@autono/pinbox-core 0.18.0 → 0.19.0

package/dist/connectors/index.d.ts

@@ -25,12 +25,38 @@ declare class GithubAppError extends Error {
   readonly status: number;
   constructor(message: string, status: number, hint?: string);
 }
+/** The App's own credential: a short-lived RS256 JWT with `iss` = app id. */
+declare function signAppJwt(appId: string, privateKeyPem: string, now?: () => number): Promise<string>;
+/** GitHub's standard request headers for the REST API. */
+declare function githubHeaders(bearer: string, json?: boolean): Record<string, string>;
+type InstallationToken = {
+  token: string;
+  expiresAt: number;
+};
+/** Exchange an App JWT for a one-hour installation token. */
+declare function mintInstallationToken(api: string, installationId: string, appJwt: string, fetchImpl: FetchLike): Promise<InstallationToken>;
 declare function createGithubAppTransport(opts: GithubAppTransportOptions): ConnectorTransport;
 /** PKCS#8 PEM in, PKCS#8 PEM out; PKCS#1 PEM (GitHub's download) is wrapped into PKCS#8. */
 declare function toPkcs8Pem(pem: string): string;
 /** PrivateKeyInfo ::= SEQUENCE { version 0, algorithm rsaEncryption, privateKey OCTET STRING }. */
 declare function pkcs1ToPkcs8(pkcs1: Uint8Array): Uint8Array;
 //#endregion
+//#region src/connectors/github-webhook.d.ts
+type GithubWebhookOptions = {
+  /** The webhook secret configured on the App — HMAC-SHA256 key for the signature. */
+  secret: string;
+  /** "owner/name": events for any other repository are acknowledged and ignored. */
+  repo: string;
+};
+/**
+ * Handle one webhook delivery. Returns the hub's machine envelope: 200 with
+ * `{ applied, ignored }`, 401 `E_AUTH` on a signature failure, 400 `E_INVALID_INPUT` on a
+ * body GitHub would never send.
+ */
+declare function handleGithubWebhook(req: Request, store: PinStore, opts: GithubWebhookOptions): Promise<Response>;
+/** `sha256=<hex hmac>` over the raw body, compared in constant time. */
+declare function signatureValid(secret: string, rawBody: string, header: string | null): Promise<boolean>;
+//#endregion
 //#region src/connectors/mirror.d.ts
 declare function createConnectorEvents(store: PinStore, pinId: string): ConnectorEvents;
 /**
@@ -64,4 +90,4 @@ type SlackConnectorOptions = {
 /** Links are `ref: "<channel>/<thread_ts>"`; every thread op derives channel + ts from the ref. */
 declare function createSlackConnector(transport: ConnectorTransport, opts: SlackConnectorOptions): Connector;
 //#endregion
-export { Connector, ConnectorEvents, ConnectorTransport, FetchLike, GithubAppError, GithubAppTransportOptions, POLL_OPEN_MS, POLL_RESOLVED_MS, RemoteComment, RemoteStatus, SlackConnectorOptions, SlackTransportOptions, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates, pkcs1ToPkcs8, toPkcs8Pem };
+export { Connector, ConnectorEvents, ConnectorTransport, FetchLike, GithubAppError, GithubAppTransportOptions, GithubWebhookOptions, InstallationToken, POLL_OPEN_MS, POLL_RESOLVED_MS, RemoteComment, RemoteStatus, SlackConnectorOptions, SlackTransportOptions, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, githubHeaders, handleGithubWebhook, mintInstallationToken, outboundCandidates, pkcs1ToPkcs8, signAppJwt, signatureValid, toPkcs8Pem };

