hippo-memory 1.59.0 → 1.61.0

package/dist/connectors/slack/dlq.js

@@ -93,35 +93,9 @@ export function replayDlqEntry(ctx, id, opts = {}) {
     }
     // Signature verification (current secret, not previous).
     if (!opts.force) {
-        if (!row.signature || !row.slackTimestamp) {
-            return {
-                ok: false,
-                status: 'sig_missing',
-                memoryId: null,
-                retryCount: row.retryCount,
-                reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
-            };
-        }
-        if (opts.signingSecret) {
-            const ok = verifySlackSignature({
-                rawBody: row.rawPayload,
-                signature: row.signature,
-                timestamp: row.slackTimestamp,
-                signingSecret: opts.signingSecret,
-                now: opts.now,
-                // Replays happen long after the fact — give them a wider skew unless overridden.
-                skewSeconds: opts.skewSeconds ?? 60 * 60 * 24 * 365,
-            });
-            if (!ok) {
-                return {
-                    ok: false,
-                    status: 'sig_fail',
-                    memoryId: null,
-                    retryCount: row.retryCount,
-                    reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
-                };
-            }
-        }
+        const sigFailure = checkReplaySignature(row, opts);
+        if (sigFailure)
+            return sigFailure;
     }
     // Parse + dispatch.
     let parsed;
@@ -129,24 +103,10 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         parsed = JSON.parse(row.rawPayload);
     }
     catch (e) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'parse_error',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `still unparseable: ${e instanceof Error ? e.message : String(e)}`,
-        };
+        return failAndBump(ctx.hippoRoot, row, 'parse_error', `still unparseable: ${e instanceof Error ? e.message : String(e)}`);
     }
     if (!isSlackEventEnvelope(parsed)) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unhandled',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'not an event_callback envelope',
-        };
+        return failAndBump(ctx.hippoRoot, row, 'unhandled', 'not an event_callback envelope');
     }
     // Resolve tenant against current state. If still unroutable, bail.
     const db2 = openHippoDb(ctx.hippoRoot);
@@ -158,31 +118,59 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         closeHippoDb(db2);
     }
     if (!tenant) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unroutable',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `team_id ${parsed.team_id} still unroutable`,
-        };
+        return failAndBump(ctx.hippoRoot, row, 'unroutable', `team_id ${parsed.team_id} still unroutable`);
     }
     const replayCtx = {
         hippoRoot: ctx.hippoRoot,
         tenantId: tenant,
         actor: adminActor('connector:slack:replay'),
     };
-    const inner = parsed.event;
-    if (!isSlackMessageEvent(inner)) {
-        bumpRetryCount(ctx.hippoRoot, id);
+    return dispatchReplay(replayCtx, row, parsed);
+}
+/** The failure result when the row cannot pass the signature gate, else null; never bumps the count. */
+function checkReplaySignature(row, opts) {
+    if (!row.signature || !row.slackTimestamp) {
         return {
             ok: false,
-            status: 'unhandled',
+            status: 'sig_missing',
             memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `unhandled inner event type`,
+            retryCount: row.retryCount,
+            reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
         };
     }
+    if (opts.signingSecret) {
+        const ok = verifySlackSignature({
+            rawBody: row.rawPayload,
+            signature: row.signature,
+            timestamp: row.slackTimestamp,
+            signingSecret: opts.signingSecret,
+            now: opts.now,
+            // Replays happen long after the fact — give them a wider skew unless overridden.
+            skewSeconds: opts.skewSeconds ?? 60 * 60 * 24 * 365,
+        });
+        if (!ok) {
+            return {
+                ok: false,
+                status: 'sig_fail',
+                memoryId: null,
+                retryCount: row.retryCount,
+                reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
+            };
+        }
+    }
+    return null;
+}
+function failAndBump(hippoRoot, row, status, reason) {
+    bumpRetryCount(hippoRoot, row.id);
+    return { ok: false, status, memoryId: null, retryCount: row.retryCount + 1, reason };
+}
+function dispatchReplay(replayCtx, row, parsed) {
+    const { hippoRoot } = replayCtx;
+    const id = row.id;
+    const inner = parsed.event;
+    if (!isSlackMessageEvent(inner)) {
+        return failAndBump(hippoRoot, row, 'unhandled', `unhandled inner event type`);
+    }
     if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
         const r = handleMessageDeleted(replayCtx, {
             teamId: parsed.team_id,
@@ -190,7 +178,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
             deletedTs: inner.deleted_ts,
             eventId: parsed.event_id,
         });
-        markRetried(ctx.hippoRoot, id);
+        markRetried(hippoRoot, id);
         return { ok: true, status: r.status, memoryId: r.memoryId, retryCount: row.retryCount + 1 };
     }
     const result = ingestMessage(replayCtx, {
@@ -204,7 +192,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         message: inner,
         eventId: parsed.event_id,
     });
-    markRetried(ctx.hippoRoot, id);
+    markRetried(hippoRoot, id);
     return { ok: true, status: result.status, memoryId: result.memoryId, retryCount: row.retryCount + 1 };
 }
 function markRetried(hippoRoot, id) {

