@pome-sh/cli 0.1.0 → 0.2.0

package/dist/src/twin-slack/auth.d.ts

@@ -1,38 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-export interface SessionClaims {
-    sid: string;
-    team_id: string;
-    exp: number;
-    login?: string;
-}
-export interface Session {
-    sid: string;
-    team_id: string;
-    login?: string;
-}
-export declare function resolveAuthSecret(): string;
-export declare function bearerAuth(): MiddlewareHandler;
-/**
- * Admin endpoint protection. Tiered policy:
- *   1. TWIN_ADMIN_TOKEN set → require X-Admin-Token to match (timing-safe).
- *   2. TWIN_ADMIN_TOKEN unset + remoteAddress known → allow only loopback.
- *   3. TWIN_ADMIN_TOKEN unset + remoteAddress unknown (test path) →
- *      allow only when NODE_ENV is not "production".
- *
- * The unknown-remote case is the gap that the legacy localhostOnly() fell
- * through. In production we now deny it explicitly; in tests we still allow
- * so the in-process Hono harness keeps working without env plumbing.
- */
-export declare function requireAdminAuth(): MiddlewareHandler;
-export declare const localhostOnly: typeof requireAdminAuth;
-/**
- * Build a provider-shape Slack token. When `exp` is passed, emits the
- * 4-segment shape `<prefix>-pome-<base64url(sid)>_<exp>_<sig>` where the
- * HMAC covers `slack:<sid>:<exp>` so a leaked token expires with its
- * session. When `exp` is omitted, emits the legacy 3-segment shape for
- * backward compatibility — verifyProviderToken accepts both.
- *
- * Cloud control-plane should always pass `exp` matching the issued JWT's
- * `exp` claim so xoxb / xoxp tokens cannot outlive their session.
- */
-export declare function signSlackProviderToken(sid: string, secret?: string, prefix?: "xoxb" | "xoxp", exp?: number): string;

