hippo-memory 1.68.0 → 1.70.0

package/dist/connectors/dlq.d.ts

@@ -0,0 +1,44 @@
+import { type HippoStore } from '../store/index.js';
+import type { ConnectorDeadLetter } from '../store/port.js';
+declare const DEFAULT_BUCKET = "parse_error";
+/** What a caller hands over to park one payload, whatever the connector. */
+export interface ParkOpts<Bucket extends string> {
+    /** null when no tenant was resolved for the payload. */
+    tenantId: string | null;
+    rawPayload: string;
+    error: string;
+    bucket?: Bucket;
+    signature?: string | null;
+}
+/** The columns every connector's table has, as stored. */
+export interface ParkedRow<Bucket extends string> {
+    tenantId: string;
+    rawPayload: string;
+    error: string;
+    bucket: Bucket | typeof DEFAULT_BUCKET;
+    signature: string | null;
+}
+/** What one connector supplies: the tag that names its table to the store, and its list. `Own` is the columns only its table has. */
+export interface ConnectorDlq<Own, Bucket extends string, Item> {
+    readonly letter: (row: ParkedRow<Bucket> & Own) => ConnectorDeadLetter;
+    readonly list: (hippoRoot: string, tenantId: string, limit: number) => Item[];
+}
+/** Parks on `store`, else on hippo.db under `hippoRoot`. */
+export declare function parkInDlq<Own, Bucket extends string>(dlq: ConnectorDlq<Own, Bucket, unknown>, hippoRoot: string, opts: ParkOpts<Bucket> & NoInfer<Own>, store?: HippoStore): Promise<number>;
+export declare function listDlq<Item>(dlq: ConnectorDlq<never, never, Item>, hippoRoot: string, opts: {
+    tenantId: string;
+    limit?: number;
+}): Item[];
+/** Every outcome a replay reports; a connector that re-ingests inline reports the ingest outcome itself. */
+export type ReplayStatus = 'not_found' | 'sig_missing' | 'sig_fail' | 'parse_error' | 'unhandled' | 'unroutable' | 'replayed' | 'ingested' | 'duplicate' | 'skipped' | 'skipped_duplicate' | 'archived';
+export interface ReplayResult {
+    ok: boolean;
+    status: ReplayStatus;
+    memoryId: string | null;
+    retryCount: number;
+    reason?: string;
+}
+/** A replay that did not go through; `retryCount` is the row's count after any bump the caller made. */
+export declare function replayFailed(status: ReplayStatus, retryCount: number, reason: string): ReplayResult;
+export {};
+//# sourceMappingURL=dlq.d.ts.map

package/dist/connectors/dlq.js

@@ -0,0 +1,30 @@
+// The dead-letter queue every webhook connector parks into: one redaction, one unroutable sentinel, one set of defaults, one replay result.
+import { DLQ_REDACTED_NOTE, redactPayload } from '../util/secret-detect.js';
+import { requireGroup, storeFor } from '../store/index.js';
+/** The tenant stored on a row no tenant was resolved for; the column is NOT NULL. */
+const UNROUTABLE_TENANT = '__unroutable__';
+const DEFAULT_BUCKET = 'parse_error';
+const DEFAULT_LIST_LIMIT = 100;
+/** Parks on `store`, else on hippo.db under `hippoRoot`. */
+export async function parkInDlq(dlq, hippoRoot, opts, store) {
+    const rawPayload = redactPayload(opts.rawPayload);
+    // A redacted body can never match its signature, so the row keeps none and replay needs --force.
+    const redacted = rawPayload !== opts.rawPayload;
+    const letter = dlq.letter({
+        ...opts,
+        tenantId: opts.tenantId ?? UNROUTABLE_TENANT,
+        rawPayload,
+        error: redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error,
+        bucket: opts.bucket ?? DEFAULT_BUCKET,
+        signature: redacted ? null : opts.signature ?? null,
+    });
+    return requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').parkDeadLetter(letter);
+}
+export function listDlq(dlq, hippoRoot, opts) {
+    return dlq.list(hippoRoot, opts.tenantId, opts.limit ?? DEFAULT_LIST_LIMIT);
+}
+/** A replay that did not go through; `retryCount` is the row's count after any bump the caller made. */
+export function replayFailed(status, retryCount, reason) {
+    return { ok: false, status, memoryId: null, retryCount, reason };
+}
+//# sourceMappingURL=dlq.js.map

