hippo-memory 2.0.0 → 2.1.0

package/dist/store/compactions.js

@@ -1,6 +1,7 @@
 import { originInSql } from '../core/project-identity.js';
 import { scopeAdmitSql } from './rule-sql.js';
-const COLUMNS = 'tenant_id, id, session_id, origin_project, compact_trigger, cwd, transcript_path, snapshot_saved, started_at, summarised_at, summary, ' +
+const COLUMNS = 'tenant_id, id, session_id, origin_project, compact_trigger, cwd, transcript_path, snapshot_saved, started_at, ' +
+    'summarised_at, summary, ' +
     'items_json, items_written, status';
 function selectRows(db, where, ...params) {
     // SAFETY: the SELECT names exactly COLUMNS, matching CompactionRow's field set.
@@ -15,7 +16,8 @@ export function compactionRowsByRequest(db, tenantId, requestId) {
 }
 /** The session's newest `started` row with a start in [`notBefore`, `notAfter`], both ISO strings. */
 export function latestStartedRows(db, tenantId, sessionId, notAfter, notBefore) {
-    return selectRows(db, `tenant_id = ? AND session_id = ? AND status = 'started' AND started_at <= ? AND started_at >= ? ORDER BY started_at DESC, id DESC LIMIT 1`, tenantId, sessionId, notAfter, notBefore);
+    return selectRows(db, `tenant_id = ? AND session_id = ? AND status = 'started' AND started_at <= ? AND started_at >= ? ORDER BY ` +
+        `started_at DESC, id DESC LIMIT 1`, tenantId, sessionId, notAfter, notBefore);
 }
 /** `summarised` rows whose summary is older than `summarisedBefore`, an ISO string. */
 export function stalledSummarisedRows(db, tenantId, summarisedBefore) {
@@ -23,10 +25,12 @@ export function stalledSummarisedRows(db, tenantId, summarisedBefore) {
 }
 /** `started` rows with a transcript whose start lies between `startedAfter` and `startedBefore`, oldest first. */
 export function openTranscriptRows(db, tenantId, startedBefore, startedAfter) {
-    return selectRows(db, `tenant_id = ? AND status = 'started' AND started_at < ? AND started_at > ? AND transcript_path IS NOT NULL ORDER BY started_at`, tenantId, startedBefore, startedAfter);
+    return selectRows(db, `tenant_id = ? AND status = 'started' AND started_at < ? AND started_at > ? AND transcript_path IS NOT NULL ` +
+        `ORDER BY started_at`, tenantId, startedBefore, startedAfter);
 }
 export function insertStartedCompaction(db, tenantId, start) {
-    db.prepare(`INSERT INTO compactions(tenant_id, id, session_id, origin_project, compact_trigger, cwd, transcript_path, started_at)
+    db.prepare(`INSERT INTO compactions(tenant_id, id, session_id, origin_project, compact_trigger, cwd, transcript_path, ` +
+        `started_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(tenantId, start.id, start.sessionId, start.originProject, start.trigger, start.cwd, start.transcriptPath, start.startedAt);
 }
 /** Moves a `started` row to `summarised`; false when another process already moved it. */
@@ -34,8 +38,11 @@ export function markCompactionSummarised(db, tenantId, id, update) {
     const { summary, itemsJson, summarisedAt, requestId } = update;
     // Only a caller names the column, so a store from before it was added still takes local writes.
     const stamp = requestId === undefined ? [] : [requestId];
-    const result = db.prepare(`UPDATE compactions SET summary = ?, items_json = ?, summarised_at = ?, status = 'summarised'${stamp.length === 0 ? '' : ', request_id = ?'}
-     WHERE tenant_id = ? AND id = ? AND status = 'started'`).run(summary, itemsJson, summarisedAt, ...stamp, tenantId, id);
+    const result = db
+        .prepare(`UPDATE compactions SET summary = ?, items_json = ?, summarised_at = ?, status = ` +
+        `'summarised'${stamp.length === 0 ? '' : ', request_id = ?'}
+     WHERE tenant_id = ? AND id = ? AND status = 'started'`)
+        .run(summary, itemsJson, summarisedAt, ...stamp, tenantId, id);
     return (result.changes ?? 0) > 0;
 }
 export function insertSummarisedCompaction(db, tenantId, meta, row) {
@@ -43,7 +50,8 @@ export function insertSummarisedCompaction(db, tenantId, meta, row) {
     // Only a caller names the column, so a store from before it was added still takes local writes.
