@dotwire/host 0.0.0-stage → 0.2.0

package/dist/index.cjs

@@ -0,0 +1,1000 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BatchModerationWorker: () => BatchModerationWorker,
+  DotwireApiError: () => DotwireApiError,
+  DotwireHostClient: () => DotwireHostClient,
+  DotwireHostRoom: () => DotwireHostRoom,
+  DotwireTokenSigner: () => DotwireTokenSigner,
+  ModerationQueue: () => ModerationQueue,
+  PostSendError: () => PostSendError,
+  PresendRejectedError: () => PresendRejectedError,
+  PresendResult: () => PresendResult,
+  mapErrorKind: () => mapErrorKind
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/types.ts
+var PresendResult = {
+  accept(content) {
+    return { allow: true, content };
+  },
+  reject(reason) {
+    return { allow: false, rejectionReason: reason };
+  }
+};
+
+// src/errors.ts
+var DotwireApiError = class extends Error {
+  status;
+  kind;
+  code;
+  reason;
+  retryAfterMs;
+  method;
+  path;
+  constructor(init) {
+    super(`dotwire ${init.method} ${init.path} failed: ${init.status}${init.code ? ` ${init.code}` : ""}`);
+    this.name = "DotwireApiError";
+    this.status = init.status;
+    this.kind = init.kind;
+    this.code = init.code;
+    this.reason = init.reason;
+    this.retryAfterMs = init.retryAfterMs;
+    this.method = init.method;
+    this.path = init.path;
+  }
+};
+function mapErrorKind(status, code) {
+  switch (status) {
+    case 400:
+      return "BadRequest";
+    case 401:
+      return "Unauthorized";
+    case 403:
+      return "Forbidden";
+    case 404:
+      return "NotFound";
+    case 422:
+      return code === "presend_rejected" ? "PresendRejected" : "BadRequest";
+    case 429:
+      return "RateLimited";
+    case 503:
+      return "Unavailable";
+    default:
+      return "Unknown";
+  }
+}
+var PresendRejectedError = class extends Error {
+  reason;
+  constructor(reason) {
+    super(reason);
+    this.name = "PresendRejectedError";
+    this.reason = reason;
+  }
+};
+var PostSendError = class extends Error {
+  sent;
+  constructor(sent, cause) {
+    super("The message was sent, but the postSend hook failed.", { cause });
+    this.name = "PostSendError";
+    this.sent = sent;
+  }
+};
+
+// src/signer.ts
+var import_jose = require("jose");
+var DotwireTokenSigner = class {
+  config;
+  keyPromise;
+  defaultTtl;
+  constructor(config) {
+    this.config = config;
+    this.keyPromise = (0, import_jose.importPKCS8)(config.privateKeyPem, "RS256");
+    this.defaultTtl = config.defaultTokenTtl ?? "15m";
+  }
+  async mintToken(userId, options = {}) {
+    const key = await this.keyPromise;
+    const jwt = new import_jose.SignJWT({
+      "dw:role": options.role ?? "member",
+      ...options.displayName ? { "dw:name": options.displayName } : {}
+    }).setProtectedHeader({ alg: "RS256", kid: this.config.keyId }).setIssuer(this.config.issuer).setSubject(userId).setAudience(this.config.audience ?? "dotwire").setIssuedAt().setExpirationTime(options.ttl ?? this.defaultTtl);
+    return jwt.sign(key);
+  }
+};
+
+// src/room.ts
+var DotwireHostRoom = class {
+  client;
+  roomId;
+  constructor(client, roomId) {
+    this.client = client;
+    this.roomId = roomId;
+  }
+  addMembers(userIds, options) {
+    return this.client.addRoomMembers(this.roomId, userIds, options);
+  }
+  removeMember(userId) {
+    return this.client.removeRoomMember(this.roomId, userId);
+  }
+  getMembers() {
+    return this.client.getRoomMembers(this.roomId);
+  }
+  getParticipants(asUserId) {
+    return this.client.getRoomParticipants(this.roomId, asUserId);
+  }
+  sendAsUser(userId, content) {
+    return this.client.sendAsUser(this.roomId, userId, content);
+  }
+  sendSystemMessage(content, options) {
+    return this.client.sendSystemMessage(this.roomId, content, options);
+  }
+  getMessages(options) {
+    return this.client.getMessages(this.roomId, options);
+  }
+  events(options) {
+    return this.client.streamRoomEvents(this.roomId, options);
+  }
+  redact(seq) {
+    return this.client.redactMessage(this.roomId, seq);
+  }
+};
+
+// src/client.ts
+var import_node_crypto = require("crypto");
+
+// src/sse.ts
+async function* parseSseStream(body, signal) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  try {
+    while (true) {
+      if (signal?.aborted) return;
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true }).replace(/\r\n/g, "\n");
+      let idx;
+      while ((idx = buffer.indexOf("\n\n")) !== -1) {
