hippo-memory 2.0.0 → 2.1.0

package/dist/connectors/slack/web-client.js

@@ -5,12 +5,16 @@ import { isJsonObject, isJsonString } from '../../util/json.js';
 /** Build a SlackHistoryFetcher that pages `conversations.history` over HTTP via `fetchWithRetry` (429 and 5xx handled).
  *  Slack omits `channel` from history messages, so the request channel id is stamped onto each one for ingest. */
 const SLACK_TIMEOUT_MS = 30_000;
-// A page is at most 200 messages, each up to 40,000 characters at 4 bytes, carried once as text and once as rich-text blocks.
+// A page is at most 200 messages, each up to 40,000 characters at 4 bytes, carried once as text and once as rich-text
+// blocks.
 const SLACK_MAX_REPLY_BYTES = 64 * 1024 * 1024;
 function isSlackMessage(m) {
     return isJsonObject(m) && m.type === 'message' && isJsonString(m.ts);
 }
-/** The reply as a JSON object. The error names the status and the path only, since the query string carries channel ids and cursors. */
+/**
+ * The reply as a JSON object. The error names the status and the path only, since the query string carries channel ids
+ * and cursors.
+ */
 async function readHistoryReply(r, url) {
     const where = `slack: HTTP ${r.status} on ${url.pathname}`;
     let body;
@@ -22,8 +26,9 @@ async function readHistoryReply(r, url) {
     }
     if (!isJsonObject(body))
         throw new Error(`${where}: the reply is not a JSON object`);
-    if (body.messages !== undefined && !Array.isArray(body.messages))
+    if (body.messages !== undefined && !Array.isArray(body.messages)) {
         throw new Error(`${where}: \`messages\` is not an array`);
+    }
     return body;
 }
 export function slackHistoryFetcher(token, fetchImpl) {

package/dist/connectors/slack/webhook.d.ts

@@ -1,7 +1,7 @@
-import type { HippoStore } from '../../store/index.js';
+import type { ConnectorStore } from '../store.js';
 import { type WebhookRequest } from '../../util/http-util.js';
-/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares webhook-signature);
- *  malformed payloads go to slack_dlq, ACK 200.
- *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
-export declare function handleSlackEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares
+ * webhook-signature); malformed payloads go to slack_dlq, ACK 200. 404 (not 503) when the secret is unset, so a probe
+ * cannot tell a gated-off route from a missing one. */
+export declare function handleSlackEventsWebhook(request: WebhookRequest, store: ConnectorStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/slack/webhook.js

