hippo-memory 1.69.0 → 1.71.0

package/dist/decisions.js

@@ -1,326 +0,0 @@
-/**
- * Decision first-class object.
- *
- * `hippo decide` used to write only a tagged memory (tags ['decision'], source
- * 'decision') with a 90-day half-life, so an in-force decision decayed out of
- * recall even though it was never reversed. The `decisions` table is now the
- * source of truth: a decision stays `active` regardless of memory decay, and
- * `hippo decide list --status active` is authoritative. A memory row still
- * mirrors the decision for recall surfaces but is NOT canonical — memory_id is
- * NULLABLE with ON DELETE SET NULL so forget/consolidate/archive gracefully
- * orphans the decision row.
- *
- * Lifecycle: active -> superseded (a newer decision replaces it; superseded_by
- * points to the successor) or active -> closed (retired with no successor).
- *
- * Tenant scoping: every helper requires tenantId. BEFORE INSERT/UPDATE triggers
- * enforce decisions.tenant_id == the referenced memory's tenant_id, and a
- * superseded_by same-tenant trigger makes cross-tenant supersession
- * unrepresentable. Mirrors the predictions pattern (src/predictions.ts).
- *
- * Dual-write atomicity: `saveDecision` writes the memory + decisions row (and,
- * when superseding, the old row's UPDATE) inside writeEntry's SAVEPOINT
- * 'write_entry' (store/entry-writes.ts) via the afterWrite hook, so a failure in any
- * step rolls all of them back. Pattern matches savePrediction (predictions.ts).
- */
-import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
-import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store/entry-writes.js';
-import { assertTenantId } from './tenant.js';
-import { markGraphDirty, removeGraphEntitiesForObject } from './graph/write.js';
-import { createMemory, Layer } from './memory.js';
-import { appendAuditEvent } from './audit.js';
-import { objectHalfLifeDays } from './half-life-migration.js';
-import { keysetAfter } from './keyset.js';
-export const VALID_DECISION_STATES = new Set([
-    'active',
-    'superseded',
-    'closed',
-]);
-function rowToDecision(row) {
-    return {
-        id: row.id,
-        memoryId: row.memory_id,
-        tenantId: row.tenant_id,
-        decisionText: row.decision_text,
-        context: row.context,
-        // SAFETY: status is DB-constrained to VALID_DECISION_STATES; this module
-        // is the only writer and always inserts one of those literal strings.
-        status: row.status,
-        supersededBy: row.superseded_by,
-        supersededAt: row.superseded_at,
-        closedAt: row.closed_at,
-        createdAt: row.created_at,
-    };
-}
-const DECISION_COLS = `
-  id, memory_id, tenant_id, decision_text, context, status,
-  superseded_by, superseded_at, closed_at, created_at
-`;
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/** The legacy `hippo decide` memory mirror for a decision. */
-function buildDecisionMemory(hippoRoot, tenantId, opts) {
-    const content = opts.context
-        ? `${opts.decisionText}\n\nContext: ${opts.context}`
-        : opts.decisionText;
-    const tags = ['decision', ...(opts.extraTags ?? [])];
-    return createMemory(content, {
-        tags,
-        layer: Layer.Semantic,
-        confidence: 'verified',
-        source: 'decision',
-        baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
-        tenantId,
-    });
-}
-// Preflight the supersede target BEFORE inserting the new row. The new
-// row's autoincrement id could otherwise collide with a non-existent
-// supersedesDecisionId (e.g. superseding id 1 on an empty store, where the
-// INSERT below would itself become id 1), making the row supersede itself.
-// Validating first means the new row is never a candidate for its own
-// supersede UPDATE.
-function preflightDecisionSupersede(db, tenantId, supersedesId) {
-    // SAFETY: row shape matches the single `status` column named in the SELECT below.
