hippo-memory 1.71.0 → 1.72.0

package/dist/api/conflicts.js

@@ -0,0 +1,61 @@
+// Conflict resolution for every front end, so the reach, status, pair and liveness checks live in one place.
+// SHORTCUT: hippo.db only, since the store port has no conflict calls; a conflicts group when a served store needs them.
+import { BadRequestError, ConflictError, NotFoundError } from '../core/api-errors.js';
+import { listMemoryConflicts, listTouchableConflicts, resolveConflict } from '../store/conflicts.js';
+import { loadEntriesByIds } from '../store/entry-reads.js';
+import { chunked } from '../util/chunked.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
+import { classifyOriginProject } from '../core/project-identity.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { requireHostAdmin } from './types.js';
+function isLive(entry) {
+    return !entry.superseded_by && (entry.kind === 'raw' || entry.kind === 'distilled') && !isQuarantineScope(entry.scope);
+}
+/** Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as `ctx.actor`.
+ *  NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair. */
+export function resolveMemoryConflict(ctx, conflictId, opts) {
+    // Read with every status, so a resolved conflict answers 409 while one holding another person's personal row stays a 404.
+    const conflict = listTouchableConflicts(ctx.hippoRoot, '*', ctx.tenantId, ctx.actor).find((c) => c.id === conflictId);
+    if (!conflict)
+        throw new NotFoundError(`conflict not found: ${conflictId}`);
+    if (conflict.status !== 'open')
+        throw new ConflictError(`conflict ${conflictId} is already resolved`);
+    const pair = [conflict.memory_a_id, conflict.memory_b_id];
+    if (!pair.includes(opts.keepId))
+        throw new BadRequestError(`keep must be one of the two memories in conflict ${conflictId}: ${pair.join(', ')}`);
+    if (loadEntriesByIds(ctx.hippoRoot, pair, ctx.tenantId).filter(isLive).length < pair.length) {
+        throw new NotFoundError(`conflict ${conflictId} names a memory that is superseded, archived or quarantined`);
+    }
+    const resolved = resolveConflict(ctx.hippoRoot, conflictId, opts.keepId, opts.forget === true, ctx.tenantId, {
+        rejectLoserValue: opts.rejectLoser === true,
+        reason: opts.reason,
+        rejectedBy: ctx.actor.subject,
+    });
+    // Every check passed above, so null here is another resolver getting there first.
+    if (resolved === null)
+        throw new ConflictError(`conflict ${conflictId} is already resolved`);
+    return { conflictId, keptId: opts.keepId, loserId: resolved.loserId };
+}
+/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
+ *  its repo or user-global, and no scope it was not asked for. */
+export function listOpenConflicts(ctx, project) {
+    const touchable = listTouchableConflicts(ctx.hippoRoot, 'open', ctx.tenantId, ctx.actor);
+    if (!project)
+        return touchable;
+    const own = personalScopeOf(ctx.actor);
+    const ids = [...new Set(touchable.flatMap((c) => [c.memory_a_id, c.memory_b_id]))];
+    // loadEntriesByIds reads at most one chunk of ids per call.
+    const rows = new Map(chunked(ids).flatMap((chunk) => loadEntriesByIds(ctx.hippoRoot, chunk, ctx.tenantId)).map((row) => [row.id, row]));
+    const shown = (id) => {
+        const row = rows.get(id);
+        return row !== undefined && classifyOriginProject(row.origin_project, project) !== 'cross-project'
+            && passesScopeFilterForRecall(row.scope ?? null, undefined, own);
+    };
+    return touchable.filter((c) => shown(c.memory_a_id) && shown(c.memory_b_id));
+}
+/** Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only. */
+export function listConflicts(ctx, status, reach = {}) {
+    requireHostAdmin(ctx, 'Listing conflicts past the scope check');
+    return listMemoryConflicts(ctx.hippoRoot, status, reach.everyTenant ? undefined : ctx.tenantId);
+}
+//# sourceMappingURL=conflicts.js.map

