cross-poster-sdk 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 takao-dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,205 @@
-# Temporary Holding Version
+# cross-poster-sdk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/takao-dev/cross-poster-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/takao-dev/cross-poster-sdk/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/takao-dev/cross-poster-sdk/actions/workflows/codeql.yml/badge.svg)](https://github.com/takao-dev/cross-poster-sdk/actions/workflows/codeql.yml)
+[![npm version](https://img.shields.io/npm/v/cross-poster-sdk.svg)](https://www.npmjs.com/package/cross-poster-sdk)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+> **Zero-dependency, multi-SNS cross-posting SDK for X (Twitter), Mastodon, Bluesky (AT Protocol), Misskey, and Meta Threads, engineered with DNS-rebinding-safe SSRF defense and AES-256-GCM credential envelopes.**
+
+Cross-posting across federated (Mastodon, Misskey) and centralized (X, Bluesky, Threads) networks introduces severe security hazards: users supply arbitrary instance domains that can target internal cloud metadata endpoints (`169.254.169.254`) or trigger DNS rebinding attacks. `cross-poster-sdk` provides an all-in-one unified cross-posting pipeline with rock-solid security defaults and **zero external npm dependencies**.
+
+---
+
+## Features
+
+- **Unified 5-Network Adapter**:
+  Post and delete across **X (v2 API)**, **Mastodon (v1 API)**, **Bluesky (AT Protocol / XRPC)**, **Misskey (Notes API)**, and **Threads (2-step container API)** through a single clean interface.
+- **DNS-Rebinding-Proof SSRF Protection**:
+  Validates destination addresses against private/internal IPv4 and IPv6 CIDR blocks (RFC1918, CGNAT, Loopback, Link-Local, Cloud Metadata, 6to4, IPv4-mapped IPv6). Resolves and **pins the IP address** directly into the Node.js socket TLS handshake (`lookup` hook), completely eliminating Time-Of-Check to Time-Of-Use (TOCTOU) DNS rebinding attacks.
+- **AES-256-GCM Credential Envelopes**:
+  Built-in `v1.<iv>.<tag>.<ciphertext>` authenticated encryption helpers for securely storing OAuth tokens and app passwords at rest in your database.
+- **Dry-Run Simulation Mode**:
+  Test your cross-posting workflows locally without touching live APIs or burning rate limits.
+- **Zero Runtime Dependencies**:
+  Built exclusively on Node.js core modules (`node:https`, `node:dns/promises`, `node:net`, `node:crypto`).
+
+---
+
+## Installation
+
+```bash
+npm install cross-poster-sdk
+```
+
+Requirements:
+- Node.js `>= 18.0.0`
+
+---
+
+## Quick Start
+
+### 1. Unified Cross-Posting
+
+```typescript
+import { postToService, deleteFromService } from 'cross-poster-sdk';
+
+// 1. Post to Bluesky
+const bskyResult = await postToService(
+  {
+    service: 'bluesky',
+    credentials: {
+      username: 'handle.bsky.social',
+      appPassword: 'xxxx-xxxx-xxxx-xxxx',
+    },
+  },
+  'Hello from cross-poster-sdk! 🚀'
+);
+console.log('Bluesky Post URI:', bskyResult.remoteId);
+// -> "at://did:plc:.../app.bsky.feed.post/3k..."
+
+// 2. Post to a custom Mastodon or Misskey instance (SSRF-protected)
+const fediverseResult = await postToService(
+  {
+    service: 'mastodon',
+    instanceUrl: 'https://mastodon.social',
+    credentials: { accessToken: 'YOUR_MASTODON_ACCESS_TOKEN' },
+  },
+  'Federated status update'
+);
+console.log('Mastodon Status ID:', fediverseResult.remoteId);
+
+// 3. Delete a post
+await deleteFromService(
+  {
+    service: 'bluesky',
+    credentials: {
+      username: 'handle.bsky.social',
+      appPassword: 'xxxx-xxxx-xxxx-xxxx',
+    },
+  },
+  bskyResult.remoteId!
+);
+```
+
+---
+
+## Supported Services & Credentials
+
+| Service | `service` identifier | Required Credentials | Notes |
+| :--- | :--- | :--- | :--- |
+| **Bluesky** | `'bluesky'` | `{ username, appPassword }` | Authenticates via ATProto XRPC `createSession` and writes to `app.bsky.feed.post` |
+| **Mastodon** | `'mastodon'` | `{ accessToken }`, `instanceUrl` | Posts via `/api/v1/statuses` with strict instance URL validation |
+| **Misskey** | `'misskey'` | `{ accessToken }`, `instanceUrl` | Posts via `/api/notes/create` with strict instance URL validation |
+| **Threads** | `'threads'` | `{ accessToken }` | Handles 2-step container creation and immediate publishing |
+| **X (Twitter)** | `'x'` | `{ accessToken }` | Uses Twitter API v2 `/2/tweets` |
+
+---
+
+## Security Architecture
+
+### Why standard `fetch()` is dangerous for Fediverse instances
+
+When accepting federated instance URLs from users (e.g. `https://my-community.net`), attackers can provide URLs that resolve to internal network addresses or use DNS rebinding (returning a public IP during DNS check, and `169.254.169.254` during HTTP connection):
+
+```mermaid
+sequenceDiagram
+    participant App as cross-poster-sdk
+    participant DNS as DNS Resolver
+    participant Target as Target / Internal Service
+
+    App->>DNS: Resolve "user-domain.com"
+    DNS-->>App: 93.184.216.34 (Public IP)
+    Note over App: Validates against private IP blocks (OK)
+    Note over App: Pins IP into TLS socket lookup hook!
