npm - @mushi-mushi/plugin-msteams - Versions diffs - 0.1.1 - Mend

@mushi-mushi/plugin-msteams 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/CODE_OF_CONDUCT.md ADDED Viewed

@@ -0,0 +1,51 @@
+<!--
+  AUTO-SYNCED from repo root by scripts/sync-community-files.mjs.
+  Do not edit here — edit the canonical file at the repository root and
+  re-run `node scripts/sync-community-files.mjs` (pre-commit hook does this
+  automatically).
+-->
+# Contributor Covenant Code of Conduct
+## Our Pledge
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+## Our Standards
+Examples of behavior that contributes to a positive environment:
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+Examples of unacceptable behavior:
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+## Enforcement
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project team at **kensaurus@gmail.com**.
+All complaints will be reviewed and investigated promptly and fairly.
+## Attribution
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/),
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.

package/CONTRIBUTING.md ADDED Viewed

@@ -0,0 +1,126 @@
+<!--
+  AUTO-SYNCED from repo root by scripts/sync-community-files.mjs.
+  Do not edit here — edit the canonical file at the repository root and
+  re-run `node scripts/sync-community-files.mjs` (pre-commit hook does this
+  automatically).
+-->
+# Contributing to Mushi Mushi
+Thanks for wanting to help. Here's everything you need to get started.
+## Prerequisites
+- **Node.js >= 22** (see `.node-version`)
+- **pnpm >= 10** — install with `corepack enable`
+## Setup
+```bash
+git clone https://github.com/kensaurus/mushi-mushi.git
+cd mushi-mushi
+pnpm install
+pnpm build
+```
+## Development
+```bash
+pnpm dev          # Start all dev servers (admin on :6464)
+pnpm test         # Run Vitest across all packages
+pnpm typecheck    # TypeScript checks
+pnpm lint         # ESLint
+pnpm format       # Prettier
+```
+Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
+root, but root-level `*.png` files are intentionally ignored. Canonical
+screenshots that should be versioned belong under `docs/screenshots/`.
+### Working on a single package
+```bash
+cd packages/core
+pnpm dev          # Watch mode
+pnpm test         # Tests for this package only
+```
+## Project Structure
+```
+packages/
+  core/          Types, API client, offline queue (MIT)
+  web/           Browser SDK — widget, capture (MIT)
+  react/         React bindings (MIT)
+  vue/           Vue 3 plugin (MIT)
+  svelte/        Svelte SDK (MIT)
+  angular/       Angular SDK (MIT)
+  react-native/  React Native SDK (MIT)
+  cli/           CLI tool (MIT)
+  mcp/           MCP server for coding agents (MIT)
+  server/        Supabase Edge Functions (BSL)
+  agents/        Agentic fix pipeline (BSL)
+  verify/        Fix verification (BSL)
+apps/
+  admin/         Admin dashboard (React + Tailwind)
+  docs/          Documentation site (planned)
+tooling/
+  eslint-config/ Shared ESLint flat config
+  tsconfig/      Shared TypeScript configs
+```
+## Making Changes
+1. Create a feature branch from `master`
+2. Make your changes
+3. Add tests for new functionality
+4. Run `pnpm typecheck && pnpm lint && pnpm test` to verify
+5. Create a changeset if your change affects published packages:
+   ```bash
+   pnpm changeset
+   ```
+6. Open a pull request
+## Changesets
+We use [Changesets](https://github.com/changesets/changesets) for versioning. If your PR modifies a published package (`core`, `web`, `react`, `vue`, `svelte`, `angular`, `react-native`, `cli`, `mcp`), add a changeset:
+```bash
+pnpm changeset
+```
+Select the affected packages, the semver bump type, and write a summary. The changeset file gets committed with your PR.
+## Code Style
+- **TypeScript strict mode** — no `any` unless absolutely necessary
+- **Prettier** formats everything — run `pnpm format` before committing
+- **ESLint** catches bugs — `pnpm lint` must pass
+- **No default exports** in library packages — use named exports
+- **Dual ESM/CJS** builds via tsup for all SDK packages
+## Commit Messages
+Use conventional commits:
+```
+feat(core): add batch report submission
+fix(web): prevent widget from opening during screenshot
+docs(react): update provider usage example
+chore: bump dependencies
+```
+## Tests
+- **Framework:** Vitest
+- **Location:** Co-located with source (`src/foo.test.ts`)
+- **Coverage:** Required for `core`, `web`, `react` — encouraged for all packages
+## License
+- SDK packages are MIT — your contributions will be MIT-licensed
+- Server/agents/verify are BSL 1.1 — contributions to those packages fall under BSL
+## Questions?
+Open an issue or start a discussion. We're happy to help.

package/LICENSE ADDED Viewed

@@ -0,0 +1,21 @@
+MIT License
+Copyright (c) 2026 Kenji Sakuramoto
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md ADDED Viewed

@@ -0,0 +1,56 @@
+# `@mushi-mushi/plugin-msteams`
+Mushi Mushi plugin: post Adaptive Card 1.4 notifications to a Microsoft
+Teams Incoming Webhook for the major report lifecycle events.
+## Install
+```bash
+npm i @mushi-mushi/plugin-msteams
+```
+## Run as a stand-alone server
+```bash
+MUSHI_PLUGIN_SECRET=...        # set when the plugin is installed in Mushi admin
+TEAMS_WEBHOOK_URL=https://...  # Microsoft Teams Incoming Webhook URL
+ADMIN_BASE_URL=https://...     # Mushi admin base URL (deep-links)
+PORT=3000                      # optional
+npx mushi-plugin-msteams
+```
+Install **Microsoft Teams** in the Mushi admin Marketplace and point its
+`webhook_url` at `https://your-host/mushi/webhook`.
+## Programmatic usage
+```ts
+import { createMsTeamsPlugin } from '@mushi-mushi/plugin-msteams'
+import express from 'express'
+import { expressMiddleware } from '@mushi-mushi/plugin-sdk'
+const handler = createMsTeamsPlugin({
+  webhookUrl: process.env.TEAMS_WEBHOOK_URL!,
+  adminBaseUrl: process.env.ADMIN_BASE_URL!,
+  mushiSecret: process.env.MUSHI_PLUGIN_SECRET!,
+})
+express().post('/mushi/webhook', expressMiddleware(handler)).listen(3000)
+```
+## Subscribed events
+- `report.classified` — Adaptive Card with severity-coloured accent.
+- `fix.proposed` — Adaptive Card with PR link if available.
+- `fix.applied` — green confirmation card.
+## Notes
+- Adaptive Card schema version `1.4` so cards render correctly in modern
+  Teams clients (desktop ≥ 1.5.x, mobile ≥ April 2024 release).
+- All webhook calls retry transient `5xx` via `withRetry` from
+  `@mushi-mushi/plugin-sdk`.
+## License
+MIT

