hippo-memory 1.68.0 → 1.70.0

package/dist/{project-merge.js → sharing/project-merge.js}

@@ -1,23 +1,25 @@
 // `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { setAsideRow } from './agent-memories/apply.js';
-import { transcriptNotesProject } from './agent-memories/claude-code.js';
-import { containerId, containerPrefix } from './agent-memories/source.js';
-import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from './agent-memories/tools.js';
-import { appendAuditEvent, queryAuditEvents } from './audit.js';
-import { isSharedStore } from './config.js';
-import { withBackup } from './db/backup.js';
-import { getMeta, setMeta } from './db/meta.js';
-import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from './dormant.js';
-import { processEnv } from './env.js';
-import { calculateStrength } from './memory.js';
-import { isObjectLike, isStringValue } from './capture-contract.js';
-import { isGlobalStoreRoot, projectNames, resolveProjectIdentity } from './project-identity.js';
-import { duplicateKey } from './same-text.js';
-import { removeEntryMirrors } from './store/mirrors.js';
-import { deleteEntryRowInTx, writeEntryMirrors } from './store/entry-writes.js';
-import { selectAllEntries, selectLiveEntriesBySourcePrefix } from './store/entry-reads.js';
+import { setAsideRow } from '../agent-memories/apply.js';
+import { transcriptNotesProject } from '../agent-memories/claude-code.js';
+import { containerId, containerPrefix } from '../agent-memories/source.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from '../core/agent-memory-tools.js';
+import { appendAuditEvent, queryAuditEvents } from '../store/audit.js';
+import { isSharedStore } from '../core/config.js';
+import { withTrialScope, withWriteScope } from '../db/index.js';
+import { withBackup } from '../db/backup.js';
+import { getMeta, setMeta } from '../db/meta.js';
+import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from '../store/dormant.js';
+import { processEnv } from '../util/env.js';
+import { calculateStrength } from '../core/memory.js';
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
+import { isGlobalStoreRoot, projectNames, resolveProjectIdentity } from '../core/project-identity.js';
+import { duplicateKey } from '../util/same-text.js';
+import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin } from '../store/compactions.js';
+import { removeEntryMirrors } from '../store/mirrors.js';
+import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors } from '../store/entry-writes.js';
+import { selectAllEntries, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
 const ACTOR = 'cli';
 function isImport(entry) {
     return entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX);
@@ -50,19 +52,7 @@ export function listProjects(db, tenantId) {
     }).sort((a, b) => b.newest.localeCompare(a.newest));
 }
 function inTransaction(db, dryRun, body) {
-    db.exec(dryRun ? 'BEGIN' : 'BEGIN IMMEDIATE');
-    try {
-        const out = body();
-        db.exec(dryRun ? 'ROLLBACK' : 'COMMIT');
-        return out;
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* already rolled back; keep the original error */ }
-        throw err;
-    }
+    return dryRun ? withTrialScope(db, 'merge_projects', body) : withWriteScope(db, 'merge_projects', body);
 }
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export function validateMergeNames(from, into) {
@@ -103,8 +93,7 @@ function foldInTx(db, tenantId, from, into) {
     }
     const gone = new Set(setAside);
     const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
-    db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND origin_project = ?`)
-        .run(into, tenantId, from);
+    restampOriginProjectAt(db, tenantId, from, into);
     const dormantRestamped = [];
     for (const snap of listDormantSnapshots(db, tenantId)) {
         if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
@@ -112,8 +101,7 @@ function foldInTx(db, tenantId, from, into) {
         replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
         dormantRestamped.push(snap.entry.id);
     }
-    const compactions = Number(db.prepare(`UPDATE compactions SET origin_project = ? WHERE tenant_id = ? AND origin_project = ?`)
-        .run(into, tenantId, from).changes ?? 0);
+    const compactions = restampCompactionOrigin(db, tenantId, from, into);
     return { setAside, restamped, dormantRestamped, compactions };
 }
 /** Tool, note key and hash of an import, without the container, whose id hashes the project name. */
@@ -134,9 +122,7 @@ function strayImports(db, hippoRoot, tenantId) {
         return copies;
     const machine = { platform: process.platform, env: processEnv() };
     const { platform } = machine;
-    // SAFETY: the SELECT names the two columns of the row type.
-    const sessions = db.prepare(`SELECT DISTINCT transcript_path AS transcript, cwd FROM compactions WHERE tenant_id = ? AND transcript_path IS NOT NULL`)
-        .all(tenantId);
+    const sessions = compactionTranscripts(db, tenantId);
     const owners = new Map();
     for (const { transcript, cwd } of sessions) {
         const project = transcriptNotesProject(transcript, cwd, machine);
@@ -172,9 +158,7 @@ function planFolds(db, hippoRoot, tenantId, globalFolds) {
     const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
     if (!isGlobalStoreRoot(hippoRoot))
         return { folds: ownLegacyFold(db, hippoRoot, tenantId).filter((f) => !chosen.has(f.from)), collisions: [] };
-    // SAFETY: the SELECT names the two columns of the row type.
-    const rows = db.prepare(`SELECT DISTINCT origin_project AS origin, cwd FROM compactions WHERE tenant_id = ? AND origin_project <> '' AND cwd IS NOT NULL`)
-        .all(tenantId);
+    const rows = compactionOriginsWithCwd(db, tenantId);
     const today = new Map();
     for (const { origin, cwd } of rows) {
         if (fs.existsSync(cwd))
@@ -203,8 +187,7 @@ function ownLegacyFold(db, hippoRoot, tenantId) {
     const { name, legacyName } = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
     if (legacyName === '' || legacyName === name)
         return [];
-    const heldIn = (table) => db.prepare(`SELECT 1 FROM ${table} WHERE tenant_id = ? AND origin_project = ? LIMIT 1`).get(tenantId, legacyName) !== undefined;
-    const held = heldIn('memories') || heldIn('compactions') || listDormantSnapshots(db, tenantId).some((s) => s.entry.origin_project === legacyName);
+    const held = holdsOrigin(db, 'memories', tenantId, legacyName) || holdsOrigin(db, 'compactions', tenantId, legacyName) || listDormantSnapshots(db, tenantId).some((s) => s.entry.origin_project === legacyName);
     return held ? [{ from: legacyName, into: name }] : [];
 }
 function foldOf(value) {
@@ -285,9 +268,7 @@ export function repairProjects(db, hippoRoot, opts) {
         const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
         const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
         const plan = planUserGlobalRepair(db, tenantId, []);
-        const stamp = db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND id = ?`);
-        for (const { id, origin } of plan.toProject)
-            stamp.run(origin, tenantId, id);
+        stampOriginProjectsAt(db, tenantId, plan.toProject);
         const aside = new Set(plan.setAside);
         const now = new Date();
         for (const row of selectAllEntries(db, tenantId).filter((e) => aside.has(e.id))) {

