hippo-memory 1.72.0 → 2.0.0

package/dist/store/conflicts.d.ts

@@ -38,9 +38,15 @@ export interface ResolveConflictOpts {
      *  loser is kind='raw'). Defaults to a conflict-context string. */
     reason?: string;
 }
+export interface ResolveConflictRequest {
+    readonly conflictId: number;
+    readonly keepId: string;
+    readonly forgetLoser?: boolean;
+    readonly tenantId?: string;
+}
 /** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser, `opts.rejectLoserValue` also tombstones its
  * digest. Every path emits a `conflict_resolve` audit row. Returns the resolved conflict, or null if not found. */
-export declare function resolveConflict(hippoRoot: string, conflictId: number, keepId: string, forgetLoser?: boolean, tenantId?: string, opts?: ResolveConflictOpts): {
+export declare function resolveConflict(hippoRoot: string, { conflictId, keepId, forgetLoser, tenantId }: ResolveConflictRequest, opts?: ResolveConflictOpts): {
     conflict: MemoryConflict;
     loserId: string;
 } | null;

package/dist/store/conflicts.js

@@ -2,7 +2,7 @@ import { DEFAULT_TENANT_ID } from '../util/env.js';
 import { closeHippoDb, withWriteScope } from '../db/index.js';
 import { rejectionDigest, insertRejectedValue, normalizeValueForRejection } from './rejection.js';
 import { archiveRawMemory } from './raw-archive.js';
-import { rowToMemoryConflict } from './rows.js';
+import { parseJsonArray, rowToMemoryConflict } from './rows.js';
 import { audit } from './audit-event.js';
 import { syncChangedMirrors, purgeMirrorBestEffort } from './mirrors.js';
 import { selectEntriesByIds } from './entry-reads.js';
@@ -12,6 +12,7 @@ import { deleteEntryCore } from './delete-and-batch.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { canTouchScope, isPersonalScope } from '../core/recall-scope.js';
 import { selectMemoryReach } from './tenant-lookup.js';
+import { placeholders } from '../util/sql.js';
 // The one place MemoryConflictRow's columns are listed; CONFLICT_COLS_MC is the same list under the `mc` alias.
 const CONFLICT_COLS = 'id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at';
 const CONFLICT_COLS_MC = CONFLICT_COLS.split(', ').map((c) => `mc.${c}`).join(', ');
@@ -132,7 +133,7 @@ function readConflictRefresh(db, detected) {
     }
     const given = [...new Set(detected.flatMap((c) => [c.memory_a_id, c.memory_b_id]))].filter((id) => !tenantById.has(id));
     for (const ids of chunked(given)) {
-        const marks = ids.map(() => '?').join(',');
+        const marks = placeholders(ids.length);
         // SAFETY: rows' shape matches the two columns named in the SELECT.
         const found = db.prepare(`SELECT id, tenant_id FROM memories WHERE id IN (${marks})`).all(...ids);
         for (const r of found)
@@ -253,7 +254,7 @@ function findResolvableConflict(db, conflictId, keepId, tenantId) {
 }
 /** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser, `opts.rejectLoserValue` also tombstones its
  * digest. Every path emits a `conflict_resolve` audit row. Returns the resolved conflict, or null if not found. */
-export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = false, tenantId, opts) {
+export function resolveConflict(hippoRoot, { conflictId, keepId, forgetLoser = false, tenantId }, opts) {
     const db = openStore(hippoRoot);
     const scope = conflictMemScope(tenantId);
     try {
@@ -389,7 +390,7 @@ function stripConflictRefs(db, t, loserRemoved) {
     // SAFETY: keepRow's shape matches the single `conflicts_with_json` column selected above.
     const keepRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(keepId, ...memArgs);
     if (keepRow) {
-        const refs = JSON.parse(keepRow.conflicts_with_json || '[]');
+        const refs = parseJsonArray(keepRow.conflicts_with_json, { table: 'memories', id: keepId, column: 'conflicts_with_json' });
         const cleaned = refs.filter((r) => r !== loserId);
         db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
             .run(JSON.stringify(cleaned), keepId, ...memArgs);
@@ -399,7 +400,7 @@ function stripConflictRefs(db, t, loserRemoved) {
         // column named in the SELECT below.
         const loserRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(loserId, ...memArgs);
         if (loserRow) {
-            const refs = JSON.parse(loserRow.conflicts_with_json || '[]');
+            const refs = parseJsonArray(loserRow.conflicts_with_json, { table: 'memories', id: loserId, column: 'conflicts_with_json' });
             const cleaned = refs.filter((r) => r !== keepId);
             db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
                 .run(JSON.stringify(cleaned), loserId, ...memArgs);

