hippo-memory 1.69.0 → 1.71.0

package/dist/trust/reject-flow.js

@@ -0,0 +1,65 @@
+// The reject, unreject and list flow the CLI verbs and the api functions share: the rules and their wording live here,
+// and src/store/rejected-values.ts runs each one on a single handle.
+import { BadRequestError } from '../core/api-errors.js';
+import { isPersonalScope } from '../store/recall-scope.js';
+import { mergedSuccessor } from '../consolidate/merged-row.js';
+import { normalizeValueForRejection } from '../store/rejection.js';
+import { applyRejection, liftRejection, loadRejectedValues, } from '../store/rejected-values.js';
+function assertRejectOpts(opts) {
+    if (!opts.reason.trim()) {
+        throw new Error('reject requires a non-empty --reason (the tombstone stores no content; reason is its only identity).');
+    }
+    if (opts.memoryId === undefined && opts.value === undefined) {
+        throw new Error('reject requires either a memory id or --value.');
+    }
+    if (opts.memoryId !== undefined && opts.value !== undefined) {
+        // Enforced here, not only in the CLI parser, so a direct api caller passing both
+        // is refused instead of silently getting the memoryId path with `value` ignored.
+        throw new Error('reject accepts either a memory id or --value, not both.');
+    }
+    if (opts.value !== undefined && normalizeValueForRejection(opts.value).length === 0) {
+        // Direct api callers can pass strings the CLI flag parser would refuse; an empty-normalized tombstone would refuse nothing and pollute the listing.
+        throw new Error('reject --value requires non-empty content.');
+    }
+}
+function contentToReject(opts, row) {
+    if (opts.memoryId === undefined)
+        return opts.value;
+    if (!row || row.tenant_id !== opts.tenantId) {
+        throw new Error(`memory not found: ${opts.memoryId}`);
+    }
+    // A tombstone is tenant-wide, so one made from personal text would show its reason to everyone.
+    if (isPersonalScope(row.scope))
+        throw new BadRequestError("Personal memories can't be rejected. Use forget to remove it.");
+    return row.content;
+}
+/** Every row but another person's personal one, which is outside the caller's recall and so outside its reject. */
+function inReach(opts, scope) {
+    return !isPersonalScope(scope) || scope === opts.ownScope;
+}
+/** `hippo reject` and `api.reject`: refuses a bad request, then tombstones the value and removes every row in reach that holds it. */
+export function rejectValue(opts) {
+    assertRejectOpts(opts);
+    return applyRejection(opts.hippoRoot, {
+        tenantId: opts.tenantId,
+        actor: opts.actor,
+        reason: opts.reason,
+        memoryId: opts.memoryId,
+        textOf: (source) => contentToReject(opts, source),
+        inReach: (scope) => inReach(opts, scope),
+        successorOf: mergedSuccessor,
+    });
+}
+/** `hippo unreject` and `api.unreject`: lifts the one tombstone a digest or prefix names. The only way to allow a rejected value again. */
+export function unrejectValue(hippoRoot, tenantId, digestOrPrefix, actor) {
+    // A blank prefix would match every digest and list the whole tombstone set as ambiguous.
+    if (digestOrPrefix.trim().length === 0) {
+        return { status: 'not_found' };
+    }
+    return liftRejection(hippoRoot, tenantId, digestOrPrefix, actor);
+}
+/** `hippo rejections` / `api.listRejections` — list tombstones for a tenant. */
+export function listRejectionsForTenant(hippoRoot, tenantId) {
+    return loadRejectedValues(hippoRoot, tenantId);
+}
+//# sourceMappingURL=reject-flow.js.map

