hippo-memory 1.72.0 → 2.1.0

package/dist/store/port.js

@@ -6,7 +6,8 @@ export function isObjectRefusal(written) {
 export function hasGroup(store, group) {
     return group === 'base' || store[group] !== undefined;
 }
-/** The group's methods; a store without them throws StoreNotPortedError, which answers 501 as any unported path does. */
+/** The group's methods; a store without them throws
+ * StoreNotPortedError, which answers 501 as any unported path does. */
 export function requireGroup(store, group) {
     const groups = store;
     const methods = groups[group];
@@ -14,12 +15,5 @@ export function requireGroup(store, group) {
         throw new StoreNotPortedError(store.kind, group);
     return methods;
 }
-export const STORE_BUSY_MESSAGE = 'store busy (another hippo process holds the write lock); retry shortly';
-/** A store behind the port throws this when its lock wait runs out, so the server answers 503 as it does for a busy hippo.db. */
-export class StoreBusyError extends Error {
-    constructor(message = STORE_BUSY_MESSAGE, options) {
-        super(message, options);
-        this.name = 'StoreBusyError';
-    }
-}
+export { isStoreBusy, STORE_BUSY_MESSAGE, StoreBusyError } from './busy.js';
 //# sourceMappingURL=port.js.map

package/dist/store/predictions.d.ts

@@ -1,6 +1,7 @@
-/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth; the memory row only mirrors the claim.
- * Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers enforce the prediction's tenant matches the referenced memory's.
- * `savePrediction` writes memory and prediction inside `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
+/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth;
+ * the memory row only mirrors the claim. Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers
+ * enforce the prediction's tenant matches the referenced memory's. `savePrediction` writes memory and prediction inside
+ * `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
 import { type MemoryEntry } from '../core/memory.js';
 import { type KeysetPosition } from '../util/keyset.js';
 import type { PredictionSave } from './port.js';
@@ -40,16 +41,17 @@ export interface ListPredictionsOpts {
     /** Resume after this row: the position the previous page ended on. */
     after?: KeysetPosition;
 }
-/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure rolls back both.
- * The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the predictions table feeds the planning-fallacy detector. */
+/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure
+ * rolls back both. The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the
+ * predictions table feeds the planning-fallacy detector. */
 export declare function savePrediction(hippoRoot: string, tenantId: string, opts: SavePredictionOpts, actor?: string): Prediction;
 /** The memory row that mirrors a claim into recall, built here alone so every store keeps the same row for it. */
 export declare function predictionMirror(tenantId: string, claim: SavePredictionOpts, baseHalfLifeDays: number): MemoryEntry;
 /** The store port's save on hippo.db: the mirror goes in as the port's writeEntry has it, tenant
  * check included, and its predictions row shares that write scope, so neither lands alone. */
 export declare function writePrediction(hippoRoot: string, tenantId: string, save: PredictionSave, actor: string): Prediction;
-/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table is the source of truth).
- * Accuracy is computed from (estimateValue, actualValue) at query time. */
+/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table
+ * is the source of truth). Accuracy is computed from (estimateValue, actualValue) at query time. */
 export declare function closePrediction(hippoRoot: string, tenantId: string, id: number, opts: ClosePredictionOpts, actor?: string): Prediction;
 export declare function loadPredictionById(hippoRoot: string, tenantId: string, id: number): Prediction | null;
 export declare function loadPredictionsByClass(hippoRoot: string, tenantId: string, classTag: string, opts?: ListPredictionsOpts): Prediction[];
@@ -84,13 +86,15 @@ export interface BaserateRow {
     estimate_value: number;
     actual_value: number;
 }
-/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed' with estimate and actual non-null;
- * closed-unknown and open are excluded. Audit-emit is built in here, not at the 3 call sites, so callers cannot drift. */
+/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed'
+ * with estimate and actual non-null; closed-unknown and open are excluded. Audit-emit is built in here, not at the 3
+ * call sites, so callers cannot drift. */
 export declare function computePredictionBaserate(hippoRoot: string, tenantId: string, classTag: string, actor?: string, 
 /** False skips the predict_baserate audit so that channel only records deliberate
  *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
 emitAudit?: boolean): PredictionBaserate;
-/** A class's stats over its closed rows, summed in the order given. Every store computes them here, so no two can disagree on the arithmetic. */
+/** A class's stats over its closed rows, summed in the order given. Every store computes them here, so no two can
+ * disagree on the arithmetic. */
 export declare function predictionBaserateOf(classTag: string, rows: readonly BaserateRow[]): PredictionBaserate;
 export declare function loadOpenPredictions(hippoRoot: string, tenantId: string, opts?: {
     classTag?: string;