package/dist/src/twin-slack/auth.js

@@ -1,219 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { verify } from "hono/jwt";
-import { slackError } from "./serializers.js";
-export function resolveAuthSecret() {
-    const secret = process.env.TWIN_AUTH_SECRET;
-    if (!secret && process.env.NODE_ENV === "production") {
-        throw new Error("TWIN_AUTH_SECRET required in production");
-    }
-    return secret ?? "dev-only-insecure-secret";
-}
-function unauthorized(code = "invalid_auth") {
-    return Response.json(slackError(code), { status: 401 });
-}
-/**
- * Resolve the bearer token from any of the locations real Slack accepts:
- *   1. Authorization: Bearer <token>  (preferred — MCP / SDK default)
- *   2. ?token=<token> in the URL    (some legacy Slack SDK paths)
- *   3. token=<token> in the form body (Slack docs note this is supported
- *      for application/x-www-form-urlencoded requests).
- *
- * We read the form body via parseBody() — but only when the content-type
- * is form-encoded, to avoid breaking JSON streaming reads downstream.
- */
-async function resolveToken(c) {
-    const header = c.req.header("Authorization") ?? c.req.header("authorization");
-    if (header && header.startsWith("Bearer ")) {
-        const t = header.slice("Bearer ".length).trim();
-        if (t)
-            return t;
-    }
-    // ?token= fallback (query string).
-    const qToken = c.req.query("token");
-    if (qToken)
-        return qToken;
-    // form-body token= fallback. Only attempt for form-encoded POSTs.
-    const contentType = (c.req.header("content-type") ?? "").toLowerCase();
-    if (c.req.method === "POST" &&
-        (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data"))) {
-        try {
-            // parseBody is buffered + caches the parsed body on Hono's context,
-            // so downstream handlers calling parseFormOrJson get the same object.
-            const body = (await c.req.parseBody());
-            const formToken = body.token;
-            if (typeof formToken === "string" && formToken.length > 0)
-                return formToken;
-        }
-        catch {
-            // ignore parse failures; auth fall-through returns not_authed
-        }
-    }
-    return undefined;
-}
-function extractSidFromUrl(rawUrl) {
-    try {
-        const path = new URL(rawUrl).pathname;
-        const match = path.match(/^\/s\/([^/]+)/);
-        return match?.[1] ? decodeURIComponent(match[1]) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function bearerAuth() {
-    return async (c, next) => {
-        const token = await resolveToken(c);
-        if (!token)
-            return unauthorized("not_authed");
-        // Provider-shape Slack tokens: xoxb-pome-<sid>-<sig> | xoxp-pome-<sid>-<sig>
-        const providerSid = verifyProviderToken(token);
-        if (providerSid) {
-            const pathSid = c.req.param("sid") ?? extractSidFromUrl(c.req.url);
-            if (providerSid !== pathSid) {
-                return Response.json(slackError("invalid_auth"), { status: 401 });
-            }
-            c.set("session", { sid: providerSid, team_id: "provider-shaped", login: "pome-agent" });
-            await next();
-            return;
-        }
-        let claims;
-        try {
-            claims = (await verify(token, resolveAuthSecret(), "HS256"));
-        }
-        catch (err) {
-            const name = err.name ?? "";
-            if (name === "JwtTokenExpired" || /expired/i.test(err.message ?? "")) {
-                return unauthorized("token_expired");
-            }
-            return unauthorized("invalid_auth");
-        }
-        if (typeof claims.exp === "number" && claims.exp < Math.floor(Date.now() / 1000)) {
-            return unauthorized("token_expired");
-        }
-        const pathSid = c.req.param("sid") ?? extractSidFromUrl(c.req.url);
-        if (!claims.sid || claims.sid !== pathSid) {
-            return Response.json(slackError("invalid_auth"), { status: 401 });
-        }
-        const session = { sid: claims.sid, team_id: claims.team_id };
-        if (typeof claims.login === "string" && claims.login.length > 0)
-            session.login = claims.login;
-        c.set("session", session);
-        await next();
-    };
-}
-function verifyProviderToken(token) {
-    // Preferred shape (with session expiry): xoxb-pome-<base64url(sid)>_<exp>_<sig>
-    // Legacy shape (no expiry):              xoxb-pome-<base64url(sid)>_<sig>
-    // The `\d+` middle segment unambiguously picks the new shape over the legacy.
-    const matchExp = token.match(/^xox[bp]-pome-([^_]+)_(\d+)_(.+)$/);