package/dist/api/context-render.js

@@ -1,6 +1,7 @@
 // The strings a context block prints. The budget prices these same strings, so selection and print cannot drift.
+import { MINUTE_MS } from '../util/time.js';
 import { calculateStrength, confidenceFacets, confidenceLabel } from '../core/memory.js';
-import { evalNow } from '../core/ablation.js';
+import { evalNow, strengthAblation } from '../core/ablation.js';
 import { estimateTokens } from '../util/token-text.js';
 import { renderAmbientSummary } from '../core/ambient.js';
 import { formatHandoffEvidenceLine } from '../core/handoff.js';
@@ -56,7 +57,7 @@ export function sessionTrailText(events) {
 // Each trail event is capped only in the compact-resume block, so other trail prints keep full content.
 export const COMPACT_RESUME_EVENT_CONTENT_CAP = 400;
 // A snapshot older than this was not written for this compaction (pre-compact skipped), so restoring it is stale, not a resume.
-export const COMPACT_RESUME_MAX_AGE_MS = 15 * 60_000;
+export const COMPACT_RESUME_MAX_AGE_MS = 15 * MINUTE_MS;
 /** The block compact-resume hands the model; events arrive already capped. */
 export function compactResumeText(snapshot, events) {
     return [
@@ -71,7 +72,7 @@ export function compactResumeText(snapshot, events) {
 export function contextHeading(heading, entries, tokens) {
     return `## ${heading} (${entries} entries, ${tokens} tokens)\n`;
 }
-export function contextLine(item, framing, showStrength, now, strengthPct = Math.round(calculateStrength(item.entry) * 100)) {
+export function contextLine(item, framing, showStrength, now, strengthPct = Math.round(calculateStrength(item.entry, undefined, { ablation: strengthAblation() }) * 100)) {
     const e = item.entry;
     const tagStr = e.tags.length > 0 ? ` [${e.tags.join(', ')}]` : '';
     const strengthStr = showStrength ? ` (${strengthPct}%)` : '';

package/dist/api/context-select.js

@@ -5,19 +5,19 @@ import { calculateStrength } from '../core/memory.js';
 import { auditQueryFields, recordAuditEvent } from '../store/audit.js';
 import { isWorthSurfacing } from '../core/memory-quality.js';
 import { rankBothStores } from '../sharing/search-both.js';
-import { evalNow } from '../core/ablation.js';
+import { evalNow, strengthAblation } from '../core/ablation.js';
 import { hybridSearch } from '../search/hybrid.js';
-import { physicsSearch } from '../search/physics-search.js';
+import { physicsSearchIn } from '../search/physics-search.js';
 import { DEFAULT_LOCAL_BUMP } from '../core/search-types.js';
 import { compareScoredResults } from '../core/compare.js';
-import { scopeMatch } from '../sharing/scope.js';
+import { scopeMatch } from '../core/active-scope.js';
 import { scopeBoostFor } from '../search/boosts.js';
 import { promptTokens, contentTokens, gatePromptRecall, } from '../core/prompt-recall.js';
 const GLOBAL_DISCOUNT = 1 / DEFAULT_LOCAL_BUMP;
 // Share and promote copy a memory to the global store under a new id, so equal content is the only link.
 // A pinned copy wins, then the stronger one after the ranking's own global discount; a tie keeps the local copy.
 export function oneCopyPerMemory(local, global, now) {
-    const score = (e, isGlobal) => calculateStrength(e, now) * (isGlobal ? GLOBAL_DISCOUNT : 1);
+    const score = (e, isGlobal) => calculateStrength(e, now, { ablation: strengthAblation() }) * (isGlobal ? GLOBAL_DISCOUNT : 1);
     const best = new Map();
     const offer = (entry, isGlobal) => {
         const held = best.get(entry.content);
@@ -77,7 +77,7 @@ function rankPinned(plan, pinnedLocal, pinnedGlobal, nowP) {
         const scopeBoost = scopeBoostFor(scopeMatch(entry.tags, plan.activeScope));
         return {
             entry,
-            score: calculateStrength(entry, nowP) * (isGlobal ? GLOBAL_DISCOUNT : 1) * scopeBoost,
+            score: calculateStrength(entry, nowP, { ablation: strengthAblation() }) * (isGlobal ? GLOBAL_DISCOUNT : 1) * scopeBoost,
             tokens: plan.price(entry, isGlobal),
             isGlobal,
         };
@@ -200,7 +200,7 @@ function backfillRecent(plan, options) {
         .slice(0, plan.includeRecent)
         .map(({ entry, isGlobal }) => ({
         entry,
-        score: calculateStrength(entry, nowP) * (isGlobal ? GLOBAL_DISCOUNT : 1),
+        score: calculateStrength(entry, nowP, { ablation: strengthAblation() }) * (isGlobal ? GLOBAL_DISCOUNT : 1),
         tokens: plan.price(entry, isGlobal),
         isGlobal,
     }));
@@ -213,7 +213,7 @@ export function selectStrongest(plan, left, pools) {
     const localRanked = localPool
         .map((e) => ({
         entry: e,
-        score: calculateStrength(e, now),
+        score: calculateStrength(e, now, { ablation: strengthAblation() }),
         tokens: plan.price(e, plan.primaryIsGlobal),
         isGlobal: plan.primaryIsGlobal,
     }))
@@ -221,7 +221,7 @@ export function selectStrongest(plan, left, pools) {
     const globalRanked = globalPool
         .map((e) => ({
         entry: e,
-        score: calculateStrength(e, now) * GLOBAL_DISCOUNT,
+        score: calculateStrength(e, now, { ablation: strengthAblation() }) * GLOBAL_DISCOUNT,
         tokens: plan.price(e, true),
         isGlobal: true,
     }))
@@ -280,15 +280,13 @@ async function searchLocalRows(ctx, plan, options) {
     const vectorCandidates = contextVectorSpec(ctx, plan, admit);
     const store = plan.local.store;
     const ctxResults = usePhysicsCtx
-        ? await physicsSearch(query, localEntries, {
+        ? await physicsSearchIn({ root: ctx.hippoRoot, store }, query, localEntries, {
             budget: left,
             minResults,
             cost: localCost,
-            hippoRoot: ctx.hippoRoot,
             physicsConfig: ctxConfig.physics,
             scope: plan.activeScope,
             vectorCandidates,
-            store,
         })
         : await hybridSearch(query, localEntries, {
             budget: left,

