@autono/pinbox-core 0.16.0 → 0.18.0

package/dist/connectors/index.d.ts

@@ -1,6 +1,36 @@
 import { g as ThreadMessage } from "../schema-BlM4lTLW.js";
 import { a as RemoteStatus, i as RemoteComment, n as ConnectorEvents, r as ConnectorTransport, t as Connector } from "../types-BmfT_m1p.js";
 import { c as PinStore } from "../store-DAB5CEA1.js";
+//#region src/connectors/github-app.d.ts
+/** The slice of fetch this transport uses — injectable without dragging in Bun's extras. */
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+type GithubAppTransportOptions = {
+  /** The App's numeric id (the `iss` claim). */
+  appId: string;
+  /** PEM, PKCS#1 or PKCS#8 — GitHub downloads PKCS#1. */
+  privateKeyPem: string;
+  /** The installation on the target repo's owner. */
+  installationId: string;
+  /** "owner/name". */
+  repo: string;
+  /** Default https://api.github.com; GHES uses https://<host>/api/v3. */
+  apiBase?: string;
+  fetchImpl?: FetchLike;
+  /** Test seam: epoch ms. */
+  now?: () => number;
+};
+/** A transport failure carrying the hint the link route surfaces as E_CONNECTOR. */
+declare class GithubAppError extends Error {
+  readonly hint: string | undefined;
+  readonly status: number;
+  constructor(message: string, status: number, hint?: string);
+}
+declare function createGithubAppTransport(opts: GithubAppTransportOptions): ConnectorTransport;
+/** PKCS#8 PEM in, PKCS#8 PEM out; PKCS#1 PEM (GitHub's download) is wrapped into PKCS#8. */
+declare function toPkcs8Pem(pem: string): string;
+/** PrivateKeyInfo ::= SEQUENCE { version 0, algorithm rsaEncryption, privateKey OCTET STRING }. */
+declare function pkcs1ToPkcs8(pkcs1: Uint8Array): Uint8Array;
+//#endregion
 //#region src/connectors/mirror.d.ts
 declare function createConnectorEvents(store: PinStore, pinId: string): ConnectorEvents;
 /**
@@ -34,4 +64,4 @@ type SlackConnectorOptions = {
 /** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
 declare function createSlackConnector(transport: ConnectorTransport, opts: SlackConnectorOptions): Connector;
 //#endregion
-export { Connector, ConnectorEvents, ConnectorTransport, POLL_OPEN_MS, POLL_RESOLVED_MS, RemoteComment, RemoteStatus, SlackConnectorOptions, SlackTransportOptions, createConnectorEvents, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates };
+export { Connector, ConnectorEvents, ConnectorTransport, FetchLike, GithubAppError, GithubAppTransportOptions, POLL_OPEN_MS, POLL_RESOLVED_MS, RemoteComment, RemoteStatus, SlackConnectorOptions, SlackTransportOptions, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates, pkcs1ToPkcs8, toPkcs8Pem };

package/dist/connectors/index.js

@@ -1,103 +1,3 @@
 import { a as outboundCandidates, i as createConnectorEvents, n as POLL_RESOLVED_MS, r as drainConnectorPolls, t as POLL_OPEN_MS } from "../poll-BrcAuaAz.js";
-import { pinsToMarkdown } from "../markdown.js";
-import { z } from "zod";
-//#region src/connectors/slack.ts
-/**
-* request(op, params) → POST https://slack.com/api/<op> (JSON, bearer botToken).
-* Slack's `{ok:false, error}` becomes a rejection carrying the Slack error string —
-* the route layer surfaces it as 502 E_CONNECTOR.
