@barryfan2045/dsh-matrix 0.1.0

package/dist/auth/challenge.d.ts

@@ -0,0 +1,93 @@
+/**
+ * T2: challenge-based DM authentication - pure strategy ported from
+ * pi-courier src/auth/challenge-auth.ts (MIT), Matrix-free and fully
+ * data-in/data-out:
+ *
+ *  - unknown DM user → gateDm issues a one-shot 6-digit challenge; the code
+ *    only ever leaves through the onCode log callback, the chat gets the
+ *    prompt text (sent by the caller via Transport.send);
+ *  - code replies are validated with submitCode (whole-message 6 digits);
+ *  - 2-minute expiry, 3 wrong attempts → 5-minute lockout, one active
+ *    challenge per user;
+ *  - trust list + first-trusted-becomes-admin live in the injected AuthStore.
+ *
+ * Divergences from pi-courier (deliberate):
+ *  - no `transport:` namespacing (identity is the raw MXID - single transport);
+ *  - the admin is assigned AT GRANT TIME (first user ever trusted), not
+ *    lazily on the next message;
+ *  - clock/RNG are injectable so the lifecycle is table-testable.
+ */
+import type { AuthStore } from './store.ts';
+export declare const CHALLENGE_TTL_MS: number;
+export declare const MAX_ATTEMPTS = 3;
+export declare const LOCKOUT_MS: number;
+/** Room-facing prompt; the code itself only goes to the log (onCode). */
+export declare const CHALLENGE_PROMPT = "\uD83D\uDD10 \u4F60\u662F\u964C\u751F\u7528\u6237\u3002\u6865\u7684\u5BBF\u4E3B\u65E5\u5FD7\u91CC\u521A\u6253\u5370\u4E86\u4E00\u4E32\u5C5E\u4E8E\u4F60\u7684 6 \u4F4D\u9A8C\u8BC1\u7801,\u8BF7\u628A\u5B83\u4F5C\u4E3A\u6D88\u606F\u53D1\u56DE\u6765\u3002\n\u23F1\uFE0F 2 \u5206\u949F\u5185\u6709\u6548\u3002";
+export interface ChallengeDeps {
+    /** Clock injection point (epoch ms). Defaults to Date.now. */
+    now?: () => number;
+    /** RNG injection point in [0,1), used when codeSource is absent. */
+    random?: () => number;
+    /** RNG injection point for the whole code; wins over random (tests). */
+    codeSource?: () => string;
+    /** The fresh code is logged host-side only - never sent to the room. */
+    onCode?: (userId: string, code: string) => void;
+    /** Host-side lifecycle chatter (admin grant, lockout). */
+    notify?: (message: string, level?: 'info' | 'warn') => void;
+    /**
+     * Config-owner bootstrap: when the row config already ships a trustedUsers
+     * list, its first entry is seeded as admin instead of the first challenge
+     * winner (bridge rule: admin = AuthStore.adminUserId ?? 静态名单第一人).
+     */
+    seedAdmin?: string;
+}
+export type DmDecision = {
+    kind: 'trusted';
+} | {
+    kind: 'challenged';
+    prompt: string;
+} | {
+    kind: 'pending';
+} | {
+    kind: 'locked';
+    retryInMs: number;
+};
+export type CodeResult = {
+    kind: 'none';
+} | {
+    kind: 'authenticated';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'wrong';
+    attemptsLeft: number;
+} | {
+    kind: 'locked';
+    retryInMs: number;
+};
+export declare class ChallengeEngine {
+    private readonly store;
+    private challenges;
+    private lockedUntil;
+    private readonly now;
+    private readonly codeSource;
+    private readonly onCode?;
+    private readonly notify;
+    private readonly seedAdmin?;
+    constructor(store: AuthStore, deps?: ChallengeDeps);
+    isTrusted(userId: string): boolean;
+    /** Trust gate + challenge lifecycle for a DM message from a stranger. */
+    gateDm(userId: string): DmDecision;
+    /**
+     * Try to consume a message as a challenge-code reply. Returns none when
+     * the text is not a 6-digit code or the user has no active challenge
+     * (never counts as an attempt).
+     */
+    submitCode(userId: string, text: string): CodeResult;
+    /** Drop any pending challenge/prompt state for a user (e.g. after revoke). */
+    reset(userId: string): void;
+    private grantTrust;
+    /** Lock expiry, or undefined when not locked (auto-cleans stale entries). */
+    private activeLock;
+}
+//# sourceMappingURL=challenge.d.ts.map

