hippo-memory 2.0.0 → 2.1.0

package/dist/cli.js

@@ -12,17 +12,18 @@ import { printGitHubBackfillUsage } from './cli/github.js';
 import { printError } from './cli/output.js';
 import { errorFields, errorMessage, isLevelEnabled, log } from './util/log.js';
 import { STORE_BUSY_MESSAGE } from './store/port.js';
-import { isStoreBusy } from './store/sqlite/busy.js';
+import { isStoreBusy } from './api/busy.js';
 import { flagIsTrue, isBooleanFlag, isStringFlag } from './cli/flag-values.js';
-import { USAGE_HEADER, USAGE_EXAMPLES, printAuditPruneUsage, printSlackBackfillUsage, printSlackWorkspacesUsage } from './cli/usage.js';
+import { USAGE_HEADER, USAGE_EXAMPLES, printAuditPruneUsage, printSlackBackfillUsage, printSlackWorkspacesUsage, } from './cli/usage.js';
 import { flagKind, isKnownFlag, undeclaredFlags } from './cli/flags.js';
 import { COMMANDS } from './cli/verbs.js';
-import { CliExit } from './cli/exit.js';
-// Helpers
+import { CliExit, fail } from './cli/exit.js';
 // A command that does not honour --dry-run would ignore it and run for real.
 function dryRunRefusal(command, spec, args, flags) {
     const only = spec?.dryRun;
-    const honoured = only === undefined ? spec?.flags.switches?.includes('dry-run') : only !== false && only.honoured(args, flags);
+    const honoured = only === undefined
+        ? spec?.flags.switches?.includes('dry-run')
+        : only !== false && only.honoured(args, flags);
     if (honoured)
         return null;
     const where = only ? ` outside \`hippo ${command} ${only.form}\`` : '';
@@ -59,7 +60,6 @@ function setSeparatedFlag(flags, key, next, kind) {
         return 2;
     }
     if (!next || next.startsWith('--') || kind === 'switch') {
-        // Boolean flag
         flags[key] = true;
         return 1;
     }
@@ -122,7 +122,7 @@ function maybeRepairCodexWrapper(currentCommand, flags) {
         repairCodexWrapperIfInstalled();
     }
     catch (err) {
-        log.debug(`codex wrapper not repaired: ${errorMessage(err)}`);
+        log.debug(`codex wrapper not repaired: ${errorMessage(err)}`, errorFields(err));
     }
 }
 const ROWS = Object.values(COMMANDS);
@@ -154,7 +154,6 @@ function printHelp(command, args) {
     else
         console.log(verbUsage(command) ?? usageText());
 }
-// Entry point
 function printVersion() {
     const __filename_local = fileURLToPath(import.meta.url);
     const __dirname_local = path.dirname(__filename_local);
@@ -168,8 +167,7 @@ function printVersion() {
  *  reject it once here so every command, thin-client relays included, sees only a non-empty string. */
 function rejectEmptyScope(flags) {
     if ('scope' in flags && (!isStringFlag(flags['scope']) || !flags['scope'].trim())) {
-        printError('--scope requires a non-empty value (e.g. --scope slack:private:C1).');
-        throw new CliExit(1);
+        fail('--scope requires a non-empty value (e.g. --scope slack:private:C1).');
     }
 }
 // parseArgs stores a value-less flag as boolean true, and NaN then survives every
@@ -179,8 +177,7 @@ function rejectNonNumericFlags(flags, declared) {
         if (flagKind(declared, key) !== 'number')
             continue;
         if (!isStringFlag(raw) || !raw.trim() || !Number.isFinite(Number(raw))) {
-            printError(`--${key} requires a numeric value.`);
-            throw new CliExit(1);
+            fail(`--${key} requires a numeric value.`);
         }
     }
 }
@@ -189,8 +186,7 @@ function rejectNonNumericFlags(flags, declared) {
 function rejectValuedSwitches(flags, declared) {
     for (const [key, raw] of Object.entries(flags)) {
         if (flagKind(declared, key) === 'switch' && !isBooleanFlag(raw)) {
-            printError(`--${key} takes no value`);
-            throw new CliExit(1);
+            fail(`--${key} takes no value`);
         }
     }
 }
@@ -207,8 +203,9 @@ function checkUnknownFlags(command, flags, spec) {
     }
     // main() refuses --dry-run by name on a verb without one, so that flag is not also called ignored.
     const ignored = declared ? undeclaredFlags(declared, Object.keys(flags)).filter((key) => key !== 'dry-run') : unknown;
-    if (ignored.length > 0)
+    if (ignored.length > 0) {
         printError(`hippo: ignoring unknown flag ${flagNames(ignored)}. A later release will reject it.`);
+    }
 }
 async function main(command, args, flags, hippoRoot) {
     if (command === '--version' || command === '-v' || flags['version'])
@@ -239,7 +236,7 @@ async function main(command, args, flags, hippoRoot) {
         throw new CliExit(1);
     }
     const run = () => spec.run({ hippoRoot, tenantId: resolveTenantId({}), args, flags });
-    await (spec.scoped ? (await import('./db/request-stores.js')).runWithRequestStores(run) : run());
+    await (spec.scoped ? (await import('./cli/api-context.js')).cliRequest(run) : run());
 }
 export async function runCli(argv = process.argv) {
     const { command, args, flags } = parseArgs(argv);

