@autono/pinbox-core 0.17.0 → 0.19.0

package/dist/connectors/index.d.ts

@@ -1,6 +1,62 @@
 import { g as ThreadMessage } from "../schema-BlM4lTLW.js";
 import { a as RemoteStatus, i as RemoteComment, n as ConnectorEvents, r as ConnectorTransport, t as Connector } from "../types-BmfT_m1p.js";
 import { c as PinStore } from "../store-DAB5CEA1.js";
+//#region src/connectors/github-app.d.ts
+/** The slice of fetch this transport uses — injectable without dragging in Bun's extras. */
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+type GithubAppTransportOptions = {
+  /** The App's numeric id (the `iss` claim). */
+  appId: string;
+  /** PEM, PKCS#1 or PKCS#8 — GitHub downloads PKCS#1. */
+  privateKeyPem: string;
+  /** The installation on the target repo's owner. */
+  installationId: string;
+  /** "owner/name". */
+  repo: string;
+  /** Default https://api.github.com; GHES uses https://<host>/api/v3. */
+  apiBase?: string;
+  fetchImpl?: FetchLike;
+  /** Test seam: epoch ms. */
+  now?: () => number;
+};
+/** A transport failure carrying the hint the link route surfaces as E_CONNECTOR. */
+declare class GithubAppError extends Error {
+  readonly hint: string | undefined;
+  readonly status: number;
+  constructor(message: string, status: number, hint?: string);
+}
+/** The App's own credential: a short-lived RS256 JWT with `iss` = app id. */
+declare function signAppJwt(appId: string, privateKeyPem: string, now?: () => number): Promise<string>;
+/** GitHub's standard request headers for the REST API. */
+declare function githubHeaders(bearer: string, json?: boolean): Record<string, string>;
+type InstallationToken = {
+  token: string;
+  expiresAt: number;
+};
+/** Exchange an App JWT for a one-hour installation token. */
+declare function mintInstallationToken(api: string, installationId: string, appJwt: string, fetchImpl: FetchLike): Promise<InstallationToken>;
+declare function createGithubAppTransport(opts: GithubAppTransportOptions): ConnectorTransport;
+/** PKCS#8 PEM in, PKCS#8 PEM out; PKCS#1 PEM (GitHub's download) is wrapped into PKCS#8. */
+declare function toPkcs8Pem(pem: string): string;
+/** PrivateKeyInfo ::= SEQUENCE { version 0, algorithm rsaEncryption, privateKey OCTET STRING }. */
+declare function pkcs1ToPkcs8(pkcs1: Uint8Array): Uint8Array;
+//#endregion
+//#region src/connectors/github-webhook.d.ts
+type GithubWebhookOptions = {
+  /** The webhook secret configured on the App — HMAC-SHA256 key for the signature. */
+  secret: string;
+  /** "owner/name": events for any other repository are acknowledged and ignored. */
+  repo: string;
+};
+/**
+ * Handle one webhook delivery. Returns the hub's machine envelope: 200 with
+ * `{ applied, ignored }`, 401 `E_AUTH` on a signature failure, 400 `E_INVALID_INPUT` on a
+ * body GitHub would never send.
+ */
+declare function handleGithubWebhook(req: Request, store: PinStore, opts: GithubWebhookOptions): Promise<Response>;
+/** `sha256=<hex hmac>` over the raw body, compared in constant time. */
+declare function signatureValid(secret: string, rawBody: string, header: string | null): Promise<boolean>;
+//#endregion
 //#region src/connectors/mirror.d.ts
 declare function createConnectorEvents(store: PinStore, pinId: string): ConnectorEvents;
 /**
@@ -34,4 +90,4 @@ type SlackConnectorOptions = {
 /** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
 declare function createSlackConnector(transport: ConnectorTransport, opts: SlackConnectorOptions): Connector;
 //#endregion
-export { Connector, ConnectorEvents, ConnectorTransport, POLL_OPEN_MS, POLL_RESOLVED_MS, RemoteComment, RemoteStatus, SlackConnectorOptions, SlackTransportOptions, createConnectorEvents, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates };
+export { Connector, ConnectorEvents, ConnectorTransport, FetchLike, GithubAppError, GithubAppTransportOptions, GithubWebhookOptions, InstallationToken, POLL_OPEN_MS, POLL_RESOLVED_MS, RemoteComment, RemoteStatus, SlackConnectorOptions, SlackTransportOptions, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, githubHeaders, handleGithubWebhook, mintInstallationToken, outboundCandidates, pkcs1ToPkcs8, signAppJwt, signatureValid, toPkcs8Pem };

