@oortmem/core 0.2.1 → 0.4.0

package/dist/store-conformance.js

@@ -11,7 +11,8 @@
  * more); a store with a fixed dimension must be built by `make()` with it.
  */
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { localGrant, principalGrant } from './grant.js';
+import { addressed, addressOf, authorOf, canonicalMemory, GALAXY_ROOT, nodeOf, } from './address.js';
+import { GrantError, localGrant, nodeGrant, principalGrant } from './grant.js';
 import { localScope } from './scope.js';
 import { isolationViolations, nonInterference } from './isolation.js';
 export const CONFORMANCE_DIMENSION = 4;
@@ -387,12 +388,14 @@ export function storeConformance(name, make) {
             const others = {
                 'other-org': { ...localScope(), orgId: 'another-org' },
                 'other-customer': { ...localScope(), customerId: 'someone-else' },
-                'other-agent': { ...localScope(), agentId: 'another-agent' },
             };
             await store.upsert(TG, makeMemory({ id: 'mine', text, embedding }));
             for (const [id, scope] of Object.entries(others)) {
                 await store.upsert(grantFor(scope), makeMemory({ id, text, embedding, scope }));
             }
+            // Another agent's Star is private to it (CON-62).
+            const star = { level: 'agent', orgId: 'local', agentId: 'another-agent' };
+            await store.upsert(nodesGrant(star), memoryAt('other-agent', star, { agentId: 'another-agent' }, { text, embedding }));
             expect(ids(await store.lexical(localGrant(LOCAL), 'auth-service-8080', 10))).toEqual([
                 'mine',
             ]);
@@ -578,6 +581,367 @@ export function storeConformance(name, make) {
                 expect(await nonInterference(make, seed, 60)).toBeNull();
             }
         }, 120_000);
+        it(`isolation.non-interference-multi-node-${seeds}-seeds`, async () => {
+            for (let seed = 1; seed <= seeds; seed++) {
+                expect(await nonInterference(make, seed, 60, { multiNode: true })).toBeNull();
+            }
+        }, 120_000);
+        it(`isolation.non-interference-peer-agents-${seeds}-seeds`, async () => {
+            // CON-62: another agent of the same person, working in its own Star, never reaches mine.
+            for (let seed = 1; seed <= seeds; seed++) {
+                expect(await nonInterference(make, seed, 60, { peers: true })).toBeNull();
+            }
+        }, 120_000);
+    });
+    levelConformance(name, make);
+}
+/** The owner every level case belongs to or reads as: the local principal. */
+const OWNER = { orgId: 'local', customerId: 'self', agentId: 'claude-code' };
+/**
+ * The grant every local caller had before CON-62: the owner's Planet, restricted to memories its
+ * own agent wrote. Kept to prove data written before levels reads back unchanged.
+ */
+const PRE_LEVEL = nodeGrant({
+    principal: OWNER,
+    read: [
+        {
+            node: { level: 'user', orgId: 'local', customerId: 'self' },
+            projectIds: 'all',
+            authorAgentId: 'claude-code',
+        },
+    ],
+});
+const PROVENANCE = {
+    derivedFrom: [{ vault: 'acct:1', memoryId: 'src-1' }],
+    contributors: [
+        {
+            memberRef: 'mem-1',
+            agentId: 'claude-code',
+            at: '2026-11-01T00:00:00.000Z',
+            action: 'asserted',
+        },
+    ],
+    support: { members: 1, agents: 1 },
+    gate: { policyVersion: 'p1', mode: 'confirmed' },
+};
+/** One memory per level (and a Planet memory by another agent), each with a distinct embedding. */
+export const LEVEL_CASES = [
+    {
+        name: 'planet-other-author',
+        address: { level: 'user', orgId: 'local', customerId: 'self', projectId: 'p1' },
+        author: { agentId: 'cursor' },
+    },
+    {
+        name: 'star',
+        address: { level: 'agent', orgId: 'local', agentId: 'cursor', projectId: 'p1' },
+        author: { agentId: 'cursor' },
+    },
+    {
+        name: 'orbit',
+        address: {
+            level: 'agent-user',
+            orgId: 'org:acme',
+            agentId: 'support-bot',
+            customerId: 'end-user-1',
+        },
+        author: { agentId: 'support-bot' },
+    },
+    {
+        name: 'flyby',
+        address: {
+            level: 'run',
+            orgId: 'local',
+            agentId: 'claude-code',
+            runId: 'run-1',
+            customerId: 'self',
+        },
+        author: { agentId: 'claude-code' },
+    },
+    {
+        name: 'flyby-no-customer',
+        address: { level: 'run', orgId: 'local', agentId: 'claude-code', runId: 'run-2' },
