hippo-memory 1.59.0 → 1.61.0

package/dist/store/mirrors.js

@@ -0,0 +1,312 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { Layer } from '../memory.js';
+import { dumpFrontmatter } from '../yaml.js';
+import { getMeta } from '../db.js';
+import { log } from '../log.js';
+import { parseJsonArray, INDEX_VERSION, parseLastTraceId, MEMORY_SELECT_COLUMNS, rowToEntry, rowToMemoryConflict, } from './rows.js';
+import { serializeEntry } from './markdown.js';
+export function layerDir(root, layer) {
+    return path.join(root, layer);
+}
+export function ensureMirrorDirectories(hippoRoot) {
+    const dirs = [
+        hippoRoot,
+        path.join(hippoRoot, 'buffer'),
+        path.join(hippoRoot, 'episodic'),
+        path.join(hippoRoot, 'semantic'),
+        path.join(hippoRoot, 'conflicts'),
+    ];
+    for (const dir of dirs) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+// Tenant-scoped mirror file paths. The single-tenant 'default' deployment
+// keeps the original `active-task.md` / `recent-session.md` filenames for
+// on-disk back-compat; multi-tenant deployments get a `.<tenantId>` suffix
+// so tenant B saving cannot overwrite tenant A's mirror file.
+function activeTaskMirrorPath(hippoRoot, tenantId) {
+    const file = tenantId === 'default' ? 'active-task.md' : `active-task.${tenantId}.md`;
+    return path.join(hippoRoot, 'buffer', file);
+}
+function recentSessionMirrorPath(hippoRoot, tenantId) {
+    const file = tenantId === 'default' ? 'recent-session.md' : `recent-session.${tenantId}.md`;
+    return path.join(hippoRoot, 'buffer', file);
+}
+export function writeActiveTaskMirror(hippoRoot, tenantId, snapshot) {
+    const filePath = activeTaskMirrorPath(hippoRoot, tenantId);
+    const fm = dumpFrontmatter({
+        id: snapshot.id,
+        task: snapshot.task,
+        status: snapshot.status,
+        source: snapshot.source,
+        session_id: snapshot.session_id,
+        created_at: snapshot.created_at,
+        updated_at: snapshot.updated_at,
+        next_step: snapshot.next_step,
+    });
+    const body = [
+        `# Active Task Snapshot`,
+        '',
+        `## Summary`,
+        snapshot.summary,
+        '',
+        `## Next step`,
+        snapshot.next_step,
+        '',
+        `## Task`,
+        snapshot.task,
+        '',
+    ];
+    if (snapshot.session_id) {
+        body.push(`## Session`, snapshot.session_id, '');
+    }
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, `${fm}\n\n${body.join('\n')}`, 'utf8');
+}
+export function removeActiveTaskMirror(hippoRoot, tenantId) {
+    const filePath = activeTaskMirrorPath(hippoRoot, tenantId);
+    if (fs.existsSync(filePath)) {
+        fs.unlinkSync(filePath);
+    }
+}
+export function writeRecentSessionMirror(hippoRoot, tenantId, events) {
+    const filePath = recentSessionMirrorPath(hippoRoot, tenantId);
+    if (events.length === 0) {
+        if (fs.existsSync(filePath)) {
+            fs.unlinkSync(filePath);
+        }
+        return;
+    }
+    const latest = events[events.length - 1];
+    const fm = dumpFrontmatter({
+        session_id: latest.session_id,
+        task: latest.task,
+        event_count: events.length,
+        updated_at: latest.created_at,
+    });
+    const lines = [
+        '# Recent Session Trail',
+        '',
+        `- Session: ${latest.session_id}`,
+        `- Task: ${latest.task ?? 'n/a'}`,
+        `- Updated: ${latest.created_at}`,
+        '',
+        '## Events',
+        '',
+    ];
+    for (const event of events) {
+        lines.push(`- [${event.created_at}] (${event.event_type}) ${event.content}`);
