hippo-memory 1.72.0 → 2.1.0

package/dist/connectors/github/webhook.js

@@ -1,5 +1,6 @@
 import { envGitHubWebhookSecret, envGitHubWebhookSecretPrevious } from '../../util/env.js';
-import { verifyGitHubSignature } from './signature.js';
+import { DAY_MS } from '../../util/time.js';
+import { isWellFormedGitHubSignature, verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope, isGitHubIssueEvent, isGitHubIssueCommentEvent, isGitHubPullRequestEvent, isGitHubPullRequestReviewCommentEvent, } from './types.js';
 import { ingestEvent as ingestGitHubEvent } from './ingest.js';
 import { handleCommentDeleted as handleGitHubCommentDeleted } from './deletion.js';
@@ -9,9 +10,18 @@ import { resolveTenantForGitHub } from './tenant-routing.js';
 import { computeDeletionKey as computeGitHubDeletionKey } from './signature.js';
 import { resolveTenantId } from '../../store/tenant.js';
 import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson, } from '../../util/http-util.js';
-/** GitHub webhook receiver: HMAC SHA-256 over the raw body, event type from the X-GitHub-Event header, tenant by installation.id then repository.full_name.
- *  ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature; 409 on a delivery id seen in the replay window;
- *  404 when GITHUB_WEBHOOK_SECRET is unset. No Bearer: its route row declares webhook-signature. */
+/** Reads the raw body and refuses it unless the signature matches the current or the previous secret. */
+async function readSignedBody(request, secret, sigStr) {
+    const rawBody = await readWebhookBody(request);
+    const previousSecret = envGitHubWebhookSecretPrevious();
+    if (!verifyGitHubSignature({ rawBody, signature: sigStr, webhookSecret: secret, previousSecret })) {
+        throw new HttpError(401, 'invalid GitHub signature');
+    }
+    return rawBody;
+}
+/** GitHub webhook receiver: HMAC SHA-256 over the raw body, event type from the X-GitHub-Event header, tenant by
+ *  installation.id then repository.full_name. ACKs 200 on signed envelopes (DLQ too); 401 only on a bad signature;
+ *  409 on a replayed delivery id; 404 if GITHUB_WEBHOOK_SECRET is unset. No Bearer: route auth is webhook-signature. */
 export async function handleGitHubEventsWebhook(request, store) {
     const { req, res, opts } = request;
     // Secret and signature header before the body, so a caller with neither cannot make the server buffer one.
@@ -22,33 +32,33 @@ export async function handleGitHubEventsWebhook(request, store) {
         res.end(JSON.stringify({ error: 'not found' }));
         return;
     }
-    const previousSecret = envGitHubWebhookSecretPrevious();
     const sigHdr = req.headers['x-hub-signature-256'];
     const eventHdr = req.headers['x-github-event'];
     const deliveryHdr = req.headers['x-github-delivery'];
     const sigStr = isHeaderString(sigHdr) ? sigHdr : null;
     const eventName = isHeaderString(eventHdr) ? eventHdr : null;
     const deliveryId = isHeaderString(deliveryHdr) ? deliveryHdr : null;
-    if (sigStr === null) {
+    if (sigStr === null || !isWellFormedGitHubSignature(sigStr)) {
         closeIfBodyUnread(request);
         throw new HttpError(401, 'invalid GitHub signature');
     }
-    const rawBody = await readWebhookBody(request);
-    if (!verifyGitHubSignature({
-        rawBody,
-        signature: sigStr,
-        webhookSecret: secret,
-        previousSecret,
-    })) {
-        throw new HttpError(401, 'invalid GitHub signature');
-    }
+    const rawBody = await readSignedBody(request, secret, sigStr);