     const stamp = requestId === undefined ? [] : [requestId];
     const [col, mark] = stamp.length === 0 ? ['', ''] : [', request_id', ', ?'];
-    db.prepare(`INSERT INTO compactions(tenant_id, id, session_id, origin_project, compact_trigger, cwd, transcript_path, started_at, ` +
+    db.prepare(`INSERT INTO compactions(tenant_id, id, session_id, origin_project, compact_trigger, cwd, transcript_path, ` +
+        `started_at, ` +
         `summarised_at, summary, items_json, status${col})\n` +
         `     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'summarised'${mark})`).run(tenantId, id, meta.sessionId, meta.originProject, meta.trigger, meta.cwd, meta.transcriptPath, meta.startedAt, summarisedAt, summary, itemsJson, ...stamp);
 }
@@ -51,7 +59,8 @@ export function markSnapshotSavedRow(db, tenantId, recordId) {
     db.prepare(`UPDATE compactions SET snapshot_saved = 1 WHERE tenant_id = ? AND id = ?`).run(tenantId, recordId);
 }
 export function compactionProgress(db, tenantId, id) {
-    return db.prepare(`SELECT status, items_written FROM compactions WHERE tenant_id = ? AND id = ?`)
+    return db
+        .prepare(`SELECT status, items_written FROM compactions WHERE tenant_id = ? AND id = ?`)
         .get(tenantId, id);
 }
 export function markCompactionDone(db, tenantId, id, itemsWritten) {
@@ -59,11 +68,14 @@ export function markCompactionDone(db, tenantId, id, itemsWritten) {
 }
 /** Rows changed: 1 when the `started` row was closed, 0 when it had already moved. */
 export function closeStartedWithoutSummary(db, tenantId, id) {
-    const result = db.prepare(`UPDATE compactions SET status = 'no-summary' WHERE tenant_id = ? AND id = ? AND status = 'started'`).run(tenantId, id);
+    const result = db
+        .prepare(`UPDATE compactions SET status = 'no-summary' WHERE tenant_id = ? AND id = ? AND status = 'started'`)
+        .run(tenantId, id);
     return Number(result.changes ?? 0);
 }
 export function nextCompactionStart(db, tenantId, sessionId, after) {
-    const row = db.prepare(`SELECT MIN(started_at) AS at FROM compactions WHERE tenant_id = ? AND session_id = ? AND started_at > ?`)
+    const row = db
+        .prepare(`SELECT MIN(started_at) AS at FROM compactions WHERE tenant_id = ? AND session_id = ? AND started_at > ?`)
         .get(tenantId, sessionId, after);
     return row?.at ?? null;
 }
@@ -71,8 +83,11 @@ export function nextCompactionStart(db, tenantId, sessionId, after) {
 export function heldMemoryRows(db, tenantId, origins) {
     const deny = scopeAdmitSql('');
     // SAFETY: the SELECT names the id, source_session_id and content columns.
-    return db.prepare(`SELECT id, source_session_id, content FROM memories WHERE tenant_id = ? AND ${originInSql(origins)} AND superseded_by IS NULL AND kind != 'raw'
-       AND ${deny.sql}`).all(tenantId, ...origins, ...deny.params);
+    return db
+        .prepare(`SELECT id, source_session_id, content FROM memories WHERE tenant_id = ? AND ${originInSql(origins)} AND ` +
+        `superseded_by IS NULL AND kind != 'raw'
+       AND ${deny.sql}`)
+        .all(tenantId, ...origins, ...deny.params);
 }
 export function restampCompactionOrigin(db, tenantId, from, into) {
     return Number(db.prepare(`UPDATE compactions SET origin_project = ? WHERE tenant_id = ? AND origin_project = ?`)
@@ -80,16 +95,21 @@ export function restampCompactionOrigin(db, tenantId, from, into) {
 }
 export function compactionTranscripts(db, tenantId) {
     // SAFETY: the SELECT names the two columns of the row type.
-    return db.prepare(`SELECT DISTINCT transcript_path AS transcript, cwd FROM compactions WHERE tenant_id = ? AND transcript_path IS NOT NULL`)
+    return db
+        .prepare(`SELECT DISTINCT transcript_path AS transcript, cwd FROM compactions WHERE tenant_id = ? AND transcript_path ` +
+        `IS NOT NULL`)
         .all(tenantId);
 }
 export function compactionOriginsWithCwd(db, tenantId) {
     // SAFETY: the SELECT names the two columns of the row type.