package/dist/api/context.js

@@ -1,24 +1,23 @@
 // Ambient context injection: the admission policy and getContext.
-import { isInitialized } from '../store/open.js';
 import { DEFAULT_SEARCH_CANDIDATE_LIMIT } from '../store/rows.js';
 import { freshActiveSnapshot, SNAPSHOT_AMBIENT_MAX_AGE_MS } from '../store/sessions.js';
 import { estimateTokens } from '../util/token-text.js';
 import { markRetrieved, COMPACTION_MEMORY_TAG } from '../core/memory.js';
 import { isWorthSurfacing } from '../core/memory-quality.js';
 import { getGlobalRoot } from '../sharing/global-store.js';
-import { evalNow } from '../core/ablation.js';
+import { evalNow, strengthAblation } from '../core/ablation.js';
 import { dropHeldCopies } from '../util/same-text.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { isSharedStore, loadConfig } from '../core/config.js';
-import { rethrowIfSqliteBlocked } from '../db/index.js';
+import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
 import { errorMessage, log } from '../util/log.js';
-import { resolveProjectIdentity, classifyOriginProject, isGlobalStoreRoot, projectId, projectNames } from '../core/project-identity.js';
+import { resolveProjectIdentity, classifyOriginProject, isGlobalStoreRoot, isInitialized, projectId, projectNames, } from '../core/project-identity.js';
 import { promptTokens } from '../core/prompt-recall.js';
 import { detectSecret } from '../util/secret-detect.js';
 import { isSessionDigestRow } from '../core/session-digest-row.js';
 import { addAmbientTallies, ambientStateFromTallies } from '../core/ambient.js';
 import { requireGroup, sqliteStore, storeFor } from '../store/index.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { finiteOr, selectBySearch, selectPinned, selectStrongest, } from './context-select.js';
 import { andThen, onStore } from './on-store.js';
 import { strengthenOf } from './recall-record.js';
@@ -222,7 +221,11 @@ function openBlockBudget(plan, opts, budget) {
     if (!pinnedOnly)
         obs?.queried(plan.query);
     return cost
-        ? Math.max(0, blockBudget - cost.fixed(blockBudget, { cross: plan.includeCrossProject, promptRecall: promptRecallPending, ambient: !pinnedOnly && config.ambient.enabled }))
+        ? Math.max(0, blockBudget - cost.fixed(blockBudget, {
+            cross: plan.includeCrossProject,
+            promptRecall: promptRecallPending,
+            ambient: !pinnedOnly && config.ambient.enabled,
+        }))
         : blockBudget;
 }
 const NO_TASK_STATE = { snapshot: null, handoff: null, events: [] };
@@ -370,7 +373,7 @@ async function traceEmptyContext(ctx, opts, plan) {
 /** Strengthens and marks the returned rows, then writes the trace and index together. */
 async function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
     const toUpdate = selected.map((s) => s.entry);
-    const updatedEntries = markRetrieved(toUpdate);
+    const updatedEntries = markRetrieved(toUpdate, undefined, { ablation: strengthAblation() });
     const retrievedIds = updatedEntries.map((u) => u.id);
     const trace = {
         tenantId: ctx.tenantId,
@@ -399,7 +402,13 @@ async function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
     return { items, ambientState: plan.config.ambient.enabled ? await readAmbientState(ctx, plan) : undefined };
 }
 async function readAmbientState(ctx, plan) {
-    const filter = { exactScope: plan.exactScope, ownScope: plan.ownScope, project: plan.originProject, currentProject: projectNames(plan.currentProject), now: evalNow() };
+    const filter = {
+        exactScope: plan.exactScope,
+        ownScope: plan.ownScope,
+        project: plan.originProject,
+        currentProject: projectNames(plan.currentProject),
+        now: evalNow(),
+    };
     const sources = [
         ...(plan.hasLocal ? [plan.local.reads] : []),
         ...(plan.hasGlobal && !plan.primaryIsGlobal ? [sourceOf(sqliteStore(plan.globalRoot)).reads] : []),