package/dist/connectors/github/backfill.d.ts

@@ -23,7 +23,7 @@
  * through to private. Callers who know the repo is public can re-tag
  * downstream; the fail-safe default protects private orgs.
  */
-import type { Context } from '../../api.js';
+import type { Context } from '../../api/index.js';
 import type { GitHubFetcher } from './octokit-client.js';
 export interface BackfillOpts {
     /** e.g. 'acme/repo'. */

package/dist/connectors/github/backfill.js

@@ -23,40 +23,10 @@
  * through to private. Callers who know the repo is public can re-tag
  * downstream; the fail-safe default protects private orgs.
  */
-import { openHippoDb, closeHippoDb } from '../../db.js';
+import { readCursors, writeHwm } from '../../store/connectors/github.js';
 import { ingestEvent } from './ingest.js';
+import { isJsonObject } from '../../util/json.js';
 const API = 'https://api.github.com';
-function readCursor(root, tenantId, repo) {
-    const db = openHippoDb(root);
-    try {
-        // SAFETY: row's shape matches the three HWM columns named in the SELECT
-        // above; `better-sqlite3`'s `.get()` return type is untyped by the driver.
-        const row = db
-            .prepare(`SELECT issues_hwm, issue_comments_hwm, pr_review_comments_hwm
-         FROM github_cursors WHERE tenant_id = ? AND repo_full_name = ?`)
-            .get(tenantId, repo);
-        return {
-            issues: row?.issues_hwm ?? null,
-            issueComments: row?.issue_comments_hwm ?? null,
-            prReviewComments: row?.pr_review_comments_hwm ?? null,
-        };
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-function writeOneHwm(root, tenantId, repo, column, value) {
-    const db = openHippoDb(root);
-    try {
-        db.prepare(`INSERT INTO github_cursors (tenant_id, repo_full_name, ${column}, updated_at)
-       VALUES (?, ?, ?, ?)
-       ON CONFLICT(tenant_id, repo_full_name)
-       DO UPDATE SET ${column} = excluded.${column}, updated_at = excluded.updated_at`).run(tenantId, repo, value, new Date().toISOString());
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 /**
  * Build a synthetic `repository` object from the known repo full name.
  * REST list endpoints often omit the full repository object on each item;
@@ -86,14 +56,11 @@ function parseTrailingNumber(url) {
     const n = Number(m[1]);
     return Number.isFinite(n) ? n : null;
 }
-function isPlainObject(x) {
-    return x !== undefined && x !== null && typeof x === 'object' && !Array.isArray(x);
-}
 function isGitHubUser(x) {
-    return isPlainObject(x) && typeof x.login === 'string' && typeof x.id === 'number';
+    return isJsonObject(x) && typeof x.login === 'string' && typeof x.id === 'number';
 }
 function isIssuesItem(x) {
-    if (!isPlainObject(x))
+    if (!isJsonObject(x))
         return false;
     if (typeof x.number !== 'number')
         return false;
@@ -102,47 +69,27 @@ function isIssuesItem(x) {
     return isGitHubUser(x.user);
 }
 function isCommentItem(x) {
-    if (!isPlainObject(x))
+    if (!isJsonObject(x))
         return false;
     if (typeof x.id !== 'number')
         return false;
     return isGitHubUser(x.user);
 }
-/**
- * Drain one stream end-to-end. Pauses and retries on rate-limit. Throws on
- * any other fetch error so the caller leaves the HWM unchanged.
- *
- *   - Tracks max(updated_at) across ALL fetched items, including ones
- *     `toIngestEvent` rejects (e.g., PRs returned via `/issues`). Otherwise
- *     a page of pure PRs would never advance the HWM and the next run would
- *     re-fetch the same window forever.
- *   - Returns `drained: boolean` — true only when the stream actually ran
- *     to next=null. Callers MUST NOT advance the HWM when drained=false,
- *     or a capped run would persist a partial HWM and skip the unfetched tail.
- */
-async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxItems) {
+async function drainStream(ctx, url0, options) {
+    const { toIngestEvent, maxItems } = options;
     let url = url0;
     let ingested = 0;
     let pages = 0;
     let maxUpdatedAt = null;
     while (url) {
-        // Fetch with rate-limit retry loop.
-        let page;
-        while (true) {
-            page = await fetcher({ url, token });
-            if (page.rateLimit.reason !== 'none') {
-                await sleep(page.rateLimit.sleepSeconds * 1000);
-                continue;
-            }
-            break;
-        }
+        const page = await fetchPagePastRateLimit(options, url);
         pages++;
         for (const item of page.items) {
             // Track updated_at on EVERY item, before the toIngestEvent filter, so PR-only pages don't loop forever.
             // SAFETY: updated_at is GitHub's ISO-timestamp field on every item
             // shape this stream returns; a non-string value would only fail the
             // string comparisons below, matching pre-migration passthrough.
-            const updatedAt = isPlainObject(item)
+            const updatedAt = isJsonObject(item)
                 ? (item.updated_at ?? null)
                 : null;
             if (updatedAt && (!maxUpdatedAt || updatedAt > maxUpdatedAt)) {
@@ -151,7 +98,7 @@ async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxI
             const evt = toIngestEvent(item);
             if (!evt)
                 continue;
-            const r = ingestEvent(ctx, {
+            const r = await ingestEvent(ctx, {
                 event: evt,
                 rawBody: JSON.stringify(item),
                 deliveryId: `backfill:${ctx.tenantId}:${updatedAt ?? ''}`,
@@ -167,6 +114,16 @@ async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxI
     }
     return { ingested, pages, maxUpdatedAt, drained: true };
 }
+async function fetchPagePastRateLimit(options, url) {
+    const { fetcher, token, sleep } = options;
+    // Fetch with rate-limit retry loop.
+    while (true) {
+        const page = await fetcher({ url, token });
+        if (page.rateLimit.reason === 'none')
+            return page;
+        await sleep(page.rateLimit.sleepSeconds * 1000);
+    }
+}
 function issueItemToEvent(item, repository) {
     if (!isIssuesItem(item))
         return null;
@@ -234,16 +191,22 @@ function prReviewCommentItemToEvent(item, repository) {
 }
 /** Drains one stream, then persists its HWM only when the stream ran to the end. */
 async function backfillStream(ctx, opts, sleep, stream) {
-    const res = await drainStream(ctx, stream.url, stream.toIngestEvent, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const res = await drainStream(ctx, stream.url, {
+        toIngestEvent: stream.toIngestEvent,
+        fetcher: opts.fetcher,
+        token: opts.token,
+        sleep,
+        maxItems: opts.maxPerStream,
+    });
     // A capped run (--max) must leave the HWM at its previous value so the next run re-fetches the unprocessed tail.
     if (res.drained && res.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, stream.column, res.maxUpdatedAt);
+        writeHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, stream.column, res.maxUpdatedAt);
     }
     return { ingested: res.ingested, pages: res.pages };
 }
 export async function backfillRepo(ctx, opts) {
     const sleep = opts.sleepMs ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    const cursors = readCursor(ctx.hippoRoot, ctx.tenantId, opts.repoFullName);
+    const cursors = readCursors(ctx.hippoRoot, ctx.tenantId, opts.repoFullName);
     const repository = syntheticRepository(opts.repoFullName);
     const result = {
         ingested: { issues: 0, issueComments: 0, prReviewComments: 0 },

