hippo-memory 1.44.0 → 1.46.0

package/dist/src/project-identity.js

@@ -1,200 +0,0 @@
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-const MAX_WALK_DEPTH = 64;
-const identityCache = new Map();
-/** Clear the per-process identity cache (test seam). */
-export function clearProjectIdentityCache() {
-    identityCache.clear();
-}
-/**
- * Canonicalize a path via realpath, falling back to path.resolve when the
- * path does not exist or realpath fails (mirrors importers.ts).
- */
-export function realpathOrResolve(p) {
-    try {
-        return fs.realpathSync.native(p);
-    }
-    catch {
-        return path.resolve(p);
-    }
-}
-/** Compare two canonical paths, case-insensitively on Windows. */
-function samePath(a, b) {
-    if (process.platform === 'win32')
-        return a.toLowerCase() === b.toLowerCase();
-    return a === b;
-}
-function isUnder(child, parent) {
-    const rel = path.relative(parent, child);
-    const under = rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
-    if (under)
-        return true;
-    if (process.platform === 'win32') {
-        const relLower = path.relative(parent.toLowerCase(), child.toLowerCase());
-        return relLower === '' || (!relLower.startsWith('..') && !path.isAbsolute(relLower));
-    }
-    return false;
-}
-/** A `.hippo` marker must be a DIRECTORY (a store) - a stray file named
- *  `.hippo` must not turn its parent into a project. `.git` stays existsSync
- *  because worktrees legitimately use a `.git` FILE. */
-function isDirectoryAt(p) {
-    try {
-        return fs.statSync(p).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Resolve the project identity for a working directory.
- * Defaults to process.cwd(). Results are cached per resolved input path.
- */
-export function resolveProjectIdentity(cwd, opts) {
-    const startInput = path.resolve(cwd ?? process.cwd());
-    const cacheable = !opts?.homeDir && !opts?.stopDir;
-    if (cacheable) {
-        const cached = identityCache.get(startInput);
-        if (cached)
-            return cached;
-    }
-    const home = realpathOrResolve(opts?.homeDir ?? os.homedir());
-    const stopDir = opts?.stopDir ? realpathOrResolve(opts.stopDir) : null;
-    const start = realpathOrResolve(startInput);
-    const { hippoRoot, gitRoot, reachedHome } = walkProjectMarkers(start, home, stopDir === null ? [] : [stopDir]);
-    let identity;
-    const root = hippoRoot ?? gitRoot;
-    if (root !== null) {
-        identity = { root, name: path.basename(root).toLowerCase(), isHome: false };
-    }
-    else if (reachedHome || isUnder(start, home)) {
-        identity = { root: home, name: '', isHome: true };
-    }
-    else {
-        // No markers anywhere: not a project. Empty name keeps these memories
-        // user-global rather than fabricating an origin from a basename.
-        identity = { root: start, name: '', isHome: false };
-    }
-    if (cacheable)
-        identityCache.set(startInput, identity);
-    return identity;
-}
-/** Climb from start toward the root; home (never a project) and every stop dir end the walk unchecked. */
-function walkProjectMarkers(start, home, stopDirs) {
-    let hippoRoot = null;
-    let gitRoot = null;
-    let reachedHome = false;
-    let dir = start;
-    for (let depth = 0; depth < MAX_WALK_DEPTH; depth++) {
-        if (samePath(dir, home)) {
-            reachedHome = true;
-            break;
-        }
-        if (stopDirs.some((stop) => samePath(dir, stop)))
-            break;
-        if (hippoRoot === null && isDirectoryAt(path.join(dir, '.hippo'))) {
-            hippoRoot = dir;
-        }
-        if (gitRoot === null && fs.existsSync(path.join(dir, '.git'))) {
-            gitRoot = dir;
-        }
-        const parent = path.dirname(dir);
-        if (samePath(parent, dir))
-            break; // filesystem root
-        dir = parent;
-    }
-    return { hippoRoot, gitRoot, reachedHome };
-}
-/** Nearest ancestor `.hippo` below home and the temp root (never projects; on Windows the temp root sits inside home).