package/dist/connectors/index.js

@@ -1,103 +1,3 @@
-import { a as outboundCandidates, i as createConnectorEvents, n as POLL_RESOLVED_MS, r as drainConnectorPolls, t as POLL_OPEN_MS } from "../poll-BrcAuaAz.js";
-import { pinsToMarkdown } from "../markdown.js";
-import { z } from "zod";
-//#region src/connectors/slack.ts
-/**
-* request(op, params) → POST https://slack.com/api/<op> (JSON, bearer botToken).
-* Slack's `{ok:false, error}` becomes a rejection carrying the Slack error string —
-* the route layer surfaces it as 502 E_CONNECTOR.
-*/
-function createSlackTransport(opts) {
-	const fetchImpl = opts.fetchImpl ?? fetch;
-	return { async request(op, params) {
-		const res = await fetchImpl(`https://slack.com/api/${op}`, {
-			method: "POST",
-			headers: {
-				authorization: `Bearer ${opts.botToken}`,
-				"content-type": "application/json; charset=utf-8"
-			},
-			body: JSON.stringify(params)
-		});
-		if (!res.ok) throw new Error(`slack ${op} failed: HTTP ${res.status}`);
-		const data = await res.json();
-		const envelope = SlackEnvelopeSchema.parse(data);
-		if (!envelope.ok) throw new Error(`slack ${op} failed: ${envelope.error ?? "unknown_error"}`);
-		return data;
-	} };
-}
-/** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
-function createSlackConnector(transport, opts) {
-	return {
-		name: "slack",
-		async createItem(pin, thread) {
-			const text = [pinsToMarkdown([pin], "standard"), ...thread.map((m) => `${m.role}: ${m.text}`)].join("\n").trimEnd();
-			const posted = PostMessageSchema.parse(await transport.request("chat.postMessage", {
-				channel: opts.channel,
-				text
-			}));
-			const channel = posted.channel ?? opts.channel;
-			const permalink = PermalinkSchema.parse(await transport.request("chat.getPermalink", {
-				channel,
-				message_ts: posted.ts
-			}));
-			return {
-				connector: "slack",
-				ref: `${channel}/${posted.ts}`,
-				url: permalink.permalink
-			};
-		},
-		async postComment(link, message) {
-			const { channel, ts } = parseRef(link.ref);
-			await transport.request("chat.postMessage", {
-				channel,
-				thread_ts: ts,
-				text: message.text
-			});
-		},
-		async sync(link, events) {
-			const { channel, ts } = parseRef(link.ref);
-			const replies = RepliesSchema.parse(await transport.request("conversations.replies", {
-				channel,
-				ts
-			}));
-			for (const reply of replies.messages) {
-				if (reply.ts === ts) continue;
-				const atMs = slackTsToMs(reply.ts);
-				await events.onRemoteComment(link, {
-					origin: `slack:${reply.user}`,
-					text: reply.text ?? "",
-					at: new Date(atMs).toISOString()
-				});
-			}
-		},
-		async setRemoteStatus() {}
-	};
-}
-const SlackEnvelopeSchema = z.looseObject({
-	ok: z.boolean(),
-	error: z.string().optional()
-});
-const PostMessageSchema = z.looseObject({
-	channel: z.string().optional(),
-	ts: z.string()
-});
-const PermalinkSchema = z.looseObject({ permalink: z.string() });
-const RepliesSchema = z.looseObject({ messages: z.array(z.looseObject({
-	ts: z.string(),
-	user: z.string(),
-	text: z.string().optional()
-})) });
-function parseRef(ref) {
-	const slash = ref.indexOf("/");
-	if (slash <= 0 || slash === ref.length - 1) throw new Error(`slack link ref must be "<channel>/<thread_ts>", got "${ref}"`);
-	return {
-		channel: ref.slice(0, slash),
-		ts: ref.slice(slash + 1)
-	};
-}
-/** Slack ts is "<epoch-seconds>.<suffix>" — epoch milliseconds for the reported `at`. */
-function slackTsToMs(ts) {
-	return Number(ts) * 1e3;
-}
-//#endregion
-export { POLL_OPEN_MS, POLL_RESOLVED_MS, createConnectorEvents, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates };
+import { a as createConnectorEvents, n as POLL_RESOLVED_MS, o as outboundCandidates, r as drainConnectorPolls, t as POLL_OPEN_MS } from "../poll-ZSv3wN9C.js";
+import { a as GithubAppError, c as mintInstallationToken, d as toPkcs8Pem, i as signatureValid, l as pkcs1ToPkcs8, n as createSlackTransport, o as createGithubAppTransport, r as handleGithubWebhook, s as githubHeaders, t as createSlackConnector, u as signAppJwt } from "../slack-C4P0AbuZ.js";
+export { GithubAppError, POLL_OPEN_MS, POLL_RESOLVED_MS, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, githubHeaders, handleGithubWebhook, mintInstallationToken, outboundCandidates, pkcs1ToPkcs8, signAppJwt, signatureValid, toPkcs8Pem };

