hippo-memory 1.69.0 → 1.71.0

package/dist/store-port.d.ts

@@ -1,262 +0,0 @@
-import type { AmbientTallies } from './ambient.js';
-import { type AmbientStoreFilter } from './ambient-store.js';
-import { type ApiKeyListRow, type ApiKeyRecord, type ListApiKeysOpts, type NewApiKey } from './auth.js';
-import { type AppendAuditOpts, type AuditEvent, type ListAuditAfterOpts } from './audit.js';
-import type { ContinuityBlock } from './api/recall-types.js';
-import { type EmbeddingIndexState } from './embeddings.js';
-import { type ActiveGoals, type GetActiveGoalsOpts, type GoalRecallLogRow } from './goals.js';
-import type { SessionHandoff } from './handoff.js';
-import type { JsonValue } from './json.js';
-import type { MemoryEntry } from './memory.js';
-import type { PhysicsParticle } from './physics.js';
-import { type PlanningFallacyEvidence } from './predictions/planning-fallacy.js';
-import { type RecallTraceInput } from './recall-trace.js';
-import { type AmbientLoadResult, type AmbientRecallRequest, type ContextCandidateFilter, type RecentOrigins } from './store/candidates.js';
-import { type StrengthenOptions } from './store/entry-writes.js';
-import { type OriginFilter, type VectorCandidateSpec } from './store/search-rows.js';
-import { type ContinuityKey } from './store/sessions.js';
-import { type TokenUse } from './token-ledger.js';
-/** The arguments of `loadRecallSearchEntries` after the query, by name. */
-export interface RecallSearchArgs {
-    readonly limit: number;
-    readonly tenantId?: string;
-    readonly requestedScope?: string;
-    readonly explicitScopeMode: 'exact' | 'additive';
-    readonly includeSuperseded: boolean;
-    readonly originProjects?: OriginFilter;
-    /** The caller's personal scope, which the default deny admits; undefined admits no personal row. */
-    readonly ownScope: string | undefined;
-}
-/** Everything one recall writes once its reply is decided, so a store writes it on one connection. */
-export interface RecallWrites {
-    /** Insert or ignore on (memory_id, goal_id), so the first row wins, a duplicate inside this batch included. First drop a row
-     *  whose memory_id is in no memories row of this store, whatever that row's tenant, as `localGoalRecallRows` does. */
-    readonly goalLog: readonly GoalRecallLogRow[];
-    /** In the order they happened. */
-    readonly audit: readonly AppendAuditOpts[];
-    readonly trace?: RecallTraceInput;
-    /** Nothing when `recallBoostAblated`. Each id found, in `tenantId` when set, gets the retrieval_count, last_retrieved,
-     *  half_life_days and strength `markRetrieved` computes from the row read before any update, so a repeated id moves once. */
-    readonly strengthen?: {
-        readonly ids: readonly string[];
-        readonly opts: StrengthenOptions;
-    };
-}
-/** The reads behind recall's vector arm. */
-export interface VectorReads {
-    /** The stored model and whether any vector exists, in one snapshot. */
-    embeddingIndexState(): Promise<EmbeddingIndexState>;
-    storedVectors(ids: readonly string[]): Promise<Map<string, number[]>>;
-    /** The `spec.limit ?? 50` rows nearest `queryVector` by `rankVectorRows` among those where the tenant matches (when set), kind is not 'archived', a superseded row
-     *  shows only with `includeSuperseded`, scope follows `RecallScopeFilter`, and origin is '' or listed (when `spec.origin` is set). */
-    nearestEntries(queryVector: readonly number[], spec: VectorCandidateSpec): Promise<MemoryEntry[]>;
-    /** The particles of `ids` only; an empty list reads nothing. */
-    physicsParticles(ids: readonly string[]): Promise<Map<string, PhysicsParticle>>;
-}
-/** One memory's vector, computed by the caller's embedding provider. */
-export interface VectorRowWrite {
-    readonly memoryId: string;
-    readonly vector: readonly number[];
-    /** Kept only when the memory has no particle yet, under `memoryId` whatever its own memoryId says. */
-    readonly particle?: PhysicsParticle;
-}
-export interface VectorWrite {
-    readonly tenantId: string;
-    /** The index identity the vectors were built by, `embeddingIndexIdentity(provider.id)`. */
-    readonly model: string;
-    /** Set only by embedAll's rebuild, so a write that read the index state before another process rebuilt it cannot drop that rebuild. */
-    readonly replaceIndex: boolean;
-    readonly rows: readonly VectorRowWrite[];
-}
-export interface VectorWriteResult {
-    readonly written: number;
-    /** True when another model built the index and `replaceIndex` is false; the store then keeps nothing and `written` is 0. */
-    readonly modelMismatch: boolean;
-}
-export interface VectorBackfillQuery {
-    readonly model: string;
-    /** Only ids above this one in byte order; unset starts at the first. */
-    readonly afterId?: string;
-    /** Clamped to 1..500; a non-integer rejects with RangeError `limit must be an integer`. */
-    readonly limit: number;
-    /** Every tenant when unset, since the backfill covers the whole store. */
-    readonly tenantId?: string;
-}
-/** The writes behind embed on write and the backfill: core computes each vector, the store only keeps it.