-    if (matchExp) {
-        const expSeconds = Number(matchExp[2]);
-        if (!Number.isFinite(expSeconds))
-            return undefined;
-        if (expSeconds < Math.floor(Date.now() / 1000))
-            return undefined;
-        const sid = decodeBase64Url(matchExp[1]);
-        if (!sid)
-            return undefined;
-        const expected = signProviderExp(sid, expSeconds, resolveAuthSecret());
-        if (safeEqual(matchExp[3], expected))
-            return sid;
-        return undefined;
-    }
-    const matchLegacy = token.match(/^xox[bp]-pome-([^_]+)_(.+)$/);
-    if (!matchLegacy)
-        return undefined;
-    const sid = decodeBase64Url(matchLegacy[1]);
-    if (!sid)
-        return undefined;
-    const expected = signProvider(sid, resolveAuthSecret());
-    if (safeEqual(matchLegacy[2], expected))
-        return sid;
-    return undefined;
-}
-function signProvider(sid, secret) {
-    return createHmac("sha256", secret).update(`slack:${sid}`).digest("base64url").slice(0, 22);
-}
-function signProviderExp(sid, exp, secret) {
-    return createHmac("sha256", secret).update(`slack:${sid}:${exp}`).digest("base64url").slice(0, 22);
-}
-function decodeBase64Url(value) {
-    try {
-        return Buffer.from(value, "base64url").toString("utf8");
-    }
-    catch {
-        return undefined;
-    }
-}
-function safeEqual(a, b) {
-    const ab = Buffer.from(a);
-    const bb = Buffer.from(b);
-    return ab.length === bb.length && timingSafeEqual(ab, bb);
-}
-/**
- * Admin endpoint protection. Tiered policy:
- *   1. TWIN_ADMIN_TOKEN set → require X-Admin-Token to match (timing-safe).
- *   2. TWIN_ADMIN_TOKEN unset + remoteAddress known → allow only loopback.
- *   3. TWIN_ADMIN_TOKEN unset + remoteAddress unknown (test path) →
- *      allow only when NODE_ENV is not "production".
- *
- * The unknown-remote case is the gap that the legacy localhostOnly() fell
- * through. In production we now deny it explicitly; in tests we still allow
- * so the in-process Hono harness keeps working without env plumbing.
- */
-export function requireAdminAuth() {
-    return async (c, next) => {
-        const adminToken = process.env.TWIN_ADMIN_TOKEN;
-        if (adminToken && adminToken.length > 0) {
-            const provided = c.req.header("X-Admin-Token") ?? c.req.header("x-admin-token");
-            if (!provided) {
-                return Response.json(slackError("restricted_action"), { status: 403 });
-            }
-            const a = Buffer.from(provided);
-            const b = Buffer.from(adminToken);
-            if (a.length !== b.length || !timingSafeEqual(a, b)) {
-                return Response.json(slackError("restricted_action"), { status: 403 });
-            }
-            await next();
-            return;
-        }
-        const remote = c.env?.incoming?.socket?.remoteAddress;
-        if (!remote) {
-            if (process.env.NODE_ENV === "production") {
-                return Response.json(slackError("restricted_action"), { status: 403 });
-            }
-            await next();
-            return;
-        }
-        const isLocal = remote === "127.0.0.1" ||
-            remote === "::1" ||
-            remote === "::ffff:127.0.0.1" ||
-            remote === "localhost";
-        if (!isLocal) {
-            return Response.json(slackError("restricted_action"), { status: 403 });
-        }
-        await next();
-    };
-}
-// Back-compat alias — existing imports of localhostOnly resolve to the new
-// tiered policy. New code should import requireAdminAuth directly.
-export const localhostOnly = requireAdminAuth;
-/**
- * Build a provider-shape Slack token. When `exp` is passed, emits the
- * 4-segment shape `<prefix>-pome-<base64url(sid)>_<exp>_<sig>` where the
- * HMAC covers `slack:<sid>:<exp>` so a leaked token expires with its
- * session. When `exp` is omitted, emits the legacy 3-segment shape for
- * backward compatibility — verifyProviderToken accepts both.
- *
- * Cloud control-plane should always pass `exp` matching the issued JWT's
- * `exp` claim so xoxb / xoxp tokens cannot outlive their session.
- */
-export function signSlackProviderToken(sid, secret = resolveAuthSecret(), prefix = "xoxb", exp) {
-    const sigEncoded = Buffer.from(sid, "utf8").toString("base64url");
-    if (typeof exp === "number" && Number.isFinite(exp)) {
-        const sig = signProviderExp(sid, exp, secret);
-        return `${prefix}-pome-${sigEncoded}_${exp}_${sig}`;
-    }
-    const sig = signProvider(sid, secret);
-    return `${prefix}-pome-${sigEncoded}_${sig}`;
-}

