hippo-memory 1.70.0 → 1.72.0

package/dist/sharing/global-store.d.ts

@@ -0,0 +1,19 @@
+import { MemoryEntry } from '../core/memory.js';
+import type { DatabaseSyncLike } from '../db/index.js';
+/** Returns the path to the global Hippo store.
+ *  Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/ */
+export declare function getGlobalRoot(): string;
+/** Ensure the global store exists. */
+export declare function initGlobal(): void;
+/** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
+export declare function promoteToGlobal(localRoot: string, id: string, opts?: {
+    actor?: string;
+    tenantId?: string;
+    afterWrite?: (db: DatabaseSyncLike, globalId: string) => void;
+    /** Also writes one `promote` audit row for the copy ({sourceId}), in the copy's own transaction. */
+    auditAs?: {
+        tenantId: string;
+        actor: string;
+    };
+}): MemoryEntry;
+//# sourceMappingURL=global-store.d.ts.map

package/dist/sharing/global-store.js

@@ -0,0 +1,75 @@
+// The global store: where it lives, creating it, and copying a local memory into it.
+import { BadRequestError, NotFoundError } from '../core/api-errors.js';
+import * as fs from 'fs';
+import { generateId } from '../core/memory.js';
+import { initStore } from '../store/open.js';
+import { writeEntry } from '../store/entry-writes.js';
+import { readEntry } from '../store/entry-reads.js';
+import { isPersonalScope } from '../core/recall-scope.js';
+import { fallbackOrigin, resolveGlobalRootDir } from '../core/project-identity.js';
+import { isSharedStore } from '../core/config.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { embedMemory } from '../search/embed-memories.js';
+import { appendAuditEvent } from '../store/audit.js';
+/** Returns the path to the global Hippo store.
+ *  Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/ */
+export function getGlobalRoot() {
+    // Single source of truth lives in project-identity.ts (leaf) so db migrations
+    // can resolve the same path without a shared.ts import cycle.
+    return resolveGlobalRootDir();
+}
+/** Ensure the global store exists. */
+export function initGlobal() {
+    const globalRoot = getGlobalRoot();
+    if (!fs.existsSync(globalRoot)) {
+        initStore(globalRoot);
+    }
+    else {
+        // Ensure subdirectories exist in case partially initialized
+        initStore(globalRoot);
+    }
+}
+/** The copy's write hook: the `promote` row when asked for, then the caller's own hook, both in the copy's transaction. */
+function promoteHook(sourceId, auditAs, afterWrite) {
+    if (!auditAs)
+        return afterWrite;
+    return (db, globalId) => {
+        appendAuditEvent(db, { tenantId: auditAs.tenantId, actor: auditAs.actor, op: 'promote', targetId: globalId, metadata: { sourceId } });
+        afterWrite?.(db, globalId);
+    };
+}
+/** Copies a local memory to the global store and returns the copy, which gets a new `g_` id so it cannot collide. */
+export function promoteToGlobal(localRoot, id, opts) {
+    const entry = readEntry(localRoot, id, opts?.tenantId);
+    if (!entry)
+        throw new NotFoundError(`Memory not found: ${id}`);
+    // Same quarantine veto as shareMemory; a promoted copy would have no quarantine record to review.
+    if (isQuarantineScope(entry.scope)) {
+        throw new BadRequestError(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
+    if (isPersonalScope(entry.scope ?? null)) {
+        throw new BadRequestError(`Refusing to promote ${id}: it is a personal memory and stays with its owner on this server.`);
+    }
+    // Secret producer veto: promote is a producer path to the global store
+    // exactly like shareMemory - same hard rule.
+    const promoteSecret = detectSecret(entry);
+    if (promoteSecret.flagged) {
+        throw new BadRequestError(`Refusing to promote ${id} to the global store: content matches secret material (${promoteSecret.reason}). ` +
+            `Secrets stay in their owning project's store.`);
+    }
+    initGlobal();
+    const globalRoot = getGlobalRoot();
+    // A project store's NULL row gets its folder back; a shared store's folder is no caller's project, so NULL stays and the label names no path.
