hippo-memory 1.71.0 → 2.0.0

package/dist/store/entry-reads.d.ts

@@ -3,10 +3,6 @@ import { type DatabaseSyncLike } from '../db/index.js';
 export declare const TENANT_IS = "+tenant_id = ?";
 /** Read a memory entry by ID. With `tenantId` the read is tenant-scoped (cross-tenant returns null); omitted, no tenant filter is applied. */
 export declare function readEntry(hippoRoot: string, id: string, tenantId?: string): MemoryEntry | null;
-/** Ids per `IN (...)` list: far under SQLite's bound-parameter limit, with room for the tenant filter. */
-export declare const ID_CHUNK = 500;
-/** `items` in consecutive slices of at most `size`. */
-export declare function chunked<T>(items: readonly T[], size?: number): T[][];
 /** Answers whether a tenant's rows in this store hold an id: `ids` are looked up now, one query per chunk, and any other id on its first ask. */
 export declare function heldIdLookup(hippoRoot: string, tenantId: string, ids: readonly string[]): (id: string) => boolean;
 /** Rows by id on the caller's handle, one query per chunk; an id missing or in another tenant is absent from the map. */
@@ -28,6 +24,19 @@ export declare function loadFreshRawMemories(hippoRoot: string, count: number, t
 export declare function loadAllEntries(hippoRoot: string, tenantId?: string): MemoryEntry[];
 /** Every tenant's memory ids in loadAllEntries' order, for a caller that reads the rows a page at a time instead of holding them all. */
 export declare function loadAllEntryIds(hippoRoot: string): string[];
+/** How many memory rows the store holds across every tenant. */
+export declare function countAllEntries(hippoRoot: string): number;
+/** A superset, in loadAllEntries' order, of the rows whose lowercased content holds any of `tokens` or whose lowercased tags hold `tag`.
+ * The caller re-checks each row exactly; this only spares decoding rows that cannot match. */
+export declare function loadEntriesMentioning(hippoRoot: string, tokens: readonly string[], tag: string, tenantId?: string): MemoryEntry[];
+export interface EntryTextKey {
+    id: string;
+    tenant_id: string;
+    content: string;
+    source: string;
+}
+/** The rows in loadAllEntries' order (every tenant unless one is named), with only the columns that say whether another store already holds each. */
+export declare function loadEntryTextKeys(hippoRoot: string, tenantId?: string): EntryTextKey[];
 export interface EntriesWithBase {
     entries: MemoryEntry[];
     base: {
@@ -36,8 +45,30 @@ export interface EntriesWithBase {
 }
 /** Every entry plus a by-id lookup of each as loaded, rebuilt from its row on first use, so no deep copy of the store is kept. */
 export declare function loadAllEntriesWithBase(hippoRoot: string): EntriesWithBase;
+/** Where a page stopped: the `created`, `id` of its last row, in loadAllEntries' order. */
+export interface EntryCursor {
+    created: string;
+    id: string;
+}
+export interface EntryPage {
+    entries: MemoryEntry[];
+    /** The cursor that reads the page after this one, or null when this was the last. */
+    next: EntryCursor | null;
+}
+/** Up to `limit` rows in loadAllEntries' order, starting after `after`; omitting `tenantId` reads every tenant. */
+export declare function loadEntriesPage(hippoRoot: string, tenantId: string | undefined, page: {
+    limit: number;
+    after?: EntryCursor;
+}): EntryPage;
 /** Every memory row on an open connection, so a caller can read inside its own transaction. */
 export declare function selectAllEntries(db: DatabaseSyncLike, tenantId?: string): MemoryEntry[];
+/** The columns a text match needs, for every row of a tenant in loadAllEntries' order: callers read whole rows only for the ids that match. */
+export declare function selectTenantTexts(db: DatabaseSyncLike, tenantId: string): Array<{
+    id: string;
+    content: string;
+    source: string;
+    scope: string | null;
+}>;
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export declare function selectLiveEntriesBySourcePrefix(db: DatabaseSyncLike, tenantId: string, prefix: string): MemoryEntry[];
 export declare function loadContentsWithTag(hippoRoot: string, tenantId: string, tag: string, origins?: readonly string[]): string[];

