rest

type ActivityEvent struct {
	// Actor Who performed the operation: the name of the API key that authenticated the request. Absent for the admin env key, a dev-mode request, or a legacy row predating attribution — actor_kind disambiguates those.
	Actor *string `json:"actor,omitempty"`

	// ActorKind Classifies the actor: "key" (a named API key, actor holds its name), "env" (the admin env key), "none" (an unauthenticated dev-mode request). Absent on a legacy row predating attribution.
	ActorKind *ActivityEventActorKind `json:"actor_kind,omitempty"`

	// Detail Kind-specific context — a recall's degraded mode, a supersession's replacement id.
	Detail *map[string]interface{} `json:"detail,omitempty"`

	// Kind The operation an activity event records. Reads: recall, get, briefing. Writes: remember, update, forget, supersede, pin, unpin, settings. Client telemetry: inject (a POST /v1/activity/injected report).
	Kind EventKind `json:"kind"`

	// Memories Empty for a recall that matched nothing.
	Memories *[]ActivityMemory `json:"memories,omitempty"`

	// Namespace The namespace the request was made against.
	Namespace string `json:"namespace"`
	OpId      string `json:"op_id"`

	// Query The recall query; absent for every other kind.
	Query *string   `json:"query,omitempty"`
	Time  time.Time `json:"time"`
}

type ActivityEventActorKind string

type ActivityMemory struct {
	// Filtered Present when the recall dropped this hit from its response but still logged it — "rank_floor" when the per-call min_rank_score composite floor cut it. Absent on a served hit. Lets the feed dim what was filtered instead of hiding it; recall only.
	Filtered *ActivityMemoryFiltered `json:"filtered,omitempty"`
	Id       string                  `json:"id"`

	// Injected The served→injected join's verdict, on a recall event's memories: true when a client injection-telemetry report (POST /v1/activity/injected) named this memory as actually reaching model context, false when a report covered the recall but omitted it (the client suppressed it). ABSENT when no report covered the serve — absent means unknown, so old data and non-reporting integrations render unchanged; only a report ever yields false.
	Injected *bool `json:"injected,omitempty"`

	// Namespace The memory's own namespace, which for a cascading recall may differ from the event's.
	Namespace string `json:"namespace"`

	// Rank 1-based position the memory was served at; absent when not applicable.
	Rank *int `json:"rank,omitempty"`

	// Score Composite relevance score it was served with; recall only.
	Score *float64 `json:"score,omitempty"`

	// Section Which briefing section it appeared under; briefing only.
	Section *string `json:"section,omitempty"`
	Summary string  `json:"summary"`
	Tier    Tier    `json:"tier"`
}

type ActivityMemoryFiltered string

type ActivityResponse struct {
	Events  []ActivityEvent `json:"events"`
	HasMore bool            `json:"has_more"`

	// NextCursor Pass as "before" to fetch the next page; absent on the last page.
	NextCursor *string `json:"next_cursor,omitempty"`
}

type AnswerQuestionJSONRequestBody = AnswerRequest

type AnswerQuestionParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type AnswerRequest struct {
	Levels *[]Level `json:"levels,omitempty"`

	// Limit Caps how many recalled memories ground the answer.
	Limit *int `json:"limit,omitempty"`

	// Metadata Ground only on memories whose top-level metadata contains every listed key=value pair (AND).
	Metadata *map[string]string `json:"metadata,omitempty"`
	Query    string             `json:"query"`

	// Scope Selects the grounding read set shape, same vocabulary as the recall `scope`: "full" (default) grounds on the request namespace plus its ancestor/home/link cascade; "project" grounds on the request namespace only (no cascade); "everywhere" is "full" plus the request namespace's subtree. "exact" and "subtree" are deprecated aliases ("exact" → "project", "subtree" → "everywhere"). Any other value is rejected with 400. Reaches parity with the MCP `memory_answer` tool's `scope` argument.
	Scope *AnswerRequestScope `json:"scope,omitempty"`

	// Tags Ground only on memories carrying every listed tag (AND).
	Tags  *[]string `json:"tags,omitempty"`
	Tiers *[]Tier   `json:"tiers,omitempty"`
}

type AnswerRequestScope string

type AnswerResponse struct {
	Answer  string         `json:"answer"`
	Sources []ScoredMemory `json:"sources"`
}

type ApiKey struct {
	// Admin Whether this key is an admin credential: it may reach the admin-gated surfaces (/v1/keys CRUD and /v1/settings/defaults), exactly like the admin env key (MEMINI_API_KEY). A self-guard still applies — an admin key cannot demote, disable, or delete itself over this API.
	Admin bool `json:"admin"`

	// CreatedAt Omitted for a source=file key: MEMINI_API_KEYS_FILE entries carry no creation timestamp (the file is the source of truth, not a database row) — always present for source=db.
	CreatedAt *time.Time `json:"created_at,omitempty"`

	// DefaultNamespace Namespace applied when a request presents this key with no explicit X-Memini-Namespace header.
	DefaultNamespace *string `json:"default_namespace,omitempty"`
	Disabled         bool    `json:"disabled"`

	// Home Bound home namespace; omitted/empty means unbound.
	Home *string `json:"home,omitempty"`
	Name string  `json:"name"`

	// ReadOnly Whether this key is a read-only credential: it may issue reads (GET/HEAD, plus the read-shaped POSTs /v1/search, /v1/answer and /v1/handshake) and every mutating request is refused with 403, across both the REST and MCP surfaces. Independent of admin — an admin key that is also read_only may enumerate keys but not change them. Note this bounds what the key may CHANGE, not what it may SEE: a read-only key can still name any namespace and read it.
	ReadOnly bool `json:"read_only"`

	// Settings Per-key behavioral settings override; fields left unset inherit the server's global defaults.
	Settings *ClientSettings `json:"settings,omitempty"`

	// Source Where the key is stored: "db" is a row in the api_keys table (mutable via this API); "file" comes from MEMINI_API_KEYS_FILE, loaded once at boot and immutable through this API — update/rotate/ delete all reject a "file" key with 409.
	Source ApiKeySource `json:"source"`
}

type ApiKeySource string

type ApiKeyWithSecret struct {
	// Admin Whether this key is an admin credential: it may reach the admin-gated surfaces (/v1/keys CRUD and /v1/settings/defaults), exactly like the admin env key (MEMINI_API_KEY). A self-guard still applies — an admin key cannot demote, disable, or delete itself over this API.
	Admin bool `json:"admin"`

	// CreatedAt Omitted for a source=file key: MEMINI_API_KEYS_FILE entries carry no creation timestamp (the file is the source of truth, not a database row) — always present for source=db.
	CreatedAt *time.Time `json:"created_at,omitempty"`

	// DefaultNamespace Namespace applied when a request presents this key with no explicit X-Memini-Namespace header.
	DefaultNamespace *string `json:"default_namespace,omitempty"`
	Disabled         bool    `json:"disabled"`

	// Home Bound home namespace; omitted/empty means unbound.
	Home *string `json:"home,omitempty"`
	Name string  `json:"name"`

	// ReadOnly Whether this key is a read-only credential: it may issue reads (GET/HEAD, plus the read-shaped POSTs /v1/search, /v1/answer and /v1/handshake) and every mutating request is refused with 403, across both the REST and MCP surfaces. Independent of admin — an admin key that is also read_only may enumerate keys but not change them. Note this bounds what the key may CHANGE, not what it may SEE: a read-only key can still name any namespace and read it.
	ReadOnly bool `json:"read_only"`

	// Secret The plaintext credential, shown exactly once, here — it is never stored (only its SHA-256 hash is) and cannot be recovered or displayed again.
	Secret string `json:"secret"`

	// Settings Per-key behavioral settings override; fields left unset inherit the server's global defaults.
	Settings *ClientSettings `json:"settings,omitempty"`

	// Source Where the key is stored: "db" is a row in the api_keys table (mutable via this API); "file" comes from MEMINI_API_KEYS_FILE, loaded once at boot and immutable through this API — update/rotate/ delete all reject a "file" key with 409.
	Source ApiKeySource `json:"source"`
}

type ApiKeysResponse struct {
	Keys []ApiKey `json:"keys"`
}

type AuthConfig struct {
	// APIKey, when non-empty, is required as "Authorization: Bearer <key>".
	APIKey string
	// APIKeyStore, when non-nil, enables table-key auth alongside (or instead
	// of) APIKey: a bearer that doesn't match APIKey is looked up by hex
	// SHA-256 hash. nil means the backing store predates APIKeyStore, or the
	// feature is simply unused — see apiauth.Config.Authenticate for the full
	// enforcement rules, including when table auth becomes mandatory.
	APIKeyStore store.APIKeyStore
	// FileKeys, when non-nil, enables the declarative MEMINI_API_KEYS_FILE
	// keys (K2b) alongside APIKey/APIKeyStore: checked after APIKey and
	// before APIKeyStore — see apiauth.Config.Authenticate. nil (the default)
	// means the feature is unused, matching a server built before it existed.
	FileKeys *apiauth.FileKeySet
	// NamespaceHeader names the request header carrying the per-request namespace.
	NamespaceHeader string
	// DefaultNamespace is used when the header is absent and the
	// authenticated key (if any) carries no per-key default either.
	DefaultNamespace string
	// HomeHeader names the request header carrying the caller's personal
	// namespace (see service.RecallInput.Home). Unlike NamespaceHeader there
	// is no default: an absent or empty header means no home leg for the
	// request. Ignored outright for a key bound to a home namespace — see
	// homeMiddleware's doc for the deliberate asymmetry with namespace
	// resolution below.
	HomeHeader string
	// RequestTimeout bounds how long a single /v1 request may run
	// (chi/middleware.Timeout, applied only to the /v1 group Mount attaches —
	// never to /mcp, /healthz, /readyz, or /metrics). It cancels the request
	// context once the timeout elapses; handlers that don't observe
	// ctx.Done() are not forcibly aborted, they just run to completion as
	// before (see chi's Timeout doc comment). 0 disables it.
	RequestTimeout time.Duration

	// ClientDefaults, when non-nil, is the env-managed global-defaults
	// ClientSettings layer (config.Config.ClientDefaults, from
	// MEMINI_CLIENT_DEFAULTS). When set it IS the server's global-defaults
	// layer for the config-handshake surface: /v1/handshake and /v1/self
	// resolve through it, GET /v1/settings/defaults reports managed_by=env, and
	// PUT /v1/settings/defaults is refused with 409 — the KV-backed global
	// layer is never consulted. nil (the default) leaves the KV store as the
	// global-defaults layer, unchanged.
	ClientDefaults *store.ClientSettings