-    return db.prepare(`SELECT DISTINCT origin_project AS origin, cwd FROM compactions WHERE tenant_id = ? AND origin_project <> '' AND cwd IS NOT NULL`)
+    return db
+        .prepare(`SELECT DISTINCT origin_project AS origin, cwd FROM compactions WHERE tenant_id = ? AND origin_project <> '' ` +
+        `AND cwd IS NOT NULL`)
         .all(tenantId);
 }
 /** True when `table` holds a row of this tenant under the project name. */
 export function holdsOrigin(db, table, tenantId, name) {
-    return db.prepare(`SELECT 1 FROM ${table} WHERE tenant_id = ? AND origin_project = ? LIMIT 1`).get(tenantId, name) !== undefined;
+    return (db.prepare(`SELECT 1 FROM ${table} WHERE tenant_id = ? AND origin_project = ? LIMIT 1`).get(tenantId, name) !==
+        undefined);
 }
 //# sourceMappingURL=compactions.js.map

package/dist/store/conflicts.d.ts

@@ -4,18 +4,21 @@ import { type MemoryConflict } from './rows.js';
 export declare function listMemoryConflicts(hippoRoot: string, status?: string, tenantId?: string): MemoryConflict[];
 /** How many open conflicts listMemoryConflicts returns for a tenant, without loading one. */
 export declare function countOpenConflicts(hippoRoot: string, tenantId: string): number;
+/** countOpenConflicts on a handle the caller holds, so it can share a snapshot with other reads. */
+export declare function countOpenConflictsAt(db: DatabaseSyncLike, tenantId: string): number;
 /** One open conflict of a memory, with the row on its other side. */
 export interface OpenConflictOf {
     conflict: MemoryConflict;
     other: MemoryEntry;
 }
-/** A tenant's open conflicts naming `memoryId`, in listMemoryConflicts' order, each with its other member read in one batch. */
+/** A tenant's open conflicts naming `memoryId`, in listMemoryConflicts'
+ * order, each with its other member read in one batch. */
 export declare function loadOpenConflictsOf(hippoRoot: string, tenantId: string, memoryId: string): OpenConflictOf[];
 /** Conflicts whose two rows `actor` may both touch; someone else's personal row hides its whole pair. */
 export declare function listTouchableConflicts(hippoRoot: string, status: string, tenantId: string, actor: {
     owner?: string;
 }): MemoryConflict[];
-type DetectedConflict = {
+export type DetectedConflict = {
     memory_a_id: string;
     memory_b_id: string;
     reason: string;
@@ -23,7 +26,8 @@ type DetectedConflict = {
 };
 type SameTenant = (a: string, b: string) => boolean;
 export declare function replaceDetectedConflicts(hippoRoot: string, detected: Array<DetectedConflict>, detectedAt?: string): void;
-/** The tenant of every memory the refresh can compare, and each stored conflicts_with_json other than '[]', read before the refresh takes the write lock. */
+/** The tenant of every memory the refresh can compare, and each stored conflicts_with_json other than '[]', read
+ * before the refresh takes the write lock. */
 export interface ConflictRefreshReads {
     sameTenant: SameTenant;
     storedRefs: ReadonlyMap<string, string | null>;
@@ -44,7 +48,8 @@ export interface ResolveConflictRequest {
     readonly forgetLoser?: boolean;
     readonly tenantId?: string;
 }
-/** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser, `opts.rejectLoserValue` also tombstones its
+/** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser,
+ * `opts.rejectLoserValue` also tombstones its
  * digest. Every path emits a `conflict_resolve` audit row. Returns the resolved conflict, or null if not found. */
 export declare function resolveConflict(hippoRoot: string, { conflictId, keepId, forgetLoser, tenantId }: ResolveConflictRequest, opts?: ResolveConflictOpts): {
     conflict: MemoryConflict;

package/dist/store/conflicts.js

@@ -22,25 +22,30 @@ function canonicalConflictPair(aId, bId) {
         : { memory_a_id: bId, memory_b_id: aId };
 }
 function selectConflictRowsInTenant(db, status, allStatuses, tenantId) {
-    // Tenanted query: JOIN memories on both members and require each in-tenant, so no cross-tenant or stale pre-fix pair surfaces.
+    // Tenanted query: JOIN memories on both members and require each in-tenant, so no cross-tenant or stale pre-fix pair
+    // surfaces.
     // SAFETY: both branches select CONFLICT_COLS_MC, MemoryConflictRow's columns.
     return allStatuses
-        ? db.prepare(`
+        ? db
+            .prepare(`
         SELECT ${CONFLICT_COLS_MC}
         FROM memory_conflicts mc
         JOIN memories ma ON ma.id = mc.memory_a_id
         JOIN memories mb ON mb.id = mc.memory_b_id
         WHERE ma.tenant_id = ? AND mb.tenant_id = ?
         ORDER BY mc.updated_at DESC, mc.id DESC
-      `).all(tenantId, tenantId)
-        : db.prepare(`
+      `)
+            .all(tenantId, tenantId)
+        : db
+            .prepare(`
         SELECT ${CONFLICT_COLS_MC}
         FROM memory_conflicts mc
         JOIN memories ma ON ma.id = mc.memory_a_id
         JOIN memories mb ON mb.id = mc.memory_b_id
         WHERE mc.status = ? AND ma.tenant_id = ? AND mb.tenant_id = ?