package/dist/store/entry-reads.js

@@ -3,7 +3,10 @@ import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { onHandle, openStore } from './open.js';
 import { escapeLike } from '../util/escape.js';
 import { originInSql } from '../core/project-identity.js';
-import { scopeAdmitSql } from './recall-scope.js';
+import { scopeAdmitSql } from './rule-sql.js';
+import { chunked } from '../util/chunked.js';
+import { DEFAULT_TENANT_ID } from '../util/env.js';
+import { placeholders } from '../util/sql.js';
 const MAX_IDS_PER_READ = 500;
 // The plus keeps SQLite on the primary key for an id list: with a bare tenant_id it walks every row of the tenant instead.
 export const TENANT_IS = '+tenant_id = ?';
@@ -18,15 +21,6 @@ export function readEntry(hippoRoot, id, tenantId) {
         return row ? rowToEntry(row) : null;
     }, openStore);
 }
-/** Ids per `IN (...)` list: far under SQLite's bound-parameter limit, with room for the tenant filter. */
-export const ID_CHUNK = 500;
-/** `items` in consecutive slices of at most `size`. */
-export function chunked(items, size = ID_CHUNK) {
-    const out = [];
-    for (let i = 0; i < items.length; i += size)
-        out.push(items.slice(i, i + size));
-    return out;
-}
 /** Answers whether a tenant's rows in this store hold an id: `ids` are looked up now, one query per chunk, and any other id on its first ask. */
 export function heldIdLookup(hippoRoot, tenantId, ids) {
     const held = new Map();
@@ -36,7 +30,7 @@ export function heldIdLookup(hippoRoot, tenantId, ids) {
                 for (const id of chunk)
                     held.set(id, false);
                 // SAFETY: rows' shape matches the single `id` column selected.
-                const rows = db.prepare(`SELECT id FROM memories WHERE id IN (${chunk.map(() => '?').join(',')}) AND ${TENANT_IS}`).all(...chunk, tenantId);
+                const rows = db.prepare(`SELECT id FROM memories WHERE id IN (${placeholders(chunk.length)}) AND ${TENANT_IS}`).all(...chunk, tenantId);
                 for (const row of rows)
                     held.set(row.id, true);
             }
@@ -56,9 +50,9 @@ export function selectEntriesByIds(db, ids, tenantId) {
     const tenantClause = tenantId !== undefined ? ` AND ${TENANT_IS}` : '';
     const tenantArgs = tenantId !== undefined ? [tenantId] : [];
     for (const chunk of chunked([...new Set(ids)])) {
-        const placeholders = chunk.map(() => '?').join(',');
+        const marks = placeholders(chunk.length);
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders})${tenantClause}`).all(...chunk, ...tenantArgs);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${marks})${tenantClause}`).all(...chunk, ...tenantArgs);
         for (const row of rows)
             byId.set(row.id, rowToEntry(row));
     }
@@ -70,9 +64,9 @@ export function selectChildrenByParent(db, parentIds, tenantId) {
     const tenantClause = tenantId !== undefined ? ` AND ${TENANT_IS}` : '';
     const tenantArgs = tenantId !== undefined ? [tenantId] : [];
     for (const chunk of chunked([...new Set(parentIds)])) {
-        const placeholders = chunk.map(() => '?').join(',');
+        const marks = placeholders(chunk.length);
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${placeholders})${tenantClause} ORDER BY created ASC, id ASC`).all(...chunk, ...tenantArgs);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks})${tenantClause} ORDER BY created ASC, id ASC`).all(...chunk, ...tenantArgs);
         for (const row of rows) {
             const entry = rowToEntry(row);
             const parentId = entry.dag_parent_id ?? '';
@@ -91,12 +85,12 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
         return [];
     const capped = ids.slice(0, MAX_IDS_PER_READ);
     return onHandle(hippoRoot, (db) => {
-        const placeholders = capped.map(() => '?').join(',');
+        const marks = placeholders(capped.length);
         // Without ORDER BY, rows follow SQLite's IN(...) scan order, undefined w.r.t. `ids`.
         // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
         const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) AND ${TENANT_IS} ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) ORDER BY created ASC, content ASC, id ASC`).all(...capped);
+            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${marks}) AND ${TENANT_IS} ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
+            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${marks}) ORDER BY created ASC, content ASC, id ASC`).all(...capped);
         return rows.map(rowToEntry);
     }, openStore);
 }
@@ -201,6 +195,50 @@ export function loadAllEntryIds(hippoRoot) {
         return db.prepare('SELECT id FROM memories ORDER BY created ASC, id ASC').all().map((row) => row.id);
     }, openStore);
 }
+/** How many memory rows the store holds across every tenant. */
+export function countAllEntries(hippoRoot) {
+    return onHandle(hippoRoot, (db) => {
+        // SAFETY: row's shape matches the single `COUNT(*) AS c` column.
+        const row = db.prepare('SELECT COUNT(*) AS c FROM memories').get();
+        return Number(row?.c ?? 0);
+    }, openStore);
+}
+// The only code points whose JS toLowerCase yields ASCII, which SQLite's ASCII-only LIKE folding cannot see.
+const FOLDS_TO_ASCII = ['\u0130', '\u212A'];
+/** A superset, in loadAllEntries' order, of the rows whose lowercased content holds any of `tokens` or whose lowercased tags hold `tag`.
