@pyxmate/memory 1.17.14 → 1.17.15

package/dist/{chunk-3QDXACBV.mjs → chunk-LGNSLDGB.mjs}

@@ -62,6 +62,40 @@ function projectSearchResponseForMcp(payload) {
   return projectSearchResultRecord(payload);
 }
 
+// ../shared/src/mcp/secret-elevation-notice.ts
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function elevationMessage(credentialTypes) {
+  const types = credentialTypes.length > 0 ? credentialTypes.join(", ") : "unspecified";
+  return `Auto-classified sensitivity=secret because credential patterns were detected (credentialTypes: ${types}). Secret entries are invisible to hosted MCP reads \u2014 search, get and list all cap MCP callers at internal. When an encryption key is configured the content is also encrypted at rest and embedded as a placeholder, so REST callers lose semantic search recall for it too (REST list/get still return the row). If this is a false positive: delete the entry by id, or store it again under the same id with the credential-shaped notation rephrased \u2014 a same-id re-store re-classifies the content. A canonical entry carrying metadata.dbRef.revision must advance that revision on the re-store, or it fails with revision_reuse_conflict.`;
+}
+function secretElevationNoticeFor(entry) {
+  if (!isRecord2(entry) || entry.sensitivity !== "secret") return void 0;
+  const metadata = entry.metadata;
+  if (!isRecord2(metadata) || metadata.credentialsDetected !== true) return void 0;
+  const credentialTypes = Array.isArray(metadata.credentialTypes) ? metadata.credentialTypes.filter((type) => typeof type === "string") : [];
+  return { sensitivity: "secret", credentialTypes, message: elevationMessage(credentialTypes) };
+}
+function withSecretElevationNotice(payload) {
+  if (!isRecord2(payload)) return payload;
+  const entry = isRecord2(payload.data) ? payload.data : payload;
+  const notice = secretElevationNoticeFor(entry);
+  if (!notice) return payload;
+  const elevated = { ...entry, secretElevation: notice };
+  return entry === payload ? elevated : { ...payload, data: elevated };
+}
+function secretElevationAggregate(elevated) {
+  if (elevated.length === 0) return void 0;
+  const credentialTypes = [...new Set(elevated.flatMap((item) => item.notice.credentialTypes))];
+  return {
+    count: elevated.length,
+    entryIds: elevated.map((item) => item.entryId),
+    credentialTypes,
+    message: `${elevated.length} stored chunk(s) were auto-elevated. ${elevationMessage(credentialTypes)}`
+  };
+}
+
 // ../shared/src/types/isolation.ts
 var NamespaceIsolation = {
   SHARED: "shared",
@@ -1022,6 +1056,9 @@ export {
   DEFAULTS,
   TAXONOMY_MAX_CATEGORIES,
   projectSearchResponseForMcp,
+  secretElevationNoticeFor,
+  withSecretElevationNotice,
+  secretElevationAggregate,
   NamespaceIsolation,
   MemoryType,
   SensitivityLevel,

package/dist/{chunk-X3QODOJV.mjs → chunk-WDF5LAZS.mjs}

@@ -1,6 +1,6 @@
 import {
   MemoryClient
-} from "./chunk-3QDXACBV.mjs";
+} from "./chunk-LGNSLDGB.mjs";
 
 // ../dashboard/src/aggregations/consolidation-analytics.ts
 function analyzeConsolidationLog(entries) {

package/dist/cli/pyx-mem.mjs

@@ -835,7 +835,7 @@ function createProxyServer(client, version, uploadLocalFile) {
   return server;
 }
 async function runMcpProxyServer(opts) {
-  const version = opts.version ?? (true ? "1.17.14" : "0.0.0-dev");
+  const version = opts.version ?? (true ? "1.17.15" : "0.0.0-dev");
   const read = await opts.readCredentials();
   if (!read.ok) {
     const text = read.result.content.map((c) => c.type === "text" ? c.text : "").join(" ").trim();

package/dist/dashboard.mjs

@@ -11,8 +11,8 @@ import {
   toGraphologyFormat,
   transformGraphData,
   unreachableHealth
-} from "./chunk-X3QODOJV.mjs";
-import "./chunk-3QDXACBV.mjs";
+} from "./chunk-WDF5LAZS.mjs";
+import "./chunk-LGNSLDGB.mjs";
 import "./chunk-A3L46P2G.mjs";
 export {
   DashboardClient,

package/dist/index.d.ts

@@ -1307,6 +1307,47 @@ declare function mergeExtractedEntities(callerEntities: IngestEntity[] | undefin
 
 declare function projectSearchResponseForMcp(payload: unknown): unknown;
 