package/dist/util/anthropic-messages.d.ts

@@ -0,0 +1,31 @@
+/** The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller reacts to. */
+export interface AnthropicMessageRequest {
+    apiKey: string;
+    model?: string;
+    maxTokens: number;
+    prompt: string;
+    /** Injected for tests; defaults to the real fetch. */
+    fetcher?: typeof fetch;
+}
+export type AnthropicMessageFailure = {
+    kind: 'request';
+    message: string;
+} | {
+    kind: 'http';
+    status: number;
+} | {
+    kind: 'unreadable';
+    message: string;
+};
+export type AnthropicMessageResult = {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    failure: AnthropicMessageFailure;
+};
+/** The reply's first text block, trimmed (empty when the reply has none); never throws. */
+export declare function sendAnthropicMessage(req: AnthropicMessageRequest): Promise<AnthropicMessageResult>;
+/** The text extraction and DAG summaries hand to their `onError` callback. */
+export declare function describeMessageFailure(failure: AnthropicMessageFailure): string;
+//# sourceMappingURL=anthropic-messages.d.ts.map

package/dist/util/anthropic-messages.js

@@ -0,0 +1,58 @@
+/** The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller reacts to. */
+import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
+import { errorMessage } from './log.js';
+import { readCappedJson } from './capped-json.js';
+import { isJsonObject, isJsonString } from './json.js';
+const MESSAGES_URL = 'https://api.anthropic.com/v1/messages';
+const API_VERSION = '2023-06-01';
+const DEFAULT_MODEL = 'claude-sonnet-4-6';
+// Callers ask for at most 1,200 tokens, a reply of a few KB; 1 MiB leaves room for a verbose envelope.
+const MAX_REPLY_BYTES = 1024 * 1024;
+/** The first content block's text, trimmed; empty when the reply has no such block. */
+function firstText(reply) {
+    const first = Array.isArray(reply.content) ? reply.content[0] : undefined;
+    const text = isJsonObject(first) ? first.text : undefined;
+    return isJsonString(text) ? text.trim() : '';
+}
+/** The reply's first text block, trimmed (empty when the reply has none); never throws. */
+export async function sendAnthropicMessage(req) {
+    let res;
+    try {
+        res = await fetchWithRetry(MESSAGES_URL, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-api-key': req.apiKey,
+                'anthropic-version': API_VERSION,
+            },
+            body: JSON.stringify({
+                model: req.model ?? DEFAULT_MODEL,
+                max_tokens: req.maxTokens,
+                messages: [{ role: 'user', content: req.prompt }],
+            }),
+        }, { timeoutMs: llmTimeoutMs(), fetchFn: req.fetcher ?? fetch });
+    }
+    catch (err) {
+        return { ok: false, failure: { kind: 'request', message: errorMessage(err) } };
+    }
+    if (!res.ok)
+        return { ok: false, failure: { kind: 'http', status: res.status } };
+    try {
+        const data = await readCappedJson(res, MAX_REPLY_BYTES);
+        if (!isJsonObject(data))
+            return { ok: false, failure: { kind: 'unreadable', message: 'the reply is not a JSON object' } };
+        return { ok: true, text: firstText(data) };
+    }
+    catch (err) {
+        return { ok: false, failure: { kind: 'unreadable', message: errorMessage(err) } };
+    }
+}
+/** The text extraction and DAG summaries hand to their `onError` callback. */
+export function describeMessageFailure(failure) {
+    switch (failure.kind) {
+        case 'request': return `request failed: ${failure.message}`;
+        case 'http': return `HTTP ${failure.status}`;
+        case 'unreadable': return `unparseable response: ${failure.message}`;
+    }
+}
+//# sourceMappingURL=anthropic-messages.js.map

package/dist/util/atomic-write.d.ts

@@ -0,0 +1,4 @@
+/** Replaces `file` through a flushed temp file and a rename, so a reader, or a crash at any point, finds the old content or the new, whole.
+ *  A file with other hard links, or a rename the platform refuses (logged), is written in place: a crash mid-write can leave it truncated. */
+export declare function writeFileAtomic(file: string, text: string): void;
+//# sourceMappingURL=atomic-write.d.ts.map

