hippo-memory 1.72.0 → 2.1.0

package/dist/util/spawn-argv.d.ts

@@ -0,0 +1,11 @@
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+/** Quotes one cmd.exe argument; each `%` leaves the quotes as `^%`, so no %NAME% pair can expand. */
+export declare function quoteCmdArg(arg: string): string;
+/** cmd.exe arguments that run a .cmd or .bat shim with every forwarded argument delivered verbatim. */
+export declare function cmdShimArgs(shimPath: string, forwardArgs: readonly string[]): string[];
+/**
+ * Spawns argv[0] with the rest as its arguments and no shell. Node refuses to start a .cmd or .bat without one
+ * (CVE-2024-27980),
+ *  so on win32 such a shim runs through cmd.exe with every argument quoted for it. */
+export declare function spawnArgv(argv: readonly string[], options: SpawnOptions): ChildProcess;
+//# sourceMappingURL=spawn-argv.d.ts.map

package/dist/util/spawn-argv.js

@@ -0,0 +1,66 @@
+// Starting a command from an argv list with no shell, Windows .cmd and .bat shims included, so no argument is ever
+// parsed as shell syntax.
+import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { envPath, envPathExt } from './env.js';
+/** Quotes one cmd.exe argument; each `%` leaves the quotes as `^%`, so no %NAME% pair can expand. */
+export function quoteCmdArg(arg) {
+    // cmd.exe ends the command line at CR or LF, so what follows would run as a new command.
+    if (/[\r\n]/.test(arg))
+        throw new Error('cmd.exe argument contains a CR or LF, which would start a new command');
+    if (arg.length === 0)
+        return '""';
+    if (!/[ \t"&()^<>|%!]/.test(arg))
+        return arg;
+    return `"${arg.replace(/"/g, '""').replace(/%/g, '"^%"')}"`;
+}
+/** cmd.exe arguments that run a .cmd or .bat shim with every forwarded argument delivered verbatim. */
+export function cmdShimArgs(shimPath, forwardArgs) {
+    const command = `"${shimPath}"${forwardArgs.length > 0 ? ` ${forwardArgs.map(quoteCmdArg).join(' ')}` : ''}`;
+    // The line is already quoted for cmd.exe, so Node must not quote it again; /s strips the outer pair.
+    return ['/d', '/v:off', '/s', '/c', `"${command}"`];
+}
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+function isFile(candidate) {
+    return fs.statSync(candidate, { throwIfNoEntry: false })?.isFile() === true;
+}
+/**
+ * The file `command` names on win32: as given when it has a folder, else the first hit on PATH (never the working
+ * folder, where a project file could stand in for a tool), trying each PATHEXT.
+ */
+function resolveWindowsCommand(command) {
+    const exts = (envPathExt() ?? DEFAULT_PATHEXT).split(';').filter((ext) => ext.length > 0);
+    const dirs = /[\\/]/.test(command) ? [''] : (envPath() ?? '').split(path.delimiter).filter((dir) => dir.length > 0);
+    for (const dir of dirs) {
+        const base = dir === '' ? command : path.join(dir, command);
+        const candidates = path.extname(command) === '' ? exts.map((ext) => base + ext) : [base, ...exts.map((ext) => base + ext)];
+        const hit = candidates.find(isFile);
+        if (hit !== undefined)
+            return hit;
+    }
+    return null;
+}
+/**
+ * Spawns argv[0] with the rest as its arguments and no shell. Node refuses to start a .cmd or .bat without one
+ * (CVE-2024-27980),
+ *  so on win32 such a shim runs through cmd.exe with every argument quoted for it. */
+export function spawnArgv(argv, options) {
+    const [command, ...args] = argv;
+    if (command === undefined || command.length === 0)
+        throw new RangeError('spawnArgv needs a command: argv is empty');
+    if (process.platform === 'win32') {
+        const resolved = resolveWindowsCommand(command);
+        const ext = resolved === null ? '' : path.extname(resolved).toLowerCase();
+        if (resolved !== null && (ext === '.cmd' || ext === '.bat')) {
+            return spawn('cmd.exe', cmdShimArgs(resolved, args), {
+                ...options,
+                windowsHide: options.windowsHide ?? true,
+                shell: false,
+                windowsVerbatimArguments: true,
+            });
+        }
+    }
+    return spawn(command, args, { ...options, windowsHide: options.windowsHide ?? true, shell: false });
+}
+//# sourceMappingURL=spawn-argv.js.map