+    }
+    lines.push('');
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, `${fm}\n\n${lines.join('\n')}`, 'utf8');
+}
+function writeConflictMirrors(hippoRoot, conflicts) {
+    const conflictDir = path.join(hippoRoot, 'conflicts');
+    fs.mkdirSync(conflictDir, { recursive: true });
+    const keep = new Set();
+    for (const conflict of conflicts) {
+        const filename = `conflict_${conflict.id}.md`;
+        keep.add(filename);
+        const fm = dumpFrontmatter({
+            id: conflict.id,
+            memory_a_id: conflict.memory_a_id,
+            memory_b_id: conflict.memory_b_id,
+            reason: conflict.reason,
+            score: Math.round(conflict.score * 10000) / 10000,
+            status: conflict.status,
+            detected_at: conflict.detected_at,
+            updated_at: conflict.updated_at,
+        });
+        const body = [
+            '# Memory Conflict',
+            '',
+            `- Memory A: ${conflict.memory_a_id}`,
+            `- Memory B: ${conflict.memory_b_id}`,
+            `- Reason: ${conflict.reason}`,
+            `- Score: ${conflict.score.toFixed(3)}`,
+            `- Status: ${conflict.status}`,
+            '',
+        ].join('\n');
+        fs.writeFileSync(path.join(conflictDir, filename), `${fm}\n\n${body}`, 'utf8');
+    }
+    for (const existing of fs.readdirSync(conflictDir)) {
+        if (existing === '.gitkeep')
+            continue;
+        if (!keep.has(existing)) {
+            fs.unlinkSync(path.join(conflictDir, existing));
+        }
+    }
+}
+export function writeMarkdownMirror(hippoRoot, entry) {
+    removeEntryMirrors(hippoRoot, entry.id);
+    const dir = layerDir(hippoRoot, entry.layer);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, `${entry.id}.md`), serializeEntry(entry), 'utf8');
+}
+// AT1 P1 fix (codex): `writeMarkdownMirror` writes ANY layer's mirror,
+// including `trace/<id>.md` for Layer.Trace rows (auto-promoted traces,
+// consolidate.ts) — but this enumeration only walked
+// Buffer/Episodic/Semantic. A rejected/forgotten trace row's markdown
+// content survived on disk while the purge (and `hippo reject`/plain
+// `forget`) reported success, and a stale trace mirror is exactly the
+// resurrection channel bootstrapLegacyStore/rebuildIndex guard against.
+// Fixes BOTH the AT1 reject-flow purge and the pre-existing plain-`forget`
+// gap for trace rows (deleteEntry has always called this same function).
+export function removeEntryMirrors(hippoRoot, id) {
+    for (const layer of [Layer.Buffer, Layer.Episodic, Layer.Semantic, Layer.Trace]) {
+        const file = path.join(layerDir(hippoRoot, layer), `${id}.md`);
+        if (fs.existsSync(file)) {
+            fs.unlinkSync(file);
+        }
+    }
+}
+/**
+ * AT1 mirror-purge honesty fix (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
+ * the candidate markdown mirror paths still on disk for `id`, computed the
+ * same way `removeEntryMirrors` walks them (one per layer: buffer/episodic/
+ * semantic), filtered to the ones that still `fs.existsSync`. Used to report
+ * an EXPLICIT path when a best-effort purge fails and no reaper exists to
+ * retry it — plain `removeEntryMirrors` returns void, giving no way to name
+ * which file is stuck.
+ */
+export function getExistingEntryMirrorPaths(hippoRoot, id) {
+    // AT1 P1 fix (codex): same missing Layer.Trace as removeEntryMirrors above
+    // — kept in lockstep with it since this function's whole purpose is
+    // walking the mirror paths "the same way removeEntryMirrors walks them"
+    // (see its own doc comment).