- *  A store deletes a memory's vector and particle when the memory is deleted (hippo.db does it by trigger and foreign-key cascade). */
-export interface VectorWrites {
-    /** Memories of any kind with no vector stored under `query.model`, by id ascending in byte order. */
-    entriesWithoutVector(query: VectorBackfillQuery): Promise<MemoryEntry[]>;
-    /** In one transaction: refuses with `modelMismatch` if `replacesIndex` and not `replaceIndex`; else, when a row is writable (memory in `tenantId`, vector non-empty
-     *  and finite), drops every vector and particle if `replacesIndex`, keeps each writable row under `model` with its particle where none exists, sets `model`. No audit row. */
-    writeVectors(write: VectorWrite): Promise<VectorWriteResult>;
-}
-export interface KeyRevoke {
-    readonly tenantId: string;
-    readonly keyId: string;
-    readonly actor: string;
-    readonly at: string;
-}
-export interface KeyAudit {
-    /** Sets revoked_at to `at` and appends one auth_revoke row (the key's tenant, `actor`, the key id) in one transaction, then resolves to `at`. A revoked
-     *  key resolves to its own revoked_at and writes nothing; a key missing from `tenantId` rejects with NotFoundError `Unknown key_id: <keyId>`. */
-    revokeApiKey(revoke: KeyRevoke): Promise<string>;
-    /** As `listAuditEventsAfter`: rows above `afterId` in ascending id order, with its RangeErrors, limit clamp and tenant filter. */
-    auditEventsAfter(opts: ListAuditAfterOpts): Promise<AuditEvent[]>;
-    /** The highest audit id ever assigned, pruned rows included, 0 before the first; a tail that sees it drop knows the log was restored. */
-    auditHighId(): Promise<number>;
-}
-/** One ambient load: the pins, the `recentNeeded` newest rows `admit` keeps, and the prompt-recall candidates. */
-export interface AmbientCandidateRequest {
-    readonly recentNeeded: number;
-    /** Sees each row in the order `loadAmbientCandidates` reads them, since the delivery ledger counts its refusals. */
-    readonly admit: (e: MemoryEntry) => boolean;
-    readonly recall?: AmbientRecallRequest;
-    readonly origins?: RecentOrigins;
-}
-/** The reads behind getContext beyond the base `continuity`: its fallback handoff, candidate rows and ambient tallies.
