hippo-memory 1.69.0 → 1.71.0

package/dist/connectors/slack/web-client.js

@@ -1,15 +1,31 @@
-import { fetchWithRetry, isRetryableStatus } from '../../http-retry.js';
-import { isJsonString } from '../../json.js';
-/**
- * Build a SlackHistoryFetcher that pages `conversations.history` over real
- * HTTP. Wraps `fetchWithRetry` so 429 and 5xx handling is automatic. The returned
- * fetcher is the one `backfillChannel` consumes.
- *
- * Slack omits `channel` from messages in the history response, so we stamp
- * the request channel id onto each parsed message — downstream ingest needs
- * it on every event.
- */
+import { fetchWithRetry, isRetryableStatus } from '../../util/http-retry.js';
+import { readCappedJson } from '../../util/capped-json.js';
+import { errorMessage } from '../../util/log.js';
+import { isJsonObject, isJsonString } from '../../util/json.js';
+/** Build a SlackHistoryFetcher that pages `conversations.history` over HTTP via `fetchWithRetry` (429 and 5xx handled).
+ *  Slack omits `channel` from history messages, so the request channel id is stamped onto each one for ingest. */
 const SLACK_TIMEOUT_MS = 30_000;
+// A page is at most 200 messages, each up to 40,000 characters at 4 bytes, carried once as text and once as rich-text blocks.
+const SLACK_MAX_REPLY_BYTES = 64 * 1024 * 1024;
+function isSlackMessage(m) {
+    return isJsonObject(m) && m.type === 'message' && isJsonString(m.ts);
+}
+/** The reply as a JSON object. The error names the status and the path only, since the query string carries channel ids and cursors. */
+async function readHistoryReply(r, url) {
+    const where = `slack: HTTP ${r.status} on ${url.pathname}`;
+    let body;
+    try {
+        body = await readCappedJson(r, SLACK_MAX_REPLY_BYTES);
+    }
+    catch (err) {
+        throw new Error(`${where}: ${errorMessage(err)}`, { cause: err });
+    }
+    if (!isJsonObject(body))
+        throw new Error(`${where}: the reply is not a JSON object`);
+    if (body.messages !== undefined && !Array.isArray(body.messages))
+        throw new Error(`${where}: \`messages\` is not an array`);
+    return body;
+}
 export function slackHistoryFetcher(token, fetchImpl) {
     return async ({ channelId, cursor, oldest }) => {
         const url = new URL('https://slack.com/api/conversations.history');
@@ -25,27 +41,17 @@ export function slackHistoryFetcher(token, fetchImpl) {
         });
         if (isRetryableStatus(r.status))
             throw new Error(`slack: still rate-limited or unavailable (HTTP ${r.status})`);
-        // SAFETY: body is the Slack `conversations.history` response; per the
-        // documented shape it's `{ ok, error?, messages?, response_metadata? }`.
-        const body = (await r.json());
-        if (!body.ok)
-            throw new Error(`slack: ${body.error ?? 'unknown error'}`);
-        const messages = (body.messages ?? [])
-            .filter((m) => {
-            if (m === null || Array.isArray(m) || typeof m !== 'object') {
-                return false;
-            }
-            // SAFETY: the check above just confirmed m is a non-null, non-array
-            // plain object, so it's safe to treat as a JSON-shaped record; the
-            // `m is SlackMessageEvent` predicate is what validates the fields.
-            const o = m;
-            return o.type === 'message' && isJsonString(o.ts);
-        })
+        const body = await readHistoryReply(r, url);
+        if (body.ok !== true)
+            throw new Error(`slack: ${isJsonString(body.error) ? body.error : 'unknown error'}`);
+        const messages = (Array.isArray(body.messages) ? body.messages : [])
+            .filter(isSlackMessage)
             // Slack returns messages without `channel`; stamp it from the request.
             .map((m) => ({ ...m, channel: channelId }));
+        const nextCursor = isJsonObject(body.response_metadata) ? body.response_metadata.next_cursor : undefined;
         return {
             messages,
-            next_cursor: body.response_metadata?.next_cursor ?? null,
+            next_cursor: isJsonString(nextCursor) ? nextCursor : null,
         };
     };
 }