package/dist/auth/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/auth/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,eAAO,MAAM,gBAAgB,QAAgB,CAAA;AAC7C,eAAO,MAAM,YAAY,IAAI,CAAA;AAC7B,eAAO,MAAM,UAAU,QAAgB,CAAA;AAEvC,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,qTACkC,CAAA;AAE/D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;IACrB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/C,0DAA0D;IAC1D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,KAAK,IAAI,CAAA;IAC3D;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzC,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQzC,qBAAa,eAAe;IAUd,OAAO,CAAC,QAAQ,CAAC,KAAK;IATlC,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,WAAW,CAA4B;IAE/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoD;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAQ;gBAEN,KAAK,EAAE,SAAS,EAAE,IAAI,GAAE,aAAkB;IAUvE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIlC,yEAAyE;IACzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IAkBlC;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IA+BpD,8EAA8E;IAC9E,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3B,OAAO,CAAC,UAAU;IAYlB,6EAA6E;IAC7E,OAAO,CAAC,UAAU;CAOnB"}

package/dist/auth/challenge.js

@@ -0,0 +1,104 @@
+export const CHALLENGE_TTL_MS = 2 * 60 * 1000;
+export const MAX_ATTEMPTS = 3;
+export const LOCKOUT_MS = 5 * 60 * 1000;
+/** Room-facing prompt; the code itself only goes to the log (onCode). */
+export const CHALLENGE_PROMPT = '🔐 你是陌生用户。桥的宿主日志里刚打印了一串属于你的 6 位验证码,请把它作为消息发回来。\n⏱️ 2 分钟内有效。';
+export class ChallengeEngine {
+    store;
+    challenges = new Map();
+    lockedUntil = new Map();
+    now;
+    codeSource;
+    onCode;
+    notify;
+    seedAdmin;
+    constructor(store, deps = {}) {
+        this.store = store;
+        this.now = deps.now ?? (() => Date.now());
+        const random = deps.random ?? Math.random;
+        this.codeSource = deps.codeSource
+            ?? (() => String(Math.floor(100000 + random() * 900000)));
+        this.onCode = deps.onCode;
+        this.notify = deps.notify ?? (() => { });
+        this.seedAdmin = deps.seedAdmin;
+    }
+    isTrusted(userId) {
+        return this.store.get().trustedUsers.includes(userId);
+    }
+    /** Trust gate + challenge lifecycle for a DM message from a stranger. */
+    gateDm(userId) {
+        const lock = this.activeLock(userId);
+        if (lock !== undefined)
+            return { kind: 'locked', retryInMs: lock - this.now() };
+        if (this.isTrusted(userId))
+            return { kind: 'trusted' };
+        const active = this.challenges.get(userId);
+        if (active) {
+            if (this.now() <= active.expiresAt)
+                return { kind: 'pending' };
+            this.challenges.delete(userId); // expired: fall through to a fresh code
+        }
+        const code = this.codeSource();
+        this.challenges.set(userId, { code, expiresAt: this.now() + CHALLENGE_TTL_MS, attempts: 0 });
+        this.onCode?.(userId, code);
+        return { kind: 'challenged', prompt: CHALLENGE_PROMPT };
+    }
+    /**
+     * Try to consume a message as a challenge-code reply. Returns none when
+     * the text is not a 6-digit code or the user has no active challenge
+     * (never counts as an attempt).
+     */
+    submitCode(userId, text) {
+        const trimmed = text.trim();
+        if (!/^\d{6}$/.test(trimmed))
+            return { kind: 'none' };
+        const lock = this.activeLock(userId);
+        if (lock !== undefined)
+            return { kind: 'locked', retryInMs: lock - this.now() };
+        const challenge = this.challenges.get(userId);
+        if (!challenge)
+            return { kind: 'none' };
+        if (this.now() > challenge.expiresAt) {
+            this.challenges.delete(userId);
+            return { kind: 'expired' };
+        }
+        if (trimmed === challenge.code) {
+            this.challenges.delete(userId);
+            this.grantTrust(userId);
+            return { kind: 'authenticated' };
+        }
+        challenge.attempts++;
+        if (challenge.attempts >= MAX_ATTEMPTS) {
+            this.challenges.delete(userId);
+            this.lockedUntil.set(userId, this.now() + LOCKOUT_MS);
+            this.notify(`🚫 ${userId} 连错 ${MAX_ATTEMPTS} 次,锁定 5 分钟`, 'warn');
+            return { kind: 'locked', retryInMs: LOCKOUT_MS };
+        }
+        return { kind: 'wrong', attemptsLeft: MAX_ATTEMPTS - challenge.attempts };
+    }
+    /** Drop any pending challenge/prompt state for a user (e.g. after revoke). */
+    reset(userId) {
+        this.challenges.delete(userId);
+    }
+    grantTrust(userId) {
+        const state = this.store.get();
+        if (!state.trustedUsers.includes(userId))
+            state.trustedUsers.push(userId);
+        const becameAdmin = state.adminUserId === undefined;
+        if (becameAdmin)
+            state.adminUserId = this.seedAdmin ?? userId;
+        this.store.set(state);
+        this.notify(`✅ ${userId} 认证通过${becameAdmin && state.adminUserId === userId ? ',成为管理员' : ''}`, 'info');
+    }
+    /** Lock expiry, or undefined when not locked (auto-cleans stale entries). */
+    activeLock(userId) {
+        const until = this.lockedUntil.get(userId);
+        if (until === undefined)
+            return undefined;
+        if (this.now() < until)
+            return until;
+        this.lockedUntil.delete(userId);
+        return undefined;
+    }
+}
+//# sourceMappingURL=challenge.js.map

