hippo-memory 1.69.0 → 1.71.0

package/dist/replay.js

@@ -1,122 +0,0 @@
-/**
- * Replay — biologically-inspired rehearsal during consolidation.
- *
- * Hippocampal replay is internally-driven reactivation of memories during
- * slow-wave sleep: the brain picks important recent experiences and "plays
- * them back" without external input, strengthening them before they decay.
- * In McClelland's complementary-learning-systems framing, replay is also
- * how episodic memories train the neocortex (interleaved rehearsal); in
- * reward-modulated STDP, replay is gated by dopamine so rewarded
- * experiences get preferentially consolidated.
- *
- * This module implements a lightweight, deterministic analog. During each
- * `hippo sleep`, we sample N surviving memories by a priority score that
- * weighs reward feedback, emotional valence, under-rehearsal, and age —
- * then apply the same retrieval-strengthening dynamics `markRetrieved`
- * applies to real queries. The effect is that important memories stay
- * strong even when the user hasn't explicitly queried them recently.
- *
- * Distinct from the other consolidation passes:
- *   - decay: removes what's too weak
- *   - physics: moves particles in embedding space
- *   - merge: collapses near-duplicate episodics into semantics
- *   - REPLAY: picks winners and rehearses them (this file)
- */
-import { isOutcomeSlowAblated } from './ablation.js';
-import { resolveConfidence } from './memory.js';
-const VALENCE_WEIGHT = {
-    neutral: 1.0,
-    positive: 1.3,
-    negative: 1.5,
-    critical: 2.0,
-};
-/**
- * Priority score used to rank survivors for replay. Higher = more likely
- * to be sampled. Pure function of the entry and current time.
- */
-export function replayPriority(entry, now) {
-    const pos = entry.outcome_positive ?? 0;
-    const neg = entry.outcome_negative ?? 0;
-    // Reward signal: neutral memories get 1, strongly-rewarded memories > 1,
-    // negative-dominated memories floor at 0.1 (so they're still eligible, just
-    // much less likely to be sampled than neutral peers). Clamp is required
-    // because sampleForReplay depends on all weights being positive.
-    const rewardSignal = isOutcomeSlowAblated()
-        ? 1.0 // EVAL-ONLY ablation (see ablation.ts): outcome-off also silences replay's reward bias
-        : Math.max(0.1, 1 + pos * 0.5 + (pos - neg) * 0.25);
-    const valence = VALENCE_WEIGHT[entry.emotional_valence] ?? 1.0;
-    // Under-rehearsed memories benefit most from replay.
-    const underRehearsed = 1 / (1 + (entry.retrieval_count ?? 0));
-    // Idle-time boost: memories that haven't been touched recently need rehearsal more.
-    const lastRetrieved = new Date(entry.last_retrieved);
-    const deltaMs = now.getTime() - lastRetrieved.getTime();
-    const ageHours = Number.isFinite(deltaMs) ? Math.max(0, deltaMs / 3_600_000) : 0;
-    const idleBoost = 1 + Math.log1p(ageHours) * 0.1;
-    // Weight by current strength so dead-and-decaying memories don't waste replay slots.
-    const rawStrength = Number.isFinite(entry.strength) ? entry.strength : 0;
-    const strengthFloor = Math.max(0.1, rawStrength);
-    return rewardSignal * valence * underRehearsed * idleBoost * strengthFloor;
-}
-/**
- * Deterministic 32-bit RNG (Mulberry32). Same seed → same sequence.
- * Keeps replay reproducible for tests and audit runs without bringing
- * in a random-number dependency.
- */
-function mulberry32(seed) {
-    let s = seed >>> 0;
-    return () => {
-        let t = (s += 0x6D2B79F5);
-        t = Math.imul(t ^ (t >>> 15), t | 1);
-        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
-        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
-    };
-}
-/**
- * Pick `count` memories for replay, weighted by `replayPriority`, without
- * replacement. Deterministic given the same seed.
- *
- * The sampler is weighted but not greedy — picking by priority alone would
- * always pick the top-N, which overfits. Biological replay shows both
- * preferential-for-reward AND stochastic-exploration characteristics; we
- * keep the stochastic element so adjacent survivors aren't always ignored.
- */
-export function sampleForReplay(survivors, count, now, seed = Date.now() >>> 0) {
-    if (count <= 0 || survivors.length === 0)
-        return [];
-    const rng = mulberry32(seed);
-    // Deliberately-marked and aged-out memories are both untrusted; rehearsing
-    // them would defeat the purpose of staleness, so derive rather than trust
-    // the stored value (it no longer carries the age-out case, see memory.ts).
-    const eligible = survivors.filter((e) => resolveConfidence(e, now) !== 'stale');
-    if (eligible.length === 0)
-        return [];
-    const pool = eligible.map((entry, idx) => ({
-        entry,
-        idx,
-        weight: replayPriority(entry, now),
-    }));
-    const want = Math.min(count, pool.length);
-    const chosen = [];
-    const taken = new Set();
-    for (let k = 0; k < want; k++) {
-        let totalW = 0;
-        for (const p of pool)
-            if (!taken.has(p.idx))
-                totalW += p.weight;
-        if (totalW <= 0)
-            break;
-        let r = rng() * totalW;
-        for (const p of pool) {
-            if (taken.has(p.idx))
-                continue;
-            r -= p.weight;
-            if (r <= 0) {
-                chosen.push(p.entry);
-                taken.add(p.idx);
-                break;
-            }
-        }
-    }
-    return chosen;
-}
-//# sourceMappingURL=replay.js.map

