@remnic/core 9.69.6 → 9.69.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.69.6",
+  "version": "9.69.8",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3217,7 +3217,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.69.6"
+    "@remnic/coding-graph": "^9.69.8"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/activity/timeline/index.ts

@@ -16,6 +16,7 @@ export * from "./week-export.js";
 export * from "./week-snapshot.js";
 export * from "./week-previous.js";
 export * from "./week-recurring.js";
+export * from "./week-config-hash.js";
 export * from "./analysis-batch.js";
 export * from "./analysis-evidence.js";
 export * from "./analysis-prompt.js";

package/src/activity/timeline/week-config-hash.test.ts

@@ -0,0 +1,207 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { computeWeeklyConfigHash, WEEK_START_DAYS, type WeeklyConfigInput } from "./week-config-hash.js";
+
+const BASE: WeeklyConfigInput = {
+  timezone: "Europe/Paris",
+  weekStartsOn: "monday",
+  categories: [
+    { id: "development", name: "Development" },
+    { id: "communication", name: "Communication" },
+    { id: "system.unknown", name: "Uncategorized" },
+  ],
+};
+
+test("identical inputs produce identical hashes", () => {
+  const again: WeeklyConfigInput = {
+    timezone: "Europe/Paris",
+    weekStartsOn: "monday",
+    categories: BASE.categories.map((category) => ({ id: category.id, name: category.name })),
+  };
+  assert.strictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(again));
+});
+
+test("category order does not change the hash", () => {
+  const reordered: WeeklyConfigInput = {
+    ...BASE,
+    categories: [...BASE.categories].reverse(),
+  };
+  assert.strictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(reordered));
+});
+
+test("key insertion order does not change the hash", () => {
+  const rotated: WeeklyConfigInput = {
+    categories: [
+      { name: "Development", id: "development" },
+      { name: "Communication", id: "communication" },
+      { name: "Uncategorized", id: "system.unknown" },
+    ],
+    weekStartsOn: "monday",
+    timezone: "Europe/Paris",
+  };
+  assert.strictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(rotated));
+});
+
+test("a renamed category changes the hash", () => {
+  const renamed: WeeklyConfigInput = {
+    ...BASE,
+    categories: BASE.categories.map((category) =>
+      category.id === "development" ? { id: "development", name: "Coding" } : category,
+    ),
+  };
+  assert.notStrictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(renamed));
+});
+
+test("an added category changes the hash", () => {
+  const added: WeeklyConfigInput = {
+    ...BASE,
+    categories: [...BASE.categories, { id: "design", name: "Design" }],
+  };
+  assert.notStrictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(added));
+});
+
+test("a removed category changes the hash", () => {
+  const removed: WeeklyConfigInput = {
+    ...BASE,
+    categories: BASE.categories.slice(0, 2),
+  };
+  assert.notStrictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(removed));
+});
+
+test("a different timezone changes the hash", () => {
+  const shifted: WeeklyConfigInput = { ...BASE, timezone: "UTC" };
+  assert.notStrictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(shifted));
+});
+
+test("a different weekStartsOn changes the hash", () => {
+  const shifted: WeeklyConfigInput = { ...BASE, weekStartsOn: "sunday" };
+  assert.notStrictEqual(computeWeeklyConfigHash(BASE), computeWeeklyConfigHash(shifted));
+});
+
+test("duplicate category ids throw RangeError", () => {
+  const duplicated: WeeklyConfigInput = {
+    ...BASE,
+    categories: [
+      { id: "development", name: "Development" },
+      { id: "development", name: "Dev" },
+    ],
+  };