package/dist/store/connectors/dlq.js

@@ -1,10 +1,11 @@
 // The dead-letter statements both connectors share; each connector names its table and columns and maps rows to its own item type.
+import { placeholders } from '../../util/sql.js';
 /** Inserts one row, stamping received_at; `columns` pairs each column name with its value, in insert order. */
 export function insertDlqRow(db, table, columns) {
     const names = [...columns.map(([name]) => name), 'received_at'];
     const values = [...columns.map(([, value]) => value), new Date().toISOString()];
     const result = db
-        .prepare(`INSERT INTO ${table} (${names.join(', ')}) VALUES (${names.map(() => '?').join(', ')})`)
+        .prepare(`INSERT INTO ${table} (${names.join(', ')}) VALUES (${placeholders(names.length)})`)
         .run(...values);
     return Number(result.lastInsertRowid);
 }

package/dist/store/connectors/event-log.d.ts

@@ -0,0 +1,13 @@
+import type { DatabaseSyncLike } from '../../db/index.js';
+import type { ConnectorEventRecord } from '../port.js';
+/** Which log table a connector writes and the column its dedupe key lives in. */
+export interface EventLogSpec {
+    readonly table: 'slack_event_log' | 'github_event_log';
+    readonly keyColumn: 'event_id' | 'idempotency_key';
+}
+export declare function eventSeenAt(db: DatabaseSyncLike, log: EventLogSpec, key: string): boolean;
+export declare function eventMemoryAt(db: DatabaseSyncLike, log: EventLogSpec, key: string): string | null;
+/** Records the key unless a row holds it already; false means another writer got there first. `extra` pairs connector-only columns with values. */
+export declare function markEventSeenAt(db: DatabaseSyncLike, log: EventLogSpec, key: string, extra: ReadonlyArray<readonly [string, string]>, memoryId: string | null): boolean;
+export declare function eventRecord(hippoRoot: string, log: EventLogSpec, key: string): ConnectorEventRecord;
+//# sourceMappingURL=event-log.d.ts.map

package/dist/store/connectors/event-log.js

@@ -0,0 +1,24 @@
+// The event-log statements both connectors share; each connector names its table, key column and extra columns.
+import { placeholders } from '../../util/sql.js';
+import { onHandle } from '../open.js';
+export function eventSeenAt(db, log, key) {
+    return !!db.prepare(`SELECT 1 FROM ${log.table} WHERE ${log.keyColumn} = ?`).get(key);
+}
+export function eventMemoryAt(db, log, key) {
+    // SAFETY: the SELECT projects only `memory_id`, a nullable column; .get() returns undefined when no row matches.
+    const row = db.prepare(`SELECT memory_id FROM ${log.table} WHERE ${log.keyColumn} = ?`).get(key);
+    return row?.memory_id ?? null;
+}
+/** Records the key unless a row holds it already; false means another writer got there first. `extra` pairs connector-only columns with values. */
+export function markEventSeenAt(db, log, key, extra, memoryId) {
+    const names = [log.keyColumn, ...extra.map(([name]) => name), 'ingested_at', 'memory_id'];
+    const values = [key, ...extra.map(([, value]) => value), new Date().toISOString(), memoryId];
+    const inserted = db
+        .prepare(`INSERT OR IGNORE INTO ${log.table} (${names.join(', ')}) VALUES (${placeholders(names.length)})`)
+        .run(...values);
+    return Number(inserted.changes ?? 0) !== 0;
+}
+export function eventRecord(hippoRoot, log, key) {
+    return onHandle(hippoRoot, (db) => eventSeenAt(db, log, key) ? { seen: true, memoryId: eventMemoryAt(db, log, key) } : { seen: false });
+}
+//# sourceMappingURL=event-log.js.map

