hippo-memory 1.69.0 → 1.71.0

package/dist/store/sessions.js

@@ -1,13 +1,13 @@
-import { isSharedStore } from '../config.js';
-import { closeHippoDb } from '../db.js';
+import { isSharedStore } from '../core/config.js';
+import { closeHippoDb, HOOK_DB_WAIT_MS, scopedBusyWait, withWriteScope } from '../db/index.js';
 import { raiseMinBinary } from '../db/meta.js';
-import { originInSql } from '../project-identity.js';
-import { assertTenantId } from '../tenant.js';
-import { redactSecretsStrict } from '../secret-detect.js';
-import { TASK_OWNER_MIN_BINARY } from '../version.js';
+import { originInSql } from '../core/project-identity.js';
+import { assertTenantId } from './tenant.js';
+import { redactSecretsStrict } from '../util/secret-detect.js';
+import { TASK_OWNER_MIN_BINARY } from '../util/version.js';
 import { rowToTaskSnapshot, rowToSessionEvent, } from './rows.js';
 import { writeActiveTaskMirror, removeActiveTaskMirror, writeRecentSessionMirror } from './mirrors.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 /** All or nothing: a key missing its owner or every project name matches no row, never the tenant's newest. */
 export function continuityWhere(key) {
     const names = key.project.filter((n) => n !== '');
@@ -42,14 +42,15 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
     try {
-        db.exec('BEGIN IMMEDIATE');
-        db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?${owned ? ` AND ${owned.sql}` : ''}`)
-            .run(now, tenantId, ...(owned?.params ?? []));
-        const id = insertSnapshot(db, tenantId, snapshot, now, stamp);
-        // An older binary's tenant-wide supersede would close other owners' rows, so the first owner row shuts it out.
-        if (stamp)
-            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
-        db.exec('COMMIT');
+        const id = withWriteScope(db, 'save_active_task', () => {
+            db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?${owned ? ` AND ${owned.sql}` : ''}`)
+                .run(now, tenantId, ...(owned?.params ?? []));
+            const inserted = insertSnapshot(db, tenantId, snapshot, now, stamp);
+            // An older binary's tenant-wide supersede would close other owners' rows, so the first owner row shuts it out.
+            if (stamp)
+                raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
+            return inserted;
+        });
         // SAFETY: row's shape matches the ten columns named in the SELECT above.
         const row = db.prepare(`
       SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
@@ -65,15 +66,6 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
             writeActiveTaskMirror(hippoRoot, tenantId, loaded);
         return loaded;
     }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch {
-            // Ignore nested rollback failures.
-        }
-        throw error;
-    }
     finally {
         closeHippoDb(db);
     }
@@ -81,8 +73,7 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
 export function loadActiveTaskSnapshot(hippoRoot, tenantId, key) {
     assertTenantId('loadActiveTaskSnapshot', tenantId);
     const owned = key ? continuityWhere(key) : null;
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: row's shape matches the ten columns named in the SELECT above.
         const row = db.prepare(`
       SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
@@ -100,47 +91,17 @@ export function loadActiveTaskSnapshot(hippoRoot, tenantId, key) {
         if (!key)
             writeActiveTaskMirror(hippoRoot, tenantId, loaded);
         return loaded;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Default freshness bound for AMBIENT active-task-snapshot reads: 72h, chosen over 48h so
- * a Friday-evening orphan still offers continuity on Monday morning.
- * Exported so callers can override via `loadFreshActiveTaskSnapshot`'s
- * `opts.maxAgeMs`; deliberately no env knob (Simplicity First).
- */
+/** Default freshness bound for AMBIENT active-task-snapshot reads: 72h rather than 48h so a Friday-evening orphan still offers continuity on Monday;
+ * override via `loadFreshActiveTaskSnapshot`'s `opts.maxAgeMs`; deliberately no env knob. */
 export const SNAPSHOT_AMBIENT_MAX_AGE_MS = 72 * 60 * 60 * 1000;
-/** A usable session id: non-null, non-empty string. Named predicate (not an
- * inline `typeof` check) so the owner-match rule in
- * `loadFreshActiveTaskSnapshot` states its contract once. */
+/** A usable session id: non-null, non-empty string; named so the owner-match rule in `loadFreshActiveTaskSnapshot` states its contract once. */
 function isNonEmptySessionId(value) {
     return typeof value === 'string' && value.length > 0;
 }
-/**
- * Bounded read for AMBIENT active-task-snapshot surfaces (UserPromptSubmit
- * hook context, MCP recall block), so snapshots expire. A
- * snapshot written by `hippo pre-compact` has no death path tied to the
- * session that owns it, so an orphaned row would otherwise inject into
- * every prompt of every later session forever. Wraps `loadActiveTaskSnapshot`
