hippo-memory 1.71.0 → 2.0.0

package/dist/connectors/github/dlq.js

@@ -1,88 +1,46 @@
-import { bumpGitHubDlqRetryCount, githubDlqEntry, listGitHubDlq, } from '../../store/connectors/github.js';
-import { replayFailed } from '../dlq.js';
+import { githubDlqEntry, markGitHubDlqRetried, listGitHubDlq, } from '../../store/connectors/github.js';
+import { replayParked } from '../dlq.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope } from './types.js';
 /** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
 export const githubDlq = {
     letter: (row) => ({ connector: 'github', ...row }),
     list: listGitHubDlq,
+    entry: githubDlqEntry,
+    bump: markGitHubDlqRetried,
 };
 /** Replay a DLQ row through the normal ingest path; a failed signature, parse or envelope check bumps retry_count.
  *  Without an `ingestHook` (dry-run) it bumps retry_count and returns `replayed` with memoryId=null; replays use today's routing, not the original's. */
 export async function replayDlqEntry(ctx, id, opts = {}) {
-    const row = githubDlqEntry(ctx.hippoRoot, id);
-    if (!row)
-        return replayFailed('not_found', 0, `dlq id ${id} not found`);
-    // Signature verification (current secret, not the one in effect when DLQed).
-    if (!opts.force && opts.webhookSecret) {
-        const sigFailure = checkReplaySignature(ctx.hippoRoot, id, row, opts.webhookSecret, opts.previousSecret);
-        if (sigFailure)
-            return sigFailure;
-    }
-    const envelopeFailure = checkReplayEnvelope(ctx.hippoRoot, id, row);
-    if (envelopeFailure)
-        return envelopeFailure;
-    // Without an ingest hook this is a dry-run validation. Bump and report.
-    if (!opts.ingestHook) {
-        bumpGitHubDlqRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: true,
-            status: 'replayed',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'dry-run: no ingest hook supplied',
-        };
-    }
-    // Real replay path: the route's IngestHook owns routing, idempotency and the memory write; this module only validates and bumps the retry counter.
-    // No idempotencyKey arg: the hook re-derives it from the parsed event (artifact_ref + updated_at).
-    const eventName = row.eventName ?? '';
-    const deliveryId = row.deliveryId ?? '';
-    const { memoryId } = await opts.ingestHook(ctx, {
-        rawPayload: row.rawPayload,
-        eventName,
-        deliveryId,
-    });
-    bumpGitHubDlqRetryCount(ctx.hippoRoot, id);
-    return {
-        ok: true,
-        status: 'replayed',
-        memoryId,
-        retryCount: row.retryCount + 1,
-    };
+    const { webhookSecret, previousSecret, ingestHook } = opts;
+    return replayParked({
+        dlq: githubDlq,
+        // The secret in effect now, not the one in effect when the row was parked.
+        refuseSignature: (row) => (webhookSecret ? refuseSignature(row, webhookSecret, previousSecret) : null),
+        isEnvelope: isGitHubWebhookEnvelope,
+        notEnvelope: 'not a GitHub webhook envelope',
+        reingest: async (row) => {
+            if (!ingestHook)
+                return { ok: true, status: 'replayed', memoryId: null, reason: 'dry-run: no ingest hook supplied' };
+            // The hook owns routing, idempotency and the memory write, and re-derives the key from the parsed event.
+            const { memoryId } = await ingestHook(ctx, {
+                rawPayload: row.rawPayload,
+                eventName: row.eventName ?? '',
+                deliveryId: row.deliveryId ?? '',
+            });
+            return { ok: true, status: 'replayed', memoryId };
+        },
+    }, ctx.hippoRoot, id, opts.force === true);
 }
-/** The failure result when the row cannot pass the signature gate, else null. */
-function checkReplaySignature(hippoRoot, id, row, webhookSecret, previousSecret) {
+function refuseSignature(row, webhookSecret, previousSecret) {
     if (!row.signature) {
-        return replayFailed('sig_missing', row.retryCount, 'row has no signature (legacy, or redacted before storing); pass --force to replay');
-    }
-    const sigOk = verifyGitHubSignature({
-        rawBody: row.rawPayload,
-        signature: row.signature,
-        webhookSecret,
-        previousSecret,
-    });
-    if (!sigOk) {
-        bumpGitHubDlqRetryCount(hippoRoot, id);
-        return replayFailed('sig_fail', row.retryCount + 1, 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway');
+        return { status: 'sig_missing', reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay' };
     }
-    return null;
-}
-/** Parse + envelope guard; the failure result after bumping the count, else null. */
-function checkReplayEnvelope(hippoRoot, id, row) {
-    let parsed;
-    try {
-        parsed = JSON.parse(row.rawPayload);
-    }
-    catch (e) {
-        bumpGitHubDlqRetryCount(hippoRoot, id);
-        // SAFETY: best-effort error message only; property access on any JS value is safe, even for a non-Error throw.
-        const message = e.message;
-        return replayFailed('parse_error', row.retryCount + 1, `still unparseable: ${message}`);
-    }
-    if (!isGitHubWebhookEnvelope(parsed)) {
-        bumpGitHubDlqRetryCount(hippoRoot, id);
-        return replayFailed('unhandled', row.retryCount + 1, 'not a GitHub webhook envelope');
-    }
-    return null;
+    if (verifyGitHubSignature({ rawBody: row.rawPayload, signature: row.signature, webhookSecret, previousSecret }))
+        return null;
+    return {
+        status: 'sig_fail',
+        reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',
+    };
 }
 //# sourceMappingURL=dlq.js.map