+ * The caller re-checks each row exactly; this only spares decoding rows that cannot match. */
+export function loadEntriesMentioning(hippoRoot, tokens, tag, tenantId) {
+    const likes = [...new Set(tokens)].map((t) => `%${escapeLike(t)}%`);
+    const clauses = likes.map(() => `content LIKE ? ESCAPE '\\'`);
+    const params = [...likes];
+    // A tag needing JSON escapes or case folding past ASCII is not found by a substring of tags_json, so every tagged row stays in.
+    if (/^[\x20-\x7e]*$/.test(tag) && !/["\\]/.test(tag)) {
+        clauses.push(`tags_json LIKE ? ESCAPE '\\'`);
+        params.push(`%${escapeLike(tag)}%`);
+    }
+    else
+        clauses.push(`COALESCE(tags_json, '[]') != '[]'`);
+    for (const ch of FOLDS_TO_ASCII) {
+        clauses.push('instr(content, ?) > 0', 'instr(tags_json, ?) > 0');
+        params.push(ch, ch);
+    }
+    const tenantClause = tenantId !== undefined ? 'tenant_id = ? AND ' : '';
+    return onHandle(hippoRoot, (db) => {
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE ${tenantClause}(${clauses.join(' OR ')}) ORDER BY created ASC, id ASC`).all(...(tenantId !== undefined ? [tenantId] : []), ...params);
+        return rows.map(rowToEntry);
+    }, openStore);
+}
+/** The rows in loadAllEntries' order (every tenant unless one is named), with only the columns that say whether another store already holds each. */
+export function loadEntryTextKeys(hippoRoot, tenantId) {
+    return onHandle(hippoRoot, (db) => {
+        const where = tenantId !== undefined ? 'WHERE tenant_id = ? ' : '';
+        // SAFETY: rows' shape matches the four columns named in the SELECT.
+        const rows = db.prepare(`SELECT id, tenant_id, content, source FROM memories ${where}ORDER BY created ASC, id ASC`)
+            .all(...(tenantId !== undefined ? [tenantId] : []));
+        return rows.map((row) => ({ id: row.id, tenant_id: row.tenant_id ?? DEFAULT_TENANT_ID, content: row.content, source: row.source }));
+    }, openStore);
+}
 /** Every entry plus a by-id lookup of each as loaded, rebuilt from its row on first use, so no deep copy of the store is kept. */
 export function loadAllEntriesWithBase(hippoRoot) {
     const db = openStore(hippoRoot);
@@ -229,10 +267,38 @@ function selectAllRows(db, tenantId) {
         ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE tenant_id = ? ORDER BY created ASC, id ASC`).all(tenantId)
         : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ORDER BY created ASC, id ASC`).all();
 }
+/** Up to `limit` rows in loadAllEntries' order, starting after `after`; omitting `tenantId` reads every tenant. */
+export function loadEntriesPage(hippoRoot, tenantId, page) {
+    const where = [];
+    const params = [];
+    if (tenantId !== undefined) {
+        where.push('tenant_id = ?');
+        params.push(tenantId);
+    }
+    if (page.after) {
+        where.push('(created > ? OR (created = ? AND id > ?))');
+        params.push(page.after.created, page.after.created, page.after.id);
+    }
+    const clause = where.length > 0 ? `WHERE ${where.join(' AND ')} ` : '';
+    // One extra row says whether another page follows without a count.
+    params.push(page.limit + 1);
+    return onHandle(hippoRoot, (db) => {
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ${clause}ORDER BY created ASC, id ASC LIMIT ?`).all(...params);
+        const entries = rows.slice(0, page.limit).map(rowToEntry);
+        const last = entries[entries.length - 1];
+        return { entries, next: rows.length > page.limit && last ? { created: last.created, id: last.id } : null };
+    }, openStore);
+}
 /** Every memory row on an open connection, so a caller can read inside its own transaction. */
 export function selectAllEntries(db, tenantId) {
     return selectAllRows(db, tenantId).map(rowToEntry);
 }
+/** The columns a text match needs, for every row of a tenant in loadAllEntries' order: callers read whole rows only for the ids that match. */
+export function selectTenantTexts(db, tenantId) {
+    // SAFETY: rows' shape matches the four columns named in the SELECT.
+    return db.prepare('SELECT id, content, source, scope FROM memories WHERE tenant_id = ? ORDER BY created ASC, id ASC').all(tenantId);
+}
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export function selectLiveEntriesBySourcePrefix(db, tenantId, prefix) {
     // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
@@ -265,7 +331,8 @@ export function loadVaultRawRows(hippoRoot, likeParam, tenantId) {
 export function selectPreviewRows(db, columns, tenantId) {
     const tenant = columns.has('tenant_id') ? ' WHERE tenant_id = ?' : '';
     const column = (name, fallback) => (columns.has(name) ? name : `${fallback} AS ${name}`);
-    const statement = db.prepare(`SELECT id, content, ${column('source', "''")}, ${column('confidence', 'NULL')}, ${column('extracted_from', 'NULL')}, ${column('dag_level', '0')}, ${column('tags_json', "'[]'")} FROM memories${tenant}`);
+    const statement = db.prepare(`SELECT id, content, ${column('source', "''")}, ${column('confidence', 'NULL')}, ${column('extracted_from', 'NULL')}, ` +
+        `${column('dag_level', '0')}, ${column('tags_json', "'[]'")} FROM memories${tenant}`);
     // SAFETY: the SELECT names every PreviewRow field, each a literal fallback when its column is missing.
     return (tenant ? statement.all(tenantId) : statement.all());
 }