package/dist/do.d.ts

@@ -1,4 +1,5 @@
 import { a as Link, g as ThreadMessage, m as SessionRef, r as Attachment, s as Pin, t as AppliedEdit } from "./schema-BlM4lTLW.js";
+import { t as Connector } from "./types-BmfT_m1p.js";
 import { r as SessionStore } from "./sessions-BOrd8Yvv.js";
 import { a as LinkStore, c as PinStore, i as DeliveryStore, l as StoredEvent, t as CursorStore } from "./store-DAB5CEA1.js";
 import { Broadcaster } from "./ws.js";
@@ -34,6 +35,14 @@ type PinboxDoEnv = {
   JWT_ISSUER?: string;
   JWT_JWKS_URL?: string;
   JWT_AUDIENCE?: string;
+  GITHUB_APP_ID?: string;
+  GITHUB_APP_PRIVATE_KEY?: string;
+  GITHUB_INSTALLATION_ID?: string;
+  GITHUB_REPO?: string;
+  GITHUB_API_BASE?: string;
+  GITHUB_WEBHOOK_SECRET?: string;
+  SLACK_BOT_TOKEN?: string;
+  SLACK_CHANNEL?: string;
   MEDIA?: R2Bucket;
   R2_ACCOUNT_ID?: string;
   R2_BUCKET?: string;
@@ -46,6 +55,12 @@ declare class DoBroadcaster implements Broadcaster {
   publish(topic: string, data: string): void;
   subscriberCount(topic: string): number;
 }
+/**
+ * The cloud connector set, from the environment: github when the App quartet is present,
+ * slack when its pair is. A partial quartet is ignored rather than half-configured — the
+ * link route then answers 502 E_CONNECTOR with the `pinbox doctor` hint, as with no config.
+ */
+declare function buildConnectors(env: PinboxDoEnv): Connector[];
 declare class PinboxHubDO {
   readonly store: DoPinStore;
   readonly broadcaster: DoBroadcaster;
@@ -56,9 +71,16 @@ declare class PinboxHubDO {
   private readonly handler;
   /** Undefined when no adapter is configured — the hub then stores pins and delivers nothing. */
   private readonly router;
+  /** Host-injected tracker connectors (github via App token, slack); empty ⇒ link routes 502. */
+  private readonly connectors;
   constructor(ctx: DurableObjectState, env: PinboxDoEnv);
   fetch(req: Request): Promise<Response>;
   private intercept;
+  /**
+   * GitHub cannot present our credential: the HMAC signature is this route's whole auth
+   * (github-webhook.ts), so it sits outside the bearer/JWT gate. Unconfigured ⇒ falls to 404.
+   */
+  private githubWebhook;
   webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): void;
   webSocketClose(_ws: WebSocket, _code: number, _reason: string, _wasClean: boolean): void;
   /**
@@ -69,6 +91,8 @@ declare class PinboxHubDO {
   alarm(): Promise<void>;
   /** Re-arm while work remains. Setting an alarm that already exists is a no-op. */
   private scheduleDrain;
+  /** Any delivery row pending, or any linked pin with a poll deadline set. */
+  private hasPendingWork;
   private upgrade;
   private protocolError;
   private unauthorized;
@@ -76,4 +100,4 @@ declare class PinboxHubDO {
   private serveMedia;
 }
 //#endregion
-export { DoBroadcaster, PinboxDoEnv, PinboxHubDO };
+export { DoBroadcaster, PinboxDoEnv, PinboxHubDO, buildConnectors };