package/dist/auth/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/auth/challenge.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAA;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvC,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAC3B,6DAA6D,CAAA;AAwC/D,MAAM,OAAO,eAAe;IAUG;IATrB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAA;IACzC,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAE9B,GAAG,CAAc;IACjB,UAAU,CAAc;IACxB,MAAM,CAAyC;IAC/C,MAAM,CAAoD;IAC1D,SAAS,CAAS;IAEnC,YAA6B,KAAgB,EAAE,OAAsB,EAAE;QAA1C,UAAK,GAAL,KAAK,CAAW;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;eAC5B,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IACjC,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvD,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAc;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QAE/E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAC9D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,wCAAwC;QACzE,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5F,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,MAAc,EAAE,IAAY;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAErD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QAE/E,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAEvC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACvB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;QAClC,CAAC;QAED,SAAS,CAAC,QAAQ,EAAE,CAAA;QACpB,IAAI,SAAS,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAA;YACrD,IAAI,CAAC,MAAM,CAAC,MAAM,MAAM,OAAO,YAAY,YAAY,EAAE,MAAM,CAAC,CAAA;YAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAA;IAC3E,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC9B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAA;QACnD,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAA;QAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,IAAI,CAAC,MAAM,CACT,KAAK,MAAM,QAAQ,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAChF,MAAM,CACP,CAAA;IACH,CAAC;IAED,6EAA6E;IACrE,UAAU,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,OAAO,KAAK,CAAA;QACpC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;CACF"}

package/dist/auth/store.d.ts

@@ -0,0 +1,55 @@
+export type ChannelMode = 'all' | 'mentions' | 'trusted-only';
+export interface ChannelAuth {
+    enabled: boolean;
+    mode: ChannelMode;
+}
+export interface AuthState {
+    /** Matrix MXIDs granted trust at runtime (union'd with the static config list). */
+    trustedUsers: string[];
+    /** First runtime-authenticated user becomes admin (pi-courier rule). */
+    adminUserId?: string;
+    /** Group-room policy map; schema only in T2, T8 consumes it. */
+    channels: Record<string, ChannelAuth>;
+}
+export declare function emptyAuthState(): AuthState;
+/** Lenient parse: keeps well-formed fields, drops junk - never throws. */
+export declare function parseAuthState(raw: unknown): AuthState;
+export interface AuthStore {
+    /** Pull persisted state into memory (missing/corrupt source → empty state). */
+    load(): Promise<AuthState>;
+    /** Current in-memory snapshot (a copy; callers never mutate it in place). */
+    get(): AuthState;
+    /** Replace state; implementations schedule persistence (non-blocking). */
+    set(next: AuthState): void;
+    /** Flush the current state now and await durability. */
+    save(): Promise<void>;
+}
+/** Test fake: in-memory only; `saves` lets tests assert persistence points. */
+export declare class MemoryAuthStore implements AuthStore {
+    readonly saves: AuthState[];
+    private state;
+    constructor(initial?: AuthState);
+    load(): Promise<AuthState>;
+    get(): AuthState;
+    set(next: AuthState): void;
+    save(): Promise<void>;
+}
+export declare function expandHome(p: string): string;
+export declare const DEFAULT_AUTH_STORE_PATH = "~/.dsh/dsh-matrix-auth.json";
+export interface JsonFileStoreOptions {
+    /** Receive non-fatal I/O / parse errors (wire to the bridge logger). */
+    onError?: (error: unknown) => void;
+}
+export declare class JsonFileStore implements AuthStore {
+    private readonly path;
+    private readonly options;
+    private state;
+    private pending;
+    constructor(path?: string, options?: JsonFileStoreOptions);
+    load(): Promise<AuthState>;
+    get(): AuthState;
+    set(next: AuthState): void;
+    save(): Promise<void>;
+    private write;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,cAAc,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACtC;AAED,wBAAgB,cAAc,IAAI,SAAS,CAE1C;AASD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,CActD;AAED,MAAM,WAAW,SAAS;IACxB,+EAA+E;IAC/E,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1B,6EAA6E;IAC7E,GAAG,IAAI,SAAS,CAAA;IAChB,0EAA0E;IAC1E,GAAG,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;IAC1B,wDAAwD;IACxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAWD,+EAA+E;AAC/E,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,CAAK;IAChC,OAAO,CAAC,KAAK,CAAW;gBAEZ,OAAO,GAAE,SAA4B;IAI3C,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAGhC,GAAG,IAAI,SAAS;IAGhB,GAAG,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAIpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAG5B;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI5C;AAED,eAAO,MAAM,uBAAuB,gCAAgC,CAAA;AAEpE,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACnC;AAED,qBAAa,aAAc,YAAW,SAAS;IAK3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,OAAO,CAAmC;gBAG/B,IAAI,GAAE,MAAgC,EACtC,OAAO,GAAE,oBAAyB;IAG/C,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAahC,GAAG,IAAI,SAAS;IAIhB,GAAG,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAOpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAKb,KAAK;CAQpB"}