package/dist/connectors/slack/ingest.js

@@ -54,57 +54,64 @@ export function ingestMessage(ctx, input) {
     // together. Slack's 1-minute retry window can no longer produce a duplicate
     // via the crash-between-handles race.
     try {
-        // v1.12.0: drop the legacy `|| 'connector:slack'` fallback — ctx is always
-        // provided by server.ts:1039 which constructs it with the connector subject.
-        // Under the new object-shaped Context.actor, an OR-fallback would evaluate
-        // an object as truthy and skip the fallback anyway (logic bug if ctx were
-        // ever missing); explicit reliance on the caller is safer.
-        const result = remember(ctx, {
-            ...opts,
-            untrusted: true,
-            afterWrite: (innerDb, memoryId) => {
-                const inserted = innerDb
-                    .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)
-                    .run(input.eventId, new Date().toISOString(), memoryId);
-                if ((Number(inserted.changes ?? 0)) === 0) {
-                    // Two-worker race: another writer reserved this event_id between
-                    // the pre-check and the write. Throw to roll back the SAVEPOINT
-                    // in writeEntry — the memory row gets discarded, idempotency
-                    // holds, exactly one memory exists for this event_id.
-                    throw new DuplicateEventError(input.eventId);
-                }
-            },
-        });
-        return { status: 'ingested', memoryId: result.id };
+        return rememberWithEventLog(ctx, input.eventId, opts);
     }
     catch (e) {
-        if (e instanceof DuplicateEventError) {
-            // The other worker's memory row is already committed. Return its id
-            // so the caller behaves identically to the fast-path 'duplicate' branch.
-            const db3 = openHippoDb(ctx.hippoRoot);
-            try {
-                const cachedId = lookupMemoryByEvent(db3, input.eventId);
-                return { status: 'skipped_duplicate', memoryId: cachedId };
-            }
-            finally {
-                closeHippoDb(db3);
-            }
-        }
-        if (e instanceof RejectedValueError) {
-            // AT1 (plan §3 containment): a tombstone hit is a PERMANENT skip, not
-            // a transient failure — never DLQ-retry it (retrying would just hit
-            // the same refusal forever). Mark the event seen exactly like the
-            // empty-body branch above so a Slack retry acks as done, not error.
-            const db4 = openHippoDb(ctx.hippoRoot);
-            try {
-                markEventSeen(db4, input.eventId, null);
-            }
-            finally {
-                closeHippoDb(db4);
-            }
-            return { status: 'skipped', memoryId: null };
-        }
+        if (e instanceof DuplicateEventError)
+            return lostRaceResult(ctx, input.eventId);
+        if (e instanceof RejectedValueError)
+            return rejectedValueResult(ctx, input.eventId);
         throw e;
     }
 }
+function rememberWithEventLog(ctx, eventId, opts) {
+    // v1.12.0: drop the legacy `|| 'connector:slack'` fallback — ctx is always
+    // provided by server.ts:1039 which constructs it with the connector subject.
+    // Under the new object-shaped Context.actor, an OR-fallback would evaluate
+    // an object as truthy and skip the fallback anyway (logic bug if ctx were
+    // ever missing); explicit reliance on the caller is safer.
+    const result = remember(ctx, {
+        ...opts,
+        untrusted: true,
+        afterWrite: (innerDb, memoryId) => {
+            const inserted = innerDb
+                .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)
+                .run(eventId, new Date().toISOString(), memoryId);
+            if ((Number(inserted.changes ?? 0)) === 0) {
+                // Two-worker race: another writer reserved this event_id between
+                // the pre-check and the write. Throw to roll back the SAVEPOINT
+                // in writeEntry — the memory row gets discarded, idempotency
+                // holds, exactly one memory exists for this event_id.
+                throw new DuplicateEventError(eventId);
+            }
+        },
+    });
+    return { status: 'ingested', memoryId: result.id };
+}
+function lostRaceResult(ctx, eventId) {
+    // The other worker's memory row is already committed. Return its id
+    // so the caller behaves identically to the fast-path 'duplicate' branch.
+    const db3 = openHippoDb(ctx.hippoRoot);
+    try {
+        const cachedId = lookupMemoryByEvent(db3, eventId);
+        return { status: 'skipped_duplicate', memoryId: cachedId };
+    }
+    finally {
+        closeHippoDb(db3);
+    }
+}
+function rejectedValueResult(ctx, eventId) {
+    // AT1 (plan §3 containment): a tombstone hit is a PERMANENT skip, not
+    // a transient failure — never DLQ-retry it (retrying would just hit
+    // the same refusal forever). Mark the event seen exactly like the
+    // empty-body branch above so a Slack retry acks as done, not error.
+    const db4 = openHippoDb(ctx.hippoRoot);
+    try {
+        markEventSeen(db4, eventId, null);
+    }
+    finally {
+        closeHippoDb(db4);
+    }
+    return { status: 'skipped', memoryId: null };
+}
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/slack/tenant-routing.js

