hippo-memory 1.61.0 → 1.63.0

package/dist/ambient-store.d.ts

@@ -2,10 +2,10 @@ import { type AmbientTallies } from './ambient.js';
 /** The rows an ambient summary describes: a context read's envelope, origin partition and tag secret veto. */
 export interface AmbientStoreFilter {
     exactScope?: string;
-    /** Rows of this project and user-global rows pass; absent admits every origin. */
-    project?: string;
-    /** The reader's project: a secret-tagged row counts only inside its own non-empty origin project. */
-    currentProject: string;
+    /** Rows carrying one of these project names, and user-global rows, pass; absent admits every origin. */
+    project?: readonly string[];
+    /** The reader's project names: a secret-tagged row counts only inside its own non-empty origin project. */
+    currentProject: readonly string[];
     now: Date;
 }
 /** Whole-store ambient tallies in one aggregate pass, no row loaded. Content-pattern secrets and session-local

package/dist/ambient-store.js

@@ -3,6 +3,7 @@ import { strengthSql } from './memory.js';
 import { RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
 import { SECRET_TAGS } from './secret-detect.js';
 import { openStore } from './store/open.js';
+import { originInSql } from './project-identity.js';
 import { isErrorTagged } from './ambient.js';
 // A malformed or non-array JSON list reads as empty, as parseJsonArray does, instead of failing json_each.
 const jsonList = (column) => `(CASE WHEN json_valid(${column}) AND json_type(${column}) = 'array' THEN ${column} ELSE '[]' END)`;
@@ -19,8 +20,8 @@ function contextRowsWhere(tenantId, filter) {
         params.push(...RECALL_DEFAULT_DENY_SCOPES);
     }
     if (filter.project !== undefined) {
-        where.push(`(origin_project = '' OR origin_project = ?)`);
-        params.push(filter.project);
+        where.push(`(origin_project = '' OR ${originInSql(filter.project)})`);
+        params.push(...filter.project);
     }
     return { where, params };
 }
@@ -57,7 +58,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       '[' || COALESCE(group_concat(${jsonList('tags_json')}, ','), '') || ']' AS tagLists
       FROM memories
       WHERE ${where.join(' AND ')}
-        AND ((origin_project = ? AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, filter.currentProject, ...secret.params);
+        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, ...filter.currentProject, ...secret.params);
         const tagCounts = new Map();
         let errors = 0;
         const lists = /* SAFETY: jsonList yields an array per row, joined into one array */ JSON.parse(row.tagLists);

package/dist/api/assemble.d.ts

@@ -1,6 +1,7 @@
 import type { Context } from './types.js';
+export declare const DEFAULT_ASSEMBLE_BUDGET = 4000;
 export interface AssembleOpts {
-    /** Token budget. Default 4000. */
+    /** Token budget. Default DEFAULT_ASSEMBLE_BUDGET. */
     budget?: number;
     /** Recent raw rows always kept verbatim. Default 10. */
     freshTailCount?: number;
@@ -8,7 +9,7 @@ export interface AssembleOpts {
      *  ancestor. Default true. */
     summarizeOlder?: boolean;
     /**
-     * Restrict to a specific scope. v1.6.1 senior-review P1 #3 parity with
+     * Restrict to a specific scope, same rule as
      * `recall`: when set, exact match required (so an authorised caller can
      * assemble a `slack:private:CSEC` session by passing scope explicitly).
      * When undefined, default-deny applies to ANY `<source>:private:*` and
@@ -49,19 +50,15 @@ export interface AssembleResult {
     items: AssembledContextItem[];
     tokens: number;
     /**
-     * Tenant + scope-filtered raw row count for the session — what the caller
-     * could have seen given their grant. Pre-v1.6.1 was pre-filter (confusing
-     * for all-private sessions); pre-v1.6.3 was capped (under-reported on
-     * sessions > rowCap). v1.6.3 reports the FULL post-filter count via a
-     * separate COUNT(*) query so consumers can render "session has N msgs"
-     * accurately even when items[] is the windowed view.
+     * Tenant + scope-filtered raw row count for the session, uncapped by `rowCap`, so
+     * "session has N msgs" stays accurate when items[] is the windowed view.
      */
     totalRaw: number;
     summarized: number;
     evicted: number;
     /**
-     * True when `rowCap` truncated the loaded window. With v1.6.2's NEWEST-cap
-     * semantics, the items[] array represents the freshest tail of the session;
+     * True when `rowCap` truncated the loaded window. The cap keeps the NEWEST
+     * rows, so the items[] array represents the freshest tail of the session;
      * older rows beyond the cap are silently absent. Use `totalRaw - items.length
      * - summarized + ...` to estimate how much you didn't see, or widen `rowCap`.
      */