         ORDER BY mc.updated_at DESC, mc.id DESC
-      `).all(status, tenantId, tenantId);
+      `)
+            .all(status, tenantId, tenantId);
 }
 function selectConflictRowsUnscoped(db, status, allStatuses) {
     // Unscoped query — legacy direct-mode (CLI, tests, consolidate).
@@ -60,7 +65,8 @@ function selectConflictRowsUnscoped(db, status, allStatuses) {
 }
 export function listMemoryConflicts(hippoRoot, status = 'open', tenantId) {
     return onHandle(hippoRoot, (db) => {
-        // '*' is a sentinel for no status filter; the 4 SQL branches below cover {tenanted | unscoped} x {all-statuses | specific-status}.
+        // '*' is a sentinel for no status filter; the 4 SQL branches below
+        // cover {tenanted | unscoped} x {all-statuses | specific-status}.
         const allStatuses = status === '*';
         const rows = tenantId !== undefined
             ? selectConflictRowsInTenant(db, status, allStatuses, tenantId)
@@ -75,13 +81,16 @@ const OPEN_IN_TENANT = `FROM memory_conflicts mc
   WHERE mc.status = 'open' AND ma.tenant_id = ? AND mb.tenant_id = ?`;
 /** How many open conflicts listMemoryConflicts returns for a tenant, without loading one. */
 export function countOpenConflicts(hippoRoot, tenantId) {
-    return onHandle(hippoRoot, (db) => {
-        // SAFETY: one row with the single aliased count column.
-        const row = db.prepare(`SELECT COUNT(*) AS n ${OPEN_IN_TENANT}`).get(tenantId, tenantId);
-        return Number(row.n);
-    }, openStore);
+    return onHandle(hippoRoot, (db) => countOpenConflictsAt(db, tenantId), openStore);
 }
-/** A tenant's open conflicts naming `memoryId`, in listMemoryConflicts' order, each with its other member read in one batch. */
+/** countOpenConflicts on a handle the caller holds, so it can share a snapshot with other reads. */
+export function countOpenConflictsAt(db, tenantId) {
+    // SAFETY: one row with the single aliased count column.
+    const row = db.prepare(`SELECT COUNT(*) AS n ${OPEN_IN_TENANT}`).get(tenantId, tenantId);
+    return Number(row.n);
+}
+/** A tenant's open conflicts naming `memoryId`, in listMemoryConflicts'
+ * order, each with its other member read in one batch. */
 export function loadOpenConflictsOf(hippoRoot, tenantId, memoryId) {
     return onHandle(hippoRoot, (db) => {
         // SAFETY: selects CONFLICT_COLS_MC, MemoryConflictRow's columns.
@@ -113,7 +122,8 @@ export function replaceDetectedConflicts(hippoRoot, detected, detectedAt = new D
         syncChangedMirrors(hippoRoot, db, [...selectEntriesByIds(db, changedIds).values()]);
     }, openStore);
 }
-/** The refresh's reads, kept out of the write lock; only rows holding refs, in an open conflict or in `detected` are loaded, not the whole table. */
+/** The refresh's reads, kept out of the write lock; only rows holding refs, in an open conflict or in `detected` are
+ * loaded, not the whole table. */
 function readConflictRefresh(db, detected) {
     // Tenant guard (E2): a conflict is meaningful only within one tenant, so cross-tenant pairs are
     // skipped on insert and on rebuild, and a stale cross-tenant row can neither persist nor leak a foreign id.
@@ -171,7 +181,8 @@ function resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt
     for (const row of openRows) {
         const key = `${row.memory_a_id}::${row.memory_b_id}`;
         const stale = !detectedKeys.has(key);
-        // Auto-resolve any open cross-tenant row: the insert loop and refMap rebuild skip those pairs, so re-detected ones would linger as 'open'.
+        // Auto-resolve any open cross-tenant row: the insert loop and refMap rebuild skip those pairs, so re-detected ones
+        // would linger as 'open'.
         const crossTenant = !sameTenant(row.memory_a_id, row.memory_b_id);
         if (stale || crossTenant)
             resolve.run(detectedAt, row.id);
@@ -204,8 +215,8 @@ function rebuildConflictsWithJson(db, { sameTenant, storedRefs }) {
   `).all();
     const refMap = new Map();
     for (const row of openConflicts) {
-        // Skip cross-tenant pairs so a stale row never seeds a foreign id
-        // into conflicts_with_json.
