hippo-memory 1.70.0 → 1.72.0

package/dist/api/drill-down.d.ts

@@ -3,21 +3,10 @@ import type { Context } from './types.js';
 export interface DrillDownOpts {
     /** Cap on number of children returned. Default 50. */
     limit?: number;
-    /**
-     * Optional token budget. When set, children are appended in chronological
-     * order (created ASC) until adding the next child would exceed the budget.
-     * Token cost = the child's printed line under `cost`, else ceil(content.length / 4).
-     *
-     * For depth > 1, the budget is GLOBAL cumulative (NOT per-level).
-     */
+    /** Token budget: children append in created order until the next would exceed it (cost: printed line under `cost`, else ceil(content.length / 4)).
+     * For depth > 1 the budget is global and cumulative, not per level. */
     budget?: number;
-    /**
-     * v0.30 / E5 — walk N levels down (default 1 = direct children only).
-     * Higher values include children of children, etc. Internal hard cap 10
-     * to prevent pathological depth walks. BFS uses visited Set for dedup
-     * (defensive against shared-child data anomalies; DAG is acyclic by
-     * construction).
-     */
+    /** Levels to walk down (default 1 = direct children); capped at 10 internally. BFS dedups with a visited Set, defensive against shared-child anomalies. */
     depth?: number;
     cost?: DrillDownCost;
     project?: CallerProject;
@@ -46,41 +35,13 @@ export interface DrillDownResult {
     totalChildren: number;
     truncated: boolean;
 }
-/**
- * v1.6.4 discriminated failure shape. Two reasons distinguishable:
- *   - `not_found`: covers genuinely-missing, wrong-tenant, AND
- *     scope-blocked (codex round 3 P1 — distinguishing scope_blocked
- *     from not_found on non-HTTP surfaces leaked private-row existence
- *     to no-scope callers, even though the HTTP route already collapsed
- *     them. Collapse at the API layer.)
- *   - `not_drillable`: id is a leaf row (level 0/1). Caller-actionable.
- *
- * If a future drillDown gains a `scope` opt for explicit-scope callers,
- * a `scope_blocked` failure could be safely re-introduced ONLY for that
- * code path (caller already proved authorization by passing a scope).
- */
+/** `not_found` covers missing, wrong-tenant AND scope-blocked, because distinguishing scope_blocked leaked private-row existence to no-scope callers.
+ *  `not_drillable`: the id is a leaf row (level 0/1), which the caller can act on. */
 export interface DrillDownFailure {
     failure: 'not_found' | 'not_drillable';
 }
 export type DrillDownOutcome = DrillDownResult | DrillDownFailure;
-/**
- * Walk one step down the DAG from a level-2 (or higher) summary to its direct
- * children. Companion to `recall(... summarizeOverflow: true)` — when recall
- * surfaces a summary with `substitutedFor: [...]`, the caller drills into the
- * summary id to recover the original detail.
- *
- * Tenant scope: only summaries owned by `ctx.tenantId` are reachable. The same
- * scope filter that recall applies is enforced on the children — a level-2
- * summary in `slack:public:CGEN` cannot leak `slack:private:*` children even
- * if the underlying DAG accidentally linked across scopes.
- *
- * Returns a discriminated `DrillDownOutcome`: `DrillDownResult` on success,
- * or `{failure: '...'}` for `not_found` (covers genuinely-missing, wrong-
- * tenant and scope-blocked, intentionally indistinguishable) or
- * `not_drillable` (id is a leaf row).
- *
- * Pre-v1.6.4 returned null for all three cases. JS callers migrate via
- * `'failure' in result` checks; HTTP route maps `not_drillable` to 422.
- */
+/** One step down the DAG from a level-2+ summary to its direct children (the way back from `recall(... summarizeOverflow: true)` substitutions). Only
+ * `ctx.tenantId` summaries are reachable; children get recall's scope filter. Returns `DrillDownResult` or `{failure}`; HTTP maps `not_drillable` to 422. */
 export declare function drillDown(ctx: Context, summaryId: string, opts?: DrillDownOpts): Promise<DrillDownOutcome>;
 //# sourceMappingURL=drill-down.d.ts.map