package/dist/connectors/index.js

@@ -1,3 +1,3 @@
-import { a as outboundCandidates, i as createConnectorEvents, n as POLL_RESOLVED_MS, r as drainConnectorPolls, t as POLL_OPEN_MS } from "../poll-BrcAuaAz.js";
-import { a as pkcs1ToPkcs8, i as createGithubAppTransport, n as createSlackTransport, o as toPkcs8Pem, r as GithubAppError, t as createSlackConnector } from "../slack-Dnq9bnXd.js";
-export { GithubAppError, POLL_OPEN_MS, POLL_RESOLVED_MS, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, outboundCandidates, pkcs1ToPkcs8, toPkcs8Pem };
+import { a as createConnectorEvents, n as POLL_RESOLVED_MS, o as outboundCandidates, r as drainConnectorPolls, t as POLL_OPEN_MS } from "../poll-ZSv3wN9C.js";
+import { a as GithubAppError, c as mintInstallationToken, d as toPkcs8Pem, i as signatureValid, l as pkcs1ToPkcs8, n as createSlackTransport, o as createGithubAppTransport, r as handleGithubWebhook, s as githubHeaders, t as createSlackConnector, u as signAppJwt } from "../slack-C4P0AbuZ.js";
+export { GithubAppError, POLL_OPEN_MS, POLL_RESOLVED_MS, createConnectorEvents, createGithubAppTransport, createSlackConnector, createSlackTransport, drainConnectorPolls, githubHeaders, handleGithubWebhook, mintInstallationToken, outboundCandidates, pkcs1ToPkcs8, signAppJwt, signatureValid, toPkcs8Pem };

package/dist/do.d.ts

@@ -40,6 +40,7 @@ type PinboxDoEnv = {
   GITHUB_INSTALLATION_ID?: string;
   GITHUB_REPO?: string;
   GITHUB_API_BASE?: string;
+  GITHUB_WEBHOOK_SECRET?: string;
   SLACK_BOT_TOKEN?: string;
   SLACK_CHANNEL?: string;
   MEDIA?: R2Bucket;
@@ -75,6 +76,11 @@ declare class PinboxHubDO {
   constructor(ctx: DurableObjectState, env: PinboxDoEnv);
   fetch(req: Request): Promise<Response>;
   private intercept;
+  /**
+   * GitHub cannot present our credential: the HMAC signature is this route's whole auth
+   * (github-webhook.ts), so it sits outside the bearer/JWT gate. Unconfigured ⇒ falls to 404.
+   */
+  private githubWebhook;
   webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): void;
   webSocketClose(_ws: WebSocket, _code: number, _reason: string, _wasClean: boolean): void;
   /**

package/dist/do.js

@@ -1,12 +1,12 @@
 import { AttachmentSchema, PinInputSchema, PinSchema, SessionRefSchema, ThreadMessageSchema } from "./schema.js";
 import { a as NotFoundError, i as ConflictError, o as newId, t as SessionSchema } from "./sessions-DrCVTMfI.js";
 import { t as MIGRATIONS } from "./store-IR3o5YwY.js";
-import { r as drainConnectorPolls } from "./poll-BrcAuaAz.js";
-import { n as createHubHandler, o as ok, r as err } from "./hub-I67BuX9S.js";
+import { r as drainConnectorPolls } from "./poll-ZSv3wN9C.js";
+import { n as createHubHandler, o as ok, r as err } from "./hub-D-cHpKmA.js";
 import { ClientHelloSchema, WS_CLOSE_PROTOCOL, WS_CLOSE_UNAUTHORIZED, WS_TOKEN_SUBPROTOCOL_PREFIX, encodeWsEvent } from "./ws-protocol.js";
 import { n as DeliveryRouter } from "./router-BH74psWn.js";
 import { createWebhookAdapter } from "./delivery/webhook.js";
-import { i as createGithubAppTransport, n as createSlackTransport, t as createSlackConnector } from "./slack-Dnq9bnXd.js";
+import { n as createSlackTransport, o as createGithubAppTransport, r as handleGithubWebhook, t as createSlackConnector } from "./slack-C4P0AbuZ.js";
 import { createGithubConnector } from "./connectors/github.js";
 import { i as verifyJwt, n as verifyNone, r as verifyToken } from "./verify-BDt9d9Np.js";
 //#region src/do-store-registries.ts
@@ -564,6 +564,8 @@ var DoBroadcaster = class {
 		return this.state.getWebSockets(topic).length;
 	}
 };
+/** Hub-root path of the GitHub webhook receiver (`/_pinbox/webhooks/github` on the Worker). */
+const WEBHOOK_PATH = "/webhooks/github";
 /** Retry cadence for the delivery queue. Coarse: the receiver being down is not urgent. */
 const DRAIN_INTERVAL_MS = 3e4;
 /** Later than any due_at this hub can write, so `due()` answers "anything pending?". */
@@ -653,11 +655,25 @@ var PinboxHubDO = class {
 		return await this.intercept(req, url, verify) ?? this.handler(req);
 	}
 	async intercept(req, url, verify) {
+		if (req.method === "POST" && url.pathname === WEBHOOK_PATH) return this.githubWebhook(req);
 		if (req.method === "POST" && url.pathname === "/attachments") return await this.unauthorized(verify, req) ?? this.createAttachment(req, url);
 		const mediaKey = /^\/media\/([^/]+)$/.exec(url.pathname)?.[1];
 		if (req.method === "GET" && mediaKey !== void 0) return await this.unauthorized(verify, req) ?? this.serveMedia(mediaKey);
 		return null;
 	}
+	/**
+	* GitHub cannot present our credential: the HMAC signature is this route's whole auth
+	* (github-webhook.ts), so it sits outside the bearer/JWT gate. Unconfigured ⇒ falls to 404.
+	*/
+	githubWebhook(req) {
+		const secret = this.env.GITHUB_WEBHOOK_SECRET;
+		const repo = this.env.GITHUB_REPO;
+		if (secret === void 0 || secret === "" || repo === void 0 || repo === "") return null;
+		return handleGithubWebhook(req, this.store, {
+			secret,
+			repo
+		});
+	}
 	webSocketMessage(ws, message) {
 		if (typeof message !== "string") {
 			this.protocolError(ws, "binary frames are not part of protocol 1");

