@mneme-ai/core 0.8.4 → 0.10.0

package/dist/util/index.js

@@ -1,3 +1,4 @@
+export * from "./redact.js";
 /** Load every commit from the store, oldest first, with its file list. */
 export function loadAllCommits(s) {
     const rows = s.db
@@ -21,7 +22,7 @@ export function loadCommitsBetween(s, sinceIso, untilIso) {
     const rows = s.db.prepare(sql).all(...params);
     return rows.map((r) => rowToCommit(r, s));
 }
-function rowToCommit(r, s) {
+export function rowToCommit(r, s) {
     const hash = String(r.hash);
     return {
         hash,

package/dist/util/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/util/index.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,CAAa;IAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE;SACd,OAAO,CAAC,gDAAgD,CAAC;SACzD,GAAG,EAAoC,CAAC;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,kBAAkB,CAChC,CAAa,EACb,QAAiB,EACjB,QAAiB;IAEjB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,GAAG,GAAG,wBAAwB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC;IACnH,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAmC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,CAA0B,EAAE,CAAa;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;QAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACnE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACpD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACjD,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAG,KAAe;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,CAAe,EAAE,CAAe;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;QACf,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QACd,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/util/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAE5B,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,CAAa;IAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE;SACd,OAAO,CAAC,gDAAgD,CAAC;SACzD,GAAG,EAAoC,CAAC;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,kBAAkB,CAChC,CAAa,EACb,QAAiB,EACjB,QAAiB;IAEjB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,GAAG,GAAG,wBAAwB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC;IACnH,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAmC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAA0B,EAAE,CAAa;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;QAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACnE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACpD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACjD,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAG,KAAe;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,CAAe,EAAE,CAAe;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;QACf,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QACd,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;AACvC,CAAC"}

package/dist/util/redact.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Secret redaction layer — regex scrubber for common credential formats.
+ *
+ * Used before any text leaves the machine (sent to remote embedder, written
+ * to logs, exported via `mneme ledger`). The redactor strips matches from
+ * the *text Mneme processes* — your actual git history is never modified.
+ *
+ * Why this lives in `core/util` and not in a separate package: every code
+ * path that touches a remote service (embedder, LLM provider, observability
+ * adapter) must run through it, and "import from a sibling package" is too
+ * easy to forget. Keeping it adjacent to types.ts makes it the obvious choice.
+ *
+ * Coverage rationale:
+ *   - High-confidence patterns (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack,
+ *     GitLab, npm, Google API, private keys, JWT) — built-in, ON by default.
+ *   - Lower-confidence (generic `password=` lines, hex blobs that may be hashes)
+ *     — opt-in via { aggressive: true } because false-positive rate matters
+ *     when redacting commit text that may legitimately contain hex commit hashes.
+ */
+export interface RedactionRule {
+    /** Stable name shown in audit logs and counters. */
+    name: string;
+    /** Pattern that matches the secret. The *whole match* is replaced. */
+    pattern: RegExp;
+    /** What to put in place of the match. Default: `<REDACTED:${name}>`. */
+    replacement?: string;
+}
+export interface RedactOptions {
+    /** Add lower-confidence patterns (generic password=, hex blobs ≥ 40 chars). */
+    aggressive?: boolean;
+    /** Append custom rules (or override built-ins by name). */
+    extraRules?: RedactionRule[];
+    /** Disable specific built-in rules by name. */
+    disableRules?: string[];
+}
+export interface RedactionResult {
+    /** Text with every match replaced. */
+    text: string;
+    /** Per-rule hit count for audit reporting. Zero-count rules are omitted. */
+    hits: Record<string, number>;
+}
+/**
+ * Redact every match of every active rule from the input text.
+ * Returns the redacted text plus per-rule hit counts.
+ */
+export declare function redact(text: string, opts?: RedactOptions): RedactionResult;
+/**
+ * Returns true iff the text contains any match for any active rule. Useful
+ * when you want to short-circuit (e.g. refuse to send to remote embedder)
+ * rather than redact-and-send.
+ */
+export declare function containsSecret(text: string, opts?: RedactOptions): boolean;
+/**
+ * Aggregate hit counters across many redactions — useful for audit reporting
+ * after a full index run.
+ */
+export declare function mergeHits(a: Record<string, number>, b: Record<string, number>): Record<string, number>;
+//# sourceMappingURL=redact.d.ts.map