package/dist/auth/store.js

@@ -0,0 +1,124 @@
+/**
+ * T2: runtime auth state persistence.
+ *
+ * The row config's trustedUsers is a BOOT SNAPSHOT (read-only at start);
+ * everything the challenge flow and admin commands change at runtime lives
+ * here, persisted to ~/.dsh/dsh-matrix-auth.json (0600, tmp+rename atomic).
+ *
+ * AuthStore is the interface the bridge codes against; MemoryAuthStore is
+ * the test fake, JsonFileStore the production implementation.
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+export function emptyAuthState() {
+    return { trustedUsers: [], channels: {} };
+}
+function isChannelAuth(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return typeof v.enabled === 'boolean'
+        && (v.mode === 'all' || v.mode === 'mentions' || v.mode === 'trusted-only');
+}
+/** Lenient parse: keeps well-formed fields, drops junk - never throws. */
+export function parseAuthState(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return emptyAuthState();
+    const v = raw;
+    const state = emptyAuthState();
+    if (Array.isArray(v.trustedUsers)) {
+        state.trustedUsers = v.trustedUsers.filter((x) => typeof x === 'string' && x.length > 0);
+    }
+    if (typeof v.adminUserId === 'string' && v.adminUserId)
+        state.adminUserId = v.adminUserId;
+    if (typeof v.channels === 'object' && v.channels !== null && !Array.isArray(v.channels)) {
+        for (const [roomId, entry] of Object.entries(v.channels)) {
+            if (isChannelAuth(entry))
+                state.channels[roomId] = { enabled: entry.enabled, mode: entry.mode };
+        }
+    }
+    return state;
+}
+function cloneState(s) {
+    return {
+        trustedUsers: [...s.trustedUsers],
+        ...(s.adminUserId !== undefined ? { adminUserId: s.adminUserId } : {}),
+        channels: Object.fromEntries(Object.entries(s.channels).map(([k, c]) => [k, { enabled: c.enabled, mode: c.mode }])),
+    };
+}
+/** Test fake: in-memory only; `saves` lets tests assert persistence points. */
+export class MemoryAuthStore {
+    saves = [];
+    state;
+    constructor(initial = emptyAuthState()) {
+        this.state = cloneState(initial);
+    }
+    async load() {
+        return cloneState(this.state);
+    }
+    get() {
+        return cloneState(this.state);
+    }
+    set(next) {
+        this.state = cloneState(next);
+        void this.save();
+    }
+    async save() {
+        this.saves.push(cloneState(this.state));
+    }
+}
+export function expandHome(p) {
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/'))
+        return join(homedir(), p.slice(2));
+    return p;
+}
+export const DEFAULT_AUTH_STORE_PATH = '~/.dsh/dsh-matrix-auth.json';
+export class JsonFileStore {
+    path;
+    options;
+    state = emptyAuthState();
+    pending = Promise.resolve();
+    constructor(path = DEFAULT_AUTH_STORE_PATH, options = {}) {
+        this.path = path;
+        this.options = options;
+    }
+    async load() {
+        try {
+            const raw = await readFile(expandHome(this.path), 'utf8');
+            this.state = parseAuthState(JSON.parse(raw));
+        }
+        catch (error) {
+            // ENOENT is the normal first-run case; anything else (corrupt JSON)
+            // degrades to empty state so the bridge still boots.
+            if (error?.code !== 'ENOENT')
+                this.options.onError?.(error);
+            this.state = emptyAuthState();
+        }
+        return cloneState(this.state);
+    }
+    get() {
+        return cloneState(this.state);
+    }
+    set(next) {
+        this.state = cloneState(next);
+        // Fire-and-persist: set() is on the message hot path; a failed write is
+        // logged, never thrown back into the pipeline (pi-courier semantics).
+        this.pending = this.pending.then(() => this.write()).catch((error) => this.options.onError?.(error));
+    }
+    async save() {
+        this.pending = this.pending.then(() => this.write()).catch((error) => this.options.onError?.(error));
+        await this.pending;
+    }
+    async write() {
+        const path = expandHome(this.path);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        // Atomic: full write into a unique tmp sibling, then rename over.
+        const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+        await writeFile(tmp, JSON.stringify(this.state, null, 2), { mode: 0o600 });
+        await rename(tmp, path);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAkBzC,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;WAChC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,EAAE,CAAA;IAC1F,MAAM,CAAC,GAAG,GAA8B,CAAA;IACxC,MAAM,KAAK,GAAc,cAAc,EAAE,CAAA;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW;QAAE,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAA;IACzF,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAmC,CAAC,EAAE,CAAC;YACpF,IAAI,aAAa,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QACjG,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAaD,SAAS,UAAU,CAAC,CAAY;IAC9B,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QACjC,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KACzF,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,OAAO,eAAe;IACjB,KAAK,GAAgB,EAAE,CAAA;IACxB,KAAK,CAAW;IAExB,YAAY,UAAqB,cAAc,EAAE;QAC/C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,GAAG;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,GAAG,CAAC,IAAe;QACjB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAC7B,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;IAClB,CAAC;IACD,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACzC,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAA;AAOpE,MAAM,OAAO,aAAa;IAKL;IACA;IALX,KAAK,GAAc,cAAc,EAAE,CAAA;IACnC,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAElD,YACmB,OAAe,uBAAuB,EACtC,UAAgC,EAAE;QADlC,SAAI,GAAJ,IAAI,CAAkC;QACtC,YAAO,GAAP,OAAO,CAA2B;IAClD,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YACzD,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,qDAAqD;YACrD,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;gBAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;YACtF,IAAI,CAAC,KAAK,GAAG,cAAc,EAAE,CAAA;QAC/B,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IAED,GAAG;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IAED,GAAG,CAAC,IAAe;QACjB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAC7B,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IACtG,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QACpG,MAAM,IAAI,CAAC,OAAO,CAAA;IACpB,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,kEAAkE;QAClE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAA;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;CACF"}

