@archipelagolab/lobi 1.0.1 → 1.0.6

package/dist/chunk-AAO7BQEV.js

@@ -0,0 +1,258 @@
+import {
+  isMatrixDeviceOwnerVerified
+} from "./chunk-H6YVV7GE.js";
+import {
+  isRepairableSecretStorageAccessError
+} from "./chunk-FQTLJO4W.js";
+import {
+  CryptoEvent
+} from "./chunk-FQ4R7IOX.js";
+import {
+  LogService
+} from "./chunk-BMFZL2P4.js";
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/matrix/sdk/crypto-bootstrap.ts
+init_shims();
+var MatrixCryptoBootstrapper = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.verificationHandlerRegistered = false;
+  }
+  async bootstrap(crypto, options = {}) {
+    const strict = options.strict === true;
+    this.registerVerificationRequestHandler(crypto);
+    await this.bootstrapSecretStorage(crypto, {
+      strict,
+      allowSecretStorageRecreateWithoutRecoveryKey: options.allowSecretStorageRecreateWithoutRecoveryKey === true
+    });
+    const crossSigning = await this.bootstrapCrossSigning(crypto, {
+      forceResetCrossSigning: options.forceResetCrossSigning === true,
+      allowAutomaticCrossSigningReset: options.allowAutomaticCrossSigningReset !== false,
+      allowSecretStorageRecreateWithoutRecoveryKey: options.allowSecretStorageRecreateWithoutRecoveryKey === true,
+      strict
+    });
+    await this.bootstrapSecretStorage(crypto, {
+      strict,
+      allowSecretStorageRecreateWithoutRecoveryKey: options.allowSecretStorageRecreateWithoutRecoveryKey === true
+    });
+    const ownDeviceVerified = await this.ensureOwnDeviceTrust(crypto, strict);
+    return {
+      crossSigningReady: crossSigning.ready,
+      crossSigningPublished: crossSigning.published,
+      ownDeviceVerified
+    };
+  }
+  createSigningKeysUiAuthCallback(params) {
+    return async (makeRequest) => {
+      try {
+        return await makeRequest(null);
+      } catch {
+        try {
+          return await makeRequest({ type: "m.login.dummy" });
+        } catch {
+          if (!params.password?.trim()) {
+            throw new Error(
+              "Matrix cross-signing key upload requires UIA; provide matrix.password for m.login.password fallback"
+            );
+          }
+          return await makeRequest({
+            type: "m.login.password",
+            identifier: { type: "m.id.user", user: params.userId },
+            password: params.password
+          });
+        }
+      }
+    };
+  }
+  async bootstrapCrossSigning(crypto, options) {
+    const userId = await this.deps.getUserId();
+    const authUploadDeviceSigningKeys = this.createSigningKeysUiAuthCallback({
+      userId,
+      password: this.deps.getPassword?.()
+    });
+    const hasPublishedCrossSigningKeys = async () => {
+      if (typeof crypto.userHasCrossSigningKeys !== "function") {
+        return true;
+      }
+      try {
+        return await crypto.userHasCrossSigningKeys(userId, true);
+      } catch {
+        return false;
+      }
+    };
+    const isCrossSigningReady = async () => {
+      if (typeof crypto.isCrossSigningReady !== "function") {
+        return true;
+      }
+      try {
+        return await crypto.isCrossSigningReady();
+      } catch {
+        return false;
+      }
+    };
+    const finalize = async () => {
+      const ready = await isCrossSigningReady();
+      const published = await hasPublishedCrossSigningKeys();
+      if (ready && published) {
+        LogService.info("MatrixClientLite", "Cross-signing bootstrap complete");
+        return { ready, published };
+      }
+      const message = "Cross-signing bootstrap finished but server keys are still not published";
+      LogService.warn("MatrixClientLite", message);
+      if (options.strict) {
+        throw new Error(message);
+      }
+      return { ready, published };
+    };
+    if (options.forceResetCrossSigning) {
+      try {
+        await crypto.bootstrapCrossSigning({
+          setupNewCrossSigning: true,
+          authUploadDeviceSigningKeys
+        });
+      } catch (err) {
+        LogService.warn("MatrixClientLite", "Forced cross-signing reset failed:", err);
+        if (options.strict) {
+          throw err instanceof Error ? err : new Error(String(err));
+        }
+        return { ready: false, published: false };
+      }
+      return await finalize();
+    }
+    try {
+      await crypto.bootstrapCrossSigning({
+        authUploadDeviceSigningKeys
+      });
+    } catch (err) {
+      const shouldRepairSecretStorage = options.allowSecretStorageRecreateWithoutRecoveryKey && isRepairableSecretStorageAccessError(err);
+      if (shouldRepairSecretStorage) {
+        LogService.warn(
+          "MatrixClientLite",
+          "Cross-signing bootstrap could not unlock secret storage; recreating secret storage during explicit bootstrap and retrying."
+        );
+        await this.deps.recoveryKeyStore.bootstrapSecretStorageWithRecoveryKey(crypto, {
+          allowSecretStorageRecreateWithoutRecoveryKey: true,
+          forceNewSecretStorage: true
+        });
+        await crypto.bootstrapCrossSigning({
+          authUploadDeviceSigningKeys
+        });
+      } else if (!options.allowAutomaticCrossSigningReset) {
+        LogService.warn(
+          "MatrixClientLite",
+          "Initial cross-signing bootstrap failed and automatic reset is disabled:",
+          err
+        );
+        return { ready: false, published: false };
+      } else {
+        LogService.warn(
+          "MatrixClientLite",
+          "Initial cross-signing bootstrap failed, trying reset:",
+          err
+        );
+        try {
+          await crypto.bootstrapCrossSigning({
+            setupNewCrossSigning: true,
+            authUploadDeviceSigningKeys
+          });
+        } catch (resetErr) {
+          LogService.warn("MatrixClientLite", "Failed to bootstrap cross-signing:", resetErr);
+          if (options.strict) {
+            throw resetErr instanceof Error ? resetErr : new Error(String(resetErr));
+          }
+          return { ready: false, published: false };
+        }
+      }
+    }
+    const firstPassReady = await isCrossSigningReady();
+    const firstPassPublished = await hasPublishedCrossSigningKeys();
+    if (firstPassReady && firstPassPublished) {
+      LogService.info("MatrixClientLite", "Cross-signing bootstrap complete");
+      return { ready: true, published: true };
+    }
+    if (!options.allowAutomaticCrossSigningReset) {
+      return { ready: firstPassReady, published: firstPassPublished };
+    }
+    try {
+      await crypto.bootstrapCrossSigning({
+        setupNewCrossSigning: true,
+        authUploadDeviceSigningKeys
+      });
+    } catch (err) {
+      LogService.warn("MatrixClientLite", "Fallback cross-signing bootstrap failed:", err);
+      if (options.strict) {
+        throw err instanceof Error ? err : new Error(String(err));
+      }
+      return { ready: false, published: false };
+    }
+    return await finalize();
+  }
+  async bootstrapSecretStorage(crypto, options) {
+    try {
+      await this.deps.recoveryKeyStore.bootstrapSecretStorageWithRecoveryKey(crypto, {
+        allowSecretStorageRecreateWithoutRecoveryKey: options.allowSecretStorageRecreateWithoutRecoveryKey
+      });
+      LogService.info("MatrixClientLite", "Secret storage bootstrap complete");
+    } catch (err) {
+      LogService.warn("MatrixClientLite", "Failed to bootstrap secret storage:", err);
+      if (options.strict) {
+        throw err instanceof Error ? err : new Error(String(err));
+      }
+    }
+  }
+  registerVerificationRequestHandler(crypto) {
+    if (this.verificationHandlerRegistered) {
+      return;
+    }
+    this.verificationHandlerRegistered = true;
+    crypto.on(CryptoEvent.VerificationRequestReceived, async (request) => {
+      const verificationRequest = request;
+      try {
+        this.deps.verificationManager.trackVerificationRequest(verificationRequest);
+      } catch (err) {
+        LogService.warn(
+          "MatrixClientLite",
+          `Failed to track verification request from ${verificationRequest.otherUserId}:`,
+          err
+        );
+      }
+    });
+    this.deps.decryptBridge.bindCryptoRetrySignals(crypto);
+    LogService.info("MatrixClientLite", "Verification request handler registered");
+  }
+  async ensureOwnDeviceTrust(crypto, strict = false) {
+    const deviceId = this.deps.getDeviceId()?.trim();
+    if (!deviceId) {
+      return null;
+    }
+    const userId = await this.deps.getUserId();
+    const deviceStatus = typeof crypto.getDeviceVerificationStatus === "function" ? await crypto.getDeviceVerificationStatus(userId, deviceId).catch(() => null) : null;
+    const alreadyVerified = isMatrixDeviceOwnerVerified(deviceStatus);
+    if (alreadyVerified) {
+      return true;
+    }
+    if (typeof crypto.setDeviceVerified === "function") {
+      await crypto.setDeviceVerified(userId, deviceId, true);
+    }
+    if (typeof crypto.crossSignDevice === "function") {
+      const crossSigningReady = typeof crypto.isCrossSigningReady === "function" ? await crypto.isCrossSigningReady() : true;
+      if (crossSigningReady) {
+        await crypto.crossSignDevice(deviceId);
+      }
+    }
+    const refreshedStatus = typeof crypto.getDeviceVerificationStatus === "function" ? await crypto.getDeviceVerificationStatus(userId, deviceId).catch(() => null) : null;
+    const verified = isMatrixDeviceOwnerVerified(refreshedStatus);
+    if (!verified && strict) {
+      throw new Error(`Matrix own device ${deviceId} is not verified by its owner after bootstrap`);
+    }
+    return verified;
+  }
+};
+
+export {
+  MatrixCryptoBootstrapper
+};
+//# sourceMappingURL=chunk-AAO7BQEV.js.map