- *  getContext with a query under an embedding provider needs `vectors` too, and answers 501 without it. */
-export interface ContextReads {
-    /** The newest handoff of the last `maxAgeMs` that is its session's highest id, has no outcome or a partial or failed one, and
-     *  passes recall's default scope deny, as `loadLatestHandoff` with `unfinishedOnly` and `scopeFilter: 'default-deny'`. Rejects an empty tenant id. */
-    unfinishedHandoff(tenantId: string, maxAgeMs: number, key: ContinuityKey | null): Promise<SessionHandoff | null>;
-    /** As `loadAmbientCandidates`; `recall` searches with the query `rarestFtsQuery` builds from FTS document counts over every tenant's rows,
-     *  and finds nothing when no term is indexed. Core keeps only `tenantId`'s rows that its own admit passes, whatever the store returns. */
-    ambientCandidates(tenantId: string, request: AmbientCandidateRequest): Promise<AmbientLoadResult>;
-    /** As `loadContextCandidates`: at most `filter.cap` live rows, pins and then the least decayed first, returned by created, then id. */
-    contextCandidates(tenantId: string, filter: ContextCandidateFilter): Promise<MemoryEntry[]>;
-    /** As `loadAmbientTallies`: one aggregate over the live, unarchived rows `filter` admits, less other projects' secret-tagged rows. */
-    ambientTallies(tenantId: string, filter: AmbientStoreFilter): Promise<AmbientTallies>;
-}
-export interface EntryWrite {
-    readonly entry: MemoryEntry;
-    readonly actor: string;
-}
-/** Who acts on which of a tenant's rows; `ownScope` is the caller's personal scope, so every other personal row is out of reach. */
-export interface EntryTarget {
-    readonly tenantId: string;
-    readonly actor: string;
-    readonly ownScope: string | null;
-}
-export interface OutcomeWrite extends EntryTarget {
-    readonly ids: readonly string[];
-    readonly good: boolean;
-}
-export interface SupersedeWrite extends EntryTarget {
-    readonly oldId: string;
-    readonly successor: MemoryEntry;
-}
-export interface EntryRemoval extends EntryTarget {
-    readonly id: string;
-}
-export interface RawArchive extends EntryRemoval {
-    readonly reason: string;
-}
-/** The memory-row writes behind remember, outcome, supersede, archive and forget. Each writes its audit rows in the write's own transaction,
- *  a child row's change marks its level 2 or 3 summary parent dirty (one summary_marked_dirty row on the flip), and the schema's rules hold. */
-export interface EntryWrites {
-    /** Upserts the row, its full-text row and one remember row ({kind, scope}) in the entry's tenant; an id another tenant holds rejects in the transaction with ConflictError `Memory <id>
-     *  belongs to another tenant`. Content the write brings into a tenant that tombstoned it rejects with RejectedValueError and writes one reject_refusal row after the rollback, best effort. */
-    writeEntry(write: EntryWrite): Promise<void>;
-    /** For each id in order, a row of the tenant within reach gets `entryAfterOutcome`, a rewrite as writeEntry does and one outcome row ({good}); other ids are skipped, a repeated id builds
-     *  on its first outcome. Each read holds the row's lock to commit (SELECT ... FOR UPDATE), so a supersede between read and rewrite is not undone. Resolves to the ids applied, repeats kept. */
-    applyOutcome(outcome: OutcomeWrite): Promise<string[]>;
-    /** Sets the old row's superseded_by where it is within reach and not yet superseded, both checked in the transaction, else rejects with NotFoundError `memory not found: <oldId>` or
-     *  ConflictError `Memory <oldId> already superseded by another writer`. Then writes the successor as writeEntry does and one supersede row ({newId}), all or nothing. */
-    supersede(write: SupersedeWrite): Promise<void>;
-    /** Moves a raw row to raw_archive (metadata only, no content), deletes it and its full-text row and writes one archive_raw row ({reason});
-     *  resolves to the archived_at written. A row out of reach rejects with NotFoundError `memory not found: <id>`, any other kind with BadRequestError. */
-    archiveRaw(archive: RawArchive): Promise<string>;
-    /** Deletes the row and its full-text row and writes one forget row; a raw row rejects, being append-only. A row out of reach rejects with
-     *  NotFoundError `memory not found: <id>`. Archive and forget then add one to the store-wide forgotten counter, best effort. */
-    forget(removal: EntryRemoval): Promise<void>;
-}
-/** A key to insert and the actor and metadata of its auth_create row, whose tenant and target are the key's. Neither holds the plaintext. */
-export interface KeyMint {
-    readonly key: NewApiKey;
-    readonly actor: string;
-    readonly metadata: Readonly<Record<string, JsonValue>>;
-}
-export interface SelfKeyMint extends KeyMint {
-    readonly key: NewApiKey & {
-        readonly ownerSubject: string;
-        readonly expiresAt: string;
-    };
-    /** Live keys the owner may hold in the tenant once this one is in. */
-    readonly perSubject: number;
-}
-/** `listApiKeyRows`'s filters, always inside one tenant. */
-export interface KeyListQuery extends Omit<ListApiKeysOpts, 'tenantId'> {
-    readonly tenantId: string;
-}
-export interface KeyWrites {