package/dist/connectors/slack/webhook.d.ts

@@ -1,22 +1,6 @@
-import { type WebhookRequest } from '../../http-util.js';
-/**
- * Slack Events API webhook. Auth is signature-based (HMAC over the raw
- * body with SLACK_SIGNING_SECRET); Bearer is NOT required, which is why
- * this route is in PUBLIC_ROUTES. The route is responsible for:
- *   1. Echoing the one-time url_verification challenge.
- *   2. Verifying the HMAC on every other inbound payload.
- *   3. Resolving body.team_id → tenantId via slack_workspaces, falling
- *      back to HIPPO_TENANT then 'default'.
- *   4. Dispatching event_callback envelopes to ingestMessage /
- *      handleMessageDeleted.
- *   5. Parking malformed or unhandled payloads in slack_dlq and STILL
- *      ACKing 200 - Slack retries forever otherwise.
- *
- * When SLACK_SIGNING_SECRET is unset we return 404, not
- * 503, so an external probe cannot distinguish "route gated off by config"
- * from "route does not exist on this build".
- *
- * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
- */
-export declare function handleSlackEventsWebhook({ req, res, opts }: WebhookRequest): Promise<void>;
+import type { HippoStore } from '../../store/index.js';
+import { type WebhookRequest } from '../../util/http-util.js';
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (hence PUBLIC_ROUTES); malformed payloads go to slack_dlq, ACK 200.
+ *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
+export declare function handleSlackEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/slack/webhook.js

