hippo-memory 1.69.0 → 1.71.0

package/dist/project-briefs.js

@@ -1,523 +0,0 @@
-/**
- * Project_brief first-class object.
- *
- * A `project_brief` is the living, repo-scoped summary of a repository's state: a
- * `summary` body scoped to a `repo`, evolving via the supersede delta lifecycle.
- * "Auto-refreshes from receipts" is scoped to a DETERMINISTIC (no-LLM) assembler:
- * `refreshBrief` gathers the repo's recent receipts (memory rows tagged
- * `path:<repo>`) and assembles them into the brief body. The distinguishing
- * capability is therefore the refresh assembler (analog of skill's export
- * renderer), not an LLM/async pipeline (deferred).
- *
- * Reuses the skill/process supersede machinery verbatim (superseded_by self-FK +
- * CAS + INSERT-preflight + server-derived version + change_summary + supersede
- * tenant-match trigger). It DROPS skill's `skill_name`/`trigger_text` and ADDS
- * `repo` (the repo-scoping dimension) + `summary` (the brief body).
- *
- * The `project_briefs` table is the source of truth (survives memory decay); the
- * memory mirror is for recall. memory_id is NULLABLE with ON DELETE SET NULL.
- *
- * Lifecycle: active -> superseded (a newer version replaces it) or active ->
- * closed (retired).
- */
-import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
-import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store/entry-writes.js';
-import { assertTenantId } from './tenant.js';
-import { scopeAdmitSql } from './recall-scope.js';
-import { markGraphDirty, removeGraphEntitiesForObject } from './graph/write.js';
-import { createMemory, Layer } from './memory.js';
-import { appendAuditEvent } from './audit.js';
-import { objectHalfLifeDays } from './half-life-migration.js';
-import { keysetAfter } from './keyset.js';
-import { escapeLike } from './escape.js';
-export const VALID_BRIEF_STATES = new Set([
-    'active',
-    'superseded',
-    'closed',
-]);
-/** Field caps (untrusted at the HTTP/SDK boundary). summary is a body, so a larger
- *  cap than the 4096 short-field convention. */
-export const MAX_REPO_LEN = 256;
-export const MAX_BRIEF_SUMMARY_LEN = 8192;
-export const MAX_CHANGE_SUMMARY_LEN = 4096;
-/** Bound the receipts gathered per refresh (a refresh reads memories; cap the scan
- *  + the rendered body). Realistic repos have far fewer recent receipts than this. */
-export const MAX_BRIEF_RECEIPTS = 50;
-/** Truncate each receipt's headline in the assembled digest. */
-export const MAX_RECEIPT_HEADLINE_LEN = 200;
-// ---------------------------------------------------------------------------
-// Validation
-// ---------------------------------------------------------------------------
-/**
- * Validate + normalise brief fields. `repo` is trimmed and MUST be a single line
- * (no newlines): it becomes a path tag on the refresh match AND an H1 heading in
- * the assembled digest. `summary` is kept verbatim (operator content) but capped.
- * Returns the normalised repo.
- */
-function validateBriefFields(repo, summary, changeSummary) {
-    const normalizedRepo = (repo ?? '').trim();
-    if (normalizedRepo.length === 0)
-        throw new BadRequestError('saveProjectBrief: repo is required');
-    if (/[\r\n]/.test(normalizedRepo)) {
-        throw new BadRequestError('saveProjectBrief: repo must be a single line (no newlines)');
-    }
-    if (normalizedRepo.length > MAX_REPO_LEN) {
-        throw new BadRequestError(`saveProjectBrief: repo exceeds the ${MAX_REPO_LEN}-char cap`);
-    }
-    if (!summary || summary.trim().length === 0) {
-        throw new BadRequestError('saveProjectBrief: summary is required');
-    }
-    if (summary.length > MAX_BRIEF_SUMMARY_LEN) {
-        throw new BadRequestError(`saveProjectBrief: summary exceeds the ${MAX_BRIEF_SUMMARY_LEN}-char cap`);
-    }
-    if (changeSummary !== undefined && changeSummary.length > MAX_CHANGE_SUMMARY_LEN) {
-        throw new BadRequestError(`saveProjectBrief: changeSummary exceeds the ${MAX_CHANGE_SUMMARY_LEN}-char cap`);
-    }
-    return { repo: normalizedRepo };
-}
-function rowToProjectBrief(row) {
-    return {
-        id: row.id,
-        memoryId: row.memory_id,
-        tenantId: row.tenant_id,
-        repo: row.repo,
-        summary: row.summary,
-        version: row.version,
-        // SAFETY: row.status is DB-constrained to BriefStatus values; every INSERT/
-        // UPDATE in this file writes only the literal 'active' | 'superseded' | 'closed'.