package/dist/api/drill-down.js

@@ -1,28 +1,11 @@
 // DAG drill-down from a summary to its children.
 import { requireGroup, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
-import { passesScopeFilterForRecall, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject } from '../core/project-identity.js';
 const DEFAULT_DRILL_DOWN_LIMIT = 50;
-/**
- * Walk one step down the DAG from a level-2 (or higher) summary to its direct
- * children. Companion to `recall(... summarizeOverflow: true)` — when recall
- * surfaces a summary with `substitutedFor: [...]`, the caller drills into the
- * summary id to recover the original detail.
- *
- * Tenant scope: only summaries owned by `ctx.tenantId` are reachable. The same
- * scope filter that recall applies is enforced on the children — a level-2
- * summary in `slack:public:CGEN` cannot leak `slack:private:*` children even
- * if the underlying DAG accidentally linked across scopes.
- *
- * Returns a discriminated `DrillDownOutcome`: `DrillDownResult` on success,
- * or `{failure: '...'}` for `not_found` (covers genuinely-missing, wrong-
- * tenant and scope-blocked, intentionally indistinguishable) or
- * `not_drillable` (id is a leaf row).
- *
- * Pre-v1.6.4 returned null for all three cases. JS callers migrate via
- * `'failure' in result` checks; HTTP route maps `not_drillable` to 422.
- */
+/** One step down the DAG from a level-2+ summary to its direct children (the way back from `recall(... summarizeOverflow: true)` substitutions). Only
+ * `ctx.tenantId` summaries are reachable; children get recall's scope filter. Returns `DrillDownResult` or `{failure}`; HTTP maps `not_drillable` to 422. */
 export async function drillDown(ctx, summaryId, opts = {}) {
     const limit = opts.limit ?? DEFAULT_DRILL_DOWN_LIMIT;
     // v0.30 / E5: depth defaults 1 (backward compat); hard cap 10 levels
@@ -38,10 +21,8 @@ export async function drillDown(ctx, summaryId, opts = {}) {
         admit: (row) => readable(row) && (row.id !== summaryId || isDrillable(row)),
         page: limit >= 0 && Number.isSafeInteger(pastLimit) ? { rows: pastLimit, admit: readable } : undefined,
     });
-    // No unscoped cross-tenant probe here: the tenant-scoped read's miss covers
-    // both "doesn't exist" and "exists in another tenant" by design.
-    // Distinguishing them via an unscoped lookup would leak existence to
-    // unauthorised tenants. The two cases collapse into not_found.
+    // No unscoped cross-tenant probe: the tenant-scoped miss covers "missing" and "in another tenant" alike,
+    // because telling them apart would leak existence to unauthorised tenants.
     if (!walked)
         return { failure: 'not_found' };
     // A distinguishable "scope_blocked" would tell a no-scope caller "this row
@@ -80,9 +61,7 @@ function drillResult({ summary, levels, sizes: counted }, opts, limit) {
     return {
         summary: summaryOut,
         children,
-        // v0.30 / E5: totalChildren = BFS-collected count (depth-aware). For
-        // depth=1 this equals the eligible direct-children count (backward
-        // compat). For depth>1 it is the cumulative count across levels.
+        // totalChildren is the BFS-collected count, cumulative across levels (equals the direct-children count at depth=1).
         totalChildren: total,
         truncated,
     };

package/dist/api/embeddings.d.ts

@@ -0,0 +1,17 @@
+import type { EmbeddingProvider } from '../embeddings/provider.js';
+import { type Context } from './types.js';
+/** Embed every memory that has no vector yet; resolves to how many it embedded. */
+export declare function embedMissingMemories(ctx: Context, provider?: EmbeddingProvider): Promise<number>;
+/** How many vectors the store holds, live memory or not. */
+export declare function storedVectorCount(ctx: Context): number;
+export interface EmbedCoverage {
+    /** Every memory id in the store. */
+    memoryIds: string[];
+    /** Every id with a stored vector, including orphans whose memory is gone. */
+    vectorIds: string[];
+}
+/** Memory ids against vector ids, for the embed status and backfill lines. */
+export declare function embedCoverage(ctx: Context): EmbedCoverage;
+/** Re-seed every memory's physics particle from its vector; returns how many it reset. */
+export declare function resetPhysicsFromVectors(ctx: Context): number;
+//# sourceMappingURL=embeddings.d.ts.map

