@kodelyth/matrix 2026.5.39 → 2026.6.1

package/dist/account-selection-Y50DNJ2l.js

@@ -0,0 +1,158 @@
+import { n as listMatrixEnvAccountIds, t as getMatrixScopedEnvVarNames } from "./env-vars-EQKQv-FE.js";
+import { t as isRecord } from "./record-shared-DGvSFn5M.js";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "klaw/plugin-sdk/account-id";
+import { normalizeOptionalString } from "klaw/plugin-sdk/string-coerce-runtime";
+import { listCombinedAccountIds, listConfiguredAccountIds, resolveListedDefaultAccountId, resolveNormalizedAccountEntry } from "klaw/plugin-sdk/account-core";
+import { hasConfiguredSecretInput } from "klaw/plugin-sdk/secret-input-runtime";
+//#region extensions/matrix/src/auth-precedence.ts
+const MATRIX_DEFAULT_ACCOUNT_AUTH_ONLY_FIELDS = new Set([
+	"userId",
+	"accessToken",
+	"password",
+	"deviceId"
+]);
+function resolveMatrixStringSourceValue(value) {
+	return typeof value === "string" ? value : "";
+}
+function shouldAllowBaseAuthFallback(accountId, field) {
+	return normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID || !MATRIX_DEFAULT_ACCOUNT_AUTH_ONLY_FIELDS.has(field);
+}
+function resolveMatrixAccountStringValues(params) {
+	const fields = [
+		"homeserver",
+		"userId",
+		"accessToken",
+		"password",
+		"deviceId",
+		"deviceName"
+	];
+	const resolved = {};
+	for (const field of fields) resolved[field] = resolveMatrixStringSourceValue(params.account?.[field]) || resolveMatrixStringSourceValue(params.scopedEnv?.[field]) || (shouldAllowBaseAuthFallback(params.accountId, field) ? resolveMatrixStringSourceValue(params.channel?.[field]) || resolveMatrixStringSourceValue(params.globalEnv?.[field]) : "");
+	return resolved;
+}
+//#endregion
+//#region extensions/matrix/src/account-selection.ts
+function readConfiguredMatrixString(value) {
+	return normalizeOptionalString(value) ?? "";
+}
+function readConfiguredMatrixSecretSource(value) {
+	return hasConfiguredSecretInput(value) ? "configured" : "";
+}
+function resolveMatrixChannelStringSources(entry) {
+	if (!entry) return {};
+	return {
+		homeserver: readConfiguredMatrixString(entry.homeserver),
+		userId: readConfiguredMatrixString(entry.userId),
+		accessToken: readConfiguredMatrixSecretSource(entry.accessToken),
+		password: readConfiguredMatrixSecretSource(entry.password),
+		deviceId: readConfiguredMatrixString(entry.deviceId),
+		deviceName: readConfiguredMatrixString(entry.deviceName)
+	};
+}
+function readEnvMatrixString(env, key) {
+	return normalizeOptionalString(env[key]) ?? "";
+}
+function resolveScopedMatrixEnvStringSources(accountId, env) {
+	const keys = getMatrixScopedEnvVarNames(accountId);
+	return {
+		homeserver: readEnvMatrixString(env, keys.homeserver),
+		userId: readEnvMatrixString(env, keys.userId),
+		accessToken: readEnvMatrixString(env, keys.accessToken),
+		password: readEnvMatrixString(env, keys.password),
+		deviceId: readEnvMatrixString(env, keys.deviceId),
+		deviceName: readEnvMatrixString(env, keys.deviceName)
+	};
+}
+function resolveGlobalMatrixEnvStringSources(env) {
+	return {
+		homeserver: readEnvMatrixString(env, "MATRIX_HOMESERVER"),
+		userId: readEnvMatrixString(env, "MATRIX_USER_ID"),
+		accessToken: readEnvMatrixString(env, "MATRIX_ACCESS_TOKEN"),
+		password: readEnvMatrixString(env, "MATRIX_PASSWORD"),
+		deviceId: readEnvMatrixString(env, "MATRIX_DEVICE_ID"),
+		deviceName: readEnvMatrixString(env, "MATRIX_DEVICE_NAME")
+	};
+}
+function hasUsableResolvedMatrixAuth(values) {
+	return Boolean(values.homeserver && (values.accessToken || values.userId));
+}
+function hasFreshResolvedMatrixAuth(values) {