package/dist/connectors/dlq.d.ts

@@ -1,4 +1,4 @@
-import { type HippoStore } from '../store/index.js';
+import type { StoreWith } from '../store/index.js';
 import type { ConnectorDeadLetter } from '../store/port.js';
 import type { JsonValue } from '../util/json.js';
 declare const DEFAULT_BUCKET = "parse_error";
@@ -19,8 +19,8 @@ export interface ParkedRow<Bucket extends string> {
     bucket: Bucket | typeof DEFAULT_BUCKET;
     signature: string | null;
 }
-/** What one connector supplies: the tag that names its table to the store, its list, its one-row read and its retry bump.
- * `Own` is the columns only its table has. */
+/** What one connector supplies: the tag that names its table to the store, its list, its one-row read and its retry
+ * bump. `Own` is the columns only its table has. */
 export interface ConnectorDlq<Own, Bucket extends string, Item> {
     readonly letter: (row: ParkedRow<Bucket> & Own) => ConnectorDeadLetter;
     readonly list: (hippoRoot: string, tenantId: string, limit: number) => Item[];
@@ -28,8 +28,7 @@ export interface ConnectorDlq<Own, Bucket extends string, Item> {
     /** Adds one to `retry_count` and stamps `retried_at`. */
     readonly bump: (hippoRoot: string, id: number) => void;
 }
-/** Parks on `store`, else on hippo.db under `hippoRoot`. */
-export declare function parkInDlq<Own, Bucket extends string>(dlq: ConnectorDlq<Own, Bucket, unknown>, hippoRoot: string, opts: ParkOpts<Bucket> & NoInfer<Own>, store?: HippoStore): Promise<number>;
+export declare function parkInDlq<Own, Bucket extends string>(dlq: ConnectorDlq<Own, Bucket, unknown>, store: StoreWith<'connectorEvents'>, opts: ParkOpts<Bucket> & NoInfer<Own>): Promise<number>;
 export declare function listDlq<Item>(dlq: ConnectorDlq<never, never, Item>, hippoRoot: string, opts: {
     tenantId: string;
     limit?: number;
@@ -74,7 +73,8 @@ export interface ReplaySteps<Item, Envelope extends JsonValue> {
     readonly notEnvelope: string;
     readonly reingest: (row: Item, envelope: Envelope) => Promise<Reingest>;
 }
-/** Re-runs a parked row under today's secret and routing; every attempt past the read is counted once, except a missing signature. */
+/** Re-runs a parked row under today's secret and routing; every
+ * attempt past the read is counted once, except a missing signature. */
 export declare function replayParked<Item extends ParkedEntry, Envelope extends JsonValue>(steps: ReplaySteps<Item, Envelope>, hippoRoot: string, id: number, force: boolean): Promise<ReplayResult>;
 export {};
 //# sourceMappingURL=dlq.d.ts.map