+        author: { agentId: 'claude-code' },
+    },
+    {
+        name: 'constellation',
+        address: { level: 'hive', orgId: 'org:acme', hiveId: 'checkout', projectId: 'p1' },
+        author: { agentId: 'claude-code', accountRef: 'acct:1' },
+        provenance: PROVENANCE,
+    },
+    {
+        name: 'galaxy',
+        address: { level: 'hive', orgId: 'org:acme', hiveId: GALAXY_ROOT },
+        author: { agentId: 'claude-code' },
+    },
+];
+/** A memory at `address` by `author` (scope filled to match). */
+export function memoryAt(id, address, author, overrides = {}) {
+    return makeMemory({ id, ...addressed(address, author), ...overrides });
+}
+/** Read and write every project of `nodes` (no author restriction). */
+export function nodesGrant(...nodes) {
+    return nodeGrant({
+        principal: OWNER,
+        read: nodes.map((node) => ({ node, projectIds: 'all' })),
+    });
+}
+function render(m) {
+    return m === null
+        ? 'null'
+        : JSON.stringify({ ...m, embedding: m.embedding === undefined ? null : [...m.embedding] });
+}
+/**
+ * Levels (CON-61): every address round-trips, illegal ones are refused, grants
+ * over node sets see exactly their nodes, and memories written before levels
+ * (and every pre-level grant) behave exactly as they did.
+ */
+function levelConformance(name, make) {
+    describe(`store levels: ${name}`, () => {
+        let store;
+        beforeEach(async () => {
+            store = await make();
+        });
+        afterEach(async () => {
+            await store.close();
+        });
+        const cases = () => LEVEL_CASES.map((c, i) => {
+            const m = memoryAt(`lv-${c.name}`, c.address, c.author, {
+                text: `levelprobe ${c.name} text`,
+                stub: `levelprobe ${c.name}`,
+                embedding: vec(i + 1, 1, -1, 2),
+                ...(c.provenance !== undefined && { provenance: c.provenance }),
+            });
+            return { ...c, m, g: nodesGrant(nodeOf(c.address)) };
+        });
+        it('levels.planet-memories-keep-their-shape', async () => {
+            const m = makeMemory({ id: 'legacy', scope: localScope('p1'), embedding: vec(1, 2, 3, 4) });
+            await store.upsert(TG, m);
+            const got = await store.get(TG, 'legacy');
+            expect(got).toEqual(m);
+            expect(got !== null && ('address' in got || 'author' in got || 'provenance' in got)).toBe(false);
+            expect(addressOf(got)).toEqual({
+                level: 'user',
+                orgId: 'local',
+                customerId: 'self',
+                projectId: 'p1',
+            });
+            expect(authorOf(got)).toEqual({ agentId: 'claude-code' });
+        });
+        it('levels.every-level-roundtrips', async () => {
+            for (const c of cases()) {
+                await store.upsert(c.g, c.m);
+                const got = await store.get(c.g, c.m.id);
+                expect(got, c.name).toEqual(canonicalMemory(c.m));
+                expect(addressOf(got), c.name).toEqual(c.address);
+                expect(authorOf(got), c.name).toEqual(c.author);
+                expect(got?.provenance ?? null, c.name).toEqual(c.provenance ?? null);
+                expect(ids(await store.list(c.g)), c.name).toEqual([c.m.id]);
+                expect(ids(await store.lexical(c.g, 'levelprobe', 10)), c.name).toEqual([c.m.id]);
+                expect(ids(await store.dense(c.g, c.m.embedding, 10)), c.name).toEqual([
+                    c.m.id,
+                ]);
+                const snapshot = (await store.get(c.g, c.m.id));
+                expect((await store.coldPut(c.g, snapshot)).skipped, c.name).toEqual([]);
+                expect(await store.coldGet(c.g, c.m.id), c.name).toEqual(canonicalMemory(snapshot));
+                expect((await store.get(c.g, c.m.id))?.tier, c.name).toBe('cold');
+            }
+        });
+        it('levels.pre-level-grants-see-no-other-level', async () => {
+            for (const c of cases())
+                await store.upsert(c.g, c.m);
+            for (const c of cases())
+                expect(await store.get(PRE_LEVEL, c.m.id), c.name).toBeNull();
+            expect(await store.list(PRE_LEVEL, { validOnly: false })).toEqual([]);
+            expect(await store.lexical(PRE_LEVEL, 'levelprobe', 50)).toEqual([]);
+            expect(await store.dense(PRE_LEVEL, vec(1, 1, -1, 2), 50)).toEqual([]);
+        });
+        it('levels.local-grants-see-the-planet-and-their-own-star', async () => {
+            // CON-62: a person's agents share the Planet; each agent's Star is its own.