+    const globalEntry = {
+        ...entry,
+        id: generateId('g'),
+        source: isSharedStore(localRoot) ? `shared::${new Date().toISOString()}` : `promoted:${localRoot}`,
+        origin_project: entry.origin_project ?? fallbackOrigin(localRoot),
+    };
+    writeEntry(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: promoteHook(id, opts?.auditAs, opts?.afterWrite) });
+    // Fire-and-forget: embedMemory gates on availability and never rejects.
+    void embedMemory(globalRoot, globalEntry);
+    return globalEntry;
+}
+//# sourceMappingURL=global-store.js.map

package/dist/sharing/global-sync.d.ts

@@ -0,0 +1,6 @@
+/** Copy all global memories into the local store, skipping entries that already exist locally by ID or text (promote and share copy under a new ID).
+ *  Returns the count of newly copied entries. */
+export declare function syncGlobalToLocal(localRoot: string, globalRoot: string, opts?: {
+    includeCrossProject?: boolean;
+}): number;
+//# sourceMappingURL=global-sync.d.ts.map

package/dist/sharing/global-sync.js

@@ -0,0 +1,73 @@
+// Copying the global store's memories down into a local store.
+import { BadRequestError } from '../core/api-errors.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { AGENT_MEMORY_SOURCE_PREFIX } from '../core/agent-memory-tools.js';
+import { writeEntriesSkippingRejected } from '../store/entry-writes.js';
+import { loadEntriesByIds, loadEntryTextKeys } from '../store/entry-reads.js';
+import { chunked } from '../util/chunked.js';
+import { withRequestStoresSync } from '../db/request-stores.js';
+import { classifyOriginProject, resolveProjectIdentity } from '../core/project-identity.js';
+import { isSharedStore } from '../core/config.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { embedAll } from '../search/embed-memories.js';
+import { log } from '../util/log.js';
+import { logEmbedAllFailure } from './search-both.js';
+/** Copy all global memories into the local store, skipping entries that already exist locally by ID or text (promote and share copy under a new ID).
+ *  Returns the count of newly copied entries. */
+export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
+    if (isSharedStore(localRoot)) {
+        throw new BadRequestError(`Refusing to sync into ${localRoot}: a shared store takes no copies of a personal global store, ` +
+            `whose rows would reach every member.`);
+    }
+    if (!fs.existsSync(globalRoot))
+        return 0;
+    return withRequestStoresSync(() => copyMissingRows(localRoot, globalRoot, opts.includeCrossProject === true));
+}
+const textKey = (e) => `${e.tenantId}\n${e.content}`;
+/** One open per store and one transaction: id, tenant and text decide which rows to read whole, and the copies commit together. */
+function copyMissingRows(localRoot, globalRoot, includeCrossProject) {
+    // Host-wide read: the global union is copied into a tenant-scoped local store, and each copy keeps its own tenant.
+    const localKeys = loadEntryTextKeys(localRoot);
+    const localIds = new Set(localKeys.map((k) => k.id));
+    const localText = new Set(localKeys.map(textKey));
+    // Only the global store's user pass sets an imported note's row aside, so a copy would outlive the note.
+    const candidates = loadEntryTextKeys(globalRoot).filter((k) => !localIds.has(k.id) && !k.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX) && !localText.has(textKey(k)));
+    if (candidates.length === 0)
+        return 0;
+    const byId = new Map(chunked(candidates.map((k) => k.id)).flatMap((ids) => loadEntriesByIds(globalRoot, ids)).map((e) => [e.id, e]));
+    // Syncing down must not re-import what ambient context excludes: other-project rows are skipped by default and secret rows never copied.
+    // origin_project is preserved on the copy (the write stamps it only when missing).