package/dist/chunk-AAO7BQEV.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/sdk/crypto-bootstrap.ts"],
+  "sourcesContent": ["import { CryptoEvent } from \"@archipelagolab/lobi-js-sdk/lib/crypto-api/CryptoEvent.js\";\nimport type { MatrixDecryptBridge } from \"./decrypt-bridge.js\";\nimport { LogService } from \"./logger.js\";\nimport type { MatrixRecoveryKeyStore } from \"./recovery-key-store.js\";\nimport { isRepairableSecretStorageAccessError } from \"./recovery-key-store.js\";\nimport type {\n  MatrixAuthDict,\n  MatrixCryptoBootstrapApi,\n  MatrixRawEvent,\n  MatrixUiAuthCallback,\n} from \"./types.js\";\nimport type {\n  MatrixVerificationManager,\n  MatrixVerificationRequestLike,\n} from \"./verification-manager.js\";\nimport { isMatrixDeviceOwnerVerified } from \"./verification-status.js\";\n\nexport type MatrixCryptoBootstrapperDeps<TRawEvent extends MatrixRawEvent> = {\n  getUserId: () => Promise<string>;\n  getPassword?: () => string | undefined;\n  getDeviceId: () => string | null | undefined;\n  verificationManager: MatrixVerificationManager;\n  recoveryKeyStore: MatrixRecoveryKeyStore;\n  decryptBridge: Pick<MatrixDecryptBridge<TRawEvent>, \"bindCryptoRetrySignals\">;\n};\n\nexport type MatrixCryptoBootstrapOptions = {\n  forceResetCrossSigning?: boolean;\n  allowAutomaticCrossSigningReset?: boolean;\n  allowSecretStorageRecreateWithoutRecoveryKey?: boolean;\n  strict?: boolean;\n};\n\nexport type MatrixCryptoBootstrapResult = {\n  crossSigningReady: boolean;\n  crossSigningPublished: boolean;\n  ownDeviceVerified: boolean | null;\n};\n\nexport class MatrixCryptoBootstrapper<TRawEvent extends MatrixRawEvent> {\n  private verificationHandlerRegistered = false;\n\n  constructor(private readonly deps: MatrixCryptoBootstrapperDeps<TRawEvent>) {}\n\n  async bootstrap(\n    crypto: MatrixCryptoBootstrapApi,\n    options: MatrixCryptoBootstrapOptions = {},\n  ): Promise<MatrixCryptoBootstrapResult> {\n    const strict = options.strict === true;\n    // Register verification listeners before expensive bootstrap work so incoming requests\n    // are not missed during startup.\n    this.registerVerificationRequestHandler(crypto);\n    await this.bootstrapSecretStorage(crypto, {\n      strict,\n      allowSecretStorageRecreateWithoutRecoveryKey:\n        options.allowSecretStorageRecreateWithoutRecoveryKey === true,\n    });\n    const crossSigning = await this.bootstrapCrossSigning(crypto, {\n      forceResetCrossSigning: options.forceResetCrossSigning === true,\n      allowAutomaticCrossSigningReset: options.allowAutomaticCrossSigningReset !== false,\n      allowSecretStorageRecreateWithoutRecoveryKey:\n        options.allowSecretStorageRecreateWithoutRecoveryKey === true,\n      strict,\n    });\n    await this.bootstrapSecretStorage(crypto, {\n      strict,\n      allowSecretStorageRecreateWithoutRecoveryKey:\n        options.allowSecretStorageRecreateWithoutRecoveryKey === true,\n    });\n    const ownDeviceVerified = await this.ensureOwnDeviceTrust(crypto, strict);\n    return {\n      crossSigningReady: crossSigning.ready,\n      crossSigningPublished: crossSigning.published,\n      ownDeviceVerified,\n    };\n  }\n\n  private createSigningKeysUiAuthCallback(params: {\n    userId: string;\n    password?: string;\n  }): MatrixUiAuthCallback {\n    return async <T>(makeRequest: (authData: MatrixAuthDict | null) => Promise<T>): Promise<T> => {\n      try {\n        return await makeRequest(null);\n      } catch {\n        // Some homeservers require an explicit dummy UIA stage even when no user interaction is needed.\n        try {\n          return await makeRequest({ type: \"m.login.dummy\" });\n        } catch {\n          if (!params.password?.trim()) {\n            throw new Error(\n              \"Matrix cross-signing key upload requires UIA; provide matrix.password for m.login.password fallback\",\n            );\n          }\n          return await makeRequest({\n            type: \"m.login.password\",\n            identifier: { type: \"m.id.user\", user: params.userId },\n            password: params.password,\n          });\n        }\n      }\n    };\n  }\n\n  private async bootstrapCrossSigning(\n    crypto: MatrixCryptoBootstrapApi,\n    options: {\n      forceResetCrossSigning: boolean;\n      allowAutomaticCrossSigningReset: boolean;\n      allowSecretStorageRecreateWithoutRecoveryKey: boolean;\n      strict: boolean;\n    },\n  ): Promise<{ ready: boolean; published: boolean }> {\n    const userId = await this.deps.getUserId();\n    const authUploadDeviceSigningKeys = this.createSigningKeysUiAuthCallback({\n      userId,\n      password: this.deps.getPassword?.(),\n    });\n    const hasPublishedCrossSigningKeys = async (): Promise<boolean> => {\n      if (typeof crypto.userHasCrossSigningKeys !== \"function\") {\n        return true;\n      }\n      try {\n        return await crypto.userHasCrossSigningKeys(userId, true);\n      } catch {\n        return false;\n      }\n    };\n    const isCrossSigningReady = async (): Promise<boolean> => {\n      if (typeof crypto.isCrossSigningReady !== \"function\") {\n        return true;\n      }\n      try {\n        return await crypto.isCrossSigningReady();\n      } catch {\n        return false;\n      }\n    };\n\n    const finalize = async (): Promise<{ ready: boolean; published: boolean }> => {\n      const ready = await isCrossSigningReady();\n      const published = await hasPublishedCrossSigningKeys();\n      if (ready && published) {\n        LogService.info(\"MatrixClientLite\", \"Cross-signing bootstrap complete\");\n        return { ready, published };\n      }\n      const message = \"Cross-signing bootstrap finished but server keys are still not published\";\n      LogService.warn(\"MatrixClientLite\", message);\n      if (options.strict) {\n        throw new Error(message);\n      }\n      return { ready, published };\n    };\n\n    if (options.forceResetCrossSigning) {\n      try {\n        await crypto.bootstrapCrossSigning({\n          setupNewCrossSigning: true,\n          authUploadDeviceSigningKeys,\n        });\n      } catch (err) {\n        LogService.warn(\"MatrixClientLite\", \"Forced cross-signing reset failed:\", err);\n        if (options.strict) {\n          throw err instanceof Error ? err : new Error(String(err));\n        }\n        return { ready: false, published: false };\n      }\n      return await finalize();\n    }\n\n    // First pass: preserve existing cross-signing identity and ensure public keys are uploaded.\n    try {\n      await crypto.bootstrapCrossSigning({\n        authUploadDeviceSigningKeys,\n      });\n    } catch (err) {\n      const shouldRepairSecretStorage =\n        options.allowSecretStorageRecreateWithoutRecoveryKey &&\n        isRepairableSecretStorageAccessError(err);\n      if (shouldRepairSecretStorage) {\n        LogService.warn(\n          \"MatrixClientLite\",\n          \"Cross-signing bootstrap could not unlock secret storage; recreating secret storage during explicit bootstrap and retrying.\",\n        );\n        await this.deps.recoveryKeyStore.bootstrapSecretStorageWithRecoveryKey(crypto, {\n          allowSecretStorageRecreateWithoutRecoveryKey: true,\n          forceNewSecretStorage: true,\n        });\n        await crypto.bootstrapCrossSigning({\n          authUploadDeviceSigningKeys,\n        });\n      } else if (!options.allowAutomaticCrossSigningReset) {\n        LogService.warn(\n          \"MatrixClientLite\",\n          \"Initial cross-signing bootstrap failed and automatic reset is disabled:\",\n          err,\n        );\n        return { ready: false, published: false };\n      } else {\n        LogService.warn(\n          \"MatrixClientLite\",\n          \"Initial cross-signing bootstrap failed, trying reset:\",\n          err,\n        );\n        try {\n          await crypto.bootstrapCrossSigning({\n            setupNewCrossSigning: true,\n            authUploadDeviceSigningKeys,\n          });\n        } catch (resetErr) {\n          LogService.warn(\"MatrixClientLite\", \"Failed to bootstrap cross-signing:\", resetErr);\n          if (options.strict) {\n            throw resetErr instanceof Error ? resetErr : new Error(String(resetErr));\n          }\n          return { ready: false, published: false };\n        }\n      }\n    }\n\n    const firstPassReady = await isCrossSigningReady();\n    const firstPassPublished = await hasPublishedCrossSigningKeys();\n    if (firstPassReady && firstPassPublished) {\n      LogService.info(\"MatrixClientLite\", \"Cross-signing bootstrap complete\");\n      return { ready: true, published: true };\n    }\n\n    if (!options.allowAutomaticCrossSigningReset) {\n      return { ready: firstPassReady, published: firstPassPublished };\n    }\n\n    // Fallback: recover from broken local/server state by creating a fresh identity.