hippo-memory 1.71.0 → 2.0.0

package/dist/sharing/global-sync.js

@@ -3,70 +3,63 @@ import { BadRequestError } from '../core/api-errors.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { AGENT_MEMORY_SOURCE_PREFIX } from '../core/agent-memory-tools.js';
-import { writeEntry } from '../store/entry-writes.js';
-import { loadAllEntries } from '../store/entry-reads.js';
+import { writeEntriesSkippingRejected } from '../store/entry-writes.js';
+import { loadEntriesByIds, loadEntryTextKeys } from '../store/entry-reads.js';
+import { chunked } from '../util/chunked.js';
+import { withRequestStoresSync } from '../db/request-stores.js';
 import { classifyOriginProject, resolveProjectIdentity } from '../core/project-identity.js';
 import { isSharedStore } from '../core/config.js';
 import { detectSecret } from '../util/secret-detect.js';
-import { RejectedValueError } from '../store/rejection.js';
-import { embedAll } from '../store/embeddings/index.js';
+import { embedAll } from '../search/embed-memories.js';
 import { log } from '../util/log.js';
 import { logEmbedAllFailure } from './search-both.js';
 /** Copy all global memories into the local store, skipping entries that already exist locally by ID or text (promote and share copy under a new ID).
  *  Returns the count of newly copied entries. */
 export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
     if (isSharedStore(localRoot)) {
-        throw new BadRequestError(`Refusing to sync into ${localRoot}: a shared store takes no copies of a personal global store, whose rows would reach every member.`);
+        throw new BadRequestError(`Refusing to sync into ${localRoot}: a shared store takes no copies of a personal global store, ` +
+            `whose rows would reach every member.`);
     }
     if (!fs.existsSync(globalRoot))
         return 0;
-    // Host-wide read: the global union is copied into a tenant-scoped local store, and writeEntry carries the tenant if the local-root context has one.
-    const globalEntries = loadAllEntries(globalRoot);
-    const textKey = (e) => `${e.tenantId}\n${e.content}`;
-    const localEntries = loadAllEntries(localRoot);
-    const localIds = new Set(localEntries.map((e) => e.id));
-    const localText = new Set(localEntries.map(textKey));
+    return withRequestStoresSync(() => copyMissingRows(localRoot, globalRoot, opts.includeCrossProject === true));
+}
+const textKey = (e) => `${e.tenant_id}\n${e.content}`;
+/** One open per store and one transaction: id, tenant and text decide which rows to read whole, and the copies commit together. */
+function copyMissingRows(localRoot, globalRoot, includeCrossProject) {
+    // Host-wide read: the global union is copied into a tenant-scoped local store, and each copy keeps its own tenant.
+    const localKeys = loadEntryTextKeys(localRoot);
+    const localIds = new Set(localKeys.map((k) => k.id));
+    const localText = new Set(localKeys.map(textKey));
+    // Only the global store's user pass sets an imported note's row aside, so a copy would outlive the note.
+    const candidates = loadEntryTextKeys(globalRoot).filter((k) => !localIds.has(k.id) && !k.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX) && !localText.has(textKey(k)));
+    if (candidates.length === 0)
+        return 0;
+    const byId = new Map(chunked(candidates.map((k) => k.id)).flatMap((ids) => loadEntriesByIds(globalRoot, ids)).map((e) => [e.id, e]));
     // Syncing down must not re-import what ambient context excludes: other-project rows are skipped by default and secret rows never copied.
-    // origin_project is preserved on the copy (writeEntry stamps it only when missing).
+    // origin_project is preserved on the copy (the write stamps it only when missing).
     const currentProject = resolveProjectIdentity(path.dirname(path.resolve(localRoot)));
-    let count = 0;
-    // A locally rejected value must not come back through sync down: caught per item, printed as one line.
+    // A locally rejected value must not come back through sync down: skipped per item, printed as one line.
     let rejected = 0;
-    for (const entry of globalEntries) {
-        // Skip if already present by ID
-        if (localIds.has(entry.id))
-            continue;
-        // Only the global store's user pass sets an imported note's row aside, so a copy would outlive the note.
