hippo-memory 1.71.0 → 2.0.0

package/dist/store/delivery-recorder.d.ts

@@ -1,7 +1,7 @@
 import type { MemoryEntry } from '../core/memory.js';
 import { type PromptRecallGate } from '../core/prompt-recall.js';
 export type DeliveryRuntime = 'claude-code' | 'codex' | 'copilot' | 'unknown';
-export type DeliveryEventType = 'prompt-submit' | 'pinned-manual' | 'pre-compact' | 'compact-resume' | 'session-end' | 'context';
+export type DeliveryEventType = 'prompt-submit' | 'pinned-manual' | 'pre-compact' | 'compact-resume' | 'session-end' | 'context' | 'tool-failure';
 /** True for the boundary types: a compaction's two hooks and the end of a session. */
 export declare const isBoundaryEvent: (type: DeliveryEventType) => boolean;
 export type DeliverySurface = 'hook' | 'context';
@@ -12,8 +12,9 @@ export type DeliveryPool = 'pin' | 'recent' | 'prompt-recall' | 'strength' | 'se
 export type DeliveryStage = 'load' | 'eligible' | 'gate' | 'budget' | 'limit' | 'final';
 export type DeliveryOutcome = 'emitted' | 'reused' | 'rejected';
 export type DeliveryRejectReason = 'budget' | 'gate-below-threshold' | 'gate-max-items' | 'duplicate' | 'scope' | 'quality' | 'limit';
-/** Row format version in `delivery_events.ledger_version`: 3 = written by a binary that can write session-end and context rows, so `event_type` has six values. */
-export declare const DELIVERY_LEDGER_VERSION = 3;
+/** Row format version in `delivery_events.ledger_version`: 4 = written by a binary that can write `tool-failure` rows and hashes the
+ * store's resolved root. */
+export declare const DELIVERY_LEDGER_VERSION = 4;
 /** Rejected candidate rows kept per event; the rest only add to `rejected_unlisted`. */
 export declare const DELIVERY_REJECTED_ROW_CAP = 16;
 export interface DeliveryCandidateInput {
@@ -61,6 +62,10 @@ export interface DeliveryEventInput {
     recallHash: string | null;
     emittedHash: string | null;
     elapsedMs: number;
+    /** The host's id for the tool call; set on `tool-failure` rows only. */
+    toolUseId?: string | null;
+    /** The `failure_log` row the failure was logged as; set on `tool-failure` rows only. */
+    failureId?: number | null;
     candidates: readonly DeliveryCandidateInput[];
 }
 export interface DeliveryFacts {
@@ -116,6 +121,8 @@ export interface DeliveryOutcomeInput {
 export interface DeliveryRecorder extends DeliveryObserver {
     readonly root: string;
     delivered(outcome: DeliveryOutcomeInput): void;
+    /** The failure log row id a `tool-failure` event links to; null when the log write threw. */
+    logged(failureId: number | null): void;
     /** Builds the event and hands it to `write` once per call; throws on an injected fault, and writes nothing once broken. */
     flush(write: (input: DeliveryEventInput) => number | null): void;
 }
@@ -131,10 +138,10 @@ export interface DeliveryRecorderInit {
     runtime?: DeliveryRuntime;
     /** Set by hooks that are not prompt or context calls; without it the payload's hook event decides. */
     eventType?: DeliveryEventType;
+    /** Makes this recorder throw at one stage; only tests set it, and no CLI flag or environment variable reaches it. */
+    fault?: DeliveryFault;
 }
 export type DeliveryFault = 'observe' | 'build' | 'flush';
-/** Makes every recorder created afterwards throw at one stage. Only tests call it; the shipped CLI and server have no route here. */
-export declare function _setDeliveryFaultForTests(fault: DeliveryFault | null): void;
 /** A recorder for one call; every observer method is guarded, and a throw marks it broken instead of escaping. */
 export declare function createDeliveryRecorder(init: DeliveryRecorderInit): DeliveryRecorder;
 //# sourceMappingURL=delivery-recorder.d.ts.map

package/dist/store/delivery-recorder.js

@@ -1,14 +1,15 @@
 import { evalNow } from '../core/ablation.js';
 import { scoreOverlap } from '../core/prompt-recall.js';
-import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from './token-ledger.js';
+import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from '../util/hook-payload.js';
 import { blockHash, estimateTokens } from '../util/token-text.js';
 import { errorMessage, log } from '../util/log.js';
 /** True for the boundary types: a compaction's two hooks and the end of a session. */
 export const isBoundaryEvent = (type) => type === 'pre-compact' || type === 'compact-resume' || type === 'session-end';
 /** Only the per-prompt calls keep prompt facts; a boundary or a `hippo context` run is not a prompt. */
 const carriesPrompt = (type) => type === 'prompt-submit' || type === 'pinned-manual';
-/** Row format version in `delivery_events.ledger_version`: 3 = written by a binary that can write session-end and context rows, so `event_type` has six values. */
-export const DELIVERY_LEDGER_VERSION = 3;
+/** Row format version in `delivery_events.ledger_version`: 4 = written by a binary that can write `tool-failure` rows and hashes the
+ * store's resolved root. */
+export const DELIVERY_LEDGER_VERSION = 4;
 /** Rejected candidate rows kept per event; the rest only add to `rejected_unlisted`. */
 export const DELIVERY_REJECTED_ROW_CAP = 16;
 // Deeper stages were closer to being sent, so the row cap keeps them first.