+    return [Layer.Buffer, Layer.Episodic, Layer.Semantic, Layer.Trace]
+        .map((layer) => path.join(layerDir(hippoRoot, layer), `${id}.md`))
+        .filter((file) => fs.existsSync(file));
+}
+/**
+ * AT1 fix: best-effort markdown-mirror purge shared by `reject-flow.ts`'s
+ * `rejectValue` and `resolveConflict`'s post-commit purge. Both used to log
+ * "will retry via reaper on next open" for EVERY failure, but the reaper
+ * (`cleanupArchivedMirrors`, raw-archive-mirror-cleanup.ts) only scans
+ * `raw_archive` — that message was false for a non-raw id, which has no
+ * reaper at all.
+ *
+ * Retries the unlink once synchronously (the common real-world failure is a
+ * transient lock/AV-scanner false positive, not a permanent one). On a
+ * second failure: raw ids still get the honest reaper message (true); non-raw
+ * ids get the EXPLICIT leftover file path(s) and a manual-delete instruction,
+ * since nothing will ever retry them automatically.
+ *
+ * Returns true if the mirror ended up purged (first or second attempt).
+ */
+export function purgeMirrorBestEffort(hippoRoot, id, isRaw, logPrefix) {
+    try {
+        removeEntryMirrors(hippoRoot, id);
+        return true;
+    }
+    catch {
+        try {
+            removeEntryMirrors(hippoRoot, id);
+            return true;
+        }
+        catch (secondErr) {
+            const msg = secondErr instanceof Error ? secondErr.message : String(secondErr);
+            if (isRaw) {
+                log.error(`${logPrefix}: mirror cleanup failed for ${id} (will retry via reaper on next open): ${msg}`);
+            }
+            else {
+                const leftover = getExistingEntryMirrorPaths(hippoRoot, id);
+                const pathsNote = leftover.length > 0 ? leftover.join(', ') : `${id}.md (path unresolved)`;
+                log.error(`${logPrefix}: mirror cleanup failed for ${id} - no automatic retry exists for this file, ` +
+                    `delete it manually: ${pathsNote} (${msg})`);
+            }
+            return false;
+        }
+    }
+}
+/** Derive the current `HippoIndex` from SQLite. Exported for `rebuildIndex`
+ *  (the only index.json writer) and the longmemeval benchmark. */
+export function buildIndexFromDb(db) {
+    // SAFETY: rows' shape matches the seven columns named in the SELECT below.
+    const rows = db.prepare(`SELECT id, created, last_retrieved, strength, layer, tags_json, pinned FROM memories ORDER BY created ASC, id ASC`).all();
+    const entries = {};
+    for (const row of rows) {
+        // SAFETY: layer is only ever written from the Layer enum by this
+        // module's own INSERT/UPDATE paths.
+        const layer = row.layer;
+        entries[row.id] = {
+            id: row.id,
+            file: path.join(layer, `${row.id}.md`),
+            layer,
+            strength: Number(row.strength ?? 0),
+            tags: parseJsonArray(row.tags_json),
+            created: row.created,
+            last_retrieved: row.last_retrieved,
+            pinned: Boolean(row.pinned),
+        };
+    }
+    // LC1 codex round-2 med: the two lockstep keys must be read in ONE
+    // statement. Two autocommit SELECTs leave a window where a concurrent
+    // saveIndex (which commits both keys in one transaction) lands between
+    // them, handing the reader mismatched last_retrieval_ids / last_trace_id
+    // and re-opening the mislinkage hole saveIndex's BEGIN/COMMIT closed on
+    // the write side. One SELECT = one SQLite read snapshot.
+    // SAFETY: lockstepRows' shape matches the key/value columns named above.