	// KeyAuth, when non-nil, is used verbatim as the auth policy instead of
	// New building one from APIKey/APIKeyStore/FileKeys. Set this to share
	// ONE apiauth.Config (and its cache pointer) with another surface mounted
	// in the same process — e.g. MCP's HTTPHandlerWithAuth — so a cache
	// invalidation from a key mutation here (see apikeys.go's Invalidate
	// calls) reaches that surface immediately instead of leaving it to ride
	// out apiauth's table-emptiness cache TTL. nil (the default) preserves
	// pre-existing behavior for callers that don't share a Config.
	KeyAuth *apiauth.Config
	// contains filtered or unexported fields
}

type Briefing struct {
	// Children Direct-child namespace rollups (one segment deeper than the briefed namespace), each aggregating its whole subtree: all-tier live total plus up to 3 pinned and 3 recent-durable highlight memories. Ordered by most-recent write, capped at 10 children; omitted at a leaf namespace.
	Children *[]BriefingChild `json:"children,omitempty"`

	// Degraded Read-set namespaces that could not be loaded and were skipped, so a caller can distinguish an empty section from an unreachable one. The briefed namespace itself never appears here: losing it fails the request rather than degrading it. Omitted on a healthy briefing.
	Degraded *[]string `json:"degraded,omitempty"`

	// Facts Durable semantic facts, highest-retention first.
	Facts *[]BriefingItem `json:"facts,omitempty"`

	// Handoffs The session handoff waiting in each slot of the briefed namespace, one entry per slot, ordered by slot name. A pointer only — never the prompt text, which runs to hundreds of lines and is fetched on demand with GET /v1/memories/{id}. Drawn from the briefed namespace alone, never the ancestor/link cascade: a handoff says where THIS project's work stands. Exempt from the `max_tokens` budget, which never drops a pointer. Omitted when no slot holds one.
	Handoffs  *[]HandoffPointer `json:"handoffs,omitempty"`
	Namespace string            `json:"namespace"`

	// Omitted Total items dropped across the four sections by the request's `max_tokens` budget. Absent — never an explicit 0 — when no budget was set or everything fit.
	Omitted *int `json:"omitted,omitempty"`

	// Pinned Pinned memories (any tier).
	Pinned *[]BriefingItem `json:"pinned,omitempty"`

	// Procedures Procedural how-to memories, highest-retention first.
	Procedures *[]BriefingItem `json:"procedures,omitempty"`

	// Recent Recent episodic activity, newest first.
	Recent *[]BriefingItem `json:"recent,omitempty"`

	// ScopeHeader A human-readable one-line summary of which namespaces this briefing drew from (its resolved read set scope), e.g. "Scope: acme/phoenix/api ← acme/phoenix(3) ← acme(4) ← personal(2), +1 link" — primary first, then each cascade leg that contributed durable memories (nearest ancestor first, home last, counts per leg), then a "+K link(s)" suffix for contributing links.
	ScopeHeader *string `json:"scope_header,omitempty"`
}

type BriefingChild struct {
	Namespace string `json:"namespace"`

	// Pinned Full pinned highlight memories; only with children=full (the default).
	Pinned *[]Memory `json:"pinned,omitempty"`

	// PinnedTitles Compact display titles (summary, else a ≤60-rune boundary cut of content) of the pinned highlights; only with children=summary, which ships titles/counts and no memory objects.
	PinnedTitles *[]string `json:"pinned_titles,omitempty"`

	// Recent Full recent-durable highlight memories; only with children=full (the default).
	Recent *[]Memory `json:"recent,omitempty"`

	// RecentTitles Compact display titles of the recent-durable highlights; only with children=summary.
	RecentTitles *[]string `json:"recent_titles,omitempty"`

	// Total Live memory count in this child namespace.
	Total int `json:"total"`
}

type BriefingItem struct {
	// From Read-set provenance beyond memory.namespace — same semantics as ScoredMemory.from (see there). Omitted for a primary-namespace item.
	From   *string `json:"from,omitempty"`
	Memory Memory  `json:"memory"`
}

type CallerIdentity struct {
	// Admin Effective admin capability: true for the admin env key, dev mode with no auth configured, and a named key with admin=true. When true the caller may reach the admin-gated surfaces (/v1/keys CRUD and /v1/settings/defaults); when false those return 403.
	Admin         bool `json:"admin"`
	Authenticated bool `json:"authenticated"`

	// DefaultNamespace The key's bound default namespace, if any.
	DefaultNamespace *string `json:"default_namespace,omitempty"`

	// Home The key's bound home namespace, if any.
	Home *string `json:"home,omitempty"`

	// KeyName Name of the API key that authenticated the request; absent for the admin key or dev mode (no named principal).
	KeyName *string `json:"key_name,omitempty"`

	// ReadOnly Effective read-only capability: true only for a named key with read_only=true. False for the admin env key and dev mode, which authenticate with no named principal and so carry no capability bits. When true, every mutating request is refused with 403 — clients should skip writes rather than attempt and log them.
	ReadOnly bool `json:"read_only"`
}

type ChiServerOptions struct {
	BaseURL          string
	BaseRouter       chi.Router
	Middlewares      []MiddlewareFunc
	ErrorHandlerFunc func(w http.ResponseWriter, r *http.Request, err error)
}

type ClientSettings struct {
	// AutoSave Periodically nudge the agent to persist durable memories.
	AutoSave *bool `json:"auto_save,omitempty"`

	// AutoSaveInterval User-message interval between auto-save nudges.
	AutoSaveInterval *int `json:"auto_save_interval,omitempty"`

	// AutoSaveMinEvents Minimum buffered state-changing tool events since the last auto-save baseline for the interval nudge to fire; below this the nudge defers, then fires as a discussion-variant prompt at twice the interval. 0 disables the activity gate (interval-only cadence).
	AutoSaveMinEvents *int `json:"auto_save_min_events,omitempty"`

	// Capture Enable capture (turns/digests) at all.
	Capture *bool `json:"capture,omitempty"`

	// CaptureAssistantMaxChars Truncate the assistant side of a captured turn to this many characters, marked like capture_user_max_chars. Larger than the user side because the answer usually carries the durable content. 0 captures the assistant text whole.
	CaptureAssistantMaxChars *int `json:"capture_assistant_max_chars,omitempty"`

	// CaptureTurns Capture each user→assistant turn as episodic memory.
	CaptureTurns *bool `json:"capture_turns,omitempty"`

	// CaptureUserMaxChars Truncate the user side of a captured turn to this many characters. The cut is marked with "[...truncated]" so a later reader can tell a fragment from a whole turn. 0 captures the user text whole — the server still applies its own limits, and a very long turn costs episodic storage and recall context.
	CaptureUserMaxChars *int `json:"capture_user_max_chars,omitempty"`

	// InjectBriefingFacts Max durable semantic facts in the session-start briefing.
	InjectBriefingFacts *int `json:"inject_briefing_facts,omitempty"`

	// InjectBriefingMaxTok Hard ceiling on briefing injection tokens; 0 is uncapped. Sent to the server as the briefing's max_tokens (server-enforced budget) and kept as the client-side fallback trim for old servers.
	InjectBriefingMaxTok *int `json:"inject_briefing_max_tok,omitempty"`

	// InjectBriefingPinned Max pinned memories in the session-start briefing.
	InjectBriefingPinned *int `json:"inject_briefing_pinned,omitempty"`

	// InjectBriefingProcedures Max procedural how-tos in the session-start briefing.
	InjectBriefingProcedures *int `json:"inject_briefing_procedures,omitempty"`

	// InjectBriefingRecent Max recent episodic entries in the session-start briefing.
	InjectBriefingRecent *int `json:"inject_briefing_recent,omitempty"`

	// InjectCooldownMs Time window (milliseconds) within which an already-injected memory is not re-injected; 0 disables the time dimension.
	InjectCooldownMs *int `json:"inject_cooldown_ms,omitempty"`

	// InjectCooldownPrompts Prompt-count window within which an already-injected memory is not re-injected; 0 disables the prompt dimension.
	InjectCooldownPrompts *int `json:"inject_cooldown_prompts,omitempty"`

	// InjectDedupe Suppress re-injecting a recalled memory that is still within its injection cooldown window (inject_cooldown_ms / inject_cooldown_prompts); with both windows 0, an unchanged memory stays suppressed for the rest of the session. This gates the injection; whether the PreToolUse recall call runs at all follows inject_pretool_gate_ms, but turning inject_dedupe off also disables that call gate, because the gate's clock lives in the dedupe state.
	InjectDedupe *bool `json:"inject_dedupe,omitempty"`

	// InjectLabels Which annotation labels to render alongside an injected memory.
	InjectLabels *[]ClientSettingsInjectLabels `json:"inject_labels,omitempty"`

	// InjectPretoolGateMs Skip the PreToolUse recall server call entirely for a file whose last call was younger than this many milliseconds. 0 always calls.
	InjectPretoolGateMs *int `json:"inject_pretool_gate_ms,omitempty"`

	// InjectPretoolItems Max recalled items injected per file on PreToolUse.
	InjectPretoolItems *int `json:"inject_pretool_items,omitempty"`

	// InjectPretoolMaxTok Hard ceiling on per-tool injection tokens; 0 is uncapped. Sent to the server as each per-file search's max_tokens (server-enforced budget) and kept as the client-side fallback trim for old servers.
	InjectPretoolMaxTok *int `json:"inject_pretool_max_tok,omitempty"`

	// InjectPretoolMinScore Floor on the composite post-rerank score — the final [0,1) scale the response score field and the activity feed show — for a PreToolUse injection. All bundled integrations enforce it server-side via min_rank_score (floored hits appear in the feed marked as filtered); a custom or older caller may still apply it as a pre-rank fused-score floor. 0 disables the floor.
	InjectPretoolMinScore *float32 `json:"inject_pretool_min_score,omitempty"`

	// InjectPretoolTools Tool-name allowlist that triggers a PreToolUse injection. Glob and Grep are deliberately not in the default: pattern-derived queries ("Grep on <pattern>") are near-zero-signal and each ungated call costs a server embed+rerank — list them here to restore the old behavior.
	InjectPretoolTools *[]string `json:"inject_pretool_tools,omitempty"`