package/dist/util/sql.d.ts

@@ -0,0 +1,3 @@
+/** `n` bound-parameter marks joined for an IN list or VALUES row, e.g. 3 -> "?, ?, ?". */
+export declare function placeholders(n: number): string;
+//# sourceMappingURL=sql.d.ts.map

package/dist/util/sql.js

@@ -0,0 +1,6 @@
+// SQL text helpers shared by every layer that builds an IN list or VALUES row.
+/** `n` bound-parameter marks joined for an IN list or VALUES row, e.g. 3 -> "?, ?, ?". */
+export function placeholders(n) {
+    return Array.from({ length: n }, () => '?').join(', ');
+}
+//# sourceMappingURL=sql.js.map

package/dist/util/sqlite-blocked.d.ts

@@ -1,18 +1,29 @@
-/** Thrown by a hippo.db open inside a request served from another store: the code path is not ported to the store port yet. */
+/**
+ * Thrown by a hippo.db open inside a request served from another store: the code path is not ported to the store port
+ * yet.
+ */
 export declare class SqliteBlockedError extends Error {
     readonly storeKind: string;
     constructor(storeKind: string, message?: string);
 }
-/** A store that lacks a whole group of port methods; it maps to the same 501, and the log names the group instead of hippo.db. */
+/**
+ * A store that lacks a whole group of port methods; it maps to the same 501, and the log names the group instead of
+ * hippo.db.
+ */
 export declare class StoreNotPortedError extends SqliteBlockedError {
     readonly group: string;
     constructor(storeKind: string, group: string);
 }
-/** Thrown by a hippo.db open in a folder whose marker file names the store that holds its memories, from the CLI as from a request. */
+/**
+ * Thrown by a hippo.db open in a folder whose marker file names the store that holds its memories, from the CLI as from
+ * a request.
+ */
 export declare class OtherStoreFolderError extends SqliteBlockedError {
     readonly markerPath: string;
     constructor(storeKind: string, markerPath: string);
 }
-/** First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently. */
+/**
+ * First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently.
+ */
 export declare function rethrowIfSqliteBlocked<E>(err: E): void;
 //# sourceMappingURL=sqlite-blocked.d.ts.map

package/dist/util/sqlite-blocked.js

@@ -1,14 +1,22 @@
-// A leaf module, so http-util can map this error to a 501 without importing db/open, whose migrations reach back to http-util.
-/** Thrown by a hippo.db open inside a request served from another store: the code path is not ported to the store port yet. */
+// A leaf module, so http-util can map this error to a 501 without importing db/open, whose migrations reach back to
+// http-util.
+/**
+ * Thrown by a hippo.db open inside a request served from another store: the code path is not ported to the store port
+ * yet.
+ */
 export class SqliteBlockedError extends Error {
     storeKind;
-    constructor(storeKind, message = `hippo.db is not opened while the '${storeKind}' store serves this request; this code path is not ported to the store yet`) {
+    constructor(storeKind, message = `hippo.db is not opened while the '${storeKind}' store serves this request; this code path is not ` +
+        `ported to the store yet`) {
         super(message);
         this.storeKind = storeKind;
         this.name = 'SqliteBlockedError';
     }
 }
-/** A store that lacks a whole group of port methods; it maps to the same 501, and the log names the group instead of hippo.db. */
+/**
+ * A store that lacks a whole group of port methods; it maps to the same 501, and the log names the group instead of
+ * hippo.db.
+ */
 export class StoreNotPortedError extends SqliteBlockedError {
     group;
     constructor(storeKind, group) {
@@ -17,7 +25,10 @@ export class StoreNotPortedError extends SqliteBlockedError {
         this.name = 'StoreNotPortedError';
     }
 }
-/** Thrown by a hippo.db open in a folder whose marker file names the store that holds its memories, from the CLI as from a request. */
+/**
+ * Thrown by a hippo.db open in a folder whose marker file names the store that holds its memories, from the CLI as from
+ * a request.
+ */
 export class OtherStoreFolderError extends SqliteBlockedError {
     markerPath;
     constructor(storeKind, markerPath) {
@@ -26,7 +37,9 @@ export class OtherStoreFolderError extends SqliteBlockedError {
         this.name = 'OtherStoreFolderError';
     }
 }
-/** First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently. */
+/**
+ * First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently.
+ */
 export function rethrowIfSqliteBlocked(err) {
     if (err instanceof SqliteBlockedError)
         throw err;

