hippo-memory 1.28.0 → 1.30.0

package/dist/memory-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-value.js","sourceRoot":"","sources":["../src/memory-value.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEzF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAyC;IACpE,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;CACjB,CAAC;AAEF;2EAC2E;AAC3E,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAa5B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAkB,EAAE,GAAS;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,uDAAuD;QAChG,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,GAAG;QACrB,aAAa,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,mEAAmE;QACjH,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA4C,oBAAoB,EAChE,SAAiB,sBAAsB;IAEvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,2BAA2B;gBAChF,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAsB,EACtB,GAAS,EACT,UAA4C,oBAAoB;IAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;QAC1B,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,IAAI,GAAG,GAAG,QAAQ,CAAC;QACnB,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAwB,EAAE,CAAS,EAAU,EAAE;QAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACpC,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;QAC1B,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,gBAAgB;YAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,GAAS,EACT,UAA4C,oBAAoB,EAChE,SAAiB,sBAAsB;IAEvC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS,CAAC,gEAAgE;QACxF,kEAAkE;QAClE,uEAAuE;QACvE,8DAA8D;QAC9D,qEAAqE;QACrE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,iDAAiD;QACjD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;YACnD,OAAO,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,gBAAgB;YAC5C,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACf,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE;gBACxB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,MAAM,CAAC,MAAM;gBAC7B,KAAK;aACN,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CACvB,OAAsB,EACtB,YAAyB,EACzB,GAAS,EACT,UAA4C,oBAAoB,EAChE,SAAiB,sBAAsB,EACvC,gBAA0C;IAE1C,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,yDAAyD;IAC3F,MAAM,MAAM,GAAG,gBAAgB,IAAI,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/recall-trace.d.ts