+            for (const c of cases())
+                await store.upsert(c.g, c.m);
+            const ccStar = { level: 'agent', orgId: 'local', agentId: 'claude-code' };
+            await store.upsert(nodesGrant(ccStar), memoryAt('cc-star', ccStar, { agentId: 'claude-code' }, { text: 'levelprobe cc star' }));
+            const asClaude = [TG, localGrant({ ...OWNER, projectIds: ['p1', null] })];
+            for (const g of asClaude) {
+                expect(ids(await store.list(g, { validOnly: false })).sort()).toEqual([
+                    'cc-star',
+                    'lv-planet-other-author',
+                ]);
+                expect(ids(await store.lexical(g, 'levelprobe', 50)).sort()).toEqual([
+                    'cc-star',
+                    'lv-planet-other-author',
+                ]);
+                expect(await store.get(g, 'lv-star')).toBeNull();
+                expect(await store.setTier(g, 'lv-star', 'hot')).toBe(false);
+            }
+            const asCursor = localGrant({ ...OWNER, agentId: 'cursor', projectIds: ['p1', null] });
+            expect(ids(await store.list(asCursor, { validOnly: false })).sort()).toEqual([
+                'lv-planet-other-author',
+                'lv-star',
+            ]);
+            expect(await store.get(asCursor, 'cc-star')).toBeNull();
+            expect(ids(await store.dense(asCursor, vec(2, 1, -1, 2), 50))).not.toContain('cc-star');
+        });
+        it('levels.existing-data-unchanged', async () => {
+            const legacy = [
+                makeMemory({ id: 'old-1', text: 'levelprobe orbit one', embedding: vec(1, 1, -1, 2) }),
+                makeMemory({
+                    id: 'old-2',
+                    text: 'levelprobe orbit two',
+                    scope: localScope('p1'),
+                    embedding: vec(2, 1, -1, 2),
+                    pinned: true,
+                }),
+                makeMemory({ id: 'old-3', text: 'levelprobe orbit three', scope: localScope('p2') }),
+            ];
+            await store.upsertMany(TG, legacy);
+            await seedCold(store, makeMemory({ id: 'old-4', text: 'levelprobe cold', embedding: vec(3, 1, -1, 2) }));
+            const g = PRE_LEVEL;
+            const view = async () => {
+                const out = [];
+                for (const id of ['old-1', 'old-2', 'old-3', 'old-4']) {
+                    out.push(render(await store.get(g, id)), render(await store.coldGet(g, id)));
+                }
+                out.push((await store.list(g, { validOnly: false })).map(render).join('|'));
+                out.push(JSON.stringify(await store.dense(g, vec(1, 1, -1, 2), 10)));
+                // bm25 scores use table-wide statistics: compare which memories match.