-        status: row.status,
-        supersededBy: row.superseded_by,
-        supersededAt: row.superseded_at,
-        changeSummary: row.change_summary,
-        closedAt: row.closed_at,
-        createdAt: row.created_at,
-    };
-}
-const BRIEF_COLS = `
-  id, memory_id, tenant_id, repo, summary, version, status,
-  superseded_by, superseded_at, change_summary, closed_at, created_at
-`;
-/** Recall-surface content for the memory mirror: repo + summary. Named (mirrors
- *  buildSkillContent) so the recall surface is deterministic + unit-testable. */
-function buildBriefContent(repo, summary) {
-    return `${repo}\n\n${summary}`;
-}
-// Preflight the supersede target BEFORE inserting the new row (so the new
-// autoincrement id can never be its own supersede target); read the
-// predecessor version in the same SELECT for server-derived versioning.
-// Mirrors saveSkill / saveProcess.
-function preflightBriefSupersede(db, tenantId, supersedesId) {
-    // SAFETY: SELECT projects exactly status, version; .get() returns that
-    // shape for the matching row, or undefined when no brief/tenant pair matches.
-    const pred = db.prepare(`SELECT status, version FROM project_briefs WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
-    if (!pred) {
-        throw new NotFoundError(`saveProjectBrief: brief ${supersedesId} to supersede not found for tenant ${tenantId}`);
-    }
-    if (pred.status !== 'active') {
-        throw new ConflictError(`saveProjectBrief: brief ${supersedesId} is not active (status='${pred.status}'); only active briefs can be superseded.`);
-    }
-    return pred.version + 1;
-}
-function insertBriefRow(db, memoryId, w, version) {
-    const result = db.prepare(`
-    INSERT INTO project_briefs(
-      memory_id, tenant_id, repo, summary, version,
-      status, superseded_by, superseded_at, change_summary, closed_at, created_at
-    ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-  `).run(memoryId, w.tenantId, w.repo, w.summary, version, w.changeSummary, w.now);
-    return Number(result.lastInsertRowid ?? 0);
-}
-function supersedeBriefRow(db, w, supersedesId, briefId, version) {
-    const sup = db.prepare(`
-    UPDATE project_briefs
-    SET status = 'superseded', superseded_by = ?, superseded_at = ?
-    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-  `).run(briefId, w.now, supersedesId, w.tenantId, briefId);
-    if (sup.changes === 0) {
-        throw new ConflictError(`saveProjectBrief: brief ${supersedesId} could not be superseded (no longer active or self-reference).`);
-    }
-    appendAuditEvent(db, {
-        tenantId: w.tenantId,
-        actor: w.actor,
-        op: 'project_brief_supersede',
-        targetId: String(supersedesId),
-        metadata: {
-            brief_id: supersedesId,
-            superseded_by: briefId,
-            new_version: version,
-            refreshed: w.isRefresh,
-            ...w.refreshAuditExtra,
-        },
-    });
-}
-/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
-function writeBriefRow(db, memoryId, w) {
-    const version = w.supersedesId !== undefined ? preflightBriefSupersede(db, w.tenantId, w.supersedesId) : 1;
-    const briefId = insertBriefRow(db, memoryId, w, version);
-    if (w.supersedesId !== undefined)
-        supersedeBriefRow(db, w, w.supersedesId, briefId, version);
-    // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
-    // columns; .get() returns that row, or undefined only if the
-    // just-inserted id can't be found.