\n    try {\n      await crypto.bootstrapCrossSigning({\n        setupNewCrossSigning: true,\n        authUploadDeviceSigningKeys,\n      });\n    } catch (err) {\n      LogService.warn(\"MatrixClientLite\", \"Fallback cross-signing bootstrap failed:\", err);\n      if (options.strict) {\n        throw err instanceof Error ? err : new Error(String(err));\n      }\n      return { ready: false, published: false };\n    }\n\n    return await finalize();\n  }\n\n  private async bootstrapSecretStorage(\n    crypto: MatrixCryptoBootstrapApi,\n    options: {\n      strict: boolean;\n      allowSecretStorageRecreateWithoutRecoveryKey: boolean;\n    },\n  ): Promise<void> {\n    try {\n      await this.deps.recoveryKeyStore.bootstrapSecretStorageWithRecoveryKey(crypto, {\n        allowSecretStorageRecreateWithoutRecoveryKey:\n          options.allowSecretStorageRecreateWithoutRecoveryKey,\n      });\n      LogService.info(\"MatrixClientLite\", \"Secret storage bootstrap complete\");\n    } catch (err) {\n      LogService.warn(\"MatrixClientLite\", \"Failed to bootstrap secret storage:\", err);\n      if (options.strict) {\n        throw err instanceof Error ? err : new Error(String(err));\n      }\n    }\n  }\n\n  private registerVerificationRequestHandler(crypto: MatrixCryptoBootstrapApi): void {\n    if (this.verificationHandlerRegistered) {\n      return;\n    }\n    this.verificationHandlerRegistered = true;\n\n    // Track incoming requests; verification lifecycle decisions live in the\n    // verification manager so acceptance/start/dedupe share one code path.\n    // Remote-user verifications are only auto-accepted. The human-operated\n    // client must explicitly choose \"Verify by emoji\" so we do not race a\n    // second SAS start from the bot side and end up with mismatched keys.\n    crypto.on(CryptoEvent.VerificationRequestReceived, async (request) => {\n      const verificationRequest = request as MatrixVerificationRequestLike;\n      try {\n        this.deps.verificationManager.trackVerificationRequest(verificationRequest);\n      } catch (err) {\n        LogService.warn(\n          \"MatrixClientLite\",\n          `Failed to track verification request from ${verificationRequest.otherUserId}:`,\n          err,\n        );\n      }\n    });\n\n    this.deps.decryptBridge.bindCryptoRetrySignals(crypto);\n    LogService.info(\"MatrixClientLite\", \"Verification request handler registered\");\n  }\n\n  private async ensureOwnDeviceTrust(\n    crypto: MatrixCryptoBootstrapApi,\n    strict = false,\n  ): Promise<boolean | null> {\n    const deviceId = this.deps.getDeviceId()?.trim();\n    if (!deviceId) {\n      return null;\n    }\n    const userId = await this.deps.getUserId();\n\n    const deviceStatus =\n      typeof crypto.getDeviceVerificationStatus === \"function\"\n        ? await crypto.getDeviceVerificationStatus(userId, deviceId).catch(() => null)\n        : null;\n    const alreadyVerified = isMatrixDeviceOwnerVerified(deviceStatus);\n\n    if (alreadyVerified) {\n      return true;\n    }\n\n    if (typeof crypto.setDeviceVerified === \"function\") {\n      await crypto.setDeviceVerified(userId, deviceId, true);\n    }\n\n    if (typeof crypto.crossSignDevice === \"function\") {\n      const crossSigningReady =\n        typeof crypto.isCrossSigningReady === \"function\"\n          ? await crypto.isCrossSigningReady()\n          : true;\n      if (crossSigningReady) {\n        await crypto.crossSignDevice(deviceId);\n      }\n    }\n\n    const refreshedStatus =\n      typeof crypto.getDeviceVerificationStatus === \"function\"\n        ? await crypto.getDeviceVerificationStatus(userId, deviceId).catch(() => null)\n        : null;\n    const verified = isMatrixDeviceOwnerVerified(refreshedStatus);\n    if (!verified && strict) {\n      throw new Error(`Matrix own device ${deviceId} is not verified by its owner after bootstrap`);\n    }\n    return verified;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAuCO,IAAM,2BAAN,MAAiE;AAAA,EAGtE,YAA6B,MAA+C;AAA/C;AAF7B,SAAQ,gCAAgC;AAAA,EAEqC;AAAA,EAE7E,MAAM,UACJ,QACA,UAAwC,CAAC,GACH;AACtC,UAAM,SAAS,QAAQ,WAAW;AAGlC,SAAK,mCAAmC,MAAM;AAC9C,UAAM,KAAK,uBAAuB,QAAQ;AAAA,MACxC;AAAA,MACA,8CACE,QAAQ,iDAAiD;AAAA,IAC7D,CAAC;AACD,UAAM,eAAe,MAAM,KAAK,sBAAsB,QAAQ;AAAA,MAC5D,wBAAwB,QAAQ,2BAA2B;AAAA,MAC3D,iCAAiC,QAAQ,oCAAoC;AAAA,MAC7E,8CACE,QAAQ,iDAAiD;AAAA,MAC3D;AAAA,IACF,CAAC;AACD,UAAM,KAAK,uBAAuB,QAAQ;AAAA,MACxC;AAAA,MACA,8CACE,QAAQ,iDAAiD;AAAA,IAC7D,CAAC;AACD,UAAM,oBAAoB,MAAM,KAAK,qBAAqB,QAAQ,MAAM;AACxE,WAAO;AAAA,MACL,mBAAmB,aAAa;AAAA,MAChC,uBAAuB,aAAa;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gCAAgC,QAGf;AACvB,WAAO,OAAU,gBAA6E;AAC5F,UAAI;AACF,eAAO,MAAM,YAAY,IAAI;AAAA,MAC/B,QAAQ;AAEN,YAAI;AACF,iBAAO,MAAM,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAAA,QACpD,QAAQ;AACN,cAAI,CAAC,OAAO,UAAU,KAAK,GAAG;AAC5B,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,iBAAO,MAAM,YAAY;AAAA,YACvB,MAAM;AAAA,YACN,YAAY,EAAE,MAAM,aAAa,MAAM,OAAO,OAAO;AAAA,YACrD,UAAU,OAAO;AAAA,UACnB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,sBACZ,QACA,SAMiD;AACjD,UAAM,SAAS,MAAM,KAAK,KAAK,UAAU;AACzC,UAAM,8BAA8B,KAAK,gCAAgC;AAAA,MACvE;AAAA,MACA,UAAU,KAAK,KAAK,cAAc;AAAA,IACpC,CAAC;AACD,UAAM,+BAA+B,YAA8B;AACjE,UAAI,OAAO,OAAO,4BAA4B,YAAY;AACxD,eAAO;AAAA,MACT;AACA,UAAI;AACF,eAAO,MAAM,OAAO,wBAAwB,QAAQ,IAAI;AAAA,MAC1D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,sBAAsB,YAA8B;AACxD,UAAI,OAAO,OAAO,wBAAwB,YAAY;AACpD,eAAO;AAAA,MACT;AACA,UAAI;AACF,eAAO,MAAM,OAAO,oBAAoB;AAAA,MAC1C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,WAAW,YAA6D;AAC5E,YAAM,QAAQ,MAAM,oBAAoB;AACxC,YAAM,YAAY,MAAM,6BAA6B;AACrD,UAAI,SAAS,WAAW;AACtB,mBAAW,KAAK,oBAAoB,kCAAkC;AACtE,eAAO,EAAE,OAAO,UAAU;AAAA,MAC5B;AACA,YAAM,UAAU;AAChB,iBAAW,KAAK,oBAAoB,OAAO;AAC3C,UAAI,QAAQ,QAAQ;AAClB,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AACA,aAAO,EAAE,OAAO,UAAU;AAAA,IAC5B;AAEA,QAAI,QAAQ,wBAAwB;AAClC,UAAI;AACF,cAAM,OAAO,sBAAsB;AAAA,UACjC,sBAAsB;AAAA,UACtB;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,mBAAW,KAAK,oBAAoB,sCAAsC,GAAG;AAC7E,YAAI,QAAQ,QAAQ;AAClB,gBAAM,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAAA,QAC1D;AACA,eAAO,EAAE,OAAO,OAAO,WAAW,MAAM;AAAA,MAC1C;AACA,aAAO,MAAM,SAAS;AAAA,IACxB;AAGA,QAAI;AACF,YAAM,OAAO,sBAAsB;AAAA,QACjC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,4BACJ,QAAQ,gDACR,qCAAqC,GAAG;AAC1C,UAAI,2BAA2B;AAC7B,mBAAW;AAAA,UACT;AAAA,UACA;AAAA,QACF;AACA,cAAM,KAAK,KAAK,iBAAiB,sCAAsC,QAAQ;AAAA,UAC7E,8CAA8C;AAAA,UAC9C,uBAAuB;AAAA,QACzB,CAAC;AACD,cAAM,OAAO,sBAAsB;AAAA,UACjC;AAAA,QACF,CAAC;AAAA,MACH,WAAW,CAAC,QAAQ,iCAAiC;AACnD,mBAAW;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,eAAO,EAAE,OAAO,OAAO,WAAW,MAAM;AAAA,MAC1C,OAAO;AACL,mBAAW;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI;AACF,gBAAM,OAAO,sBAAsB;AAAA,YACjC,sBAAsB;AAAA,YACtB;AAAA,UACF,CAAC;AAAA,QACH,SAAS,UAAU;AACjB,qBAAW,KAAK,oBAAoB,sCAAsC,QAAQ;AAClF,cAAI,QAAQ,QAAQ;AAClB,kBAAM,oBAAoB,QAAQ,WAAW,IAAI,MAAM,OAAO,QAAQ,CAAC;AAAA,UACzE;AACA,iBAAO,EAAE,OAAO,OAAO,WAAW,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB,MAAM,oBAAoB;AACjD,UAAM,qBAAqB,MAAM,6BAA6B;AAC9D,QAAI,kBAAkB,oBAAoB;AACxC,iBAAW,KAAK,oBAAoB,kCAAkC;AACtE,aAAO,EAAE,OAAO,MAAM,WAAW,KAAK;AAAA,IACxC;AAEA,QAAI,CAAC,QAAQ,iCAAiC;AAC5C,aAAO,EAAE,OAAO,gBAAgB,WAAW,mBAAmB;AAAA,IAChE;AAGA,QAAI;AACF,YAAM,OAAO,sBAAsB;AAAA,QACjC,sBAAsB;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,iBAAW,KAAK,oBAAoB,4CAA4C,GAAG;AACnF,UAAI,QAAQ,QAAQ;AAClB,cAAM,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAAA,MAC1D;AACA,aAAO,EAAE,OAAO,OAAO,WAAW,MAAM;AAAA,IAC1C;AAEA,WAAO,MAAM,SAAS;AAAA,EACxB;AAAA,EAEA,MAAc,uBACZ,QACA,SAIe;AACf,QAAI;AACF,YAAM,KAAK,KAAK,iBAAiB,sCAAsC,QAAQ;AAAA,QAC7E,8CACE,QAAQ;AAAA,MACZ,CAAC;AACD,iBAAW,KAAK,oBAAoB,mCAAmC;AAAA,IACzE,SAAS,KAAK;AACZ,iBAAW,KAAK,oBAAoB,uCAAuC,GAAG;AAC9E,UAAI,QAAQ,QAAQ;AAClB,cAAM,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mCAAmC,QAAwC;AACjF,QAAI,KAAK,+BAA+B;AACtC;AAAA,IACF;AACA,SAAK,gCAAgC;AAOrC,WAAO,GAAG,YAAY,6BAA6B,OAAO,YAAY;AACpE,YAAM,sBAAsB;AAC5B,UAAI;AACF,aAAK,KAAK,oBAAoB,yBAAyB,mBAAmB;AAAA,MAC5E,SAAS,KAAK;AACZ,mBAAW;AAAA,UACT;AAAA,UACA,6CAA6C,oBAAoB,WAAW;AAAA,UAC5E;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,SAAK,KAAK,cAAc,uBAAuB,MAAM;AACrD,eAAW,KAAK,oBAAoB,yCAAyC;AAAA,EAC/E;AAAA,EAEA,MAAc,qBACZ,QACA,SAAS,OACgB;AACzB,UAAM,WAAW,KAAK,KAAK,YAAY,GAAG,KAAK;AAC/C,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,KAAK,KAAK,UAAU;AAEzC,UAAM,eACJ,OAAO,OAAO,gCAAgC,aAC1C,MAAM,OAAO,4BAA4B,QAAQ,QAAQ,EAAE,MAAM,MAAM,IAAI,IAC3E;AACN,UAAM,kBAAkB,4BAA4B,YAAY;AAEhE,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,OAAO,sBAAsB,YAAY;AAClD,YAAM,OAAO,kBAAkB,QAAQ,UAAU,IAAI;AAAA,IACvD;AAEA,QAAI,OAAO,OAAO,oBAAoB,YAAY;AAChD,YAAM,oBACJ,OAAO,OAAO,wBAAwB,aAClC,MAAM,OAAO,oBAAoB,IACjC;AACN,UAAI,mBAAmB;AACrB,cAAM,OAAO,gBAAgB,QAAQ;AAAA,MACvC;AAAA,IACF;AAEA,UAAM,kBACJ,OAAO,OAAO,gCAAgC,aAC1C,MAAM,OAAO,4BAA4B,QAAQ,QAAQ,EAAE,MAAM,MAAM,IAAI,IAC3E;AACN,UAAM,WAAW,4BAA4B,eAAe;AAC5D,QAAI,CAAC,YAAY,QAAQ;AACvB,YAAM,IAAI,MAAM,qBAAqB,QAAQ,+CAA+C;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/chunk-AH4MLRYT.js