package/dist/store/predictions.js

@@ -1,6 +1,7 @@
-/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth; the memory row only mirrors the claim.
- * Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers enforce the prediction's tenant matches the referenced memory's.
- * `savePrediction` writes memory and prediction inside `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
+/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth;
+ * the memory row only mirrors the claim. Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers
+ * enforce the prediction's tenant matches the referenced memory's. `savePrediction` writes memory and prediction inside
+ * `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
 import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { BadRequestError, NotFoundError } from '../core/api-errors.js';
 import { withWriteScope } from '../db/index.js';
@@ -35,8 +36,9 @@ function rowToPrediction(row) {
         createdAt: row.created_at,
     };
 }
-/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure rolls back both.
- * The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the predictions table feeds the planning-fallacy detector. */
+/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure
+ * rolls back both. The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the
+ * predictions table feeds the planning-fallacy detector. */
 export function savePrediction(hippoRoot, tenantId, opts, actor = 'cli') {
     assertTenantId('savePrediction', tenantId);
     if (!opts.classTag)
@@ -114,12 +116,13 @@ function auditPredictionCreate(db, who, opts) {
         },
     });
 }
-/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table is the source of truth).
- * Accuracy is computed from (estimateValue, actualValue) at query time. */
+/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table
+ * is the source of truth). Accuracy is computed from (estimateValue, actualValue) at query time. */
 export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
     assertTenantId('closePrediction', tenantId);
     if (!VALID_CLOSURE_STATES.has(opts.closureState)) {
-        throw new BadRequestError(`closePrediction: closureState must be one of ${Array.from(VALID_CLOSURE_STATES).join('|')}; got ${opts.closureState}`);
+        throw new BadRequestError(`closePrediction: closureState must be one of ${Array.from(VALID_CLOSURE_STATES).join('|')}; got ` +
+            `${opts.closureState}`);
     }
     const now = new Date().toISOString();
     return onHandle(hippoRoot, (db) => {
@@ -191,7 +194,8 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
         let rows;
         if (opts.closureState) {
             if (!VALID_CLOSURE_STATES.has(opts.closureState)) {
-                throw new BadRequestError(`loadPredictionsByClass: closureState must be one of ${Array.from(VALID_CLOSURE_STATES).join('|')}; got ${opts.closureState}`);
+                throw new BadRequestError(`loadPredictionsByClass: closureState must be one of ${Array.from(VALID_CLOSURE_STATES).join('|')}; got ` +
+                    `${opts.closureState}`);
             }
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
@@ -231,8 +235,9 @@ export function loadAllPredictions(hippoRoot, tenantId, opts = {}) {
         return rows.map(rowToPrediction);
     });
 }
-/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed' with estimate and actual non-null;
- * closed-unknown and open are excluded. Audit-emit is built in here, not at the 3 call sites, so callers cannot drift. */
+/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed'
+ * with estimate and actual non-null; closed-unknown and open are excluded. Audit-emit is built in here, not at the 3
+ * call sites, so callers cannot drift. */
 export function computePredictionBaserate(hippoRoot, tenantId, classTag, actor = 'cli', 
 /** False skips the predict_baserate audit so that channel only records deliberate
  *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
@@ -254,7 +259,8 @@ emitAudit = true) {
       ORDER BY id
     `).all(tenantId, classTag);
         const baserate = predictionBaserateOf(classTag, rows);
-        // An empty class is audited too, since an agent probing one is a signal; the recall path passes false and audits its own hint.
+        // An empty class is audited too, since an agent probing one is a signal; the recall path passes false and audits
+        // its own hint.
         if (emitAudit)
             auditBaserateRead(db, tenantId, actor, classTag, baserate.nClosed);
         return baserate;
@@ -269,12 +275,25 @@ function auditBaserateRead(db, tenantId, actor, classTag, nClosed) {
         metadata: { class_tag: classTag, n_closed: nClosed },
     });
 }
-/** A class's stats over its closed rows, summed in the order given. Every store computes them here, so no two can disagree on the arithmetic. */
+function emptyBaserate(classTag) {
+    return {
+        classTag,
+        nClosed: 0,
+        nRatioEligible: 0,
+        meanEstimate: null,
+        meanActual: null,
+        meanRatio: null,
+        p50Ratio: null,
+        mae: null,
+        summary: '',
+    };
+}
+/** A class's stats over its closed rows, summed in the order given. Every store computes them here, so no two can
+ * disagree on the arithmetic. */
 export function predictionBaserateOf(classTag, rows) {
     const nClosed = rows.length;
-    if (nClosed === 0) {
-        return { classTag, nClosed: 0, nRatioEligible: 0, meanEstimate: null, meanActual: null, meanRatio: null, p50Ratio: null, mae: null, summary: '' };
-    }
+    if (nClosed === 0)
+        return emptyBaserate(classTag);
     const ratioEligible = rows.filter((r) => r.estimate_value > 0);
     const nRatioEligible = ratioEligible.length;
     const meanEstimate = rows.reduce((s, r) => s + r.estimate_value, 0) / nClosed;
@@ -293,7 +312,8 @@ export function predictionBaserateOf(classTag, rows) {
     const ratioPart = meanRatio !== null
         ? `averaged ${meanRatio.toFixed(2)}x actual`
         : 'no ratio-eligible rows (all estimates were 0)';
-    const summary = `Last ${nClosed} estimate${nClosed === 1 ? '' : 's'} in class ${classTag} ${ratioPart} (MAE ${mae.toFixed(2)}).`;
+    const summary = `Last ${nClosed} estimate${nClosed === 1 ? '' : 's'} in class ${classTag} ${ratioPart} (MAE ` +
+        `${mae.toFixed(2)}).`;
     return {
         classTag,
         nClosed,