+/**
+ * Secret-elevation notice — one implementation of the predicate and the notice
+ * text for every store surface that can silently lose an entry to automatic
+ * credential classification: the strict hosted MCP store branch, the self-host
+ * MCP store tool, and file ingestion. Three copies of this text drifting apart
+ * is the failure mode this module exists to prevent.
+ */
+/** Notice attached to a single auto-elevated store response. */
+interface SecretElevationNotice {
+    sensitivity: 'secret';
+    credentialTypes: string[];
+    message: string;
+}
+/** Aggregate notice for one file ingest, where many chunks store at once. */
+interface SecretElevationAggregate {
+    count: number;
+    entryIds: string[];
+    credentialTypes: string[];
+    message: string;
+}
+/**
+ * D3 predicate: the entry was elevated by the classifier, not by the caller.
+ * A deliberate `sensitivity: 'secret'` store carries no `credentialsDetected`
+ * flag and gets no notice.
+ */
+declare function secretElevationNoticeFor(entry: unknown): SecretElevationNotice | undefined;
+/**
+ * Attach the notice to a store response, returning the payload untouched when
+ * the entry was not auto-elevated. Accepts either the bare stored entry (strict
+ * hosted path) or the `{ success, data }` envelope the SDK http client surfaces
+ * (`http-client.ts` sets `res.data` to the whole envelope, so the entry sits at
+ * `payload.data`). Never mutates its argument: the stored entry and the
+ * canonical payload the receipt digest covers must stay byte-identical.
+ */
+declare function withSecretElevationNotice(payload: unknown): unknown;
+/** Aggregate one file ingest's per-chunk notices. Undefined when nothing elevated. */
+declare function secretElevationAggregate(elevated: Array<{
+    entryId: string;
+    notice: SecretElevationNotice;
+}>): SecretElevationAggregate | undefined;
+
 interface ApiResponse<T> {
     success: boolean;
     data?: T;
@@ -1419,6 +1460,8 @@ interface FileIngestResult {
     totalCharacters: number;
     /** Present when images were extracted (v1) OR text windows / images were emitted (v2). */
     enrichment?: EnrichmentPending;
+    /** Present only when ≥1 stored chunk was auto-classified secret by credential detection. */
+    secretElevation?: SecretElevationAggregate;
 }
 /** Coarse pipeline stages. Stable vocabulary — finer detail goes in counters/message. */
 type IngestStage = 'parsing' | 'storing' | 'enrichment' | 'complete';
@@ -1593,4 +1636,4 @@ interface CreatePyxMemoryOptions {
 }
 declare function createPyxMemory(opts?: CreatePyxMemoryOptions): MemoryClient;
 