package/dist/util/stored-json.d.ts

@@ -4,6 +4,9 @@ export interface StoredJsonSite {
     id: string | number;
     column: string;
 }
-/** Warns the first time this row's column is found damaged (the logger caps how many), then at debug, so a row read on every recall cannot flood stderr. */
+/**
+ * Warns the first time this row's column is found damaged (the logger caps how many), then at debug, so a row read on
+ * every recall cannot flood stderr.
+ */
 export declare function warnDamagedColumn(site: StoredJsonSite, problem: 'not valid JSON' | 'wrong shape'): void;
 //# sourceMappingURL=stored-json.d.ts.map

package/dist/util/stored-json.js

@@ -1,6 +1,10 @@
-// One log line for a stored JSON column that will not read, so a reader that degrades to an empty value still leaves a trace.
+// One log line for a stored JSON column that will not read, so a reader that degrades to an empty value still leaves a
+// trace.
 import { log } from './log.js';
-/** Warns the first time this row's column is found damaged (the logger caps how many), then at debug, so a row read on every recall cannot flood stderr. */
+/**
+ * Warns the first time this row's column is found damaged (the logger caps how many), then at debug, so a row read on
+ * every recall cannot flood stderr.
+ */
 export function warnDamagedColumn(site, problem) {
     const { table, id, column } = site;
     log.warnThenDebug(`damaged-column:${table}:${id}:${column}`, `store: ${table}.${column} is ${problem}; read as empty`, { table, id, column });

package/dist/util/stream-tee.d.ts

@@ -1,3 +1,4 @@
-/** Mirrors every stdout and stderr chunk to `logFile` until the returned restore runs; an append failure warns once and never stops the real write. */
+/** Mirrors every stdout and stderr chunk to `logFile` until the returned restore runs; an append failure warns once
+ * and never stops the real write. */
 export declare function teeStdStreams(logFile: string): () => void;
 //# sourceMappingURL=stream-tee.d.ts.map

package/dist/util/stream-tee.js

@@ -1,6 +1,7 @@
 import * as fs from 'fs';
-import { errorMessage, log } from './log.js';
-/** Mirrors every stdout and stderr chunk to `logFile` until the returned restore runs; an append failure warns once and never stops the real write. */
+import { errorMessage, log, errorFields } from './log.js';
+/** Mirrors every stdout and stderr chunk to `logFile` until the returned restore runs; an append failure warns once
+ * and never stops the real write. */
 export function teeStdStreams(logFile) {
     const origStdoutWrite = process.stdout.write.bind(process.stdout);
     const origStderrWrite = process.stderr.write.bind(process.stderr);
@@ -13,16 +14,18 @@ export function teeStdStreams(logFile) {
             if (warned)
                 return;
             warned = true;
-            log.warn(`log file ${logFile} is no longer writable; output continues without it: ${errorMessage(err)}`);
+            log.warn(`log file ${logFile} is no longer writable; output continues without it: ${errorMessage(err)}`, errorFields(err));
         }
     };
     const wrapWrite = (origWrite) => {
         const wrapped = (...args) => {
             tee(args[0]);
-            // SAFETY: forwarding the exact arguments the real overloaded `write` received is safe; `StreamWriteArgs` is the union of both overloads' parameter lists.
+            // SAFETY: forwarding the exact arguments the real overloaded `write` received is safe; `StreamWriteArgs` is the
+            // union of both overloads' parameter lists.
             return origWrite(...args);
         };
-        // SAFETY: `wrapped` matches both real `write` overload shapes; TS cannot verify one implementation covers an overloaded type.
+        // SAFETY: `wrapped` matches both real `write` overload shapes; TS cannot verify one implementation covers an
+        // overloaded type.
         return wrapped;
     };
     process.stdout.write = wrapWrite(origStdoutWrite);