package/dist/rrf.d.ts

@@ -1,43 +0,0 @@
-/**
- * Reciprocal Rank Fusion (Cormack, Clarke, and Buettcher 2009).
- *
- * Fuses N ranked candidate lists into a single ordering by summing
- * weighted 1/(k + rank) contributions per candidate. The constant K is
- * the canonical 60 from the original paper and the value already in use
- * across hippo's `hybridSearch`. Do NOT tune K without an
- * explicit cross-corpus eval — it is calibrated against IR benchmarks
- * and works robustly across BM25/dense/cross-encoder rank-list shapes.
- *
- * Generic over the candidate id type so this helper can be shared by
- * `src/search.ts::hybridSearch` (T = number, idx into MemoryEntry[]) and
- * the LongMemEval hybrid retrieve benchmark (T = string, session_id).
- *
- * Behaviour MUST stay byte-identical to the inline implementation that
- * lived in `src/search.ts:354-374` before extraction (commit ab6c5eb).
- * The `tests/rrf.test.ts` suite is the contract.
- */
-export declare const RRF_K = 60;
-export interface RrfFuseOptions {
-    /** Smoothing constant. Default RRF_K = 60. */
-    k?: number;
-    /**
-     * Rank assigned to candidates absent from a list. Default is
-     * `max(rankedLists.map(l => l.length)) + 1` — the convention used in
-     * the pre-extraction `hybridSearch` code (`entries.length + 1`).
-     */
-    absentRank?: number;
-}
-/**
- * Fuse N ranked lists into a single Map of candidate id -> RRF score.
- *
- * @param rankedLists  Each inner array is candidates in descending-score order.
- *                     Element at index 0 is rank 1; index 1 is rank 2; etc.
- * @param weights      Per-list weights. weights.length === rankedLists.length.
- *                     Weights are summed without normalisation — pass {0.5, 0.5}
- *                     for symmetric fusion or {0.2, 0.8} for asymmetric.
- * @param options      Optional k override + absentRank override.
- * @returns            Map from candidate id to fused RRF score. Sort descending
- *                     by value to get the fused ordering.
- */
-export declare function rrfFuse<T>(rankedLists: ReadonlyArray<ReadonlyArray<T>>, weights: ReadonlyArray<number>, options?: RrfFuseOptions): Map<T, number>;
-//# sourceMappingURL=rrf.d.ts.map