+  assert.throws(() => computeWeeklyConfigHash(duplicated), RangeError);
+  assert.throws(() => computeWeeklyConfigHash(duplicated), /duplicate/);
+});
+
+test("blank fields throw RangeError naming the field", () => {
+  assert.throws(
+    () => computeWeeklyConfigHash({ ...BASE, timezone: "" }),
+    RangeError,
+  );
+  assert.throws(
+    () => computeWeeklyConfigHash({ ...BASE, timezone: "   " }),
+    /timezone/,
+  );
+  assert.throws(
+    () => computeWeeklyConfigHash({ ...BASE, weekStartsOn: "" }),
+    /weekStartsOn/,
+  );
+  assert.throws(
+    () => computeWeeklyConfigHash({ ...BASE, categories: [{ id: "", name: "Dev" }] }),
+    /categories\[0\]\.id/,
+  );
+  assert.throws(
+    () => computeWeeklyConfigHash({ ...BASE, categories: [{ id: "dev", name: " " }] }),
+    /categories\[0\]\.name/,
+  );
+});
+
+test("digest is lowercase hex of the documented length", () => {
+  const digest = computeWeeklyConfigHash(BASE);
+  assert.match(digest, /^[0-9a-f]{64}$/);
+  assert.strictEqual(digest.length, 64);
+});
+
+test("the caller's category array is not mutated", () => {
+  const input: WeeklyConfigInput = {
+    timezone: "UTC",
+    weekStartsOn: "monday",
+    categories: [
+      { id: "b", name: "B" },
+      { id: "a", name: "A" },
+    ],
+  };
+  const before = structuredClone(input);
+  computeWeeklyConfigHash(input);
+  assert.deepStrictEqual(input, before);
+});
+
+// Review: a non-blank check let a typo acquire a durable snapshot identity,
+// so correcting the typo later forked the stored history.
+test("an invalid IANA timezone is refused before hashing", () => {
+  // "utc" is deliberately absent: IANA zone names are case-insensitive, so
+  // the shared validator accepts it and it is not a typo.
+  for (const timezone of ["Not/AZone", "America/Nowhere", "Chicago"]) {
+    assert.throws(
+      () =>
+        computeWeeklyConfigHash({
+          timezone,
+          weekStartsOn: "monday",
+          categories: [{ id: "dev", name: "Development" }],
+        }),
+      /timezone/i,
+    );
+  }
+  // A real zone still works.
+  assert.match(
+    computeWeeklyConfigHash({
+      timezone: "America/Chicago",
+      weekStartsOn: "monday",
+      categories: [{ id: "dev", name: "Development" }],
+    }),
+    /^[0-9a-f]+$/,
+  );
+});
+
+test("weekStartsOn must be a known weekday", () => {
+  for (const weekStartsOn of ["monady", "Monday", "mon", ""]) {
+    assert.throws(
+      () =>
+        computeWeeklyConfigHash({
+          timezone: "UTC",
+          weekStartsOn,
+          categories: [{ id: "dev", name: "Development" }],
+        }),
+      /weekStartsOn/,
+    );
+  }
+  for (const weekStartsOn of WEEK_START_DAYS) {
+    assert.match(
+      computeWeeklyConfigHash({
+        timezone: "UTC",
+        weekStartsOn,
+        categories: [{ id: "dev", name: "Development" }],
+      }),
+      /^[0-9a-f]+$/,
+    );
+  }
+});
+
+// Review round 2: equivalent zone identifiers must not fork one snapshot
+// history. Canonicalization happens before hashing.
+test("equivalent timezone identifiers hash identically", () => {
+  const base = { weekStartsOn: "monday", categories: [{ id: "c", name: "Code" }] };
+  assert.equal(
+    computeWeeklyConfigHash({ ...base, timezone: "utc" }),
+    computeWeeklyConfigHash({ ...base, timezone: "UTC" }),
+    "casing is not a semantic change",
+  );
+  assert.equal(
+    computeWeeklyConfigHash({ ...base, timezone: "US/Eastern" }),
+    computeWeeklyConfigHash({ ...base, timezone: "America/New_York" }),
+    "an alias is not a semantic change",
+  );
+  assert.notEqual(
+    computeWeeklyConfigHash({ ...base, timezone: "UTC" }),
+    computeWeeklyConfigHash({ ...base, timezone: "America/New_York" }),
+    "genuinely different zones still differ",
+  );
+});

