hippo-memory 1.69.0 → 1.71.0

package/dist/api/dormant.js

@@ -1,144 +1,56 @@
 // Dormant memories: list, restore, forget and check.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { ConflictError, NotFoundError } from '../api-errors.js';
-import { auditRejectionRefusal } from '../store/audit-event.js';
+import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { writeEntryDbOnly, writeEntryMirrors } from '../store/entry-writes.js';
 import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
-import { RejectedValueError } from '../rejection.js';
-import { listDormantRows, readDormantSnapshot, deleteDormantRow, hasDormantRow, } from '../dormant.js';
-import { createMemory, calculateStrength } from '../memory.js';
-import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { loadConfig } from '../config.js';
-import { canTouchScope, personalScopeOf, touchableScopeSql } from '../recall-scope.js';
+import { loadDormantMemories, holdsDormantMemory, restoreDormantMemory, forgetDormantMemory, } from '../store/dormant.js';
+import { createMemory, calculateStrength } from '../core/memory.js';
+import { loadConfig } from '../core/config.js';
+import { canTouchScope, personalScopeOf, touchableScopeSql } from '../store/recall-scope.js';
 const touchable = (ctx) => touchableScopeSql('', personalScopeOf(ctx.actor));
-/**
- * A tenant's dormant memories (src/dormant.ts): what sleep moved out of
- * active memory instead of deleting, when `dormant.enabled` is on. Newest
- * first; `opts.query` keeps rows containing every term (case-insensitive).
- */
+/** A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of active memory when `dormant.enabled` is on. Newest first;
+ * `opts.query` keeps rows containing every term (case-insensitive). */
 export function listDormant(ctx, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return listDormantRows(db, ctx.tenantId, opts, touchable(ctx));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return loadDormantMemories(ctx.hippoRoot, ctx.tenantId, opts, touchable(ctx));
 }
-/**
- * Bring a dormant memory back into active memory. It returns as if just
- * recalled, with a full half-life. A row audit repair set aside returns
- * `verified`, so no quality check judges it again. Every other field is the
- * snapshot taken when it went dormant.
- *
- * Throws when the tenant has no dormant memory with that id (another
- * tenant's id, or another person's personal row, reads the same way), when a live memory already holds the id,
- * and RejectedValueError when the value has been rejected since. On any
- * throw the dormant copy stays where it is.
- */
+/** Restores a dormant memory as if just recalled, with a full half-life; a row set aside by audit repair returns `verified`.
+ * Throws if the tenant has no such dormant id or a live memory holds it, and RejectedValueError if the value was since rejected (the dormant copy stays). */
 export function restoreDormant(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        let restored;
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const dormant = readDormantSnapshot(db, ctx.tenantId, id);
-            if (!dormant || !canTouchScope(ctx.actor, dormant.entry.scope ?? null)) {
-                throw new NotFoundError(`dormant memory not found: ${id}`);
-            }
-            if (db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(id) !== undefined) {
-                throw new ConflictError(`memory ${id} is already active; forget it before restoring its dormant copy`);
-            }
-            const now = new Date();
-            // Dormant rows are long-lived, so a snapshot can predate a field added
-            // later: createMemory supplies a default for anything it lacks, then
-            // the snapshot overrides every field it does carry, content included.
-            // (The placeholder only satisfies createMemory's minimum length, so a
-            // legacy row shorter than 3 chars can still be restored.)
-            const revived = {
-                ...createMemory('dormant snapshot defaults', { baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays }),
-                ...dormant.entry,
-                last_retrieved: now.toISOString(),
-            };
-            if (dormant.reason === 'quality-repair')
-                revived.confidence = 'verified';