-    const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ?`)
-        .get(briefId);
-    if (!row)
-        throw new Error('saveProjectBrief: failed to reload saved brief row');
-    // GDPR-light metadata: ids + flags only, no brief text.
-    appendAuditEvent(db, {
-        tenantId: w.tenantId,
-        actor: w.actor,
-        op: 'project_brief_create',
-        targetId: String(briefId),
-        metadata: {
-            brief_id: briefId,
-            repo: w.repo,
-            version,
-            refreshed: w.isRefresh,
-            ...w.refreshAuditExtra,
-        },
-    });
-    return row;
-}
-/**
- * Create a project_brief (or a new version that supersedes an existing one). Writes
- * the memory mirror + the project_briefs row atomically inside writeEntry's
- * SAVEPOINT. When supersedesBriefId is given, the referenced ACTIVE row is
- * preflighted (status + version) BEFORE the INSERT, then CAS-UPDATEd -> superseded
- * in the same SAVEPOINT; the new version = predecessor.version + 1 (server-derived).
- */
-export function saveProjectBrief(hippoRoot, tenantId, opts, actor = 'cli') {
-    assertTenantId('saveProjectBrief', tenantId);
-    const { repo } = validateBriefFields(opts.repo, opts.summary, opts.changeSummary);
-    const isSupersede = opts.supersedesBriefId !== undefined;
-    const changeSummary = isSupersede ? (opts.changeSummary ?? null) : null;
-    const isRefresh = opts.refreshReceiptCount !== undefined;
-    const refreshAuditExtra = {};
-    if (isRefresh)
-        refreshAuditExtra.receipt_count = opts.refreshReceiptCount;
-    const now = new Date().toISOString();
-    const content = buildBriefContent(repo, opts.summary);
-    const tags = ['project_brief', ...(opts.extraTags ?? [])];
-    const mem = createMemory(content, {
-        tags,
-        layer: Layer.Semantic,
-        confidence: 'verified',
-        source: 'project_brief',
-        baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
-        tenantId,
-    });
-    const w = {
-        tenantId,
-        actor,
-        repo,
-        summary: opts.summary,
-        changeSummary,
-        supersedesId: opts.supersedesBriefId,
-        isRefresh,
-        refreshAuditExtra,
-        now,
-    };
-    let savedRow;
-    writeEntry(hippoRoot, mem, {
-        actor,
-        afterWrite: (db, memoryId) => {
-            savedRow = writeBriefRow(db, memoryId, w);
-        },
-        // afterCommit covers refreshBrief (delegates here) + brief new/supersede.
-        afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
-    });
-    if (!savedRow) {
-        throw new Error('saveProjectBrief: afterWrite did not populate the row');
-    }
-    return rowToProjectBrief(savedRow);
-}
-/**
- * Close (retire) an active brief. CAS guard WHERE status='active'; 0 changes
- * distinguishes not-found from not-active. A superseded row is terminal.
- */
-export function closeProjectBrief(hippoRoot, tenantId, id, actor = 'cli') {
-    assertTenantId('closeProjectBrief', tenantId);
-    const now = new Date().toISOString();
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const updateResult = db.prepare(`
-        UPDATE project_briefs
-        SET status = 'closed', closed_at = ?
-        WHERE id = ? AND tenant_id = ? AND status = 'active'
-      `).run(now, id, tenantId);
-            if (updateResult.changes === 0) {
-                // SAFETY: SELECT projects exactly the status column; .get() returns that
-                // shape, or undefined when the id/tenant pair doesn't exist.
-                const existing = db.prepare(`SELECT status FROM project_briefs WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
-                if (!existing) {
-                    throw new NotFoundError(`closeProjectBrief: brief ${id} not found for tenant ${tenantId}`);
-                }
-                throw new ConflictError(`closeProjectBrief: brief ${id} is not active (status='${existing.status}'); only active briefs can be closed.`);
-            }
-            // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
-            // columns; .get() returns that row for the just-updated id, or undefined
-            // only in an impossible race since the UPDATE above already matched it.