-    /** Inserts the key and appends its auth_create row in one transaction; with either one failing, neither is written. A key id taken in any tenant
-     *  rejects, since keys are looked up by id alone. */
-    createApiKey(mint: KeyMint): Promise<void>;
-    /** One transaction, serialized per (tenant, owner) before the count (hippo.db BEGIN IMMEDIATE, Postgres pg_advisory_xact_lock on the pair): revoke at `key.createdAt`
-     *  the owner's oldest live keys in the key's tenant down to `perSubject - 1`, insert the key, append an auth_revoke row `{ replacedBy: <new key id> }` per revoked key,
-     *  then the auth_create row; resolves to the revoked ids. Live: unrevoked, expires_at null or Date.parse(expires_at) after createdAt (NaN counts as expired). */
-    createSelfApiKey(mint: SelfKeyMint): Promise<string[]>;
-    /** As `listApiKeyRows`: newest inserted first, each with its scope grants; `active` drops revoked rows and an expires_at not above now's toISOString. */
-    listApiKeys(query: KeyListQuery): Promise<ApiKeyListRow[]>;
-}
-/** The optional groups: a store sets each one whole or leaves it unset, and a route or MCP tool names the one it needs. */
-export interface StoreGroups {
-    /** Unset on a store built before them, where hybrid and physics recall under an embedding provider answer 501. */
-    readonly vectors: VectorReads;
-    readonly keyAudit: KeyAudit;
-    readonly keyWrites: KeyWrites;
-    /** embedMemory and embedAll with a store need it and `vectors`. */
-    readonly vectorWrites: VectorWrites;
-    readonly entryWrites: EntryWrites;
-    readonly contextReads: ContextReads;
-}
-export type StoreGroup = 'base' | keyof StoreGroups;
-export declare function hasGroup(store: HippoStore, group: StoreGroup): boolean;
-/** The group's methods; a store without them throws StoreNotPortedError, which answers 501 as any unported path does. */
-export declare function requireGroup<G extends keyof StoreGroups>(store: HippoStore, group: G): StoreGroups[G];
-/** What `serve()` reads and writes through. Each method is atomic and no transaction spans an await, since SQLite's lock wait blocks the event loop; a lock timeout throws `StoreBusyError`. */
-export interface HippoStore extends Partial<StoreGroups> {
-    /** 'sqlite' is hippo.db under the served root. Under any other kind, an unported route answers 501 and a hippo.db open inside a request throws. */
-    readonly kind: string;
-    /** The api_keys row for `keyId` with its scope grants, revoked or not; null when no row matches. */
-    findApiKey(keyId: string): Promise<ApiKeyRecord | null>;
-    /** Recall candidates in `loadRecallSearchEntries` order: FTS, then LIKE, then every row in scope. */
-    searchRecallEntries(query: string, args: RecallSearchArgs): Promise<MemoryEntry[]>;
-    /** The rows among the first 500 ids, a tenant narrowing them, ordered by created, then content, then id, all ascending,
-     *  as `loadEntriesByIds` does; the input order is ignored. */
-    entriesByIds(ids: readonly string[], tenantId?: string): Promise<MemoryEntry[]>;
-    /** The session's active goals and their policies, read together so a goal and its policy never disagree. */
-    activeGoals(opts: GetActiveGoalsOpts): Promise<ActiveGoals>;
-    /** The first `count` (at most 200) unsuperseded raw rows a tenant, a non-empty session id and non-null `origins` (those projects and
-     *  user-global rows) must narrow, by created descending, then content and id ascending, as `loadFreshRawMemories` does. */
-    freshRawEntries(count: number, tenantId: string | undefined, sessionId: string | undefined, origins: readonly string[] | null): Promise<MemoryEntry[]>;
-    /** The newest active snapshot a non-null `key` must narrow to one owner and project (null only on an unshared hippo.db), then for its session
-     *  the newest handoff (same key) and `eventLimit` newest events returned oldest first, each tie broken by the larger id; the caller applies scope. */
-    continuity(tenantId: string, eventLimit: number, key: ContinuityKey | null): Promise<ContinuityBlock>;
-    /** Resolves a forward claim's tokens to one class and reads its baserate, writing no audit row. */
-    planningFallacyEvidence(tenantId: string, classQueryTokens: readonly string[]): Promise<PlanningFallacyEvidence>;
-    /** Appends the rows in order, all or none. */
-    appendAuditEvents(events: readonly AppendAuditOpts[]): Promise<void>;
-    /** Writes the goal log and audit rows in one transaction and rejects with none written if it fails. Then the trace and
-     *  the strengthen, each on its own: a failure there logs and still resolves, since the reply is already decided. */
-    finishRecall(writes: RecallWrites): Promise<void>;
-    /** Adds `recalled` to the one store-wide total_recalled counter, no tenant; the SQLite store also rewrites stats.json. */
-    bumpRecallStats(recalled: number): Promise<void>;
-    /** One token-ledger row. Throws, so the caller decides whether a ledger failure matters. */
-    recordTokens(use: TokenUse): Promise<void>;
-    /** Releases the store's connections; `serve()` closes only a store it made itself. */
-    close(): Promise<void>;
-}
-/** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
-export declare function storeFor(ctx: {
-    readonly hippoRoot: string;
-    readonly store?: HippoStore;
-}): HippoStore;