@@ -35,10 +36,13 @@ function readPayload(init) {
     const rawTurnId = hookPayloadString(init.stdinText, 'turn_id');
     const hostTurnId = rawTurnId !== null && rawTurnId.trim() !== '' ? rawTurnId : null;
     const hookEvent = hookPayloadString(init.stdinText, 'hook_event_name');
+    const rawToolUseId = hookPayloadString(init.stdinText, 'tool_use_id')?.trim() ?? '';
+    // Cut as failure_log cuts its payload fields: the payload is not trusted to be short.
+    const toolUseId = rawToolUseId !== '' ? rawToolUseId.slice(0, 128) : null;
     const sessionState = subagent
         ? 'subagent'
         : payloadSession !== null ? 'payload' : envSession !== null ? 'env' : 'missing';
-    return { payloadSession, envSession, prompt, hostTurnId, hookEvent, sessionState };
+    return { payloadSession, envSession, prompt, hostTurnId, hookEvent, toolUseId, sessionState };
 }
 function rejectId(state, id, rejection) {
     const { stage, reason, score, tokens } = rejection;
@@ -136,6 +140,8 @@ function buildEvent(init, payload, state, ts, startedMs) {
         recallHash: outcome.recallHash ?? null,
         emittedHash: emitted !== null ? blockHash(emitted) : null,
         elapsedMs: Math.max(0, Date.now() - startedMs),
+        toolUseId: eventType === 'tool-failure' ? payload.toolUseId : null,
+        failureId: eventType === 'tool-failure' ? state.failureId : null,
         candidates: rows,
     };
 }
@@ -192,20 +198,15 @@ function candidateMethods(state, guard) {
         }),
     };
 }
-let injectedFault = null;
-/** Makes every recorder created afterwards throw at one stage. Only tests call it; the shipped CLI and server have no route here. */
-export function _setDeliveryFaultForTests(fault) {
-    injectedFault = fault;
-}
 /** A recorder for one call; every observer method is guarded, and a throw marks it broken instead of escaping. */
 export function createDeliveryRecorder(init) {
     const startedMs = Date.now();
     const ts = evalNow().toISOString();
-    const fault = injectedFault;
+    const fault = init.fault ?? null;
     const payload = readPayload(init);
     const state = {
         candidates: new Map(), picked: new Map(), filtered: new Set(), facts: null, shown: 0, dropped: 0,
-        disabledSeen: false, outcome: { state: 'empty' }, queryHash: null, recallTraceId: null, broken: null, flushed: false,
+        disabledSeen: false, outcome: { state: 'empty' }, queryHash: null, recallTraceId: null, failureId: null, broken: null, flushed: false,
     };
     const guard = guardFor(state, fault);
     const { qualityDropped, offer, reject, dropMissing, gated, selected } = candidateMethods(state, guard);
@@ -229,6 +230,7 @@ export function createDeliveryRecorder(init) {
         queried: (query) => guard(() => { state.queryHash = blockHash(query); }),
         traced: (traceId) => guard(() => { state.recallTraceId = traceId; }),
         delivered: (o) => guard(() => { state.outcome = { ...o }; }),
+        logged: (failureId) => guard(() => { state.failureId = failureId; }),
         flush: (write) => {
             if (state.flushed)
                 return;

package/dist/store/descendant-page.js

@@ -1,6 +1,8 @@
-import { chunked, selectEntriesByIds, TENANT_IS } from './entry-reads.js';
+import { selectEntriesByIds, TENANT_IS } from './entry-reads.js';
+import { chunked } from '../util/chunked.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
-const marks = (ids) => ids.map(() => '?').join(',');
+import { placeholders } from '../util/sql.js';
+const marks = (ids) => placeholders(ids.length);
 /** The walk `summaryWithDescendants` documents, with `levels` cut to the first `page.rows` rows and each level's full count in `sizes`. */
 export function pagedDescendants(db, walk, summaryAdmitted) {
     const sizes = [];
@@ -53,7 +55,8 @@ function countedLevel(db, walk, parents, room) {
     const perParent = new Map();
     for (const chunk of chunked([...parents])) {
         // SAFETY: the SELECT names exactly ChildGroup's four fields, and the WHERE keeps dag_parent_id a string.