@@ -1,36 +1,22 @@
-import { envSlackSigningSecret, envSlackSigningSecretPrevious } from '../../env.js';
+import { envSlackSigningSecret, envSlackSigningSecretPrevious } from '../../util/env.js';
 import { verifySlackSignature } from './signature.js';
 import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
 import { ingestMessage } from './ingest.js';
 import { handleMessageDeleted } from './deletion.js';
-import { writeToDlq } from './dlq.js';
-import { resolveTenantForTeam } from './tenant-routing.js';
-import { resolveTenantId } from '../../tenant.js';
-import { openHippoDb, closeHippoDb } from '../../db.js';
-import { HttpError, JSON_HEADERS, isHeaderString, isJsonObjectRecord, readBody, sendJson, } from '../../http-util.js';
-/**
- * Slack Events API webhook. Auth is signature-based (HMAC over the raw
- * body with SLACK_SIGNING_SECRET); Bearer is NOT required, which is why
- * this route is in PUBLIC_ROUTES. The route is responsible for:
- *   1. Echoing the one-time url_verification challenge.
- *   2. Verifying the HMAC on every other inbound payload.
- *   3. Resolving body.team_id → tenantId via slack_workspaces, falling
- *      back to HIPPO_TENANT then 'default'.
- *   4. Dispatching event_callback envelopes to ingestMessage /
- *      handleMessageDeleted.
- *   5. Parking malformed or unhandled payloads in slack_dlq and STILL
- *      ACKing 200 - Slack retries forever otherwise.
- *
- * When SLACK_SIGNING_SECRET is unset we return 404, not
- * 503, so an external probe cannot distinguish "route gated off by config"
- * from "route does not exist on this build".
- *
- * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
- */
-export async function handleSlackEventsWebhook({ req, res, opts }) {
-    const rawBody = await readBody(req);
+import { parkInDlq } from '../dlq.js';
+import { slackDlq } from './dlq.js';
+import { resolveTenantForSlackTeam } from './tenant-routing.js';
+import { resolveTenantId } from '../../store/tenant.js';
+import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson } from '../../util/http-util.js';
+import { isJsonObject } from '../../util/json.js';
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (hence PUBLIC_ROUTES); malformed payloads go to slack_dlq, ACK 200.
+ *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
+export async function handleSlackEventsWebhook(request, store) {
+    const { req, res, opts } = request;
+    // Secret and headers before the body, so a caller with neither cannot make the server buffer one.
     const secret = envSlackSigningSecret();
     if (!secret) {
+        closeIfBodyUnread(request);
         res.writeHead(404, JSON_HEADERS);
         res.end(JSON.stringify({ error: 'not found' }));
         return;
@@ -40,77 +26,74 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
     const tsHdr = req.headers['x-slack-request-timestamp'];
     const sigStr = isHeaderString(sig) ? sig : null;
     const tsStr = isHeaderString(tsHdr) ? tsHdr : null;
-    if (sigStr === null ||
-        tsStr === null ||
-        !verifySlackSignature({
-            rawBody,
-            timestamp: tsStr,
-            signature: sigStr,
-            signingSecret: secret,
-            previousSecret,
-        })) {
+    if (sigStr === null || tsStr === null) {
+        closeIfBodyUnread(request);
         throw new HttpError(401, 'invalid Slack signature');
     }
-    routeSignedSlackPayload({ hippoRoot: opts.hippoRoot, res, rawBody, signature: sigStr, slackTimestamp: tsStr });
-}
-function parkInDlq(d, park) {
-    const db = openHippoDb(d.hippoRoot);
-    try {
-        writeToDlq(db, {
-            tenantId: park.tenantId,
-            teamId: park.teamId,
-            rawPayload: d.rawBody,
-            error: park.error,
-            bucket: park.bucket,
-            signature: d.signature,
-            slackTimestamp: d.slackTimestamp,
-        });
-    }
-    finally {
-        closeHippoDb(db);
+    const rawBody = await readWebhookBody(request);
+    if (!verifySlackSignature({
+        rawBody,
+        timestamp: tsStr,
+        signature: sigStr,
+        signingSecret: secret,
+        previousSecret,
+    })) {
+        throw new HttpError(401, 'invalid Slack signature');
     }
+    await routeSignedSlackPayload({ hippoRoot: opts.hippoRoot, store, res, rawBody, signature: sigStr, slackTimestamp: tsStr });
+}
+async function parkAndAck(d, park) {
+    const row = {
+        tenantId: park.tenantId,
+        teamId: park.teamId,
+        rawPayload: d.rawBody,
+        error: park.error,
+        bucket: park.bucket,
+        signature: d.signature,
+        slackTimestamp: d.slackTimestamp,
+    };
+    await parkInDlq(slackDlq, d.hippoRoot, row, d.store);
     sendJson(d.res, 200, { ok: true, status: 'dlq' });
 }
-function routeSignedSlackPayload(d) {
-    const { rawBody, res } = d;
+function teamIdInRawBody(rawBody) {
     // Cheap regex extracts team_id from a (possibly malformed) raw body so the
     // DLQ row carries it for triage even when JSON.parse fails.
-    const teamIdFromRaw = (() => {
-        const m = rawBody.match(/"team_id"\s*:\s*"([^"]+)"/);
-        return m ? m[1] : null;
-    })();
-    let body;
-    try {
-        body = JSON.parse(rawBody);
-    }
-    catch {
-        parkUnparseable(d, teamIdFromRaw);
-        return;
-    }
-    if (isJsonObjectRecord(body)) {
+    const m = rawBody.match(/"team_id"\s*:\s*"([^"]+)"/);