+        const block = buffer.slice(0, idx);
+        buffer = buffer.slice(idx + 2);
+        const parsed = parseEventBlock(block);
+        if (parsed) yield parsed;
+      }
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+}
+function parseEventBlock(block) {
+  let eventName = "message";
+  let id;
+  const dataLines = [];
+  let sawData = false;
+  for (const line of block.split("\n")) {
+    if (line.length === 0) continue;
+    if (line.startsWith(":")) continue;
+    if (line.startsWith("event:")) {
+      eventName = line.slice("event:".length).trim();
+    } else if (line.startsWith("id:")) {
+      id = line.slice("id:".length).trim();
+    } else if (line.startsWith("data:")) {
+      dataLines.push(line.slice("data:".length).trim());
+      sawData = true;
+    }
+  }
+  if (!sawData) return null;
+  return { event: eventName, data: dataLines.join("\n"), id };
+}
+function toRoomEvent(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw.data);
+  } catch {
+    return null;
+  }
+  if (typeof data !== "object" || data === null) return null;
+  const d = data;
+  switch (raw.event) {
+    case "message":
+      return {
+        type: "message",
+        roomId: String(d.roomId),
+        seq: Number(d.seq),
+        senderId: String(d.senderId),
+        time: String(d.time),
+        content: String(d.content),
+        replayed: d.replayed === true
+      };
+    case "retracted":
+      return { type: "retracted", roomId: String(d.roomId), seq: Number(d.seq) };
+    case "typing":
+      return { type: "typing", roomId: String(d.roomId), userId: String(d.userId), isTyping: Boolean(d.isTyping) };
+    case "presence":
+      return {
+        type: "presence",
+        roomId: String(d.roomId),
+        joined: Array.isArray(d.joined) ? d.joined.map(String) : [],
+        left: Array.isArray(d.left) ? d.left.map(String) : []
+      };
+    case "revoked":
+      return { type: "revoked", roomId: String(d.roomId) };
+    default:
+      return null;
+  }
+}
+
+// src/util.ts
+function delay(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new DOMException("Aborted", "AbortError"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      cleanup();
+      reject(new DOMException("Aborted", "AbortError"));
+    };
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isAbortError(err) {
+  return err instanceof Error && err.name === "AbortError";
+}
+
+// src/client.ts
+var DEFAULT_ADMIN_USER_ID = "host-admin";
+var DEFAULT_AUDITOR_USER_ID = "host-auditor";
+var DEFAULT_AUDIENCE = "dotwire";
+var DEFAULT_TOKEN_TTL = "15m";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_ROLE_CACHE_TTL_MS = 3e5;
+var TOKEN_REFRESH_MARGIN_SECONDS = 60;
+var CachedToken = class {
+  mint;
+  token;
+  expiresAtSeconds = 0;
+  constructor(mint) {
+    this.mint = mint;
+  }
+  async get() {
+    const now = Date.now() / 1e3;
+    if (this.token && this.expiresAtSeconds - now > TOKEN_REFRESH_MARGIN_SECONDS) {
+      return this.token;
+    }
+    this.token = await this.mint();
+    this.expiresAtSeconds = decodeExpiry(this.token) ?? now + 900;
+    return this.token;
+  }
+};
+function decodeExpiry(jwt) {
+  try {
+    const payloadSegment = jwt.split(".")[1];
+    const json = Buffer.from(payloadSegment, "base64url").toString("utf8");
+    const payload = JSON.parse(json);
+    return typeof payload.exp === "number" ? payload.exp : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var RoleCache = class {
+  entries = /* @__PURE__ */ new Map();
+  ttlMs;
+  constructor(ttlMs) {
+    this.ttlMs = ttlMs;
+  }
+  get(userId) {
+    const entry = this.entries.get(userId);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this.entries.delete(userId);
+      return void 0;
+    }
+    return entry.role;
+  }
+  set(userId, role) {
+    this.entries.set(userId, { role, expiresAt: Date.now() + this.ttlMs });
+  }
+};
+var DotwireHostClient = class {
+  config;
+  signer;
+  baseUrl;
+  fetchImpl;
+  requestTimeoutMs;
+  adminUserId;
+  auditorUserId;
+  defaultTtl;
+  roleCache;
+  adminToken;
+  auditorToken;
+  presend;
+  postSend;
+  constructor(config) {
+    this.config = config;
+    this.signer = new DotwireTokenSigner({
+      ...config,
+      audience: config.audience ?? DEFAULT_AUDIENCE,
+      defaultTokenTtl: config.defaultTokenTtl ?? DEFAULT_TOKEN_TTL
+    });
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.fetchImpl = config.fetch ?? fetch;