package/dist/connectors/dlq.js

@@ -1,14 +1,12 @@
-// The dead-letter queue every webhook connector parks into: one redaction, one unroutable sentinel, one set of defaults, one replay result.
+// The dead-letter queue every webhook connector parks into: one redaction, one unroutable sentinel, one set of
+// defaults, one replay result.
 import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { DLQ_REDACTED_NOTE, redactPayload } from '../util/secret-detect.js';
-import { requireGroup } from '../store/index.js';
-import { storeFor } from '../store/sqlite/store.js';
 import { errorMessage } from '../util/log.js';
 /** The tenant stored on a row no tenant was resolved for; the column is NOT NULL. */
 const UNROUTABLE_TENANT = '__unroutable__';
 const DEFAULT_BUCKET = 'parse_error';
-/** Parks on `store`, else on hippo.db under `hippoRoot`. */
-export async function parkInDlq(dlq, hippoRoot, opts, store) {
+export async function parkInDlq(dlq, store, opts) {
     const rawPayload = redactPayload(opts.rawPayload);
     // A redacted body can never match its signature, so the row keeps none and replay needs --force.
     const redacted = rawPayload !== opts.rawPayload;
@@ -20,7 +18,7 @@ export async function parkInDlq(dlq, hippoRoot, opts, store) {
         bucket: opts.bucket ?? DEFAULT_BUCKET,
         signature: redacted ? null : opts.signature ?? null,
     });
-    return requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').parkDeadLetter(letter);
+    return store.connectorEvents.parkDeadLetter(letter);
 }
 export function listDlq(dlq, hippoRoot, opts) {
     return dlq.list(hippoRoot, opts.tenantId, opts.limit ?? DEFAULT_LIST_LIMIT);
@@ -34,7 +32,8 @@ function failAndBump(dlq, hippoRoot, row, status, reason) {
     dlq.bump(hippoRoot, row.id);
     return replayFailed(status, row.retryCount + 1, reason);
 }
-/** Re-runs a parked row under today's secret and routing; every attempt past the read is counted once, except a missing signature. */
+/** Re-runs a parked row under today's secret and routing; every
+ * attempt past the read is counted once, except a missing signature. */
 export async function replayParked(steps, hippoRoot, id, force) {
     const row = steps.dlq.entry(hippoRoot, id);
     if (!row)
@@ -57,7 +56,12 @@ export async function replayParked(steps, hippoRoot, id, force) {
     if (!outcome.ok)
         return failAndBump(steps.dlq, hippoRoot, row, outcome.status, outcome.reason);
     steps.dlq.bump(hippoRoot, row.id);
-    const result = { ok: true, status: outcome.status, memoryId: outcome.memoryId, retryCount: row.retryCount + 1 };
+    const result = {
+        ok: true,
+        status: outcome.status,
+        memoryId: outcome.memoryId,
+        retryCount: row.retryCount + 1,
+    };
     if (outcome.reason !== undefined)
         result.reason = outcome.reason;
     return result;

package/dist/connectors/github/backfill.d.ts

@@ -1,7 +1,7 @@
-/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own high-water mark (HWM).
- *  An HWM is persisted only after its stream fully drains, so a crash in stream 2 leaves stream 1 committed and stream 2 resumes from its prior HWM.
+/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own HWM.
+ *  An HWM (high-water mark) is saved only after its stream fully drains, so a crash in stream 2 keeps stream 1.
  *  `repository.private` is left undefined (REST lists omit it), so scopeFromRepository falls through to private. */
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import type { GitHubFetcher } from './octokit-client.js';
 export interface BackfillOpts {
     /** e.g. 'acme/repo'. */
@@ -24,5 +24,5 @@ export interface BackfillResult {
     ingested: BackfillStreamCounts;
     pages: BackfillStreamCounts;
 }
-export declare function backfillRepo(ctx: Context, opts: BackfillOpts): Promise<BackfillResult>;
+export declare function backfillRepo(ctx: ConnectorContext, opts: BackfillOpts): Promise<BackfillResult>;
 //# sourceMappingURL=backfill.d.ts.map