+    const lockstepRows = db.prepare(`SELECT key, value FROM meta WHERE key IN ('last_retrieval_ids', 'last_trace_id')`).all();
+    const lockstep = new Map(lockstepRows.map((r) => [r.key, r.value]));
+    return {
+        version: INDEX_VERSION,
+        entries,
+        last_retrieval_ids: parseJsonArray(lockstep.get('last_retrieval_ids') ?? '[]'),
+        last_trace_id: parseLastTraceId(lockstep.get('last_trace_id') ?? ''),
+    };
+}
+export function buildStatsFromDb(db) {
+    // SAFETY: runs' shape matches the four columns named in the SELECT above.
+    const runs = db.prepare(`SELECT timestamp, decayed, merged, removed FROM consolidation_runs ORDER BY timestamp ASC, id ASC`).all();
+    return {
+        total_remembered: Number(getMeta(db, 'total_remembered', '0')),
+        total_recalled: Number(getMeta(db, 'total_recalled', '0')),
+        total_forgotten: Number(getMeta(db, 'total_forgotten', '0')),
+        consolidation_runs: runs.map((run) => ({
+            timestamp: run.timestamp,
+            decayed: run.decayed,
+            merged: run.merged,
+            removed: run.removed,
+        })),
+    };
+}
+/** Write the `index.json` mirror file for an already-derived index. Exported for
+ *  `rebuildIndex` (the only index.json writer) and the longmemeval benchmark. */
+export function writeIndexMirror(hippoRoot, index) {
+    mirrorBestEffort('index.json', () => fs.writeFileSync(path.join(hippoRoot, 'index.json'), JSON.stringify(index, null, 2), 'utf8'));
+}
+export function writeStatsMirror(hippoRoot, stats) {
+    mirrorBestEffort('stats.json', () => fs.writeFileSync(path.join(hippoRoot, 'stats.json'), JSON.stringify(stats, null, 2), 'utf8'));
+}
+/** Mirrors are derived from SQLite and written after COMMIT, so a failed write warns instead of failing a committed change. */
+export function mirrorBestEffort(what, write) {
+    try {
+        write();
+    }
+    catch (err) {
+        log.warn(`${what} not refreshed (${err instanceof Error ? err.message : String(err)}); the database write succeeded`);
+    }
+}
+export function syncMirrorFiles(hippoRoot, db) {
+    // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
+    // MemoryRow's field set.
+    const entries = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ORDER BY created ASC, id ASC`).all();
+    mirrorBestEffort('markdown mirrors', () => {
+        for (const entry of entries.map(rowToEntry))
+            writeMarkdownMirror(hippoRoot, entry);
+    });
+    // SAFETY: conflicts' shape matches the eight columns named in the SELECT
+    // above.
+    const conflicts = db.prepare(`
+    SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+    FROM memory_conflicts
+    WHERE status = 'open'
+    ORDER BY updated_at DESC, id DESC
+  `).all();
+    mirrorBestEffort('conflict mirrors', () => writeConflictMirrors(hippoRoot, conflicts.map(rowToMemoryConflict)));
+    writeStatsMirror(hippoRoot, buildStatsFromDb(db));
+}
+//# sourceMappingURL=mirrors.js.map

package/dist/store/open.d.ts

@@ -0,0 +1,15 @@
+import { type MemoryEntry } from '../memory.js';
+import { type DatabaseSyncLike } from '../db.js';
+import { type ResolveProjectIdentityOpts } from '../project-identity.js';
+/** Nearest ancestor store like git; the strict join is the fallback so `hippo init` still creates `<cwd>/.hippo`. */
+export declare function getHippoRoot(cwd?: string, opts?: ResolveProjectIdentityOpts): string;
+export declare function isInitialized(hippoRoot: string): boolean;
+export declare function initStore(hippoRoot: string): void;
+/** One open connection with init done on it, for callers who used to pay for `initStore` + a second `openHippoDb`. */
+export declare function openStore(hippoRoot: string): DatabaseSyncLike;
+/** `meta` key holding the default half-life base a store's memories are on (src/half-life-migration.ts). */
+export declare const HALF_LIFE_BASE_META_KEY = "default_half_life_base";
+/** `meta` key set once no memory of a decision, incident or other object sits on the old flat 90 days. */
+export declare const TYPED_HALF_LIFE_META_KEY = "typed_half_life_on_default";
+export declare function loadLegacyEntriesFromMarkdown(hippoRoot: string): MemoryEntry[];
+//# sourceMappingURL=open.d.ts.map

package/dist/store/open.js

@@ -0,0 +1,223 @@
+// Opens the SQLite store, the source of truth; Markdown and JSON files are human-readable mirrors of it.