package/dist/rrf.js

@@ -1,61 +0,0 @@
-/**
- * Reciprocal Rank Fusion (Cormack, Clarke, and Buettcher 2009).
- *
- * Fuses N ranked candidate lists into a single ordering by summing
- * weighted 1/(k + rank) contributions per candidate. The constant K is
- * the canonical 60 from the original paper and the value already in use
- * across hippo's `hybridSearch`. Do NOT tune K without an
- * explicit cross-corpus eval — it is calibrated against IR benchmarks
- * and works robustly across BM25/dense/cross-encoder rank-list shapes.
- *
- * Generic over the candidate id type so this helper can be shared by
- * `src/search.ts::hybridSearch` (T = number, idx into MemoryEntry[]) and
- * the LongMemEval hybrid retrieve benchmark (T = string, session_id).
- *
- * Behaviour MUST stay byte-identical to the inline implementation that
- * lived in `src/search.ts:354-374` before extraction (commit ab6c5eb).
- * The `tests/rrf.test.ts` suite is the contract.
- */
-export const RRF_K = 60;
-/**
- * Fuse N ranked lists into a single Map of candidate id -> RRF score.
- *
- * @param rankedLists  Each inner array is candidates in descending-score order.
- *                     Element at index 0 is rank 1; index 1 is rank 2; etc.
- * @param weights      Per-list weights. weights.length === rankedLists.length.
- *                     Weights are summed without normalisation — pass {0.5, 0.5}
- *                     for symmetric fusion or {0.2, 0.8} for asymmetric.
- * @param options      Optional k override + absentRank override.
- * @returns            Map from candidate id to fused RRF score. Sort descending
- *                     by value to get the fused ordering.
- */
-export function rrfFuse(rankedLists, weights, options) {
-    if (rankedLists.length !== weights.length) {
-        throw new Error(`rrfFuse: rankedLists.length (${rankedLists.length}) must match weights.length (${weights.length})`);
-    }
-    const k = options?.k ?? RRF_K;
-    const defaultAbsentRank = rankedLists.reduce((m, l) => Math.max(m, l.length), 0) + 1;
-    const absentRank = options?.absentRank ?? defaultAbsentRank;
-    const rankMaps = rankedLists.map((list) => {
-        const m = new Map();
-        for (let i = 0; i < list.length; i++) {
-            m.set(list[i], i + 1); // 1-indexed rank
-        }
-        return m;
-    });
-    const allCandidates = new Set();
-    for (const list of rankedLists)
-        for (const c of list)
-            allCandidates.add(c);
-    const scores = new Map();
-    for (const c of allCandidates) {
-        let score = 0;
-        for (let i = 0; i < rankMaps.length; i++) {
-            const rank = rankMaps[i].get(c) ?? absentRank;
-            score += weights[i] / (k + rank);
-        }
-        scores.set(c, score);
-    }
-    return scores;
-}
-//# sourceMappingURL=rrf.js.map

package/dist/scope.d.ts

@@ -1,14 +0,0 @@
-/**
- * Detect the current operational scope from environment signals.
- * Returns a scope name string (no prefix), or null if no scope detected.
- * Priority: HIPPO_SCOPE > GSTACK_SKILL > OPENCLAW_SKILL.
- *
- * Pure env var reads: no I/O, safe to call from hot paths (e.g. UserPromptSubmit hook).
- */
-export declare function detectScope(): string | null;
-/**
- * Compute scope match between a memory's scope tags and the active scope.
- * Returns: 1 if matching scope, -1 if mismatching scope, 0 if neutral (no scope on either side).
- */
-export declare function scopeMatch(memoryTags: string[], activeScope: string | null): -1 | 0 | 1;
-//# sourceMappingURL=scope.d.ts.map

