hippo-memory 1.29.0 → 1.31.0

package/dist/src/reject-flow.js

@@ -0,0 +1,207 @@
+/**
+ * AT1 rejected-value tombstone — shared reject/unreject/list flow.
+ * docs/plans/2026-08-15-at1-rejected-value-tombstone.md (T2, plan §4).
+ *
+ * The CLI (`hippo reject`/`rejections`/`unreject`) and the Context-based
+ * `api.reject`/`api.unreject`/`api.listRejections` surfaces both need the
+ * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
+ * here (leaf module) so neither duplicates it.
+ *
+ * Module direction: this file imports from store.ts, rejection.ts, and
+ * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
+ * so it introduces no cycle.
+ */
+import { openHippoDb, closeHippoDb } from './db.js';
+import { appendAuditEvent } from './audit.js';
+import { archiveRawMemory } from './raw-archive.js';
+import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
+import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
+/**
+ * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
+ * insert the tombstone, enumerate + remove every live tenant row whose
+ * normalized digest matches (kind-aware), one aggregate `reject_value`
+ * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
+ * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
+ * index mirror rewrite.
+ */
+export function rejectValue(opts) {
+    if (!opts.reason.trim()) {
+        throw new Error('reject requires a non-empty --reason (the tombstone stores no content; reason is its only identity).');
+    }
+    if (opts.memoryId === undefined && opts.value === undefined) {
+        throw new Error('reject requires either a memory id or --value.');
+    }
+    if (opts.memoryId !== undefined && opts.value !== undefined) {
+        // P2 fix: the CLI's flag parser already refuses both forms together;
+        // the shared flow itself didn't enforce it, so a direct api caller
+        // passing both silently got the memoryId path with `value` ignored —
+        // surprising for a caller who thought they were rejecting `value`.
+        throw new Error('reject accepts either a memory id or --value, not both.');
+    }
+    if (opts.value !== undefined && normalizeValueForRejection(opts.value).length === 0) {
+        // Direct api callers can pass strings the CLI flag parser would have
+        // refused; an empty-normalized tombstone would refuse nothing meaningful
+        // and pollute the listing.
+        throw new Error('reject --value requires non-empty content.');
+    }
+    initStore(opts.hippoRoot);
+    const db = openHippoDb(opts.hippoRoot);
+    try {
+        let content;
+        if (opts.memoryId !== undefined) {
+            const row = db
+                .prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`)
+                .get(opts.memoryId);
+            if (!row || row.tenant_id !== opts.tenantId) {
+                throw new Error(`memory not found: ${opts.memoryId}`);
+            }
+            content = row.content;
+        }
+        else {
+            content = opts.value;
+        }
+        const digest = rejectionDigest(content);
+        const now = new Date().toISOString();
+        const removedIds = [];
+        const removedRawIds = [];
+        db.exec('BEGIN');
+        try {
+            insertRejectedValue(db, {
+                tenantId: opts.tenantId,
+                digest,
+                reason: opts.reason,
+                rejectedBy: opts.actor,
+                rejectedAt: now,
+                sourceMemoryId: opts.memoryId ?? null,
+                normalizedChars: normalizeValueForRejection(content).length,
+            });
+            // O(N) scan over the tenant's rows (plan §4): human-triggered command
+            // on ~1-5k-row stores — acceptable, documented. A digest column on
+            // memories is the escape if stores grow 100x; not needed now.
+            const rows = db
+                .prepare(`SELECT id, kind, content FROM memories WHERE tenant_id = ?`)
+                .all(opts.tenantId);
+            for (const row of rows) {
+                if (rejectionDigest(row.content) !== digest)
+                    continue;
+                if (row.kind === 'raw') {
+                    // Append-only trigger respected — archiveRawMemory is the only
+                    // legitimate removal path for kind='raw', and its inner SAVEPOINT
+                    // composes safely inside this BEGIN/COMMIT.
+                    archiveRawMemory(db, row.id, { reason: opts.reason, who: opts.actor });
+                    removedRawIds.push(row.id);
+                }
+                else {
+                    // suppressForgetAudit: the aggregate reject_value row below is the
+                    // trail for these removals, not N individual forget rows (plan
+                    // §4, round-3 advisory 2 — mirrors api.ts:1873-1877).