package/dist/connectors/github/backfill.js

@@ -1,9 +1,10 @@
-/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own high-water mark (HWM).
- *  An HWM is persisted only after its stream fully drains, so a crash in stream 2 leaves stream 1 committed and stream 2 resumes from its prior HWM.
+/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own HWM.
+ *  An HWM (high-water mark) is saved only after its stream fully drains, so a crash in stream 2 keeps stream 1.
  *  `repository.private` is left undefined (REST lists omit it), so scopeFromRepository falls through to private. */
 import { readCursors, seedCursors, writeHwm } from '../../store/connectors/github.js';
 import { ingestEvent } from './ingest.js';
 import { isJsonObject } from '../../util/json.js';
+import { MINUTE_MS } from '../../util/time.js';
 const API = 'https://api.github.com';
 /** Build a synthetic `repository` from the known repo full name, because REST list items often omit it.
  *  `private` stays undefined so scopeFromRepository falls through to private. */
@@ -82,9 +83,10 @@ async function drainStream(ctx, url0, options) {
     }
     return { ingested, pages, maxUpdatedAt, drained: true };
 }
-// A reset hours away must fail the run for a later rerun; sleeping through it would hold the process for the whole window.
+// A reset hours away must fail the run for a later rerun; sleeping
+// through it would hold the process for the whole window.
 const MAX_RATE_LIMIT_ATTEMPTS = 5;
-const MAX_RATE_LIMIT_WAIT_MS = 10 * 60 * 1000;
+const MAX_RATE_LIMIT_WAIT_MS = 10 * MINUTE_MS;
 async function fetchPagePastRateLimit(options, url) {
     const { fetcher, token, sleep } = options;
     let waitedMs = 0;

package/dist/connectors/github/deletion.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 export interface DeletionInput {
     /** artifact_ref of the comment, e.g. 'github://acme/repo/issue/42/comment/123'
      *  or 'github://acme/repo/pull/7/review_comment/456'. */
@@ -15,7 +15,9 @@ export interface DeletionResult {
     status: DeletionStatus;
     archivedCount: number;
 }
-/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`: archive ALL active raw rows for the artifact_ref in one write.
- *  Tenant and kind='raw' filtering are load-bearing: without them a deletion could archive another tenant's row or a distilled row. */
-export declare function handleCommentDeleted(ctx: Context, input: DeletionInput): Promise<DeletionResult>;
+/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`:
+ * archive ALL active raw rows for the artifact_ref in one write. Tenant and
+ * kind='raw' filtering are load-bearing: without them a deletion could
+ * archive another tenant's row or a distilled row. */
+export declare function handleCommentDeleted(ctx: ConnectorContext, input: DeletionInput): Promise<DeletionResult>;
 //# sourceMappingURL=deletion.d.ts.map

package/dist/connectors/github/deletion.js

@@ -1,10 +1,10 @@
-import { requireGroup } from '../../store/index.js';
-import { storeFor } from '../../store/sqlite/store.js';
-/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`: archive ALL active raw rows for the artifact_ref in one write.
- *  Tenant and kind='raw' filtering are load-bearing: without them a deletion could archive another tenant's row or a distilled row. */
+/** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`:
+ * archive ALL active raw rows for the artifact_ref in one write. Tenant and
+ * kind='raw' filtering are load-bearing: without them a deletion could
+ * archive another tenant's row or a distilled row. */
 export async function handleCommentDeleted(ctx, input) {
     const { artifactRef, idempotencyKey, deliveryId, eventName } = input;
-    const done = await requireGroup(storeFor(ctx), 'connectorEvents').archiveDeletedArtifact({
+    const done = await ctx.store.connectorEvents.archiveDeletedArtifact({
         tenantId: ctx.tenantId,
         actor: ctx.actor.subject,
         artifactRef,