-/** The built-in store: today's synchronous hippo.db functions behind the port, each call on its own short-lived handles, so close has nothing to release. */
-export declare function sqliteStore(hippoRoot: string): HippoStore & StoreGroups;
-/** sqliteStore's continuity read, for the synchronous recall that cannot await the port. */
-export declare function continuityAt(hippoRoot: string, tenantId: string, eventLimit: number, key: ContinuityKey | null): ContinuityBlock;
-/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
-export declare function finishRecallAt(hippoRoot: string, writes: RecallWrites): void;
-//# sourceMappingURL=store-port.d.ts.map

package/dist/store-port.js

@@ -1,178 +0,0 @@
-import { loadAmbientTallies } from './ambient-store.js';
-import { listApiKeyRows, readApiKeyRecord } from './auth.js';
-import { appendAuditEvent, listAuditEventsAfter } from './audit.js';
-import { withWriteScope } from './db.js';
-import { StoreNotPortedError } from './db/sqlite-blocked.js';
-import { embeddingIndexStateAt, loadStoredVectors } from './embeddings.js';
-import { activeGoalsWithPolicies, localGoalRecallRows, writeGoalRecallLog, } from './goals.js';
-import { loadPhysicsState } from './physics-state.js';
-import { planningFallacyEvidenceAt } from './predictions/planning-fallacy.js';
-import { writeRecallTrace } from './recall-trace.js';
-import { loadAmbientCandidates, loadContextCandidates, } from './store/candidates.js';
-import { loadEntriesByIds, loadFreshRawMemories } from './store/entry-reads.js';
-import { auditHighIdAt, revokeKeyAt } from './store/key-audit.js';
-import { createKeyAt, createSelfKeyAt } from './store/key-writes.js';
-import { strengthenRetrievedInOwnTx } from './store/entry-writes.js';
-import { sqliteEntryWrites } from './store/entry-writes-group.js';
-import { loadLatestHandoff } from './store/handoffs.js';
-import { updateStats } from './store/index-and-stats.js';
-import { onHandle } from './store/open.js';
-import { loadRecallSearchEntries, loadVectorCandidateEntries } from './store/search-rows.js';
-import { listSessionEvents, loadActiveTaskSnapshot } from './store/sessions.js';
-import { entriesWithoutVectorAt, writeVectorsAt } from './store/vector-writes.js';
-import { recordTokenUse } from './token-ledger.js';
-export function hasGroup(store, group) {
-    return group === 'base' || store[group] !== undefined;
-}
-/** The group's methods; a store without them throws StoreNotPortedError, which answers 501 as any unported path does. */
-export function requireGroup(store, group) {
-    const groups = store;
-    const methods = groups[group];
-    if (methods === undefined)
-        throw new StoreNotPortedError(store.kind, group);
-    return methods;
-}
-/** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
-export function storeFor(ctx) {
-    return ctx.store ?? sqliteStore(ctx.hippoRoot);
-}
-/** The built-in store: today's synchronous hippo.db functions behind the port, each call on its own short-lived handles, so close has nothing to release. */
-export function sqliteStore(hippoRoot) {
-    return {
-        kind: 'sqlite',
-        async findApiKey(keyId) {
-            return onHandle(hippoRoot, (db) => readApiKeyRecord(db, keyId));
-        },
-        async searchRecallEntries(query, args) {
-            return loadRecallSearchEntries(hippoRoot, query, args.limit, args.tenantId, args.requestedScope, args.explicitScopeMode, args.includeSuperseded, args.originProjects, args.ownScope);
-        },
-        async entriesByIds(ids, tenantId) {
-            return loadEntriesByIds(hippoRoot, ids, tenantId);
-        },
-        async activeGoals(opts) {
-            return activeGoalsWithPolicies(hippoRoot, opts);
-        },
-        async freshRawEntries(count, tenantId, sessionId, origins) {
-            return loadFreshRawMemories(hippoRoot, count, tenantId, sessionId, origins ?? undefined);
-        },
-        async continuity(tenantId, eventLimit, key) {
-            return continuityAt(hippoRoot, tenantId, eventLimit, key);
-        },
-        async planningFallacyEvidence(tenantId, classQueryTokens) {
-            return planningFallacyEvidenceAt(hippoRoot, tenantId, classQueryTokens);
-        },
-        async appendAuditEvents(events) {
-            if (events.length === 0)
-                return;
-            onHandle(hippoRoot, (db) => withWriteScope(db, 'append_audit_events', () => {
-                for (const event of events)
-                    appendAuditEvent(db, event);
-            }));
-        },
-        async finishRecall(writes) {
-            finishRecallAt(hippoRoot, writes);
-        },
-        async bumpRecallStats(recalled) {
-            updateStats(hippoRoot, { recalled });
-        },
-        async recordTokens(use) {
-            onHandle(hippoRoot, (db) => recordTokenUse(db, use));
-        },
-        vectors: {
-            async embeddingIndexState() {
-                return embeddingIndexStateAt(hippoRoot);
-            },
-            async storedVectors(ids) {
-                return loadStoredVectors(hippoRoot, ids);
-            },
-            async nearestEntries(queryVector, spec) {
-                return loadVectorCandidateEntries(hippoRoot, queryVector, spec);
-            },
-            async physicsParticles(ids) {
-                // loadPhysicsState reads every row for an empty list.