package/SECURITY.md ADDED Viewed

@@ -0,0 +1,287 @@
+<!--
+  AUTO-SYNCED from repo root by scripts/sync-community-files.mjs.
+  Do not edit here — edit the canonical file at the repository root and
+  re-run `node scripts/sync-community-files.mjs` (pre-commit hook does this
+  automatically).
+-->
+# Security Policy
+## Supported Versions
+| Version | Supported |
+|---------|-----------|
+| 0.x     | Yes       |
+## Reporting a Vulnerability
+If you discover a security vulnerability, please report it responsibly.
+**Do NOT open a public GitHub issue.**
+Use either channel below:
+1. **GitHub Private Vulnerability Reporting** — strongly preferred.
+   <https://github.com/kensaurus/mushi-mushi/security/advisories/new>
+   Routes the report into a private advisory with built-in CVE issuance,
+   patch coordination, and contributor-credit workflow.
+2. **Email** — `kensaurus@gmail.com`, subject prefix `[mushi-security]`.
+   PGP welcome but not required.
+Include:
+- Description of the vulnerability
+- Steps to reproduce (smallest reproducer wins)
+- Impact assessment (what an attacker gains)
+- Suggested fix (if any)
+- Whether you want public credit (and how to spell your name)
+### Coordinated-disclosure timeline
+| Day | Action |
+|-----|--------|
+| 0 | Report received |
+| ≤ 2 | Acknowledgment + assigned a tracking ID |
+| ≤ 7 | Triage complete: severity assigned (CVSS 3.1) and target patch date communicated |
+| ≤ 30 | Patch released for critical / high (CVSS ≥ 7.0); ≤ 60 days for medium; best-effort for low |
+| Patch + 7 | Public advisory + CVE published; reporter credited unless they declined |
+| Patch + 90 | Embargo expires regardless; if upstream is unresponsive, the reporter is free to publish |
+### Safe harbor
+Good-faith security research on Mushi Mushi is welcome. If you stay
+within the rules below, we will not pursue legal action, will not ask
+your hosting provider to take you offline, and will publicly credit your
+work:
+- Test only against your own self-hosted instance, the public demo at
+  <https://kensaur.us/mushi-mushi/admin/>, or accounts you own.
+- Do not access, exfiltrate, or modify data belonging to other users.
+- Do not run automated scanning that affects availability for others
+  (rate-limit your tooling, exclude `/health`).
+- Disclose privately first (channels above); do not publish before the
+  embargo above expires.
+- Do not intentionally exploit a finding to escalate beyond proving it
+  exists.
+If a finding requires touching production data to confirm, **stop and
+ask first** — describe what you'd need to do and we'll spin up a sandbox.
+### Hall of fame
+Researchers who report a confirmed vulnerability are credited in the
+release notes for the patched version and added to
+[`docs/SECURITY_HALL_OF_FAME.md`](./docs/SECURITY_HALL_OF_FAME.md) (with
+permission).
+## Scope
+- All `@mushi-mushi/*` npm packages
+- Supabase Edge Functions (server-side)
+- Admin console application
+- CLI tool
+## Out of Scope
+- Self-hosted deployments configured by the user
+- Third-party integrations (Jira, Linear, PagerDuty)
+- Vulnerabilities requiring physical access
+## Security Best Practices for Users
+- **Never commit your API keys** — use environment variables
+- **Rotate API keys** regularly via the admin console
+- **Enable SSO** for team projects (Enterprise tier)
+- **Review audit logs** periodically for suspicious activity
+- **Verify SDK integrity** with `npm audit signatures` after install
+- **Set `Content-Security-Policy`** on any page embedding the Mushi widget;
+  the widget itself ships with `script-src 'self'` and does not load
+  remote scripts.
+## Threat model
+What we treat as in-scope attacker capabilities, and what we don't.
+| Capability | In scope | Notes |
+|-----------|----------|-------|
+| Unauthenticated network attacker hitting public endpoints | ✅ | Rate-limit + HMAC + replay protection on every webhook endpoint (`packages/server/supabase/functions/_shared/webhook-middleware.ts`). |
+| Authenticated user trying to read another tenant's data | ✅ | Postgres RLS on every `public.*` table; advisor lints reviewed monthly. |
+| Authenticated user trying to escalate to super-admin | ✅ | Role lives in `auth.users.raw_app_meta_data.role`; cannot be self-edited via PostgREST. |
+| Compromised dependency (npm supply-chain attack) | ✅ | 7-day cooldown + provenance + Harden-Runner + pinned SHAs (see "Supply-chain hardening" below). |
+| Stolen API key | ✅ | Per-key scopes (`api_key_has_scope`), revocation via admin console, audit log of every use. |
+| User pasting a Stripe / OpenAI / GitHub PAT into a bug report | ✅ | PII scrubber redacts ~15 vendor token formats client-side before the report leaves the device. Mirrors `packages/core/src/pii-scrubber.ts` across iOS, Android, Flutter, React Native. |
+| Stolen end-user device with the SDK installed | ⚠️ partial | Offline queue is AsyncStorage / Keychain / SharedPreferences — no app-level encryption beyond the OS default. Reports waiting to flush are vulnerable to a forensic attacker. |
+| Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
+| Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
+| Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+## Data handling and PII
+### What the SDK collects by default
+| Field | Scope | PII risk |
+|-------|-------|----------|
+| URL / route the user was on | Always | Low — strip query strings if your routes encode user IDs. |
+| Browser / OS / device | Always | None |
+| Console errors (last 50) | Opt-in via `captureConsole: true` | Medium — can include user data your code logs. |