package/dist/{hub-I67BuX9S.js → hub-D-cHpKmA.js}

@@ -1,6 +1,6 @@
 import { AppliedEditSchema, AttachmentSchema, PinInputSchema, SessionRefSchema } from "./schema.js";
 import { a as NotFoundError, i as ConflictError, o as newId } from "./sessions-DrCVTMfI.js";
-import { t as POLL_OPEN_MS } from "./poll-BrcAuaAz.js";
+import { t as POLL_OPEN_MS } from "./poll-ZSv3wN9C.js";
 import { t as buildInjectionContext } from "./context-BHcEpzVb.js";
 import { z } from "zod";
 //#region src/routes-links.ts

package/dist/hub-server.js

@@ -1,4 +1,4 @@
-import { c as registerAttachmentSink, n as createHubHandler } from "./hub-I67BuX9S.js";
+import { c as registerAttachmentSink, n as createHubHandler } from "./hub-D-cHpKmA.js";
 import { ClientHelloSchema, WS_CLOSE_PROTOCOL, WS_CLOSE_UNAUTHORIZED, WS_TOKEN_SUBPROTOCOL_PREFIX, encodeWsEvent } from "./ws-protocol.js";
 //#region src/attachments-local.ts
 const EXTENSIONS = {

package/dist/hub.js

@@ -1,2 +1,2 @@
-import { a as mustGetPin, i as match, n as createHubHandler, o as ok, r as err, s as readJson, t as BodyNotJsonError } from "./hub-I67BuX9S.js";
+import { a as mustGetPin, i as match, n as createHubHandler, o as ok, r as err, s as readJson, t as BodyNotJsonError } from "./hub-D-cHpKmA.js";
 export { BodyNotJsonError, createHubHandler, err, match, mustGetPin, ok, readJson };

package/dist/{poll-BrcAuaAz.js → poll-ZSv3wN9C.js}

@@ -249,4 +249,4 @@ function advances(next, current) {
 	return current === null || next > current;
 }
 //#endregion
-export { outboundCandidates as a, createConnectorEvents as i, POLL_RESOLVED_MS as n, drainConnectorPolls as r, POLL_OPEN_MS as t };
+export { createConnectorEvents as a, inboundEvents as i, POLL_RESOLVED_MS as n, outboundCandidates as o, drainConnectorPolls as r, POLL_OPEN_MS as t };