package/dist/connectors/github/dlq.d.ts

@@ -1,21 +1,23 @@
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import { type DlqBucket, type DlqItem, type GitHubDlqInsert } from '../../store/connectors/github.js';
 import { type ConnectorDlq, type ReplayResult } from '../dlq.js';
 export type { DlqBucket, DlqItem };
 type GitHubOwnColumns = Pick<GitHubDlqInsert, 'eventName' | 'deliveryId' | 'installationId' | 'repoFullName'>;
-/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
+/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row
+ * without re-reading the payload. */
 export declare const githubDlq: ConnectorDlq<GitHubOwnColumns, DlqBucket, DlqItem>;
 export interface ReplayDlqOpts {
     /** Current webhook secret. If omitted, signature check is skipped (force-only path). */
     webhookSecret?: string;
-    /** Previous webhook secret during rotation, passed to verifyGitHubSignature.previousSecret so old-secret DLQ rows need no --force. */
+    /** Previous webhook secret during rotation, passed to verifyGitHubSignature.previousSecret so old-secret DLQ rows
+     * need no --force. */
     previousSecret?: string;
     /** When true, skip signature verification (used for legacy entries after secret rotation). */
     force?: boolean;
 }
 /** Hook the webhook route injects to re-ingest a row, which keeps this module free of every event-type handler.
  *  No `idempotencyKey` field: ingest re-derives it from the parsed event, and a passed-in key could be stale. */
-export type IngestHook = (ctx: Context, args: {
+export type IngestHook = (ctx: ConnectorContext, args: {
     rawPayload: string;
     eventName: string;
     deliveryId: string;
@@ -23,8 +25,8 @@ export type IngestHook = (ctx: Context, args: {
     memoryId: string | null;
 }>;
 /** Replay a DLQ row through the normal ingest path; a failed signature, parse or envelope check bumps retry_count.
- *  Without an `ingestHook` (dry-run) it bumps retry_count and returns `replayed` with memoryId=null; replays use today's routing, not the original's. */
-export declare function replayDlqEntry(ctx: Context, id: number, opts?: ReplayDlqOpts & {
+ * No `ingestHook` (dry-run): bumps retry_count, returns `replayed` with memoryId=null. Replays use today's routing. */
+export declare function replayDlqEntry(ctx: ConnectorContext, id: number, opts?: ReplayDlqOpts & {
     ingestHook?: IngestHook;
 }): Promise<ReplayResult>;
 //# sourceMappingURL=dlq.d.ts.map

package/dist/connectors/github/dlq.js

@@ -2,7 +2,8 @@ import { githubDlqEntry, markGitHubDlqRetried, listGitHubDlq, } from '../../stor
 import { replayParked } from '../dlq.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope } from './types.js';
-/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row without re-reading the payload. */
+/** GitHub's dead-letter table; the event, delivery, installation and repo columns let an operator triage a row
+ * without re-reading the payload. */
 export const githubDlq = {
     letter: (row) => ({ connector: 'github', ...row }),
     list: listGitHubDlq,
@@ -10,7 +11,7 @@ export const githubDlq = {
     bump: markGitHubDlqRetried,
 };
 /** Replay a DLQ row through the normal ingest path; a failed signature, parse or envelope check bumps retry_count.
- *  Without an `ingestHook` (dry-run) it bumps retry_count and returns `replayed` with memoryId=null; replays use today's routing, not the original's. */
+ * No `ingestHook` (dry-run): bumps retry_count, returns `replayed` with memoryId=null. Replays use today's routing. */
 export async function replayDlqEntry(ctx, id, opts = {}) {
     const { webhookSecret, previousSecret, ingestHook } = opts;
     return replayParked({
@@ -20,8 +21,9 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
         isEnvelope: isGitHubWebhookEnvelope,
         notEnvelope: 'not a GitHub webhook envelope',
         reingest: async (row) => {
-            if (!ingestHook)
+            if (!ingestHook) {
                 return { ok: true, status: 'replayed', memoryId: null, reason: 'dry-run: no ingest hook supplied' };
+            }
             // The hook owns routing, idempotency and the memory write, and re-derives the key from the parsed event.
             const { memoryId } = await ingestHook(ctx, {
                 rawPayload: row.rawPayload,
@@ -34,10 +36,14 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
 }
 function refuseSignature(row, webhookSecret, previousSecret) {
     if (!row.signature) {
-        return { status: 'sig_missing', reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay' };
+        return {
+            status: 'sig_missing',
+            reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
+        };
     }
-    if (verifyGitHubSignature({ rawBody: row.rawPayload, signature: row.signature, webhookSecret, previousSecret }))
+    if (verifyGitHubSignature({ rawBody: row.rawPayload, signature: row.signature, webhookSecret, previousSecret })) {
         return null;
+    }
     return {
         status: 'sig_fail',
         reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',