package/dist/{scope.js → sharing/scope.js}

@@ -1,4 +1,4 @@
-import { envGstackSkill, envOpenclawSkill, envScope } from './env.js';
+import { envGstackSkill, envOpenclawSkill, envScope } from '../util/env.js';
 /**
  * Detect the current operational scope from environment signals.
  * Returns a scope name string (no prefix), or null if no scope detected.

package/dist/{shared.d.ts → sharing/shared.d.ts}

@@ -4,10 +4,10 @@
  * Resolution: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/
  * Local .hippo/ stores are per-project.
  */
-import { MemoryEntry } from './memory.js';
-import { type SearchResult, type ResultCost } from './search/types.js';
-import type { HybridVectorCandidates } from './search/vector.js';
-import type { DatabaseSyncLike } from './db.js';
+import { MemoryEntry } from '../core/memory.js';
+import { type SearchResult, type ResultCost } from '../core/search-types.js';
+import type { HybridVectorCandidates } from '../search/vector.js';
+import type { DatabaseSyncLike } from '../db/index.js';
 /**
  * Returns the path to the global Hippo store.
  * Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/
@@ -17,15 +17,16 @@ export declare function getGlobalRoot(): string;
  * Ensure the global store exists.
  */
 export declare function initGlobal(): void;
-/**
- * Copy a local memory entry to the global store.
- * Assigns a new ID (prefixed with 'g_') to avoid collisions.
- * Returns the new global entry.
- */
+/** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
 export declare function promoteToGlobal(localRoot: string, id: string, opts?: {
     actor?: string;
     tenantId?: string;
     afterWrite?: (db: DatabaseSyncLike, globalId: string) => void;
+    /** Also writes one `promote` audit row for the copy ({sourceId}), in the copy's own transaction. */
+    auditAs?: {
+        tenantId: string;
+        actor: string;
+    };
 }): MemoryEntry;
 export interface SearchOptions {
     budget?: number;