package/dist/util/transcript-tail.d.ts

@@ -4,6 +4,9 @@ export declare const PRE_COMPACT_TAIL_BYTES: number;
 export declare function truncateCodePointSafe(text: string, maxChars: number): string;
 /** The last `capBytes` of a JSONL transcript, read at an offset and starting on a whole line so every line parses. */
 export declare function readTranscriptTail(transcriptPath: string, capBytes?: number): string;
-/** {@link readTranscriptTail} for a transcript the caller opened and sized, so the size and the bytes come from one file. */
+/**
+ * {@link readTranscriptTail} for a transcript the caller opened and sized, so the size and the bytes come from one
+ * file.
+ */
 export declare function readOpenTranscriptTail(fd: number, size: number, capBytes: number): string;
 //# sourceMappingURL=transcript-tail.d.ts.map

package/dist/util/transcript-tail.js

@@ -24,7 +24,10 @@ export function readTranscriptTail(transcriptPath, capBytes = PRE_COMPACT_TAIL_B
         fs.closeSync(fd);
     }
 }
-/** {@link readTranscriptTail} for a transcript the caller opened and sized, so the size and the bytes come from one file. */
+/**
+ * {@link readTranscriptTail} for a transcript the caller opened and sized, so the size and the bytes come from one
+ * file.
+ */
 export function readOpenTranscriptTail(fd, size, capBytes) {
     const start = Math.max(0, size - capBytes);
     const length = size - start;

package/dist/util/vector-codec.d.ts

@@ -0,0 +1,4 @@
+/** Float32 vector <-> Buffer codec for BLOB columns. */
+export declare function float32ToBuffer(arr: number[]): Buffer;
+export declare function bufferToFloat32(buf: Buffer | Uint8Array): number[];
+//# sourceMappingURL=vector-codec.d.ts.map

package/dist/util/vector-codec.js

@@ -0,0 +1,15 @@
+/** Float32 vector <-> Buffer codec for BLOB columns. */
+export function float32ToBuffer(arr) {
+    const f32 = new Float32Array(arr);
+    return Buffer.from(f32.buffer);
+}
+export function bufferToFloat32(buf) {
+    if (buf.byteLength === 0 || buf.byteLength % 4 !== 0)
+        return [];
+    // Ensure we have a properly aligned copy (SQLite may return Uint8Array, not Buffer)
+    const bytes = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    const aligned = new ArrayBuffer(bytes.length);
+    new Uint8Array(aligned).set(bytes);
+    return Array.from(new Float32Array(aligned));
+}
+//# sourceMappingURL=vector-codec.js.map

package/dist/util/version.d.ts

@@ -1,10 +1,15 @@
-/** Single source of truth for the package version, written by scripts/sync-version.mjs; never edit by hand. Read by the db rollback guard, /health, MCP.
+/**
+ * Single source of truth for the package version, written by scripts/sync-version.mjs; never edit by hand. Read by the
+ * db rollback guard, /health, MCP.
  * A constant, not a runtime package.json read: the published bundle may lack package.json on a path ESM can resolve. */
-export declare const PACKAGE_VERSION = "1.72.0";
+export declare const PACKAGE_VERSION = "2.1.0";
 /** The floor a store takes on its first expiring key: the first release with schema
  * v53, set by hand in that release; scripts/check-expiring-keys-floor.mjs gates it. */
 export declare const EXPIRING_KEYS_MIN_BINARY = "1.64.0";
-/** The floor a store takes on its first session bind or owner snapshot: first release with v54; set by hand in that release. */
+/**
+ * The floor a store takes on its first session bind or owner snapshot: first release with v54; set by hand in that
+ * release.
+ */
 export declare const TASK_OWNER_MIN_BINARY = "1.64.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;