     // Signature OK from here on. Everything else is ACK-200; bad envelopes go
     // to the DLQ and a human can replay later.
     const replayKey = deliveryId === null ? null : `${opts.hippoRoot}\n${deliveryId}`;
-    if (replayKey !== null && !claimDelivery(replayKey, Date.now()))
+    if (replayKey !== null && !claimDelivery(replayKey, Date.now())) {
         throw new HttpError(409, 'duplicate X-GitHub-Delivery');
+    }
     try {
-        await routeSignedDelivery({ hippoRoot: opts.hippoRoot, store, res, rawBody, eventName, deliveryId, signature: sigStr });
+        await routeSignedDelivery({
+            hippoRoot: opts.hippoRoot,
+            store,
+            res,
+            rawBody,
+            eventName,
+            deliveryId,
+            signature: sigStr,
+        });
     }
     catch (err) {
         // A delivery that failed left nothing stored, so GitHub's redelivery of the same id must get through.
@@ -58,11 +68,13 @@ export async function handleGitHubEventsWebhook(request, store) {
     }
 }
 // GitHub signs no timestamp, so a captured delivery verifies forever; this window is what refuses its replay.
-const DELIVERY_REPLAY_TTL_MS = 24 * 60 * 60 * 1000;
+const DELIVERY_REPLAY_TTL_MS = DAY_MS;
 const DELIVERY_REPLAY_MAX_IDS = 10_000;
-// SHORTCUT: seen ids live in this process and reset on restart or eviction; move them to the store if serve ever runs as several processes.
+// A fast path only: the durable dedupe is the connector event log's content-derived idempotency key (ingest.ts, and the
+// deletion key below), so a replay after a restart or an eviction is a stored 'duplicate' with no new rows.
 const seenDeliveries = new Map();
-/** Claims a delivery id for the window; false when it was claimed within the window already. The oldest claim goes first at the cap. */
+/** Claims a delivery id for the window; false when it was claimed within the window already. The oldest claim goes
+ * first at the cap. */
 function claimDelivery(key, now) {
     const seenAt = seenDeliveries.get(key);
     if (seenAt !== undefined && now - seenAt < DELIVERY_REPLAY_TTL_MS)
@@ -94,7 +106,7 @@ async function parkAndAck(d, park) {
         installationId: park.installationId,
         repoFullName: park.repoFullName,
     };
-    await parkInDlq(githubDlq, d.hippoRoot, row, d.store);
+    await parkInDlq(githubDlq, d.store, row);
     sendJson(d.res, 200, { ok: true, status: 'dlq' });
 }
 async function routeSignedDelivery(d) {
@@ -107,7 +119,7 @@ async function routeSignedDelivery(d) {
     };
     // Tenant resolution. Fail closed on multi-tenant installs with unknown
     // routing - same policy as Slack.
-    const resolvedTenant = await resolveTenantForGitHub(d.hippoRoot, routing, d.store);
+    const resolvedTenant = await resolveTenantForGitHub(d.store, routing);
     if (resolvedTenant === null) {
         await parkAndAck(d, {
             ...routing,
@@ -184,7 +196,8 @@ async function dispatchGitHubEvent(d, ctx, body, deliveryId, routing) {
     if (action === null)
         return false;
     if (action.kind === 'manual-review') {
-        // issues.deleted (admin-initiated) is logged, not archived: archiving could lose the memory if the issue moves between accounts.
+        // issues.deleted (admin-initiated) is logged, not archived: archiving
+        // could lose the memory if the issue moves between accounts.
         await parkAndAck(d, {
             ...routing,
             tenantId: ctx.tenantId,