-        const groups = db.prepare(`SELECT dag_parent_id, scope, origin_project, COUNT(*) AS n FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? GROUP BY dag_parent_id, scope, origin_project`).all(...chunk, walk.tenantId, walk.summary.id);
+        const groups = db.prepare(`SELECT dag_parent_id, scope, origin_project, COUNT(*) AS n FROM memories ` +
+            `WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? GROUP BY dag_parent_id, scope, origin_project`).all(...chunk, walk.tenantId, walk.summary.id);
         for (const group of groups) {
             if (!walk.page.admit(group))
                 return null;
@@ -85,7 +88,8 @@ function childrenInOrder(db, walk, parents, limit) {
     const byParent = new Map();
     for (const chunk of chunked([...parents])) {
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? ORDER BY created ASC, id ASC LIMIT ?`).all(...chunk, walk.tenantId, walk.summary.id, limit);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? ` +
+            `ORDER BY created ASC, id ASC LIMIT ?`).all(...chunk, walk.tenantId, walk.summary.id, limit);
         for (const row of rows) {
             const bucket = byParent.get(row.dag_parent_id ?? '');
             if (bucket)

package/dist/store/dormant.d.ts

@@ -3,7 +3,7 @@
  * Not the raw archive (`raw_archive`, `archiveRawMemory`), which keeps metadata only. db-taking helpers leave the handle and transaction to the caller. */
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { MemoryEntry } from '../core/memory.js';
-import type { SqlFragment } from './recall-scope.js';
+import type { SqlFragment } from './rule-sql.js';
 import type { WriteBudget } from '../util/write-budget.js';
 /** Why a memory went dormant: sleep's decay pass, an imported agent memory whose note was deleted, `hippo projects repair`
  * splitting a two-project merge, or `hippo audit repair` setting aside an automatic memory with a certain defect. */

package/dist/store/dormant.js

@@ -3,7 +3,8 @@
  * Not the raw archive (`raw_archive`, `archiveRawMemory`), which keeps metadata only. db-taking helpers leave the handle and transaction to the caller. */
 import { closeHippoDb, openHippoDb, withWriteScope, withWriteScopeOr } from '../db/index.js';
 import { onHandle } from './open.js';
-import { RejectedValueError, rejectionDigest } from './rejection.js';
+import { rejectionDigest } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { escapeLike } from '../util/escape.js';
 import { warnDamagedColumn } from '../util/stored-json.js';
 import { DAY_MS } from '../util/time.js';
@@ -23,15 +24,20 @@ export function insertDormantRow(db, move) {
       reason = excluded.reason,
       strength = excluded.strength,
       dormant_at = excluded.dormant_at
-  `).run(move.entry.tenantId, move.entry.id, move.entry.content, JSON.stringify(move.entry), move.reason, move.strength, move.dormantAt);
+  `).run(move.entry.tenant_id, move.entry.id, move.entry.content, JSON.stringify(move.entry), move.reason, move.strength, move.dormantAt);
+}
+function toCurrentEntry({ tenantId, summary_dirty, tenant_id, ...rest }) {
+    return { ...rest, tenant_id: tenant_id ?? tenantId ?? '', summary_dirty: summary_dirty === true || summary_dirty === 1 };
 }
 /** Parse a stored snapshot back into a MemoryEntry, or null when the row no longer matches it (edited by hand, or truncated). */
 function parseSnapshot(row) {
     try {
         // SAFETY: entry_json is only written by insertDormantRow from a MemoryEntry;
         // the id / tenant / content checks below reject a row edited out of shape.
-        const entry = JSON.parse(row.entry_json);
-        if (entry.id !== row.id || entry.tenantId !== row.tenant_id || entry.content !== row.content) {
+        // SAFETY: entry_json came from JSON.stringify of a MemoryEntry (2.0) or a 1.x one; the checks below reject a row edited out of shape.