package/dist/api/embeddings.js

@@ -0,0 +1,28 @@
+// The vector side of a store for the embed and import verbs: embed what is missing, count coverage, re-seed physics.
+// Vectors and physics rows carry no tenant, so each op covers the whole store and needs the host admin.
+import { embedAll } from '../search/embed-memories.js';
+import { loadAllEntryIds } from '../store/entry-reads.js';
+import { loadEmbeddingIndex, resetStoredParticles, storedVectorSummary } from '../store/vector-index.js';
+import { requireHostAdmin } from './types.js';
+/** Embed every memory that has no vector yet; resolves to how many it embedded. */
+export async function embedMissingMemories(ctx, provider) {
+    requireHostAdmin(ctx, 'Embedding the store');
+    return embedAll(ctx.hippoRoot, undefined, provider);
+}
+/** How many vectors the store holds, live memory or not. */
+export function storedVectorCount(ctx) {
+    requireHostAdmin(ctx, 'Reading the vector index');
+    return storedVectorSummary(ctx.hippoRoot).ids.size;
+}
+/** Memory ids against vector ids, for the embed status and backfill lines. */
+export function embedCoverage(ctx) {
+    requireHostAdmin(ctx, 'Reading the vector index');
+    return { memoryIds: loadAllEntryIds(ctx.hippoRoot), vectorIds: [...storedVectorSummary(ctx.hippoRoot).ids] };
+}
+/** Re-seed every memory's physics particle from its vector; returns how many it reset. */
+export function resetPhysicsFromVectors(ctx) {
+    requireHostAdmin(ctx, 'Resetting physics');
+    const vectors = loadEmbeddingIndex(ctx.hippoRoot);
+    return resetStoredParticles(ctx.hippoRoot, loadAllEntryIds(ctx.hippoRoot), vectors);
+}
+//# sourceMappingURL=embeddings.js.map

package/dist/api/error-reply.d.ts

@@ -0,0 +1,8 @@
+/** The status and client-facing message for one failed request. */
+export interface ApiErrorReply {
+    status: number;
+    message: string;
+}
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export declare function mapApiError<E>(err: E): ApiErrorReply;
+//# sourceMappingURL=error-reply.d.ts.map

package/dist/api/error-reply.js

@@ -0,0 +1,21 @@
+// The one error-to-reply map the HTTP server and the MCP transports share, so a status never depends on which front end caught the error.
+import { ApiError } from '../core/api-errors.js';
+import { BodyTimeoutError, BodyTooLargeError, HttpError, INTERNAL_ERROR_MESSAGE, STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
+import { SqliteBlockedError } from '../util/sqlite-blocked.js';
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export function mapApiError(err) {
+    // An add-on can build an HttpError from any number, and writeHead throws on one outside 100-999.
+    if (err instanceof HttpError && !(Number.isInteger(err.status) && err.status >= 100 && err.status <= 999)) {
+        return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+    }
+    if (err instanceof HttpError || err instanceof ApiError)
+        return { status: err.status, message: err.message };
+    if (err instanceof BodyTooLargeError)
+        return { status: 413, message: err.message };
+    if (err instanceof BodyTimeoutError)
+        return { status: 408, message: err.message };
+    if (err instanceof SqliteBlockedError)
+        return { status: 501, message: STORE_NOT_PORTED_MESSAGE };
+    return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+}
+//# sourceMappingURL=error-reply.js.map