+    App->>Target: Connect directly to pinned 93.184.216.34 (SNI: user-domain.com)
+    Note over App: Attacker's DNS TTL expiration has NO effect!
+```
+
+`cross-poster-sdk` blocks:
+- `127.0.0.0/8` (Loopback)
+- `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (Private RFC1918)
+- `169.254.0.0/16` (Link-local & AWS/GCP/Azure Cloud Metadata)
+- `100.64.0.0/10` (Carrier-Grade NAT)
+- `::1` (IPv6 loopback), `fe80::/10` (IPv6 Link-Local), `fc00::/7` (IPv6 Unique Local)
+- `::ffff:0:0/96` (IPv4-mapped IPv6)
+- Cloud internal hostnames (`metadata.google.internal`, `instance-data.ec2.internal`, `*.localhost`, `*.internal`)
+
+---
+
+### Credential Encryption at Rest
+
+Secure sensitive API tokens with authenticated AES-256-GCM before persisting them in your database:
+
+```typescript
+import { encryptCredentials, decryptCredentials } from 'cross-poster-sdk';
+import { randomBytes } from 'node:crypto';
+
+// 32-byte secret key (e.g. from process.env.ENCRYPTION_KEY)
+const secretKey = Buffer.from(process.env.APP_SECRET_KEY!, 'hex');
+
+// Encrypt into safe string envelope: "v1.<iv>.<tag>.<ciphertext>"
+const envelope = encryptCredentials({ accessToken: 'ghp_secretToken...' }, secretKey);
+
+// Decrypt safely (throws if tampered or counterfeit)
+const creds = decryptCredentials(envelope, secretKey);
+```
+
+---
+
+## Dry-Run Testing
+
+Simulate posts without invoking external network requests:
+
+```typescript
+const result = await postToService(
+  { service: 'x', credentials: {} },
+  'Testing post',
+  { dryRun: true }
+);
+
+console.log(result);
+// { remoteId: 'dry_x_04a8b792-...', simulated: true }
+```
+
+---
+
+## 🧵 Thread Splitting & Sequential Posting
+
+Different networks enforce different character counting rules (X counts CJK as 2 and URLs as 23; Bluesky counts Grapheme Clusters; Mastodon counts code points). `cross-poster-sdk` provides built-in calculators, natural text splitters with numbering indicators `(1/N)`, and sequential chained thread posting:
+
+```typescript
+import {
+  countServiceCharacters,
+  splitPostIntoThreads,
+  postThreadToService
+} from 'cross-poster-sdk';
+
+const myLongArticle = `Very long update text...`;
+
+// 1. Measure character weight for specific platform
+const xLength = countServiceCharacters('x', myLongArticle);
+
+// 2. Automatically split into numbered threads safe for the platform limits
+const xThreads = splitPostIntoThreads('x', myLongArticle, { numbering: true });
+// -> ['Paragraph 1... (1/3)', 'Paragraph 2... (2/3)', 'Paragraph 3... (3/3)']
+
+// 3. Post sequentially as linked reply thread
+const threadResults = await postThreadToService(
+  { service: 'x', credentials: { accessToken: 'token' } },
+  xThreads
+);
+console.log('Thread published! Root ID:', threadResults[0].remoteId);
+```
+
+---
+
+## TypeScript Support
+
+Complete TypeScript declarations are bundled in `./src/index.d.ts`. Types for `CrossPosterAccount`, `SupportedService`, `PostOptions`, and `PostResult` are exported automatically.
+
+---
+
+## License
+
+MIT © [takao-dev](https://github.com/takao-dev)

package/README_JA.md

@@ -0,0 +1,185 @@
+# cross-poster-sdk
+
+[![CI](https://github.com/takao-dev/cross-poster-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/takao-dev/cross-poster-sdk/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/cross-poster-sdk.svg)](https://www.npmjs.com/package/cross-poster-sdk)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+> **X（Twitter）、Mastodon、Bluesky（AT Protocol）、Misskey、Meta Threads に対応したゼロ依存マルチSNSクロスポストSDK。DNSリバインディング完全耐性を持つSSRF防御と、AES-256-GCM 資格情報暗号化エンベロープを内蔵。**
+
+[English README is available here](./README.md)
+
+---
+
+## 💡 なぜ `cross-poster-sdk` なのか？
+
+分散型SNS（Mastodon, Misskey）と中央集権型SNS（X, Bluesky, Threads）を横断してクロスポストするシステムを構築する場合、深刻なセキュリティリスクと複雑さに直面します：
+
+1. **悪意あるインスタンスURLによる SSRF ＆ クラウド認証情報窃取**:
+   ユーザーが自由に入力できるインスタンスドメイン（`https://my-instance.com`）が悪意を持って内部ネットワークやクラウドのメタデータエンドポイント（`169.254.169.254`）に向けられていた場合、サーバーの機密情報や IAM 認証情報が即座に奪われます。
+2. **DNS リバインディング攻撃（TOCTOU）の脅威**:
+   URL検証時に正規のパブリックIPを返し、HTTP接続確立時のミリ秒で内部IP（`127.0.0.1` や `169.254.169.254`）を返すDNSリバインディング攻撃に対し、一般的な `fetch()` や `axios` では防御が極めて困難です。
+3. **API仕様と文字数計算の断片化**:
+   X (全角2/半角1/URL23), Bluesky (Grapheme Clusters), Mastodon (Code points) など、各社で異なる文字数制限やスレッド構造の処理。
+
+`cross-poster-sdk` はこれらをゼロ依存で完全に解決します：
+
+- **DNSリバインディング完全耐性を持つ SSRF 防御**:
+  プライベートIP、リンクローカル、CGNAT、ループバック、クラウドメタデータ、IPv4射影IPv6、6to4を完全遮断。DNS解決した安全なIPアドレスを **Node.js の TLS ソケットの `lookup` コールバックに直接ピン留め** するため、DNSのTTL改ざんによるすり替えが物理的に不可能です。
+- **統一 5-Network アダプター**:
+  `postToService` / `deleteFromService` の単一インターフェースで、5大SNSへの投稿・削除を網羅。