-*/
-function createSlackTransport(opts) {
-	const fetchImpl = opts.fetchImpl ?? fetch;
-	return { async request(op, params) {
-		const res = await fetchImpl(`https://slack.com/api/${op}`, {
-			method: "POST",
-			headers: {
-				authorization: `Bearer ${opts.botToken}`,
-				"content-type": "application/json; charset=utf-8"
-			},
-			body: JSON.stringify(params)
-		});
-		if (!res.ok) throw new Error(`slack ${op} failed: HTTP ${res.status}`);
-		const data = await res.json();
-		const envelope = SlackEnvelopeSchema.parse(data);
-		if (!envelope.ok) throw new Error(`slack ${op} failed: ${envelope.error ?? "unknown_error"}`);
-		return data;
-	} };
-}
-/** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
-function createSlackConnector(transport, opts) {
-	return {
-		name: "slack",
-		async createItem(pin, thread) {
-			const text = [pinsToMarkdown([pin], "standard"), ...thread.map((m) => `${m.role}: ${m.text}`)].join("\n").trimEnd();
-			const posted = PostMessageSchema.parse(await transport.request("chat.postMessage", {
-				channel: opts.channel,
-				text
-			}));
-			const channel = posted.channel ?? opts.channel;
-			const permalink = PermalinkSchema.parse(await transport.request("chat.getPermalink", {
-				channel,
-				message_ts: posted.ts
-			}));
-			return {
-				connector: "slack",
-				ref: `${channel}/${posted.ts}`,
-				url: permalink.permalink
-			};
-		},
-		async postComment(link, message) {
-			const { channel, ts } = parseRef(link.ref);
-			await transport.request("chat.postMessage", {
-				channel,
-				thread_ts: ts,
-				text: message.text
-			});
-		},
-		async sync(link, events) {
-			const { channel, ts } = parseRef(link.ref);
-			const replies = RepliesSchema.parse(await transport.request("conversations.replies", {
-				channel,
-				ts
-			}));
-			for (const reply of replies.messages) {
-				if (reply.ts === ts) continue;
-				const atMs = slackTsToMs(reply.ts);
-				await events.onRemoteComment(link, {
-					origin: `slack:${reply.user}`,
-					text: reply.text ?? "",
-					at: new Date(atMs).toISOString()
-				});
-			}
-		},
-		async setRemoteStatus() {}
-	};
-}
-const SlackEnvelopeSchema = z.looseObject({
-	ok: z.boolean(),
-	error: z.string().optional()
-});
-const PostMessageSchema = z.looseObject({
-	channel: z.string().optional(),
-	ts: z.string()
-});
-const PermalinkSchema = z.looseObject({ permalink: z.string() });
-const RepliesSchema = z.looseObject({ messages: z.array(z.looseObject({
-	ts: z.string(),
-	user: z.string(),
-	text: z.string().optional()
-})) });
-function parseRef(ref) {
-	const slash = ref.indexOf("/");
-	if (slash <= 0 || slash === ref.length - 1) throw new Error(`slack link ref must be "<channel>/<thread_ts>", got "${ref}"`);
-	return {
-		channel: ref.slice(0, slash),
-		ts: ref.slice(slash + 1)
-	};
-}
-/** Slack ts is "<epoch-seconds>.<suffix>" — epoch milliseconds for the reported `at`. */
-function slackTsToMs(ts) {
-	return Number(ts) * 1e3;
-}
-//#endregion
-export { POLL_OPEN_MS, POLL_RESOLVED_MS, createConnectorEvents, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates };
+import { a as pkcs1ToPkcs8, i as createGithubAppTransport, n as createSlackTransport, o as toPkcs8Pem, r as GithubAppError, t as createSlackConnector } from "../slack-Dnq9bnXd.js";
+export { GithubAppError, POLL_OPEN_MS, POLL_RESOLVED_MS, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates, pkcs1ToPkcs8, toPkcs8Pem };

package/dist/do.d.ts

@@ -1,4 +1,5 @@
 import { a as Link, g as ThreadMessage, m as SessionRef, r as Attachment, s as Pin, t as AppliedEdit } from "./schema-BlM4lTLW.js";
+import { t as Connector } from "./types-BmfT_m1p.js";
 import { r as SessionStore } from "./sessions-BOrd8Yvv.js";
 import { a as LinkStore, c as PinStore, i as DeliveryStore, l as StoredEvent, t as CursorStore } from "./store-DAB5CEA1.js";
 import { Broadcaster } from "./ws.js";
@@ -34,6 +35,13 @@ type PinboxDoEnv = {
   JWT_ISSUER?: string;
   JWT_JWKS_URL?: string;
   JWT_AUDIENCE?: string;
+  GITHUB_APP_ID?: string;
+  GITHUB_APP_PRIVATE_KEY?: string;
+  GITHUB_INSTALLATION_ID?: string;
+  GITHUB_REPO?: string;
+  GITHUB_API_BASE?: string;
+  SLACK_BOT_TOKEN?: string;
+  SLACK_CHANNEL?: string;
   MEDIA?: R2Bucket;
   R2_ACCOUNT_ID?: string;
   R2_BUCKET?: string;
@@ -46,6 +54,12 @@ declare class DoBroadcaster implements Broadcaster {
   publish(topic: string, data: string): void;
   subscriberCount(topic: string): number;
 }
+/**
+ * The cloud connector set, from the environment: github when the App quartet is present,
+ * slack when its pair is. A partial quartet is ignored rather than half-configured — the
+ * link route then answers 502 E_CONNECTOR with the `pinbox doctor` hint, as with no config.