	// InjectRecallMaxTok Hard ceiling on recall injection tokens; 0 is uncapped. Sent to the server as the prompt search's max_tokens (server-enforced budget) and kept as the client-side fallback trim for old servers.
	InjectRecallMaxTok *int `json:"inject_recall_max_tok,omitempty"`

	// InjectRecallMinScore Floor on the composite post-rerank score — the final [0,1) scale the response score field and the activity feed show — for a recall injection. All bundled integrations enforce it server-side via min_rank_score (floored hits appear in the feed marked as filtered); a custom or older caller may still apply it as a pre-rank fused-score floor. 0 disables the floor.
	InjectRecallMinScore *float32 `json:"inject_recall_min_score,omitempty"`

	// InjectTelemetry Report what each hook actually injected vs suppressed back to the server (POST /v1/activity/injected) so the activity feed and metrics reflect what reached model context instead of pre-suppression serves. Best-effort and bounded (the beacon never blocks or fails a hook); off disables reporting entirely.
	InjectTelemetry *bool `json:"inject_telemetry,omitempty"`

	// InlineExtract Inject the directive asking the agent to save durable facts via memory_remember.
	InlineExtract *bool `json:"inline_extract,omitempty"`

	// MinCaptureChars Minimum content length worth bothering to capture a turn.
	MinCaptureChars *int `json:"min_capture_chars,omitempty"`

	// NamespacePrefix Namespace path prepended ahead of the derived/declared namespace.
	NamespacePrefix *string `json:"namespace_prefix,omitempty"`

	// NamespaceScope "repo" derives the namespace from the bare repo name; "owner_repo" disambiguates same-named repos across owners with an owner-repo slug (owner + "-" + repo).
	NamespaceScope *ClientSettingsNamespaceScope `json:"namespace_scope,omitempty"`

	// Recall Enable recall-driven injection at all.
	Recall *bool `json:"recall,omitempty"`

	// RecallLimit Max memories per recall call.
	RecallLimit *int `json:"recall_limit,omitempty"`

	// RequestTimeoutMs How long a client waits on one memini HTTP call before giving up (MEMINI_TIMEOUT_MS locally). It must stay above the server's own MEMINI_RERANK_TIMEOUT (default 10s): the server bounds a slow reranker and degrades to composite order, but a client that hangs up first gets nothing at all instead of an unranked result. Raise it when a cross-encoder reranker, a deep MEMINI_RERANK_POOL, or a cold model pushes recall past the default. The handshake keeps its own short timeout and is not covered by this setting.
	RequestTimeoutMs *int `json:"request_timeout_ms,omitempty"`

	// SessionDigest Record a session-end/stop/pre-compact digest memory.
	SessionDigest *bool `json:"session_digest,omitempty"`
}

type ClientSettingsInjectLabels string

type ClientSettingsNamespaceScope string

type ClusterAction struct {
	RepresentativeId string   `json:"representative_id"`
	Size             int      `json:"size"`
	TombstonedIds    []string `json:"tombstoned_ids"`
}

type CreateApiKeyJSONRequestBody = CreateApiKeyRequest

type CreateApiKeyRequest struct {
	// Admin Create the key as an admin credential (see ApiKey.admin). Defaults to false — a plain key that cannot reach the admin-gated surfaces.
	Admin *bool `json:"admin,omitempty"`

	// DefaultNamespace Namespace applied when a request presents this key with no explicit namespace header.
	DefaultNamespace *string `json:"default_namespace,omitempty"`

	// Disabled Create the key already disabled.
	Disabled *bool `json:"disabled,omitempty"`

	// Home Bind the key to a home namespace.
	Home *string `json:"home,omitempty"`
	Name string  `json:"name"`

	// ReadOnly Create the key as a read-only credential (see ApiKey.read_only). Defaults to false — a key that may write.
	ReadOnly *bool `json:"read_only,omitempty"`
}

type DedupReport struct {
	// Actions Per-cluster representative selection. Omitted when no clusters were found.
	Actions       *[]ClusterAction `json:"actions,omitempty"`
	ClustersFound int              `json:"clusters_found"`
	DryRun        bool             `json:"dry_run"`
	MemoriesSeen  int              `json:"memories_seen"`
	Namespaces    int              `json:"namespaces"`
	Tombstoned    int              `json:"tombstoned"`
}

type DedupRequest struct {
	// AllNamespaces Run the pass over every namespace instead of just the request's
	// namespace. Defaults to false (scope to the request namespace).
	AllNamespaces *bool `json:"all_namespaces,omitempty"`

	// DryRun Report what would happen without tombstoning anything.
	DryRun *bool `json:"dry_run,omitempty"`

	// MinClusterSize Smallest cluster acted on. 0 falls back to 2.
	MinClusterSize *int `json:"min_cluster_size,omitempty"`

	// NeighboursPerAnchor Per-anchor vector-search fan-out. 0 falls back to 20.
	NeighboursPerAnchor *int `json:"neighbours_per_anchor,omitempty"`

	// Similarity Cosine-like threshold for cluster membership. Higher = stricter
	// (fewer, tighter clusters). 0 falls back to 0.85.
	Similarity *float64 `json:"similarity,omitempty"`

	// Tiers Restrict the pass to these tiers; empty means all.
	Tiers *[]Tier `json:"tiers,omitempty"`
}

type DeleteByTagResponse struct {
	// Deleted Number of memories deleted
	Deleted int `json:"deleted"`
}

type DeleteLinkJSONBody struct {
	// Dst Target namespace to unlink.
	Dst *string `json:"dst,omitempty"`
}

type DeleteLinkJSONRequestBody DeleteLinkJSONBody

type DeleteLinkParams struct {
	// Dst Target namespace to unlink. Required, via query or JSON body.
	Dst *string `form:"dst,omitempty" json:"dst,omitempty"`

	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type DeleteNamespaceParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type DeleteNamespaceResponse struct {
	// Deleted Number of memories deleted
	Deleted int `json:"deleted"`
}

type DeletePinJSONRequestBody = PinDeleteRequest

type Error struct {
	Error *string `json:"error,omitempty"`
}

type EventKind string

type ForgetByTagParams struct {
	// Tag Exact tag a memory must carry to be deleted.
	Tag string `form:"tag" json:"tag"`

	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type ForgetMemoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type FsckReport struct {
	DuplicateGroups  *[][]string `json:"duplicate_groups,omitempty"`
	ExpiredPurged    int         `json:"expired_purged"`
	Namespaces       int         `json:"namespaces"`
	ShortTermEvicted int         `json:"short_term_evicted"`
}

type GetBriefingParams struct {
	// PerSection Default cap applied to every section when its dedicated cap is unset. Default 5.
	PerSection *int `form:"per_section,omitempty" json:"per_section,omitempty"`

	// PerSectionPinned Max pinned memories. Overrides per_section. 0 disables the section.
	PerSectionPinned *int `form:"per_section_pinned,omitempty" json:"per_section_pinned,omitempty"`

	// PerSectionFacts Max durable semantic facts. Overrides per_section. 0 disables the section.
	PerSectionFacts *int `form:"per_section_facts,omitempty" json:"per_section_facts,omitempty"`

	// PerSectionProcedures Max procedural how-to memories. Overrides per_section. 0 disables the section.
	PerSectionProcedures *int `form:"per_section_procedures,omitempty" json:"per_section_procedures,omitempty"`

	// PerSectionRecent Max recent episodic entries. Overrides per_section. 0 disables the section.
	PerSectionRecent *int `form:"per_section_recent,omitempty" json:"per_section_recent,omitempty"`

	// Scope "full" (default) briefs the namespace plus its ancestor/home/link cascade; "project" briefs only the namespace (no cascade); "everywhere" is "full" plus namespaces nested under it ("project" also reads "project/agent"). "exact" and "subtree" are deprecated aliases kept for back-compat: "exact" behaves as "project" (its original, pre-cascade meaning) and "subtree" behaves as "everywhere". Any other value is rejected with 400.
	Scope *GetBriefingParamsScope `form:"scope,omitempty" json:"scope,omitempty"`

	// Namespaces Repeatable. Brief exactly these namespaces instead of the default read set (the namespace, its subtree, and the global namespace). An entry ending in "/*" also includes namespaces nested under it. Writes are unaffected.
	Namespaces *[]string `form:"namespaces,omitempty" json:"namespaces,omitempty"`

	// Format "detailed" (default) carries each item's full stored content. "concise" replaces each item's memory.content with its compact form — the summary when one exists, else the content cut at a word/sentence boundary to at most 280 runes (the client's briefing render cap) with a "…" suffix — and sets memory.content_truncated on items whose concise text is such a cut. Section selection and ordering are identical across formats, and memory.content_hash is always computed over the full stored content.
	Format *GetBriefingParamsFormat `form:"format,omitempty" json:"format,omitempty"`

	// Children How to render the direct-child rollup: "full" (default) carries complete memory objects per child (the admin UI consumes these); "summary" ships titles/counts only per child — namespace, total, and compact pinned/recent title lines (pinned_titles/ recent_titles), the same isolation surface the MCP briefing renders; "none" omits the rollup entirely.
	Children *GetBriefingParamsChildren `form:"children,omitempty" json:"children,omitempty"`

	// MaxTokens Server-enforced token budget across the whole briefing, filled in section order pinned → facts → procedures → recent — fill order IS priority order, so pinned fills first and recent starves first. Whole tail items are dropped, never split, and the total drop count lands in the response's `omitted`. The estimate is the same recipe as search's max_tokens (word-count over the shipped content — the concise text under format=concise — plus a 10-token per-item overhead), and the first item overall always ships. The child rollup is neither counted nor trimmed. 0 (or absent) is unbounded.
	MaxTokens *int `form:"max_tokens,omitempty" json:"max_tokens,omitempty"`

	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type GetBriefingParamsChildren string

type GetBriefingParamsFormat string

type GetBriefingParamsScope string

type GetMemoryHistoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type GetMemoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type GetReadSetParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type GetStatsParams struct {
	// AllNamespaces Aggregate counts across every namespace, ignoring the namespace header. Returns a single merged overview (namespace reported as "") so the admin UI's "All namespaces" view fetches one response instead of one request per namespace.
	AllNamespaces *bool `form:"all_namespaces,omitempty" json:"all_namespaces,omitempty"`