-            const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ? AND tenant_id = ?`)
-                .get(id, tenantId);
-            if (!row)
-                throw new NotFoundError(`closeProjectBrief: brief ${id} not found after UPDATE`);
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'project_brief_close',
-                targetId: String(id),
-                metadata: { brief_id: id },
-            });
-            db.exec('COMMIT');
-            const closed = rowToProjectBrief(row);
-            // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
-            // not only via an enqueued rebuild whose queue item is lost if the mirror is later
-            // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget. Still enqueue when a mirror exists
-            // so a concurrent rebuild re-derives consistently (harmless if it also runs).
-            removeGraphEntitiesForObject(hippoRoot, tenantId, 'project', closed.id);
-            if (closed.memoryId) {
-                markGraphDirty(hippoRoot, tenantId, closed.memoryId);
-            }
-            return closed;
-        }
-        catch (e) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch {
-                // Ignore rollback failures — the throw below is what matters.
-            }
-            throw e;
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadProjectBriefById(hippoRoot, tenantId, id) {
-    assertTenantId('loadProjectBriefById', tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
-        // columns; .get() returns that row, or undefined when the id/tenant pair
-        // doesn't exist.
-        const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ? AND tenant_id = ?`)
-            .get(id, tenantId);
-        return row ? rowToProjectBrief(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadProjectBriefs(hippoRoot, tenantId, opts = {}) {
-    assertTenantId('loadProjectBriefs', tenantId);
-    const limit = opts.limit ?? 100;
-    const after = keysetAfter('created_at', 'id', opts.after);
-    if (opts.status && !VALID_BRIEF_STATES.has(opts.status)) {
-        throw new BadRequestError(`loadProjectBriefs: status must be one of ${Array.from(VALID_BRIEF_STATES).join('|')}; got ${opts.status}`);
-    }
-    const db = openHippoDb(hippoRoot);
-    try {
-        const clauses = ['tenant_id = ?'];
-        const params = [tenantId];
-        if (opts.status) {
-            clauses.push('status = ?');
-            params.push(opts.status);
-        }
-        if (opts.repo) {
-            clauses.push('repo = ?');
-            params.push(opts.repo);
-        }
-        params.push(...after.params, limit);
-        // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow columns
-        // regardless of the dynamic WHERE clause built above; .all() returns rows
-        // in that shape.
-        const rows = db.prepare(`
-      SELECT ${BRIEF_COLS} FROM project_briefs
-      WHERE ${clauses.join(' AND ')}${after.sql}
-      ORDER BY created_at DESC, id DESC
-      LIMIT ?
-    `).all(...params);
-        return rows.map(rowToProjectBrief);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * The repo's CURRENT active brief, or null. By convention there is one active brief
- * per (tenant, repo); if an operator created more than one (the DB does not prevent
- * it, consistent with every other first-class object), the MOST-RECENT active row wins.
- */
-export function loadActiveBriefForRepo(hippoRoot, tenantId, repo) {
-    assertTenantId('loadActiveBriefForRepo', tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
-        // columns; .get() returns that row, or undefined when no active brief
-        // exists for this tenant/repo.
-        const row = db.prepare(`
-      SELECT ${BRIEF_COLS} FROM project_briefs
-      WHERE tenant_id = ? AND repo = ? AND status = 'active'
-      ORDER BY created_at DESC, id DESC
-      LIMIT 1
-    `).get(tenantId, repo);
-        return row ? rowToProjectBrief(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-// ---------------------------------------------------------------------------
-// Refresh assembler (the distinguishing deliverable)
-// ---------------------------------------------------------------------------
-/** Single-line headline for a receipt: first non-empty line, newline-stripped,
- *  truncated. Deterministic + safe for the markdown bullet list. */
-function receiptHeadline(content) {
-    const firstLine = (content ?? '').split(/\r?\n/).find((l) => l.trim().length > 0) ?? '';
-    const trimmed = firstLine.trim();
-    return trimmed.length > MAX_RECEIPT_HEADLINE_LEN
-        ? `${trimmed.slice(0, MAX_RECEIPT_HEADLINE_LEN)}...`
-        : trimmed;
-}
-/** The repo's receipt rows, newest first, capped at MAX_BRIEF_RECEIPTS. */
-function loadBriefReceipts(hippoRoot, tenantId, normalizedRepo) {
-    const tag = `path:${normalizedRepo.toLowerCase()}`;
-    const likeParam = `%"${escapeLike(tag)}"%`;
-    const deny = scopeAdmitSql('');
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: SELECT projects exactly id, created, source, content (the
-        // ReceiptRow columns); .all() returns rows in that shape.