+        const entry = toCurrentEntry(JSON.parse(row.entry_json));
+        if (entry.id !== row.id || entry.tenant_id !== row.tenant_id || entry.content !== row.content) {
+            warnDamagedColumn({ table: 'dormant_memories', id: row.id, column: 'entry_json' }, 'wrong shape');
             return null;
         }
         return entry;

package/dist/store/embeddings/index.d.ts

@@ -1,9 +1,6 @@
-/** Optional embedding-based semantic search for Hippo.
- * Uses @huggingface/transformers (local, no API keys, ~22MB model); falls back silently if not installed. */
-import { MemoryEntry } from '../../core/memory.js';
+/** The stored vector index's identity: which model and text format built it, and when a provider change means a rebuild.
+ * Picking a provider and computing vectors sit in src/search/embed-memories.ts; this module only reads and writes what is stored. */
 import { EMBEDDING_MODEL_META_KEY } from '../../db/vector-store.js';
-import { type EmbeddingProvider } from './provider.js';
-import type { HippoStore } from '../index.js';
 export { EMBEDDING_MODEL_META_KEY };
 /** Bump when `embeddingInputText` changes existing vectors; folded into the stored index identity (`embeddingIndexIdentity`) so it reindexes like a model
  * change. Format 2 = `path:*` tags excluded; format 1 (implicit, no suffix) included them. */
@@ -26,11 +23,4 @@ export declare function resolveIndexedEmbeddingModel(hippoRoot: string, index?:
 export declare function embeddingModelRequiresReindex(hippoRoot: string, model: string, index?: Record<string, number[]>): boolean;
 /** Cosine similarity; handles unnormalized vectors, returns 0 for empty or mismatched vectors. */
 export declare function cosineSimilarity(a: number[], b: number[]): number;
-/** `cosineSimilarity` over any indexable vectors; a Float32 view reads the same doubles as its number[] copy, so the score is the same. */
-export declare function cosineOf(a: ArrayLike<number>, b: ArrayLike<number>): number;
-/** Embed a single memory entry and cache the result in the embedding index; with `store`, through its vectorWrites, never opening hippo.db. */
-export declare function embedMemory(hippoRoot: string, entry: MemoryEntry, model?: string, store?: HippoStore): Promise<void>;
-/** Embeds every entry with no cached vector, prunes vectors of deleted memories, and returns how many it embedded; `provider` defaults to the
- *  configured one. With `store`, every tenant's memories with no vector for the provider's model go through its `vectorWrites`, never hippo.db. */
-export declare function embedAll(hippoRoot: string, model?: string, provider?: EmbeddingProvider, store?: HippoStore): Promise<number>;
 //# sourceMappingURL=index.d.ts.map

package/dist/store/embeddings/index.js

@@ -1,19 +1,10 @@
-/** Optional embedding-based semantic search for Hippo.
- * Uses @huggingface/transformers (local, no API keys, ~22MB model); falls back silently if not installed. */
-import { envByName } from '../../util/env.js';
-import * as fs from 'fs';
-import * as path from 'path';
-import { randomUUID } from 'crypto';
-import { chunked, loadAllEntryIds, loadEntriesByIds } from '../entry-reads.js';
-import { rethrowIfSqliteBlocked } from '../../db/index.js';
+/** The stored vector index's identity: which model and text format built it, and when a provider change means a rebuild.
