@stage-labs/metro 0.1.0-beta.156 → 0.1.0-beta.158

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.156",
+  "version": "0.1.0-beta.158",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.156",
+  "version": "0.1.0-beta.158",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/src/lines.ts

@@ -25,8 +25,8 @@ function parseAccountScoped(
 }
 
 const isSnowflake = (s: string): boolean => /^\d+$/.test(s);
-const isThreemaId = (s: string): boolean =>
-  /^(?:[A-Z0-9]{8}|\*[A-Z0-9]{7})$/i.test(s);
+const isThreemaResource = (s: string): boolean =>
+  /^(?:[A-Z0-9]{8}|\*[A-Z0-9]{7})(?:-[0-9a-f]{16})?$/i.test(s);
 const isSignedInt = (s: string): boolean => /^-?\d+$/.test(s);
 
 function splitTelegramAccount(path: string[]): { accountId: string; rest: string[] } {
@@ -83,5 +83,5 @@ export const Line = {
   parseTelegram: (line: Line | string) => parseTelegramLine(line),
 
   parseThreema: (line: Line | string) =>
-    parseAccountScoped(line, 'threema', isThreemaId),
+    parseAccountScoped(line, 'threema', isThreemaResource),
 };

package/runtime/node_modules/@metro-labs/threema/src/accounts.ts

@@ -9,6 +9,8 @@ import { Line } from '@metro-labs/core/lines';
 import { fetchPublicKey } from './api.js';
 import { hexToBytes, keyPairFrom, type KeyPair } from './crypto.js';
 import { isGatewayId, normalizeThreemaId, parsePrivateKey } from './ids.js';
+import { GroupStore, parseGroupKey } from './groups.js';
+import type { GroupRef } from './messages.js';
 
 const ACCOUNTS_FILE =
   process.env.THREEMA_ACCOUNTS_FILE ??
@@ -55,14 +57,17 @@ export interface Account {
   cfg: AccountConfig;
   keys: KeyPair;
   publicKeys: Map<string, Uint8Array>;
+  groups: GroupStore;
 }
 
+export type Target = { kind: 'user'; id: string } | { kind: 'group'; group: GroupRef };
+
 export const accounts = new Map<string, Account>();
 
 export function bootAccount(cfg: AccountConfig): Account {
   const key = parsePrivateKey(cfg.privateKey);
   if (key === null) throw new Error(`account '${cfg.id}' has no usable private key`);
-  return { cfg, keys: keyPairFrom(key), publicKeys: new Map() };
+  return { cfg, keys: keyPairFrom(key), publicKeys: new Map(), groups: new GroupStore(cfg.id, cfg.gatewayId) };
 }
 
 export function accountFor(id: string): Account {
@@ -77,7 +82,7 @@ export function accountFor(id: string): Account {
 export function targetOf(
   line: string,
   account?: string,
-): { acct: Account; to: string } {
+): { acct: Account; target: Target } {
   const parsed = Line.parseThreema(line);
   if (parsed === null) throw new Error(`not a threema line: ${line}`);
   const id = resolveAccountId(
@@ -85,7 +90,9 @@ export function targetOf(
     { account, line },
     (l) => Line.parseThreema(l)?.accountId,
   );
-  return { acct: accountFor(id), to: normalizeThreemaId(parsed.resource) };
+  const group = parseGroupKey(parsed.resource);
+  const target: Target = group === null ? { kind: 'user', id: normalizeThreemaId(parsed.resource) } : { kind: 'group', group };
+  return { acct: accountFor(id), target };
 }
 