-        return db.prepare(`
-      SELECT id, created, source, content FROM memories
-      WHERE tenant_id = ?
-        AND source != 'project_brief'
-        AND LOWER(tags_json) LIKE ? ESCAPE '\\'
-        AND ${deny.sql}
-      ORDER BY created DESC, id DESC
-      LIMIT ?
-    `).all(tenantId, likeParam, ...deny.params, MAX_BRIEF_RECEIPTS);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-// NOTE on ordering: the `id DESC` tiebreak is lexical on a random-ish memory id
-// (e.g. `sem_<hex>`), NOT chronological — within the same `created` timestamp the
-// order is stable-but-arbitrary, not insertion order. `created DESC` is the real
-// recency ordering.
-//
-// Budget-aware assembly: the digest is the
-// brief `summary`, which saveProjectBrief caps at MAX_BRIEF_SUMMARY_LEN. The
-// receipt/headline caps (50 x ~200) could otherwise build an ~11KB body that the
-// store then REJECTS, breaking refresh for inputs within the advertised caps. So
-// include receipt lines newest-first only while they fit under the cap (reserving
-// slack for the header + an omission footer), and note the omitted remainder.
-function fitReceiptLines(receipts) {
-    const buildReceiptLine = (r) => `- ${(r.created ?? '').slice(0, 10)} [${r.source}] ${receiptHeadline(r.content)}`;
-    const receiptLines = [];
-    if (receipts.length > 0) {
-        // Header + "## Recent receipts" + a worst-case omission footer cost; keep slack
-        // so the joined markdown stays <= MAX_BRIEF_SUMMARY_LEN even after the footer.
-        const SLACK = 400;
-        let bodyBudget = MAX_BRIEF_SUMMARY_LEN - SLACK;
-        for (const r of receipts) {
-            const line = buildReceiptLine(r);
-            if (line.length + 1 > bodyBudget)
-                break;
-            receiptLines.push(line);
-            bodyBudget -= line.length + 1;
-        }
-    }
-    return receiptLines;
-}
-function renderBriefDigest(normalizedRepo, receiptCount, receiptLines) {
-    const omitted = receiptCount - receiptLines.length;
-    const lines = [];
-    lines.push(`# Project Brief: ${normalizedRepo}`);
-    lines.push('');
-    lines.push(omitted > 0
-        ? `_Auto-assembled from ${receiptLines.length} of ${receiptCount} receipt(s)._`
-        : `_Auto-assembled from ${receiptCount} receipt(s)._`);
-    lines.push('');
-    lines.push('## Recent receipts');
-    lines.push('');
-    if (receiptCount === 0) {
-        lines.push(`_No receipts found for ${normalizedRepo}._`);
-    }
-    else {
-        lines.push(...receiptLines);
-        if (omitted > 0) {
-            lines.push('');
-            lines.push(`_... ${omitted} more receipt(s) omitted (summary cap)._`);
-        }
-    }
-    // Belt-and-suspenders: the budget loop keeps us under the cap, but hard-clamp the
-    // joined string so the store's NOT-NULL/<=cap contract can never be violated even
-    // for a pathological single oversized line.
-    let markdown = lines.join('\n');
-    if (markdown.length > MAX_BRIEF_SUMMARY_LEN) {
-        markdown = markdown.slice(0, MAX_BRIEF_SUMMARY_LEN);
-    }
-    return markdown;
-}
-/**
- * Assemble the repo's recent receipts into a deterministic markdown digest, and
- * return it WITH the receipt count (the count feeds refreshBrief's change_summary +
- * audit metadata). NO LLM. Always returns a non-empty, valid summary (a brief
- * `summary` is NOT NULL), including the zero-receipts case.