package/dist/store/project-tags.d.ts

@@ -41,7 +41,8 @@ export interface TagRewrite<T> {
 }
 export interface ProjectTagStore extends ProjectTagReads {
     readonly hippoRoot: string;
-    /** One transaction; a dry run rolls back with no backup, else the store is backed up first and mirrors follow the commit. */
+    /** One transaction; a dry run rolls back with no backup, else the store is backed up first and mirrors follow the
+     * commit. */
     rewrite<T>(opts: {
         readonly dryRun: boolean;
         readonly backupLabel: string;
@@ -57,6 +58,8 @@ export interface ProjectTagScope {
 }
 /** Reads on a handle the caller opened and closes, for doctor's read-only check and the note sync. */
 export declare function projectTagReads(db: DatabaseSyncLike, tenantId: string): ProjectTagReads;
+/** `projectTagReads` on a read-only handle this call opens and closes, for doctor; `fn` must finish with the reads. */
+export declare function readProjectTags<T>(hippoRoot: string, tenantId: string, fn: (reads: ProjectTagReads) => T): T;
 /** Runs `fn` on hippo.db under `scope.hippoRoot`, opened for this call and closed after. */
 export declare function onProjectTags<T>(scope: ProjectTagScope, fn: (store: ProjectTagStore) => T): T;
 //# sourceMappingURL=project-tags.d.ts.map