-                return ids.length === 0 ? new Map() : onHandle(hippoRoot, (db) => loadPhysicsState(db, [...ids]));
-            },
-        },
-        keyAudit: sqliteKeyAudit(hippoRoot),
-        keyWrites: sqliteKeyWrites(hippoRoot),
-        vectorWrites: {
-            async entriesWithoutVector(query) {
-                return onHandle(hippoRoot, (db) => entriesWithoutVectorAt(db, query));
-            },
-            async writeVectors(write) {
-                return onHandle(hippoRoot, (db) => writeVectorsAt(db, write));
-            },
-        },
-        entryWrites: sqliteEntryWrites(hippoRoot),
-        contextReads: sqliteContextReads(hippoRoot),
-        async close() { },
-    };
-}
-function sqliteContextReads(hippoRoot) {
-    return {
-        async unfinishedHandoff(tenantId, maxAgeMs, key) {
-            return loadLatestHandoff(hippoRoot, tenantId, undefined, { unfinishedOnly: true, maxAgeMs, scopeFilter: 'default-deny' }, key ?? undefined);
-        },
-        async ambientCandidates(tenantId, { recentNeeded, admit, recall, origins }) {
-            return loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit, recall, origins);
-        },
-        async contextCandidates(tenantId, filter) {
-            return loadContextCandidates(hippoRoot, tenantId, filter);
-        },
-        async ambientTallies(tenantId, filter) {
-            return loadAmbientTallies(hippoRoot, tenantId, filter);
-        },
-    };
-}
-function sqliteKeyWrites(hippoRoot) {
-    return {
-        async createApiKey(mint) {
-            onHandle(hippoRoot, (db) => createKeyAt(db, mint));
-        },
-        async createSelfApiKey(mint) {
-            return onHandle(hippoRoot, (db) => createSelfKeyAt(db, mint));
-        },
-        async listApiKeys(query) {
-            return onHandle(hippoRoot, (db) => listApiKeyRows(db, query));
-        },
-    };
-}
-function sqliteKeyAudit(hippoRoot) {
-    return {
-        async revokeApiKey(revoke) {
-            return onHandle(hippoRoot, (db) => revokeKeyAt(db, revoke));
-        },
-        async auditEventsAfter(opts) {
-            return onHandle(hippoRoot, (db) => listAuditEventsAfter(db, opts));
-        },
-        async auditHighId() {
-            return onHandle(hippoRoot, auditHighIdAt);
-        },
-    };
-}
-/** sqliteStore's continuity read, for the synchronous recall that cannot await the port. */
-export function continuityAt(hippoRoot, tenantId, eventLimit, key) {
-    const activeSnapshot = loadActiveTaskSnapshot(hippoRoot, tenantId, key ?? undefined);
-    const sessionId = activeSnapshot?.session_id ?? undefined;
-    return {
-        activeSnapshot,
-        sessionHandoff: sessionId ? loadLatestHandoff(hippoRoot, tenantId, sessionId, {}, key ?? undefined) : null,
-        recentSessionEvents: sessionId ? listSessionEvents(hippoRoot, tenantId, { session_id: sessionId, limit: eventLimit }) : [],
-    };
-}
-/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
-export function finishRecallAt(hippoRoot, writes) {
-    onHandle(hippoRoot, (db) => {
-        withWriteScope(db, 'finish_recall', () => {
-            writeGoalRecallLog(db, localGoalRecallRows(db, writes.goalLog));
-            for (const event of writes.audit)
-                appendAuditEvent(db, event);
-        });
-        // Each opens its own transaction, so neither can share the scope above.