+                    deleteEntryCore(db, row.id, { actor: opts.actor, suppressForgetAudit: true });
+                }
+                removedIds.push(row.id);
+            }
+            try {
+                appendAuditEvent(db, {
+                    tenantId: opts.tenantId,
+                    actor: opts.actor,
+                    op: 'reject_value',
+                    targetId: opts.memoryId,
+                    metadata: { digest, removedIds, count: removedIds.length },
+                });
+            }
+            catch {
+                // Best-effort — mirrors store.ts's private audit() semantics. This
+                // runs INSIDE the still-open transaction (COMMIT is the next
+                // statement): a swallowed audit failure lets the tombstone +
+                // removals commit without the trail row, rather than rolling the
+                // whole reject back over bookkeeping.
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch {
+                // already rolled back
+            }
+            throw err;
+        }
+        // Post-commit, db handle still open (same pattern as api.archiveRaw):
+        // best-effort mirror purge per removed id, reaper-backstop stamp for
+        // raw ids, one index mirror rewrite.
+        for (const id of removedIds) {
+            // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
+            // which cleanupArchivedMirrors' reaper never scans — reports the
+            // EXPLICIT leftover path(s) instead of the false "will retry via
+            // reaper" claim. See its own doc comment (store.ts, near
+            // removeEntryMirrors) for the full rationale.
+            const mirrorOk = purgeMirrorBestEffort(opts.hippoRoot, id, removedRawIds.includes(id), 'hippo reject');
+            if (mirrorOk && removedRawIds.includes(id)) {
+                db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
+            }
+        }
+        if (removedIds.length > 0) {
+            writeIndexMirror(opts.hippoRoot, buildIndexFromDb(db));
+        }
+        return { digest, content, removedIds, removedRawIds };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/**
+ * `hippo unreject` / `api.unreject` — resolve a unique tombstone by digest
+ * (or prefix), delete it, audit `unreject_value`. The only v1 escape hatch
+ * (plan §4): no per-write force flag.
+ */
+export function unrejectValue(hippoRoot, tenantId, digestOrPrefix, actor) {
+    // P2 fix: an empty/blank prefix startsWith-matches EVERY digest (every
+    // string starts with ''), which would previously fall through to the
+    // ambiguous-candidates branch and list the whole tombstone set instead of
+    // failing loud on the actually-invalid input. Reject before the DB round
+    // trip.
+    if (digestOrPrefix.trim().length === 0) {
+        return { status: 'not_found' };
+    }
+    initStore(hippoRoot);
+    const db = openHippoDb(hippoRoot);
+    try {
+        const all = listRejectedValues(db, tenantId);
+        const matches = all.filter((r) => r.digest.startsWith(digestOrPrefix));
+        if (matches.length === 0)
+            return { status: 'not_found' };
+        if (matches.length > 1)
+            return { status: 'ambiguous', candidates: matches };
+        const target = matches[0];
+        deleteRejectedValue(db, tenantId, target.digest);
+        try {
+            appendAuditEvent(db, {
+                tenantId,
+                actor,
+                op: 'unreject_value',
+                targetId: target.sourceMemoryId ?? undefined,
+                metadata: { digest: target.digest, reason: target.reason },
+            });
+        }
+        catch {
+            // Best-effort, same as reject's audit call above.