package/dist/store/connectors/github.js

@@ -2,23 +2,21 @@
 import { withWriteScope } from '../../db/index.js';
 import { archiveRawMemory } from '../raw-archive.js';
 import { onHandle } from '../open.js';
+import { eventMemoryAt, eventRecord, eventSeenAt, markEventSeenAt } from './event-log.js';
 import { getDlqRow, insertDlqRow, listDlqRows, markDlqRetried } from './dlq.js';
+const GITHUB_LOG = { table: 'github_event_log', keyColumn: 'idempotency_key' };
 export function githubEventSeenAt(db, idempotencyKey) {
-    const row = db.prepare(`SELECT 1 FROM github_event_log WHERE idempotency_key = ?`).get(idempotencyKey);
-    return !!row;
+    return eventSeenAt(db, GITHUB_LOG, idempotencyKey);
 }
 export function githubEventMemoryAt(db, idempotencyKey) {
-    // SAFETY: the SELECT projects exactly the memory_id column of github_event_log.
-    const row = db.prepare(`SELECT memory_id FROM github_event_log WHERE idempotency_key = ?`).get(idempotencyKey);
-    return row?.memory_id ?? null;
+    return eventMemoryAt(db, GITHUB_LOG, idempotencyKey);
 }
 /** False when the key was already logged, so a caller inside a write scope can roll its own row back. */
 export function markGitHubEventSeenAt(db, entry) {
-    const inserted = db.prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`).run(entry.idempotencyKey, entry.deliveryId, entry.eventName, new Date().toISOString(), entry.memoryId);
-    return Number(inserted.changes ?? 0) !== 0;
+    return markEventSeenAt(db, GITHUB_LOG, entry.idempotencyKey, [['delivery_id', entry.deliveryId], ['event_name', entry.eventName]], entry.memoryId);
 }
 export function githubEventRecord(hippoRoot, idempotencyKey) {
-    return onHandle(hippoRoot, (db) => githubEventSeenAt(db, idempotencyKey) ? { seen: true, memoryId: githubEventMemoryAt(db, idempotencyKey) } : { seen: false });
+    return eventRecord(hippoRoot, GITHUB_LOG, idempotencyKey);
 }
 export function markGitHubEventSeen(hippoRoot, entry) {
     onHandle(hippoRoot, (db) => { markGitHubEventSeenAt(db, entry); });

package/dist/store/connectors/slack.js

@@ -1,6 +1,7 @@
 // Every statement the Slack connector runs on hippo.db: backfill cursors, the event log, the dead-letter queue and workspace routing.
 // `xAt(db, ...)` runs on the caller's handle; the same name without `At` opens hippo.db for that one call.
 import { onHandle } from '../open.js';
+import { eventMemoryAt, eventRecord, eventSeenAt, markEventSeenAt } from './event-log.js';
 import { getDlqRow, insertDlqRow, listDlqRows, markDlqRetried } from './dlq.js';
 // Backfill cursors
 export function slackCursorAt(db, tenantId, channelId) {
@@ -21,24 +22,19 @@ export function saveSlackCursor(hippoRoot, tenantId, channelId, latestTs) {
     onHandle(hippoRoot, (db) => saveSlackCursorAt(db, tenantId, channelId, latestTs));
 }
 // Event log
+const SLACK_LOG = { table: 'slack_event_log', keyColumn: 'event_id' };
 export function slackEventSeenAt(db, eventId) {
-    const row = db.prepare(`SELECT 1 FROM slack_event_log WHERE event_id = ?`).get(eventId);
-    return !!row;
+    return eventSeenAt(db, SLACK_LOG, eventId);
 }
 /** Records the event unless a row already holds its id; false means another writer got there first. */
 export function markSlackEventSeenAt(db, eventId, memoryId) {
-    const inserted = db
-        .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)
-        .run(eventId, new Date().toISOString(), memoryId);
-    return Number(inserted.changes ?? 0) !== 0;
+    return markEventSeenAt(db, SLACK_LOG, eventId, [], memoryId);
 }
 export function slackEventMemoryAt(db, eventId) {
-    // SAFETY: the SELECT names only `memory_id`, a nullable column; .get() returns undefined when no row matches.
-    const row = db.prepare(`SELECT memory_id FROM slack_event_log WHERE event_id = ?`).get(eventId);
-    return row?.memory_id ?? null;
+    return eventMemoryAt(db, SLACK_LOG, eventId);
 }
 export function slackEventRecord(hippoRoot, eventId) {
-    return onHandle(hippoRoot, (db) => slackEventSeenAt(db, eventId) ? { seen: true, memoryId: slackEventMemoryAt(db, eventId) } : { seen: false });
+    return eventRecord(hippoRoot, SLACK_LOG, eventId);
 }
 export function markSlackEventSeen(hippoRoot, eventId, memoryId) {
     onHandle(hippoRoot, (db) => markSlackEventSeenAt(db, eventId, memoryId));