+        // Skip cross-tenant pairs so a stale row never
+        // seeds a foreign id into conflicts_with_json.
         if (!sameTenant(row.memory_a_id, row.memory_b_id))
             continue;
         if (!refMap.has(row.memory_a_id))
@@ -215,8 +226,10 @@ function rebuildConflictsWithJson(db, { sameTenant, storedRefs }) {
         refMap.get(row.memory_a_id).add(row.memory_b_id);
         refMap.get(row.memory_b_id).add(row.memory_a_id);
     }
-    // Only a row holding refs, or due some, can change. Compare-and-set, so a writer since the read keeps its value and the next sleep redoes the row.
-    const update = db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ? AND conflicts_with_json IS ?`);
+    // Only a row holding refs, or due some, can change. Compare-and-set, so a writer since the read keeps its value and
+    // the next sleep redoes the row.
+    const update = db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') ` +
+        `WHERE id = ? AND conflicts_with_json IS ?`);
     const changedIds = [];
     for (const id of new Set([...storedRefs.keys(), ...refMap.keys()])) {
         const stored = storedRefs.has(id) ? storedRefs.get(id) ?? null : '[]';
@@ -228,7 +241,8 @@ function rebuildConflictsWithJson(db, { sameTenant, storedRefs }) {
     }
     return changedIds;
 }
-// With tenantId, both members must be in-tenant and every memories mutation carries AND tenant_id = ?; a cross-tenant probe returns null like a bad id.
+// With tenantId, both members must be in-tenant and every memories mutation carries AND tenant_id = ?; a cross-tenant
+// probe returns null like a bad id.
 // Omitted tenantId = unscoped (CLI direct mode, tests).
 function conflictMemScope(tenantId) {
     return {
@@ -252,7 +266,8 @@ function findResolvableConflict(db, conflictId, keepId, tenantId) {
         return null;
     return { conflict, loserId };
 }
-/** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser, `opts.rejectLoserValue` also tombstones its
+/** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser,
+ * `opts.rejectLoserValue` also tombstones its
  * digest. Every path emits a `conflict_resolve` audit row. Returns the resolved conflict, or null if not found. */
 export function resolveConflict(hippoRoot, { conflictId, keepId, forgetLoser = false, tenantId }, opts) {
     const db = openStore(hippoRoot);
@@ -299,18 +314,26 @@ function selectConflictRow(db, conflictId, tenantId) {
 }
 function weakenConflictLoser(db, t) {
     // Halve the loser's half-life (weakens it over time)
-    db.prepare(`UPDATE memories SET half_life_days = MAX(1, half_life_days / 2), updated_at = datetime('now') WHERE id = ?${t.scope.memScope}`)
-        .run(t.loserId, ...t.scope.memArgs);
-    return { loserRemoved: false, loserWasRaw: false, rejectedDigest: undefined, extraRemovedIds: [], extraRemovedRawIds: [] };
+    db.prepare(`UPDATE memories SET half_life_days = MAX(1, half_life_days / 2), updated_at = datetime('now') ` +
+        `WHERE id = ?${t.scope.memScope}`).run(t.loserId, ...t.scope.memArgs);
+    return {
+        loserRemoved: false,
+        loserWasRaw: false,
+        rejectedDigest: undefined,
+        extraRemovedIds: [],
+        extraRemovedRawIds: [],
+    };
 }
 function removeConflictLoser(db, t) {
-    // Removal is kind-aware: a bare DELETE on a raw loser fires the append-only trigger, so use the same helpers as the reject verb.
+    // Removal is kind-aware: a bare DELETE on a raw loser fires the append-only trigger, so use the same helpers as the
+    // reject verb.
     // loserRemoved / loserWasRaw drive the conflicts_with_json skip below and the post-commit mirror purge.
     const removal = {
         loserRemoved: false,
         loserWasRaw: false,
         rejectedDigest: undefined,
-        // Same-tenant duplicates of the loser's content that rejectLoserValue also removes; kept apart from loserId so audit and mirror purge cover all of them.
+        // Same-tenant duplicates of the loser's content that rejectLoserValue also removes; kept apart from loserId so
+        // audit and mirror purge cover all of them.
         extraRemovedIds: [],
         extraRemovedRawIds: [],
     };
@@ -350,28 +373,31 @@ function recordRejectedLoserValue(db, t, loserRow, digest, who) {
         normalizedChars: normalizeValueForRejection(loserRow.content).length,
     });
 }
-/** Tombstones the loser's digest and removes its same-tenant duplicates into `removal`; returns the digest. */
-function tombstoneLoserValue(db, t, loserRow, who, removal) {
-    if (isPersonalScope(loserRow.scope)) {
-        throw new BadRequestError(`cannot reject the value of personal memory ${t.loserId}: a rejection reaches the whole tenant, ` +
-            `so its reason would show to everyone; resolve with forget instead`);
-    }
+/** Removes the live same-tenant rows whose digest matches the rejected value into `removal`; `keepId` is spared. */
+function removeDuplicatesOfRejectedValue(db, t, loserRow, rejectedDigest, who, removal) {
     const { actor, reason } = who;
-    const rejectedDigest = rejectionDigest(loserRow.content);
-    recordRejectedLoserValue(db, t, loserRow, rejectedDigest, who);
-    // Remove ALL live same-tenant rows whose digest matches (as reject-flow.ts rejectValue does), not just loserId; the O(N) scan is human-scale.