package/src/activity/timeline/week-config-hash.ts

@@ -0,0 +1,83 @@
+/**
+ * Weekly snapshot config hash (issue #2052).
+ *
+ * `persistWeeklySnapshot` keys each snapshot file by a `configHash`; this
+ * computes that digest deterministically from the weekly config so every
+ * caller derives the same value for the same inputs. Stable across category
+ * order and key insertion order; any semantic change produces a new digest,
+ * which keys a new snapshot file instead of mutating an unrelated period.
+ *
+ * Values are validated, not merely non-blank: a typo like `"Not/AZone"` or
+ * `"monady"` would otherwise get a durable snapshot identity, and correcting
+ * the typo later would fork the stored history instead of continuing it.
+ */
+import { assertValidTimezone, hashActivityBody } from "../digest.js";
+
+export interface WeeklyConfigInput {
+  timezone: string;
+  weekStartsOn: string;
+  /** Category definitions that shape the snapshot. */
+  categories: readonly { id: string; name: string }[];
+}
+
+/** Week-start vocabulary. Lowercase day names, matching the config surface. */
+export const WEEK_START_DAYS = Object.freeze([
+  "monday",
+  "tuesday",
+  "wednesday",
+  "thursday",
+  "friday",
+  "saturday",
+  "sunday",
+] as const);
+
+function requireNonBlank(value: unknown, field: string): string {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new RangeError(`${field} must be a non-blank string`);
+  }
+  return value;
+}
+
+export function computeWeeklyConfigHash(input: WeeklyConfigInput): string {
+  if (typeof input !== "object" || input === null) {
+    throw new RangeError("input must be a WeeklyConfigInput object");
+  }
+  const rawTimezone = requireNonBlank(input.timezone, "timezone");
+  assertValidTimezone(rawTimezone);
+  // Canonicalize before hashing: `utc` and `UTC` are the same zone, and
+  // `US/Eastern` is an alias of `America/New_York`. Hashing the raw string
+  // gives two callers two identities for one zone, which would fork one
+  // snapshot history on a harmless casing or alias change.
+  const timezone = new Intl.DateTimeFormat("en-US", { timeZone: rawTimezone })
+    .resolvedOptions().timeZone;
+  const weekStartsOn = requireNonBlank(input.weekStartsOn, "weekStartsOn");
+  if (!(WEEK_START_DAYS as readonly string[]).includes(weekStartsOn)) {
+    throw new RangeError(
+      `weekStartsOn must be one of ${WEEK_START_DAYS.join(", ")}; got ${JSON.stringify(weekStartsOn)}`,
+    );
+  }
+  if (!Array.isArray(input.categories)) {
+    throw new RangeError("categories must be an array of category definitions");
+  }
+  // Copy + sort: never sort the caller's array in place, and hash category
+  // order-independently so a harmless reorder cannot orphan stored snapshots.
+  const sorted = input.categories
+    .map((category, index) => ({
+      id: requireNonBlank(category?.id, `categories[${index}].id`),
+      name: requireNonBlank(category?.name, `categories[${index}].name`),
+    }))
+    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  for (let index = 1; index < sorted.length; index++) {
+    if (sorted[index].id === sorted[index - 1].id) {
+      throw new RangeError(`duplicate category id: ${sorted[index].id}`);
+    }
+  }
+  // Fixed field order; JSON.stringify each part so no separator can collide
+  // with category content.
+  const body = [
+    JSON.stringify(timezone),
+    JSON.stringify(weekStartsOn),
+    ...sorted.map((category) => JSON.stringify([category.id, category.name])),
+  ].join("\n");
+  return hashActivityBody(body);
+}