- * (unchanged, still the source of truth for explicit continuity surfaces),
- * then applies, in order:
- *
- * 1. Owner match — ONLY when both `opts.sessionId` and the snapshot's
- *    `session_id` are non-null, non-empty strings and strictly equal
- *    (`===`). Owner reads are unbounded: the session that owns the snapshot
- *    can always see its own working state, regardless of age.
- * 2. Age check — everything else, including absent-vs-absent ids. A
- *    null/undefined/empty id on EITHER side never counts as an owner match;
- *    it falls through here instead. (`runPreCompact` can legitimately save a
- *    snapshot with `session_id = null`; a null-equals-null "match" would
- *    reopen indefinite ambient injection for exactly those rows.) Returns
- *    the snapshot only when `age(updated_at) <= maxAgeMs` (default
- *    `SNAPSHOT_AMBIENT_MAX_AGE_MS`); otherwise null.
- *
- * No SQL change — age derives from the existing `updated_at` column.
- */
+/** Bounded read for AMBIENT snapshot surfaces so orphaned snapshots expire. The owner (both session ids non-empty and `===`) always sees its own state;
+ * all others, null ids included (null === null is no match), get it only if age(updated_at) <= maxAgeMs (default `SNAPSHOT_AMBIENT_MAX_AGE_MS`), else null. */
 export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}, key) {
     return freshActiveSnapshot(loadActiveTaskSnapshot(hippoRoot, tenantId, key), opts);
 }
@@ -178,15 +139,8 @@ export function clearActiveTaskSnapshot(hippoRoot, tenantId, clearedStatus = 'cl
         closeHippoDb(db);
     }
 }
-/**
- * Close the `active` task snapshot(s) owned by `sessionId`, for the
- * session-end death path.
- * Only one `active` row exists per tenant (per owner and project when keyed) in practice (supersession happens
- * at save), but the WHERE clause scopes on `session_id` too — not just
- * `status='active' AND tenant_id=?` — so an ending session can never close a
- * different, newer session's active snapshot. Returns the number of rows
- * closed (0 when no active row is owned by `sessionId`).
- */
+/** Close the `active` task snapshot(s) owned by `sessionId` at session end; the WHERE scopes on `session_id` too so an ending session can never close a
+ * newer session's snapshot. Returns the number of rows closed. */
 export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, status = 'session-ended', key) {
     assertTenantId('closeTaskSnapshotsForSession', tenantId);
     if (key)
@@ -202,39 +156,45 @@ export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, sta
         closeHippoDb(db);
     }
 }
-export function appendSessionEvent(hippoRoot, tenantId, event) {
-    assertTenantId('appendSessionEvent', tenantId);
-    const db = openStore(hippoRoot);
-    const now = new Date().toISOString();
-    // Scope is stored as given; default-deny in api.recall + cmdRecall
-    // continuity reads applies to slack:private:* and 'unknown:legacy' rows.
-    try {
-        const result = db.prepare(`
+function insertSessionEventRow(db, tenantId, event, now) {
+    const result = db.prepare(`
       INSERT INTO session_events(session_id, task, event_type, content, source, scope, metadata_json, tenant_id, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
     `).run(event.session_id, event.task ?? null, event.event_type, event.content, event.source ?? 'cli', event.scope ?? null, JSON.stringify(event.metadata ?? {}), tenantId, now);
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches the nine columns named in the SELECT
-        // above.
-        const row = db.prepare(`
+    return Number(result.lastInsertRowid ?? 0);
+}
+function reloadSessionEvent(db, id) {
+    // SAFETY: row's shape matches the nine columns named in the SELECT below.
+    const row = db.prepare(`
       SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
       FROM session_events
       WHERE id = ?
     `).get(id);
-        if (!row) {
-            throw new Error('Failed to reload saved session event');
-        }
-        const loaded = rowToSessionEvent(row);
-        // SAFETY: recentRows' shape matches the nine columns named in the
-        // SELECT above.
-        const recentRows = db.prepare(`
+    if (!row) {
+        throw new Error('Failed to reload saved session event');
+    }
+    return rowToSessionEvent(row);
+}
+function recentSessionEventsOldestFirst(db, tenantId, sessionId, limit) {
+    // SAFETY: recentRows' shape matches the nine columns named in the SELECT below.
+    const recentRows = db.prepare(`
       SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
       FROM session_events
       WHERE session_id = ? AND tenant_id = ?
       ORDER BY created_at DESC, id DESC
       LIMIT ?
-    `).all(loaded.session_id, tenantId, 20);
-        const recent = recentRows.map(rowToSessionEvent).reverse();
+    `).all(sessionId, tenantId, limit);
+    return recentRows.map(rowToSessionEvent).reverse();
+}
+export function appendSessionEvent(hippoRoot, tenantId, event) {
+    assertTenantId('appendSessionEvent', tenantId);
+    const db = openStore(hippoRoot);
+    const now = new Date().toISOString();