package/dist/connectors/github/ingest.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import { type IngestResult } from '../ingest.js';
 import type { GitHubIssueEvent, GitHubIssueCommentEvent, GitHubPullRequestEvent, GitHubPullRequestReviewCommentEvent } from './types.js';
 /** Discriminated union of the four event shapes V1 ingests; eventName MUST equal the X-GitHub-Event header,
@@ -24,5 +24,5 @@ export interface IngestInput {
     /** X-GitHub-Delivery header value, audit metadata only. */
     deliveryId: string;
 }
-export declare function ingestEvent(ctx: Context, input: IngestInput): Promise<IngestResult>;
+export declare function ingestEvent(ctx: ConnectorContext, input: IngestInput): Promise<IngestResult>;
 //# sourceMappingURL=ingest.d.ts.map

package/dist/connectors/github/ingest.js

@@ -1,8 +1,6 @@
 // GitHub event ingest, once per idempotency key. The key comes from the event's own content, never from the unsigned
-// X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast path:
-// the store logs the key in the memory's own transaction, which is what holds when two workers race.
-import { requireGroup } from '../../store/index.js';
-import { storeFor } from '../../store/sqlite/store.js';
+// X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast
+// path: the store logs the key in the memory's own transaction, which is what holds when two workers race.
 import { rememberWithEventLog } from '../ingest.js';
 import { computeIdempotencyKey } from './signature.js';
 import { issueEventToRememberOpts, issueCommentEventToRememberOpts, pullRequestEventToRememberOpts, prReviewCommentEventToRememberOpts, } from './transform.js';
@@ -46,9 +44,14 @@ function eventUpdatedAt(event) {
     }
 }
 export async function ingestEvent(ctx, input) {
-    const events = requireGroup(storeFor(ctx), 'connectorEvents');
+    const events = ctx.store.connectorEvents;
     const idempotencyKey = computeIdempotencyKey(eventArtifactRef(input.event), eventUpdatedAt(input.event));
-    const event = { connector: 'github', idempotencyKey, deliveryId: input.deliveryId, eventName: input.event.eventName };
+    const event = {
+        connector: 'github',
+        idempotencyKey,
+        deliveryId: input.deliveryId,
+        eventName: input.event.eventName,
+    };
     // Fast path: pre-check. Avoids running the transform / opening a write tx
     // for the common already-seen case (GitHub auto-retries with the same body).
     const seen = await events.eventRecord(event);

package/dist/connectors/github/octokit-client.d.ts

@@ -1,5 +1,7 @@
 /** Octokit-shaped HTTP fetcher for the GitHub backfill; tests inject a fake `GitHubFetcher`.
- *  Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a silent empty backfill. */
+ * Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a
+ * silent empty backfill.
+ */
 import { type RateLimitInfo } from './ratelimit.js';
 import type { JsonValue } from '../../util/json.js';
 export declare class GitHubFetchError extends Error {