package/dist/store/project-tags.js

@@ -1,13 +1,13 @@
 // The rows `hippo projects` and sleep's tag repair read and write, bound to one hippo.db handle and tenant,
 // so the merge and repair rules in src/sharing/project-merge.ts decide without holding the handle.
-import { getMeta, setMeta, withTrialScope, withWriteScope } from '../db/index.js';
+import { closeHippoDb, getMeta, openHippoDbReadOnly, setMeta, withTrialScope, withWriteScope, } from '../db/index.js';
 import { withBackup } from '../db/backup.js';
 import { calculateStrength } from '../core/memory.js';
 import { appendAuditEvent, queryAuditEvents } from './audit.js';
-import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin } from './compactions.js';
-import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from './dormant.js';
+import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin, } from './compactions.js';
+import { insertDormantRow, listDormantSnapshots, replaceDormantEntry, } from './dormant.js';
 import { selectAllEntries, selectEntriesByIds, selectLiveEntriesBySourcePrefix } from './entry-reads.js';
-import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors } from './entry-writes.js';
+import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors, } from './entry-writes.js';
 import { removeEntryMirrors } from './mirrors.js';
 import { onHandle } from './open.js';
 import { setAsideRow } from './set-aside.js';
@@ -27,6 +27,16 @@ export function projectTagReads(db, tenantId) {
         holdsOrigin: (table, name) => holdsOrigin(db, table, tenantId, name),
     };
 }
+/** `projectTagReads` on a read-only handle this call opens and closes, for doctor; `fn` must finish with the reads. */
+export function readProjectTags(hippoRoot, tenantId, fn) {
+    const db = openHippoDbReadOnly(hippoRoot);
+    try {
+        return fn(projectTagReads(db, tenantId));
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 function projectTagWrites(db, { tenantId, actor }) {
     return {
         ...projectTagReads(db, tenantId),
@@ -48,8 +58,9 @@ function rewriteOn(db, scope, opts, body) {
         return withTrialScope(db, TX_LABEL, () => body(tx, null)).result;
     const done = withBackup(db, scope.hippoRoot, opts.backupLabel, (backup) => withWriteScope(db, TX_LABEL, () => body(tx, backup)));
     // After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild.
-    for (const entry of selectEntriesByIds(db, done.rewrite, scope.tenantId).values())
+    for (const entry of selectEntriesByIds(db, done.rewrite, scope.tenantId).values()) {
         writeEntryMirrors(scope.hippoRoot, entry);
+    }
     for (const id of done.purge)
         removeEntryMirrors(scope.hippoRoot, id);
     return done.result;

package/dist/store/quality-repair.d.ts

@@ -1,11 +1,13 @@
-/** One automatic row with a defect. `set-aside` moves to dormant storage on apply, `review` is listed only, `protected` is kept. */
+/** One automatic row with a defect. `set-aside` moves to dormant storage on apply, `review` is listed only, `protected`
+ * is kept. */
 export interface QualityRepairIssue {
     readonly id: string;
     readonly reason: string;
     readonly disposition: 'set-aside' | 'review' | 'protected';
     readonly protection?: string;
 }
-/** One tenant's plan; `supported` is false, with `blockers` naming each gap, when the schema cannot be changed safely. */
+/** One tenant's plan; `supported` is false, with `blockers` naming each gap, when the schema cannot be changed
+ * safely. */
 export interface QualityRepairResult {
     readonly root: string;
     readonly schema: number;
@@ -17,11 +19,13 @@ export interface QualityRepairResult {
     readonly backup: string | null;
     readonly warnings: readonly string[];
 }
-/** Preview by default; apply backs the database up, then moves certain defects to dormant storage, without running migrations. */
+/** Preview by default; apply backs the database up, then moves certain defects to dormant storage, without running
+ * migrations. */
 export declare function repairAutomaticMemories(root: string, opts: {
     tenantId: string;
     apply?: boolean;
 }): QualityRepairResult;
-/** Applies the repair once per store, so stores that predate the quality gate are cleaned on upgrade with no command; null once done. */
+/** Applies the repair once per store, so stores that predate the quality gate are cleaned on upgrade with no command;
+ * null once done. */
 export declare function repairQualityOnce(root: string, tenantId: string): QualityRepairResult | null;
 //# sourceMappingURL=quality-repair.d.ts.map

