hippo-memory 1.69.0 → 1.70.0

package/dist/server/types.d.ts

@@ -1,8 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { Context } from '../api.js';
-import type { JsonValue } from '../json.js';
-import type { RateLimiter } from '../rate-limit.js';
-import type { HippoStore, StoreGroup } from '../store-port.js';
+import type { Context } from '../api/index.js';
+import type { JsonValue } from '../util/json.js';
+import type { RateLimiter } from './rate-limit.js';
+import type { HippoStore, StoreGroup } from '../store/index.js';
 export interface ServerHandle {
     port: number;
     url: string;
@@ -46,15 +46,24 @@ export interface ServeOpts {
     authResolverTimeoutMs?: number;
     port?: number;
     host?: string;
-    /** Stop and exit on SIGINT/SIGTERM. Only `hippo serve` owns the process, so only it sets this. */
+    /** Stop and exit on SIGINT/SIGTERM, and drain then exit 1 on an uncaught exception or unhandled rejection. Only `hippo serve` owns the process, so only it sets this. */
     handleSignals?: boolean;
     /** How long stop() lets in-flight requests finish before closing their sockets; defaults to 5000 ms. */
     shutdownDrainMs?: number;
+    /** How long a request may stay unanswered before one warn names it; the request itself is left alone. Defaults to 60000 ms. */
+    slowRequestWarnMs?: number;
     /** Defaults to hippo.db under `hippoRoot`. A store of another kind runs only the routes ported to it; its caller closes it. */
     store?: HippoStore;
     autoSleep?: false;
     routes?: readonly AddonRoute[];
     mintBodyDeadlineMs?: number;
+    /** Tests only: shortens the wait for a signed webhook's body, which defaults to 10 s. */
+    webhookBodyDeadlineMs?: number;
+    /** PEM certificate and key: serve() then answers HTTPS only. Unset means cleartext HTTP, which needs a TLS-terminating proxy in front on any non-loopback bind. */
+    tls?: {
+        cert: string | Buffer;
+        key: string | Buffer;
+    };
     /** Static JSON served to anyone at GET <path>; built once at boot and never authenticated, so it must hold nothing secret. */
     publicJson?: Readonly<Record<string, JsonValue>>;
     /** Request limits: perCaller after auth; perAddress replaces HIPPO_V1_RPS when set, 'off' disables it; failedAuthPerAddress guards scrypt. */
@@ -77,11 +86,20 @@ export interface RouteRequest {
     opts: ResolvedServeOpts;
     query: URLSearchParams;
 }
-/** One /v1 route: an exact path, a matchPath pattern, or a regex, each paired with the handler for one method. Under another store it runs only when that store has its `storeReady` group. */
+/** A route's store status: a `storeReady` group, a `sqliteOnly` reason, or neither while it waits for a group; never both. */
+type StoreStatus = {
+    storeReady?: StoreGroup;
+    sqliteOnly?: never;
+} | {
+    sqliteOnly: string;
+    storeReady?: never;
+};
+/** One /v1 route: an exact path, a matchPath pattern, or a regex, each paired with the handler for one method. Under another store it runs only when that store has its `storeReady` group; a `sqliteOnly` route never does.
+ *  `loop: 'off'` declares that the route's SQLite work runs on a worker thread, so its handler opens no hippo.db on the server thread. */
 export type Route = {
     method: string;
-    storeReady?: StoreGroup;
-} & ({
+    loop?: 'off';
+} & StoreStatus & ({
     path: string;
     handler: (r: RouteRequest) => Promise<void>;
 } | {
@@ -91,4 +109,5 @@ export type Route = {
     regex: RegExp;
     handler: (r: RouteRequest, match: RegExpMatchArray) => Promise<void>;
 });
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/server/validation.d.ts