package/dist/store/dashboard-reads.js

@@ -8,6 +8,7 @@ import { storedVectorIds } from '../db/vector-store.js';
 import { onHandle, openStore } from './open.js';
 import { QUARANTINE_SCOPE_PREFIX } from './quarantine.js';
 import { parseJsonArray } from './rows.js';
+// Full content stays: dashboard-snapshot's Fact.lower serves search over the whole text, so a preview would change which rows match.
 const LIVE_COLUMNS = 'id, created, last_retrieved, retrieval_count, half_life_days, layer, tags_json, emotional_valence, outcome_positive, ' +
     'outcome_negative, pinned, confidence, content, superseded_by, kind, scope, origin_project';
 // SQL twins of isQuarantineScope and of the two halves of isLiveMemory; substr compares bytes, as startsWith does, where LIKE would fold case.

package/dist/store/delete-and-batch.js

@@ -14,6 +14,7 @@ import { purgeMirrorBestEffort, mirrorBestEffort, writeMarkdownMirror } from './
 import { onHandle, openStore } from './open.js';
 import { clock } from '../util/write-budget.js';
 import { chunked } from '../util/chunked.js';
+import { placeholders } from '../util/sql.js';
 /** Tables whose rows keep a first-class object's backing memory in `memory_id` (ON DELETE SET NULL); tests/dormant-memories.test.ts pins it to the schema. */
 export const MEMORY_BACKED_TABLES = ['predictions', 'decisions', 'incidents', 'processes', 'policies', 'skills', 'project_briefs', 'customer_notes'];
 /** Deleting a memory that backs an object nulls the object's link, and no restore can repair it, so no automatic pass may. */
@@ -118,7 +119,7 @@ function selectDeleteTargets(db, ids) {
     const rows = new Map();
     for (const chunk of chunked([...new Set(ids)])) {
         // SAFETY: rows' shape matches the three columns named in the SELECT.
-        const found = db.prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id IN (${chunk.map(() => '?').join(',')})`)
+        const found = db.prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id IN (${placeholders(chunk.length)})`)
             .all(...chunk);
         for (const row of found)
             rows.set(row.id, row);
@@ -248,7 +249,7 @@ function moveDormantAndDelete(db, dormantMoves, deletableIds, out) {
 /** The still auto-deletable rows among `ids`, recording each one's DAG parent as dirty. Placeholders come from `ids` itself. */
 function selectAutoDeletableRows(db, ids, dirty) {
     // SAFETY: rows' shape matches the three columns named in the SELECT.
-    const rows = db.prepare(`SELECT id, dag_parent_id, tenant_id FROM memories WHERE id IN (${ids.map(() => '?').join(',')}) AND ${AUTOMATIC_DELETE_SQL}`).all(...ids);
+    const rows = db.prepare(`SELECT id, dag_parent_id, tenant_id FROM memories WHERE id IN (${placeholders(ids.length)}) AND ${AUTOMATIC_DELETE_SQL}`).all(...ids);
     for (const row of rows) {
         if (row.dag_parent_id) {
             dirty.parents.add(row.dag_parent_id);
@@ -287,13 +288,13 @@ function applyBatchWrites(db, stampedWrites, snapshot, out) {
         // Hook for writes: a new child, or a change to what its summary reads, marks the parent dirty; decay alone does not.
         if (row.dag_parent_id && (!live || SUMMARY_INPUTS.some((k) => row[k] !== live[k]))) {
             dirty.parents.add(row.dag_parent_id);
-            dirty.tenantById.set(row.dag_parent_id, row.tenantId);
+            dirty.tenantById.set(row.dag_parent_id, row.tenant_id);
         }
     }
 }
 /** True, after auditing the refusal, when the write would introduce a rejected value. */
 function isRejectedBatchWrite(db, row) {
-    const entryTenantId = row.tenantId ?? DEFAULT_TENANT_ID;
+    const entryTenantId = row.tenant_id ?? DEFAULT_TENANT_ID;
     // checkRejectionGuard, not a bare tombstone probe: a tombstone can coexist with a live same-content row,
     // and skipping every re-persist would starve it of decay/replay updates; only new or changed content is refused.
     try {