+    // Scope is stored as given; default-deny in api.recall + cmdRecall
+    // continuity reads applies to slack:private:* and 'unknown:legacy' rows.
+    try {
+        const loaded = reloadSessionEvent(db, insertSessionEventRow(db, tenantId, event, now));
+        const recent = recentSessionEventsOldestFirst(db, tenantId, loaded.session_id, 20);
         writeRecentSessionMirror(hippoRoot, tenantId, recent);
         return loaded;
     }
@@ -244,8 +204,7 @@ export function appendSessionEvent(hippoRoot, tenantId, event) {
 }
 export function listSessionEvents(hippoRoot, tenantId, options = {}) {
     assertTenantId('listSessionEvents', tenantId);
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const clauses = ['tenant_id = ?'];
         const params = [tenantId];
         if (options.session_id) {
@@ -269,19 +228,12 @@ export function listSessionEvents(hippoRoot, tenantId, options = {}) {
       LIMIT ?
     `).all(...params);
         return rows.map(rowToSessionEvent).reverse();
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Return session_ids with a `session_complete` event newer than `sinceMs`.
- * Used by the sleep auto-promotion pass to bound scanning to a fixed window.
- */
+/** Session_ids with a `session_complete` event newer than `sinceMs`; bounds the sleep auto-promotion scan to a fixed window. */
 export function findPromotableSessions(hippoRoot, tenantId, sinceMs) {
     assertTenantId('findPromotableSessions', tenantId);
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: rows' shape matches the single `session_id` column selected
         // above.
         const rows = db.prepare(`
@@ -289,28 +241,54 @@ export function findPromotableSessions(hippoRoot, tenantId, sinceMs) {
       WHERE event_type = 'session_complete' AND created_at >= ? AND tenant_id = ?
     `).all(new Date(sinceMs).toISOString(), tenantId);
         return rows;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Idempotency guard — true if a trace-layer memory with this source_session_id
- * already exists.
- */
+/** Idempotency guard: true if a trace-layer memory with this source_session_id already exists. */
 export function traceExistsForSession(hippoRoot, tenantId, session_id) {
     assertTenantId('traceExistsForSession', tenantId);
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const row = db.prepare(`
       SELECT 1 FROM memories
       WHERE source_session_id = ? AND layer = 'trace' AND tenant_id = ?
       LIMIT 1
     `).get(session_id, tenantId);
         return !!row;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
+}
+/** The owner a session id is bound to, or null. */
+function selectSessionOwnerAt(db, tenantId, sessionId) {
+    // SAFETY: the SELECT names exactly this one TEXT column.
+    const row = db.prepare(`SELECT owner_subject FROM session_owners WHERE tenant_id = ? AND session_id = ?`).get(tenantId, sessionId);
+    return row?.owner_subject ?? null;
+}
+/** Binds `sessionId` to `owner` unless a binding exists; the count is 1 when this call bound it. */
+function insertSessionOwnerAt(db, tenantId, sessionId, owner, createdAt) {
+    const result = db.prepare(`INSERT OR IGNORE INTO session_owners(tenant_id, session_id, owner_subject, created_at) VALUES (?, ?, ?, ?)`)
+        .run(tenantId, sessionId, owner, createdAt);
+    return Number(result.changes ?? 0);
+}
+// SHORTCUT: no created_at index, so each first bind scans the table; add one past a few hundred thousand rows.
+/** Drops bindings created before `cutoffIso`. */
+function deleteSessionOwnersBeforeAt(db, cutoffIso) {
+    db.prepare(`DELETE FROM session_owners WHERE created_at < ?`).run(cutoffIso);
+}
+/** Binds under the write lock and returns the stored owner, which is not `owner` when a concurrent first bind won. */
+function insertSessionOwner(db, binding) {
+    const { tenantId, sessionId, owner, retentionMs } = binding;
+    withWriteScope(db, 'bind_session_owner', () => {
+        const bound = insertSessionOwnerAt(db, tenantId, sessionId, owner, new Date().toISOString());
+        // An older binary supersedes across owners, so the first binding shuts it out in the same transaction.
+        if (bound === 1)
+            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
+        // Pruned on write, as the failure log is; a pruned session id is a UUID no other caller knows.
+        deleteSessionOwnersBeforeAt(db, new Date(Date.now() - retentionMs).toISOString());
+    }, { busyWaitMs: scopedBusyWait() ?? HOOK_DB_WAIT_MS });
+    // Re-read, since a concurrent first bind may have won the INSERT OR IGNORE.
+    return selectSessionOwnerAt(db, tenantId, sessionId);
+}
+/** The owner stored for the session id, binding `binding.owner` first when none is stored. */
+export function sessionOwnerOrBind(hippoRoot, binding) {
+    // A bound session is the common case after the first prompt, so it must not take the write lock.
+    return onHandle(hippoRoot, (db) => selectSessionOwnerAt(db, binding.tenantId, binding.sessionId) ?? insertSessionOwner(db, binding));
 }
 //# sourceMappingURL=sessions.js.map