package/dist/api/assemble.js

@@ -2,6 +2,7 @@
 import { loadEntriesByIds, loadSessionRawMemories, countSessionRawMemories } from '../store/entry-reads.js';
 import { estimateTokens } from '../token-ledger.js';
 import { passesScopeFilterForRecall, assertScopeRequestAllowed } from '../recall-scope.js';
+export const DEFAULT_ASSEMBLE_BUDGET = 4000;
 /**
  * Build a chronologically-ordered context window for a session. Adapts the
  * lossless-claw context-engine pattern to Hippo's score-ranked memory store.
@@ -26,7 +27,7 @@ import { passesScopeFilterForRecall, assertScopeRequestAllowed } from '../recall
  */
 export function assemble(ctx, sessionId, opts = {}) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
-    const budget = opts.budget ?? 4000;
+    const budget = opts.budget ?? DEFAULT_ASSEMBLE_BUDGET;
     const freshTailCount = opts.freshTailCount ?? 10;
     const summarizeOlder = opts.summarizeOlder ?? true;
     const rowCap = opts.rowCap ?? 5000;
@@ -35,17 +36,12 @@ export function assemble(ctx, sessionId, opts = {}) {
     }
     const rows = loadSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, rowCap);
     const truncated = rows.length === rowCap;
-    // v1.6.3 senior-review P0-1: report the FULL post-filter row count even
-    // when the cap windows the loaded set. Pre-v1.6.3 used `scoped.length`
-    // which under-reported on long sessions and made consumers render
-    // wrong "session has N msgs" UX.
+    // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
     const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope));
     let totalRaw;
     if (truncated) {
-        // v1.6.3 codex P1 / senior P0: scope-aware unbounded COUNT. The helper
-        // SQL-encodes the same default-deny rule passesScopeFilterForRecall
-        // applies in TS, so a no-scope caller cannot infer private rows by
-        // comparing totalRaw to items.length on a truncated session.
+        // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
+        // caller cannot infer private rows by comparing totalRaw to items.length.
         totalRaw = countSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, opts.scope);
     }
     else {
@@ -59,58 +55,9 @@ export function assemble(ctx, sessionId, opts = {}) {
     const olderRows = scoped.slice(0, tailStartIdx);
     const tailRows = scoped.slice(tailStartIdx);
     // Substitute parent summaries for older rows that share one.
-    const olderItems = [];
-    let summarized = 0;
-    if (summarizeOlder && olderRows.length > 0) {
-        const olderByParent = new Map();
-        for (const r of olderRows) {
-            if (!r.dag_parent_id)
-                continue;
-            const list = olderByParent.get(r.dag_parent_id) ?? [];
-            list.push(r);
-            olderByParent.set(r.dag_parent_id, list);
-        }
-        const eligibleParentIds = Array.from(olderByParent.keys()).filter((pid) => (olderByParent.get(pid)?.length ?? 0) >= 2);
-        const parents = eligibleParentIds.length > 0
-            ? loadEntriesByIds(ctx.hippoRoot, eligibleParentIds, ctx.tenantId)
-                .filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by)
-                .filter((p) => passesScopeFilterForRecall(p.scope ?? null, opts.scope))
-            : [];
-        const claimedRawIds = new Set();
-        for (const parent of parents) {
-            const claimed = (olderByParent.get(parent.id) ?? []).map((r) => r.id);
-            claimed.forEach((id) => claimedRawIds.add(id));
-            olderItems.push({
-                id: parent.id,
-                content: parent.content,
-                createdAt: parent.earliest_at ?? parent.created,
-                isSummary: true,
-                substitutedFor: claimed,
-                strength: parent.strength,
-            });
-            summarized += claimed.length;
-        }
-        for (const r of olderRows) {
-            if (claimedRawIds.has(r.id))
-                continue;
-            olderItems.push({