package/src/extraction-span-source-hash.test.ts

@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  stampSpanSource,
+  verifySpanSource,
+  type SpanSourceStamp,
+} from "./extraction-span-source-hash.js";
+
+const TEXT = "The canary offset string, version one.";
+
+test("stampSpanSource: round trip verifies ok", () => {
+  const stamp = stampSpanSource(TEXT);
+  const check = verifySpanSource(TEXT, stamp);
+  assert.deepEqual(check, { ok: true });
+});
+
+test("stampSpanSource: empty string gets a real stamp and round trips", () => {
+  const stamp = stampSpanSource("");
+  assert.match(stamp.hash, /^[0-9a-f]{64}$/);
+  assert.equal(stamp.length, 0);
+  assert.equal(
+    stamp.hash,
+    "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  );
+  assert.deepEqual(verifySpanSource("", stamp), { ok: true });
+});
+
+test("verifySpanSource: same-length single-character edit is hash_mismatch", () => {
+  const stamp = stampSpanSource(TEXT);
+  const edited = TEXT.replace("canary", "canarz");
+  assert.equal(edited.length, TEXT.length);
+  const check = verifySpanSource(edited, stamp);
+  assert.equal(check.ok, false);
+  if (!check.ok) {
+    assert.equal(check.error, "hash_mismatch");
+  }
+});
+
+test("verifySpanSource: added character is length_mismatch even though hash also differs", () => {
+  const stamp = stampSpanSource(TEXT);
+  const longer = `${TEXT}!`;
+  const check = verifySpanSource(longer, stamp);
+  assert.equal(check.ok, false);
+  if (!check.ok) {
+    assert.equal(check.error, "length_mismatch");
+    assert.equal(check.expected.length, TEXT.length);
+    assert.equal(check.actual.length, longer.length);
+  }
+});
+
+test("verifySpanSource: failure result carries no source text", () => {
+  const original = "original driftmarker-alpha payload";
+  const edited = "original driftmarker-beta payload";
+  const stamp = stampSpanSource(original);
+  const check = verifySpanSource(edited, stamp);
+  assert.equal(check.ok, false);
+  const serialized = JSON.stringify(check);
+  assert.ok(!serialized.includes("driftmarker-alpha"));
+  assert.ok(!serialized.includes("driftmarker-beta"));
+});
+
+test("stampSpanSource: non-string text throws TypeError naming text", () => {
+  assert.throws(() => stampSpanSource(42 as unknown as string), /text/);
+  assert.throws(() => stampSpanSource(null as unknown as string), /text/);
+  assert.throws(
+    () => stampSpanSource(undefined as unknown as string),
+    /text/,
+  );
+});
+
+test("verifySpanSource: non-string text throws TypeError naming text", () => {
+  const stamp = stampSpanSource(TEXT);
+  assert.throws(
+    () => verifySpanSource(7 as unknown as string, stamp),
+    /text/,
+  );
+});
+
+function stampWithHash(hash: unknown): SpanSourceStamp {
+  return { hash: hash as string, length: TEXT.length };
+}
+
+test("verifySpanSource: malformed expected hash throws RangeError naming the field", () => {
+  const good = stampSpanSource(TEXT);
+  const tooShort = good.hash.slice(0, 63);
+  const upper = good.hash.toUpperCase();
+  const nonHex = `${good.hash.slice(0, 63)}z`;
+  for (const bad of [tooShort, upper, nonHex, 123, null]) {
+    assert.throws(
+      () => verifySpanSource(TEXT, stampWithHash(bad)),
+      (err: unknown) => {
+        assert.ok(err instanceof RangeError);
+        assert.match((err as Error).message, /hash/);
+        return true;
+      },
+    );
+  }
+});
+
+test("verifySpanSource: inherited stamp fields are rejected", () => {
+  const good = stampSpanSource(TEXT);
+  const inherited = Object.create(good) as SpanSourceStamp;
+  assert.throws(
+    () => verifySpanSource(TEXT, inherited),
+    (err: unknown) => {
+      assert.ok(err instanceof RangeError);
+      assert.match((err as Error).message, /hash/);
+      return true;
+    },
+  );
+});
+
+test("verifySpanSource: negative or fractional expected length throws", () => {
+  const good = stampSpanSource(TEXT);
+  for (const bad of [-1, -0.5, 4.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+    assert.throws(
+      () => verifySpanSource(TEXT, { hash: good.hash, length: bad }),
+      (err: unknown) => {
+        assert.ok(err instanceof RangeError);
+        assert.match((err as Error).message, /length/);
+        return true;
+      },
+    );
+  }
+});
+
+test("stampSpanSource: two stamps of the same string are identical", () => {
+  const a = stampSpanSource(TEXT);
+  const b = stampSpanSource(TEXT);
+  assert.deepEqual(a, b);
+  assert.equal(JSON.stringify(a), JSON.stringify(b));
+});
+
+// Review: Node's UTF-8 encoder replaces an unpaired surrogate with U+FFFD, so
+// hashing utf8 gave these three distinct strings ONE digest and drift between
+// them verified as unchanged. Unpaired surrogates arrive via JSON escapes.
+test("unpaired surrogates produce distinct stamps", () => {
+  const a = stampSpanSource("\ud800");
+  const b = stampSpanSource("\ud801");
+  const replacement = stampSpanSource("\ufffd");
+  assert.notEqual(a.hash, b.hash);
+  assert.notEqual(a.hash, replacement.hash);
+  assert.notEqual(b.hash, replacement.hash);
+  // And drift between them is now caught rather than passing.
+  assert.deepEqual(verifySpanSource("\ud801", a), {
+    ok: false,
+    error: "hash_mismatch",
+    expected: { hash: a.hash, length: a.length },
+    actual: b,
+  });
+});
+
+// Review: the result echoed the caller's stamp object, so an extra property
+// holding the source text would travel with the failure.
+test("a failure result carries only the two stamp fields", () => {
+  const stamped = stampSpanSource("the original source text");
+  const contaminated = { ...stamped, source: "SENSITIVE-SOURCE-TEXT" } as typeof stamped;
+  const result = verifySpanSource("a different source text!", contaminated);
+  assert.equal(result.ok, false);
+  const serialized = JSON.stringify(result);
+  assert.equal(serialized.includes("SENSITIVE-SOURCE-TEXT"), false);
+  assert.equal(serialized.includes("source"), false);
+  assert.ok(!result.ok && result.error === "hash_mismatch");
+  assert.deepEqual(Object.keys(result.ok === false ? result.expected : {}).sort(), ["hash", "length"]);
+});