+- **各社仕様に忠実な文字数カウンター ＆ 自動スレッド分割**:
+  各SNS固有のカウントロジックに基づき、長文を最適な文末境界で分割して `(1/3)`, `(2/3)` などのナンバリングを付与し、連鎖スレッド投稿（`postThreadToService`）を実行。
+- **AES-256-GCM 資格情報エンベロープ**:
+  データベースに保存する OAuth トークンや App パスワードを `v1.<iv>.<tag>.<ciphertext>` 形式で安全に認証暗号化。
+- **外部依存ゼロ (Zero Dependencies)**:
+  Node.js 標準組み込みモジュール（`node:https`, `node:dns`, `node:net`, `node:crypto`）のみで完結。
+
+---
+
+## 📦 インストール
+
+```bash
+npm install cross-poster-sdk
+```
+
+要件: Node.js `>= 18.0.0`
+
+---
+
+## 🚀 クイックスタート
+
+### 1. 単一投稿と削除
+
+```typescript
+import { postToService, deleteFromService } from 'cross-poster-sdk';
+
+// 1. Bluesky へ投稿
+const bskyResult = await postToService(
+  {
+    service: 'bluesky',
+    credentials: {
+      username: 'handle.bsky.social',
+      appPassword: 'xxxx-xxxx-xxxx-xxxx',
+    },
+  },
+  'cross-poster-sdk からこんにちは！ 🚀'
+);
+console.log('Bluesky Post URI:', bskyResult.remoteId);
+
+// 2. カスタム Mastodon または Misskey インスタンスへ安全に投稿（SSRF保護済み）
+const mastodonResult = await postToService(
+  {
+    service: 'mastodon',
+    instanceUrl: 'https://mastodon.social',
+    credentials: { accessToken: 'YOUR_MASTODON_TOKEN' },
+  },
+  'Mastodonへのステータス投稿'
+);
+
+// 3. 投稿の削除
+await deleteFromService(
+  {
+    service: 'bluesky',
+    credentials: { username: 'handle.bsky.social', appPassword: 'xxxx-xxxx-xxxx-xxxx' },
+  },
+  bskyResult.remoteId!
+);
+```
+
+---
+
+### 2. スマート長文スレッド分割 ＆ 連鎖投稿
+
+各SNSの文字数上限に合わせて自動分割し、直前の投稿にリプライする形でスレッドを連続投稿します：
+
+```typescript
+import {
+  countServiceCharacters,
+  splitPostIntoThreads,
+  postThreadToService,
+} from 'cross-poster-sdk';
+
+const longText = `長文のアナウンス記事です...（非常に長い本文）...`;
+
+// 1. 各SNS固有の文字数重みを正確に測定
+const weight = countServiceCharacters('x', longText);
+
+// 2. ナンバリングインジケータ付きで安全な長さに分割
+const threads = splitPostIntoThreads('x', longText, { numbering: true });
+// -> ['段落1... (1/3)', '段落2... (2/3)', '段落3... (3/3)']
+
+// 3. 前の投稿へ自動リプライしながら一括連鎖投稿
+const results = await postThreadToService(
+  { service: 'x', credentials: { accessToken: 'token' } },
+  threads
+);
+console.log('スレッド投稿完了！親ツイートID:', results[0].remoteId);
+```
+
+---
+
+### 3. トークン暗号化エンベロープ
+
+データベースにアクセストークンを保存する際、平文ではなく AES-256-GCM 認証暗号化エンベロープとして保護します：
+
+```typescript
+import { encryptCredentials, decryptCredentials } from 'cross-poster-sdk';
+
+const secretKey = Buffer.from(process.env.APP_SECRET_KEY!, 'hex'); // 32バイト
+
+// 暗号化エンベロープを作成: "v1.<iv>.<tag>.<ciphertext>"
+const envelope = encryptCredentials({ accessToken: 'user-secret-oauth-token' }, secretKey);
+
+// 復号（改ざんや破損時は安全に例外スロー）
+const creds = decryptCredentials(envelope, secretKey);
+```
+
+---
+
+### 4. ドライラン（シミュレーション）モード
+
+API のレートリミットを消費せずに、ローカルテストやデバッグを実行できます：
+
+```typescript
+const dryResult = await postToService(
+  { service: 'x', credentials: {} },
+  'テストメッセージ',
+  { dryRun: true }
+);
+
+console.log(dryResult);
+// -> { remoteId: 'dry_x_04a8b792-...', simulated: true }
+```
+
+---
+
+## 🛡️ SSRF 防御の仕組み
+
+```
+ユーザー指定URL (例: https://custom-community.net)
+     │
+     ▼
+[URL形式検証] ── HTTPS 必須 / Basic認証情報の混入を禁止
+     │
+[DNS名前解決] ── 全IPアドレスを取得
+     │
+[IP範囲検証]  ── 以下の危険なIPブロックを完全遮断:
+                 • 127.0.0.0/8 (ループバック)
+                 • 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (プライベートIP)
+                 • 169.254.0.0/16 (リンクローカル / クラウドメタデータ)
+                 • 100.64.0.0/10 (CGNAT)
+                 • ::1, fe80::/10, fc00::/7 (IPv6 ループバック/ローカル)
+                 • ::ffff:0:0/96 (IPv4射影IPv6)
+                 • 内部ホスト名 (*.internal, metadata.google.internal 等)
+     │
+     ▼
+[IPピン留め]  ── 検証を通過した IP を TLS ソケットの lookup フックに直接固定
+                 接続確立時の DNS 再問い合わせを発生させないため
+                 DNSリバインディング攻撃は成立しません。
+```
+
+---
+
+## 📄 ライセンス
+
+MIT License © 2026 takao-dev

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "cross-poster-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Zero-dependency multi-SNS cross-posting SDK (X, Mastodon, Bluesky, Misskey, Threads) with DNS-rebinding-safe SSRF protection for federated instances and AES-256-GCM credential envelopes.",
+  "type": "module",
+  "main": "./src/index.mjs",
+  "types": "./src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.mjs"
+    }
+  },
+  "files": [
+    "src",
+    "LICENSE",
+    "README.md",
+    "README_JA.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "test": "node --test",
+    "test:coverage": "node -e \"require('node:fs').mkdirSync('coverage', {recursive: true})\" && node --test --experimental-test-coverage --test-reporter=spec --test-reporter=lcov --test-reporter-destination=stdout --test-reporter-destination=coverage/lcov.info"
+  },
+  "sideEffects": false,
+  "keywords": [
+    "cross-post",
