@harperfast/harper 5.2.0 → 5.2.2

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@harperfast/harper",
 	"description": "Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.",
-	"version": "5.2.0",
+	"version": "5.2.2",
 	"license": "Apache-2.0",
 	"homepage": "https://harper.fast",
 	"bugs": {
@@ -63,6 +63,7 @@
 		"lint:fix": "npm run lint -- --fix",
 		"format:check": "prettier --check .",
 		"format:write": "prettier --write .",
+		"test:bench": "node --test \"benchmarks/**/*.test.mts\"",
 		"test:integration": "harper-integration-test-run",
 		"test:integration:all": "npm run test:integration -- \"integrationTests/**/*.test.ts\" \"integrationTests/**/*.test.mjs\"",
 		"test:integration:mcp": "npm run test:integration -- \"integrationTests/mcp/**/*.test.ts\"",
@@ -130,7 +131,7 @@
 	},
 	"devDependencies": {
 		"@harperfast/code-guidelines": "^0.1.2",
-		"@harperfast/integration-testing": "^0.6.2",
+		"@harperfast/integration-testing": "^0.7.0",
 		"@modelcontextprotocol/sdk": "^1.29.0",
 		"@types/busboy": "^1.5.4",
 		"@types/fs-extra": "^11.0.4",
@@ -155,6 +156,7 @@
 		"mkcert": "^3.2.0",
 		"mocha": "^11.7.5",
 		"mqtt": "^5.15.1",
+		"openai": "^6.45.0",
 		"oxlint": "^1.31.0",
 		"prettier": "~3.9.0",
 		"rewire": "^9.0.1",
@@ -170,14 +172,14 @@
 	},
 	"dependencies": {
 		"@aws-sdk/client-s3": "^3.1012.0",
-		"@aws-sdk/lib-storage": "3.1090.0",
+		"@aws-sdk/lib-storage": "3.1096.0",
 		"@endo/static-module-record": "^1.1.2",
 		"@fastify/autoload": "^6.3.1",
 		"@fastify/compress": "^8.3.1",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/static": "^9.1.3",
 		"@harperfast/extended-iterable": "^1.0.1",
-		"@harperfast/rocksdb-js": "^2.5.0",
+		"@harperfast/rocksdb-js": "^2.7.1",
 		"@harperfast/skills": "^1.10.8",
 		"@turf/area": "6.5.0",
 		"@turf/boolean-contains": "6.5.0",
@@ -190,7 +192,7 @@
 		"@turf/length": "6.5.0",
 		"alasql": "4.17.3",
 		"amaro": "^1.1.8",
-		"argon2": "0.44.0",
+		"argon2": "0.45.1",
 		"asn1js": "3.0.10",
 		"busboy": "^1.6.0",
 		"cbor-x": "1.6.4",
@@ -203,7 +205,7 @@
 		"fast-glob": "3.3.3",
 		"fastify": "^5.8.2",
 		"fastify-plugin": "^5.1.0",
-		"fs-extra": "11.3.6",
+		"fs-extra": "11.4.0",
 		"graphql": "^16.10.0",
 		"graphql-http": "^1.22.4",
 		"gunzip-maybe": "1.4.2",
@@ -221,10 +223,10 @@
 		"minimist": "1.2.8",
 		"moment": "2.30.1",
 		"mqtt-packet": "~9.0.1",
-		"msgpackr": "^2.0.4",
+		"msgpackr": "^2.0.5",
 		"needle": "3.5.0",
 		"node-forge": "^1.3.1",
-		"node-stream-zip": "1.15.0",
+		"node-stream-zip": "1.16.0",
 		"normalize-path": "^3.0.0",
 		"ora": "8.2.0",
 		"ordered-binary": "1.6.1",

package/resources/DESIGN.md

@@ -94,6 +94,7 @@ One giant `makeTable()` factory that returns a `TableResource extends Resource`
 | How does a URL path map to a Resource?                                | `Resources.ts → getMatch` (exact/prefix fast path) then `matchParamRoute` (parameterised routes); see "Path routing" below                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | How does HNSW keep the graph connected on delete?                     | `indexes/HierarchicalNavigableSmallWorld.ts → index()` delete path: zero-degree orphans reindexed via `needsReindexing`; severed multi-node islands detected and reconnected by `repairSeveredNeighbors` (#1712)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | How is a filter applied _during_ a vector search?                     | Predicate-aware traversal (#1241): `search.ts → executeConditions` composes companion AND conditions with request `vectorFilter` / `rowFilter` predicates into one `(primaryKey) => boolean` (`composeRecordFilter`) and passes it to `HierarchicalNavigableSmallWorld.search(cond, ctx, filter)`. The filter gates result admission at layer 0 only (routing ignores it, ACORN-style); a visit budget (`filterExpansion`) bounds the under-filled/selective case. Very selective _condition_ filters are instead diverted to the exact brute-force path by the query planner's `estimateCountAsSort` ordering.                                                                                                                                         |
+| How does post-ordering resolve vector distances safely?               | Each comparator owns its `Sort`, passes it directly to the custom-index resolver, and caches distances by that immutable per-query sort object.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | How is application row filtering applied?                             | Authorization admission happens in the resource operation before query work. The legacy `allow*` hook, when armed by the protocol, is evaluated once with its historical receiver semantics; overriding it never changes its scope. An operation override may add indexed conditions and/or attach the JavaScript-only synchronous `target.rowFilter(record, context)`. `Table.search` composes it with query filters and rechecks the final materialized cache/source record. `SubscriptionRequest.rowFilter` covers full-row events; `eventFilter(event, context)` explicitly handles tombstones/messages/raw events. Prefer indexed conditions because an opaque predicate may inspect every admitted candidate and `limit` applies after filtering. |
 
 **QUERY admission uses the body projection.** `Resource.transactional` resolves an asynchronous HTTP QUERY body before resource resolution, recursively clones away client-supplied `checkPermission`, and copies the body's `select` onto the operation admission target before `allowRead`. After authorization, `Resource.query` transfers only the narrowed projection to the body target. This ensures a body-only relationship select is checked before `Table.search`; permission-control fields from QUERY data must never reach a search target.