package/dist/do.js

@@ -1,10 +1,13 @@
 import { AttachmentSchema, PinInputSchema, PinSchema, SessionRefSchema, ThreadMessageSchema } from "./schema.js";
 import { a as NotFoundError, i as ConflictError, o as newId, t as SessionSchema } from "./sessions-DrCVTMfI.js";
 import { t as MIGRATIONS } from "./store-IR3o5YwY.js";
-import { n as createHubHandler, o as ok, r as err } from "./hub-I67BuX9S.js";
+import { r as drainConnectorPolls } from "./poll-ZSv3wN9C.js";
+import { n as createHubHandler, o as ok, r as err } from "./hub-D-cHpKmA.js";
 import { ClientHelloSchema, WS_CLOSE_PROTOCOL, WS_CLOSE_UNAUTHORIZED, WS_TOKEN_SUBPROTOCOL_PREFIX, encodeWsEvent } from "./ws-protocol.js";
 import { n as DeliveryRouter } from "./router-BH74psWn.js";
 import { createWebhookAdapter } from "./delivery/webhook.js";
+import { n as createSlackTransport, o as createGithubAppTransport, r as handleGithubWebhook, t as createSlackConnector } from "./slack-C4P0AbuZ.js";
+import { createGithubConnector } from "./connectors/github.js";
 import { i as verifyJwt, n as verifyNone, r as verifyToken } from "./verify-BDt9d9Np.js";
 //#region src/do-store-registries.ts
 function parseSession(json) {
@@ -561,6 +564,8 @@ var DoBroadcaster = class {
 		return this.state.getWebSockets(topic).length;
 	}
 };
+/** Hub-root path of the GitHub webhook receiver (`/_pinbox/webhooks/github` on the Worker). */
+const WEBHOOK_PATH = "/webhooks/github";
 /** Retry cadence for the delivery queue. Coarse: the receiver being down is not urgent. */
 const DRAIN_INTERVAL_MS = 3e4;
 /** Later than any due_at this hub can write, so `due()` answers "anything pending?". */
@@ -583,6 +588,24 @@ function buildRouter(store, env) {
 		})]
 	});
 }
+/**
+* The cloud connector set, from the environment: github when the App quartet is present,
+* slack when its pair is. A partial quartet is ignored rather than half-configured — the
+* link route then answers 502 E_CONNECTOR with the `pinbox doctor` hint, as with no config.
+*/
+function buildConnectors(env) {
+	const out = [];
+	const present = (v) => v !== void 0 && v !== "";
+	if (present(env.GITHUB_APP_ID) && present(env.GITHUB_APP_PRIVATE_KEY) && present(env.GITHUB_INSTALLATION_ID) && present(env.GITHUB_REPO)) out.push(createGithubConnector(createGithubAppTransport({
+		appId: env.GITHUB_APP_ID,
+		privateKeyPem: env.GITHUB_APP_PRIVATE_KEY,
+		installationId: env.GITHUB_INSTALLATION_ID,
+		repo: env.GITHUB_REPO,
+		...present(env.GITHUB_API_BASE) ? { apiBase: env.GITHUB_API_BASE } : {}
+	})));
+	if (present(env.SLACK_BOT_TOKEN) && present(env.SLACK_CHANNEL)) out.push(createSlackConnector(createSlackTransport({ botToken: env.SLACK_BOT_TOKEN }), { channel: env.SLACK_CHANNEL }));
+	return out;
+}
 var PinboxHubDO = class {
 	store;
 	broadcaster;
@@ -593,6 +616,8 @@ var PinboxHubDO = class {
 	handler;
 	/** Undefined when no adapter is configured — the hub then stores pins and delivers nothing. */
 	router;
+	/** Host-injected tracker connectors (github via App token, slack); empty ⇒ link routes 502. */
+	connectors;
 	constructor(ctx, env) {
 		this.ctx = ctx;
 		this.env = env;
@@ -600,10 +625,12 @@ var PinboxHubDO = class {
 		this.topic = `project:${ctx.id.name ?? ctx.id.toString()}`;
 		this.broadcaster = new DoBroadcaster(ctx);
 		this.strategy = buildStrategy(env);
+		this.connectors = buildConnectors(env);
 		this.handler = createHubHandler({
 			store: this.store,
 			token: env.PINBOX_TOKEN ?? "",
-			..."verify" in this.strategy ? { verify: this.strategy.verify } : {}
+			..."verify" in this.strategy ? { verify: this.strategy.verify } : {},
+			...this.connectors.length > 0 ? { connectors: this.connectors } : {}
 		});
 		this.store.subscribe((event) => this.broadcaster.publish(this.topic, encodeWsEvent(event)));
 		this.router = buildRouter(this.store, env);
@@ -614,6 +641,10 @@ var PinboxHubDO = class {
 			});
 			this.scheduleDrain();
 		}
+		if (this.connectors.length > 0) {
+			this.store.subscribe(() => void this.scheduleDrain());
+			this.scheduleDrain();
+		}
 		ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair("ping", "pong"));
 	}
 	async fetch(req) {
@@ -624,11 +655,25 @@ var PinboxHubDO = class {
 		return await this.intercept(req, url, verify) ?? this.handler(req);
 	}
 	async intercept(req, url, verify) {
+		if (req.method === "POST" && url.pathname === WEBHOOK_PATH) return this.githubWebhook(req);
 		if (req.method === "POST" && url.pathname === "/attachments") return await this.unauthorized(verify, req) ?? this.createAttachment(req, url);
 		const mediaKey = /^\/media\/([^/]+)$/.exec(url.pathname)?.[1];
 		if (req.method === "GET" && mediaKey !== void 0) return await this.unauthorized(verify, req) ?? this.serveMedia(mediaKey);
 		return null;
 	}
+	/**
+	* GitHub cannot present our credential: the HMAC signature is this route's whole auth
+	* (github-webhook.ts), so it sits outside the bearer/JWT gate. Unconfigured ⇒ falls to 404.
+	*/
+	githubWebhook(req) {
+		const secret = this.env.GITHUB_WEBHOOK_SECRET;
+		const repo = this.env.GITHUB_REPO;
+		if (secret === void 0 || secret === "" || repo === void 0 || repo === "") return null;
+		return handleGithubWebhook(req, this.store, {
+			secret,
+			repo
+		});
+	}
 	webSocketMessage(ws, message) {
 		if (typeof message !== "string") {
 			this.protocolError(ws, "binary frames are not part of protocol 1");
@@ -677,17 +722,21 @@ var PinboxHubDO = class {
 	* DO has been unloaded and woken again.
 	*/
 	async alarm() {
-		if (this.router === void 0) return;
-		await this.router.drainDue();
+		if (this.router !== void 0) await this.router.drainDue();
+		if (this.connectors.length > 0) await drainConnectorPolls(this.store, this.connectors);
 		await this.scheduleDrain();
 	}
 	/** Re-arm while work remains. Setting an alarm that already exists is a no-op. */
 	async scheduleDrain() {
-		if (this.router === void 0) return;
-		if (this.store.deliveries.due(FAR_FUTURE).length === 0) return;
+		if (!this.hasPendingWork()) return;
 		if (await this.ctx.storage.getAlarm() !== null) return;
 		await this.ctx.storage.setAlarm(Date.now() + DRAIN_INTERVAL_MS);
 	}
+	/** Any delivery row pending, or any linked pin with a poll deadline set. */
+	hasPendingWork() {
+		if (this.router !== void 0 && this.store.deliveries.due(FAR_FUTURE).length > 0) return true;
+		return this.connectors.length > 0 && this.store.pinsDueBefore(FAR_FUTURE).length > 0;
+	}
 	async upgrade(req, url, verify) {
 		let token = url.searchParams.get("token");
 		let acceptedProtocol;
@@ -763,4 +812,4 @@ var PinboxHubDO = class {
 	}
 };
 //#endregion
-export { DoBroadcaster, PinboxHubDO };
+export { DoBroadcaster, PinboxHubDO, buildConnectors };