- *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. Design notes: docs/plans/2026-09-05-*.md */
-export function findHippoStoreDir(cwd, opts) {
-    const home = realpathOrResolve(opts?.homeDir ?? os.homedir());
-    const stops = [realpathOrResolve(os.tmpdir())];
-    if (opts?.stopDir)
-        stops.push(realpathOrResolve(opts.stopDir));
-    const start = realpathOrResolve(cwd ?? process.cwd());
-    const { hippoRoot } = walkProjectMarkers(start, home, stops);
-    return hippoRoot === null ? null : path.join(hippoRoot, '.hippo');
-}
-/**
- * v39 memory scope isolation: classify a memory's origin_project against the
- * active project. `currentName === ''` means the session is not in a project
- * (home dir or markerless cwd) - everything is in scope there, matching
- * pre-isolation behavior. NULL/undefined origin is a legacy pre-v39 row and
- * is treated as cross-project (deny by default) - the safe direction for a
- * security partition.
- */
-export function classifyOriginProject(origin, currentName) {
-    if (currentName === '')
-        return 'project';
-    if (origin === undefined || origin === null)
-        return 'cross-project';
-    if (origin === '')
-        return 'user-global';
-    return origin === currentName ? 'project' : 'cross-project';
-}
-/**
- * The global Hippo store directory, resolved the same way shared.ts does:
- * $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo. Lives here (leaf module) so
- * db.ts migrations can use it without importing shared.ts (store.ts cycle);
- * shared.getGlobalRoot delegates to this.
- */
-export function resolveGlobalRootDir() {
-    const hippoHome = process.env.HIPPO_HOME?.trim();
-    if (hippoHome)
-        return hippoHome;
-    const xdgData = process.env.XDG_DATA_HOME?.trim();
-    if (xdgData)
-        return path.join(xdgData, 'hippo');
-    return path.join(os.homedir(), '.hippo');
-}
-/**
- * True when `p` IS the global store root. Used by the v39 migration so a
- * global store whose parent chain happens to contain `.git`/`.hippo`
- * (git-managed HIPPO_HOME, dotfiles setups) still backfills as user-global
- * ('') instead of being stamped with the surrounding repo's name - which
- * would hide the user's entire global corpus from every project.
- */
-export function isGlobalStoreRoot(p) {
-    return samePath(realpathOrResolve(path.resolve(p)), realpathOrResolve(resolveGlobalRootDir()));
-}
-/**
- * Parse a memory's origin from its provenance `source` string, mirroring the
- * v39 migration's evidence rules: `shared:<project>:<ts>` and
- * `promoted:<localRoot>` identify the owning project; the user home dir's
- * basename maps to '' (user-global). Returns null when the source carries no
- * origin evidence. Pure string logic - recorded paths may no longer exist.
- */
-export function originFromSource(source, homeName) {
-    if (!source)
-        return null;
-    const home = (homeName ?? path.basename(os.homedir())).toLowerCase();
-    const shared = /^shared:([^:]+):/.exec(source);
-    if (shared) {
-        const name = shared[1].toLowerCase();
-        return name === home ? '' : name;
-    }
-    if (source.startsWith('promoted:')) {
-        const promotedPath = source.slice('promoted:'.length).trim();
-        if (!promotedPath)
-            return null;
-        const name = path.basename(path.resolve(promotedPath, '..')).toLowerCase();
-        if (!name)
-            return null;
-        return name === home ? '' : name;
-    }
-    return null;
-}
-/**
- * The origin project to stamp on a memory written from cwd.
- * Returns the project name, or '' for user-global (written at/under home or
- * in a markerless directory) - injectable everywhere. Write sites must always
- * persist this value; a NULL origin_project column is reserved for legacy
- * pre-migration rows, which ambient context treats as deny (see plan
- * docs/plans/2026-07-01-memory-scope-isolation.md "Origin model").
- */
-export function deriveOriginProject(cwd, opts) {
-    return resolveProjectIdentity(cwd, opts).name;
-}
-//# sourceMappingURL=project-identity.js.map