+	return Boolean(values.homeserver && (values.accessToken || values.userId && values.password));
+}
+function resolveEffectiveMatrixAccountSources(params) {
+	const normalizedAccountId = normalizeAccountId(params.accountId);
+	return resolveMatrixAccountStringValues({
+		accountId: normalizedAccountId,
+		scopedEnv: resolveScopedMatrixEnvStringSources(normalizedAccountId, params.env),
+		channel: resolveMatrixChannelStringSources(params.channel),
+		globalEnv: resolveGlobalMatrixEnvStringSources(params.env)
+	});
+}
+function hasUsableEffectiveMatrixAccountSource(params) {
+	return hasUsableResolvedMatrixAuth(resolveEffectiveMatrixAccountSources(params));
+}
+function hasFreshEffectiveMatrixAccountSource(params) {
+	return hasFreshResolvedMatrixAuth(resolveEffectiveMatrixAccountSources(params));
+}
+function hasConfiguredDefaultMatrixAccountSource(params) {
+	return hasFreshEffectiveMatrixAccountSource({
+		channel: params.channel,
+		accountId: DEFAULT_ACCOUNT_ID,
+		env: params.env
+	});
+}
+function resolveMatrixChannelConfig(cfg) {
+	return isRecord(cfg.channels?.matrix) ? cfg.channels.matrix : null;
+}
+function findMatrixAccountEntry(cfg, accountId) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	if (!channel) return null;
+	const accounts = isRecord(channel.accounts) ? channel.accounts : null;
+	if (!accounts) return null;
+	const entry = resolveNormalizedAccountEntry(accounts, accountId, normalizeAccountId);
+	return isRecord(entry) ? entry : null;
+}
+function resolveConfiguredMatrixAccountIds(cfg, env = process.env) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	const configuredAccountIds = listConfiguredAccountIds({
+		accounts: channel && isRecord(channel.accounts) ? channel.accounts : void 0,
+		normalizeAccountId
+	});
+	if (hasConfiguredDefaultMatrixAccountSource({
+		channel,
+		env
+	})) configuredAccountIds.push(DEFAULT_ACCOUNT_ID);
+	return listCombinedAccountIds({
+		configuredAccountIds,
+		additionalAccountIds: listMatrixEnvAccountIds(env).filter((accountId) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID ? hasConfiguredDefaultMatrixAccountSource({
+			channel,
+			env
+		}) : hasUsableEffectiveMatrixAccountSource({
+			channel,
+			accountId,
+			env
+		})),
+		fallbackAccountIdWhenEmpty: channel ? DEFAULT_ACCOUNT_ID : void 0
+	});
+}
+function resolveMatrixDefaultOrOnlyAccountId(cfg, env = process.env) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	if (!channel) return DEFAULT_ACCOUNT_ID;
+	const configuredDefault = normalizeOptionalAccountId(typeof channel.defaultAccount === "string" ? channel.defaultAccount : void 0);
+	return resolveListedDefaultAccountId({
+		accountIds: resolveConfiguredMatrixAccountIds(cfg, env),
+		configuredDefaultAccountId: configuredDefault,
+		ambiguousFallbackAccountId: DEFAULT_ACCOUNT_ID
+	});
+}
+function requiresExplicitMatrixDefaultAccount(cfg, env = process.env) {
+	const channel = resolveMatrixChannelConfig(cfg);
+	if (!channel) return false;
+	const configuredAccountIds = resolveConfiguredMatrixAccountIds(cfg, env);
+	if (configuredAccountIds.length <= 1) return false;
+	if (configuredAccountIds.includes(DEFAULT_ACCOUNT_ID)) return false;
+	const configuredDefault = normalizeOptionalAccountId(typeof channel.defaultAccount === "string" ? channel.defaultAccount : void 0);
+	return !(configuredDefault && configuredAccountIds.includes(configuredDefault));
+}
+//#endregion
+export { resolveMatrixDefaultOrOnlyAccountId as a, resolveMatrixChannelConfig as i, requiresExplicitMatrixDefaultAccount as n, resolveMatrixAccountStringValues as o, resolveConfiguredMatrixAccountIds as r, findMatrixAccountEntry as t };