-        if (writes.trace)
-            writeRecallTrace(db, writes.trace);
-        if (writes.strengthen)
-            strengthenRetrievedInOwnTx(db, writes.strengthen.ids, writes.strengthen.opts);
-    });
-}
-//# sourceMappingURL=store-port.js.map

package/dist/tenant.d.ts

@@ -1,25 +0,0 @@
-import type { DatabaseSyncLike } from './db.js';
-import type { JsonValue } from './json.js';
-export interface ResolveOpts {
-    db?: DatabaseSyncLike;
-    apiKey?: string;
-}
-export declare function resolveTenantId(opts: ResolveOpts): string;
-/**
- * Defensive runtime guard for tenant id arguments.
- *
- * The continuity helpers (saveActiveTaskSnapshot, listSessionEvents, etc.)
- * gained a required `tenantId` parameter (schema v22) to close a
- * cross-tenant data leak. TypeScript catches misbinding at compile time, but
- * JavaScript callers from older versions can silently pass a `sessionId`
- * where `tenantId` is now expected, e.g.
- *   loadLatestHandoff(root, 'sess-abc')   // WRONG: 'sess-abc' becomes the tenant
- * which would silently filter to a non-existent tenant and return null with
- * no error. This guard rejects the most common shape of that mistake (any
- * value beginning with the conventional `sess-` / `sess_` session prefix).
- *
- * False-positive cost: a tenant literally named `sess-...` will be rejected.
- * Acceptable tradeoff for catching the silent-leak class.
- */
-export declare function assertTenantId(fnName: string, value: JsonValue): asserts value is string;
-//# sourceMappingURL=tenant.d.ts.map

package/dist/tenant.js

@@ -1,43 +0,0 @@
-import { envTenant } from './env.js';
-import { validateApiKey } from './auth.js';
-export function resolveTenantId(opts) {
-    if (opts.apiKey) {
-        if (!opts.db)
-            throw new Error('resolveTenantId: db required when apiKey is set');
-        const ctx = validateApiKey(opts.db, opts.apiKey);
-        if (!ctx.valid || !ctx.tenantId)
-            throw new Error('invalid api key');
-        return ctx.tenantId;
-    }
-    // L1: empty / whitespace-only HIPPO_TENANT must fall through to 'default'.
-    // `??` only catches undefined, so HIPPO_TENANT="" leaked through as the
-    // literal empty string and broke every downstream tenant filter.
-    return envTenant();
-}
-/**
- * Defensive runtime guard for tenant id arguments.
- *
- * The continuity helpers (saveActiveTaskSnapshot, listSessionEvents, etc.)
- * gained a required `tenantId` parameter (schema v22) to close a
- * cross-tenant data leak. TypeScript catches misbinding at compile time, but
- * JavaScript callers from older versions can silently pass a `sessionId`
- * where `tenantId` is now expected, e.g.
- *   loadLatestHandoff(root, 'sess-abc')   // WRONG: 'sess-abc' becomes the tenant
- * which would silently filter to a non-existent tenant and return null with
- * no error. This guard rejects the most common shape of that mistake (any
- * value beginning with the conventional `sess-` / `sess_` session prefix).
- *
- * False-positive cost: a tenant literally named `sess-...` will be rejected.
- * Acceptable tradeoff for catching the silent-leak class.
- */
-export function assertTenantId(fnName, value) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`${fnName}: tenantId is required (got ${typeof value})`);
-    }
-    if (/^sess[-_]/i.test(value)) {
-        throw new Error(`${fnName}: tenantId looks like a session id ('${value}'). ` +
-            `In v0.41+ these helpers take (hippoRoot, tenantId, ...). ` +
-            `Pass the tenant id (e.g. 'default') and the session id separately.`);
-    }
-}
-//# sourceMappingURL=tenant.js.map

package/dist/trace.d.ts

@@ -1,34 +0,0 @@
-/**
- * Trace-layer helpers.
- *
- * A trace is a `MemoryEntry` with `layer === 'trace'` that captures an ordered
- * sequence of agent actions and their final outcome. v1 stores steps as
- * markdown in `content`; `renderTraceContent` is the canonical formatter.