package/dist/{hub-I67BuX9S.js → hub-D-cHpKmA.js}

@@ -1,6 +1,6 @@
 import { AppliedEditSchema, AttachmentSchema, PinInputSchema, SessionRefSchema } from "./schema.js";
 import { a as NotFoundError, i as ConflictError, o as newId } from "./sessions-DrCVTMfI.js";
-import { t as POLL_OPEN_MS } from "./poll-BrcAuaAz.js";
+import { t as POLL_OPEN_MS } from "./poll-ZSv3wN9C.js";
 import { t as buildInjectionContext } from "./context-BHcEpzVb.js";
 import { z } from "zod";
 //#region src/routes-links.ts

package/dist/hub-server.js

@@ -1,4 +1,4 @@
-import { c as registerAttachmentSink, n as createHubHandler } from "./hub-I67BuX9S.js";
+import { c as registerAttachmentSink, n as createHubHandler } from "./hub-D-cHpKmA.js";
 import { ClientHelloSchema, WS_CLOSE_PROTOCOL, WS_CLOSE_UNAUTHORIZED, WS_TOKEN_SUBPROTOCOL_PREFIX, encodeWsEvent } from "./ws-protocol.js";
 //#region src/attachments-local.ts
 const EXTENSIONS = {

package/dist/hub.js

@@ -1,2 +1,2 @@
-import { a as mustGetPin, i as match, n as createHubHandler, o as ok, r as err, s as readJson, t as BodyNotJsonError } from "./hub-I67BuX9S.js";
+import { a as mustGetPin, i as match, n as createHubHandler, o as ok, r as err, s as readJson, t as BodyNotJsonError } from "./hub-D-cHpKmA.js";
 export { BodyNotJsonError, createHubHandler, err, match, mustGetPin, ok, readJson };

package/dist/{poll-BrcAuaAz.js → poll-ZSv3wN9C.js}

@@ -249,4 +249,4 @@ function advances(next, current) {
 	return current === null || next > current;
 }
 //#endregion
-export { outboundCandidates as a, createConnectorEvents as i, POLL_RESOLVED_MS as n, drainConnectorPolls as r, POLL_OPEN_MS as t };
+export { createConnectorEvents as a, inboundEvents as i, POLL_RESOLVED_MS as n, outboundCandidates as o, drainConnectorPolls as r, POLL_OPEN_MS as t };