package/dist/util/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/util/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAuED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,eAAe,CAsB9E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAE9E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAItG"}

package/dist/util/redact.js

@@ -0,0 +1,129 @@
+/**
+ * Secret redaction layer — regex scrubber for common credential formats.
+ *
+ * Used before any text leaves the machine (sent to remote embedder, written
+ * to logs, exported via `mneme ledger`). The redactor strips matches from
+ * the *text Mneme processes* — your actual git history is never modified.
+ *
+ * Why this lives in `core/util` and not in a separate package: every code
+ * path that touches a remote service (embedder, LLM provider, observability
+ * adapter) must run through it, and "import from a sibling package" is too
+ * easy to forget. Keeping it adjacent to types.ts makes it the obvious choice.
+ *
+ * Coverage rationale:
+ *   - High-confidence patterns (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack,
+ *     GitLab, npm, Google API, private keys, JWT) — built-in, ON by default.
+ *   - Lower-confidence (generic `password=` lines, hex blobs that may be hashes)
+ *     — opt-in via { aggressive: true } because false-positive rate matters
+ *     when redacting commit text that may legitimately contain hex commit hashes.
+ */
+/**
+ * Built-in rules. Ordered roughly by specificity (most specific first) so a
+ * GitHub PAT is recognized as a GitHub PAT and not a generic Bearer token.
+ *
+ * Each pattern uses `g` flag — `redact()` consumes the lastIndex correctly
+ * by re-creating from `source` + flags on every call (regex objects are
+ * stateful between matches; reusing them across inputs corrupts state).
+ */
+const BUILTIN_RULES = [
+    // AWS — keys are stable, well-formed, and unambiguous.
+    { name: "aws-access-key-id", pattern: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { name: "aws-secret-access-key", pattern: /\b(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40}(?![A-Za-z0-9+/])\b/g },
+    // GitHub — modern format, all variants. github_pat_ is the new fine-grained one.
+    { name: "github-pat", pattern: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+    { name: "github-pat-fine-grained", pattern: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g },
+    // GitLab
+    { name: "gitlab-pat", pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g },
+    // OpenAI / Anthropic / generic sk-* keys
+    { name: "anthropic-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g },
+    { name: "openai-key", pattern: /\bsk-[A-Za-z0-9]{20,}\b/g },
+    // Stripe — live and test
+    { name: "stripe-key", pattern: /\b(?:sk|pk|rk)_(?:live|test)_[0-9A-Za-z]{20,}\b/g },
+    // Slack
+    { name: "slack-token", pattern: /\bxox[abprs]-[0-9A-Za-z-]{10,}\b/g },
+    // Google API (AIza prefix)
+    { name: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    // npm token (modern format)
+    { name: "npm-token", pattern: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    // JWT (header.payload.signature, all base64url)
+    { name: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    // PEM-armored private keys (multiline). These leak through commit messages
+    // and PR descriptions surprisingly often when copy/paste goes wrong.
+    {
+        name: "pem-private-key",
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    },
+    // Generic bearer tokens (RFC 6750). Less specific — placed last so it does
+    // not eat more specific patterns above.
+    { name: "bearer-token", pattern: /\bBearer\s+[A-Za-z0-9._~+/-]{20,}=*\b/g },
+];
+/** Lower-confidence rules — gated behind `aggressive: true`. */
+const AGGRESSIVE_RULES = [
+    // password=... in commit text. Conservative bounds prevent eating commit messages.
+    // Lookbehind excludes alphanumerics (so "subpassword=..." doesn't fire) but
+    // *allows* `_` and `-` (so "DB_PASSWORD=..." and "API-KEY=..." both match —
+    // \b alone doesn't, because regex \b treats `_` as a word character).
+    {
+        name: "password-assignment",