@@ -1,9 +1,8 @@
 import type { IncomingMessage } from 'node:http';
-import type { Context, RememberOpts } from '../api.js';
-import { type JsonValue } from '../json.js';
-export declare function isJsonNumber(value: JsonValue | undefined): value is number;
-export declare function isJsonBoolean(value: JsonValue | undefined): value is boolean;
+import type { Context, RememberOpts } from '../api/index.js';
+import { type JsonValue } from '../util/json.js';
 export declare function isSetMember<T extends string>(set: ReadonlySet<T>, value: string): value is T;
+export declare const MAX_LIST_LIMIT = 1000;
 export declare function parseListLimit(limitRaw: string | null, defaultLimit?: number, maxLimit?: number): number;
 /** `_authed` is proof the caller passed auth, so a full-size body is read only for an authenticated caller; the key mint reads first under its own small cap. */
 export declare function parseJsonBody(req: IncomingMessage, _authed: Context): Promise<Record<string, JsonValue>>;

package/dist/server/validation.js

@@ -1,11 +1,5 @@
-import { HttpError, isJsonObjectRecord, MAX_ID_LEN, readBody } from '../http-util.js';
-import { isJsonString } from '../json.js';
-export function isJsonNumber(value) {
-    return typeof value === 'number';
-}
-export function isJsonBoolean(value) {
-    return typeof value === 'boolean';
-}
+import { HttpError, MAX_ID_LEN, readBody } from '../util/http-util.js';
+import { isJsonString, isJsonObject } from '../util/json.js';
 // Runtime membership check for a `ReadonlySet<T>` of string-literal union
 // members, used at every `body` field validated against a VALID_* set below.
 // Set<T>.has(value: T) itself gives no narrowing (its parameter type is T,
@@ -21,7 +15,8 @@ export function isSetMember(set, value) {
 }
 // Number.isInteger, not isFinite: SQLite `LIMIT ?` rejects "1.5" with a 500.
 // Shared by every first-class-object list route so the guard cannot drift.
-export function parseListLimit(limitRaw, defaultLimit = 100, maxLimit = 1000) {
+export const MAX_LIST_LIMIT = 1000;
+export function parseListLimit(limitRaw, defaultLimit = 100, maxLimit = MAX_LIST_LIMIT) {
     if (limitRaw === null)
         return defaultLimit;
     const limit = Number(limitRaw);
@@ -39,7 +34,7 @@ export function parseJsonObjectText(raw) {
         return {};
     try {
         const parsed = JSON.parse(raw);
-        if (!isJsonObjectRecord(parsed)) {
+        if (!isJsonObject(parsed)) {
             throw new HttpError(400, 'request body must be a JSON object');
         }
         return parsed;
@@ -67,7 +62,7 @@ export function getCallerProject(body) {
     const v = body.project;
     if (v === undefined || v === null)
         return undefined;
-    if (!isJsonObjectRecord(v) || !isJsonString(v.name)) {
+    if (!isJsonObject(v) || !isJsonString(v.name)) {
         throw new HttpError(400, 'project must be an object with a "name" string');
     }
     if (v.aliases === undefined)