-                id: r.id,
-                content: r.content,
-                createdAt: r.created,
-                strength: r.strength,
-            });
-        }
-    }
-    else {
-        for (const r of olderRows) {
-            olderItems.push({
-                id: r.id,
-                content: r.content,
-                createdAt: r.created,
-                strength: r.strength,
-            });
-        }
-    }
+    const { olderItems, summarized } = summarizeOlder && olderRows.length > 0
+        ? substituteSummaries(ctx, olderRows, opts.scope)
+        : { olderItems: olderRows.map(rawItem), summarized: 0 };
     const tailItems = tailRows.map((r) => ({
         id: r.id,
         content: r.content,
@@ -118,15 +65,64 @@ export function assemble(ctx, sessionId, opts = {}) {
         isFreshTail: true,
         strength: r.strength,
     }));
-    // F4 (v1.6.5): byte compare canonical UTC ISO timestamps. ~50× faster than
-    // localeCompare and chronological by virtue of the timestamp invariant
-    // documented in src/memory.ts above MemoryEntry.
+    // Byte compare is chronological for the fixed-form UTC ISO timestamps
+    // (invariant documented in src/memory.ts above MemoryEntry).
     const cmpIso = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
     olderItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
     tailItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
-    let items = [...olderItems, ...tailItems];
     const itemCost = opts.cost?.item ?? ((it) => estimateTokens(it.content));
     const room = budget - (opts.cost?.fixed(Math.max(budget, totalRaw)) ?? 0);
+    const { items, tokens, evicted } = evictToBudget([...olderItems, ...tailItems], itemCost, room);
+    return { sessionId, items, tokens, totalRaw, summarized, evicted, truncated };
+}
+function rawItem(r) {
+    return {
+        id: r.id,
+        content: r.content,
+        createdAt: r.created,
+        strength: r.strength,
+    };
+}
+function substituteSummaries(ctx, olderRows, scope) {
+    const olderItems = [];
+    let summarized = 0;
+    const olderByParent = new Map();
+    for (const r of olderRows) {
+        if (!r.dag_parent_id)
+            continue;
+        const list = olderByParent.get(r.dag_parent_id) ?? [];
+        list.push(r);
+        olderByParent.set(r.dag_parent_id, list);
+    }
+    const eligibleParentIds = Array.from(olderByParent.keys()).filter((pid) => (olderByParent.get(pid)?.length ?? 0) >= 2);
+    const parents = eligibleParentIds.length > 0
+        ? loadEntriesByIds(ctx.hippoRoot, eligibleParentIds, ctx.tenantId)
+            .filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by)
+            .filter((p) => passesScopeFilterForRecall(p.scope ?? null, scope))
+        : [];
+    const claimedRawIds = new Set();
+    for (const parent of parents) {
+        const claimed = (olderByParent.get(parent.id) ?? []).map((r) => r.id);
+        claimed.forEach((id) => claimedRawIds.add(id));
+        olderItems.push({
+            id: parent.id,
+            content: parent.content,
+            createdAt: parent.earliest_at ?? parent.created,
+            isSummary: true,
+            substitutedFor: claimed,
+            strength: parent.strength,
+        });
+        summarized += claimed.length;
+    }
+    for (const r of olderRows) {
+        if (claimedRawIds.has(r.id))
+            continue;
+        olderItems.push(rawItem(r));
+    }
+    return { olderItems, summarized };
+}
+function evictToBudget(start, itemCost, room) {
+    let items = start;
     let tokens = items.reduce((acc, it) => acc + itemCost(it), 0);
     let evicted = 0;
     while (tokens > room && items.length > 0) {
@@ -147,6 +143,6 @@ export function assemble(ctx, sessionId, opts = {}) {
         tokens -= cost;
         evicted++;
     }
-    return { sessionId, items, tokens, totalRaw, summarized, evicted, truncated };
+    return { items, tokens, evicted };
 }
 //# sourceMappingURL=assemble.js.map