package/dist/api/continuity.d.ts

@@ -0,0 +1,47 @@
+import type { HandoffOutcome, SessionHandoff } from '../core/handoff.js';
+import type { SessionEvent, TaskSnapshot } from '../store/rows.js';
+import { appendSessionEvent, listSessionEvents, saveActiveTaskSnapshot } from '../store/sessions.js';
+import { wmClear, wmFlush, wmPush, wmRead, type WorkingMemoryItem } from '../store/working-memory.js';
+import type { Context } from './types.js';
+/** What a snapshot save carries. */
+export type SnapshotSaveInput = Parameters<typeof saveActiveTaskSnapshot>[2];
+/** What a session event append carries. */
+export type SessionEventAppendInput = Parameters<typeof appendSessionEvent>[2];
+/** What a session event listing filters on. */
+export type SessionEventListOpts = NonNullable<Parameters<typeof listSessionEvents>[2]>;
+/** Save the caller's active task snapshot. */
+export declare function snapshotSave(ctx: Context, input: SnapshotSaveInput): TaskSnapshot;
+/** Clear the caller's active task snapshot; false when there was none. */
+export declare function snapshotClear(ctx: Context, status: string): boolean;
+/** The caller's active task snapshot, or null. */
+export declare function snapshotLoad(ctx: Context): TaskSnapshot | null;
+/** Append a session event in the caller's tenant. */
+export declare function sessionEventAppend(ctx: Context, event: SessionEventAppendInput): SessionEvent;
+/** List the caller's session events. */
+export declare function sessionEventList(ctx: Context, opts: SessionEventListOpts): SessionEvent[];
+export interface LatestContinuity {
+    snapshot: TaskSnapshot | null;
+    events: SessionEvent[];
+}
+/** The active snapshot plus recent events for `sessionId`, falling back to the snapshot's own session. */
+export declare function continuityLatest(ctx: Context, opts: {
+    sessionId?: string;
+    limit: number;
+}): LatestContinuity;
+/** Stamp the outcome on the caller's handoff for `sessionId`; returns the rows stamped. */
+export declare function handoffStampOutcome(ctx: Context, sessionId: string, outcome: HandoffOutcome): number;
+/** Save a session handoff in the caller's tenant. */
+export declare function handoffSave(ctx: Context, handoff: Omit<SessionHandoff, 'updatedAt'>): SessionHandoff;
+/** The caller's latest handoff, optionally for one session. */
+export declare function handoffLatest(ctx: Context, sessionId?: string): SessionHandoff | null;
+/** The caller's handoff by id, or null. */
+export declare function handoffById(ctx: Context, id: number): SessionHandoff | null;
+/** Push a working memory entry in the caller's tenant; returns its row id. */
+export declare function workingMemoryPush(ctx: Context, opts: Omit<Parameters<typeof wmPush>[1], 'tenantId'>): number;
+/** The caller's working memory entries, most important first. */
+export declare function workingMemoryRead(ctx: Context, opts: Omit<NonNullable<Parameters<typeof wmRead>[1]>, 'tenantId'>): WorkingMemoryItem[];
+/** Delete the caller's working memory entries; returns the count. */
+export declare function workingMemoryClear(ctx: Context, opts: Omit<NonNullable<Parameters<typeof wmClear>[1]>, 'tenantId'>): number;
+/** Flush the caller's working memory at session end; returns the count. */
+export declare function workingMemoryFlush(ctx: Context, opts: Omit<NonNullable<Parameters<typeof wmFlush>[1]>, 'tenantId'>): number;
+//# sourceMappingURL=continuity.d.ts.map