+    "social-media",
+    "x",
+    "twitter",
+    "mastodon",
+    "bluesky",
+    "atproto",
+    "misskey",
+    "threads",
+    "fediverse",
+    "ssrf-protection",
+    "dns-rebinding",
+    "zero-dependencies"
+  ],
+  "author": "takao-dev",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/takao-dev/cross-poster-sdk.git"
+  }
+}

package/src/index.d.ts

@@ -0,0 +1,149 @@
+/// <reference types="node" />
+
+import type { LookupAddress } from 'node:dns';
+import type { URL } from 'node:url';
+
+export type SupportedService = 'x' | 'mastodon' | 'bluesky' | 'misskey' | 'threads';
+
+export declare const SUPPORTED_SERVICES: ReadonlySet<SupportedService>;
+
+export declare const SERVICE_LABELS: Record<SupportedService, string>;
+
+export declare const SERVICE_LIMITS: Record<SupportedService, number>;
+
+export interface SplitPostOptions {
+  numbering?: boolean;
+}
+
+export declare function countServiceCharacters(
+  service: SupportedService,
+  text: string
+): number;
+
+export declare function splitPostIntoThreads(
+  service: SupportedService,
+  text: string,
+  options?: SplitPostOptions
+): string[];
+
+export interface XCredentials {
+  accessToken: string;
+}
+
+export interface MastodonCredentials {
+  accessToken: string;
+}
+
+export interface MisskeyCredentials {
+  accessToken: string;
+}
+
+export interface BlueskyCredentials {
+  username: string;
+  appPassword: string;
+}
+
+export interface ThreadsCredentials {
+  accessToken: string;
+}
+
+export type ServiceCredentials =
+  | XCredentials
+  | MastodonCredentials
+  | MisskeyCredentials
+  | BlueskyCredentials
+  | ThreadsCredentials;
+
+export interface CrossPosterAccount {
+  service: SupportedService;
+  instanceUrl?: string | null;
+  credentials: Record<string, any>;
+}
+
+export interface PostOptions {
+  dryRun?: boolean;
+  replyToId?: string | null;
+  replyRoot?: string | null;
+  replyRootCid?: string | null;
+  replyParentCid?: string | null;
+  requestImpl?: (
+    url: string,
+    options: {
+      method?: string;
+      headers?: Record<string, string>;
+      body?: string | URLSearchParams;
+      signal?: AbortSignal;
+    }
+  ) => Promise<{
+    status: number;
+    ok: boolean;
+    text: () => Promise<string>;
+  }>;
+}
+
+export interface PostResult {
+  remoteId: string | null;
+  simulated?: boolean;
+}
+
+export interface DeleteResult {
+  simulated?: boolean;
+}
+
+export declare function normalizeInstanceUrl(value: unknown): string;
+
+export declare function isUnsafeIpv4(address: string): boolean;
+
+export declare function parseIpv6(address: string): number[] | null;
+
+export declare function isUnsafeAddress(address: string): boolean;
+
+export declare function createPinnedAddressLookup(
+  address: string
+): (
+  hostname: string,
+  options: { all?: boolean },
+  callback: (err: Error | null, addressOrList: string | LookupAddress[], family?: number) => void
+) => void;
+
+export declare function resolveSafeExternalUrl(
+  rawUrl: string | URL
+): Promise<{ parsed: URL; address: string }>;
+
+export declare function assertSafeExternalUrl(rawUrl: string | URL): Promise<URL>;
+
+export declare function encryptCredentials(value: unknown, key: Buffer): string;
+
+export declare function decryptCredentials<T = unknown>(value: string, key: Buffer): T;
+
+export declare function requestExternal(
+  rawUrl: string | URL,
+  options?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string | URLSearchParams | Buffer;
+    signal?: AbortSignal;
+  }
+): Promise<{
+  status: number;
+  ok: boolean;
+  text: () => Promise<string>;
+}>;
+
+export declare function postToService(
+  account: CrossPosterAccount,
+  text: string,
+  options?: PostOptions
+): Promise<PostResult>;
+
+export declare function deleteFromService(
+  account: CrossPosterAccount,
+  remoteId: string,
+  options?: PostOptions
+): Promise<DeleteResult>;
+
+export declare function postThreadToService(
+  account: CrossPosterAccount,
+  posts: string[],
+  options?: PostOptions
+): Promise<PostResult[]>;

package/src/index.mjs

@@ -0,0 +1,479 @@
+import http from 'node:http';
+import https from 'node:https';
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID } from 'node:crypto';
+import dns from 'node:dns/promises';
+import net from 'node:net';
+import { URL } from 'node:url';
+
+export const SUPPORTED_SERVICES = new Set(['x', 'mastodon', 'bluesky', 'misskey', 'threads']);
+
+export const SERVICE_LABELS = {
+  x: 'X',
+  mastodon: 'Mastodon',
+  bluesky: 'Bluesky',
+  misskey: 'Misskey',
+  threads: 'Threads',
+};
+
+export const SERVICE_LIMITS = {
+  x: 280,
+  mastodon: 500,
+  bluesky: 300,