package/dist/api/audit.d.ts

@@ -10,8 +10,8 @@ export interface AuditListOpts {
     after?: KeysetPosition;
 }
 /**
- * Read audit events scoped to `ctx.tenantId`. Read-only — no audit emit (matches
- * A5: cmdAuditList does not record a 'recall'-style read event).
+ * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
+ * cmdAuditList, which does not record a 'recall'-style read event).
  */
 export declare function auditList(ctx: Context, opts: AuditListOpts): AuditEvent[];
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -2,8 +2,8 @@
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { queryAuditEvents } from '../audit.js';
 /**
- * Read audit events scoped to `ctx.tenantId`. Read-only — no audit emit (matches
- * A5: cmdAuditList does not record a 'recall'-style read event).
+ * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
+ * cmdAuditList, which does not record a 'recall'-style read event).
  */
 export function auditList(ctx, opts) {
     const db = openHippoDb(ctx.hippoRoot);

package/dist/api/auth.d.ts

@@ -4,8 +4,8 @@ import type { Context } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
     /**
-     * v1.12.3: authorization role for the new key. Defaults to `'admin'` for
-     * back-compat with v1.12.0-v1.12.2 (the api_keys.role column DEFAULT also
+     * Authorization role for the new key. Defaults to `'admin'` for
+     * back-compat with keys minted before roles existed (the api_keys.role column DEFAULT also
      * resolves to 'admin' if omitted from the INSERT). Member keys are
      * 403-blocked from admin-gated routes (e.g. `POST /v1/sleep`).
      */
@@ -15,7 +15,7 @@ export interface AuthCreateResult {
     keyId: string;
     plaintext: string;
     tenantId: string;
-    /** v1.12.3: the role bound to the new key (admin | member). */
+    /** The role bound to the new key (admin | member). */
     role: 'admin' | 'member';
 }
 /**
@@ -36,7 +36,7 @@ export declare function authCreate(ctx: Context, opts: AuthCreateOpts): AuthCrea
  * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
  * regardless of tenant (single-tenant deployments). The API surface is tenant-
  * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only — no audit emit (matches A5).
+ * tenant A must not see tenant B's keys. Read-only, so no audit emit.
  */
 export declare function authList(ctx: Context, opts: {
     active: boolean;
@@ -55,7 +55,7 @@ export declare function authListRows(ctx: Context, opts: {
  * revoke only its own key (checked first), so no caller can probe other key_ids.
  *
  * Audit: emits 'auth_revoke' with `tenantId` set to the KEY ROW's tenant_id
- * (M1 fix from A5 review, mirrors src/cli.ts:cmdAuthRevoke). Skipped on no-op
+ * (mirrors src/cli.ts:cmdAuthRevoke). Skipped on no-op
  * revoke (already revoked) so re-running doesn't pad the audit log.
  */
 export interface AuthRevokeResult {
@@ -72,7 +72,7 @@ export declare function authKeyTenant(ctx: Context, keyId: string): string | und
 export interface AuthGrantResult {
     ok: true;
 }
-/** Grant `keyId` read access to one restricted `scope` (ROADMAP Part VIII EI2). Admin only. */
+/** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;