package/dist/connectors/github/cli-impl.js

@@ -9,13 +9,14 @@
  *   - hippo github dlq list
  *   - hippo github dlq replay <id> [--force]
  */
-import { envGithubToken, envGithubWebhookSecret, envGithubWebhookSecretPrevious } from '../../env.js';
-import { adminActor } from '../../api.js';
-import { openHippoDb, closeHippoDb } from '../../db.js';
-import { resolveTenantId } from '../../tenant.js';
+import { envGithubToken, envGithubWebhookSecret, envGithubWebhookSecretPrevious } from '../../util/env.js';
+import { adminActor } from '../../api/index.js';
+import { seedCursors } from '../../store/connectors/github.js';
+import { resolveTenantId } from '../../store/tenant.js';
 import { backfillRepo } from './backfill.js';
 import { realGitHubFetcher } from './octokit-client.js';
-import { listDlq, replayDlqEntry } from './dlq.js';
+import { listDlq } from '../dlq.js';
+import { githubDlq, replayDlqEntry } from './dlq.js';
 import { ingestEvent } from './ingest.js';
 import { handleCommentDeleted } from './deletion.js';
 import { computeDeletionKey } from './signature.js';
@@ -61,6 +62,16 @@ export function printGithubBackfillUsage() {
     console.log('  --max    Cap items per stream (optional, integer)');
     console.log('  Requires GITHUB_TOKEN env var with repo read scope.');
 }
+/** `--max` as a whole positive count; undefined (no cap) when absent or not one. */
+function maxPerStreamFlag(maxRaw) {
+    if (isFlagString(maxRaw) || isFlagValueNumberLike(maxRaw)) {
+        const parsed = Number(maxRaw);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            return Math.floor(parsed);
+        }
+    }
+    return undefined;
+}
 /**
  * `hippo github backfill`. The fetcher is injectable so tests can drive the
  * code path without hitting the network. Defaults to `realGitHubFetcher`.
@@ -76,14 +87,7 @@ export async function cmdGithubBackfill(hippoRoot, flags, fetcher = realGitHubFe
         console.error('GITHUB_TOKEN is not set. Backfill requires a personal access token with repo read scope.');
         process.exit(2);
     }
-    const maxRaw = flags['max'];
-    let maxPerStream;
-    if (isFlagString(maxRaw) || isFlagValueNumberLike(maxRaw)) {
-        const parsed = Number(maxRaw);
-        if (Number.isFinite(parsed) && parsed > 0) {
-            maxPerStream = Math.floor(parsed);
-        }
-    }
+    const maxPerStream = maxPerStreamFlag(flags['max']);
     const sinceFlag = flags['since'];
     const sinceIso = isFlagString(sinceFlag) ? sinceFlag : undefined;
     const tenantId = resolveTenantId({});
@@ -91,21 +95,8 @@ export async function cmdGithubBackfill(hippoRoot, flags, fetcher = realGitHubFe
     // COALESCE preserves any existing HWM (subsequent runs ignore --since for
     // streams that already drained at least once — same idempotency story as
     // Slack's slack_cursors).
-    if (sinceIso) {
-        const db = openHippoDb(hippoRoot);
-        try {
-            db.prepare(`INSERT INTO github_cursors (tenant_id, repo_full_name, issues_hwm, issue_comments_hwm, pr_review_comments_hwm, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?)
-         ON CONFLICT(tenant_id, repo_full_name) DO UPDATE SET
-           issues_hwm = COALESCE(github_cursors.issues_hwm, excluded.issues_hwm),
-           issue_comments_hwm = COALESCE(github_cursors.issue_comments_hwm, excluded.issue_comments_hwm),
-           pr_review_comments_hwm = COALESCE(github_cursors.pr_review_comments_hwm, excluded.pr_review_comments_hwm),
-           updated_at = excluded.updated_at`).run(tenantId, repo, sinceIso, sinceIso, sinceIso, new Date().toISOString());
-        }
-        finally {
-            closeHippoDb(db);
-        }
-    }
+    if (sinceIso)
+        seedCursors(hippoRoot, tenantId, repo, sinceIso);
     const ctx = {
         hippoRoot,
         tenantId,
@@ -129,22 +120,48 @@ export async function cmdGithubBackfill(hippoRoot, flags, fetcher = realGitHubFe
     }
 }
 export function cmdGithubDlqList(hippoRoot, _flags) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        const tenantId = resolveTenantId({});
-        const items = listDlq(db, { tenantId });
-        if (items.length === 0) {
-            console.log('no entries');
-            return;
-        }
-        for (const it of items) {
-            console.log(`${it.id}\t${it.bucket}\t${it.tenantId}\t${it.eventName ?? '-'}\t${it.receivedAt}\t${it.error}`);
-        }
+    const items = listDlq(githubDlq, hippoRoot, { tenantId: resolveTenantId({}) });
+    if (items.length === 0) {