package/dist/store/sqlite/commit-watch.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseSyncLike } from '../../db/index.js';
+/** Calls `mark` before `db` is handed any statement that may commit. */
+export declare function watchCommits(db: DatabaseSyncLike, mark: () => void): void;
+//# sourceMappingURL=commit-watch.d.ts.map

package/dist/store/sqlite/commit-watch.js

@@ -0,0 +1,29 @@
+const ROLLS_BACK_PART = /^\s*ROLLBACK\s+TO\b/i;
+// After any of these the connection may be in autocommit, where a statement prepared earlier commits on its own.
+const ENDS_TRANSACTION = /^\s*(?:COMMIT|END|RELEASE|ROLLBACK)\b/i;
+// Reads, and the statements that open a transaction: none makes a change durable on its own.
+const NEVER_COMMITS = /^\s*(?:SELECT|BEGIN|SAVEPOINT|PRAGMA|EXPLAIN)\b/i;
+/** Whether running `sql` on `db` can make a change durable. Anything the patterns do not know counts as a commit. */
+function mayCommit(db, sql) {
+    if (ROLLS_BACK_PART.test(sql))
+        return false;
+    if (ENDS_TRANSACTION.test(sql))
+        return true;
+    return db.isTransaction !== true && !NEVER_COMMITS.test(sql);
+}
+/** Calls `mark` before `db` is handed any statement that may commit. */
+export function watchCommits(db, mark) {
+    const exec = db.exec.bind(db);
+    const prepare = db.prepare.bind(db);
+    db.exec = (sql) => {
+        if (mayCommit(db, sql))
+            mark();
+        exec(sql);
+    };
+    db.prepare = (sql) => {
+        if (mayCommit(db, sql))
+            mark();
+        return prepare(sql);
+    };
+}
+//# sourceMappingURL=commit-watch.js.map