+                out.push(ids(await store.lexical(g, 'levelprobe orbit', 50))
+                    .sort()
+                    .join(','));
+                return out;
+            };
+            const before = await view();
+            for (const c of cases())
+                await store.upsert(c.g, c.m);
+            expect(await view()).toEqual(before);
+        });
+        it('levels.illegal-addresses-are-refused', async () => {
+            const bad = [
+                [
+                    'planet without customer',
+                    { address: { level: 'user', orgId: 'local' } },
+                ],
+                [
+                    'constellation with a customer',
+                    {
+                        address: {
+                            level: 'hive',
+                            orgId: 'o',
+                            hiveId: 'h',
+                            customerId: 'c',
+                        },
+                    },
+                ],
+                [
+                    'star with a customer',
+                    {
+                        address: {
+                            level: 'agent',
+                            orgId: 'o',
+                            agentId: 'a',
+                            customerId: 'c',
+                        },
+                    },
+                ],
+                [
+                    'flyby without run',
+                    { address: { level: 'run', orgId: 'o', agentId: 'a' } },
+                ],
+                ['unknown level', { address: { level: 'team', orgId: 'o' } }],
+                ['empty owner', { address: { level: 'hive', orgId: '', hiveId: 'h' } }],
+                [
+                    'unknown field',
+                    { address: { level: 'hive', orgId: 'o', hiveId: 'h', extra: 1 } },
+                ],
+                ['empty author', { author: { agentId: '' } }],
+                [
+                    'scope that is not the address',
+                    { address: { level: 'agent', orgId: 'local', agentId: 'cursor' }, scope: localScope() },
+                ],
+            ];
+            const all = nodesGrant({ level: 'user', orgId: 'local', customerId: 'self' }, { level: 'hive', orgId: 'o', hiveId: 'h' }, { level: 'agent', orgId: 'local', agentId: 'cursor' });
+            for (const [what, overrides] of bad) {
+                const m = makeMemory({ id: 'bad', ...overrides });
+                await expect(store.upsert(all, m), what).rejects.toThrow(RangeError);
+                const ok = makeMemory({ id: 'ok' });
+                await expect(store.upsertMany(all, [ok, m]), what).rejects.toThrow(RangeError);
+                expect(await store.get(all, 'ok'), what).toBeNull();
+                expect(await store.get(all, 'bad'), what).toBeNull();
+            }
+        });
+        it('levels.address-and-author-are-fixed-per-id', async () => {
+            const [star, hive] = [LEVEL_CASES[1], LEVEL_CASES[5]];
+            const g = nodesGrant(nodeOf(star.address), nodeOf(hive.address));
+            const m = memoryAt('fixed', star.address, star.author);
+            await store.upsert(g, m);
+            const moved = memoryAt('fixed', hive.address, hive.author);
+            await expect(store.upsert(g, moved)).rejects.toThrow(GrantError);
+            const reauthored = memoryAt('fixed', star.address, {
+                agentId: 'cursor',
+                accountRef: 'acct:2',
+            });
+            await expect(store.upsert(g, reauthored)).rejects.toThrow(GrantError);
+            expect(await store.get(g, 'fixed')).toEqual(canonicalMemory(m));
+        });
+        it('levels.author-restriction-is-exact', async () => {
+            const planet = { level: 'user', orgId: 'local', customerId: 'self' };
+            const mine = makeMemory({ id: 'by-cc', text: 'authorprobe one' });
+            const theirs = memoryAt('by-cursor', { level: 'user', orgId: 'local', customerId: 'self' }, { agentId: 'cursor' }, { text: 'authorprobe two' });
+            const everyone = nodesGrant(planet);
+            await store.upsertMany(everyone, [mine, theirs]);
+            expect(ids(await store.lexical(everyone, 'authorprobe', 10)).sort()).toEqual([
+                'by-cc',
+                'by-cursor',
+            ]);
+            expect(ids(await store.lexical(PRE_LEVEL, 'authorprobe', 10))).toEqual(['by-cc']);
+            // The local grant shares the Planet among the person's agents (CON-62).
+            expect(ids(await store.lexical(TG, 'authorprobe', 10)).sort()).toEqual([
+                'by-cc',
+                'by-cursor',
+            ]);
+            const cursor = nodeGrant({
+                principal: { ...OWNER, agentId: 'cursor' },
+                read: [{ node: planet, projectIds: 'all', authorAgentId: 'cursor' }],
+            });
+            expect(ids(await store.lexical(cursor, 'authorprobe', 10))).toEqual(['by-cursor']);
+            expect(await store.get(cursor, 'by-cc')).toBeNull();
+        });
+        it('levels.multi-node-grant-reads-across-owners', async () => {
+            const all = cases();
+            for (const c of all)
+                await store.upsert(c.g, c.m);
+            const own = makeMemory({ id: 'own', text: 'levelprobe own', embedding: vec(9, 1, -1, 2) });
+            await store.upsert(TG, own);
+            const hive = all.find((c) => c.name === 'constellation');
+            const galaxy = all.find((c) => c.name === 'galaxy');
+            const star = all.find((c) => c.name === 'star');
+            // My Planet (as before levels) plus a Constellation of another owner, read-only.