package/dist/active-client-CmFdvPdO.js

@@ -0,0 +1,20 @@
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "klaw/plugin-sdk/account-id";
+//#region extensions/matrix/src/matrix/active-client.ts
+const activeClients = /* @__PURE__ */ new Map();
+function resolveAccountKey(accountId) {
+	return normalizeAccountId(accountId) || DEFAULT_ACCOUNT_ID;
+}
+function setActiveMatrixClient(client, accountId) {
+	const key = resolveAccountKey(accountId);
+	if (!client) {
+		activeClients.delete(key);
+		return;
+	}
+	activeClients.set(key, client);
+}
+function getActiveMatrixClient(accountId) {
+	const key = resolveAccountKey(accountId);
+	return activeClients.get(key) ?? null;
+}
+//#endregion
+export { setActiveMatrixClient as n, getActiveMatrixClient as t };

package/dist/api.js

@@ -0,0 +1,12 @@
+import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, n as getMatrixThreadBindingManager, p as setMatrixThreadBindingMaxAgeBySessionKey, s as resetMatrixThreadBindingsForTests } from "./thread-bindings-shared-fvfP7jVs.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-Y50DNJ2l.js";
+import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-EQKQv-FE.js";
+import { a as resolveMatrixCredentialsPath, c as resolveMatrixLegacyFlatStoreRoot, i as resolveMatrixCredentialsFilename, l as sanitizeMatrixPathSegment, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as resolveMatrixLegacyFlatStoragePaths, t as hashMatrixAccessToken } from "./storage-paths-BTAketfg.js";
+import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-BEYoXF3J.js";
+import { t as matrixPlugin } from "./channel-C0kCyTNB.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-c28ON6jq.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-FjAZmDUP.js";
+//#region extensions/matrix/api.ts
+const matrixSessionBindingAdapterChannels = ["matrix"];
+//#endregion
+export { createMatrixSetupWizardProxy, createMatrixThreadBindingManager, findMatrixAccountEntry, getMatrixScopedEnvVarNames, getMatrixThreadBindingManager, hashMatrixAccessToken, listMatrixEnvAccountIds, matrixOnboardingAdapter, matrixOnboardingAdapter as matrixSetupWizard, matrixPlugin, matrixSessionBindingAdapterChannels, matrixSetupAdapter, requiresExplicitMatrixDefaultAccount, resetMatrixThreadBindingsForTests, resolveConfiguredMatrixAccountIds, resolveMatrixAccountStorageRoot, resolveMatrixChannelConfig, resolveMatrixCredentialsDir, resolveMatrixCredentialsFilename, resolveMatrixCredentialsPath, resolveMatrixDefaultOrOnlyAccountId, resolveMatrixEnvAccountToken, resolveMatrixHomeserverKey, resolveMatrixLegacyFlatStoragePaths, resolveMatrixLegacyFlatStoreRoot, sanitizeMatrixPathSegment, setMatrixThreadBindingIdleTimeoutBySessionKey, setMatrixThreadBindingMaxAgeBySessionKey };

package/dist/approval-handler.runtime-BIi4fL0R.js

@@ -0,0 +1,377 @@
+import { a as resolveMatrixTargetIdentity } from "./target-ids-Bsazo8si.js";
+import { g as resolveMatrixAccount } from "./setup-core-BEYoXF3J.js";
+import { _ as shouldHandleMatrixApprovalRequest, g as isMatrixAnyApprovalClientEnabled } from "./channel-C0kCyTNB.js";
+import { a as sendMessageMatrix, i as reactMatrixMessage, p as repairMatrixDirectRooms, s as sendSingleTextMessageMatrix } from "./send-CJunc6QM.js";
+import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-nDm2x-K5.js";
+import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-CRA9WGg0.js";
+import { listMessageReceiptPlatformIds, resolveMessageReceiptPrimaryId } from "klaw/plugin-sdk/channel-message";