-    // Tenant-scoped ONLY, since tombstones are; `keepId` is excluded even if its content matches, because the human chose to keep it.
+    // Remove ALL live same-tenant rows whose digest matches (as reject-flow.ts rejectValue does), not just loserId; the
+    // O(N) scan is human-scale.
+    // Tenant-scoped ONLY, since tombstones are; `keepId` is excluded even if its content matches, because the human chose
+    // to keep it.
     const loserTenantId = loserRow.tenant_id ?? DEFAULT_TENANT_ID;
-    // SAFETY: dupRows' shape matches the four columns named in the SELECT above.
+    // SHORTCUT: streams the tenant to hold only the matches; a stored digest column with a (tenant_id, digest) index
+    // would read just those.
+    // SAFETY: each row has the four columns named in the SELECT.
     const dupRows = db
         .prepare(`SELECT id, kind, content, scope FROM memories WHERE tenant_id = ? AND id != ? AND id != ?`)
-        .all(loserTenantId, t.loserId, t.keepId);
+        .iterate(loserTenantId, t.loserId, t.keepId);
+    const dups = [];
     for (const dup of dupRows) {
         if (rejectionDigest(dup.content) !== rejectedDigest)
             continue;
         // Another person's personal row is outside this resolver's reach, as it is outside their recall.
         if (isPersonalScope(dup.scope) && dup.scope !== loserRow.scope)
             continue;
+        dups.push({ id: dup.id, kind: dup.kind });
+    }
+    // Removed after the read ends, since deleting rows under an open cursor can skip or repeat rows.
+    for (const dup of dups) {
         if (dup.kind === 'raw') {
             archiveRawMemory(db, dup.id, { reason, who: actor });
             removal.extraRemovedRawIds.push(dup.id);
@@ -381,6 +407,16 @@ function tombstoneLoserValue(db, t, loserRow, who, removal) {
         }
         removal.extraRemovedIds.push(dup.id);
     }
+}
+/** Tombstones the loser's digest and removes its same-tenant duplicates into `removal`; returns the digest. */
+function tombstoneLoserValue(db, t, loserRow, who, removal) {
+    if (isPersonalScope(loserRow.scope)) {
+        throw new BadRequestError(`cannot reject the value of personal memory ${t.loserId}: a rejection reaches the whole tenant, ` +
+            `so its reason would show to everyone; resolve with forget instead`);
+    }
+    const rejectedDigest = rejectionDigest(loserRow.content);
+    recordRejectedLoserValue(db, t, loserRow, rejectedDigest, who);
+    removeDuplicatesOfRejectedValue(db, t, loserRow, rejectedDigest, who, removal);
     return rejectedDigest;
 }
 function stripConflictRefs(db, t, loserRemoved) {
@@ -390,7 +426,11 @@ function stripConflictRefs(db, t, loserRemoved) {
     // SAFETY: keepRow's shape matches the single `conflicts_with_json` column selected above.
     const keepRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(keepId, ...memArgs);
     if (keepRow) {
-        const refs = parseJsonArray(keepRow.conflicts_with_json, { table: 'memories', id: keepId, column: 'conflicts_with_json' });
+        const refs = parseJsonArray(keepRow.conflicts_with_json, {
+            table: 'memories',
+            id: keepId,
+            column: 'conflicts_with_json',
+        });
         const cleaned = refs.filter((r) => r !== loserId);
         db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
             .run(JSON.stringify(cleaned), keepId, ...memArgs);
@@ -400,7 +440,11 @@ function stripConflictRefs(db, t, loserRemoved) {
         // column named in the SELECT below.
         const loserRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(loserId, ...memArgs);
         if (loserRow) {
-            const refs = parseJsonArray(loserRow.conflicts_with_json, { table: 'memories', id: loserId, column: 'conflicts_with_json' });
+            const refs = parseJsonArray(loserRow.conflicts_with_json, {
+                table: 'memories',
+                id: loserId,
+                column: 'conflicts_with_json',
+            });
             const cleaned = refs.filter((r) => r !== keepId);
             db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
                 .run(JSON.stringify(cleaned), loserId, ...memArgs);
@@ -423,15 +467,23 @@ function auditConflictResolve(db, t, removal, tenantId) {
     // omitting the key, exactly as the pre-migration object literal did.
     if (rejectedDigest !== undefined)
         conflictResolveMeta.rejectedDigest = rejectedDigest;
-    // Fresh spread literal: ConflictResolveMeta is a closed interface, not assignable to audit()'s Record<string, JsonValue> metadata otherwise.