-        if (entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX))
-            continue;
-        if (localText.has(textKey(entry)))
-            continue;
-        if (detectSecret(entry).flagged)
-            continue;
-        if (!opts.includeCrossProject && classifyOriginProject(entry.origin_project, currentProject) === 'cross-project')
-            continue;
-        if (!writeUnlessRejected(localRoot, entry)) {
-            rejected++;
-            continue;
+    const count = writeEntriesSkippingRejected(localRoot, (put) => {
+        for (const { id } of candidates) {
+            const entry = byId.get(id);
+            // A row the global store dropped between the two reads, or a text an earlier copy in this batch already brought down.
+            if (!entry || localText.has(textKey(entry)))
+                continue;
+            if (detectSecret(entry).flagged)
+                continue;
+            if (!includeCrossProject && classifyOriginProject(entry.origin_project, currentProject) === 'cross-project')
+                continue;
+            if (put(entry))
+                localText.add(textKey(entry));
+            else
+                rejected++;
         }
-        localText.add(textKey(entry));
-        count++;
-    }
+    });
     finishSyncDown(localRoot, count, rejected);
     return count;
 }
-/** False when the local store rejects the value; any other failure still throws. */
-function writeUnlessRejected(localRoot, entry) {
-    try {
-        writeEntry(localRoot, entry);
-        return true;
-    }
-    catch (err) {
-        if (err instanceof RejectedValueError)
-            return false;
-        throw err;
-    }
-}
 function finishSyncDown(localRoot, count, rejected) {
     if (rejected > 0) {
         log.warn(`syncGlobalToLocal: skipped ${rejected} rejected value(s) (run \`hippo unreject\` on the local store to allow).`);

package/dist/sharing/project-merge.d.ts

@@ -1,4 +1,5 @@
-import { type DatabaseSyncLike } from '../db/index.js';
+import { type ProjectFold } from '../agent-memories/project-folds.js';
+import type { ProjectTagReads, ProjectTagStore } from '../store/project-tags.js';
 export interface ProjectSummary {
     /** '' is user-global, null is unknown; neither can be merged. */
     readonly origin: string | null;
@@ -18,10 +19,6 @@ export interface MergeResult {
     readonly compactions: number;
     readonly backup: string | null;
 }
-export interface ProjectFold {
-    readonly from: string;
-    readonly into: string;
-}
 /** An old name whose session folders now resolve to several projects: no fold can say whose rows are whose. */
 export interface ProjectCollision {
     readonly name: string;
@@ -45,28 +42,24 @@ export interface RepairResult {
     readonly backup: string | null;
 }
 /** Live rows per project name, newest write first, with how many of its imported notes are copies held elsewhere. */
-export declare function listProjects(db: DatabaseSyncLike, tenantId: string): ProjectSummary[];
+export declare function listProjects(store: ProjectTagReads): ProjectSummary[];
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export declare function validateMergeNames(from: string, into: string): string | null;
 /** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
-export declare function mergeProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
-    tenantId: string;
+export declare function mergeProjects(store: ProjectTagStore, opts: {
     from: string;
     into: string;
     dryRun: boolean;
 }): MergeResult;
-/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
-export declare function namesFoldedInto(db: DatabaseSyncLike, tenantId: string, names: readonly string[]): string[];
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export declare function planProjectRepair(db: DatabaseSyncLike, hippoRoot: string, tenantId: string, globalFolds?: boolean): Omit<RepairResult, 'backup'>;
+export declare function planProjectRepair(store: ProjectTagReads, hippoRoot: string, globalFolds?: boolean): Omit<RepairResult, 'backup'>;
 /** Sets aside stray imports, folds the names the resolver now maps elsewhere, then
  * re-tags sleep's user-global merges by their parents; a dry run only plans. */
-export declare function repairProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
-    tenantId: string;
+export declare function repairProjects(store: ProjectTagStore, opts: {
     dryRun: boolean;
     globalFolds?: boolean;
 }): RepairResult;
 /** Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
