hippo-memory 1.69.0 → 1.70.0

package/dist/connectors/github/dlq.js

@@ -1,74 +1,12 @@
-import { openHippoDb, closeHippoDb } from '../../db.js';
+import { bumpDlqRetry, dlqEntry, listDlqRows, } from '../../store/connectors/github.js';
+import { replayFailed } from '../dlq.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope } from './types.js';
-import { redactPayload, DLQ_REDACTED_NOTE } from '../../secret-detect.js';
-export function writeToDlq(db, opts) {
-    const rawPayload = redactPayload(opts.rawPayload);
-    const redacted = rawPayload !== opts.rawPayload;
-    const result = db
-        .prepare(`INSERT INTO github_dlq
-        (tenant_id, raw_payload, error, event_name, delivery_id, signature,
-         installation_id, repo_full_name, received_at, bucket)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(opts.tenantId ?? '__unroutable__', rawPayload, redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error, opts.eventName ?? null, opts.deliveryId ?? null, redacted ? null : opts.signature ?? null, opts.installationId ?? null, opts.repoFullName ?? null, new Date().toISOString(), opts.bucket ?? 'parse_error');
-    return Number(result.lastInsertRowid);
-}
-const SELECT_COLUMNS = `id, tenant_id, raw_payload, error, event_name, delivery_id,
-            signature, installation_id, repo_full_name, retry_count,
-            received_at, retried_at, bucket`;
-export function listDlq(db, opts) {
-    // SAFETY: rows come from the SELECT above (SELECT_COLUMNS), which projects
-    // exactly DlqRawRow's fields, in the same order github_dlq defines them.
-    const rows = db
-        .prepare(`SELECT ${SELECT_COLUMNS}
-         FROM github_dlq
-        WHERE tenant_id = ?
-        ORDER BY received_at ASC
-        LIMIT ?`)
-        .all(opts.tenantId, opts.limit ?? 100);
-    return rows.map(rowToItem);
-}
-export function getDlqEntry(db, id) {
-    // SAFETY: the row comes from the SELECT above (SELECT_COLUMNS), which
-    // projects exactly DlqRawRow's fields, in the same order github_dlq defines them.
-    const row = db
-        .prepare(`SELECT ${SELECT_COLUMNS}
-         FROM github_dlq
-        WHERE id = ?`)
-        .get(id);
-    if (!row)
-        return null;
-    return rowToItem(row);
-}
-function rowToItem(r) {
-    return {
-        id: Number(r.id),
-        tenantId: String(r.tenant_id),
-        rawPayload: String(r.raw_payload),
-        error: String(r.error),
-        eventName: r.event_name == null ? null : String(r.event_name),
-        deliveryId: r.delivery_id == null ? null : String(r.delivery_id),
-        signature: r.signature == null ? null : String(r.signature),
-        installationId: r.installation_id == null ? null : String(r.installation_id),
-        repoFullName: r.repo_full_name == null ? null : String(r.repo_full_name),
-        retryCount: Number(r.retry_count ?? 0),
-        receivedAt: String(r.received_at),
-        retriedAt: r.retried_at == null ? null : String(r.retried_at),
-        bucket: r.bucket == null ? 'parse_error' : String(r.bucket),
-    };
-}
-function bumpRetryCount(hippoRoot, id) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.prepare(`UPDATE github_dlq
-          SET retry_count = retry_count + 1,
-              retried_at = ?
-        WHERE id = ?`).run(new Date().toISOString(), id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
+/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
+export const githubDlq = {
+    letter: (row) => ({ connector: 'github', ...row }),
+    list: listDlqRows,
+};
 /**
  * Replay a DLQ row through the normal ingest path. Behavior:
  *   1. Fetch row by id. Not found → `not_found`.
@@ -85,23 +23,9 @@ function bumpRetryCount(hippoRoot, id) {
  * deployment state NOW, not at the time of original DLQing.
  */
 export async function replayDlqEntry(ctx, id, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    let row;
-    try {
-        row = getDlqEntry(db, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    if (!row) {
-        return {
-            ok: false,
-            status: 'not_found',
-            memoryId: null,
-            retryCount: 0,
-            reason: `dlq id ${id} not found`,
-        };
-    }
+    const row = dlqEntry(ctx.hippoRoot, id);
+    if (!row)
+        return replayFailed('not_found', 0, `dlq id ${id} not found`);
     // Signature verification (current secret, not the one in effect when DLQed).
     if (!opts.force && opts.webhookSecret) {
         const sigFailure = checkReplaySignature(ctx.hippoRoot, id, row, opts.webhookSecret, opts.previousSecret);
@@ -113,7 +37,7 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
         return envelopeFailure;
     // Without an ingest hook this is a dry-run validation. Bump and report.
     if (!opts.ingestHook) {
-        bumpRetryCount(ctx.hippoRoot, id);
+        bumpDlqRetry(ctx.hippoRoot, id);
         return {
             ok: true,
             status: 'replayed',
@@ -133,7 +57,7 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
         eventName,
         deliveryId,
     });
-    bumpRetryCount(ctx.hippoRoot, id);
+    bumpDlqRetry(ctx.hippoRoot, id);
     return {
         ok: true,
         status: 'replayed',
@@ -144,13 +68,7 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
 /** The failure result when the row cannot pass the signature gate, else null. */
 function checkReplaySignature(hippoRoot, id, row, webhookSecret, previousSecret) {
     if (!row.signature) {
-        return {
-            ok: false,
-            status: 'sig_missing',
-            memoryId: null,
-            retryCount: row.retryCount,
-            reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
-        };
+        return replayFailed('sig_missing', row.retryCount, 'row has no signature (legacy, or redacted before storing); pass --force to replay');
     }
     const sigOk = verifyGitHubSignature({
         rawBody: row.rawPayload,
@@ -159,14 +77,8 @@ function checkReplaySignature(hippoRoot, id, row, webhookSecret, previousSecret)
         previousSecret,
     });
     if (!sigOk) {
-        bumpRetryCount(hippoRoot, id);
-        return {
-            ok: false,
-            status: 'sig_fail',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',
-        };
+        bumpDlqRetry(hippoRoot, id);
+        return replayFailed('sig_fail', row.retryCount + 1, 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway');
     }
     return null;
 }
@@ -177,28 +89,16 @@ function checkReplayEnvelope(hippoRoot, id, row) {
         parsed = JSON.parse(row.rawPayload);
     }
     catch (e) {
-        bumpRetryCount(hippoRoot, id);
+        bumpDlqRetry(hippoRoot, id);
         // SAFETY: this is a best-effort error message only; property access on
         // any JS value is safe (undefined if absent), preserving the existing
         // lenient formatting even when something non-Error was thrown.
         const message = e.message;
-        return {
-            ok: false,
-            status: 'parse_error',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `still unparseable: ${message}`,
-        };
+        return replayFailed('parse_error', row.retryCount + 1, `still unparseable: ${message}`);
     }
     if (!isGitHubWebhookEnvelope(parsed)) {
-        bumpRetryCount(hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unhandled',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'not a GitHub webhook envelope',
-        };
+        bumpDlqRetry(hippoRoot, id);
+        return replayFailed('unhandled', row.retryCount + 1, 'not a GitHub webhook envelope');
     }
     return null;
 }