+    return m ? m[1] : null;
+}
+/** Answers Slack's URL-verification handshake; false when the payload is anything else. */
+function answerUrlVerification(res, body) {
+    if (isJsonObject(body)) {
         const bodyRecord = body;
         if (bodyRecord.type === 'url_verification') {
             sendJson(res, 200, {
                 challenge: String(bodyRecord.challenge ?? ''),
             });
-            return;
+            return true;
         }
     }
-    // Resolve tenant, failing closed: when slack_workspaces is non-empty
-    // and the team_id is unknown, resolveTenantForTeam returns null and we
-    // park the envelope in slack_dlq with bucket='unroutable'. Mandatory ACK
-    // 200 so Slack stops retrying; do NOT call ingest.
+    return false;
+}
+async function routeSignedSlackPayload(d) {
+    const { rawBody, res } = d;
+    const teamIdFromRaw = teamIdInRawBody(rawBody);
+    let body;
+    try {
+        body = JSON.parse(rawBody);
+    }
+    catch {
+        await parkUnparseable(d, teamIdFromRaw);
+        return;
+    }
+    if (answerUrlVerification(res, body))
+        return;
+    // Fail closed: resolveTenantForSlackTeam returns null for an unknown team on a non-empty slack_workspaces; park it in slack_dlq (bucket='unroutable')
+    // and still ACKs 200 so Slack stops retrying; never call ingest.
     let resolvedTenant = null;
     if (body !== undefined && isSlackEventEnvelope(body)) {
-        const db = openHippoDb(d.hippoRoot);
-        try {
-            resolvedTenant = resolveTenantForTeam(db, body.team_id);
-        }
-        finally {
-            closeHippoDb(db);
-        }
+        resolvedTenant = await resolveTenantForSlackTeam(d.hippoRoot, body.team_id, d.store);
         if (resolvedTenant === null) {
-            parkInDlq(d, {
+            await parkAndAck(d, {
                 tenantId: null, // unroutable - stored as '__unroutable__'
                 teamId: body.team_id,
                 error: `unroutable team_id: ${body.team_id}`,
@@ -127,9 +110,10 @@ function routeSignedSlackPayload(d) {
         hippoRoot: d.hippoRoot,
         tenantId: resolvedTenant,
         actor: { subject: 'connector:slack', role: 'admin' },
+        store: d.store,
     };
     if (body === undefined || !isSlackEventEnvelope(body)) {
-        parkInDlq(d, {
+        await parkAndAck(d, {
             tenantId: ctx.tenantId,
             teamId: teamIdFromRaw,
             error: 'not an event_callback envelope',
@@ -137,35 +121,25 @@ function routeSignedSlackPayload(d) {
         });
         return;
     }
-    dispatchSlackEvent(d, ctx, body);
+    await dispatchSlackEvent(d, ctx, body);
 }
-function parkUnparseable(d, teamIdFromRaw) {
+async function parkUnparseable(d, teamIdFromRaw) {
     // Attribute the parse failure to the originating workspace via the regex-extracted
     // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
-    const db = openHippoDb(d.hippoRoot);
-    try {
-        const parseFailTenant = teamIdFromRaw !== null ? resolveTenantForTeam(db, teamIdFromRaw) : null;
-        writeToDlq(db, {
-            tenantId: parseFailTenant, // null → '__unroutable__' sentinel
-            teamId: teamIdFromRaw,
-            rawPayload: d.rawBody,
-            error: 'invalid JSON',
-            bucket: 'parse_error',
-            signature: d.signature,
-            slackTimestamp: d.slackTimestamp,
-        });
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    sendJson(d.res, 200, { ok: true, status: 'dlq' });
+    const parseFailTenant = teamIdFromRaw !== null ? await resolveTenantForSlackTeam(d.hippoRoot, teamIdFromRaw, d.store) : null;
+    await parkAndAck(d, {
+        tenantId: parseFailTenant, // null → '__unroutable__' sentinel
+        teamId: teamIdFromRaw,
+        error: 'invalid JSON',
+        bucket: 'parse_error',
+    });
 }
-function dispatchSlackEvent(d, ctx, body) {
+async function dispatchSlackEvent(d, ctx, body) {
     const { res } = d;
     const inner = body.event;
     if (isSlackMessageEvent(inner)) {
         if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
-            const r = handleMessageDeleted(ctx, {
+            const r = await handleMessageDeleted(ctx, {
                 teamId: body.team_id,
                 channelId: inner.channel,
                 deletedTs: inner.deleted_ts,
@@ -174,11 +148,9 @@ function dispatchSlackEvent(d, ctx, body) {
             sendJson(res, 200, { ok: true, status: r.status });
             return;
         }
-        const r = ingestMessage(ctx, {
+        const r = await ingestMessage(ctx, {
             teamId: body.team_id,
-            // channel privacy isn't on the inner event; use channel_type as a
-            // proxy. 'group'|'im'|'mpim' → private. 'channel' → public. Unknown
-            // → private (fail closed).
+            // Channel privacy is not on the inner event, so channel_type is the proxy: 'group'|'im'|'mpim' private, 'channel' public, unknown private.
             channel: {
                 id: inner.channel,
                 is_private: inner.channel_type !== 'channel',
@@ -191,7 +163,7 @@ function dispatchSlackEvent(d, ctx, body) {
         sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
         return;
     }
-    parkInDlq(d, {
+    await parkAndAck(d, {
         tenantId: ctx.tenantId,
         teamId: body.team_id,
         error: `unhandled event type: ${inner.type ?? 'unknown'}`,