+ */
+declare function buildConnectors(env: PinboxDoEnv): Connector[];
 declare class PinboxHubDO {
   readonly store: DoPinStore;
   readonly broadcaster: DoBroadcaster;
@@ -56,6 +70,8 @@ declare class PinboxHubDO {
   private readonly handler;
   /** Undefined when no adapter is configured — the hub then stores pins and delivers nothing. */
   private readonly router;
+  /** Host-injected tracker connectors (github via App token, slack); empty ⇒ link routes 502. */
+  private readonly connectors;
   constructor(ctx: DurableObjectState, env: PinboxDoEnv);
   fetch(req: Request): Promise<Response>;
   private intercept;
@@ -69,6 +85,8 @@ declare class PinboxHubDO {
   alarm(): Promise<void>;
   /** Re-arm while work remains. Setting an alarm that already exists is a no-op. */
   private scheduleDrain;
+  /** Any delivery row pending, or any linked pin with a poll deadline set. */
+  private hasPendingWork;
   private upgrade;
   private protocolError;
   private unauthorized;
@@ -76,4 +94,4 @@ declare class PinboxHubDO {
   private serveMedia;
 }
 //#endregion
-export { DoBroadcaster, PinboxDoEnv, PinboxHubDO };
+export { DoBroadcaster, PinboxDoEnv, PinboxHubDO, buildConnectors };

package/dist/do.js

@@ -1,10 +1,13 @@
 import { AttachmentSchema, PinInputSchema, PinSchema, SessionRefSchema, ThreadMessageSchema } from "./schema.js";
 import { a as NotFoundError, i as ConflictError, o as newId, t as SessionSchema } from "./sessions-DrCVTMfI.js";
 import { t as MIGRATIONS } from "./store-IR3o5YwY.js";
+import { r as drainConnectorPolls } from "./poll-BrcAuaAz.js";
 import { n as createHubHandler, o as ok, r as err } from "./hub-I67BuX9S.js";
 import { ClientHelloSchema, WS_CLOSE_PROTOCOL, WS_CLOSE_UNAUTHORIZED, WS_TOKEN_SUBPROTOCOL_PREFIX, encodeWsEvent } from "./ws-protocol.js";
 import { n as DeliveryRouter } from "./router-BH74psWn.js";
 import { createWebhookAdapter } from "./delivery/webhook.js";
+import { i as createGithubAppTransport, n as createSlackTransport, t as createSlackConnector } from "./slack-Dnq9bnXd.js";
+import { createGithubConnector } from "./connectors/github.js";
 import { i as verifyJwt, n as verifyNone, r as verifyToken } from "./verify-BDt9d9Np.js";
 //#region src/do-store-registries.ts
 function parseSession(json) {
@@ -583,6 +586,24 @@ function buildRouter(store, env) {
 		})]
 	});
 }
+/**
+* The cloud connector set, from the environment: github when the App quartet is present,
+* slack when its pair is. A partial quartet is ignored rather than half-configured — the
+* link route then answers 502 E_CONNECTOR with the `pinbox doctor` hint, as with no config.