package/dist/connectors/github/ingest.d.ts

@@ -1,25 +1,4 @@
-/**
- * GitHub event ingest with afterWrite race-safe idempotency.
- *
- * Mirrors src/connectors/slack/ingest.ts. The dedupe key is sha256(eventName +
- * ':' + rawBody), derived from the signed body, not from the
- * unsigned X-GitHub-Delivery header, so a replay attacker cannot bypass
- * idempotency by rotating the delivery UUID.
- *
- * Race semantics:
- *   - Fast path: hasSeenKey pre-check returns 'duplicate' for the common case.
- *   - Slow path: hasSeenKey passes (no row yet). Two workers may race into
- *     remember() concurrently. Inside the writeEntry SAVEPOINT, INSERT OR
- *     IGNORE on github_event_log either inserts (changes=1, commit) or
- *     collides (changes=0, throw DuplicateIdempotencyError -> SAVEPOINT
- *     rolls back this worker's memory row). Exactly one memory exists per
- *     idempotency_key.
- *
- * The `__testInjectBeforeLog` hook below lets tests pre-populate github_event_log
- * inside the SAVEPOINT to exercise the changes=0 -> rollback path, not just the fast path.
- */
-import { type Context } from '../../api.js';
-import { type DatabaseSyncLike } from '../../db.js';
+import { type Context } from '../../api/index.js';
 import type { GitHubIssueEvent, GitHubIssueCommentEvent, GitHubPullRequestEvent, GitHubPullRequestReviewCommentEvent } from './types.js';
 export type IngestStatus = 'ingested' | 'duplicate' | 'skipped' | 'skipped_duplicate';
 export interface IngestResult {
@@ -52,14 +31,6 @@ export interface IngestInput {
     rawBody: string;
     /** X-GitHub-Delivery header value, audit metadata only. */
     deliveryId: string;
-    /**
-     * Test-only hook fired inside the SAVEPOINT, AFTER the memory row is
-     * inserted but BEFORE the github_event_log INSERT OR IGNORE. Tests pass
-     * a function that pre-inserts the github_event_log row using the
-     * provided db handle to simulate a concurrent worker winning the race.
-     * Production callers leave this undefined.
-     */
-    __testInjectBeforeLog?: (db: DatabaseSyncLike, idempotencyKey: string) => void;
 }
-export declare function ingestEvent(ctx: Context, input: IngestInput): IngestResult;
+export declare function ingestEvent(ctx: Context, input: IngestInput): Promise<IngestResult>;
 //# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/github/ingest.js