+import { buildChannelApprovalNativeTargetKey } from "klaw/plugin-sdk/approval-native-runtime";
+import { setTimeout } from "node:timers/promises";
+import { createChannelApprovalNativeRuntimeAdapter } from "klaw/plugin-sdk/approval-handler-runtime";
+import { buildExecApprovalPendingReplyPayload, buildPluginApprovalPendingReplyPayload } from "klaw/plugin-sdk/approval-reply-runtime";
+import { buildPluginApprovalResolvedReplyPayload } from "klaw/plugin-sdk/approval-runtime";
+//#region extensions/matrix/src/approval-handler.runtime.ts
+const MATRIX_APPROVAL_METADATA_KEY = "com.klaw.approval";
+const MATRIX_APPROVAL_DELIVERY_ATTEMPTS = 3;
+const MATRIX_APPROVAL_DELIVERY_RETRY_DELAY_MS = 250;
+function resolveHandlerContext(params) {
+	const context = params.context;
+	const accountId = params.accountId?.trim() || "";
+	if (!context?.client || !accountId) return null;
+	return {
+		accountId,
+		context
+	};
+}
+function normalizePendingMessageIds(entry) {
+	return Array.from(new Set(entry.platformMessageIds.map((messageId) => messageId.trim()).filter(Boolean)));
+}
+function normalizeReactionTargetRef(params) {
+	const roomId = params.roomId.trim();
+	const eventId = params.eventId.trim();
+	if (!roomId || !eventId) return null;
+	return {
+		roomId,
+		eventId
+	};
+}
+function normalizeThreadId(value) {
+	return (value == null ? "" : String(value).trim()) || void 0;
+}
+function isSingleMatrixMessageLimitError(error) {
+	return error instanceof Error && error.message.includes("Matrix single-message text exceeds limit");
+}
+async function retryMatrixApprovalDelivery(operation, params = {}) {
+	let lastError;
+	for (let attempt = 1; attempt <= MATRIX_APPROVAL_DELIVERY_ATTEMPTS; attempt += 1) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		if (attempt === MATRIX_APPROVAL_DELIVERY_ATTEMPTS || params.shouldRetry?.(error) === false) break;
+		await setTimeout(MATRIX_APPROVAL_DELIVERY_RETRY_DELAY_MS * attempt);
+	}
+	throw lastError;
+}
+async function prepareTarget(params) {
+	const resolved = resolveHandlerContext(params);
+	if (!resolved) return null;
+	const target = resolveMatrixTargetIdentity(params.rawTarget.to);
+	if (!target) return null;
+	const threadId = normalizeThreadId(params.rawTarget.threadId);
+	if (target.kind === "user") {
+		const account = resolveMatrixAccount({
+			cfg: params.cfg,
+			accountId: resolved.accountId
+		});
+		const repairDirectRooms = resolved.context.deps?.repairDirectRooms ?? repairMatrixDirectRooms;
+		const repaired = await retryMatrixApprovalDelivery(async () => await repairDirectRooms({
+			client: resolved.context.client,
+			remoteUserId: target.id,
+			encrypted: account.config.encryption === true
+		}));
+		if (!repaired.activeRoomId) return null;
+		return {
+			to: `room:${repaired.activeRoomId}`,
+			roomId: repaired.activeRoomId,
+			threadId
+		};
+	}
+	return {
+		to: `room:${target.id}`,
+		roomId: target.id,
+		threadId
+	};
+}
+function buildMatrixApprovalMetadata(params) {
+	const base = {
+		version: 1,
+		type: "approval.request",
+		id: params.view.approvalId,
+		state: "pending",
+		kind: params.view.approvalKind,
+		phase: params.view.phase,
+		title: params.view.title,
+		expiresAtMs: params.view.expiresAtMs,
+		metadata: params.view.metadata,
+		allowedDecisions: Array.from(params.allowedDecisions),
+		actions: params.view.actions.map((action) => ({
+			decision: action.decision,
+			label: action.label,
+			style: action.style,
+			command: action.command
+		})),
+		...params.view.description != null ? { description: params.view.description } : {}
+	};
+	if (params.view.approvalKind === "plugin") return {