@@ -0,0 +1,117 @@
+/**
+ * LC1 — retrieval-trace persistence
+ * (docs/plans/2026-08-02-lc1-recall-trace-persistence.md).
+ *
+ * Single producer for the `recall_traces` / `recall_trace_results` /
+ * `recall_trace_outcomes` tables (schema v40). Every recall on the three
+ * wired paths (api.recall, api.getContext, CLI cmdRecall) writes a trace
+ * row: the ids + ranks + scores actually returned. Outcome events that
+ * resolve their targets from last-retrieval state link back to the trace
+ * they judge via `recordTraceOutcome`. This is the (query, shown, outcome)
+ * training triple every Track LC learned component needs.
+ *
+ * All writes here are fail-soft: a broken trace write must never break the
+ * surrounding recall or outcome call. Failures are logged to stderr and
+ * swallowed (matches the api.ts ~2843 "audit emit failed" precedent — no
+ * new debug env var).
+ */
+import { type DatabaseSyncLike } from './db.js';
+import type { RerankStep } from './search.js';
+/** One ranked result to persist alongside its trace row. */
+export interface RecallTraceResultInput {
+    memoryId: string;
+    score: number;
+    /** Per-stage rerank steps when the caller ran with explain/--why; omitted
+     *  (or empty) persists `rerank_json` as NULL. */
+    rerankSteps?: RerankStep[];
+}
+/** Input to `writeRecallTrace` / `writeRecallTraceAtRoot`. */
+export interface RecallTraceInput {
+    tenantId: string;
+    sessionId?: string | null;
+    pipeline: 'api' | 'cli' | 'context' | 'mcp';
+    /** Raw query text. NEVER persisted — only its sha256/16 hash + length are
+     *  stored (GDPR Path A / audit convention, cli.ts:1532). */
+    query: string;
+    /** True when the caller ran with explain/--why (per-result rerank steps
+     *  may be present). Defaults to false. */
+    explainMode?: boolean;
+    /** Results in returned rank order (index 0 = rank 1). */
+    results: RecallTraceResultInput[];
+}
+/**
+ * Insert a `recall_traces` row + its `recall_trace_results` rows in ONE
+ * transaction, on the connection handed in. Fail-soft: never throws —
+ * logs to stderr and returns null on any failure.
+ *
+ * Connection policy (per the plan): api.recall calls this directly on its
+ * own already-open handle. api.getContext and CLI cmdRecall go through
+ * `writeRecallTraceAtRoot` instead, since their audit handles are already
+ * closed by the time tracing runs.
+ */
+export declare function writeRecallTrace(db: DatabaseSyncLike, input: RecallTraceInput): number | null;
+/**
+ * Convenience wrapper: opens a fresh short-lived connection at `root`,
+ * writes the trace, and closes. Returns the new trace id, or null on any
+ * failure (fail-soft).
+ *
+ * Used at api.getContext and CLI cmdRecall — sites where the block's own
+ * convention is per-call handles (writeEntry, saveIndex) and the earlier
+ * audit handles are already closed. NOT used by api.recall, which must
+ * reuse the caller's open handle (v1.11.5 no-side-effects contract,
+ * tests/api-recall-no-side-effects.test.ts).
+ *
+ * F1 structural fix (replaces the earlier stamp-then-clear design): this
+ * function does NOT touch the `last_trace_id` meta key. Stamping lived here
+ * originally, on its own connection, separate from the `last_retrieval_ids`
+ * write in `saveIndex` — two connections meant two commits, so a crash or
+ * a failed second write could advance one without the other. LOCKSTEP
+ * INVARIANT: `last_trace_id` must only ever advance in the SAME write as
+ * `last_retrieval_ids`. The caller now does: call this function FIRST, set
+ * `localIndex.last_trace_id` from the returned id, THEN call `saveIndex`
+ * once — `saveIndex` persists both meta keys in one transaction
+ * (store.ts). Call sites that trace WITHOUT advancing `last_retrieval_ids`
+ * (CLI cmdRecall's zero-result path, getContext's empty-result path) simply
+ * never touch `localIndex` at all — they can't desync by construction.
+ *
+ * Fail-soft: never throws, including on connection failure.
+ */
+export declare function writeRecallTraceAtRoot(root: string, input: RecallTraceInput): number | null;
+/** Input to `recordTraceOutcome`. */
+export interface RecordTraceOutcomeInput {
+    traceId: number;
+    tenantId: string;
+    outcome: 'positive' | 'negative';
+    /** Ids actually credited by this outcome event (post tenant-filtering). */
+    memoryIds: string[];
+}
+/**
+ * Record an outcome event against a trace, linking the (query, shown,
+ * outcome) triple. Called ONLY where the credited ids actually come from
+ * the last-retrieval mechanism (api.outcomeForLastRecall and any outcome
+ * flow that resolves its targets from last-retrieval state) or from an
+ * SDK caller's explicit `traceId` opt — never unconditionally from
+ * api.outcome, which would mislink an explicit-id caller to a stale,
+ * unrelated trace.
+ *
+ * Lives in its own append-only table, not audit_log metadata: audit_log is
+ * pruned by `pruneAuditLog`, and pruning must never erase training data.
+ *
+ * F4 validation (codex cross-model finding): `traceId`/`memoryIds` reach
+ * this function from caller-side state (`last_trace_id` / applied outcome
+ * ids) that can go stale relative to the trace it names — a forgotten
+ * memory, a tenant switch mid-session, or a race between two callers. Two
+ * checks run before the insert, both skip silently (console.error one
+ * line) rather than throw:
+ *   1. The named trace must exist and belong to `input.tenantId` — a
+ *      tenant mismatch or a dangling id (deleted trace) skips.
+ *   2. `input.memoryIds` is intersected against the trace's OWN
+ *      `recall_trace_results.memory_id` set — only ids that trace actually
+ *      returned are recorded. An id that was never in this trace's result
+ *      set (stale caller state) is silently dropped rather than recorded
+ *      as a false credit. If the intersection is empty, no row is written.
+ *
+ * Fail-soft: never throws.
+ */
+export declare function recordTraceOutcome(db: DatabaseSyncLike, input: RecordTraceOutcomeInput): void;
+//# sourceMappingURL=recall-trace.d.ts.map

package/dist/recall-trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recall-trace.d.ts","sourceRoot":"","sources":["../src/recall-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;qDACiD;IACjD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;IAC5C;gEAC4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd;8CAC0C;IAC1C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yDAAyD;IACzD,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAgD7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAc3F;AAED,qCAAqC;AACrC,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;IACjC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,GAAG,IAAI,CA8B7F"}

