hippo-memory 1.69.0 → 1.71.0

package/dist/connectors/slack/dlq.js

@@ -1,96 +1,23 @@
-import { adminActor } from '../../api.js';
-import { openHippoDb, closeHippoDb } from '../../db.js';
+import { adminActor } from '../../api/index.js';
+import { bumpSlackDlqRetryCount, listSlackDlq, markSlackDlqRetried, slackDlqEntry, } from '../../store/connectors/slack.js';
+import { replayFailed } from '../dlq.js';
 import { ingestMessage } from './ingest.js';
-import { resolveTenantForTeam } from './tenant-routing.js';
+import { resolveTenantForSlackTeam } from './tenant-routing.js';
 import { verifySlackSignature } from './signature.js';
 import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
 import { handleMessageDeleted } from './deletion.js';
-import { redactPayload, DLQ_REDACTED_NOTE } from '../../secret-detect.js';
-export function writeToDlq(db, opts) {
-    const rawPayload = redactPayload(opts.rawPayload);
-    // A redacted body can never match its signature, so the row keeps none and replay needs --force.
-    const redacted = rawPayload !== opts.rawPayload;
-    const result = db
-        .prepare(`INSERT INTO slack_dlq
-        (tenant_id, team_id, raw_payload, error, received_at, bucket, signature, slack_timestamp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(opts.tenantId ?? '__unroutable__', opts.teamId ?? null, rawPayload, redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error, new Date().toISOString(), opts.bucket ?? 'parse_error', redacted ? null : opts.signature ?? null, opts.slackTimestamp ?? null);
-    return Number(result.lastInsertRowid);
-}
-export function listDlq(db, opts) {
-    // SAFETY: row shape matches the columns named in the SELECT below.
-    const rows = db
-        .prepare(`SELECT id, tenant_id, team_id, raw_payload, error, received_at, retried_at,
-              bucket, retry_count, signature, slack_timestamp
-         FROM slack_dlq
-        WHERE tenant_id = ?
-        ORDER BY received_at ASC
-        LIMIT ?`)
-        .all(opts.tenantId, opts.limit ?? 100);
-    return rows.map(rowToItem);
-}
-export function getDlqEntry(db, id) {
-    // SAFETY: row shape matches the columns named in the SELECT below.
-    const row = db
-        .prepare(`SELECT id, tenant_id, team_id, raw_payload, error, received_at, retried_at,
-              bucket, retry_count, signature, slack_timestamp
-         FROM slack_dlq
-        WHERE id = ?`)
-        .get(id);
+import { errorMessage } from '../../util/log.js';
+/** Slack's dead-letter table; `teamId` and `slackTimestamp` are the columns only it has. */
+export const slackDlq = {
+    letter: (row) => ({ connector: 'slack', ...row }),
+    list: listSlackDlq,
+};
+/** Replay a DLQ row via the normal ingest path (`hippo slack dlq replay <id> [--force]`), re-verifying the signature with the CURRENT secret unless forced.
+ *  Rows with a NULL signature need --force; replays use today's routing, because the DLQ exists to be drained after the operator fixed routing. */
+export async function replayDlqEntry(ctx, id, opts = {}) {
+    const row = slackDlqEntry(ctx.hippoRoot, id);
     if (!row)
-        return null;
-    return rowToItem(row);
-}
-function rowToItem(r) {
-    return {
-        id: Number(r.id),
-        tenantId: String(r.tenant_id),
-        teamId: r.team_id == null ? null : String(r.team_id),
-        rawPayload: String(r.raw_payload),
-        error: String(r.error),
-        receivedAt: String(r.received_at),
-        retriedAt: r.retried_at == null ? null : String(r.retried_at),
-        bucket: r.bucket == null ? 'parse_error' : String(r.bucket),
-        retryCount: Number(r.retry_count ?? 0),
-        signature: r.signature == null ? null : String(r.signature),
-        slackTimestamp: r.slack_timestamp == null ? null : String(r.slack_timestamp),
-    };
-}
-export function markDlqRetried(db, id) {
-    db.prepare(`UPDATE slack_dlq SET retried_at = ?, retry_count = retry_count + 1 WHERE id = ?`)
-        .run(new Date().toISOString(), id);
-}
-/**
- * Replay a DLQ row through the normal ingest path. Used by `hippo slack dlq
- * replay <id> [--force]`.
- *
- * Behavior:
- *   1. SELECT the row.
- *   2. If signature + slack_timestamp are present and `signingSecret` is set,
- *      re-verify with the CURRENT secret (not previous). Failure → bail unless
- *      --force. Legacy rows from before v19 may have NULL signature; those
- *      require --force to replay safely.
- *   3. Re-parse the raw_payload and dispatch to ingestMessage / handleMessageDeleted.
- *   4. On success: mark retried_at, increment retry_count.
- *   5. On failure: increment retry_count only, leave the row.
- *
- * The replay always uses the routing the deployment has NOW (current
- * slack_workspaces table + env), not whatever was in effect when the original
- * envelope was DLQed. That is intentional: the DLQ exists to be drained after
- * the operator fixed the routing.
- */