+*/
+function buildConnectors(env) {
+	const out = [];
+	const present = (v) => v !== void 0 && v !== "";
+	if (present(env.GITHUB_APP_ID) && present(env.GITHUB_APP_PRIVATE_KEY) && present(env.GITHUB_INSTALLATION_ID) && present(env.GITHUB_REPO)) out.push(createGithubConnector(createGithubAppTransport({
+		appId: env.GITHUB_APP_ID,
+		privateKeyPem: env.GITHUB_APP_PRIVATE_KEY,
+		installationId: env.GITHUB_INSTALLATION_ID,
+		repo: env.GITHUB_REPO,
+		...present(env.GITHUB_API_BASE) ? { apiBase: env.GITHUB_API_BASE } : {}
+	})));
+	if (present(env.SLACK_BOT_TOKEN) && present(env.SLACK_CHANNEL)) out.push(createSlackConnector(createSlackTransport({ botToken: env.SLACK_BOT_TOKEN }), { channel: env.SLACK_CHANNEL }));
+	return out;
+}
 var PinboxHubDO = class {
 	store;
 	broadcaster;
@@ -593,6 +614,8 @@ var PinboxHubDO = class {
 	handler;
 	/** Undefined when no adapter is configured — the hub then stores pins and delivers nothing. */
 	router;
+	/** Host-injected tracker connectors (github via App token, slack); empty ⇒ link routes 502. */
+	connectors;
 	constructor(ctx, env) {
 		this.ctx = ctx;
 		this.env = env;
@@ -600,10 +623,12 @@ var PinboxHubDO = class {
 		this.topic = `project:${ctx.id.name ?? ctx.id.toString()}`;
 		this.broadcaster = new DoBroadcaster(ctx);
 		this.strategy = buildStrategy(env);
+		this.connectors = buildConnectors(env);
 		this.handler = createHubHandler({
 			store: this.store,
 			token: env.PINBOX_TOKEN ?? "",
-			..."verify" in this.strategy ? { verify: this.strategy.verify } : {}
+			..."verify" in this.strategy ? { verify: this.strategy.verify } : {},
+			...this.connectors.length > 0 ? { connectors: this.connectors } : {}
 		});
 		this.store.subscribe((event) => this.broadcaster.publish(this.topic, encodeWsEvent(event)));
 		this.router = buildRouter(this.store, env);
@@ -614,6 +639,10 @@ var PinboxHubDO = class {
 			});
 			this.scheduleDrain();
 		}
+		if (this.connectors.length > 0) {
+			this.store.subscribe(() => void this.scheduleDrain());
+			this.scheduleDrain();
+		}
 		ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair("ping", "pong"));
 	}
 	async fetch(req) {
@@ -677,17 +706,21 @@ var PinboxHubDO = class {
 	* DO has been unloaded and woken again.
 	*/
 	async alarm() {
-		if (this.router === void 0) return;
-		await this.router.drainDue();
+		if (this.router !== void 0) await this.router.drainDue();
+		if (this.connectors.length > 0) await drainConnectorPolls(this.store, this.connectors);
 		await this.scheduleDrain();
 	}
 	/** Re-arm while work remains. Setting an alarm that already exists is a no-op. */
 	async scheduleDrain() {
-		if (this.router === void 0) return;
-		if (this.store.deliveries.due(FAR_FUTURE).length === 0) return;
+		if (!this.hasPendingWork()) return;
 		if (await this.ctx.storage.getAlarm() !== null) return;
 		await this.ctx.storage.setAlarm(Date.now() + DRAIN_INTERVAL_MS);
 	}
+	/** Any delivery row pending, or any linked pin with a poll deadline set. */
+	hasPendingWork() {
+		if (this.router !== void 0 && this.store.deliveries.due(FAR_FUTURE).length > 0) return true;
+		return this.connectors.length > 0 && this.store.pinsDueBefore(FAR_FUTURE).length > 0;
+	}
 	async upgrade(req, url, verify) {
 		let token = url.searchParams.get("token");
 		let acceptedProtocol;
@@ -763,4 +796,4 @@ var PinboxHubDO = class {
 	}
 };
 //#endregion
-export { DoBroadcaster, PinboxHubDO };
+export { DoBroadcaster, PinboxHubDO, buildConnectors };

package/dist/slack-Dnq9bnXd.js

@@ -0,0 +1,305 @@
+import { pinsToMarkdown } from "./markdown.js";
+import { z } from "zod";
+import { SignJWT, importPKCS8 } from "jose";
