@autono/pinbox-core 0.18.0 → 0.20.0

package/dist/{slack-Dnq9bnXd.js → slack-C4P0AbuZ.js}

@@ -1,3 +1,4 @@
+import { i as inboundEvents } from "./poll-ZSv3wN9C.js";
 import { pinsToMarkdown } from "./markdown.js";
 import { z } from "zod";
 import { SignJWT, importPKCS8 } from "jose";
@@ -28,38 +29,44 @@ var GithubAppError = class extends Error {
 		this.hint = hint;
 	}
 };
+/** The App's own credential: a short-lived RS256 JWT with `iss` = app id. */
+async function signAppJwt(appId, privateKeyPem, now = () => Date.now()) {
+	const key = await importPKCS8(toPkcs8Pem(privateKeyPem), "RS256");
+	const iat = Math.floor(now() / 1e3) - 60;
+	return new SignJWT({}).setProtectedHeader({
+		alg: "RS256",
+		typ: "JWT"
+	}).setIssuer(appId).setIssuedAt(iat).setExpirationTime(iat + 60 + APP_JWT_TTL_S).sign(key);
+}
+/** GitHub's standard request headers for the REST API. */
+function githubHeaders(bearer, json = false) {
+	return headers(bearer, json);
+}
+/** Exchange an App JWT for a one-hour installation token. */
+async function mintInstallationToken(api, installationId, appJwt, fetchImpl) {
+	const res = await fetchImpl(`${api}/app/installations/${installationId}/access_tokens`, {
+		method: "POST",
+		headers: headers(appJwt)
+	});
+	if (!res.ok) throw new GithubAppError(`GitHub App token request failed: HTTP ${res.status}`, res.status, res.status === 401 ? "check GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY belong to the same App" : res.status === 404 ? "check GITHUB_INSTALLATION_ID — the App may not be installed on this repo's owner" : void 0);
+	const body = await res.json();
+	if (typeof body.token !== "string" || typeof body.expires_at !== "string") throw new GithubAppError("GitHub App token response was not { token, expires_at }", 502);
+	return {
+		token: body.token,
+		expiresAt: Date.parse(body.expires_at)
+	};
+}
 function createGithubAppTransport(opts) {
 	const fetchImpl = opts.fetchImpl ?? ((input, init) => fetch(input, init));
 	const now = opts.now ?? (() => Date.now());
 	const api = (opts.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
 	const repo = opts.repo.replace(/^\/+|\/+$/g, "");
 	if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) throw new GithubAppError(`GITHUB_REPO must be "owner/name", got "${opts.repo}"`, 0);
-	let keyPromise = null;
 	let cached = null;
-	function key() {
-		keyPromise ??= importPKCS8(toPkcs8Pem(opts.privateKeyPem), "RS256");
-		return keyPromise;
-	}
-	async function appJwt() {
-		const iat = Math.floor(now() / 1e3) - 60;
-		return new SignJWT({}).setProtectedHeader({
-			alg: "RS256",
-			typ: "JWT"
-		}).setIssuer(opts.appId).setIssuedAt(iat).setExpirationTime(iat + 60 + APP_JWT_TTL_S).sign(await key());
-	}
 	async function installationToken() {
 		if (cached !== null && cached.expiresAt - now() > REFRESH_MARGIN_MS) return cached.token;
-		const res = await fetchImpl(`${api}/app/installations/${opts.installationId}/access_tokens`, {
-			method: "POST",
-			headers: headers(await appJwt())
-		});
-		if (!res.ok) throw new GithubAppError(`GitHub App token request failed: HTTP ${res.status}`, res.status, res.status === 401 ? "check GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY belong to the same App" : res.status === 404 ? "check GITHUB_INSTALLATION_ID — the App may not be installed on this repo's owner" : void 0);
-		const body = await res.json();
-		if (typeof body.token !== "string" || typeof body.expires_at !== "string") throw new GithubAppError("GitHub App token response was not { token, expires_at }", 502);
-		cached = {
-			token: body.token,
-			expiresAt: Date.parse(body.expires_at)
-		};
+		const jwt = await signAppJwt(opts.appId, opts.privateKeyPem, now);
+		cached = await mintInstallationToken(api, opts.installationId, jwt, fetchImpl);
 		return cached.token;
 	}
 	async function call(method, path, body) {