-export function replayDlqEntry(ctx, id, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    let row;
-    try {
-        row = getDlqEntry(db, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    if (!row) {
-        return { ok: false, status: 'not_found', memoryId: null, retryCount: 0, reason: `dlq id ${id} not found` };
-    }
+        return replayFailed('not_found', 0, `dlq id ${id} not found`);
     // Signature verification (current secret, not previous).
     if (!opts.force) {
         const sigFailure = checkReplaySignature(row, opts);
@@ -103,20 +30,13 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         parsed = JSON.parse(row.rawPayload);
     }
     catch (e) {
-        return failAndBump(ctx.hippoRoot, row, 'parse_error', `still unparseable: ${e instanceof Error ? e.message : String(e)}`);
+        return failAndBump(ctx.hippoRoot, row, 'parse_error', `still unparseable: ${errorMessage(e)}`);
     }
     if (!isSlackEventEnvelope(parsed)) {
         return failAndBump(ctx.hippoRoot, row, 'unhandled', 'not an event_callback envelope');
     }
     // Resolve tenant against current state. If still unroutable, bail.
-    const db2 = openHippoDb(ctx.hippoRoot);
-    let tenant;
-    try {
-        tenant = resolveTenantForTeam(db2, parsed.team_id);
-    }
-    finally {
-        closeHippoDb(db2);
-    }
+    const tenant = await resolveTenantForSlackTeam(ctx.hippoRoot, parsed.team_id);
     if (!tenant) {
         return failAndBump(ctx.hippoRoot, row, 'unroutable', `team_id ${parsed.team_id} still unroutable`);
     }
@@ -130,13 +50,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
 /** The failure result when the row cannot pass the signature gate, else null; never bumps the count. */
 function checkReplaySignature(row, opts) {
     if (!row.signature || !row.slackTimestamp) {
-        return {
-            ok: false,
-            status: 'sig_missing',
-            memoryId: null,
-            retryCount: row.retryCount,
-            reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
-        };
+        return replayFailed('sig_missing', row.retryCount, 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay');
     }
     if (opts.signingSecret) {
         const ok = verifySlackSignature({
@@ -149,22 +63,16 @@ function checkReplaySignature(row, opts) {
             skewSeconds: opts.skewSeconds ?? 60 * 60 * 24 * 365,
         });
         if (!ok) {
-            return {
-                ok: false,
-                status: 'sig_fail',
-                memoryId: null,
-                retryCount: row.retryCount,
-                reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
-            };
+            return replayFailed('sig_fail', row.retryCount, 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway');
         }
     }
     return null;
 }
 function failAndBump(hippoRoot, row, status, reason) {
-    bumpRetryCount(hippoRoot, row.id);
-    return { ok: false, status, memoryId: null, retryCount: row.retryCount + 1, reason };
+    bumpSlackDlqRetryCount(hippoRoot, row.id);
+    return replayFailed(status, row.retryCount + 1, reason);
 }
-function dispatchReplay(replayCtx, row, parsed) {
+async function dispatchReplay(replayCtx, row, parsed) {
     const { hippoRoot } = replayCtx;
     const id = row.id;
     const inner = parsed.event;
@@ -172,16 +80,16 @@ function dispatchReplay(replayCtx, row, parsed) {
         return failAndBump(hippoRoot, row, 'unhandled', `unhandled inner event type`);
     }
     if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
-        const r = handleMessageDeleted(replayCtx, {
+        const r = await handleMessageDeleted(replayCtx, {
             teamId: parsed.team_id,
             channelId: inner.channel,
             deletedTs: inner.deleted_ts,
             eventId: parsed.event_id,
         });
-        markRetried(hippoRoot, id);
+        markSlackDlqRetried(hippoRoot, id);
         return { ok: true, status: r.status, memoryId: r.memoryId, retryCount: row.retryCount + 1 };
     }
-    const result = ingestMessage(replayCtx, {
+    const result = await ingestMessage(replayCtx, {
         teamId: parsed.team_id,
         channel: {
             id: inner.channel,
@@ -192,25 +100,7 @@ function dispatchReplay(replayCtx, row, parsed) {
         message: inner,
         eventId: parsed.event_id,
     });
-    markRetried(hippoRoot, id);
+    markSlackDlqRetried(hippoRoot, id);
     return { ok: true, status: result.status, memoryId: result.memoryId, retryCount: row.retryCount + 1 };
 }
-function markRetried(hippoRoot, id) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        markDlqRetried(db, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-function bumpRetryCount(hippoRoot, id) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.prepare(`UPDATE slack_dlq SET retry_count = retry_count + 1 WHERE id = ?`).run(id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 //# sourceMappingURL=dlq.js.map