package/dist/src/project-identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"project-identity.js","sourceRoot":"","sources":["../../src/project-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAwC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEzD,wDAAwD;AACxD,MAAM,UAAU,yBAAyB;IACvC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;wDAEwD;AACxD,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,IAAiC;IAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE5C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/G,IAAI,QAAyB,CAAC;IAC9B,MAAM,IAAI,GAAG,SAAS,IAAI,OAAO,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9E,CAAC;SAAM,IAAI,WAAW,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,iEAAiE;QACjE,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,SAAS;QAAE,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD,0GAA0G;AAC1G,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAE,QAA2B;IAClF,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,IAAI,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YACxB,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM;QACxD,IAAI,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClE,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,MAAM,CAAC,kBAAkB;QACpD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED;iIACiI;AACjI,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,IAAiC;IAC/E,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,IAAI,EAAE,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAiC,EACjC,WAAmB;IAEnB,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IACpE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,aAAa,CAAC;IACxC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiC,EACjC,QAAiB;IAEjB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY,EACZ,IAAiC;IAEjC,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC"}

package/dist/src/provenance-coverage.js

@@ -1,23 +0,0 @@
-/**
- * Provenance coverage gate: every `kind='raw'` row must carry both `owner`
- * and `artifact_ref`. Distilled / superseded / archived rows are excluded —
- * those are derivative or terminal, not source receipts. Coverage of 1.0 on
- * a non-empty raw set is the ship gate from the Company Brain scorecard.
- */
-export function buildProvenanceCoverage(entries) {
-    const raws = entries.filter((e) => e.kind === 'raw');
-    const gaps = [];
-    for (const e of raws) {
-        const missing = [];
-        if (!e.owner)
-            missing.push('owner');
-        if (!e.artifact_ref)
-            missing.push('artifact_ref');
-        if (missing.length > 0)
-            gaps.push({ id: e.id, missing });
-    }
-    const rawWithEnvelope = raws.length - gaps.length;
-    const coverage = raws.length === 0 ? 1 : rawWithEnvelope / raws.length;
-    return { rawTotal: raws.length, rawWithEnvelope, coverage, gaps };
-}
-//# sourceMappingURL=provenance-coverage.js.map

package/dist/src/provenance-coverage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provenance-coverage.js","sourceRoot":"","sources":["../../src/provenance-coverage.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAsB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAA+B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,OAAO,GAAiC,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC"}

package/dist/src/rate-limit.js

@@ -1,60 +0,0 @@
-/**
- * Per-key token-bucket rate limiter for inbound /v1/* requests.
- *
- * Bounds api-key-id enumeration (the v0.40 follow-up noted in auth.ts): a
- * client that drains its bucket is denied until it refills. Dependency-free
- * and unit-testable in isolation via the injectable `now`.
- */
-/**
- * Build a token-bucket limiter. Memory is bounded two ways: a sweep (throttled
- * to once per `idleEvictMs`) drops idle buckets, and a hard `maxKeys` cap evicts
- * the least-recently-used key, so a client rotating source addresses cannot
- * grow the map without bound between sweeps.
- */
-export function createRateLimiter(opts) {
-    const { ratePerSec, burst, idleEvictMs, maxKeys } = opts;
-    const buckets = new Map();
-    let lastSweep = 0;
-    function sweep(now) {
-        if (now - lastSweep < idleEvictMs)
-            return;
-        lastSweep = now;
-        for (const [key, b] of buckets) {
-            if (now - b.last >= idleEvictMs)
-                buckets.delete(key);
-        }
-    }
-    return {
-        check(key, now = Date.now()) {
-            sweep(now);
-            const existing = buckets.get(key);
-            let bucket;
-            if (existing === undefined) {
-                // Unseen key: a full bucket, so a fresh client's first request passes.
-                bucket = { tokens: burst, last: now };
-            }
-            else {
-                // Refill for elapsed time, capped at burst.
-                const refill = ((now - existing.last) / 1000) * ratePerSec;
-                existing.tokens = Math.min(burst, existing.tokens + refill);
-                existing.last = now;
-                bucket = existing;
-                // Drop the old slot so the re-insert below puts the key last in Map
-                // iteration order — Map order then tracks least-recently-used.
-                buckets.delete(key);
-            }
-            const allowed = bucket.tokens >= 1;
-            if (allowed)
-                bucket.tokens -= 1;
-            // Hard cap: evict the LRU key (first in iteration order) before inserting.
-            if (buckets.size >= maxKeys) {
-                const lru = buckets.keys().next().value;
-                if (lru !== undefined)
-                    buckets.delete(lru);
-            }
-            buckets.set(key, bucket);
-            return allowed;
-        },
-    };
-}
-//# sourceMappingURL=rate-limit.js.map

package/dist/src/rate-limit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,SAAS,KAAK,CAAC,GAAW;QACxB,IAAI,GAAG,GAAG,SAAS,GAAG,WAAW;YAAE,OAAO;QAC1C,SAAS,GAAG,GAAG,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC/B,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;YACzC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEX,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,MAAc,CAAC;YACnB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,uEAAuE;gBACvE,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;gBAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;gBAC5D,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;gBACpB,MAAM,GAAG,QAAQ,CAAC;gBAClB,oEAAoE;gBACpE,+DAA+D;gBAC/D,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YACnC,IAAI,OAAO;gBAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAEhC,2EAA2E;YAC3E,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACxC,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAEzB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/raw-archive-mirror-cleanup.js