package/dist/{shared.js → sharing/shared.js}

@@ -4,35 +4,36 @@
  * Resolution: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/
  * Local .hippo/ stores are per-project.
  */
-import { BadRequestError, NotFoundError } from './api-errors.js';
+import { BadRequestError, NotFoundError } from '../core/api-errors.js';
+import { compareScoresDesc } from '../core/compare.js';
 import * as fs from 'fs';
 import * as path from 'path';
-import { generateId, COMPACTION_MEMORY_TAG } from './memory.js';
-import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from './agent-memories/tools.js';
-import { initStore } from './store/open.js';
-import { writeEntry } from './store/entry-writes.js';
-import { loadAllEntries, readEntry } from './store/entry-reads.js';
-import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from './store/search-rows.js';
-import { tallySources } from './store/candidates.js';
-import { loadIndex } from './store/index-and-stats.js';
-import { isPersonalScope, passesScopeFilterForRecall, passesCliRecallScopeFilter } from './recall-scope.js';
-import { search } from './search/bm25-search.js';
-import { hybridSearch } from './search/hybrid.js';
-import { fitBudget } from './search/finalize.js';
-import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from './search/types.js';
-import { evalNow } from './ablation.js';
-import { fallbackOrigin, classifyOriginProject, resolveGlobalRootDir, resolveProjectIdentity } from './project-identity.js';
-import { isSharedStore } from './config.js';
-import { detectSecret } from './secret-detect.js';
-import { isQuarantineScope } from './quarantine.js';
-import { RejectedValueError } from './rejection.js';
-import { embedMemory, embedAll } from './embeddings.js';
-import { duplicateKey, storedTextKeys } from './same-text.js';
-import { isReusable } from './memory-quality.js';
-import { log } from './log.js';
+import { generateId, COMPACTION_MEMORY_TAG } from '../core/memory.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from '../core/agent-memory-tools.js';
+import { initStore } from '../store/open.js';
+import { writeEntry } from '../store/entry-writes.js';
+import { loadAllEntries, readEntry } from '../store/entry-reads.js';
+import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
+import { tallySources } from '../store/candidates.js';
+import { isPersonalScope, passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../store/recall-scope.js';
+import { search } from '../search/bm25-search.js';
+import { hybridSearch } from '../search/hybrid.js';
+import { fitBudget } from '../search/finalize.js';
+import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from '../core/search-types.js';
+import { evalNow } from '../core/ablation.js';
+import { fallbackOrigin, classifyOriginProject, resolveGlobalRootDir, resolveProjectIdentity } from '../core/project-identity.js';
+import { isSharedStore } from '../core/config.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { RejectedValueError } from '../store/rejection.js';
+import { embedMemory, embedAll } from '../store/embeddings/index.js';
+import { duplicateKey, storedTextKeys } from '../util/same-text.js';
+import { isReusable } from '../core/memory-quality.js';
+import { errorMessage, log } from '../util/log.js';
+import { appendAuditEvent } from '../store/audit.js';
 // The rows are already copied; a failed background embed only delays vectors, so it warns instead of throwing.
 function logEmbedAllFailure(caller, err) {
-    log.warn(`${caller}: background embed failed (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
+    log.warn(`${caller}: background embed failed (${errorMessage(err)}); run 'hippo embed' to backfill`);
 }
 /**
  * Returns the path to the global Hippo store.
@@ -56,11 +57,16 @@ export function initGlobal() {
         initStore(globalRoot);
     }
 }
-/**
- * Copy a local memory entry to the global store.
- * Assigns a new ID (prefixed with 'g_') to avoid collisions.
- * Returns the new global entry.
- */
+/** The copy's write hook: the `promote` row when asked for, then the caller's own hook, both in the copy's transaction. */
+function promoteHook(sourceId, auditAs, afterWrite) {
+    if (!auditAs)
+        return afterWrite;
+    return (db, globalId) => {
+        appendAuditEvent(db, { tenantId: auditAs.tenantId, actor: auditAs.actor, op: 'promote', targetId: globalId, metadata: { sourceId } });
+        afterWrite?.(db, globalId);
+    };
+}
+/** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