+        }
+        return { status: 'ok', digest: target.digest, reason: target.reason };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** `hippo rejections` / `api.listRejections` — list tombstones for a tenant. */
+export function listRejectionsForTenant(hippoRoot, tenantId) {
+    initStore(hippoRoot);
+    const db = openHippoDb(hippoRoot);
+    try {
+        return listRejectedValues(db, tenantId);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=reject-flow.js.map

package/dist/src/reject-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reject-flow.js","sourceRoot":"","sources":["../../src/reject-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AA2BxB;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,qEAAqE;QACrE,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,OAAe,CAAC;QACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,EAAE;iBACX,OAAO,CAAC,sDAAsD,CAAC;iBAC/D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAuD,CAAC;YAC5E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC,KAAM,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,mBAAmB,CAAC,EAAE,EAAE;gBACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,KAAK;gBACtB,UAAU,EAAE,GAAG;gBACf,cAAc,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;gBACrC,eAAe,EAAE,0BAA0B,CAAC,OAAO,CAAC,CAAC,MAAM;aAC5D,CAAC,CAAC;YAEH,sEAAsE;YACtE,mEAAmE;YACnE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,EAAE;iBACZ,OAAO,CAAC,4DAA4D,CAAC;iBACrE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAyD,CAAC;YAC9E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM;oBAAE,SAAS;gBACtD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACvB,+DAA+D;oBAC/D,kEAAkE;oBAClE,4CAA4C;oBAC5C,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;oBACvE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,+DAA+D;oBAC/D,sDAAsD;oBACtD,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YAED,IAAI,CAAC;gBACH,gBAAgB,CAAC,EAAE,EAAE;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,EAAE,EAAE,cAAc;oBAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,6DAA6D;gBAC7D,6DAA6D;gBAC7D,iEAAiE;gBACjE,sCAAsC;YACxC,CAAC;YAED,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,qCAAqC;QACrC,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,uEAAuE;YACvE,iEAAiE;YACjE,iEAAiE;YACjE,yDAAyD;YACzD,8CAA8C;YAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;YACvG,IAAI,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3C,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAC,GAAG,CAChF,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,QAAgB,EAChB,cAAsB,EACtB,KAAa;IAEb,uEAAuE;IACvE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,QAAQ;IACR,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAE5E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,gBAAgB,CAAC,EAAE,EAAE;gBACnB,QAAQ;gBACR,KAAK;gBACL,EAAE,EAAE,gBAAgB;gBACpB,QAAQ,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBAC5C,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,QAAgB;IACzE,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/rejection.js

@@ -0,0 +1,157 @@
+/**
+ * AT1 rejected-value tombstone — core invariant.
+ * docs/plans/2026-08-15-at1-rejected-value-tombstone.md
+ *
+ * Exact-normalized-value semantics: a human who rejects a fact can refuse
+ * byte-stable re-ingestion of the same value across remember/capture/import/
+ * sync surfaces. Paraphrase/semantic matching is explicitly out of scope
+ * (documented limitation, plan "Design").
+ *
+ * Kept db-agnostic (helpers take a `DatabaseSyncLike` handle) and does NOT
+ * import from store.ts — store.ts imports from here, and the reverse would
+ * be a cycle.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Normalize content for rejection-digest comparisons: Unicode NFC →
+ * lowercase → collapse whitespace runs to a single space → trim. No
+ * punctuation stripping — over-normalization creates false refusals, which
+ * are worse than misses (plan §1).
+ */
+export function normalizeValueForRejection(content) {
+    return content.normalize('NFC').toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/**
+ * Full sha256 hex (64 chars) of the normalized content. Reuses the strong-
+ * identity convention (importers.ts:814 content-hash tag), NOT the privacy-
+ * lossy 16-char convention (recall-trace query hashing) — a tombstone lookup
+ * key needs collision resistance, not redaction (plan §1).
+ */
+export function rejectionDigest(content) {
+    return createHash('sha256').update(normalizeValueForRejection(content)).digest('hex');
+}
+/**
+ * Thrown by the write-path guard (checkRejectionGuard, called from
+ * upsertEntryRow) when an incoming write would introduce a value matching a
+ * tombstoned digest. Carries enough context for the transaction-owner catch
+ * blocks (writeEntry, api.supersede) to write a post-rollback
+ * `reject_refusal` audit row via `auditRejectionRefusal` (plan §3).