package/dist/slack-C4P0AbuZ.js

@@ -0,0 +1,455 @@
+import { i as inboundEvents } from "./poll-ZSv3wN9C.js";
+import { pinsToMarkdown } from "./markdown.js";
+import { z } from "zod";
+import { SignJWT, importPKCS8 } from "jose";
+//#region src/connectors/github-app.ts
+const API_VERSION = "2022-11-28";
+const USER_AGENT = "pinbox";
+/** Mint a fresh installation token this close to expiry. */
+const REFRESH_MARGIN_MS = 6e4;
+/** App JWTs may live 10 minutes; nine leaves room for clock skew on GitHub's side. */
+const APP_JWT_TTL_S = 540;
+const COMMENTS_PER_PAGE = 100;
+const MAX_COMMENT_PAGES = 10;
+/** Ops that address an existing issue by number. */
+const NUMBERED_OPS = /* @__PURE__ */ new Set([
+	"issue.comment",
+	"issue.view",
+	"issue.close",
+	"issue.reopen"
+]);
+/** A transport failure carrying the hint the link route surfaces as E_CONNECTOR. */
+var GithubAppError = class extends Error {
+	hint;
+	status;
+	constructor(message, status, hint) {
+		super(message);
+		this.name = "GithubAppError";
+		this.status = status;
+		this.hint = hint;
+	}
+};
+/** The App's own credential: a short-lived RS256 JWT with `iss` = app id. */
+async function signAppJwt(appId, privateKeyPem, now = () => Date.now()) {
+	const key = await importPKCS8(toPkcs8Pem(privateKeyPem), "RS256");
+	const iat = Math.floor(now() / 1e3) - 60;
+	return new SignJWT({}).setProtectedHeader({
+		alg: "RS256",
+		typ: "JWT"
+	}).setIssuer(appId).setIssuedAt(iat).setExpirationTime(iat + 60 + APP_JWT_TTL_S).sign(key);
+}
+/** GitHub's standard request headers for the REST API. */
+function githubHeaders(bearer, json = false) {
+	return headers(bearer, json);
+}
+/** Exchange an App JWT for a one-hour installation token. */
+async function mintInstallationToken(api, installationId, appJwt, fetchImpl) {
+	const res = await fetchImpl(`${api}/app/installations/${installationId}/access_tokens`, {
+		method: "POST",
+		headers: headers(appJwt)
+	});
+	if (!res.ok) throw new GithubAppError(`GitHub App token request failed: HTTP ${res.status}`, res.status, res.status === 401 ? "check GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY belong to the same App" : res.status === 404 ? "check GITHUB_INSTALLATION_ID — the App may not be installed on this repo's owner" : void 0);
+	const body = await res.json();
+	if (typeof body.token !== "string" || typeof body.expires_at !== "string") throw new GithubAppError("GitHub App token response was not { token, expires_at }", 502);
+	return {
+		token: body.token,
+		expiresAt: Date.parse(body.expires_at)
+	};
+}
+function createGithubAppTransport(opts) {
+	const fetchImpl = opts.fetchImpl ?? ((input, init) => fetch(input, init));
+	const now = opts.now ?? (() => Date.now());
+	const api = (opts.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
+	const repo = opts.repo.replace(/^\/+|\/+$/g, "");
+	if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) throw new GithubAppError(`GITHUB_REPO must be "owner/name", got "${opts.repo}"`, 0);
+	let cached = null;
+	async function installationToken() {
+		if (cached !== null && cached.expiresAt - now() > REFRESH_MARGIN_MS) return cached.token;
+		const jwt = await signAppJwt(opts.appId, opts.privateKeyPem, now);
+		cached = await mintInstallationToken(api, opts.installationId, jwt, fetchImpl);
+		return cached.token;
+	}
+	async function call(method, path, body) {
+		const res = await fetchImpl(`${api}${path}`, {
+			method,
+			headers: headers(await installationToken(), body !== void 0),
+			...body === void 0 ? {} : { body: JSON.stringify(body) }
+		});
+		if (!res.ok) {
+			const detail = await res.text().catch(() => "");
+			if (res.status === 401) cached = null;
+			throw new GithubAppError(`GitHub ${method} ${path} failed: HTTP ${res.status}${detail ? ` — ${detail.slice(0, 200)}` : ""}`, res.status, res.status === 403 || res.status === 404 ? `check the App is installed on ${repo} with Issues: read & write` : void 0);
+		}
+		return await res.json();
+	}
+	async function allComments(number) {
+		const out = [];
+		for (let page = 1; page <= MAX_COMMENT_PAGES; page += 1) {
+			const batch = await call("GET", `/repos/${repo}/issues/${number}/comments?per_page=${COMMENTS_PER_PAGE}&page=${page}`);
+			out.push(...batch);
+			if (batch.length < COMMENTS_PER_PAGE) break;
+		}
+		return out;
+	}
+	return { request: (op, params) => dispatch(op, params, {
+		repo,
+		call,
+		allComments
+	}) };
+}
+/** The pinned op vocabulary (github.ts) over GitHub's REST paths. */
+async function dispatch(op, params, api) {
+	const { repo, call } = api;
+	const number = Number(params["number"]);
+	if (NUMBERED_OPS.has(op) && (!Number.isInteger(number) || number <= 0)) throw new GithubAppError(`github ${op} needs a positive issue number`, 0);
+	switch (op) {
+		case "issue.create": {
+			const issue = await call("POST", `/repos/${repo}/issues`, {
+				title: params["title"],
+				body: params["body"]
+			});
+			return {
+				number: issue.number,
+				url: issue.html_url
+			};
+		}
+		case "issue.comment":
+			await call("POST", `/repos/${repo}/issues/${number}/comments`, { body: params["body"] });
+			return;
+		case "issue.view": {
+			const issue = await call("GET", `/repos/${repo}/issues/${number}`);