@@ -1,27 +1,9 @@
-/**
- * GitHub event ingest with afterWrite race-safe idempotency.
- *
- * Mirrors src/connectors/slack/ingest.ts. The dedupe key is sha256(eventName +
- * ':' + rawBody), derived from the signed body, not from the
- * unsigned X-GitHub-Delivery header, so a replay attacker cannot bypass
- * idempotency by rotating the delivery UUID.
- *
- * Race semantics:
- *   - Fast path: hasSeenKey pre-check returns 'duplicate' for the common case.
- *   - Slow path: hasSeenKey passes (no row yet). Two workers may race into
- *     remember() concurrently. Inside the writeEntry SAVEPOINT, INSERT OR
- *     IGNORE on github_event_log either inserts (changes=1, commit) or
- *     collides (changes=0, throw DuplicateIdempotencyError -> SAVEPOINT
- *     rolls back this worker's memory row). Exactly one memory exists per
- *     idempotency_key.
- *
- * The `__testInjectBeforeLog` hook below lets tests pre-populate github_event_log
- * inside the SAVEPOINT to exercise the changes=0 -> rollback path, not just the fast path.
- */
-import { remember } from '../../api.js';
-import { openHippoDb, closeHippoDb } from '../../db.js';
-import { RejectedValueError } from '../../rejection.js';
-import { hasSeenKey, lookupMemoryByKey, DuplicateIdempotencyError } from './idempotency.js';
+// GitHub event ingest, once per idempotency key. The key comes from the event's own content, never from the unsigned
+// X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast path:
+// the store logs the key in the memory's own transaction, which is what holds when two workers race.
+import { remember } from '../../api/index.js';
+import { requireGroup, storeFor } from '../../store/index.js';
+import { RejectedValueError } from '../../store/rejection.js';
 import { computeIdempotencyKey } from './signature.js';
 import { issueEventToRememberOpts, issueCommentEventToRememberOpts, pullRequestEventToRememberOpts, prReviewCommentEventToRememberOpts, } from './transform.js';
 function transformEvent(event) {
@@ -67,87 +49,42 @@ function eventUpdatedAt(event) {
             return event.payload.comment.updated_at ?? null;
     }
 }
-const INSERT_EVENT_LOG_SQL = `INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`;
-export function ingestEvent(ctx, input) {
+export async function ingestEvent(ctx, input) {
+    const events = requireGroup(storeFor(ctx), 'connectorEvents');
     const idempotencyKey = computeIdempotencyKey(eventArtifactRef(input.event), eventUpdatedAt(input.event));
+    const event = { connector: 'github', idempotencyKey, deliveryId: input.deliveryId, eventName: input.event.eventName };
     // Fast path: pre-check. Avoids running the transform / opening a write tx
     // for the common already-seen case (GitHub auto-retries with the same body).
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        if (hasSeenKey(db, idempotencyKey)) {
-            return { status: 'duplicate', memoryId: lookupMemoryByKey(db, idempotencyKey) };
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const seen = await events.eventRecord(event);
+    if (seen.seen)
+        return { status: 'duplicate', memoryId: seen.memoryId };
     const opts = transformEvent(input.event);
     if (!opts) {
         // Empty body: no memory to write, but mark seen so a retry of the same
         // empty event returns 'duplicate' (not 'skipped' again — that would
         // re-run the transform on every retry).
-        markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
+        await events.markEventSeen(event);
         return { status: 'skipped', memoryId: null };
     }
-    // Atomic write via afterWrite. Inside writeEntry's SAVEPOINT:
-    //   1. memories row INSERT lands.
-    //   2. (test-only) __testInjectBeforeLog can race-inject a colliding key.
-    //   3. INSERT OR IGNORE on github_event_log; if a concurrent worker (or
-    //      the test injection) beat us, changes=0 -> throw -> SAVEPOINT rolls
-    //      back our memory row. Other worker's commit stands.
     try {
-        return rememberWithEventLog(ctx, input, idempotencyKey, opts);
+        return await rememberWithEventLog(ctx, event, opts);
     }
     catch (e) {
-        if (e instanceof DuplicateIdempotencyError) {
-            // Other worker's row is committed. Return its memory_id so callers
-            // behave identically to the fast-path 'duplicate' branch.
-            const db3 = openHippoDb(ctx.hippoRoot);
-            try {
-                return { status: 'skipped_duplicate', memoryId: lookupMemoryByKey(db3, idempotencyKey) };
-            }
-            finally {
-                closeHippoDb(db3);
-            }
-        }
         if (e instanceof RejectedValueError) {
             // A tombstone hit is a PERMANENT skip, never DLQ-retried: mark the key seen like the empty-body
             // branch above so a GitHub retry of the same delivery acks as done, not error.
-            markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
+            await events.markEventSeen(event);
             return { status: 'skipped', memoryId: null };
         }
         throw e;
     }
 }
-function markKeySeenWithoutMemory(hippoRoot, idempotencyKey, input) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        db
-            .prepare(INSERT_EVENT_LOG_SQL)
-            .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-function rememberWithEventLog(ctx, input, idempotencyKey, opts) {
+async function rememberWithEventLog(ctx, event, opts) {
     // No `|| 'connector:github'` fallback (see rememberWithEventLog in slack/ingest.ts for rationale).
-    const result = remember({ ...ctx, store: undefined }, // the event log row commits with the memory on hippo.db's own handle, never through a store
-    {
-        ...opts,
-        untrusted: true,
-        afterWrite: (innerDb, memoryId) => {
-            if (input.__testInjectBeforeLog) {
-                input.__testInjectBeforeLog(innerDb, idempotencyKey);
-            }
-            const inserted = innerDb
-                .prepare(INSERT_EVENT_LOG_SQL)
-                .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), memoryId);
-            if (Number(inserted.changes ?? 0) === 0) {
-                throw new DuplicateIdempotencyError(idempotencyKey);
-            }
-        },
-    });
+    const result = await remember(ctx, { ...opts, untrusted: true, event });
+    // Another worker logged this key between the pre-check and the write: its memory stands and ours was not stored.
+    if (result.duplicate)
+        return { status: 'skipped_duplicate', memoryId: result.duplicate.memoryId };
     return { status: 'ingested', memoryId: result.id };
 }
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/github/octokit-client.d.ts