+//#region src/connectors/github-app.ts
+const API_VERSION = "2022-11-28";
+const USER_AGENT = "pinbox";
+/** Mint a fresh installation token this close to expiry. */
+const REFRESH_MARGIN_MS = 6e4;
+/** App JWTs may live 10 minutes; nine leaves room for clock skew on GitHub's side. */
+const APP_JWT_TTL_S = 540;
+const COMMENTS_PER_PAGE = 100;
+const MAX_COMMENT_PAGES = 10;
+/** Ops that address an existing issue by number. */
+const NUMBERED_OPS = /* @__PURE__ */ new Set([
+	"issue.comment",
+	"issue.view",
+	"issue.close",
+	"issue.reopen"
+]);
+/** A transport failure carrying the hint the link route surfaces as E_CONNECTOR. */
+var GithubAppError = class extends Error {
+	hint;
+	status;
+	constructor(message, status, hint) {
+		super(message);
+		this.name = "GithubAppError";
+		this.status = status;
+		this.hint = hint;
+	}
+};
+function createGithubAppTransport(opts) {
+	const fetchImpl = opts.fetchImpl ?? ((input, init) => fetch(input, init));
+	const now = opts.now ?? (() => Date.now());
+	const api = (opts.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
+	const repo = opts.repo.replace(/^\/+|\/+$/g, "");
+	if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) throw new GithubAppError(`GITHUB_REPO must be "owner/name", got "${opts.repo}"`, 0);
+	let keyPromise = null;
+	let cached = null;
+	function key() {
+		keyPromise ??= importPKCS8(toPkcs8Pem(opts.privateKeyPem), "RS256");
+		return keyPromise;
+	}
+	async function appJwt() {
+		const iat = Math.floor(now() / 1e3) - 60;
+		return new SignJWT({}).setProtectedHeader({
+			alg: "RS256",
+			typ: "JWT"
+		}).setIssuer(opts.appId).setIssuedAt(iat).setExpirationTime(iat + 60 + APP_JWT_TTL_S).sign(await key());
+	}
+	async function installationToken() {
+		if (cached !== null && cached.expiresAt - now() > REFRESH_MARGIN_MS) return cached.token;
+		const res = await fetchImpl(`${api}/app/installations/${opts.installationId}/access_tokens`, {
+			method: "POST",
+			headers: headers(await appJwt())
+		});
+		if (!res.ok) throw new GithubAppError(`GitHub App token request failed: HTTP ${res.status}`, res.status, res.status === 401 ? "check GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY belong to the same App" : res.status === 404 ? "check GITHUB_INSTALLATION_ID — the App may not be installed on this repo's owner" : void 0);
+		const body = await res.json();
+		if (typeof body.token !== "string" || typeof body.expires_at !== "string") throw new GithubAppError("GitHub App token response was not { token, expires_at }", 502);
+		cached = {
+			token: body.token,
+			expiresAt: Date.parse(body.expires_at)
+		};
+		return cached.token;
+	}
+	async function call(method, path, body) {
+		const res = await fetchImpl(`${api}${path}`, {
+			method,
+			headers: headers(await installationToken(), body !== void 0),
+			...body === void 0 ? {} : { body: JSON.stringify(body) }
+		});
+		if (!res.ok) {
+			const detail = await res.text().catch(() => "");
+			if (res.status === 401) cached = null;
+			throw new GithubAppError(`GitHub ${method} ${path} failed: HTTP ${res.status}${detail ? ` — ${detail.slice(0, 200)}` : ""}`, res.status, res.status === 403 || res.status === 404 ? `check the App is installed on ${repo} with Issues: read & write` : void 0);
+		}
+		return await res.json();
+	}
+	async function allComments(number) {
+		const out = [];
+		for (let page = 1; page <= MAX_COMMENT_PAGES; page += 1) {
+			const batch = await call("GET", `/repos/${repo}/issues/${number}/comments?per_page=${COMMENTS_PER_PAGE}&page=${page}`);
+			out.push(...batch);
+			if (batch.length < COMMENTS_PER_PAGE) break;
+		}
+		return out;
+	}
+	return { async request(op, params) {
