('dag_level', '0')}, ${column('tags_json', "'[]'")} FROM memories${tenant}`);
+    // SAFETY: the SELECT names every PreviewRow field, each a literal fallback when its column is missing.
+    return (tenant ? statement.all(tenantId) : statement.all());
+}
+/** True when a memory row, of any tenant, already holds `id`. */
+export function entryIdTakenAt(db, id) {
+    return db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(id) !== undefined;
+}
+/** The text, tenant and scope of memory `id`, or undefined when no row holds it. */
+export function entryRejectRowAt(db, id) {
+    // SAFETY: row's shape matches the three columns named in the SELECT.
+    return db
+        .prepare(`SELECT content, tenant_id, scope FROM memories WHERE id = ?`)
+        .get(id);
+}
+/** Memory ids held by each typed-object table, with the status of the object that holds them. */
+const OBJECT_TABLES = ['decisions', 'incidents', 'processes', 'policies', 'skills', 'project_briefs', 'customer_notes'];
+export function objectMemoryRowsAt(db) {
+    const out = [];
+    for (const table of OBJECT_TABLES) {
+        // SAFETY: SELECT of two TEXT columns, filtered to a non-null memory_id.
+        out.push(...db.prepare(`SELECT memory_id, status FROM ${table} WHERE memory_id IS NOT NULL`).all());
+    }
+    return out;
+}
+/** Live rows of a tenant whose source does not start with `sourcePrefix`; `origins` (global store only) limits them to user-global rows and those projects. */
+export function selectRowsOutsideSourcePrefixAt(db, tenantId, sourcePrefix, origins) {
+    const visible = origins !== null ? ` AND (origin_project = '' OR ${originInSql(origins)})` : '';
+    const params = origins !== null ? [tenantId, sourcePrefix, ...origins] : [tenantId, sourcePrefix];
+    // SAFETY: the SELECT names the three columns of the row type.
+    return db.prepare(`SELECT id, content, source FROM memories
+      WHERE tenant_id = ? AND superseded_by IS NULL AND substr(source, 1, ${sourcePrefix.length}) != ?${visible}`).all(...params);
+}
+/** Content of a tenant's live rows written by `source` and tagged `tag` that no extraction produced, in loadAllEntries' order and in every scope; `exceptSessionId` drops one session's own rows. */
+export function loadLiveContentsBySourceAndTag(hippoRoot, tenantId, source, tag, exceptSessionId) {
+    const db = openStore(hippoRoot);
+    try {
+        /** SAFETY: rows' shape matches the two columns named in the SELECT below. */
+        const rows = db.prepare(`SELECT content, tags_json FROM memories
+       WHERE tenant_id = ? AND source = ? AND instr(tags_json, ?) > 0
+         AND COALESCE(extracted_from, '') = '' AND COALESCE(superseded_by, '') = ''
+         AND (source_session_id IS NULL OR source_session_id != ?)
+       ORDER BY created ASC, id ASC`).all(tenantId, source, JSON.stringify(tag), exceptSessionId);
+        return rows.filter((r) => parseJsonArray(r.tags_json).includes(tag)).map((r) => r.content);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** Every tenant's distilled rows nothing has superseded, in loadAllEntries' order: the rows that can be each other's duplicate. */
+export function loadCurrentDistilledEntries(hippoRoot) {
+    const db = openStore(hippoRoot);
+    try {
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories
+       WHERE COALESCE(kind, 'distilled') = 'distilled' AND COALESCE(superseded_by, '') = ''
+       ORDER BY created ASC, id ASC`).all();
+        return rows.map(rowToEntry);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 //# sourceMappingURL=entry-reads.js.map

package/dist/store/entry-row.d.ts

@@ -1,12 +1,18 @@
-import type { MemoryEntry } from '../memory.js';
-import { openHippoDb } from '../db.js';
+import type { MemoryEntry } from '../core/memory.js';
+import { openHippoDb } from '../db/index.js';
 export declare function upsertEntryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry): void;
 /** The row alone, with no rejection guard or full-text row, for `upsertEntryRow` and for `batchWriteAndDelete`, which probes tombstones and indexes per batch. Returns whether the row is new. */
 export declare function upsertMemoryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry): boolean;
 export declare function syncFtsRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, isNewRow?: boolean): void;
+export declare function ftsRowExists(db: ReturnType<typeof openHippoDb>, id: string): boolean;
 export declare function deleteFtsRow(db: ReturnType<typeof openHippoDb>, id: string): void;
 /** One set delete for `staleIds`, because `id` is UNINDEXED and each delete by id scans the whole index; then one insert per row. */
 export declare function replaceFtsRows(db: ReturnType<typeof openHippoDb>, rows: readonly MemoryEntry[], staleIds: readonly string[]): void;
+/** Row counts of a full-text index that has drifted from `memories`, re-synced after the count when `repair`; null when the two agree or there is no index. */
+export declare function ftsDrift(hippoRoot: string, repair: boolean): {
+    memories: number;
+    fts: number;
+} | null;
 /**
  * Write a memory entry to SQLite and refresh compatibility mirrors.
  *