-            restored = stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
-            writeEntryDbOnly(db, restored, { actor: ctx.actor.subject });
-            deleteDormantRow(db, ctx.tenantId, id);
-            // A restore is a labelled "forgot it, then needed it" event: the
-            // signal a learned lifecycle trains on. Same transaction
-            // as the restore, so the label exists exactly when the restore does.
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'dormant_restore',
-                targetId: id,
-                metadata: {
-                    reason: dormant.reason,
-                    strengthAtDormancy: dormant.strength,
-                    dormantAt: dormant.dormantAt,
-                    daysDormant: Math.max(0, (now.getTime() - Date.parse(dormant.dormantAt)) / (24 * 60 * 60 * 1000)),
-                },
-            });
-            db.exec('COMMIT');
-        }
-        catch (err) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* already rolled back */ }
-            if (err instanceof RejectedValueError) {
-                auditRejectionRefusal(db, err, ctx.actor.subject);
-            }
-            throw err;
-        }
-        writeEntryMirrors(ctx.hippoRoot, restored);
-        return restored;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const outcome = restoreDormantMemory(ctx.hippoRoot, {
+        tenantId: ctx.tenantId,
+        id,
+        actor: ctx.actor.subject,
+        inReach: (scope) => canTouchScope(ctx.actor, scope),
+        revive: (snapshot, now) => reviveSnapshot(ctx, snapshot, now),
+    });
+    if (outcome.status === 'missing')
+        throw new NotFoundError(`dormant memory not found: ${id}`);
+    if (outcome.status === 'active') {
+        throw new ConflictError(`memory ${id} is already active; forget it before restoring its dormant copy`);
+    }
+    return outcome.entry;
+}
+function reviveSnapshot(ctx, dormant, now) {
+    // A snapshot can predate a field added later: createMemory supplies defaults, then the snapshot overrides every field it carries.
+    // The placeholder content only meets createMemory's minimum length, so a legacy row under 3 chars still restores.
+    const revived = {
+        ...createMemory('dormant snapshot defaults', { baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays }),
+        ...dormant.entry,
+        last_retrieved: now.toISOString(),
+    };
+    if (dormant.reason === 'quality-repair')
+        revived.confidence = 'verified';
+    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
 }
-/**
- * Permanently delete a dormant memory: the explicit "forget it for good"
- * that dormant storage leaves to the user. Throws when the tenant has no
- * dormant memory with that id.
- */
+/** Permanently deletes a dormant memory, the explicit "forget it for good"; throws when the tenant has no dormant memory with that id. */
 export function forgetDormant(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        if (!hasDormantRow(db, ctx.tenantId, id, touchable(ctx)) || !deleteDormantRow(db, ctx.tenantId, id)) {
-            throw new NotFoundError(`dormant memory not found: ${id}`);
-        }
-        try {
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'forget',
-                targetId: id,
-                metadata: { dormant: true },
-            });
-        }
-        catch (error) {
-            // Best-effort, like every other forget audit row: the delete stands.
-            reportAuditWriteFailure('forget', String(error), id);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const forgotten = forgetDormantMemory(ctx.hippoRoot, { tenantId: ctx.tenantId, id, actor: ctx.actor.subject, admit: touchable(ctx) });
+    if (!forgotten)
+        throw new NotFoundError(`dormant memory not found: ${id}`);
     // Counted like every other permanent removal (forget, archiveRaw).
     updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
 }
 /** Whether the tenant holds a dormant memory with this id that the caller may touch (for "not found" hints). */
 export function isDormant(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return hasDormantRow(db, ctx.tenantId, id, touchable(ctx));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return holdsDormantMemory(ctx.hippoRoot, ctx.tenantId, id, touchable(ctx));
 }
 //# sourceMappingURL=dormant.js.map