-    audit(db, 'conflict_resolve', { targetId: t.keepId, metadata: { ...conflictResolveMeta }, actor: t.opts?.rejectedBy ?? 'cli', tenantId });
+    // Fresh spread literal: ConflictResolveMeta is a closed interface, not assignable to audit()'s Record<string,
+    // JsonValue> metadata otherwise.
+    audit(db, 'conflict_resolve', {
+        targetId: t.keepId,
+        metadata: { ...conflictResolveMeta },
+        actor: t.opts?.rejectedBy ?? 'cli',
+        tenantId,
+    });
 }
 function purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal) {
-    // Mirror purge and reaper stamp for EVERY removed loser (loserId and each extraRemovedIds duplicate), post-commit like the reject verb.
+    // Mirror purge and reaper stamp for EVERY removed loser (loserId and each extraRemovedIds duplicate), post-commit
+    // like the reject verb.
     // A non-raw mirror has no reaper, so skipping the purge would orphan it forever.
     for (const removedId of [loserId, ...removal.extraRemovedIds]) {
         const isRaw = removedId === loserId ? removal.loserWasRaw : removal.extraRemovedRawIds.includes(removedId);
-        // purgeMirrorBestEffort retries once, then reports the explicit leftover paths for non-raw ids, which the cleanupArchivedMirrors reaper never scans.
+        // purgeMirrorBestEffort retries once, then reports the explicit leftover paths for non-raw ids, which the
+        // cleanupArchivedMirrors reaper never scans.
         const mirrorOk = purgeMirrorBestEffort(hippoRoot, removedId, isRaw, 'resolveConflict');
         if (mirrorOk && isRaw) {
             db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), removedId);
@@ -441,8 +493,11 @@ function purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal) {
 /** The conflict and loser ids every conflict_resolve audit row names. */
 export function conflictResolveAuditsAt(db) {
     // SAFETY: SELECT of two fields every conflict_resolve audit row carries (ConflictResolveMeta above).
-    return db.prepare(`SELECT json_extract(metadata_json, '$.conflictId') AS conflictId, json_extract(metadata_json, '$.loserId') AS loserId ` +
-        `FROM audit_log WHERE op = 'conflict_resolve'`).all();
+    return db
+        .prepare(`SELECT json_extract(metadata_json, '$.conflictId') ` +
+        `AS conflictId, json_extract(metadata_json, '$.loserId') AS loserId ` +
+        `FROM audit_log WHERE op = 'conflict_resolve'`)
+        .all();
 }
 /** Every resolved conflict with both sides. */
 export function resolvedConflictsAt(db) {

package/dist/store/connectors/dlq.d.ts

@@ -2,9 +2,21 @@ import type { DatabaseSyncLike } from '../../db/index.js';
 export type DlqTable = 'slack_dlq' | 'github_dlq';
 export type DlqRawValue = string | number | bigint | null;
 export type DlqRawRow = Record<string, DlqRawValue>;
-/** Inserts one row, stamping received_at; `columns` pairs each column name with its value, in insert order. */
-export declare function insertDlqRow(db: DatabaseSyncLike, table: DlqTable, columns: ReadonlyArray<readonly [string, string | null]>): number;
-export declare function listDlqRows(db: DatabaseSyncLike, table: DlqTable, selectColumns: string, tenantId: string, limit: number): DlqRawRow[];
-export declare function getDlqRow(db: DatabaseSyncLike, table: DlqTable, selectColumns: string, id: number): DlqRawRow | null;
-export declare function markDlqRetried(db: DatabaseSyncLike, table: DlqTable, id: number): void;
+type DlqKind = 'int' | 'text' | 'nullableText' | 'count' | 'bucket';
+/** One DLQ column: the item field it fills, its kind, and whether insert writes it (the database sets the rest). */
+export interface DlqColumn {
+    field: string;
+    column: string;
+    kind: DlqKind;
+    insert?: true;
+}
+export interface DlqAccess<Item, Insert> {
+    insert(db: DatabaseSyncLike, row: Insert): number;
+    list(db: DatabaseSyncLike, tenantId: string, limit: number): Item[];
+    get(db: DatabaseSyncLike, id: number): Item | null;
+    markRetried(db: DatabaseSyncLike, id: number): void;
+}
+/** The four statements and the row mapping of one dead-letter table, driven by its column map. */
+export declare function dlqAccess<Item, Insert extends object>(table: DlqTable, columns: readonly DlqColumn[]): DlqAccess<Item, Insert>;
+export {};
 //# sourceMappingURL=dlq.d.ts.map

package/dist/store/connectors/dlq.js

@@ -1,15 +1,33 @@
-// The dead-letter statements both connectors share; each connector names its table and columns and maps rows to its own item type.