-    const pred = db.prepare(`SELECT status FROM decisions WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
-    if (!pred) {
-        throw new NotFoundError(`saveDecision: decision ${supersedesId} to supersede not found for tenant ${tenantId}`);
-    }
-    if (pred.status !== 'active') {
-        throw new ConflictError(`saveDecision: decision ${supersedesId} is not active (status='${pred.status}'); only active decisions can be superseded.`);
-    }
-}
-function insertDecisionRow(db, memoryId, tenantId, opts, now) {
-    const result = db.prepare(`
-    INSERT INTO decisions(
-      memory_id, tenant_id, decision_text, context,
-      status, superseded_by, superseded_at, closed_at, created_at
-    ) VALUES (?, ?, ?, ?, 'active', NULL, NULL, NULL, ?)
-  `).run(memoryId, tenantId, opts.decisionText, opts.context ?? null, now);
-    return Number(result.lastInsertRowid ?? 0);
-}
-// Supersede the (preflight-validated) prior active decision in the SAME
-// SAVEPOINT, atomic with the new row. The `id != decisionId` exclusion is
-// defense-in-depth against the self-match described above; combined with
-// the preflight, a 0-change here is unreachable in the single-writer txn.
-function supersedeDecisionRow(db, tenantId, actor, supersedesId, decisionId, now) {
-    const sup = db.prepare(`
-    UPDATE decisions
-    SET status = 'superseded', superseded_by = ?, superseded_at = ?
-    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-  `).run(decisionId, now, supersedesId, tenantId, decisionId);
-    if (sup.changes === 0) {
-        throw new ConflictError(`saveDecision: decision ${supersedesId} could not be superseded (no longer active or self-reference).`);
-    }
-    appendAuditEvent(db, {
-        tenantId,
-        actor,
-        op: 'decision_supersede',
-        targetId: String(supersedesId),
-        metadata: {
-            decision_id: supersedesId,
-            superseded_by: decisionId,
-        },
-    });
-}
-/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
-function writeDecisionRow(db, memoryId, tenantId, opts, actor, now) {
-    if (opts.supersedesDecisionId !== undefined) {
-        preflightDecisionSupersede(db, tenantId, opts.supersedesDecisionId);
-    }
-    const decisionId = insertDecisionRow(db, memoryId, tenantId, opts, now);
-    if (opts.supersedesDecisionId !== undefined) {
-        supersedeDecisionRow(db, tenantId, actor, opts.supersedesDecisionId, decisionId, now);
-    }
-    // SAFETY: row's shape matches the columns named in DECISION_COLS above.
-    const row = db.prepare(`SELECT ${DECISION_COLS} FROM decisions WHERE id = ?`)
-        .get(decisionId);
-    if (!row)
-        throw new Error('saveDecision: failed to reload saved decision row');
-    // GDPR-light metadata: id + flag only, no decision_text.
-    appendAuditEvent(db, {
-        tenantId,
-        actor,
-        op: 'decision_create',
-        targetId: String(decisionId),
-        metadata: {
-            decision_id: decisionId,
-            has_context: opts.context !== undefined && opts.context !== null && opts.context !== '',
-        },
-    });
-    return row;
-}
-/**
- * Create a decision. Writes the memory mirror + the decisions row atomically
- * inside writeEntry's SAVEPOINT 'write_entry'. When supersedesDecisionId is
- * given, the referenced ACTIVE row is UPDATEd -> superseded in the SAME
- * SAVEPOINT (CAS: WHERE status='active'; throws on changes===0 so a duplicate
- * supersede aborts the whole write rather than orphaning a successor).
- *
- * The memory mirror preserves the legacy `hippo decide` shape: tags
- * ['decision', ...extraTags], source 'decision', confidence 'verified',
- * the half-life objectHalfLifeDays picks, content = "<text>\n\nContext: <context>"
- * when context is given (so existing recall output is unchanged).
- */
-export function saveDecision(hippoRoot, tenantId, opts, actor = 'cli') {
-    assertTenantId('saveDecision', tenantId);
-    if (!opts.decisionText)
-        throw new BadRequestError('saveDecision: decisionText is required');
-    const now = new Date().toISOString();
-    const mem = buildDecisionMemory(hippoRoot, tenantId, opts);
-    // Populated inside afterWrite so the INSERT, the supersede UPDATE, and the
-    // memory write all share one SAVEPOINT.