package/dist/server-detect.d.ts

@@ -1,72 +0,0 @@
-export interface ServerInfo {
-    /**
-     * Pidfile schema version (L3). Absent on pidfiles written before this
-     * field existed — detectServer treats a missing `schema` as legacy and
-     * still accepts the pidfile.
-     */
-    schema?: number;
-    pid: number;
-    port: number;
-    url: string;
-    started_at: string;
-}
-/**
- * Read .hippo/server.pid and return the embedded ServerInfo if a live hippo
- * server is genuinely answering on the recorded url. Returns null on missing,
- * malformed, or stale pidfiles, and best-effort unlinks the file in the
- * stale/malformed cases.
- *
- * Liveness is proven in two steps. `process.kill(pid, 0)` rules out dead
- * pids. But a pid can be reused by an unrelated process, so a GET /health
- * then confirms the process that answers is *this* hippo server: its
- * `started_at` must equal the pidfile's. A mismatch, non-200, malformed
- * body, or timeout all mean the pidfile is stale.
- *
- * The /health probe runs only when a pidfile exists and the pid is live, so
- * the common no-server path stays a single fast file existence check.
- */
-export declare function detectServer(hippoRoot: string): Promise<ServerInfo | null>;
-/**
- * Atomically write the pidfile. Writes to a process-scoped temp file then
- * renames into place, which is atomic on POSIX and on NTFS via MoveFileEx.
- *
- * `startedAt` is supplied by the caller (`serve()`) rather than generated
- * here, so the pidfile and the server's GET /health response carry the same
- * timestamp — detectServer's liveness probe compares the two for equality.
- */
-export declare function writePidfile(hippoRoot: string, opts: {
-    port: number;
-    url: string;
-    startedAt: string;
-}): void;
-/**
- * Best-effort pidfile removal. Silent on ENOENT or any other error so the
- * caller can use this in shutdown paths without fear of throwing.
- *
- * Identity-blind: deletes whatever pidfile is on disk. A shutdown path that
- * must not clobber a newer server's pidfile should use removePidfileIfOwned.
- */
-export declare function removePidfile(hippoRoot: string): void;
-/**
- * Remove the pidfile only if it still describes the caller's own server.
- * Reads and parses the pidfile and unlinks it ONLY when both `pid` and
- * `started_at` match `owner`. A pidfile rewritten by a newer server is left
- * intact, so a shutting-down older server cannot orphan the newer one by
- * deleting its pidfile out from under it.
- *
- * Best-effort and never throws: a missing, unreadable, malformed, or
- * non-object pidfile (including a literal JSON `null`) is "not provably mine"
- * and left alone — detectServer unlinks a malformed pidfile on its next
- * probe, so it does not leak. Returns true iff a matching pidfile was removed.
- *
- * Residual TOCTOU: the pidfile could be rewritten between the read and the
- * unlink. The window is microseconds and the shape is the same read-check-
- * unlink detectServer already uses; this narrows the clobber from an
- * unbounded window (any time between writePidfile and stop) to a negligible
- * one.
- */
-export declare function removePidfileIfOwned(hippoRoot: string, owner: {
-    pid: number;
-    startedAt: string;
-}): boolean;
-//# sourceMappingURL=server-detect.d.ts.map