package/dist/store/delivery-recorder.d.ts

@@ -138,10 +138,10 @@ export interface DeliveryRecorderInit {
     runtime?: DeliveryRuntime;
     /** Set by hooks that are not prompt or context calls; without it the payload's hook event decides. */
     eventType?: DeliveryEventType;
+    /** Makes this recorder throw at one stage; only tests set it, and no CLI flag or environment variable reaches it. */
+    fault?: DeliveryFault;
 }
 export type DeliveryFault = 'observe' | 'build' | 'flush';
-/** Makes every recorder created afterwards throw at one stage. Only tests call it; the shipped CLI and server have no route here. */
-export declare function _setDeliveryFaultForTests(fault: DeliveryFault | null): void;
 /** A recorder for one call; every observer method is guarded, and a throw marks it broken instead of escaping. */
 export declare function createDeliveryRecorder(init: DeliveryRecorderInit): DeliveryRecorder;
 //# sourceMappingURL=delivery-recorder.d.ts.map

package/dist/store/delivery-recorder.js

@@ -198,16 +198,11 @@ function candidateMethods(state, guard) {
         }),
     };
 }
-let injectedFault = null;
-/** Makes every recorder created afterwards throw at one stage. Only tests call it; the shipped CLI and server have no route here. */
-export function _setDeliveryFaultForTests(fault) {
-    injectedFault = fault;
-}
 /** A recorder for one call; every observer method is guarded, and a throw marks it broken instead of escaping. */
 export function createDeliveryRecorder(init) {
     const startedMs = Date.now();
     const ts = evalNow().toISOString();
-    const fault = injectedFault;
+    const fault = init.fault ?? null;
     const payload = readPayload(init);
     const state = {
         candidates: new Map(), picked: new Map(), filtered: new Set(), facts: null, shown: 0, dropped: 0,

package/dist/store/descendant-page.js

@@ -1,7 +1,8 @@
 import { selectEntriesByIds, TENANT_IS } from './entry-reads.js';
 import { chunked } from '../util/chunked.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
-const marks = (ids) => ids.map(() => '?').join(',');
+import { placeholders } from '../util/sql.js';
+const marks = (ids) => placeholders(ids.length);
 /** The walk `summaryWithDescendants` documents, with `levels` cut to the first `page.rows` rows and each level's full count in `sizes`. */
 export function pagedDescendants(db, walk, summaryAdmitted) {
     const sizes = [];

package/dist/store/dormant.js

@@ -24,15 +24,19 @@ export function insertDormantRow(db, move) {
       reason = excluded.reason,
       strength = excluded.strength,
       dormant_at = excluded.dormant_at
-  `).run(move.entry.tenantId, move.entry.id, move.entry.content, JSON.stringify(move.entry), move.reason, move.strength, move.dormantAt);
+  `).run(move.entry.tenant_id, move.entry.id, move.entry.content, JSON.stringify(move.entry), move.reason, move.strength, move.dormantAt);
+}
+function toCurrentEntry({ tenantId, summary_dirty, tenant_id, ...rest }) {
+    return { ...rest, tenant_id: tenant_id ?? tenantId ?? '', summary_dirty: summary_dirty === true || summary_dirty === 1 };
 }
 /** Parse a stored snapshot back into a MemoryEntry, or null when the row no longer matches it (edited by hand, or truncated). */
 function parseSnapshot(row) {
     try {
         // SAFETY: entry_json is only written by insertDormantRow from a MemoryEntry;
         // the id / tenant / content checks below reject a row edited out of shape.
-        const entry = JSON.parse(row.entry_json);
-        if (entry.id !== row.id || entry.tenantId !== row.tenant_id || entry.content !== row.content) {
+        // SAFETY: entry_json came from JSON.stringify of a MemoryEntry (2.0) or a 1.x one; the checks below reject a row edited out of shape.
+        const entry = toCurrentEntry(JSON.parse(row.entry_json));
+        if (entry.id !== row.id || entry.tenant_id !== row.tenant_id || entry.content !== row.content) {
             warnDamagedColumn({ table: 'dormant_memories', id: row.id, column: 'entry_json' }, 'wrong shape');
             return null;
         }