@@ -7,11 +7,11 @@ import { parkInDlq } from '../dlq.js';
 import { slackDlq } from './dlq.js';
 import { resolveTenantForSlackTeam } from './tenant-routing.js';
 import { resolveTenantId } from '../../store/tenant.js';
-import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson } from '../../util/http-util.js';
+import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson, } from '../../util/http-util.js';
 import { isJsonObject } from '../../util/json.js';
-/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares webhook-signature);
- *  malformed payloads go to slack_dlq, ACK 200.
- *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares
+ * webhook-signature); malformed payloads go to slack_dlq, ACK 200. 404 (not 503) when the secret is unset, so a probe
+ * cannot tell a gated-off route from a missing one. */
 export async function handleSlackEventsWebhook(request, store) {
     const { req, res, opts } = request;
     // Secret and headers before the body, so a caller with neither cannot make the server buffer one.
@@ -41,7 +41,14 @@ export async function handleSlackEventsWebhook(request, store) {
     })) {
         throw new HttpError(401, 'invalid Slack signature');
     }
-    await routeSignedSlackPayload({ hippoRoot: opts.hippoRoot, store, res, rawBody, signature: sigStr, slackTimestamp: tsStr });
+    await routeSignedSlackPayload({
+        hippoRoot: opts.hippoRoot,
+        store,
+        res,
+        rawBody,
+        signature: sigStr,
+        slackTimestamp: tsStr,
+    });
 }
 async function parkAndAck(d, park) {
     const row = {
@@ -53,7 +60,7 @@ async function parkAndAck(d, park) {
         signature: d.signature,
         slackTimestamp: d.slackTimestamp,
     };
-    await parkInDlq(slackDlq, d.hippoRoot, row, d.store);
+    await parkInDlq(slackDlq, d.store, row);
     sendJson(d.res, 200, { ok: true, status: 'dlq' });
 }
 function teamIdInRawBody(rawBody) {
@@ -88,11 +95,11 @@ async function routeSignedSlackPayload(d) {
     }
     if (answerUrlVerification(res, body))
         return;
-    // Fail closed: resolveTenantForSlackTeam returns null for an unknown team on a non-empty slack_workspaces; park it in slack_dlq (bucket='unroutable')
-    // and still ACKs 200 so Slack stops retrying; never call ingest.
+    // Fail closed: resolveTenantForSlackTeam returns null for an unknown team on a non-empty slack_workspaces; park it in
+    // slack_dlq (bucket='unroutable') and still ACKs 200 so Slack stops retrying; never call ingest.
     let resolvedTenant = null;
     if (body !== undefined && isSlackEventEnvelope(body)) {
-        resolvedTenant = await resolveTenantForSlackTeam(d.hippoRoot, body.team_id, d.store);
+        resolvedTenant = await resolveTenantForSlackTeam(d.store, body.team_id);
         if (resolvedTenant === null) {
             await parkAndAck(d, {
                 tenantId: null, // unroutable - stored as '__unroutable__'
@@ -127,7 +134,7 @@ async function routeSignedSlackPayload(d) {
 async function parkUnparseable(d, teamIdFromRaw) {
     // Attribute the parse failure to the originating workspace via the regex-extracted
     // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
-    const parseFailTenant = teamIdFromRaw !== null ? await resolveTenantForSlackTeam(d.hippoRoot, teamIdFromRaw, d.store) : null;
+    const parseFailTenant = teamIdFromRaw !== null ? await resolveTenantForSlackTeam(d.store, teamIdFromRaw) : null;
     await parkAndAck(d, {
         tenantId: parseFailTenant, // null → '__unroutable__' sentinel
         teamId: teamIdFromRaw,
@@ -151,7 +158,8 @@ async function dispatchSlackEvent(d, ctx, body) {
         }
         const r = await ingestMessage(ctx, {
             teamId: body.team_id,
-            // Channel privacy is not on the inner event, so channel_type is the proxy: 'group'|'im'|'mpim' private, 'channel' public, unknown private.
+            // Channel privacy is not on the inner event, so channel_type is the proxy: 'group'|'im'|'mpim' private, 'channel'
+            // public, unknown private.
             channel: {
                 id: inner.channel,
                 is_private: inner.channel_type !== 'channel',

package/dist/connectors/slack/workspaces.d.ts

@@ -1,8 +1,12 @@
-/** Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty = single-tenant, non-empty = fail-closed routing).
- *  `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no delete+add. */
+/**
+ * Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty =
+ * single-tenant, non-empty = fail-closed routing).
+ * `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no
+ * delete+add.
+ */
 import { type SlackWorkspace } from '../../store/connectors/slack.js';
 export type { SlackWorkspace };
-export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace } from '../../store/connectors/slack.js';
+export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace, } from '../../store/connectors/slack.js';
 export interface AddWorkspaceOpts {
     teamId: string;
     tenantId: string;

package/dist/connectors/slack/workspaces.js

@@ -1,7 +1,11 @@
-/** Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty = single-tenant, non-empty = fail-closed routing).
- *  `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no delete+add. */
+/**
+ * Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty =
+ * single-tenant, non-empty = fail-closed routing).
+ * `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no
+ * delete+add.
+ */
 import { upsertSlackWorkspace } from '../../store/connectors/slack.js';
-export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace } from '../../store/connectors/slack.js';
+export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace, } from '../../store/connectors/slack.js';
 /** Register or re-register a Slack team → tenant mapping. Upserts on
  *  team_id conflict (operators move workspaces between tenants). */
 export function addWorkspace(hippoRoot, opts) {

package/dist/connectors/store.d.ts

@@ -0,0 +1,8 @@
+import type { ContextWith } from '../api/index.js';
+import type { StoreWith } from '../store/index.js';
+/** The groups a connector delivery writes through; the webhook gate proves all three before any delivery runs. */
+type ConnectorGroup = 'entryWrites' | 'connectorWrites' | 'connectorEvents';
+export type ConnectorStore = StoreWith<ConnectorGroup>;
+export type ConnectorContext = ContextWith<ConnectorGroup>;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/connectors/store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.js.map