package/dist/server-detect.js

@@ -1,222 +0,0 @@
-import { existsSync, readFileSync, writeFileSync, unlinkSync, renameSync } from 'node:fs';
-import { join } from 'node:path';
-import { envHealthProbeMs } from './env.js';
-// Pidfile sits directly inside hippoRoot. `hippoRoot` is the `.hippo`
-// directory itself (the same convention used by api.ts / store.ts /
-// openHippoDb), so this resolves to `${hippoRoot}/server.pid`.
-const PIDFILE = 'server.pid';
-/**
- * How long detectServer waits for the `/health` liveness probe before
- * treating the pidfile as stale. Short by design: the probe only fires on
- * the rare path where a pidfile exists and its pid is live, and the target
- * is always loopback, so a healthy server answers well within this bound. HIPPO_HEALTH_PROBE_MS overrides it.
- */
-const HEALTH_PROBE_TIMEOUT_MS = 300;
-/**
- * Hard cap on the /health response body detectServer will buffer. A real
- * hippo /health payload is well under 1 KB; a larger body means the process
- * answering on the recorded port is not hippo, so the pidfile is stale.
- */
-const HEALTH_BODY_MAX_BYTES = 64 * 1024;
-/**
- * Loopback hosts the recorded pidfile url is allowed to point at. serve()
- * only binds these (it mirrors LOOPBACK_HOSTS in server.ts); a pidfile url
- * with any other host is malformed or forged and must not be probed.
- */
-const PIDFILE_LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
-/** False when the pidfile's pid is dead or its url could not be one serve() wrote. */
-function isLiveLoopbackTarget(info) {
-    // Probe the process. Sending signal 0 throws if the pid is dead or owned
-    // by another user we cannot signal. Either way, treat as stale.
-    // Node's process.kill(pid, 0) is implemented on Windows via OpenProcess +
-    // GetExitCodeProcess, so this works cross-platform for the dead-pid case.
-    try {
-        process.kill(info.pid, 0);
-    }
-    catch {
-        return false;
-    }
-    // The pid is live, but it may have been reused by an unrelated process, and
-    // the recorded url is read from a file anyone could forge. serve() only ever
-    // binds a loopback host, so a url that is not http on a loopback host and the
-    // recorded port is malformed or forged. Reject it before probing: the probe,
-    // and the routed request that may follow, can carry HIPPO_API_KEY.
-    let probeUrl;
-    try {
-        probeUrl = new URL(info.url);
-    }
-    catch {
-        return false;
-    }
-    return (probeUrl.protocol === 'http:' &&
-        PIDFILE_LOOPBACK_HOSTS.has(probeUrl.hostname.replace(/^\[(.*)\]$/, '$1')) &&
-        probeUrl.port === String(info.port));
-}
-/** The whole body as text, or null once it passes HEALTH_BODY_MAX_BYTES (the stream is then cancelled). */
-async function readCappedBody(body) {
-    // Read the body under a hard byte cap. The process answering on info.url
-    // may not be hippo (pid reuse is the case this probe guards against), so
-    // its response is untrusted: never hand an unbounded stream to a parser.
-    const reader = body.getReader();
-    const decoder = new TextDecoder();
-    let raw = '';
-    let received = 0;
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        received += value.byteLength;
-        if (received > HEALTH_BODY_MAX_BYTES) {
-            await reader.cancel();
-            return null;
-        }
-        raw += decoder.decode(value, { stream: true });
-    }
-    raw += decoder.decode();
-    return raw;
-}
-/** True when /health on info.url reports the pidfile's started_at; unlinks the pidfile on any definitive mismatch. */
-async function healthMatchesPidfile(hippoRoot, info) {
-    // Confirm the process answering on info.url is this hippo server by matching
-    // the /health `started_at` against the pidfile. A connection refusal, a
-    // non-200, or a malformed body unlink the pidfile as stale. A probe timeout
-    // is deliberately left ambiguous: a live but momentarily-busy server (e.g.
-    // blocked on a synchronous query) can miss the 300ms window, so a timeout
-    // returns null WITHOUT unlinking. The pidfile survives for the next probe.
-    try {
-        const res = await fetch(`${info.url}/health`, {
-            signal: AbortSignal.timeout(envHealthProbeMs() ?? HEALTH_PROBE_TIMEOUT_MS),
-        });
-        if (!res.ok || !res.body) {
-            removePidfile(hippoRoot);
-            return false;
-        }
-        const raw = await readCappedBody(res.body);
-        if (raw === null) {
-            removePidfile(hippoRoot);
-            return false;
-        }
-        const body = JSON.parse(raw);
-        if (body.started_at !== info.started_at) {
-            removePidfile(hippoRoot);
-            return false;
-        }
-        return true;
-    }
-    catch (err) {