package/dist/bridge/agent-commands.d.ts

@@ -0,0 +1,39 @@
+/**
+ * T4: bridge-local command surface + DSH registry passthrough.
+ *
+ * The pipeline hands every slash line here (after the trust gate, before
+ * any prompt). Bridge-owned commands (model / sessions / …) run against the
+ * Backend port; everything else is passed through to ctx.commands.execute
+ * against the room's agent. A line the DSH registry does not know is NEVER
+ * forwarded to the model — it settles as an "unknown command" reply.
+ *
+ * Kept in its own file so parallel tickets touching pipeline.ts stay away
+ * from this route table (pipeline only holds the commandRouter hook).
+ */
+import type { Backend } from '../ports/backend.ts';
+import type { Transport } from '../ports/transport.ts';
+import type { Logger } from '../types.ts';
+export interface CommandRouteContext {
+    roomId: string;
+    sender: string;
+}
+/** The narrow slice of this module the pipeline depends on. */
+export interface CommandRouter {
+    isCommand(text: string): boolean;
+    handle(text: string, ctx: CommandRouteContext): Promise<void>;
+}
+export interface CommandRouterDeps {
+    backend: Backend;
+    transport: Transport;
+    logger: Logger;
+}
+interface BridgeCommandSpec {
+    readonly name: string;
+    readonly args?: string;
+    readonly description: string;
+}
+/** Table doubles as /help rendering; handlers register by the same names. */
+export declare const BRIDGE_COMMANDS: readonly BridgeCommandSpec[];
+export declare function createCommandRouter(deps: CommandRouterDeps): CommandRouter;
+export {};
+//# sourceMappingURL=agent-commands.d.ts.map

package/dist/bridge/agent-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-commands.d.ts","sourceRoot":"","sources":["../../src/bridge/agent-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAE,SAAS,iBAAiB,EASvD,CAAA;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAuO1E"}