	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type HandoffPointer struct {
	// ConsumedAt When some session last resumed this handoff, if any — RFC3339 by convention, but passed through verbatim as the resuming client stamped it rather than parsed, so a malformed value is visible instead of silently dropped. A resumed handoff stays listed: it is still the truth about where the work stands, and hiding it would strand a session interrupted mid-resume.
	ConsumedAt *string `json:"consumed_at,omitempty"`

	// ConsumedBy Which session or harness resumed it.
	ConsumedBy *string   `json:"consumed_by,omitempty"`
	CreatedAt  time.Time `json:"created_at"`

	// Harness The agent harness that wrote the prompt (e.g. "claude-code", "cursor"), so a session in a different harness knows before fetching that parts of the prompt may name tools it lacks.
	Harness *string `json:"harness,omitempty"`

	// Id The handoff memory's id; fetch the prompt with GET /v1/memories/{id}.
	Id string `json:"id"`

	// Lines The prompt's line count as its writer measured it, so a reader can judge the context cost of pulling it in.
	Lines *int `json:"lines,omitempty"`

	// Slot The slot this handoff occupies ("main" unless the writer named one). One live handoff per slot: a new write to a slot supersedes its predecessor, which stays readable through the memory's history. Separate slots let parallel lines of work (a worktree, a feature branch) each carry their own handoff in one namespace.
	Slot string `json:"slot"`

	// Summary The prompt's one-line summary, typically its title line.
	Summary *string `json:"summary,omitempty"`
}

type HandshakeJSONRequestBody = HandshakeRequest

type HandshakeRequest struct {
	// Client Caller identification, for logging/diagnostics only.
	Client *struct {
		Name    *string `json:"name,omitempty"`
		Version *string `json:"version,omitempty"`
	} `json:"client,omitempty"`
	Project struct {
		// Agent Per-agent suffix (e.g. "reviewer"), sanitized and appended as a nested namespace segment.
		Agent *string `json:"agent,omitempty"`

		// CwdBasename Basename of the working directory — the last-resort derivation fallback, always present.
		CwdBasename string `json:"cwd_basename"`

		// DeclaredNamespace For gateway/integration callers with no meaningful cwd (a webhook relay, a CI job) to declare their namespace directly. Wins over derivation but not over a pin or env_namespace.
		DeclaredNamespace *string `json:"declared_namespace,omitempty"`

		// EnvNamespace The client's MEMINI_NAMESPACE, when set. Sent so a pin can still beat it server-side — the client cannot make that call itself without knowing whether a pin exists.
		EnvNamespace *string `json:"env_namespace,omitempty"`

		// EnvNamespacePrefix The client's MEMINI_NAMESPACE_PREFIX, when set. A client-side override of the namespace_prefix behavioral setting: it is prepended to the derived name (personal/<repo>) exactly as the setting would be, but wins over the server-merged setting the same way any client env override does. Lets one credential serve several namespace trees selected per shell/directory (e.g. a per-tree .envrc) without a pin or a second key.
		EnvNamespacePrefix *string `json:"env_namespace_prefix,omitempty"`

		// RemoteUrl Raw git remote URL, exactly as `git remote get-url origin` reports it — unnormalized.
		RemoteUrl *string `json:"remote_url,omitempty"`

		// ToplevelBasename Basename of toplevel_path, for the toplevel fallback derivation.
		ToplevelBasename *string `json:"toplevel_basename,omitempty"`

		// ToplevelPath Absolute git toplevel directory — the machine-local pin key (path:<toplevel_path>).
		ToplevelPath *string `json:"toplevel_path,omitempty"`
	} `json:"project"`
}

type HandshakeResponse struct {
	// Identity Who the request authenticated as, independent of any resolved namespace.
	Identity CallerIdentity `json:"identity"`

	// Namespace The resolved namespace this caller should use for every subsequent request.
	Namespace string `json:"namespace"`

	// NamespaceSource Which rule resolved `namespace`, highest precedence first.
	NamespaceSource HandshakeResponseNamespaceSource `json:"namespace_source"`

	// Pin Present only when namespace_source is "pin".
	Pin *struct {
		// CreatedBy Name of the API key that created the pin, when known — same semantics as Pin.created_by (absent for a pin created by the admin key or in dev mode, which carry no named principal).
		CreatedBy *string `json:"created_by,omitempty"`

		// Key The pin key that matched (remote:<canonical-remote> or path:<toplevel_path>).
		Key       string    `json:"key"`
		Note      *string   `json:"note,omitempty"`
		UpdatedAt time.Time `json:"updated_at"`
	} `json:"pin,omitempty"`

	// ReadSet The read set `namespace` resolves to (same shape as GET /v1/namespaces/readset).
	ReadSet []ReadSetEntryItem `json:"read_set"`
	Server  struct {
		DefaultNamespace string `json:"default_namespace"`
		Version          string `json:"version"`
	} `json:"server"`

	// Settings Fully resolved — every field present.
	Settings ClientSettings `json:"settings"`

	// SettingsSources Per-field provenance for `settings`, keyed by the same field names.
	SettingsSources map[string]HandshakeResponseSettingsSources `json:"settings_sources"`
}

type HandshakeResponseNamespaceSource string

type HandshakeResponseSettingsSources string

type InjectedReport struct {
	// InjectedChars Characters actually injected.
	InjectedChars *int `json:"injected_chars,omitempty"`

	// InjectedIds Memory ids actually injected, in injection order. May be empty — a suppression-only report still records.
	InjectedIds *[]string `json:"injected_ids,omitempty"`

	// InjectedTokensEst Client-side estimate of the tokens the injections consumed.
	InjectedTokensEst *int `json:"injected_tokens_est,omitempty"`

	// SessionId The client session the injection happened in.
	SessionId *string `json:"session_id,omitempty"`

	// Source Free-form client name (e.g. "claude-code").
	Source *string `json:"source,omitempty"`

	// Suppressed Per-reason counts of served memories the client's local gates held back from injection. Omitted reasons mean "none reported".
	Suppressed *InjectedSuppressed `json:"suppressed,omitempty"`

	// Surface Which hook surface is reporting.
	Surface InjectedReportSurface `json:"surface"`
}

type InjectedReportSurface string

type InjectedSuppressed struct {
	// Budget Over the token/char budget for the surface.
	Budget *int `json:"budget,omitempty"`

	// Cooldown Inside the injection cooldown window.
	Cooldown *int `json:"cooldown,omitempty"`

	// Score Below the client's score floor.
	Score *int `json:"score,omitempty"`

	// Seen Already injected this session (dedupe).
	Seen *int `json:"seen,omitempty"`

	// Unchanged Byte-identical to what was already injected.
	Unchanged *int `json:"unchanged,omitempty"`
}

type InvalidParamFormatError struct {
	ParamName string
	Err       error
}

type Level string

type ListActivityParams struct {
	// Kind Repeatable and/or comma-separated event-kind filter; omitted means all kinds.
	Kind *[]EventKind `form:"kind,omitempty" json:"kind,omitempty"`

	// Tier Repeatable and/or comma-separated tier filter. Selects whole operations that touched a memory of a listed tier — a matching event is returned with every memory it served, so its counts stay truthful.
	Tier *[]Tier `form:"tier,omitempty" json:"tier,omitempty"`

	// Q Free-text filter, case-insensitive. Selects whole operations whose recall query or any served memory's summary contains it.
	Q *string `form:"q,omitempty" json:"q,omitempty"`

	// Actor Restrict to events performed by this API key (exact name match). The admin env key and dev-mode requests carry no name, so they are never selected by this filter.
	Actor *string `form:"actor,omitempty" json:"actor,omitempty"`

	// Since Only events recorded at or after this instant.
	Since *time.Time `form:"since,omitempty" json:"since,omitempty"`

	// Namespace With all_namespaces=true, restrict the feed to these namespaces (repeatable, exact match); ignored otherwise.
	Namespace *[]string `form:"namespace,omitempty" json:"namespace,omitempty"`

	// Limit Caps the returned events (operations, not rows). Default 50, max 200.
	Limit *int `form:"limit,omitempty" json:"limit,omitempty"`

	// Before Opaque cursor from a previous response's next_cursor; returns the page of events strictly older than it.
	Before *string `form:"before,omitempty" json:"before,omitempty"`

	// AllNamespaces Aggregate across every namespace, ignoring the namespace header.
	AllNamespaces *bool `form:"all_namespaces,omitempty" json:"all_namespaces,omitempty"`

	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type ListLinksParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type ListMemoriesParams struct {
	// Tier Repeatable and/or comma-separated tier filter; omitted means all tiers.
	Tier *[]Tier `form:"tier,omitempty" json:"tier,omitempty"`

	// Level Repeatable and/or comma-separated level filter; omitted means all levels.
	Level *[]Level `form:"level,omitempty" json:"level,omitempty"`

	// Tag Repeatable and/or comma-separated tag filter; a memory must carry every listed tag (AND).
	Tag *[]string `form:"tag,omitempty" json:"tag,omitempty"`

	// Meta Repeatable metadata filter in "key=value" form; a memory's top-level metadata must contain every listed pair (AND). Only string values match.
	Meta              *[]string `form:"meta,omitempty" json:"meta,omitempty"`
	IncludeExpired    *bool     `form:"include_expired,omitempty" json:"include_expired,omitempty"`
	IncludeSuperseded *bool     `form:"include_superseded,omitempty" json:"include_superseded,omitempty"`

	// Limit Caps the result count; 0 or absent returns all matches.
	Limit *int `form:"limit,omitempty" json:"limit,omitempty"`

	// AllNamespaces Aggregate across every namespace, ignoring the namespace header. The server merges all namespaces and applies limit as a single global cap under the requested sort, so the admin UI's "All namespaces" view fetches one response instead of one request per namespace.
	AllNamespaces *bool `form:"all_namespaces,omitempty" json:"all_namespaces,omitempty"`

	// Namespace With all_namespaces=true, restrict the aggregate to these namespaces (repeatable, exact match); ignored otherwise. Lets the browser narrow an "All namespaces" listing without changing the active namespace.
	Namespace *[]string `form:"namespace,omitempty" json:"namespace,omitempty"`