@@ -0,0 +1,91 @@
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/matrix/monitor/allowlist.ts
+init_shims();
+import {
+  resolveAllowlistMatchByCandidates
+} from "openclaw/plugin-sdk/allow-from";
+import { normalizeStringEntries } from "openclaw/plugin-sdk/string-normalization-runtime";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
+function normalizeAllowList(list) {
+  return normalizeStringEntries(list);
+}
+function normalizeMatrixUser(raw) {
+  const value = (raw ?? "").trim();
+  if (!value) {
+    return "";
+  }
+  if (!value.startsWith("@") || !value.includes(":")) {
+    return normalizeLowercaseStringOrEmpty(value);
+  }
+  const withoutAt = value.slice(1);
+  const splitIndex = withoutAt.indexOf(":");
+  if (splitIndex === -1) {
+    return normalizeLowercaseStringOrEmpty(value);
+  }
+  const localpart = normalizeLowercaseStringOrEmpty(withoutAt.slice(0, splitIndex));
+  const server = normalizeLowercaseStringOrEmpty(withoutAt.slice(splitIndex + 1));
+  if (!server) {
+    return normalizeLowercaseStringOrEmpty(value);
+  }
+  return `@${localpart}:${server}`;
+}
+function normalizeMatrixUserId(raw) {
+  const trimmed = (raw ?? "").trim();
+  if (!trimmed) {
+    return "";
+  }
+  const lowered = normalizeLowercaseStringOrEmpty(trimmed);
+  if (lowered.startsWith("matrix:")) {
+    return normalizeMatrixUser(trimmed.slice("matrix:".length));
+  }
+  if (lowered.startsWith("user:")) {
+    return normalizeMatrixUser(trimmed.slice("user:".length));
+  }
+  return normalizeMatrixUser(trimmed);
+}
+function normalizeMatrixAllowListEntry(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return "";
+  }
+  if (trimmed === "*") {
+    return trimmed;
+  }
+  const lowered = normalizeLowercaseStringOrEmpty(trimmed);
+  if (lowered.startsWith("matrix:")) {
+    return `matrix:${normalizeMatrixUser(trimmed.slice("matrix:".length))}`;
+  }
+  if (lowered.startsWith("user:")) {
+    return `user:${normalizeMatrixUser(trimmed.slice("user:".length))}`;
+  }
+  return normalizeMatrixUser(trimmed);
+}
+function normalizeMatrixAllowList(list) {
+  return normalizeAllowList(list).map((entry) => normalizeMatrixAllowListEntry(entry));
+}
+function resolveMatrixAllowListMatch(params) {
+  const allowList = params.allowList;
+  if (allowList.length === 0) {
+    return { allowed: false };
+  }
+  if (allowList.includes("*")) {
+    return { allowed: true, matchKey: "*", matchSource: "wildcard" };
+  }
+  const userId = normalizeMatrixUser(params.userId);
+  const candidates = [
+    { value: userId, source: "id" },
+    { value: userId ? `matrix:${userId}` : "", source: "prefixed-id" },
+    { value: userId ? `user:${userId}` : "", source: "prefixed-user" }
+  ];
+  return resolveAllowlistMatchByCandidates({ allowList, candidates });
+}
+
+export {
+  normalizeMatrixUserId,
+  normalizeMatrixAllowList,
+  resolveMatrixAllowListMatch
+};
+//# sourceMappingURL=chunk-AH4MLRYT.js.map