package/dist/api/forget.d.ts

@@ -1,6 +1,7 @@
-import type { RejectedValueRow } from '../store/rejection.js';
-import type { Context, StoreReply } from './types.js';
-/** Delete a memory by id. Reach is checked inside the delete's write scope, and a row out of reach answers as not found, so a caller learns nothing about it. */
+import { type RejectFlowResult } from '../trust/reject-flow.js';
+import { type Context, type StoreReply } from './types.js';
+/** Delete a memory by id. Reach is checked inside the delete's write scope, and a
+ * row out of reach answers as not found, so a caller learns nothing about it. */
 export interface ForgetResult {
     ok: true;
     id: string;
@@ -18,31 +19,15 @@ export interface RejectResult {
     digest: string;
     removedIds: string[];
 }
-/**
- * Reject a value: tombstone its normalized digest so a matching write is
- * refused everywhere (remember/capture/import/sync) until `unreject`. Two
- * forms — pass exactly one:
- *  - `memoryId`: reject the CURRENT content of an existing memory. Removes
- *    that row and every other live row in the tenant whose normalized
- *    digest matches (not just the id passed), except another person's personal rows.
- *  - `value`: pre-emptive form — tombstone content that may not currently
- *    be stored (or is already gone). Zero removals.
- *
- * `reason` is required (the tombstone stores no content; reason is its
- * only human-readable identity). Throws if the memory id is not found in
- * `ctx.tenantId`, or if both/neither of `memoryId`/`value` are given.
- */
-export declare function reject(ctx: Context, opts: RejectOpts): RejectResult;
-/**
- * Delete a tombstone by exact digest or unambiguous prefix, restoring the
- * value's writability — the only v1 escape hatch (no per-write force flag).
- * Throws if `digestOrPrefix` matches no tombstone, is blank, or matches
- * more than one (use a longer prefix).
- */
+/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
+ * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
+export declare function reject(ctx: Context, opts: RejectOpts): Promise<RejectResult>;
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
+ *  personal refusal rather than reject's not-found, as the operator can see that row. */
+export declare function rejectOnHost(ctx: Context, opts: RejectOpts): RejectFlowResult;
+/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export declare function unreject(ctx: Context, digestOrPrefix: string): {
     ok: boolean;
     digest: string;
 };
-/** List every rejected-value tombstone for `ctx.tenantId`, newest first. */
-export declare function listRejections(ctx: Context): RejectedValueRow[];
 //# sourceMappingURL=forget.d.ts.map

package/dist/api/forget.js

@@ -1,9 +1,10 @@
 // Forget a memory, and reject or unreject a value so it cannot be stored again.
 import { BadRequestError, NotFoundError } from '../core/api-errors.js';
-import { rejectValue, unrejectValue, listRejectionsForTenant } from '../trust/reject-flow.js';
+import { rejectValue, unrejectValue } from '../trust/reject-flow.js';
 import { andThen, notPorted, onStore } from './on-store.js';
-import { readEntry } from '../store/entry-reads.js';
-import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
+import { requireHostAdmin } from './types.js';
+import { getMemory } from './memories.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
 export function forget(ctx, id) {
     return onStore(ctx, (port) => {
         const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
@@ -11,31 +12,28 @@ export function forget(ctx, id) {
         return andThen(entryWrites.forget(removal), () => ({ ok: true, id }));
     });
 }
-/**
- * Reject a value: tombstone its normalized digest so a matching write is
- * refused everywhere (remember/capture/import/sync) until `unreject`. Two
- * forms — pass exactly one:
- *  - `memoryId`: reject the CURRENT content of an existing memory. Removes
- *    that row and every other live row in the tenant whose normalized
- *    digest matches (not just the id passed), except another person's personal rows.
- *  - `value`: pre-emptive form — tombstone content that may not currently
- *    be stored (or is already gone). Zero removals.
- *
- * `reason` is required (the tombstone stores no content; reason is its
- * only human-readable identity). Throws if the memory id is not found in
- * `ctx.tenantId`, or if both/neither of `memoryId`/`value` are given.
- */
-export function reject(ctx, opts) {
+/** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
+ * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
+export async function reject(ctx, opts) {
     if (opts.memoryId !== undefined) {
-        // Tenant scope, same not-found-shaped denial as forget/promote above:
-        // rejectValue itself also tenant-checks the id, but pre-checking here
-        // keeps the error message consistent with the rest of this module.
-        const entry = readEntry(ctx.hippoRoot, opts.memoryId);
-        if (entry?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, entry.scope)) {
+        // Tenant scope: same not-found-shaped denial as forget/promote; rejectValue tenant-checks too, but pre-checking keeps the error message consistent.
+        const entry = await getMemory(ctx, opts.memoryId);
+        if (entry === null || !canTouchScope(ctx.actor, entry.scope)) {
             throw new NotFoundError(`memory not found: ${opts.memoryId}`);
         }
     }
-    const result = rejectValue({
+    const result = applyReject(ctx, opts);
+    return { digest: result.digest, removedIds: result.removedIds };
+}
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
+ *  personal refusal rather than reject's not-found, as the operator can see that row. */
+export function rejectOnHost(ctx, opts) {
+    requireHostAdmin(ctx, 'Rejecting with the removal report');
+    return applyReject(ctx, opts);
+}
+function applyReject(ctx, opts) {
+    // SHORTCUT: the tombstone write is hippo.db only, as the port has no rejection group; one when a served store needs reject.
+    return rejectValue({
         hippoRoot: ctx.hippoRoot,
         tenantId: ctx.tenantId,
         actor: ctx.actor.subject,
@@ -44,14 +42,8 @@ export function reject(ctx, opts) {
         value: opts.value,
         ownScope: personalScopeOf(ctx.actor) ?? undefined,
     });
-    return { digest: result.digest, removedIds: result.removedIds };
 }
-/**
- * Delete a tombstone by exact digest or unambiguous prefix, restoring the
- * value's writability — the only v1 escape hatch (no per-write force flag).
- * Throws if `digestOrPrefix` matches no tombstone, is blank, or matches
- * more than one (use a longer prefix).
- */
+/** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export function unreject(ctx, digestOrPrefix) {
     const outcome = unrejectValue(ctx.hippoRoot, ctx.tenantId, digestOrPrefix, ctx.actor.subject);
     if (outcome.status === 'not_found') {
@@ -62,8 +54,4 @@ export function unreject(ctx, digestOrPrefix) {
     }
     return { ok: true, digest: outcome.digest };
 }
-/** List every rejected-value tombstone for `ctx.tenantId`, newest first. */
-export function listRejections(ctx) {
-    return listRejectionsForTenant(ctx.hippoRoot, ctx.tenantId);
-}
 //# sourceMappingURL=forget.js.map