  *  with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted. */
-export declare function repairOnceOnSleep(db: DatabaseSyncLike, hippoRoot: string, tenantId: string): RepairResult | null;
+export declare function repairOnceOnSleep(store: ProjectTagStore): RepairResult | null;
 //# sourceMappingURL=project-merge.d.ts.map

package/dist/sharing/project-merge.js

@@ -1,26 +1,14 @@
 // `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { setAsideRow } from '../agent-memories/apply.js';
 import { transcriptNotesProject } from '../agent-memories/claude-code.js';
 import { containerId, containerPrefix } from '../agent-memories/source.js';
+import { foldEdges, foldedInto } from '../agent-memories/project-folds.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from '../core/agent-memory-tools.js';
-import { appendAuditEvent, queryAuditEvents } from '../store/audit.js';
 import { isSharedStore } from '../core/config.js';
-import { withTrialScope, withWriteScope } from '../db/index.js';
-import { withBackup } from '../db/backup.js';
-import { getMeta, setMeta } from '../db/meta.js';
-import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from '../store/dormant.js';
 import { processEnv } from '../util/env.js';
-import { calculateStrength } from '../core/memory.js';
-import { isObjectLike, isStringValue } from '../core/capture-contract.js';
 import { isGlobalStoreRoot, projectNames, resolveProjectIdentity } from '../core/project-identity.js';
 import { duplicateKey } from '../util/same-text.js';
-import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin } from '../store/compactions.js';
-import { removeEntryMirrors } from '../store/mirrors.js';
-import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors } from '../store/entry-writes.js';
-import { selectAllEntries, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
-const ACTOR = 'cli';
 function isImport(entry) {
     return entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX);
 }
@@ -29,8 +17,8 @@ function toolTag(source) {
     return AGENT_MEMORY_TOOLS.find((t) => t.id === id)?.tag ?? null;
 }
 /** Live rows per project name, newest write first, with how many of its imported notes are copies held elsewhere. */
-export function listProjects(db, tenantId) {
-    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by);
+export function listProjects(store) {
+    const live = store.entries().filter((e) => !e.superseded_by);
     const byOrigin = new Map();
     const holders = new Map();
     for (const e of live) {
@@ -51,9 +39,6 @@ export function listProjects(db, tenantId) {
         };
     }).sort((a, b) => b.newest.localeCompare(a.newest));
 }
-function inTransaction(db, dryRun, body) {
-    return dryRun ? withTrialScope(db, 'merge_projects', body) : withWriteScope(db, 'merge_projects', body);
-}
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export function validateMergeNames(from, into) {
     if (from.trim() === '' || into.trim() === '')
@@ -63,23 +48,19 @@ export function validateMergeNames(from, into) {
     return null;
 }
 /** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
-export function mergeProjects(db, hippoRoot, opts) {
+export function mergeProjects(store, opts) {
     const refusal = validateMergeNames(opts.from, opts.into);
     if (refusal)
         throw new Error(refusal);
-    const { tenantId, from, into, dryRun } = opts;
-    const fold = (backup) => inTransaction(db, dryRun, () => {
-        const folded = foldInTx(db, tenantId, from, into);
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_merge', metadata: { from, into, backup, ...folded } });
-        return { from, into, ...folded, backup };
+    const { from, into, dryRun } = opts;
+    return store.rewrite({ dryRun, backupLabel: 'before-merge' }, (tx, backup) => {
+        const folded = foldInTx(tx, from, into);
+        tx.audit('project_merge', { from, into, backup, ...folded });
+        return { result: { from, into, ...folded, backup }, rewrite: folded.restamped, purge: folded.setAside };
     });
-    const result = dryRun ? fold(null) : withBackup(db, hippoRoot, 'before-merge', fold);
-    if (!dryRun)
-        refreshMirrors(db, hippoRoot, tenantId, result.restamped, result.setAside);
-    return result;
 }
-function foldInTx(db, tenantId, from, into) {
-    const all = selectAllEntries(db, tenantId);
+function foldInTx(tx, from, into) {
+    const all = tx.entries();
     const rows = all.filter((e) => e.origin_project === from);
     // The sync renames the rest to `into`'s prefix and keeps their ids; only a note `into` already holds would show twice.