package/dist/recall-trace.js

@@ -0,0 +1,179 @@
+/**
+ * LC1 — retrieval-trace persistence
+ * (docs/plans/2026-08-02-lc1-recall-trace-persistence.md).
+ *
+ * Single producer for the `recall_traces` / `recall_trace_results` /
+ * `recall_trace_outcomes` tables (schema v40). Every recall on the three
+ * wired paths (api.recall, api.getContext, CLI cmdRecall) writes a trace
+ * row: the ids + ranks + scores actually returned. Outcome events that
+ * resolve their targets from last-retrieval state link back to the trace
+ * they judge via `recordTraceOutcome`. This is the (query, shown, outcome)
+ * training triple every Track LC learned component needs.
+ *
+ * All writes here are fail-soft: a broken trace write must never break the
+ * surrounding recall or outcome call. Failures are logged to stderr and
+ * swallowed (matches the api.ts ~2843 "audit emit failed" precedent — no
+ * new debug env var).
+ */
+import { createHash } from 'node:crypto';
+import { openHippoDb, closeHippoDb } from './db.js';
+/**
+ * Strip a RerankStep down to {stage, multiplier, scoreBefore, scoreAfter}
+ * before persisting (F3 privacy fix, codex cross-model finding). `note` is
+ * free-form human text — the CLI's goal-boost step embeds matched goal tag
+ * text there, so persisting it verbatim would leak raw user content into
+ * training data via `rerank_json`. Only the four structured fields survive;
+ * any other/future free-form field is dropped by construction (allowlist,
+ * not a denylist).
+ */
+function sanitizeRerankSteps(steps) {
+    return steps.map((s) => ({
+        stage: s.stage,
+        multiplier: s.multiplier,
+        scoreBefore: s.scoreBefore,
+        scoreAfter: s.scoreAfter,
+    }));
+}
+/**
+ * Insert a `recall_traces` row + its `recall_trace_results` rows in ONE
+ * transaction, on the connection handed in. Fail-soft: never throws —
+ * logs to stderr and returns null on any failure.
+ *
+ * Connection policy (per the plan): api.recall calls this directly on its
+ * own already-open handle. api.getContext and CLI cmdRecall go through
+ * `writeRecallTraceAtRoot` instead, since their audit handles are already
+ * closed by the time tracing runs.
+ */
+export function writeRecallTrace(db, input) {
+    try {
+        const queryHash = createHash('sha256').update(input.query).digest('hex').slice(0, 16);
+        const ts = new Date().toISOString();
+        db.exec('BEGIN');
+        try {
+            const insertTrace = db.prepare(`
+        INSERT INTO recall_traces (ts, tenant_id, session_id, pipeline, query_hash, query_length, result_count, explain_mode)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `);
+            const traceResult = insertTrace.run(ts, input.tenantId, input.sessionId ?? null, input.pipeline, queryHash, input.query.length, input.results.length, input.explainMode ? 1 : 0);
+            const traceId = Number(traceResult.lastInsertRowid);
+            const insertResult = db.prepare(`
+        INSERT INTO recall_trace_results (trace_id, tenant_id, memory_id, result_rank, score, rerank_json)
+        VALUES (?, ?, ?, ?, ?, ?)
+      `);
+            input.results.forEach((r, i) => {
+                insertResult.run(traceId, input.tenantId, r.memoryId, i + 1, r.score, r.rerankSteps && r.rerankSteps.length > 0 ? JSON.stringify(sanitizeRerankSteps(r.rerankSteps)) : null);
+            });
+            db.exec('COMMIT');
+            return traceId;
+        }
+        catch (error) {
+            db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    catch (error) {
+        // eslint-disable-next-line no-console
+        console.error(`[hippo] recall trace write failed: ${error.message}`);
+        return null;
+    }
+}
+/**
+ * Convenience wrapper: opens a fresh short-lived connection at `root`,
+ * writes the trace, and closes. Returns the new trace id, or null on any
+ * failure (fail-soft).
+ *
+ * Used at api.getContext and CLI cmdRecall — sites where the block's own
+ * convention is per-call handles (writeEntry, saveIndex) and the earlier
+ * audit handles are already closed. NOT used by api.recall, which must
+ * reuse the caller's open handle (v1.11.5 no-side-effects contract,
+ * tests/api-recall-no-side-effects.test.ts).
+ *
+ * F1 structural fix (replaces the earlier stamp-then-clear design): this