+ * Picking a provider and computing vectors sit in src/search/embed-memories.ts; this module only reads and writes what is stored. */
+import { cosineOf } from '../../core/cosine.js';
 import { EMBEDDING_MODEL_META_KEY } from '../../db/vector-store.js';
-import { initializeParticle } from '../../db/physics-state.js';
-import { indexedModel, pruneStoredVectors, replacesIndex, resetStoredParticles, saveEmbeddingIndex, saveIndexIdentity, saveStoredVectors, seedStoredParticle, storedIndexState, } from '../vector-index.js';
-import { loadConfig } from '../../core/config.js';
-import { resolveEmbeddingProvider } from './provider.js';
-import { redactSecretsStrict } from '../../util/secret-detect.js';
+import { indexedModel, saveIndexIdentity, storedIndexState } from '../vector-index.js';
 import { errorMessage, log } from '../../util/log.js';
-import { StoreNotPortedError } from '../../util/sqlite-blocked.js';
+import { rethrowIfSqliteBlocked } from '../../util/sqlite-blocked.js';
 export { EMBEDDING_MODEL_META_KEY };
 /** Bump when `embeddingInputText` changes existing vectors; folded into the stored index identity (`embeddingIndexIdentity`) so it reindexes like a model
  * change. Format 2 = `path:*` tags excluded; format 1 (implicit, no suffix) included them. */
@@ -57,368 +48,8 @@ export function resolveIndexedEmbeddingModel(hippoRoot, index) {
 export function embeddingModelRequiresReindex(hippoRoot, model, index) {
     return indexNeedsRebuild(resolveIndexedEmbeddingModel(hippoRoot, index), model);
 }
-const STORE_PAGE = 64;
-/** The rows for `ids`, a page at a time and in that order; an id deleted since it was listed is skipped. */
-function* entryPages(hippoRoot, ids) {
-    for (const page of chunked(ids, STORE_PAGE)) {
-        const byId = new Map(loadEntriesByIds(hippoRoot, page).map((e) => [e.id, e]));
-        const entries = page.flatMap((id) => byId.get(id) ?? []);
-        if (entries.length > 0)
-            yield entries;
-    }
-}
-async function rebuildEmbeddingIndex(hippoRoot, ids, provider) {
-    const rebuilt = {};
-    for (const entries of entryPages(hippoRoot, ids)) {
-        // On a hard transport/auth failure provider.embed throws, so the caller aborts WITHOUT saving
-        // a partial index (atomic reindex: the old index + stored identity are preserved).
-        const vectors = await provider.embed(entries.map((e) => embeddingInputText(e)), 'passage');
-        for (let i = 0; i < entries.length; i++) {
-            const vec = vectors[i];
-            if (vec && vec.length > 0) {
-                rebuilt[entries[i].id] = vec;
-            }
-            else {
-                noteSkippedEmbedding(entries[i].id);
-            }
-        }
-    }
-    return rebuilt;
-}
-function resetPhysicsFromIndex(hippoRoot, ids, index) {
-    try {
-        resetStoredParticles(hippoRoot, ids, index);
-    }
-    catch (err) {
-        // Best effort: retrieval still falls back without physics state.
-        log.warn(`physics reset after reindex failed: ${errorMessage(err)}`);
-    }
-}
-/** A provider's `[]` row is a swallowed per-item failure; name the memory so the gap can be traced. */
-function noteSkippedEmbedding(id) {
-    log.warn('memory not embedded; the next embed run retries it', { id });
-}
 /** Cosine similarity; handles unnormalized vectors, returns 0 for empty or mismatched vectors. */
 export function cosineSimilarity(a, b) {
     return cosineOf(a, b);
 }
-/** `cosineSimilarity` over any indexable vectors; a Float32 view reads the same doubles as its number[] copy, so the score is the same. */
-export function cosineOf(a, b) {
-    if (a.length === 0 || b.length === 0 || a.length !== b.length)
-        return 0;
-    let dot = 0;
-    let normA = 0;
-    let normB = 0;
-    for (let i = 0; i < a.length; i++) {
-        dot += a[i] * b[i];
-        normA += a[i] * a[i];
-        normB += b[i] * b[i];
-    }
-    const denom = Math.sqrt(normA) * Math.sqrt(normB);
-    if (denom < 1e-10)
-        return 0;
-    // Clamp to [-1, 1] to handle floating point drift
-    return Math.min(1, Math.max(-1, dot / denom));
-}
-const EMBED_LOCK_FILE = 'embeddings.lock';
-const EMBED_LOCK_WAIT_MS = 10_000;
-const EMBED_LOCK_OWNER = `${process.pid}:${randomUUID()}`;
-// In-process mutex plus an O_EXCL "<pid>:<token>" lock file: our token is a lock we leaked; our PID
-// with another token is a live worker thread, unless the lock predates this process (a reused PID).
-let _embedWriteLock = Promise.resolve();
-function embedLockHolderAlive(lockPath) {
-    let raw;
-    try {
-        raw = fs.readFileSync(lockPath, 'utf8');
-    }
-    catch (err) {
-        return !(err instanceof Error && 'code' in err && err.code === 'ENOENT');
-    }
-    const mtimeMs = fs.statSync(lockPath, { throwIfNoEntry: false })?.mtimeMs ?? 0;
-    const pid = Number(raw.split(':')[0]);
-    // An empty lock is a holder between create and write; after 5 s it is a crashed one.
-    if (!Number.isInteger(pid) || pid <= 0)
-        return Date.now() - mtimeMs < 5_000;
-    if (raw === EMBED_LOCK_OWNER)
-        return false;
-    if (pid === process.pid)
-        return mtimeMs >= Date.now() - process.uptime() * 1000;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        return err instanceof Error && 'code' in err && err.code === 'EPERM';
-    }
-}
-// After the double-break race below the file can be another writer's lock, so remove only our own.