+        pattern: /(?<![A-Za-z0-9])(?:password|passwd|pwd|api[_-]?key|secret|token)\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
+    },
+    // Long hex blobs (likely a key or hash). Bounded to avoid eating short SHAs.
+    // Note: 40-char SHA1 hashes will match — false positives are expected here.
+    {
+        name: "hex-blob",
+        pattern: /\b[0-9a-fA-F]{64,}\b/g,
+    },
+];
+/**
+ * Redact every match of every active rule from the input text.
+ * Returns the redacted text plus per-rule hit counts.
+ */
+export function redact(text, opts = {}) {
+    if (!text)
+        return { text, hits: {} };
+    const disabled = new Set(opts.disableRules ?? []);
+    const rules = [];
+    for (const r of BUILTIN_RULES)
+        if (!disabled.has(r.name))
+            rules.push(r);
+    if (opts.aggressive)
+        for (const r of AGGRESSIVE_RULES)
+            if (!disabled.has(r.name))
+                rules.push(r);
+    if (opts.extraRules)
+        for (const r of opts.extraRules)
+            rules.push(r);
+    const hits = {};
+    let out = text;
+    for (const rule of rules) {
+        // Re-create regex per-call to avoid lastIndex pollution from prior runs.
+        const re = new RegExp(rule.pattern.source, rule.pattern.flags.includes("g") ? rule.pattern.flags : rule.pattern.flags + "g");
+        let count = 0;
+        out = out.replace(re, () => {
+            count += 1;
+            return rule.replacement ?? `<REDACTED:${rule.name}>`;
+        });
+        if (count > 0)
+            hits[rule.name] = count;
+    }
+    return { text: out, hits };
+}
+/**
+ * Returns true iff the text contains any match for any active rule. Useful
+ * when you want to short-circuit (e.g. refuse to send to remote embedder)
+ * rather than redact-and-send.
+ */
+export function containsSecret(text, opts = {}) {
+    return Object.keys(redact(text, opts).hits).length > 0;
+}
+/**
+ * Aggregate hit counters across many redactions — useful for audit reporting
+ * after a full index run.
+ */
+export function mergeHits(a, b) {
+    const out = { ...a };
+    for (const [k, v] of Object.entries(b))
+        out[k] = (out[k] ?? 0) + v;
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/util/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/util/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2BH;;;;;;;GAOG;AACH,MAAM,aAAa,GAAoB;IACrC,uDAAuD;IACvD,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAEvG,iFAAiF;IACjF,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACrE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,mCAAmC,EAAE;IAEjF,SAAS;IACT,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAEhE,yCAAyC;IACzC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACpE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAE3D,yBAAyB;IACzB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kDAAkD,EAAE;IAEnF,QAAQ;IACR,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE;IAErE,2BAA2B;IAC3B,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAEjE,4BAA4B;IAC5B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAE1D,gDAAgD;IAChD,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oEAAoE,EAAE;IAE9F,2EAA2E;IAC3E,qEAAqE;IACrE;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,6EAA6E;KACvF;IAED,2EAA2E;IAC3E,wCAAwC;IACxC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,wCAAwC,EAAE;CAC5E,CAAC;AAEF,gEAAgE;AAChE,MAAM,gBAAgB,GAAoB;IACxC,mFAAmF;IACnF,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mGAAmG;KAC7G;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,uBAAuB;KACjC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAAsB,EAAE;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,aAAa;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,MAAM,CAAC,IAAI,gBAAgB;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,yEAAyE;QACzE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAC7H,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE;YACzB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,IAAI,aAAa,IAAI,CAAC,IAAI,GAAG,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAsB,EAAE;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,CAAyB,EAAE,CAAyB;IAC5E,MAAM,GAAG,GAA2B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/util/redact.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redact.test.d.ts.map