package/dist/api/auth.js

@@ -27,10 +27,8 @@ export function authCreate(ctx, opts) {
     try {
         const role = opts.role ?? (ctx.actor.viaAuthResolver ? 'member' : 'admin');
         const result = createApiKey(db, { tenantId: ctx.tenantId, label: opts.label, role });
-        // v1.12.4: audit emit (closes the gap v1.12.3 CHANGELOG flagged as deferred).
-        // Mirrors the auth_revoke pattern at authRevoke — same try/catch so audit
-        // failure can't crash a successful mint. The plaintext is NEVER logged;
-        // metadata carries label + role + the keyId (which is non-secret).
+        // Same try/catch as authRevoke so audit failure can't crash a successful mint.
+        // The plaintext is NEVER logged; metadata carries label + role, keyId is non-secret.
         try {
             appendAuditEvent(db, {
                 tenantId: ctx.tenantId,
@@ -59,7 +57,7 @@ export function authCreate(ctx, opts) {
  * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
  * regardless of tenant (single-tenant deployments). The API surface is tenant-
  * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only — no audit emit (matches A5).
+ * tenant A must not see tenant B's keys. Read-only, so no audit emit.
  */
 export function authList(ctx, opts) {
     return authListRows(ctx, opts).map((r) => r.key);
@@ -101,7 +99,7 @@ export function authRevoke(ctx, keyId) {
         if (!alreadyRevoked) {
             try {
                 appendAuditEvent(db, {
-                    tenantId: row.tenantId, // M1: KEY's tenant, not ctx.tenantId.
+                    tenantId: row.tenantId, // KEY's tenant, not ctx.tenantId.
                     actor: ctx.actor.subject,
                     op: 'auth_revoke',
                     targetId: keyId,
@@ -134,7 +132,7 @@ export function authKeyTenant(ctx, keyId) {
         closeHippoDb(db);
     }
 }
-/** Grant `keyId` read access to one restricted `scope` (ROADMAP Part VIII EI2). Admin only. */
+/** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export function authGrant(ctx, keyId, scope) {
     return changeScopeGrant(ctx, keyId, scope, 'auth_grant');
 }

package/dist/api/context-select.d.ts

@@ -0,0 +1,50 @@
+import type { AmbientLoadResult } from '../store/candidates.js';
+import { type MemoryEntry } from '../memory.js';
+import { type HippoConfig } from '../config.js';
+import type { ProjectRef } from '../project-identity.js';
+import type { DeliveryObserver } from '../delivery-recorder.js';
+import type { ContextCost, ContextOpts, ContextResultEntry } from './context-types.js';
+import type { Context } from './types.js';
+/** What getContext resolved from opts and config before it read a row. */
+export interface ContextPlan {
+    pinnedOnly: boolean;
+    limit: number;
+    includeRecent: number;
+    activeScope: string;
+    exactScope: string | undefined;
+    query: string;
+    hasLocal: boolean;
+    hasGlobal: boolean;
+    globalRoot: string;
+    primaryIsGlobal: boolean;
+    hasLocalTaskState: boolean;
+    config: HippoConfig;
+    currentProject: ProjectRef;
+    includeCrossProject: boolean;
+    originProject: readonly string[] | undefined;
+    promptRecallPending: boolean;
+    cost: ContextCost | undefined;
+    price: (entry: MemoryEntry, isGlobal: boolean, promptRecall?: boolean) => number;
+    obs: DeliveryObserver | undefined;
+}
+/** The ambient admit rules; `digestHidden` is read late because a prompt-recall eligibility check can still set it. */
+export interface ContextAdmission {
+    ambientAdmit: (e: MemoryEntry) => boolean;
+    admit: (e: MemoryEntry) => boolean;
+    /** What the two-store search admits: `admit` without the own-session compaction rule. */
+    bothStoresAdmit: (e: MemoryEntry) => boolean;
+    digestHidden: () => boolean;
+}
+export interface ContextPools {
+    local: AmbientLoadResult;
+    global: AmbientLoadResult;
+}
+export declare function oneCopyPerMemory(local: readonly MemoryEntry[], global: readonly MemoryEntry[], now: Date): [MemoryEntry[], MemoryEntry[]];
+export declare const finiteOr: (v: number, dflt: number, min: number) => number;
+/** Pins plus the prompt-recall or recent-N backfill; null means the block is empty. */
+export declare function selectPinned(opts: ContextOpts, plan: ContextPlan, left: number, pools: ContextPools, admission: ContextAdmission): ContextResultEntry[] | null;
+/** No query: the strongest memories by strength, up to budget. */
+export declare function selectStrongest(plan: ContextPlan, left: number, pools: ContextPools): ContextResultEntry[];
+/** Real query: hybrid search over both stores, or physics/hybrid over the local rows; emits the 'recall' audit row. */
+export declare function selectBySearch(ctx: Context, plan: ContextPlan, left: number, pools: ContextPools, admission: ContextAdmission): Promise<ContextResultEntry[]>;
+//# sourceMappingURL=context-select.d.ts.map