package/dist/util/atomic-write.js

@@ -0,0 +1,138 @@
+// One way to replace a file a user or another program depends on: write a temp file beside it, then rename over it.
+import * as fs from 'fs';
+import * as path from 'path';
+import { errorMessage, log } from './log.js';
+const RENAME_RETRY_MS = 1000;
+const WINDOWS_RENAME_REFUSALS = ['EPERM', 'EACCES', 'EBUSY'];
+// A rename can be refused where an in-place write still works (a bind-mounted file, a read-only folder), so these fall back to one.
+const REPLACE_REFUSALS = ['EBUSY', 'EXDEV', 'EACCES', 'EPERM'];
+// Matches the usual SYMLOOP_MAX, so a link cycle ends in an error instead of a hang.
+const MAX_LINK_HOPS = 40;
+function errnoCode(err) {
+    return 'code' in err ? String(err.code) : '';
+}
+/** Windows refuses a rename onto a file another program has open, usually for a moment, so a refusal is retried before it is reported. */
+function renameOnto(tmp, target) {
+    const deadline = Date.now() + RENAME_RETRY_MS;
+    const idle = new Int32Array(new SharedArrayBuffer(4));
+    for (let pause = 10;; pause = Math.min(pause * 2, 200)) {
+        try {
+            fs.renameSync(tmp, target);
+            return;
+        }
+        catch (err) {
+            const transient = process.platform === 'win32' && err instanceof Error && WINDOWS_RENAME_REFUSALS.includes(errnoCode(err));
+            const left = deadline - Date.now();
+            if (!transient || left <= 0)
+                throw err;
+            Atomics.wait(idle, 0, 0, Math.min(pause, left));
+        }
+    }
+}
+/** Where a write to `file` lands: through any symlink, a dangling one included, so a dotfile manager's link survives. */
+function writeTarget(file) {
+    let target = file;
+    for (let hop = 0; hop < MAX_LINK_HOPS && fs.lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink(); hop++) {
+        target = path.resolve(path.dirname(target), fs.readlinkSync(target));
+    }
+    return fs.existsSync(target) ? fs.realpathSync(target) : target;
+}
+/** Gives the replacement the old file's exact mode (umask trims the create mode) and, for root, its owner. */
+function keepAccess(tmp, old) {
+    fs.chmodSync(tmp, old.mode & 0o777);
+    if (process.getuid?.() === 0)
+        fs.chownSync(tmp, old.uid, old.gid);
+}
+/** Cleanup must not hide the failure that made it necessary, so a cleanup error is logged and the first error stays the one thrown. */
+function removeTemp(tmp) {
+    try {
+        fs.rmSync(tmp, { force: true });
+    }
+    catch (err) {
+        log.warn(`could not remove the temporary file ${tmp}: ${errorMessage(err)}`);
+    }
+}
+/** Flushed before the rename, or a crash soon after could leave the file's name on bytes that never reached the disk. */
+function writeFlushed(tmp, text, old) {
+    const fd = fs.openSync(tmp, 'w', (old?.mode ?? 0o666) & 0o777);
+    try {
+        fs.writeFileSync(fd, text, 'utf8');
+        if (old)
+            keepAccess(tmp, old);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** Stores the rename itself. Windows cannot flush a folder handle, and a failure here costs durability, not content, so it only warns. */
+function flushFolder(dir) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        const fd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch (err) {
+        log.warn(`could not flush the folder ${dir} to disk after replacing a file in it: ${errorMessage(err)}`);
+    }
+}
+function replaceViaTemp(target, text, old) {
+    const tmp = `${target}.${process.pid}.tmp`;
+    try {
+        writeFlushed(tmp, text, old);
+        renameOnto(tmp, target);
+    }
+    catch (err) {
+        removeTemp(tmp);
+        throw err;
+    }
+    flushFolder(path.dirname(target));
+}
+/** The pre-rename write: it truncates first, so it is only the fallback, but it needs just a writable file and keeps hard links together. */
+function writeInPlace(target, text) {
+    try {
+        fs.writeFileSync(target, text, 'utf8');
+    }
+    catch (err) {
+        if (!(err instanceof Error))
+            throw err;
+        const reason = errnoCode(err) === 'EBUSY'
+            ? 'is in use by another program, so hippo could not replace it; close that program and run the command again'
+            : `could not be replaced (${errnoCode(err) || err.message})`;
+        throw new Error(`${target} ${reason}`, { cause: err });
+    }
+}
+/** Replaces `file` through a flushed temp file and a rename, so a reader, or a crash at any point, finds the old content or the new, whole.
+ *  A file with other hard links, or a rename the platform refuses (logged), is written in place: a crash mid-write can leave it truncated. */
+export function writeFileAtomic(file, text) {
+    const target = writeTarget(file);
+    const old = fs.statSync(target, { throwIfNoEntry: false });
+    if (old === undefined) {
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+    }
+    else {
+        // A rename replaces a read-only file that the in-place write refused, and Windows would retry that refusal for a second.
+        fs.accessSync(target, fs.constants.W_OK);
+    }
+    if (old !== undefined && old.nlink > 1) {
+        // A rename gives the file a new inode, which would leave the other hard links on the old content.
+        writeInPlace(target, text);
+        return;
+    }
+    try {
+        replaceViaTemp(target, text, old);
+    }
+    catch (err) {
+        if (!(err instanceof Error) || !REPLACE_REFUSALS.includes(errnoCode(err)))
+            throw err;
+        log.warn(`${target} could not be replaced by a rename (${errnoCode(err)}), so it is written in place: not atomic, a crash mid-write can leave it truncated`);
+        writeInPlace(target, text);
+    }
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/util/capped-json.d.ts