package/dist/connectors/ingest.d.ts

@@ -1,10 +1,12 @@
-import { type Context, type RememberOpts } from '../api/index.js';
+import { type RememberOpts } from '../api/index.js';
+import type { ConnectorContext } from './store.js';
 import type { ConnectorEvent } from '../store/port.js';
 export type IngestStatus = 'ingested' | 'duplicate' | 'skipped' | 'skipped_duplicate';
 export interface IngestResult {
     status: IngestStatus;
     memoryId: string | null;
 }
-/** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory, so a redelivery acks instead of retrying. */
-export declare function rememberWithEventLog(ctx: Context, event: ConnectorEvent, opts: RememberOpts | null): Promise<IngestResult>;
+/** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory,
+ * so a redelivery acks instead of retrying. */
+export declare function rememberWithEventLog(ctx: ConnectorContext, event: ConnectorEvent, opts: RememberOpts | null): Promise<IngestResult>;
 //# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/ingest.js

@@ -1,8 +1,8 @@
 // The write half every connector's ingest shares, after its own pre-check of the event log.
 import { remember } from '../api/index.js';
-import { requireGroup, storeFor } from '../store/index.js';
 import { RejectedValueError } from '../core/api-errors.js';
-/** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory, so a redelivery acks instead of retrying. */
+/** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory,
+ * so a redelivery acks instead of retrying. */
 export async function rememberWithEventLog(ctx, event, opts) {
     if (!opts)
         return markSkipped(ctx, event);
@@ -22,7 +22,7 @@ export async function rememberWithEventLog(ctx, event, opts) {
     }
 }
 async function markSkipped(ctx, event) {
-    await requireGroup(storeFor(ctx), 'connectorEvents').markEventSeen(event);
+    await ctx.store.connectorEvents.markEventSeen(event);
     return { status: 'skipped', memoryId: null };
 }
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/slack/backfill.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import type { SlackMessageEvent } from './types.js';
 import type { ChannelMeta } from './scope.js';
 export interface SlackHistoryPage {
@@ -9,8 +9,8 @@ export type SlackHistoryFetcher = (args: {
     channelId: string;
     /** Slack's opaque pagination token. Null on first page of a backfill run. */
     cursor: string | null;
-    /** Incremental-resume bound: skip messages with ts <= oldest, set from `slack_cursors.latest_ts` on the first page only.
-     *  Kept apart from `cursor` because Slack treats `cursor` as an opaque token, so feeding latest_ts as cursor fails on the live API. */
+    /** Incremental-resume bound: skip messages with ts <= oldest, from `slack_cursors.latest_ts` on the first page only.
+     * Kept apart from `cursor`: Slack treats `cursor` as an opaque token, so latest_ts there fails live. */
     oldest?: string;
 }) => Promise<SlackHistoryPage>;
 export interface BackfillOpts {
@@ -20,9 +20,9 @@ export interface BackfillOpts {
     /** Stop after this many messages. Default: unlimited. */
     maxMessages?: number;
 }
-/** Page through `conversations.history` and ingest each message, persisting the cursor to `slack_cursors` after every page.
+/** Page through `conversations.history` and ingest each message, persisting the cursor to `slack_cursors` per page.
  *  The synthesized eventId `backfill:${teamId}:${channelId}:${ts}` makes reruns dedupe via the `slack_event_log` PK. */
-export declare function backfillChannel(ctx: Context, opts: BackfillOpts): Promise<{
+export declare function backfillChannel(ctx: ConnectorContext, opts: BackfillOpts): Promise<{
     ingested: number;
     pages: number;
 }>;

package/dist/connectors/slack/backfill.js

@@ -1,10 +1,10 @@
 import { saveSlackCursor, slackCursor } from '../../store/connectors/slack.js';
 import { ingestMessage } from './ingest.js';
-/** Page through `conversations.history` and ingest each message, persisting the cursor to `slack_cursors` after every page.
+/** Page through `conversations.history` and ingest each message, persisting the cursor to `slack_cursors` per page.
  *  The synthesized eventId `backfill:${teamId}:${channelId}:${ts}` makes reruns dedupe via the `slack_event_log` PK. */
 export async function backfillChannel(ctx, opts) {
-    // `oldest` (numeric ts) is the resume bound for the first page only; `cursor` starts null and Slack mints the next-page token.
-    // Mixing the two would feed a numeric ts as an opaque cursor and break on rerun.
+    // `oldest` (numeric ts) is the resume bound for the first page only; `cursor` starts null and Slack mints the
+    // next-page token. Mixing the two would feed a numeric ts as an opaque cursor and break on rerun.
     const resumeFrom = slackCursor(ctx.hippoRoot, ctx.tenantId, opts.channel.id);
     let cursor = null;
     let ingested = 0;

package/dist/connectors/slack/deletion.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 export interface DeletionInput {
     teamId: string;
     channelId: string;
@@ -10,7 +10,7 @@ export interface DeletionResult {
     status: DeletionStatus;
     memoryId: string | null;
 }
-/** Handles Slack `message_deleted`. The store logs the event in the archive's own transaction, so a crash cannot leave a retry
- *  answering `not_found` where `duplicate` is due. */
-export declare function handleMessageDeleted(ctx: Context, input: DeletionInput): Promise<DeletionResult>;
+/** Handles Slack `message_deleted`. The store logs the event in the archive's own transaction, so a crash cannot leave
+ * a retry answering `not_found` where `duplicate` is due. */
+export declare function handleMessageDeleted(ctx: ConnectorContext, input: DeletionInput): Promise<DeletionResult>;
 //# sourceMappingURL=deletion.d.ts.map