package/dist/util/version.js

@@ -1,10 +1,15 @@
-/** Single source of truth for the package version, written by scripts/sync-version.mjs; never edit by hand. Read by the db rollback guard, /health, MCP.
+/**
+ * Single source of truth for the package version, written by scripts/sync-version.mjs; never edit by hand. Read by the
+ * db rollback guard, /health, MCP.
  * A constant, not a runtime package.json read: the published bundle may lack package.json on a path ESM can resolve. */
-export const PACKAGE_VERSION = '1.72.0';
+export const PACKAGE_VERSION = '2.1.0';
 /** The floor a store takes on its first expiring key: the first release with schema
  * v53, set by hand in that release; scripts/check-expiring-keys-floor.mjs gates it. */
 export const EXPIRING_KEYS_MIN_BINARY = '1.64.0';
-/** The floor a store takes on its first session bind or owner snapshot: first release with v54; set by hand in that release. */
+/**
+ * The floor a store takes on its first session bind or owner snapshot: first release with v54; set by hand in that
+ * release.
+ */
 export const TASK_OWNER_MIN_BINARY = '1.64.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {

package/dist/util/write-budget.d.ts

@@ -3,9 +3,14 @@ export declare const TARGET_HOLD_MS = 100;
 /** SQLite's longest busy-handler sleep under a hook's 1 s wait, so a waiting hook always wakes inside the gap. */
 export declare const GAP_MS = 100;
 export declare function clock(): number;
-/** Waits until GAP_MS have passed since the last commit; always yields once, so timers and requests run between chunks. */
+/**
+ * Waits until GAP_MS have passed since the last commit; always yields once, so timers and requests run between chunks.
+ */
 export declare function pauseForWaiters(lastCommitAt: number): Promise<void>;
-/** The hold, clock and pause a chunked write runs on; a test passes its own to force chunk boundaries without real waits. */
+/**
+ * The hold, clock and pause a chunked write runs on; a test passes its own to force chunk boundaries without real
+ * waits.
+ */
 export interface WriteBudget {
     readonly holdMs: number;
     readonly clock: () => number;

package/dist/util/write-budget.js

@@ -1,4 +1,5 @@
-// How long a long-running write may hold the store's write lock per transaction, and how long it lets other writers in after.
+// How long a long-running write may hold the store's write lock per transaction, and how long it lets other writers in
+// after.
 import { setTimeout as delay } from 'node:timers/promises';
 /** A chunk closes at the first unit boundary after this long: a server request gives up after a 250 ms wait. */
 export const TARGET_HOLD_MS = 100;
@@ -7,7 +8,9 @@ export const GAP_MS = 100;
 export function clock() {
     return performance.now();
 }
-/** Waits until GAP_MS have passed since the last commit; always yields once, so timers and requests run between chunks. */
+/**
+ * Waits until GAP_MS have passed since the last commit; always yields once, so timers and requests run between chunks.
+ */
 export async function pauseForWaiters(lastCommitAt) {
     await delay(Math.max(0, GAP_MS - (clock() - lastCommitAt)));
 }

package/dist/util/yaml.d.ts

@@ -1,4 +1,7 @@
-/** Minimal YAML frontmatter serializer/deserializer with no external deps: simple key-value pairs and inline arrays, enough for the MemoryEntry schema. */
+/**
+ * Minimal YAML frontmatter serializer/deserializer with no external deps: simple key-value pairs and inline arrays,
+ * enough for the MemoryEntry schema.
+ */
 type YamlValue = string | number | boolean | null | string[] | number[];
 export declare function dumpFrontmatter(obj: Record<string, YamlValue>): string;
 export interface ParsedFrontmatter {