package/dist/consolidate/conflicts.js

@@ -3,7 +3,8 @@ import { jaccardMinShared, overlapPartners } from './overlap-index.js';
 import { isQuarantineScope } from '../trust/quarantine.js';
 import { isPersonalScope } from '../core/recall-scope.js';
 import { DECAY_THRESHOLD } from './decay.js';
-// Gate contradictions on content overlap, not shared tags (`feedback`/`policy` are too coarse). The Jaccard threshold on stopword-filtered tokens
+// Gate contradictions on content overlap, not shared tags (`feedback`/`policy` are too coarse). The Jaccard threshold
+// on stopword-filtered tokens
 // only applies after a polarity signal, so it filters drive-by topic similarity, not semantic drift.
 const CONFLICT_OVERLAP_THRESHOLD = 0.5;
 // Minimum distinctive shared tokens before we trust an overlap score. Filters
@@ -45,8 +46,9 @@ rescuedIds = new Set()) {
                 continue;
             if (!recalledTogether(survivors[i], survivors[j]))
                 continue;
-            if ([survivors[i], survivors[j]].some((e) => e.tags.includes('extracted') || e.tags.includes('session-digest')))
+            if ([survivors[i], survivors[j]].some((e) => e.tags.includes('extracted') || e.tags.includes('session-digest'))) {
                 continue;
+            }
             const reasonAndScore = describeConflict(profiles[i], profiles[j]);
             if (!reasonAndScore)
                 continue;
@@ -60,7 +62,10 @@ rescuedIds = new Set()) {
     }
     return detected;
 }
-/** One project's ambient context can show both: same tenant, and the same project or a user-global row beside a project's. */
+/**
+ * One project's ambient context can show both: same tenant, and the same project or a user-global row beside a
+ * project's.
+ */
 function recalledTogether(a, b) {
     // A personal row pairs only inside its own scope; any other pair shows its id to someone else.
     if ((isPersonalScope(a.scope) || isPersonalScope(b.scope)) && a.scope !== b.scope)
@@ -72,9 +77,14 @@ function recalledTogether(a, b) {
 }
 function conflictProfile(text) {
     const opening = openingWindow(text);
-    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray negation deep in a prose memory doesn't flip the intent.
+    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray negation deep in a prose memory doesn't
+    // flip the intent.
     // Pad with spaces so space-delimited patterns match words at the start/end.
-    return { distinct: distinctiveTokens(text), polarity: inferConflictPolarity(opening), window: ' ' + opening.toLowerCase() + ' ' };
+    return {
+        distinct: distinctiveTokens(text),
+        polarity: inferConflictPolarity(opening),
+        window: ' ' + opening.toLowerCase() + ' ',
+    };
 }
 function describeConflict(a, b) {
     // Jaccard on stopword-stripped tokens. Defer the threshold check until we
@@ -122,20 +132,24 @@ function openingWindow(text) {
 }
 // Takes opening windows only, so " on " and " off " as prepositions deep in long prose don't read as enabled/disabled.
 function classifyConflictType(a, b, aPolarity, bPolarity) {
-    // Whole-word boundaries so " on " alone doesn't match "on/off"; pair only `enabled` <-> `disabled` and explicit on/off in imperative context.
+    // Whole-word boundaries so " on " alone doesn't match "on/off"; pair only `enabled` <-> `disabled` and explicit
+    // on/off in imperative context.
     const enabledDisabled = (containsAny(a, [' enabled ', ' enable ']) && containsAny(b, [' disabled ', ' disable ']))
         || (containsAny(b, [' enabled ', ' enable ']) && containsAny(a, [' disabled ', ' disable ']));
     if (enabledDisabled)
         return 'enabled/disabled mismatch on overlapping statement';
-    const trueFalse = (containsAny(a, [' true ', ' true.', ' true,', ' yes ']) && containsAny(b, [' false ', ' false.', ' false,', ' no ']))
-        || (containsAny(b, [' true ', ' true.', ' true,', ' yes ']) && containsAny(a, [' false ', ' false.', ' false,', ' no ']));
+    const trueFalse = (containsAny(a, [' true ', ' true.', ' true,', ' yes ']) &&
+        containsAny(b, [' false ', ' false.', ' false,', ' no '])) ||
+        (containsAny(b, [' true ', ' true.', ' true,', ' yes ']) &&
+            containsAny(a, [' false ', ' false.', ' false,', ' no ']));
     if (trueFalse)
         return 'true/false mismatch on overlapping statement';
     const alwaysNever = (containsAny(a, [' always ', ' must ']) && containsAny(b, [' never ', ' must not ']))
         || (containsAny(b, [' always ', ' must ']) && containsAny(a, [' never ', ' must not ']));
     if (alwaysNever)
         return 'always/never mismatch on overlapping statement';
-    if ((aPolarity === 'positive' && bPolarity === 'negative') || (aPolarity === 'negative' && bPolarity === 'positive')) {
+    if ((aPolarity === 'positive' && bPolarity === 'negative') ||
+        (aPolarity === 'negative' && bPolarity === 'positive')) {
         return 'negation polarity mismatch on overlapping statement';
     }
     return null;