package/dist/connectors/slack/deletion.js

@@ -1,9 +1,8 @@
 import { archiveRaw } from '../../api/index.js';
-import { requireGroup, storeFor } from '../../store/index.js';
-/** Handles Slack `message_deleted`. The store logs the event in the archive's own transaction, so a crash cannot leave a retry
- *  answering `not_found` where `duplicate` is due. */
+/** Handles Slack `message_deleted`. The store logs the event in the archive's own transaction, so a crash cannot leave
+ * a retry answering `not_found` where `duplicate` is due. */
 export async function handleMessageDeleted(ctx, input) {
-    const events = requireGroup(storeFor(ctx), 'connectorEvents');
+    const events = ctx.store.connectorEvents;
     const event = { connector: 'slack', eventId: input.eventId };
     // The tenant in the lookup is load-bearing: without it a deletion event from
     // tenant A could archive tenant B's raw row sharing the same artifact_ref.
@@ -20,7 +19,9 @@ export async function handleMessageDeleted(ctx, input) {
         await events.markEventSeen(event);
         return { status: 'not_found', memoryId: null };
     }
-    await archiveRaw(ctx, memoryId, `source_deleted:slack:${input.teamId}:${input.channelId}:${input.deletedTs}`, { event });
+    await archiveRaw(ctx, memoryId, `source_deleted:slack:${input.teamId}:${input.channelId}:${input.deletedTs}`, {
+        event,
+    });
     return { status: 'archived', memoryId };
 }
 //# sourceMappingURL=deletion.js.map

package/dist/connectors/slack/dlq.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import { type DlqBucket, type DlqItem, type SlackDlqInsert } from '../../store/connectors/slack.js';
 import { type ConnectorDlq, type ReplayResult } from '../dlq.js';
 export type { DlqBucket, DlqItem };
@@ -14,7 +14,7 @@ export interface ReplayDlqOpts {
     /** Skew window override for tests. */
     skewSeconds?: number;
 }
-/** Replay a DLQ row via the normal ingest path (`hippo slack dlq replay <id> [--force]`), re-verifying the signature with the CURRENT secret unless forced.
- *  Rows with a NULL signature need --force; replays use today's routing, because the DLQ exists to be drained after the operator fixed routing. */
-export declare function replayDlqEntry(ctx: Pick<Context, 'hippoRoot'>, id: number, opts?: ReplayDlqOpts): Promise<ReplayResult>;
+/** Replay a DLQ row via the normal ingest path (`hippo slack dlq replay <id> [--force]`), re-verifying the signature
+ * with the CURRENT secret unless forced. A NULL signature needs --force; replays use today's routing. */
+export declare function replayDlqEntry(ctx: Pick<ConnectorContext, 'hippoRoot' | 'store'>, id: number, opts?: ReplayDlqOpts): Promise<ReplayResult>;
 //# sourceMappingURL=dlq.d.ts.map