package/dist/store/entry-row.js

@@ -3,8 +3,15 @@ import { closeHippoDb, ftsRowCounts, openHippoDb, isFtsAvailable, repairFtsDrift
 import { fallbackOrigin, originFromSource } from '../core/project-identity.js';
 import { checkRejectionGuard } from './rejection.js';
 import { errorMessage, log } from '../util/log.js';
+/** A 1.x JS caller's `tenantId` would otherwise fall through to the default tenant without a sound. */
+function rejectLegacyTenantKey(entry) {
+    if (Object.hasOwn(entry, 'tenantId') && entry.tenant_id === undefined) {
+        throw new TypeError('tenantId was renamed to tenant_id in 2.0');
+    }
+}
 export function upsertEntryRow(db, entry) {
-    checkRejectionGuard(db, entry.tenantId ?? DEFAULT_TENANT_ID, entry.id, entry.content);
+    rejectLegacyTenantKey(entry);
+    checkRejectionGuard(db, entry.tenant_id ?? DEFAULT_TENANT_ID, entry.id, entry.content);
     syncFtsRow(db, entry, upsertMemoryRow(db, entry));
 }
 /** The row alone, with no rejection guard or full-text row, for `upsertEntryRow` and for
@@ -104,7 +111,7 @@ function memoryRowValues(entry) {
         entry.scope ?? null,
         entry.owner ?? null,
         entry.artifact_ref ?? null,
-        entry.tenantId ?? DEFAULT_TENANT_ID,
+        entry.tenant_id ?? DEFAULT_TENANT_ID,
         entry.origin_project ?? null,
         entry.descendant_count ?? 0,
         entry.earliest_at ?? null,

package/dist/store/entry-writes.d.ts

@@ -2,28 +2,31 @@ import { type MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
 export interface WriteEntryOptions {
     actor?: string;
-    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
     /** Runs after the row commits and before the mirrors, on an idle connection; keep it best-effort. */
     afterCommit?: () => void;
 }
-/** Write an entry to SQLite and refresh mirrors; `opts.afterWrite` runs in the same SAVEPOINT as the INSERT, so a throw rolls the row back.
- * `opts.actor` defaults to 'cli'; the api layer passes the resolved actor so the audit log gets one row per write. */
+/** Store-side only, never exported from a package entry: `afterWrite` hands the write's own db handle to the hook. */
+export interface WriteEntryInternalOptions extends WriteEntryOptions {
+    /** Runs in the same SAVEPOINT as the INSERT, so a throw rolls the row back. */
+    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+}
+/** Write an entry to SQLite and refresh mirrors. `opts.actor` defaults to 'cli'; the api layer passes the resolved actor,
+ * so the audit log gets one row per write. */
 export declare function writeEntry(hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryOptions): void;
+/** writeEntry for store code that needs the write's own handle: `opts.afterWrite` shares the INSERT's SAVEPOINT. */
+export declare function writeEntryWithHook(hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryInternalOptions): void;
 /** writeEntry for each of `entries` in one transaction, so all land or none; each
- * keeps its audit row, and mirrors follow the commit. Returns how many were written. */
+ * keeps its audit row, and mirrors follow the commit. Returns how many were written; an empty list opens no store. */
 export declare function writeEntriesTogether(hippoRoot: string, entries: readonly MemoryEntry[]): number;
-/** writeEntry for each of `entries` on one open store, so the open and its lock wait are
- * paid once; each row commits alone, and none opens the store when the list is empty. */
-export declare function writeEntriesSeparately(hippoRoot: string, entries: readonly MemoryEntry[]): void;
+/** Runs `fill` in one transaction; each `put` writes one entry and returns false when the store rejects its value,
+ * leaving that row's refusal audit and the rest of the batch. Mirrors follow the commit. Returns how many were written. */
+export declare function writeEntriesSkippingRejected(hippoRoot: string, fill: (put: (entry: MemoryEntry) => boolean) => void, actor?: string): number;
 /** Adds `tag` to each of a tenant's rows that lacks it, in `ids` order, each read fresh
  * on one open store and committed alone; an id the tenant does not hold is skipped. */
 export declare function addTagToEntries(hippoRoot: string, tenantId: string, ids: readonly string[], tag: string): void;
 /** DB-only write path: upsert, afterWrite hook and audit row inside one withWriteScope; the caller owns `db` and must call `writeEntryMirrors` after any
  * outer tx commits, so a rolled-back tx never leaves orphan markdown. The audit row commits atomically with the INSERT. */
-export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntry, opts?: {
-    actor?: string;
-    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
-}): void;
+export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntry, opts?: Pick<WriteEntryInternalOptions, 'actor' | 'afterWrite'>): void;
 /** What follows a row's upsert inside its write scope: the remember row, last of the write's audit rows, then the summary parent's dirty mark. */
 export declare function auditEntryWrite(db: DatabaseSyncLike, entry: MemoryEntry, actor: string): void;
 /** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
@@ -36,7 +39,7 @@ export interface StrengthenOptions {
 /** Strengthen what a read returned: update only the four retrieval columns on the live row, never a stale copy.
  *  Best effort: a failure logs and never fails the read. Returns the ids found in this store. */
 export declare function strengthenRetrieved(hippoRoot: string, ids: readonly string[], opts: StrengthenOptions): Set<string>;
-/** strengthenRetrieved on an open handle that holds no transaction, so a recall's last writes share one handle. */
+/** strengthenRetrieved on an open handle in its own write scope, a savepoint inside a caller's transaction, so a recall's last writes share one handle. */
 export declare function strengthenRetrievedInOwnTx(db: DatabaseSyncLike, ids: readonly string[], opts: StrengthenOptions): Set<string>;
 /** strengthenRetrieved on the caller's handle, inside the caller's transaction. Throws; the caller decides. */
 export declare function strengthenRetrievedOn(db: DatabaseSyncLike, ids: readonly string[], opts: StrengthenOptions): Set<string>;