package/dist/api/goals.d.ts

@@ -1,5 +1,5 @@
 import { type CompleteGoalOpts, type Goal, type PushGoalOpts } from '../store/goals.js';
-import type { Context } from './types.js';
+import { type Context } from './types.js';
 /** What a new goal carries; its tenant is always the caller's. */
 export type GoalPushOpts = Omit<PushGoalOpts, 'tenantId'>;
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */

package/dist/api/goals.js

@@ -1,6 +1,6 @@
 // The per-session goal stack that recall boosts: push, list, complete, suspend and resume.
-import { ForbiddenError } from '../core/api-errors.js';
 import { completeGoal, getActiveGoals, getSessionGoals, pushGoal, resumeGoal, suspendGoal, } from '../store/goals.js';
+import { requireHostAdmin } from './types.js';
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */
 export function goalPush(ctx, opts) {
     return pushGoal(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
@@ -12,22 +12,18 @@ export function goalList(ctx, opts) {
 }
 /** Complete a goal by id; a no-op for an unknown or already completed goal. Host admin only. */
 export function goalComplete(ctx, goalId, opts) {
-    requireHostAdmin(ctx);
+    // Goal ids are not tenant-scoped in the store, so acting on one by id reaches past the caller's tenant.
+    requireHostAdmin(ctx, 'Completing a goal by id');
     completeGoal(ctx.hippoRoot, goalId, opts);
 }
 /** Suspend an active goal by id. Host admin only. */
 export function goalSuspend(ctx, goalId) {
-    requireHostAdmin(ctx);
+    requireHostAdmin(ctx, 'Suspending a goal by id');
     suspendGoal(ctx.hippoRoot, goalId);
 }
 /** Resume a suspended goal by id, suspending the oldest active one past the depth cap. Host admin only. */
 export function goalResume(ctx, goalId) {
-    requireHostAdmin(ctx);
+    requireHostAdmin(ctx, 'Resuming a goal by id');
     resumeGoal(ctx.hippoRoot, goalId);
 }
-// Goal ids are not tenant-scoped in the store, so acting on one by id is a cross-tenant power.
-function requireHostAdmin(ctx) {
-    if (!ctx.actor.hostAdmin)
-        throw new ForbiddenError('Only the host admin can change a goal by id');
-}
 //# sourceMappingURL=goals.js.map

package/dist/api/graph.d.ts

@@ -0,0 +1,8 @@
+import type { GraphRows } from '../store/port.js';
+import type { Context } from './types.js';
+/** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
+export declare function graphRows(ctx: Context, query: {
+    entity?: string;
+    limit: number;
+}): Promise<GraphRows>;
+//# sourceMappingURL=graph.d.ts.map

package/dist/api/graph.js

@@ -0,0 +1,7 @@
+import { requireGroup, storeFor } from '../store/index.js';
+/** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
+export async function graphRows(ctx, query) {
+    const { role, scopes, owner } = ctx.actor;
+    return requireGroup(storeFor(ctx), 'graphReads').graphRows(ctx.tenantId, { ...query, reader: { role, scopes, owner } });
+}
+//# sourceMappingURL=graph.js.map