package/dist/util/redact.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.d.ts","sourceRoot":"","sources":["../../src/util/redact.test.ts"],"names":[],"mappings":""}

package/dist/util/redact.test.js

@@ -0,0 +1,148 @@
+import { describe, it, expect } from "vitest";
+import { redact, containsSecret, mergeHits } from "./redact.js";
+describe("redact — high-confidence rules", () => {
+    it("strips AWS access key id (AKIA prefix)", () => {
+        const r = redact("token=AKIAIOSFODNN7EXAMPLE in config");
+        expect(r.text).toContain("<REDACTED:aws-access-key-id>");
+        expect(r.text).not.toContain("AKIAIOSFODNN7EXAMPLE");
+        expect(r.hits["aws-access-key-id"]).toBe(1);
+    });
+    it("strips AWS access key id (ASIA prefix — temp credentials)", () => {
+        const r = redact("ASIAIOSFODNN7EXAMPLE");
+        expect(r.text).toContain("<REDACTED:aws-access-key-id>");
+    });
+    it("strips GitHub PAT (ghp_ classic)", () => {
+        const tok = "ghp" + "_" + "A".repeat(36);
+        const r = redact(`Cloning with ${tok} failed`);
+        expect(r.text).toContain("<REDACTED:github-pat>");
+        expect(r.hits["github-pat"]).toBe(1);
+    });
+    it("strips GitHub fine-grained PAT (github_pat_ prefix)", () => {
+        const tok = "github" + "_pat_" + "A".repeat(85);
+        const r = redact(`token=${tok}`);
+        expect(r.text).not.toContain(tok);
+    });
+    it("strips Stripe live secret keys", () => {
+        // Constructed at runtime so the source file does not contain a literal
+        // string that GitHub's secret scanner flags as a real Stripe key.
+        const stripeKey = "sk" + "_live_" + "A".repeat(24);
+        const r = redact(`Stripe key: ${stripeKey}`);
+        expect(r.text).toContain("<REDACTED:stripe-key>");
+    });
+    it("strips OpenAI keys (sk- prefix)", () => {
+        const openaiKey = "sk" + "-" + "A".repeat(20);
+        const r = redact(`OPENAI_API_KEY=${openaiKey}`);
+        expect(r.text).toContain("<REDACTED:openai-key>");
+    });
+    it("strips Anthropic keys (sk-ant- prefix)", () => {
+        const anthropicKey = "sk" + "-ant-" + "A".repeat(32);
+        const r = redact(`ANTHROPIC_API_KEY=${anthropicKey}`);
+        expect(r.text).toContain("<REDACTED:anthropic-key>");
+    });
+    it("strips Slack tokens (xox prefix)", () => {
+        // Constructed at runtime to avoid GitHub secret-scanner false positives.
+        const slackToken = "xox" + "b-" + "1234567890-1234567890-" + "A".repeat(14);
+        const r = redact(`Slack: ${slackToken}`);
+        expect(r.text).toContain("<REDACTED:slack-token>");
+    });
+    it("strips Google API keys (AIza prefix)", () => {
+        // Real format: AIza + exactly 35 chars of [0-9A-Za-z_-]
+        const key = "AIza" + "B".repeat(35);
+        const r = redact(`GOOGLE_API_KEY=${key}`);
+        expect(r.text).toContain("<REDACTED:google-api-key>");
+    });
+    it("strips npm tokens", () => {
+        const r = redact("NPM_TOKEN=npm_" + "x".repeat(36));
+        expect(r.text).toContain("<REDACTED:npm-token>");
+    });
+    it("strips JWTs (3 base64url segments)", () => {
+        const jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" +
+            ".eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4ifQ" +
+            ".SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+        const r = redact(`auth: ${jwt}`);
+        expect(r.text).toContain("<REDACTED:jwt>");
+    });
+    it("strips multiline PEM private keys", () => {
+        const pem = [
+            "-----BEGIN RSA PRIVATE KEY-----",
+            "MIIBOQIBAAJAVhx/mmddhM4...",