@@ -0,0 +1,6 @@
+import type { JsonValue } from './json.js';
+/** Reads a reply body as JSON and stops with an error as soon as it passes `maxBytes`. */
+export declare function readCappedJson(resp: Response, maxBytes: number): Promise<JsonValue>;
+/** Reads at most `maxBytes` of a body as text, then cancels the rest; never throws on size. */
+export declare function readCappedText(resp: Response, maxBytes: number): Promise<string>;
+//# sourceMappingURL=capped-json.d.ts.map

package/dist/util/capped-json.js

@@ -0,0 +1,46 @@
+// The timeout bounds time, not bytes: a hostile endpoint could stream a huge 2xx body into memory.
+/** Reads a reply body as JSON and stops with an error as soon as it passes `maxBytes`. */
+export async function readCappedJson(resp, maxBytes) {
+    if (!resp.body)
+        throw new Error('reply has no body');
+    const reader = resp.body.getReader();
+    const decoder = new TextDecoder();
+    let raw = '';
+    let received = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        received += value.byteLength;
+        if (received > maxBytes) {
+            await reader.cancel();
+            throw new Error(`reply over ${maxBytes} bytes`);
+        }
+        raw += decoder.decode(value, { stream: true });
+    }
+    raw += decoder.decode();
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error('reply is not JSON', { cause: err });
+    }
+}
+/** Reads at most `maxBytes` of a body as text, then cancels the rest; never throws on size. */
+export async function readCappedText(resp, maxBytes) {
+    if (!resp.body)
+        return '';
+    const reader = resp.body.getReader();
+    const chunks = [];
+    let received = 0;
+    while (received < maxBytes) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value.subarray(0, maxBytes - received));
+        received += chunks[chunks.length - 1].byteLength;
+    }
+    await reader.cancel();
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}
+//# sourceMappingURL=capped-json.js.map

package/dist/util/crash-handlers.d.ts

@@ -0,0 +1,12 @@
+/** What an entry point runs before it exits, and how long that may take before the process is ended without it. */
+export interface Shutdown {
+    readonly run: () => void | Promise<void>;
+    readonly boundMs: number;
+}
+/** Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s. */
+export declare function exitAfterFlush(code: number): void;
+/** On SIGTERM or SIGINT: runs `shutdown` once, then exits 0. */
+export declare function installSignalHandlers(name: string, shutdown: Shutdown): void;
+/** After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the supervisor or client to restart it. */
+export declare function installCrashHandlers(name: string, shutdown?: Shutdown): void;
+//# sourceMappingURL=crash-handlers.d.ts.map