package/dist/api/drill-down.d.ts

@@ -1,23 +1,12 @@
-import type { CallerProject } from '../prompt-hook.js';
+import type { CallerProject } from './prompt-hook.js';
 import type { Context } from './types.js';
 export interface DrillDownOpts {
     /** Cap on number of children returned. Default 50. */
     limit?: number;
-    /**
-     * Optional token budget. When set, children are appended in chronological
-     * order (created ASC) until adding the next child would exceed the budget.
-     * Token cost = the child's printed line under `cost`, else ceil(content.length / 4).
-     *
-     * For depth > 1, the budget is GLOBAL cumulative (NOT per-level).
-     */
+    /** Token budget: children append in created order until the next would exceed it (cost: printed line under `cost`, else ceil(content.length / 4)).
+     * For depth > 1 the budget is global and cumulative, not per level. */
     budget?: number;
-    /**
-     * v0.30 / E5 — walk N levels down (default 1 = direct children only).
-     * Higher values include children of children, etc. Internal hard cap 10
-     * to prevent pathological depth walks. BFS uses visited Set for dedup
-     * (defensive against shared-child data anomalies; DAG is acyclic by
-     * construction).
-     */
+    /** Levels to walk down (default 1 = direct children); capped at 10 internally. BFS dedups with a visited Set, defensive against shared-child anomalies. */
     depth?: number;
     cost?: DrillDownCost;
     project?: CallerProject;
@@ -46,41 +35,13 @@ export interface DrillDownResult {
     totalChildren: number;
     truncated: boolean;
 }
-/**
- * v1.6.4 discriminated failure shape. Two reasons distinguishable:
- *   - `not_found`: covers genuinely-missing, wrong-tenant, AND
- *     scope-blocked (codex round 3 P1 — distinguishing scope_blocked
- *     from not_found on non-HTTP surfaces leaked private-row existence
- *     to no-scope callers, even though the HTTP route already collapsed
- *     them. Collapse at the API layer.)
- *   - `not_drillable`: id is a leaf row (level 0/1). Caller-actionable.
- *
- * If a future drillDown gains a `scope` opt for explicit-scope callers,
- * a `scope_blocked` failure could be safely re-introduced ONLY for that
- * code path (caller already proved authorization by passing a scope).
- */
+/** `not_found` covers missing, wrong-tenant AND scope-blocked, because distinguishing scope_blocked leaked private-row existence to no-scope callers.
+ *  `not_drillable`: the id is a leaf row (level 0/1), which the caller can act on. */
 export interface DrillDownFailure {
     failure: 'not_found' | 'not_drillable';
 }
 export type DrillDownOutcome = DrillDownResult | DrillDownFailure;
-/**
- * Walk one step down the DAG from a level-2 (or higher) summary to its direct
- * children. Companion to `recall(... summarizeOverflow: true)` — when recall
- * surfaces a summary with `substitutedFor: [...]`, the caller drills into the
- * summary id to recover the original detail.
- *
- * Tenant scope: only summaries owned by `ctx.tenantId` are reachable. The same
- * scope filter that recall applies is enforced on the children — a level-2
- * summary in `slack:public:CGEN` cannot leak `slack:private:*` children even
- * if the underlying DAG accidentally linked across scopes.
- *
- * Returns a discriminated `DrillDownOutcome`: `DrillDownResult` on success,
- * or `{failure: '...'}` for `not_found` (covers genuinely-missing, wrong-
- * tenant and scope-blocked, intentionally indistinguishable) or
- * `not_drillable` (id is a leaf row).
- *
- * Pre-v1.6.4 returned null for all three cases. JS callers migrate via
- * `'failure' in result` checks; HTTP route maps `not_drillable` to 422.
- */
-export declare function drillDown(ctx: Context, summaryId: string, opts?: DrillDownOpts): DrillDownOutcome;
+/** One step down the DAG from a level-2+ summary to its direct children (the way back from `recall(... summarizeOverflow: true)` substitutions). Only
+ * `ctx.tenantId` summaries are reachable; children get recall's scope filter. Returns `DrillDownResult` or `{failure}`; HTTP maps `not_drillable` to 422. */
+export declare function drillDown(ctx: Context, summaryId: string, opts?: DrillDownOpts): Promise<DrillDownOutcome>;
 //# sourceMappingURL=drill-down.d.ts.map