+            "-----END RSA PRIVATE KEY-----",
+        ].join("\n");
+        const r = redact(`config:\n${pem}\nend`);
+        expect(r.text).toContain("<REDACTED:pem-private-key>");
+        expect(r.text).not.toContain("MIIBOQIBAAJAVhx");
+    });
+    it("strips Bearer tokens", () => {
+        const r = redact("Authorization: Bearer abcDEFghiJKLmnoPQRstuVWXyz0123456");
+        expect(r.text).toContain("<REDACTED:bearer-token>");
+    });
+    it("counts multiple hits per rule", () => {
+        const r = redact("k1=AKIAIOSFODNN7EXAMPLE k2=AKIAIOSFODNN7EXAMPLF");
+        expect(r.hits["aws-access-key-id"]).toBe(2);
+    });
+    it("counts hits across rules", () => {
+        const r = redact("aws=AKIAIOSFODNN7EXAMPLE gh=ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+        expect(r.hits["aws-access-key-id"]).toBe(1);
+        expect(r.hits["github-pat"]).toBe(1);
+    });
+    it("leaves clean text unchanged", () => {
+        const text = "Fix Stripe webhook crash on amount=BigInt overflow";
+        const r = redact(text);
+        expect(r.text).toBe(text);
+        expect(r.hits).toEqual({});
+    });
+    it("handles empty input", () => {
+        expect(redact("").text).toBe("");
+        expect(redact("").hits).toEqual({});
+    });
+});
+describe("redact — aggressive mode", () => {
+    it('catches generic password=... when { aggressive: true }', () => {
+        const r = redact("DB_PASSWORD=hunter2-very-long-password", { aggressive: true });
+        expect(r.text).toContain("<REDACTED:password-assignment>");
+    });
+    it("does NOT catch generic password=... by default (false-positive avoidance)", () => {
+        const r = redact("DB_PASSWORD=hunter2-very-long-password");
+        expect(r.text).toContain("hunter2-very-long-password");
+    });
+    it("catches long hex blobs only when aggressive", () => {
+        const hex = "a".repeat(64);
+        expect(redact(hex).text).toBe(hex);
+        expect(redact(hex, { aggressive: true }).text).toContain("<REDACTED:hex-blob>");
+    });
+});
+describe("redact — custom rules and overrides", () => {
+    it("applies extraRules from caller", () => {
+        const r = redact("internal-secret=XYZZY", {
+            extraRules: [{ name: "internal-secret", pattern: /\binternal-secret=[A-Z]+/g }],
+        });
+        expect(r.text).toContain("<REDACTED:internal-secret>");
+    });
+    it("respects custom replacement string when built-in is disabled", () => {
+        const r = redact("k=AKIAIOSFODNN7EXAMPLE", {
+            disableRules: ["aws-access-key-id"],
+            extraRules: [{ name: "aws", pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[hidden]" }],
+        });
+        expect(r.text).toBe("k=[hidden]");
+    });
+    it("disableRules removes a built-in rule", () => {
+        const r = redact("AKIAIOSFODNN7EXAMPLE", { disableRules: ["aws-access-key-id"] });
+        expect(r.text).toContain("AKIAIOSFODNN7EXAMPLE");
+        expect(r.hits["aws-access-key-id"]).toBeUndefined();
+    });
+});
+describe("containsSecret", () => {
+    it("returns true when any rule matches", () => {
+        expect(containsSecret("ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")).toBe(true);
+    });
+    it("returns false on clean text", () => {
+        expect(containsSecret("Fix Stripe webhook crash on BigInt amounts")).toBe(false);
+    });
+});
+describe("mergeHits", () => {
+    it("sums per-rule counters across two reports", () => {
+        const merged = mergeHits({ "aws": 2, "gh": 1 }, { "aws": 3, "stripe": 5 });
+        expect(merged).toEqual({ aws: 5, gh: 1, stripe: 5 });
+    });
+});
+//# sourceMappingURL=redact.test.js.map