package/dist/api/continuity.js

@@ -0,0 +1,66 @@
+// Where-you-left-off ops: task snapshot, session events, handoffs and working memory.
+import { appendSessionEvent, clearActiveTaskSnapshot, listSessionEvents, loadActiveTaskSnapshot, saveActiveTaskSnapshot, } from '../store/sessions.js';
+import { loadHandoffById, loadLatestHandoff, saveSessionHandoff, stampHandoffOutcome } from '../store/handoffs.js';
+import { wmClear, wmFlush, wmPush, wmRead } from '../store/working-memory.js';
+/** Save the caller's active task snapshot. */
+export function snapshotSave(ctx, input) {
+    return saveActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, input);
+}
+/** Clear the caller's active task snapshot; false when there was none. */
+export function snapshotClear(ctx, status) {
+    return clearActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, status);
+}
+/** The caller's active task snapshot, or null. */
+export function snapshotLoad(ctx) {
+    return loadActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId);
+}
+/** Append a session event in the caller's tenant. */
+export function sessionEventAppend(ctx, event) {
+    return appendSessionEvent(ctx.hippoRoot, ctx.tenantId, event);
+}
+/** List the caller's session events. */
+export function sessionEventList(ctx, opts) {
+    return listSessionEvents(ctx.hippoRoot, ctx.tenantId, opts);
+}
+/** The active snapshot plus recent events for `sessionId`, falling back to the snapshot's own session. */
+export function continuityLatest(ctx, opts) {
+    const snapshot = loadActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId);
+    const events = listSessionEvents(ctx.hippoRoot, ctx.tenantId, {
+        session_id: opts.sessionId || snapshot?.session_id || undefined,
+        limit: opts.limit,
+    });
+    return { snapshot, events };
+}
+/** Stamp the outcome on the caller's handoff for `sessionId`; returns the rows stamped. */
+export function handoffStampOutcome(ctx, sessionId, outcome) {
+    return stampHandoffOutcome(ctx.hippoRoot, ctx.tenantId, sessionId, outcome);
+}
+/** Save a session handoff in the caller's tenant. */
+export function handoffSave(ctx, handoff) {
+    return saveSessionHandoff(ctx.hippoRoot, ctx.tenantId, handoff);
+}
+/** The caller's latest handoff, optionally for one session. */
+export function handoffLatest(ctx, sessionId) {
+    return loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, sessionId);
+}
+/** The caller's handoff by id, or null. */
+export function handoffById(ctx, id) {
+    return loadHandoffById(ctx.hippoRoot, ctx.tenantId, id);
+}
+/** Push a working memory entry in the caller's tenant; returns its row id. */
+export function workingMemoryPush(ctx, opts) {
+    return wmPush(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
+}
+/** The caller's working memory entries, most important first. */
+export function workingMemoryRead(ctx, opts) {
+    return wmRead(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
+}
+/** Delete the caller's working memory entries; returns the count. */
+export function workingMemoryClear(ctx, opts) {
+    return wmClear(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
+}
+/** Flush the caller's working memory at session end; returns the count. */
+export function workingMemoryFlush(ctx, opts) {
+    return wmFlush(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
+}
+//# sourceMappingURL=continuity.js.map

package/dist/api/dormant.js

@@ -3,9 +3,11 @@ import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
 import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
 import { loadDormantMemories, holdsDormantMemory, restoreDormantMemory, forgetDormantMemory, } from '../store/dormant.js';
+import { strengthAblation } from '../core/ablation.js';
 import { createMemory, calculateStrength } from '../core/memory.js';
 import { loadConfig } from '../core/config.js';
-import { canTouchScope, personalScopeOf, touchableScopeSql } from '../store/recall-scope.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
+import { touchableScopeSql } from '../store/rule-sql.js';
 const touchable = (ctx) => touchableScopeSql('', personalScopeOf(ctx.actor));
 /** A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of active memory when `dormant.enabled` is on. Newest first;
  * `opts.query` keeps rows containing every term (case-insensitive). */
@@ -39,7 +41,7 @@ function reviveSnapshot(ctx, dormant, now) {
     };
     if (dormant.reason === 'quality-repair')
         revived.confidence = 'verified';
-    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
+    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now, { ablation: strengthAblation() }) });
 }
 /** Permanently deletes a dormant memory, the explicit "forget it for good"; throws when the tenant has no dormant memory with that id. */
 export function forgetDormant(ctx, id) {