package/dist/connectors/slack/ingest.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../../api.js';
+import { type Context } from '../../api/index.js';
 import type { ChannelMeta } from './scope.js';
 import type { SlackMessageEvent } from './types.js';
 export interface IngestInput {
@@ -13,21 +13,7 @@ export interface IngestResult {
     status: IngestStatus;
     memoryId: string | null;
 }
-/**
- * Ingest a Slack message into hippo as a kind='raw' memory.
- *
- * - Idempotency-checked via slack_event_log (Slack retries within 1 minute).
- * - The memory write and the slack_event_log mark commit atomically through
- *   `api.remember`'s `afterWrite` hook — a crash between the two cannot
- *   produce a duplicate on the next retry.
- * - The afterWrite hook uses an explicit `INSERT OR IGNORE` + changes-check:
- *   if a concurrent worker beat us to slack_event_log between the pre-check
- *   and the SAVEPOINT, we throw `DuplicateEventError` to roll back the memory
- *   write. The pre-check `hasSeenEvent` stays as a fast path for the common
- *   already-seen case, but the afterWrite throw is what makes idempotency
- *   correct under two-worker concurrency.
- * - Empty-body messages return 'skipped' but still mark seen so a replay
- *   returns 'duplicate' rather than re-running the transform.
- */
-export declare function ingestMessage(ctx: Context, input: IngestInput): IngestResult;
+/** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,
+ *  the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is logged with no memory. */
+export declare function ingestMessage(ctx: Context, input: IngestInput): Promise<IngestResult>;
 //# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/slack/ingest.js