package/dist/store/quality-repair.js

@@ -7,7 +7,7 @@ import { tableColumns } from '../db/tables.js';
 import { assertBinaryCompatible } from '../db/migrate.js';
 import { insertDormantRow, listDormantSnapshots } from './dormant.js';
 import { calculateStrength, canAutoDelete } from '../core/memory.js';
-import { assessAutomaticMemory, BUNDLE_HEADER, isAutomaticEntry, isCertainReason } from '../core/memory-quality.js';
+import { assessAutomaticMemory, BUNDLE_HEADER, isAutomaticEntry, isCertainReason, } from '../core/memory-quality.js';
 import { heldTexts } from '../util/same-text.js';
 import { deleteEntryCore, MEMORY_BACKED_TABLES, memoriesBackingObjectsOn } from './delete-and-batch.js';
 import { selectAllEntries, selectPreviewRows } from './entry-reads.js';
@@ -32,8 +32,9 @@ function capabilityBlockers(db) {
                 if (!columns.has(column))
                     blockers.push(`missing column: ${table}.${column}`);
     }
-    if (blockers.some((blocker) => blocker === 'missing table: meta' || blocker.startsWith('missing column: meta.')))
+    if (blockers.some((blocker) => blocker === 'missing table: meta' || blocker.startsWith('missing column: meta.'))) {
         return blockers;
+    }
     assertBinaryCompatible(db);
     if (getMeta(db, 'fts5_available', '0') === '1') {
         const columns = tableColumns(db, 'memories_fts');
@@ -76,11 +77,16 @@ function contentIssue(entry, rows) {
     const texts = heldTexts({ ...entry, source: 'consolidation' });
     if (texts.length === 0)
         return { reason: 'derived bundle has no safely parsed constituents', disposition: 'review' };
-    const reasons = texts.map((text) => assessAutomaticMemory(text).reason).filter((reason) => reason !== null);
+    const reasons = texts
+        .map((text) => assessAutomaticMemory(text).reason)
+        .filter((reason) => reason !== null);
     if (reasons.length === 0)
         return null;
     const certain = reasons.length === texts.length && reasons.every(isCertainReason) && fromAutomaticParents(entry, rows);
-    return { reason: `derived constituents: ${[...new Set(reasons)].join('; ')}`, disposition: certain ? 'set-aside' : 'review' };
+    return {
+        reason: `derived constituents: ${[...new Set(reasons)].join('; ')}`,
+        disposition: certain ? 'set-aside' : 'review',
+    };
 }
 function planRows(db, tenantId) {
     const all = selectAllEntries(db, tenantId);
@@ -95,9 +101,11 @@ function planRows(db, tenantId) {
         if (issue === null)
             continue;
         const kept = protection(entry, backing);
-        issues.push(kept === undefined ? { id: entry.id, ...issue } : { id: entry.id, ...issue, disposition: 'protected', protection: kept });
+        issues.push(kept === undefined
+            ? { id: entry.id, ...issue }
+            : { id: entry.id, ...issue, disposition: 'protected', protection: kept });
     }
-    return { total: entries.length, issues };
+    return { total: entries.length, issues, all };
 }
 function unsupportedPreview(db, tenantId) {
     const columns = tableColumns(db, 'memories');
@@ -106,42 +114,64 @@ function unsupportedPreview(db, tenantId) {
     const rows = selectPreviewRows(db, columns, tenantId);
     const issues = rows.flatMap((row) => {
         const tags = parseJsonArray(row.tags_json, { table: 'memories', id: row.id, column: 'tags_json' });
-        const provenance = { ...row, source: row.source ?? '', confidence: row.confidence ?? 'observed', dag_level: row.dag_level ?? 0, tags };
+        const provenance = {
+            ...row,
+            source: row.source ?? '',
+            confidence: row.confidence ?? 'observed',
+            dag_level: row.dag_level ?? 0,
+            tags,
+        };
         if (!isAutomaticEntry(provenance))
             return [];
         const { reason } = assessAutomaticMemory(row.content);
-        return reason === null ? [] : [{ id: row.id, reason, disposition: 'review', protection: 'unsupported schema; no changes permitted' }];
+        return reason === null
+            ? []
+            : [{ id: row.id, reason, disposition: 'review', protection: 'unsupported schema; no changes permitted' }];
     });
     return { total: rows.length, issues };
 }
-function initialResult(db, root, tenantId) {
+/** The plan plus the tenant rows it was read from, so the apply step does not read them again. */
+function plannedResult(db, root, tenantId) {