package/dist/store/sqlite/connector-events-group.d.ts

@@ -0,0 +1,5 @@
+import type { ConnectorEvents, Sync } from '../port.js';
+export declare function sqliteConnectorEvents(hippoRoot: string): Sync<ConnectorEvents>;
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export declare function servedConnectorEvents(sync: Sync<ConnectorEvents>): ConnectorEvents;
+//# sourceMappingURL=connector-events-group.d.ts.map

package/dist/store/sqlite/connector-events-group.js

@@ -0,0 +1,50 @@
+// hippo.db's half of the ConnectorEvents store group: each call on a handle of its own.
+import { archiveDeletedArtifact, eventSeenAt, githubRouting, insertGitHubDlq, logEvent, seenEvent } from '../connectors/github.js';
+import { insertSlackDlq, markSlackEventSeen, rawMemoryIdForArtifactAt, slackEventRecord, slackEventSeenAt, slackTeamRoute } from '../connectors/slack.js';
+import { onHandle } from '../open.js';
+function eventRecord(hippoRoot, event) {
+    if (event.connector === 'slack')
+        return slackEventRecord(hippoRoot, event.eventId);
+    const logged = seenEvent(hippoRoot, event.idempotencyKey);
+    return logged ? { seen: true, memoryId: logged.memoryId } : { seen: false };
+}
+function markEventSeen(hippoRoot, event) {
+    if (event.connector === 'slack')
+        return markSlackEventSeen(hippoRoot, event.eventId, null);
+    const { idempotencyKey, deliveryId, eventName } = event;
+    logEvent(hippoRoot, { idempotencyKey, deliveryId, eventName, memoryId: null });
+}
+function deletionTarget(hippoRoot, { event, artifactRef, tenantId }) {
+    return onHandle(hippoRoot, (db) => {
+        const seen = event.connector === 'slack' ? slackEventSeenAt(db, event.eventId) : eventSeenAt(db, event.idempotencyKey);
+        return seen ? { seen: true } : { seen: false, memoryId: rawMemoryIdForArtifactAt(db, artifactRef, tenantId) };
+    });
+}
+function archiveArtifact(hippoRoot, { tenantId, actor, artifactRef, reason, event }) {
+    const { idempotencyKey, deliveryId, eventName } = event;
+    return archiveDeletedArtifact(hippoRoot, { tenantId, artifactRef, idempotencyKey, deliveryId, eventName, reason, who: actor });
+}
+export function sqliteConnectorEvents(hippoRoot) {
+    return {
+        eventRecord: (event) => eventRecord(hippoRoot, event),
+        markEventSeen: (event) => markEventSeen(hippoRoot, event),
+        deletionTarget: (lookup) => deletionTarget(hippoRoot, lookup),
+        archiveDeletedArtifact: (archive) => archiveArtifact(hippoRoot, archive),
+        slackTeamRoute: (teamId) => slackTeamRoute(hippoRoot, teamId),
+        githubRouting: (query) => githubRouting(hippoRoot, query),
+        parkDeadLetter: (letter) => (letter.connector === 'slack' ? insertSlackDlq(hippoRoot, letter) : insertGitHubDlq(hippoRoot, letter)),
+    };
+}
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export function servedConnectorEvents(sync) {
+    return {
+        eventRecord: async (event) => sync.eventRecord(event),
+        markEventSeen: async (event) => sync.markEventSeen(event),
+        deletionTarget: async (lookup) => sync.deletionTarget(lookup),
+        archiveDeletedArtifact: async (archive) => sync.archiveDeletedArtifact(archive),
+        slackTeamRoute: async (teamId) => sync.slackTeamRoute(teamId),
+        githubRouting: async (query) => sync.githubRouting(query),
+        parkDeadLetter: async (letter) => sync.parkDeadLetter(letter),
+    };
+}
+//# sourceMappingURL=connector-events-group.js.map