package/dist/store/entry-reads.d.ts

@@ -31,12 +31,12 @@ export declare function countAllEntries(hippoRoot: string): number;
 export declare function loadEntriesMentioning(hippoRoot: string, tokens: readonly string[], tag: string, tenantId?: string): MemoryEntry[];
 export interface EntryTextKey {
     id: string;
-    tenantId: string;
+    tenant_id: string;
     content: string;
     source: string;
 }
-/** Every tenant's rows in loadAllEntries' order, with only the columns that say whether another store already holds each. */
-export declare function loadEntryTextKeys(hippoRoot: string): EntryTextKey[];
+/** The rows in loadAllEntries' order (every tenant unless one is named), with only the columns that say whether another store already holds each. */
+export declare function loadEntryTextKeys(hippoRoot: string, tenantId?: string): EntryTextKey[];
 export interface EntriesWithBase {
     entries: MemoryEntry[];
     base: {
@@ -45,8 +45,30 @@ export interface EntriesWithBase {
 }
 /** Every entry plus a by-id lookup of each as loaded, rebuilt from its row on first use, so no deep copy of the store is kept. */
 export declare function loadAllEntriesWithBase(hippoRoot: string): EntriesWithBase;
+/** Where a page stopped: the `created`, `id` of its last row, in loadAllEntries' order. */
+export interface EntryCursor {
+    created: string;
+    id: string;
+}
+export interface EntryPage {
+    entries: MemoryEntry[];
+    /** The cursor that reads the page after this one, or null when this was the last. */
+    next: EntryCursor | null;
+}
+/** Up to `limit` rows in loadAllEntries' order, starting after `after`; omitting `tenantId` reads every tenant. */
+export declare function loadEntriesPage(hippoRoot: string, tenantId: string | undefined, page: {
+    limit: number;
+    after?: EntryCursor;
+}): EntryPage;
 /** Every memory row on an open connection, so a caller can read inside its own transaction. */
 export declare function selectAllEntries(db: DatabaseSyncLike, tenantId?: string): MemoryEntry[];
+/** The columns a text match needs, for every row of a tenant in loadAllEntries' order: callers read whole rows only for the ids that match. */
+export declare function selectTenantTexts(db: DatabaseSyncLike, tenantId: string): Array<{
+    id: string;
+    content: string;
+    source: string;
+    scope: string | null;
+}>;
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export declare function selectLiveEntriesBySourcePrefix(db: DatabaseSyncLike, tenantId: string, prefix: string): MemoryEntry[];
 export declare function loadContentsWithTag(hippoRoot: string, tenantId: string, tag: string, origins?: readonly string[]): string[];