package/dist/api/index.d.ts

@@ -1,17 +1,20 @@
 export { ApiError, BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-export { isPrivateScope, passesScopeFilterForRecall } from '../store/recall-scope.js';
-export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../store/recall-scope.js';
+export { isPrivateScope, passesScopeFilterForRecall } from '../core/recall-scope.js';
+export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../core/recall-scope.js';
 export type { TokenSummary, TokenSurface, TokenSurfaceSummary } from '../store/token-ledger.js';
 export type { FailureSummary } from '../store/failure-log.js';
 export { classifyOriginProject } from '../core/project-identity.js';
 export * from './types.js';
 export * from './remember.js';
+export * from './remember-local.js';
 export * from './recall-types.js';
 export * from './recall.js';
 export * from './assemble.js';
 export * from './drill-down.js';
 export * from './outcome.js';
 export * from './forget.js';
+export * from './conflicts.js';
+export * from './projects.js';
 export * from './promote.js';
 export * from './auth.js';
 export * from './audit.js';
@@ -23,4 +26,5 @@ export * from './quarantine.js';
 export * from './sleep.js';
 export * from './goals.js';
 export * from './learn.js';
+export * from './refine.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.js

@@ -3,18 +3,21 @@
 // keeps every import path that callers already use.
 export { ApiError, BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
 // The recall-side scope predicates live in recall-scope.ts (leaf) so shared.ts can use them without an import cycle.
-export { isPrivateScope, passesScopeFilterForRecall } from '../store/recall-scope.js';
-export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../store/recall-scope.js';
+export { isPrivateScope, passesScopeFilterForRecall } from '../core/recall-scope.js';
+export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../core/recall-scope.js';
 // classifyOriginProject lives in project-identity.ts (leaf) for the same reason.
 export { classifyOriginProject } from '../core/project-identity.js';
 export * from './types.js';
 export * from './remember.js';
+export * from './remember-local.js';
 export * from './recall-types.js';
 export * from './recall.js';
 export * from './assemble.js';
 export * from './drill-down.js';
 export * from './outcome.js';
 export * from './forget.js';
+export * from './conflicts.js';
+export * from './projects.js';
 export * from './promote.js';
 export * from './auth.js';
 export * from './audit.js';
@@ -26,4 +29,5 @@ export * from './quarantine.js';
 export * from './sleep.js';
 export * from './goals.js';
 export * from './learn.js';
+export * from './refine.js';
 //# sourceMappingURL=index.js.map