+  threads: 500,
+  misskey: 3000,
+};
+
+export function countServiceCharacters(service, text) {
+  const str = String(text || '');
+  if (service === 'x') {
+    // X Twitter: CJK / fullwidth = 2, ASCII = 1, URLs = 23
+    let count = 0;
+    const urlRegex = /https?:\/\/[^\s]+/g;
+    const cleanText = str.replace(urlRegex, () => {
+      count += 23;
+      return '';
+    });
+    for (const char of cleanText) {
+      const code = char.codePointAt(0);
+      if (
+        (code >= 0x1100 && code <= 0x115f) ||
+        (code >= 0x2e80 && code <= 0xa4cf) ||
+        (code >= 0xac00 && code <= 0xd7a3) ||
+        (code >= 0xf900 && code <= 0xfaff) ||
+        (code >= 0xfe10 && code <= 0xfe19) ||
+        (code >= 0xfe30 && code <= 0xfe6f) ||
+        (code >= 0xff00 && code <= 0xff60) ||
+        (code >= 0xffe0 && code <= 0xffe6) ||
+        (code >= 0x20000 && code <= 0x2fffd) ||
+        (code >= 0x30000 && code <= 0x3fffd)
+      ) {
+        count += 2;
+      } else {
+        count += 1;
+      }
+    }
+    return count;
+  }
+
+  if (service === 'bluesky') {
+    if (typeof Intl !== 'undefined' && Intl.Segmenter) {
+      const segmenter = new Intl.Segmenter('en', { granularity: 'grapheme' });
+      return Array.from(segmenter.segment(str)).length;
+    }
+    return Array.from(str).length;
+  }
+
+  // Mastodon, Threads, Misskey: Unicode code point count
+  return Array.from(str).length;
+}
+
+export function splitPostIntoThreads(service, text, options = {}) {
+  const limit = SERVICE_LIMITS[service] || 300;
+  const numbering = options.numbering !== false;
+  const raw = String(text || '').trim();
+  if (!raw) return [];
+
+  if (countServiceCharacters(service, raw) <= limit) {
+    return [raw];
+  }
+
+  const paragraphs = raw.split(/\n\n+/);
+  const chunks = [];
+  let current = '';
+
+  for (const para of paragraphs) {
+    const candidate = current ? `${current}\n\n${para}` : para;
+    if (countServiceCharacters(service, candidate) <= limit - (numbering ? 8 : 0)) {
+      current = candidate;
+    } else {
+      if (current) chunks.push(current);
+      if (countServiceCharacters(service, para) > limit - (numbering ? 8 : 0)) {
+        const sentences = para.split(/(?<=[。．.！？!?\n])\s*/);
+        let sub = '';
+        for (const s of sentences) {
+          const subCand = sub ? `${sub} ${s}` : s;
+          if (countServiceCharacters(service, subCand) <= limit - (numbering ? 8 : 0)) {
+            sub = subCand;
+          } else {
+            if (sub) chunks.push(sub);
+            if (countServiceCharacters(service, s) > limit - (numbering ? 8 : 0)) {
+              let remaining = s;
+              while (remaining) {
+                let sliceLen = limit - (numbering ? 10 : 0);
+                while (sliceLen > 0 && countServiceCharacters(service, remaining.slice(0, sliceLen)) > limit - (numbering ? 10 : 0)) {
+                  sliceLen--;
+                }
+                if (sliceLen <= 0) sliceLen = 1;
+                chunks.push(remaining.slice(0, sliceLen));
+                remaining = remaining.slice(sliceLen);
+              }
+              sub = '';
+            } else {
+              sub = s;
+            }
+          }
+        }
+        if (sub) chunks.push(sub);
+        current = '';
+      } else {
+        current = para;
+      }
+    }
+  }
+  if (current) chunks.push(current);
+
+  if (!numbering || chunks.length <= 1) {
+    return chunks;
+  }
+
+  const total = chunks.length;
+  return chunks.map((chunk, idx) => `${chunk} (${idx + 1}/${total})`);
+}
+
+export function normalizeInstanceUrl(value) {
+  const raw = String(value || '').trim();
+  if (!raw) return '';
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw Object.assign(new Error('インスタンスURLはHTTPS形式で入力してください。'), { statusCode: 400 });
+  }
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password) {
+    throw Object.assign(new Error('インスタンスURLはHTTPS形式で、認証情報を含めないでください。'), { statusCode: 400 });
+  }
+  return parsed.origin;
+}
+
+export function isUnsafeIpv4(address) {
+  const octets = String(address).split('.').map((part) => Number(part));
+  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return false;
+  const value = (((octets[0] * 256) + octets[1]) * 256 + octets[2]) * 256 + octets[3];
+  const ranges = [
+    [0, 0xff000000],          // 0.0.0.0/8
+    [0x0a000000, 0xff000000], // 10.0.0.0/8
+    [0x64400000, 0xffc00000], // 100.64.0.0/10
+    [0x7f000000, 0xff000000], // 127.0.0.0/8
+    [0xa9fe0000, 0xffff0000], // 169.254.0.0/16
+    [0xac100000, 0xfff00000], // 172.16.0.0/12
+    [0xc0000000, 0xffffff00], // 192.0.0.0/24