+    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    this.adminUserId = config.adminUserId ?? DEFAULT_ADMIN_USER_ID;
+    this.auditorUserId = config.auditorUserId ?? DEFAULT_AUDITOR_USER_ID;
+    this.defaultTtl = config.defaultTokenTtl ?? DEFAULT_TOKEN_TTL;
+    this.roleCache = new RoleCache(config.roleCacheTtlMs ?? DEFAULT_ROLE_CACHE_TTL_MS);
+    this.adminToken = new CachedToken(() => this.signer.mintToken(this.adminUserId, { role: "admin", ttl: this.defaultTtl }));
+    this.auditorToken = new CachedToken(() => this.signer.mintToken(this.auditorUserId, { role: "auditor", ttl: this.defaultTtl }));
+    this.presend = config.presend;
+    this.postSend = config.postSend;
+  }
+  // ---------------------------------------------------------------------
+  // Tokens
+  // ---------------------------------------------------------------------
+  /** Mints a token directly. An explicit `role` bypasses all role resolution. */
+  async mintToken(userId, options = {}) {
+    return this.signer.mintToken(userId, { ttl: this.defaultTtl, ...options });
+  }
+  /**
+   * Returns a `Response` with body `{ token }`. When `role` is omitted, resolves it through the
+   * cached admin lookup and falls back to `member` for an unknown user (404 on the lookup) since
+   * there is no request of its own to fail here.
+   */
+  async tokenResponse(options) {
+    const role = options.role ?? await this.resolveRoleForToken(options.userId);
+    const token = await this.mintToken(options.userId, { role, displayName: options.displayName, ttl: options.ttl });
+    return jsonResponse(200, { token });
+  }
+  async resolveRoleForToken(userId) {
+    const cached = this.roleCache.get(userId);
+    if (cached !== void 0) return cached;
+    const looked = await this.lookupRole(userId);
+    const role = looked ?? "member";
+    this.roleCache.set(userId, role);
+    return role;
+  }
+  // ---------------------------------------------------------------------
+  // Roles
+  // ---------------------------------------------------------------------
+  async setUserRole(userId, role) {
+    const res = await this.adminRequest("PUT", `/admin/users/${encodeURIComponent(userId)}/role`, { body: { role } });
+    await this.throwIfError(res, "PUT", `/admin/users/${userId}/role`);
+    this.roleCache.set(userId, role);
+    return await res.json();
+  }
+  async getUserRole(userId) {
+    const path = `/admin/users/${userId}/role`;
+    const res = await this.adminRequest("GET", `/admin/users/${encodeURIComponent(userId)}/role`);
+    if (res.status === 404) return null;
+    await this.throwIfError(res, "GET", path);
+    return await res.json();
+  }
+  async deleteUserRole(userId) {
+    const path = `/admin/users/${userId}/role`;
+    const res = await this.adminRequest("DELETE", `/admin/users/${encodeURIComponent(userId)}/role`);
+    if (res.status === 404) return;
+    await this.throwIfError(res, "DELETE", path);
+  }
+  async getUserRooms(userId) {
+    const path = `/admin/users/${userId}/rooms`;
+    const res = await this.adminRequest("GET", `/admin/users/${encodeURIComponent(userId)}/rooms`);
+    await this.throwIfError(res, "GET", path);
+    const data = await res.json();
+    return data.roomIds;
+  }
+  async exportUser(userId) {
+    const path = `/admin/users/${userId}/export`;
+    const res = await this.adminRequest("GET", `/admin/users/${encodeURIComponent(userId)}/export`);
+    await this.throwIfError(res, "GET", path);
+    return await res.json();
+  }
+  /** Returns the raw response stream so the caller can pipe an arbitrarily large export without buffering it. */
+  async exportUserStream(userId) {
+    const path = `/admin/users/${userId}/export`;
+    const res = await this.adminRequest("GET", `/admin/users/${encodeURIComponent(userId)}/export`);
+    await this.throwIfError(res, "GET", path);
+    if (!res.body) throw new Error("dotwire export response had no body");
+    return res.body;
+  }
+  async lookupRole(userId) {
+    const res = await this.adminRequest("GET", `/admin/users/${encodeURIComponent(userId)}/role`);
+    if (res.status === 404) return null;
+    await this.throwIfError(res, "GET", `/admin/users/${userId}/role`);
+    const data = await res.json();
+    return data.role;
+  }
+  // ---------------------------------------------------------------------
+  // Rooms
+  // ---------------------------------------------------------------------
+  room(roomId) {
+    return new DotwireHostRoom(this, roomId);
+  }
+  async addRoomMembers(roomId, userIds, options = {}) {