package/dist/store/entry-reads.js

@@ -6,6 +6,7 @@ import { originInSql } from '../core/project-identity.js';
 import { scopeAdmitSql } from './rule-sql.js';
 import { chunked } from '../util/chunked.js';
 import { DEFAULT_TENANT_ID } from '../util/env.js';
+import { placeholders } from '../util/sql.js';
 const MAX_IDS_PER_READ = 500;
 // The plus keeps SQLite on the primary key for an id list: with a bare tenant_id it walks every row of the tenant instead.
 export const TENANT_IS = '+tenant_id = ?';
@@ -29,7 +30,7 @@ export function heldIdLookup(hippoRoot, tenantId, ids) {
                 for (const id of chunk)
                     held.set(id, false);
                 // SAFETY: rows' shape matches the single `id` column selected.
-                const rows = db.prepare(`SELECT id FROM memories WHERE id IN (${chunk.map(() => '?').join(',')}) AND ${TENANT_IS}`).all(...chunk, tenantId);
+                const rows = db.prepare(`SELECT id FROM memories WHERE id IN (${placeholders(chunk.length)}) AND ${TENANT_IS}`).all(...chunk, tenantId);
                 for (const row of rows)
                     held.set(row.id, true);
             }
@@ -49,9 +50,9 @@ export function selectEntriesByIds(db, ids, tenantId) {
     const tenantClause = tenantId !== undefined ? ` AND ${TENANT_IS}` : '';
     const tenantArgs = tenantId !== undefined ? [tenantId] : [];
     for (const chunk of chunked([...new Set(ids)])) {
-        const placeholders = chunk.map(() => '?').join(',');
+        const marks = placeholders(chunk.length);
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders})${tenantClause}`).all(...chunk, ...tenantArgs);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${marks})${tenantClause}`).all(...chunk, ...tenantArgs);
         for (const row of rows)
             byId.set(row.id, rowToEntry(row));
     }
@@ -63,9 +64,9 @@ export function selectChildrenByParent(db, parentIds, tenantId) {
     const tenantClause = tenantId !== undefined ? ` AND ${TENANT_IS}` : '';
     const tenantArgs = tenantId !== undefined ? [tenantId] : [];
     for (const chunk of chunked([...new Set(parentIds)])) {
-        const placeholders = chunk.map(() => '?').join(',');
+        const marks = placeholders(chunk.length);
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${placeholders})${tenantClause} ORDER BY created ASC, id ASC`).all(...chunk, ...tenantArgs);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks})${tenantClause} ORDER BY created ASC, id ASC`).all(...chunk, ...tenantArgs);
         for (const row of rows) {
             const entry = rowToEntry(row);
             const parentId = entry.dag_parent_id ?? '';
@@ -84,12 +85,12 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
         return [];
     const capped = ids.slice(0, MAX_IDS_PER_READ);
     return onHandle(hippoRoot, (db) => {
-        const placeholders = capped.map(() => '?').join(',');
+        const marks = placeholders(capped.length);
         // Without ORDER BY, rows follow SQLite's IN(...) scan order, undefined w.r.t. `ids`.
         // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
         const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) AND ${TENANT_IS} ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) ORDER BY created ASC, content ASC, id ASC`).all(...capped);
+            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${marks}) AND ${TENANT_IS} ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
+            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${marks}) ORDER BY created ASC, content ASC, id ASC`).all(...capped);
         return rows.map(rowToEntry);
     }, openStore);
 }
@@ -228,12 +229,14 @@ export function loadEntriesMentioning(hippoRoot, tokens, tag, tenantId) {
         return rows.map(rowToEntry);
     }, openStore);
 }
-/** Every tenant's rows in loadAllEntries' order, with only the columns that say whether another store already holds each. */
-export function loadEntryTextKeys(hippoRoot) {
+/** The rows in loadAllEntries' order (every tenant unless one is named), with only the columns that say whether another store already holds each. */
+export function loadEntryTextKeys(hippoRoot, tenantId) {
     return onHandle(hippoRoot, (db) => {
+        const where = tenantId !== undefined ? 'WHERE tenant_id = ? ' : '';
         // SAFETY: rows' shape matches the four columns named in the SELECT.
-        const rows = db.prepare('SELECT id, tenant_id, content, source FROM memories ORDER BY created ASC, id ASC').all();
-        return rows.map((row) => ({ id: row.id, tenantId: row.tenant_id ?? DEFAULT_TENANT_ID, content: row.content, source: row.source }));
+        const rows = db.prepare(`SELECT id, tenant_id, content, source FROM memories ${where}ORDER BY created ASC, id ASC`)
+            .all(...(tenantId !== undefined ? [tenantId] : []));
+        return rows.map((row) => ({ id: row.id, tenant_id: row.tenant_id ?? DEFAULT_TENANT_ID, content: row.content, source: row.source }));
     }, openStore);
 }
 /** Every entry plus a by-id lookup of each as loaded, rebuilt from its row on first use, so no deep copy of the store is kept. */
@@ -264,10 +267,38 @@ function selectAllRows(db, tenantId) {
         ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE tenant_id = ? ORDER BY created ASC, id ASC`).all(tenantId)
         : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ORDER BY created ASC, id ASC`).all();
 }
+/** Up to `limit` rows in loadAllEntries' order, starting after `after`; omitting `tenantId` reads every tenant. */
+export function loadEntriesPage(hippoRoot, tenantId, page) {
+    const where = [];
+    const params = [];
+    if (tenantId !== undefined) {
+        where.push('tenant_id = ?');
+        params.push(tenantId);
+    }
+    if (page.after) {
+        where.push('(created > ? OR (created = ? AND id > ?))');
+        params.push(page.after.created, page.after.created, page.after.id);
+    }
+    const clause = where.length > 0 ? `WHERE ${where.join(' AND ')} ` : '';
+    // One extra row says whether another page follows without a count.
+    params.push(page.limit + 1);
+    return onHandle(hippoRoot, (db) => {
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ${clause}ORDER BY created ASC, id ASC LIMIT ?`).all(...params);
+        const entries = rows.slice(0, page.limit).map(rowToEntry);
+        const last = entries[entries.length - 1];
+        return { entries, next: rows.length > page.limit && last ? { created: last.created, id: last.id } : null };
+    }, openStore);
+}
 /** Every memory row on an open connection, so a caller can read inside its own transaction. */
 export function selectAllEntries(db, tenantId) {
     return selectAllRows(db, tenantId).map(rowToEntry);
 }
+/** The columns a text match needs, for every row of a tenant in loadAllEntries' order: callers read whole rows only for the ids that match. */
+export function selectTenantTexts(db, tenantId) {
+    // SAFETY: rows' shape matches the four columns named in the SELECT.
+    return db.prepare('SELECT id, content, source, scope FROM memories WHERE tenant_id = ? ORDER BY created ASC, id ASC').all(tenantId);
+}
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export function selectLiveEntriesBySourcePrefix(db, tenantId, prefix) {
     // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.