+| Network failures (URL + status) | Opt-in via `captureNetwork: true` | Medium — query params logged as-is unless you redact in-app. |
+| User id / email / role | Only if you call `setUser()` | High — only set what you need; we do not auto-discover. |
+| Session replay frames | Off by default | High — handled by the masking layer; passwords / cards / opted-out elements never leave the page. |
+| Free-text bug description | Always | Medium — passed through the PII scrubber (see below). |
+### What the PII scrubber redacts before send
+Implemented identically across `@mushi-mushi/core`, the iOS, Android,
+Flutter, and React Native SDKs. Defaults are below — every category can
+be toggled off, but `secretTokens` is on by default and we recommend
+keeping it that way.
+| Category | Default | Patterns |
+|----------|---------|----------|
+| `ssns` | on | `123-45-6789` |
+| `creditCards` | on | 12–19 digit Luhn-shaped sequences with optional separators |
+| `secretTokens` | on | AWS access key (`AKIA…` / `ASIA…`), AWS secret (`aws_secret_access_key=…`), Stripe (`sk_live_…`, `sk_test_…`, `rk_…`, `pk_…`), Slack (`xox[abpor]-…`), GitHub PAT (`ghp_…`, `github_pat_…`), OpenAI (`sk-…`, `sk-proj-…`), Anthropic (`sk-ant-…`), Google API (`AIza…`), JWT (`eyJ…` 3-segment) |
+| `emails` | on | RFC-5322 lite |
+| `phones` | on | E.164 with optional country code |
+| `ipAddresses` | off | IPv4 (off because internal IPs are usually not PII and noise hurts triage) |
+| `ipv6` | off | Same |
+The fields scrubbed are:
+- `description` — primary free-text field of every bug report
+- `summary` — short summary, in the same composer
+- `breadcrumbs[].message` — auto-captured user-action trail (clicks, route changes, console messages)
+Structured fields you set explicitly (`metadata.userEmail`,
+`metadata.userId`, etc.) are intentionally **not** scrubbed — those are
+opt-in attribution data, and silently rewriting them would break
+support workflows.
+### Where data lives
+- **Reports & telemetry** — Supabase Postgres in the `us-west-1` region.
+- **Session replays** — Supabase Storage, same region. Lifecycle policy
+  trims replays older than 30 days unless explicitly retained from the
+  admin console.
+- **Inbound webhook bodies** — only a SHA-256 hash + `delivery_id` of
+  the body is persisted (`webhook_audit_log`). The full body is
+  processed in memory and discarded.
+- **Outbound integrations** (Slack, Jira, …) — Mushi is a sender only;
+  the receiving system's retention applies.
+### Encryption
+| Surface | At rest | In transit |
+|---------|---------|------------|
+| Postgres (Supabase) | AES-256 (Supabase default) | TLS 1.2+ |
+| Supabase Storage (replays) | AES-256 | TLS 1.2+ |
+| Edge Function ↔ Postgres | — | TLS via the Supavisor pooler |
+| SDK ↔ ingest endpoint | — | TLS 1.2+ enforced; HSTS preload on `kensaur.us` |
+| Inbound webhooks | — | TLS terminated at CloudFront / Supabase edge |
+| Audit log integrity | append-only by RLS; no in-row signing | — |
+### Cryptographic primitives
+| Use | Algorithm | Implementation |
+|-----|-----------|---------------|
+| Webhook HMAC verification (Sentry, GitHub, Datadog, Honeycomb, Grafana, Bugsnag, Rollbar, Crashlytics) | HMAC-SHA256, constant-time compare | Web Crypto in Deno; `crypto.subtle.timingSafeEqual` analogue |
+| AWS SNS subscription confirmation | RSA-SHA1 / RSA-SHA256 | Deno `crypto.subtle.verify` with the cert from `SigningCertURL` (URL allow-listed to `*.sns.*.amazonaws.com`) |
+| Opsgenie JWT shared-token | HS256 with `aud` claim verification | `jose` (Deno-compatible) |
+| API-key hashing (database) | SHA-256 prefix + bcrypt secret half | `pgcrypto` |
+| Provenance attestations (npm) | Sigstore (Fulcio + Rekor) | `npm publish --provenance` |
+We deliberately do not roll our own crypto. If you find an algorithm or
+library above that has been deprecated, please file a security advisory.
+### Operator security checklist
+When you provision a new self-hosted Mushi instance:
+- [ ] Set `auth_leaked_password_protection = true` in Supabase Auth
+      (HaveIBeenPwned blocklist; flagged as `auth_leaked_password_protection`
+      in the security advisor).
+- [ ] Enable at least two MFA factors in Supabase Auth (`auth_insufficient_mfa_options`).
+- [ ] Rotate the service-role key on day 1, then quarterly.
+- [ ] Restrict Postgres direct connections to your CI / migration runners
+      via Supabase network restrictions.
+- [ ] Run `pnpm dlx supabase advisors --project-ref <ref>` after every
+      migration; aim for zero ERROR-level findings.
+- [ ] Configure a Supabase log drain to your SIEM if you are subject to
+      SOC 2 / ISO 27001.
+- [ ] Set CSP `frame-ancestors` on the host page if you embed the Mushi
+      widget (the widget is iframe-friendly but does not enforce
+      framing constraints itself).
+## Supply-chain hardening (how this package is protected)
+Mushi Mushi is built and published with the controls below. Consumers can
+verify each control independently — the goal is to make tampering both
+difficult and detectable.
+### Publish-time controls
+| Control | What it does | How to verify |
+|---|---|---|
+| **npm Trusted Publisher (OIDC)** | Every release is published from `.github/workflows/release.yml` on `master` using a short-lived OIDC token. Long-lived `NPM_TOKEN` is not used for publishing. | `npm view @mushi-mushi/<pkg> --json` shows `"trustedPublisher"` populated for recent versions. |
+| **npm provenance attestations** | Every published tarball ships a [Sigstore provenance attestation](https://docs.npmjs.com/generating-provenance-statements) cryptographically linking the tarball to the exact GitHub Actions run that built it. | `npm audit signatures` (run inside any project that depends on `@mushi-mushi/*`) reports `verified registry signatures` and `verified attestations`. The npm web UI shows a "Built and signed on GitHub Actions" badge on each version. |