package/dist/store/entry-writes.js

@@ -1,6 +1,9 @@
+import { strengthAblation } from '../core/ablation.js';
 import { markRetrieved } from '../core/memory.js';
-import { closeHippoDb, openHippoDb, rethrowIfSqliteBlocked, withWriteScope } from '../db/index.js';
-import { RejectedValueError } from './rejection.js';
+import { closeHippoDb, openHippoDb, withWriteScope } from '../db/index.js';
+import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
+import { chunked } from '../util/chunked.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { markSummaryDirtyInTx } from './summary-dirty.js';
 import { errorMessage, log } from '../util/log.js';
 import { auditRejectionRefusal, audit } from './audit-event.js';
@@ -8,16 +11,22 @@ import { selectEntriesByIds } from './entry-reads.js';
 import { stampOriginProject, upsertEntryRow, syncFtsRow, deleteFtsRow } from './entry-row.js';
 import { mirrorBestEffort, writeMarkdownMirror } from './mirrors.js';
 import { onHandle, openStore } from './open.js';
-/** Write an entry to SQLite and refresh mirrors; `opts.afterWrite` runs in the same SAVEPOINT as the INSERT, so a throw rolls the row back.
- * `opts.actor` defaults to 'cli'; the api layer passes the resolved actor so the audit log gets one row per write. */
+/** Write an entry to SQLite and refresh mirrors. `opts.actor` defaults to 'cli'; the api layer passes the resolved actor,
+ * so the audit log gets one row per write. */
 export function writeEntry(hippoRoot, entry, opts) {
+    writeEntryWithHook(hippoRoot, entry, opts);
+}
+/** writeEntry for store code that needs the write's own handle: `opts.afterWrite` shares the INSERT's SAVEPOINT. */
+export function writeEntryWithHook(hippoRoot, entry, opts) {
     onHandle(hippoRoot, (db) => {
         writeEntryOn(db, hippoRoot, entry, opts);
     }, openStore);
 }
 /** writeEntry for each of `entries` in one transaction, so all land or none; each
- * keeps its audit row, and mirrors follow the commit. Returns how many were written. */
+ * keeps its audit row, and mirrors follow the commit. Returns how many were written; an empty list opens no store. */
 export function writeEntriesTogether(hippoRoot, entries) {
+    if (entries.length === 0)
+        return 0;
     const stamped = entries.map((entry) => stampOriginProject(hippoRoot, entry));
     const db = openStore(hippoRoot);
     try {
@@ -39,15 +48,31 @@ export function writeEntriesTogether(hippoRoot, entries) {
     }
     return stamped.length;
 }
-/** writeEntry for each of `entries` on one open store, so the open and its lock wait are
- * paid once; each row commits alone, and none opens the store when the list is empty. */
-export function writeEntriesSeparately(hippoRoot, entries) {
-    if (entries.length === 0)
-        return;
+/** Runs `fill` in one transaction; each `put` writes one entry and returns false when the store rejects its value,
+ * leaving that row's refusal audit and the rest of the batch. Mirrors follow the commit. Returns how many were written. */
+export function writeEntriesSkippingRejected(hippoRoot, fill, actor = 'cli') {
+    const written = [];
     onHandle(hippoRoot, (db) => {
-        for (const entry of entries)
-            writeEntryOn(db, hippoRoot, entry);
+        withWriteScope(db, 'write_entries_skipping_rejected', () => {
+            fill((entry) => {
+                const stamped = stampOriginProject(hippoRoot, entry);
+                try {
+                    writeEntryDbOnly(db, stamped, { actor });
+                }
+                catch (error) {
+                    if (!(error instanceof RejectedValueError))
+                        throw error;
+                    auditRejectionRefusal(db, error, actor);
+                    return false;
+                }
+                written.push(stamped);
+                return true;
+            });
+        });
     }, openStore);
+    for (const entry of written)
+        writeEntryMirrors(hippoRoot, entry);
+    return written.length;
 }
 /** Adds `tag` to each of a tenant's rows that lacks it, in `ids` order, each read fresh
  * on one open store and committed alone; an id the tenant does not hold is skipped. */