+    [0xc0000200, 0xffffff00], // 192.0.2.0/24
+    [0xc0a80000, 0xffff0000], // 192.168.0.0/16
+    [0xc6120000, 0xfffe0000], // 198.18.0.0/15
+    [0xc6336400, 0xffffff00], // 198.51.100.0/24
+    [0xcb007100, 0xffffff00], // 203.0.113.0/24
+    [0xe0000000, 0xf0000000], // multicast
+    [0xf0000000, 0xf0000000], // reserved
+  ];
+  return ranges.some(([network, mask]) => ((value & mask) >>> 0) === (network >>> 0));
+}
+
+export function parseIpv6(address) {
+  let value = String(address).toLowerCase().split('%')[0];
+  if (value.includes('.')) {
+    const lastColon = value.lastIndexOf(':');
+    if (lastColon < 0) return null;
+    const octets = value.slice(lastColon + 1).split('.').map(Number);
+    if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+    const ipv4Hex = `${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
+    value = `${value.slice(0, lastColon)}:${ipv4Hex}`;
+  }
+  const halves = value.split('::');
+  if (halves.length > 2) return null;
+  const left = halves[0] ? halves[0].split(':') : [];
+  const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+  const missing = 8 - left.length - right.length;
+  if (missing < (halves.length === 2 ? 1 : 0)) return null;
+  const groups = [...left, ...Array(missing).fill('0'), ...right];
+  if (groups.length !== 8 || groups.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) return null;
+  return groups.map((part) => Number.parseInt(part, 16));
+}
+
+export function isUnsafeAddress(address) {
+  const normalized = String(address || '').toLowerCase().replace(/^\[|\]$/g, '').split('%')[0];
+  if (net.isIP(normalized) === 4) return isUnsafeIpv4(normalized);
+  if (net.isIP(normalized) !== 6) return true;
+  const groups = parseIpv6(normalized);
+  if (!groups) return true;
+  const first = groups[0];
+  const bytes = groups.flatMap((group) => [(group >> 8) & 0xff, group & 0xff]);
+  const mappedIpv4 = bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 0xff && bytes[11] === 0xff;
+  if (mappedIpv4) return true;
+  const isGlobalUnicast = (first & 0xe000) === 0x2000;
+  const isProtocolAssignment = groups[0] === 0x2001 && (groups[1] & 0xfe00) === 0;
+  const isSixToFour = groups[0] === 0x2002;
+  const isDocumentation = (groups[0] === 0x2001 && groups[1] === 0x0db8)
+    || (groups[0] === 0x3fff && (groups[1] & 0xf000) === 0);
+  return !isGlobalUnicast
+    || isProtocolAssignment
+    || isSixToFour
+    || isDocumentation
+    || (first & 0xfe00) === 0xfc00
+    || (first & 0xffc0) === 0xfe80;
+}
+
+export const createPinnedAddressLookup = (address) => (_hostname, options, callback) =>
+  options?.all
+    ? callback(null, [{ address, family: net.isIP(address) }])
+    : callback(null, address, net.isIP(address));
+
+export async function resolveSafeExternalUrl(rawUrl) {
+  let parsed;
+  try {
+    parsed = new URL(String(rawUrl));
+  } catch {
+    throw Object.assign(new Error('外部URLが不正です。'), { statusCode: 400 });
+  }
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password) {
+    throw Object.assign(new Error('外部URLはHTTPS形式で、認証情報を含めないでください。'), { statusCode: 400 });
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  if (
+    !hostname ||
+    hostname === 'localhost' ||
+    hostname.endsWith('.localhost') ||
+    hostname.endsWith('.local') ||
+    hostname.endsWith('.internal') ||
+    hostname === 'metadata.google.internal' ||
+    hostname === 'instance-data.ec2.internal' ||
+    hostname === 'host.docker.internal'
+  ) {
+    throw Object.assign(new Error('内部ネットワーク向けのURLは利用できません。'), { statusCode: 400 });
+  }
+  let addresses;
+  try {
+    addresses = net.isIP(hostname) ? [{ address: hostname }] : await dns.lookup(hostname, { all: true, verbatim: true });
+  } catch {
+    throw Object.assign(new Error('外部URLのホストを解決できません。'), { statusCode: 400 });
+  }
+  if (!addresses.length || addresses.some(({ address }) => isUnsafeAddress(address))) {
+    throw Object.assign(new Error('内部ネットワーク向けのURLは利用できません。'), { statusCode: 400 });
+  }
+  return { parsed, address: addresses[0].address };
+}
+
+export async function assertSafeExternalUrl(rawUrl) {
+  const { parsed } = await resolveSafeExternalUrl(rawUrl);
+  return parsed;
+}
+
+export function encryptCredentials(value, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+  return `v1.${iv.toString('base64url')}.${cipher.getAuthTag().toString('base64url')}.${encrypted.toString('base64url')}`;
+}
+
+export function decryptCredentials(value, key) {
+  const [version, ivEncoded, tagEncoded, payloadEncoded] = String(value || '').split('.');
+  if (version !== 'v1' || !ivEncoded || !tagEncoded || !payloadEncoded) throw new Error('暗号化データが不正です。');