 export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
     if (!entry)
@@ -88,7 +94,7 @@ export function promoteToGlobal(localRoot, id, opts) {
         source: isSharedStore(localRoot) ? `shared::${new Date().toISOString()}` : `promoted:${localRoot}`,
         origin_project: entry.origin_project ?? fallbackOrigin(localRoot),
     };
-    writeEntry(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: opts?.afterWrite });
+    writeEntry(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: promoteHook(id, opts?.auditAs, opts?.afterWrite) });
     // Fire-and-forget: embedMemory gates on availability and never rejects.
     void embedMemory(globalRoot, globalEntry);
     return globalEntry;
@@ -108,8 +114,24 @@ export function searchBoth(query, localRoot, globalRoot, options = {}) {
     // Search each store with full budget, then blend
     const localResults = search(query, localEntries, { budget, now, minResults });
     const globalResults = search(query, globalEntries, { budget, now, minResults });
+    const deduped = dedupeByContent(tagLocalAndGlobal(localResults, globalResults));
+    // PLAIN stable score sort on purpose: both inputs are deterministically ordered,
+    // and an exact tie keeps the LOCAL result ahead of the global one (concat order).
+    deduped.sort((a, b) => compareScoresDesc(a.score, b.score));
+    // Apply combined token budget (guarantee at least minResults items)
+    const results = [];
+    let usedTokens = 0;
+    for (let i = 0; i < deduped.length; i++) {
+        if (results.length >= effectiveMin && usedTokens + deduped[i].tokens > budget)
+            continue;
+        usedTokens += deduped[i].tokens;
+        results.push(deduped[i]);
+    }
+    return results;
+}
+function tagLocalAndGlobal(localResults, globalResults) {
     // Tag global results. Local memories get a configurable priority bump.
-    const tagged = [
+    return [
         ...localResults.map((r) => ({
             ...r,
             isGlobal: false,
@@ -120,28 +142,17 @@ export function searchBoth(query, localRoot, globalRoot, options = {}) {
         })),
         ...globalResults.map((r) => ({ ...r, isGlobal: true })),
     ];
+}
+function dedupeByContent(tagged) {
     // Remove duplicates by content (local/global IDs differ after promote/share)
     const seen = new Set();
-    const deduped = tagged.filter((r) => {
+    return tagged.filter((r) => {
         const key = duplicateKey(r.entry.content);
         if (seen.has(key))
             return false;
         seen.add(key);
         return true;
     });
-    // PLAIN stable score sort on purpose: both inputs are deterministically ordered,
-    // and an exact tie keeps the LOCAL result ahead of the global one (concat order).
-    deduped.sort((a, b) => b.score - a.score);
-    // Apply combined token budget (guarantee at least minResults items)
-    const results = [];
-    let usedTokens = 0;
-    for (let i = 0; i < deduped.length; i++) {
-        if (results.length >= effectiveMin && usedTokens + deduped[i].tokens > budget)
-            continue;
-        usedTokens += deduped[i].tokens;
-        results.push(deduped[i]);
-    }
-    return results;
 }
 /**
  * Hybrid search across both local and global stores, using embeddings when available.
@@ -213,7 +224,7 @@ export async function rankBothStores(query, roots, entries, vectorCandidates, op
     });
     // PLAIN stable score sort on purpose -- see searchBoth above;
     // same rationale (deterministic inputs + stability; local-first on ties).
-    deduped.sort((a, b) => b.score - a.score);
+    deduped.sort((a, b) => compareScoresDesc(a.score, b.score));
     return fitBudget(deduped, budget, minResults ?? 1, cost);
 }
 // ---------------------------------------------------------------------------
@@ -283,21 +294,7 @@ export function shareMemory(localRoot, id, options = {}) {
     const entry = readEntry(localRoot, id, options.tenantId);
     if (!entry)
         throw new NotFoundError(`Memory not found: ${id}`);
-    // Secret producer veto: secrets never go to the global store, not even
-    // with --force. Explicit and loud - a silent null would read as "low
-    // transfer score" and invite retries.
-    const secret = detectSecret(entry);
-    if (secret.flagged) {
-        throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
-            `Secrets stay in their owning project's store.`);
-    }
-    // A quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
-    if (isQuarantineScope(entry.scope)) {