@@ -97,11 +122,11 @@ export function auditEntryWrite(db, entry, actor) {
     audit(db, 'remember', { targetId: entry.id, metadata: {
             kind: entry.kind ?? 'distilled',
             scope: entry.scope ?? null,
-        }, actor, tenantId: entry.tenantId });
+        }, actor, tenantId: entry.tenant_id });
     // A child write marks its summary parent dirty for the sleep-cycle rebuild; most writes
     // have no parent, so the hot path pays one null check.
     if (entry.dag_parent_id) {
-        markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenantId, actor);
+        markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenant_id, actor);
     }
 }
 /** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
@@ -129,7 +154,7 @@ export function strengthenRetrieved(hippoRoot, ids, opts) {
         closeHippoDb(db);
     }
 }
-/** strengthenRetrieved on an open handle that holds no transaction, so a recall's last writes share one handle. */
+/** strengthenRetrieved on an open handle in its own write scope, a savepoint inside a caller's transaction, so a recall's last writes share one handle. */
 export function strengthenRetrievedInOwnTx(db, ids, opts) {
     if (ids.length === 0 || opts.recallBoostAblated)
         return new Set();
@@ -144,6 +169,8 @@ export function strengthenRetrievedInOwnTx(db, ids, opts) {
 function warnStrengthenFailed(error) {
     log.warn(`retrieval stats not saved (${errorMessage(error)})`);
 }
+/** Rows per recall-write statement: five bound values each, far under SQLite's parameter limit. */
+const RETRIEVAL_UPDATE_CHUNK = 100;
 /** strengthenRetrieved on the caller's handle, inside the caller's transaction. Throws; the caller decides. */
 export function strengthenRetrievedOn(db, ids, opts) {
     const found = new Set();
@@ -151,25 +178,30 @@ export function strengthenRetrievedOn(db, ids, opts) {
         return found;
     const byId = selectEntriesByIds(db, ids, opts.tenantId);
     const live = [...new Set(ids)].flatMap((id) => byId.get(id) ?? []);
-    const update = db.prepare('UPDATE memories SET retrieval_count = ?, last_retrieved = ?, half_life_days = ?, strength = ? WHERE id = ?');
-    for (const e of markRetrieved(live)) {
-        update.run(e.retrieval_count, e.last_retrieved, e.half_life_days, e.strength, e.id);
-        found.add(e.id);
+    const updated = markRetrieved(live, undefined, { ablation: strengthAblation() });
+    // One UPDATE ... FROM per chunk of rows instead of one statement per row.
+    for (const chunk of chunked(updated, RETRIEVAL_UPDATE_CHUNK)) {
+        const values = chunk.map(() => '(?, ?, ?, ?, ?)').join(', ');
+        db.prepare(`WITH v(id, rc, lr, hl, st) AS (VALUES ${values})
+       UPDATE memories SET retrieval_count = v.rc, last_retrieved = v.lr, half_life_days = v.hl, strength = v.st
+       FROM v WHERE memories.id = v.id`).run(...chunk.flatMap((e) => [e.id, e.retrieval_count, e.last_retrieved, e.half_life_days, e.strength]));
+        for (const e of chunk)
+            found.add(e.id);
     }
     return found;
 }
 /** Rewrites a live row's tags and its full-text row on the caller's transaction, with no audit row. */
 export function setEntryTagsInTx(db, entry) {
     db.prepare(`UPDATE memories SET tags_json = ?, updated_at = datetime('now') WHERE id = ? AND tenant_id = ?`)
-        .run(JSON.stringify(entry.tags), entry.id, entry.tenantId);
+        .run(JSON.stringify(entry.tags), entry.id, entry.tenant_id);
     syncFtsRow(db, entry);
 }
 /** Removes a row from `memories` and full-text search on the caller's transaction, as sleep's dormant move does, and marks its summary parent dirty. */
 export function deleteEntryRowInTx(db, entry, actor) {
-    db.prepare('DELETE FROM memories WHERE id = ? AND tenant_id = ?').run(entry.id, entry.tenantId);
+    db.prepare('DELETE FROM memories WHERE id = ? AND tenant_id = ?').run(entry.id, entry.tenant_id);
     deleteFtsRow(db, entry.id);
     if (entry.dag_parent_id)
-        markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenantId, actor);
+        markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenant_id, actor);
 }
 /** One half-life per memory id, on the caller's transaction. */
 export function setHalfLivesAt(db, rows) {