package/dist/util/crash-handlers.js

@@ -0,0 +1,72 @@
+// Last-resort process handlers shared by the long-running entry points (`hippo mcp`, `hippo serve`).
+import { errorFields, errorMessage, log } from './log.js';
+function afterFlush(leave) {
+    let pending = 2;
+    const done = () => { if (--pending === 0)
+        leave(); };
+    process.stdout.write('', done);
+    process.stderr.write('', done);
+    setTimeout(leave, 1000).unref();
+}
+/** Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s. */
+export function exitAfterFlush(code) {
+    process.exitCode = code;
+    afterFlush(() => process.exit(code));
+}
+// process.exit joins every worker thread, so one stuck in a synchronous statement would hold the exit open; a kill cannot be held.
+function killSelf() {
+    process.kill(process.pid, 'SIGKILL');
+}
+/** Runs `shutdown` for `cause`, then exits with `code`, or 1 when it threw. One still running after its bound is logged and the process ended without it. */
+function exitAfterShutdown(name, cause, shutdown, code) {
+    let ended = false;
+    // Referenced on purpose: a shutdown that never settles must end at the bound, not when the loop happens to empty.
+    const bound = setTimeout(() => {
+        ended = true;
+        log.error(`${name} shutdown after ${cause} did not finish within ${shutdown.boundMs} ms; ending the process without it`);
+        process.exitCode = 1;
+        afterFlush(killSelf);
+    }, shutdown.boundMs);
+    void Promise.resolve()
+        .then(shutdown.run)
+        .then(() => code, (err) => {
+        log.error(`${name} shutdown after ${cause} failed: ${errorMessage(err)}`, errorFields(err));
+        return 1;
+    })
+        .then((exitCode) => {
+        clearTimeout(bound);
+        if (!ended)
+            exitAfterFlush(exitCode);
+    });
+}
+/** On SIGTERM or SIGINT: runs `shutdown` once, then exits 0. */
+export function installSignalHandlers(name, shutdown) {
+    let shuttingDown = false;
+    const stopFor = (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        log.warn(`received ${signal}, shutting down`);
+        exitAfterShutdown(name, signal, shutdown, 0);
+    };
+    process.once('SIGTERM', () => stopFor('SIGTERM'));
+    process.once('SIGINT', () => stopFor('SIGINT'));
+}
+/** After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the supervisor or client to restart it. */
+export function installCrashHandlers(name, shutdown) {
+    let crashing = false;
+    const crash = (kind, err) => {
+        log.error(`${name} ${kind}: ${errorMessage(err)}`, errorFields(err));
+        // A throw while shutdown runs is logged above and must not start it again.
+        if (crashing)
+            return;
+        crashing = true;
+        if (shutdown)
+            exitAfterShutdown(name, kind, shutdown, 1);
+        else
+            exitAfterFlush(1);
+    };
+    process.on('uncaughtException', (err) => crash('uncaught exception', err));
+    process.on('unhandledRejection', (err) => crash('unhandled rejection', err));
+}
+//# sourceMappingURL=crash-handlers.js.map