+    const ensureMemberRole = options.ensureMemberRole ?? true;
+    const path = `/admin/rooms/${roomId}/members`;
+    const res = await this.adminRequest("POST", path, { body: { userIds, ensureMemberRole } });
+    await this.throwIfError(res, "POST", path);
+    const data = await res.json();
+    return data.members;
+  }
+  async removeRoomMember(roomId, userId) {
+    const path = `/admin/rooms/${roomId}/members/${userId}`;
+    const res = await this.adminRequest("DELETE", `/admin/rooms/${roomId}/members/${encodeURIComponent(userId)}`);
+    if (res.status === 404) return;
+    await this.throwIfError(res, "DELETE", path);
+  }
+  async getRoomMembers(roomId) {
+    const path = `/admin/rooms/${roomId}/members`;
+    const res = await this.adminRequest("GET", path);
+    await this.throwIfError(res, "GET", path);
+    const data = await res.json();
+    return data.members;
+  }
+  /** Reads participants under the user's own room membership, without admin access. */
+  async getRoomParticipants(roomId, asUserId) {
+    const path = `/rooms/${roomId}/participants`;
+    const res = await this.fetchAsUser("GET", path, asUserId);
+    await this.throwIfError(res, "GET", path);
+    return await res.json();
+  }
+  // ---------------------------------------------------------------------
+  // Sending
+  // ---------------------------------------------------------------------
+  async sendAsUser(roomId, userId, content) {
+    if (this.presend) {
+      const result = await this.presend({ roomId, content, senderUserId: userId });
+      if (!result.allow) {
+        throw new PresendRejectedError(result.rejectionReason ?? "Message rejected by presend hook.");
+      }
+      if (result.content !== void 0) {
+        content = result.content;
+      }
+    }
+    const path = `/rooms/${roomId}/messages`;
+    const res = await this.fetchAsUser("POST", `/rooms/${roomId}/messages`, userId, { body: { content } });
+    await this.throwIfError(res, "POST", path);
+    const ack = await res.json();
+    if (this.postSend) {
+      try {
+        await this.postSend({ roomId, seq: ack.seq, time: ack.time, content, senderUserId: userId });
+      } catch (err) {
+        throw new PostSendError(ack, err);
+      }
+    }
+    return ack;
+  }
+  /** Admin message injection (spec §3.3). Presend/postSend hooks do not run for system injections. */
+  async sendSystemMessage(roomId, content, options = {}) {
+    const senderId = options.senderId ?? "system";
+    const path = `/admin/rooms/${roomId}/messages`;
+    const res = await this.adminRequest("POST", path, { body: { content, senderId } });
+    await this.throwIfError(res, "POST", path);
+    return await res.json();
+  }
+  async getMessages(roomId, options) {
+    const path = `/rooms/${roomId}/messages`;
+    const res = await this.fetchAsUser("GET", path, options.asUserId, {
+      query: { afterSeq: options.afterSeq, beforeSeq: options.beforeSeq, limit: options.limit }
+    });
+    await this.throwIfError(res, "GET", path);
+    return await res.json();
+  }
+  /** Parses SSE from `GET /rooms/{roomId}/events`, reconnecting on drop when `autoResume` (default true). */
+  streamRoomEvents(roomId, options) {
+    return this.streamRoomEventsGenerator(roomId, options);
+  }
+  async *streamRoomEventsGenerator(roomId, options) {
+    const autoResume = options.autoResume ?? true;
+    const signal = options.signal;
+    let lastSeq = options.afterSeq;
+    let backoffMs = 1e3;
+    const maxBackoffMs = 3e4;
+    while (true) {
+      if (signal?.aborted) return;
+      let response;
+      try {
+        response = await this.fetchAsUser("GET", `/rooms/${roomId}/events`, options.asUserId, {
+          query: lastSeq === void 0 ? {} : { afterSeq: lastSeq },
+          extraHeaders: {
+            Accept: "text/event-stream",
+            ...lastSeq !== void 0 ? { "Last-Event-ID": String(lastSeq) } : {}
+          },
+          signal,
+          timeout: false
+        });
+      } catch (err) {
+        if (signal?.aborted || isAbortError(err)) return;
+        if (!autoResume) throw err;
+        await delay(backoffMs, signal).catch(() => void 0);
+        backoffMs = Math.min(backoffMs * 2, maxBackoffMs);
+        continue;
+      }
+      if (!response.ok) {
+        await this.throwIfError(response, "GET", `/rooms/${roomId}/events`);
+      }
+      if (!response.body) return;
+      let revoked = false;
+      try {