package/dist/store/sqlite/connector-writes-group.d.ts

@@ -0,0 +1,6 @@
+import type { ConnectorWrites, Sync } from '../port.js';
+/** Each call on its own handle; the mirror follows the commit, so a duplicate or a rolled-back write leaves none. */
+export declare function sqliteConnectorWrites(hippoRoot: string): Sync<ConnectorWrites>;
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export declare function servedConnectorWrites(sync: Sync<ConnectorWrites>): ConnectorWrites;
+//# sourceMappingURL=connector-writes-group.d.ts.map

package/dist/store/sqlite/connector-writes-group.js

@@ -0,0 +1,65 @@
+import { eventMemoryAt, logEventAt } from '../connectors/github.js';
+import { markSlackEventSeenAt, slackEventMemoryAt } from '../connectors/slack.js';
+import { stampOriginProject } from '../entry-row.js';
+import { writeEntryMirrors } from '../entry-writes.js';
+import { onHandle, openStore } from '../open.js';
+import { recordQuarantine } from '../quarantine.js';
+import { archiveRawAt, writeInOwnTenant } from './entry-writes-group.js';
+/** Unwinds a write whose event key is already logged. Caught in this file, so no caller ever sees it. */
+class EventAlreadyLogged extends Error {
+}
+/** False when the key was logged before: the insert ignores a taken key, so the first writer's row stays. */
+function logEvent(db, event, memoryId) {
+    if (event.connector === 'slack')
+        return markSlackEventSeenAt(db, event.eventId, memoryId);
+    const { idempotencyKey, deliveryId, eventName } = event;
+    return logEventAt(db, { idempotencyKey, deliveryId, eventName, memoryId });
+}
+function loggedMemory(db, event) {
+    return event.connector === 'slack' ? slackEventMemoryAt(db, event.eventId) : eventMemoryAt(db, event.idempotencyKey);
+}
+/** The record, then the log row, go in after the memory row and ahead of its remember row, as a second store must order them. */
+function writeWithCompanions(db, { entry, actor, event, quarantine }) {
+    writeInOwnTenant(db, entry, actor, (handle, memoryId) => {
+        if (quarantine)
+            recordQuarantine(handle, { tenantId: entry.tenantId, memoryId, originalScope: quarantine.originalScope, reason: quarantine.reason, actor });
+        if (event && !logEvent(handle, event, memoryId))
+            throw new EventAlreadyLogged();
+    });
+}
+function writeOnce(db, write) {
+    try {
+        writeWithCompanions(db, write);
+        return { outcome: 'written' };
+    }
+    catch (err) {
+        if (!(err instanceof EventAlreadyLogged) || !write.event)
+            throw err;
+        // The scope has unwound, so this reads the winner's committed row.
+        return { outcome: 'duplicate', memoryId: loggedMemory(db, write.event) };
+    }
+}
+/** Each call on its own handle; the mirror follows the commit, so a duplicate or a rolled-back write leaves none. */
+export function sqliteConnectorWrites(hippoRoot) {
+    return {
+        writeConnectorEntry(write) {
+            const entry = stampOriginProject(hippoRoot, write.entry);
+            const result = onHandle(hippoRoot, (db) => writeOnce(db, { ...write, entry }), openStore);
+            if (result.outcome === 'written')
+                writeEntryMirrors(hippoRoot, entry);
+            return result;
+        },
+        archiveConnectorEntry(archive) {
+            // The log write's answer is unread: a key logged before keeps its row and the archive stands.
+            return archiveRawAt(hippoRoot, archive, (db, archivedId) => { logEvent(db, archive.event, archivedId); });
+        },
+    };
+}
+/** The group as a served store answers it: each call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export function servedConnectorWrites(sync) {
+    return {
+        writeConnectorEntry: async (write) => sync.writeConnectorEntry(write),
+        archiveConnectorEntry: async (archive) => sync.archiveConnectorEntry(archive),
+    };
+}
+//# sourceMappingURL=connector-writes-group.js.map

package/dist/store/sqlite/dag-reads-group.d.ts

@@ -0,0 +1,3 @@
+import type { DagReads, Sync } from '../port.js';
+export declare function sqliteDagReads(hippoRoot: string): Sync<DagReads>;
+//# sourceMappingURL=dag-reads-group.d.ts.map