@@ -84,44 +91,51 @@ function createGithubAppTransport(opts) {
 		}
 		return out;
 	}
-	return { async request(op, params) {
-		const number = Number(params["number"]);
-		if (NUMBERED_OPS.has(op) && (!Number.isInteger(number) || number <= 0)) throw new GithubAppError(`github ${op} needs a positive issue number`, 0);
-		switch (op) {
-			case "issue.create": {
-				const issue = await call("POST", `/repos/${repo}/issues`, {
-					title: params["title"],
-					body: params["body"]
-				});
-				return {
-					number: issue.number,
-					url: issue.html_url
-				};
-			}
-			case "issue.comment":
-				await call("POST", `/repos/${repo}/issues/${number}/comments`, { body: params["body"] });
-				return;
-			case "issue.view": {
-				const issue = await call("GET", `/repos/${repo}/issues/${number}`);
-				const comments = await allComments(number);
-				return {
-					state: issue.state === "closed" ? "closed" : "open",
-					comments: comments.map((c) => ({
-						author: c.user?.login ?? "ghost",
-						body: c.body ?? "",
-						createdAt: c.created_at
-					}))
-				};
-			}
-			case "issue.close":
-				await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "closed" });
-				return;
-			case "issue.reopen":
-				await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "open" });
-				return;
-			default: throw new GithubAppError(`unknown github op: ${op}`, 0);
+	return { request: (op, params) => dispatch(op, params, {
+		repo,
+		call,
+		allComments
+	}) };
+}
+/** The pinned op vocabulary (github.ts) over GitHub's REST paths. */
+async function dispatch(op, params, api) {
+	const { repo, call } = api;
+	const number = Number(params["number"]);
+	if (NUMBERED_OPS.has(op) && (!Number.isInteger(number) || number <= 0)) throw new GithubAppError(`github ${op} needs a positive issue number`, 0);
+	switch (op) {
+		case "issue.create": {
+			const issue = await call("POST", `/repos/${repo}/issues`, {
+				title: params["title"],
+				body: params["body"]
+			});
+			return {
+				number: issue.number,
+				url: issue.html_url
+			};
 		}
-	} };
+		case "issue.comment":
+			await call("POST", `/repos/${repo}/issues/${number}/comments`, { body: params["body"] });
+			return;
+		case "issue.view": {
+			const issue = await call("GET", `/repos/${repo}/issues/${number}`);
+			const comments = await api.allComments(number);
+			return {
+				state: issue.state === "closed" ? "closed" : "open",
+				comments: comments.map((c) => ({
+					author: c.user?.login ?? "ghost",
+					body: c.body ?? "",
+					createdAt: c.created_at
+				}))
+			};
+		}
+		case "issue.close":
+			await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "closed" });
+			return;
+		case "issue.reopen":
+			await call("PATCH", `/repos/${repo}/issues/${number}`, { state: "open" });
+			return;
+		default: throw new GithubAppError(`unknown github op: ${op}`, 0);
+	}
 }
 function headers(bearer, json = false) {
 	return {
@@ -203,6 +217,142 @@ function concat(...parts) {
 	return out;
 }
 //#endregion
+//#region src/connectors/github-webhook.ts
+/** Trailer marking bodies pinbox itself wrote (github.ts); never mirror those back in. */
+const PINBOX_TRAILER = "— pinbox";
+/**
+* Handle one webhook delivery. Returns the hub's machine envelope: 200 with
+* `{ applied, ignored }`, 401 `E_AUTH` on a signature failure, 400 `E_INVALID_INPUT` on a
+* body GitHub would never send.
+*/
+async function handleGithubWebhook(req, store, opts) {
+	const raw = await req.text();
+	const signature = req.headers.get("x-hub-signature-256");
+	if (!await signatureValid(opts.secret, raw, signature)) return envelope(401, {
+		code: "E_AUTH",
+		message: "webhook signature missing or invalid",
+		hint: "the App's webhook secret must equal GITHUB_WEBHOOK_SECRET on the hub"
+	});
+	let payload;
+	try {
+		payload = JSON.parse(raw);