package/dist/api/drill-down.js

@@ -1,70 +1,51 @@
 // DAG drill-down from a summary to its children.
-import { closeHippoDb } from '../db.js';
-import { openStore } from '../store/open.js';
-import { selectEntriesByIds, selectChildrenByParent } from '../store/entry-reads.js';
-import { estimateTokens } from '../token-ledger.js';
-import { passesScopeFilterForRecall, personalScopeOf } from '../recall-scope.js';
-import { classifyOriginProject } from '../project-identity.js';
-/**
- * Walk one step down the DAG from a level-2 (or higher) summary to its direct
- * children. Companion to `recall(... summarizeOverflow: true)` — when recall
- * surfaces a summary with `substitutedFor: [...]`, the caller drills into the
- * summary id to recover the original detail.
- *
- * Tenant scope: only summaries owned by `ctx.tenantId` are reachable. The same
- * scope filter that recall applies is enforced on the children — a level-2
- * summary in `slack:public:CGEN` cannot leak `slack:private:*` children even
- * if the underlying DAG accidentally linked across scopes.
- *
- * Returns a discriminated `DrillDownOutcome`: `DrillDownResult` on success,
- * or `{failure: '...'}` for `not_found` (covers genuinely-missing, wrong-
- * tenant and scope-blocked, intentionally indistinguishable) or
- * `not_drillable` (id is a leaf row).
- *
- * Pre-v1.6.4 returned null for all three cases. JS callers migrate via
- * `'failure' in result` checks; HTTP route maps `not_drillable` to 422.
- */
-export function drillDown(ctx, summaryId, opts = {}) {
-    const limit = opts.limit ?? 50;
+import { requireGroup, storeFor } from '../store/index.js';
+import { estimateTokens } from '../util/token-text.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../store/recall-scope.js';
+import { classifyOriginProject } from '../core/project-identity.js';
+const DEFAULT_DRILL_DOWN_LIMIT = 50;
+/** One step down the DAG from a level-2+ summary to its direct children (the way back from `recall(... summarizeOverflow: true)` substitutions). Only
+ * `ctx.tenantId` summaries are reachable; children get recall's scope filter. Returns `DrillDownResult` or `{failure}`; HTTP maps `not_drillable` to 422. */
+export async function drillDown(ctx, summaryId, opts = {}) {
+    const limit = opts.limit ?? DEFAULT_DRILL_DOWN_LIMIT;
     // v0.30 / E5: depth defaults 1 (backward compat); hard cap 10 levels
     // prevents pathological deep trees. CLI/HTTP/MCP reject invalid values.
     const depth = Math.max(1, Math.min(Math.trunc(opts.depth ?? 1), 10));
-    const db = openStore(ctx.hippoRoot);
-    try {
-        return drillDownOn(db, ctx, summaryId, depth, opts, limit);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-function drillDownOn(db, ctx, summaryId, depth, opts, limit) {
-    const summary = selectEntriesByIds(db, [summaryId], ctx.tenantId).get(summaryId) ?? null;
-    // No unscoped cross-tenant probe here: the tenant-scoped read's miss covers
-    // both "doesn't exist" and "exists in another tenant" by design.
-    // Distinguishing them via an unscoped lookup would leak existence to
-    // unauthorised tenants. The two cases collapse into not_found.
-    if (!summary)
-        return { failure: 'not_found' };
     const own = personalScopeOf(ctx.actor) ?? undefined;
-    if (!passesScopeFilterForRecall(summary.scope ?? null, undefined, own)) {
-        // codex round 3 P1: collapse to not_found. A distinguishable
-        // "scope_blocked" tells a no-scope caller "this row exists, just
-        // not for you" — same existence-leak the HTTP 404 collapse was
-        // already preventing. Match the HTTP behaviour at the API level.
+    const readable = (row) => passesScopeFilterForRecall(row.scope ?? null, undefined, own)
+        && (!opts.project || classifyOriginProject(row.origin_project, opts.project) !== 'cross-project');
+    const pastLimit = Math.floor(limit) + 1;
+    const walked = await requireGroup(storeFor(ctx), 'dagReads').summaryWithDescendants(ctx.tenantId, summaryId, {
+        depth,
+        // A leaf answers not_drillable, so nothing under it is read.
+        admit: (row) => readable(row) && (row.id !== summaryId || isDrillable(row)),
+        page: limit >= 0 && Number.isSafeInteger(pastLimit) ? { rows: pastLimit, admit: readable } : undefined,
+    });
+    // No unscoped cross-tenant probe: the tenant-scoped miss covers "missing" and "in another tenant" alike,