+        console.log('no entries');
+        return;
     }
-    finally {
-        closeHippoDb(db);
+    for (const it of items) {
+        console.log(`${it.id}\t${it.bucket}\t${it.tenantId}\t${it.eventName ?? '-'}\t${it.receivedAt}\t${it.error}`);
     }
 }
+const reingestParkedDelivery = async (innerCtx, args) => {
+    const parsed = JSON.parse(args.rawPayload);
+    const event = parsedToIngestEvent(parsed, args.eventName);
+    if (!event) {
+        return { memoryId: null };
+    }
+    // A replayed comment `.deleted` row must route to the deletion handler, NOT to ingestEvent,
+    // which would write the deleted comment as a NEW raw memory instead of archiving the matching ones.
+    if ((event.eventName === 'issue_comment' || event.eventName === 'pull_request_review_comment') &&
+        event.payload.action === 'deleted') {
+        const repo = event.payload.repository?.full_name ?? '';
+        const artifactRef = event.eventName === 'issue_comment'
+            ? `github://${repo}/issue/${event.payload.issue.number}/comment/${event.payload.comment.id}`
+            : `github://${repo}/pull/${event.payload.pull_request.number}/review_comment/${event.payload.comment.id}`;
+        const idempotencyKey = computeDeletionKey(artifactRef, event.payload.comment.updated_at ?? null);
+        const r = await handleCommentDeleted(innerCtx, {
+            artifactRef,
+            idempotencyKey,
+            deliveryId: args.deliveryId,
+            eventName: event.eventName,
+        });
+        // archivedCount maps to memoryId only loosely — return null since the
+        // archive operation can affect multiple rows. The replay-result audit
+        // trail is in github_dlq.retry_count + retried_at.
+        return { memoryId: r.archivedCount > 0 ? 'archived' : null };
+    }
+    const r = await ingestEvent(innerCtx, {
+        event,
+        rawBody: args.rawPayload,
+        deliveryId: args.deliveryId,
+    });
+    return { memoryId: r.memoryId };
+};
 export async function cmdGithubDlqReplay(hippoRoot, args, flags) {
     const idArg = args[0];
     if (!idArg) {
@@ -167,39 +184,7 @@ export async function cmdGithubDlqReplay(hippoRoot, args, flags) {
         force,
         webhookSecret: envGithubWebhookSecret(),
         previousSecret: envGithubWebhookSecretPrevious(),
-        ingestHook: async (innerCtx, args) => {
-            const parsed = JSON.parse(args.rawPayload);
-            const event = parsedToIngestEvent(parsed, args.eventName);
-            if (!event) {
-                return { memoryId: null };
-            }
-            // A replayed comment `.deleted` row must route to the deletion handler, NOT to ingestEvent,
-            // which would write the deleted comment as a NEW raw memory instead of archiving the matching ones.
-            if ((event.eventName === 'issue_comment' || event.eventName === 'pull_request_review_comment') &&
-                event.payload.action === 'deleted') {
-                const repo = event.payload.repository?.full_name ?? '';
-                const artifactRef = event.eventName === 'issue_comment'
-                    ? `github://${repo}/issue/${event.payload.issue.number}/comment/${event.payload.comment.id}`
-                    : `github://${repo}/pull/${event.payload.pull_request.number}/review_comment/${event.payload.comment.id}`;
-                const idempotencyKey = computeDeletionKey(artifactRef, event.payload.comment.updated_at ?? null);
-                const r = handleCommentDeleted(innerCtx, {
-                    artifactRef,
-                    idempotencyKey,
-                    deliveryId: args.deliveryId,
-                    eventName: event.eventName,
-                });
-                // archivedCount maps to memoryId only loosely — return null since the
-                // archive operation can affect multiple rows. The replay-result audit
-                // trail is in github_dlq.retry_count + retried_at.
-                return { memoryId: r.archivedCount > 0 ? 'archived' : null };
-            }
-            const r = ingestEvent(innerCtx, {
-                event,
-                rawBody: args.rawPayload,
-                deliveryId: args.deliveryId,
-            });
-            return { memoryId: r.memoryId };
-        },
+        ingestHook: reingestParkedDelivery,
     });
     if (!result.ok) {
         console.error(`replay failed: status=${result.status} retry_count=${result.retryCount}${result.reason ? ` reason=${result.reason}` : ''}`);