+			const comments = await api.allComments(number);
+			return {
+				state: issue.state === "closed" ? "closed" : "open",
+				comments: comments.map((c) => ({
+					author: c.user?.login ?? "ghost",
+					body: c.body ?? "",
+					createdAt: c.created_at
+				}))
+			};
+		}
+		case "issue.close":
+			await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "closed" });
+			return;
+		case "issue.reopen":
+			await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "open" });
+			return;
+		default: throw new GithubAppError(`unknown github op: ${op}`, 0);
+	}
+}
+function headers(bearer, json = false) {
+	return {
+		authorization: `Bearer ${bearer}`,
+		accept: "application/vnd.github+json",
+		"x-github-api-version": API_VERSION,
+		"user-agent": USER_AGENT,
+		...json ? { "content-type": "application/json" } : {}
+	};
+}
+/** PKCS#8 PEM in, PKCS#8 PEM out; PKCS#1 PEM (GitHub's download) is wrapped into PKCS#8. */
+function toPkcs8Pem(pem) {
+	const trimmed = pem.trim();
+	if (trimmed.includes("BEGIN PRIVATE KEY")) return trimmed;
+	if (!trimmed.includes("BEGIN RSA PRIVATE KEY")) throw new GithubAppError("GITHUB_APP_PRIVATE_KEY is not a PEM private key", 0, "paste the whole file GitHub downloaded, \"-----BEGIN RSA PRIVATE KEY-----\" through the END line");
+	return toPem("PRIVATE KEY", pkcs1ToPkcs8(pemBody(trimmed)));
+}
+function pemBody(pem) {
+	const b64 = pem.split("\n").filter((line) => !line.startsWith("-----")).join("").replace(/\s+/g, "");
+	const bin = atob(b64);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+	return out;
+}
+function toPem(label, der) {
+	let bin = "";
+	for (const b of der) bin += String.fromCharCode(b);
+	return `-----BEGIN ${label}-----\n${btoa(bin).replace(/(.{64})/g, "$1\n").trimEnd()}\n-----END ${label}-----`;
+}
+/** rsaEncryption AlgorithmIdentifier: SEQUENCE { OID 1.2.840.113549.1.1.1, NULL }. */
+const RSA_ALGORITHM = new Uint8Array([
+	48,
+	13,
+	6,
+	9,
+	42,
+	134,
+	72,
+	134,
+	247,
+	13,
+	1,
+	1,
+	1,
+	5,
+	0
+]);
+const VERSION_ZERO = new Uint8Array([
+	2,
+	1,
+	0
+]);
+/** PrivateKeyInfo ::= SEQUENCE { version 0, algorithm rsaEncryption, privateKey OCTET STRING }. */
+function pkcs1ToPkcs8(pkcs1) {
+	return derTlv(48, concat(VERSION_ZERO, RSA_ALGORITHM, derTlv(4, pkcs1)));
+}
+function derTlv(tag, body) {
+	const len = body.length;
+	let header;
+	if (len < 128) header = [tag, len];
+	else {
+		const bytes = [];
+		for (let v = len; v > 0; v = Math.floor(v / 256)) bytes.unshift(v & 255);
+		header = [
+			tag,
+			128 | bytes.length,
+			...bytes
+		];
+	}
+	return concat(new Uint8Array(header), body);
+}
+function concat(...parts) {
+	const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+	let at = 0;
+	for (const p of parts) {
+		out.set(p, at);
+		at += p.length;
+	}
+	return out;
+}
+//#endregion
+//#region src/connectors/github-webhook.ts
+/** Trailer marking bodies pinbox itself wrote (github.ts); never mirror those back in. */
+const PINBOX_TRAILER = "— pinbox";
+/**
+* Handle one webhook delivery. Returns the hub's machine envelope: 200 with
+* `{ applied, ignored }`, 401 `E_AUTH` on a signature failure, 400 `E_INVALID_INPUT` on a
+* body GitHub would never send.
+*/
+async function handleGithubWebhook(req, store, opts) {
+	const raw = await req.text();
+	const signature = req.headers.get("x-hub-signature-256");
+	if (!await signatureValid(opts.secret, raw, signature)) return envelope(401, {
+		code: "E_AUTH",
+		message: "webhook signature missing or invalid",
+		hint: "the App's webhook secret must equal GITHUB_WEBHOOK_SECRET on the hub"
+	});
+	let payload;
+	try {
+		payload = JSON.parse(raw);
+	} catch {
+		return envelope(400, {
+			code: "E_INVALID_INPUT",
+			message: "webhook body is not JSON"
+		});
+	}
+	const event = req.headers.get("x-github-event") ?? "";
+	return envelope(200, void 0, await apply(store, opts.repo, event, payload));
+}
+async function apply(store, repo, event, payload) {
+	if (event === "ping") return {
+		applied: 0,
+		ignored: "ping"
+	};
+	if (event !== "issues" && event !== "issue_comment") return {
+		applied: 0,
+		ignored: `event ${event}`
+	};
+	const body = payload;
+	const fullName = body.repository?.full_name;
+	if (typeof fullName !== "string" || fullName.toLowerCase() !== repo.toLowerCase()) return {
+		applied: 0,
+		ignored: `repository ${fullName ?? "?"}`
+	};
+	const number = body.issue?.number;
+	if (typeof number !== "number") return {
+		applied: 0,
+		ignored: "no issue"
+	};
+	const row = store.links.all().find((r) => r.link.connector === "github" && r.link.ref === String(number));
+	if (row === void 0) return {
+		applied: 0,
+		ignored: `issue #${number} is not linked`
+	};
+	const { events } = inboundEvents(store, row.pinId, "github", false);
+	return event === "issue_comment" ? applyComment(body, row.link, events) : applyStatus(body, row.link, events);
+}
+async function applyComment(body, link, events) {
+	if (body.action !== "created") return {
+		applied: 0,
+		ignored: `issue_comment ${body.action}`
+	};
+	const comment = body.comment;
+	const text = comment?.body ?? "";
+	if (isOwnMirror(text) || comment?.user?.type === "Bot") return {
+		applied: 0,
+		ignored: "own mirror"
+	};
+	await events.onRemoteComment(link, {