+ */
+export class RejectedValueError extends Error {
+    digest;
+    tenantId;
+    entryId;
+    reason;
+    rejectedAt;
+    constructor(opts) {
+        super(`Memory value refused: matches a rejected value (digest ${opts.digest.slice(0, 12)}..., ` +
+            `reason: ${opts.reason ?? 'none given'}). Run "hippo unreject" to allow it again.`);
+        this.name = 'RejectedValueError';
+        this.digest = opts.digest;
+        this.tenantId = opts.tenantId;
+        this.entryId = opts.entryId;
+        this.reason = opts.reason;
+        this.rejectedAt = opts.rejectedAt;
+    }
+}
+function rowToRejectedValue(row) {
+    return {
+        tenantId: row.tenant_id,
+        digest: row.digest,
+        reason: row.reason,
+        rejectedBy: row.rejected_by,
+        rejectedAt: row.rejected_at,
+        sourceMemoryId: row.source_memory_id,
+        normalizedChars: row.normalized_chars,
+    };
+}
+/**
+ * Look up a tombstone by tenant + digest. One indexed point query — the
+ * guard's common-case cost, a miss ends the guard (plan §3).
+ */
+export function findRejectedValue(db, tenantId, digest) {
+    const row = db
+        .prepare(`SELECT tenant_id, digest, reason, rejected_by, rejected_at, source_memory_id, normalized_chars
+       FROM rejected_values WHERE tenant_id = ? AND digest = ?`)
+        .get(tenantId, digest);
+    return row ? rowToRejectedValue(row) : null;
+}
+/**
+ * Insert (or refresh) a tombstone row. Caller owns the transaction — used by
+ * the T2 `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
+ */
+export function insertRejectedValue(db, opts) {
+    db.prepare(`INSERT INTO rejected_values(tenant_id, digest, reason, rejected_by, rejected_at, source_memory_id, normalized_chars)
+     VALUES (?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(tenant_id, digest) DO UPDATE SET
+       reason = excluded.reason,
+       rejected_by = excluded.rejected_by,
+       rejected_at = excluded.rejected_at,
+       source_memory_id = excluded.source_memory_id,
+       normalized_chars = excluded.normalized_chars`).run(opts.tenantId, opts.digest, opts.reason, opts.rejectedBy, opts.rejectedAt, opts.sourceMemoryId ?? null, opts.normalizedChars);
+}
+/**
+ * Delete a tombstone by tenant + exact digest — the T2 `unreject` verb, the
+ * only v1 escape hatch (plan §4).
+ */
+export function deleteRejectedValue(db, tenantId, digest) {
+    const result = db.prepare(`DELETE FROM rejected_values WHERE tenant_id = ? AND digest = ?`).run(tenantId, digest);
+    return (result.changes ?? 0) > 0;
+}
+/** List tombstones for a tenant, newest first — the T2 `rejections` verb. */
+export function listRejectedValues(db, tenantId) {
+    const rows = db
+        .prepare(`SELECT tenant_id, digest, reason, rejected_by, rejected_at, source_memory_id, normalized_chars
+       FROM rejected_values WHERE tenant_id = ? ORDER BY rejected_at DESC, digest ASC`)
+        .all(tenantId);
+    return rows.map(rowToRejectedValue);
+}
+/**
+ * The write-path guard's check helper, called from `upsertEntryRow`
+ * (store.ts). Fires when the incoming content's digest matches a tombstone
+ * AND the write *introduces* that content: the row is new, OR the stored
+ * row's content digest differs from the incoming one — an UPSERT editing a
+ * same-id row TO a rejected value is a content introduction and must be
+ * refused. Unchanged same-id re-persists (recall boost, decay, star toggle)
+ * are exempt by construction (plan §3).
+ *
+ * Ordering minimizes queries on the common (miss) path: (a) caller has
+ * already computed nothing yet — this does the digest + point lookup first;
+ * (b) a miss returns immediately (ONE indexed point query); (c) only on a
+ * tombstone hit does it SELECT the stored row's content to classify
+ * new-row vs content-introduction (+1 query, rare path).
+ */
+export function checkRejectionGuard(db, tenantId, entryId, content) {
+    const incomingDigest = rejectionDigest(content);
+    const tombstone = findRejectedValue(db, tenantId, incomingDigest);
+    if (!tombstone)
+        return; // miss ends the guard — the overwhelmingly common case
+    // Deliberately id-only (no tenant filter): memory ids are globally unique
+    // ULIDs, this lookup only classifies new-row vs same-id re-persist for the
+    // id the caller is already writing, and the tombstone lookup above is the
+    // tenant-scoped decision. Matches deleteEntry's own by-id SELECT.