+| **Pre-publish workspace-protocol guard** | Aborts the publish if `workspace:*` ranges leaked into the tarball (the bug class behind the v0.1.0 incident). | `scripts/check-workspace-protocol.mjs` runs before `changeset publish` in `pnpm release`. |
+| **Post-publish tarball verification** | Re-downloads each just-published tarball and asserts it doesn't contain `workspace:*`. | See the "Verify published tarballs do not contain workspace:*" step in `release.yml`. |
+| **Post-publish `npm audit signatures`** | Re-installs each published version and validates registry signatures + provenance against npm's transparency log. | See the "Audit signatures of installed dependencies" step in `release.yml`. |
+### Build-time controls
+| Control | What it does |
+|---|---|
+| **All third-party GitHub Actions pinned to commit SHAs** | Every `uses:` in every workflow under `.github/workflows/` is pinned to a 40-character commit SHA with a version comment. Floating tags (`@v4`, `@main`) are mutable and were the entry point for the [tj-actions/changed-files compromise (CVE-2025-30066)](https://github.com/step-security/harden-runner#detected-attacks). |
+| **Harden-Runner egress audit on every job** | [step-security/harden-runner](https://github.com/step-security/harden-runner) records every outbound network call, file write, and process spawn on every CI runner. Detects exfiltration attempts in real time — caught the tj-actions, NX, Shai-Hulud, and Axios attacks for other projects. |
+| **OpenSSF Scorecard** | Weekly + on-push score of the repo's security posture (Pinned-Dependencies, Token-Permissions, Branch-Protection, Code-Review, Dangerous-Workflow, Maintained, SAST, Security-Policy, Signed-Releases, Vulnerabilities). Public results at [scorecard.dev](https://scorecard.dev/viewer/?uri=github.com/kensaurus/mushi-mushi). |
+| **Server-side secret scan (Gitleaks)** | Every PR and every push to `master` runs Gitleaks across the diff / full tree. Belt-and-suspenders to the local pre-commit hook (`scripts/check-no-secrets.mjs`) which can be bypassed with `--no-verify`. |
+| **Local pre-commit secret scanner** | `scripts/check-no-secrets.mjs` runs as a git hook installed by `pnpm install`, blocking commits that look like AWS / Stripe / GitHub / Anthropic / OpenAI / Slack / Supabase keys. |
+| **CodeQL `security-extended`** | Semantic analysis of every TypeScript / JavaScript change finds injection sinks, taint flows, prototype pollution, etc. Runs on every PR, push, and weekly cron. |
+| **Dependency review on PRs** | `actions/dependency-review-action` blocks the PR if it adds or upgrades a dep with a high-severity advisory. |
+| **`pnpm audit --prod --audit-level=high`** | Weekly cron + every push to `master` fails on any high/critical advisory in production deps. |
+### Install-time controls (protect the project's own dependency graph)
+| Control | What it does |
+|---|---|
+| **`min-release-age` (npm) / `minimumReleaseAge` (pnpm)** | Refuses to resolve any dep version published less than 7 days ago. The Axios 1.14.1 / 0.30.4 compromise (Mar 2026) was detected and removed within ~5 hours; Shai-Hulud (Sep 2025) within <12 hours — a 7-day cooldown blocks every publicly-disclosed 2025–2026 npm supply-chain attack outright. |
+| **`strictDepBuilds: true`** | Fails the install if any transitive dep tries to run a `postinstall` hook the workspace hasn't pre-approved (`onlyBuiltDependencies` allow-list). |
+| **`blockExoticSubdeps: true`** | Refuses to resolve transitive deps from git URLs, tarball URLs, or filesystem paths — anything that didn't go through the npm registry's signing pipeline. |
+| **Dependabot with cooldown** | Routine dep upgrades wait 7 days; security advisories bypass the cooldown automatically. |
+| **`pnpm audit signatures`-style verification** | The release pipeline re-runs `npm audit signatures` against each published version after the publish, with `--audit-level=high`. |
+### Verifying a Mushi Mushi tarball before installing
+```bash
+# 1. Check provenance attestation matches the public GitHub Actions run
+npm view @mushi-mushi/core --json | jq '.signatures, .dist'
+# 2. Inside your own project after install
+npm audit signatures
+# Expected: every @mushi-mushi/* package reports
+#   "verified registry signature"
+#   "verified attestation"
+```
+If `npm audit signatures` reports any `@mushi-mushi/*` package as unsigned
+or with an invalid attestation, **stop the install and email
+kensaurus@gmail.com immediately** — that's the symptom of either a
+registry compromise or a tampered tarball, and we want to know within
+hours, not days.
+### What this hardening does NOT cover
+- **Self-hosted deployments.** Once the package is on your machine, the
+  security of your `node_modules`, build pipeline, and runtime is your
+  responsibility. The hardening above protects the path from source to
+  registry; it cannot protect a tarball after it has been downloaded.
+- **Compromise of `kensaurus@gmail.com`.** A trusted-publisher rule still
+  lets the legitimate maintainer publish from any branch they push. If
+  you find yourself with admin access to this repo, treat
+  `.github/workflows/release.yml` as a tier-0 secret.
+- **First-party bugs.** Provenance proves *who* built the tarball and
+  *when*; it does not prove the code is bug-free. CodeQL + tests cover
+  that surface, but no automation catches everything — please continue
+  to report issues to the address above.