package/dist/connectors/github/deletion.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../../api.js';
+import { type Context } from '../../api/index.js';
 export interface DeletionInput {
     /** artifact_ref of the comment, e.g.,
      *  'github://acme/repo/issue/42/comment/123' or
@@ -23,14 +23,13 @@ export interface DeletionResult {
  * GitHub edits keep the same artifact_ref, so multiple active raw rows can
  * match a single deletion event. Archive ALL of them.
  *
- * ONE shared DB handle wraps ALL archives + the idempotency mark in a single
- * outer write scope: a per-row failure rolls back the whole batch, idempotency
- * included, so a retry re-attempts cleanly instead of leaving searchable
- * survivors. archiveRawMemory's own inner SAVEPOINT nests safely inside it.
+ * The store runs ALL archives + the idempotency mark as one write: a per-row
+ * failure rolls back the whole batch, idempotency included, so a retry
+ * re-attempts cleanly instead of leaving searchable survivors.
  *
  * Tenant scope and kind='raw' filtering are load-bearing: without them a
  * deletion event from tenant A could archive tenant B's row sharing the same
  * artifact_ref, or accidentally target a distilled row.
  */
-export declare function handleCommentDeleted(ctx: Context, input: DeletionInput): DeletionResult;
+export declare function handleCommentDeleted(ctx: Context, input: DeletionInput): Promise<DeletionResult>;
 //# sourceMappingURL=deletion.d.ts.map