package/dist/chunk-AH4MLRYT.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/monitor/allowlist.ts"],
+  "sourcesContent": ["import {\n  resolveAllowlistMatchByCandidates,\n  type AllowlistMatch,\n} from \"openclaw/plugin-sdk/allow-from\";\nimport { normalizeStringEntries } from \"openclaw/plugin-sdk/string-normalization-runtime\";\nimport { normalizeLowercaseStringOrEmpty } from \"openclaw/plugin-sdk/text-runtime\";\n\nfunction normalizeAllowList(list?: Array<string | number>) {\n  return normalizeStringEntries(list);\n}\n\nfunction normalizeMatrixUser(raw?: string | null): string {\n  const value = (raw ?? \"\").trim();\n  if (!value) {\n    return \"\";\n  }\n  if (!value.startsWith(\"@\") || !value.includes(\":\")) {\n    return normalizeLowercaseStringOrEmpty(value);\n  }\n  const withoutAt = value.slice(1);\n  const splitIndex = withoutAt.indexOf(\":\");\n  if (splitIndex === -1) {\n    return normalizeLowercaseStringOrEmpty(value);\n  }\n  const localpart = normalizeLowercaseStringOrEmpty(withoutAt.slice(0, splitIndex));\n  const server = normalizeLowercaseStringOrEmpty(withoutAt.slice(splitIndex + 1));\n  if (!server) {\n    return normalizeLowercaseStringOrEmpty(value);\n  }\n  return `@${localpart}:${server}`;\n}\n\nexport function normalizeMatrixUserId(raw?: string | null): string {\n  const trimmed = (raw ?? \"\").trim();\n  if (!trimmed) {\n    return \"\";\n  }\n  const lowered = normalizeLowercaseStringOrEmpty(trimmed);\n  if (lowered.startsWith(\"matrix:\")) {\n    return normalizeMatrixUser(trimmed.slice(\"matrix:\".length));\n  }\n  if (lowered.startsWith(\"user:\")) {\n    return normalizeMatrixUser(trimmed.slice(\"user:\".length));\n  }\n  return normalizeMatrixUser(trimmed);\n}\n\nfunction normalizeMatrixAllowListEntry(raw: string): string {\n  const trimmed = raw.trim();\n  if (!trimmed) {\n    return \"\";\n  }\n  if (trimmed === \"*\") {\n    return trimmed;\n  }\n  const lowered = normalizeLowercaseStringOrEmpty(trimmed);\n  if (lowered.startsWith(\"matrix:\")) {\n    return `matrix:${normalizeMatrixUser(trimmed.slice(\"matrix:\".length))}`;\n  }\n  if (lowered.startsWith(\"user:\")) {\n    return `user:${normalizeMatrixUser(trimmed.slice(\"user:\".length))}`;\n  }\n  return normalizeMatrixUser(trimmed);\n}\n\nexport function normalizeMatrixAllowList(list?: Array<string | number>) {\n  return normalizeAllowList(list).map((entry) => normalizeMatrixAllowListEntry(entry));\n}\n\nexport type MatrixAllowListMatch = AllowlistMatch<\n  \"wildcard\" | \"id\" | \"prefixed-id\" | \"prefixed-user\"\n>;\n\ntype MatrixAllowListMatchSource = NonNullable<MatrixAllowListMatch[\"matchSource\"]>;\n\nexport function resolveMatrixAllowListMatch(params: {\n  allowList: string[];\n  userId?: string;\n}): MatrixAllowListMatch {\n  const allowList = params.allowList;\n  if (allowList.length === 0) {\n    return { allowed: false };\n  }\n  if (allowList.includes(\"*\")) {\n    return { allowed: true, matchKey: \"*\", matchSource: \"wildcard\" };\n  }\n  const userId = normalizeMatrixUser(params.userId);\n  const candidates: Array<{ value?: string; source: MatrixAllowListMatchSource }> = [\n    { value: userId, source: \"id\" },\n    { value: userId ? `matrix:${userId}` : \"\", source: \"prefixed-id\" },\n    { value: userId ? `user:${userId}` : \"\", source: \"prefixed-user\" },\n  ];\n  return resolveAllowlistMatchByCandidates<MatrixAllowListMatchSource>({ allowList, candidates });\n}\n"],
+  "mappings": ";;;;;AAAA;AAAA;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAEhD,SAAS,mBAAmB,MAA+B;AACzD,SAAO,uBAAuB,IAAI;AACpC;AAEA,SAAS,oBAAoB,KAA6B;AACxD,QAAM,SAAS,OAAO,IAAI,KAAK;AAC/B,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,SAAS,GAAG,GAAG;AAClD,WAAO,gCAAgC,KAAK;AAAA,EAC9C;AACA,QAAM,YAAY,MAAM,MAAM,CAAC;AAC/B,QAAM,aAAa,UAAU,QAAQ,GAAG;AACxC,MAAI,eAAe,IAAI;AACrB,WAAO,gCAAgC,KAAK;AAAA,EAC9C;AACA,QAAM,YAAY,gCAAgC,UAAU,MAAM,GAAG,UAAU,CAAC;AAChF,QAAM,SAAS,gCAAgC,UAAU,MAAM,aAAa,CAAC,CAAC;AAC9E,MAAI,CAAC,QAAQ;AACX,WAAO,gCAAgC,KAAK;AAAA,EAC9C;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEO,SAAS,sBAAsB,KAA6B;AACjE,QAAM,WAAW,OAAO,IAAI,KAAK;AACjC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,UAAU,gCAAgC,OAAO;AACvD,MAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,WAAO,oBAAoB,QAAQ,MAAM,UAAU,MAAM,CAAC;AAAA,EAC5D;AACA,MAAI,QAAQ,WAAW,OAAO,GAAG;AAC/B,WAAO,oBAAoB,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAC1D;AACA,SAAO,oBAAoB,OAAO;AACpC;AAEA,SAAS,8BAA8B,KAAqB;AAC1D,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK;AACnB,WAAO;AAAA,EACT;AACA,QAAM,UAAU,gCAAgC,OAAO;AACvD,MAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,WAAO,UAAU,oBAAoB,QAAQ,MAAM,UAAU,MAAM,CAAC,CAAC;AAAA,EACvE;AACA,MAAI,QAAQ,WAAW,OAAO,GAAG;AAC/B,WAAO,QAAQ,oBAAoB,QAAQ,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EACnE;AACA,SAAO,oBAAoB,OAAO;AACpC;AAEO,SAAS,yBAAyB,MAA+B;AACtE,SAAO,mBAAmB,IAAI,EAAE,IAAI,CAAC,UAAU,8BAA8B,KAAK,CAAC;AACrF;AAQO,SAAS,4BAA4B,QAGnB;AACvB,QAAM,YAAY,OAAO;AACzB,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,MAAI,UAAU,SAAS,GAAG,GAAG;AAC3B,WAAO,EAAE,SAAS,MAAM,UAAU,KAAK,aAAa,WAAW;AAAA,EACjE;AACA,QAAM,SAAS,oBAAoB,OAAO,MAAM;AAChD,QAAM,aAA4E;AAAA,IAChF,EAAE,OAAO,QAAQ,QAAQ,KAAK;AAAA,IAC9B,EAAE,OAAO,SAAS,UAAU,MAAM,KAAK,IAAI,QAAQ,cAAc;AAAA,IACjE,EAAE,OAAO,SAAS,QAAQ,MAAM,KAAK,IAAI,QAAQ,gBAAgB;AAAA,EACnE;AACA,SAAO,kCAA8D,EAAE,WAAW,WAAW,CAAC;AAChG;",
+  "names": []
+}