-        // A timeout is ambiguous (the server may be alive but busy), so keep the
-        // pidfile. Any other failure (connection refused, malformed body) is
-        // definitive: unlink it as stale.
-        // SAFETY: err's shape is unknown (catch clause); reading an optional
-        // .name property structurally is safe regardless of the object's actual type.
-        if (err?.name !== 'TimeoutError') {
-            removePidfile(hippoRoot);
-        }
-        return false;
-    }
-}
-/**
- * Read .hippo/server.pid and return the embedded ServerInfo if a live hippo
- * server is genuinely answering on the recorded url. Returns null on missing,
- * malformed, or stale pidfiles, and best-effort unlinks the file in the
- * stale/malformed cases.
- *
- * Liveness is proven in two steps. `process.kill(pid, 0)` rules out dead
- * pids. But a pid can be reused by an unrelated process, so a GET /health
- * then confirms the process that answers is *this* hippo server: its
- * `started_at` must equal the pidfile's. A mismatch, non-200, malformed
- * body, or timeout all mean the pidfile is stale.
- *
- * The /health probe runs only when a pidfile exists and the pid is live, so
- * the common no-server path stays a single fast file existence check.
- */
-export async function detectServer(hippoRoot) {
-    const path = join(hippoRoot, PIDFILE);
-    if (!existsSync(path))
-        return null;
-    let info;
-    try {
-        info = JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        removePidfile(hippoRoot);
-        return null;
-    }
-    if (!isLiveLoopbackTarget(info)) {
-        removePidfile(hippoRoot);
-        return null;
-    }
-    return (await healthMatchesPidfile(hippoRoot, info)) ? info : null;
-}
-/**
- * Atomically write the pidfile. Writes to a process-scoped temp file then
- * renames into place, which is atomic on POSIX and on NTFS via MoveFileEx.
- *
- * `startedAt` is supplied by the caller (`serve()`) rather than generated
- * here, so the pidfile and the server's GET /health response carry the same
- * timestamp — detectServer's liveness probe compares the two for equality.
- */
-export function writePidfile(hippoRoot, opts) {
-    const path = join(hippoRoot, PIDFILE);
-    const tmp = `${path}.tmp.${process.pid}`;
-    const info = {
-        schema: 1,
-        pid: process.pid,
-        port: opts.port,
-        url: opts.url,
-        started_at: opts.startedAt,
-    };
-    writeFileSync(tmp, JSON.stringify(info));
-    renameSync(tmp, path);
-}
-/**
- * Best-effort pidfile removal. Silent on ENOENT or any other error so the
- * caller can use this in shutdown paths without fear of throwing.
- *
- * Identity-blind: deletes whatever pidfile is on disk. A shutdown path that
- * must not clobber a newer server's pidfile should use removePidfileIfOwned.
- */
-export function removePidfile(hippoRoot) {
-    const path = join(hippoRoot, PIDFILE);
-    try {
-        unlinkSync(path);
-    }
-    catch { /* already gone or undeletable; the next detectServer probe re-checks */ }
-}
-/**
- * Remove the pidfile only if it still describes the caller's own server.
- * Reads and parses the pidfile and unlinks it ONLY when both `pid` and
- * `started_at` match `owner`. A pidfile rewritten by a newer server is left
- * intact, so a shutting-down older server cannot orphan the newer one by
- * deleting its pidfile out from under it.
- *
- * Best-effort and never throws: a missing, unreadable, malformed, or
- * non-object pidfile (including a literal JSON `null`) is "not provably mine"
- * and left alone — detectServer unlinks a malformed pidfile on its next
- * probe, so it does not leak. Returns true iff a matching pidfile was removed.
- *
- * Residual TOCTOU: the pidfile could be rewritten between the read and the
- * unlink. The window is microseconds and the shape is the same read-check-
- * unlink detectServer already uses; this narrows the clobber from an
- * unbounded window (any time between writePidfile and stop) to a negligible
- * one.
- */
-export function removePidfileIfOwned(hippoRoot, owner) {
-    const path = join(hippoRoot, PIDFILE);
-    try {
-        const info = JSON.parse(readFileSync(path, 'utf8'));
-        // A literal JSON `null` parses cleanly but throws on property access;
-        // that lands in the catch below, which is the intended "not mine" path.
-        if (info.pid !== owner.pid || info.started_at !== owner.startedAt) {
-            return false; // a different server owns the pidfile now
-        }
-        unlinkSync(path);
-        return true;
-    }
-    catch {
-        // Missing, unreadable, malformed, or non-object pidfile, or an unlink
-        // failure: none is a provable own-removal, so report not-removed.
-        return false;
-    }
-}
-//# sourceMappingURL=server-detect.js.map