package/dist/store/entry-row.js

@@ -1,7 +1,7 @@
-import { isFtsAvailable } from '../db.js';
-import { fallbackOrigin, originFromSource } from '../project-identity.js';
-import { checkRejectionGuard } from '../rejection.js';
-import { log } from '../log.js';
+import { closeHippoDb, ftsRowCounts, openHippoDb, isFtsAvailable, repairFtsDrift } from '../db/index.js';
+import { fallbackOrigin, originFromSource } from '../core/project-identity.js';
+import { checkRejectionGuard } from './rejection.js';
+import { errorMessage, log } from '../util/log.js';
 export function upsertEntryRow(db, entry) {
     checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
     syncFtsRow(db, entry, upsertMemoryRow(db, entry));
@@ -120,9 +120,12 @@ export function syncFtsRow(db, entry, isNewRow = false) {
     }
     catch (err) {
         // The memories table stays authoritative; a stale FTS row only costs recall quality, so the write goes on.
-        log.warnThenDebug('fts-sync', `FTS index update failed for ${entry.id}; keyword recall may miss it: ${err instanceof Error ? err.message : String(err)}`);
+        log.warnThenDebug('fts-sync', `FTS index update failed for ${entry.id}; keyword recall may miss it: ${errorMessage(err)}`);
     }
 }
+export function ftsRowExists(db, id) {
+    return db.prepare('SELECT id FROM memories_fts WHERE id = ?').get(id) !== undefined;
+}
 export function deleteFtsRow(db, id) {
     if (!isFtsAvailable(db))
         return;
@@ -130,7 +133,7 @@ export function deleteFtsRow(db, id) {
         db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(id);
     }
     catch (err) {
-        log.warnThenDebug('fts-delete', `FTS index delete failed for ${id}; recall may return a stale hit: ${err instanceof Error ? err.message : String(err)}`);
+        log.warnThenDebug('fts-delete', `FTS index delete failed for ${id}; recall may return a stale hit: ${errorMessage(err)}`);
     }
 }
 /** One set delete for `staleIds`, because `id` is UNINDEXED and each delete by id scans the whole index; then one insert per row. */
@@ -145,7 +148,7 @@ export function replaceFtsRows(db, rows, staleIds) {
         catch (err) {
             // Their old rows are still indexed, so inserting them again would index an id twice; only new ids go in.
             kept = new Set(staleIds);
-            log.warnThenDebug('fts-delete', `FTS index delete failed for ${staleIds.length} row(s); recall may return a stale hit: ${err instanceof Error ? err.message : String(err)}`);
+            log.warnThenDebug('fts-delete', `FTS index delete failed for ${staleIds.length} row(s); recall may return a stale hit: ${errorMessage(err)}`);
         }
     }
     const toInsert = rows.filter((row) => !kept.has(row.id));
@@ -157,10 +160,27 @@ export function replaceFtsRows(db, rows, staleIds) {
             insert.run(row.id, row.content, row.tags.join(' '));
         }
         catch (err) {
-            log.warnThenDebug('fts-sync', `FTS index update failed for ${row.id}; keyword recall may miss it: ${err instanceof Error ? err.message : String(err)}`);
+            log.warnThenDebug('fts-sync', `FTS index update failed for ${row.id}; keyword recall may miss it: ${errorMessage(err)}`);
         }
     }
 }
+/** Row counts of a full-text index that has drifted from `memories`, re-synced after the count when `repair`; null when the two agree or there is no index. */
+export function ftsDrift(hippoRoot, repair) {
+    const db = openHippoDb(hippoRoot);
+    try {
+        if (!isFtsAvailable(db))
+            return null;
+        const counts = ftsRowCounts(db);
+        if (counts === null || counts.memories === counts.fts)
+            return null;
+        if (repair)
+            repairFtsDrift(db);
+        return counts;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 /**
  * Write a memory entry to SQLite and refresh compatibility mirrors.
  *