@@ -1,3 +1,4 @@
+import { envSlackAllowUnknownTeamFallback, envTenant } from '../../env.js';
 /**
  * Look up the tenant_id for a Slack team_id.
  *
@@ -31,10 +32,10 @@ export function resolveTenantForTeam(db, teamId) {
         .get().c;
     if (Number(total) === 0) {
         // Single-workspace install: env fallback is safe.
-        return process.env.HIPPO_TENANT?.trim() || 'default';
+        return envTenant();
     }
-    if (process.env.SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK === '1') {
-        return process.env.HIPPO_TENANT?.trim() || 'default';
+    if (envSlackAllowUnknownTeamFallback()) {
+        return envTenant();
     }
     return null; // fail closed
 }

package/dist/connectors/slack/webhook.js

@@ -1,3 +1,4 @@
+import { envSlackSigningSecret, envSlackSigningSecretPrevious } from '../../env.js';
 import { verifySlackSignature } from './signature.js';
 import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
 import { ingestMessage } from './ingest.js';
@@ -6,7 +7,6 @@ import { writeToDlq } from './dlq.js';
 import { resolveTenantForTeam } from './tenant-routing.js';
 import { resolveTenantId } from '../../tenant.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
-import { adminActor } from '../../api.js';
 import { HttpError, JSON_HEADERS, isHeaderString, isJsonObjectRecord, readBody, sendJson, } from '../../http-util.js';
 /**
  * Slack Events API webhook. Auth is signature-based (HMAC over the raw
@@ -29,13 +29,13 @@ import { HttpError, JSON_HEADERS, isHeaderString, isJsonObjectRecord, readBody,
  */
 export async function handleSlackEventsWebhook({ req, res, opts }) {
     const rawBody = await readBody(req);
-    const secret = process.env.SLACK_SIGNING_SECRET;
+    const secret = envSlackSigningSecret();
     if (!secret) {
         res.writeHead(404, JSON_HEADERS);
         res.end(JSON.stringify({ error: 'not found' }));
         return;
     }
-    const previousSecret = process.env.SLACK_SIGNING_SECRET_PREVIOUS;
+    const previousSecret = envSlackSigningSecretPrevious();
     const sig = req.headers['x-slack-signature'];
     const tsHdr = req.headers['x-slack-request-timestamp'];
     const sigStr = isHeaderString(sig) ? sig : null;
@@ -51,6 +51,28 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
         })) {
         throw new HttpError(401, 'invalid Slack signature');
     }
+    routeSignedSlackPayload({ hippoRoot: opts.hippoRoot, res, rawBody, signature: sigStr, slackTimestamp: tsStr });
+}
+function parkInDlq(d, park) {
+    const db = openHippoDb(d.hippoRoot);
+    try {
+        writeToDlq(db, {
+            tenantId: park.tenantId,
+            teamId: park.teamId,
+            rawPayload: d.rawBody,
+            error: park.error,
+            bucket: park.bucket,
+            signature: d.signature,
+            slackTimestamp: d.slackTimestamp,
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    sendJson(d.res, 200, { ok: true, status: 'dlq' });
+}
+function routeSignedSlackPayload(d) {
+    const { rawBody, res } = d;
     // Cheap regex extracts team_id from a (possibly malformed) raw body so the
     // DLQ row carries it for triage even when JSON.parse fails.
     const teamIdFromRaw = (() => {
@@ -62,25 +84,7 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
         body = JSON.parse(rawBody);
     }
     catch {
-        // Attribute the parse failure to the originating workspace via the regex-extracted
-        // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            const parseFailTenant = teamIdFromRaw !== null ? resolveTenantForTeam(db, teamIdFromRaw) : null;
-            writeToDlq(db, {
-                tenantId: parseFailTenant, // null → '__unroutable__' sentinel
-                teamId: teamIdFromRaw,
-                rawPayload: rawBody,
-                error: 'invalid JSON',
-                bucket: 'parse_error',
-                signature: sigStr,
-                slackTimestamp: tsStr,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
+        parkUnparseable(d, teamIdFromRaw);
         return;
     }
     if (isJsonObjectRecord(body)) {
@@ -98,7 +102,7 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
     // 200 so Slack stops retrying; do NOT call ingest.
     let resolvedTenant = null;
     if (body !== undefined && isSlackEventEnvelope(body)) {
-        const db = openHippoDb(opts.hippoRoot);
+        const db = openHippoDb(d.hippoRoot);
         try {
             resolvedTenant = resolveTenantForTeam(db, body.team_id);
         }
@@ -106,22 +110,12 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