package/dist/connectors/slack/dlq.js

@@ -14,15 +14,15 @@ export const slackDlq = {
     entry: slackDlqEntry,
     bump: markSlackDlqRetried,
 };
-/** Replay a DLQ row via the normal ingest path (`hippo slack dlq replay <id> [--force]`), re-verifying the signature with the CURRENT secret unless forced.
- *  Rows with a NULL signature need --force; replays use today's routing, because the DLQ exists to be drained after the operator fixed routing. */
+/** Replay a DLQ row via the normal ingest path (`hippo slack dlq replay <id> [--force]`), re-verifying the signature
+ * with the CURRENT secret unless forced. A NULL signature needs --force; replays use today's routing. */
 export async function replayDlqEntry(ctx, id, opts = {}) {
     return replayParked({
         dlq: slackDlq,
         refuseSignature: (row) => refuseSignature(row, opts),
         isEnvelope: isSlackEventEnvelope,
         notEnvelope: 'not an event_callback envelope',
-        reingest: (_row, envelope) => reingest(ctx.hippoRoot, envelope),
+        reingest: (_row, envelope) => reingest(ctx, envelope),
     }, ctx.hippoRoot, id, opts.force === true);
 }
 /** A missing signature or timestamp refuses even without a secret; a mismatch needs the current secret to show. */
@@ -51,14 +51,14 @@ function refuseSignature(row, opts) {
         reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
     };
 }
-async function reingest(hippoRoot, envelope) {
-    const tenantId = await resolveTenantForSlackTeam(hippoRoot, envelope.team_id);
+async function reingest({ hippoRoot, store }, envelope) {
+    const tenantId = await resolveTenantForSlackTeam(store, envelope.team_id);
     if (!tenantId)
         return { ok: false, status: 'unroutable', reason: `team_id ${envelope.team_id} still unroutable` };
     const inner = envelope.event;
     if (!isSlackMessageEvent(inner))
         return { ok: false, status: 'unhandled', reason: 'unhandled inner event type' };
-    const replayCtx = { hippoRoot, tenantId, actor: adminActor('connector:slack:replay') };
+    const replayCtx = { hippoRoot, tenantId, actor: adminActor('connector:slack:replay'), store };
     if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
         const r = await handleMessageDeleted(replayCtx, {
             teamId: envelope.team_id,

package/dist/connectors/slack/ingest.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import { type IngestResult } from '../ingest.js';
 import type { ChannelMeta } from './scope.js';
 import type { SlackMessageEvent } from './types.js';
@@ -9,7 +9,9 @@ export interface IngestInput {
     /** Slack event_id for the envelope (or for backfill, a synthesized stable id). */
     eventId: string;
 }
-/** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,
- *  the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is logged with no memory. */
-export declare function ingestMessage(ctx: Context, input: IngestInput): Promise<IngestResult>;
+/** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check
+ * is only the fast path,
+ * the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is
+ * logged with no memory. */
+export declare function ingestMessage(ctx: ConnectorContext, input: IngestInput): Promise<IngestResult>;
 //# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/slack/ingest.js

@@ -1,10 +1,11 @@
-import { requireGroup, storeFor } from '../../store/index.js';
 import { rememberWithEventLog } from '../ingest.js';
 import { messageToRememberOpts } from './transform.js';
-/** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,
- *  the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is logged with no memory. */
+/** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check
+ * is only the fast path,
+ * the store logs the event in the memory's own transaction, which holds when two workers race. An empty body is
+ * logged with no memory. */
 export async function ingestMessage(ctx, input) {
-    const events = requireGroup(storeFor(ctx), 'connectorEvents');
+    const events = ctx.store.connectorEvents;
     const event = { connector: 'slack', eventId: input.eventId };
     // Idempotency check: if already seen, return the cached memory_id without
     // re-running the transform or hitting api.remember.

package/dist/connectors/slack/signature.d.ts

@@ -3,7 +3,10 @@ export interface VerifyOpts {
     timestamp: string;
     signature: string;
     signingSecret: string;
-    /** Previous signing secret during rotation (SLACK_SIGNING_SECRET_PREVIOUS); the verifier tries `signingSecret` first, then this. */
+    /**
+     * Previous signing secret during rotation (SLACK_SIGNING_SECRET_PREVIOUS); the verifier tries `signingSecret` first,
+     * then this.
+     */
     previousSecret?: string;
     /** Current unix seconds. Injectable for tests. */
     now?: number;

package/dist/connectors/slack/tenant-routing.d.ts

@@ -1,5 +1,7 @@
-import { type HippoStore } from '../../store/index.js';
-/** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty (single-workspace install).
- *  An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is the emergency escape. */
-export declare function resolveTenantForSlackTeam(hippoRoot: string, teamId: string, store?: HippoStore): Promise<string | null>;
+import type { StoreWith } from '../../store/index.js';
+/** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty
+ * (single-workspace install).
+ * An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is
+ * the emergency escape. */
+export declare function resolveTenantForSlackTeam(store: StoreWith<'connectorEvents'>, teamId: string): Promise<string | null>;
 //# sourceMappingURL=tenant-routing.d.ts.map