-function releaseEmbedFileLock(lockPath) {
-    let raw;
-    try {
-        raw = fs.readFileSync(lockPath, 'utf8');
-    }
-    catch (err) {
-        if (err instanceof Error && 'code' in err && err.code === 'ENOENT')
-            return;
-        throw err;
-    }
-    if (raw === EMBED_LOCK_OWNER)
-        fs.rmSync(lockPath, { force: true });
-}
-async function acquireEmbedFileLock(hippoRoot) {
-    const lockPath = path.join(hippoRoot, EMBED_LOCK_FILE);
-    const deadline = Date.now() + EMBED_LOCK_WAIT_MS;
-    for (;;) {
-        try {
-            fs.writeFileSync(lockPath, EMBED_LOCK_OWNER, { flag: 'wx' });
-            return () => releaseEmbedFileLock(lockPath);
-        }
-        catch (err) {
-            if (!(err instanceof Error && 'code' in err && err.code === 'EEXIST'))
-                throw err;
-        }
-        // SHORTCUT: two waiters can both break one dead holder's lock; a vector lost that way is backfilled by the next `hippo embed`.
-        if (!embedLockHolderAlive(lockPath)) {
-            fs.rmSync(lockPath, { force: true });
-            continue;
-        }
-        if (Date.now() >= deadline)
-            throw new Error(`the embedding index is busy: another hippo process holds ${lockPath}`);
-        await new Promise((r) => setTimeout(r, 50));
-    }
-}
-async function withEmbedLock(hippoRoot, fn) {
-    return withProcessEmbedLock(async () => {
-        const release = await acquireEmbedFileLock(hippoRoot);
-        try {
-            return await fn();
-        }
-        finally {
-            release();
-        }
-    });
-}
-// A store keeps each write whole in its own transaction, and a lock file in hippoRoot would not reach a worker on another host.
-async function withProcessEmbedLock(fn) {
-    let resolve;
-    const next = new Promise(r => { resolve = r; });
-    const prev = _embedWriteLock;
-    _embedWriteLock = next;
-    await prev;
-    try {
-        return await fn();
-    }
-    finally {
-        resolve();
-    }
-}
-// A bad key fails every write; one warning tells the user, N would bury the command's own output.
-let _embedFailureWarned = false;
-function warnEmbedFailureOnce(source, rawMessage) {
-    if (_embedFailureWarned)
-        return;
-    _embedFailureWarned = true;
-    // Strict scrub: this line can land in a hook log file, and an API may echo the key back in its error body.
-    const message = redactSecretsStrict(rawMessage).replace(/\s+/g, ' ').replace(/\.+$/, '');
-    log.warn(`embedding failed (${source}): ${message}. Memories are stored without embeddings until this is fixed.`);
-}
-// requireGroup (src/store/port.ts) would close an import cycle with this module.
-function vectorGroups(store) {
-    if (store.vectors === undefined)
-        throw new StoreNotPortedError(store.kind, 'vectors');
-    if (store.vectorWrites === undefined)
-        throw new StoreNotPortedError(store.kind, 'vectorWrites');
-    return [store.vectors, store.vectorWrites];
-}
-/** Writes one page's vectors, one writeVectors per tenant, and stops at the first refused write; `withParticles` seeds each memory's particle. */
-async function writeVectorPage(writes, write, page, vectors, withParticles) {
-    const byTenant = new Map();
-    page.forEach((entry, i) => {
-        const vector = vectors[i];
-        if (!vector || vector.length === 0)
-            return noteSkippedEmbedding(entry.id);
-        const row = withParticles ? { memoryId: entry.id, vector, particle: initializeParticle(entry, vector) } : { memoryId: entry.id, vector };
-        byTenant.set(entry.tenantId, [...(byTenant.get(entry.tenantId) ?? []), row]);
-    });
-    let written = 0;
-    for (const [tenantId, rows] of byTenant) {
-        const result = await writes.writeVectors({ ...write, tenantId, rows });
-        if (result.modelMismatch)
-            return { written, modelMismatch: true };
-        written += result.written;
-    }
-    return { written, modelMismatch: false };
-}
-const OTHER_MODEL_INDEX = "the vector index was built by another embedding model; run 'hippo embed' to rebuild it";
-/** Embeds every memory with no vector under `model`, page by page, so a provider failure keeps the pages written; a rebuild reseeds the particles it drops. */
-async function backfillInStore(writes, provider, model, rebuild) {
-    let count = 0;
-    let afterId;
-    for (;;) {
-        const page = await writes.entriesWithoutVector({ model, afterId, limit: STORE_PAGE });
-        if (page.length === 0)
-            return count;
-        afterId = page[page.length - 1].id;
-        const vectors = await provider.embed(page.map((e) => embeddingInputText(e)), 'passage');
-        const result = await writeVectorPage(writes, { model, replaceIndex: rebuild }, page, vectors, rebuild);
-        // Another process rebuilt the index mid-run; every later page would be refused too, after paying the provider for it.