             closeHippoDb(db);
         }
         if (resolvedTenant === null) {
-            const db2 = openHippoDb(opts.hippoRoot);
-            try {
-                writeToDlq(db2, {
-                    tenantId: null, // unroutable - stored as '__unroutable__'
-                    teamId: body.team_id,
-                    rawPayload: rawBody,
-                    error: `unroutable team_id: ${body.team_id}`,
-                    bucket: 'unroutable',
-                    signature: sigStr,
-                    slackTimestamp: tsStr,
-                });
-            }
-            finally {
-                closeHippoDb(db2);
-            }
-            sendJson(res, 200, { ok: true, status: 'dlq' });
+            parkInDlq(d, {
+                tenantId: null, // unroutable - stored as '__unroutable__'
+                teamId: body.team_id,
+                error: `unroutable team_id: ${body.team_id}`,
+                bucket: 'unroutable',
+            });
             return;
         }
     }
@@ -130,29 +124,44 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
         resolvedTenant = resolveTenantId({});
     }
     const ctx = {
-        hippoRoot: opts.hippoRoot,
+        hippoRoot: d.hippoRoot,
         tenantId: resolvedTenant,
-        actor: adminActor('connector:slack'),
+        actor: { subject: 'connector:slack', role: 'admin' },
     };
     if (body === undefined || !isSlackEventEnvelope(body)) {
-        const db = openHippoDb(ctx.hippoRoot);
-        try {
-            writeToDlq(db, {
-                tenantId: ctx.tenantId,
-                teamId: teamIdFromRaw,
-                rawPayload: rawBody,
-                error: 'not an event_callback envelope',
-                bucket: 'parse_error',
-                signature: sigStr,
-                slackTimestamp: tsStr,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
+        parkInDlq(d, {
+            tenantId: ctx.tenantId,
+            teamId: teamIdFromRaw,
+            error: 'not an event_callback envelope',
+            bucket: 'parse_error',
+        });
         return;
     }
+    dispatchSlackEvent(d, ctx, body);
+}
+function parkUnparseable(d, teamIdFromRaw) {
+    // Attribute the parse failure to the originating workspace via the regex-extracted
+    // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
+    const db = openHippoDb(d.hippoRoot);
+    try {
+        const parseFailTenant = teamIdFromRaw !== null ? resolveTenantForTeam(db, teamIdFromRaw) : null;
+        writeToDlq(db, {
+            tenantId: parseFailTenant, // null → '__unroutable__' sentinel
+            teamId: teamIdFromRaw,
+            rawPayload: d.rawBody,
+            error: 'invalid JSON',
+            bucket: 'parse_error',
+            signature: d.signature,
+            slackTimestamp: d.slackTimestamp,
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    sendJson(d.res, 200, { ok: true, status: 'dlq' });
+}
+function dispatchSlackEvent(d, ctx, body) {
+    const { res } = d;
     const inner = body.event;
     if (isSlackMessageEvent(inner)) {
         if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
@@ -182,22 +191,11 @@ export async function handleSlackEventsWebhook({ req, res, opts }) {
         sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
         return;
     }
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        writeToDlq(db, {
-            tenantId: ctx.tenantId,
-            teamId: body.team_id,
-            rawPayload: rawBody,
-            error: `unhandled event type: ${inner.type ?? 'unknown'}`,
-            bucket: 'parse_error',
-            signature: sigStr,
-            slackTimestamp: tsStr,
-        });
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    sendJson(res, 200, { ok: true, status: 'dlq' });
-    return;
+    parkInDlq(d, {
+        tenantId: ctx.tenantId,
+        teamId: body.team_id,
+        error: `unhandled event type: ${inner.type ?? 'unknown'}`,
+        bucket: 'parse_error',
+    });
 }
 //# sourceMappingURL=webhook.js.map

package/dist/consolidate/conflicts.d.ts

@@ -0,0 +1,10 @@
+import { MemoryEntry, type DecayOptions } from '../memory.js';
+/** Pairs of live non-semantic memories that contradict each other, in survivor order. */
+export declare function detectConflicts(entries: MemoryEntry[], now: Date, decayOpts?: DecayOptions, rescuedIds?: Set<string>): Array<{
+    memory_a_id: string;
+    memory_b_id: string;
+    reason: string;
+    score: number;
+}>;
+export declare function jaccardSets(a: Set<string>, b: Set<string>): number;
+//# sourceMappingURL=conflicts.d.ts.map