@@ -1,109 +1,44 @@
-import { remember } from '../../api.js';
-import { openHippoDb, closeHippoDb } from '../../db.js';
-import { RejectedValueError } from '../../rejection.js';
-import { hasSeenEvent, markEventSeen, lookupMemoryByEvent, DuplicateEventError, } from './idempotency.js';
+import { remember } from '../../api/index.js';
+import { requireGroup, storeFor } from '../../store/index.js';
+import { RejectedValueError } from '../../store/rejection.js';
 import { messageToRememberOpts } from './transform.js';
-/**
- * Ingest a Slack message into hippo as a kind='raw' memory.
- *
- * - Idempotency-checked via slack_event_log (Slack retries within 1 minute).
- * - The memory write and the slack_event_log mark commit atomically through
- *   `api.remember`'s `afterWrite` hook — a crash between the two cannot
- *   produce a duplicate on the next retry.
- * - The afterWrite hook uses an explicit `INSERT OR IGNORE` + changes-check:
- *   if a concurrent worker beat us to slack_event_log between the pre-check
- *   and the SAVEPOINT, we throw `DuplicateEventError` to roll back the memory
- *   write. The pre-check `hasSeenEvent` stays as a fast path for the common
- *   already-seen case, but the afterWrite throw is what makes idempotency
- *   correct under two-worker concurrency.
- * - Empty-body messages return 'skipped' but still mark seen so a replay
- *   returns 'duplicate' rather than re-running the transform.
- */
-export function ingestMessage(ctx, input) {
+/** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,
+ *  the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is logged with no memory. */
+export async function ingestMessage(ctx, input) {
+    const events = requireGroup(storeFor(ctx), 'connectorEvents');
+    const event = { connector: 'slack', eventId: input.eventId };
     // Idempotency check: if already seen, return the cached memory_id without
     // re-running the transform or hitting api.remember.
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        if (hasSeenEvent(db, input.eventId)) {
-            // Empty-body events are marked seen with memory_id=NULL, so their replay returns the same 'skipped'
-            // they first returned; a non-NULL memory_id means a memory was ingested, so 'duplicate'.
-            const cachedId = lookupMemoryByEvent(db, input.eventId);
-            return { status: cachedId === null ? 'skipped' : 'duplicate', memoryId: cachedId };
-        }
-    }
-    finally {
-        closeHippoDb(db);
+    const seen = await events.eventRecord(event);
+    if (seen.seen) {
+        // Empty-body events are marked seen with memory_id=NULL, so their replay returns the same 'skipped'
+        // they first returned; a non-NULL memory_id means a memory was ingested, so 'duplicate'.
+        return { status: seen.memoryId === null ? 'skipped' : 'duplicate', memoryId: seen.memoryId };
     }
     const opts = messageToRememberOpts(input);
     if (!opts) {
-        const db2 = openHippoDb(ctx.hippoRoot);
-        try {
-            markEventSeen(db2, input.eventId, null);
-        }
-        finally {
-            closeHippoDb(db2);
-        }
+        await events.markEventSeen(event);
         return { status: 'skipped', memoryId: null };
     }
-    // Atomic write: the afterWrite callback runs inside writeEntry's SAVEPOINT,
-    // so the memory row and the slack_event_log row commit (or roll back)
-    // together. Slack's 1-minute retry window can no longer produce a duplicate
-    // via the crash-between-handles race.
     try {
-        return rememberWithEventLog(ctx, input.eventId, opts);
+        return await rememberWithEventLog(ctx, event, opts);
     }
     catch (e) {
-        if (e instanceof DuplicateEventError)
-            return lostRaceResult(ctx, input.eventId);
-        if (e instanceof RejectedValueError)
-            return rejectedValueResult(ctx, input.eventId);
-        throw e;
+        if (!(e instanceof RejectedValueError))
+            throw e;
+        // A tombstone hit is a PERMANENT skip: a DLQ retry would hit the same refusal forever, so mark the
+        // event seen like the empty-body branch above and let a Slack retry ack as done, not error.
+        await events.markEventSeen(event);
+        return { status: 'skipped', memoryId: null };
     }
 }
-function rememberWithEventLog(ctx, eventId, opts) {
+async function rememberWithEventLog(ctx, event, opts) {
     // No `|| 'connector:slack'` fallback: the caller always builds ctx with the connector subject, and with
     // an object-shaped Context.actor an OR-fallback would never fire anyway.
-    const result = remember({ ...ctx, store: undefined }, // the event log row commits with the memory on hippo.db's own handle, never through a store
-    {
-        ...opts,
-        untrusted: true,
-        afterWrite: (innerDb, memoryId) => {
-            const inserted = innerDb
-                .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)
-                .run(eventId, new Date().toISOString(), memoryId);
-            if ((Number(inserted.changes ?? 0)) === 0) {
-                // Two-worker race: another writer reserved this event_id between
-                // the pre-check and the write. Throw to roll back the SAVEPOINT
-                // in writeEntry — the memory row gets discarded, idempotency
-                // holds, exactly one memory exists for this event_id.
-                throw new DuplicateEventError(eventId);
-            }
-        },
-    });
+    const result = await remember(ctx, { ...opts, untrusted: true, event });
+    // Another worker logged this event between the pre-check and the write: its memory stands and ours was not stored.
+    if (result.duplicate)
+        return { status: 'skipped_duplicate', memoryId: result.duplicate.memoryId };
     return { status: 'ingested', memoryId: result.id };
 }
-function lostRaceResult(ctx, eventId) {
-    // The other worker's memory row is already committed. Return its id
-    // so the caller behaves identically to the fast-path 'duplicate' branch.
-    const db3 = openHippoDb(ctx.hippoRoot);
-    try {
-        const cachedId = lookupMemoryByEvent(db3, eventId);
-        return { status: 'skipped_duplicate', memoryId: cachedId };
-    }
-    finally {
-        closeHippoDb(db3);
-    }
-}
-function rejectedValueResult(ctx, eventId) {
-    // A tombstone hit is a PERMANENT skip: a DLQ retry would hit the same refusal forever, so mark the
-    // event seen like the empty-body branch above and let a Slack retry ack as done, not error.
-    const db4 = openHippoDb(ctx.hippoRoot);
-    try {
-        markEventSeen(db4, eventId, null);
-    }
-    finally {
-        closeHippoDb(db4);
-    }
-    return { status: 'skipped', memoryId: null };
-}
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/slack/scope.d.ts