package/dist/consolidate/dag-summary.js

@@ -1,4 +1,5 @@
-// The one LLM call behind every DAG summary, kept apart from the graph writes so its request bytes are tested on their own.
+// The one LLM call behind every DAG summary, kept apart from the graph writes so its request bytes are tested on their
+// own.
 import { redactSecretsStrict } from '../util/secret-detect.js';
 import { describeMessageFailure, sendAnthropicMessage } from '../util/anthropic-messages.js';
 import { certainDefect } from '../core/memory-quality.js';

package/dist/consolidate/dag.d.ts

@@ -1,5 +1,8 @@
 import { type MemoryEntry } from '../core/memory.js';
+import type { Consolidation, LocalFiles } from '../store/port.js';
 import { type DagSummaryOptions } from './dag-summary.js';
+/** Sleep's store, with the folder whose config sets a new summary's half-life. */
+type DagStore = Pick<LocalFiles, 'hippoRoot' | 'consolidation'>;
 export interface FactCluster {
     label: string;
     members: MemoryEntry[];
@@ -14,7 +17,7 @@ export interface DagBuildResult {
      *  guard-exempt (same id + content), so only summary-creation refusals count. */
     rejected: number;
 }
-export declare function buildDag(hippoRoot: string, facts: MemoryEntry[], opts: DagSummaryOptions): Promise<DagBuildResult>;
+export declare function buildDag(local: DagStore, facts: MemoryEntry[], opts: DagSummaryOptions): Promise<DagBuildResult>;
 export interface DagRebuildResult {
     attempted: number;
     rebuilt: number;
@@ -23,9 +26,10 @@ export interface DagRebuildResult {
     failed: number;
     capped: boolean;
 }
-/** Sleep-cycle phase draining the dirty L2 summary queue; one throwing rebuild does not abort the rest.
- * A concurrent sleep's second writer gets changed=false (UPDATE requires summary_dirty=1) and is skipped silently; a tombstone hit counts as `refused`. */
-export declare function rebuildDirtySummaries(hippoRoot: string, opts: DagSummaryOptions & {
+/** Sleep-cycle phase draining the dirty L2 summary queue; one throwing rebuild does not abort the rest. A concurrent
+ * sleep's second writer gets changed=false (UPDATE requires summary_dirty=1) and is skipped silently; a tombstone hit
+ * counts as `refused`. */
+export declare function rebuildDirtySummaries(store: Consolidation, opts: DagSummaryOptions & {
     cap?: number;
 }): Promise<DagRebuildResult>;
 export interface EntityProfilesBuildResult {
@@ -39,5 +43,6 @@ export interface EntityProfilesBuildResult {
 }
 /** Build L3 entity profiles by clustering L2 summaries sharing entity tags (2+ L2s per entity).
  * Each L2 link write marks the new L3 dirty, so clear it or the same cycle re-rebuilds it. */
-export declare function buildEntityProfiles(hippoRoot: string, l2Summaries: MemoryEntry[], opts: DagSummaryOptions): Promise<EntityProfilesBuildResult>;
+export declare function buildEntityProfiles(local: DagStore, l2Summaries: MemoryEntry[], opts: DagSummaryOptions): Promise<EntityProfilesBuildResult>;
+export {};
 //# sourceMappingURL=dag.d.ts.map