     const held = new Set(all.filter((e) => e.origin_project === into && !e.superseded_by && isImport(e)).map(noteKey));
@@ -88,20 +69,20 @@ function foldInTx(db, tenantId, from, into) {
         const tag = toolTag(row.source);
         if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null || !held.has(noteKey(row)))
             continue;
-        if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
+        if (tx.setAside(tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
             setAside.push(row.id);
     }
     const gone = new Set(setAside);
     const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
-    restampOriginProjectAt(db, tenantId, from, into);
+    tx.restampOrigin(from, into);
     const dormantRestamped = [];
-    for (const snap of listDormantSnapshots(db, tenantId)) {
+    for (const snap of tx.dormant()) {
         if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
             continue;
-        replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
+        tx.replaceDormant(snap.entry.id, { ...snap.entry, origin_project: into });
         dormantRestamped.push(snap.entry.id);
     }
-    const compactions = restampCompactionOrigin(db, tenantId, from, into);
+    const compactions = tx.restampCompactions(from, into);
     return { setAside, restamped, dormantRestamped, compactions };
 }
 /** Tool, note key and hash of an import, without the container, whose id hashes the project name. */
@@ -110,20 +91,20 @@ function noteKey(entry) {
     return `${rest.split(':')[0]}:${rest.slice(rest.indexOf('/') + 1)}`;
 }
 /** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
-function importCopies(db, tenantId) {
-    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by && isImport(e));
+function importCopies(store) {
+    const live = store.entries().filter((e) => !e.superseded_by && isImport(e));
     const userGlobal = new Set(live.filter((e) => e.origin_project === '').map((e) => duplicateKey(e.content)));
     return live.filter((e) => e.origin_project && e.kind !== 'raw' && !e.pinned && toolTag(e.source) !== null && userGlobal.has(duplicateKey(e.content)));
 }
 /** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its
  * notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
-function strayImports(db, hippoRoot, tenantId) {
-    const copies = importCopies(db, tenantId);
+function strayImports(store, hippoRoot) {
+    const copies = importCopies(store);
     if (!isGlobalStoreRoot(hippoRoot))
         return copies;
     const machine = { platform: process.platform, env: processEnv() };
     const { platform } = machine;
-    const sessions = compactionTranscripts(db, tenantId);
+    const sessions = store.compactionTranscripts();
     const owners = new Map();
     for (const { transcript, cwd } of sessions) {
         const project = transcriptNotesProject(transcript, cwd, machine);
@@ -134,9 +115,9 @@ function strayImports(db, hippoRoot, tenantId) {
         owners.set(dir, ids.set(project.name, [...new Set([...(ids.get(project.name) ?? []), ...projectNames(project)])]));
     }
     const tool = toolSourcePrefix('claude-code');
-    const live = selectLiveEntriesBySourcePrefix(db, tenantId, tool).filter((e) => e.kind !== 'raw' && !e.pinned);
+    const live = store.liveEntriesBySourcePrefix(tool).filter((e) => e.kind !== 'raw' && !e.pinned);
     const origins = new Set(live.map((e) => e.origin_project ?? ''));
-    const edges = foldEdges(db, tenantId);
+    const edges = foldEdges(store);
     const right = new Set();
     const wrong = new Set();
     for (const [dir, ids] of owners) {
@@ -154,12 +135,12 @@ function strayImports(db, hippoRoot, tenantId) {
     return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
 }
 /** The global store reads each name's recorded session folders, where a compaction's name came from its cwd; a project store folds only its own folder name. */
-function planFolds(db, hippoRoot, tenantId, globalFolds) {
+function planFolds(store, hippoRoot, globalFolds) {
     // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
-    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
+    const chosen = new Set(store.auditEvents('project_merge').map((e) => e.metadata.into));
     if (!isGlobalStoreRoot(hippoRoot))
-        return { folds: ownLegacyFold(db, hippoRoot, tenantId).filter((f) => !chosen.has(f.from)), collisions: [] };
-    const rows = compactionOriginsWithCwd(db, tenantId);
+        return { folds: ownLegacyFold(store, hippoRoot).filter((f) => !chosen.has(f.from)), collisions: [] };
+    const rows = store.compactionOriginsWithCwd();
     const today = new Map();
     for (const { origin, cwd } of rows) {
         if (fs.existsSync(cwd))
@@ -181,60 +162,29 @@ function planFolds(db, hippoRoot, tenantId, globalFolds) {
     return { folds: globalFolds ? folds.filter((f) => !sources.has(f.into)) : [], collisions };
 }
 /** A project store's rows, dormant snapshots and compaction records written before its id existed carry its folder name. */
-function ownLegacyFold(db, hippoRoot, tenantId) {
+function ownLegacyFold(store, hippoRoot) {
     // A shared store's rows carry their callers' names, so one matching its folder's is a member's project, not a legacy tag.