@@ -4,13 +4,7 @@ export interface ChannelMeta {
     is_im?: boolean;
     is_mpim?: boolean;
 }
-/**
- * Map a Slack channel into a hippo scope string.
- *
- * Default to private when privacy is undetermined. The cost of leaking a
- * public channel into private scope (recall returns nothing) is far smaller
- * than the cost of leaking a private channel into public scope (data exposed
- * to a tenant that should not see it).
- */
+/** Map a Slack channel into a hippo scope string, defaulting to private when privacy is undetermined:
+ *  a public channel leaking into private scope returns nothing, but the reverse exposes data. */
 export declare function scopeFromChannel(ch: ChannelMeta): string;
 //# sourceMappingURL=scope.d.ts.map

package/dist/connectors/slack/scope.js

@@ -1,11 +1,5 @@
-/**
- * Map a Slack channel into a hippo scope string.
- *
- * Default to private when privacy is undetermined. The cost of leaking a
- * public channel into private scope (recall returns nothing) is far smaller
- * than the cost of leaking a private channel into public scope (data exposed
- * to a tenant that should not see it).
- */
+/** Map a Slack channel into a hippo scope string, defaulting to private when privacy is undetermined:
+ *  a public channel leaking into private scope returns nothing, but the reverse exposes data. */
 export function scopeFromChannel(ch) {
     const isPublic = ch.is_private === false && !ch.is_im && !ch.is_mpim;
     return isPublic ? `slack:public:${ch.id}` : `slack:private:${ch.id}`;

package/dist/connectors/slack/signature.d.ts

@@ -3,12 +3,7 @@ export interface VerifyOpts {
     timestamp: string;
     signature: string;
     signingSecret: string;
-    /**
-     * Previous signing secret during a rotation. Deploy with
-     * both `SLACK_SIGNING_SECRET` (new) and `SLACK_SIGNING_SECRET_PREVIOUS` (old)
-     * set, verify both work, drop previous after rollover. The verifier tries
-     * `signingSecret` first, then `previousSecret` if that fails.
-     */
+    /** Previous signing secret during rotation (SLACK_SIGNING_SECRET_PREVIOUS); the verifier tries `signingSecret` first, then this. */
     previousSecret?: string;
     /** Current unix seconds. Injectable for tests. */
     now?: number;

package/dist/connectors/slack/signature.js

@@ -1,4 +1,5 @@
 import { createHmac, timingSafeEqual } from 'crypto';
+const DEFAULT_SKEW_SECONDS = 5 * 60;
 function verifyOne(rawBody, signature, timestamp, secret) {
     if (!signature.startsWith('v0='))
         return false;
@@ -12,7 +13,7 @@ function verifyOne(rawBody, signature, timestamp, secret) {
 export function verifySlackSignature(opts) {
     const { rawBody, timestamp, signature, signingSecret, previousSecret } = opts;
     const now = opts.now ?? Math.floor(Date.now() / 1000);
-    const skew = opts.skewSeconds ?? 5 * 60;
+    const skew = opts.skewSeconds ?? DEFAULT_SKEW_SECONDS;
     const ts = Number(timestamp);
     if (!Number.isFinite(ts))
         return false;

package/dist/connectors/slack/tenant-routing.d.ts

@@ -1,19 +1,5 @@
-import type { DatabaseSyncLike } from '../../db.js';
-/**
- * Look up the tenant_id for a Slack team_id.
- *
- * Returns:
- *   - mapped tenant_id when slack_workspaces has a row for `teamId`
- *   - the deployment's HIPPO_TENANT fallback (or 'default') when slack_workspaces
- *     is empty (single-workspace install — env fallback is safe)
- *   - null when slack_workspaces is non-empty AND `teamId` is unknown
- *     (multi-workspace install — fail closed; an unknown team is not the
- *     deployment's tenant). Escape hatch: SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1
- *     restores the env fallback for emergency rollback only.
- *
- * The fail-closed contract lives here so every caller (route handler, CLI
- * replay, future MCP) gets the same protection against routing a foreign
- * workspace's events into the deployment tenant.
- */
-export declare function resolveTenantForTeam(db: DatabaseSyncLike, teamId: string): string | null;
+import { type HippoStore } from '../../store/index.js';
+/** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty (single-workspace install).
+ *  An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is the emergency escape. */
+export declare function resolveTenantForSlackTeam(hippoRoot: string, teamId: string, store?: HippoStore): Promise<string | null>;
 //# sourceMappingURL=tenant-routing.d.ts.map