package/dist/chunk-AHKR32FH.js

@@ -0,0 +1,7 @@
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/matrix-migration.runtime.ts
+init_shims();
+//# sourceMappingURL=chunk-AHKR32FH.js.map

package/dist/chunk-AHKR32FH.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix-migration.runtime.ts"],
+  "sourcesContent": ["export { autoMigrateLegacyMatrixState, detectLegacyMatrixState } from \"./legacy-state.js\";\nexport { autoPrepareLegacyMatrixCrypto, detectLegacyMatrixCrypto } from \"./legacy-crypto.js\";\nexport {\n  hasActionableMatrixMigration,\n  hasPendingMatrixMigration,\n  resolveMatrixMigrationStatus,\n  type MatrixMigrationStatus,\n} from \"./migration-snapshot.js\";\nexport { maybeCreateMatrixMigrationSnapshot } from \"./migration-snapshot-backup.js\";\n"],
+  "mappings": ";;;;;AAAA;",
+  "names": []
+}

package/dist/chunk-ALKRFDAW.js

@@ -0,0 +1,94 @@
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/matrix/direct-room.ts
+init_shims();
+function trimMaybeString(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function normalizeJoinedMatrixMembers(joinedMembers) {
+  if (!Array.isArray(joinedMembers)) {
+    return [];
+  }
+  return joinedMembers.map((entry) => trimMaybeString(entry)).filter((entry) => Boolean(entry));
+}
+function isStrictDirectMembership(params) {
+  const selfUserId = trimMaybeString(params.selfUserId);
+  const remoteUserId = trimMaybeString(params.remoteUserId);
+  const joinedMembers = params.joinedMembers ?? [];
+  return Boolean(
+    selfUserId && remoteUserId && joinedMembers.length === 2 && joinedMembers.includes(selfUserId) && joinedMembers.includes(remoteUserId)
+  );
+}
+async function readJoinedMatrixMembers(client, roomId) {
+  try {
+    return normalizeJoinedMatrixMembers(await client.getJoinedRoomMembers(roomId));
+  } catch {
+    return null;
+  }
+}
+async function hasDirectMatrixMemberFlag(client, roomId, userId) {
+  const normalizedUserId = trimMaybeString(userId);
+  if (!normalizedUserId) {
+    return null;
+  }
+  try {
+    const state = await client.getRoomStateEvent(roomId, "m.room.member", normalizedUserId);
+    if (state?.is_direct === true) {
+      return true;
+    }
+    if (state?.is_direct === false) {
+      return false;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function inspectMatrixDirectRoomEvidence(params) {
+  const selfUserId = params.selfUserId !== void 0 ? trimMaybeString(params.selfUserId) : trimMaybeString(await params.client.getUserId().catch(() => null));
+  const joinedMembers = await readJoinedMatrixMembers(params.client, params.roomId);
+  const strict = isStrictDirectMembership({
+    selfUserId,
+    remoteUserId: params.remoteUserId,
+    joinedMembers
+  });
+  if (!strict) {
+    return {
+      joinedMembers,
+      strict: false,
+      viaMemberState: false,
+      memberStateFlag: null
+    };
+  }
+  const memberStateFlag = await hasDirectMatrixMemberFlag(params.client, params.roomId, selfUserId);
+  return {
+    joinedMembers,
+    strict,
+    viaMemberState: memberStateFlag === true,
+    memberStateFlag
+  };
+}
+async function isStrictDirectRoom(params) {
+  return (await inspectMatrixDirectRoomEvidence({
+    client: params.client,
+    roomId: params.roomId,
+    remoteUserId: params.remoteUserId,
+    selfUserId: params.selfUserId
+  })).strict;
+}
+
+export {
+  normalizeJoinedMatrixMembers,
+  isStrictDirectMembership,
+  readJoinedMatrixMembers,
+  hasDirectMatrixMemberFlag,
+  inspectMatrixDirectRoomEvidence,
+  isStrictDirectRoom
+};
+//# sourceMappingURL=chunk-ALKRFDAW.js.map