package/dist/connectors/github/ingest.d.ts

@@ -1,10 +1,6 @@
-import { type Context } from '../../api/index.js';
+import type { Context } from '../../api/index.js';
+import { type IngestResult } from '../ingest.js';
 import type { GitHubIssueEvent, GitHubIssueCommentEvent, GitHubPullRequestEvent, GitHubPullRequestReviewCommentEvent } from './types.js';
-export type IngestStatus = 'ingested' | 'duplicate' | 'skipped' | 'skipped_duplicate';
-export interface IngestResult {
-    status: IngestStatus;
-    memoryId: string | null;
-}
 /** Discriminated union of the four event shapes V1 ingests; eventName MUST equal the X-GitHub-Event header,
  *  since computeIdempotencyKey folds it into the dedupe key. */
 export type IngestEvent = {

package/dist/connectors/github/ingest.js

@@ -1,9 +1,9 @@
 // GitHub event ingest, once per idempotency key. The key comes from the event's own content, never from the unsigned
 // X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast path:
 // the store logs the key in the memory's own transaction, which is what holds when two workers race.
-import { remember } from '../../api/index.js';
-import { requireGroup, storeFor } from '../../store/index.js';
-import { RejectedValueError } from '../../store/rejection.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
+import { rememberWithEventLog } from '../ingest.js';
 import { computeIdempotencyKey } from './signature.js';
 import { issueEventToRememberOpts, issueCommentEventToRememberOpts, pullRequestEventToRememberOpts, prReviewCommentEventToRememberOpts, } from './transform.js';
 function transformEvent(event) {
@@ -54,31 +54,7 @@ export async function ingestEvent(ctx, input) {
     const seen = await events.eventRecord(event);
     if (seen.seen)
         return { status: 'duplicate', memoryId: seen.memoryId };
-    const opts = transformEvent(input.event);
-    if (!opts) {
-        // Empty body: no memory to write, but mark seen so a retry returns 'duplicate' instead of re-running the transform.
-        await events.markEventSeen(event);
-        return { status: 'skipped', memoryId: null };
-    }
-    try {
-        return await rememberWithEventLog(ctx, event, opts);
-    }
-    catch (e) {
-        if (e instanceof RejectedValueError) {
-            // A tombstone hit is a PERMANENT skip, never DLQ-retried: mark the key seen like the empty-body
-            // branch above so a GitHub retry of the same delivery acks as done, not error.
-            await events.markEventSeen(event);
-            return { status: 'skipped', memoryId: null };
-        }
-        throw e;
-    }
-}
-async function rememberWithEventLog(ctx, event, opts) {
-    // No `|| 'connector:github'` fallback: the caller always builds ctx with the connector subject (same as slack/ingest.ts).
-    const result = await remember(ctx, { ...opts, untrusted: true, event });
-    // Another worker logged this key between the pre-check and the write: its memory stands and ours was not stored.
-    if (result.duplicate)
-        return { status: 'skipped_duplicate', memoryId: result.duplicate.memoryId };
-    return { status: 'ingested', memoryId: result.id };
+    // An empty body is logged too, so a retry returns 'duplicate' instead of re-running the transform.
+    return rememberWithEventLog(ctx, event, transformEvent(input.event));
 }
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/github/tenant-routing.js

@@ -1,5 +1,6 @@
 import { envGitHubAllowUnknownInstallationFallback, envTenant } from '../../util/env.js';
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Resolve a GitHub envelope's tenant_id by installation id, then repository.full_name; the HIPPO_TENANT fallback applies only if both tables are empty.
  *  An unknown installation or repo on a multi-tenant deployment returns null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
 export async function resolveTenantForGitHub(hippoRoot, args, store) {

package/dist/connectors/github/webhook.d.ts

@@ -1,6 +1,7 @@
 import type { HippoStore } from '../../store/index.js';
 import { type WebhookRequest } from '../../util/http-util.js';
 /** GitHub webhook receiver: HMAC SHA-256 over the raw body, event type from the X-GitHub-Event header, tenant by installation.id then repository.full_name.
- *  ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature; 404 when GITHUB_WEBHOOK_SECRET is unset. No Bearer: server.ts checks isPublicRoute. */
+ *  ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature; 409 on a delivery id seen in the replay window;
+ *  404 when GITHUB_WEBHOOK_SECRET is unset. No Bearer: its route row declares webhook-signature. */
 export declare function handleGitHubEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/github/webhook.js

@@ -1,4 +1,5 @@
 import { envGitHubWebhookSecret, envGitHubWebhookSecretPrevious } from '../../util/env.js';
+import { DAY_MS } from '../../util/time.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope, isGitHubIssueEvent, isGitHubIssueCommentEvent, isGitHubPullRequestEvent, isGitHubPullRequestReviewCommentEvent, } from './types.js';
 import { ingestEvent as ingestGitHubEvent } from './ingest.js';
@@ -10,7 +11,8 @@ import { computeDeletionKey as computeGitHubDeletionKey } from './signature.js';
 import { resolveTenantId } from '../../store/tenant.js';
 import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson, } from '../../util/http-util.js';
 /** GitHub webhook receiver: HMAC SHA-256 over the raw body, event type from the X-GitHub-Event header, tenant by installation.id then repository.full_name.
- *  ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature; 404 when GITHUB_WEBHOOK_SECRET is unset. No Bearer: server.ts checks isPublicRoute. */
+ *  ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature; 409 on a delivery id seen in the replay window;
+ *  404 when GITHUB_WEBHOOK_SECRET is unset. No Bearer: its route row declares webhook-signature. */
 export async function handleGitHubEventsWebhook(request, store) {
     const { req, res, opts } = request;
     // Secret and signature header before the body, so a caller with neither cannot make the server buffer one.
@@ -43,7 +45,38 @@ export async function handleGitHubEventsWebhook(request, store) {
     }
     // Signature OK from here on. Everything else is ACK-200; bad envelopes go
     // to the DLQ and a human can replay later.
-    await routeSignedDelivery({ hippoRoot: opts.hippoRoot, store, res, rawBody, eventName, deliveryId, signature: sigStr });
+    const replayKey = deliveryId === null ? null : `${opts.hippoRoot}\n${deliveryId}`;
+    if (replayKey !== null && !claimDelivery(replayKey, Date.now()))
+        throw new HttpError(409, 'duplicate X-GitHub-Delivery');
+    try {
+        await routeSignedDelivery({ hippoRoot: opts.hippoRoot, store, res, rawBody, eventName, deliveryId, signature: sigStr });
+    }
+    catch (err) {
+        // A delivery that failed left nothing stored, so GitHub's redelivery of the same id must get through.
+        if (replayKey !== null)
+            seenDeliveries.delete(replayKey);
+        throw err;
+    }
+}
+// GitHub signs no timestamp, so a captured delivery verifies forever; this window is what refuses its replay.
+const DELIVERY_REPLAY_TTL_MS = DAY_MS;
+const DELIVERY_REPLAY_MAX_IDS = 10_000;
+// A fast path only: the durable dedupe is the connector event log's content-derived idempotency key (ingest.ts, and the deletion key below),
+// so a replay after a restart or an eviction is a stored 'duplicate' with no new rows.
+const seenDeliveries = new Map();
+/** Claims a delivery id for the window; false when it was claimed within the window already. The oldest claim goes first at the cap. */
+function claimDelivery(key, now) {
+    const seenAt = seenDeliveries.get(key);
+    if (seenAt !== undefined && now - seenAt < DELIVERY_REPLAY_TTL_MS)
+        return false;
+    seenDeliveries.delete(key);
+    if (seenDeliveries.size >= DELIVERY_REPLAY_MAX_IDS) {
+        const oldest = seenDeliveries.keys().next();
+        if (!oldest.done)
+            seenDeliveries.delete(oldest.value);
+    }
+    seenDeliveries.set(key, now);
+    return true;
 }
 const ALLOWED_EVENTS = new Set([
     'issues',

package/dist/connectors/ingest.d.ts

@@ -0,0 +1,10 @@
+import { type Context, type RememberOpts } from '../api/index.js';
+import type { ConnectorEvent } from '../store/port.js';
+export type IngestStatus = 'ingested' | 'duplicate' | 'skipped' | 'skipped_duplicate';
+export interface IngestResult {
+    status: IngestStatus;
+    memoryId: string | null;
+}
+/** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory, so a redelivery acks instead of retrying. */
+export declare function rememberWithEventLog(ctx: Context, event: ConnectorEvent, opts: RememberOpts | null): Promise<IngestResult>;
+//# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/ingest.js

@@ -0,0 +1,29 @@
+// The write half every connector's ingest shares, after its own pre-check of the event log.
+import { remember } from '../api/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
+import { RejectedValueError } from '../core/api-errors.js';
+/** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory, so a redelivery acks instead of retrying. */
+export async function rememberWithEventLog(ctx, event, opts) {
+    if (!opts)
+        return markSkipped(ctx, event);
+    try {
+        // No actor fallback: every caller builds ctx with its connector subject.
+        const result = await remember(ctx, { ...opts, untrusted: true, event });
+        // Another worker logged this key between the pre-check and the write: its memory stands and ours was not stored.
+        if (result.duplicate)
+            return { status: 'skipped_duplicate', memoryId: result.duplicate.memoryId };
+        return { status: 'ingested', memoryId: result.id };
+    }
+    catch (e) {
+        // A tombstone refusal is permanent, so a DLQ retry would hit it forever.
+        if (e instanceof RejectedValueError)
+            return markSkipped(ctx, event);
+        throw e;
+    }
+}
+async function markSkipped(ctx, event) {
+    await requireGroup(storeFor(ctx), 'connectorEvents').markEventSeen(event);
+    return { status: 'skipped', memoryId: null };
+}
+//# sourceMappingURL=ingest.js.map

package/dist/connectors/slack/deletion.js

@@ -1,5 +1,6 @@
 import { archiveRaw } from '../../api/index.js';
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Handles Slack `message_deleted`. The store logs the event in the archive's own transaction, so a crash cannot leave a retry
  *  answering `not_found` where `duplicate` is due. */
 export async function handleMessageDeleted(ctx, input) {

package/dist/connectors/slack/dlq.js

@@ -1,96 +1,75 @@
 import { adminActor } from '../../api/index.js';
-import { bumpSlackDlqRetryCount, listSlackDlq, markSlackDlqRetried, slackDlqEntry, } from '../../store/connectors/slack.js';
-import { replayFailed } from '../dlq.js';
+import { listSlackDlq, markSlackDlqRetried, slackDlqEntry, } from '../../store/connectors/slack.js';
+import { replayParked } from '../dlq.js';
 import { ingestMessage } from './ingest.js';
 import { resolveTenantForSlackTeam } from './tenant-routing.js';
 import { verifySlackSignature } from './signature.js';
 import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
 import { handleMessageDeleted } from './deletion.js';
-import { errorMessage } from '../../util/log.js';
+import { YEAR_S } from '../../util/time.js';
 /** Slack's dead-letter table; `teamId` and `slackTimestamp` are the columns only it has. */
 export const slackDlq = {
     letter: (row) => ({ connector: 'slack', ...row }),
     list: listSlackDlq,
+    entry: slackDlqEntry,
+    bump: markSlackDlqRetried,
 };
 /** Replay a DLQ row via the normal ingest path (`hippo slack dlq replay <id> [--force]`), re-verifying the signature with the CURRENT secret unless forced.
  *  Rows with a NULL signature need --force; replays use today's routing, because the DLQ exists to be drained after the operator fixed routing. */
 export async function replayDlqEntry(ctx, id, opts = {}) {
-    const row = slackDlqEntry(ctx.hippoRoot, id);
-    if (!row)
-        return replayFailed('not_found', 0, `dlq id ${id} not found`);
-    // Signature verification (current secret, not previous).
-    if (!opts.force) {
-        const sigFailure = checkReplaySignature(row, opts);
-        if (sigFailure)
-            return sigFailure;
-    }
-    // Parse + dispatch.
-    let parsed;
-    try {
-        parsed = JSON.parse(row.rawPayload);
-    }
-    catch (e) {
-        return failAndBump(ctx.hippoRoot, row, 'parse_error', `still unparseable: ${errorMessage(e)}`);
-    }
-    if (!isSlackEventEnvelope(parsed)) {
-        return failAndBump(ctx.hippoRoot, row, 'unhandled', 'not an event_callback envelope');
-    }
-    // Resolve tenant against current state. If still unroutable, bail.
-    const tenant = await resolveTenantForSlackTeam(ctx.hippoRoot, parsed.team_id);
-    if (!tenant) {
-        return failAndBump(ctx.hippoRoot, row, 'unroutable', `team_id ${parsed.team_id} still unroutable`);
-    }
-    const replayCtx = {
-        hippoRoot: ctx.hippoRoot,
-        tenantId: tenant,
-        actor: adminActor('connector:slack:replay'),
-    };
-    return dispatchReplay(replayCtx, row, parsed);
+    return replayParked({
+        dlq: slackDlq,
+        refuseSignature: (row) => refuseSignature(row, opts),
+        isEnvelope: isSlackEventEnvelope,
+        notEnvelope: 'not an event_callback envelope',
+        reingest: (_row, envelope) => reingest(ctx.hippoRoot, envelope),
+    }, ctx.hippoRoot, id, opts.force === true);
 }
-/** The failure result when the row cannot pass the signature gate, else null; never bumps the count. */
-function checkReplaySignature(row, opts) {
+/** A missing signature or timestamp refuses even without a secret; a mismatch needs the current secret to show. */
+function refuseSignature(row, opts) {
     if (!row.signature || !row.slackTimestamp) {
-        return replayFailed('sig_missing', row.retryCount, 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay');
+        return {
+            status: 'sig_missing',
+            reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
+        };
     }
-    if (opts.signingSecret) {
-        const ok = verifySlackSignature({
-            rawBody: row.rawPayload,
-            signature: row.signature,
-            timestamp: row.slackTimestamp,
-            signingSecret: opts.signingSecret,
-            now: opts.now,
-            // Replays happen long after the fact — give them a wider skew unless overridden.
-            skewSeconds: opts.skewSeconds ?? 60 * 60 * 24 * 365,
-        });
-        if (!ok) {
-            return replayFailed('sig_fail', row.retryCount, 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway');
-        }
-    }
-    return null;
-}
-function failAndBump(hippoRoot, row, status, reason) {
-    bumpSlackDlqRetryCount(hippoRoot, row.id);
-    return replayFailed(status, row.retryCount + 1, reason);
+    if (!opts.signingSecret)
+        return null;
+    const ok = verifySlackSignature({
+        rawBody: row.rawPayload,
+        signature: row.signature,
+        timestamp: row.slackTimestamp,
+        signingSecret: opts.signingSecret,
+        now: opts.now,
+        // Replays happen long after the fact, so give them a wider skew unless overridden.
+        skewSeconds: opts.skewSeconds ?? YEAR_S,
+    });
+    if (ok)
+        return null;
+    return {
+        status: 'sig_fail',
+        reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
+    };
 }
-async function dispatchReplay(replayCtx, row, parsed) {
-    const { hippoRoot } = replayCtx;
-    const id = row.id;
-    const inner = parsed.event;
-    if (!isSlackMessageEvent(inner)) {
-        return failAndBump(hippoRoot, row, 'unhandled', `unhandled inner event type`);
-    }
+async function reingest(hippoRoot, envelope) {
+    const tenantId = await resolveTenantForSlackTeam(hippoRoot, envelope.team_id);
+    if (!tenantId)
+        return { ok: false, status: 'unroutable', reason: `team_id ${envelope.team_id} still unroutable` };
+    const inner = envelope.event;
+    if (!isSlackMessageEvent(inner))
+        return { ok: false, status: 'unhandled', reason: 'unhandled inner event type' };
+    const replayCtx = { hippoRoot, tenantId, actor: adminActor('connector:slack:replay') };
     if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
         const r = await handleMessageDeleted(replayCtx, {
-            teamId: parsed.team_id,
+            teamId: envelope.team_id,
             channelId: inner.channel,
             deletedTs: inner.deleted_ts,
-            eventId: parsed.event_id,
+            eventId: envelope.event_id,
         });
-        markSlackDlqRetried(hippoRoot, id);
-        return { ok: true, status: r.status, memoryId: r.memoryId, retryCount: row.retryCount + 1 };
+        return { ok: true, status: r.status, memoryId: r.memoryId };
     }
     const result = await ingestMessage(replayCtx, {
-        teamId: parsed.team_id,
+        teamId: envelope.team_id,
         channel: {
             id: inner.channel,
             is_private: inner.channel_type !== 'channel',
@@ -98,9 +77,8 @@ async function dispatchReplay(replayCtx, row, parsed) {
             is_mpim: inner.channel_type === 'mpim',
         },
         message: inner,
-        eventId: parsed.event_id,
+        eventId: envelope.event_id,
     });
-    markSlackDlqRetried(hippoRoot, id);
-    return { ok: true, status: result.status, memoryId: result.memoryId, retryCount: row.retryCount + 1 };
+    return { ok: true, status: result.status, memoryId: result.memoryId };
 }
 //# sourceMappingURL=dlq.js.map