@@ -8,7 +8,7 @@
  * `GitHubFetchError`: an empty page would be an empty backfill with no operator signal.
  */
 import { type RateLimitInfo } from './ratelimit.js';
-import type { JsonValue } from '../../json.js';
+import type { JsonValue } from '../../util/json.js';
 export declare class GitHubFetchError extends Error {
     readonly status: number;
     readonly bodyExcerpt: string;

package/dist/connectors/github/octokit-client.js

@@ -8,7 +8,7 @@
  * `GitHubFetchError`: an empty page would be an empty backfill with no operator signal.
  */
 import { parseRateLimit } from './ratelimit.js';
-import { fetchWithRetry } from '../../http-retry.js';
+import { fetchWithRetry } from '../../util/http-retry.js';
 export class GitHubFetchError extends Error {
     status;
     bodyExcerpt;
@@ -55,6 +55,7 @@ export const realGitHubFetcher = async ({ url, token }) => {
     const rateLimit = parseRateLimit(headers, res.status);
     // Don't silently turn 401/403/404/500 into empty pages.
     if (res.status !== 200 && rateLimit.reason === 'none') {
+        // The status is the error reported; a body that cannot be read only costs its snippet.
         const body = await res.text().catch(() => '');
         throw new GitHubFetchError(res.status, body.slice(0, ERROR_BODY_SNIPPET_CHARS), url);
     }