package/dist/connectors/github/deletion.js

@@ -1,6 +1,4 @@
-import { openHippoDb, closeHippoDb, withWriteScope } from '../../db.js';
-import { archiveRawMemory } from '../../raw-archive.js';
-import { hasSeenKey, markKeySeen } from './idempotency.js';
+import { requireGroup, storeFor } from '../../store/index.js';
 /**
  * Handle GitHub `issue_comment.deleted` and `pull_request_review_comment.deleted`.
  *
@@ -8,59 +6,27 @@ import { hasSeenKey, markKeySeen } from './idempotency.js';
  * GitHub edits keep the same artifact_ref, so multiple active raw rows can
  * match a single deletion event. Archive ALL of them.
  *
- * ONE shared DB handle wraps ALL archives + the idempotency mark in a single
- * outer write scope: a per-row failure rolls back the whole batch, idempotency
- * included, so a retry re-attempts cleanly instead of leaving searchable
- * survivors. archiveRawMemory's own inner SAVEPOINT nests safely inside it.
+ * The store runs ALL archives + the idempotency mark as one write: a per-row
+ * failure rolls back the whole batch, idempotency included, so a retry
+ * re-attempts cleanly instead of leaving searchable survivors.
  *
  * Tenant scope and kind='raw' filtering are load-bearing: without them a
  * deletion event from tenant A could archive tenant B's row sharing the same
  * artifact_ref, or accidentally target a distilled row.
  */
-export function handleCommentDeleted(ctx, input) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        if (hasSeenKey(db, input.idempotencyKey)) {
-            return { status: 'duplicate', archivedCount: 0 };
-        }
-        // SAFETY: rows come from the SELECT above, which projects only the
-        // `id` column, so each row is exactly `{ id: string }`.
-        const rows = db
-            .prepare(`SELECT id FROM memories WHERE artifact_ref = ? AND tenant_id = ? AND kind = 'raw'`)
-            .all(input.artifactRef, ctx.tenantId);
-        const memoryIds = rows.map((r) => r.id);
-        if (memoryIds.length === 0) {
-            // Nothing to archive — still mark idempotency so a retry returns 'duplicate'.
-            // Independent INSERT, no rollback needed.
-            markKeySeen(db, {
-                idempotencyKey: input.idempotencyKey,
-                deliveryId: input.deliveryId,
-                eventName: input.eventName,
-                memoryId: null,
-            });
-            return { status: 'archive_skipped_not_found', archivedCount: 0 };
-        }
-        // Outer write scope wrapping all archives + the idempotency mark. Any throw
-        // rolls back the whole batch so retry sees neither archive nor mark — and
-        // re-attempts the full set.
-        withWriteScope(db, 'github_delete_all', () => {
-            for (const id of memoryIds) {
-                archiveRawMemory(db, id, {
-                    reason: `source_deleted:github:${input.eventName}:${input.deliveryId}`,
-                    who: ctx.actor.subject,
-                });
-            }
-            markKeySeen(db, {
-                idempotencyKey: input.idempotencyKey,
-                deliveryId: input.deliveryId,
-                eventName: input.eventName,
-                memoryId: memoryIds[0],
-            });
-        });
-        return { status: 'archived', archivedCount: memoryIds.length };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+export async function handleCommentDeleted(ctx, input) {
+    const { artifactRef, idempotencyKey, deliveryId, eventName } = input;
+    const done = await requireGroup(storeFor(ctx), 'connectorEvents').archiveDeletedArtifact({
+        tenantId: ctx.tenantId,
+        actor: ctx.actor.subject,
+        artifactRef,
+        reason: `source_deleted:github:${eventName}:${deliveryId}`,
+        event: { connector: 'github', idempotencyKey, deliveryId, eventName },
+    });
+    if (done.duplicate)
+        return { status: 'duplicate', archivedCount: 0 };
+    if (done.archived === 0)
+        return { status: 'archive_skipped_not_found', archivedCount: 0 };
+    return { status: 'archived', archivedCount: done.archived };
 }
 //# sourceMappingURL=deletion.js.map