+        for await (const raw of parseSseStream(response.body, signal)) {
+          const event = toRoomEvent(raw);
+          if (!event) continue;
+          if (event.type === "message") lastSeq = event.seq;
+          yield event;
+          if (event.type === "revoked") {
+            revoked = true;
+            break;
+          }
+        }
+      } catch (err) {
+        if (signal?.aborted || isAbortError(err)) return;
+        if (!autoResume) throw err;
+        await delay(backoffMs, signal).catch(() => void 0);
+        backoffMs = Math.min(backoffMs * 2, maxBackoffMs);
+        continue;
+      }
+      if (revoked || !autoResume || signal?.aborted) return;
+      backoffMs = 1e3;
+      await delay(backoffMs, signal).catch(() => void 0);
+    }
+  }
+  async redactMessage(roomId, seq) {
+    const path = `/admin/rooms/${roomId}/messages/${seq}`;
+    const res = await this.adminRequest("DELETE", path);
+    await this.throwIfError(res, "DELETE", path);
+    return await res.json();
+  }
+  // ---------------------------------------------------------------------
+  // Audit
+  // ---------------------------------------------------------------------
+  async readAuditLog(afterId = 0, limit = 100) {
+    const path = "/audit";
+    const res = await this.auditorRequest("GET", path, { query: { afterId, limit } });
+    await this.throwIfError(res, "GET", path);
+    return await res.json();
+  }
+  async verifyAuditLog(full = false) {
+    const path = "/audit/verify";
+    const res = await this.auditorRequest("GET", path, { query: { full } });
+    await this.throwIfError(res, "GET", path);
+    return await res.json();
+  }
+  async getAuditCheckpoints(limit = 30) {
+    const path = "/audit/checkpoints";
+    const res = await this.auditorRequest("GET", path, { query: { limit } });
+    await this.throwIfError(res, "GET", path);
+    const data = await res.json();
+    return data.checkpoints;
+  }
+  // ---------------------------------------------------------------------
+  // Retention
+  // ---------------------------------------------------------------------
+  async getMessageRetentionDays() {
+    const path = "/admin/retention";
+    const res = await this.adminRequest("GET", path);
+    await this.throwIfError(res, "GET", path);
+    return (await res.json()).messagesDays;
+  }
+  async setMessageRetentionDays(days) {
+    const path = "/admin/retention";
+    const res = await this.adminRequest("PUT", path, { body: { messagesDays: days } });
+    await this.throwIfError(res, "PUT", path);
+    return (await res.json()).messagesDays;
+  }
+  // ---------------------------------------------------------------------
+  // Request handlers (web-standard Request/Response)
+  // ---------------------------------------------------------------------
+  /** Parses `{ roomId, content }`, calls {@link sendAsUser}, and mirrors the server's own send response shape/status. */
+  async handleClientSend(request, senderUserId) {
+    let parsed;
+    try {
+      parsed = await request.json();
+    } catch {
+      return jsonResponse(400, { error: "invalid_request" });
+    }
+    const result = await this.handleClientSendCore(parsed, senderUserId);
+    return jsonResponse(result.status, result.body);
+  }
+  /** Express-friendly variant: `body` is already-parsed JSON. */
+  async handleClientSendBody(body, senderUserId) {
+    return this.handleClientSendCore(body, senderUserId);
+  }
+  async handleClientSendCore(body, senderUserId) {
+    const b = body ?? {};
+    if (typeof b.roomId !== "string" || typeof b.content !== "string") {
+      return { status: 400, body: { error: "invalid_request" } };
+    }
+    try {
+      const ack = await this.sendAsUser(b.roomId, senderUserId, b.content);
+      return { status: 202, body: ack };
+    } catch (err) {
+      if (err instanceof PresendRejectedError) {
+        return { status: 422, body: { error: "presend_rejected", reason: err.reason } };
+      }
+      if (err instanceof DotwireApiError) {
+        return { status: err.status, body: { error: err.code ?? "unknown", reason: err.reason } };
+      }
+      if (err instanceof PostSendError) {
+        return { status: 202, body: err.sent };
+      }
+      throw err;
+    }
+  }
+  /** Verifies `X-Dotwire-Signature` (when `webhookSecret` is set), runs the local `presend` hook, and mirrors the server's presend webhook response shape. */
+  async handlePresendWebhook(request) {
+    const text = await request.text();