package/dist/api/drill-down.js

@@ -1,7 +1,7 @@
 // DAG drill-down from a summary to its children.
 import { requireGroup, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
-import { passesScopeFilterForRecall, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject } from '../core/project-identity.js';
 const DEFAULT_DRILL_DOWN_LIMIT = 50;
 /** One step down the DAG from a level-2+ summary to its direct children (the way back from `recall(... summarizeOverflow: true)` substitutions). Only

package/dist/api/embeddings.d.ts

@@ -0,0 +1,17 @@
+import type { EmbeddingProvider } from '../embeddings/provider.js';
+import { type Context } from './types.js';
+/** Embed every memory that has no vector yet; resolves to how many it embedded. */
+export declare function embedMissingMemories(ctx: Context, provider?: EmbeddingProvider): Promise<number>;
+/** How many vectors the store holds, live memory or not. */
+export declare function storedVectorCount(ctx: Context): number;
+export interface EmbedCoverage {
+    /** Every memory id in the store. */
+    memoryIds: string[];
+    /** Every id with a stored vector, including orphans whose memory is gone. */
+    vectorIds: string[];
+}
+/** Memory ids against vector ids, for the embed status and backfill lines. */
+export declare function embedCoverage(ctx: Context): EmbedCoverage;
+/** Re-seed every memory's physics particle from its vector; returns how many it reset. */
+export declare function resetPhysicsFromVectors(ctx: Context): number;
+//# sourceMappingURL=embeddings.d.ts.map

package/dist/api/embeddings.js

@@ -0,0 +1,28 @@
+// The vector side of a store for the embed and import verbs: embed what is missing, count coverage, re-seed physics.
+// Vectors and physics rows carry no tenant, so each op covers the whole store and needs the host admin.
+import { embedAll } from '../search/embed-memories.js';
+import { loadAllEntryIds } from '../store/entry-reads.js';
+import { loadEmbeddingIndex, resetStoredParticles, storedVectorSummary } from '../store/vector-index.js';
+import { requireHostAdmin } from './types.js';
+/** Embed every memory that has no vector yet; resolves to how many it embedded. */
+export async function embedMissingMemories(ctx, provider) {
+    requireHostAdmin(ctx, 'Embedding the store');
+    return embedAll(ctx.hippoRoot, undefined, provider);
+}
+/** How many vectors the store holds, live memory or not. */
+export function storedVectorCount(ctx) {
+    requireHostAdmin(ctx, 'Reading the vector index');
+    return storedVectorSummary(ctx.hippoRoot).ids.size;
+}
+/** Memory ids against vector ids, for the embed status and backfill lines. */
+export function embedCoverage(ctx) {
+    requireHostAdmin(ctx, 'Reading the vector index');
+    return { memoryIds: loadAllEntryIds(ctx.hippoRoot), vectorIds: [...storedVectorSummary(ctx.hippoRoot).ids] };
+}
+/** Re-seed every memory's physics particle from its vector; returns how many it reset. */
+export function resetPhysicsFromVectors(ctx) {
+    requireHostAdmin(ctx, 'Resetting physics');
+    const vectors = loadEmbeddingIndex(ctx.hippoRoot);
+    return resetStoredParticles(ctx.hippoRoot, loadAllEntryIds(ctx.hippoRoot), vectors);
+}
+//# sourceMappingURL=embeddings.js.map

package/dist/api/error-reply.d.ts

@@ -0,0 +1,8 @@
+/** The status and client-facing message for one failed request. */
+export interface ApiErrorReply {
+    status: number;
+    message: string;
+}
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export declare function mapApiError<E>(err: E): ApiErrorReply;
+//# sourceMappingURL=error-reply.d.ts.map

package/dist/api/error-reply.js

@@ -0,0 +1,21 @@
+// The one error-to-reply map the HTTP server and the MCP transports share, so a status never depends on which front end caught the error.
+import { ApiError } from '../core/api-errors.js';
+import { BodyTimeoutError, BodyTooLargeError, HttpError, INTERNAL_ERROR_MESSAGE, STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
+import { SqliteBlockedError } from '../util/sqlite-blocked.js';
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export function mapApiError(err) {
+    // An add-on can build an HttpError from any number, and writeHead throws on one outside 100-999.
+    if (err instanceof HttpError && !(Number.isInteger(err.status) && err.status >= 100 && err.status <= 999)) {
+        return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+    }
+    if (err instanceof HttpError || err instanceof ApiError)
+        return { status: err.status, message: err.message };
+    if (err instanceof BodyTooLargeError)
+        return { status: 413, message: err.message };
+    if (err instanceof BodyTimeoutError)
+        return { status: 408, message: err.message };
+    if (err instanceof SqliteBlockedError)
+        return { status: 501, message: STORE_NOT_PORTED_MESSAGE };
+    return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+}
+//# sourceMappingURL=error-reply.js.map