-    let savedRow;
-    writeEntry(hippoRoot, mem, {
-        actor,
-        afterWrite: (db, memoryId) => {
-            savedRow = writeDecisionRow(db, memoryId, tenantId, opts, actor, now);
-        },
-        // Post-commit hook: mark the tenant's graph dirty AFTER the DB row commits
-        // but BEFORE the markdown mirrors are written, so a mirror-write failure can
-        // never leave a committed save unflagged. markGraphDirty is fail-soft.
-        afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
-    });
-    if (!savedRow) {
-        // Unreachable unless afterWrite threw first; defensive.
-        throw new Error('saveDecision: afterWrite did not populate the row');
-    }
-    return rowToDecision(savedRow);
-}
-/**
- * Close (retire) an active decision with no successor. Updates the decisions
- * row only; the memory mirror is not mutated. CAS guard mirrors closePrediction
- * (predictions.ts): WHERE status='active'; 0 changes distinguishes not-found
- * from not-active so callers surface the right error.
- */
-export function closeDecision(hippoRoot, tenantId, id, actor = 'cli') {
-    assertTenantId('closeDecision', tenantId);
-    const now = new Date().toISOString();
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const updateResult = db.prepare(`
-        UPDATE decisions
-        SET status = 'closed', closed_at = ?
-        WHERE id = ? AND tenant_id = ? AND status = 'active'
-      `).run(now, id, tenantId);
-            if (updateResult.changes === 0) {
-                // SAFETY: row shape matches the single `status` column named in the SELECT above.
-                const existing = db.prepare(`SELECT status FROM decisions WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
-                if (!existing) {
-                    throw new NotFoundError(`closeDecision: decision ${id} not found for tenant ${tenantId}`);
-                }
-                throw new ConflictError(`closeDecision: decision ${id} is not active (status='${existing.status}'); only active decisions can be closed.`);
-            }
-            // SAFETY: row's shape matches the columns named in DECISION_COLS above.
-            const row = db.prepare(`SELECT ${DECISION_COLS} FROM decisions WHERE id = ? AND tenant_id = ?`)
-                .get(id, tenantId);
-            if (!row)
-                throw new NotFoundError(`closeDecision: decision ${id} not found after UPDATE`);
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'decision_close',
-                targetId: String(id),
-                metadata: { decision_id: id },
-            });
-            db.exec('COMMIT');
-            const closed = rowToDecision(row);
-            // After COMMIT (write lock released), before the finally closes `db`.
-            // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
-            // not only via an enqueued rebuild whose queue item is lost if the mirror is later
-            // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget. Still enqueue when a mirror exists
-            // so a concurrent rebuild re-derives consistently (harmless if it also runs).
-            removeGraphEntitiesForObject(hippoRoot, tenantId, 'decision', closed.id);
-            if (closed.memoryId) {
-                markGraphDirty(hippoRoot, tenantId, closed.memoryId);
-            }
-            return closed;
-        }
-        catch (e) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch {
-                // Ignore rollback failures — the throw below is what matters.
-            }
-            throw e;
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadDecisionById(hippoRoot, tenantId, id) {
-    assertTenantId('loadDecisionById', tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: row's shape matches the columns named in DECISION_COLS above.
-        const row = db.prepare(`SELECT ${DECISION_COLS} FROM decisions WHERE id = ? AND tenant_id = ?`)
-            .get(id, tenantId);
-        return row ? rowToDecision(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadDecisions(hippoRoot, tenantId, opts = {}) {
-    assertTenantId('loadDecisions', tenantId);
-    const limit = opts.limit ?? 100;
-    const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
-        let rows;
-        if (opts.status) {
-            if (!VALID_DECISION_STATES.has(opts.status)) {
-                throw new BadRequestError(`loadDecisions: status must be one of ${Array.from(VALID_DECISION_STATES).join('|')}; got ${opts.status}`);
-            }
-            // SAFETY: rows' shape matches the columns named in DECISION_COLS above.