package/dist/util/redact.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.js","sourceRoot":"","sources":["../../src/util/redact.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEhE,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,QAAQ,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,SAAS,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,CAAC,qBAAqB,YAAY,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,yEAAyE;QACzE,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,GAAG,wBAAwB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,GAAG,GAAG,sCAAsC;YAChD,iDAAiD;YACjD,8CAA8C,CAAC;QACjD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG;YACV,iCAAiC;YACjC,4BAA4B;YAC5B,+BAA+B;SAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,yDAAyD,CAAC,CAAC;QAC5E,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,sEAAsE,CAAC,CAAC;QACzF,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,IAAI,GAAG,oDAAoD,CAAC;QAClE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,MAAM,CAAC,wCAAwC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,GAAG,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAC3D,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,uBAAuB,EAAE;YACxC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,CAAC,wBAAwB,EAAE;YACzC,YAAY,EAAE,CAAC,mBAAmB,CAAC;YACnC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,sBAAsB,EAAE,EAAE,YAAY,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,cAAc,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,cAAc,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/wisdom/calibrator.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Auto-calibrator — picks the search config that maximizes hit rate on the
+ * accumulated feedback set.
+ *
+ * Approach: small-grid search over (semanticWeight × minSemCosine × rrfK).
+ * Re-runs every query in the feedback set with each config and counts how
+ * many of the originally-helpful results stay in top-K. The config with the
+ * highest count wins.
+ *
+ * Pragmatically:
+ *   - Grid is intentionally small (3 × 3 × 2 = 18 configs) to fit in seconds.
+ *   - We only consider feedback where was_helpful = 1 (positive examples).
+ *   - We require ≥ 10 positive examples before calibrating; below that, the
+ *     defaults are statistically stronger than any tuned value.
+ *
+ * The output is written to wisdom_calibration so search() can read the
+ * latest calibrated values without re-running the calibrator.
+ */
+import type { MnemeStore } from "../store/sqlite.js";
+import type { EmbeddingProvider } from "../types.js";
+import { type CalibrationConfig, type CalibrationRow } from "./types.js";
+export interface CalibrationResult {
+    /** The winning config. If no calibration ran, equals DEFAULT_CALIBRATION. */
+    config: CalibrationConfig;
+    /** Score on the feedback set: fraction of helpful results re-found in top-3. */
+    hitRate: number;
+    /** Number of positive examples evaluated (gating threshold: 10). */
+    positiveExamples: number;
+    /** Whether the calibrator actually ran or returned defaults. */
+    calibrated: boolean;
+    /** The full grid result, sorted desc by hitRate. */
+    grid: Array<CalibrationConfig & {
+        hitRate: number;
+    }>;
+}
+export declare function calibrate(store: MnemeStore, embedder?: EmbeddingProvider): Promise<CalibrationResult>;
+export declare function persistCalibration(store: MnemeStore, key: string, config: CalibrationConfig & {
+    hitRate: number;
+}, metricName: string, notes?: string): void;
+/** Read back the current calibration. Returns DEFAULT_CALIBRATION if no row. */
+export declare function readCalibration(store: MnemeStore, key?: string): CalibrationConfig;
+export declare function listCalibrations(store: MnemeStore): CalibrationRow[];
+//# sourceMappingURL=calibrator.d.ts.map