package/dist/{env.d.ts → util/env.d.ts}

@@ -12,8 +12,6 @@ export declare function envAblateRecency(): boolean;
 export declare function envEvalRecencyDays(): number | null;
 /** HIPPO_FAKE_NOW as epoch millis, or null unless it is byte-identical to Date.toISOString output. */
 export declare function envFakeNowMs(): number | null;
-export declare function envTestDeliveryFault(): string;
-export declare function envForceLikePath(): boolean;
 export declare function envLossAversionRatio(): string | undefined;
 export declare function envSummaryDeboost(): string | undefined;
 export declare function envAutodebiasOff(): boolean;
@@ -30,7 +28,9 @@ export declare function envClaudeCodeSessionId(): string | undefined;
 export declare function envScope(): string | undefined;
 export declare function envGstackSkill(): string | undefined;
 export declare function envOpenclawSkill(): string | undefined;
-/** HIPPO_TENANT trimmed; empty or whitespace-only falls through to 'default'. */
+/** The tenant of a store that names none. */
+export declare const DEFAULT_TENANT_ID = "default";
+/** HIPPO_TENANT trimmed; empty or whitespace-only falls through to the default tenant. */
 export declare function envTenant(): string;
 export declare function envSkipAutoIntegrations(): boolean;
 export declare function envSkipPostinstall(): boolean;
@@ -40,14 +40,32 @@ export declare function envRequireServer(): boolean;
 export declare function envRequireSessionScopedFreshTail(): boolean;
 export declare function envStdinWaitMs(): number | undefined;
 export declare function envLogLevel(): string;
+/** `HIPPO_LOG_FORMAT=json` writes each log line as one JSON object; anything else keeps the text line. */
+export declare function envLogJson(): boolean;
 export declare function envPort(): string | undefined;
 /** How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds the default. */
 export declare function envHealthProbeMs(): number | undefined;
 export declare function envRequireAuth(): boolean;
+/** `1` lets a request made on this machine in with no key, as host admin; HIPPO_REQUIRE_AUTH=1 wins over it. */
+export declare function envAllowKeylessLocal(): boolean;
 export declare function envV1Rps(): string | undefined;
+/** How long a request body may take to arrive; http-util.ts holds the default. */
+export declare function envBodyTimeoutMs(): number | undefined;
+/** How long POST /v1/sleep lets its consolidation run; server/sleep-offload.ts holds the default. */
+export declare function envSleepTimeoutMs(): number | undefined;
+/** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
+ * request before its timeout error; 0 for no deadline; server/deadline.ts holds the default. */
+export declare function envRequestDeadlineMs(): number | undefined;
+/** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
+export declare function envStoreQueueMax(): number | undefined;
+/** How long the daily runner lets one child `hippo` step run; cli/setup.ts holds the default. */
+export declare function envDailyStepTimeoutMs(): number | undefined;
 export declare function envApiKey(): string | undefined;
 export declare function envClientIpHeader(): string | undefined;
 export declare function envTrustedProxies(): string | undefined;
+/** Paths to the PEM certificate and key `hippo serve` answers HTTPS with; the --tls-cert and --tls-key flags win. */
+export declare function envTlsCert(): string | undefined;
+export declare function envTlsKey(): string | undefined;
 export declare function envMcpSseMaxStreams(): number | undefined;
 export declare function envMcpSseHeartbeatMs(): number | undefined;
 export declare function envMcpSseMaxAgeSec(): number | undefined;
@@ -56,6 +74,8 @@ export declare function envLlmTimeoutMs(): number | undefined;
 export declare function envTypesafeApiKey(): string | undefined;
 export declare function envJevTimeoutMs(): number | undefined;
 export declare function envJevModel(): string | undefined;
+/** How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds the default. */
+export declare function envQueryEmbedTimeoutMs(): number | undefined;
 export declare function envLlmRerankerUrl(): string | undefined;
 export declare function envLlmRerankerKey(): string | undefined;
 export declare function envLlmRerankerModel(): string | undefined;
@@ -70,8 +90,8 @@ export declare function envSlackTeamId(): string | undefined;
 export declare function envSlackSigningSecret(): string | undefined;
 export declare function envSlackSigningSecretPrevious(): string | undefined;
 export declare function envSlackAllowUnknownTeamFallback(): boolean;
-export declare function envGithubToken(): string | undefined;
-export declare function envGithubWebhookSecret(): string | undefined;
-export declare function envGithubWebhookSecretPrevious(): string | undefined;
-export declare function envGithubAllowUnknownInstallationFallback(): boolean;
+export declare function envGitHubToken(): string | undefined;
+export declare function envGitHubWebhookSecret(): string | undefined;
+export declare function envGitHubWebhookSecretPrevious(): string | undefined;
+export declare function envGitHubAllowUnknownInstallationFallback(): boolean;
 //# sourceMappingURL=env.d.ts.map