package/dist/api/forget.d.ts

@@ -1,4 +1,5 @@
-import type { Context, StoreReply } from './types.js';
+import { type RejectFlowResult } from '../trust/reject-flow.js';
+import { type Context, type StoreReply } from './types.js';
 /** Delete a memory by id. Reach is checked inside the delete's write scope, and a
  * row out of reach answers as not found, so a caller learns nothing about it. */
 export interface ForgetResult {
@@ -20,7 +21,10 @@ export interface RejectResult {
 }
 /** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
  * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
-export declare function reject(ctx: Context, opts: RejectOpts): RejectResult;
+export declare function reject(ctx: Context, opts: RejectOpts): Promise<RejectResult>;
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
+ *  personal refusal rather than reject's not-found, as the operator can see that row. */
+export declare function rejectOnHost(ctx: Context, opts: RejectOpts): RejectFlowResult;
 /** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export declare function unreject(ctx: Context, digestOrPrefix: string): {
     ok: boolean;

package/dist/api/forget.js

@@ -2,8 +2,9 @@
 import { BadRequestError, NotFoundError } from '../core/api-errors.js';
 import { rejectValue, unrejectValue } from '../trust/reject-flow.js';
 import { andThen, notPorted, onStore } from './on-store.js';
-import { readEntry } from '../store/entry-reads.js';
-import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
+import { requireHostAdmin } from './types.js';
+import { getMemory } from './memories.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
 export function forget(ctx, id) {
     return onStore(ctx, (port) => {
         const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
@@ -13,15 +14,26 @@ export function forget(ctx, id) {
 }
 /** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
  * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
-export function reject(ctx, opts) {
+export async function reject(ctx, opts) {
     if (opts.memoryId !== undefined) {
         // Tenant scope: same not-found-shaped denial as forget/promote; rejectValue tenant-checks too, but pre-checking keeps the error message consistent.
-        const entry = readEntry(ctx.hippoRoot, opts.memoryId);
-        if (entry?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, entry.scope)) {
+        const entry = await getMemory(ctx, opts.memoryId);
+        if (entry === null || !canTouchScope(ctx.actor, entry.scope)) {
             throw new NotFoundError(`memory not found: ${opts.memoryId}`);
         }
     }
-    const result = rejectValue({
+    const result = applyReject(ctx, opts);
+    return { digest: result.digest, removedIds: result.removedIds };
+}
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
+ *  personal refusal rather than reject's not-found, as the operator can see that row. */
+export function rejectOnHost(ctx, opts) {
+    requireHostAdmin(ctx, 'Rejecting with the removal report');
+    return applyReject(ctx, opts);
+}
+function applyReject(ctx, opts) {
+    // SHORTCUT: the tombstone write is hippo.db only, as the port has no rejection group; one when a served store needs reject.
+    return rejectValue({
         hippoRoot: ctx.hippoRoot,
         tenantId: ctx.tenantId,
         actor: ctx.actor.subject,
@@ -30,7 +42,6 @@ export function reject(ctx, opts) {
         value: opts.value,
         ownScope: personalScopeOf(ctx.actor) ?? undefined,
     });
-    return { digest: result.digest, removedIds: result.removedIds };
 }
 /** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export function unreject(ctx, digestOrPrefix) {

package/dist/api/goals.d.ts

@@ -1,5 +1,5 @@
 import { type CompleteGoalOpts, type Goal, type PushGoalOpts } from '../store/goals.js';
-import type { Context } from './types.js';
+import { type Context } from './types.js';
 /** What a new goal carries; its tenant is always the caller's. */
 export type GoalPushOpts = Omit<PushGoalOpts, 'tenantId'>;
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */

package/dist/api/goals.js

@@ -1,6 +1,6 @@
 // The per-session goal stack that recall boosts: push, list, complete, suspend and resume.
-import { ForbiddenError } from '../core/api-errors.js';
 import { completeGoal, getActiveGoals, getSessionGoals, pushGoal, resumeGoal, suspendGoal, } from '../store/goals.js';
+import { requireHostAdmin } from './types.js';
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */
 export function goalPush(ctx, opts) {
     return pushGoal(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
@@ -12,22 +12,18 @@ export function goalList(ctx, opts) {
 }
 /** Complete a goal by id; a no-op for an unknown or already completed goal. Host admin only. */
 export function goalComplete(ctx, goalId, opts) {
-    requireHostAdmin(ctx);
+    // Goal ids are not tenant-scoped in the store, so acting on one by id reaches past the caller's tenant.
+    requireHostAdmin(ctx, 'Completing a goal by id');
     completeGoal(ctx.hippoRoot, goalId, opts);
 }
 /** Suspend an active goal by id. Host admin only. */
 export function goalSuspend(ctx, goalId) {
-    requireHostAdmin(ctx);
+    requireHostAdmin(ctx, 'Suspending a goal by id');
     suspendGoal(ctx.hippoRoot, goalId);
 }
 /** Resume a suspended goal by id, suspending the oldest active one past the depth cap. Host admin only. */
 export function goalResume(ctx, goalId) {
-    requireHostAdmin(ctx);
+    requireHostAdmin(ctx, 'Resuming a goal by id');
     resumeGoal(ctx.hippoRoot, goalId);
 }
-// Goal ids are not tenant-scoped in the store, so acting on one by id is a cross-tenant power.
-function requireHostAdmin(ctx) {
-    if (!ctx.actor.hostAdmin)
-        throw new ForbiddenError('Only the host admin can change a goal by id');
-}
 //# sourceMappingURL=goals.js.map

package/dist/api/index.d.ts

@@ -1,6 +1,6 @@
 export { ApiError, BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-export { isPrivateScope, passesScopeFilterForRecall } from '../store/recall-scope.js';
-export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../store/recall-scope.js';
+export { isPrivateScope, passesScopeFilterForRecall } from '../core/recall-scope.js';
+export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../core/recall-scope.js';
 export type { TokenSummary, TokenSurface, TokenSurfaceSummary } from '../store/token-ledger.js';
 export type { FailureSummary } from '../store/failure-log.js';
 export { classifyOriginProject } from '../core/project-identity.js';
@@ -13,6 +13,8 @@ export * from './assemble.js';
 export * from './drill-down.js';
 export * from './outcome.js';
 export * from './forget.js';
+export * from './conflicts.js';
+export * from './projects.js';
 export * from './promote.js';
 export * from './auth.js';
 export * from './audit.js';

package/dist/api/index.js

@@ -3,8 +3,8 @@
 // keeps every import path that callers already use.
 export { ApiError, BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
 // The recall-side scope predicates live in recall-scope.ts (leaf) so shared.ts can use them without an import cycle.
-export { isPrivateScope, passesScopeFilterForRecall } from '../store/recall-scope.js';
-export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../store/recall-scope.js';
+export { isPrivateScope, passesScopeFilterForRecall } from '../core/recall-scope.js';
+export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../core/recall-scope.js';
 // classifyOriginProject lives in project-identity.ts (leaf) for the same reason.
 export { classifyOriginProject } from '../core/project-identity.js';
 export * from './types.js';
@@ -16,6 +16,8 @@ export * from './assemble.js';
 export * from './drill-down.js';
 export * from './outcome.js';
 export * from './forget.js';
+export * from './conflicts.js';
+export * from './projects.js';
 export * from './promote.js';
 export * from './auth.js';
 export * from './audit.js';

package/dist/api/instruction-detect.js

@@ -3,7 +3,11 @@ const INSTRUCTION_PATTERNS = [
     { name: 'override-instructions', re: /\b(?:ignore|disregard|forget)\b[^.\n]{0,40}\b(?:previous|prior|above)\b[^.\n]{0,40}\binstructions?\b/i },
     { name: 'role-reassignment', re: /\b(?:you are now|act as|pretend to be)\b[^.\n]{0,40}\b(?:an?\s+)?(?:ai|assistant|agent|system)\b/i },
     { name: 'chat-role-markup', re: /<\|im_start\|>|<\|system\|>|\[INST\]|<\/?system>|###\s*system\s*:/i },
-    { name: 'system-prompt-reference', re: /\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b/i },
+    {
+        name: 'system-prompt-reference',
+        re: new RegExp(String.raw `\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|` +
+            String.raw `(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b`, 'i'),
+    },
     // "always"/"never" alone (ordinary PR prose) doesn't flag without an agent-facing target nearby too.
     {
         name: 'standing-order',