package/dist/src/twin-slack/build-info.d.ts

@@ -1,7 +0,0 @@
-export type TwinBuildInfo = {
-    package: string;
-    version: string;
-    git_sha: string;
-    build_time: string;
-};
-export declare function twinBuildInfo(): TwinBuildInfo;

package/dist/src/twin-slack/build-info.js

@@ -1,9 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-export function twinBuildInfo() {
-    return {
-        package: "@pome-sh/twin-slack",
-        version: process.env.POME_TWIN_VERSION ?? "0.1.0",
-        git_sha: process.env.POME_TWIN_GIT_SHA ?? process.env.VERCEL_GIT_COMMIT_SHA ?? "dev",
-        build_time: process.env.POME_TWIN_BUILD_TIME ?? "dev",
-    };
-}

package/dist/src/twin-slack/db.d.ts

@@ -1,4 +0,0 @@
-import type { SlackTwinDatabase } from "./types.js";
-export declare function openSlackTwinDatabase(path?: string): SlackTwinDatabase;
-export declare function migrate(db: SlackTwinDatabase): void;
-export declare function resetDatabase(db: SlackTwinDatabase): void;

package/dist/src/twin-slack/db.js

@@ -1,213 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import Database from "better-sqlite3";
-import { mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-const MIGRATION_SQL = `
-CREATE TABLE IF NOT EXISTS workspaces (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  domain TEXT NOT NULL,
-  url TEXT NOT NULL,
-  enterprise_id TEXT,
-  created_at TEXT NOT NULL,
-  entity_counter INTEGER NOT NULL DEFAULT 0
-);
-
-CREATE TABLE IF NOT EXISTS users (
-  id TEXT PRIMARY KEY,
-  team_id TEXT NOT NULL,
-  name TEXT NOT NULL,
-  real_name TEXT NOT NULL DEFAULT '',
-  display_name TEXT NOT NULL DEFAULT '',
-  email TEXT,
-  is_bot INTEGER NOT NULL DEFAULT 0,
-  is_admin INTEGER NOT NULL DEFAULT 0,
-  deleted INTEGER NOT NULL DEFAULT 0,
-  tz TEXT NOT NULL DEFAULT 'America/Los_Angeles',
-  profile_json TEXT NOT NULL DEFAULT '{}',
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL,
-  FOREIGN KEY (team_id) REFERENCES workspaces(id) ON DELETE CASCADE
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS users_email_idx
-  ON users(team_id, email) WHERE email IS NOT NULL;
-
-CREATE TABLE IF NOT EXISTS channels (
-  id TEXT PRIMARY KEY,
-  team_id TEXT NOT NULL,
-  name TEXT NOT NULL DEFAULT '',
-  is_channel INTEGER NOT NULL DEFAULT 1,
-  is_group INTEGER NOT NULL DEFAULT 0,
-  is_im INTEGER NOT NULL DEFAULT 0,
-  is_mpim INTEGER NOT NULL DEFAULT 0,
-  is_private INTEGER NOT NULL DEFAULT 0,
-  is_archived INTEGER NOT NULL DEFAULT 0,
-  topic TEXT NOT NULL DEFAULT '',
-  purpose TEXT NOT NULL DEFAULT '',
-  creator TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  ts_counter INTEGER NOT NULL DEFAULT 0,
-  dm_signature TEXT,
-  FOREIGN KEY (team_id) REFERENCES workspaces(id) ON DELETE CASCADE
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS channels_name_idx
-  ON channels(team_id, name) WHERE name <> '';
-
--- Deterministic DM / MPIM dedup: dm_signature is the sorted member-id list
--- joined with a pipe character. NULL on public channels and private groups.
-CREATE UNIQUE INDEX IF NOT EXISTS channels_dm_signature_idx
-  ON channels(team_id, dm_signature) WHERE dm_signature IS NOT NULL;
-
-CREATE TABLE IF NOT EXISTS channel_members (
-  channel_id TEXT NOT NULL,
-  user_id TEXT NOT NULL,
-  joined_at TEXT NOT NULL,
-  last_read TEXT NOT NULL DEFAULT '0000000000.000000',
-  PRIMARY KEY (channel_id, user_id),
-  FOREIGN KEY (channel_id) REFERENCES channels(id) ON DELETE CASCADE,
-  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-);
-
-CREATE TABLE IF NOT EXISTS messages (
-  channel_id TEXT NOT NULL,
-  ts TEXT NOT NULL,
-  user_id TEXT NOT NULL,
-  text TEXT NOT NULL,
-  subtype TEXT,
-  thread_ts TEXT,
-  reply_count INTEGER NOT NULL DEFAULT 0,
-  reply_users_count INTEGER NOT NULL DEFAULT 0,
-  latest_reply TEXT,
-  edited_user_id TEXT,
-  edited_ts TEXT,
-  blocks_json TEXT NOT NULL DEFAULT '[]',
-  attachments_json TEXT NOT NULL DEFAULT '[]',
-  bot_id TEXT,
-  app_id TEXT,
-  username TEXT,
-  icon_url TEXT,
-  icon_emoji TEXT,
-  PRIMARY KEY (channel_id, ts),
-  FOREIGN KEY (channel_id) REFERENCES channels(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS messages_history_idx ON messages(channel_id, ts DESC);