- *
- * A "receipt" = a tenant memory row carrying the repo's `path:<repo>` tag. The
- * brief's OWN memory mirror (source='project_brief') is excluded so a brief never
- * becomes its own receipt on the next refresh. The match is against the JSON-array
- * serialization (each element is a double-quoted string `"path:hippo"`); the
- * surrounding quotes are load-bearing — they stop `hip` matching `path:hippo`.
- * `repo` is LIKE-escaped + parameterized (operator-supplied; security.md).
- */
-export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
-    assertTenantId('assembleBriefFromReceipts', tenantId);
-    const normalizedRepo = (repo ?? '').trim();
-    if (normalizedRepo.length === 0) {
-        throw new BadRequestError('assembleBriefFromReceipts: repo is required');
-    }
-    const receipts = loadBriefReceipts(hippoRoot, tenantId, normalizedRepo);
-    const markdown = renderBriefDigest(normalizedRepo, receipts.length, fitReceiptLines(receipts));
-    return { markdown, receiptCount: receipts.length };
-}
-/**
- * Auto-refresh the repo's brief from its receipts: assemble the digest, then create
- * a new version. If the repo already has an active brief it is superseded (the
- * change_summary records the auto-refresh + the audit metadata carries
- * `refreshed: true`); otherwise a v1 is created. Returns the new brief.
- *
- * The assemble (a read of `memories`) happens BEFORE writeEntry opens its SAVEPOINT;
- * a concurrent receipt write landing between the read and the brief write simply
- * appears in the NEXT refresh — the brief is a derived snapshot, not a transactional
- * aggregate, so no consistency invariant is violated.
- */
-export function refreshBrief(hippoRoot, tenantId, repo, actor = 'cli') {
-    assertTenantId('refreshBrief', tenantId);
-    const normalizedRepo = (repo ?? '').trim();
-    if (normalizedRepo.length === 0)
-        throw new BadRequestError('refreshBrief: repo is required');
-    const { markdown, receiptCount } = assembleBriefFromReceipts(hippoRoot, tenantId, normalizedRepo);
-    const active = loadActiveBriefForRepo(hippoRoot, tenantId, normalizedRepo);
-    return saveProjectBrief(hippoRoot, tenantId, {
-        repo: normalizedRepo,
-        summary: markdown,
-        changeSummary: active ? `auto-refresh from ${receiptCount} receipt(s)` : undefined,
-        supersedesBriefId: active ? active.id : undefined,
-        refreshReceiptCount: receiptCount,
-        // Tag the refreshed brief's mirror as repo-local so path-aware recall boosts
-        // it like the manual `brief new`/`supersede` paths do.
-        // Safe vs self-recursion: assembleBriefFromReceipts excludes
-        // source='project_brief', so the brief never becomes its own receipt.
-        extraTags: [`path:${normalizedRepo.toLowerCase()}`],
-    }, actor);
-}
-//# sourceMappingURL=project-briefs.js.map

package/dist/provenance-coverage.d.ts

@@ -1,18 +0,0 @@
-import { MemoryEntry } from './memory.js';
-export interface ProvenanceCoverage {
-    rawTotal: number;
-    rawWithEnvelope: number;
-    coverage: number;
-    gaps: Array<{
-        id: string;
-        missing: ('owner' | 'artifact_ref')[];
-    }>;
-}
-/**
- * Provenance coverage gate: every `kind='raw'` row must carry both `owner`
- * and `artifact_ref`. Distilled / superseded / archived rows are excluded —
- * those are derivative or terminal, not source receipts. Coverage of 1.0 on
- * a non-empty raw set is the ship gate from the Company Brain scorecard.
- */
-export declare function buildProvenanceCoverage(entries: MemoryEntry[]): ProvenanceCoverage;
-//# sourceMappingURL=provenance-coverage.d.ts.map

package/dist/rate-limit.d.ts

@@ -1,34 +0,0 @@
-/**
- * Per-key token-bucket rate limiter for inbound /v1/* requests.