package/dist/connectors/slack/tenant-routing.js

@@ -1,9 +1,10 @@
 import { envSlackAllowUnknownTeamFallback, envTenant } from '../../util/env.js';
-import { requireGroup, storeFor } from '../../store/index.js';
-/** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty (single-workspace install).
- *  An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is the emergency escape. */
-export async function resolveTenantForSlackTeam(hippoRoot, teamId, store) {
-    return tenantForRoute(await requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').slackTeamRoute(teamId));
+/** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty
+ * (single-workspace install).
+ * An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is
+ * the emergency escape. */
+export async function resolveTenantForSlackTeam(store, teamId) {
+    return tenantForRoute(await store.connectorEvents.slackTeamRoute(teamId));
 }
 function tenantForRoute(route) {
     if (route.tenantId !== null)

package/dist/connectors/slack/transform.d.ts

@@ -6,7 +6,11 @@ export interface TransformInput {
     channel: ChannelMeta;
     message: SlackMessageEvent;
 }
-/** Convert a SlackMessageEvent into RememberOpts; returns null when the message has no usable body so the caller marks it seen and skips it.
- *  artifact_ref MUST be `slack://${teamId}/${channelId}/${ts}` (deletion looks it up); owner is never null: `user:<id>`, `bot:<bot_id>`, else `bot:unknown`. */
+/**
+ * Convert a SlackMessageEvent into RememberOpts; returns null when the message has no usable body so the caller marks
+ * it seen and skips it.
+ * artifact_ref MUST be `slack://${teamId}/${channelId}/${ts}` (deletion looks it up); owner is never null: `user:<id>`,
+ * `bot:<bot_id>`, else `bot:unknown`.
+ */
 export declare function messageToRememberOpts(input: TransformInput): RememberOpts | null;
 //# sourceMappingURL=transform.d.ts.map

package/dist/connectors/slack/transform.js

@@ -1,6 +1,10 @@
 import { scopeFromChannel } from './scope.js';
-/** Convert a SlackMessageEvent into RememberOpts; returns null when the message has no usable body so the caller marks it seen and skips it.
- *  artifact_ref MUST be `slack://${teamId}/${channelId}/${ts}` (deletion looks it up); owner is never null: `user:<id>`, `bot:<bot_id>`, else `bot:unknown`. */
+/**
+ * Convert a SlackMessageEvent into RememberOpts; returns null when the message has no usable body so the caller marks
+ * it seen and skips it.
+ * artifact_ref MUST be `slack://${teamId}/${channelId}/${ts}` (deletion looks it up); owner is never null: `user:<id>`,
+ * `bot:<bot_id>`, else `bot:unknown`.
+ */
 export function messageToRememberOpts(input) {
     const text = input.message.text?.trim();
     if (!text)

package/dist/connectors/slack/types.d.ts

@@ -15,7 +15,9 @@ export interface SlackMessageEvent {
     text?: string;
     ts: string;
     thread_ts?: string;
-    /** The `bot_message` subtype carries `bot_id` instead of `user`; transform.ts derives `owner: bot:<bot_id>` from it. */
+    /**
+     * The `bot_message` subtype carries `bot_id` instead of `user`; transform.ts derives `owner: bot:<bot_id>` from it.
+     */
     bot_id?: string;
     /** Present on subtype='message_deleted'. */
     deleted_ts?: string;