+ * function does NOT touch the `last_trace_id` meta key. Stamping lived here
+ * originally, on its own connection, separate from the `last_retrieval_ids`
+ * write in `saveIndex` — two connections meant two commits, so a crash or
+ * a failed second write could advance one without the other. LOCKSTEP
+ * INVARIANT: `last_trace_id` must only ever advance in the SAME write as
+ * `last_retrieval_ids`. The caller now does: call this function FIRST, set
+ * `localIndex.last_trace_id` from the returned id, THEN call `saveIndex`
+ * once — `saveIndex` persists both meta keys in one transaction
+ * (store.ts). Call sites that trace WITHOUT advancing `last_retrieval_ids`
+ * (CLI cmdRecall's zero-result path, getContext's empty-result path) simply
+ * never touch `localIndex` at all — they can't desync by construction.
+ *
+ * Fail-soft: never throws, including on connection failure.
+ */
+export function writeRecallTraceAtRoot(root, input) {
+    let db;
+    try {
+        db = openHippoDb(root);
+    }
+    catch (error) {
+        // eslint-disable-next-line no-console
+        console.error(`[hippo] recall trace connection failed: ${error.message}`);
+        return null;
+    }
+    try {
+        return writeRecallTrace(db, input);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/**
+ * Record an outcome event against a trace, linking the (query, shown,
+ * outcome) triple. Called ONLY where the credited ids actually come from
+ * the last-retrieval mechanism (api.outcomeForLastRecall and any outcome
+ * flow that resolves its targets from last-retrieval state) or from an
+ * SDK caller's explicit `traceId` opt — never unconditionally from
+ * api.outcome, which would mislink an explicit-id caller to a stale,
+ * unrelated trace.
+ *
+ * Lives in its own append-only table, not audit_log metadata: audit_log is
+ * pruned by `pruneAuditLog`, and pruning must never erase training data.
+ *
+ * F4 validation (codex cross-model finding): `traceId`/`memoryIds` reach
+ * this function from caller-side state (`last_trace_id` / applied outcome
+ * ids) that can go stale relative to the trace it names — a forgotten
+ * memory, a tenant switch mid-session, or a race between two callers. Two
+ * checks run before the insert, both skip silently (console.error one
+ * line) rather than throw:
+ *   1. The named trace must exist and belong to `input.tenantId` — a
+ *      tenant mismatch or a dangling id (deleted trace) skips.
+ *   2. `input.memoryIds` is intersected against the trace's OWN
+ *      `recall_trace_results.memory_id` set — only ids that trace actually
+ *      returned are recorded. An id that was never in this trace's result
+ *      set (stale caller state) is silently dropped rather than recorded
+ *      as a false credit. If the intersection is empty, no row is written.
+ *
+ * Fail-soft: never throws.
+ */
+export function recordTraceOutcome(db, input) {
+    try {
+        const trace = db.prepare(`SELECT tenant_id FROM recall_traces WHERE id = ?`).get(input.traceId);
+        if (!trace || trace.tenant_id !== input.tenantId) {
+            // eslint-disable-next-line no-console
+            console.error(`[hippo] recall trace outcome skipped: trace ${input.traceId} missing or tenant mismatch`);
+            return;
+        }
+        const memberRows = db
+            .prepare(`SELECT memory_id FROM recall_trace_results WHERE trace_id = ?`)
+            .all(input.traceId);
+        const members = new Set(memberRows.map((r) => r.memory_id));
+        const credited = input.memoryIds.filter((id) => members.has(id));
+        if (credited.length === 0) {
+            // eslint-disable-next-line no-console
+            console.error(`[hippo] recall trace outcome skipped: no credited ids intersect trace ${input.traceId}'s results`);
+            return;
+        }
+        db.prepare(`
+      INSERT INTO recall_trace_outcomes (trace_id, ts, tenant_id, outcome, memory_ids_json)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(input.traceId, new Date().toISOString(), input.tenantId, input.outcome, JSON.stringify(credited));
+    }
+    catch (error) {
+        // eslint-disable-next-line no-console
+        console.error(`[hippo] recall trace outcome write failed: ${error.message}`);
+    }
+}
+//# sourceMappingURL=recall-trace.js.map