+    const currentProject = resolveProjectIdentity(path.dirname(path.resolve(localRoot)));
+    // A locally rejected value must not come back through sync down: skipped per item, printed as one line.
+    let rejected = 0;
+    const count = writeEntriesSkippingRejected(localRoot, (put) => {
+        for (const { id } of candidates) {
+            const entry = byId.get(id);
+            // A row the global store dropped between the two reads, or a text an earlier copy in this batch already brought down.
+            if (!entry || localText.has(textKey(entry)))
+                continue;
+            if (detectSecret(entry).flagged)
+                continue;
+            if (!includeCrossProject && classifyOriginProject(entry.origin_project, currentProject) === 'cross-project')
+                continue;
+            if (put(entry))
+                localText.add(textKey(entry));
+            else
+                rejected++;
+        }
+    });
+    finishSyncDown(localRoot, count, rejected);
+    return count;
+}
+function finishSyncDown(localRoot, count, rejected) {
+    if (rejected > 0) {
+        log.warn(`syncGlobalToLocal: skipped ${rejected} rejected value(s) (run \`hippo unreject\` on the local store to allow).`);
+    }
+    // Batch producer: one embedAll() on the destination rather than an
+    // embedMemory() per copied row (same batching invariant as autoShare).
+    if (count > 0) {
+        void embedAll(localRoot).catch((err) => logEmbedAllFailure('syncGlobalToLocal', err));
+    }
+}
+//# sourceMappingURL=global-sync.js.map

package/dist/sharing/project-merge.d.ts

@@ -1,4 +1,5 @@
-import { type DatabaseSyncLike } from '../db/index.js';
+import { type ProjectFold } from '../agent-memories/project-folds.js';
+import type { ProjectTagReads, ProjectTagStore } from '../store/project-tags.js';
 export interface ProjectSummary {
     /** '' is user-global, null is unknown; neither can be merged. */
     readonly origin: string | null;
@@ -18,10 +19,6 @@ export interface MergeResult {
     readonly compactions: number;
     readonly backup: string | null;
 }
-export interface ProjectFold {
-    readonly from: string;
-    readonly into: string;
-}
 /** An old name whose session folders now resolve to several projects: no fold can say whose rows are whose. */
 export interface ProjectCollision {
     readonly name: string;
@@ -45,29 +42,24 @@ export interface RepairResult {
     readonly backup: string | null;
 }
 /** Live rows per project name, newest write first, with how many of its imported notes are copies held elsewhere. */
-export declare function listProjects(db: DatabaseSyncLike, tenantId: string): ProjectSummary[];
+export declare function listProjects(store: ProjectTagReads): ProjectSummary[];
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export declare function validateMergeNames(from: string, into: string): string | null;
 /** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
-export declare function mergeProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
-    tenantId: string;
+export declare function mergeProjects(store: ProjectTagStore, opts: {
     from: string;
     into: string;
     dryRun: boolean;
 }): MergeResult;
-/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
-export declare function namesFoldedInto(db: DatabaseSyncLike, tenantId: string, names: readonly string[]): string[];
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export declare function planProjectRepair(db: DatabaseSyncLike, hippoRoot: string, tenantId: string, globalFolds?: boolean): Omit<RepairResult, 'backup'>;
-/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
-export declare function repairProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
-    tenantId: string;
+export declare function planProjectRepair(store: ProjectTagReads, hippoRoot: string, globalFolds?: boolean): Omit<RepairResult, 'backup'>;
+/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then
+ * re-tags sleep's user-global merges by their parents; a dry run only plans. */
+export declare function repairProjects(store: ProjectTagStore, opts: {
     dryRun: boolean;
     globalFolds?: boolean;
 }): RepairResult;
-/**
- * Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
- * with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted.