+    const signature = request.headers.get("x-dotwire-signature");
+    const result = await this.handlePresendWebhookCore(text, signature);
+    return jsonResponse(result.status, result.body);
+  }
+  async handlePresendWebhookBody(body, signatureHeader, rawBody) {
+    const text = rawBody ?? JSON.stringify(body);
+    return this.handlePresendWebhookCore(text, signatureHeader ?? null, body);
+  }
+  async handlePresendWebhookCore(rawText, signatureHeader, parsedBody) {
+    if (!this.verifySignature(rawText, signatureHeader)) {
+      return { status: 401, body: { allow: false, reason: "invalid_signature" } };
+    }
+    let payload;
+    try {
+      payload = parsedBody ?? JSON.parse(rawText);
+    } catch {
+      return { status: 400, body: { allow: false, reason: "invalid_request" } };
+    }
+    if (typeof payload.roomId !== "string" || typeof payload.senderId !== "string" || typeof payload.content !== "string") {
+      return { status: 400, body: { allow: false, reason: "invalid_request" } };
+    }
+    if (!this.presend) {
+      return { status: 200, body: { allow: true } };
+    }
+    try {
+      const result = await this.presend({ roomId: payload.roomId, content: payload.content, senderUserId: payload.senderId });
+      if (!result.allow) {
+        return { status: 200, body: { allow: false, reason: result.rejectionReason } };
+      }
+      return { status: 200, body: { allow: true, content: result.content } };
+    } catch (err) {
+      return { status: 200, body: { allow: false, reason: err instanceof Error ? err.message : "presend hook failed" } };
+    }
+  }
+  /** Verifies the signature, runs the local `postSend` hook, and always answers `{}` (postsend is best-effort). */
+  async handlePostSendWebhook(request) {
+    const text = await request.text();
+    const signature = request.headers.get("x-dotwire-signature");
+    const result = await this.handlePostSendWebhookCore(text, signature);
+    return jsonResponse(result.status, result.body);
+  }
+  async handlePostSendWebhookBody(body, signatureHeader, rawBody) {
+    const text = rawBody ?? JSON.stringify(body);
+    return this.handlePostSendWebhookCore(text, signatureHeader ?? null, body);
+  }
+  async handlePostSendWebhookCore(rawText, signatureHeader, parsedBody) {
+    if (!this.verifySignature(rawText, signatureHeader)) {
+      return { status: 401, body: {} };
+    }
+    let payload;
+    try {
+      payload = parsedBody ?? JSON.parse(rawText);
+    } catch {
+      return { status: 400, body: {} };
+    }
+    if (typeof payload.roomId !== "string" || typeof payload.seq !== "number" || typeof payload.senderId !== "string" || typeof payload.content !== "string" || typeof payload.time !== "string") {
+      return { status: 400, body: {} };
+    }
+    if (this.postSend) {
+      try {
+        await this.postSend({ roomId: payload.roomId, seq: payload.seq, time: payload.time, content: payload.content, senderUserId: payload.senderId });
+      } catch {
+      }
+    }
+    return { status: 200, body: {} };
+  }
+  verifySignature(rawBody, signatureHeader) {
+    if (!this.config.webhookSecret) return true;
+    if (!signatureHeader) return false;
+    const prefix = "sha256=";
+    if (!signatureHeader.startsWith(prefix)) return false;
+    const provided = signatureHeader.slice(prefix.length);
+    const expected = (0, import_node_crypto.createHmac)("sha256", this.config.webhookSecret).update(rawBody, "utf8").digest("hex");
+    const providedBuf = Buffer.from(provided, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    if (providedBuf.length !== expectedBuf.length) return false;
+    return (0, import_node_crypto.timingSafeEqual)(providedBuf, expectedBuf);
+  }
+  // ---------------------------------------------------------------------
+  // HTTP plumbing
+  // ---------------------------------------------------------------------
+  async adminRequest(method, path, opts = {}) {
+    const token = await this.adminToken.get();
+    return this.rawFetch(method, path, { ...opts, token });
+  }
+  async auditorRequest(method, path, opts = {}) {
+    const token = await this.auditorToken.get();
+    return this.rawFetch(method, path, { ...opts, token });
+  }
+  /**
+   * Role resolution for user-scoped operations (spec §4.3 / §5): try the cached role (or
+   * `member` when nothing is cached); on 403, look the role up through the admin API, cache it,
+   * and retry once. A second 403 surfaces as a `Forbidden` {@link DotwireApiError}.