+    // because telling them apart would leak existence to unauthorised tenants.
+    if (!walked)
         return { failure: 'not_found' };
-    }
-    const shown = (row) => !opts.project || classifyOriginProject(row.origin_project, opts.project) !== 'cross-project';
-    if (!shown(summary))
+    // A distinguishable "scope_blocked" would tell a no-scope caller "this row
+    // exists, just not for you", the existence leak the HTTP 404 collapse prevents.
+    if (!readable(walked.summary))
         return { failure: 'not_found' };
-    if ((summary.dag_level ?? 0) < 2)
+    if (!isDrillable(walked.summary))
         return { failure: 'not_drillable' };
-    const { collected, level0DirectCount } = collectDescendants(db, ctx.tenantId, summaryId, depth, own, shown);
+    return drillResult(walked, opts, limit);
+}
+function isDrillable(row) {
+    return (row.dag_level ?? 0) >= 2;
+}
+function drillResult({ summary, levels, sizes: counted }, opts, limit) {
+    const collected = levels.flat();
+    const sizes = counted ?? levels.map((level) => level.length);
+    const total = sizes.reduce((sum, n) => sum + n, 0);
     const summaryOut = {
         id: summary.id,
         content: summary.content,
         // v0.30 / E5: the STORED direct-child count; the legacy fallback counts
         // level-0 children, never the BFS-depth-N total (independent-review MED #4).
-        descendantCount: summary.descendant_count ?? level0DirectCount,
+        descendantCount: summary.descendant_count ?? (sizes[0] ?? 0),
         earliestAt: summary.earliest_at ?? null,
         latestAt: summary.latest_at ?? null,
     };
@@ -75,54 +56,24 @@ function drillDownOn(db, ctx, summaryId, depth, opts, limit) {
         dagLevel: c.dag_level ?? 0,
         created: c.created,
     }));
-    const { children, truncated } = capChildren(all, summaryOut, opts, limit);
+    const fixed = opts.budget !== undefined ? opts.cost?.fixed(summaryOut, total) ?? 0 : 0;
+    const { children, truncated } = capChildren(all, fixed, opts, limit);
     return {
         summary: summaryOut,
         children,
-        // v0.30 / E5: totalChildren = BFS-collected count (depth-aware). For
-        // depth=1 this equals the eligible direct-children count (backward
-        // compat). For depth>1 it is the cumulative count across levels.
-        totalChildren: collected.length,
+        // totalChildren is the BFS-collected count, cumulative across levels (equals the direct-children count at depth=1).
+        totalChildren: total,
         truncated,
     };
 }
-// BFS with a visited set: dag_parent_id is not unique, so a misconfigured tree could emit a child twice past depth 1.
-// The level-0 count is kept apart so a legacy summary's descendantCount fallback counts direct children only.
-function collectDescendants(db, tenantId, summaryId, depth, own, shown) {
-    const collected = [];
-    const visited = new Set([summaryId]);
-    let frontier = [summaryId];
-    let level0DirectCount = 0;
-    for (let level = 0; level < depth; level++) {
-        const nextFrontier = [];
-        const kidsByParent = selectChildrenByParent(db, frontier, tenantId);
-        for (const parentId of frontier) {
-            const kids = kidsByParent.get(parentId) ?? [];
-            const eligibleKids = kids.filter((c) => passesScopeFilterForRecall(c.scope ?? null, undefined, own) && shown(c));
-            for (const k of eligibleKids) {
-                if (visited.has(k.id))
-                    continue;
-                visited.add(k.id);
-                collected.push(k);
-                nextFrontier.push(k.id);
-                if (level === 0)
-                    level0DirectCount++;
-            }
-        }
-        if (nextFrontier.length === 0)
-            break;
-        frontier = nextFrontier;
-    }
-    return { collected, level0DirectCount };
-}
 /** Global cumulative token budget first, then the `limit` cap. */
-function capChildren(all, summaryOut, opts, limit) {
+function capChildren(all, fixed, opts, limit) {
     let children = all;
     let truncated = false;
     if (opts.budget !== undefined) {
         const out = [];
         let used = 0;
-        const room = opts.budget - (opts.cost?.fixed(summaryOut, all.length) ?? 0);
+        const room = opts.budget - fixed;
         for (const c of all) {
             const t = opts.cost ? opts.cost.child(c) : estimateTokens(c.content);
             if (out.length > 0 && used + t > room) {