-        if (result.modelMismatch)
-            throw new Error(OTHER_MODEL_INDEX);
-        count += result.written;
-    }
-}
-/** embedAll on a store: a model change re-embeds every memory, and the first page written drops the old index. */
-async function embedAllInStore(store, provider) {
-    const [reads, writes] = vectorGroups(store);
-    const rebuild = indexNeedsRebuild(indexedModel(await reads.embeddingIndexState()), provider.id);
-    return backfillInStore(writes, provider, embeddingIndexIdentity(provider.id), rebuild);
-}
-/** embedMemory on a store; like the hippo.db path it resolves whatever fails. Unlike it, it leaves a model change to embedAll, so a stale
- *  read here never drops another process's rebuild; the read only saves a paid embed call, as the write refuses another model itself. */
-function embedMemoryInStore(store, provider, entry) {
-    return withProcessEmbedLock(async () => {
-        const [reads, writes] = vectorGroups(store);
-        const model = embeddingIndexIdentity(provider.id);
-        try {
-            const refused = replacesIndex(await reads.embeddingIndexState(), model)
-                || (await writeVectorPage(writes, { model, replaceIndex: false }, [entry], await provider.embed([embeddingInputText(entry)], 'passage'), true)).modelMismatch;
-            if (refused)
-                warnEmbedFailureOnce('index', OTHER_MODEL_INDEX);
-        }
-        catch (err) {
-            warnEmbedFailureOnce(provider.kind, errorMessage(err));
-        }
-    }).catch((err) => {
-        log.warn(`skipped embedding ${entry.id} (${errorMessage(err)})`);
-    });
-}
-/** Embed a single memory entry and cache the result in the embedding index; with `store`, through its vectorWrites, never opening hippo.db. */
-export async function embedMemory(hippoRoot, entry, model, store) {
-    let provider;
-    try {
-        provider = resolveEmbeddingProvider(hippoRoot, { model });
-    }
-    catch (err) {
-        // Callers fire and forget, so this must resolve: a bad config warns once instead of rejecting.
-        warnEmbedFailureOnce('config', errorMessage(err));
-        return;
-    }
-    if (!provider.isAvailable())
-        return;
-    if (store)
-        return embedMemoryInStore(store, provider, entry);
-    return withEmbedLock(hippoRoot, async () => {
-        // Best-effort: an embedding failure (API down, bad key, 5xx) must not reject the caller's write; the existing index is left as-is.
-        // Failures surface on the explicit `hippo embed` / `embedAll` path.
-        try {
-            const identity = provider.id;
-            if (embeddingModelRequiresReindex(hippoRoot, identity)) {
-                await rebuildIndexForProvider(hippoRoot, provider);
-                return;
-            }
-            const text = embeddingInputText(entry);
-            const [vector] = await provider.embed([text], 'passage');
-            if (!vector || vector.length === 0)
-                return;
-            saveStoredVectors(hippoRoot, [[entry.id, vector]], embeddingIndexIdentity(identity));
-            saveStoredEmbeddingModel(hippoRoot, identity);
-            // Initialize physics state for this memory
-            initializePhysicsIfMissing(hippoRoot, entry, vector);
-        }
-        catch (err) {
-            // Provider failure (API down / bad key). Best-effort: leave the index as-is, but say so once.
-            warnEmbedFailureOnce(provider.kind, errorMessage(err));
-        }
-    }).catch((err) => {
-        log.warn(`skipped embedding ${entry.id} (${errorMessage(err)}); run 'hippo embed' to backfill`);
-    });
-}
-// Every page is embedded before one transaction replaces the index, and the identity is saved only after that: a provider failure or a crash
-// at any earlier point leaves the old identity, so embeddingModelRequiresReindex has the next run rebuild from the start.
-async function rebuildIndexForProvider(hippoRoot, provider) {
-    const identity = provider.id;
-    // Host-wide rebuild: one embedding index per hippoRoot, keyed by tenant-scoped entry.id; per-tenant indices would be a larger architecture change.