package/dist/chunk-NTWIK2O3.js ADDED Viewed

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+// src/index.ts
+import {
+  createPluginHandler
+} from "@mushi-mushi/plugin-sdk";
+var SEVERITY_COLORS = {
+  critical: "attention",
+  high: "warning",
+  medium: "accent",
+  low: "good"
+};
+function createMsteamsPlugin(cfg) {
+  const f = cfg.fetchImpl ?? fetch;
+  const adminBase = cfg.adminBaseUrl.replace(/\/$/, "");
+  function reportUrl(reportId) {
+    return `${adminBase}/reports/${encodeURIComponent(reportId)}`;
+  }
+  function buildPayload(body, actions = []) {
+    return {
+      type: "message",
+      attachments: [
+        {
+          contentType: "application/vnd.microsoft.card.adaptive",
+          content: {
+            $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+            type: "AdaptiveCard",
+            version: "1.4",
+            body,
+            actions
+          }
+        }
+      ]
+    };
+  }
+  async function post(payload) {
+    const res = await f(cfg.webhookUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`Teams webhook ${res.status}: ${text.slice(0, 300)}`);
+    }
+  }
+  return createPluginHandler({
+    secret: cfg.mushiSecret,
+    on: {
+      "report.classified": async (e) => {
+        const data = e.data;
+        const { report, classification } = data;
+        const color = SEVERITY_COLORS[classification.severity] ?? "accent";
+        const body = [
+          {
+            type: "TextBlock",
+            size: "Large",
+            weight: "Bolder",
+            text: `New ${classification.category} report classified`,
+            wrap: true
+          },
+          {
+            type: "TextBlock",
+            text: report.title ?? `Mushi report \`${report.id.slice(0, 8)}...\``,
+            wrap: true,
+            spacing: "None"
+          },
+          {
+            type: "FactSet",
+            facts: [
+              { title: "Severity", value: classification.severity },
+              { title: "Category", value: classification.category },
+              { title: "Confidence", value: `${Math.round(classification.confidence * 100)}%` },
+              { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` }
+            ]
+          },
+          {
+            type: "TextBlock",
+            text: e.occurredAt,
+            size: "Small",
+            color: "default",
+            isSubtle: true,
+            spacing: "Medium"
+          }
+        ];
+        await post(
+          buildPayload(
+            [
+              {
+                type: "Container",
+                style: color,
+                items: body
+              }
+            ],
+            [
+              {
+                type: "Action.OpenUrl",
+                title: "View in Mushi",
+                url: reportUrl(report.id)
+              }
+            ]
+          )
+        );
+      },
+      "fix.proposed": async (e) => {
+        const data = e.data;
+        const { report, fix } = data;
+        const facts = [
+          { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` },
+          { title: "Fix status", value: fix.status }
+        ];
+        if (fix.branch) facts.push({ title: "Branch", value: fix.branch });
+        const actions = [
+          { type: "Action.OpenUrl", title: "View report", url: reportUrl(report.id) }
+        ];
+        if (fix.pullRequestUrl) {
+          actions.push({ type: "Action.OpenUrl", title: "View Pull Request", url: fix.pullRequestUrl });
+        }
+        await post(
+          buildPayload([
+            {
+              type: "Container",
+              style: "accent",
+              items: [
+                { type: "TextBlock", size: "Large", weight: "Bolder", text: "Fix proposed by Mushi", wrap: true },
+                {
+                  type: "TextBlock",
+                  text: fix.summary ?? `A fix has been proposed for report \`${report.id.slice(0, 8)}...\``,
+                  wrap: true,
+                  spacing: "None"
+                },
+                { type: "FactSet", facts }
+              ]
+            }
+          ], actions)
+        );
+      },
+      "fix.applied": async (e) => {
+        const data = e.data;
+        const { report, fix } = data;
+        const actions = [
+          { type: "Action.OpenUrl", title: "View report", url: reportUrl(report.id) }
+        ];
+        if (fix.pullRequestUrl) {
+          actions.push({ type: "Action.OpenUrl", title: "View merged PR", url: fix.pullRequestUrl });
+        }
+        await post(
+          buildPayload([
+            {
+              type: "Container",
+              style: "good",
+              items: [
+                { type: "TextBlock", size: "Large", weight: "Bolder", text: "Fix applied \u2014 issue resolved", wrap: true },
+                {
+                  type: "TextBlock",
+                  text: fix.summary ?? `Fix merged for report \`${report.id.slice(0, 8)}...\``,
+                  wrap: true,
+                  spacing: "None"
+                },
+                {
+                  type: "FactSet",
+                  facts: [
+                    { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` },
+                    { title: "Fix status", value: fix.status }
+                  ]
+                }
+              ]
+            }
+          ], actions)
+        );
+      }
+    },
+    logger: {
+      info: (msg, meta) => console.log(`[mushi-plugin-msteams] ${msg}`, meta ?? ""),
+      warn: (msg, meta) => console.warn(`[mushi-plugin-msteams] ${msg}`, meta ?? ""),
+      error: (msg, meta) => console.error(`[mushi-plugin-msteams] ${msg}`, meta ?? "")
+    }
+  });
+}
+export {
+  createMsteamsPlugin
+};