+	} catch {
+		return envelope(400, {
+			code: "E_INVALID_INPUT",
+			message: "webhook body is not JSON"
+		});
+	}
+	const event = req.headers.get("x-github-event") ?? "";
+	return envelope(200, void 0, await apply(store, opts.repo, event, payload));
+}
+async function apply(store, repo, event, payload) {
+	if (event === "ping") return {
+		applied: 0,
+		ignored: "ping"
+	};
+	if (event !== "issues" && event !== "issue_comment") return {
+		applied: 0,
+		ignored: `event ${event}`
+	};
+	const body = payload;
+	const fullName = body.repository?.full_name;
+	if (typeof fullName !== "string" || fullName.toLowerCase() !== repo.toLowerCase()) return {
+		applied: 0,
+		ignored: `repository ${fullName ?? "?"}`
+	};
+	const number = body.issue?.number;
+	if (typeof number !== "number") return {
+		applied: 0,
+		ignored: "no issue"
+	};
+	const row = store.links.all().find((r) => r.link.connector === "github" && r.link.ref === String(number));
+	if (row === void 0) return {
+		applied: 0,
+		ignored: `issue #${number} is not linked`
+	};
+	const { events } = inboundEvents(store, row.pinId, "github", false);
+	return event === "issue_comment" ? applyComment(body, row.link, events) : applyStatus(body, row.link, events);
+}
+async function applyComment(body, link, events) {
+	if (body.action !== "created") return {
+		applied: 0,
+		ignored: `issue_comment ${body.action}`
+	};
+	const comment = body.comment;
+	const text = comment?.body ?? "";
+	if (isOwnMirror(text) || comment?.user?.type === "Bot") return {
+		applied: 0,
+		ignored: "own mirror"
+	};
+	await events.onRemoteComment(link, {
+		origin: `github:${comment?.user?.login ?? "ghost"}`,
+		text,
+		at: comment?.created_at ?? (/* @__PURE__ */ new Date()).toISOString()
+	});
+	return {
+		applied: 1,
+		ignored: null
+	};
+}
+async function applyStatus(body, link, events) {
+	if (body.action === "closed") {
+		await events.onRemoteStatus(link, "closed");
+		return {
+			applied: 1,
+			ignored: null
+		};
+	}
+	if (body.action === "reopened") {
+		await events.onRemoteStatus(link, "open");
+		return {
+			applied: 1,
+			ignored: null
+		};
+	}
+	return {
+		applied: 0,
+		ignored: `issues ${body.action}`
+	};
+}
+function isOwnMirror(text) {
+	return (text.trimEnd().split("\n").at(-1) ?? "").startsWith(PINBOX_TRAILER);
+}
+/** `sha256=<hex hmac>` over the raw body, compared in constant time. */
+async function signatureValid(secret, rawBody, header) {
+	if (header === null || !header.startsWith("sha256=")) return false;
+	const expected = await hmacHex(secret, rawBody);
+	return timingSafeEqual(header.slice(7), expected);
+}
+async function hmacHex(secret, body) {
+	const enc = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", enc.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(body)));
+	let hex = "";
+	for (const b of sig) hex += b.toString(16).padStart(2, "0");
+	return hex;
+}
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+function envelope(status, error, data) {
+	return new Response(JSON.stringify(error === void 0 ? {
+		ok: true,
+		data
+	} : {
+		ok: false,
+		error
+	}), {
+		status,
+		headers: { "content-type": "application/json; charset=utf-8" }
+	});
+}
+//#endregion
 //#region src/connectors/slack.ts
 /**
 * request(op, params) → POST https://slack.com/api/<op> (JSON, bearer botToken).
@@ -302,4 +452,4 @@ function slackTsToMs(ts) {
 	return Number(ts) * 1e3;
 }
 //#endregion
-export { pkcs1ToPkcs8 as a, createGithubAppTransport as i, createSlackTransport as n, toPkcs8Pem as o, GithubAppError as r, createSlackConnector as t };
+export { GithubAppError as a, mintInstallationToken as c, toPkcs8Pem as d, signatureValid as i, pkcs1ToPkcs8 as l, createSlackTransport as n, createGithubAppTransport as o, handleGithubWebhook as r, githubHeaders as s, createSlackConnector as t, signAppJwt as u };