package/dist/api/instruction-detect.js

@@ -3,12 +3,25 @@ const INSTRUCTION_PATTERNS = [
     { name: 'override-instructions', re: /\b(?:ignore|disregard|forget)\b[^.\n]{0,40}\b(?:previous|prior|above)\b[^.\n]{0,40}\binstructions?\b/i },
     { name: 'role-reassignment', re: /\b(?:you are now|act as|pretend to be)\b[^.\n]{0,40}\b(?:an?\s+)?(?:ai|assistant|agent|system)\b/i },
     { name: 'chat-role-markup', re: /<\|im_start\|>|<\|system\|>|\[INST\]|<\/?system>|###\s*system\s*:/i },
-    { name: 'system-prompt-reference', re: /\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b/i },
+    {
+        name: 'system-prompt-reference',
+        re: new RegExp(String.raw `\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|` +
+            String.raw `(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b`, 'i'),
+    },
     // "always"/"never" alone (ordinary PR prose) doesn't flag without an agent-facing target nearby too.
-    { name: 'standing-order', re: /\b(?:from now on|whenever you|always|never)\b[^.\n]{0,50}\b(?:you must|(?:the ai|the assistant|the agent|claude|copilot)\s+(?:must|should|will)\b)/i },
+    {
+        name: 'standing-order',
+        re: /\b(?:from now on|whenever you|always|never)\b[^.\n]{0,50}\b(?:you must|(?:the ai|the assistant|the agent|claude|copilot)\s+(?:must|should|will)\b)/i
+    },
     { name: 'concealment', re: /\b(?:do not|never|don't)\b[^.\n]{0,40}\b(?:tell|mention|reveal)\b[^.\n]{0,40}\bthe user\b/i },
-    { name: 'remote-script-exec', re: /\b(?:curl|wget)\b[^\n|]{0,80}\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b|\biex\s*\(\s*(?:iwr|invoke-webrequest|new-object\s+net\.webclient)/i },
-    { name: 'exfiltration', re: /\b(?:send|post|upload|exfiltrate)\b[^.\n]{0,40}\b(?:secrets?|tokens?|api[- ]?keys?|credentials?|env(?:ironment)? variables?)\b/i },
+    {
+        name: 'remote-script-exec',
+        re: /\b(?:curl|wget)\b[^\n|]{0,80}\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b|\biex\s*\(\s*(?:iwr|invoke-webrequest|new-object\s+net\.webclient)/i
+    },
+    {
+        name: 'exfiltration',
+        re: /\b(?:send|post|upload|exfiltrate)\b[^.\n]{0,40}\b(?:secrets?|tokens?|api[- ]?keys?|credentials?|env(?:ironment)? variables?)\b/i
+    },
     { name: 'unicode-tag-chars', re: /[\u{E0000}-\u{E007F}]/u },
 ];
 // A stray zero-width char has legitimate uses (ZWJ); only a run of 3+ adjacent ones reads as smuggling.
@@ -22,8 +35,10 @@ const NAMED_REFERENCES = new Map([['amp', '&'], ['lt', '<'], ['gt', '>'], ['quot
 const INVISIBLE_RE = /[\u034F\u00AD\u180E\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/g;
 // Cyrillic, then Greek, letters drawn like a c e i j o p s x y; closed at those, so Russian or Greek prose folds into no phrase a pattern names.
 const LOOKALIKES = new Map([
-    ['\u0430', 'a'], ['\u0441', 'c'], ['\u0435', 'e'], ['\u0456', 'i'], ['\u0458', 'j'], ['\u043E', 'o'], ['\u0440', 'p'], ['\u0455', 's'], ['\u0445', 'x'], ['\u0443', 'y'],
-    ['\u0410', 'A'], ['\u0421', 'C'], ['\u0415', 'E'], ['\u0406', 'I'], ['\u0408', 'J'], ['\u041E', 'O'], ['\u0420', 'P'], ['\u0405', 'S'], ['\u0425', 'X'], ['\u0423', 'Y'],
+    ['\u0430', 'a'], ['\u0441', 'c'], ['\u0435', 'e'], ['\u0456', 'i'], ['\u0458', 'j'], ['\u043E', 'o'], ['\u0440', 'p'], ['\u0455', 's'],
+    ['\u0445', 'x'], ['\u0443', 'y'],
+    ['\u0410', 'A'], ['\u0421', 'C'], ['\u0415', 'E'], ['\u0406', 'I'], ['\u0408', 'J'], ['\u041E', 'O'], ['\u0420', 'P'], ['\u0405', 'S'],
+    ['\u0425', 'X'], ['\u0423', 'Y'],
     ['\u03B1', 'a'], ['\u03B5', 'e'], ['\u03B9', 'i'], ['\u03F3', 'j'], ['\u03BF', 'o'], ['\u03C1', 'p'], ['\u03C7', 'x'], ['\u03B3', 'y'],
     ['\u0391', 'A'], ['\u0395', 'E'], ['\u0399', 'I'], ['\u037F', 'J'], ['\u039F', 'O'], ['\u03A1', 'P'], ['\u03A7', 'X'], ['\u03A5', 'Y'],
 ]);

package/dist/api/learn.d.ts

@@ -1,3 +1,4 @@
+import { type InvalidationOptions, type InvalidationResult, type InvalidationTarget } from '../learn/invalidation.js';
 import type { Context } from './types.js';
 /** How a surface writes what it learns. */
 export interface LearnProfile {
@@ -28,4 +29,7 @@ export interface LearnResult {
 }
 /** Learn from `repoPath`'s last `days` of commits into the caller's tenant. Host admin only. */
 export declare function learn(ctx: Context, opts: LearnOpts): LearnResult;
+export type { InvalidationOptions, InvalidationResult, InvalidationTarget };
+/** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */
+export declare function invalidateMemories(ctx: Context, target: InvalidationTarget, options: InvalidationOptions): InvalidationResult;
 //# sourceMappingURL=learn.d.ts.map