@@ -1,55 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-const LAYERS = ['episodic', 'buffer', 'semantic'];
-const MAX_WARN_LOGS = 5;
-/**
- * Path A backfill cleanup: existing raw_archive rows that were archived BEFORE
- * commit 70180b5 left their markdown mirrors at <hippoRoot>/<layer>/<id>.md
- * with original content intact. The DB is already redacted via migration v20;
- * this function deletes those filesystem mirrors so RTBF holds for historical
- * archives too.
- *
- * Per-row tracking via raw_archive.mirror_cleaned_at (added in v21):
- *   - SELECT only rows WHERE mirror_cleaned_at IS NULL.
- *   - On success (every layer either deleted or didn't exist), UPDATE the row
- *     with the cleanup timestamp.
- *   - On any unlink failure, leave mirror_cleaned_at NULL so the next
- *     openHippoDb call retries. Warn (capped at MAX_WARN_LOGS rows per call).
- *
- * Steady-state cost is one SELECT returning empty after every row has been
- * cleaned successfully.
- */
-export function cleanupArchivedMirrors(hippoRoot, db) {
-    // SAFETY: the SELECT above names exactly one column, memory_id (raw_archive.memory_id
-    // is NOT NULL TEXT), so the row shape matches this assertion.
-    const rows = db
-        .prepare(`SELECT memory_id FROM raw_archive WHERE mirror_cleaned_at IS NULL`)
-        .all();
-    if (rows.length === 0)
-        return;
-    const update = db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`);
-    const now = new Date().toISOString();
-    let warnCount = 0;
-    for (const row of rows) {
-        let allOk = true;
-        for (const layer of LAYERS) {
-            const filePath = path.join(hippoRoot, layer, `${row.memory_id}.md`);
-            try {
-                if (fs.existsSync(filePath)) {
-                    fs.unlinkSync(filePath);
-                }
-            }
-            catch (err) {
-                allOk = false;
-                if (warnCount < MAX_WARN_LOGS) {
-                    console.warn(`cleanupArchivedMirrors: unlink failed for ${filePath} (will retry on next DB open):`, err);
-                    warnCount += 1;
-                }
-            }
-        }
-        if (allOk) {
-            update.run(now, row.memory_id);
-        }
-    }
-}
-//# sourceMappingURL=raw-archive-mirror-cleanup.js.map

package/dist/src/raw-archive-mirror-cleanup.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"raw-archive-mirror-cleanup.js","sourceRoot":"","sources":["../../src/raw-archive-mirror-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,MAAM,MAAM,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAC3D,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,EAAoB;IAC5E,sFAAsF;IACtF,8DAA8D;IAC9D,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,mEAAmE,CAAC;SAC5E,GAAG,EAAkC,CAAC;IAEzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,GAAG,KAAK,CAAC;gBACd,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CACV,6CAA6C,QAAQ,gCAAgC,EACrF,GAAG,CACJ,CAAC;oBACF,SAAS,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/raw-archive.js