+   */
+  async fetchAsUser(method, path, userId, opts = {}) {
+    const cachedRole = this.roleCache.get(userId);
+    const firstRole = cachedRole ?? "member";
+    const attempt = async (role) => {
+      const token = await this.signer.mintToken(userId, { role, ttl: this.defaultTtl });
+      return this.rawFetch(method, path, { ...opts, token });
+    };
+    let res = await attempt(firstRole);
+    if (res.status === 403) {
+      const looked = await this.lookupRole(userId);
+      const resolvedRole = looked ?? "member";
+      this.roleCache.set(userId, resolvedRole);
+      res = await attempt(resolvedRole);
+    }
+    return res;
+  }
+  async rawFetch(method, path, opts) {
+    const url = new URL(this.baseUrl + path);
+    if (opts.query) {
+      for (const [key, value] of Object.entries(opts.query)) {
+        if (value !== void 0) url.searchParams.set(key, String(value));
+      }
+    }
+    const headers = { ...opts.extraHeaders };
+    if (opts.token) headers.Authorization = `Bearer ${opts.token}`;
+    if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+    const useTimeout = opts.timeout ?? true;
+    let signal = opts.signal;
+    if (useTimeout) {
+      const timeoutSignal = AbortSignal.timeout(this.requestTimeoutMs);
+      signal = opts.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
+    }
+    return this.fetchImpl(url.toString(), {
+      method,
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+      signal
+    });
+  }
+  async throwIfError(res, method, path) {
+    if (res.ok) return;
+    let code;
+    let reason;
+    try {
+      const clone = res.clone();
+      const body = await clone.json();
+      code = body?.error;
+      reason = body?.reason;
+    } catch {
+    }
+    const retryAfterHeader = res.headers.get("retry-after");
+    const retryAfterMs = retryAfterHeader ? Number(retryAfterHeader) * 1e3 : void 0;
+    throw new DotwireApiError({
+      status: res.status,
+      kind: mapErrorKind(res.status, code),
+      code,
+      reason,
+      retryAfterMs,
+      method,
+      path
+    });
+  }
+};
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+
+// src/moderation.ts
+var ModerationQueue = class {
+  items = [];
+  waitingReaders = [];
+  waitingWriters = [];
+  completed = false;
+  capacity;
+  constructor(capacity = 1e4) {
+    this.capacity = capacity;
+  }
+  async enqueue(item, signal) {
+    if (this.completed) throw new Error("ModerationQueue is already completed");
+    while (this.items.length >= this.capacity) {
+      await this.waitForWriteSlot(signal);
+    }
+    this.items.push(item);
+    this.wake(this.waitingReaders);
+  }
+  /** Assign directly: `client.postSend = queue.postSendHook`. */
+  postSendHook = (ctx) => this.enqueue({ roomId: ctx.roomId, seq: ctx.seq, time: ctx.time, senderUserId: ctx.senderUserId, content: ctx.content });
+  /** Signals the worker to drain what is queued and stop. */
+  complete() {
+    this.completed = true;
+    this.wake(this.waitingReaders);
+  }
+  /** Blocks for an item; resolves null once completed and drained, or if `signal` fires. */
+  async dequeue(signal) {
+    while (this.items.length === 0) {
+      if (this.completed || signal?.aborted) return null;
+      await new Promise((resolve) => {
+        const onAbort = () => resolve();
+        signal?.addEventListener("abort", onAbort, { once: true });
+        this.waitingReaders.push(() => {
+          signal?.removeEventListener("abort", onAbort);
+          resolve();
+        });
+      });
+    }
+    return this.take();
+  }
+  /** Waits up to `timeoutMs` for an item. Resolves 'timeout' on expiry, null on completion/abort. */
+  async tryDequeue(timeoutMs, signal) {
+    if (this.items.length > 0) return this.take();
+    if (this.completed || signal?.aborted) return null;
+    return new Promise((resolve) => {
+      let settled = false;
+      const finish = (value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        resolve(value);