package/dist/index.cjs ADDED Viewed

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  createMsteamsPlugin: () => createMsteamsPlugin
+});
+module.exports = __toCommonJS(src_exports);
+var import_plugin_sdk = require("@mushi-mushi/plugin-sdk");
+var SEVERITY_COLORS = {
+  critical: "attention",
+  high: "warning",
+  medium: "accent",
+  low: "good"
+};
+function createMsteamsPlugin(cfg) {
+  const f = cfg.fetchImpl ?? fetch;
+  const adminBase = cfg.adminBaseUrl.replace(/\/$/, "");
+  function reportUrl(reportId) {
+    return `${adminBase}/reports/${encodeURIComponent(reportId)}`;
+  }
+  function buildPayload(body, actions = []) {
+    return {
+      type: "message",
+      attachments: [
+        {
+          contentType: "application/vnd.microsoft.card.adaptive",
+          content: {
+            $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+            type: "AdaptiveCard",
+            version: "1.4",
+            body,
+            actions
+          }
+        }
+      ]
+    };
+  }
+  async function post(payload) {
+    const res = await f(cfg.webhookUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`Teams webhook ${res.status}: ${text.slice(0, 300)}`);
+    }
+  }
+  return (0, import_plugin_sdk.createPluginHandler)({
+    secret: cfg.mushiSecret,
+    on: {
+      "report.classified": async (e) => {
+        const data = e.data;
+        const { report, classification } = data;
+        const color = SEVERITY_COLORS[classification.severity] ?? "accent";
+        const body = [
+          {
+            type: "TextBlock",
+            size: "Large",
+            weight: "Bolder",
+            text: `New ${classification.category} report classified`,
+            wrap: true
+          },
+          {
+            type: "TextBlock",
+            text: report.title ?? `Mushi report \`${report.id.slice(0, 8)}...\``,
+            wrap: true,
+            spacing: "None"
+          },
+          {
+            type: "FactSet",
+            facts: [
+              { title: "Severity", value: classification.severity },
+              { title: "Category", value: classification.category },
+              { title: "Confidence", value: `${Math.round(classification.confidence * 100)}%` },
+              { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` }
+            ]
+          },
+          {
+            type: "TextBlock",
+            text: e.occurredAt,
+            size: "Small",
+            color: "default",
+            isSubtle: true,
+            spacing: "Medium"
+          }
+        ];
+        await post(
+          buildPayload(
+            [
+              {
+                type: "Container",
+                style: color,
+                items: body
+              }
+            ],
+            [
+              {
+                type: "Action.OpenUrl",
+                title: "View in Mushi",
+                url: reportUrl(report.id)
+              }
+            ]
+          )
+        );
+      },
+      "fix.proposed": async (e) => {
+        const data = e.data;
+        const { report, fix } = data;
+        const facts = [
+          { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` },
+          { title: "Fix status", value: fix.status }
+        ];
+        if (fix.branch) facts.push({ title: "Branch", value: fix.branch });
+        const actions = [
+          { type: "Action.OpenUrl", title: "View report", url: reportUrl(report.id) }
+        ];
+        if (fix.pullRequestUrl) {
+          actions.push({ type: "Action.OpenUrl", title: "View Pull Request", url: fix.pullRequestUrl });
+        }
+        await post(
+          buildPayload([
+            {
+              type: "Container",
+              style: "accent",
+              items: [
+                { type: "TextBlock", size: "Large", weight: "Bolder", text: "Fix proposed by Mushi", wrap: true },
+                {
+                  type: "TextBlock",
+                  text: fix.summary ?? `A fix has been proposed for report \`${report.id.slice(0, 8)}...\``,
+                  wrap: true,
+                  spacing: "None"
+                },
+                { type: "FactSet", facts }
+              ]
+            }
+          ], actions)
+        );
+      },
+      "fix.applied": async (e) => {
+        const data = e.data;
+        const { report, fix } = data;
+        const actions = [
+          { type: "Action.OpenUrl", title: "View report", url: reportUrl(report.id) }
+        ];
+        if (fix.pullRequestUrl) {
+          actions.push({ type: "Action.OpenUrl", title: "View merged PR", url: fix.pullRequestUrl });
+        }
+        await post(
+          buildPayload([
+            {
+              type: "Container",
+              style: "good",
+              items: [
+                { type: "TextBlock", size: "Large", weight: "Bolder", text: "Fix applied \u2014 issue resolved", wrap: true },
+                {
+                  type: "TextBlock",
+                  text: fix.summary ?? `Fix merged for report \`${report.id.slice(0, 8)}...\``,
+                  wrap: true,
+                  spacing: "None"
+                },
+                {
+                  type: "FactSet",
+                  facts: [
+                    { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` },
+                    { title: "Fix status", value: fix.status }
+                  ]
+                }
+              ]
+            }
+          ], actions)
+        );
+      }
+    },
+    logger: {
+      info: (msg, meta) => console.log(`[mushi-plugin-msteams] ${msg}`, meta ?? ""),
+      warn: (msg, meta) => console.warn(`[mushi-plugin-msteams] ${msg}`, meta ?? ""),
+      error: (msg, meta) => console.error(`[mushi-plugin-msteams] ${msg}`, meta ?? "")
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createMsteamsPlugin
+});