- */
-export declare function repairOnceOnSleep(db: DatabaseSyncLike, hippoRoot: string, tenantId: string): RepairResult | null;
+/** Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
+ *  with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted. */
+export declare function repairOnceOnSleep(store: ProjectTagStore): RepairResult | null;
 //# sourceMappingURL=project-merge.d.ts.map

package/dist/sharing/project-merge.js

@@ -1,26 +1,14 @@
 // `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { setAsideRow } from '../agent-memories/apply.js';
 import { transcriptNotesProject } from '../agent-memories/claude-code.js';
 import { containerId, containerPrefix } from '../agent-memories/source.js';
+import { foldEdges, foldedInto } from '../agent-memories/project-folds.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from '../core/agent-memory-tools.js';
-import { appendAuditEvent, queryAuditEvents } from '../store/audit.js';
 import { isSharedStore } from '../core/config.js';
-import { withTrialScope, withWriteScope } from '../db/index.js';
-import { withBackup } from '../db/backup.js';
-import { getMeta, setMeta } from '../db/meta.js';
-import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from '../store/dormant.js';
 import { processEnv } from '../util/env.js';
-import { calculateStrength } from '../core/memory.js';
-import { isObjectLike, isStringValue } from '../core/capture-contract.js';
 import { isGlobalStoreRoot, projectNames, resolveProjectIdentity } from '../core/project-identity.js';
 import { duplicateKey } from '../util/same-text.js';
-import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin } from '../store/compactions.js';
-import { removeEntryMirrors } from '../store/mirrors.js';
-import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors } from '../store/entry-writes.js';
-import { selectAllEntries, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
-const ACTOR = 'cli';
 function isImport(entry) {
     return entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX);
 }
@@ -29,8 +17,8 @@ function toolTag(source) {
     return AGENT_MEMORY_TOOLS.find((t) => t.id === id)?.tag ?? null;
 }
 /** Live rows per project name, newest write first, with how many of its imported notes are copies held elsewhere. */
-export function listProjects(db, tenantId) {
-    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by);
+export function listProjects(store) {
+    const live = store.entries().filter((e) => !e.superseded_by);
     const byOrigin = new Map();
     const holders = new Map();
     for (const e of live) {
@@ -51,9 +39,6 @@ export function listProjects(db, tenantId) {
         };
     }).sort((a, b) => b.newest.localeCompare(a.newest));
 }
-function inTransaction(db, dryRun, body) {
-    return dryRun ? withTrialScope(db, 'merge_projects', body) : withWriteScope(db, 'merge_projects', body);
-}
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export function validateMergeNames(from, into) {
     if (from.trim() === '' || into.trim() === '')
@@ -63,23 +48,19 @@ export function validateMergeNames(from, into) {
     return null;
 }
 /** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
-export function mergeProjects(db, hippoRoot, opts) {
+export function mergeProjects(store, opts) {
     const refusal = validateMergeNames(opts.from, opts.into);
     if (refusal)
         throw new Error(refusal);
-    const { tenantId, from, into, dryRun } = opts;
-    const fold = (backup) => inTransaction(db, dryRun, () => {
-        const folded = foldInTx(db, tenantId, from, into);
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_merge', metadata: { from, into, backup, ...folded } });
-        return { from, into, ...folded, backup };
+    const { from, into, dryRun } = opts;
+    return store.rewrite({ dryRun, backupLabel: 'before-merge' }, (tx, backup) => {
+        const folded = foldInTx(tx, from, into);
+        tx.audit('project_merge', { from, into, backup, ...folded });
+        return { result: { from, into, ...folded, backup }, rewrite: folded.restamped, purge: folded.setAside };
     });
-    const result = dryRun ? fold(null) : withBackup(db, hippoRoot, 'before-merge', fold);
-    if (!dryRun)
-        refreshMirrors(db, hippoRoot, tenantId, result.restamped, result.setAside);
-    return result;
 }
-function foldInTx(db, tenantId, from, into) {
-    const all = selectAllEntries(db, tenantId);
+function foldInTx(tx, from, into) {
+    const all = tx.entries();
     const rows = all.filter((e) => e.origin_project === from);
     // The sync renames the rest to `into`'s prefix and keeps their ids; only a note `into` already holds would show twice.