package/dist/connectors/github/dlq.d.ts

@@ -1,56 +1,10 @@
-import type { DatabaseSyncLike } from '../../db.js';
-import type { Context } from '../../api.js';
-/**
- * GitHub webhook DLQ. Mirrors the Slack DLQ shape (src/connectors/slack/dlq.ts)
- * but carries GitHub-specific metadata: event_name, delivery_id, signature,
- * installation_id, repo_full_name, so a `hippo gh dlq replay` operator can
- * triage without re-deriving anything from the raw payload.
- *
- * Buckets:
- *   - parse_error     — raw_payload was not valid JSON
- *   - unroutable      — no tenant resolved for installation_id / repo_full_name
- *   - signature_failed — HMAC did not verify against the active webhook secret
- *   - unhandled       — parsed but no handler matched the event
- */
-export type DlqBucket = 'parse_error' | 'unroutable' | 'signature_failed' | 'unhandled';
-export interface DlqItem {
-    id: number;
-    tenantId: string;
-    rawPayload: string;
-    error: string;
-    eventName: string | null;
-    deliveryId: string | null;
-    signature: string | null;
-    installationId: string | null;
-    repoFullName: string | null;
-    retryCount: number;
-    receivedAt: string;
-    retriedAt: string | null;
-    bucket: DlqBucket | string;
-}
-/**
- * `tenantId: null` means the connector could not resolve a tenant for the
- * envelope (unroutable installation/repo). Stored as the sentinel
- * `'__unroutable__'` so the NOT NULL column is honored — same convention as
- * Slack DLQ.
- */
-export interface WriteDlqOpts {
-    tenantId: string | null;
-    rawPayload: string;
-    error: string;
-    bucket?: DlqBucket;
-    eventName?: string | null;
-    deliveryId?: string | null;
-    signature?: string | null;
-    installationId?: string | null;
-    repoFullName?: string | null;
-}
-export declare function writeToDlq(db: DatabaseSyncLike, opts: WriteDlqOpts): number;
-export declare function listDlq(db: DatabaseSyncLike, opts: {
-    tenantId: string;
-    limit?: number;
-}): DlqItem[];
-export declare function getDlqEntry(db: DatabaseSyncLike, id: number): DlqItem | null;
+import type { Context } from '../../api/index.js';
+import { type DlqBucket, type DlqItem, type GithubDlqWrite } from '../../store/connectors/github.js';
+import { type ConnectorDlq, type ReplayResult } from '../dlq.js';
+export type { DlqBucket, DlqItem };
+type GithubOwnColumns = Pick<GithubDlqWrite, 'eventName' | 'deliveryId' | 'installationId' | 'repoFullName'>;
+/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
+export declare const githubDlq: ConnectorDlq<GithubOwnColumns, DlqBucket, DlqItem>;
 export interface ReplayDlqOpts {
     /** Current webhook secret. If omitted, signature check is skipped (force-only path). */
     webhookSecret?: string;
@@ -64,14 +18,6 @@ export interface ReplayDlqOpts {
     /** When true, skip signature verification (used for legacy entries after secret rotation). */
     force?: boolean;
 }
-export type ReplayStatus = 'replayed' | 'parse_error' | 'sig_fail' | 'sig_missing' | 'unhandled' | 'not_found';
-export interface ReplayResult {
-    ok: boolean;
-    status: ReplayStatus;
-    memoryId: string | null;
-    retryCount: number;
-    reason?: string;
-}
 /**
  * Hook the webhook route injects to actually re-ingest a row. Decoupling
  * the dispatch keeps this module free of every event-type handler — the