	// MemoryType Repeatable and/or comma-separated metadata.memory_type filter; a memory matches if its type is ANY of the listed values (OR). Distinct from "meta", which ANDs one value per key.
	MemoryType *[]string `form:"memory_type,omitempty" json:"memory_type,omitempty"`

	// CreatedAfter Only memories created at or after this instant.
	CreatedAfter *time.Time `form:"created_after,omitempty" json:"created_after,omitempty"`

	// AccessedAfter Only memories last accessed at or after this instant.
	AccessedAfter *time.Time `form:"accessed_after,omitempty" json:"accessed_after,omitempty"`

	// Sort Column to order by. Defaults to created_at.
	Sort *ListMemoriesParamsSort `form:"sort,omitempty" json:"sort,omitempty"`

	// Order Sort direction. Defaults to desc (newest / highest first).
	Order *ListMemoriesParamsOrder `form:"order,omitempty" json:"order,omitempty"`

	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type ListMemoriesParamsOrder string

type ListMemoriesParamsSort string

type ListResponse struct {
	Memories []Memory `json:"memories"`
}

type Memory struct {
	AccessCount int `json:"access_count"`

	// AssessedImportance System-generated: how intrinsically important the LLM judged this content to be, in [0.1,0.9]. Null when never assessed. It refines a tier-seeded importance and is cleared whenever a caller supplies an explicit importance, so it never overrides what you asked for.
	AssessedImportance *float64 `json:"assessed_importance,omitempty"`

	// AutoSuperseded Optional. Present only on POST /v1/memories responses when the write's nearest same-tier candidate scored at/above MEMINI_WRITE_DEDUP_SCORE with MEMINI_WRITE_DEDUP_ACTION="supersede" and the old memory was tombstoned in the background. The caller still receives the new memory.
	AutoSuperseded *bool `json:"auto_superseded,omitempty"`

	// Confidence Corroboration of a durable fact in [0,1]; null when not tracked.
	Confidence *float64 `json:"confidence,omitempty"`
	Content    string   `json:"content"`

	// ContentHash Content-identity hash for injection dedupe: the first 16 hex chars of sha256 over the FULL stored content, falling back to the summary only when content is empty — the same recipe as the plugin client's injectedIdentity, so client and server derive identical identities. Always computed over the stored text (never a concise projection), so it is stable across response formats. Present on search and briefing responses; omitted elsewhere.
	ContentHash *string `json:"content_hash,omitempty"`

	// ContentTruncated Present (true) only in concise-format responses (response_format=concise on /v1/search, format=concise on /v1/namespaces/briefing) when this memory's content was replaced by a boundary cut of the stored content. Absent when the concise text is a stored summary or content short enough to pass through verbatim — and always absent in detailed responses.
	ContentTruncated *bool     `json:"content_truncated,omitempty"`
	CreatedAt        time.Time `json:"created_at"`

	// EmbedState Deferred-repair state. Empty (or absent) means healthy. "pending" and "enrich" are transient: the repair worker clears them within seconds of the embedder recovering. "failed" means the repair exhausted its attempt ceiling, so the memory stays keyword-only until the sweeper re-arms it or an operator intervenes — the one value worth surfacing to a user.
	EmbedState     *MemoryEmbedState `json:"embed_state,omitempty"`
	ExpiresAt      *time.Time        `json:"expires_at,omitempty"`
	Id             string            `json:"id"`
	Importance     float64           `json:"importance"`
	LastAccessedAt time.Time         `json:"last_accessed_at"`

	// Level Derivation provenance: explicit (user-stated / heuristic) vs deduced (LLM-distilled). Null/omitted when the row predates the tag or when unset.
	Level *Level `json:"level,omitempty"`

	// MergeHint Optional. Present only on POST /v1/memories responses when the write's nearest same-tier candidate scored at/above MEMINI_WRITE_DEDUP_SCORE and MEMINI_WRITE_DEDUP_ACTION is "hint".
	MergeHint *MergeHint              `json:"merge_hint,omitempty"`
	Metadata  *map[string]interface{} `json:"metadata,omitempty"`
	Namespace string                  `json:"namespace"`

	// Reinforced Optional. Present only on POST /v1/memories responses when the fact was already known and NO new memory was created: the existing memory was strengthened (reinforced and corroborated) and is what this response returns. Two paths reach it — the exact-restatement fingerprint fast path, and MEMINI_WRITE_DEDUP_ACTION="coalesce" when the incoming phrasing is not richer than the stored one. Without this flag a 201 would read as "created", which is exactly what did not happen, and the id would appear to belong to a memory the caller wrote when it does not.
	Reinforced   *bool     `json:"reinforced,omitempty"`
	Summary      *string   `json:"summary,omitempty"`
	SupersededBy *string   `json:"superseded_by,omitempty"`
	Tags         *[]string `json:"tags,omitempty"`
	Tier         Tier      `json:"tier"`
	UpdatedAt    time.Time `json:"updated_at"`

	// ValidFrom Start of the wall-clock interval the fact was true; null means open ("always, until valid_to"). Used by time-travel (as_of) recall.
	ValidFrom *time.Time `json:"valid_from,omitempty"`

	// ValidTo End of the interval the fact was true; null means open ("still true"). Stamped automatically when a fact is superseded.
	ValidTo *time.Time `json:"valid_to,omitempty"`
}

type MemoryEmbedState string

type MergeHint struct {
	// Score Fused similarity between the new write and the near-duplicate (0..1).
	Score *float64 `json:"score,omitempty"`

	// SimilarContent Preview (≤200 chars) of the near-duplicate memory's content.
	SimilarContent *string `json:"similar_content,omitempty"`

	// SimilarId ID of the near-duplicate memory.
	SimilarId *string `json:"similar_id,omitempty"`
	Tier      *Tier   `json:"tier,omitempty"`
}

type MiddlewareFunc func(http.Handler) http.Handler

type MoveNamespaceJSONBody struct {
	DryRun *bool `json:"dry_run,omitempty"`

	// To Target namespace.
	To string `json:"to"`
}

type MoveNamespaceJSONRequestBody MoveNamespaceJSONBody

type MoveNamespaceParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type Namespace = string

type NamespaceLink struct {
	CreatedAt time.Time `json:"created_at"`
	Dst       string    `json:"dst"`
	Note      *string   `json:"note,omitempty"`
	Src       string    `json:"src"`

	// Tiers Tier restriction on the link; empty/omitted means the durable default (semantic, procedural).
	Tiers *[]Tier `json:"tiers,omitempty"`
}

type NamespaceLinksResponse struct {
	Links []NamespaceLink `json:"links"`
}

type NamespacesResponse struct {
	Namespaces []string `json:"namespaces"`
}

type Pin struct {
	CreatedAt time.Time `json:"created_at"`

	// CreatedBy Name of the API key that created the pin, when known.
	CreatedBy *string `json:"created_by,omitempty"`

	// Key The pin key: "remote:<canonical-remote>" or "path:<abs-toplevel>".
	Key       string    `json:"key"`
	Namespace string    `json:"namespace"`
	Note      *string   `json:"note,omitempty"`
	UpdatedAt time.Time `json:"updated_at"`
}

type PinDeleteRequest struct {
	RemoteUrl    *string `json:"remote_url,omitempty"`
	ToplevelPath *string `json:"toplevel_path,omitempty"`
}

type PinListResponse struct {
	Entries []Pin `json:"entries"`
}

type PinPutRequest struct {
	Namespace string  `json:"namespace"`
	Note      *string `json:"note,omitempty"`

	// RemoteUrl Raw git remote URL; canonicalized server-side into the remote:<canonical> key.
	RemoteUrl *string `json:"remote_url,omitempty"`

	// ToplevelPath Absolute git toplevel path; stored as the path:<toplevel_path> key.
	ToplevelPath *string `json:"toplevel_path,omitempty"`
}

type PutLinkJSONBody struct {
	// Dst Target namespace.
	Dst string `json:"dst"`

	// Note Free-text annotation for operators.
	Note *string `json:"note,omitempty"`

	// Tiers Restrict which tiers cross the link; empty/omitted means the durable default (semantic, procedural) — non-durable tiers never cross a link regardless.
	Tiers *[]Tier `json:"tiers,omitempty"`
}

type PutLinkJSONRequestBody PutLinkJSONBody

type PutLinkParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type PutPinJSONRequestBody = PinPutRequest

type PutSelfSettingsJSONRequestBody = ClientSettings

type PutSettingsDefaultsJSONRequestBody = ClientSettings

type ReadSetEntryItem struct {
	Namespace string `json:"namespace"`

	// Origin Why a namespace is in the read set: "primary" is the request namespace (and its subtree, when expanded), "ancestor" is a path-prefix cascade leg, "home" is the caller's personal namespace, "link" is a stored namespace link, and "call" is an explicit per-call namespace.
	Origin ReadSetOrigin `json:"origin"`

	// Tiers Tier restriction applied to this namespace; omitted means the request's own tier filter, unrestricted beyond that.
	Tiers *[]Tier `json:"tiers,omitempty"`
}

type ReadSetOrigin string

type ReadSetResponse struct {
	Entries []ReadSetEntryItem `json:"entries"`
}

type ReassignMemoryJSONBody struct {
	// To Target namespace.
	To string `json:"to"`
}

type ReassignMemoryJSONRequestBody ReassignMemoryJSONBody

type ReassignMemoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type RememberMemoryJSONRequestBody = RememberRequest

type RememberMemoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type RememberRequest struct {
	// Confidence Seed corroboration for a durable fact (e.g. a trusted import). Omit to use the default seed; ignored for short-term tiers.
	Confidence *float64 `json:"confidence,omitempty"`
	Content    string   `json:"content"`

	// Id Upserts an existing memory when provided.
	Id *string `json:"id,omitempty"`

	// Importance Ranking and retention bias. Omit for the tier default — the server may then assess one itself (assessed_importance); an explicit value always wins and clears that assessment.
	Importance *float64 `json:"importance,omitempty"`

	// Level Label the derivation provenance (explicit vs deduced) at write time. Omit to leave unset (default, legacy rows, auto-tagged by service).
	Level *Level `json:"level,omitempty"`

	// Metadata Replaces the stored metadata wholesale when this write carries an id (an upsert). Use PATCH /v1/memories/{id} to merge key-by-key instead.
	Metadata *map[string]interface{} `json:"metadata,omitempty"`
	Summary  *string                 `json:"summary,omitempty"`
	Tags     *[]string               `json:"tags,omitempty"`