package/dist/connectors/github/octokit-client.js

@@ -1,5 +1,7 @@
 /** Octokit-shaped HTTP fetcher for the GitHub backfill; tests inject a fake `GitHubFetcher`.
- *  Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a silent empty backfill. */
+ * Any non-200 that is not a recognised rate-limit pause MUST throw `GitHubFetchError`, since an empty page would be a
+ * silent empty backfill.
+ */
 import { parseRateLimit } from './ratelimit.js';
 import { fetchWithRetry } from '../../util/http-retry.js';
 import { readCappedJson, readCappedText } from '../../util/capped-json.js';
@@ -36,7 +38,10 @@ const ERROR_BODY_SNIPPET_CHARS = 256;
 const UTF8_MAX_BYTES_PER_CHAR = 4;
 // A page is at most 100 items (per_page=100), each with a body of up to 65,536 characters at 4 bytes, plus its fields.
 const GITHUB_MAX_REPLY_BYTES = 32 * 1024 * 1024;
-/** The items of a 200 list reply. A body that is not JSON, is over the cap or is not an array throws, so it never reaches ingest as items. */
+/**
+ * The items of a 200 list reply. A body that is not JSON, is over the cap or is not an array throws, so it never
+ * reaches ingest as items.
+ */
 async function readItems(res, url) {
     // The path only: a `next` link comes from the server, so its query string is not ours to print.
     const path = new URL(url).pathname;

package/dist/connectors/github/ratelimit.d.ts

@@ -1,9 +1,13 @@
-/** GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
+/**
+ * GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
  *  Backfill must pause and resume rather than error. */
 export interface RateLimitInfo {
     readonly sleepSeconds: number;
     readonly reason: 'primary' | 'secondary' | 'none';
 }
-/** Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for deterministic tests. */
+/**
+ * Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for
+ * deterministic tests.
+ */
 export declare function parseRateLimit(headers: Record<string, string | undefined>, status: number, now?: number): RateLimitInfo;
 //# sourceMappingURL=ratelimit.d.ts.map

package/dist/connectors/github/ratelimit.js

@@ -1,6 +1,10 @@
-/** GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
+/**
+ * GitHub rate-limit header parser: 403 with `X-RateLimit-Remaining: 0` is primary, 429 with `Retry-After` is secondary.
  *  Backfill must pause and resume rather than error. */
-/** Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for deterministic tests. */
+/**
+ * Parse the rate-limit signal from a GitHub response; `headers` are lower-cased and `now` (epoch seconds) is for
+ * deterministic tests.
+ */
 export function parseRateLimit(headers, status, now) {
     const _now = now ?? Math.floor(Date.now() / 1000);
     if (status === 429) {

package/dist/connectors/github/signature.d.ts

@@ -6,11 +6,22 @@ export interface VerifyOpts {
     /** Previous secret for rotation parity with Slack. Optional. */
     previousSecret?: string;
 }
+/**
+ * True for a header that could be a GitHub signature; anything else is refused before the body is read, since no secret
+ * can make it match.
+ */
+export declare function isWellFormedGitHubSignature(signature: string): boolean;
 export declare function verifyGitHubSignature(opts: VerifyOpts): boolean;
-/** Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the SAME event dedupe.
- *  An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so replays cannot bypass dedupe. */
+/**
+ * Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the
+ * SAME event dedupe.
+ * An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so
+ * replays cannot bypass dedupe.
+ */
 export declare function computeIdempotencyKey(artifactRef: string, updatedAt: string | null | undefined): string;
 /** Deletion idempotency key: sha256('deleted:' + artifactRef + ':' + updatedAt).
- *  A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same deletion still dedupe. */
+ * A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same
+ * deletion still dedupe.
+ */
 export declare function computeDeletionKey(artifactRef: string, updatedAt: string | null | undefined): string;
 //# sourceMappingURL=signature.d.ts.map