-            rows = db.prepare(`
-        SELECT ${DECISION_COLS} FROM decisions
-        WHERE tenant_id = ? AND status = ?${after.sql}
-        ORDER BY created_at DESC, id DESC
-        LIMIT ?
-      `).all(tenantId, opts.status, ...after.params, limit);
-        }
-        else {
-            // SAFETY: rows' shape matches the columns named in DECISION_COLS above.
-            rows = db.prepare(`
-        SELECT ${DECISION_COLS} FROM decisions
-        WHERE tenant_id = ?${after.sql}
-        ORDER BY created_at DESC, id DESC
-        LIMIT ?
-      `).all(tenantId, ...after.params, limit);
-        }
-        return rows.map(rowToDecision);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadActiveDecisions(hippoRoot, tenantId, opts = {}) {
-    return loadDecisions(hippoRoot, tenantId, { status: 'active', limit: opts.limit });
-}
-/**
- * Resolve a `--supersedes <memory-id>` (the legacy CLI contract) to the table id
- * of the ACTIVE decision backed by that memory, or null when the memory has no
- * active decision row (a legacy pre-episode decision-tagged memory). Extracted
- * so the CLI's backward-compat path is unit-testable at the store layer without
- * exporting cmdDecide.
- */
-export function resolveActiveDecisionIdByMemory(hippoRoot, tenantId, memoryId) {
-    assertTenantId('resolveActiveDecisionIdByMemory', tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: row shape matches the single `id` column named in the SELECT above.
-        const row = db.prepare(`SELECT id FROM decisions WHERE memory_id = ? AND tenant_id = ? AND status = 'active' ORDER BY id DESC LIMIT 1`).get(memoryId, tenantId);
-        return row ? row.id : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-//# sourceMappingURL=decisions.js.map

package/dist/dedupe.d.ts

@@ -1,75 +0,0 @@
-/**
- * Store-level deduplication. Scans for memories with the same text apart
- * from spacing, keeps the stronger copy (by strength + retrieval count),
- * removes the rest.
- *
- * Extracted from cli.ts in Episode A (v1.11.3) so `api.sleep` can dedupe
- * during the consolidation pipeline without violating the cli -> api
- * dependency direction. `cmdDedup` in cli.ts continues to import and use
- * this function unchanged.
- *
- * Survivor selection is a total order as of v1.26.3
- * (docs/plans/2026-07-16-dedupe-survivor-determinism.md): strength bucket
- * desc -> retrieval_count desc -> compareEntryIdentity (content asc ->
- * layer rank -> tags -> source -> id asc; the metadata keys arrived in
- * v1.38.1, docs/plans/2026-09-04-dedupe-survivor-metadata.md). Previously
- * the strength/retrieval-count comparator could tie exactly with no terminal
- * key, so the survivor fell to load order (arrival-order-dependent); see
- * `strengthBucket` below for the bucket encoding. As of the tenant-partition
- * fix (docs/plans/2026-08-15-dedupe-tenant-partition.md) the order is scoped
- * WITHIN each tenant group; cross-tenant pairs are never compared. Raw and
- * superseded rows are not candidates at all (v1.38.1).
- */
-export interface DedupPair {
-    kept: string;
-    keptContent: string;
-    keptLayer: string;
-    keptStrength: number;
-    removed: string;
-    removedContent: string;
-    removedLayer: string;
-    removedStrength: number;
-    similarity: number;
-}
-/** Result of `deduplicateStore`: how many entries were removed, and the kept/removed pairs. */
-export interface DedupResult {
-    removed: number;
-    pairs: DedupPair[];
-}
-/**
- * Quantize a strength value into an integer "bucket" for tie comparison.