package/dist/chunk-ALKRFDAW.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/direct-room.ts"],
+  "sourcesContent": ["import type { MatrixClient } from \"./sdk.js\";\n\nfunction trimMaybeString(value: unknown): string | null {\n  if (typeof value !== \"string\") {\n    return null;\n  }\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nexport function normalizeJoinedMatrixMembers(joinedMembers: unknown): string[] {\n  if (!Array.isArray(joinedMembers)) {\n    return [];\n  }\n  return joinedMembers\n    .map((entry) => trimMaybeString(entry))\n    .filter((entry): entry is string => Boolean(entry));\n}\n\nexport function isStrictDirectMembership(params: {\n  selfUserId?: string | null;\n  remoteUserId?: string | null;\n  joinedMembers?: readonly string[] | null;\n}): boolean {\n  const selfUserId = trimMaybeString(params.selfUserId);\n  const remoteUserId = trimMaybeString(params.remoteUserId);\n  const joinedMembers = params.joinedMembers ?? [];\n  return Boolean(\n    selfUserId &&\n    remoteUserId &&\n    joinedMembers.length === 2 &&\n    joinedMembers.includes(selfUserId) &&\n    joinedMembers.includes(remoteUserId),\n  );\n}\n\nexport async function readJoinedMatrixMembers(\n  client: MatrixClient,\n  roomId: string,\n): Promise<string[] | null> {\n  try {\n    return normalizeJoinedMatrixMembers(await client.getJoinedRoomMembers(roomId));\n  } catch {\n    return null;\n  }\n}\n\nexport async function hasDirectMatrixMemberFlag(\n  client: MatrixClient,\n  roomId: string,\n  userId?: string | null,\n): Promise<boolean | null> {\n  const normalizedUserId = trimMaybeString(userId);\n  if (!normalizedUserId) {\n    return null;\n  }\n  try {\n    const state = await client.getRoomStateEvent(roomId, \"m.room.member\", normalizedUserId);\n    // Return true if is_direct is explicitly true, false if explicitly false, null if absent\n    if (state?.is_direct === true) {\n      return true;\n    }\n    if (state?.is_direct === false) {\n      return false;\n    }\n    // is_direct field is absent from the membership event\n    return null;\n  } catch {\n    // API/network error - treat as unavailable\n    return null;\n  }\n}\n\nexport type MatrixDirectRoomEvidence = {\n  joinedMembers: string[] | null;\n  strict: boolean;\n  viaMemberState: boolean;\n  memberStateFlag: boolean | null;\n};\n\nexport async function inspectMatrixDirectRoomEvidence(params: {\n  client: MatrixClient;\n  roomId: string;\n  remoteUserId: string;\n  selfUserId?: string | null;\n}): Promise<MatrixDirectRoomEvidence> {\n  const selfUserId =\n    params.selfUserId !== undefined\n      ? trimMaybeString(params.selfUserId)\n      : trimMaybeString(await params.client.getUserId().catch(() => null));\n  const joinedMembers = await readJoinedMatrixMembers(params.client, params.roomId);\n  const strict = isStrictDirectMembership({\n    selfUserId,\n    remoteUserId: params.remoteUserId,\n    joinedMembers,\n  });\n  if (!strict) {\n    return {\n      joinedMembers,\n      strict: false,\n      viaMemberState: false,\n      memberStateFlag: null,\n    };\n  }\n  const memberStateFlag = await hasDirectMatrixMemberFlag(params.client, params.roomId, selfUserId);\n  return {\n    joinedMembers,\n    strict,\n    viaMemberState: memberStateFlag === true,\n    memberStateFlag,\n  };\n}\n\nexport async function isStrictDirectRoom(params: {\n  client: MatrixClient;\n  roomId: string;\n  remoteUserId: string;\n  selfUserId?: string | null;\n}): Promise<boolean> {\n  return (\n    await inspectMatrixDirectRoomEvidence({\n      client: params.client,\n      roomId: params.roomId,\n      remoteUserId: params.remoteUserId,\n      selfUserId: params.selfUserId,\n    })\n  ).strict;\n}\n"],
+  "mappings": ";;;;;AAAA;AAEA,SAAS,gBAAgB,OAA+B;AACtD,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEO,SAAS,6BAA6B,eAAkC;AAC7E,MAAI,CAAC,MAAM,QAAQ,aAAa,GAAG;AACjC,WAAO,CAAC;AAAA,EACV;AACA,SAAO,cACJ,IAAI,CAAC,UAAU,gBAAgB,KAAK,CAAC,EACrC,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC;AACtD;AAEO,SAAS,yBAAyB,QAI7B;AACV,QAAM,aAAa,gBAAgB,OAAO,UAAU;AACpD,QAAM,eAAe,gBAAgB,OAAO,YAAY;AACxD,QAAM,gBAAgB,OAAO,iBAAiB,CAAC;AAC/C,SAAO;AAAA,IACL,cACA,gBACA,cAAc,WAAW,KACzB,cAAc,SAAS,UAAU,KACjC,cAAc,SAAS,YAAY;AAAA,EACrC;AACF;AAEA,eAAsB,wBACpB,QACA,QAC0B;AAC1B,MAAI;AACF,WAAO,6BAA6B,MAAM,OAAO,qBAAqB,MAAM,CAAC;AAAA,EAC/E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,0BACpB,QACA,QACA,QACyB;AACzB,QAAM,mBAAmB,gBAAgB,MAAM;AAC/C,MAAI,CAAC,kBAAkB;AACrB,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,kBAAkB,QAAQ,iBAAiB,gBAAgB;AAEtF,QAAI,OAAO,cAAc,MAAM;AAC7B,aAAO;AAAA,IACT;AACA,QAAI,OAAO,cAAc,OAAO;AAC9B,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,gCAAgC,QAKhB;AACpC,QAAM,aACJ,OAAO,eAAe,SAClB,gBAAgB,OAAO,UAAU,IACjC,gBAAgB,MAAM,OAAO,OAAO,UAAU,EAAE,MAAM,MAAM,IAAI,CAAC;AACvE,QAAM,gBAAgB,MAAM,wBAAwB,OAAO,QAAQ,OAAO,MAAM;AAChF,QAAM,SAAS,yBAAyB;AAAA,IACtC;AAAA,IACA,cAAc,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ,OAAO,QAAQ,UAAU;AAChG,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,gBAAgB,oBAAoB;AAAA,IACpC;AAAA,EACF;AACF;AAEA,eAAsB,mBAAmB,QAKpB;AACnB,UACE,MAAM,gCAAgC;AAAA,IACpC,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,cAAc,OAAO;AAAA,IACrB,YAAY,OAAO;AAAA,EACrB,CAAC,GACD;AACJ;",
+  "names": []
+}

package/dist/chunk-AQQGAE7N.js

@@ -0,0 +1,12 @@
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/record-shared.ts
+init_shims();
+import { isRecord } from "openclaw/plugin-sdk/text-runtime";
+
+export {
+  isRecord
+};
+//# sourceMappingURL=chunk-AQQGAE7N.js.map

package/dist/chunk-AQQGAE7N.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/record-shared.ts"],
+  "sourcesContent": ["import { isRecord } from \"openclaw/plugin-sdk/text-runtime\";\n\nexport { isRecord };\n"],
+  "mappings": ";;;;;AAAA;AAAA,SAAS,gBAAgB;",
+  "names": []
+}

package/dist/chunk-ARGF232V.js

@@ -0,0 +1,32 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// ../../node_modules/@archipelagolab/lobi-js-sdk/lib/crypto-api/CryptoEvent.js
+init_shims();
+var CryptoEvent = /* @__PURE__ */ (function(CryptoEvent2) {
+  CryptoEvent2["UserTrustStatusChanged"] = "userTrustStatusChanged";
+  CryptoEvent2["KeyBackupStatus"] = "crypto.keyBackupStatus";
+  CryptoEvent2["KeyBackupFailed"] = "crypto.keyBackupFailed";
+  CryptoEvent2["KeyBackupSessionsRemaining"] = "crypto.keyBackupSessionsRemaining";
+  CryptoEvent2["KeyBackupDecryptionKeyCached"] = "crypto.keyBackupDecryptionKeyCached";
+  CryptoEvent2["VerificationRequestReceived"] = "crypto.verificationRequestReceived";
+  CryptoEvent2["WillUpdateDevices"] = "crypto.willUpdateDevices";
+  CryptoEvent2["DevicesUpdated"] = "crypto.devicesUpdated";
+  CryptoEvent2["KeysChanged"] = "crossSigning.keysChanged";
+  CryptoEvent2["LegacyCryptoStoreMigrationProgress"] = "crypto.legacyCryptoStoreMigrationProgress";
+  CryptoEvent2["DehydratedDeviceCreated"] = "dehydration.DehydratedDeviceCreated";
+  CryptoEvent2["DehydratedDeviceUploaded"] = "dehydration.DehydratedDeviceUploaded";
+  CryptoEvent2["RehydrationStarted"] = "dehydration.RehydrationStarted";
+  CryptoEvent2["RehydrationProgress"] = "dehydration.RehydrationProgress";
+  CryptoEvent2["RehydrationCompleted"] = "dehydration.RehydrationCompleted";
+  CryptoEvent2["RehydrationError"] = "dehydration.RehydrationError";
+  CryptoEvent2["DehydrationKeyCached"] = "dehydration.DehydrationKeyCached";
+  CryptoEvent2["DehydratedDeviceRotationError"] = "dehydration.DehydratedDeviceRotationError";
+  return CryptoEvent2;
+})({});
+
+export {
+  CryptoEvent
+};
+//# sourceMappingURL=chunk-ARGF232V.js.map