package/dist/server.d.ts

@@ -1,81 +1,59 @@
-import { type Actor, authCreateSelf, type AuthCreateSelfOpts, type AuthCreateSelfResult, authRevoke, type AuthRevokeReply, type AuthRevokeResult, type Context } from './api.js';
-import { ForbiddenError, NotFoundError } from './api-errors.js';
-import type { ServeOpts, ServerHandle } from './server/types.js';
+import { type Actor, authCreateSelf, type AuthCreateSelfOpts, type AuthCreateSelfResult, authRevoke, type AuthRevokeReply, type AuthRevokeResult, type Context } from './api/index.js';
+import { ForbiddenError, NotFoundError } from './core/api-errors.js';
+export { serve } from './server/boot.js';
 export { authCreateSelf, authRevoke, ForbiddenError, NotFoundError, type AuthCreateSelfOpts, type AuthCreateSelfResult, type AuthRevokeReply, type AuthRevokeResult, type Context, type Actor, };
-export { isCrossSite, LOOPBACK_HOST_HEADER } from './http-util.js';
+export { isCrossSite, LOOPBACK_HOST_HEADER } from './util/http-util.js';
 export { __resetSessionRecallHistoryHttp } from './server/routes/recall.js';
 export { clientIpForRateLimit } from './server/client-ip.js';
 export { isLoopback, isReservedActor } from './server/auth.js';
 export type { AddonCall, AddonRoute, AuthResolver, RateLimitSpec, ResolvedBearer, ServeOpts, ServerHandle } from './server/types.js';
-export { HttpError } from './http-util.js';
-export { promptHookContext, type CallerProject } from './prompt-hook.js';
-export type { JsonValue } from './json.js';
+export { HttpError } from './util/http-util.js';
+export { promptHookContext, type CallerProject } from './api/prompt-hook.js';
+export type { JsonValue } from './util/json.js';
 export { captureSessionTexts, type SessionCaptureRequest, type SessionCaptureResult } from './capture/session-texts.js';
-export { hasGroup, sqliteStore, type AmbientCandidateRequest, type ContextReads, type EntryRemoval, type EntryTarget, type EntryWrite, type EntryWrites, type HippoStore, type KeyAudit, type KeyListQuery, type KeyMint, type KeyRevoke, type KeyWrites, type OutcomeWrite, type RawArchive, type RecallSearchArgs, type RecallWrites, type SelfKeyMint, type StoreGroup, type StoreGroups, type SupersedeWrite, type VectorReads, type VectorBackfillQuery, type VectorRowWrite, type VectorWrite, type VectorWriteResult, type VectorWrites, } from './store-port.js';
-export { entryAfterOutcome } from './memory.js';
-export { rejectionDigest, RejectedValueError } from './rejection.js';
-export { ownScopeTouches } from './recall-scope.js';
-export { BadRequestError, ConflictError } from './api-errors.js';
+export { hasGroup, sqliteStore, type AmbientCandidateRequest, type ContextReads, type EntryRemoval, type EntryTarget, type EntryWrite, type EntryWrites, type HippoStore, type KeyAudit, type KeyListQuery, type KeyMint, type KeyRevoke, type KeyWrites, type OutcomeWrite, type RawArchive, type RecallSearchArgs, type RecallWrites, type SelfKeyMint, type StoreGroup, type StoreGroups, type SupersedeWrite, type VectorReads, type VectorBackfillQuery, type VectorRowWrite, type VectorWrite, type VectorWriteResult, type VectorWrites, } from './store/index.js';
+export { entryAfterOutcome } from './core/memory.js';
+export { rejectionDigest, RejectedValueError } from './store/rejection.js';
+export { ownScopeTouches } from './store/recall-scope.js';
+export { BadRequestError, ConflictError } from './core/api-errors.js';
 export type { HippoDbContext, StoreReply } from './api/types.js';
-export type { ApiKeyListItem, ApiKeyListRow, ApiKeyRecord, ListApiKeysOpts, NewApiKey } from './auth.js';
-export type { KeysetPosition } from './keyset.js';
-export type { AppendAuditOpts, AuditEvent, ListAuditAfterOpts } from './audit.js';
+export type { ApiKeyListItem, ApiKeyListRow, ApiKeyRecord, ListApiKeysOpts, NewApiKey } from './store/auth.js';
+export type { KeysetPosition } from './util/keyset.js';
+export type { AppendAuditOpts, AuditEvent, ListAuditAfterOpts } from './store/audit.js';
 export type { ContinuityBlock } from './api/recall-types.js';
-export type { ActiveGoals, GetActiveGoalsOpts, Goal, GoalRecallLogRow, RetrievalPolicy } from './goals.js';
-export type { MemoryEntry } from './memory.js';
-export type { ClassResolution, PlanningFallacyEvidence } from './predictions/planning-fallacy.js';
-export type { PredictionBaserate } from './predictions/store.js';
-export type { RecallTraceInput } from './recall-trace.js';
+export type { ActiveGoals, GetActiveGoalsOpts, Goal, GoalRecallLogRow, RetrievalPolicy } from './store/goals.js';
+export type { MemoryEntry } from './core/memory.js';
+export type { ClassResolution, PlanningFallacyEvidence } from './store/planning-fallacy-evidence.js';
+export type { PredictionBaserate } from './store/predictions.js';
+export type { RecallTraceInput } from './store/recall-trace.js';
 export type { StrengthenOptions } from './store/entry-writes.js';
 export type { OriginFilter, RecallScopeFilter, VectorCandidateSpec } from './store/search-rows.js';