package/dist/{slack-Dnq9bnXd.js → slack-C4P0AbuZ.js}

@@ -1,3 +1,4 @@
+import { i as inboundEvents } from "./poll-ZSv3wN9C.js";
 import { pinsToMarkdown } from "./markdown.js";
 import { z } from "zod";
 import { SignJWT, importPKCS8 } from "jose";
@@ -28,38 +29,44 @@ var GithubAppError = class extends Error {
 		this.hint = hint;
 	}
 };
+/** The App's own credential: a short-lived RS256 JWT with `iss` = app id. */
+async function signAppJwt(appId, privateKeyPem, now = () => Date.now()) {
+	const key = await importPKCS8(toPkcs8Pem(privateKeyPem), "RS256");
+	const iat = Math.floor(now() / 1e3) - 60;
+	return new SignJWT({}).setProtectedHeader({
+		alg: "RS256",
+		typ: "JWT"
+	}).setIssuer(appId).setIssuedAt(iat).setExpirationTime(iat + 60 + APP_JWT_TTL_S).sign(key);
+}
+/** GitHub's standard request headers for the REST API. */
+function githubHeaders(bearer, json = false) {
+	return headers(bearer, json);
+}
+/** Exchange an App JWT for a one-hour installation token. */
+async function mintInstallationToken(api, installationId, appJwt, fetchImpl) {
+	const res = await fetchImpl(`${api}/app/installations/${installationId}/access_tokens`, {
+		method: "POST",
+		headers: headers(appJwt)
+	});
+	if (!res.ok) throw new GithubAppError(`GitHub App token request failed: HTTP ${res.status}`, res.status, res.status === 401 ? "check GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY belong to the same App" : res.status === 404 ? "check GITHUB_INSTALLATION_ID — the App may not be installed on this repo's owner" : void 0);
+	const body = await res.json();
+	if (typeof body.token !== "string" || typeof body.expires_at !== "string") throw new GithubAppError("GitHub App token response was not { token, expires_at }", 502);
+	return {
+		token: body.token,
+		expiresAt: Date.parse(body.expires_at)
+	};
+}
 function createGithubAppTransport(opts) {
 	const fetchImpl = opts.fetchImpl ?? ((input, init) => fetch(input, init));
 	const now = opts.now ?? (() => Date.now());
 	const api = (opts.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
 	const repo = opts.repo.replace(/^\/+|\/+$/g, "");
 	if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) throw new GithubAppError(`GITHUB_REPO must be "owner/name", got "${opts.repo}"`, 0);
-	let keyPromise = null;
 	let cached = null;
-	function key() {
-		keyPromise ??= importPKCS8(toPkcs8Pem(opts.privateKeyPem), "RS256");
-		return keyPromise;
-	}
-	async function appJwt() {
-		const iat = Math.floor(now() / 1e3) - 60;
-		return new SignJWT({}).setProtectedHeader({
-			alg: "RS256",
-			typ: "JWT"
-		}).setIssuer(opts.appId).setIssuedAt(iat).setExpirationTime(iat + 60 + APP_JWT_TTL_S).sign(await key());
-	}
 	async function installationToken() {
 		if (cached !== null && cached.expiresAt - now() > REFRESH_MARGIN_MS) return cached.token;
-		const res = await fetchImpl(`${api}/app/installations/${opts.installationId}/access_tokens`, {
-			method: "POST",
-			headers: headers(await appJwt())
-		});
-		if (!res.ok) throw new GithubAppError(`GitHub App token request failed: HTTP ${res.status}`, res.status, res.status === 401 ? "check GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY belong to the same App" : res.status === 404 ? "check GITHUB_INSTALLATION_ID — the App may not be installed on this repo's owner" : void 0);
-		const body = await res.json();
-		if (typeof body.token !== "string" || typeof body.expires_at !== "string") throw new GithubAppError("GitHub App token response was not { token, expires_at }", 502);
-		cached = {
-			token: body.token,
-			expiresAt: Date.parse(body.expires_at)
-		};
+		const jwt = await signAppJwt(opts.appId, opts.privateKeyPem, now);
+		cached = await mintInstallationToken(api, opts.installationId, jwt, fetchImpl);
 		return cached.token;
 	}
 	async function call(method, path, body) {
@@ -84,44 +91,51 @@ function createGithubAppTransport(opts) {