+    //
+    // P2 fix: also read tenant_id. Content-digest-only comparison let a
+    // same-id upsert that ONLY changes tenantId slip through as an "unchanged
+    // re-persist" — content C sitting quietly (never rejected) in tenant A
+    // could be re-tagged into tenant B, and since C's digest already matched
+    // this row's stored digest, the guard exempted it even though B is the
+    // tenant that rejected C (that is WHY `tombstone` above is non-null: the
+    // lookup already ran under the INCOMING/destination tenantId). A tenant
+    // change on the SAME id is therefore always a content introduction into
+    // the destination tenant, exactly as if the row were new there.
+    const storedRow = db.prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`).get(entryId);
+    const isNewRow = storedRow === undefined;
+    const tenantChanged = !isNewRow && storedRow.tenant_id !== tenantId;
+    const isContentIntroduction = isNewRow || tenantChanged || rejectionDigest(storedRow.content) !== incomingDigest;
+    if (!isContentIntroduction)
+        return; // unchanged same-id re-persist — exempt by construction
+    throw new RejectedValueError({
+        digest: incomingDigest,
+        tenantId,
+        entryId,
+        reason: tombstone.reason,
+        rejectedAt: tombstone.rejectedAt,
+    });
+}
+//# sourceMappingURL=rejection.js.map

package/dist/src/rejection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rejection.js","sourceRoot":"","sources":["../../src/rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,OAAO,CAAS;IAChB,MAAM,CAAgB;IACtB,UAAU,CAAS;IAE5B,YAAY,IAMX;QACC,KAAK,CACH,0DAA0D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;YACvF,WAAW,IAAI,CAAC,MAAM,IAAI,YAAY,4CAA4C,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;AAsBD,SAAS,kBAAkB,CAAC,GAAwB;IAClD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,cAAc,EAAE,GAAG,CAAC,gBAAgB;QACpC,eAAe,EAAE,GAAG,CAAC,gBAAgB;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAoB,EACpB,QAAgB,EAChB,MAAc;IAEd,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;+DACyD,CAC1D;SACA,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAoC,CAAC;IAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAoB,EACpB,IAQC;IAED,EAAE,CAAC,OAAO,CACR;;;;;;;oDAOgD,CACjD,CAAC,GAAG,CACH,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,cAAc,IAAI,IAAI,EAC3B,IAAI,CAAC,eAAe,CACrB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAoB,EAAE,QAAgB,EAAE,MAAc;IACxF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClH,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,EAAoB,EAAE,QAAgB;IACvE,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;sFACgF,CACjF;SACA,GAAG,CAAC,QAAQ,CAA0B,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAoB,EACpB,QAAgB,EAChB,OAAe,EACf,OAAe;IAEf,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,uDAAuD;IAE/E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,kEAAkE;IAClE,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,OAAO,CAEnF,CAAC;IACd,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC;IACpE,MAAM,qBAAqB,GACzB,QAAQ,IAAI,aAAa,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,cAAc,CAAC;IACrF,IAAI,CAAC,qBAAqB;QAAE,OAAO,CAAC,wDAAwD;IAE5F,MAAM,IAAI,kBAAkB,CAAC;QAC3B,MAAM,EAAE,cAAc;QACtB,QAAQ;QACR,OAAO;QACP,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/server.js

@@ -108,6 +108,11 @@ const VALID_AUDIT_OPS = new Set([
     'customer_note_create', // E2 customer_note first-class object — emitted by saveCustomerNote
     'customer_note_supersede', // E2 — emitted by saveCustomerNote on a supersession
     'customer_note_close', // E2 — emitted by closeCustomerNote
+    'mv_rescue', // LC2-E3 — emitted by consolidate() per rescue; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'reject_value', // AT1 — emitted by `hippo reject`; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'reject_refusal', // AT1 — emitted when the rejection guard refuses a write; lockstep
+    'unreject_value', // AT1 — emitted by `hippo unreject`; lockstep
+    'conflict_resolve', // AT1 — emitted by resolveConflict on every resolution path; lockstep
 ]);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but