-        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
-    }
-    if (isPersonalScope(entry.scope ?? null)) {
-        throw new BadRequestError(`Refusing to share ${id}: it is a personal memory and stays with its owner on this server.`);
-    }
+    assertShareable(entry, id);
     const score = transferScore(entry);
     if (score < 0.3 && !options.force)
         return null;
@@ -323,6 +320,23 @@ export function shareMemory(localRoot, id, options = {}) {
     }
     return globalEntry;
 }
+function assertShareable(entry, id) {
+    // Secret producer veto: secrets never go to the global store, not even
+    // with --force. Explicit and loud - a silent null would read as "low
+    // transfer score" and invite retries.
+    const secret = detectSecret(entry);
+    if (secret.flagged) {
+        throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
+            `Secrets stay in their owning project's store.`);
+    }
+    // A quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    if (isQuarantineScope(entry.scope)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
+    if (isPersonalScope(entry.scope ?? null)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is a personal memory and stays with its owner on this server.`);
+    }
+}
 /**
  * List all projects that have contributed memories to the global store.
  * Parses the source field for 'shared:<project>:' or 'promoted:<path>' patterns.
@@ -489,9 +503,10 @@ export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
     // tenant-scoped local store; writeEntry on each row carries the tenant if
     // the local-root context provides one.
     const globalEntries = loadAllEntries(globalRoot);
-    const localIndex = loadIndex(localRoot);
     const textKey = (e) => `${e.tenantId}\n${e.content}`;
-    const localText = new Set(loadAllEntries(localRoot).map(textKey));
+    const localEntries = loadAllEntries(localRoot);
+    const localIds = new Set(localEntries.map((e) => e.id));
+    const localText = new Set(localEntries.map(textKey));
     // Syncing down must not re-import what ambient context
     // excludes - other-project rows are skipped by default and secret rows
     // are never copied. origin_project is preserved on the copy (writeEntry
@@ -502,7 +517,7 @@ export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
     let rejected = 0;
     for (const entry of globalEntries) {
         // Skip if already present by ID
-        if (localIndex.entries[entry.id])
+        if (localIds.has(entry.id))
             continue;
         // Only the global store's user pass sets an imported note's row aside, so a copy would outlive the note.
         if (entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX))
@@ -511,22 +526,31 @@ export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
             continue;
         if (detectSecret(entry).flagged)
             continue;
-        if (!opts.includeCrossProject &&
-            classifyOriginProject(entry.origin_project, currentProject) === 'cross-project')
+        if (!opts.includeCrossProject && classifyOriginProject(entry.origin_project, currentProject) === 'cross-project')
+            continue;
+        if (!writeUnlessRejected(localRoot, entry)) {
+            rejected++;
             continue;
-        try {
-            writeEntry(localRoot, entry);
-        }
-        catch (err) {
-            if (err instanceof RejectedValueError) {
-                rejected++;
-                continue;
-            }
-            throw err;
         }
         localText.add(textKey(entry));
         count++;
     }
+    finishSyncDown(localRoot, count, rejected);
+    return count;
+}
+/** False when the local store rejects the value; any other failure still throws. */
+function writeUnlessRejected(localRoot, entry) {
+    try {
+        writeEntry(localRoot, entry);
+        return true;
+    }
+    catch (err) {
+        if (err instanceof RejectedValueError)
+            return false;
+        throw err;
+    }
+}
+function finishSyncDown(localRoot, count, rejected) {
     if (rejected > 0) {
         log.warn(`syncGlobalToLocal: skipped ${rejected} rejected value(s) (run \`hippo unreject\` on the local store to allow).`);
     }
@@ -535,6 +559,5 @@ export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
     if (count > 0) {
         void embedAll(localRoot).catch((err) => logEmbedAllFailure('syncGlobalToLocal', err));
     }
-    return count;
 }
 //# sourceMappingURL=shared.js.map