     const blockers = capabilityBlockers(db);
     const schema = pragmaUserVersion(db);
-    const plan = blockers.length > 0 ? unsupportedPreview(db, tenantId) : planRows(db, tenantId);
-    return {
+    const plan = blockers.length > 0 ? { ...unsupportedPreview(db, tenantId), all: [] } : planRows(db, tenantId);
+    const result = {
         root, schema, supported: blockers.length === 0, blockers,
         total: plan.total,
         issues: plan.issues, appliedIds: [], backup: null, warnings: [],
     };
+    return { result, all: plan.all };
 }
-// No rejection record, as in project repair: the writers refuse these defects themselves, and a record would also refuse a person's copy.
+// No rejection record, as in project repair: the writers refuse these defects themselves, and a record would also
+// refuse a person's copy.
 function setAsideIssue(db, entry, reason, now, backup) {
     const actor = 'quality-repair';
     if (deleteEntryCore(db, entry.id, { actor, automatic: true, suppressForgetAudit: true }) === null)
         return false;
-    insertDormantRow(db, { entry, strength: calculateStrength(entry, now), reason: 'quality-repair', dormantAt: now.toISOString() });
+    insertDormantRow(db, {
+        entry,
+        strength: calculateStrength(entry, now),
+        reason: 'quality-repair',
+        dormantAt: now.toISOString(),
+    });
     if (getMeta(db, 'fts5_available', '0') === '1' && ftsRowExists(db, entry.id)) {
         throw new Error(`Quality repair could not remove the full-text row for ${entry.id}`);
     }
-    appendAuditEvent(db, { tenantId: entry.tenantId, actor, op: 'quality_repair', targetId: entry.id, metadata: { reason, backup } });
+    appendAuditEvent(db, {
+        tenantId: entry.tenant_id,
+        actor,
+        op: 'quality_repair',
+        targetId: entry.id,
+        metadata: { reason, backup },
+    });
     return true;
 }
 function applyPlan(db, root, tenantId, backup, doneKey) {
     return withWriteScope(db, 'quality_repair_apply', () => {
-        const result = initialResult(db, root, tenantId);
+        const { result, all } = plannedResult(db, root, tenantId);
         if (!result.supported)
             throw new Error(`Quality repair capability changed: ${result.blockers.join('; ')}`);
-        const entries = new Map(selectAllEntries(db, tenantId).map((entry) => [entry.id, entry]));
+        const entries = new Map(all.map((entry) => [entry.id, entry]));
         const appliedIds = [];
         const warnings = [];
         const now = new Date();
@@ -159,9 +189,10 @@ function applyPlan(db, root, tenantId, backup, doneKey) {
     });
 }
 function repairOn(db, root, opts) {
-    const initial = withTrialScope(db, 'quality_repair_plan', () => initialResult(db, root, opts.tenantId));
-    if (!opts.apply || !initial.supported || !initial.issues.some((issue) => issue.disposition === 'set-aside'))
+    const initial = withTrialScope(db, 'quality_repair_plan', () => plannedResult(db, root, opts.tenantId).result);
+    if (!opts.apply || !initial.supported || !initial.issues.some((issue) => issue.disposition === 'set-aside')) {
         return initial;
+    }
     db.exec('PRAGMA foreign_keys = ON');
     const result = withBackup(db, root, 'before-quality-repair', (backup) => applyPlan(db, root, opts.tenantId, backup, opts.doneKey));
     const warnings = [...result.warnings];
@@ -172,12 +203,14 @@ function repairOn(db, root, opts) {
     }
     return { ...result, warnings };
 }
-/** Preview by default; apply backs the database up, then moves certain defects to dormant storage, without running migrations. */
+/** Preview by default; apply backs the database up, then moves certain defects to dormant storage, without running
+ * migrations. */
 export function repairAutomaticMemories(root, opts) {
     return withUnmigratedDb(root, !opts.apply, (db) => repairOn(db, root, opts));
 }
 const AUTO_REPAIR_META_KEY = 'quality_repair_auto';
-/** Applies the repair once per store, so stores that predate the quality gate are cleaned on upgrade with no command; null once done. */
+/** Applies the repair once per store, so stores that predate the quality gate are cleaned on upgrade with no command;
+ * null once done. */
 export function repairQualityOnce(root, tenantId) {
     return withUnmigratedDb(root, false, (db) => {
         if (getMeta(db, AUTO_REPAIR_META_KEY) === '1')