package/dist/session-owners.d.ts

@@ -1,7 +0,0 @@
-import { type Context } from './api/types.js';
-import { type DatabaseSyncLike } from './db.js';
-/** Binds under the write lock and returns the stored owner, which is not `owner` when a concurrent first bind won. */
-export declare function insertBinding(db: DatabaseSyncLike, tenantId: string, sessionId: string, owner: string): string | null;
-/** Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set it aside. */
-export declare function bindSessionOwner(ctx: Context, sessionId: string): void;
-//# sourceMappingURL=session-owners.d.ts.map

package/dist/session-owners.js

@@ -1,54 +0,0 @@
-// A session id belongs to the first owner that binds it, so one developer's client cannot write into another's session.
-import { ConflictError } from './api-errors.js';
-import { ownerOrSubject } from './api/types.js';
-import { closeHippoDb, execWithBusyRetry, HOOK_DB_WAIT_MS, openHippoDb, scopedBusyWait } from './db.js';
-import { raiseMinBinary } from './db/meta.js';
-import { assertTenantId } from './tenant.js';
-import { TASK_OWNER_MIN_BINARY } from './version.js';
-/** Bindings older than this are pruned when a new session binds. */
-const BINDING_RETENTION_DAYS = 90;
-function boundOwner(db, tenantId, sessionId) {
-    // SAFETY: the SELECT names exactly this one TEXT column.
-    const row = db.prepare(`SELECT owner_subject FROM session_owners WHERE tenant_id = ? AND session_id = ?`).get(tenantId, sessionId);
-    return row?.owner_subject ?? null;
-}
-/** Binds under the write lock and returns the stored owner, which is not `owner` when a concurrent first bind won. */
-export function insertBinding(db, tenantId, sessionId, owner) {
-    execWithBusyRetry(db, 'BEGIN IMMEDIATE', scopedBusyWait() ?? HOOK_DB_WAIT_MS);
-    try {
-        const result = db.prepare(`INSERT OR IGNORE INTO session_owners(tenant_id, session_id, owner_subject, created_at) VALUES (?, ?, ?, ?)`)
-            .run(tenantId, sessionId, owner, new Date().toISOString());
-        // An older binary supersedes across owners, so the first binding shuts it out in the same transaction.
-        if (Number(result.changes ?? 0) === 1)
-            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
-        // Pruned on write, as the failure log is; a pruned session id is a UUID no other caller knows.
-        // SHORTCUT: no created_at index, so each first bind scans the table; add one past a few hundred thousand rows.
-        db.prepare(`DELETE FROM session_owners WHERE created_at < ?`).run(new Date(Date.now() - BINDING_RETENTION_DAYS * 86_400_000).toISOString());
-        db.exec('COMMIT');
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* the insert's error is the one to surface */ }
-        throw err;
-    }
-    // Re-read, since a concurrent first bind may have won the INSERT OR IGNORE.
-    return boundOwner(db, tenantId, sessionId);
-}
-/** Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set it aside. */
-export function bindSessionOwner(ctx, sessionId) {
-    assertTenantId('bindSessionOwner', ctx.tenantId);
-    const owner = ownerOrSubject(ctx.actor);
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        // A bound session is the common case after the first prompt, so it must not take the write lock.
-        const bound = boundOwner(db, ctx.tenantId, sessionId) ?? insertBinding(db, ctx.tenantId, sessionId, owner);
-        if (bound !== owner)
-            throw new ConflictError('session id belongs to another caller');
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-//# sourceMappingURL=session-owners.js.map