- *
- * Encodes the historical 0.01 epsilon transitively: two strengths compare
- * equal here iff they round to the same multiple of `STRENGTH_TIE_EPSILON`,
- * which (unlike a raw `Math.abs(a - b) > epsilon` check) is a genuine
- * equivalence relation — no more "A ties B, B ties C, but A beats C"
- * (see the file-level history note above).
- *
- * Non-finite input (`NaN`, `+/-Infinity`) maps to bucket `0` rather than
- * propagating: a NaN bucket would make the sort comparator return NaN,
- * silently reintroducing the non-total-order class this fix exists to kill.
- * (`null`/`undefined` already default to strength `0` via `?? 0`, same as
- * before this change.)
- *
- * Bucket-edge nuance: two strengths straddling a bucket edge (e.g. 0.0049 vs
- * 0.0051) now compare as different, where the old raw-epsilon check called
- * them tied. The flip always favors the not-weaker entry, and the OLD
- * behavior at such pairs was itself order/engine-dependent (the defect this
- * fix exists to kill) — so there is no stable prior behavior being broken.
- */
-export declare function strengthBucket(strength: number | null | undefined): number;
-/**
- * Scan the store for duplicates and remove the weaker copy: same text apart
- * from spacing, since a near-duplicate can differ in a value (port, version,
- * path, name), AND the same tenant: the scan is partitioned by
- * tenantId, so byte-identical content in two tenants is never a duplicate
- * pair (the tenant boundary is an isolation boundary; cross-tenant removal
- * was the v1.32.0 known-issue data-loss bug).
- * Keeps the one with higher strength (or more retrievals if tied). `threshold` is accepted for old callers and ignored.
- */
-export declare function deduplicateStore(hippoRoot: string, options?: {
-    threshold?: number;
-    dryRun?: boolean;
-    actor?: string;
-}): DedupResult;
-//# sourceMappingURL=dedupe.d.ts.map

package/dist/dedupe.js

@@ -1,169 +0,0 @@
-/**
- * Store-level deduplication. Scans for memories with the same text apart
- * from spacing, keeps the stronger copy (by strength + retrieval count),
- * removes the rest.
- *
- * Extracted from cli.ts in Episode A (v1.11.3) so `api.sleep` can dedupe
- * during the consolidation pipeline without violating the cli -> api
- * dependency direction. `cmdDedup` in cli.ts continues to import and use
- * this function unchanged.
- *
- * Survivor selection is a total order as of v1.26.3
- * (docs/plans/2026-07-16-dedupe-survivor-determinism.md): strength bucket
- * desc -> retrieval_count desc -> compareEntryIdentity (content asc ->
- * layer rank -> tags -> source -> id asc; the metadata keys arrived in
- * v1.38.1, docs/plans/2026-09-04-dedupe-survivor-metadata.md). Previously
- * the strength/retrieval-count comparator could tie exactly with no terminal
- * key, so the survivor fell to load order (arrival-order-dependent); see
- * `strengthBucket` below for the bucket encoding. As of the tenant-partition
- * fix (docs/plans/2026-08-15-dedupe-tenant-partition.md) the order is scoped
- * WITHIN each tenant group; cross-tenant pairs are never compared. Raw and
- * superseded rows are not candidates at all (v1.38.1).
- */
-import { textOverlap } from './tokenize.js';
-import { loadAllEntries } from './store/entry-reads.js';
-import { deleteEntryOn, memoriesBackingObjects } from './store/delete-and-batch.js';
-import { openStore } from './store/open.js';
-import { closeHippoDb } from './db.js';
-import { compareEntryIdentity } from './compare.js';
-import { canAutoDelete } from './memory.js';
-import { derivationPartitionKey } from './recall-scope.js';
-import { duplicateKey } from './same-text.js';
-/** Quantization step for strength-tie comparisons. The historical 0.01
- *  epsilon (see `strengthBucket` below) applied via rounding instead of a
- *  raw abs-diff threshold, so the tiebreak is transitive. */
-const STRENGTH_TIE_EPSILON = 0.01;
-/**
- * Quantize a strength value into an integer "bucket" for tie comparison.