	// Tier Omit to let the server choose: the content is classified by the marker heuristic (a terse, unhedged decision/preference/problem lands in semantic/procedural, stamped metadata.tier_classified=marker), falling back to working. Classification never picks working (the default) — it only raises to semantic/procedural.
	Tier *Tier `json:"tier,omitempty"`

	// TtlSeconds Overrides the tier default TTL; negative means never expire.
	TtlSeconds *int `json:"ttl_seconds,omitempty"`

	// ValidFrom Start of the interval the fact was true. Defaults to now; backdate it to record a historical fact so time-travel (as_of) recall surfaces it.
	ValidFrom *time.Time `json:"valid_from,omitempty"`

	// ValidTo End of the interval the fact was true (for recording a fact that was true only in the past). Omit for a fact that is still true.
	ValidTo *time.Time `json:"valid_to,omitempty"`

	// Visibility Write-side namespace scoping. Omit or "project" (default) writes to the request namespace itself. "personal" writes to the caller's home namespace (X-Memini-Home header / MEMINI_HOME on the client) instead — an error if no home namespace is configured. Any other value must name an ancestor of the request namespace, either its full path or an unambiguous last path segment (e.g. "acme" for request namespace "acme/phoenix/api"), and the write lands there instead. Ignored for non-durable writes: an episodic/working memory always stays in the request namespace regardless of visibility.
	Visibility *string `json:"visibility,omitempty"`
}

type RenamespaceReport struct {
	// DryRun Whether this was a dry run.
	DryRun *bool `json:"dry_run,omitempty"`

	// Moved Number of memories moved.
	Moved *int `json:"moved,omitempty"`

	// Skipped Memories left in place (no grouping key, or already in place).
	Skipped *int `json:"skipped,omitempty"`

	// Targets Memories moved into each destination namespace.
	Targets *map[string]int `json:"targets,omitempty"`
}

type ReportInjectedJSONRequestBody = InjectedReport

type ReportInjectedParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type RequiredHeaderError struct {
	ParamName string
	Err       error
}

type RequiredParamError struct {
	ParamName string
}

type RunDedupJSONRequestBody = DedupRequest

type RunDedupParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type RunFsckParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type ScoredMemory struct {
	// From Read-set provenance beyond memory.namespace: omitted for a hit from the request (primary) namespace — the common case, no annotation needed — the ancestor/home namespace name itself for those two origins ("acme", "personal/kit"), and a prefixed form for a stored link or an explicit per-call namespace ("link:shared/golang", "call:acme/other"). Only populated when the read drew from a resolved read set (recall/answer); omitted otherwise.
	From   *string `json:"from,omitempty"`
	Memory Memory  `json:"memory"`
	Score  float64 `json:"score"`
}

type SearchMemoriesJSONRequestBody = SearchRequest

type SearchMemoriesParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type SearchRequest struct {
	// AsOf Time-travel recall: return facts whose validity window contained this instant (including ones since superseded), for "what was true then" queries.
	AsOf *time.Time `json:"as_of,omitempty"`

	// ExcludeIds Drop memories with these ids, applied before ranking and the limit so an excluded hit never consumes a result slot. Lets a long-lived client keep memories it has already injected out of recall and still receive the next-best fresh hits, instead of filtering client-side after the top-limit slots are spent.
	ExcludeIds *[]string `json:"exclude_ids,omitempty"`

	// ExcludeMetadata Drop memories whose top-level metadata carries any of these key=value pairs (the inverse of metadata). Lets a caller keep its own just-written memories out of recall — e.g. excluding the current session's captured turns so they are not echoed back as memory.
	ExcludeMetadata *map[string]string `json:"exclude_metadata,omitempty"`
	IncludeExpired  *bool              `json:"include_expired,omitempty"`

	// IncludeFreshTurns When true, disable the server-side temporal echo guard for this call: just-captured episodic turn captures (metadata.format="turn" younger than the server's window, default 5m) are NOT dropped. Default (false) drops them — a just-captured turn is live context, not long-term memory, and echoing it back makes the agent parrot itself. Opt in only when you genuinely need fresh turns.
	IncludeFreshTurns *bool `json:"include_fresh_turns,omitempty"`

	// IncludeHandoffs When true, stored session handoffs are eligible for this search. Default (false) excludes them: a handoff is a 100-300 line prompt that shares surface with almost any query about the project, so leaving it in the corpus crowds real facts out of the top results. Handoffs are reached deliberately, through the briefing pointer and GET /v1/memories/{id}. Opt in only to search across handoffs.
	IncludeHandoffs   *bool    `json:"include_handoffs,omitempty"`
	IncludeSuperseded *bool    `json:"include_superseded,omitempty"`
	Levels            *[]Level `json:"levels,omitempty"`
	Limit             *int     `json:"limit,omitempty"`

	// MaxTokens Server-enforced token budget over the results. The server fills results in final rank order until the estimated cost — a cheap word-count estimate (ceil(words*4/3), the client hooks' own approxTokens recipe) over the content each result ships (the concise text under response_format=concise) plus a 10-token per-item render overhead — would exceed the budget, drops the whole tail, and reports the drop count in the response's `omitted`. The first result always ships even when it alone exceeds the budget: a non-empty recall never becomes empty by budget. An estimate, not a tokenizer — treat the bound as approximate. 0 (or absent) is unbounded. The drop count is also recorded server-side as `budget_omitted` on the recall activity event.
	MaxTokens *int `json:"max_tokens,omitempty"`

	// Metadata A memory's top-level metadata must contain every listed key=value pair (AND).
	Metadata *map[string]string `json:"metadata,omitempty"`

	// MinRankScore Per-call floor on the final ranked (composite) score — the same score the response `score` field and the activity feed show. Applied AFTER re-ranking, so it changes membership of the final list only, never the candidate pool the reranker judged nor its ordering. Floored hits are still logged to the activity feed, marked as filtered, so what was dropped stays visible. 0 (or unset) disables it. Results added by `include_linked` expansion are exempt (the floor runs before expansion). With `query_rewrite` it applies per query variant, before the RRF fusion of variants. Distinct from `min_score`, which floors the raw fused score before re-ranking.
	MinRankScore *float64 `json:"min_rank_score,omitempty"`

	// MinScore Per-call relevance floor on the fused score. Candidates below it are dropped server-side before re-ranking. 0 (or unset) falls back to the server's baked relevance floor (0.1). Only meaningful with score fusion (RRF scores are not comparable to this threshold).
	MinScore *float64 `json:"min_score,omitempty"`

	// Namespaces Search exactly these namespaces instead of the default read set (the request namespace, its subtree, and the global namespace). An entry ending in "/*" also includes namespaces nested under it. Writes are unaffected.
	Namespaces *[]string `json:"namespaces,omitempty"`
	Query      string    `json:"query"`

	// QueryRewrite When true and an LLM is configured, rewrite the query into 2-3 diverse variants before recall and fuse results via RRF. Cheapest read-path LLM lever; opt-in per call.
	QueryRewrite *bool `json:"query_rewrite,omitempty"`

	// Reinforce Whether returned memories count as used. Set false for automatic context injection: results are still logged, but access counts, access timestamps, confidence, and expiry are unchanged. Omitted or true preserves reinforcement for explicit recalls.
	Reinforce *bool `json:"reinforce,omitempty"`

	// ResponseFormat "detailed" (default, and the behavior when absent) returns each result's full stored content. "concise" replaces each result's memory.content with its compact form — the summary when one exists, else the content cut at a word/sentence boundary to at most 240 runes with a "…" suffix — and sets memory.content_truncated on results whose concise text is such a cut. A projection at response mapping only: ranking, filters, and scores are identical across formats, and memory.content_hash is always computed over the full stored content. Fetch full text with GET /v1/memories/{id}.
	ResponseFormat *SearchRequestResponseFormat `json:"response_format,omitempty"`

	// Scope "full" (default) searches the request namespace plus its ancestor/home/link cascade; "project" searches only the request namespace (no cascade); "everywhere" is "full" plus the request namespace's subtree, for the multi-agent read-shared-plus-private pattern. "exact" and "subtree" are deprecated aliases kept for back-compat: "exact" behaves as "project" (its original, pre-cascade meaning — the request namespace only) and "subtree" behaves as "everywhere". Any other value is rejected with 400.
	Scope *SearchRequestScope `json:"scope,omitempty"`

	// Source Why this recall ran — which integration or code path asked for it. Recorded verbatim on the activity event (the "why" the feed shows). Documented vocabulary: "pretool", "session_start", "mcp", "ui", "api", "answer", "doctor". NOT enum-validated server-side, so an unknown value from a fail-soft client is logged rather than rejected. Absent defaults to "api".
	Source *string `json:"source,omitempty"`

	// Tags A memory must carry every listed tag (AND).
	Tags  *[]string `json:"tags,omitempty"`
	Tiers *[]Tier   `json:"tiers,omitempty"`
}

type SearchRequestResponseFormat string

type SearchRequestScope string

type SearchResponse struct {
	// Degraded Set when this search returned less than the full corpus. "keyword_only" means the query embed failed or timed out and the search fell back to keyword-only matching. "partial" means one or more read-set namespaces were unreachable and were skipped (the namespace you asked about is never among them — losing it fails the request instead). Omitted on a healthy search.
	Degraded *string `json:"degraded,omitempty"`

	// Note Human-readable explanation of `degraded`; omitted alongside it on a healthy search.
	Note *string `json:"note,omitempty"`

	// Omitted Results dropped by the request's `max_tokens` budget. Absent — never an explicit 0 — when no budget was set or everything fit, so its presence always means the server trimmed the tail.
	Omitted *int           `json:"omitted,omitempty"`
	Results []ScoredMemory `json:"results"`
}

type SelfResponse struct {
	// Identity Who the request authenticated as, independent of any resolved namespace.
	Identity CallerIdentity `json:"identity"`

	// Settings Fully resolved — every field present.
	Settings ClientSettings `json:"settings"`