 export type { ContinuityKey } from './store/sessions.js';
 export type { SessionEvent, TaskSnapshot } from './store/rows.js';
-export type { SessionHandoff } from './handoff.js';
+export type { SessionHandoff } from './core/handoff.js';
 export type { AmbientLoadResult, AmbientRecallRequest, ContextCandidateFilter, RecentOrigins } from './store/candidates.js';
-export type { AmbientStoreFilter } from './ambient-store.js';
-export type { AmbientTallies } from './ambient.js';
-export type { TokenUse } from './token-ledger.js';
-export type { EmbeddingIndexState } from './embeddings.js';
-export type { PhysicsParticle } from './physics.js';
-export { StoreBusyError } from './db.js';
-export { decodeVector, EMBEDDING_MODEL_META_KEY, encodeVector, rankVectorRows, type VectorMatch, type VectorRow } from './vector-store.js';
-export { bufferToFloat32, float32ToBuffer } from './physics-state.js';
-export { replacesIndex } from './embeddings.js';
-export { passesScopeFilterForRecall, RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
-export { SECRET_TAGS } from './secret-detect.js';
-export { tallyAmbientEntries } from './ambient.js';
-export { ftsTermParts, rarestFtsQuery } from './prompt-recall.js';
-export { OTHER_STORE_MARKER, OtherStoreFolderError, withSqliteAllowed } from './db.js';
-export { authCreate, type AuthCreateOpts, type AuthCreateResult } from './api.js';
-export { isSharedStore } from './config.js';
-export { ownerOrSubject } from './api.js';
-export { bindSessionOwner } from './session-owners.js';
+export type { AmbientStoreFilter } from './store/ambient.js';
+export type { AmbientTallies } from './core/ambient.js';
+export type { TokenUse } from './store/token-ledger.js';
+export type { EmbeddingIndexState } from './store/embeddings/index.js';
+export type { PhysicsParticle } from './core/physics.js';
+export { StoreBusyError } from './db/index.js';
+export { decodeVector, EMBEDDING_MODEL_META_KEY, encodeVector, rankVectorRows, type VectorMatch, type VectorRow } from './db/vector-store.js';
+export { bufferToFloat32, float32ToBuffer } from './db/physics-state.js';
+export { replacesIndex } from './store/embeddings/index.js';
+export { passesScopeFilterForRecall, RECALL_DEFAULT_DENY_SCOPES } from './store/recall-scope.js';
+export { SECRET_TAGS } from './util/secret-detect.js';
+export { tallyAmbientEntries } from './core/ambient.js';
+export { ftsTermParts, rarestFtsQuery } from './core/prompt-recall.js';
+export { OTHER_STORE_MARKER, OtherStoreFolderError, withSqliteAllowed } from './db/index.js';
+export { authCreate, type AuthCreateOpts, type AuthCreateResult } from './api/index.js';
+export { isSharedStore } from './core/config.js';
+export { ownerOrSubject } from './api/index.js';
+export { bindSessionOwner } from './api/session-owners.js';
 export { preCompactForCaller, type CallerHookOutput, type CallerPreCompactRequest } from './capture/pre-compact-caller.js';
 export { compactResumeForCaller, type CallerCompactResumeRequest } from './capture/compact-resume-caller.js';
 export { saveCompactionItemsForCaller, type CallerItemsRequest, type CallerItemsResult } from './capture/compaction-items-caller.js';
 export { captureFailureForCaller, type CallerFailureRequest, type CallerFailureResult } from './capture/failure-caller.js';
 export { sessionEndHandoffForCaller, type CallerEvidence, type CallerSessionEndRequest, type CallerSessionEndResult } from './capture/session-end-caller.js';
 export type { WorkingState } from './capture/working-state.js';
-/**
- * Boot the HTTP daemon on host:port and write the pidfile under hippoRoot.
- *
- * Refuses non-loopback hosts at boot unless
- * HIPPO_REQUIRE_AUTH=1 is set. The auth middleware (buildContextWithAuth /
- * requireAuth) has shipped and every route checks it except GET /health
- * (public by design for platform health checks) and the two connector
- * webhooks in PUBLIC_ROUTES, which are HMAC-gated by their own signing
- * secrets and 404 when those secrets are unset, and any publicJson GET path. But the loopback
- * no-auth fallback inside buildContextWithAuth still admits unauthenticated
- * requests from a loopback remote address (unless they carry Forwarded,
- * X-Forwarded-For/-Host/-Proto, X-Real-IP, Cf-Connecting-Ip or True-Client-Ip, which mark a same-host proxy and get
- * a 401 like any keyless remote request), so binding to a non-loopback host
- * is only safe once that fallback is disabled with HIPPO_REQUIRE_AUTH=1,
- * which forces every request (loopback or not) through Bearer-token
- * validation. Without that env var set, a non-loopback bind would expose the
- * DB to the network with no auth, so we fail fast instead.
- *
- * Use port: 0 in tests to bind to an ephemeral port and read the actual
- * port back via server.address() after listen.
- */
-export declare function serve(opts: ServeOpts): Promise<ServerHandle>;
 //# sourceMappingURL=server.d.ts.map