package/dist/util/yaml.js

@@ -1,4 +1,7 @@
-/** Minimal YAML frontmatter serializer/deserializer with no external deps: simple key-value pairs and inline arrays, enough for the MemoryEntry schema. */
+/**
+ * Minimal YAML frontmatter serializer/deserializer with no external deps: simple key-value pairs and inline arrays,
+ * enough for the MemoryEntry schema.
+ */
 const SCALAR_LOOKALIKE = /^(null|true|false|-?\d+(\.\d+)?)$/;
 const UNESCAPES = new Map([['\\', '\\'], ['"', '"'], ['n', '\n'], ['r', '\r']]);
 function escapeString(s) {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.",
-  "version": "1.72.0",
+  "version": "2.1.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.72.0",
+  "version": "2.1.0",
   "type": "module",
   "description": "Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.",
-  "version": "1.72.0",
+  "version": "2.1.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.72.0",
+  "version": "2.1.0",
   "description": "Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",
@@ -8,6 +8,8 @@
   "exports": {
     ".": "./dist/index.js",
     "./server": "./dist/server.js",
+    "./store-kit": "./dist/entry/store-kit.js",
+    "./testing": "./dist/entry/testing.js",
     "./project-identity": "./dist/entry/project-identity.js",
     "./json-hooks": "./dist/entry/json-hooks.js",
     "./session-text": "./dist/entry/session-text.js"
@@ -34,6 +36,7 @@
     "baseline": "npm run build && npm test",
     "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc && tsc -p tsconfig.benchmarks.json && tsc -p tsconfig.extensions.json",
     "typecheck:tests": "tsc -p tsconfig.tests.json",
+    "check:dts": "node scripts/check-dts-diff.mjs",
     "dev": "tsc --watch",
     "pretest": "npm run build",
     "test": "vitest run",

package/scripts/postinstall.cjs

@@ -11,6 +11,8 @@ if (!fs.existsSync(distPostinstall)) {
   process.exit(0);
 }
 
-import(pathToFileURL(distPostinstall).href).catch(() => {
+// A failed nudge must not fail the install, but the reason still reaches the user.
+import(pathToFileURL(distPostinstall).href).catch((err) => {
+  process.stderr.write(`hippo-memory postinstall skipped: ${err instanceof Error ? err.message : err}\n`);
   process.exit(0);
 });

package/dist/api/audit.js

@@ -1,56 +0,0 @@
-// Audit log queries and retention, and the memory-quality audit with its repair passes.
-import { pruneAuditRows } from '../store/audit.js';
-import { auditMemories } from '../core/memory-audit.js';
-import { deleteEntriesAutomatically, memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { loadAllEntries } from '../store/entry-reads.js';
-import { repairAutomaticMemories, repairQualityOnce } from '../store/quality-repair.js';
-import { DAY_MS } from '../util/time.js';
-import { requireGroup, storeFor } from '../store/index.js';
-/** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
-export async function auditList(ctx, opts) {
-    return requireGroup(storeFor(ctx), 'auditLog').listAuditEvents({
-        tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
-    });
-}
-/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
-export function removeAuditErrors(ctx, pass, issues) {
-    const removals = issues
-        .filter((issue) => issue.severity === 'error')
-        .map((issue) => ({ id: issue.memoryId, reason: `${pass}: ${issue.reason}` }));
-    return deleteEntriesAutomatically(ctx.hippoRoot, removals, ctx.actor.subject);
-}
-// SHORTCUT: hippo.db only, as the port has no whole-tenant read, backing-object read or automatic delete with a reason; another store kind
-// answers 501 at the open. Port groups for them once a served store must audit.
-/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
-export function auditMemoryQuality(ctx) {
-    return auditMemories(loadAllEntries(ctx.hippoRoot, ctx.tenantId), memoriesBackingObjects(ctx.hippoRoot));
-}
-/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
-export function repairMemoryQuality(ctx, apply) {
-    return repairAutomaticMemories(ctx.hippoRoot, { tenantId: ctx.tenantId, apply });
-}
-/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
-export function repairMemoryQualityOnce(ctx) {
-    return repairQualityOnce(ctx.hippoRoot, ctx.tenantId);
-}
-/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
-export function computeCutoff(days, now = new Date()) {
-    const cutoff = new Date(now.getTime() - days * DAY_MS);
-    return cutoff.toISOString();
-}
-/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
- *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
- *  Throws on non-positive days or an empty tenant. */
-export function pruneAuditLog(ctx, opts) {
-    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
-        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
-    }
-    if (!ctx.tenantId) {
-        throw new Error('pruneAuditLog: tenantId is required');
-    }
-    const dryRun = opts.dryRun === true;
-    const cutoff = computeCutoff(opts.olderThanDays);
-    const count = pruneAuditRows(ctx.hippoRoot, { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun });
-    return { cutoff, count, dryRun };
-}
-//# sourceMappingURL=audit.js.map