+  const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(ivEncoded, 'base64url'));
+  decipher.setAuthTag(Buffer.from(tagEncoded, 'base64url'));
+  const payload = Buffer.concat([decipher.update(Buffer.from(payloadEncoded, 'base64url')), decipher.final()]);
+  return JSON.parse(payload.toString('utf8'));
+}
+
+export function requestExternal(rawUrl, options = {}) {
+  return resolveSafeExternalUrl(rawUrl).then(({ parsed, address }) => new Promise((resolve, reject) => {
+    const transport = parsed.protocol === 'https:' ? https : http;
+    const headers = { ...(options.headers || {}) };
+    const body = options.body instanceof URLSearchParams ? options.body.toString() : options.body;
+    if (body && !Object.keys(headers).some((key) => key.toLowerCase() === 'content-length')) {
+      headers['Content-Length'] = Buffer.byteLength(body);
+    }
+    const request = transport.request({
+      protocol: parsed.protocol,
+      hostname: parsed.hostname.replace(/^\[|\]$/g, ''),
+      port: parsed.port || undefined,
+      path: `${parsed.pathname}${parsed.search}`,
+      method: options.method || 'GET',
+      headers,
+      lookup: createPinnedAddressLookup(address),
+      servername: net.isIP(parsed.hostname.replace(/^\[|\]$/g, '')) ? undefined : parsed.hostname,
+      signal: options.signal,
+    }, (response) => {
+      const chunks = [];
+      let total = 0;
+      response.on('data', (chunk) => {
+        total += chunk.length;
+        if (total > 2 * 1024 * 1024) {
+          request.destroy(new Error('外部APIレスポンスが大きすぎます。'));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.on('end', () => {
+        const raw = Buffer.concat(chunks).toString('utf8');
+        resolve({ status: response.statusCode || 0, ok: (response.statusCode || 0) >= 200 && (response.statusCode || 0) < 300, text: async () => raw });
+      });
+      response.on('error', reject);
+    });
+    request.on('error', reject);
+    if (body) request.write(body);
+    request.end();
+  }));
+}
+
+async function fetchJson(url, options = {}) {
+  const requester = options.requestImpl || requestExternal;
+  const response = await requester(url, { ...options, signal: AbortSignal.timeout(30000) });
+  const raw = await response.text();
+  let body = null;
+  try { body = raw ? JSON.parse(raw) : {}; } catch { body = { raw: raw.slice(0, 500) }; }
+  if (!response.ok) {
+    const message = body?.error?.message || body?.error || body?.message || `外部APIエラー (${response.status})`;
+    throw new Error(String(message).slice(0, 300));
+  }
+  return body;
+}
+
+async function formRequest(url, params, options = {}) {
+  return fetchJson(url, {
+    ...options,
+    method: options.method || 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', ...(options.headers || {}) },
+    body: new URLSearchParams(Object.entries(params).map(([key, value]) => [key, String(value)])),
+  });
+}
+
+export async function postToService(account, text, options = {}) {
+  if (options.dryRun) {
+    return { remoteId: `dry_${account.service}_${randomUUID()}`, simulated: true };
+  }
+  const credentials = account.credentials;
+  const reqOpts = options.requestImpl ? { requestImpl: options.requestImpl } : {};
+  switch (account.service) {
+    case 'x': {
+      const payload = { text };
+      if (options.replyToId) {
+        payload.reply = { in_reply_to_tweet_id: options.replyToId };
+      }
+      const body = await fetchJson('https://api.x.com/2/tweets', {
+        ...reqOpts,
+        method: 'POST',
+        headers: { Authorization: `Bearer ${credentials.accessToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      });
+      return { remoteId: body.data?.id || null };
+    }
+    case 'mastodon': {
+      const instanceUrl = normalizeInstanceUrl(account.instanceUrl);
+      const form = { status: text };
+      if (options.replyToId) {
+        form.in_reply_to_id = options.replyToId;
+      }
+      const body = await formRequest(`${instanceUrl}/api/v1/statuses`, form, { ...reqOpts, headers: { Authorization: `Bearer ${credentials.accessToken}` } });
+      return { remoteId: body.id || null };
+    }
+    case 'misskey': {
+      const instanceUrl = normalizeInstanceUrl(account.instanceUrl);
+      const payload = { i: credentials.accessToken, text };
+      if (options.replyToId) {
+        payload.replyId = options.replyToId;
+      }
+      const body = await fetchJson(`${instanceUrl}/api/notes/create`, {
+        ...reqOpts,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      });
+      return { remoteId: body.createdNote?.id || null };
+    }