package/dist/chunk-ARGF232V.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../node_modules/@archipelagolab/lobi-js-sdk/src/crypto-api/CryptoEvent.ts"],
+  "sourcesContent": ["/*\n * Copyright 2024 The Matrix.org Foundation C.I.C.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Cryptography-related events emitted by the {@link matrix.LobiClient}.\n */\nexport enum CryptoEvent {\n    /**\n     * Fires when the trust status of a user changes.\n     * The payload is a pair (userId, userTrustLevel). The trust level is one of the values from UserVerificationStatus.\n     */\n    UserTrustStatusChanged = \"userTrustStatusChanged\",\n\n    /**\n     * Fires when the key backup status changes.\n     * The payload is a boolean indicating whether the key backup is enabled.\n     */\n    KeyBackupStatus = \"crypto.keyBackupStatus\",\n\n    /**\n     * Fires when we failed to back up the keys\n     * The payload is the error code of the error that occurred.\n     */\n    KeyBackupFailed = \"crypto.keyBackupFailed\",\n\n    /**\n     * Fires when the number of sessions that can be backed up changes.\n     * The payload is the remaining number of sessions that can be backed up.\n     */\n    KeyBackupSessionsRemaining = \"crypto.keyBackupSessionsRemaining\",\n\n    /**\n     * Fires when a new valid backup decryption key is in cache.\n     * This will happen when a secret is received from another session, from secret storage,\n     * or when a new backup is created from this session.\n     *\n     * The payload is the version of the backup for which we have the key for.\n     *\n     * This event is only fired by the rust crypto backend.\n     */\n    KeyBackupDecryptionKeyCached = \"crypto.keyBackupDecryptionKeyCached\",\n\n    /**\n     * Fires when a key verification request is received.\n     * The payload is a VerificationRequest object representing the request.\n     */\n    VerificationRequestReceived = \"crypto.verificationRequestReceived\",\n\n    /** @deprecated Use {@link DevicesUpdated} instead when using rust crypto */\n    WillUpdateDevices = \"crypto.willUpdateDevices\",\n\n    /**\n     * Fires whenever the stored devices for a user have been updated\n     * The payload is a pair (userIds, initialFetch).\n     */\n    DevicesUpdated = \"crypto.devicesUpdated\",\n\n    /**\n     * Fires when the user's cross-signing keys have changed or cross-signing\n     * has been enabled/disabled. The client can use getStoredCrossSigningForUser\n     * with the user ID of the logged in user to check if cross-signing is\n     * enabled on the account. If enabled, it can test whether the current key\n     * is trusted using with checkUserTrust with the user ID of the logged\n     * in user. The checkOwnCrossSigningTrust function may be used to reconcile\n     * the trust in the account key.\n     *\n     * The cross-signing API is currently UNSTABLE and may change without notice.\n     * @experimental\n     */\n    KeysChanged = \"crossSigning.keysChanged\",\n\n    /**\n     * Fires when data is being migrated from legacy crypto to rust crypto.\n     *\n     * The payload is a pair `(progress, total)`, where `progress` is the number of steps completed so far, and\n     * `total` is the total number of steps. When migration is complete, a final instance of the event is emitted, with\n     * `progress === total === -1`.\n     */\n    LegacyCryptoStoreMigrationProgress = \"crypto.legacyCryptoStoreMigrationProgress\",\n\n    /**\n     * Fires when a new dehydrated device is created locally.\n     *\n     * After the client calls {@link CryptoApi.startDehydration}, this event\n     * will be fired every time a new dehydrated device is created.  It may fire\n     * before `startDehydration` returns.\n     */\n    DehydratedDeviceCreated = \"dehydration.DehydratedDeviceCreated\",\n\n    /**\n     * Fires when a new dehydrated device is successfully uploaded to the server.\n     *\n     * This should fire shortly after {@link DehydratedDeviceCreated} fires. If\n     * upload is unsuccessful, this will be reported either by an error thrown\n     * by {@link CryptoApi.startDehydration} (for errors that happen before\n     * `startDehydration` returns), or by firing {@link DehydratedDeviceRotationError}\n     * (for errors that happen during regular rotation of the dehydrated device)\n     */\n    DehydratedDeviceUploaded = \"dehydration.DehydratedDeviceUploaded\",\n\n    /**\n     * Fires when rehydration has started.\n     *\n     * After the client calls {@link CryptoApi.startDehydration}, this event will\n     * fire if a dehydrated device is found and we attempt to rehydrate it.\n     */\n    RehydrationStarted = \"dehydration.RehydrationStarted\",\n\n    /**\n     * Fires during rehydration, to inform the application of rehydration progress.\n     *\n     * The payload is a pair `[roomKeyCount: number, toDeviceCount: number]`,\n     * where `roomKeyCount` is the number of room keys that have been received\n     * so far, and `toDeviceCount` is the number of to-device messages received\n     * so far (including the messages containing room keys).\n     */\n    RehydrationProgress = \"dehydration.RehydrationProgress\",\n\n    /** Fires when rehydration has completed successfully. */\n    RehydrationCompleted = \"dehydration.RehydrationCompleted\",\n\n    /** Fires when there was an error in rehydration.\n     *\n     * The payload is an error message as a string.\n     */\n    RehydrationError = \"dehydration.RehydrationError\",\n\n    /**\n     * Fires when a dehydrated device key has been cached in the local database.\n     */\n    DehydrationKeyCached = \"dehydration.DehydrationKeyCached\",\n\n    /**\n     * Fires when an error occurs during periodic rotation of the dehydrated device.\n     *\n     * The payload is an error message as a string.\n     */\n    DehydratedDeviceRotationError = \"dehydration.DehydratedDeviceRotationError\",\n}\n"],
+  "mappings": ";;;;;AAAA;AAmBA,IAAYA,cAAW,0BAAXA,cAAW;AAAXA,EAAAA,aAAW,wBAAA,IAAA;AAAXA,EAAAA,aAAW,iBAAA,IAAA;AAAXA,EAAAA,aAAW,iBAAA,IAAA;AAAXA,EAAAA,aAAW,4BAAA,IAAA;AAAXA,EAAAA,aAAW,8BAAA,IAAA;AAAXA,EAAAA,aAAW,6BAAA,IAAA;AAAXA,EAAAA,aAAW,mBAAA,IAAA;AAAXA,EAAAA,aAAW,gBAAA,IAAA;AAAXA,EAAAA,aAAW,aAAA,IAAA;AAAXA,EAAAA,aAAW,oCAAA,IAAA;AAAXA,EAAAA,aAAW,yBAAA,IAAA;AAAXA,EAAAA,aAAW,0BAAA,IAAA;AAAXA,EAAAA,aAAW,oBAAA,IAAA;AAAXA,EAAAA,aAAW,qBAAA,IAAA;AAAXA,EAAAA,aAAW,sBAAA,IAAA;AAAXA,EAAAA,aAAW,kBAAA,IAAA;AAAXA,EAAAA,aAAW,sBAAA,IAAA;AAAXA,EAAAA,aAAW,+BAAA,IAAA;AAAA,SAAXA;AAAW,GAAA,CAAA,CAAA;",
+  "names": ["CryptoEvent"]
+}

package/dist/chunk-ATCJOK3K.js

@@ -0,0 +1,24 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/exec-approval-resolver.ts
+init_shims();
+import { resolveApprovalOverGateway } from "openclaw/plugin-sdk/approval-gateway-runtime";
+import { isApprovalNotFoundError } from "openclaw/plugin-sdk/error-runtime";
+async function resolveMatrixApproval(params) {
+  await resolveApprovalOverGateway({
+    cfg: params.cfg,
+    approvalId: params.approvalId,
+    decision: params.decision,
+    senderId: params.senderId,
+    gatewayUrl: params.gatewayUrl,
+    clientDisplayName: `Matrix approval (${params.senderId?.trim() || "unknown"})`
+  });
+}
+
+export {
+  isApprovalNotFoundError,
+  resolveMatrixApproval
+};
+//# sourceMappingURL=chunk-ATCJOK3K.js.map

package/dist/chunk-ATCJOK3K.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/exec-approval-resolver.ts"],
+  "sourcesContent": ["import { resolveApprovalOverGateway } from \"openclaw/plugin-sdk/approval-gateway-runtime\";\nimport type { ExecApprovalReplyDecision } from \"openclaw/plugin-sdk/approval-runtime\";\nimport type { OpenClawConfig } from \"openclaw/plugin-sdk/config-runtime\";\nimport { isApprovalNotFoundError } from \"openclaw/plugin-sdk/error-runtime\";\n\nexport { isApprovalNotFoundError };\n\nexport async function resolveMatrixApproval(params: {\n  cfg: OpenClawConfig;\n  approvalId: string;\n  decision: ExecApprovalReplyDecision;\n  senderId?: string | null;\n  gatewayUrl?: string;\n}): Promise<void> {\n  await resolveApprovalOverGateway({\n    cfg: params.cfg,\n    approvalId: params.approvalId,\n    decision: params.decision,\n    senderId: params.senderId,\n    gatewayUrl: params.gatewayUrl,\n    clientDisplayName: `Matrix approval (${params.senderId?.trim() || \"unknown\"})`,\n  });\n}\n"],
+  "mappings": ";;;;;AAAA;AAAA,SAAS,kCAAkC;AAG3C,SAAS,+BAA+B;AAIxC,eAAsB,sBAAsB,QAM1B;AAChB,QAAM,2BAA2B;AAAA,IAC/B,KAAK,OAAO;AAAA,IACZ,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,mBAAmB,oBAAoB,OAAO,UAAU,KAAK,KAAK,SAAS;AAAA,EAC7E,CAAC;AACH;",
+  "names": []
+}