	// SettingsSources Per-field provenance for `settings`, keyed by the same field names.
	SettingsSources map[string]SelfResponseSettingsSources `json:"settings_sources"`
}

type SelfResponseSettingsSources string

type Server struct {
	// contains filtered or unexported fields
}

type ServerInterface interface {
	// ListActivity Recent memory activity — what was served or written, and why
	// (GET /v1/activity)
	ListActivity(w http.ResponseWriter, r *http.Request, params ListActivityParams)
	// ReportInjected Report what a client hook actually injected vs suppressed
	// (POST /v1/activity/injected)
	ReportInjected(w http.ResponseWriter, r *http.Request, params ReportInjectedParams)
	// AnswerQuestion Recall memories and answer a question grounded on them (requires an LLM)
	// (POST /v1/answer)
	AnswerQuestion(w http.ResponseWriter, r *http.Request, params AnswerQuestionParams)
	// RunDedup Collapse near-duplicate memories (vector cluster) — tombstone the lower-scored members of each cluster
	// (POST /v1/dedup)
	RunDedup(w http.ResponseWriter, r *http.Request, params RunDedupParams)
	// RunFsck Run a consistency sweep (purge expired, enforce short-term cap, audit duplicates)
	// (POST /v1/fsck)
	RunFsck(w http.ResponseWriter, r *http.Request, params RunFsckParams)
	// Handshake Resolve namespace, identity, and behavioral settings from client-supplied project facts
	// (POST /v1/handshake)
	Handshake(w http.ResponseWriter, r *http.Request)
	// ListApiKeys List API keys (name/home/default namespace/created/disabled/admin/read_only/source — never a secret or hash)
	// (GET /v1/keys)
	ListApiKeys(w http.ResponseWriter, r *http.Request)
	// CreateApiKey Create a new API key, returning its secret exactly once
	// (POST /v1/keys)
	CreateApiKey(w http.ResponseWriter, r *http.Request)
	// DeleteApiKey Delete an API key
	// (DELETE /v1/keys/{name})
	DeleteApiKey(w http.ResponseWriter, r *http.Request, name string)
	// UpdateApiKey Update an API key's home namespace, default namespace, disabled state, admin capability, read-only capability, and/or per-key settings
	// (PATCH /v1/keys/{name})
	UpdateApiKey(w http.ResponseWriter, r *http.Request, name string)
	// RotateApiKey Rotate an API key's secret, returning the new secret exactly once
	// (POST /v1/keys/{name}/rotate)
	RotateApiKey(w http.ResponseWriter, r *http.Request, name string)
	// DeleteLink Delete a namespace link
	// (DELETE /v1/links)
	DeleteLink(w http.ResponseWriter, r *http.Request, params DeleteLinkParams)
	// ListLinks List outgoing namespace links from the request namespace
	// (GET /v1/links)
	ListLinks(w http.ResponseWriter, r *http.Request, params ListLinksParams)
	// PutLink Create or replace a namespace link (cross-namespace read edge)
	// (POST /v1/links)
	PutLink(w http.ResponseWriter, r *http.Request, params PutLinkParams)
	// ForgetByTag Delete every memory in the namespace carrying a tag
	// (DELETE /v1/memories)
	ForgetByTag(w http.ResponseWriter, r *http.Request, params ForgetByTagParams)
	// ListMemories List memories in a namespace (backs the admin UI browser)
	// (GET /v1/memories)
	ListMemories(w http.ResponseWriter, r *http.Request, params ListMemoriesParams)
	// RememberMemory Remember (store) a memory
	// (POST /v1/memories)
	RememberMemory(w http.ResponseWriter, r *http.Request, params RememberMemoryParams)
	// ForgetMemory Forget (delete) a memory
	// (DELETE /v1/memories/{id})
	ForgetMemory(w http.ResponseWriter, r *http.Request, id string, params ForgetMemoryParams)
	// GetMemory Fetch a memory by ID (or unique id prefix)
	// (GET /v1/memories/{id})
	GetMemory(w http.ResponseWriter, r *http.Request, id string, params GetMemoryParams)
	// UpdateMemory Update a memory in place
	// (PATCH /v1/memories/{id})
	UpdateMemory(w http.ResponseWriter, r *http.Request, id string, params UpdateMemoryParams)
	// GetMemoryHistory The full version chain (supersession lineage) of a memory
	// (GET /v1/memories/{id}/history)
	GetMemoryHistory(w http.ResponseWriter, r *http.Request, id string, params GetMemoryHistoryParams)
	// ReassignMemory Move a single memory to a different namespace
	// (POST /v1/memories/{id}/reassign)
	ReassignMemory(w http.ResponseWriter, r *http.Request, id string, params ReassignMemoryParams)
	// SupersedeMemory Tombstone a memory, recording it was replaced by `by`.
	// (POST /v1/memories/{id}/supersede)
	SupersedeMemory(w http.ResponseWriter, r *http.Request, id string, params SupersedeMemoryParams)
	// DeleteNamespace Delete every memory in the request namespace
	// (DELETE /v1/namespaces)
	DeleteNamespace(w http.ResponseWriter, r *http.Request, params DeleteNamespaceParams)
	// ListNamespaces List the distinct namespaces holding memories
	// (GET /v1/namespaces)
	ListNamespaces(w http.ResponseWriter, r *http.Request)
	// GetBriefing Layered session-start briefing for the request namespace
	// (GET /v1/namespaces/briefing)
	GetBriefing(w http.ResponseWriter, r *http.Request, params GetBriefingParams)
	// MoveNamespace Relocate every memory in the request namespace to another namespace
	// (POST /v1/namespaces/move)
	MoveNamespace(w http.ResponseWriter, r *http.Request, params MoveNamespaceParams)
	// GetReadSet Resolve the structural read set for the request namespace
	// (GET /v1/namespaces/readset)
	GetReadSet(w http.ResponseWriter, r *http.Request, params GetReadSetParams)
	// SplitNamespace Split the request namespace by metadata keys
	// (POST /v1/namespaces/split)
	SplitNamespace(w http.ResponseWriter, r *http.Request, params SplitNamespaceParams)
	// DeletePin Delete an explicit project→namespace pin
	// (DELETE /v1/pins)
	DeletePin(w http.ResponseWriter, r *http.Request)
	// ListPins List explicit project→namespace pins
	// (GET /v1/pins)
	ListPins(w http.ResponseWriter, r *http.Request)
	// PutPin Create or replace an explicit project→namespace pin
	// (PUT /v1/pins)
	PutPin(w http.ResponseWriter, r *http.Request)
	// SearchMemories Recall memories via hybrid (vector + keyword) search
	// (POST /v1/search)
	SearchMemories(w http.ResponseWriter, r *http.Request, params SearchMemoriesParams)
	// GetSelf The caller's identity and fully-merged behavioral settings
	// (GET /v1/self)
	GetSelf(w http.ResponseWriter, r *http.Request)
	// PutSelfSettings Replace the caller's own per-key behavioral settings
	// (PUT /v1/self/settings)
	PutSelfSettings(w http.ResponseWriter, r *http.Request)
	// GetSettingsDefaults The server's global default ClientSettings
	// (GET /v1/settings/defaults)
	GetSettingsDefaults(w http.ResponseWriter, r *http.Request)
	// PutSettingsDefaults Replace the server's global default ClientSettings
	// (PUT /v1/settings/defaults)
	PutSettingsDefaults(w http.ResponseWriter, r *http.Request)
	// GetStats Per-namespace overview (counts by tier, accesses, importance)
	// (GET /v1/stats)
	GetStats(w http.ResponseWriter, r *http.Request, params GetStatsParams)
}

type ServerInterfaceWrapper struct {
	Handler            ServerInterface
	HandlerMiddlewares []MiddlewareFunc
	ErrorHandlerFunc   func(w http.ResponseWriter, r *http.Request, err error)
}

type SettingsDefaultsResponse struct {
	// AutoSave Periodically nudge the agent to persist durable memories.
	AutoSave *bool `json:"auto_save,omitempty"`

	// AutoSaveInterval User-message interval between auto-save nudges.
	AutoSaveInterval *int `json:"auto_save_interval,omitempty"`

	// AutoSaveMinEvents Minimum buffered state-changing tool events since the last auto-save baseline for the interval nudge to fire; below this the nudge defers, then fires as a discussion-variant prompt at twice the interval. 0 disables the activity gate (interval-only cadence).
	AutoSaveMinEvents *int `json:"auto_save_min_events,omitempty"`

	// Capture Enable capture (turns/digests) at all.
	Capture *bool `json:"capture,omitempty"`

	// CaptureAssistantMaxChars Truncate the assistant side of a captured turn to this many characters, marked like capture_user_max_chars. Larger than the user side because the answer usually carries the durable content. 0 captures the assistant text whole.
	CaptureAssistantMaxChars *int `json:"capture_assistant_max_chars,omitempty"`

	// CaptureTurns Capture each user→assistant turn as episodic memory.
	CaptureTurns *bool `json:"capture_turns,omitempty"`

	// CaptureUserMaxChars Truncate the user side of a captured turn to this many characters. The cut is marked with "[...truncated]" so a later reader can tell a fragment from a whole turn. 0 captures the user text whole — the server still applies its own limits, and a very long turn costs episodic storage and recall context.
	CaptureUserMaxChars *int `json:"capture_user_max_chars,omitempty"`

	// InjectBriefingFacts Max durable semantic facts in the session-start briefing.
	InjectBriefingFacts *int `json:"inject_briefing_facts,omitempty"`

	// InjectBriefingMaxTok Hard ceiling on briefing injection tokens; 0 is uncapped. Sent to the server as the briefing's max_tokens (server-enforced budget) and kept as the client-side fallback trim for old servers.
	InjectBriefingMaxTok *int `json:"inject_briefing_max_tok,omitempty"`

	// InjectBriefingPinned Max pinned memories in the session-start briefing.
	InjectBriefingPinned *int `json:"inject_briefing_pinned,omitempty"`

	// InjectBriefingProcedures Max procedural how-tos in the session-start briefing.
	InjectBriefingProcedures *int `json:"inject_briefing_procedures,omitempty"`

	// InjectBriefingRecent Max recent episodic entries in the session-start briefing.
	InjectBriefingRecent *int `json:"inject_briefing_recent,omitempty"`

	// InjectCooldownMs Time window (milliseconds) within which an already-injected memory is not re-injected; 0 disables the time dimension.
	InjectCooldownMs *int `json:"inject_cooldown_ms,omitempty"`

	// InjectCooldownPrompts Prompt-count window within which an already-injected memory is not re-injected; 0 disables the prompt dimension.
	InjectCooldownPrompts *int `json:"inject_cooldown_prompts,omitempty"`