- */
-export interface TraceStep {
-    action: string;
-    observation: string;
-    timestamp?: string;
-}
-export interface TraceRecord {
-    task: string;
-    steps: TraceStep[];
-    outcome: 'success' | 'failure' | 'partial';
-}
-/**
- * Render a trace record as agent-readable markdown.
- *
- * Format:
- *   Task: <task>
- *   Outcome: <outcome>
- *   Steps:
- *     1. <action>
- *        → <observation>   (omitted if observation is empty)
- *     2. ...
- */
-export declare function renderTraceContent(rec: TraceRecord): string;
-/**
- * Parse a JSON string into an array of TraceStep. Throws on invalid shape.
- */
-export declare function parseSteps(json: string): TraceStep[];
-//# sourceMappingURL=trace.d.ts.map

package/dist/transcript-tail.js

@@ -1,48 +0,0 @@
-// Transcript reads shared by capture.ts and compaction-record.ts; a leaf so neither has to import the other.
-import * as fs from 'fs';
-/** Never read the whole transcript: PreCompact fires exactly when it's largest. */
-export const PRE_COMPACT_TAIL_BYTES = 256 * 1024;
-/** Cut to `maxChars` UTF-16 units, backing off one unit rather than leave half a surrogate pair in a stored field. */
-export function truncateCodePointSafe(text, maxChars) {
-    if (text.length <= maxChars)
-        return text;
-    let end = maxChars;
-    if (end > 0) {
-        const code = text.charCodeAt(end - 1);
-        if (code >= 0xd800 && code <= 0xdbff)
-            end -= 1;
-    }
-    return text.slice(0, end);
-}
-/** The last `capBytes` of a JSONL transcript, read at an offset and starting on a whole line so every line parses. */
-export function readTranscriptTail(transcriptPath, capBytes = PRE_COMPACT_TAIL_BYTES) {
-    const size = fs.statSync(transcriptPath).size;
-    const start = Math.max(0, size - capBytes);
-    const length = size - start;
-    if (length <= 0)
-        return '';
-    const fd = fs.openSync(transcriptPath, 'r');
-    try {
-        // A seek that lands just after '\n' already starts a whole line and must keep it.
-        let onLineBoundary = start === 0;
-        if (!onLineBoundary) {
-            const prevByte = Buffer.alloc(1);
-            fs.readSync(fd, prevByte, 0, 1, start - 1);
-            onLineBoundary = prevByte[0] === 0x0a; // '\n'
-        }
-        const buf = Buffer.alloc(length);
-        fs.readSync(fd, buf, 0, length, start);
-        let text = buf.toString('utf8');
-        if (!onLineBoundary) {
-            // Landed mid-line — drop the partial first line so every remaining
-            // line parses as complete JSON.
-            const nl = text.indexOf('\n');
-            text = nl === -1 ? '' : text.slice(nl + 1);
-        }
-        return text;
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-}
-//# sourceMappingURL=transcript-tail.js.map

package/dist/version.d.ts

@@ -1,26 +0,0 @@
-/**
- * Single source of truth for the hippo-memory binary's package version.
- *
- * Written by `npm version <x> --no-git-tag-version` through
- * scripts/sync-version.mjs, with the three plugin manifests; never edit it by
- * hand. scripts/check-manifest-versions.mjs gates publish on all seven sites.
- *
- * Used by:
- *   - src/db/migrate.ts rollback-safety guard (refuses to open a DB stamped with
- *     min_compatible_binary newer than this).
- *   - src/server.ts HTTP /health.
- *   - src/mcp/server.ts MCP serverInfo.
- *
- * Why not read package.json at runtime: the npm-published bundle ships
- * compiled `dist/` files that may not have package.json on a relative path
- * an ESM `import` can resolve cleanly, and a hardcoded constant survives
- * any packager that drops .json files.
- */
-export declare const PACKAGE_VERSION = "1.69.0";
-/** The floor a store takes on its first expiring key: the first release with schema v53, set by hand in that release; scripts/check-expiring-keys-floor.mjs gates it. */
-export declare const EXPIRING_KEYS_MIN_BINARY = "1.64.0";
-/** The floor a store takes on its first session bind or owner snapshot: first release with v54; set by hand in that release. */
-export declare const TASK_OWNER_MIN_BINARY = "1.64.0";
-/** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
-export declare function compareSemver(a: string, b: string): number;
-//# sourceMappingURL=version.d.ts.map