-CREATE INDEX IF NOT EXISTS messages_thread_idx ON messages(channel_id, thread_ts, ts);
-
-CREATE TABLE IF NOT EXISTS reactions (
-  channel_id TEXT NOT NULL,
-  message_ts TEXT NOT NULL,
-  name TEXT NOT NULL,
-  user_id TEXT NOT NULL,
-  added_at TEXT NOT NULL,
-  PRIMARY KEY (channel_id, message_ts, name, user_id),
-  FOREIGN KEY (channel_id, message_ts) REFERENCES messages(channel_id, ts) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS reactions_by_msg_idx ON reactions(channel_id, message_ts);
-
-CREATE TABLE IF NOT EXISTS pins (
-  channel_id TEXT NOT NULL,
-  message_ts TEXT NOT NULL,
-  pinned_by TEXT NOT NULL,
-  pinned_at TEXT NOT NULL,
-  PRIMARY KEY (channel_id, message_ts),
-  FOREIGN KEY (channel_id, message_ts) REFERENCES messages(channel_id, ts) ON DELETE CASCADE
-);
-
-CREATE TABLE IF NOT EXISTS files (
-  id TEXT PRIMARY KEY,
-  team_id TEXT NOT NULL,
-  user_id TEXT NOT NULL,
-  name TEXT NOT NULL,
-  title TEXT NOT NULL DEFAULT '',
-  mimetype TEXT NOT NULL DEFAULT 'text/plain',
-  filetype TEXT NOT NULL DEFAULT 'text',
-  size INTEGER NOT NULL DEFAULT 0,
-  url_private TEXT NOT NULL DEFAULT '',
-  channels_json TEXT NOT NULL DEFAULT '[]',
-  deleted INTEGER NOT NULL DEFAULT 0,
-  content TEXT,
-  created_at TEXT NOT NULL,
-  FOREIGN KEY (team_id) REFERENCES workspaces(id) ON DELETE CASCADE
-);
-
-CREATE TABLE IF NOT EXISTS bookmarks (
-  id TEXT PRIMARY KEY,
-  channel_id TEXT NOT NULL,
-  title TEXT NOT NULL,
-  link TEXT NOT NULL,
-  emoji TEXT,
-  type TEXT NOT NULL DEFAULT 'link',
-  created_by TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  FOREIGN KEY (channel_id) REFERENCES channels(id) ON DELETE CASCADE
-);
-
-CREATE TABLE IF NOT EXISTS scheduled_messages (
-  id TEXT PRIMARY KEY,
-  channel_id TEXT NOT NULL,
-  user_id TEXT NOT NULL,
-  text TEXT NOT NULL,
-  thread_ts TEXT,
-  post_at INTEGER NOT NULL,
-  date_created INTEGER NOT NULL,
-  blocks_json TEXT NOT NULL DEFAULT '[]',
-  FOREIGN KEY (channel_id) REFERENCES channels(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS messages_text_idx ON messages(text);
-`;
-const RESET_SQL = `
-DELETE FROM scheduled_messages;
-DELETE FROM bookmarks;
-DELETE FROM files;
-DELETE FROM pins;
-DELETE FROM reactions;
-DELETE FROM messages;
-DELETE FROM channel_members;
-DELETE FROM channels;
-DELETE FROM users;
-DELETE FROM workspaces;
-`;
-export function openSlackTwinDatabase(path = process.env.SLACK_CLONE_DB ?? ":memory:") {
-    if (path !== ":memory:") {
-        mkdirSync(dirname(path), { recursive: true });
-    }
-    const db = new Database(path);
-    migrate(db);
-    return db;
-}
-export function migrate(db) {
-    db.pragma("busy_timeout = 5000");
-    db.pragma("journal_mode = WAL");
-    db.pragma("foreign_keys = ON");
-    db.exec(MIGRATION_SQL);
-    // Append-only column additions for forward-compat (e.g. future fields).
-    ensureColumn(db, "workspaces", "entity_counter", "INTEGER NOT NULL DEFAULT 0");
-    ensureColumn(db, "workspaces", "ts_counter", "INTEGER NOT NULL DEFAULT 0");
-    ensureColumn(db, "channels", "ts_counter", "INTEGER NOT NULL DEFAULT 0");
-    ensureColumn(db, "channels", "dm_signature", "TEXT");
-    // Backfill workspace.ts_counter from per-channel max so any in-flight
-    // snapshot stays monotonic after the per-workspace switch.
-    db.exec(`UPDATE workspaces SET ts_counter = COALESCE(
-       (SELECT MAX(ts_counter) FROM channels WHERE team_id = workspaces.id),
-       ts_counter
-     ) WHERE ts_counter = 0`);
-    ensureColumn(db, "messages", "bot_id", "TEXT");
-    ensureColumn(db, "messages", "app_id", "TEXT");
-    ensureColumn(db, "messages", "username", "TEXT");
-    ensureColumn(db, "messages", "icon_url", "TEXT");
-    ensureColumn(db, "messages", "icon_emoji", "TEXT");
-}
-export function resetDatabase(db) {
-    db.exec(RESET_SQL);
-}
-function ensureColumn(db, table, column, definition) {
-    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-    if (!columns.some((row) => row.name === column)) {
-        db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
-    }
-}