package/dist/connectors/github/tenant-routing.d.ts

@@ -1,4 +1,4 @@
-import type { DatabaseSyncLike } from '../../db.js';
+import { type HippoStore } from '../../store/index.js';
 export interface ResolveArgs {
     /** String form of `installation.id`. `null`/`undefined` means "no installation field" (PAT-mode webhook). */
     installationId?: string | null;
@@ -29,5 +29,5 @@ export interface ResolveArgs {
  * The fail-closed contract lives here so every caller (route handler, CLI
  * replay, future MCP) gets identical protection.
  */
-export declare function resolveTenantForGitHub(db: DatabaseSyncLike, args: ResolveArgs): string | null;
+export declare function resolveTenantForGitHub(hippoRoot: string, args: ResolveArgs, store?: HippoStore): Promise<string | null>;
 //# sourceMappingURL=tenant-routing.d.ts.map

package/dist/connectors/github/tenant-routing.js

@@ -1,4 +1,5 @@
-import { envGithubAllowUnknownInstallationFallback, envTenant } from '../../env.js';
+import { envGithubAllowUnknownInstallationFallback, envTenant } from '../../util/env.js';
+import { requireGroup, storeFor } from '../../store/index.js';
 /**
  * Resolve the tenant_id for a GitHub webhook envelope.
  *
@@ -23,48 +24,21 @@ import { envGithubAllowUnknownInstallationFallback, envTenant } from '../../env.
  * The fail-closed contract lives here so every caller (route handler, CLI
  * replay, future MCP) gets identical protection.
  */
-export function resolveTenantForGitHub(db, args) {
+export async function resolveTenantForGitHub(hippoRoot, args, store) {
     const envFallback = () => envTenant();
     const escapeHatch = envGithubAllowUnknownInstallationFallback();
-    // SAFETY: the row comes from the SELECT above, which projects exactly one
-    // column, `c`, as a COUNT(*).
-    const instCount = db
-        .prepare(`SELECT COUNT(*) AS c FROM github_installations`)
-        .get().c;
-    // SAFETY: the row comes from the SELECT above, which projects exactly one
-    // column, `c`, as a COUNT(*).
-    const repoCount = db
-        .prepare(`SELECT COUNT(*) AS c FROM github_repositories`)
-        .get().c;
+    const routing = await requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').githubRouting(args);
+    if (routing.tenant)
+        return routing.tenant;
     if (args.installationId) {
-        // SAFETY: the row comes from the SELECT above, which projects exactly
-        // the tenant_id column of github_installations.
-        const row = db
-            .prepare(`SELECT tenant_id FROM github_installations WHERE installation_id = ?`)
-            .get(args.installationId);
-        if (row?.tenant_id)
-            return row.tenant_id;
-        if (Number(instCount) === 0) {
-            // Single-tenant install (table empty); env fallback is safe.
+        // An empty table is a single-tenant install, where the env fallback is safe; else fail closed.
+        if (routing.installations === 0)
             return envFallback();
-        }
-        // Multi-tenant install with unknown installation_id — fail closed.
         return escapeHatch ? envFallback() : null;
     }
-    // No installation.id (PAT-mode webhook).
-    if (Number(instCount) === 0 && Number(repoCount) === 0) {
-        // Single-tenant deployment with no routing tables populated.
+    // No installation.id (PAT-mode webhook) and no routing rows at all: single-tenant deployment.
+    if (routing.installations === 0 && routing.repositories === 0)
         return envFallback();
-    }
-    if (args.repoFullName) {
-        // SAFETY: the row comes from the SELECT above, which projects exactly
-        // the tenant_id column of github_repositories.
-        const row = db
-            .prepare(`SELECT tenant_id FROM github_repositories WHERE repo_full_name = ? ORDER BY added_at, tenant_id LIMIT 1`)
-            .get(args.repoFullName);
-        if (row?.tenant_id)
-            return row.tenant_id;
-    }
     return escapeHatch ? envFallback() : null;
 }
 //# sourceMappingURL=tenant-routing.js.map

package/dist/connectors/github/transform.d.ts

@@ -1,4 +1,4 @@
-import type { RememberOpts } from '../../api.js';
+import type { RememberOpts } from '../../api/index.js';
 import type { GitHubIssueEvent, GitHubIssueCommentEvent, GitHubPullRequestEvent, GitHubPullRequestReviewCommentEvent } from './types.js';
 export declare function issueEventToRememberOpts(evt: GitHubIssueEvent): RememberOpts | null;
 export declare function issueCommentEventToRememberOpts(evt: GitHubIssueCommentEvent): RememberOpts | null;