	// InjectDedupe Suppress re-injecting a recalled memory that is still within its injection cooldown window (inject_cooldown_ms / inject_cooldown_prompts); with both windows 0, an unchanged memory stays suppressed for the rest of the session. This gates the injection; whether the PreToolUse recall call runs at all follows inject_pretool_gate_ms, but turning inject_dedupe off also disables that call gate, because the gate's clock lives in the dedupe state.
	InjectDedupe *bool `json:"inject_dedupe,omitempty"`

	// InjectLabels Which annotation labels to render alongside an injected memory.
	InjectLabels *[]SettingsDefaultsResponseInjectLabels `json:"inject_labels,omitempty"`

	// InjectPretoolGateMs Skip the PreToolUse recall server call entirely for a file whose last call was younger than this many milliseconds. 0 always calls.
	InjectPretoolGateMs *int `json:"inject_pretool_gate_ms,omitempty"`

	// InjectPretoolItems Max recalled items injected per file on PreToolUse.
	InjectPretoolItems *int `json:"inject_pretool_items,omitempty"`

	// InjectPretoolMaxTok Hard ceiling on per-tool injection tokens; 0 is uncapped. Sent to the server as each per-file search's max_tokens (server-enforced budget) and kept as the client-side fallback trim for old servers.
	InjectPretoolMaxTok *int `json:"inject_pretool_max_tok,omitempty"`

	// InjectPretoolMinScore Floor on the composite post-rerank score — the final [0,1) scale the response score field and the activity feed show — for a PreToolUse injection. All bundled integrations enforce it server-side via min_rank_score (floored hits appear in the feed marked as filtered); a custom or older caller may still apply it as a pre-rank fused-score floor. 0 disables the floor.
	InjectPretoolMinScore *float32 `json:"inject_pretool_min_score,omitempty"`

	// InjectPretoolTools Tool-name allowlist that triggers a PreToolUse injection. Glob and Grep are deliberately not in the default: pattern-derived queries ("Grep on <pattern>") are near-zero-signal and each ungated call costs a server embed+rerank — list them here to restore the old behavior.
	InjectPretoolTools *[]string `json:"inject_pretool_tools,omitempty"`

	// InjectRecallMaxTok Hard ceiling on recall injection tokens; 0 is uncapped. Sent to the server as the prompt search's max_tokens (server-enforced budget) and kept as the client-side fallback trim for old servers.
	InjectRecallMaxTok *int `json:"inject_recall_max_tok,omitempty"`

	// InjectRecallMinScore Floor on the composite post-rerank score — the final [0,1) scale the response score field and the activity feed show — for a recall injection. All bundled integrations enforce it server-side via min_rank_score (floored hits appear in the feed marked as filtered); a custom or older caller may still apply it as a pre-rank fused-score floor. 0 disables the floor.
	InjectRecallMinScore *float32 `json:"inject_recall_min_score,omitempty"`

	// InjectTelemetry Report what each hook actually injected vs suppressed back to the server (POST /v1/activity/injected) so the activity feed and metrics reflect what reached model context instead of pre-suppression serves. Best-effort and bounded (the beacon never blocks or fails a hook); off disables reporting entirely.
	InjectTelemetry *bool `json:"inject_telemetry,omitempty"`

	// InlineExtract Inject the directive asking the agent to save durable facts via memory_remember.
	InlineExtract *bool `json:"inline_extract,omitempty"`

	// ManagedBy "api" means the layer is stored in the server's KV store and editable via PUT /v1/settings/defaults; "env" means it is pinned by the MEMINI_CLIENT_DEFAULTS environment variable, and PUT is refused with 409.
	ManagedBy SettingsDefaultsResponseManagedBy `json:"managed_by"`

	// MinCaptureChars Minimum content length worth bothering to capture a turn.
	MinCaptureChars *int `json:"min_capture_chars,omitempty"`

	// NamespacePrefix Namespace path prepended ahead of the derived/declared namespace.
	NamespacePrefix *string `json:"namespace_prefix,omitempty"`

	// NamespaceScope "repo" derives the namespace from the bare repo name; "owner_repo" disambiguates same-named repos across owners with an owner-repo slug (owner + "-" + repo).
	NamespaceScope *SettingsDefaultsResponseNamespaceScope `json:"namespace_scope,omitempty"`

	// Recall Enable recall-driven injection at all.
	Recall *bool `json:"recall,omitempty"`

	// RecallLimit Max memories per recall call.
	RecallLimit *int `json:"recall_limit,omitempty"`

	// RequestTimeoutMs How long a client waits on one memini HTTP call before giving up (MEMINI_TIMEOUT_MS locally). It must stay above the server's own MEMINI_RERANK_TIMEOUT (default 10s): the server bounds a slow reranker and degrades to composite order, but a client that hangs up first gets nothing at all instead of an unranked result. Raise it when a cross-encoder reranker, a deep MEMINI_RERANK_POOL, or a cold model pushes recall past the default. The handshake keeps its own short timeout and is not covered by this setting.
	RequestTimeoutMs *int `json:"request_timeout_ms,omitempty"`

	// SessionDigest Record a session-end/stop/pre-compact digest memory.
	SessionDigest *bool `json:"session_digest,omitempty"`
}

type SettingsDefaultsResponseInjectLabels string

type SettingsDefaultsResponseManagedBy string

type SettingsDefaultsResponseNamespaceScope string

type SplitNamespaceJSONBody struct {
	// By Metadata keys to group by. Defaults to import_source_namespace, user_id, agent_id, run_id, project.
	By     *[]string `json:"by,omitempty"`
	DryRun *bool     `json:"dry_run,omitempty"`
}

type SplitNamespaceJSONRequestBody SplitNamespaceJSONBody

type SplitNamespaceParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type Stats struct {
	AvgImportance float64 `json:"avg_importance"`

	// ByMemoryType Live count per typed-extraction memory_type (decision/preference/problem).
	ByMemoryType *map[string]int `json:"by_memory_type,omitempty"`
	ByTier       map[string]int  `json:"by_tier"`

	// EmbedStuck Live memories whose repair exhausted its attempt ceiling. Unlike pending_embed these do not fix themselves on the next tick — they stay keyword-only until the sweeper re-arms them or an operator intervenes.
	EmbedStuck  *int       `json:"embed_stuck,omitempty"`
	Expired     int        `json:"expired"`
	LastWriteAt *time.Time `json:"last_write_at,omitempty"`

	// LowConfidenceDurable Live durable memories whose decayed confidence is below the demote floor — reclaimable, uncorroborated debris.
	LowConfidenceDurable int    `json:"low_confidence_durable"`
	Namespace            string `json:"namespace"`

	// PendingEmbed Live memories saved without a vector because the embedder was unreachable at write time. The repair worker re-embeds them and replays the write-time enrichment they missed, so a persistently nonzero value means the embedder is still down.
	PendingEmbed int `json:"pending_embed"`
	Superseded   int `json:"superseded"`

	// Total Live memories (excludes expired/superseded)
	Total         int `json:"total"`
	TotalAccesses int `json:"total_accesses"`
}

type SupersedeMemoryJSONRequestBody = SupersedeRequest

type SupersedeMemoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type SupersedeRequest struct {
	// By ID of the memory that replaces the target.
	By string `json:"by"`
}

type Tier string

type TooManyValuesForParamError struct {
	ParamName string
	Count     int
}

type UnescapedCookieParamError struct {
	ParamName string
	Err       error
}

type Unimplemented struct{}

type UnmarshalingParamError struct {
	ParamName string
	Err       error
}

type UpdateApiKeyJSONRequestBody = UpdateApiKeyRequest

type UpdateApiKeyRequest struct {
	// Admin Omit to leave the current admin capability unchanged; grant it with true, revoke it with false. A named admin key cannot revoke its own admin (admin=false targeting the key that authenticated the request) — that returns 409; use the admin env key or another admin key.
	Admin *bool `json:"admin,omitempty"`

	// DefaultNamespace Omit to leave the current default unchanged; an explicit empty string clears it.
	DefaultNamespace *string `json:"default_namespace,omitempty"`

	// Disabled Omit to leave the current disabled state unchanged.
	Disabled *bool `json:"disabled,omitempty"`

	// Home Omit to leave the current binding unchanged; an explicit empty string clears it.
	Home *string `json:"home,omitempty"`

	// ReadOnly Omit to leave the current read-only capability unchanged; impose it with true, lift it with false. A named key cannot impose read_only on itself (read_only=true targeting the key that authenticated the request) — that returns 409, because a read-only credential can no longer reach this endpoint to undo it; use the admin env key, another admin key, or the CLI.
	ReadOnly *bool `json:"read_only,omitempty"`

	// Settings Omit to leave the key's settings override unchanged; present fields replace the corresponding stored value (fields left unset within it continue to inherit the server's global defaults).
	Settings *ClientSettings `json:"settings,omitempty"`
}

type UpdateMemoryJSONRequestBody = UpdateMemoryRequest

type UpdateMemoryParams struct {
	// XMeminiNamespace Namespace for this request; falls back to the server default.
	XMeminiNamespace *Namespace `json:"X-Memini-Namespace,omitempty"`
}

type UpdateMemoryRequest struct {
	// Confidence Omit to keep the stored confidence; ignored for short-term tiers.
	Confidence *float64 `json:"confidence,omitempty"`
	Content    *string  `json:"content,omitempty"`

	// Importance Omit to keep the stored importance. An explicit value clears the LLM self-assessment (assessed_importance). Note that 0 is currently indistinguishable from omitted and keeps the stored value.
	Importance *float64 `json:"importance,omitempty"`

	// Level Relabel derivation provenance. Omit to keep the stored level.
	Level *Level `json:"level,omitempty"`

	// Metadata Merges into the stored metadata key-by-key: listed keys are added or overwritten, unlisted keys are untouched, and a key sent with a null value is deleted. POST /v1/memories with an id replaces metadata wholesale instead.
	Metadata *map[string]interface{} `json:"metadata,omitempty"`
	Summary  *string                 `json:"summary,omitempty"`

	// Tags Replaces the stored tag set wholesale. Omit to keep it; send an empty array to clear it.
	Tags *[]string `json:"tags,omitempty"`

	// Tier Move the memory to this tier. Omit to keep the stored tier.
	Tier *Tier `json:"tier,omitempty"`
}