     if (isSharedStore(hippoRoot))
         return [];
     const { name, legacyName } = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
     if (legacyName === '' || legacyName === name)
         return [];
-    const held = holdsOrigin(db, 'memories', tenantId, legacyName)
-        || holdsOrigin(db, 'compactions', tenantId, legacyName)
-        || listDormantSnapshots(db, tenantId).some((s) => s.entry.origin_project === legacyName);
+    const held = store.holdsOrigin('memories', legacyName)
+        || store.holdsOrigin('compactions', legacyName)
+        || store.dormant().some((s) => s.entry.origin_project === legacyName);
     return held ? [{ from: legacyName, into: name }] : [];
 }
-function foldOf(value) {
-    if (!isObjectLike(value) || Array.isArray(value))
-        return [];
-    const { from, into } = value;
-    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
-}
-function foldEdges(db, tenantId) {
-    return [
-        ...queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).flatMap((e) => foldOf(e.metadata)),
-        ...queryAuditEvents(db, { tenantId, op: 'project_repair', limit: 10000 })
-            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
-    ];
-}
-function foldedInto(edges, names) {
-    const seen = new Set(names);
-    let grew = true;
-    while (grew) {
-        grew = false;
-        for (const { from, into } of edges) {
-            if (!seen.has(into) || seen.has(from))
-                continue;
-            seen.add(from);
-            grew = true;
-        }
-    }
-    return [...seen].filter((n) => !names.includes(n));
-}
-/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
-export function namesFoldedInto(db, tenantId, names) {
-    return foldedInto(foldEdges(db, tenantId), names);
-}
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export function planProjectRepair(db, hippoRoot, tenantId, globalFolds = true) {
-    const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
-    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(db, tenantId, folds) };
+export function planProjectRepair(store, hippoRoot, globalFolds = true) {
+    const { folds, collisions } = planFolds(store, hippoRoot, globalFolds);
+    return { copies: strayImports(store, hippoRoot).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(store, folds) };
 }
 /** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
-function planUserGlobalRepair(db, tenantId, folds) {
-    const all = selectAllEntries(db, tenantId);
+function planUserGlobalRepair(store, folds) {
+    const all = store.entries();
     const renamed = new Map(folds.map((f) => [f.from, f.into]));
     const after = (origin) => (origin ? renamed.get(origin) ?? origin : origin ?? null);
-    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, after(s.entry.origin_project)]));
+    const origins = new Map(store.dormant().map((s) => [s.entry.id, after(s.entry.origin_project)]));
     for (const e of all)
         origins.set(e.id, after(e.origin_project));
     const toProject = [];
@@ -258,59 +208,45 @@ function planUserGlobalRepair(db, tenantId, folds) {
 }
 /** Sets aside stray imports, folds the names the resolver now maps elsewhere, then
  * re-tags sleep's user-global merges by their parents; a dry run only plans. */
-export function repairProjects(db, hippoRoot, opts) {
-    const { tenantId, dryRun, globalFolds = true } = opts;
+export function repairProjects(store, opts) {
+    const { dryRun, globalFolds = true } = opts;
+    const { hippoRoot } = store;
     if (dryRun)
-        return { ...planProjectRepair(db, hippoRoot, tenantId, globalFolds), backup: null };
-    const { result, rewrite, purge } = withBackup(db, hippoRoot, 'before-repair', (backup) => inTransaction(db, false, () => {
+        return { ...planProjectRepair(store, hippoRoot, globalFolds), backup: null };
+    return store.rewrite({ dryRun: false, backupLabel: 'before-repair' }, (tx, backup) => {
         const copies = [];
-        for (const row of strayImports(db, hippoRoot, tenantId)) {
+        for (const row of strayImports(tx, hippoRoot)) {
             const tag = toolTag(row.source);
-            if (tag !== null && setAsideRow(db, tag, row, 'project-repair').kind === 'dormant')
+            if (tag !== null && tx.setAside(tag, row, 'project-repair').kind === 'dormant')
                 copies.push(row.id);
         }
-        const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
-        const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
-        const plan = planUserGlobalRepair(db, tenantId, []);
-        stampOriginProjectsAt(db, tenantId, plan.toProject);
-        const aside = new Set(plan.setAside);
+        const { folds, collisions } = planFolds(tx, hippoRoot, globalFolds);
+        const folded = folds.map((f) => foldInTx(tx, f.from, f.into));