 export async function publicKeyFor(

package/runtime/node_modules/@metro-labs/threema/src/actions.ts

@@ -6,47 +6,19 @@ import {
 } from '@metro-labs/core/stations/station-runtime';
 import type { Normalized } from '@metro-labs/core/stations/messaging-normalize';
 import { accountFor, accounts, publicKeyFor, targetOf, type Account } from './accounts.js';
-import { sendE2E } from './api.js';
-import {
-  bytesToHex,
-  decode,
-  encodeText,
-  hexToBytes,
-  macMatches,
-  open,
-  quoted,
-  seal,
-  type Decoded,
-} from './crypto.js';
-import {
-  emitInbound,
-  emitOutbound,
-  receiptEnvelope,
-  textEnvelope,
-  type InboundMeta,
-} from './format.js';
-import { isThreemaId, MESSAGE_ID_RE, normalizeThreemaId } from './ids.js';
+import { hexToBytes, macMatches, open } from './crypto.js';
+import { groupLineOf, type InboundMeta } from './format.js';
+import { groupKey } from './groups.js';
+import { deliver } from './inbound.js';
+import { isThreemaId, normalizeThreemaId } from './ids.js';
+import { decode } from './messages.js';
+import { react, send } from './outbound.js';
 
 export type { CallMsg };
-
-export const MAX_TEXT_BYTES = 3500;
-const SENT_MAX = 2000;
+export { MAX_TEXT_BYTES } from './outbound.js';
 
 type Args = Record<string, unknown>;
 
-const sentIds = new Set<string>();
-
-function noteSent(messageId: string): void {
-  sentIds.add(messageId);
-  while (sentIds.size > SENT_MAX) {
-    const oldest = sentIds.values().next();
-    if (oldest.done) break;
-    sentIds.delete(oldest.value);
-  }
-}
-
-const sentByUs = (messageId: string): boolean => sentIds.has(messageId);
-
 const WEB_CHAT = 'https://web.threema.com/#!/messenger/conversation/contact/';
 
 export const chatUrl = (gatewayId: string): string => `${WEB_CHAT}${encodeURIComponent(gatewayId)}`;
@@ -58,6 +30,7 @@ function listAccounts(id: string): void {
     url: chatUrl(a.cfg.gatewayId),
     owner: a.cfg.owner ?? null,
     gatewayId: a.cfg.gatewayId,
+    groups: a.groups.list().map((g) => ({ line: groupLineOf(a.cfg.id, g), name: g.name, members: g.members.length })),
     ...(a.cfg.callbackId && a.cfg.callbackToken
       ? { callbackId: a.cfg.callbackId, callbackToken: a.cfg.callbackToken }
       : {}),
@@ -65,53 +38,20 @@ function listAccounts(id: string): void {
   respond(id, { result: { accounts: list } });
 }
 
-interface SendArgs {
-  line: string;
-  text?: unknown;
-  replyTo?: unknown;
-  account?: string;
-}
-
-function requireText(a: SendArgs): string {
-  const text = typeof a.text === 'string' ? a.text : '';
-  if (text === '')
-    throw new TrainError(
-      'threema_text_required',
-      'threema carries text only; give some text to send',
-      { retryable: false },
-    );
-  return text;
-}
-
-function replyTargetOf(a: SendArgs): string | undefined {
-  if (a.replyTo === undefined || a.replyTo === null || a.replyTo === '') return undefined;
-  const target = typeof a.replyTo === 'string' ? a.replyTo.toLowerCase() : '';
-  if (!MESSAGE_ID_RE.test(target))
-    throw new TrainError(
-      'threema_bad_reply_target',
-      'replyTo must be a Threema message id, 16 hex characters',
-      { retryable: false },
-    );
-  return target;
-}
-
-async function send(id: string, args: Args): Promise<void> {
-  const a = args as unknown as SendArgs;
-  const text = requireText(a);
-  const replyTo = replyTargetOf(a);
-  const { acct, to } = targetOf(a.line, a.account);
-  const plain = encodeText(replyTo === undefined ? text : quoted(replyTo, text));
-  if (plain.length - 1 > MAX_TEXT_BYTES)
-    throw new TrainError(
-      'threema_message_too_long',
-      `Threema carries at most ${MAX_TEXT_BYTES} bytes of text per message; split it up`,
-      { retryable: false },
-    );
-  const { nonce, box } = seal(plain, await publicKeyFor(acct, to), acct.keys);
-  const messageId = await sendE2E(acct.cfg, to, bytesToHex(nonce), bytesToHex(box));
-  noteSent(messageId);
-  emitOutbound(acct.cfg.id, a.line, messageId, text, replyTo);
-  respond(id, { result: { messageId, account: acct.cfg.id } });
+function listMembers(id: string, args: Args): void {
+  const line = typeof args.line === 'string' ? args.line : '';
+  const { acct, target } = targetOf(line, typeof args.account === 'string' ? args.account : undefined);
+  if (target.kind !== 'group') {
+    respond(id, { result: { members: [], capability: { supported: false, complete: false, reason: 'a Threema 1:1 chat has no roster' } } });
+    return;
+  }
+  const roster = acct.groups.get(target.group);
+  if (roster === undefined) {
+    respond(id, { result: { members: [], capability: { supported: true, complete: false, reason: `no member list yet for ${groupKey(target.group)}` } } });
+    return;
+  }
+  const members = roster.members.map((m) => ({ id: m, name: m, is_admin: m === roster.creator, is_bot: m === acct.cfg.gatewayId }));
+  respond(id, { result: { members, capability: { supported: true, complete: true, total: members.length } } });
 }
 