package/dist/api/forget.d.ts

@@ -1,15 +1,6 @@
-import type { RejectedValueRow } from '../rejection.js';
 import type { Context, StoreReply } from './types.js';
-/**
- * Delete a memory by id. `deleteEntry` threads ctx.actor.subject into its internal
- * audit hook, so exactly one 'forget' event lands with the supplied actor.
- *
- * Tenant scope: deleteEntry looks up the row by id alone, so without an
- * explicit tenant guard a Bearer for tenant A could delete tenant B's row
- * by guessing or leaking the id. Pre-check the row's tenant_id and deny
- * cross-tenant access with a not-found error (no info leak about whether
- * the id exists in another tenant).
- */
+/** Delete a memory by id. Reach is checked inside the delete's write scope, and a
+ * row out of reach answers as not found, so a caller learns nothing about it. */
 export interface ForgetResult {
     ok: true;
     id: string;
@@ -27,31 +18,12 @@ export interface RejectResult {
     digest: string;
     removedIds: string[];
 }
-/**
- * Reject a value: tombstone its normalized digest so a matching write is
- * refused everywhere (remember/capture/import/sync) until `unreject`. Two
- * forms — pass exactly one:
- *  - `memoryId`: reject the CURRENT content of an existing memory. Removes
- *    that row and every other live row in the tenant whose normalized
- *    digest matches (not just the id passed), except another person's personal rows.
- *  - `value`: pre-emptive form — tombstone content that may not currently
- *    be stored (or is already gone). Zero removals.
- *
- * `reason` is required (the tombstone stores no content; reason is its
- * only human-readable identity). Throws if the memory id is not found in
- * `ctx.tenantId`, or if both/neither of `memoryId`/`value` are given.
- */
+/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
+ * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
 export declare function reject(ctx: Context, opts: RejectOpts): RejectResult;
-/**
- * Delete a tombstone by exact digest or unambiguous prefix, restoring the
- * value's writability — the only v1 escape hatch (no per-write force flag).
- * Throws if `digestOrPrefix` matches no tombstone, is blank, or matches
- * more than one (use a longer prefix).
- */
+/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export declare function unreject(ctx: Context, digestOrPrefix: string): {
     ok: boolean;
     digest: string;
 };
-/** List every rejected-value tombstone for `ctx.tenantId`, newest first. */
-export declare function listRejections(ctx: Context): RejectedValueRow[];
 //# sourceMappingURL=forget.d.ts.map

package/dist/api/forget.js

@@ -1,71 +1,24 @@
 // Forget a memory, and reject or unreject a value so it cannot be stored again.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { BadRequestError, NotFoundError } from '../api-errors.js';
-import { deleteEntry } from '../store/delete-and-batch.js';
-import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
-import { rejectValue, unrejectValue, listRejectionsForTenant } from '../reject-flow.js';
-import { requireGroup } from '../store-port.js';
-import { selectMemoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope, personalScopeOf } from '../recall-scope.js';
+import { BadRequestError, NotFoundError } from '../core/api-errors.js';
+import { rejectValue, unrejectValue } from '../trust/reject-flow.js';
+import { andThen, notPorted, onStore } from './on-store.js';
+import { readEntry } from '../store/entry-reads.js';
+import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
 export function forget(ctx, id) {
-    const reply = ctx.store ? forgetThroughStore(ctx, ctx.store, id) : forgetOnHippoDb(ctx, id);
-    // SAFETY: a C typed with a store gets the promise its path returns; a wide C is typed as the union, which a caller has to await anyway.
-    return reply;
-}
-async function forgetThroughStore(ctx, store, id) {
-    const entryWrites = requireGroup(store, 'entryWrites');
-    await entryWrites.forget({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id });
-    return { ok: true, id };
-}
-function forgetOnHippoDb(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        const reach = selectMemoryReach(db, id);
-        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-            throw new NotFoundError(`memory not found: ${id}`);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    const removed = deleteEntry(ctx.hippoRoot, id, { actor: ctx.actor.subject });
-    if (!removed) {
-        throw new NotFoundError(`memory not found: ${id}`);
-    }
-    // Counted here, not in the CLI: both callers of this function (cmdForget and
-    // the HTTP route) are the two paths of one user command, so neither can miss
-    // it. api.remember cannot take the same move; see the server route.
-    updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
-    return { ok: true, id };
+    return onStore(ctx, (port) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        const removal = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id };
+        return andThen(entryWrites.forget(removal), () => ({ ok: true, id }));
+    });
 }
-/**
- * Reject a value: tombstone its normalized digest so a matching write is
- * refused everywhere (remember/capture/import/sync) until `unreject`. Two
- * forms — pass exactly one:
- *  - `memoryId`: reject the CURRENT content of an existing memory. Removes
- *    that row and every other live row in the tenant whose normalized
- *    digest matches (not just the id passed), except another person's personal rows.
- *  - `value`: pre-emptive form — tombstone content that may not currently
- *    be stored (or is already gone). Zero removals.
- *
- * `reason` is required (the tombstone stores no content; reason is its
- * only human-readable identity). Throws if the memory id is not found in
- * `ctx.tenantId`, or if both/neither of `memoryId`/`value` are given.
- */
+/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
+ * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
 export function reject(ctx, opts) {
     if (opts.memoryId !== undefined) {
-        // Tenant scope, same not-found-shaped denial as forget/promote above:
-        // rejectValue itself also tenant-checks the id, but pre-checking here
-        // keeps the error message consistent with the rest of this module.
-        const db = openHippoDb(ctx.hippoRoot);
-        try {
-            const reach = selectMemoryReach(db, opts.memoryId);
-            if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
-                throw new NotFoundError(`memory not found: ${opts.memoryId}`);
-            }
-        }
-        finally {
-            closeHippoDb(db);
+        // Tenant scope: same not-found-shaped denial as forget/promote; rejectValue tenant-checks too, but pre-checking keeps the error message consistent.
+        const entry = readEntry(ctx.hippoRoot, opts.memoryId);
+        if (entry?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, entry.scope)) {
+            throw new NotFoundError(`memory not found: ${opts.memoryId}`);
         }
     }
     const result = rejectValue({
@@ -79,12 +32,7 @@ export function reject(ctx, opts) {
     });
     return { digest: result.digest, removedIds: result.removedIds };
 }
-/**
- * Delete a tombstone by exact digest or unambiguous prefix, restoring the
- * value's writability — the only v1 escape hatch (no per-write force flag).
- * Throws if `digestOrPrefix` matches no tombstone, is blank, or matches
- * more than one (use a longer prefix).
- */
+/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export function unreject(ctx, digestOrPrefix) {
     const outcome = unrejectValue(ctx.hippoRoot, ctx.tenantId, digestOrPrefix, ctx.actor.subject);
     if (outcome.status === 'not_found') {
@@ -95,8 +43,4 @@ export function unreject(ctx, digestOrPrefix) {
     }
     return { ok: true, digest: outcome.digest };
 }
-/** List every rejected-value tombstone for `ctx.tenantId`, newest first. */
-export function listRejections(ctx) {
-    return listRejectionsForTenant(ctx.hippoRoot, ctx.tenantId);
-}
 //# sourceMappingURL=forget.js.map