package/dist/connectors/github/signature.js

@@ -1,4 +1,12 @@
 import { createHmac, createHash, timingSafeEqual } from 'crypto';
+const SIGNATURE_HEADER_RE = /^sha256=[0-9a-f]{64}$/;
+/**
+ * True for a header that could be a GitHub signature; anything else is refused before the body is read, since no secret
+ * can make it match.
+ */
+export function isWellFormedGitHubSignature(signature) {
+    return SIGNATURE_HEADER_RE.test(signature);
+}
 function verifyOne(rawBody, signature, secret) {
     if (!signature.startsWith('sha256='))
         return false;
@@ -16,13 +24,19 @@ export function verifyGitHubSignature(opts) {
         return true;
     return false;
 }
-/** Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the SAME event dedupe.
- *  An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so replays cannot bypass dedupe. */
+/**
+ * Source-aware idempotency key: artifact_ref plus the source-side updated_at, so a webhook and a REST backfill of the
+ * SAME event dedupe.
+ * An edit gets a new key (a new revision); both inputs come from the parsed event, not the unsigned delivery header, so
+ * replays cannot bypass dedupe.
+ */
 export function computeIdempotencyKey(artifactRef, updatedAt) {
     return createHash('sha256').update(`${artifactRef}:${updatedAt ?? ''}`).digest('hex');
 }
 /** Deletion idempotency key: sha256('deleted:' + artifactRef + ':' + updatedAt).
- *  A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same deletion still dedupe. */
+ * A separate namespace so an ingest's event-log row cannot make a deletion return 'duplicate'; retries of the same
+ * deletion still dedupe.
+ */
 export function computeDeletionKey(artifactRef, updatedAt) {
     return createHash('sha256').update(`deleted:${artifactRef}:${updatedAt ?? ''}`).digest('hex');
 }

package/dist/connectors/github/tenant-routing.d.ts

@@ -1,11 +1,13 @@
-import { type HippoStore } from '../../store/index.js';
+import type { StoreWith } from '../../store/index.js';
 export interface ResolveArgs {
     /** String form of `installation.id`. `null`/`undefined` means "no installation field" (PAT-mode webhook). */
     installationId?: string | null;
     /** `repository.full_name` from the webhook envelope, used for PAT-mode multi-tenant routing. */
     repoFullName?: string | null;
 }
-/** Resolve a GitHub envelope's tenant_id by installation id, then repository.full_name; the HIPPO_TENANT fallback applies only if both tables are empty.
- *  An unknown installation or repo on a multi-tenant deployment returns null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
-export declare function resolveTenantForGitHub(hippoRoot: string, args: ResolveArgs, store?: HippoStore): Promise<string | null>;
+/** Resolve a GitHub envelope's tenant_id by installation id, then
+ * repository.full_name; the HIPPO_TENANT fallback applies only if both tables are
+ * empty. An unknown installation or repo on a multi-tenant deployment returns
+ * null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
+export declare function resolveTenantForGitHub(store: StoreWith<'connectorEvents'>, args: ResolveArgs): Promise<string | null>;
 //# sourceMappingURL=tenant-routing.d.ts.map

package/dist/connectors/github/tenant-routing.js

@@ -1,12 +1,12 @@
 import { envGitHubAllowUnknownInstallationFallback, envTenant } from '../../util/env.js';
-import { requireGroup } from '../../store/index.js';
-import { storeFor } from '../../store/sqlite/store.js';
-/** Resolve a GitHub envelope's tenant_id by installation id, then repository.full_name; the HIPPO_TENANT fallback applies only if both tables are empty.
- *  An unknown installation or repo on a multi-tenant deployment returns null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
-export async function resolveTenantForGitHub(hippoRoot, args, store) {
+/** Resolve a GitHub envelope's tenant_id by installation id, then
+ * repository.full_name; the HIPPO_TENANT fallback applies only if both tables are
+ * empty. An unknown installation or repo on a multi-tenant deployment returns
+ * null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
+export async function resolveTenantForGitHub(store, args) {
     const envFallback = () => envTenant();
     const escapeHatch = envGitHubAllowUnknownInstallationFallback();
-    const routing = await requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').githubRouting(args);
+    const routing = await store.connectorEvents.githubRouting(args);
     if (routing.tenant)
         return routing.tenant;
     if (args.installationId) {