+// The dead-letter statements both connectors share; each connector names its table and columns and maps rows to its own
+// item type.
 import { placeholders } from '../../util/sql.js';
+const DLQ_TABLES = ['slack_dlq', 'github_dlq'];
+const COLUMN_NAME = /^[a-z_]+$/;
+// The statements splice identifiers into SQL, so the typed union is backed by a runtime check.
+function assertTable(table) {
+    if (!DLQ_TABLES.includes(table))
+        throw new Error(`Invalid DLQ table: ${table}`);
+}
+function assertColumns(names) {
+    for (const name of names) {
+        if (!COLUMN_NAME.test(name))
+            throw new Error(`Invalid DLQ column name: ${name}`);
+    }
+}
 /** Inserts one row, stamping received_at; `columns` pairs each column name with its value, in insert order. */
-export function insertDlqRow(db, table, columns) {
+function insertDlqRow(db, table, columns) {
+    assertTable(table);
     const names = [...columns.map(([name]) => name), 'received_at'];
+    assertColumns(names);
     const values = [...columns.map(([, value]) => value), new Date().toISOString()];
     const result = db
         .prepare(`INSERT INTO ${table} (${names.join(', ')}) VALUES (${placeholders(names.length)})`)
         .run(...values);
     return Number(result.lastInsertRowid);
 }
-export function listDlqRows(db, table, selectColumns, tenantId, limit) {
+function listDlqRows(db, table, selectColumns, tenantId, limit) {
+    assertTable(table);
+    assertColumns(selectColumns.split(',').map((name) => name.trim()));
     // SAFETY: the caller's selectColumns names exactly the fields its rowToItem reads.
     return db
         .prepare(`SELECT ${selectColumns}
@@ -19,15 +37,48 @@ export function listDlqRows(db, table, selectColumns, tenantId, limit) {
         LIMIT ?`)
         .all(tenantId, limit);
 }
-export function getDlqRow(db, table, selectColumns, id) {
+function getDlqRow(db, table, selectColumns, id) {
+    assertTable(table);
+    assertColumns(selectColumns.split(',').map((name) => name.trim()));
     // SAFETY: the caller's selectColumns names exactly the fields its rowToItem reads.
     const row = db
         .prepare(`SELECT ${selectColumns} FROM ${table} WHERE id = ?`)
         .get(id);
     return row ?? null;
 }
-export function markDlqRetried(db, table, id) {
+function markDlqRetried(db, table, id) {
+    assertTable(table);
     db.prepare(`UPDATE ${table} SET retried_at = ?, retry_count = retry_count + 1 WHERE id = ?`)
         .run(new Date().toISOString(), id);
 }
+function coerceDlqValue(kind, raw) {
+    switch (kind) {
+        case 'int': return Number(raw);
+        case 'count': return Number(raw ?? 0);
+        case 'text': return String(raw);
+        case 'nullableText': return raw == null ? null : String(raw);
+        case 'bucket': return raw == null ? 'parse_error' : String(raw);
+    }
+}
+/** The four statements and the row mapping of one dead-letter table, driven by its column map. */
+export function dlqAccess(table, columns) {
+    const selectColumns = columns.map((c) => c.column).join(', ');
+    const insertColumns = columns.filter((c) => c.insert);
+    // SAFETY: the column map names every field of Item with the kind that coerces it.
+    const toItem = (raw) => Object.fromEntries(columns.map((c) => [c.field, coerceDlqValue(c.kind, raw[c.column])]));
+    return {
+        insert: (db, row) => {
+            // SAFETY: every insert field of the column map is a string, null or absent on Insert.
+            const fields = row;
+            const pairs = insertColumns.map((c) => [c.column, fields[c.field] ?? null]);
+            return insertDlqRow(db, table, pairs);
+        },
+        list: (db, tenantId, limit) => listDlqRows(db, table, selectColumns, tenantId, limit).map(toItem),
+        get: (db, id) => {
+            const row = getDlqRow(db, table, selectColumns, id);
+            return row ? toItem(row) : null;
+        },
+        markRetried: (db, id) => markDlqRetried(db, table, id),
+    };
+}
 //# sourceMappingURL=dlq.js.map