package/dist/store/quarantine.d.ts

@@ -1,6 +1,7 @@
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { QuarantineApproval, QuarantineListQuery, QuarantineRejection, QuarantinedMemory } from './port.js';
 export declare const QUARANTINE_SCOPE_PREFIX = "quarantine:private:";
+export declare function isQuarantineScope(scope: string | null | undefined): boolean;
 /** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
 export declare function quarantineScopeFor(original: string | null): string;
 export type QuarantineStatus = 'pending' | 'approved' | 'rejected';

package/dist/store/quarantine.js

@@ -5,6 +5,9 @@ import { withWriteScopeOr } from '../db/index.js';
 import { keysetAfter } from '../util/keyset.js';
 import { selectEntriesByIds } from './entry-reads.js';
 export const QUARANTINE_SCOPE_PREFIX = 'quarantine:private:';
+export function isQuarantineScope(scope) {
+    return scope != null && scope.startsWith(QUARANTINE_SCOPE_PREFIX);
+}
 /** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
 export function quarantineScopeFor(original) {
     return `${QUARANTINE_SCOPE_PREFIX}${original ?? 'unscoped'}`;
@@ -29,16 +32,21 @@ function getQuarantineRow(db, tenantId, memoryId) {
     return row ? fromDbRow(row) : null;
 }
 function listQuarantineRows(db, tenantId, status = 'pending', limit = DEFAULT_LIST_LIMIT, afterRow) {
-    // A pending row whose memory was deleted (e.g. Slack message_deleted) is dead; keep its history, drop it from the queue.
+    // A pending row whose memory was deleted (e.g. Slack message_deleted) is dead; keep its history, drop it from the
+    // queue.
     const live = status === 'pending'
-        ? ' AND EXISTS (SELECT 1 FROM memories m WHERE m.id = memory_quarantine.memory_id AND m.tenant_id = memory_quarantine.tenant_id)'
+        ? ' AND EXISTS (SELECT 1 FROM memories m WHERE m.id = memory_quarantine.memory_id AND m.tenant_id = ' +
+            'memory_quarantine.tenant_id)'
         : '';
     const after = keysetAfter('quarantined_at', 'memory_id', afterRow);
     const order = 'ORDER BY quarantined_at DESC, memory_id DESC LIMIT ?';
     const rows = status === 'all'
-        ? db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ?${after.sql} ${order}`)
+        ? db
+            .prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ?${after.sql} ${order}`)
             .all(tenantId, ...after.params, limit)
-        : db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND status = ?${live}${after.sql} ${order}`)
+        : db
+            .prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND status = ?${live}${after.sql} ` +
+            `${order}`)
             .all(tenantId, status, ...after.params, limit);
     // SAFETY: both branches select SELECT_COLUMNS, matching QuarantineDbRow's field set.
     return rows.map(fromDbRow);
@@ -56,12 +64,12 @@ export function recordQuarantine(db, opts) {
     });
 }
 function approveQuarantineRow(db, tenantId, memoryId, decidedBy) {
-    db.prepare(`UPDATE memory_quarantine SET status = 'approved', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
-        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+    db.prepare(`UPDATE memory_quarantine SET status = 'approved', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND ` +
+        `memory_id = ?`).run(new Date().toISOString(), decidedBy, tenantId, memoryId);
 }
 function rejectQuarantineRow(db, tenantId, memoryId, decidedBy) {
-    db.prepare(`UPDATE memory_quarantine SET status = 'rejected', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
-        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+    db.prepare(`UPDATE memory_quarantine SET status = 'rejected', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND ` +
+        `memory_id = ?`).run(new Date().toISOString(), decidedBy, tenantId, memoryId);
 }
 /** A page of the tenant's records, each with its memory's content read in the same query batch. */
 export function listQuarantinedAt(db, tenantId, { status, limit, after }) {
@@ -91,7 +99,13 @@ export function approveQuarantinedAt(db, tenantId, id, actor) {
         if (Number(updated.changes ?? 0) !== 1)
             return rollback({ outcome: 'scope_moved' });
         approveQuarantineRow(db, tenantId, id, actor);
-        appendAuditEvent(db, { tenantId, actor, op: 'quarantine_approve', targetId: id, metadata: { originalScope: row.originalScope } });
+        appendAuditEvent(db, {
+            tenantId,
+            actor,
+            op: 'quarantine_approve',
+            targetId: id,
+            metadata: { originalScope: row.originalScope },
+        });
         return { outcome: 'approved' };
     });
 }

package/dist/store/raw-archive.d.ts

@@ -2,13 +2,14 @@ import type { DatabaseSyncLike } from '../db/index.js';
 export interface ArchiveOpts {
     reason: string;
     who: string;
-    /** Hook run inside the archive SAVEPOINT after the audit row and before RELEASE (the Slack deletion connector marks the event seen atomically);
-     * throwing rolls back the whole archive, audit row included. */
+    /** Hook run inside the archive SAVEPOINT after the audit row and before RELEASE (the Slack deletion connector marks
+     * the event seen atomically); throwing rolls back the whole archive, audit row included. */
     afterArchive?: (db: DatabaseSyncLike, archivedMemoryId: string) => void;
 }
 /** Stamps the archived copy of `memoryId` as having its markdown mirror cleaned at `at`. */
 export declare function markMirrorCleaned(db: DatabaseSyncLike, memoryId: string, at: string): void;
-/** The only way to remove a `kind='raw'` row: snapshots it into `raw_archive`, flips `kind` to 'archived' so the append-only trigger allows the delete,
- * all in one write scope that nests in an outer transaction. Throws if the row is missing or not raw; returns the archived_at. */
+/** The only way to remove a `kind='raw'` row: snapshots it into `raw_archive`, flips `kind` to 'archived' so the
+ * append-only trigger allows the delete, all in one write scope that nests in an outer transaction. Throws if the row
+ * is missing or not raw; returns the archived_at. */
 export declare function archiveRawMemory(db: DatabaseSyncLike, id: string, opts: ArchiveOpts): string;
 //# sourceMappingURL=raw-archive.d.ts.map