package/dist/{store-IR3o5YwY.js → store-Daziyk0_.js}

@@ -1,4 +1,4 @@
-import { LinkSchema, PinInputSchema, PinSchema, SessionRefSchema, ThreadMessageSchema } from "./schema.js";
+import { a as PinSchema, c as SessionRefSchema, i as PinInputSchema, l as ThreadMessageSchema, r as LinkSchema } from "./schema-DDpii7iQ.js";
 import { a as NotFoundError, i as ConflictError, n as SqliteSessionStore, o as newId } from "./sessions-DrCVTMfI.js";
 import { Database } from "bun:sqlite";
 //#region src/store-deliveries.ts

package/dist/{store-DAB5CEA1.d.ts → store-QLtACKhW.d.ts}

@@ -1,5 +1,5 @@
-import { a as Link, c as PinInput, g as ThreadMessage, m as SessionRef, r as Attachment, s as Pin, t as AppliedEdit } from "./schema-BlM4lTLW.js";
-import { r as SessionStore } from "./sessions-BOrd8Yvv.js";
+import { a as Link, c as PinInput, g as ThreadMessage, m as SessionRef, r as Attachment, s as Pin, t as AppliedEdit } from "./schema-BLZ3MqMD.js";
+import { r as SessionStore } from "./sessions-Bd7_G5jW.js";
 //#region src/store-errors.d.ts
 /** The addressed row does not exist. Mapped to 404 / `E_NOT_FOUND` by the hub. */
 declare class NotFoundError extends Error {}

package/dist/store.d.ts

@@ -1,2 +1,2 @@
-import { a as LinkStore, c as PinStore, d as ConflictError, f as NotFoundError, i as DeliveryStore, l as StoredEvent, n as DeliveryRow, o as MIGRATIONS, r as DeliveryStatus, s as Migration, t as CursorStore, u as openStore } from "./store-DAB5CEA1.js";
+import { a as LinkStore, c as PinStore, d as ConflictError, f as NotFoundError, i as DeliveryStore, l as StoredEvent, n as DeliveryRow, o as MIGRATIONS, r as DeliveryStatus, s as Migration, t as CursorStore, u as openStore } from "./store-QLtACKhW.js";
 export { ConflictError, CursorStore, DeliveryRow, DeliveryStatus, DeliveryStore, LinkStore, MIGRATIONS, Migration, NotFoundError, PinStore, StoredEvent, openStore };

package/dist/store.js

@@ -1,3 +1,3 @@
 import { a as NotFoundError, i as ConflictError } from "./sessions-DrCVTMfI.js";
-import { n as openStore, t as MIGRATIONS } from "./store-IR3o5YwY.js";
+import { n as openStore, t as MIGRATIONS } from "./store-Daziyk0_.js";
 export { ConflictError, MIGRATIONS, NotFoundError, openStore };

package/dist/{types-BmfT_m1p.d.ts → types-BIm_s4nu.d.ts}

@@ -1,4 +1,4 @@
-import { a as Link, g as ThreadMessage, s as Pin } from "./schema-BlM4lTLW.js";
+import { a as Link, g as ThreadMessage, s as Pin } from "./schema-BLZ3MqMD.js";
 //#region src/connectors/types.d.ts
 /** Host-injected transport: local = `gh` CLI shell-out (impl in packages/cli, Bun.$); Worker = App token fetch. */
 interface ConnectorTransport {

package/dist/ws-protocol.d.ts

@@ -1,4 +1,4 @@
-import { l as StoredEvent } from "./store-DAB5CEA1.js";
+import { l as StoredEvent } from "./store-QLtACKhW.js";
 import { z } from "zod";
 //#region src/ws-protocol.d.ts
 declare const WS_PATH = "/ws";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autono/pinbox-core",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "type": "module",
   "license": "MIT",
   "repository": {

package/dist/payload-CYbjb8ZB.d.ts

@@ -1,6 +0,0 @@
-import { s as Pin } from "./schema-BlM4lTLW.js";
-import "./store-DAB5CEA1.js";
-//#region src/delivery/payload.d.ts
-type GetPin = (id: string) => Pin | null;
-//#endregion
-export { GetPin as t };