     const held = new Set(all.filter((e) => e.origin_project === into && !e.superseded_by && isImport(e)).map(noteKey));
@@ -88,20 +69,20 @@ function foldInTx(db, tenantId, from, into) {
         const tag = toolTag(row.source);
         if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null || !held.has(noteKey(row)))
             continue;
-        if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
+        if (tx.setAside(tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
             setAside.push(row.id);
     }
     const gone = new Set(setAside);
     const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
-    restampOriginProjectAt(db, tenantId, from, into);
+    tx.restampOrigin(from, into);
     const dormantRestamped = [];
-    for (const snap of listDormantSnapshots(db, tenantId)) {
+    for (const snap of tx.dormant()) {
         if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
             continue;
-        replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
+        tx.replaceDormant(snap.entry.id, { ...snap.entry, origin_project: into });
         dormantRestamped.push(snap.entry.id);
     }
-    const compactions = restampCompactionOrigin(db, tenantId, from, into);
+    const compactions = tx.restampCompactions(from, into);
     return { setAside, restamped, dormantRestamped, compactions };
 }
 /** Tool, note key and hash of an import, without the container, whose id hashes the project name. */
@@ -110,19 +91,20 @@ function noteKey(entry) {
     return `${rest.split(':')[0]}:${rest.slice(rest.indexOf('/') + 1)}`;
 }
 /** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
-function importCopies(db, tenantId) {
-    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by && isImport(e));
+function importCopies(store) {
+    const live = store.entries().filter((e) => !e.superseded_by && isImport(e));
     const userGlobal = new Set(live.filter((e) => e.origin_project === '').map((e) => duplicateKey(e.content)));
     return live.filter((e) => e.origin_project && e.kind !== 'raw' && !e.pinned && toolTag(e.source) !== null && userGlobal.has(duplicateKey(e.content)));
 }
-/** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
-function strayImports(db, hippoRoot, tenantId) {
-    const copies = importCopies(db, tenantId);
+/** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its
+ * notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
+function strayImports(store, hippoRoot) {
+    const copies = importCopies(store);
     if (!isGlobalStoreRoot(hippoRoot))
         return copies;
     const machine = { platform: process.platform, env: processEnv() };
     const { platform } = machine;
-    const sessions = compactionTranscripts(db, tenantId);
+    const sessions = store.compactionTranscripts();
     const owners = new Map();
     for (const { transcript, cwd } of sessions) {
         const project = transcriptNotesProject(transcript, cwd, machine);
@@ -133,9 +115,9 @@ function strayImports(db, hippoRoot, tenantId) {
         owners.set(dir, ids.set(project.name, [...new Set([...(ids.get(project.name) ?? []), ...projectNames(project)])]));
     }
     const tool = toolSourcePrefix('claude-code');
-    const live = selectLiveEntriesBySourcePrefix(db, tenantId, tool).filter((e) => e.kind !== 'raw' && !e.pinned);
+    const live = store.liveEntriesBySourcePrefix(tool).filter((e) => e.kind !== 'raw' && !e.pinned);
     const origins = new Set(live.map((e) => e.origin_project ?? ''));
-    const edges = foldEdges(db, tenantId);
+    const edges = foldEdges(store);
     const right = new Set();
     const wrong = new Set();
     for (const [dir, ids] of owners) {
@@ -153,12 +135,12 @@ function strayImports(db, hippoRoot, tenantId) {
     return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
 }
 /** The global store reads each name's recorded session folders, where a compaction's name came from its cwd; a project store folds only its own folder name. */
-function planFolds(db, hippoRoot, tenantId, globalFolds) {
+function planFolds(store, hippoRoot, globalFolds) {
     // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
-    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
+    const chosen = new Set(store.auditEvents('project_merge').map((e) => e.metadata.into));
     if (!isGlobalStoreRoot(hippoRoot))
-        return { folds: ownLegacyFold(db, hippoRoot, tenantId).filter((f) => !chosen.has(f.from)), collisions: [] };
-    const rows = compactionOriginsWithCwd(db, tenantId);
+        return { folds: ownLegacyFold(store, hippoRoot).filter((f) => !chosen.has(f.from)), collisions: [] };
+    const rows = store.compactionOriginsWithCwd();
     const today = new Map();
     for (const { origin, cwd } of rows) {
         if (fs.existsSync(cwd))
@@ -180,58 +162,29 @@ function planFolds(db, hippoRoot, tenantId, globalFolds) {
     return { folds: globalFolds ? folds.filter((f) => !sources.has(f.into)) : [], collisions };
 }
 /** A project store's rows, dormant snapshots and compaction records written before its id existed carry its folder name. */
-function ownLegacyFold(db, hippoRoot, tenantId) {
+function ownLegacyFold(store, hippoRoot) {
     // A shared store's rows carry their callers' names, so one matching its folder's is a member's project, not a legacy tag.