package/dist/connectors/slack/web-client.js

@@ -5,12 +5,16 @@ import { isJsonObject, isJsonString } from '../../util/json.js';
 /** Build a SlackHistoryFetcher that pages `conversations.history` over HTTP via `fetchWithRetry` (429 and 5xx handled).
  *  Slack omits `channel` from history messages, so the request channel id is stamped onto each one for ingest. */
 const SLACK_TIMEOUT_MS = 30_000;
-// A page is at most 200 messages, each up to 40,000 characters at 4 bytes, carried once as text and once as rich-text blocks.
+// A page is at most 200 messages, each up to 40,000 characters at 4 bytes, carried once as text and once as rich-text
+// blocks.
 const SLACK_MAX_REPLY_BYTES = 64 * 1024 * 1024;
 function isSlackMessage(m) {
     return isJsonObject(m) && m.type === 'message' && isJsonString(m.ts);
 }
-/** The reply as a JSON object. The error names the status and the path only, since the query string carries channel ids and cursors. */
+/**
+ * The reply as a JSON object. The error names the status and the path only, since the query string carries channel ids
+ * and cursors.
+ */
 async function readHistoryReply(r, url) {
     const where = `slack: HTTP ${r.status} on ${url.pathname}`;
     let body;
@@ -22,8 +26,9 @@ async function readHistoryReply(r, url) {
     }
     if (!isJsonObject(body))
         throw new Error(`${where}: the reply is not a JSON object`);
-    if (body.messages !== undefined && !Array.isArray(body.messages))
+    if (body.messages !== undefined && !Array.isArray(body.messages)) {
         throw new Error(`${where}: \`messages\` is not an array`);
+    }
     return body;
 }
 export function slackHistoryFetcher(token, fetchImpl) {

package/dist/connectors/slack/webhook.d.ts

@@ -1,7 +1,7 @@
-import type { HippoStore } from '../../store/index.js';
+import type { ConnectorStore } from '../store.js';
 import { type WebhookRequest } from '../../util/http-util.js';
-/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares webhook-signature);
- *  malformed payloads go to slack_dlq, ACK 200.
- *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
-export declare function handleSlackEventsWebhook(request: WebhookRequest, store?: HippoStore): Promise<void>;
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares
+ * webhook-signature); malformed payloads go to slack_dlq, ACK 200. 404 (not 503) when the secret is unset, so a probe
+ * cannot tell a gated-off route from a missing one. */
+export declare function handleSlackEventsWebhook(request: WebhookRequest, store: ConnectorStore): Promise<void>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/slack/webhook.js

@@ -7,11 +7,11 @@ import { parkInDlq } from '../dlq.js';
 import { slackDlq } from './dlq.js';
 import { resolveTenantForSlackTeam } from './tenant-routing.js';
 import { resolveTenantId } from '../../store/tenant.js';
-import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson } from '../../util/http-util.js';
+import { HttpError, JSON_HEADERS, isHeaderString, closeIfBodyUnread, readWebhookBody, sendJson, } from '../../util/http-util.js';
 import { isJsonObject } from '../../util/json.js';
-/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares webhook-signature);
- *  malformed payloads go to slack_dlq, ACK 200.
- *  404 (not 503) when the secret is unset, so a probe cannot tell a gated-off route from a missing one. */
+/** Slack Events API webhook: HMAC over the raw body with SLACK_SIGNING_SECRET, no Bearer (its route row declares
+ * webhook-signature); malformed payloads go to slack_dlq, ACK 200. 404 (not 503) when the secret is unset, so a probe
+ * cannot tell a gated-off route from a missing one. */
 export async function handleSlackEventsWebhook(request, store) {
     const { req, res, opts } = request;
     // Secret and headers before the body, so a caller with neither cannot make the server buffer one.
@@ -41,7 +41,14 @@ export async function handleSlackEventsWebhook(request, store) {
     })) {
         throw new HttpError(401, 'invalid Slack signature');
     }
-    await routeSignedSlackPayload({ hippoRoot: opts.hippoRoot, store, res, rawBody, signature: sigStr, slackTimestamp: tsStr });
+    await routeSignedSlackPayload({
+        hippoRoot: opts.hippoRoot,
+        store,
+        res,
+        rawBody,
+        signature: sigStr,
+        slackTimestamp: tsStr,
+    });
 }
 async function parkAndAck(d, park) {
     const row = {
@@ -53,7 +60,7 @@ async function parkAndAck(d, park) {
         signature: d.signature,
         slackTimestamp: d.slackTimestamp,
     };
-    await parkInDlq(slackDlq, d.hippoRoot, row, d.store);
+    await parkInDlq(slackDlq, d.store, row);
     sendJson(d.res, 200, { ok: true, status: 'dlq' });
 }
 function teamIdInRawBody(rawBody) {
@@ -88,11 +95,11 @@ async function routeSignedSlackPayload(d) {
     }
     if (answerUrlVerification(res, body))
         return;
-    // Fail closed: resolveTenantForSlackTeam returns null for an unknown team on a non-empty slack_workspaces; park it in slack_dlq (bucket='unroutable')
-    // and still ACKs 200 so Slack stops retrying; never call ingest.
+    // Fail closed: resolveTenantForSlackTeam returns null for an unknown team on a non-empty slack_workspaces; park it in
+    // slack_dlq (bucket='unroutable') and still ACKs 200 so Slack stops retrying; never call ingest.
     let resolvedTenant = null;
     if (body !== undefined && isSlackEventEnvelope(body)) {
-        resolvedTenant = await resolveTenantForSlackTeam(d.hippoRoot, body.team_id, d.store);
+        resolvedTenant = await resolveTenantForSlackTeam(d.store, body.team_id);
         if (resolvedTenant === null) {
             await parkAndAck(d, {
                 tenantId: null, // unroutable - stored as '__unroutable__'
@@ -127,7 +134,7 @@ async function routeSignedSlackPayload(d) {
 async function parkUnparseable(d, teamIdFromRaw) {
     // Attribute the parse failure to the originating workspace via the regex-extracted
     // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
-    const parseFailTenant = teamIdFromRaw !== null ? await resolveTenantForSlackTeam(d.hippoRoot, teamIdFromRaw, d.store) : null;
+    const parseFailTenant = teamIdFromRaw !== null ? await resolveTenantForSlackTeam(d.store, teamIdFromRaw) : null;
     await parkAndAck(d, {
         tenantId: parseFailTenant, // null → '__unroutable__' sentinel
         teamId: teamIdFromRaw,
@@ -151,7 +158,8 @@ async function dispatchSlackEvent(d, ctx, body) {
         }
         const r = await ingestMessage(ctx, {
             teamId: body.team_id,
-            // Channel privacy is not on the inner event, so channel_type is the proxy: 'group'|'im'|'mpim' private, 'channel' public, unknown private.
+            // Channel privacy is not on the inner event, so channel_type is the proxy: 'group'|'im'|'mpim' private, 'channel'
+            // public, unknown private.
             channel: {
                 id: inner.channel,
                 is_private: inner.channel_type !== 'channel',