+		...base,
+		kind: "plugin",
+		severity: params.view.severity,
+		...params.view.agentId != null ? { agentId: params.view.agentId } : {},
+		...params.view.pluginId != null ? { pluginId: params.view.pluginId } : {},
+		...params.view.toolName != null ? { toolName: params.view.toolName } : {}
+	};
+	return {
+		...base,
+		kind: "exec",
+		commandText: params.view.commandText,
+		...params.view.ask != null ? { ask: params.view.ask } : {},
+		...params.view.agentId != null ? { agentId: params.view.agentId } : {},
+		...params.view.commandPreview != null ? { commandPreview: params.view.commandPreview } : {},
+		...params.view.cwd != null ? { cwd: params.view.cwd } : {},
+		...params.view.envKeys != null ? { envKeys: params.view.envKeys } : {},
+		...params.view.host != null ? { host: params.view.host } : {},
+		...params.view.nodeId != null ? { nodeId: params.view.nodeId } : {},
+		...params.view.sessionKey != null ? { sessionKey: params.view.sessionKey } : {}
+	};
+}
+function buildPendingApprovalContent(params) {
+	const allowedDecisions = params.view.actions.map((action) => action.decision);
+	const payload = params.view.approvalKind === "plugin" ? buildPluginApprovalPendingReplyPayload({
+		request: {
+			id: params.view.approvalId,
+			request: {
+				title: params.view.title,
+				description: params.view.description ?? "",
+				severity: params.view.severity,
+				toolName: params.view.toolName ?? void 0,
+				pluginId: params.view.pluginId ?? void 0,
+				agentId: params.view.agentId ?? void 0
+			},
+			createdAtMs: 0,
+			expiresAtMs: params.view.expiresAtMs
+		},
+		nowMs: params.nowMs,
+		allowedDecisions
+	}) : buildExecApprovalPendingReplyPayload({
+		approvalId: params.view.approvalId,
+		approvalSlug: params.view.approvalId.slice(0, 8),
+		approvalCommandId: params.view.approvalId,
+		ask: params.view.ask ?? void 0,
+		agentId: params.view.agentId ?? void 0,
+		allowedDecisions,
+		command: params.view.commandText,
+		cwd: params.view.cwd ?? void 0,
+		host: params.view.host === "node" ? "node" : "gateway",
+		nodeId: params.view.nodeId ?? void 0,
+		sessionKey: params.view.sessionKey ?? void 0,
+		expiresAtMs: params.view.expiresAtMs,
+		nowMs: params.nowMs
+	});
+	const hint = buildMatrixApprovalReactionHint(allowedDecisions);
+	const text = payload.text ?? "";
+	return {
+		approvalId: params.view.approvalId,
+		text: hint ? text ? `${hint}\n\n${text}` : hint : text,
+		allowedDecisions,
+		extraContent: { [MATRIX_APPROVAL_METADATA_KEY]: buildMatrixApprovalMetadata({
+			view: params.view,
+			allowedDecisions
+		}) }
+	};
+}
+function buildResolvedApprovalText(view) {
+	if (view.approvalKind === "plugin") return buildPluginApprovalResolvedReplyPayload({ resolved: {
+		id: view.approvalId,
+		decision: view.decision,
+		resolvedBy: view.resolvedBy ?? void 0,
+		ts: 0
+	} }).text ?? "";
+	return [
+		`Exec approval: ${view.decision === "allow-once" ? "Allowed once" : view.decision === "allow-always" ? "Allowed always" : "Denied"}`,
+		"",
+		"Command",
+		buildMarkdownCodeBlock(view.commandText)
+	].join("\n");
+}
+function buildMarkdownCodeBlock(text) {
+	const longestFence = Math.max(...Array.from(text.matchAll(/`+/g), (match) => match[0].length), 0);
+	const fence = "`".repeat(Math.max(3, longestFence + 1));
+	return [
+		fence,
+		text,
+		fence
+	].join("\n");
+}
+const matrixApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
+	eventKinds: ["exec", "plugin"],
+	availability: {
+		isConfigured: ({ cfg, accountId, context }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return false;