package/dist/{env.js → util/env.js}

@@ -15,6 +15,11 @@ function positiveInt(name) {
     const parsed = Number.parseInt(raw(name) ?? '', 10);
     return parsed > 0 ? parsed : undefined;
 }
+/** parseInt, kept from zero up, for a setting whose 0 means off. */
+function nonNegativeInt(name) {
+    const parsed = Number.parseInt(raw(name) ?? '', 10);
+    return parsed >= 0 ? parsed : undefined;
+}
 /** Trimmed, with an empty or whitespace-only value read as unset. */
 function trimmed(name) {
     return raw(name)?.trim() || undefined;
@@ -48,8 +53,6 @@ export function envFakeNowMs() {
     const parsed = Date.parse(value);
     return Number.isFinite(parsed) && new Date(parsed).toISOString() === value ? parsed : null;
 }
-export function envTestDeliveryFault() { return raw('HIPPO_TEST_DELIVERY_FAULT') ?? ''; }
-export function envForceLikePath() { return isOne('HIPPO_FORCE_LIKE_PATH'); }
 export function envLossAversionRatio() { return raw('HIPPO_LOSS_AVERSION_RATIO'); }
 export function envSummaryDeboost() { return raw('HIPPO_SUMMARY_DEBOOST'); }
 export function envAutodebiasOff() { return raw('HIPPO_AUTODEBIAS') === 'off'; }
@@ -68,9 +71,11 @@ export function envClaudeCodeSessionId() { return trimmed('CLAUDE_CODE_SESSION_I
 export function envScope() { return raw('HIPPO_SCOPE'); }
 export function envGstackSkill() { return raw('GSTACK_SKILL'); }
 export function envOpenclawSkill() { return raw('OPENCLAW_SKILL'); }
-/** HIPPO_TENANT trimmed; empty or whitespace-only falls through to 'default'. */
+/** The tenant of a store that names none. */
+export const DEFAULT_TENANT_ID = 'default';
+/** HIPPO_TENANT trimmed; empty or whitespace-only falls through to the default tenant. */
 export function envTenant() {
-    return raw('HIPPO_TENANT')?.trim() || 'default';
+    return raw('HIPPO_TENANT')?.trim() || DEFAULT_TENANT_ID;
 }
 // Install and CLI switches.
 export function envSkipAutoIntegrations() { return isOne('HIPPO_SKIP_AUTO_INTEGRATIONS'); }
@@ -81,15 +86,33 @@ export function envRequireServer() { return isOneOrTrue('HIPPO_REQUIRE_SERVER');
 export function envRequireSessionScopedFreshTail() { return isOne('HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL'); }
 export function envStdinWaitMs() { return positiveInt('HIPPO_STDIN_WAIT_MS'); }
 export function envLogLevel() { return raw('HIPPO_LOG')?.trim().toLowerCase() ?? ''; }
+/** `HIPPO_LOG_FORMAT=json` writes each log line as one JSON object; anything else keeps the text line. */
+export function envLogJson() { return raw('HIPPO_LOG_FORMAT')?.trim().toLowerCase() === 'json'; }
 // Server.
 export function envPort() { return raw('HIPPO_PORT'); }
 /** How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds the default. */
 export function envHealthProbeMs() { return positiveInt('HIPPO_HEALTH_PROBE_MS'); }
 export function envRequireAuth() { return isOne('HIPPO_REQUIRE_AUTH'); }
+/** `1` lets a request made on this machine in with no key, as host admin; HIPPO_REQUIRE_AUTH=1 wins over it. */
+export function envAllowKeylessLocal() { return isOne('HIPPO_ALLOW_KEYLESS_LOCAL'); }
 export function envV1Rps() { return raw('HIPPO_V1_RPS'); }
+/** How long a request body may take to arrive; http-util.ts holds the default. */
+export function envBodyTimeoutMs() { return positiveInt('HIPPO_BODY_TIMEOUT_MS'); }
+/** How long POST /v1/sleep lets its consolidation run; server/sleep-offload.ts holds the default. */
+export function envSleepTimeoutMs() { return positiveInt('HIPPO_SLEEP_TIMEOUT_MS'); }
+/** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
+ * request before its timeout error; 0 for no deadline; server/deadline.ts holds the default. */