package/dist/connectors/slack/workspaces.d.ts

@@ -1,46 +1,13 @@
-/**
- * Slack workspace registration helpers.
- *
- * The `slack_workspaces` table maps Slack `team_id` → hippo `tenant_id`.
- * Empty table = single-tenant install (HIPPO_TENANT fallback).
- * Non-empty = multi-workspace install (fail-closed routing via
- * `resolveTenantForTeam`).
- *
- * These helpers give the CLI (`hippo slack workspaces add|list|remove`) a
- * surface, so operators with multiple workspaces need no direct SQL.
- *
- * Design choices:
- *   - `add` is an upsert (ON CONFLICT UPDATE). Re-registering an
- *     existing team_id with a different tenant_id intentionally
- *     overwrites — operators move workspaces between tenants and the
- *     CLI shouldn't require a delete+add dance.
- *   - `list` sorts by team_id for stable output.
- *   - `remove` returns a boolean for the CLI to distinguish "removed"
- *     from "not found" without an extra SELECT.
- */
-import type { DatabaseSyncLike } from '../../db.js';
-export interface SlackWorkspace {
-    teamId: string;
-    tenantId: string;
-    addedAt: string;
-}
+/** Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty = single-tenant, non-empty = fail-closed routing).
+ *  `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no delete+add. */
+import { type SlackWorkspace } from '../../store/connectors/slack.js';
+export type { SlackWorkspace };
+export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace } from '../../store/connectors/slack.js';
 export interface AddWorkspaceOpts {
     teamId: string;
     tenantId: string;
 }
-/**
- * Register or re-register a Slack team → tenant mapping. Upserts on
- * team_id conflict (operators move workspaces between tenants).
- */
-export declare function addWorkspace(db: DatabaseSyncLike, opts: AddWorkspaceOpts): SlackWorkspace;
-/**
- * List all registered workspaces, sorted by team_id for stable output.
- */
-export declare function listWorkspaces(db: DatabaseSyncLike): SlackWorkspace[];
-/**
- * Remove a workspace registration by team_id. Returns true if a row was
- * deleted, false if no row matched (so the CLI can report not-found
- * without a separate lookup).
- */
-export declare function removeWorkspace(db: DatabaseSyncLike, teamId: string): boolean;
+/** Register or re-register a Slack team → tenant mapping. Upserts on
+ *  team_id conflict (operators move workspaces between tenants). */
+export declare function addWorkspace(hippoRoot: string, opts: AddWorkspaceOpts): SlackWorkspace;
 //# sourceMappingURL=workspaces.d.ts.map