package/dist/wisdom/calibrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calibrator.d.ts","sourceRoot":"","sources":["../../src/wisdom/calibrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEpB,MAAM,YAAY,CAAC;AAWpB,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,EAAE,iBAAiB,CAAC;IAC1B,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,UAAU,EAAE,OAAO,CAAC;IACpB,oDAAoD;IACpD,IAAI,EAAE,KAAK,CAAC,iBAAiB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAID,wBAAsB,SAAS,CAC7B,KAAK,EAAE,UAAU,EACjB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAmD5B;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,iBAAiB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/C,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,IAAI,CAmBN;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,SAAW,GAAG,iBAAiB,CAiBpF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,EAAE,CAsBpE"}

package/dist/wisdom/calibrator.js

@@ -0,0 +1,120 @@
+/**
+ * Auto-calibrator — picks the search config that maximizes hit rate on the
+ * accumulated feedback set.
+ *
+ * Approach: small-grid search over (semanticWeight × minSemCosine × rrfK).
+ * Re-runs every query in the feedback set with each config and counts how
+ * many of the originally-helpful results stay in top-K. The config with the
+ * highest count wins.
+ *
+ * Pragmatically:
+ *   - Grid is intentionally small (3 × 3 × 2 = 18 configs) to fit in seconds.
+ *   - We only consider feedback where was_helpful = 1 (positive examples).
+ *   - We require ≥ 10 positive examples before calibrating; below that, the
+ *     defaults are statistically stronger than any tuned value.
+ *
+ * The output is written to wisdom_calibration so search() can read the
+ * latest calibrated values without re-running the calibrator.
+ */
+import { search } from "../retrieve/search.js";
+import { listFeedback } from "./feedback.js";
+import { DEFAULT_CALIBRATION, } from "./types.js";
+const SEARCH_GRID = [];
+for (const semanticWeight of [0.4, 0.65, 0.85]) {
+    for (const minSemCosine of [0.3, 0.4, 0.5]) {
+        for (const rrfK of [60, 30]) {
+            SEARCH_GRID.push({ semanticWeight, minSemCosine, rrfK });
+        }
+    }
+}
+const MIN_POSITIVE_EXAMPLES = 10;
+export async function calibrate(store, embedder) {
+    const positives = listFeedback(store, { limit: 500 }).filter((f) => f.wasHelpful === 1 && f.resultHashes.length > 0);
+    if (positives.length < MIN_POSITIVE_EXAMPLES) {
+        return {
+            config: DEFAULT_CALIBRATION,
+            hitRate: 0,
+            positiveExamples: positives.length,
+            calibrated: false,
+            grid: [],
+        };
+    }
+    const results = [];
+    for (const config of SEARCH_GRID) {
+        let hits = 0;
+        for (const ex of positives) {
+            // The "ground truth" is the top-3 hashes from the original query —
+            // we re-run with the candidate config and check overlap.
+            const groundTruth = new Set(ex.resultHashes.slice(0, 3));
+            const re = await search(ex.query, {
+                store,
+                embedder,
+                topK: 3,
+                semanticWeight: config.semanticWeight,
+                confidenceFloor: { minFtsHits: 1, minSemCosine: config.minSemCosine },
+            });
+            const reHashes = new Set(re.map((r) => r.commit.hash));
+            // Count this query as a "hit" if at least one of the original useful
+            // results is still surfaced.
+            const overlap = [...groundTruth].some((h) => reHashes.has(h));
+            if (overlap)
+                hits += 1;
+        }
+        results.push({ ...config, hitRate: hits / positives.length });
+    }
+    results.sort((a, b) => b.hitRate - a.hitRate);
+    const best = results[0];
+    persistCalibration(store, "search", best, "hit_rate");
+    return {
+        config: { semanticWeight: best.semanticWeight, minSemCosine: best.minSemCosine, rrfK: best.rrfK },
+        hitRate: best.hitRate,
+        positiveExamples: positives.length,
+        calibrated: true,
+        grid: results,
+    };
+}
+export function persistCalibration(store, key, config, metricName, notes) {
+    store.db
+        .prepare(`INSERT OR REPLACE INTO wisdom_calibration
+       (key, value, metric_value, metric_name, calibrated_at, notes)
+       VALUES (?, ?, ?, ?, ?, ?)`)
+        .run(key, JSON.stringify({
+        semanticWeight: config.semanticWeight,
+        minSemCosine: config.minSemCosine,
+        rrfK: config.rrfK,
+    }), config.hitRate, metricName, new Date().toISOString(), notes ?? null);
+}
+/** Read back the current calibration. Returns DEFAULT_CALIBRATION if no row. */
+export function readCalibration(store, key = "search") {
+    const row = store.db
+        .prepare(`SELECT value FROM wisdom_calibration WHERE key = ? ORDER BY calibrated_at DESC LIMIT 1`)
+        .get(key);
+    if (!row)
+        return DEFAULT_CALIBRATION;
+    try {
+        const parsed = JSON.parse(row.value);
+        return {
+            semanticWeight: parsed.semanticWeight ?? DEFAULT_CALIBRATION.semanticWeight,
+            minSemCosine: parsed.minSemCosine ?? DEFAULT_CALIBRATION.minSemCosine,
+            rrfK: parsed.rrfK ?? DEFAULT_CALIBRATION.rrfK,
+        };
+    }
+    catch {
+        return DEFAULT_CALIBRATION;
+    }
+}
+export function listCalibrations(store) {
+    const rows = store.db
+        .prepare(`SELECT key, value, metric_value, metric_name, calibrated_at, notes
+       FROM wisdom_calibration ORDER BY calibrated_at DESC`)
+        .all();
+    return rows.map((r) => ({
+        key: r.key,
+        value: JSON.parse(r.value),
+        metricValue: r.metric_value ?? undefined,
+        metricName: r.metric_name ?? undefined,
+        calibratedAt: r.calibrated_at,
+        notes: r.notes ?? undefined,
+    }));
+}
+//# sourceMappingURL=calibrator.js.map