package/dist/consolidate/dag.js

@@ -1,6 +1,4 @@
 import { createMemory, Layer } from '../core/memory.js';
-import { writeEntry, writeEntriesTogether } from '../store/entry-writes.js';
-import { loadAllDirtySummaries, loadChildrenOfSummary, loadChildrenOfSummaries, childrenKey, applyRebuildResult, clearSummaryDirtyAfterBuild, } from '../store/summaries.js';
 import { RejectedValueError } from '../core/api-errors.js';
 import { generateDagSummary } from './dag-summary.js';
 import { overlapPartners } from './overlap-index.js';
@@ -17,7 +15,8 @@ export function clusterFacts(facts) {
         return [];
     const entityTags = facts.map((f) => f.tags.filter((t) => t.startsWith('speaker:') || t.startsWith('topic:')));
     const tagSets = entityTags.map((tags) => new Set(tags));
-    // Every tag indexed, not a prefix: a repeated tag counts twice in `shared`, so the prefix-filter bound would not hold.
+    // Every tag indexed, not a prefix: a repeated tag counts twice in `shared`, so the prefix-filter bound would not
+    // hold.
     const partnersOf = overlapPartners(tagSets, () => 1);
     const assigned = new Set();
     const clusters = [];
@@ -45,8 +44,8 @@ export function clusterFacts(facts) {
     }
     return clusters;
 }
-// Partition before clustering so one LLM summary never mixes tenants; Map keeps insertion order, so a single-tenant store iterates as before.
-// buildEntityProfiles partitions its L2s with this same key.
+// Partition before clustering so one LLM summary never mixes tenants; Map keeps insertion order, so a single-tenant
+// store iterates as before. buildEntityProfiles partitions its L2s with this same key.
 function partitionFactsByTenant(unparented) {
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
@@ -62,12 +61,13 @@ function partitionFactsByTenant(unparented) {
 /** The L2 summary entry for one cluster, landing in the facts' own tenant and scope. */
 function createClusterSummaryEntry(summary, cluster, home) {
     const memberCreatedAts = cluster.members.map((m) => m.created).sort();
-    // Every cluster member shares home.tenantId (tenant partition above), so the summary lands in the facts' tenant, not 'default'.
+    // Every cluster member shares home.tenantId (tenant partition above), so the summary lands in the facts' tenant,
+    // not 'default'.
     const summaryEntry = createMemory(summary, {
         layer: Layer.Semantic,
         tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-summary'],
         confidence: 'inferred',
-        dag_level: 2,
+        dagLevel: 2,
         tenantId: home.tenantId,
         scope: home.scope,
         baseHalfLifeDays: home.baseHalfLifeDays,
@@ -81,7 +81,7 @@ function createClusterSummaryEntry(summary, cluster, home) {
     return summaryEntry;
 }
 /** Summarize one eligible cluster, write the summary, then re-parent its members under it. */
-async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
+async function summarizeCluster(store, cluster, home, opts, result) {
     const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
     if (!summary)
         return;
@@ -89,25 +89,25 @@ async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
     // A refused summary skips only this cluster. writeEntry's guard reads tenantId off the entry
     // (home.tenantId), so it already checks this tenant's tombstones: no separate check here.
     try {
-        writeEntry(hippoRoot, summaryEntry);
+        store.writeEntry(summaryEntry);
     }
     catch (err) {
         if (err instanceof RejectedValueError) {
             result.rejected++;
-            log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
+            log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`, errorFields(err));
             return;
         }
         throw err;
     }
     result.summariesCreated++;
-    result.factsLinked += writeEntriesTogether(hippoRoot, cluster.members.map((member) => ({ ...member, dag_parent_id: summaryEntry.id })));
+    result.factsLinked += store.writeTogether(cluster.members.map((member) => ({ ...member, dag_parent_id: summaryEntry.id })));
     // Member writes just marked this fresh summary dirty; clear it, or the same sleep cycle's
     // rebuild pass would re-rebuild every new summary at twice the LLM cost.
-    clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenant_id, 'buildDag');