package/dist/{ambient-store.d.ts → store/ambient.d.ts}

@@ -1,4 +1,4 @@
-import { type AmbientTallies } from './ambient.js';
+import { type AmbientTallies } from '../core/ambient.js';
 /** The rows an ambient summary describes: a context read's envelope, origin partition and tag secret veto. */
 export interface AmbientStoreFilter {
     exactScope?: string;
@@ -13,4 +13,4 @@ export interface AmbientStoreFilter {
 /** Whole-store ambient tallies in one aggregate pass, no row loaded. Content-pattern secrets and session-local
  *  rows (own compaction items, a printed handoff's digest) still count: only injection drops them. */
 export declare function loadAmbientTallies(hippoRoot: string, tenantId: string, filter: AmbientStoreFilter): AmbientTallies;
-//# sourceMappingURL=ambient-store.d.ts.map
+//# sourceMappingURL=ambient.d.ts.map

package/dist/{ambient-store.js → store/ambient.js}

@@ -1,12 +1,12 @@
-import { closeHippoDb } from './db.js';
-import { strengthSql } from './memory.js';
+import { closeHippoDb } from '../db/index.js';
+import { strengthSql } from '../core/memory.js';
 import { scopeAdmitSql } from './recall-scope.js';
-import { SECRET_TAGS } from './secret-detect.js';
-import { openStore } from './store/open.js';
-import { originInSql } from './project-identity.js';
-import { isErrorTagged } from './ambient.js';
-// A malformed or non-array JSON list reads as empty, as parseJsonArray does, instead of failing json_each.
-const jsonList = (column) => `(CASE WHEN json_valid(${column}) AND json_type(${column}) = 'array' THEN ${column} ELSE '[]' END)`;
+import { SECRET_TAGS } from '../util/secret-detect.js';
+import { openStore } from './open.js';
+import { jsonList } from './candidates.js';
+import { originInSql } from '../core/project-identity.js';
+import { isErrorTagged } from '../core/ambient.js';
+import { DAY_MS } from '../util/time.js';
 // SHORTCUT: mirrors loadContextCandidates' WHERE (request-path snapshots pin the match); share it once store.ts is split.
 function contextRowsWhere(tenantId, filter) {
     const where = ['tenant_id = ?', `COALESCE(superseded_by, '') = ''`, `COALESCE(kind, '') != 'archived'`];
@@ -40,7 +40,7 @@ function secretTaggedSql() {
 export function loadAmbientTallies(hippoRoot, tenantId, filter) {
     const { where, params } = contextRowsWhere(tenantId, filter);
     const secret = secretTaggedSql();
-    const sevenDaysAgo = new Date(filter.now.getTime() - 7 * 86400000).toISOString();
+    const sevenDaysAgo = new Date(filter.now.getTime() - 7 * DAY_MS).toISOString();
     const db = openStore(hippoRoot);
     try {
         // SAFETY: one aggregate row whose columns are the aliases named below. Tag lists come back as one JSON array of
@@ -89,4 +89,4 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
         closeHippoDb(db);
     }
 }
-//# sourceMappingURL=ambient-store.js.map
+//# sourceMappingURL=ambient.js.map

package/dist/store/audit-event.d.ts

@@ -1,17 +1,23 @@
-import { openHippoDb } from '../db.js';
-import { type AuditOp } from '../audit.js';
-import { RejectedValueError } from '../rejection.js';
-import type { JsonValue } from '../json.js';
+import { openHippoDb } from '../db/index.js';
+import { type AuditOp } from './audit.js';
+import { RejectedValueError } from './rejection.js';
+import type { JsonValue } from '../util/json.js';
+export interface AuditOptions {
+    readonly targetId?: string;
+    readonly metadata?: Record<string, JsonValue>;
+    readonly actor?: string;
+    readonly tenantId?: string;
+}
 /**
  * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
  * log can never crash the surrounding mutation — the SQLite store is still the
  * source of truth and audit failures are diagnosable from the missing rows.
  */
-export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, targetId?: string, metadata?: Record<string, JsonValue>, actor?: string, tenantId?: string): void;
+export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, options?: AuditOptions): void;
 /**
  * Refusal audit for the rejected-value guard. Written by the
  * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and api.supersede's
+ * there, so this lands in a fresh implicit transaction) and commitSupersede's
  * catch (after its own ROLLBACK) — never inside a scope the caller's own
  * rollback could claw back. Best-effort `audit()` semantics: never throws.
  */