     if (isSharedStore(hippoRoot))
         return [];
     const { name, legacyName } = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
     if (legacyName === '' || legacyName === name)
         return [];
-    const held = holdsOrigin(db, 'memories', tenantId, legacyName) || holdsOrigin(db, 'compactions', tenantId, legacyName) || listDormantSnapshots(db, tenantId).some((s) => s.entry.origin_project === legacyName);
+    const held = store.holdsOrigin('memories', legacyName)
+        || store.holdsOrigin('compactions', legacyName)
+        || store.dormant().some((s) => s.entry.origin_project === legacyName);
     return held ? [{ from: legacyName, into: name }] : [];
 }
-function foldOf(value) {
-    if (!isObjectLike(value) || Array.isArray(value))
-        return [];
-    const { from, into } = value;
-    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
-}
-function foldEdges(db, tenantId) {
-    return [
-        ...queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).flatMap((e) => foldOf(e.metadata)),
-        ...queryAuditEvents(db, { tenantId, op: 'project_repair', limit: 10000 })
-            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
-    ];
-}
-function foldedInto(edges, names) {
-    const seen = new Set(names);
-    let grew = true;
-    while (grew) {
-        grew = false;
-        for (const { from, into } of edges) {
-            if (!seen.has(into) || seen.has(from))
-                continue;
-            seen.add(from);
-            grew = true;
-        }
-    }
-    return [...seen].filter((n) => !names.includes(n));
-}
-/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
-export function namesFoldedInto(db, tenantId, names) {
-    return foldedInto(foldEdges(db, tenantId), names);
-}
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export function planProjectRepair(db, hippoRoot, tenantId, globalFolds = true) {
-    const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
-    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(db, tenantId, folds) };
+export function planProjectRepair(store, hippoRoot, globalFolds = true) {
+    const { folds, collisions } = planFolds(store, hippoRoot, globalFolds);
+    return { copies: strayImports(store, hippoRoot).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(store, folds) };
 }
 /** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
-function planUserGlobalRepair(db, tenantId, folds) {
-    const all = selectAllEntries(db, tenantId);
+function planUserGlobalRepair(store, folds) {
+    const all = store.entries();
     const renamed = new Map(folds.map((f) => [f.from, f.into]));
     const after = (origin) => (origin ? renamed.get(origin) ?? origin : origin ?? null);
-    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, after(s.entry.origin_project)]));
+    const origins = new Map(store.dormant().map((s) => [s.entry.id, after(s.entry.origin_project)]));
     for (const e of all)
         origins.set(e.id, after(e.origin_project));
     const toProject = [];
@@ -253,62 +206,47 @@ function planUserGlobalRepair(db, tenantId, folds) {
     }
     return { toProject, setAside, untraced };
 }
-/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