package/dist/connectors/slack/tenant-routing.js

@@ -1,34 +1,14 @@
-import { envSlackAllowUnknownTeamFallback, envTenant } from '../../env.js';
-/**
- * Look up the tenant_id for a Slack team_id.
- *
- * Returns:
- *   - mapped tenant_id when slack_workspaces has a row for `teamId`
- *   - the deployment's HIPPO_TENANT fallback (or 'default') when slack_workspaces
- *     is empty (single-workspace install — env fallback is safe)
- *   - null when slack_workspaces is non-empty AND `teamId` is unknown
- *     (multi-workspace install — fail closed; an unknown team is not the
- *     deployment's tenant). Escape hatch: SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1
- *     restores the env fallback for emergency rollback only.
- *
- * The fail-closed contract lives here so every caller (route handler, CLI
- * replay, future MCP) gets the same protection against routing a foreign
- * workspace's events into the deployment tenant.
- */
-export function resolveTenantForTeam(db, teamId) {
-    // SAFETY: query selects only `tenant_id`, so a returned row has that shape;
-    // .get() returns undefined when no row matches.
-    const row = db
-        .prepare(`SELECT tenant_id FROM slack_workspaces WHERE team_id = ?`)
-        .get(teamId);
-    if (row?.tenant_id)
-        return row.tenant_id;
-    // SAFETY: `COUNT(*) AS c` always returns exactly one row shaped { c }; sqlite
-    // may return the count as number or bigint depending on driver.
-    const total = db
-        .prepare(`SELECT COUNT(*) AS c FROM slack_workspaces`)
-        .get().c;
-    if (Number(total) === 0) {
+import { envSlackAllowUnknownTeamFallback, envTenant } from '../../util/env.js';
+import { requireGroup, storeFor } from '../../store/index.js';
+/** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty (single-workspace install).
+ *  An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is the emergency escape. */
+export async function resolveTenantForSlackTeam(hippoRoot, teamId, store) {
+    return tenantForRoute(await requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').slackTeamRoute(teamId));
+}
+function tenantForRoute(route) {
+    if (route.tenantId !== null)
+        return route.tenantId;
+    if (route.workspaceCount === 0) {
         // Single-workspace install: env fallback is safe.
         return envTenant();
     }

package/dist/connectors/slack/transform.d.ts

@@ -1,4 +1,4 @@
-import type { RememberOpts } from '../../api.js';
+import type { RememberOpts } from '../../api/index.js';
 import { type ChannelMeta } from './scope.js';
 import type { SlackMessageEvent } from './types.js';
 export interface TransformInput {
@@ -6,23 +6,7 @@ export interface TransformInput {
     channel: ChannelMeta;
     message: SlackMessageEvent;
 }
-/**
- * Convert a SlackMessageEvent into RememberOpts for api.remember(). Returns
- * null when the message has no usable body (e.g. system events, bot reactions
- * without text). Caller treats null as "skip but mark idempotency seen".
- *
- * Contract:
- * - kind is the literal 'raw' (connector boundary, see src/importers.ts).
- * - artifact_ref format MUST be exactly `slack://${teamId}/${channelId}/${ts}`;
- *   the deletion path looks up by this string.
- * - owner is non-null whenever a row is written. Required by the
- *   provenance gate (`hippo provenance --strict`).
- *   - `user:<slack_user_id>` when the event carries a `user`.
- *   - `bot:<bot_id>` for the `bot_message` subtype (or any userless+text event
- *     that supplies bot_id).
- *   - `bot:unknown` only as a last-resort sentinel so the gate never sees null.
- *     Skipping userless messages instead would silently drop bot ingestion
- *     via the "skipped but seen" path in ingest.ts.
- */
+/** Convert a SlackMessageEvent into RememberOpts; returns null when the message has no usable body so the caller marks it seen and skips it.
+ *  artifact_ref MUST be `slack://${teamId}/${channelId}/${ts}` (deletion looks it up); owner is never null: `user:<id>`, `bot:<bot_id>`, else `bot:unknown`. */
 export declare function messageToRememberOpts(input: TransformInput): RememberOpts | null;
 //# sourceMappingURL=transform.d.ts.map