package/dist/recall-trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recall-trace.js","sourceRoot":"","sources":["../src/recall-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAyB,MAAM,SAAS,CAAC;AA2B3E;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAAmB;IAEnB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAoB,EAAE,KAAuB;IAC5E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;;;OAG9B,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CACjC,EAAE,EACF,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,QAAQ,EACd,SAAS,EACT,KAAK,CAAC,KAAK,CAAC,MAAM,EAClB,KAAK,CAAC,OAAO,CAAC,MAAM,EACpB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1B,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAEpD,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC;;;OAG/B,CAAC,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC7B,YAAY,CAAC,GAAG,CACd,OAAO,EACP,KAAK,CAAC,QAAQ,EACd,CAAC,CAAC,QAAQ,EACV,CAAC,GAAG,CAAC,EACL,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtG,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,sCAAuC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,KAAuB;IAC1E,IAAI,EAAoB,CAAC;IACzB,IAAI,CAAC;QACH,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,2CAA4C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAoB,EAAE,KAA8B;IACrF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAEjF,CAAC;QACd,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjD,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,+CAA+C,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,EAAE;aAClB,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAiC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,yEAAyE,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QAED,EAAE,CAAC,OAAO,CAAC;;;KAGV,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/secret-detect.d.ts

@@ -30,4 +30,12 @@ export declare function detectSecret(entry: {
     content: string;
     tags: string[];
 }): SecretDetection;
+/**
+ * Replace secret-shaped substrings in free text with a redaction marker.
+ * Reuses the same `SECRET_PATTERNS` / co-occurrence guard as `detectSecret`
+ * (which only flags whole-entry content) so callers that must persist raw
+ * text that never passes through the normal capture content gate — e.g. the
+ * CS1 pre-compact snapshot fields — can scrub it in place instead.
+ */
+export declare function redactSecrets(text: string): string;
 //# sourceMappingURL=secret-detect.d.ts.map

package/dist/secret-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-detect.d.ts","sourceRoot":"","sources":["../src/secret-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAoCD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,eAAe,CAYxF"}
+{"version":3,"file":"secret-detect.d.ts","sourceRoot":"","sources":["../src/secret-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAoCD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,eAAe,CAYxF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBlD"}

package/dist/secret-detect.js

@@ -67,4 +67,29 @@ export function detectSecret(entry) {
     }
     return { flagged: false, reason: null };
 }
+/**
+ * Replace secret-shaped substrings in free text with a redaction marker.
+ * Reuses the same `SECRET_PATTERNS` / co-occurrence guard as `detectSecret`
+ * (which only flags whole-entry content) so callers that must persist raw
+ * text that never passes through the normal capture content gate — e.g. the
+ * CS1 pre-compact snapshot fields — can scrub it in place instead.
+ */
+export function redactSecrets(text) {
+    if (!text)
+        return text;
+    let result = text;
+    // PEM/OpenSSH blocks first: the pattern-table entry matches only the
+    // BEGIN delimiter, which is fine for detectSecret's flag-or-not decision
+    // but would leave the base64 payload behind here. Consume through the
+    // matching END delimiter; a truncated block with no END is redacted to
+    // the end of the text (codex round 3).
+    result = result.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|[\s\S]*$)/g, '[REDACTED]');
+    for (const { name, re } of SECRET_PATTERNS) {
+        if (CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
+            continue;
+        const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
+        result = result.replace(new RegExp(re.source, flags), '[REDACTED]');
+    }
+    return result;
+}
 //# sourceMappingURL=secret-detect.js.map

package/dist/secret-detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-detect.js","sourceRoot":"","sources":["../src/secret-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa;IAC1D,OAAO,EAAE,UAAU,EAAE,aAAa;CACnC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAgD;IACnE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,sBAAsB,EAAE;IACtD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,6CAA6C,EAAE;IAC3E,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EAAE,kCAAkC,EAAE;IAC3E,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,kCAAkC,EAAE;IAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,0CAA0C,EAAE;IACtE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,2BAA2B,EAAE;IAC3D,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,oCAAoC,EAAE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,QAAQ;IACR,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,2BAA2B,EAAE;IACzD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,sCAAsC,EAAE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,mCAAmC;IACnC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,uGAAuG,EAAE;CAC3I,CAAC;AAEF,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE7E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAA0C;IACrE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,SAAS;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"secret-detect.js","sourceRoot":"","sources":["../src/secret-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa;IAC1D,OAAO,EAAE,UAAU,EAAE,aAAa;CACnC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAgD;IACnE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,sBAAsB,EAAE;IACtD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,6CAA6C,EAAE;IAC3E,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EAAE,kCAAkC,EAAE;IAC3E,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,kCAAkC,EAAE;IAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,0CAA0C,EAAE;IACtE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,2BAA2B,EAAE;IAC3D,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,oCAAoC,EAAE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,QAAQ;IACR,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,2BAA2B,EAAE;IACzD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,sCAAsC,EAAE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,mCAAmC;IACnC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,uGAAuG,EAAE;CAC3I,CAAC;AAEF,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE7E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAA0C;IACrE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,SAAS;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,qEAAqE;IACrE,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uCAAuC;IACvC,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,0FAA0F,EAC1F,YAAY,CACb,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,eAAe,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/E,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC;QACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AA0QD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;8BAG0B;IAC1B,MAAM,CAAC,EAAE,OAAO,WAAW,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA0HD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMrE;AAmrFD;;;;;;;;;;GAUG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CA0JlE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AA2QD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;8BAG0B;IAC1B,MAAM,CAAC,EAAE,OAAO,WAAW,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA0HD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMrE;AAmrFD;;;;;;;;;;GAUG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CA0JlE"}

package/dist/server.js

@@ -108,6 +108,7 @@ const VALID_AUDIT_OPS = new Set([
     'customer_note_create', // E2 customer_note first-class object — emitted by saveCustomerNote
     'customer_note_supersede', // E2 — emitted by saveCustomerNote on a supersession
     'customer_note_close', // E2 — emitted by closeCustomerNote
+    'mv_rescue', // LC2-E3 — emitted by consolidate() per rescue; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
 ]);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but