-export function repairProjects(db, hippoRoot, opts) {
-    const { tenantId, dryRun, globalFolds = true } = opts;
+/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then
+ * re-tags sleep's user-global merges by their parents; a dry run only plans. */
+export function repairProjects(store, opts) {
+    const { dryRun, globalFolds = true } = opts;
+    const { hippoRoot } = store;
     if (dryRun)
-        return { ...planProjectRepair(db, hippoRoot, tenantId, globalFolds), backup: null };
-    const { result, rewrite, purge } = withBackup(db, hippoRoot, 'before-repair', (backup) => inTransaction(db, false, () => {
+        return { ...planProjectRepair(store, hippoRoot, globalFolds), backup: null };
+    return store.rewrite({ dryRun: false, backupLabel: 'before-repair' }, (tx, backup) => {
         const copies = [];
-        for (const row of strayImports(db, hippoRoot, tenantId)) {
+        for (const row of strayImports(tx, hippoRoot)) {
             const tag = toolTag(row.source);
-            if (tag !== null && setAsideRow(db, tag, row, 'project-repair').kind === 'dormant')
+            if (tag !== null && tx.setAside(tag, row, 'project-repair').kind === 'dormant')
                 copies.push(row.id);
         }
-        const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
-        const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
-        const plan = planUserGlobalRepair(db, tenantId, []);
-        stampOriginProjectsAt(db, tenantId, plan.toProject);
-        const aside = new Set(plan.setAside);
+        const { folds, collisions } = planFolds(tx, hippoRoot, globalFolds);
+        const folded = folds.map((f) => foldInTx(tx, f.from, f.into));
+        const plan = planUserGlobalRepair(tx, []);
+        tx.stampOrigins(plan.toProject);
         const now = new Date();
-        for (const row of selectAllEntries(db, tenantId).filter((e) => aside.has(e.id))) {
-            insertDormantRow(db, { entry: row, strength: calculateStrength(row, now), reason: 'project-repair', dormantAt: now.toISOString() });
-            deleteEntryRowInTx(db, row, ACTOR);
-        }
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, copies, folds, folded, ...plan } });
+        for (const row of tx.entriesByIds(plan.setAside).values())
+            tx.retire(row, 'project-repair', now);
+        tx.audit('project_repair', { backup, copies, folds, folded, ...plan });
         return {
             result: { copies, folds, collisions, ...plan, backup },
             rewrite: [...plan.toProject.map((r) => r.id), ...folded.flatMap((f) => f.restamped)],
             purge: [...copies, ...plan.setAside, ...folded.flatMap((f) => f.setAside)],
         };
-    }));
-    refreshMirrors(db, hippoRoot, tenantId, rewrite, purge);
-    return result;
+    });
 }
-const AUTO_REPAIR_META_KEY = 'project_repair_auto';
 /** True when a repair would change nothing. */
 function repairIsEmpty(r) {
     return r.copies.length + r.folds.length + r.toProject.length + r.setAside.length === 0;
 }
-/**
- * Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
- * with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted.