+      };
+      const timer = setTimeout(() => finish("timeout"), timeoutMs);
+      const onAbort = () => finish(null);
+      const wake = () => {
+        if (settled) return;
+        if (this.items.length > 0) finish(this.take());
+        else if (this.completed) finish(null);
+        else this.waitingReaders.push(wake);
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      this.waitingReaders.push(wake);
+    });
+  }
+  take() {
+    const item = this.items.shift();
+    const writer = this.waitingWriters.shift();
+    if (writer) writer();
+    return item;
+  }
+  waitForWriteSlot(signal) {
+    return new Promise((resolve) => {
+      const onAbort = () => resolve();
+      signal?.addEventListener("abort", onAbort, { once: true });
+      this.waitingWriters.push(() => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      });
+    });
+  }
+  wake(waiters) {
+    const pending = waiters.splice(0);
+    for (const w of pending) w();
+  }
+};
+var BatchModerationWorker = class {
+  queue;
+  classifier;
+  onFlagged;
+  onError;
+  maxBatchSize;
+  maxBatchDelayMs;
+  maxClassifierAttempts;
+  constructor(queue, classifier, onFlagged, options = {}, onError) {
+    this.queue = queue;
+    this.classifier = classifier;
+    this.onFlagged = onFlagged;
+    this.onError = onError;
+    this.maxBatchSize = options.maxBatchSize ?? 100;
+    this.maxBatchDelayMs = options.maxBatchDelayMs ?? 3e4;
+    this.maxClassifierAttempts = options.maxClassifierAttempts ?? 3;
+  }
+  /** The usual action: physically redact the flagged message through the admin API, honouring `Retry-After` on 429. */
+  static redactWith(host) {
+    return async (verdict) => {
+      const maxAttempts = 3;
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+          await host.redactMessage(verdict.roomId, verdict.seq);
+          return;
+        } catch (err) {
+          if (err instanceof DotwireApiError && err.status === 429 && attempt < maxAttempts) {
+            await delay(err.retryAfterMs ?? 1e3 * attempt);
+            continue;
+          }
+          throw err;
+        }
+      }
+    };
+  }
+  /** Runs until `signal` fires or the queue is completed and drained. */
+  async run(signal) {
+    while (true) {
+      const batch = await this.fillBatch(signal);
+      if (batch.length === 0) return;
+      await this.processBatch(batch, signal);
+      if (signal.aborted) return;
+    }
+  }
+  async fillBatch(signal) {
+    const batch = [];
+    const first = await this.queue.dequeue(signal);
+    if (first === null) return batch;
+    batch.push(first);
+    const deadline = Date.now() + this.maxBatchDelayMs;
+    while (batch.length < this.maxBatchSize) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      const item = await this.queue.tryDequeue(remaining, signal);
+      if (item === "timeout" || item === null) break;
+      batch.push(item);
+    }
+    return batch;
+  }
+  async processBatch(batch, signal) {
+    let verdicts;
+    for (let attempt = 1; attempt <= this.maxClassifierAttempts; attempt++) {
+      try {
+        verdicts = await this.classifier.classify(batch, signal);
+        break;
+      } catch (err) {
+        if (signal.aborted) return;
+        this.onError?.(err);
+        if (attempt === this.maxClassifierAttempts) return;
+        await delay(1e3 * Math.pow(2, attempt), signal).catch(() => void 0);
+      }
+    }
+    if (!verdicts) return;
+    for (const verdict of verdicts) {
+      if (!verdict.flagged) continue;
+      try {
+        await this.onFlagged(verdict, signal);
+      } catch (err) {
+        if (signal.aborted) return;
+        this.onError?.(err);
+      }
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BatchModerationWorker,
+  DotwireApiError,
+  DotwireHostClient,
+  DotwireHostRoom,
+  DotwireTokenSigner,
+  ModerationQueue,
+  PostSendError,
+  PresendRejectedError,
+  PresendResult,
+  mapErrorKind
+});
+//# sourceMappingURL=index.cjs.map