-export { type AgentId, type ApiResponse, type ConsolidationRunResult, type CorrectionInput, type CorrectionRecord, type CreatePyxMemoryOptions, DEFAULTS, DEPRECATED_RAG_STRATEGIES, DisabledMemory, type DroppedGraphRelationship, type DueScanInput, EmbeddingProviderName, type EnrichmentCallbacks, type EntityExtractionResult, type ExtendedMemoryInterface, type FetchCorrectionsInput, type GraphEnrichment, type GraphEnrichmentStatus, type GraphFailureMode, type GraphNode, type GraphRelationship, type GraphRepairResult, type GraphTelemetrySnapshot, type GraphTraversalResult, type IngestEntity, type IngestErrorEvent, type IngestEvent, type IngestFileOptions, type IngestHeartbeatEvent, type IngestProgressEvent, type IngestRelationship, type IngestResultEvent, type IngestStage, type IngestionResult, type LineageParams, type LineageResult, type LineageVersion, MemoryClient, type MemoryClientOptions, type MemoryEntry, type MemoryIngestRequest, type MemoryInterface, type MemoryListParams, type MemoryListResult, type MemoryLogFilters, type MemorySearchParams, type MemorySearchResult, MemoryServerError, type MemoryStats, MemoryType, type MoveEntriesFilter, MoveFailureReason, type MoveResult, type MoveTarget, NamespaceIsolation, type PrincipalContext, RAGStrategy, type ReinforceParams, type ReinforceResult, type ReinforceSignal, SINGLE_TENANT_ID, SensitivityLevel, type SourceEvidence, type StoreInput, StoreTarget, TAXONOMY_MAX_CATEGORIES, type TemporalQueryFilters, type TenantScopeOptions, type Timestamp, type Topology, type TopologyExtractionProvider, type TopologyServiceVariant, type UsageHygieneSnapshot, VectorProvider, type VectorStatus, type WikiLintReport, createPyxMemory, mergeExtractedEntities, normalizeGraphLabel, normalizeNameKey, projectSearchResponseForMcp };
+export { type AgentId, type ApiResponse, type ConsolidationRunResult, type CorrectionInput, type CorrectionRecord, type CreatePyxMemoryOptions, DEFAULTS, DEPRECATED_RAG_STRATEGIES, DisabledMemory, type DroppedGraphRelationship, type DueScanInput, EmbeddingProviderName, type EnrichmentCallbacks, type EntityExtractionResult, type ExtendedMemoryInterface, type FetchCorrectionsInput, type GraphEnrichment, type GraphEnrichmentStatus, type GraphFailureMode, type GraphNode, type GraphRelationship, type GraphRepairResult, type GraphTelemetrySnapshot, type GraphTraversalResult, type IngestEntity, type IngestErrorEvent, type IngestEvent, type IngestFileOptions, type IngestHeartbeatEvent, type IngestProgressEvent, type IngestRelationship, type IngestResultEvent, type IngestStage, type IngestionResult, type LineageParams, type LineageResult, type LineageVersion, MemoryClient, type MemoryClientOptions, type MemoryEntry, type MemoryIngestRequest, type MemoryInterface, type MemoryListParams, type MemoryListResult, type MemoryLogFilters, type MemorySearchParams, type MemorySearchResult, MemoryServerError, type MemoryStats, MemoryType, type MoveEntriesFilter, MoveFailureReason, type MoveResult, type MoveTarget, NamespaceIsolation, type PrincipalContext, RAGStrategy, type ReinforceParams, type ReinforceResult, type ReinforceSignal, SINGLE_TENANT_ID, type SecretElevationAggregate, type SecretElevationNotice, SensitivityLevel, type SourceEvidence, type StoreInput, StoreTarget, TAXONOMY_MAX_CATEGORIES, type TemporalQueryFilters, type TenantScopeOptions, type Timestamp, type Topology, type TopologyExtractionProvider, type TopologyServiceVariant, type UsageHygieneSnapshot, VectorProvider, type VectorStatus, type WikiLintReport, createPyxMemory, mergeExtractedEntities, normalizeGraphLabel, normalizeNameKey, projectSearchResponseForMcp, secretElevationAggregate, secretElevationNoticeFor, withSecretElevationNotice };

package/dist/index.mjs

@@ -14,8 +14,11 @@ import {
   StoreTarget,
   TAXONOMY_MAX_CATEGORIES,
   VectorProvider,
-  projectSearchResponseForMcp
-} from "./chunk-3QDXACBV.mjs";
+  projectSearchResponseForMcp,
+  secretElevationAggregate,
+  secretElevationNoticeFor,
+  withSecretElevationNotice
+} from "./chunk-LGNSLDGB.mjs";
 import {
   mergeExtractedEntities,
   normalizeGraphLabel,
@@ -55,5 +58,8 @@ export {
   mergeExtractedEntities,
   normalizeGraphLabel,
   normalizeNameKey,
-  projectSearchResponseForMcp
+  projectSearchResponseForMcp,
+  secretElevationAggregate,
+  secretElevationNoticeFor,
+  withSecretElevationNotice
 };

package/dist/react.mjs

@@ -11,8 +11,8 @@ import {
   toGraphologyFormat,
   transformGraphData,
   unreachableHealth
-} from "./chunk-X3QODOJV.mjs";
-import "./chunk-3QDXACBV.mjs";
+} from "./chunk-WDF5LAZS.mjs";
+import "./chunk-LGNSLDGB.mjs";
 import "./chunk-A3L46P2G.mjs";
 
 // ../dashboard/src/hooks/use-consolidation-log.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyxmate/memory",
-  "version": "1.17.14",
+  "version": "1.17.15",
   "type": "module",
   "description": "SDK for pyx-memory — Memory as a Service for AI agents",
   "license": "MIT",