package/dist/store/entry-row.js

@@ -3,8 +3,15 @@ import { closeHippoDb, ftsRowCounts, openHippoDb, isFtsAvailable, repairFtsDrift
 import { fallbackOrigin, originFromSource } from '../core/project-identity.js';
 import { checkRejectionGuard } from './rejection.js';
 import { errorMessage, log } from '../util/log.js';
+/** A 1.x JS caller's `tenantId` would otherwise fall through to the default tenant without a sound. */
+function rejectLegacyTenantKey(entry) {
+    if (Object.hasOwn(entry, 'tenantId') && entry.tenant_id === undefined) {
+        throw new TypeError('tenantId was renamed to tenant_id in 2.0');
+    }
+}
 export function upsertEntryRow(db, entry) {
-    checkRejectionGuard(db, entry.tenantId ?? DEFAULT_TENANT_ID, entry.id, entry.content);
+    rejectLegacyTenantKey(entry);
+    checkRejectionGuard(db, entry.tenant_id ?? DEFAULT_TENANT_ID, entry.id, entry.content);
     syncFtsRow(db, entry, upsertMemoryRow(db, entry));
 }
 /** The row alone, with no rejection guard or full-text row, for `upsertEntryRow` and for
@@ -104,7 +111,7 @@ function memoryRowValues(entry) {
         entry.scope ?? null,
         entry.owner ?? null,
         entry.artifact_ref ?? null,
-        entry.tenantId ?? DEFAULT_TENANT_ID,
+        entry.tenant_id ?? DEFAULT_TENANT_ID,
         entry.origin_project ?? null,
         entry.descendant_count ?? 0,
         entry.earliest_at ?? null,

package/dist/store/entry-writes.d.ts

@@ -2,13 +2,19 @@ import { type MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
 export interface WriteEntryOptions {
     actor?: string;
-    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
     /** Runs after the row commits and before the mirrors, on an idle connection; keep it best-effort. */
     afterCommit?: () => void;
 }
-/** Write an entry to SQLite and refresh mirrors; `opts.afterWrite` runs in the same SAVEPOINT as the INSERT, so a throw rolls the row back.
- * `opts.actor` defaults to 'cli'; the api layer passes the resolved actor so the audit log gets one row per write. */
+/** Store-side only, never exported from a package entry: `afterWrite` hands the write's own db handle to the hook. */
+export interface WriteEntryInternalOptions extends WriteEntryOptions {
+    /** Runs in the same SAVEPOINT as the INSERT, so a throw rolls the row back. */
+    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+}
+/** Write an entry to SQLite and refresh mirrors. `opts.actor` defaults to 'cli'; the api layer passes the resolved actor,
+ * so the audit log gets one row per write. */
 export declare function writeEntry(hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryOptions): void;
+/** writeEntry for store code that needs the write's own handle: `opts.afterWrite` shares the INSERT's SAVEPOINT. */
+export declare function writeEntryWithHook(hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryInternalOptions): void;
 /** writeEntry for each of `entries` in one transaction, so all land or none; each
  * keeps its audit row, and mirrors follow the commit. Returns how many were written; an empty list opens no store. */
 export declare function writeEntriesTogether(hippoRoot: string, entries: readonly MemoryEntry[]): number;
@@ -20,10 +26,7 @@ export declare function writeEntriesSkippingRejected(hippoRoot: string, fill: (p
 export declare function addTagToEntries(hippoRoot: string, tenantId: string, ids: readonly string[], tag: string): void;
 /** DB-only write path: upsert, afterWrite hook and audit row inside one withWriteScope; the caller owns `db` and must call `writeEntryMirrors` after any
  * outer tx commits, so a rolled-back tx never leaves orphan markdown. The audit row commits atomically with the INSERT. */
-export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntry, opts?: {
-    actor?: string;
-    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
-}): void;
+export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntry, opts?: Pick<WriteEntryInternalOptions, 'actor' | 'afterWrite'>): void;
 /** What follows a row's upsert inside its write scope: the remember row, last of the write's audit rows, then the summary parent's dirty mark. */
 export declare function auditEntryWrite(db: DatabaseSyncLike, entry: MemoryEntry, actor: string): void;
 /** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */