hippo-memory 1.72.0 → 2.1.0

package/dist/connectors/github/backfill.js

@@ -1,9 +1,10 @@
-/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own high-water mark (HWM).
- *  An HWM is persisted only after its stream fully drains, so a crash in stream 2 leaves stream 1 committed and stream 2 resumes from its prior HWM.
+/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own HWM.
+ *  An HWM (high-water mark) is saved only after its stream fully drains, so a crash in stream 2 keeps stream 1.
  *  `repository.private` is left undefined (REST lists omit it), so scopeFromRepository falls through to private. */
 import { readCursors, seedCursors, writeHwm } from '../../store/connectors/github.js';
 import { ingestEvent } from './ingest.js';
 import { isJsonObject } from '../../util/json.js';
+import { MINUTE_MS } from '../../util/time.js';
 const API = 'https://api.github.com';
 /** Build a synthetic `repository` from the known repo full name, because REST list items often omit it.
  *  `private` stays undefined so scopeFromRepository falls through to private. */
@@ -82,9 +83,10 @@ async function drainStream(ctx, url0, options) {
     }
     return { ingested, pages, maxUpdatedAt, drained: true };
 }
-// A reset hours away must fail the run for a later rerun; sleeping through it would hold the process for the whole window.
+// A reset hours away must fail the run for a later rerun; sleeping
+// through it would hold the process for the whole window.
 const MAX_RATE_LIMIT_ATTEMPTS = 5;
-const MAX_RATE_LIMIT_WAIT_MS = 10 * 60 * 1000;
+const MAX_RATE_LIMIT_WAIT_MS = 10 * MINUTE_MS;
 async function fetchPagePastRateLimit(options, url) {
     const { fetcher, token, sleep } = options;
     let waitedMs = 0;

package/dist/connectors/github/deletion.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 export interface DeletionInput {
     /** artifact_ref of the comment, e.g. 'github://acme/repo/issue/42/comment/123'
      *  or 'github://acme/repo/pull/7/review_comment/456'. */
@@ -15,7 +15,9 @@ export interface DeletionResult {
     status: DeletionStatus;
     archivedCount: number;
 }
-/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`: archive ALL active raw rows for the artifact_ref in one write.
- *  Tenant and kind='raw' filtering are load-bearing: without them a deletion could archive another tenant's row or a distilled row. */
-export declare function handleCommentDeleted(ctx: Context, input: DeletionInput): Promise<DeletionResult>;
+/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`:
+ * archive ALL active raw rows for the artifact_ref in one write. Tenant and
+ * kind='raw' filtering are load-bearing: without them a deletion could
+ * archive another tenant's row or a distilled row. */
+export declare function handleCommentDeleted(ctx: ConnectorContext, input: DeletionInput): Promise<DeletionResult>;
 //# sourceMappingURL=deletion.d.ts.map

package/dist/connectors/github/deletion.js

@@ -1,9 +1,10 @@
-import { requireGroup, storeFor } from '../../store/index.js';
-/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`: archive ALL active raw rows for the artifact_ref in one write.
- *  Tenant and kind='raw' filtering are load-bearing: without them a deletion could archive another tenant's row or a distilled row. */
+/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`:
+ * archive ALL active raw rows for the artifact_ref in one write. Tenant and
+ * kind='raw' filtering are load-bearing: without them a deletion could
+ * archive another tenant's row or a distilled row. */
 export async function handleCommentDeleted(ctx, input) {
     const { artifactRef, idempotencyKey, deliveryId, eventName } = input;
-    const done = await requireGroup(storeFor(ctx), 'connectorEvents').archiveDeletedArtifact({
+    const done = await ctx.store.connectorEvents.archiveDeletedArtifact({
         tenantId: ctx.tenantId,
         actor: ctx.actor.subject,
         artifactRef,

package/dist/connectors/github/dlq.d.ts

@@ -1,21 +1,23 @@
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import { type DlqBucket, type DlqItem, type GitHubDlqInsert } from '../../store/connectors/github.js';
 import { type ConnectorDlq, type ReplayResult } from '../dlq.js';
 export type { DlqBucket, DlqItem };
 type GitHubOwnColumns = Pick<GitHubDlqInsert, 'eventName' | 'deliveryId' | 'installationId' | 'repoFullName'>;
-/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
+/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row
+ * without re-reading the payload. */
 export declare const githubDlq: ConnectorDlq<GitHubOwnColumns, DlqBucket, DlqItem>;
 export interface ReplayDlqOpts {
     /** Current webhook secret. If omitted, signature check is skipped (force-only path). */
     webhookSecret?: string;
-    /** Previous webhook secret during rotation, passed to verifyGitHubSignature.previousSecret so old-secret DLQ rows need no --force. */
+    /** Previous webhook secret during rotation, passed to verifyGitHubSignature.previousSecret so old-secret DLQ rows
+     * need no --force. */
     previousSecret?: string;
     /** When true, skip signature verification (used for legacy entries after secret rotation). */
     force?: boolean;
 }
 /** Hook the webhook route injects to re-ingest a row, which keeps this module free of every event-type handler.
  *  No `idempotencyKey` field: ingest re-derives it from the parsed event, and a passed-in key could be stale. */
-export type IngestHook = (ctx: Context, args: {
+export type IngestHook = (ctx: ConnectorContext, args: {
     rawPayload: string;
     eventName: string;
     deliveryId: string;
@@ -23,8 +25,8 @@ export type IngestHook = (ctx: Context, args: {
     memoryId: string | null;
 }>;
 /** Replay a DLQ row through the normal ingest path; a failed signature, parse or envelope check bumps retry_count.
- *  Without an `ingestHook` (dry-run) it bumps retry_count and returns `replayed` with memoryId=null; replays use today's routing, not the original's. */
-export declare function replayDlqEntry(ctx: Context, id: number, opts?: ReplayDlqOpts & {
+ * No `ingestHook` (dry-run): bumps retry_count, returns `replayed` with memoryId=null. Replays use today's routing. */
+export declare function replayDlqEntry(ctx: ConnectorContext, id: number, opts?: ReplayDlqOpts & {
     ingestHook?: IngestHook;
 }): Promise<ReplayResult>;
 //# sourceMappingURL=dlq.d.ts.map

package/dist/connectors/github/dlq.js

@@ -2,7 +2,8 @@ import { githubDlqEntry, markGitHubDlqRetried, listGitHubDlq, } from '../../stor
 import { replayParked } from '../dlq.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope } from './types.js';
-/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
+/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row
+ * without re-reading the payload. */
 export const githubDlq = {
     letter: (row) => ({ connector: 'github', ...row }),
     list: listGitHubDlq,
@@ -10,7 +11,7 @@ export const githubDlq = {
     bump: markGitHubDlqRetried,
 };
 /** Replay a DLQ row through the normal ingest path; a failed signature, parse or envelope check bumps retry_count.
- *  Without an `ingestHook` (dry-run) it bumps retry_count and returns `replayed` with memoryId=null; replays use today's routing, not the original's. */
+ * No `ingestHook` (dry-run): bumps retry_count, returns `replayed` with memoryId=null. Replays use today's routing. */
 export async function replayDlqEntry(ctx, id, opts = {}) {
     const { webhookSecret, previousSecret, ingestHook } = opts;
     return replayParked({
@@ -20,8 +21,9 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
         isEnvelope: isGitHubWebhookEnvelope,
         notEnvelope: 'not a GitHub webhook envelope',
         reingest: async (row) => {
-            if (!ingestHook)
+            if (!ingestHook) {
                 return { ok: true, status: 'replayed', memoryId: null, reason: 'dry-run: no ingest hook supplied' };
+            }
             // The hook owns routing, idempotency and the memory write, and re-derives the key from the parsed event.
             const { memoryId } = await ingestHook(ctx, {
                 rawPayload: row.rawPayload,
@@ -34,10 +36,14 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
 }
 function refuseSignature(row, webhookSecret, previousSecret) {
     if (!row.signature) {
-        return { status: 'sig_missing', reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay' };
+        return {
+            status: 'sig_missing',
+            reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
+        };
     }
-    if (verifyGitHubSignature({ rawBody: row.rawPayload, signature: row.signature, webhookSecret, previousSecret }))
+    if (verifyGitHubSignature({ rawBody: row.rawPayload, signature: row.signature, webhookSecret, previousSecret })) {
         return null;
+    }
     return {
         status: 'sig_fail',
         reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',

package/dist/connectors/github/ingest.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import { type IngestResult } from '../ingest.js';
 import type { GitHubIssueEvent, GitHubIssueCommentEvent, GitHubPullRequestEvent, GitHubPullRequestReviewCommentEvent } from './types.js';
 /** Discriminated union of the four event shapes V1 ingests; eventName MUST equal the X-GitHub-Event header,
@@ -24,5 +24,5 @@ export interface IngestInput {
     /** X-GitHub-Delivery header value, audit metadata only. */
     deliveryId: string;
 }
-export declare function ingestEvent(ctx: Context, input: IngestInput): Promise<IngestResult>;
+export declare function ingestEvent(ctx: ConnectorContext, input: IngestInput): Promise<IngestResult>;
 //# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/github/ingest.js

@@ -1,7 +1,6 @@
 // GitHub event ingest, once per idempotency key. The key comes from the event's own content, never from the unsigned
-// X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast path:
-// the store logs the key in the memory's own transaction, which is what holds when two workers race.
-import { requireGroup, storeFor } from '../../store/index.js';
+// X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast
+// path: the store logs the key in the memory's own transaction, which is what holds when two workers race.
 import { rememberWithEventLog } from '../ingest.js';
 import { computeIdempotencyKey } from './signature.js';
 import { issueEventToRememberOpts, issueCommentEventToRememberOpts, pullRequestEventToRememberOpts, prReviewCommentEventToRememberOpts, } from './transform.js';
@@ -45,9 +44,14 @@ function eventUpdatedAt(event) {
     }
 }
 export async function ingestEvent(ctx, input) {
-    const events = requireGroup(storeFor(ctx), 'connectorEvents');
+    const events = ctx.store.connectorEvents;
     const idempotencyKey = computeIdempotencyKey(eventArtifactRef(input.event), eventUpdatedAt(input.event));
-    const event = { connector: 'github', idempotencyKey, deliveryId: input.deliveryId, eventName: input.event.eventName };
+    const event = {
+        connector: 'github',
+        idempotencyKey,
+        deliveryId: input.deliveryId,
+        eventName: input.event.eventName,
+    };
     // Fast path: pre-check. Avoids running the transform / opening a write tx
     // for the common already-seen case (GitHub auto-retries with the same body).
     const seen = await events.eventRecord(event);

package/dist/connectors/github/octokit-client.d.ts

@@ -1,5 +1,7 @@
 /** Octokit-shaped HTTP fetcher for the GitHub backfill; tests inject a fake `GitHubFetcher`.
- *  Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a silent empty backfill. */
+ * Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a
+ * silent empty backfill.
+ */
 import { type RateLimitInfo } from './ratelimit.js';
 import type { JsonValue } from '../../util/json.js';
 export declare class GitHubFetchError extends Error {

package/dist/connectors/github/octokit-client.js

@@ -1,5 +1,7 @@
 /** Octokit-shaped HTTP fetcher for the GitHub backfill; tests inject a fake `GitHubFetcher`.
- *  Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a silent empty backfill. */
+ * Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a
+ * silent empty backfill.
+ */
 import { parseRateLimit } from './ratelimit.js';
 import { fetchWithRetry } from '../../util/http-retry.js';
 import { readCappedJson, readCappedText } from '../../util/capped-json.js';
@@ -36,7 +38,10 @@ const ERROR_BODY_SNIPPET_CHARS = 256;
 const UTF8_MAX_BYTES_PER_CHAR = 4;
 // A page is at most 100 items (per_page=100), each with a body of up to 65,536 characters at 4 bytes, plus its fields.
 const GITHUB_MAX_REPLY_BYTES = 32 * 1024 * 1024;
-/** The items of a 200 list reply. A body that is not JSON, is over the cap or is not an array throws, so it never reaches ingest as items. */
+/**
+ * The items of a 200 list reply. A body that is not JSON, is over the cap or is not an array throws, so it never
+ * reaches ingest as items.
+ */
 async function readItems(res, url) {
     // The path only: a `next` link comes from the server, so its query string is not ours to print.
     const path = new URL(url).pathname;

package/dist/connectors/github/ratelimit.d.ts

@@ -1,9 +1,13 @@
-/** GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
+/**
+ * GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
  *  Backfill must pause and resume rather than error. */
 export interface RateLimitInfo {
     readonly sleepSeconds: number;
     readonly reason: 'primary' | 'secondary' | 'none';
 }
-/** Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for deterministic tests. */
+/**
+ * Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for
+ * deterministic tests.
+ */
 export declare function parseRateLimit(headers: Record<string, string | undefined>, status: number, now?: number): RateLimitInfo;
 //# sourceMappingURL=ratelimit.d.ts.map

package/dist/connectors/github/ratelimit.js

@@ -1,6 +1,10 @@
-/** GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
+/**
+ * GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
  *  Backfill must pause and resume rather than error. */
-/** Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for deterministic tests. */
+/**
+ * Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for
+ * deterministic tests.
+ */
 export function parseRateLimit(headers, status, now) {
     const _now = now ?? Math.floor(Date.now() / 1000);
     if (status === 429) {

package/dist/connectors/github/signature.d.ts

@@ -6,11 +6,22 @@ export interface VerifyOpts {
     /** Previous secret for rotation parity with Slack. Optional. */
     previousSecret?: string;
 }
+/**
+ * True for a header that could be a GitHub signature; anything else is refused before the body is read, since no secret
+ * can make it match.
+ */
+export declare function isWellFormedGitHubSignature(signature: string): boolean;
 export declare function verifyGitHubSignature(opts: VerifyOpts): boolean;
-/** Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the SAME event dedupe.
- *  An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so replays cannot bypass dedupe. */
+/**
+ * Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the
+ * SAME event dedupe.
+ * An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so
+ * replays cannot bypass dedupe.
+ */
 export declare function computeIdempotencyKey(artifactRef: string, updatedAt: string | null | undefined): string;
 /** Deletion idempotency key: sha256('deleted:' + artifactRef + ':' + updatedAt).
- *  A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same deletion still dedupe. */
+ * A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same
+ * deletion still dedupe.
+ */
 export declare function computeDeletionKey(artifactRef: string, updatedAt: string | null | undefined): string;
 //# sourceMappingURL=signature.d.ts.map

package/dist/connectors/github/signature.js

@@ -1,4 +1,12 @@
 import { createHmac, createHash, timingSafeEqual } from 'crypto';
+const SIGNATURE_HEADER_RE = /^sha256=[0-9a-f]{64}$/;
+/**
+ * True for a header that could be a GitHub signature; anything else is refused before the body is read, since no secret
+ * can make it match.
+ */
+export function isWellFormedGitHubSignature(signature) {
+    return SIGNATURE_HEADER_RE.test(signature);
+}
 function verifyOne(rawBody, signature, secret) {
     if (!signature.startsWith('sha256='))
         return false;
@@ -16,13 +24,19 @@ export function verifyGitHubSignature(opts) {
         return true;
     return false;
 }
-/** Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the SAME event dedupe.
- *  An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so replays cannot bypass dedupe. */
+/**
+ * Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the
+ * SAME event dedupe.
+ * An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so
+ * replays cannot bypass dedupe.
+ */
 export function computeIdempotencyKey(artifactRef, updatedAt) {
     return createHash('sha256').update(`${artifactRef}:${updatedAt ?? ''}`).digest('hex');
 }
 /** Deletion idempotency key: sha256('deleted:' + artifactRef + ':' + updatedAt).
- *  A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same deletion still dedupe. */
+ * A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same
+ * deletion still dedupe.
+ */
 export function computeDeletionKey(artifactRef, updatedAt) {
     return createHash('sha256').update(`deleted:${artifactRef}:${updatedAt ?? ''}`).digest('hex');
 }

package/dist/connectors/github/tenant-routing.d.ts

@@ -1,11 +1,13 @@
-import { type HippoStore } from '../../store/index.js';
+import type { StoreWith } from '../../store/index.js';
 export interface ResolveArgs {
     /** String form of `installation.id`. `null`/`undefined` means "no installation field" (PAT-mode webhook). */
     installationId?: string | null;
     /** `repository.full_name` from the webhook envelope, used for PAT-mode multi-tenant routing. */
     repoFullName?: string | null;
 }
-/** Resolve a GitHub envelope's tenant_id by installation id, then repository.full_name; the HIPPO_TENANT fallback applies only if both tables are empty.
- *  An unknown installation or repo on a multi-tenant deployment returns null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
-export declare function resolveTenantForGitHub(hippoRoot: string, args: ResolveArgs, store?: HippoStore): Promise<string | null>;
+/** Resolve a GitHub envelope's tenant_id by installation id, then
+ * repository.full_name; the HIPPO_TENANT fallback applies only if both tables are
+ * empty. An unknown installation or repo on a multi-tenant deployment returns
+ * null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
+export declare function resolveTenantForGitHub(store: StoreWith<'connectorEvents'>, args: ResolveArgs): Promise<string | null>;
 //# sourceMappingURL=tenant-routing.d.ts.map

package/dist/connectors/github/tenant-routing.js

@@ -1,11 +1,12 @@
 import { envGitHubAllowUnknownInstallationFallback, envTenant } from '../../util/env.js';
-import { requireGroup, storeFor } from '../../store/index.js';
-/** Resolve a GitHub envelope's tenant_id by installation id, then repository.full_name; the HIPPO_TENANT fallback applies only if both tables are empty.
- *  An unknown installation or repo on a multi-tenant deployment returns null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
-export async function resolveTenantForGitHub(hippoRoot, args, store) {
+/** Resolve a GitHub envelope's tenant_id by installation id, then
+ * repository.full_name; the HIPPO_TENANT fallback applies only if both tables are
+ * empty. An unknown installation or repo on a multi-tenant deployment returns
+ * null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
+export async function resolveTenantForGitHub(store, args) {
     const envFallback = () => envTenant();
     const escapeHatch = envGitHubAllowUnknownInstallationFallback();
-    const routing = await requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').githubRouting(args);
+    const routing = await store.connectorEvents.githubRouting(args);
     if (routing.tenant)
         return routing.tenant;
     if (args.installationId) {

package/dist/connectors/github/transform.js

@@ -1,89 +1,72 @@
 import { scopeFromRepository } from './scope.js';
-/** Convert GitHub webhook events into RememberOpts; each returns null when the event has no usable body so the caller marks it seen and skips the insert.
- *  artifact_ref formats (github://<owner/repo>/issue|pull/<n>[/comment|review_comment/<id>]) are stable because deletion looks rows up by them. */
+/**
+ * Convert GitHub webhook events into RememberOpts; each returns null when the event has no usable body so the caller
+ * marks it seen and skips the insert.
+ * artifact_ref formats (github://<owner/repo>/issue|pull/<n>[/comment|review_comment/<id>]) are stable because deletion
+ * looks rows up by them.
+ */
 const UNKNOWN_REPO = 'unknown/unknown';
-export function issueEventToRememberOpts(evt) {
-    const body = evt.issue.body?.trim();
-    const title = evt.issue.title?.trim();
-    const text = [title, body].filter(Boolean).join('\n\n');
-    if (!text)
-        return null;
-    const repoFull = evt.repository?.full_name ?? UNKNOWN_REPO;
-    const login = evt.issue.user.login;
+function rememberOpts(repository, { content, refPath, event, login }) {
+    const repoFull = repository?.full_name ?? UNKNOWN_REPO;
     return {
-        content: text,
+        content,
         kind: 'raw',
-        scope: scopeFromRepository(evt.repository),
-        artifactRef: `github://${repoFull}/issue/${evt.issue.number}`,
+        scope: scopeFromRepository(repository),
+        artifactRef: `github://${repoFull}/${refPath}`,
         owner: `user:github:${login}`,
         tags: [
             'source:github',
             `repo:${repoFull}`,
-            `event:issues.${evt.action}`,
+            `event:${event}`,
             `user:github:${login}`,
         ],
     };
 }
+function titleAndBody(item) {
+    return [item.title?.trim(), item.body?.trim()].filter(Boolean).join('\n\n');
+}
+export function issueEventToRememberOpts(evt) {
+    const content = titleAndBody(evt.issue);
+    if (!content)
+        return null;
+    return rememberOpts(evt.repository, {
+        content,
+        refPath: `issue/${evt.issue.number}`,
+        event: `issues.${evt.action}`,
+        login: evt.issue.user.login,
+    });
+}
 export function issueCommentEventToRememberOpts(evt) {
-    const text = evt.comment.body?.trim();
-    if (!text)
+    const content = evt.comment.body?.trim();
+    if (!content)
         return null;
-    const repoFull = evt.repository?.full_name ?? UNKNOWN_REPO;
-    const login = evt.comment.user.login;
-    return {
-        content: text,
-        kind: 'raw',
-        scope: scopeFromRepository(evt.repository),
-        artifactRef: `github://${repoFull}/issue/${evt.issue.number}/comment/${evt.comment.id}`,
-        owner: `user:github:${login}`,
-        tags: [
-            'source:github',
-            `repo:${repoFull}`,
-            `event:issue_comment.${evt.action}`,
-            `user:github:${login}`,
-        ],
-    };
+    return rememberOpts(evt.repository, {
+        content,
+        refPath: `issue/${evt.issue.number}/comment/${evt.comment.id}`,
+        event: `issue_comment.${evt.action}`,
+        login: evt.comment.user.login,
+    });
 }
 export function pullRequestEventToRememberOpts(evt) {
-    const body = evt.pull_request.body?.trim();
-    const title = evt.pull_request.title?.trim();
-    const text = [title, body].filter(Boolean).join('\n\n');
-    if (!text)
+    const content = titleAndBody(evt.pull_request);
+    if (!content)
         return null;
-    const repoFull = evt.repository?.full_name ?? UNKNOWN_REPO;
-    const login = evt.pull_request.user.login;
-    return {
-        content: text,
-        kind: 'raw',
-        scope: scopeFromRepository(evt.repository),
-        artifactRef: `github://${repoFull}/pull/${evt.pull_request.number}`,
-        owner: `user:github:${login}`,
-        tags: [
-            'source:github',
-            `repo:${repoFull}`,
-            `event:pull_request.${evt.action}`,
-            `user:github:${login}`,
-        ],
-    };
+    return rememberOpts(evt.repository, {
+        content,
+        refPath: `pull/${evt.pull_request.number}`,
+        event: `pull_request.${evt.action}`,
+        login: evt.pull_request.user.login,
+    });
 }
 export function prReviewCommentEventToRememberOpts(evt) {
-    const text = evt.comment.body?.trim();
-    if (!text)
+    const content = evt.comment.body?.trim();
+    if (!content)
         return null;
-    const repoFull = evt.repository?.full_name ?? UNKNOWN_REPO;
-    const login = evt.comment.user.login;
-    return {
-        content: text,
-        kind: 'raw',
-        scope: scopeFromRepository(evt.repository),
-        artifactRef: `github://${repoFull}/pull/${evt.pull_request.number}/review_comment/${evt.comment.id}`,
-        owner: `user:github:${login}`,
-        tags: [
-            'source:github',
-            `repo:${repoFull}`,
-            `event:pull_request_review_comment.${evt.action}`,
-            `user:github:${login}`,
-        ],
-    };
+    return rememberOpts(evt.repository, {
+        content,
+        refPath: `pull/${evt.pull_request.number}/review_comment/${evt.comment.id}`,
+        event: `pull_request_review_comment.${evt.action}`,
+        login: evt.comment.user.login,
+    });
 }
 //# sourceMappingURL=transform.js.map

package/dist/connectors/github/types.d.ts

@@ -1,7 +1,14 @@
-/** GitHub webhook event shapes for the ingestion connector (https://docs.github.com/en/webhooks/webhook-events-and-payloads).
- *  Each guard is gated on the X-GitHub-Event header so a misrouted payload cannot satisfy a guard for the wrong event type. */
+/**
+ * GitHub webhook event shapes for the ingestion connector
+ * (https://docs.github.com/en/webhooks/webhook-events-and-payloads).
+ * Each guard is gated on the X-GitHub-Event header so a misrouted payload cannot satisfy a guard for the wrong event
+ * type.
+ */
 import { type JsonValue } from '../../util/json.js';
-/** `private` MUST stay optional: scope.ts maps `private: undefined` to private, and a strict boolean would reject the payload before scope can fail closed. */
+/**
+ * `private` MUST stay optional: scope.ts maps `private: undefined` to private, and a strict boolean would reject the
+ * payload before scope can fail closed.
+ */
 export interface GitHubRepository {
     full_name: string;
     private?: boolean;

package/dist/connectors/github/types.js

@@ -1,5 +1,9 @@
-/** GitHub webhook event shapes for the ingestion connector (https://docs.github.com/en/webhooks/webhook-events-and-payloads).
- *  Each guard is gated on the X-GitHub-Event header so a misrouted payload cannot satisfy a guard for the wrong event type. */
+/**
+ * GitHub webhook event shapes for the ingestion connector
+ * (https://docs.github.com/en/webhooks/webhook-events-and-payloads).
+ * Each guard is gated on the X-GitHub-Event header so a misrouted payload cannot satisfy a guard for the wrong event
+ * type.
+ */
 import { isJsonString, isJsonNumber } from '../../util/json.js';
 function isObjectOrArray(x) {
     return x !== null && typeof x === 'object';

package/dist/connectors/github/webhook.d.ts

@@ -1,7 +1,7 @@
-import type { HippoStore } from '../../store/index.js';
+import type { ConnectorStore } from '../store.js';
 import { type WebhookRequest } from '../../util/http-util.js';
-/** GitHub webhook receiver: HMAC SHA-256 over the raw body, event type from the X-GitHub-Event header, tenant by installation.id then repository.full_name.
- *  ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature; 409 on a delivery id seen in the replay window;
- *  404 when GITHUB_WEBHOOK_SECRET is unset. No Bearer: its route row declares webhook-signature. */
-export declare function handleGitHubEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
+/** GitHub webhook receiver: HMAC SHA-256 over the raw body, event type from the X-GitHub-Event header, tenant by
+ *  installation.id then repository.full_name. ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature;
+ *  409 on a replayed delivery id; 404 if GITHUB_WEBHOOK_SECRET is unset. No Bearer: route auth is webhook-signature. */
+export declare function handleGitHubEventsWebhook(request: WebhookRequest, store: ConnectorStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map