package/dist/store/audit-event.js

@@ -1,11 +1,12 @@
-import { resolveTenantId } from '../tenant.js';
-import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
+import { resolveTenantId } from './tenant.js';
+import { appendAuditEvent, reportAuditWriteFailure } from './audit.js';
 /**
  * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
  * log can never crash the surrounding mutation — the SQLite store is still the
  * source of truth and audit failures are diagnosable from the missing rows.
  */
-export function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
+export function audit(db, op, options = {}) {
+    const { targetId, metadata, actor = 'cli', tenantId } = options;
     try {
         appendAuditEvent(db, {
             tenantId: tenantId ?? resolveTenantId({}),
@@ -23,11 +24,11 @@ export function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
 /**
  * Refusal audit for the rejected-value guard. Written by the
  * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and api.supersede's
+ * there, so this lands in a fresh implicit transaction) and commitSupersede's
  * catch (after its own ROLLBACK) — never inside a scope the caller's own
  * rollback could claw back. Best-effort `audit()` semantics: never throws.
  */
 export function auditRejectionRefusal(db, err, actor) {
-    audit(db, 'reject_refusal', err.entryId, { digest: err.digest, reason: err.reason }, actor, err.tenantId);
+    audit(db, 'reject_refusal', { targetId: err.entryId, metadata: { digest: err.digest, reason: err.reason }, actor, tenantId: err.tenantId });
 }
 //# sourceMappingURL=audit-event.js.map

package/dist/{audit.d.ts → store/audit.d.ts}

@@ -1,7 +1,7 @@
-import { type MemoryEntry } from './memory.js';
-import type { DatabaseSyncLike } from './db.js';
+import { type MemoryEntry } from '../core/memory.js';
+import { type DatabaseSyncLike } from '../db/index.js';
 import type { JsonObject } from './working-memory.js';
-import { type KeysetPosition } from './keyset.js';
+import { type KeysetPosition } from '../util/keyset.js';
 export type AuditSeverity = 'warning' | 'error';
 export interface AuditIssue {
     memoryId: string;
@@ -32,10 +32,14 @@ export type AuditQueryFields = {
 };
 export declare function auditQueryFields(query: string): AuditQueryFields;
 export declare function appendAuditEvent(db: DatabaseSyncLike, opts: AppendAuditOpts): void;
+/** One audit row in the store under `hippoRoot`, as its own write. */
+export declare function recordAuditEvent(hippoRoot: string, event: AppendAuditOpts): void;
 /** For callers that keep a mutation when its audit row fails: the failure is logged and counted, never silent. */
 export declare function reportAuditWriteFailure(op: AuditOp, reason: string, targetId?: string | null): void;
 /** Audit rows this process failed to write; the loopback `/health` body reports it. */
 export declare function auditWriteFailureCount(): number;
+/** Adds the failures a store worker counted on its own thread, so the process reports one number. */
+export declare function addAuditWriteFailures(count: number): void;
 export interface QueryAuditOpts {
     tenantId: string;
     op?: AuditOp;
@@ -68,4 +72,24 @@ export interface ListAuditAfterOpts {
  * the last id returned, never from a count.
  */
 export declare function listAuditEventsAfter(db: DatabaseSyncLike, opts: ListAuditAfterOpts): AuditEvent[];
+/** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike queryAuditEvents it has no row cap. */
+export declare function confirmedOutcomeTimes(hippoRoot: string, tenantId: string): Map<string, string>;
+/** An audit row that did not land, with what its write threw. */
+export interface FailedAuditEvent {
+    event: AppendAuditOpts;
+    error: unknown;
+}
+/** Appends each event as its own write on one handle, so a row that fails drops only itself. Returns the rows that failed, for the caller to report. */
+export declare function recordAuditEventsRowByRow(hippoRoot: string, events: readonly AppendAuditOpts[]): FailedAuditEvent[];
+export interface AuditPrune {
+    tenantId: string;
+    /** ISO time; rows with `ts` before it go. */
+    cutoff: string;
+    actor: string;
+    olderThanDays: number;
+    /** Count the rows and delete nothing. */
+    dryRun: boolean;
+}
+/** Deletes a tenant's audit rows older than the cutoff and records the prune in the same write scope, so neither lands alone; returns the row count. */
+export declare function pruneAuditRows(hippoRoot: string, prune: AuditPrune): number;
 //# sourceMappingURL=audit.d.ts.map