+		const number = Number(params["number"]);
+		if (NUMBERED_OPS.has(op) && (!Number.isInteger(number) || number <= 0)) throw new GithubAppError(`github ${op} needs a positive issue number`, 0);
+		switch (op) {
+			case "issue.create": {
+				const issue = await call("POST", `/repos/${repo}/issues`, {
+					title: params["title"],
+					body: params["body"]
+				});
+				return {
+					number: issue.number,
+					url: issue.html_url
+				};
+			}
+			case "issue.comment":
+				await call("POST", `/repos/${repo}/issues/${number}/comments`, { body: params["body"] });
+				return;
+			case "issue.view": {
+				const issue = await call("GET", `/repos/${repo}/issues/${number}`);
+				const comments = await allComments(number);
+				return {
+					state: issue.state === "closed" ? "closed" : "open",
+					comments: comments.map((c) => ({
+						author: c.user?.login ?? "ghost",
+						body: c.body ?? "",
+						createdAt: c.created_at
+					}))
+				};
+			}
+			case "issue.close":
+				await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "closed" });
+				return;
+			case "issue.reopen":
+				await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "open" });
+				return;
+			default: throw new GithubAppError(`unknown github op: ${op}`, 0);
+		}
+	} };
+}
+function headers(bearer, json = false) {
+	return {
+		authorization: `Bearer ${bearer}`,
+		accept: "application/vnd.github+json",
+		"x-github-api-version": API_VERSION,
+		"user-agent": USER_AGENT,
+		...json ? { "content-type": "application/json" } : {}
+	};
+}
+/** PKCS#8 PEM in, PKCS#8 PEM out; PKCS#1 PEM (GitHub's download) is wrapped into PKCS#8. */
+function toPkcs8Pem(pem) {
+	const trimmed = pem.trim();
+	if (trimmed.includes("BEGIN PRIVATE KEY")) return trimmed;
+	if (!trimmed.includes("BEGIN RSA PRIVATE KEY")) throw new GithubAppError("GITHUB_APP_PRIVATE_KEY is not a PEM private key", 0, "paste the whole file GitHub downloaded, \"-----BEGIN RSA PRIVATE KEY-----\" through the END line");
+	return toPem("PRIVATE KEY", pkcs1ToPkcs8(pemBody(trimmed)));
+}
+function pemBody(pem) {
+	const b64 = pem.split("\n").filter((line) => !line.startsWith("-----")).join("").replace(/\s+/g, "");
+	const bin = atob(b64);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+	return out;
+}
+function toPem(label, der) {
+	let bin = "";
+	for (const b of der) bin += String.fromCharCode(b);
+	return `-----BEGIN ${label}-----\n${btoa(bin).replace(/(.{64})/g, "$1\n").trimEnd()}\n-----END ${label}-----`;
+}
+/** rsaEncryption AlgorithmIdentifier: SEQUENCE { OID 1.2.840.113549.1.1.1, NULL }. */
+const RSA_ALGORITHM = new Uint8Array([
+	48,
+	13,
+	6,
+	9,
+	42,
+	134,
+	72,
+	134,
+	247,
+	13,
+	1,
+	1,
+	1,
+	5,
+	0
+]);
+const VERSION_ZERO = new Uint8Array([
+	2,
+	1,
+	0
+]);
+/** PrivateKeyInfo ::= SEQUENCE { version 0, algorithm rsaEncryption, privateKey OCTET STRING }. */
+function pkcs1ToPkcs8(pkcs1) {
+	return derTlv(48, concat(VERSION_ZERO, RSA_ALGORITHM, derTlv(4, pkcs1)));
+}
+function derTlv(tag, body) {
+	const len = body.length;
+	let header;
+	if (len < 128) header = [tag, len];
+	else {
+		const bytes = [];
+		for (let v = len; v > 0; v = Math.floor(v / 256)) bytes.unshift(v & 255);
+		header = [
+			tag,
+			128 | bytes.length,
+			...bytes
+		];
+	}
+	return concat(new Uint8Array(header), body);
+}
+function concat(...parts) {
+	const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+	let at = 0;
+	for (const p of parts) {
+		out.set(p, at);
+		at += p.length;
+	}
+	return out;
+}
+//#endregion
+//#region src/connectors/slack.ts
+/**
+* request(op, params) → POST https://slack.com/api/<op> (JSON, bearer botToken).