package/dist/store/raw-archive.js

@@ -8,8 +8,8 @@ export function markMirrorCleaned(db, memoryId, at) {
     db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(at, memoryId);
 }
 function loadRawRow(db, id) {
-    // SAFETY: SELECT * returns every memories column; only kind, tenant_id and dag_parent_id are read below, all guaranteed present (possibly null) by the
-    // schema.
+    // SAFETY: SELECT * returns every memories column; only kind, tenant_id and dag_parent_id are read below, all
+    // guaranteed present (possibly null) by the schema.
     const row = db.prepare(`SELECT * FROM memories WHERE id = ?`).get(id);
     if (!row)
         throw new NotFoundError(`memory not found: ${id}`);
@@ -19,8 +19,8 @@ function loadRawRow(db, id) {
     return row;
 }
 function moveRowToArchive(db, id, row, opts) {
-    // GDPR: raw_archive stores ONLY metadata, never the original content; the archive_raw audit row is the compliance trail,
-    // so the content is unrecoverable from here on.
+    // GDPR: raw_archive stores ONLY metadata, never the original content; the archive_raw audit row is the compliance
+    // trail, so the content is unrecoverable from here on.
     const archivedAt = new Date().toISOString();
     const redactedPayload = JSON.stringify({
         redacted: true,
@@ -38,8 +38,8 @@ function moveRowToArchive(db, id, row, opts) {
         db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(id);
     return archivedAt;
 }
-// Emit the archive_raw audit inside the SAVEPOINT so it commits atomically with the row deletion, attributed to the row's own tenant_id,
-// not whatever HIPPO_TENANT the calling shell has set.
+// Emit the archive_raw audit inside the SAVEPOINT so it commits atomically with the row deletion, attributed to the
+// row's own tenant_id, not whatever HIPPO_TENANT the calling shell has set.
 function auditArchive(db, id, row, opts) {
     try {
         appendAuditEvent(db, {
@@ -55,8 +55,9 @@ function auditArchive(db, id, row, opts) {
         reportAuditWriteFailure('archive_raw', String(error), id);
     }
 }
-/** The only way to remove a `kind='raw'` row: snapshots it into `raw_archive`, flips `kind` to 'archived' so the append-only trigger allows the delete,
- * all in one write scope that nests in an outer transaction. Throws if the row is missing or not raw; returns the archived_at. */
+/** The only way to remove a `kind='raw'` row: snapshots it into `raw_archive`, flips `kind` to 'archived' so the
+ * append-only trigger allows the delete, all in one write scope that nests in an outer transaction. Throws if the row
+ * is missing or not raw; returns the archived_at. */
 export function archiveRawMemory(db, id, opts) {
     const row = loadRawRow(db, id);
     // A SAVEPOINT when already inside a transaction (e.g. batchWriteAndDelete), so a throw here
@@ -69,8 +70,8 @@ export function archiveRawMemory(db, id, opts) {
         if (row.dag_parent_id) {
             markSummaryDirtyInTx(db, String(row.dag_parent_id), String(row.tenant_id ?? DEFAULT_TENANT_ID), opts.who || 'cli');
         }
-        // afterArchive hook: connector idempotency markers (e.g. slack_event_log) must commit atomically with the archive, so it runs INSIDE the SAVEPOINT;
-        // throwing rolls back both.
+        // afterArchive hook: connector idempotency markers (e.g. slack_event_log) must commit atomically with the archive,
+        // so it runs INSIDE the SAVEPOINT; throwing rolls back both.
         if (opts.afterArchive) {
             opts.afterArchive(db, id);
         }