package/dist/store/sqlite/dag-reads-group.js

@@ -0,0 +1,45 @@
+import { pagedDescendants } from '../descendant-page.js';
+import { countSessionRawMemories, loadSessionRawMemories, selectChildrenByParent, selectEntriesByIds } from '../entry-reads.js';
+import { onHandle, openStore } from '../open.js';
+export function sqliteDagReads(hippoRoot) {
+    return {
+        sessionRawEntries({ tenantId, sessionId, cap, origins }) {
+            return loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap, origins);
+        },
+        sessionRawCount({ tenantId, sessionId, scope, ownScope, origins }) {
+            return countSessionRawMemories(hippoRoot, sessionId, tenantId, scope, ownScope, origins);
+        },
+        summaryWithDescendants(tenantId, id, walk) {
+            return onHandle(hippoRoot, (db) => summaryWithDescendantsAt(db, tenantId, id, walk), openStore);
+        },
+    };
+}
+// dag_parent_id is not unique to a tree, so `seen` keeps a mislinked row from being listed twice or walked in a loop.
+function summaryWithDescendantsAt(db, tenantId, id, { depth, admit, page }) {
+    const summary = selectEntriesByIds(db, [id], tenantId).get(id);
+    if (!summary)
+        return null;
+    if (page)
+        return pagedDescendants(db, { tenantId, summary, depth, page }, admit(summary));
+    const levels = [];
+    const seen = new Set([id]);
+    let parents = admit(summary) ? [id] : [];
+    for (let level = 0; level < depth && parents.length > 0; level++) {
+        const childrenOf = selectChildrenByParent(db, parents, tenantId);
+        const admitted = [];
+        for (const parentId of parents) {
+            for (const child of childrenOf.get(parentId) ?? []) {
+                if (seen.has(child.id) || !admit(child))
+                    continue;
+                seen.add(child.id);
+                admitted.push(child);
+            }
+        }
+        if (admitted.length === 0)
+            break;
+        levels.push(admitted);
+        parents = admitted.map((row) => row.id);
+    }
+    return { summary, levels };
+}
+//# sourceMappingURL=dag-reads-group.js.map

package/dist/store/sqlite/entry-writes-group.d.ts

@@ -0,0 +1,18 @@
+import { type DatabaseSyncLike } from '../../db/index.js';
+import { type MemoryEntry } from '../../core/memory.js';
+import { type ArchiveOpts } from '../raw-archive.js';
+import type { EntryWrite, EntryWrites, OutcomeWrite, RawArchive, Sync } from '../port.js';
+import { type WriteEntryOptions } from '../entry-writes.js';
+/** Each call on its own handle; mirrors and the forgotten counter follow the commit, so a rolled-back write leaves neither. */
+export declare function sqliteEntryWrites(hippoRoot: string): Sync<EntryWrites>;
+/** A store-side hook writes on the row's handle inside its write scope, so its throw undoes the row. */
+export declare function writeEntryAt(hippoRoot: string, { entry, actor }: EntryWrite, afterWrite?: WriteEntryOptions['afterWrite']): void;
+/** A trace link follows the commit on the same handle and names only the ids applied, so a rolled-back outcome leaves none. */
+export declare function applyOutcomeAt(hippoRoot: string, outcome: OutcomeWrite, traceId?: number): string[];
+/** Reach is checked inside the archive's write scope. A store-side hook writes on the same handle inside that scope, so its throw undoes the archive. */
+export declare function archiveRawAt(hippoRoot: string, archive: RawArchive, afterArchive?: ArchiveOpts['afterArchive']): string;
+/** The refusal row lands after `write` has rolled back, in a fresh implicit transaction the aborted one cannot undo. */
+export declare function auditingRefusal<T>(db: DatabaseSyncLike, actor: string, write: () => T): T;
+/** writeEntryAt on the caller's handle, so a sibling group can read on it after the scope has unwound. */
+export declare function writeInOwnTenant(db: DatabaseSyncLike, entry: MemoryEntry, actor: string, afterWrite?: WriteEntryOptions['afterWrite']): void;
+//# sourceMappingURL=entry-writes-group.d.ts.map