- *
- * Encodes the historical 0.01 epsilon transitively: two strengths compare
- * equal here iff they round to the same multiple of `STRENGTH_TIE_EPSILON`,
- * which (unlike a raw `Math.abs(a - b) > epsilon` check) is a genuine
- * equivalence relation — no more "A ties B, B ties C, but A beats C"
- * (see the file-level history note above).
- *
- * Non-finite input (`NaN`, `+/-Infinity`) maps to bucket `0` rather than
- * propagating: a NaN bucket would make the sort comparator return NaN,
- * silently reintroducing the non-total-order class this fix exists to kill.
- * (`null`/`undefined` already default to strength `0` via `?? 0`, same as
- * before this change.)
- *
- * Bucket-edge nuance: two strengths straddling a bucket edge (e.g. 0.0049 vs
- * 0.0051) now compare as different, where the old raw-epsilon check called
- * them tied. The flip always favors the not-weaker entry, and the OLD
- * behavior at such pairs was itself order/engine-dependent (the defect this
- * fix exists to kill) — so there is no stable prior behavior being broken.
- */
-export function strengthBucket(strength) {
-    const s = strength ?? 0;
-    return Number.isFinite(s) ? Math.round(s / STRENGTH_TIE_EPSILON) : 0;
-}
-// finiteCount mirrors strengthBucket's non-finite hardening on the
-// retrieval leg: a NaN retrieval_count would make the comparator return
-// NaN and break the total order the same way a NaN bucket would.
-// Unreachable via the schema (non-nullable INTEGER column), so this is
-// symmetry, not a live bug.
-const finiteCount = (n) => Number.isFinite(n ?? 0) ? (n ?? 0) : 0;
-/** The v1.26.3 survivor total order: strength bucket desc, then retrieval_count desc, then compareEntryIdentity. */
-function survivorOrder(a, b) {
-    const bucketDiff = strengthBucket(b.strength) - strengthBucket(a.strength);
-    if (bucketDiff !== 0)
-        return bucketDiff;
-    const retrievalDiff = finiteCount(b.retrieval_count) - finiteCount(a.retrieval_count);
-    if (retrievalDiff !== 0)
-        return retrievalDiff;
-    return compareEntryIdentity(a, b);
-}
-// Tenant partition (mirrors consolidate.ts mergeCandidatesByTenant and
-// dag.ts unparentedByTenant): group by tenantId BEFORE the sort so a
-// duplicate pair can never form across tenants. Map preserves insertion
-// order, so a single-tenant store (every row 'default') gets exactly one
-// group and the sort plus pair loop below run byte-identical to the
-// pre-fix global pass.
-function entriesByPartition(entries) {
-    const entriesByTenant = new Map();
-    for (const entry of entries) {
-        // EI2: also split by restricted scope, else a private copy can delete the readable one.
-        const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
-        const bucket = entriesByTenant.get(key);
-        if (bucket)
-            bucket.push(entry);
-        else
-            entriesByTenant.set(key, [entry]);
-    }
-    return entriesByTenant;
-}
-function dedupPair(kept, dropped) {
-    return {
-        kept: kept.id,
-        keptContent: kept.content,
-        keptLayer: kept.layer,
-        keptStrength: kept.strength ?? 0,
-        removed: dropped.id,
-        removedContent: dropped.content,
-        removedLayer: dropped.layer,
-        removedStrength: dropped.strength ?? 0,
-        similarity: textOverlap(kept.content, dropped.content),
-    };
-}
-/** Pairs within one partition, already in survivor order, grouped by survivor; marks each loser in `removed`. */
-function partitionPairs(tenantEntries, removed, backing) {
-    const groups = new Map();
-    for (const entry of tenantEntries) {
-        const key = duplicateKey(entry.content);
-        const group = groups.get(key);
-        if (!group) {
-            groups.set(key, { survivor: entry, pairs: [] });
-            continue;
-        }
-        if (!canAutoDelete(entry) || backing.has(entry.id))
-            continue;
-        removed.add(entry.id);
-        group.pairs.push(dedupPair(group.survivor, entry));
-    }
-    return [...groups.values()].flatMap((group) => group.pairs);
-}
-/**
- * Scan the store for duplicates and remove the weaker copy: same text apart
- * from spacing, since a near-duplicate can differ in a value (port, version,
- * path, name), AND the same tenant: the scan is partitioned by
- * tenantId, so byte-identical content in two tenants is never a duplicate
- * pair (the tenant boundary is an isolation boundary; cross-tenant removal
- * was the v1.32.0 known-issue data-loss bug).