package/dist/api/goals.d.ts

@@ -1,4 +1,4 @@
-import { type CompleteGoalOpts, type Goal, type PushGoalOpts } from '../goals.js';
+import { type CompleteGoalOpts, type Goal, type PushGoalOpts } from '../store/goals.js';
 import type { Context } from './types.js';
 /** What a new goal carries; its tenant is always the caller's. */
 export type GoalPushOpts = Omit<PushGoalOpts, 'tenantId'>;

package/dist/api/goals.js

@@ -1,6 +1,6 @@
 // The per-session goal stack that recall boosts: push, list, complete, suspend and resume.
-import { ForbiddenError } from '../api-errors.js';
-import { completeGoal, getActiveGoals, getSessionGoals, pushGoal, resumeGoal, suspendGoal, } from '../goals.js';
+import { ForbiddenError } from '../core/api-errors.js';
+import { completeGoal, getActiveGoals, getSessionGoals, pushGoal, resumeGoal, suspendGoal, } from '../store/goals.js';
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */
 export function goalPush(ctx, opts) {
     return pushGoal(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });

package/dist/api/graph.d.ts

@@ -0,0 +1,8 @@
+import type { GraphRows } from '../store/port.js';
+import type { Context } from './types.js';
+/** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
+export declare function graphRows(ctx: Context, query: {
+    entity?: string;
+    limit: number;
+}): Promise<GraphRows>;
+//# sourceMappingURL=graph.d.ts.map

package/dist/api/graph.js

@@ -0,0 +1,7 @@
+import { requireGroup, storeFor } from '../store/index.js';
+/** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
+export async function graphRows(ctx, query) {
+    const { role, scopes, owner } = ctx.actor;
+    return requireGroup(storeFor(ctx), 'graphReads').graphRows(ctx.tenantId, { ...query, reader: { role, scopes, owner } });
+}
+//# sourceMappingURL=graph.js.map