@@ -1,91 +0,0 @@
-import { isFtsAvailable } from './db.js';
-import { appendAuditEvent } from './audit.js';
-import { markSummaryDirtyInTx } from './store.js';
-export function archiveRawMemory(db, id, opts) {
-    // SAFETY: SELECT * FROM memories returns every column of the memories table; only
-    // kind, tenant_id, and dag_parent_id are read below, all guaranteed present (possibly
-    // null) by the memories schema.
-    const row = db.prepare(`SELECT * FROM memories WHERE id = ?`).get(id);
-    if (!row)
-        throw new Error(`memory not found: ${id}`);
-    if (row.kind !== 'raw') {
-        throw new Error(`memory ${id} is not raw (kind=${String(row.kind)})`);
-    }
-    // SAVEPOINT (not BEGIN) so this works whether or not we're already inside a
-    // transaction. SQLite refuses BEGIN within a transaction; SAVEPOINT nests safely.
-    db.exec('SAVEPOINT archive_raw');
-    try {
-        // GDPR Path A (v0.39): raw_archive stores ONLY metadata, not the original
-        // memory content. The audit_log row appended below carries op='archive_raw'
-        // for the compliance audit trail. True right-to-be-forgotten — the original
-        // content is unrecoverable from raw_archive after this point.
-        const archivedAt = new Date().toISOString();
-        const redactedPayload = JSON.stringify({
-            redacted: true,
-            archived_at: archivedAt,
-            tenant_id: row.tenant_id ?? 'default',
-            kind: row.kind,
-            reason: opts.reason,
-        });
-        db.prepare(`INSERT INTO raw_archive (memory_id, archived_at, reason, archived_by, payload_json) VALUES (?, ?, ?, ?, ?)`).run(id, archivedAt, opts.reason, opts.who, redactedPayload);
-        // Flip kind to 'archived' so the BEFORE DELETE trigger no longer fires, then delete.
-        db.prepare(`UPDATE memories SET kind = 'archived' WHERE id = ?`).run(id);
-        db.prepare(`DELETE FROM memories WHERE id = ?`).run(id);
-        // FTS5 is a virtual table — no FK CASCADE applies. Purge the FTS row so the
-        // archived content is not searchable after archive. Without this the original
-        // raw text remains in memories_fts until the next DB-open backfill, defeating
-        // GDPR right-to-be-forgotten.
-        if (isFtsAvailable(db)) {
-            try {
-                db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(id);
-            }
-            catch {
-                // Best effort only. The DELETE on memories already succeeded; FTS will
-                // self-heal on next DB open via backfillFtsIndex.
-            }
-        }
-        // A5 audit: emit archive_raw event inside the SAVEPOINT so the audit row is
-        // committed atomically with the row deletion. Use the row's own tenant_id
-        // (fetched above as part of SELECT *), not the env. Archives must be
-        // attributed to the tenant that owns the row, not whatever HIPPO_TENANT
-        // happens to be set to in the calling shell.
-        try {
-            appendAuditEvent(db, {
-                tenantId: String(row.tenant_id ?? 'default'),
-                actor: opts.who || 'cli',
-                op: 'archive_raw',
-                targetId: id,
-                metadata: { reason: opts.reason },
-            });
-        }
-        catch {
-            // Audit must not crash the archive. Failures here mean the audit table
-            // is unwritable; the archive itself has already succeeded.
-        }
-        // v0.30 / E2 — DAG live-coupling: archive of a child under a level-2
-        // summary marks parent dirty. Inside the SAVEPOINT so the dirty-mark
-        // commits atomically with the archive. row.dag_parent_id was fetched
-        // via SELECT * at L28 (schema v28 includes it).
-        if (row.dag_parent_id) {
-            markSummaryDirtyInTx(db, String(row.dag_parent_id), String(row.tenant_id ?? 'default'), opts.who || 'cli');
-        }
-        // afterArchive hook (v0.39 commit 3): connector-level idempotency markers
-        // (e.g. slack_event_log) must commit atomically with the archive itself.
-        // Throwing here rolls back the entire SAVEPOINT — both the archive and any
-        // hook side effects. The hook runs INSIDE the SAVEPOINT so its writes
-        // share the archive's transactional fate.
-        if (opts.afterArchive) {
-            opts.afterArchive(db, id);
-        }
-        db.exec('RELEASE SAVEPOINT archive_raw');
-    }
-    catch (e) {
-        try {
-            db.exec('ROLLBACK TO SAVEPOINT archive_raw');
-            db.exec('RELEASE SAVEPOINT archive_raw');
-        }
-        catch { /* savepoint already discarded; keep the original error */ }
-        throw e;
-    }
-}
-//# sourceMappingURL=raw-archive.js.map

package/dist/src/raw-archive.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"raw-archive.js","sourceRoot":"","sources":["../../src/raw-archive.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA+BlD,MAAM,UAAU,gBAAgB,CAAC,EAAoB,EAAE,EAAU,EAAE,IAAiB;IAClF,kFAAkF;IAClF,sFAAsF;IACtF,gCAAgC;IAChC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,CAEvD,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,qBAAqB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,kFAAkF;IAClF,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;YACrC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CACR,4GAA4G,CAC7G,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC9D,qFAAqF;QACrF,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,8BAA8B;QAC9B,IAAI,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,6CAA6C;QAC7C,IAAI,CAAC;YACH,gBAAgB,CAAC,EAAE,EAAE;gBACnB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;gBAC5C,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,KAAK;gBACxB,EAAE,EAAE,aAAa;gBACjB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,2DAA2D;QAC7D,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,gDAAgD;QAChD,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACtB,oBAAoB,CAClB,EAAE,EACF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EACzB,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC,EAClC,IAAI,CAAC,GAAG,IAAI,KAAK,CAClB,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAC7C,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC,CAAC,0DAA0D,CAAC,CAAC;QACtE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}