+    store.clearSummaryDirty(summaryEntry.id, summaryEntry.tenant_id, 'buildDag');
 }
-export async function buildDag(hippoRoot, facts, opts) {
+export async function buildDag(local, facts, opts) {
     const result = { candidateClusters: 0, summariesCreated: 0, factsLinked: 0, rejected: 0 };
-    const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
+    const baseHalfLifeDays = loadConfig(local.hippoRoot).defaultHalfLifeDays;
     const unparented = facts.filter((f) => f.dag_level === 1 && !f.dag_parent_id && f.tags.includes('extracted'));
     for (const [, tenantFacts] of partitionFactsByTenant(unparented)) {
         const home = {
@@ -120,19 +120,19 @@ export async function buildDag(hippoRoot, facts, opts) {
         const eligibleClusters = clusters.filter((c) => c.members.length >= 3);
         result.candidateClusters += eligibleClusters.length;
         for (const cluster of eligibleClusters) {
-            await summarizeCluster(hippoRoot, cluster, home, opts, result);
+            await summarizeCluster(local.consolidation, cluster, home, opts, result);
         }
     }
     return result;
 }
 /** Regenerate one dirty summary from its children and tally the outcome; throws reach the caller's isolation. */
-async function rebuildOneSummary(hippoRoot, summary, opts, result, preloaded, queuedIds) {
+async function rebuildOneSummary(store, summary, opts, result, preloaded, queuedIds) {
     // A queued child may have been rebuilt earlier in this drain, so its preloaded content is stale: reread then.
     const children = preloaded.some((c) => queuedIds.has(c.id))
-        ? loadChildrenOfSummary(hippoRoot, summary.id, summary.tenant_id)
+        ? store.childrenOfSummary(summary.id, summary.tenant_id)
         : preloaded;
     if (children.length === 0) {
-        clearZeroChildSummary(hippoRoot, summary, result);
+        clearZeroChildSummary(store, summary, result);
         return;
     }
     const newContent = await generateDagSummary(summaryLabel(summary), children.map((c) => c.content), opts);
@@ -142,7 +142,7 @@ async function rebuildOneSummary(hippoRoot, summary, opts, result, preloaded, qu
         return;
     }
     const childCreatedAts = children.map((c) => c.created).sort();
-    const { changed, refused } = applyRebuildResult(hippoRoot, summary, {
+    const { changed, refused } = store.applyRebuild(summary, {
         content: newContent,
         descendant_count: children.length,
         earliest_at: childCreatedAts[0],
@@ -161,8 +161,8 @@ async function rebuildOneSummary(hippoRoot, summary, opts, result, preloaded, qu
     // success, silently skip
 }
 /** Zero-child case: clear dirty + zero counts, no LLM call, no rebuild_count bump. */
-function clearZeroChildSummary(hippoRoot, summary, result) {
-    const { changed } = applyRebuildResult(hippoRoot, summary, {
+function clearZeroChildSummary(store, summary, result) {
+    const { changed } = store.applyRebuild(summary, {
         content: summary.content,
         descendant_count: 0,
         earliest_at: null,
@@ -183,12 +183,13 @@ function summaryLabel(summary) {
         ? entityTags.map((t) => t.split(':')[1]).join(': ')
         : summary.content.slice(0, SUMMARY_FALLBACK_CHARS);
 }
-/** Sleep-cycle phase draining the dirty L2 summary queue; one throwing rebuild does not abort the rest.
- * A concurrent sleep's second writer gets changed=false (UPDATE requires summary_dirty=1) and is skipped silently; a tombstone hit counts as `refused`. */
-export async function rebuildDirtySummaries(hippoRoot, opts) {
+/** Sleep-cycle phase draining the dirty L2 summary queue; one throwing rebuild does not abort the rest. A concurrent
+ * sleep's second writer gets changed=false (UPDATE requires summary_dirty=1) and is skipped silently; a tombstone hit
+ * counts as `refused`. */
+export async function rebuildDirtySummaries(store, opts) {
     const cap = opts.cap ?? DEFAULT_REBUILD_CAP;
     // One past the cap tells whether more were waiting without reading the rest.
-    const dirty = loadAllDirtySummaries(hippoRoot, cap + 1);
+    const dirty = store.dirtySummaries(cap + 1);
     const capped = dirty.length > cap;
     const queue = dirty.slice(0, cap);
     const result = {
@@ -199,7 +200,7 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
         failed: 0,
         capped,
     };