package/dist/connectors/slack/workspaces.js

@@ -1,60 +1,10 @@
-/**
- * Slack workspace registration helpers.
- *
- * The `slack_workspaces` table maps Slack `team_id` → hippo `tenant_id`.
- * Empty table = single-tenant install (HIPPO_TENANT fallback).
- * Non-empty = multi-workspace install (fail-closed routing via
- * `resolveTenantForTeam`).
- *
- * These helpers give the CLI (`hippo slack workspaces add|list|remove`) a
- * surface, so operators with multiple workspaces need no direct SQL.
- *
- * Design choices:
- *   - `add` is an upsert (ON CONFLICT UPDATE). Re-registering an
- *     existing team_id with a different tenant_id intentionally
- *     overwrites — operators move workspaces between tenants and the
- *     CLI shouldn't require a delete+add dance.
- *   - `list` sorts by team_id for stable output.
- *   - `remove` returns a boolean for the CLI to distinguish "removed"
- *     from "not found" without an extra SELECT.
- */
-/**
- * Register or re-register a Slack team → tenant mapping. Upserts on
- * team_id conflict (operators move workspaces between tenants).
- */
-export function addWorkspace(db, opts) {
-    const addedAt = new Date().toISOString();
-    db.prepare(`INSERT INTO slack_workspaces (team_id, tenant_id, added_at)
-     VALUES (?, ?, ?)
-     ON CONFLICT(team_id) DO UPDATE SET
-       tenant_id = excluded.tenant_id,
-       added_at = excluded.added_at`).run(opts.teamId, opts.tenantId, addedAt);
-    return { teamId: opts.teamId, tenantId: opts.tenantId, addedAt };
-}
-/**
- * List all registered workspaces, sorted by team_id for stable output.
- */
-export function listWorkspaces(db) {
-    // SAFETY: query selects exactly team_id, tenant_id, added_at, all NOT NULL
-    // text columns in the slack_workspaces schema, so each row has this shape.
-    const rows = db
-        .prepare(`SELECT team_id, tenant_id, added_at FROM slack_workspaces ORDER BY team_id`)
-        .all();
-    return rows.map((r) => ({
-        teamId: r.team_id,
-        tenantId: r.tenant_id,
-        addedAt: r.added_at,
-    }));
-}
-/**
- * Remove a workspace registration by team_id. Returns true if a row was
- * deleted, false if no row matched (so the CLI can report not-found
- * without a separate lookup).
- */
-export function removeWorkspace(db, teamId) {
-    const result = db
-        .prepare(`DELETE FROM slack_workspaces WHERE team_id = ?`)
-        .run(teamId);
-    return Number(result.changes) > 0;
+/** Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty = single-tenant, non-empty = fail-closed routing).
+ *  `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no delete+add. */
+import { upsertSlackWorkspace } from '../../store/connectors/slack.js';
+export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace } from '../../store/connectors/slack.js';
+/** Register or re-register a Slack team → tenant mapping. Upserts on
+ *  team_id conflict (operators move workspaces between tenants). */
+export function addWorkspace(hippoRoot, opts) {
+    return upsertSlackWorkspace(hippoRoot, opts.teamId, opts.tenantId);
 }
 //# sourceMappingURL=workspaces.js.map

package/dist/consolidate/conflicts.d.ts

@@ -1,4 +1,4 @@
-import { MemoryEntry, type DecayOptions } from '../memory.js';
+import { MemoryEntry, type DecayOptions } from '../core/memory.js';
 /** Pairs of live non-semantic memories that contradict each other, in survivor order. */
 export declare function detectConflicts(entries: MemoryEntry[], now: Date, decayOpts?: DecayOptions, rescuedIds?: Set<string>): Array<{
     memory_a_id: string;

package/dist/consolidate/conflicts.js

@@ -1,14 +1,10 @@
-import { Layer, calculateStrength } from '../memory.js';
-import { jaccardMinShared, overlapPartners } from '../overlap-index.js';
-import { isQuarantineScope } from '../quarantine.js';
-import { isPersonalScope } from '../recall-scope.js';
+import { Layer, calculateStrength } from '../core/memory.js';
+import { jaccardMinShared, overlapPartners } from './overlap-index.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { isPersonalScope } from '../store/recall-scope.js';
 import { DECAY_THRESHOLD } from './decay.js';
-// Contradictions should be gated by content overlap, not shared tags. Tags like
-// `feedback` / `policy` are too coarse and can make unrelated rules look like
-// conflicts before the polarity heuristics run.
-// Jaccard threshold on stopword-filtered tokens. Only applied after a polarity
-// signal has already been detected (explicit pair or inferred negation), so
-// this just filters out drive-by topic similarity, not semantic drift.
+// Gate contradictions on content overlap, not shared tags (`feedback`/`policy` are too coarse). The Jaccard threshold on stopword-filtered tokens
+// only applies after a polarity signal, so it filters drive-by topic similarity, not semantic drift.
 const CONFLICT_OVERLAP_THRESHOLD = 0.5;
 // Minimum distinctive shared tokens before we trust an overlap score. Filters
 // out cases where two memories share only common English + a project name.
@@ -41,9 +37,8 @@ rescuedIds = new Set()) {
     const partnersOf = overlapPartners(profiles.map((p) => p.distinct), jaccardMinShared(CONFLICT_OVERLAP_THRESHOLD, CONFLICT_MIN_RARE_SHARED));
     for (let i = 0; i < survivors.length; i++) {
         for (const j of partnersOf(i)) {
-            // Traces are variants of each other, not contradictions. Two
-            // strategies for the same task can both be valid; conflict detection
-            // exists for stated-rule disagreement, not strategy diversity.
+            // Traces are variants of each other, not contradictions: two strategies for the same task can both be valid,
+            // and conflict detection is for stated-rule disagreement, not strategy diversity.
             if (survivors[i].layer === Layer.Trace && survivors[j].layer === Layer.Trace)
                 continue;
             if (survivors[i].superseded_by || survivors[j].superseded_by)
@@ -77,8 +72,7 @@ function recalledTogether(a, b) {
 }
 function conflictProfile(text) {
     const opening = openingWindow(text);
-    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray
-    // negation deep in a prose memory doesn't flip the intent.
+    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray negation deep in a prose memory doesn't flip the intent.
     // Pad with spaces so space-delimited patterns match words at the start/end.
     return { distinct: distinctiveTokens(text), polarity: inferConflictPolarity(opening), window: ' ' + opening.toLowerCase() + ' ' };
 }
@@ -128,9 +122,7 @@ function openingWindow(text) {
 }
 // Takes opening windows only, so " on " and " off " as prepositions deep in long prose don't read as enabled/disabled.
 function classifyConflictType(a, b, aPolarity, bPolarity) {
-    // Tightened tokens: require whole-word boundaries so " on " alone doesn't
-    // match "on/off". Pair only `enabled` ↔ `disabled` and explicit on/off in
-    // imperative context.
+    // Whole-word boundaries so " on " alone doesn't match "on/off"; pair only `enabled` <-> `disabled` and explicit on/off in imperative context.
     const enabledDisabled = (containsAny(a, [' enabled ', ' enable ']) && containsAny(b, [' disabled ', ' disable ']))
         || (containsAny(b, [' enabled ', ' enable ']) && containsAny(a, [' disabled ', ' disable ']));
     if (enabledDisabled)