package/dist/api/cards.d.ts

@@ -1,42 +0,0 @@
-import type { Card, CardComment, CardRun, CardStatus } from '../core/card.js';
-import type { HandoffOutcome } from '../core/handoff.js';
-import { type CardDetail } from '../store/card-detail.js';
-import type { Context } from './types.js';
-/** Create a card in the caller's tenant. Throws on an empty title or an unknown dependency. */
-export declare function cardCreate(ctx: Context, input: {
-    title: string;
-    repo?: string;
-    contract?: string;
-    budget?: number;
-    dependsOn?: string[];
-}): Card;
-/** One card by id, or null when the caller's tenant has none. */
-export declare function cardLoad(ctx: Context, id: string): Card | null;
-/** The card with its dependencies, runs, comments and latest handoff, or null when unknown. */
-export declare function cardDetail(ctx: Context, id: string): CardDetail | null;
-/** The caller's cards, newest-updated first, optionally filtered to one status. */
-export declare function cardList(ctx: Context, opts?: {
-    status?: CardStatus;
-}): Card[];
-/** Every run of a card, newest first. */
-export declare function cardRuns(ctx: Context, id: string): CardRun[];
-/** Claim a ready or blocked card for a runtime; null when it cannot be claimed. */
-export declare function cardClaim(ctx: Context, id: string, runtime: string, sessionId?: string): (Card & {
-    runId: number;
-}) | null;
-/** Extend a live run's lease; null when the run is not live. */
-export declare function cardHeartbeat(ctx: Context, id: string, runId: number): Card | null;
-/** Block a running card with a reason; null when it is not running. */
-export declare function cardBlock(ctx: Context, id: string, reason: string, runId?: number): Card | null;
-/** Move a running card to review; null when it is not running. */
-export declare function cardReview(ctx: Context, id: string, runId?: number): Card | null;
-/** Complete a card in review and promote the children it unblocks; null when not in review. */
-export declare function cardComplete(ctx: Context, id: string, outcome: HandoffOutcome, runId?: number): {
-    card: Card;
-    promotedChildren: string[];
-} | null;
-/** Return every card with an expired lease to ready; yields the reclaimed ids. */
-export declare function cardReclaimExpired(ctx: Context): string[];
-/** Add a comment to a card. Throws on an empty body. */
-export declare function cardComment(ctx: Context, cardId: string, author: string, body: string): CardComment;
-//# sourceMappingURL=cards.d.ts.map

package/dist/api/conflicts.d.ts

@@ -1,28 +0,0 @@
-import type { MemoryConflict } from '../store/rows.js';
-import type { CallerProject } from './prompt-hook.js';
-import { type Context } from './types.js';
-import type { TenantReach } from './memories.js';
-export interface ResolveMemoryConflictOpts {
-    /** One of the conflict's two memories; the other is the loser. */
-    keepId: string;
-    /** Delete the loser instead of halving its half-life. */
-    forget?: boolean;
-    /** Tombstone the loser's value as well, which removes it whatever `forget` says. */
-    rejectLoser?: boolean;
-    /** Kept on the tombstone; a conflict-context reason when unset. */
-    reason?: string;
-}
-export interface ResolveMemoryConflictResult {
-    conflictId: number;
-    keptId: string;
-    loserId: string;
-}
-/** Keeps `keepId` and weakens, deletes or rejects the other side of an open conflict in the caller's tenant, auditing as `ctx.actor`.
- *  NotFound: missing, untouchable or no longer live. Conflict: already resolved. BadRequest: `keepId` outside the pair. */
-export declare function resolveMemoryConflict(ctx: Context, conflictId: number, opts: ResolveMemoryConflictOpts): ResolveMemoryConflictResult;
-/** Open conflicts whose two rows the caller may touch; with `project`, only pairs it could also recall:
- *  its repo or user-global, and no scope it was not asked for. */
-export declare function listOpenConflicts(ctx: Context, project?: CallerProject): MemoryConflict[];
-/** Conflicts with `status` ('*' for any) in reach, with no scope filter: the host's own view, so the host admin only. */
-export declare function listConflicts(ctx: Context, status: string, reach?: TenantReach): MemoryConflict[];
-//# sourceMappingURL=conflicts.d.ts.map