-    const childrenByParent = loadChildrenOfSummaries(hippoRoot, queue);
+    const childrenOf = store.childrenOfSummaries(queue);
     const queuedIds = new Set(queue.map((s) => s.id));
     for (const [index, summary] of queue.entries()) {
         // Yield the macrotask queue every 25 summaries: each iteration is synchronous SQLite, so a batch of up to 1000
@@ -208,7 +209,7 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             await new Promise((resolve) => setImmediate(resolve));
         }
         try {
-            await rebuildOneSummary(hippoRoot, summary, opts, result, childrenByParent.get(childrenKey(summary.tenant_id, summary.id)) ?? [], queuedIds);
+            await rebuildOneSummary(store, summary, opts, result, childrenOf(summary), queuedIds);
         }
         catch (err) {
             // One throw doesn't abort the queue; log enough to triage an exotic
@@ -227,7 +228,7 @@ function createProfileEntry(summary, cluster, home) {
         layer: Layer.Semantic,
         tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
         confidence: 'inferred',
-        dag_level: 3,
+        dagLevel: 3,
         tenantId: home.tenantId,
         scope: home.scope,
         baseHalfLifeDays: home.baseHalfLifeDays,
@@ -240,7 +241,7 @@ function createProfileEntry(summary, cluster, home) {
     return profileEntry;
 }
 /** Profile one eligible cluster of L2s, write it, then re-link the L2s under it. */
-async function profileCluster(hippoRoot, cluster, home, opts, result) {
+async function profileCluster(store, cluster, home, opts, result) {
     const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
     if (!summary) {
         result.failed++;
@@ -249,25 +250,25 @@ async function profileCluster(hippoRoot, cluster, home, opts, result) {
     const profileEntry = createProfileEntry(summary, cluster, home);
     // A refused profile skips only this cluster; the re-linking below never runs for it.
     try {
-        writeEntry(hippoRoot, profileEntry);
+        store.writeEntry(profileEntry);
     }
     catch (err) {
         if (err instanceof RejectedValueError) {
             result.rejected++;
-            log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
+            log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`, errorFields(err));
             return;
         }
         throw err;
     }
     result.profilesCreated++;
-    result.l2sLinked += writeEntriesTogether(hippoRoot, cluster.members.map((member) => ({ ...member, dag_parent_id: profileEntry.id })));
+    result.l2sLinked += store.writeTogether(cluster.members.map((member) => ({ ...member, dag_parent_id: profileEntry.id })));
     // Re-linking just marked the fresh L3 dirty; clear it so this cycle's rebuild skips it.
     // The distinct source tags the audit row.
-    clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, home.tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
+    store.clearSummaryDirty(profileEntry.id, home.tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
 }
 /** Build L3 entity profiles by clustering L2 summaries sharing entity tags (2+ L2s per entity).
  * Each L2 link write marks the new L3 dirty, so clear it or the same cycle re-rebuilds it. */
-export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
+export async function buildEntityProfiles(local, l2Summaries, opts) {
     const result = {
         candidateClusters: 0,
         profilesCreated: 0,
@@ -275,7 +276,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
         failed: 0,
         rejected: 0,
     };
-    const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
+    const baseHalfLifeDays = loadConfig(local.hippoRoot).defaultHalfLifeDays;
     // Only L2 with no L3 parent yet (avoid re-clustering already-profiled L2s).
     const unparented = l2Summaries.filter((s) => s.dag_level === 2 && !s.dag_parent_id);
     for (const [, tenantL2s] of partitionFactsByTenant(unparented)) {
@@ -289,7 +290,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
         const eligible = clusters.filter((c) => c.members.length >= 2);
         result.candidateClusters += eligible.length;
         for (const cluster of eligible) {
-            await profileCluster(hippoRoot, cluster, home, opts, result);
+            await profileCluster(local.consolidation, cluster, home, opts, result);
         }
     }
     return result;