+    case 'bluesky': {
+      const session = await fetchJson('https://bsky.social/xrpc/com.atproto.server.createSession', {
+        ...reqOpts,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ identifier: credentials.username, password: credentials.appPassword }),
+      });
+      const record = {
+        '$type': 'app.bsky.feed.post',
+        text,
+        createdAt: new Date().toISOString(),
+      };
+      if (options.replyToId) {
+        record.reply = {
+          root: { uri: options.replyRoot || options.replyToId, cid: options.replyRootCid || 'bafyreie546fudph4' },
+          parent: { uri: options.replyToId, cid: options.replyParentCid || 'bafyreie546fudph4' },
+        };
+      }
+      const postRecord = await fetchJson('https://bsky.social/xrpc/com.atproto.repo.createRecord', {
+        ...reqOpts,
+        method: 'POST',
+        headers: { Authorization: `Bearer ${session.accessJwt}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          repo: session.did || credentials.username,
+          collection: 'app.bsky.feed.post',
+          record,
+        }),
+      });
+      return { remoteId: postRecord.uri || null };
+    }
+    case 'threads': {
+      const form = { media_type: 'TEXT', text, access_token: credentials.accessToken };
+      if (options.replyToId) {
+        form.reply_to_id = options.replyToId;
+      }
+      const container = await formRequest('https://graph.threads.com/v1.0/me/threads', form, reqOpts);
+      const published = await formRequest('https://graph.threads.com/v1.0/me/threads_publish', { creation_id: container.id, access_token: credentials.accessToken }, reqOpts);
+      return { remoteId: published.id || container.id || null };
+    }
+    default:
+      throw new Error('投稿サービスが不正です。');
+  }
+}
+
+export async function postThreadToService(account, posts, options = {}) {
+  const results = [];
+  let lastRemoteId = null;
+  let blueskyRootUri = null;
+
+  for (let i = 0; i < posts.length; i++) {
+    const text = posts[i];
+    const postOptions = {
+      ...options,
+      ...(lastRemoteId ? { replyToId: lastRemoteId } : {}),
+      ...(blueskyRootUri ? { replyRoot: blueskyRootUri } : {}),
+    };
+    const res = await postToService(account, text, postOptions);
+    results.push(res);
+    lastRemoteId = res.remoteId;
+    if (account.service === 'bluesky' && i === 0 && res.remoteId) {
+      blueskyRootUri = res.remoteId;
+    }
+  }
+  return results;
+}
+
+export async function deleteFromService(account, remoteId, options = {}) {
+  if (options.dryRun || String(remoteId).startsWith('dry_')) return { simulated: true };
+  const credentials = account.credentials;
+  const reqOpts = options.requestImpl ? { requestImpl: options.requestImpl } : {};
+  switch (account.service) {
+    case 'x':
+      await fetchJson(`https://api.x.com/2/tweets/${encodeURIComponent(remoteId)}`, { ...reqOpts, method: 'DELETE', headers: { Authorization: `Bearer ${credentials.accessToken}` } });
+      return {};
+    case 'mastodon': {
+      const instanceUrl = normalizeInstanceUrl(account.instanceUrl);
+      await fetchJson(`${instanceUrl}/api/v1/statuses/${encodeURIComponent(remoteId)}`, { ...reqOpts, method: 'DELETE', headers: { Authorization: `Bearer ${credentials.accessToken}` } });
+      return {};
+    }
+    case 'misskey': {
+      const instanceUrl = normalizeInstanceUrl(account.instanceUrl);
+      await fetchJson(`${instanceUrl}/api/notes/delete`, { ...reqOpts, method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ i: credentials.accessToken, noteId: remoteId }) });
+      return {};
+    }
+    case 'bluesky': {
+      const [repo, collection, rkey] = String(remoteId).replace(/^at:\/\//, '').split('/');
+      if (!repo || !rkey) throw new Error('Bluesky投稿IDを解釈できません。');
+      const session = await fetchJson('https://bsky.social/xrpc/com.atproto.server.createSession', { ...reqOpts, method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ identifier: credentials.username, password: credentials.appPassword }) });
+      await fetchJson('https://bsky.social/xrpc/com.atproto.repo.deleteRecord', { ...reqOpts, method: 'POST', headers: { Authorization: `Bearer ${session.accessJwt}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ repo, collection: collection || 'app.bsky.feed.post', rkey }) });
+      return {};
+    }
+    case 'threads':
+      await fetchJson(`https://graph.threads.com/v1.0/${encodeURIComponent(remoteId)}?access_token=${encodeURIComponent(credentials.accessToken)}`, { ...reqOpts, method: 'DELETE' });
+      return {};
+    default:
+      throw new Error('削除サービスが不正です。');
+  }
+}