package/src/extraction-span-source-hash.ts

@@ -0,0 +1,100 @@
+/**
+ * Span source stamp/verify (issue #2333).
+ *
+ * Offsets index the exact normalized string sent to the model. If that string
+ * drifts before materialization, the offsets point at different characters and
+ * a wrong quote is persisted as verbatim source. The stamp lets materialization
+ * detect the drift without carrying the source text alongside it.
+ *
+ * Pure apart from hashing: no I/O, no clock, no randomness. The input text is
+ * never mutated and never appears in a result or error message.
+ */
+
+import { createHash } from "node:crypto";
+
+export interface SpanSourceStamp {
+  /** Hex digest of the exact string the model was shown. */
+  hash: string;
+  /** Length of that string, so a mismatch reports which dimension drifted. */
+  length: number;
+}
+
+export type SpanSourceCheck =
+  | { ok: true }
+  | {
+      ok: false;
+      error: "length_mismatch" | "hash_mismatch";
+      expected: SpanSourceStamp;
+      actual: SpanSourceStamp;
+    };
+
+const HASH_PATTERN = /^[0-9a-f]{64}$/;
+
+function requireText(text: string): void {
+  if (typeof text !== "string") {
+    throw new TypeError(`text must be a string, got ${typeof text}`);
+  }
+}
+
+function requireStamp(expected: SpanSourceStamp): void {
+  if (!Object.hasOwn(expected, "hash")) {
+    throw new RangeError("expected stamp is missing field hash");
+  }
+  if (!Object.hasOwn(expected, "length")) {
+    throw new RangeError("expected stamp is missing field length");
+  }
+  const { hash, length } = expected;
+  if (typeof hash !== "string" || !HASH_PATTERN.test(hash)) {
+    throw new RangeError(
+      "expected stamp field hash must be 64 lowercase hex characters",
+    );
+  }
+  if (!Number.isInteger(length) || length < 0) {
+    throw new RangeError(
+      "expected stamp field length must be a non-negative integer",
+    );
+  }
+}
+
+/**
+ * Hash the exact string. No trimming, no newline normalization.
+ *
+ * The digest covers UTF-16LE code units, not UTF-8 bytes: Node's UTF-8
+ * encoder replaces an unpaired surrogate with U+FFFD before hashing, so
+ * "\ud800", "\ud801", and "\ufffd" all produce ONE digest under utf8 and
+ * drift between them would verify as unchanged. Unpaired surrogates reach
+ * real memory text through JSON escapes, and this stamp exists to catch
+ * exactly that class of silent substitution, so it hashes a lossless
+ * representation of the string instead.
+ */
+export function stampSpanSource(text: string): SpanSourceStamp {
+  requireText(text);
+  const hash = createHash("sha256").update(Buffer.from(text, "utf16le")).digest("hex");
+  return { hash, length: text.length };
+}
+
+/**
+ * Verify the materialized string against its stamp. Length is compared first:
+ * it is the cheaper, more diagnostic dimension. Mismatch results carry both
+ * stamps and never the text itself.
+ */
+export function verifySpanSource(
+  text: string,
+  expected: SpanSourceStamp,
+): SpanSourceCheck {
+  requireText(text);
+  requireStamp(expected);
+  const actual = stampSpanSource(text);
+  // Project the caller's stamp down to exactly the two stamp fields. Echoing
+  // the original object would re-export any extra property it carries — a
+  // `source` field holding the text defeats the whole point of a stamp, which
+  // exists so the content does not have to travel.
+  const safeExpected: SpanSourceStamp = { hash: expected.hash, length: expected.length };
+  if (actual.length !== safeExpected.length) {
+    return { ok: false, error: "length_mismatch", expected: safeExpected, actual };
+  }
+  if (actual.hash !== safeExpected.hash) {
+    return { ok: false, error: "hash_mismatch", expected: safeExpected, actual };
+  }
+  return { ok: true };
+}