+            const g = nodeGrant({
+                principal: OWNER,
+                read: [...TG.readNodes, { node: nodeOf(hive.address), projectIds: ['p1'] }],
+                write: TG.writeNodes,
+            });
+            const other = all.find((c) => c.name === 'planet-other-author');
+            const visible = ['own', other.m.id, hive.m.id].sort();
+            expect(ids(await store.list(g, { validOnly: false })).sort()).toEqual(visible);
+            expect(ids(await store.lexical(g, 'levelprobe', 50)).sort()).toEqual(visible);
+            const dense = await store.dense(g, vec(9, 1, -1, 2), 50);
+            expect(ids(dense).sort()).toEqual(visible);
+            expect(dense.map((h) => h.score)).toEqual(dense.map((h) => h.score).sort((a, b) => b - a));
+            expect(ids(await store.dense(g, vec(9, 1, -1, 2), 1))).toEqual(['own']);
+            expect(await store.get(g, hive.m.id)).toEqual(canonicalMemory(hive.m));
+            for (const c of [galaxy, star])
+                expect(await store.get(g, c.m.id)).toBeNull();
+            // The hive side is read-only.
+            expect(await store.setTier(g, hive.m.id, 'hot')).toBe(false);
+            await store.forget(g, hive.m.id);
+            expect(await store.get(hive.g, hive.m.id)).not.toBeNull();
+            await expect(store.upsert(g, memoryAt('new-hive', hive.address, hive.author))).rejects.toThrow(GrantError);
+            // A project outside the pattern stays out.
+            const hiveP2 = memoryAt('hive-p2', { ...hive.address, projectId: 'p2' }, hive.author);
+            await store.upsert(hive.g, hiveP2);
+            expect(await store.get(g, 'hive-p2')).toBeNull();
+        });
     });
 }
 //# sourceMappingURL=store-conformance.js.map

package/dist/temporal.js

@@ -1,4 +1,4 @@
-import * as chrono from 'chrono-node';
+import { loadChrono, mayHaveDateCue } from './date-cue.js';
 /**
  * Time handling in code, never in a model (CON-34): relative expressions are resolved with
  * chrono-node against the observation's own timestamp, at day precision, in the turn's UTC
@@ -8,6 +8,13 @@ const DAY_MS = 86_400_000;
 const MIN_MS = 60_000;
 /** chrono's reference: the instant, and the offset in minutes east of UTC. */
 const ref = (at, offset = 0) => ({ instant: at, timezone: offset });
+/**
+ * chrono's parse, loading chrono only for a text with a date cue (CON-82): a text without one
+ * is a text chrono reads nothing the functions below act on.
+ */
+function parse(text, reference, option) {
+    return mayHaveDateCue(text) ? loadChrono().parse(text, reference, option) : [];
+}
 /** Midnight of `d`'s day in the given offset, as an instant. */
 const startOfDay = (d, offset = 0) => {
     const local = new Date(d.getTime() + offset * MIN_MS);
@@ -52,8 +59,8 @@ function leadIn(text, r) {
  */
 export function factInterval(text, at, offset = 0) {
     const out = {};
-    const forward = chrono.parse(text, ref(at, offset), { forwardDate: true });
-    const backward = chrono.parse(text, ref(at, offset), { forwardDate: false });
+    const forward = parse(text, ref(at, offset), { forwardDate: true });
+    const backward = parse(text, ref(at, offset), { forwardDate: false });
     const day = (d) => startOfDay(d, offset);
     for (const r of forward) {
         const lead = leadIn(text, r);
@@ -113,9 +120,7 @@ export function checkWriterDate(turnText, factText, at, offset = 0) {
     if (relatives.length !== 1 || days.length !== 1)
         return { text: factText };
     const isRelative = new RegExp(RELATIVE.source, 'i');
-    const parsed = chrono
-        .parse(turnText, ref(at, offset), { forwardDate: false })
-        .filter((r) => isRelative.test(r.text));
+    const parsed = parse(turnText, ref(at, offset), { forwardDate: false }).filter((r) => isRelative.test(r.text));
     if (parsed.length !== 1)
         return { text: factText };
     const resolved = ymd(parsed[0].start.date(), offset);
@@ -161,7 +166,7 @@ function without(query, part, dangling = false) {
  * in November is this year's March).
  */
 export function temporalIntent(query, now) {
-    const r = chrono.parse(query, ref(now), { forwardDate: false })[0];
+    const r = parse(query, ref(now), { forwardDate: false })[0];
     let day;
     if (r !== undefined) {
         let d = r.start.date();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oortmem/core",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Oort core: the tiered hot, warm and cold memory engine for AI agents (types, scoring, recall, consolidation).",
   "keywords": [
     "oort",