- */
-export function repairOnceOnSleep(db, hippoRoot, tenantId) {
-    if (getMeta(db, AUTO_REPAIR_META_KEY) === '1')
+/** Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
+ *  with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted. */
+export function repairOnceOnSleep(store) {
+    if (store.repairedOnce())
         return null;
-    const plan = planProjectRepair(db, hippoRoot, tenantId, false);
-    const result = repairIsEmpty(plan) ? null : repairProjects(db, hippoRoot, { tenantId, dryRun: false, globalFolds: false });
-    setMeta(db, AUTO_REPAIR_META_KEY, '1');
+    const plan = planProjectRepair(store, store.hippoRoot, false);
+    const result = repairIsEmpty(plan) ? null : repairProjects(store, { dryRun: false, globalFolds: false });
+    store.markRepairedOnce();
     return result;
 }
-/** After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild. */
-function refreshMirrors(db, hippoRoot, tenantId, rewrite, purge) {
-    const ids = new Set(rewrite);
-    for (const entry of selectAllEntries(db, tenantId))
-        if (ids.has(entry.id))
-            writeEntryMirrors(hippoRoot, entry);
-    for (const id of purge)
-        removeEntryMirrors(hippoRoot, id);
-}
 //# sourceMappingURL=project-merge.js.map

package/dist/sharing/search-both.d.ts

@@ -0,0 +1,60 @@
+import { MemoryEntry } from '../core/memory.js';
+import { type SearchResult, type ResultCost } from '../core/search-types.js';
+import { type HybridVectorCandidates } from '../search/vector.js';
+export declare function logEmbedAllFailure<E>(caller: string, err: E): void;
+export interface SearchOptions {
+    budget?: number;
+    now?: Date;
+    minResults?: number;
+    /** Tenant scope for both stores. Undefined = no filter (legacy single-tenant). */
+    tenantId?: string;
+}
+/** Search both local and global stores and merge: local results are boosted 1.2x to prefer project context.
+ *  Returns results sorted by adjusted score within the combined token budget. */
+export declare function searchBoth(query: string, localRoot: string, globalRoot: string, options?: SearchOptions): SearchResult[];
+export interface HybridSearchOptions extends SearchOptions {
+    embeddingWeight?: number;
+    explain?: boolean;
+    mmr?: boolean;
+    mmrLambda?: number;
+    /** Multiplier applied to local-store scores when merging with global.
+     *  Defaults to 1.2. Use 1.0 to remove the local bias for eval comparisons. */
+    localBump?: number;
+    /** Active scope for scope-boost scoring. Auto-detected if not provided. */
+    scope?: string | null;
+    /** Include superseded memories in results. Default false. */
+    includeSuperseded?: boolean;
+    /** Filter to memories current at this ISO date string. */
+    asOf?: string;
+    /** Budget cost per result, spent the same way in each store and in the merged list. */
+    cost?: ResultCost;
+    /** Propagated to underlying hybridSearch calls.
+     *  Per-call > env HIPPO_SUMMARY_DEBOOST > 0.85 default. */
+    summaryDeboost?: number;
+    /** Propagated. Default true (1.05 boost if rebuilt within 7d). */
+    summaryFreshness?: boolean;
+    /** Optional admission predicate applied to the loaded candidates of BOTH stores before ranking, cross-store dedupe and budgeting,
+     *  so an excluded row cannot shadow its admitted duplicate or saturate the budget. Undefined (recall paths never set it) means no filter. */
+    entryFilter?: (entry: MemoryEntry) => boolean;
+    /** Recall scope filter for `searchBothHybrid`: absent is the only unfiltered mode; present uses `loadRecallSearchEntries` plus a JS post-filter.
+     *  `{}` = default-deny (legacy and `<source>:private:*` excluded); `{ requested: 'X' }` = exact; `{ requested: 'X', additive: true }` = default plus X.
+     *  An object, not `string | null`, because the sibling `scope` option already gives null a different meaning.
+     *  Do not pass `{}` casually from non-recall paths. */
+    recallScope?: {
+        requested?: string;
+        additive?: boolean;
+        ownScope?: string;
+    };
+}
+/** Hybrid search across both local and global stores, using embeddings when available.
+ *  Async version of searchBoth that calls hybridSearch instead of search. */
+export declare function searchBothHybrid(query: string, localRoot: string, globalRoot: string, options?: HybridSearchOptions): Promise<SearchResult[]>;
+/** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
+export declare function rankBothStores(query: string, roots: {
+    local: string;
+    global: string;
+}, entries: {
+    local: MemoryEntry[];
+    global: MemoryEntry[];
+}, vectorCandidates: HybridVectorCandidates, options?: HybridSearchOptions): Promise<SearchResult[]>;
+//# sourceMappingURL=search-both.d.ts.map