package/dist/consolidate/decay.js

@@ -4,7 +4,8 @@ import { rescueSet, rankNonPinnedByTenant, validateWeights } from './memory-valu
 import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
 const STRENGTH_DECIMALS = 4;
 export const DECAY_THRESHOLD = 0.05;
-// Leaving active memory: a raw receipt stays (the append-only trigger aborts DELETE for the whole batch; stored strength refreshed) but sits out this cycle;
+// Leaving active memory: a raw receipt stays (the append-only trigger aborts DELETE for the whole batch; stored
+// strength refreshed) but sits out this cycle;
 // others go dormant when config.dormant is on, else are deleted. Only called for rows `retirable` allows.
 function retireFaded(run, entry, strength) {
     const { result } = run;
@@ -14,7 +15,12 @@ function retireFaded(run, entry, strength) {
     if (run.config.dormant.enabled && !detectSecret(entry).flagged) {
         result.dormant++;
         result.details.push(`  💤 dormant ${entry.id} ${why}`);
-        run.pendingDormant.push({ entry: { ...entry, strength }, strength, reason: 'decay', dormantAt: run.now.toISOString() });
+        run.pendingDormant.push({
+            entry: { ...entry, strength },
+            strength,
+            reason: 'decay',
+            dormantAt: run.now.toISOString(),
+        });
         return;
     }
     result.removed++;
@@ -31,7 +37,8 @@ function keepSurvivor(run, entry, strength) {
     run.result.decayed++;
     return updated;
 }
-// 1. Decay pass. Memory-value flag OFF runs the single-phase loop below; ON classifies every entry with zero commits, runs rescueSet per tenant, then commits.
+// 1. Decay pass. Memory-value flag OFF runs the single-phase loop below; ON classifies every entry with zero commits,
+// runs rescueSet per tenant, then commits.
 // Rescued entries stay full survivors for this cycle's later passes.
 export function decayPass(run) {
     if (run.config.memoryValue.enabled)
@@ -85,14 +92,19 @@ function decayWithMemoryValue(run) {
     let rescuedIds = new Set();
     let rankById = new Map();
     const { strengthById, condemnedIds } = classifyByStrength(run);
-    // Phase 2a: rescue decision (pure compute); runs under --dry-run too (only the pendingDeletes flush and the logRun audit write are !dryRun-gated).
+    // Phase 2a: rescue decision (pure compute); runs under --dry-run too (only the pendingDeletes flush and the logRun
+    // audit write are !dryRun-gated).
     // Fail-loud must not depend on condemnation traffic: validate the frozen weights even when nothing is condemned.
     validateWeights();
     if (condemnedIds.size > 0) {
         // Rank per tenant ONCE: rankById feeds both rescueSet (via precomputedRanks) and the detail/audit
         // context below, so the whole-store ranking runs once per sleep and only when something is condemned.
         rankById = rankNonPinnedByTenant(all, now);
-        rescuedIds = rescueSet(all, condemnedIds, now, { weights: MEMORY_VALUE_WEIGHTS, digest: SOURCE_ARTIFACT_SHA256, precomputedRanks: rankById });
+        rescuedIds = rescueSet(all, condemnedIds, now, {
+            weights: MEMORY_VALUE_WEIGHTS,
+            digest: SOURCE_ARTIFACT_SHA256,
+            precomputedRanks: rankById,
+        });
         reportNonFiniteScores(result, rankById);
     }
     // --- Phase 2b: commit, one pass over `all` in ITS ORIGINAL ORDER ---
@@ -101,7 +113,8 @@ function decayWithMemoryValue(run) {
         const strength = strengthById.get(entry.id);
         if (run.retirable(entry) && strength < DECAY_THRESHOLD) {
             if (rescuedIds.has(entry.id)) {
-                // Rescued: standard survivor stored-strength refresh. Confidence is left alone: it is an epistemic tier, not a cached
+                // Rescued: standard survivor stored-strength refresh. Confidence is left alone: it is an epistemic tier, not a
+                // cached
                 // computation, so resolveConfidence derives it on read.
                 rescuedEntries.push(keepSurvivor(run, entry, strength));
                 reportRescue(result, entry, strength, rankById.get(entry.id));

package/dist/consolidate/dedupe.d.ts

@@ -1,5 +1,10 @@
-/** Store-level dedup: same text apart from spacing, keeping the stronger copy; split out so `api.sleep` can dedupe without cli -> api imports.
- * Survivor order is total and tenant-scoped: strength bucket, retrieval_count, then compareEntryIdentity; raw and superseded rows are not candidates. */
+/**
+ * Store-level dedup: same text apart from spacing, keeping the stronger copy; split out so `api.sleep` can dedupe
+ * without cli -> api imports.
+ * Survivor order is total and tenant-scoped: strength bucket, retrieval_count, then compareEntryIdentity; raw and
+ * superseded rows are not candidates.
+ */
+import type { Consolidation } from '../store/port.js';
 import { type MemoryEntry } from '../core/memory.js';
 export interface DedupPair {
     kept: string;
@@ -17,7 +22,9 @@ export interface DedupResult {
     removed: number;
     pairs: DedupPair[];
 }
-/** Quantize strength to an integer bucket so ties are a true equivalence relation (equal iff same multiple of `STRENGTH_TIE_EPSILON`).
+/**
+ * Quantize strength to an integer bucket so ties are a true equivalence relation (equal iff same multiple of
+ * `STRENGTH_TIE_EPSILON`).
  * Non-finite input maps to 0: a NaN bucket would make the comparator return NaN and break the total order. */
 export declare function strengthBucket(strength: number | null | undefined): number;
 /** Every row of the store, read once by a caller that also needs them, with the ids of rows backing an object. */
@@ -25,9 +32,11 @@ export interface LoadedStore {
     readonly entries: readonly MemoryEntry[];
     readonly backing: ReadonlySet<string>;
 }
-/** Remove the weaker copy of same-text (apart from spacing) memories within one tenant; cross-tenant pairs are never duplicates (isolation boundary).
+/**
+ * Remove the weaker copy of same-text (apart from spacing) memories within one tenant; cross-tenant pairs are never
+ * duplicates (isolation boundary).
  * Higher strength wins, then more retrievals; `threshold` is accepted for old callers and ignored. */
-export declare function deduplicateStore(hippoRoot: string, options?: {
+export declare function deduplicateStore(store: Consolidation, options?: {
     threshold?: number;
     dryRun?: boolean;
     actor?: string;