+import * as fs from 'fs';
+import * as path from 'path';
+import { DEFAULT_HALF_LIFE_DAYS, Layer } from '../memory.js';
+import { closeHippoDb, openHippoDb, getMeta, setMeta } from '../db.js';
+import { findHippoStoreDir, realpathOrResolve } from '../project-identity.js';
+import { RejectedValueError } from '../rejection.js';
+import { log } from '../log.js';
+import { isPlainJsonObject } from './rows.js';
+import { audit } from './audit-event.js';
+import { deserializeEntry } from './markdown.js';
+import { stampOriginProjectForImport, upsertEntryRow } from './entry-row.js';
+import { ensureMirrorDirectories, syncMirrorFiles, layerDir } from './mirrors.js';
+/** Nearest ancestor store like git; the strict join is the fallback so `hippo init` still creates `<cwd>/.hippo`. */
+export function getHippoRoot(cwd = process.cwd(), opts) {
+    return findHippoStoreDir(cwd, opts) ?? path.join(realpathOrResolve(cwd), '.hippo');
+}
+export function isInitialized(hippoRoot) {
+    // A bare .hippo directory is not enough — autoInstallHooks /
+    // setupDailySchedule can create it without ever calling initStore,
+    // leaving a partial directory (integrations/, logs/, runs/) with no
+    // hippo.db. Returning true in that state caused `hippo init` to skip
+    // initStore and `hippo recall` to silently fall back to an empty store
+    // (incident 2026-04-26: ingest_direct.py against a bare .hippo).
+    // Treat the store as initialized only if hippo.db actually exists.
+    return fs.existsSync(path.join(hippoRoot, 'hippo.db'));
+}
+export function initStore(hippoRoot) {
+    closeHippoDb(openStore(hippoRoot));
+}
+/** One open connection with init done on it, for callers who used to pay for `initStore` + a second `openHippoDb`. */
+export function openStore(hippoRoot) {
+    ensureMirrorDirectories(hippoRoot);
+    const db = openHippoDb(hippoRoot);
+    try {
+        const bootstrapped = bootstrapLegacyStore(db, hippoRoot);
+        if (bootstrapped) {
+            syncMirrorFiles(hippoRoot, db);
+        }
+        recordHalfLifeBaseForNewStore(db);
+        return db;
+    }
+    catch (error) {
+        try {
+            closeHippoDb(db);
+        }
+        catch {
+            // Best effort only; surface the original init error.
+        }
+        throw error;
+    }
+}
+/** `meta` key holding the default half-life base a store's memories are on (src/half-life-migration.ts). */
+export const HALF_LIFE_BASE_META_KEY = 'default_half_life_base';
+/** `meta` key set once no memory of a decision, incident or other object sits on the old flat 90 days. */
+export const TYPED_HALF_LIFE_META_KEY = 'typed_half_life_on_default';
+/**
+ * A store with no memories starts on the current default half-life base, so
+ * `hippo sleep` never migrates it. A store that already holds memories and
+ * no recorded base predates the record, and keeps reading as the legacy
+ * 7-day base until sleep migrates it.