-    const ids = loadAllEntryIds(hippoRoot);
-    const rebuiltIndex = await rebuildEmbeddingIndex(hippoRoot, ids, provider);
-    saveEmbeddingIndex(hippoRoot, rebuiltIndex, embeddingIndexIdentity(identity));
-    saveStoredEmbeddingModel(hippoRoot, identity);
-    resetPhysicsFromIndex(hippoRoot, ids, rebuiltIndex);
-    return Object.keys(rebuiltIndex).length;
-}
-function initializePhysicsIfMissing(hippoRoot, entry, vector) {
-    try {
-        seedStoredParticle(hippoRoot, entry, vector);
-    }
-    catch (err) {
-        // Physics init is best-effort and must not fail the embedding that just landed.
-        log.debug(`physics state not initialised for ${entry.id}: ${errorMessage(err)}`);
-    }
-}
-/** Throws when an unavailable provider is a misconfiguration rather than an intentional no-op. */
-function throwIfProviderKeyMissing(hippoRoot, provider) {
-    // A configured API provider with a missing key is a misconfiguration: surface it so callers of the exported embedAll() learn nothing was written.
-    // Local-not-installed and an explicit enabled=false stay silent no-ops.
-    const cfg = loadConfig(hippoRoot).embeddings;
-    if (provider.kind !== 'local' &&
-        cfg.enabled !== false &&
-        provider.keyEnv &&
-        !envByName(provider.keyEnv)?.trim()) {
-        throw new Error(`Embedding provider '${provider.kind}' is configured but ${provider.keyEnv} is not set.`);
-    }
-}
-// Embeds entries without a cached vector in save-checkpointed chunks; a `[]` row means that item could not be embedded and is retried next run.
-// On a hard provider failure mid-backfill the chunks already embedded are persisted (paid progress), then it stops and resumes next run.
-async function backfillPending(hippoRoot, provider, pending, model) {
-    let count = 0;
-    // Initialized to `undefined` so it stays a plain `unknown` binding for the arbitrary caught value; falsy either way.
-    let backfillError = undefined;
-    for (const chunk of entryPages(hippoRoot, pending)) {
-        let vectors;
-        try {
-            vectors = await provider.embed(chunk.map((e) => embeddingInputText(e)), 'passage');
-        }
-        catch (err) {
-            // Preserve the chunks already saved this run, then surface the failure
-            // below so the explicit `hippo embed` path never reports a false success.
-            backfillError = err;
-            break;
-        }
-        const rows = [];
-        for (let j = 0; j < chunk.length; j++) {
-            const vec = vectors[j];
-            if (vec && vec.length > 0)
-                rows.push([chunk[j].id, vec]);
-            else
-                noteSkippedEmbedding(chunk[j].id);
-        }
-        count += saveStoredVectors(hippoRoot, rows, model);
-    }
-    return { count, backfillError };
-}
-/** Embeds every entry with no cached vector, prunes vectors of deleted memories, and returns how many it embedded; `provider` defaults to the
- *  configured one. With `store`, every tenant's memories with no vector for the provider's model go through its `vectorWrites`, never hippo.db. */
-export async function embedAll(hippoRoot, model, provider = resolveEmbeddingProvider(hippoRoot, { model }), store) {
-    if (!provider.isAvailable()) {
-        throwIfProviderKeyMissing(hippoRoot, provider);
-        return 0;
-    }
-    if (store)
-        return withProcessEmbedLock(() => embedAllInStore(store, provider));
-    return withEmbedLock(hippoRoot, async () => {
-        const identity = provider.id;
-        if (embeddingModelRequiresReindex(hippoRoot, identity))
-            return rebuildIndexForProvider(hippoRoot, provider);
-        // Host-wide by design: embedAll backfills all tenants' entries into the per-host index; per-tenant filtering would produce partial indices and break
-        // recall.
-        const embedded = pruneStoredVectors(hippoRoot);
-        const pending = loadAllEntryIds(hippoRoot).filter((id) => !embedded.has(id));
-        const { count, backfillError } = await backfillPending(hippoRoot, provider, pending, embeddingIndexIdentity(identity));
-        saveStoredEmbeddingModel(hippoRoot, identity);
-        // Partial progress is now persisted; surface a hard backfill failure so the
-        // explicit embed path reports it (best-effort callers go via embedMemory).
-        if (backfillError)
-            throw backfillError;
-        return count;
-    });
-}
 //# sourceMappingURL=index.js.map