package/dist/wisdom/calibrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calibrator.js","sourceRoot":"","sources":["../../src/wisdom/calibrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAGL,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,GAAwB,EAAE,CAAC;AAC5C,KAAK,MAAM,cAAc,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IAC/C,KAAK,MAAM,YAAY,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAeD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAiB,EACjB,QAA4B;IAE5B,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAC1D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CACvD,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,CAAC;YACV,gBAAgB,EAAE,SAAS,CAAC,MAAM;YAClC,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAmD,EAAE,CAAC;IAEnE,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;gBAChC,KAAK;gBACL,QAAQ;gBACR,IAAI,EAAE,CAAC;gBACP,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;aACtE,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,qEAAqE;YACrE,6BAA6B;YAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,OAAO;gBAAE,IAAI,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAEzB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QACjG,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,SAAS,CAAC,MAAM;QAClC,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,GAAW,EACX,MAA+C,EAC/C,UAAkB,EAClB,KAAc;IAEd,KAAK,CAAC,EAAE;SACL,OAAO,CACN;;iCAE2B,CAC5B;SACA,GAAG,CACF,GAAG,EACH,IAAI,CAAC,SAAS,CAAC;QACb,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,EACF,MAAM,CAAC,OAAO,EACd,UAAU,EACV,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,KAAK,IAAI,IAAI,CACd,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,GAAG,GAAG,QAAQ;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CACN,wFAAwF,CACzF;SACA,GAAG,CAAC,GAAG,CAAkC,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA+B,CAAC;QACnE,OAAO;YACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc;YAC3E,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,mBAAmB,CAAC,YAAY;YACrE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;SAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE;SAClB,OAAO,CACN;2DACqD,CACtD;SACA,GAAG,EAOJ,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAY;QACrC,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACxC,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;QACtC,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;KAC5B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/wisdom/feedback.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Feedback collector — every `mneme ask` writes one row.
+ *
+ * was_helpful starts NULL and is filled by:
+ *   - explicit:        `mneme feedback <id> up|down`
+ *   - implicit-revisit: the user ran `mneme why <commit>` on a returned commit
+ *                       within 5 minutes — strong positive signal.
+ *   - implicit-reuse:   the user did not re-ask a slightly-different version of
+ *                       the same query within 60s — weak positive signal.
+ *
+ * Why these heuristics: they require zero UX work from the user. The
+ * explicit path exists for power users; the implicit paths cover the 95%.
+ */
+import type { MnemeStore } from "../store/sqlite.js";
+import type { FeedbackRow } from "./types.js";
+export interface RecordFeedbackInput {
+    query: string;
+    resultHashes: string[];
+    topScore?: number;
+    semanticWeight?: number;
+    minSemCosine?: number;
+    rrfK?: number;
+}
+/** Insert a pending feedback row. Returns the id so callers can update it later. */
+export declare function recordQuery(store: MnemeStore, input: RecordFeedbackInput): string;
+/** Set was_helpful for a feedback row. */
+export declare function setHelpful(store: MnemeStore, id: string, wasHelpful: boolean, source?: FeedbackRow["source"]): boolean;
+/**
+ * Implicit positive signal: the user looked at one of the returned commits
+ * via `mneme why`. We mark the most recent matching pending row as helpful.
+ */
+export declare function recordImplicitRevisit(store: MnemeStore, commitHash: string): number;
+export declare function listFeedback(store: MnemeStore, opts?: {
+    since?: string;
+    limit?: number;
+}): FeedbackRow[];
+export interface FeedbackSummary {
+    total: number;
+    helpful: number;
+    unhelpful: number;
+    pending: number;
+    hitRate: number;
+}
+export declare function summarizeFeedback(store: MnemeStore, since?: string): FeedbackSummary;
+//# sourceMappingURL=feedback.d.ts.map

package/dist/wisdom/feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedback.d.ts","sourceRoot":"","sources":["../../src/wisdom/feedback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAqBjF;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,OAAO,EACnB,MAAM,GAAE,WAAW,CAAC,QAAQ,CAAc,GACzC,OAAO,CAKT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAsBnF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,EAAE,CAwC5G;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,CA0BpF"}