package/dist/connectors/slack/ingest.d.ts

@@ -1,4 +1,5 @@
-import { type Context } from '../../api/index.js';
+import type { Context } from '../../api/index.js';
+import { type IngestResult } from '../ingest.js';
 import type { ChannelMeta } from './scope.js';
 import type { SlackMessageEvent } from './types.js';
 export interface IngestInput {
@@ -8,11 +9,6 @@ export interface IngestInput {
     /** Slack event_id for the envelope (or for backfill, a synthesized stable id). */
     eventId: string;
 }
-export type IngestStatus = 'ingested' | 'duplicate' | 'skipped' | 'skipped_duplicate';
-export interface IngestResult {
-    status: IngestStatus;
-    memoryId: string | null;
-}
 /** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,
  *  the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is logged with no memory. */
 export declare function ingestMessage(ctx: Context, input: IngestInput): Promise<IngestResult>;

package/dist/connectors/slack/ingest.js

@@ -1,6 +1,6 @@
-import { remember } from '../../api/index.js';
-import { requireGroup, storeFor } from '../../store/index.js';
-import { RejectedValueError } from '../../store/rejection.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
+import { rememberWithEventLog } from '../ingest.js';
 import { messageToRememberOpts } from './transform.js';
 /** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,
  *  the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is logged with no memory. */
@@ -15,30 +15,6 @@ export async function ingestMessage(ctx, input) {
         // they first returned; a non-NULL memory_id means a memory was ingested, so 'duplicate'.
         return { status: seen.memoryId === null ? 'skipped' : 'duplicate', memoryId: seen.memoryId };
     }
-    const opts = messageToRememberOpts(input);
-    if (!opts) {
-        await events.markEventSeen(event);
-        return { status: 'skipped', memoryId: null };
-    }
-    try {
-        return await rememberWithEventLog(ctx, event, opts);
-    }
-    catch (e) {
-        if (!(e instanceof RejectedValueError))
-            throw e;
-        // A tombstone hit is a PERMANENT skip: a DLQ retry would hit the same refusal forever, so mark the
-        // event seen like the empty-body branch above and let a Slack retry ack as done, not error.
-        await events.markEventSeen(event);
-        return { status: 'skipped', memoryId: null };
-    }
-}
-async function rememberWithEventLog(ctx, event, opts) {
-    // No `|| 'connector:slack'` fallback: the caller always builds ctx with the connector subject, and with
-    // an object-shaped Context.actor an OR-fallback would never fire anyway.
-    const result = await remember(ctx, { ...opts, untrusted: true, event });
-    // Another worker logged this event between the pre-check and the write: its memory stands and ours was not stored.
-    if (result.duplicate)
-        return { status: 'skipped_duplicate', memoryId: result.duplicate.memoryId };
-    return { status: 'ingested', memoryId: result.id };
+    return rememberWithEventLog(ctx, event, messageToRememberOpts(input));
 }
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/slack/tenant-routing.js

@@ -1,5 +1,6 @@
 import { envSlackAllowUnknownTeamFallback, envTenant } from '../../util/env.js';
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty (single-workspace install).
  *  An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is the emergency escape. */
 export async function resolveTenantForSlackTeam(hippoRoot, teamId, store) {

package/dist/connectors/slack/webhook.d.ts

@@ -1,6 +1,7 @@
 import type { HippoStore } from '../../store/index.js';
 import { type WebhookRequest } from '../../util/http-util.js';
-/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (hence PUBLIC_ROUTES); malformed payloads go to slack_dlq, ACK 200.
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares webhook-signature);
+ *  malformed payloads go to slack_dlq, ACK 200.
  *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
 export declare function handleSlackEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/slack/webhook.js

@@ -9,7 +9,8 @@ import { resolveTenantForSlackTeam } from './tenant-routing.js';
 import { resolveTenantId } from '../../store/tenant.js';
 import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson } from '../../util/http-util.js';
 import { isJsonObject } from '../../util/json.js';
-/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (hence PUBLIC_ROUTES); malformed payloads go to slack_dlq, ACK 200.
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares webhook-signature);
+ *  malformed payloads go to slack_dlq, ACK 200.
  *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
 export async function handleSlackEventsWebhook(request, store) {
     const { req, res, opts } = request;

package/dist/consolidate/conflicts.js

@@ -1,7 +1,7 @@
 import { Layer, calculateStrength } from '../core/memory.js';
 import { jaccardMinShared, overlapPartners } from './overlap-index.js';
 import { isQuarantineScope } from '../trust/quarantine.js';
-import { isPersonalScope } from '../store/recall-scope.js';
+import { isPersonalScope } from '../core/recall-scope.js';
 import { DECAY_THRESHOLD } from './decay.js';
 // Gate contradictions on content overlap, not shared tags (`feedback`/`policy` are too coarse). The Jaccard threshold on stopword-filtered tokens
 // only applies after a polarity signal, so it filters drive-by topic similarity, not semantic drift.
@@ -65,7 +65,7 @@ function recalledTogether(a, b) {
     // A personal row pairs only inside its own scope; any other pair shows its id to someone else.
     if ((isPersonalScope(a.scope) || isPersonalScope(b.scope)) && a.scope !== b.scope)
         return false;
-    if (a.tenantId !== b.tenantId)
+    if (a.tenant_id !== b.tenant_id)
         return false;
     const [x, y] = [a.origin_project ?? null, b.origin_project ?? null];
     return x === y || (x === '' && y !== null) || (y === '' && x !== null);