package/dist/store/failure-log-at.d.ts

@@ -0,0 +1,8 @@
+import { type FailureEvent, type FailureOutcome } from './failure-log.js';
+/** {@link recordFailure} on a handle of its own. */
+export declare function recordFailureAt(hippoRoot: string, event: FailureEvent): number;
+/** {@link requestOutcome} on a handle of its own. */
+export declare function requestOutcomeAt(hippoRoot: string, tenantId: string, requestId: string, sessionId: string): FailureOutcome | null;
+/** {@link settleFailureOutcome} on a handle of its own. */
+export declare function settleFailureOutcomeAt(hippoRoot: string, tenantId: string, requestId: string, outcome: FailureOutcome): void;
+//# sourceMappingURL=failure-log-at.d.ts.map

package/dist/store/failure-log-at.js

@@ -0,0 +1,16 @@
+// The failure log on a handle of its own, for code that has a folder and no connection.
+import { onHandle } from './open.js';
+import { recordFailure, requestOutcome, settleFailureOutcome } from './failure-log.js';
+/** {@link recordFailure} on a handle of its own. */
+export function recordFailureAt(hippoRoot, event) {
+    return onHandle(hippoRoot, (db) => recordFailure(db, event));
+}
+/** {@link requestOutcome} on a handle of its own. */
+export function requestOutcomeAt(hippoRoot, tenantId, requestId, sessionId) {
+    return onHandle(hippoRoot, (db) => requestOutcome(db, tenantId, requestId, sessionId));
+}
+/** {@link settleFailureOutcome} on a handle of its own. */
+export function settleFailureOutcomeAt(hippoRoot, tenantId, requestId, outcome) {
+    onHandle(hippoRoot, (db) => settleFailureOutcome(db, tenantId, requestId, outcome));
+}
+//# sourceMappingURL=failure-log-at.js.map

package/dist/store/failure-log.d.ts

@@ -28,8 +28,8 @@ export interface FailureEvent {
     /** Override the timestamp (tests). ISO string. */
     now?: string;
 }
-/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
-export declare function recordFailure(db: DatabaseSyncLike, event: FailureEvent): void;
+/** Prune rows past {@link FAILURE_LOG_RETENTION_DAYS}, then append one failure row; returns the new row's id. */
+export declare function recordFailure(db: DatabaseSyncLike, event: FailureEvent): number;
 /** The outcome logged for a caller's request id, or null, so a retried send finds the first one; another session's id is a ConflictError. */
 export declare function requestOutcome(db: DatabaseSyncLike, tenantId: string, requestId: string, sessionId: string): FailureOutcome | null;
 /** A retry that stored what the first try could not rewrites that row, since the request id allows one row per tenant. */

package/dist/store/failure-log.js

@@ -5,14 +5,16 @@ import { DAY_MS } from '../util/time.js';
 export const FAILURE_LOG_RETENTION_DAYS = 90;
 /** Longest session id or tool name kept; the hook payload is not trusted to be short. */
 const MAX_FIELD = 128;
-/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
+/** Prune rows past {@link FAILURE_LOG_RETENTION_DAYS}, then append one failure row; returns the new row's id. */
 export function recordFailure(db, event) {
     // Normalised, because the window and prune compare timestamps as strings.
     const now = new Date(event.now ?? Date.now()).toISOString();
-    db.prepare(`INSERT INTO failure_log (ts, tenant_id, session_id, tool, outcome, skip_rule, sig_hash, detail_hash, owner_subject, origin_project, request_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(now, event.tenantId, event.sessionId?.slice(0, MAX_FIELD) ?? null, event.tool?.slice(0, MAX_FIELD) ?? null, event.outcome, event.rule ?? null, event.sigHash ?? null, event.detailHash ?? null, event.ownerSubject ?? null, event.originProject ?? null, event.requestId ?? null);
+    // Prune first: nothing after the insert can throw, so a returned id always means a committed row.
     const cutoff = new Date(Date.parse(now) - FAILURE_LOG_RETENTION_DAYS * DAY_MS).toISOString();
     db.prepare(`DELETE FROM failure_log WHERE ts < ?`).run(cutoff);
+    const inserted = db.prepare(`INSERT INTO failure_log (ts, tenant_id, session_id, tool, outcome, skip_rule, sig_hash, detail_hash, owner_subject, origin_project, request_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(now, event.tenantId, event.sessionId?.slice(0, MAX_FIELD) ?? null, event.tool?.slice(0, MAX_FIELD) ?? null, event.outcome, event.rule ?? null, event.sigHash ?? null, event.detailHash ?? null, event.ownerSubject ?? null, event.originProject ?? null, event.requestId ?? null);
+    return Number(inserted.lastInsertRowid);
 }
 /** The outcome logged for a caller's request id, or null, so a retried send finds the first one; another session's id is a ConflictError. */
 export function requestOutcome(db, tenantId, requestId, sessionId) {