package/src/location/matching.test.ts

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { matchDominantPlace, memoryLocationWindow, type LocationTagPolicy } from "./matching.js";
+import { locationTagSlug, matchDominantPlace, memoryLocationWindow, type LocationTagPolicy } from "./matching.js";
 import type { LocationPlace, LocationSegment } from "./types.js";
 
 const policy: LocationTagPolicy = {
@@ -63,3 +63,33 @@ test("dominant named place wins; ties stay unmatched", () => {
   assert.equal(tied.status, "unmatched");
   if (tied.status === "unmatched") assert.equal(tied.reason, "ambiguous");
 });
+
+test("locationTagSlug: pins slug collapsing and edge trimming", () => {
+  assert.equal(locationTagSlug("reitti:place:7"), "reitti-place-7");
+  assert.equal(locationTagSlug("  --Mixed CASE--  "), "mixed-case");
+  assert.equal(locationTagSlug("---"), "");
+  assert.equal(locationTagSlug("a---b"), "a-b");
+  assert.equal(locationTagSlug("Café Central"), "caf-central");
+});
+
+test("locationTagSlug: the collapse keeps edges single-dash, so the trim is complete", () => {
+  // This is the invariant the single-character edge strips depend on: the
+  // /[^a-z0-9]+/ collapse cannot leave two dashes at an edge. Relax or reorder
+  // the collapse and the strips silently stop being complete, so assert the
+  // OUTPUT contract directly rather than timing something the collapse has
+  // already bounded.
+  const adversarial = [
+    "-".repeat(5_000),
+    "a" + "-".repeat(5_000) + "b",
+    "-".repeat(5_000) + "a",
+    "a" + "-".repeat(5_000),
+    "___---...   a   ...---___",
+    "\u2014\u2014a\u2014\u2014",
+  ];
+  for (const placeId of adversarial) {
+    const slug = locationTagSlug(placeId);
+    assert.ok(!slug.startsWith("-"), `leading dash survived: ${JSON.stringify(slug)}`);
+    assert.ok(!slug.endsWith("-"), `trailing dash survived: ${JSON.stringify(slug)}`);
+    assert.doesNotMatch(slug, /--/, `adjacent dashes survived: ${JSON.stringify(slug)}`);
+  }
+});

package/src/location/matching.ts

@@ -233,7 +233,12 @@ export function locationTagSlug(placeId: string): string {
   const slug = placeId
     .toLowerCase()
     .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+    // The collapse above leaves at most one dash at each edge, so single-char
+    // strips are complete. The old /^-+|-+$/ alternation backtracked
+    // quadratically on unsanitized dash runs (CodeQL js/polynomial-redos);
+    // single-character anchors are linear.
+    .replace(/^-/, "")
+    .replace(/-$/, "");
   return slug.slice(0, TAG_LIMITS.maxTagLength - LOCATION_TAG_PREFIX.length);
 }