package/dist/index.d.cts ADDED Viewed

@@ -0,0 +1,33 @@
+import * as _mushi_mushi_plugin_sdk from '@mushi-mushi/plugin-sdk';
+/**
+ * Microsoft Teams plugin for Mushi Mushi.
+ *
+ * Posts Adaptive Cards to a Teams channel via an Incoming Webhook connector.
+ * Uses the legacy Incoming Webhook format (still supported in 2026) which
+ * wraps an Adaptive Card inside a `message` attachment envelope.
+ *
+ * Adaptive Card version: 1.4 — compatible with Teams desktop, web, and
+ * mobile clients that shipped after 2021.
+ *
+ * Events handled:
+ *   - `report.classified` — new classified bug with severity badge
+ *   - `fix.proposed`      — Mushi has opened a fix PR
+ *   - `fix.applied`       — fix has been merged
+ *
+ * Auth: Teams Incoming Webhook URL (no additional token required beyond
+ * the URL itself, which embeds the connector auth).
+ */
+interface MsteamsPluginConfig {
+    /** Microsoft Teams Incoming Webhook URL. */
+    webhookUrl: string;
+    /** Mushi admin base URL used to build deep-link report URLs. */
+    adminBaseUrl: string;
+    /** Mushi plugin signing secret. */
+    mushiSecret: string;
+    /** Override `fetch` for tests. */
+    fetchImpl?: typeof fetch;
+}
+declare function createMsteamsPlugin(cfg: MsteamsPluginConfig): (input: _mushi_mushi_plugin_sdk.HandlePluginRequestInput) => Promise<_mushi_mushi_plugin_sdk.HandlePluginResult>;
+export { type MsteamsPluginConfig, createMsteamsPlugin };

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,33 @@
+import * as _mushi_mushi_plugin_sdk from '@mushi-mushi/plugin-sdk';
+/**
+ * Microsoft Teams plugin for Mushi Mushi.
+ *
+ * Posts Adaptive Cards to a Teams channel via an Incoming Webhook connector.
+ * Uses the legacy Incoming Webhook format (still supported in 2026) which
+ * wraps an Adaptive Card inside a `message` attachment envelope.
+ *
+ * Adaptive Card version: 1.4 — compatible with Teams desktop, web, and
+ * mobile clients that shipped after 2021.
+ *
+ * Events handled:
+ *   - `report.classified` — new classified bug with severity badge
+ *   - `fix.proposed`      — Mushi has opened a fix PR
+ *   - `fix.applied`       — fix has been merged
+ *
+ * Auth: Teams Incoming Webhook URL (no additional token required beyond
+ * the URL itself, which embeds the connector auth).
+ */
+interface MsteamsPluginConfig {
+    /** Microsoft Teams Incoming Webhook URL. */
+    webhookUrl: string;
+    /** Mushi admin base URL used to build deep-link report URLs. */
+    adminBaseUrl: string;
+    /** Mushi plugin signing secret. */
+    mushiSecret: string;
+    /** Override `fetch` for tests. */
+    fetchImpl?: typeof fetch;
+}
+declare function createMsteamsPlugin(cfg: MsteamsPluginConfig): (input: _mushi_mushi_plugin_sdk.HandlePluginRequestInput) => Promise<_mushi_mushi_plugin_sdk.HandlePluginResult>;
+export { type MsteamsPluginConfig, createMsteamsPlugin };

package/dist/index.js ADDED Viewed

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import {
+  createMsteamsPlugin
+} from "./chunk-NTWIK2O3.js";
+export {
+  createMsteamsPlugin
+};