package/dist/{trust → store}/gated-write.d.ts

@@ -1,7 +1,9 @@
 import type { DatabaseSyncLike } from '../db/index.js';
 import type { MemoryEntry } from '../core/memory.js';
 export type GatedWriteResult = 'written' | 'skipped:not-worth-storing' | 'skipped:secret' | 'skipped:rejected';
-/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because a batch that rolls back stays `summarised` and replay writes the audit again. */
+/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the
+ * caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because
+ * a batch that rolls back stays `summarised` and replay writes the audit again. */
 export declare function gatedWrite(db: DatabaseSyncLike, hippoRoot: string, entry: MemoryEntry, opts?: {
     actor?: string;
     worthCheck?: boolean;

package/dist/{trust → store}/gated-write.js

@@ -1,11 +1,13 @@
 // The one write path for text no person typed into hippo: capture, compaction items and imported agent memories.
 import { isContentWorthStoring } from '../core/memory-quality.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { detectSecret } from '../util/secret-detect.js';
-import { auditRejectionRefusal } from '../store/audit-event.js';
-import { stampOriginProject } from '../store/entry-row.js';
-import { writeEntryDbOnly } from '../store/entry-writes.js';
-/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because a batch that rolls back stays `summarised` and replay writes the audit again. */
+import { auditRejectionRefusal } from './audit-event.js';
+import { stampOriginProject } from './entry-row.js';
+import { writeEntryDbOnly } from './entry-writes.js';
+/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the
+ * caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because
+ * a batch that rolls back stays `summarised` and replay writes the audit again. */
 export function gatedWrite(db, hippoRoot, entry, opts) {
     // Off for imported agent memories: a person wrote those notes, and a one-line preference fails the check.
     if (opts?.worthCheck !== false && !isContentWorthStoring(entry.content))

package/dist/store/goals.js

@@ -2,6 +2,7 @@
 import { randomUUID } from 'node:crypto';
 import { withWriteScope } from '../db/index.js';
 import { onHandle } from './open.js';
+import { placeholders } from '../util/sql.js';
 const MAX_ACTIVE_GOAL_DEPTH = 3;
 export function rowToGoal(row) {
     return {
@@ -146,26 +147,28 @@ function getActiveGoalsWithDb(db, opts) {
 // Per-goal retrieval_policy multipliers compose onto the base goal-tag boost and are hard-capped at MAX_FINAL_MULTIPLIER (3.0x) before scoring.
 function loadGoalPolicies(db, active) {
     const policiesByGoalId = new Map();
+    const policyIds = [...new Set(active.flatMap((g) => (g.retrievalPolicyId ? [g.retrievalPolicyId] : [])))];
+    if (policyIds.length === 0)
+        return policiesByGoalId;
+    // SAFETY: the SELECT projects exactly these seven retrieval_policy columns; MAX_ACTIVE_GOAL_DEPTH bounds the IN list.
+    const rows = db.prepare(`
+    SELECT id, goal_id, policy_type, weight_schema_fit, weight_recency, weight_outcome, error_priority
+    FROM retrieval_policy WHERE id IN (${placeholders(policyIds.length)})
+  `).all(...policyIds);
+    const byId = new Map(rows.map((row) => [row.id, row]));
     for (const g of active) {
-        if (!g.retrievalPolicyId)
+        const row = g.retrievalPolicyId ? byId.get(g.retrievalPolicyId) : undefined;
+        if (!row)
             continue;
-        // SAFETY: the row comes from the SELECT above, which projects exactly
-        // these seven retrieval_policy columns.
-        const row = db.prepare(`
-      SELECT id, goal_id, policy_type, weight_schema_fit, weight_recency, weight_outcome, error_priority
-      FROM retrieval_policy WHERE id = ?
-    `).get(g.retrievalPolicyId);
-        if (row) {
-            policiesByGoalId.set(g.id, {
-                id: row.id,
-                goalId: row.goal_id,
-                policyType: row.policy_type,
-                weightSchemaFit: row.weight_schema_fit,
-                weightRecency: row.weight_recency,
-                weightOutcome: row.weight_outcome,
-                errorPriority: row.error_priority,
-            });
-        }
+        policiesByGoalId.set(g.id, {
+            id: row.id,
+            goalId: row.goal_id,
+            policyType: row.policy_type,
+            weightSchemaFit: row.weight_schema_fit,
+            weightRecency: row.weight_recency,
+            weightOutcome: row.weight_outcome,
+            errorPriority: row.error_priority,
+        });
     }
     return policiesByGoalId;
 }
@@ -176,7 +179,7 @@ export function localGoalRecallRows(db, rows) {
         return [];
     const ids = [...new Set(rows.map((r) => r.memoryId))];
     // SAFETY: the SELECT projects exactly one column, `id`, from memories.
-    const local = db.prepare(`SELECT id FROM memories WHERE id IN (${ids.map(() => '?').join(',')})`).all(...ids);
+    const local = db.prepare(`SELECT id FROM memories WHERE id IN (${placeholders(ids.length)})`).all(...ids);
     const localIds = new Set(local.map((r) => r.id));
     return rows.filter((r) => localIds.has(r.memoryId));
 }