package/dist/connectors/slack/transform.js

@@ -1,22 +1,6 @@
 import { scopeFromChannel } from './scope.js';
-/**
- * Convert a SlackMessageEvent into RememberOpts for api.remember(). Returns
- * null when the message has no usable body (e.g. system events, bot reactions
- * without text). Caller treats null as "skip but mark idempotency seen".
- *
- * Contract:
- * - kind is the literal 'raw' (connector boundary, see src/importers.ts).
- * - artifact_ref format MUST be exactly `slack://${teamId}/${channelId}/${ts}`;
- *   the deletion path looks up by this string.
- * - owner is non-null whenever a row is written. Required by the
- *   provenance gate (`hippo provenance --strict`).
- *   - `user:<slack_user_id>` when the event carries a `user`.
- *   - `bot:<bot_id>` for the `bot_message` subtype (or any userless+text event
- *     that supplies bot_id).
- *   - `bot:unknown` only as a last-resort sentinel so the gate never sees null.
- *     Skipping userless messages instead would silently drop bot ingestion
- *     via the "skipped but seen" path in ingest.ts.
- */
+/** Convert a SlackMessageEvent into RememberOpts; returns null when the message has no usable body so the caller marks it seen and skips it.
+ *  artifact_ref MUST be `slack://${teamId}/${channelId}/${ts}` (deletion looks it up); owner is never null: `user:<id>`, `bot:<bot_id>`, else `bot:unknown`. */
 export function messageToRememberOpts(input) {
     const text = input.message.text?.trim();
     if (!text)

package/dist/connectors/slack/types.d.ts

@@ -1,8 +1,6 @@
-/**
- * Slack Events API envelope shapes used by the ingestion connector.
- * Spec: https://api.slack.com/events-api
- */
-import { type JsonValue } from '../../json.js';
+/** Slack Events API envelope shapes used by the ingestion connector.
+ *  Spec: https://api.slack.com/events-api */
+import { type JsonValue } from '../../util/json.js';
 export interface SlackUrlVerification {
     type: 'url_verification';
     challenge: string;
@@ -17,11 +15,7 @@ export interface SlackMessageEvent {
     text?: string;
     ts: string;
     thread_ts?: string;
-    /**
-     * Slack `bot_message` subtype carries `bot_id` instead of `user`. The
-     * provenance gate requires a non-null `owner`, so transform.ts
-     * derives `owner: bot:<bot_id>` when `user` is absent.
-     */
+    /** The `bot_message` subtype carries `bot_id` instead of `user`; transform.ts derives `owner: bot:<bot_id>` from it. */
     bot_id?: string;
     /** Present on subtype='message_deleted'. */
     deleted_ts?: string;

package/dist/connectors/slack/types.js

@@ -1,19 +1,8 @@
-/**
- * Slack Events API envelope shapes used by the ingestion connector.
- * Spec: https://api.slack.com/events-api
- */
-import { isJsonString } from '../../json.js';
-function isJsonNumber(value) {
-    return typeof value === 'number';
-}
-function isJsonRecord(value) {
-    return (value !== null &&
-        value !== undefined &&
-        !Array.isArray(value) &&
-        typeof value === 'object');
-}
+/** Slack Events API envelope shapes used by the ingestion connector.
+ *  Spec: https://api.slack.com/events-api */
+import { isJsonString, isJsonObject, isJsonNumber } from '../../util/json.js';
 export function isSlackEventEnvelope(x) {
-    if (!isJsonRecord(x))
+    if (!isJsonObject(x))
         return false;
     const o = x;
     if (o.type !== 'event_callback')
@@ -22,7 +11,7 @@ export function isSlackEventEnvelope(x) {
         return false;
     }
     const event = o.event;
-    return isJsonRecord(event) && isJsonString(event.type);
+    return isJsonObject(event) && isJsonString(event.type);
 }
 export function isSlackMessageEvent(x) {
     if (x === null || typeof x !== 'object' || Array.isArray(x))