package/dist/connectors/github/types.d.ts

@@ -7,7 +7,7 @@
  * header value so a malicious or misrouted payload cannot satisfy a guard
  * for the wrong event type.
  */
-import { type JsonValue } from '../../json.js';
+import { type JsonValue } from '../../util/json.js';
 /**
  * `private` MUST be optional, not required. The Slack-style
  * fail-safe in scope.ts requires an envelope with `private: undefined` to

package/dist/connectors/github/types.js

@@ -7,33 +7,30 @@
  * header value so a malicious or misrouted payload cannot satisfy a guard
  * for the wrong event type.
  */
-import { isJsonString } from '../../json.js';
-function isJsonObject(x) {
+import { isJsonString, isJsonNumber } from '../../util/json.js';
+function isObjectOrArray(x) {
     return x !== null && typeof x === 'object';
 }
-function isJsonNumber(x) {
-    return typeof x === 'number';
-}
 function isGitHubSender(x) {
-    if (!isJsonObject(x))
+    if (!isObjectOrArray(x))
         return false;
     return isJsonString(x.login) && isJsonNumber(x.id);
 }
 export function isGitHubWebhookEnvelope(x) {
-    if (!isJsonObject(x))
+    if (!isObjectOrArray(x))
         return false;
     // Duck-type: an envelope must at least carry an action OR a repository field.
-    return isJsonString(x.action) || isJsonObject(x.repository);
+    return isJsonString(x.action) || isObjectOrArray(x.repository);
 }
 export function isGitHubIssueEvent(x, evtHeader) {
     if (evtHeader !== 'issues')
         return false;
-    if (!isJsonObject(x))
+    if (!isObjectOrArray(x))
         return false;
     if (!isJsonString(x.action))
         return false;
     const issue = x.issue;
-    if (!isJsonObject(issue))
+    if (!isObjectOrArray(issue))
         return false;
     if (!isJsonNumber(issue.number))
         return false;
@@ -44,15 +41,15 @@ export function isGitHubIssueEvent(x, evtHeader) {
 export function isGitHubIssueCommentEvent(x, evtHeader) {
     if (evtHeader !== 'issue_comment')
         return false;
-    if (!isJsonObject(x))
+    if (!isObjectOrArray(x))
         return false;
     if (!isJsonString(x.action))
         return false;
     const issue = x.issue;
-    if (!isJsonObject(issue) || !isJsonNumber(issue.number))
+    if (!isObjectOrArray(issue) || !isJsonNumber(issue.number))
         return false;
     const comment = x.comment;
-    if (!isJsonObject(comment))
+    if (!isObjectOrArray(comment))
         return false;
     if (!isJsonNumber(comment.id))
         return false;
@@ -63,12 +60,12 @@ export function isGitHubIssueCommentEvent(x, evtHeader) {
 export function isGitHubPullRequestEvent(x, evtHeader) {
     if (evtHeader !== 'pull_request')
         return false;
-    if (!isJsonObject(x))
+    if (!isObjectOrArray(x))
         return false;
     if (!isJsonString(x.action))
         return false;
     const pr = x.pull_request;
-    if (!isJsonObject(pr))
+    if (!isObjectOrArray(pr))
         return false;
     if (!isJsonNumber(pr.number))
         return false;
@@ -79,15 +76,15 @@ export function isGitHubPullRequestEvent(x, evtHeader) {
 export function isGitHubPullRequestReviewCommentEvent(x, evtHeader) {
     if (evtHeader !== 'pull_request_review_comment')
         return false;
-    if (!isJsonObject(x))
+    if (!isObjectOrArray(x))
         return false;
     if (!isJsonString(x.action))
         return false;
     const pr = x.pull_request;
-    if (!isJsonObject(pr) || !isJsonNumber(pr.number))
+    if (!isObjectOrArray(pr) || !isJsonNumber(pr.number))
         return false;
     const comment = x.comment;
-    if (!isJsonObject(comment))
+    if (!isObjectOrArray(comment))
         return false;
     if (!isJsonNumber(comment.id))
         return false;

package/dist/connectors/github/webhook.d.ts

@@ -1,4 +1,5 @@
-import { type WebhookRequest } from '../../http-util.js';
+import type { HippoStore } from '../../store/index.js';
+import { type WebhookRequest } from '../../util/http-util.js';
 /**
  * GitHub webhook receiver. Mirrors the Slack route shape but with
  * GitHub-specific idioms:
@@ -15,5 +16,5 @@ import { type WebhookRequest } from '../../http-util.js';
  *
  * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
  */
-export declare function handleGitHubEventsWebhook({ req, res, opts }: WebhookRequest): Promise<void>;
+export declare function handleGitHubEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map