 		}
 		return out;
 	}
-	return { async request(op, params) {
-		const number = Number(params["number"]);
-		if (NUMBERED_OPS.has(op) && (!Number.isInteger(number) || number <= 0)) throw new GithubAppError(`github ${op} needs a positive issue number`, 0);
-		switch (op) {
-			case "issue.create": {
-				const issue = await call("POST", `/repos/${repo}/issues`, {
-					title: params["title"],
-					body: params["body"]
-				});
-				return {
-					number: issue.number,
-					url: issue.html_url
-				};
-			}
-			case "issue.comment":
-				await call("POST", `/repos/${repo}/issues/${number}/comments`, { body: params["body"] });
-				return;
-			case "issue.view": {
-				const issue = await call("GET", `/repos/${repo}/issues/${number}`);
-				const comments = await allComments(number);
-				return {
-					state: issue.state === "closed" ? "closed" : "open",
-					comments: comments.map((c) => ({
-						author: c.user?.login ?? "ghost",
-						body: c.body ?? "",
-						createdAt: c.created_at
-					}))
-				};
-			}
-			case "issue.close":
-				await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "closed" });
-				return;
-			case "issue.reopen":
-				await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "open" });
-				return;
-			default: throw new GithubAppError(`unknown github op: ${op}`, 0);
+	return { request: (op, params) => dispatch(op, params, {
+		repo,
+		call,
+		allComments
+	}) };
+}
+/** The pinned op vocabulary (github.ts) over GitHub's REST paths. */
+async function dispatch(op, params, api) {
+	const { repo, call } = api;
+	const number = Number(params["number"]);
+	if (NUMBERED_OPS.has(op) && (!Number.isInteger(number) || number <= 0)) throw new GithubAppError(`github ${op} needs a positive issue number`, 0);
+	switch (op) {
+		case "issue.create": {
+			const issue = await call("POST", `/repos/${repo}/issues`, {
+				title: params["title"],
+				body: params["body"]
+			});
+			return {
+				number: issue.number,
+				url: issue.html_url
+			};
 		}
-	} };
+		case "issue.comment":
+			await call("POST", `/repos/${repo}/issues/${number}/comments`, { body: params["body"] });
+			return;
+		case "issue.view": {
+			const issue = await call("GET", `/repos/${repo}/issues/${number}`);
+			const comments = await api.allComments(number);
+			return {
+				state: issue.state === "closed" ? "closed" : "open",
+				comments: comments.map((c) => ({
+					author: c.user?.login ?? "ghost",
+					body: c.body ?? "",
+					createdAt: c.created_at
+				}))
+			};
+		}
+		case "issue.close":
+			await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "closed" });
+			return;
+		case "issue.reopen":
+			await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "open" });
+			return;
+		default: throw new GithubAppError(`unknown github op: ${op}`, 0);
+	}
 }
 function headers(bearer, json = false) {
 	return {
@@ -203,6 +217,142 @@ function concat(...parts) {
 	return out;
 }
 //#endregion
+//#region src/connectors/github-webhook.ts
+/** Trailer marking bodies pinbox itself wrote (github.ts); never mirror those back in. */
+const PINBOX_TRAILER = "— pinbox";
+/**
+* Handle one webhook delivery. Returns the hub's machine envelope: 200 with
+* `{ applied, ignored }`, 401 `E_AUTH` on a signature failure, 400 `E_INVALID_INPUT` on a
+* body GitHub would never send.
+*/
+async function handleGithubWebhook(req, store, opts) {
+	const raw = await req.text();
+	const signature = req.headers.get("x-hub-signature-256");
+	if (!await signatureValid(opts.secret, raw, signature)) return envelope(401, {
+		code: "E_AUTH",
+		message: "webhook signature missing or invalid",
+		hint: "the App's webhook secret must equal GITHUB_WEBHOOK_SECRET on the hub"
+	});
+	let payload;
+	try {
+		payload = JSON.parse(raw);
+	} catch {
+		return envelope(400, {
+			code: "E_INVALID_INPUT",
+			message: "webhook body is not JSON"
+		});
+	}