- *
- * Bounds api-key-id enumeration: a
- * client that drains its bucket is denied until it refills. Dependency-free
- * and unit-testable in isolation via the injectable `now`.
- */
-export interface RateLimiter {
-    /**
-     * Consume one token for `key`. Returns true if the request is allowed,
-     * false if the key's bucket is exhausted. `now` (epoch ms) is injectable
-     * for deterministic tests.
-     */
-    check(key: string, now?: number): boolean;
-    readonly retryAfterSec: number;
-}
-export interface RateLimiterOpts {
-    /** Sustained refill rate in tokens per second. */
-    ratePerSec: number;
-    /** Bucket capacity — the largest burst a fresh client may spend at once. */
-    burst: number;
-    /** A bucket untouched for this many ms is dropped by the throttled sweep. */
-    idleEvictMs: number;
-    /** Hard cap on tracked keys; the least-recently-used key is evicted on overflow. */
-    maxKeys: number;
-}
-/**
- * Build a token-bucket limiter. Memory is bounded two ways: a sweep (throttled
- * to once per `idleEvictMs`) drops idle buckets, and a hard `maxKeys` cap evicts
- * the least-recently-used key, so a client rotating source addresses cannot
- * grow the map without bound between sweeps.
- */
-export declare function createRateLimiter(opts: RateLimiterOpts): RateLimiter;
-//# sourceMappingURL=rate-limit.d.ts.map

package/dist/raw-archive-mirror-cleanup.d.ts

@@ -1,20 +0,0 @@
-import type { DatabaseSyncLike } from './db.js';
-/**
- * Path A backfill cleanup: existing raw_archive rows that were archived BEFORE
- * commit 70180b5 left their markdown mirrors at <hippoRoot>/<layer>/<id>.md
- * with original content intact. The DB is already redacted via migration v20;
- * this function deletes those filesystem mirrors so RTBF holds for historical
- * archives too.
- *
- * Per-row tracking via raw_archive.mirror_cleaned_at (added in v21):
- *   - SELECT only rows WHERE mirror_cleaned_at IS NULL.
- *   - On success (every layer either deleted or didn't exist), UPDATE the row
- *     with the cleanup timestamp.
- *   - On any unlink failure, leave mirror_cleaned_at NULL so the next
- *     openHippoDb call retries. Warn (capped at MAX_WARN_LOGS rows per call).
- *
- * Steady-state cost is one SELECT returning empty after every row has been
- * cleaned successfully.
- */
-export declare function cleanupArchivedMirrors(hippoRoot: string, db: DatabaseSyncLike): void;
-//# sourceMappingURL=raw-archive-mirror-cleanup.d.ts.map

package/dist/raw-archive.d.ts

@@ -1,24 +0,0 @@
-import type { DatabaseSyncLike } from './db.js';
-export interface ArchiveOpts {
-    reason: string;
-    who: string;
-    /**
-     * Optional hook invoked inside the same SAVEPOINT as the archive INSERT/DELETE,
-     * after the audit row is appended and before RELEASE. Used by the Slack
-     * deletion connector to mark the deletion event seen atomically — a crash
-     * mid-archive must not leave the deletion event untracked. Throwing rolls
-     * back the entire archive (including the audit row).
-     */
-    afterArchive?: (db: DatabaseSyncLike, archivedMemoryId: string) => void;
-}
-/**
- * The only legitimate path to remove a `kind='raw'` row from `memories`.
- *
- * Snapshots the full row into `raw_archive`, flips `kind` to `'archived'` so the
- * append-only trigger lets the delete through, then deletes the row. All in one
- * write scope, which nests inside an outer transaction (e.g. batchWriteAndDelete).
- *
- * Throws if the row does not exist or is not `kind='raw'`. Returns the archived_at it wrote.
- */
-export declare function archiveRawMemory(db: DatabaseSyncLike, id: string, opts: ArchiveOpts): string;
-//# sourceMappingURL=raw-archive.d.ts.map