@pyxmate/memory 0.17.0 → 0.17.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyxmate/memory",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "type": "module",
   "description": "SDK for pyx-memory — Memory as a Service for AI agents",
   "license": "MIT",

package/skills/pyx-memory/patterns/access-control.md

@@ -452,6 +452,25 @@ await memory.store({
 });
 ```
 
+HTTP ingest accepts the same resource coordinate on JSON and file uploads:
+
+```bash
+curl -X POST "$MEMORY_URL/api/memory/ingest" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "X-Tenant-Id: tenant-acme" \
+  -H "X-Namespace-Id: <NS_ID>" \
+  -H "Content-Type: application/json" \
+  -d '{"content":"Q4 revenue projections","type":"long-term"}'
+
+curl -N -X POST "$MEMORY_URL/api/memory/ingest/file" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "X-Tenant-Id: tenant-acme" \
+  -H "X-Namespace-Id: <NS_ID>" \
+  -F "file=@report.pdf"
+```
+
+`X-Namespace-Id` is canonical when both header and body/form field are sent; conflicting values return `400 namespace_id_conflict`. A missing or cross-tenant namespace returns `404 namespace_not_found`.
+
 No bulk migration is required — legacy data keeps working unchanged.
 
 ### Migrating legacy entries (v0.16.1)

package/skills/pyx-memory/reference/http-api.md

@@ -24,8 +24,8 @@ const client = new MemoryClient('http://localhost:7822', process.env.MEMORY_API_
 |--------|----------|-------------|
 | GET | `/health` | Public health check (status only — no internals exposed) |
 | GET | `/admin/health` | Admin health check (version, uptime, embedding provider, memory stats) |
-| POST | `/api/memory/ingest` | Store a memory (JSON: `{ content, type, metadata, agentId?, sessionId?, targets?, entities?, relationships?, importance?, source?, eventTime?, id?, parentId?, ingestTime?, pinned? }`) |
-| POST | `/api/memory/ingest/file` | Upload file (multipart, 100MB limit). For PDFs with images, returns an `enrichment` block with HMAC token and image metadata for two-phase enrichment. |
+| POST | `/api/memory/ingest` | Store a memory (JSON: `{ content, type, metadata, namespaceId?, agentId?, sessionId?, targets?, entities?, relationships?, importance?, source?, eventTime?, id?, parentId?, ingestTime?, pinned? }`) |
+| POST | `/api/memory/ingest/file` | Upload file (multipart, 100MB limit; optional `namespaceId` field or `X-Namespace-Id` header). For PDFs with images, returns an `enrichment` block with HMAC token and image metadata for two-phase enrichment. |
 | GET | `/api/memory/files/download/:filename` | Download uploaded file binary by filename. Returns the original file with proper Content-Type. Images served inline, documents as attachment. |
 | GET | `/api/memory/files/:fileId/images/:imageId?token=...` | Fetch an extracted PDF image (binary). Requires HMAC token from ingest response. |
 | POST | `/api/memory/files/:fileId/enrich` | Submit image descriptions + entities after LLM vision processing. Requires `X-Enrichment-Token` header. |
@@ -82,6 +82,21 @@ Fine-grained access control inside a tenant — namespaces, principals, group me
 
 Cross-tenant safety: every route verifies the referenced resource belongs to the caller's tenant; mismatches return `404` (not `403`) to avoid existence disclosure.
 
+## Namespaced Ingest (v0.17.1)
+
+`POST /api/memory/ingest` accepts `namespaceId` either in the JSON body or the `X-Namespace-Id` header. `POST /api/memory/ingest/file` accepts the same header or a multipart `namespaceId` field. The header is canonical; sending both channels with different values returns `400 namespace_id_conflict`. Sending JSON `namespaceId: null` is invalid; omit the field to keep the legacy NULL namespace bucket.
+
+When a namespace is supplied, the server resolves it once against the caller tenant before storing. Missing or cross-tenant namespaces return `404 namespace_not_found` so callers cannot distinguish "does not exist" from "exists in another tenant".
+
+```bash
+curl -X POST {{ENDPOINT}}/api/memory/ingest \
+  -H "Authorization: Bearer {{API_KEY}}" \
+  -H "X-Tenant-Id: tenant-acme" \
+  -H "X-Namespace-Id: ns-engineering" \
+  -H "Content-Type: application/json" \
+  -d '{"content":"Q4 revenue projections","type":"long-term"}'
+```
+
 ## Strict Topology Isolation (v0.17.0)
 
 | Method | Endpoint | Description |
@@ -161,6 +176,7 @@ The inner `success: false` flag carries `failureReason` ∈ `{ not_found, cross_
 |-------|------|----------|-------------|
 | `file` | File | Yes | The file to ingest (max 100MB) |
 | `description` | string | No | Agent-provided description (e.g., from LLM vision). Used instead of parser output for images. |
+| `namespaceId` | string | No | ReBAC namespace to stamp on every chunk. `X-Namespace-Id` header is preferred when both are present. |
 
 **Supported formats**: `.txt`, `.md`, `.csv`, `.tsv`, `.log`, `.pdf`, `.docx`, `.xlsx`, `.pptx`, `.json`, `.jsonl`, `.html`, `.htm`, `.png`, `.jpg`, `.jpeg`, `.webp`, `.gif`, `.bmp`, `.tiff`, `.svg`