+ */
+function recordHalfLifeBaseForNewStore(db) {
+    if (getMeta(db, HALF_LIFE_BASE_META_KEY, '') !== '')
+        return;
+    if (db.prepare(`SELECT 1 AS x FROM memories LIMIT 1`).get() !== undefined)
+        return;
+    setMeta(db, HALF_LIFE_BASE_META_KEY, String(DEFAULT_HALF_LIFE_DAYS));
+    setMeta(db, TYPED_HALF_LIFE_META_KEY, '1');
+}
+function bootstrapLegacyStore(db, hippoRoot) {
+    // SAFETY: countRow's shape matches the single `COUNT(*) AS count` column
+    // selected above; `.get()` returns undefined only when no row exists.
+    const countRow = db.prepare(`SELECT COUNT(*) AS count FROM memories`).get();
+    const memoryCount = Number(countRow?.count ?? 0);
+    if (memoryCount > 0)
+        return false;
+    // AT1 P2 fix: memoryCount alone is not a reliable "already bootstrapped"
+    // signal once the rejection guard exists. If EVERY legacy mirror row is
+    // rejected, memories stays at 0 rows even after a successful bootstrap
+    // pass, so the memoryCount>0 gate above never trips — every subsequent
+    // initStore() call would re-run this whole function: re-scan the legacy
+    // mirrors, re-attempt (and re-refuse, re-auditing) every row, and
+    // re-INSERT the legacy consolidation_runs rows with no dedup, duplicating
+    // them on each open. A dedicated meta flag marks bootstrap as
+    // attempted-and-settled regardless of how many rows actually landed.
+    if (getMeta(db, 'legacy_bootstrap_completed', '0') === '1')
+        return false;
+    const legacyEntries = loadLegacyEntriesFromMarkdown(hippoRoot);
+    if (legacyEntries.length === 0)
+        return false;
+    db.exec('BEGIN');
+    try {
+        importLegacyEntries(db, hippoRoot, legacyEntries);
+        importLegacyIndexAndStats(db, hippoRoot);
+        // AT1 P2 fix: stamp completion regardless of how many rows actually
+        // landed (all-rejected included) — see the gate comment above.
+        setMeta(db, 'legacy_bootstrap_completed', '1');
+        db.exec('COMMIT');
+    }
+    catch (error) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { /* already rolled back; keep the original error */ }
+        throw error;
+    }
+    return true;
+}
+function importLegacyEntries(db, hippoRoot, legacyEntries) {
+    // AT1 (plan §3, round-3 redesign): run the guard LIVE per row rather
+    // than bypassing it. bootstrapLegacyStore is exactly the channel through
+    // which a stale/never-purged markdown mirror could resurrect a rejected
+    // value; a skip-and-count here closes that structurally, independent of
+    // mirror state. The refusal audit is written INLINE inside this
+    // still-open loop transaction (plain audit() — nothing is rolled back
+    // on a per-row skip, so the post-rollback auditRejectionRefusal helper
+    // is the wrong tool here).
+    let rejectedCount = 0;
+    for (const entry of legacyEntries) {
+        // v39: legacy markdown carries no origin_project; stamp from the store
+        // location so bootstrapped rows stay visible to ambient context.
+        const stamped = stampOriginProjectForImport(hippoRoot, entry);
+        try {
+            upsertEntryRow(db, stamped);
+        }
+        catch (err) {
+            if (err instanceof RejectedValueError) {
+                rejectedCount++;
+                audit(db, 'reject_refusal', err.entryId, { digest: err.digest, reason: err.reason }, 'cli', err.tenantId);
+                continue;
+            }
+            throw err;
+        }
+    }
+    if (rejectedCount > 0) {
+        log.warn(`bootstrapLegacyStore: skipped ${rejectedCount} rejected value(s) found in legacy mirrors`);
+    }
+}
+function importLegacyIndexAndStats(db, hippoRoot) {
+    const legacyIndex = loadLegacyIndexFile(hippoRoot);
+    setMeta(db, 'last_retrieval_ids', JSON.stringify(legacyIndex.last_retrieval_ids ?? []));
+    // LC1: legacy index.json predates last_trace_id, so this is '' for every
+    // pre-v40 store — harmless, matches the ensureMetaDefaults default.