+export function envRequestDeadlineMs() { return nonNegativeInt('HIPPO_REQUEST_DEADLINE_MS'); }
+/** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
+export function envStoreQueueMax() { return positiveInt('HIPPO_STORE_QUEUE_MAX'); }
+/** How long the daily runner lets one child `hippo` step run; cli/setup.ts holds the default. */
+export function envDailyStepTimeoutMs() { return positiveInt('HIPPO_DAILY_STEP_TIMEOUT_MS'); }
 export function envApiKey() { return raw('HIPPO_API_KEY'); }
 export function envClientIpHeader() { return raw('HIPPO_CLIENT_IP_HEADER')?.trim().toLowerCase(); }
 export function envTrustedProxies() { return raw('HIPPO_TRUSTED_PROXIES'); }
+/** Paths to the PEM certificate and key `hippo serve` answers HTTPS with; the --tls-cert and --tls-key flags win. */
+export function envTlsCert() { return trimmed('HIPPO_TLS_CERT'); }
+export function envTlsKey() { return trimmed('HIPPO_TLS_KEY'); }
 export function envMcpSseMaxStreams() { return positiveInt('MCP_SSE_MAX_STREAMS'); }
 export function envMcpSseHeartbeatMs() { return positiveInt('MCP_SSE_HEARTBEAT_MS'); }
 export function envMcpSseMaxAgeSec() { return positiveInt('MCP_SSE_MAX_AGE_SEC'); }
@@ -99,6 +122,8 @@ export function envLlmTimeoutMs() { return positiveInt('HIPPO_LLM_TIMEOUT_MS');
 export function envTypesafeApiKey() { return trimmed('TYPESAFE_API_KEY'); }
 export function envJevTimeoutMs() { return positiveInt('HIPPO_JEV_TIMEOUT_MS'); }
 export function envJevModel() { return raw('HIPPO_JEV_MODEL'); }
+/** How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds the default. */
+export function envQueryEmbedTimeoutMs() { return positiveInt('HIPPO_QUERY_EMBED_TIMEOUT_MS'); }
 export function envLlmRerankerUrl() { return raw('HIPPO_LLM_RERANKER_URL'); }
 export function envLlmRerankerKey() { return raw('HIPPO_LLM_RERANKER_KEY'); }
 export function envLlmRerankerModel() { return raw('HIPPO_LLM_RERANKER_MODEL'); }
@@ -114,8 +139,8 @@ export function envSlackTeamId() { return raw('SLACK_TEAM_ID'); }
 export function envSlackSigningSecret() { return raw('SLACK_SIGNING_SECRET'); }
 export function envSlackSigningSecretPrevious() { return raw('SLACK_SIGNING_SECRET_PREVIOUS'); }
 export function envSlackAllowUnknownTeamFallback() { return isOne('SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK'); }
-export function envGithubToken() { return raw('GITHUB_TOKEN'); }
-export function envGithubWebhookSecret() { return raw('GITHUB_WEBHOOK_SECRET'); }
-export function envGithubWebhookSecretPrevious() { return raw('GITHUB_WEBHOOK_SECRET_PREVIOUS'); }
-export function envGithubAllowUnknownInstallationFallback() { return isOne('GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK'); }
+export function envGitHubToken() { return raw('GITHUB_TOKEN'); }
+export function envGitHubWebhookSecret() { return raw('GITHUB_WEBHOOK_SECRET'); }
+export function envGitHubWebhookSecretPrevious() { return raw('GITHUB_WEBHOOK_SECRET_PREVIOUS'); }
+export function envGitHubAllowUnknownInstallationFallback() { return isOne('GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK'); }
 //# sourceMappingURL=env.js.map

package/dist/{home-path.d.ts → util/home-path.d.ts}

@@ -1,4 +1,5 @@
-/** One pattern per path shape that carries a user name: Windows, Git Bash and WSL mounts, extended-length, UNC home shares, Linux, macOS and 8.3 short names. */
+/** One pattern per path shape that carries a user name: Windows, Git Bash and WSL
+ * mounts, extended-length, UNC home shares, Linux, macOS and 8.3 short names. */
 export declare const USER_SEGMENT: readonly RegExp[];
 /** `text` with each home-directory segment replaced by `[home]`. */
 export declare function maskHomePaths(text: string): string;