- * Keeps the one with higher strength (or more retrievals if tied). `threshold` is accepted for old callers and ignored.
- */
-export function deduplicateStore(hippoRoot, options = {}) {
-    const dryRun = options.dryRun ?? false;
-    // Only current distilled rows compete: raw rows are append-only (the delete
-    // trigger would abort sleep mid-loop) and superseded rows are history, as in consolidate.ts.
-    const entries = loadAllEntries(hippoRoot).filter((e) => e.kind === 'distilled' && !e.superseded_by);
-    const entriesByTenant = entriesByPartition(entries);
-    // Shared across tenant groups: safe because memory ids are globally
-    // unique (crypto.randomUUID at creation), so an id in `removed` can never
-    // collide with another tenant's row, and deleteEntry below deletes by
-    // primary-key id alone.
-    const removed = new Set();
-    const pairs = [];
-    const backing = memoriesBackingObjects(hippoRoot);
-    for (const tenantEntries of entriesByTenant.values()) {
-        // The survivor total order (see the file-level docstring), scoped per
-        // tenant group: the total order holds within a tenant only, matching the partition above.
-        tenantEntries.sort(survivorOrder);
-        pairs.push(...partitionPairs(tenantEntries, removed, backing));
-    }
-    const done = dryRun ? pairs : deletePairs(hippoRoot, pairs, options.actor);
-    return { removed: done.length, pairs: done };
-}
-/** The pairs whose loser was deleted; one store handle, one transaction per delete. */
-function deletePairs(hippoRoot, pairs, actor) {
-    if (pairs.length === 0)
-        return [];
-    const db = openStore(hippoRoot);
-    try {
-        return pairs.filter((p) => deleteEntryOn(db, hippoRoot, p.removed, { actor, reason: `dedup: duplicate of ${p.kept}`, automatic: true }));
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-//# sourceMappingURL=dedupe.js.map

package/dist/dormant.d.ts

@@ -1,93 +0,0 @@
-/**
- * Dormant memories: what sleep does with a faded memory instead of deleting
- * it (config `dormant.enabled`, on by default; `retentionDays` bounds how
- * long one is kept).
- *
- * A dormant memory keeps its full content in `dormant_memories` (schema v44)
- * but is no longer a `memories` row, so recall, context, every sleep pass and
- * every other reader of `memories` stop seeing it exactly as if it had been
- * deleted. `hippo dormant` lists and searches them, `hippo dormant restore`
- * brings one back, `hippo dormant forget` deletes one for good.
- *
- * Not to be confused with the raw archive (`raw_archive`, `archiveRawMemory`,
- * `hippo forget --archive`): that path removes a raw receipt's content and
- * keeps only its metadata. A dormant memory keeps its content.
- *
- * DB-only helpers: the caller owns the handle and any transaction. The
- * tenant-scoped entry points are api.listDormant / restoreDormant /
- * forgetDormant.