+			return isMatrixAnyApprovalClientEnabled({
+				cfg,
+				accountId: resolved.accountId
+			});
+		},
+		shouldHandle: ({ cfg, accountId, request, context }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return false;
+			return shouldHandleMatrixApprovalRequest({
+				cfg,
+				accountId: resolved.accountId,
+				request
+			});
+		}
+	},
+	presentation: {
+		buildPendingPayload: ({ view, nowMs }) => buildPendingApprovalContent({
+			view,
+			nowMs
+		}),
+		buildResolvedResult: ({ view }) => ({
+			kind: "update",
+			payload: buildResolvedApprovalText(view)
+		}),
+		buildExpiredResult: () => ({ kind: "delete" })
+	},
+	transport: {
+		prepareTarget: ({ cfg, accountId, context, plannedTarget }) => {
+			return prepareTarget({
+				cfg,
+				accountId,
+				context,
+				rawTarget: plannedTarget.target
+			}).then((preparedTarget) => preparedTarget ? {
+				dedupeKey: buildChannelApprovalNativeTargetKey({
+					to: preparedTarget.roomId,
+					threadId: preparedTarget.threadId
+				}),
+				target: preparedTarget
+			} : null);
+		},
+		deliverPending: async ({ cfg, accountId, context, preparedTarget, pendingPayload, view }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return null;
+			const sendSingleTextMessage = resolved.context.deps?.sendSingleTextMessage ?? sendSingleTextMessageMatrix;
+			const reactMessage = resolved.context.deps?.reactMessage ?? reactMatrixMessage;
+			let result;
+			try {
+				result = await retryMatrixApprovalDelivery(async () => await sendSingleTextMessage(preparedTarget.to, pendingPayload.text, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					threadId: preparedTarget.threadId,
+					extraContent: pendingPayload.extraContent
+				}), { shouldRetry: (error) => !isSingleMatrixMessageLimitError(error) });
+			} catch (error) {
+				if (!isSingleMatrixMessageLimitError(error)) throw error;
+				const sendMessage = resolved.context.deps?.sendMessage ?? sendMessageMatrix;
+				result = await retryMatrixApprovalDelivery(async () => await sendMessage(preparedTarget.to, pendingPayload.text, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					threadId: preparedTarget.threadId,
+					extraContent: pendingPayload.extraContent
+				}));
+			}
+			const receiptMessageIds = listMessageReceiptPlatformIds(result.receipt);
+			const platformMessageIds = receiptMessageIds.length ? receiptMessageIds : [result.messageId.trim()].filter(Boolean);
+			const reactionEventId = resolveMessageReceiptPrimaryId(result.receipt) || result.primaryMessageId?.trim() || platformMessageIds[0] || result.messageId.trim();
+			registerMatrixApprovalReactionTarget({
+				roomId: result.roomId,
+				eventId: reactionEventId,
+				approvalId: pendingPayload.approvalId,
+				allowedDecisions: pendingPayload.allowedDecisions,
+				ttlMs: view.expiresAtMs - Date.now()
+			});
+			await Promise.allSettled(listMatrixApprovalReactionBindings(pendingPayload.allowedDecisions).map(async ({ emoji }) => {
+				await reactMessage(result.roomId, reactionEventId, emoji, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client
+				});
+			}));
+			return {
+				roomId: result.roomId,
+				platformMessageIds,
+				reactionEventId
+			};
+		},
+		updateEntry: async ({ cfg, accountId, context, entry, payload }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return;
+			const editMessage = resolved.context.deps?.editMessage ?? editMatrixMessage;
+			const deleteMessage = resolved.context.deps?.deleteMessage ?? deleteMatrixMessage;
+			const [primaryMessageId, ...staleMessageIds] = normalizePendingMessageIds(entry);
+			if (!primaryMessageId) return;