package/dist/consolidate/dag-summary.d.ts

@@ -0,0 +1,8 @@
+export interface DagSummaryOptions {
+    apiKey: string;
+    model?: string;
+    fetcher?: typeof fetch;
+    onError?: (msg: string) => void;
+}
+export declare function generateDagSummary(label: string, factContents: string[], opts: DagSummaryOptions): Promise<string | null>;
+//# sourceMappingURL=dag-summary.d.ts.map

package/dist/consolidate/dag-summary.js

@@ -0,0 +1,41 @@
+// The one LLM call behind every DAG summary, kept apart from the graph writes so its request bytes are tested on their own.
+import { redactSecretsStrict } from '../util/secret-detect.js';
+import { describeMessageFailure, sendAnthropicMessage } from '../util/anthropic-messages.js';
+import { certainDefect } from '../core/memory-quality.js';
+const DAG_SUMMARY_PROMPT = `You are summarizing a cluster of facts about a specific topic/entity for a memory system.
+
+Topic: {label}
+Facts:
+{facts}
+
+` +
+    'Write a single concise paragraph (2-4 sentences) that captures all the key information from these facts. ' +
+    'This summary will be used to quickly determine if this cluster is relevant to a future query, ' +
+    'so include specific names, dates, numbers, and key details. Output ONLY the summary paragraph, no preamble.';
+// Output budget for one summary paragraph, and the shortest reply kept as a summary.
+const SUMMARY_MAX_TOKENS = 400;
+const SUMMARY_MIN_CHARS = 20;
+export async function generateDagSummary(label, factContents, opts) {
+    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecretsStrict(f)}`).join('\n');
+    const prompt = DAG_SUMMARY_PROMPT
+        .replace('{label}', redactSecretsStrict(label))
+        .replace('{facts}', factsBlock);
+    const reply = await sendAnthropicMessage({
+        apiKey: opts.apiKey,
+        model: opts.model,
+        maxTokens: SUMMARY_MAX_TOKENS,
+        prompt,
+        fetcher: opts.fetcher,
+    });
+    if (!reply.ok) {
+        opts.onError?.(describeMessageFailure(reply.failure));
+        return null;
+    }
+    const defect = certainDefect(reply.text);
+    if (defect !== null) {
+        opts.onError?.(`summary quality refused: ${defect}`);
+        return null;
+    }
+    return reply.text.length >= SUMMARY_MIN_CHARS ? reply.text : null;
+}
+//# sourceMappingURL=dag-summary.js.map