+    // Coerce like its neighbors below coerce theirs (independent-review-critic
+    // LOW finding): accept only a clean digit string, else fall back to ''
+    // rather than trusting whatever a hand-edited/corrupt index.json carries.
+    const legacyTraceId = String(legacyIndex.last_trace_id ?? '');
+    setMeta(db, 'last_trace_id', /^\d+$/.test(legacyTraceId) ? legacyTraceId : '');
+    const legacyStats = loadLegacyStatsFile(hippoRoot);
+    setMeta(db, 'total_remembered', String(Number(legacyStats.total_remembered ?? 0)));
+    setMeta(db, 'total_recalled', String(Number(legacyStats.total_recalled ?? 0)));
+    setMeta(db, 'total_forgotten', String(Number(legacyStats.total_forgotten ?? 0)));
+    const runs = Array.isArray(legacyStats.consolidation_runs) ? legacyStats.consolidation_runs : [];
+    const insertRun = db.prepare(`INSERT INTO consolidation_runs(timestamp, decayed, merged, removed) VALUES (?, ?, ?, ?)`);
+    for (const run of runs) {
+        if (!isPlainJsonObject(run))
+            continue;
+        const row = run;
+        insertRun.run(String(row.timestamp ?? new Date().toISOString()), Number(row.decayed ?? 0), Number(row.merged ?? 0), Number(row.removed ?? 0));
+    }
+}
+export function loadLegacyEntriesFromMarkdown(hippoRoot) {
+    const entries = [];
+    for (const layer of [Layer.Buffer, Layer.Episodic, Layer.Semantic]) {
+        const dir = layerDir(hippoRoot, layer);
+        if (!fs.existsSync(dir))
+            continue;
+        for (const file of fs.readdirSync(dir)) {
+            if (!file.endsWith('.md'))
+                continue;
+            const raw = fs.readFileSync(path.join(dir, file), 'utf8');
+            const entry = deserializeEntry(raw);
+            if (entry)
+                entries.push(entry);
+        }
+    }
+    return entries;
+}
+function loadLegacyIndexFile(hippoRoot) {
+    const indexPath = path.join(hippoRoot, 'index.json');
+    if (!fs.existsSync(indexPath)) {
+        return { version: 1, entries: {}, last_retrieval_ids: [], last_trace_id: null };
+    }
+    try {
+        // SAFETY: index.json is only ever written by writeIndexMirror below,
+        // which always serializes a HippoIndex; a hand-edited or corrupted file
+        // that violates the shape falls through to the catch block's fallback.
+        return JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+    }
+    catch (err) {
+        log.debug(`store: unreadable index.json read as empty: ${err instanceof Error ? err.message : String(err)}`);
+        return { version: 1, entries: {}, last_retrieval_ids: [], last_trace_id: null };
+    }
+}
+function loadLegacyStatsFile(hippoRoot) {
+    const statsPath = path.join(hippoRoot, 'stats.json');
+    if (!fs.existsSync(statsPath)) {
+        return {
+            total_remembered: 0,
+            total_recalled: 0,
+            total_forgotten: 0,
+            consolidation_runs: [],
+        };
+    }
+    try {
+        // SAFETY: stats.json is only ever written by writeStatsMirror below,
+        // which always emits exactly these four fields; callers additionally
+        // guard every read with `?? 0` / `Array.isArray`, tolerating a
+        // hand-edited or corrupted file even if this optimistic cast is wrong.
+        return JSON.parse(fs.readFileSync(statsPath, 'utf8'));
+    }
+    catch (err) {
+        log.debug(`store: unreadable stats.json read as zero: ${err instanceof Error ? err.message : String(err)}`);
+        return {
+            total_remembered: 0,
+            total_recalled: 0,
+            total_forgotten: 0,
+            consolidation_runs: [],
+        };
+    }
+}
+//# sourceMappingURL=open.js.map