package/dist/server.cjs ADDED Viewed

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+"use strict";
+// src/server.ts
+var import_node_http = require("http");
+// src/index.ts
+var import_plugin_sdk = require("@mushi-mushi/plugin-sdk");
+var SEVERITY_COLORS = {
+  critical: "attention",
+  high: "warning",
+  medium: "accent",
+  low: "good"
+};
+function createMsteamsPlugin(cfg) {
+  const f = cfg.fetchImpl ?? fetch;
+  const adminBase = cfg.adminBaseUrl.replace(/\/$/, "");
+  function reportUrl(reportId) {
+    return `${adminBase}/reports/${encodeURIComponent(reportId)}`;
+  }
+  function buildPayload(body, actions = []) {
+    return {
+      type: "message",
+      attachments: [
+        {
+          contentType: "application/vnd.microsoft.card.adaptive",
+          content: {
+            $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+            type: "AdaptiveCard",
+            version: "1.4",
+            body,
+            actions
+          }
+        }
+      ]
+    };
+  }
+  async function post(payload) {
+    const res = await f(cfg.webhookUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`Teams webhook ${res.status}: ${text.slice(0, 300)}`);
+    }
+  }
+  return (0, import_plugin_sdk.createPluginHandler)({
+    secret: cfg.mushiSecret,
+    on: {
+      "report.classified": async (e) => {
+        const data = e.data;
+        const { report, classification } = data;
+        const color = SEVERITY_COLORS[classification.severity] ?? "accent";
+        const body = [
+          {
+            type: "TextBlock",
+            size: "Large",
+            weight: "Bolder",
+            text: `New ${classification.category} report classified`,
+            wrap: true
+          },
+          {
+            type: "TextBlock",
+            text: report.title ?? `Mushi report \`${report.id.slice(0, 8)}...\``,
+            wrap: true,
+            spacing: "None"
+          },
+          {
+            type: "FactSet",
+            facts: [
+              { title: "Severity", value: classification.severity },
+              { title: "Category", value: classification.category },
+              { title: "Confidence", value: `${Math.round(classification.confidence * 100)}%` },
+              { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` }
+            ]
+          },
+          {
+            type: "TextBlock",
+            text: e.occurredAt,
+            size: "Small",
+            color: "default",
+            isSubtle: true,
+            spacing: "Medium"
+          }
+        ];
+        await post(
+          buildPayload(
+            [
+              {
+                type: "Container",
+                style: color,
+                items: body
+              }
+            ],
+            [
+              {
+                type: "Action.OpenUrl",
+                title: "View in Mushi",
+                url: reportUrl(report.id)
+              }
+            ]
+          )
+        );
+      },
+      "fix.proposed": async (e) => {
+        const data = e.data;
+        const { report, fix } = data;
+        const facts = [
+          { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` },
+          { title: "Fix status", value: fix.status }
+        ];
+        if (fix.branch) facts.push({ title: "Branch", value: fix.branch });
+        const actions = [
+          { type: "Action.OpenUrl", title: "View report", url: reportUrl(report.id) }
+        ];
+        if (fix.pullRequestUrl) {
+          actions.push({ type: "Action.OpenUrl", title: "View Pull Request", url: fix.pullRequestUrl });
+        }
+        await post(
+          buildPayload([
+            {
+              type: "Container",
+              style: "accent",
+              items: [
+                { type: "TextBlock", size: "Large", weight: "Bolder", text: "Fix proposed by Mushi", wrap: true },
+                {
+                  type: "TextBlock",
+                  text: fix.summary ?? `A fix has been proposed for report \`${report.id.slice(0, 8)}...\``,
+                  wrap: true,
+                  spacing: "None"
+                },
+                { type: "FactSet", facts }
+              ]
+            }
+          ], actions)
+        );
+      },
+      "fix.applied": async (e) => {
+        const data = e.data;
+        const { report, fix } = data;
+        const actions = [
+          { type: "Action.OpenUrl", title: "View report", url: reportUrl(report.id) }
+        ];
+        if (fix.pullRequestUrl) {
+          actions.push({ type: "Action.OpenUrl", title: "View merged PR", url: fix.pullRequestUrl });
+        }
+        await post(
+          buildPayload([
+            {
+              type: "Container",
+              style: "good",
+              items: [
+                { type: "TextBlock", size: "Large", weight: "Bolder", text: "Fix applied \u2014 issue resolved", wrap: true },
+                {
+                  type: "TextBlock",
+                  text: fix.summary ?? `Fix merged for report \`${report.id.slice(0, 8)}...\``,
+                  wrap: true,
+                  spacing: "None"
+                },
+                {
+                  type: "FactSet",
+                  facts: [
+                    { title: "Report ID", value: `\`${report.id.slice(0, 8)}...\`` },
+                    { title: "Fix status", value: fix.status }
+                  ]
+                }
+              ]
+            }
+          ], actions)
+        );
+      }
+    },
+    logger: {
+      info: (msg, meta) => console.log(`[mushi-plugin-msteams] ${msg}`, meta ?? ""),
+      warn: (msg, meta) => console.warn(`[mushi-plugin-msteams] ${msg}`, meta ?? ""),
+      error: (msg, meta) => console.error(`[mushi-plugin-msteams] ${msg}`, meta ?? "")
+    }
+  });
+}
+// src/server.ts
+var port = Number(process.env.PORT ?? 3e3);
+var handler = createMsteamsPlugin({
+  mushiSecret: required("MUSHI_PLUGIN_SECRET"),
+  webhookUrl: required("TEAMS_WEBHOOK_URL"),
+  adminBaseUrl: process.env.ADMIN_BASE_URL ?? ""
+});
+(0, import_node_http.createServer)(async (req, res) => {
+  if (req.method !== "POST" || req.url !== "/mushi/webhook") {
+    res.statusCode = 404;
+    res.end();
+    return;
+  }
+  const chunks = [];
+  req.on("data", (c) => chunks.push(c));
+  req.on("end", async () => {
+    const rawBody = Buffer.concat(chunks).toString("utf8");
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) headers[k] = Array.isArray(v) ? v[0] : v;
+    const result = await handler({ rawBody, headers });
+    res.statusCode = result.status;
+    res.setHeader("Content-Type", "application/json");
+    res.end(JSON.stringify(result.body));
+  });
+}).listen(port, () => {
+  console.warn(`mushi-plugin-msteams listening on :${port}`);
+});
+function required(name) {
+  const v = process.env[name];
+  if (!v) {
+    console.error(`Missing required env var: ${name}`);
+    process.exit(1);
+  }
+  return v;
+}

package/dist/server.d.cts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+
2	+ export { }

package/dist/server.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+
2	+ export { }

package/dist/server.js ADDED Viewed

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import {
+  createMsteamsPlugin
+} from "./chunk-NTWIK2O3.js";
+// src/server.ts
+import { createServer } from "http";
+var port = Number(process.env.PORT ?? 3e3);
+var handler = createMsteamsPlugin({
+  mushiSecret: required("MUSHI_PLUGIN_SECRET"),
+  webhookUrl: required("TEAMS_WEBHOOK_URL"),
+  adminBaseUrl: process.env.ADMIN_BASE_URL ?? ""
+});
+createServer(async (req, res) => {
+  if (req.method !== "POST" || req.url !== "/mushi/webhook") {
+    res.statusCode = 404;
+    res.end();
+    return;
+  }
+  const chunks = [];
+  req.on("data", (c) => chunks.push(c));
+  req.on("end", async () => {
+    const rawBody = Buffer.concat(chunks).toString("utf8");
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) headers[k] = Array.isArray(v) ? v[0] : v;
+    const result = await handler({ rawBody, headers });
+    res.statusCode = result.status;
+    res.setHeader("Content-Type", "application/json");
+    res.end(JSON.stringify(result.body));
+  });
+}).listen(port, () => {
+  console.warn(`mushi-plugin-msteams listening on :${port}`);
+});
+function required(name) {
+  const v = process.env[name];
+  if (!v) {
+    console.error(`Missing required env var: ${name}`);
+    process.exit(1);
+  }
+  return v;
+}

package/package.json ADDED Viewed

@@ -0,0 +1,64 @@
+{
+  "name": "@mushi-mushi/plugin-msteams",
+  "version": "0.1.1",
+  "description": "Mushi Mushi plugin for Microsoft Teams — posts Adaptive Cards to an Incoming Webhook for report and fix lifecycle events.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "bin": {
+    "mushi-plugin-msteams": "./dist/server.js"
+  },
+  "sideEffects": false,
+  "dependencies": {
+    "@mushi-mushi/plugin-sdk": "^0.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsup": "^8.4.0",
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.4"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/kensaurus/mushi-mushi.git",
+    "directory": "packages/plugin-msteams"
+  },
+  "keywords": [
+    "mushi-mushi",
+    "microsoft-teams",
+    "msteams",
+    "plugin",
+    "notifications",
+    "adaptive-cards"
+  ],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}