+			const text = payload;
+			await Promise.allSettled([editMessage(entry.roomId, primaryMessageId, text, {
+				cfg,
+				accountId: resolved.accountId,
+				client: resolved.context.client
+			}), ...staleMessageIds.map(async (messageId) => {
+				await deleteMessage(entry.roomId, messageId, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					reason: "approval resolved"
+				});
+			})]);
+		},
+		deleteEntry: async ({ cfg, accountId, context, entry, phase }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return;
+			const deleteMessage = resolved.context.deps?.deleteMessage ?? deleteMatrixMessage;
+			await Promise.allSettled(normalizePendingMessageIds(entry).map(async (messageId) => {
+				await deleteMessage(entry.roomId, messageId, {
+					cfg,
+					accountId: resolved.accountId,
+					client: resolved.context.client,
+					reason: phase === "expired" ? "approval expired" : "approval resolved"
+				});
+			}));
+		}
+	},
+	interactions: {
+		bindPending: (params) => {
+			const target = normalizeReactionTargetRef({
+				roomId: params.entry.roomId,
+				eventId: params.entry.reactionEventId
+			});
+			if (!target) return null;
+			registerMatrixApprovalReactionTarget({
+				roomId: target.roomId,
+				eventId: target.eventId,
+				approvalId: params.pendingPayload.approvalId,
+				allowedDecisions: params.pendingPayload.allowedDecisions,
+				ttlMs: params.view.expiresAtMs - Date.now()
+			});
+			return target;
+		},
+		unbindPending: (params) => {
+			const target = normalizeReactionTargetRef(params.binding);
+			if (!target) return;
+			unregisterMatrixApprovalReactionTarget(target);
+		},
+		cancelDelivered: (params) => {
+			const target = normalizeReactionTargetRef({
+				roomId: params.entry.roomId,
+				eventId: params.entry.reactionEventId
+			});
+			if (!target) return;
+			unregisterMatrixApprovalReactionTarget(target);
+		}
+	}
+});
+//#endregion
+export { matrixApprovalNativeRuntime };

package/dist/approval-ids-BGHK7PnZ.js

@@ -0,0 +1,7 @@
+import { a as normalizeMatrixUserId } from "./config-schema-BMGOlhdI.js";
+//#region extensions/matrix/src/approval-ids.ts
+function normalizeMatrixApproverId(value) {
+	return normalizeMatrixUserId(String(value)) || void 0;
+}
+//#endregion
+export { normalizeMatrixApproverId as t };

package/dist/approval-reaction-auth-CL0-nCNV.js

@@ -0,0 +1,27 @@
+import { g as resolveMatrixAccount } from "./setup-core-BEYoXF3J.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-BGHK7PnZ.js";
+import { resolveApprovalApprovers } from "klaw/plugin-sdk/approval-auth-runtime";
+//#region extensions/matrix/src/approval-reaction-auth.ts
+function normalizeMatrixExecApproverId(value) {
+	const normalized = normalizeMatrixApproverId(value);
+	return normalized === "*" ? void 0 : normalized;
+}
+function getMatrixApprovalReactionApprovers(params) {
+	const account = resolveMatrixAccount(params).config;
+	if (params.approvalKind === "plugin") return resolveApprovalApprovers({
+		allowFrom: account.dm?.allowFrom,
+		normalizeApprover: normalizeMatrixApproverId
+	});
+	return resolveApprovalApprovers({
+		explicit: account.execApprovals?.approvers,
+		allowFrom: account.dm?.allowFrom,
+		normalizeApprover: normalizeMatrixExecApproverId
+	});
+}
+function isMatrixApprovalReactionAuthorizedSender(params) {
+	const normalizedSenderId = params.senderId ? normalizeMatrixApproverId(params.senderId) : void 0;
+	if (!normalizedSenderId) return false;
+	return getMatrixApprovalReactionApprovers(params).includes(normalizedSenderId);
+}
+//#endregion
+export { isMatrixApprovalReactionAuthorizedSender };