+	const event = req.headers.get("x-github-event") ?? "";
+	return envelope(200, void 0, await apply(store, opts.repo, event, payload));
+}
+async function apply(store, repo, event, payload) {
+	if (event === "ping") return {
+		applied: 0,
+		ignored: "ping"
+	};
+	if (event !== "issues" && event !== "issue_comment") return {
+		applied: 0,
+		ignored: `event ${event}`
+	};
+	const body = payload;
+	const fullName = body.repository?.full_name;
+	if (typeof fullName !== "string" || fullName.toLowerCase() !== repo.toLowerCase()) return {
+		applied: 0,
+		ignored: `repository ${fullName ?? "?"}`
+	};
+	const number = body.issue?.number;
+	if (typeof number !== "number") return {
+		applied: 0,
+		ignored: "no issue"
+	};
+	const row = store.links.all().find((r) => r.link.connector === "github" && r.link.ref === String(number));
+	if (row === void 0) return {
+		applied: 0,
+		ignored: `issue #${number} is not linked`
+	};
+	const { events } = inboundEvents(store, row.pinId, "github", false);
+	return event === "issue_comment" ? applyComment(body, row.link, events) : applyStatus(body, row.link, events);
+}
+async function applyComment(body, link, events) {
+	if (body.action !== "created") return {
+		applied: 0,
+		ignored: `issue_comment ${body.action}`
+	};
+	const comment = body.comment;
+	const text = comment?.body ?? "";
+	if (isOwnMirror(text) || comment?.user?.type === "Bot") return {
+		applied: 0,
+		ignored: "own mirror"
+	};
+	await events.onRemoteComment(link, {
+		origin: `github:${comment?.user?.login ?? "ghost"}`,
+		text,
+		at: comment?.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
+	});
+	return {
+		applied: 1,
+		ignored: null
+	};
+}
+async function applyStatus(body, link, events) {
+	if (body.action === "closed") {
+		await events.onRemoteStatus(link, "closed");
+		return {
+			applied: 1,
+			ignored: null
+		};
+	}
+	if (body.action === "reopened") {
+		await events.onRemoteStatus(link, "open");
+		return {
+			applied: 1,
+			ignored: null
+		};
+	}
+	return {
+		applied: 0,
+		ignored: `issues ${body.action}`
+	};
+}
+function isOwnMirror(text) {
+	return (text.trimEnd().split("\n").at(-1) ?? "").startsWith(PINBOX_TRAILER);
+}
+/** `sha256=<hex hmac>` over the raw body, compared in constant time. */
+async function signatureValid(secret, rawBody, header) {
+	if (header === null || !header.startsWith("sha256=")) return false;
+	const expected = await hmacHex(secret, rawBody);
+	return timingSafeEqual(header.slice(7), expected);
+}
+async function hmacHex(secret, body) {
+	const enc = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", enc.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(body)));
+	let hex = "";
+	for (const b of sig) hex += b.toString(16).padStart(2, "0");
+	return hex;
+}
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+function envelope(status, error, data) {
+	return new Response(JSON.stringify(error === void 0 ? {
+		ok: true,
+		data
+	} : {
+		ok: false,
+		error
+	}), {
+		status,
+		headers: { "content-type": "application/json; charset=utf-8" }
+	});
+}
+//#endregion
 //#region src/connectors/slack.ts
 /**
 * request(op, params) → POST https://slack.com/api/<op> (JSON, bearer botToken).
@@ -302,4 +452,4 @@ function slackTsToMs(ts) {
 	return Number(ts) * 1e3;
 }
 //#endregion
-export { pkcs1ToPkcs8 as a, createGithubAppTransport as i, createSlackTransport as n, toPkcs8Pem as o, GithubAppError as r, createSlackConnector as t };
+export { GithubAppError as a, mintInstallationToken as c, toPkcs8Pem as d, signatureValid as i, pkcs1ToPkcs8 as l, createSlackTransport as n, createGithubAppTransport as o, handleGithubWebhook as r, githubHeaders as s, createSlackConnector as t, signAppJwt as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autono/pinbox-core",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "type": "module",
   "license": "MIT",
   "repository": {