- */
-import type { DatabaseSyncLike } from './db.js';
-import type { MemoryEntry } from './memory.js';
-import type { SqlFragment } from './recall-scope.js';
-/** Why a memory went dormant: sleep's decay pass, an imported agent memory whose note was deleted, `hippo projects repair` splitting a two-project merge, or `hippo audit repair` setting aside an automatic memory with a certain defect. */
-export type DormantReason = 'decay' | 'source-deleted' | 'project-repair' | 'quality-repair';
-/** One memory that sleep is moving out of active memory into the dormant store. */
-export interface DormantMove {
-    /** The memory as it stood when it faded; restored verbatim apart from its recall clock. */
-    entry: MemoryEntry;
-    /** Live strength at the moment it went dormant (below the decay threshold). */
-    strength: number;
-    reason: DormantReason;
-    /** ISO time of the sleep that made it dormant. */
-    dormantAt: string;
-}
-/** A dormant memory as listed to a user. */
-export interface DormantMemory {
-    id: string;
-    tenantId: string;
-    content: string;
-    tags: string[];
-    /** Live strength when it went dormant. */
-    strength: number;
-    /** Why it went dormant: one of the {@link DormantReason} values. */
-    reason: string;
-    /** ISO time it went dormant. */
-    dormantAt: string;
-}
-/** Options for {@link listDormantRows}. */
-export interface ListDormantOpts {
-    /** Whitespace-separated terms; a row must contain every term (case-insensitive substring). */
-    query?: string;
-    /** Maximum rows returned, newest first. Default 20. */
-    limit?: number;
-}
-/**
- * Insert (or refresh) the dormant snapshot for `move.entry`. Does not touch
- * the `memories` row: the caller deletes it in the same transaction, so the
- * memory is never in both places or in neither.
- */
-export declare function insertDormantRow(db: DatabaseSyncLike, move: DormantMove): void;
-/** A tenant's dormant memories whose scope `admit` passes, newest first, optionally filtered by search terms. */
-export declare function listDormantRows(db: DatabaseSyncLike, tenantId: string, opts?: ListDormantOpts, admit?: SqlFragment): DormantMemory[];
-/** A dormant memory's stored snapshot plus when and why it went dormant. */
-export interface DormantSnapshot {
-    entry: MemoryEntry;
-    reason: string;
-    strength: number;
-    dormantAt: string;
-}
-/**
- * The stored snapshot for a tenant's dormant memory, or null when the tenant
- * has no dormant memory with that id (another tenant's id reads as absent).
- */
-export declare function readDormantSnapshot(db: DatabaseSyncLike, tenantId: string, id: string): DormantSnapshot | null;
-/** Every dormant memory of a tenant whose snapshot still reads back. */
-export declare function listDormantSnapshots(db: DatabaseSyncLike, tenantId: string): DormantSnapshot[];
-/** Readable snapshots whose entry's source starts with `prefix`; a malformed snapshot is passed over, not an error. */
-export declare function dormantSnapshotsBySourcePrefix(db: DatabaseSyncLike, tenantId: string, prefix: string): DormantSnapshot[];
-/** Put `entry` in place of a tenant's dormant memory `id`, keeping when and why that one went dormant. */
-export declare function replaceDormantEntry(db: DatabaseSyncLike, tenantId: string, id: string, entry: MemoryEntry): void;
-/** Whether a tenant has a dormant memory with this id whose scope `admit` passes (snapshot readable or not). */
-export declare function hasDormantRow(db: DatabaseSyncLike, tenantId: string, id: string, admit?: SqlFragment): boolean;
-/** Delete a tenant's dormant memory. Returns false when there was none. */
-export declare function deleteDormantRow(db: DatabaseSyncLike, tenantId: string, id: string): boolean;
-/** Deletes the tenant's dormant copies of a rejected digest whose snapshot scope `inReach` admits, so the value cannot linger; returns their ids. */
-export declare function purgeDormantByDigest(db: DatabaseSyncLike, tenantId: string, digest: string, inReach: (scope: string | null) => boolean): string[];
-export interface DormantKey {
-    readonly tenantId: string;
-    readonly id: string;
-}
-export declare function expiredDormantKeys(db: DatabaseSyncLike, cutoffIso: string): DormantKey[];
-export declare function deleteExpiredDormantRow(db: DatabaseSyncLike, key: DormantKey, cutoffIso: string): number;
-//# sourceMappingURL=dormant.d.ts.map