+		origin: `github:${comment?.user?.login ?? "ghost"}`,
+		text,
+		at: comment?.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
+	});
+	return {
+		applied: 1,
+		ignored: null
+	};
+}
+async function applyStatus(body, link, events) {
+	if (body.action === "closed") {
+		await events.onRemoteStatus(link, "closed");
+		return {
+			applied: 1,
+			ignored: null
+		};
+	}
+	if (body.action === "reopened") {
+		await events.onRemoteStatus(link, "open");
+		return {
+			applied: 1,
+			ignored: null
+		};
+	}
+	return {
+		applied: 0,
+		ignored: `issues ${body.action}`
+	};
+}
+function isOwnMirror(text) {
+	return (text.trimEnd().split("\n").at(-1) ?? "").startsWith(PINBOX_TRAILER);
+}
+/** `sha256=<hex hmac>` over the raw body, compared in constant time. */
+async function signatureValid(secret, rawBody, header) {
+	if (header === null || !header.startsWith("sha256=")) return false;
+	const expected = await hmacHex(secret, rawBody);
+	return timingSafeEqual(header.slice(7), expected);
+}
+async function hmacHex(secret, body) {
+	const enc = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", enc.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(body)));
+	let hex = "";
+	for (const b of sig) hex += b.toString(16).padStart(2, "0");
+	return hex;
+}
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+function envelope(status, error, data) {
+	return new Response(JSON.stringify(error === void 0 ? {
+		ok: true,
+		data
+	} : {
+		ok: false,
+		error
+	}), {
+		status,
+		headers: { "content-type": "application/json; charset=utf-8" }
+	});
+}
+//#endregion
+//#region src/connectors/slack.ts
+/**
+* request(op, params) → POST https://slack.com/api/<op> (JSON, bearer botToken).
+* Slack's `{ok:false, error}` becomes a rejection carrying the Slack error string —
+* the route layer surfaces it as 502 E_CONNECTOR.
+*/
+function createSlackTransport(opts) {
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	return { async request(op, params) {
+		const res = await fetchImpl(`https://slack.com/api/${op}`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${opts.botToken}`,
+				"content-type": "application/json; charset=utf-8"
+			},
+			body: JSON.stringify(params)
+		});
+		if (!res.ok) throw new Error(`slack ${op} failed: HTTP ${res.status}`);
+		const data = await res.json();
+		const envelope = SlackEnvelopeSchema.parse(data);
+		if (!envelope.ok) throw new Error(`slack ${op} failed: ${envelope.error ?? "unknown_error"}`);
+		return data;
+	} };
+}
+/** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
+function createSlackConnector(transport, opts) {
+	return {
+		name: "slack",
+		async createItem(pin, thread) {
+			const text = [pinsToMarkdown([pin], "standard"), ...thread.map((m) => `${m.role}: ${m.text}`)].join("\n").trimEnd();
+			const posted = PostMessageSchema.parse(await transport.request("chat.postMessage", {
+				channel: opts.channel,
+				text
+			}));
+			const channel = posted.channel ?? opts.channel;
+			const permalink = PermalinkSchema.parse(await transport.request("chat.getPermalink", {
+				channel,
+				message_ts: posted.ts
+			}));
+			return {
+				connector: "slack",
+				ref: `${channel}/${posted.ts}`,
+				url: permalink.permalink
+			};
+		},
+		async postComment(link, message) {
+			const { channel, ts } = parseRef(link.ref);
+			await transport.request("chat.postMessage", {
+				channel,
+				thread_ts: ts,
+				text: message.text
+			});
+		},
+		async sync(link, events) {
+			const { channel, ts } = parseRef(link.ref);
+			const replies = RepliesSchema.parse(await transport.request("conversations.replies", {
+				channel,
+				ts
+			}));
+			for (const reply of replies.messages) {
+				if (reply.ts === ts) continue;
+				const atMs = slackTsToMs(reply.ts);
+				await events.onRemoteComment(link, {
+					origin: `slack:${reply.user}`,
+					text: reply.text ?? "",
+					at: new Date(atMs).toISOString()
+				});
+			}
+		},
+		async setRemoteStatus() {}
+	};
+}
+const SlackEnvelopeSchema = z.looseObject({
+	ok: z.boolean(),
+	error: z.string().optional()
+});
+const PostMessageSchema = z.looseObject({
+	channel: z.string().optional(),
+	ts: z.string()
+});
+const PermalinkSchema = z.looseObject({ permalink: z.string() });
+const RepliesSchema = z.looseObject({ messages: z.array(z.looseObject({
+	ts: z.string(),
+	user: z.string(),
+	text: z.string().optional()
+})) });
+function parseRef(ref) {
+	const slash = ref.indexOf("/");
+	if (slash <= 0 || slash === ref.length - 1) throw new Error(`slack link ref must be "<channel>/<thread_ts>", got "${ref}"`);
+	return {
+		channel: ref.slice(0, slash),
+		ts: ref.slice(slash + 1)
+	};
+}
+/** Slack ts is "<epoch-seconds>.<suffix>" — epoch milliseconds for the reported `at`. */
+function slackTsToMs(ts) {
+	return Number(ts) * 1e3;
+}
+//#endregion
+export { GithubAppError as a, mintInstallationToken as c, toPkcs8Pem as d, signatureValid as i, pkcs1ToPkcs8 as l, createSlackTransport as n, createGithubAppTransport as o, handleGithubWebhook as r, githubHeaders as s, createSlackConnector as t, signAppJwt as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autono/pinbox-core",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "type": "module",
   "license": "MIT",
   "repository": {