+* Slack's `{ok:false, error}` becomes a rejection carrying the Slack error string —
+* the route layer surfaces it as 502 E_CONNECTOR.
+*/
+function createSlackTransport(opts) {
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	return { async request(op, params) {
+		const res = await fetchImpl(`https://slack.com/api/${op}`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${opts.botToken}`,
+				"content-type": "application/json; charset=utf-8"
+			},
+			body: JSON.stringify(params)
+		});
+		if (!res.ok) throw new Error(`slack ${op} failed: HTTP ${res.status}`);
+		const data = await res.json();
+		const envelope = SlackEnvelopeSchema.parse(data);
+		if (!envelope.ok) throw new Error(`slack ${op} failed: ${envelope.error ?? "unknown_error"}`);
+		return data;
+	} };
+}
+/** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
+function createSlackConnector(transport, opts) {
+	return {
+		name: "slack",
+		async createItem(pin, thread) {
+			const text = [pinsToMarkdown([pin], "standard"), ...thread.map((m) => `${m.role}: ${m.text}`)].join("\n").trimEnd();
+			const posted = PostMessageSchema.parse(await transport.request("chat.postMessage", {
+				channel: opts.channel,
+				text
+			}));
+			const channel = posted.channel ?? opts.channel;
+			const permalink = PermalinkSchema.parse(await transport.request("chat.getPermalink", {
+				channel,
+				message_ts: posted.ts
+			}));
+			return {
+				connector: "slack",
+				ref: `${channel}/${posted.ts}`,
+				url: permalink.permalink
+			};
+		},
+		async postComment(link, message) {
+			const { channel, ts } = parseRef(link.ref);
+			await transport.request("chat.postMessage", {
+				channel,
+				thread_ts: ts,
+				text: message.text
+			});
+		},
+		async sync(link, events) {
+			const { channel, ts } = parseRef(link.ref);
+			const replies = RepliesSchema.parse(await transport.request("conversations.replies", {
+				channel,
+				ts
+			}));
+			for (const reply of replies.messages) {
+				if (reply.ts === ts) continue;
+				const atMs = slackTsToMs(reply.ts);
+				await events.onRemoteComment(link, {
+					origin: `slack:${reply.user}`,
+					text: reply.text ?? "",
+					at: new Date(atMs).toISOString()
+				});
+			}
+		},
+		async setRemoteStatus() {}
+	};
+}
+const SlackEnvelopeSchema = z.looseObject({
+	ok: z.boolean(),
+	error: z.string().optional()
+});
+const PostMessageSchema = z.looseObject({
+	channel: z.string().optional(),
+	ts: z.string()
+});
+const PermalinkSchema = z.looseObject({ permalink: z.string() });
+const RepliesSchema = z.looseObject({ messages: z.array(z.looseObject({
+	ts: z.string(),
+	user: z.string(),
+	text: z.string().optional()
+})) });
+function parseRef(ref) {
+	const slash = ref.indexOf("/");
+	if (slash <= 0 || slash === ref.length - 1) throw new Error(`slack link ref must be "<channel>/<thread_ts>", got "${ref}"`);
+	return {
+		channel: ref.slice(0, slash),
+		ts: ref.slice(slash + 1)
+	};
+}
+/** Slack ts is "<epoch-seconds>.<suffix>" — epoch milliseconds for the reported `at`. */
+function slackTsToMs(ts) {
+	return Number(ts) * 1e3;
+}
+//#endregion
+export { pkcs1ToPkcs8 as a, createGithubAppTransport as i, createSlackTransport as n, toPkcs8Pem as o, GithubAppError as r, createSlackConnector as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autono/pinbox-core",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "type": "module",
   "license": "MIT",
   "repository": {