package/dist/connectors/slack/workspaces.d.ts

@@ -1,8 +1,12 @@
-/** Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty = single-tenant, non-empty = fail-closed routing).
- *  `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no delete+add. */
+/**
+ * Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty =
+ * single-tenant, non-empty = fail-closed routing).
+ * `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no
+ * delete+add.
+ */
 import { type SlackWorkspace } from '../../store/connectors/slack.js';
 export type { SlackWorkspace };
-export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace } from '../../store/connectors/slack.js';
+export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace, } from '../../store/connectors/slack.js';
 export interface AddWorkspaceOpts {
     teamId: string;
     tenantId: string;

package/dist/connectors/slack/workspaces.js

@@ -1,7 +1,11 @@
-/** Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty = single-tenant, non-empty = fail-closed routing).
- *  `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no delete+add. */
+/**
+ * Slack workspace registration helpers: the `slack_workspaces` table maps `team_id` to `tenant_id` (empty =
+ * single-tenant, non-empty = fail-closed routing).
+ * `add` is an upsert that overwrites an existing team_id's tenant on purpose, so moving a workspace needs no
+ * delete+add.
+ */
 import { upsertSlackWorkspace } from '../../store/connectors/slack.js';
-export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace } from '../../store/connectors/slack.js';
+export { listSlackWorkspaces as listWorkspaces, removeSlackWorkspace as removeWorkspace, } from '../../store/connectors/slack.js';
 /** Register or re-register a Slack team → tenant mapping. Upserts on
  *  team_id conflict (operators move workspaces between tenants). */
 export function addWorkspace(hippoRoot, opts) {

package/dist/connectors/store.d.ts

@@ -0,0 +1,8 @@
+import type { ContextWith } from '../api/index.js';
+import type { StoreWith } from '../store/index.js';
+/** The groups a connector delivery writes through; the webhook gate proves all three before any delivery runs. */
+type ConnectorGroup = 'entryWrites' | 'connectorWrites' | 'connectorEvents';
+export type ConnectorStore = StoreWith<ConnectorGroup>;
+export type ConnectorContext = ContextWith<ConnectorGroup>;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/connectors/store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.js.map