+        const plan = planUserGlobalRepair(tx, []);
+        tx.stampOrigins(plan.toProject);
         const now = new Date();
-        for (const row of selectAllEntries(db, tenantId).filter((e) => aside.has(e.id))) {
-            insertDormantRow(db, { entry: row, strength: calculateStrength(row, now), reason: 'project-repair', dormantAt: now.toISOString() });
-            deleteEntryRowInTx(db, row, ACTOR);
-        }
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, copies, folds, folded, ...plan } });
+        for (const row of tx.entriesByIds(plan.setAside).values())
+            tx.retire(row, 'project-repair', now);
+        tx.audit('project_repair', { backup, copies, folds, folded, ...plan });
         return {
             result: { copies, folds, collisions, ...plan, backup },
             rewrite: [...plan.toProject.map((r) => r.id), ...folded.flatMap((f) => f.restamped)],
             purge: [...copies, ...plan.setAside, ...folded.flatMap((f) => f.setAside)],
         };
-    }));
-    refreshMirrors(db, hippoRoot, tenantId, rewrite, purge);
-    return result;
+    });
 }
-const AUTO_REPAIR_META_KEY = 'project_repair_auto';
 /** True when a repair would change nothing. */
 function repairIsEmpty(r) {
     return r.copies.length + r.folds.length + r.toProject.length + r.setAside.length === 0;
 }
 /** Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
  *  with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted. */
-export function repairOnceOnSleep(db, hippoRoot, tenantId) {
-    if (getMeta(db, AUTO_REPAIR_META_KEY) === '1')
+export function repairOnceOnSleep(store) {
+    if (store.repairedOnce())
         return null;
-    const plan = planProjectRepair(db, hippoRoot, tenantId, false);
-    const result = repairIsEmpty(plan) ? null : repairProjects(db, hippoRoot, { tenantId, dryRun: false, globalFolds: false });
-    setMeta(db, AUTO_REPAIR_META_KEY, '1');
+    const plan = planProjectRepair(store, store.hippoRoot, false);
+    const result = repairIsEmpty(plan) ? null : repairProjects(store, { dryRun: false, globalFolds: false });
+    store.markRepairedOnce();
     return result;
 }
-/** After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild. */
-function refreshMirrors(db, hippoRoot, tenantId, rewrite, purge) {
-    const ids = new Set(rewrite);
-    for (const entry of selectAllEntries(db, tenantId))
-        if (ids.has(entry.id))
-            writeEntryMirrors(hippoRoot, entry);
-    for (const id of purge)
-        removeEntryMirrors(hippoRoot, id);
-}
 //# sourceMappingURL=project-merge.js.map

package/dist/sharing/search-both.js

@@ -1,8 +1,8 @@
 // Search across the local and global stores, merged into one ranked, budgeted list.
 import { compareScoresDesc } from '../core/compare.js';
 import * as fs from 'fs';
-import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
-import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../store/recall-scope.js';
+import { loadSearchEntries, loadRecallEntries, recallScopeFilter } from '../store/search-rows.js';
+import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../core/recall-scope.js';
 import { search } from '../search/bm25-search.js';
 import { hybridSearch } from '../search/hybrid.js';
 import { fitBudget } from '../search/finalize.js';
@@ -79,7 +79,14 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
         if (!fs.existsSync(root))
             return [];
         return recallScope
-            ? loadRecallSearchEntries(root, query, searchWindow, tenantId, recallScope.requested, recallScope.additive ? 'additive' : 'exact', Boolean(includeSuperseded) || Boolean(asOf), undefined, recallScope.ownScope)
+            ? loadRecallEntries(root, query, {
+                limit: searchWindow,
+                tenantId,
+                requestedScope: recallScope.requested,
+                explicitScopeMode: recallScope.additive ? 'additive' : 'exact',
+                includeSuperseded: Boolean(includeSuperseded) || Boolean(asOf),
+                ownScope: recallScope.ownScope,
+            })
             : loadSearchEntries(root, query, searchWindow, tenantId);
     };
     const passesScope = (e) => !recallScope || (recallScope.additive

package/dist/sharing/share.d.ts

@@ -4,6 +4,8 @@ export declare const NEVER_AUTO_SHARE_TAGS: ReadonlySet<string>;
 export declare function neverAutoShareTags(sources: readonly MemoryEntry[]): string[];
 /** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
 export declare const NO_MERGE_TAGS: ReadonlySet<string>;
+/** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
+export declare const AUTO_SHARE_MIN_SCORE = 0.6;
 /** Estimate how well a memory would transfer to other projects.
  *  Returns 0..1 where >0.5 = good candidate for sharing. */
 export declare function transferScore(entry: MemoryEntry): number;