 interface CallbackArgs {
@@ -148,50 +88,21 @@ function parseCallback(args: Args): CallbackArgs {
   return nickname === '' ? fields : { ...fields, nickname };
 }
 
-function deliver(acct: Account, m: InboundMeta, decoded: Decoded): string {
-  const owner = acct.cfg.owner;
-  if (decoded.kind === 'text') {
-    emitInbound(acct.cfg.id, owner, textEnvelope(acct.cfg.id, m, decoded.text, sentByUs));
-    return 'text';
-  }
-  if (decoded.kind === 'receipt') {
-    let reactions = 0;
-    for (const target of decoded.messageIds) {
-      const env = receiptEnvelope(acct.cfg.id, m, decoded.status, target);
-      if (env === null) continue;
-      emitInbound(acct.cfg.id, owner, env);
-      reactions += 1;
-    }
-    return reactions > 0 ? 'reaction' : `receipt:${decoded.status}`;
-  }
-  if (decoded.kind === 'typing') return 'typing';
-  const type = `0x${decoded.type.toString(16)}`;
-  process.stderr.write(
-    `threema[${acct.cfg.id}]: ignored a message of type ${type} from ${m.from}\n`,
-  );
-  return `ignored:${type}`;
+function checkedSender(acct: Account, cb: CallbackArgs): string {
+  if (!macMatches(acct.cfg.secret, cb, cb.mac))
+    throw new TrainError('threema_bad_mac', 'the callback MAC does not match this account API secret', { retryable: false });
+  const from = normalizeThreemaId(cb.from);
+  if (!isThreemaId(from))
+    throw new TrainError('threema_bad_callback', `'${cb.from}' is not a Threema ID`, { retryable: false });
+  if (normalizeThreemaId(cb.to) !== acct.cfg.gatewayId)
+    throw new TrainError('threema_wrong_recipient', `callback addressed to ${cb.to}, not to ${acct.cfg.gatewayId}`, { retryable: false });
+  return from;
 }
 
 async function callback(id: string, args: Args): Promise<void> {
   const cb = parseCallback(args);
   const acct = accountFor(cb.account);
-  if (!macMatches(acct.cfg.secret, cb, cb.mac))
-    throw new TrainError(
-      'threema_bad_mac',
-      'the callback MAC does not match this account API secret',
-      { retryable: false },
-    );
-  const from = normalizeThreemaId(cb.from);
-  if (!isThreemaId(from))
-    throw new TrainError('threema_bad_callback', `'${cb.from}' is not a Threema ID`, {
-      retryable: false,
-    });
-  if (normalizeThreemaId(cb.to) !== acct.cfg.gatewayId)
-    throw new TrainError(
-      'threema_wrong_recipient',
-      `callback addressed to ${cb.to}, not to ${acct.cfg.gatewayId}`,
-      { retryable: false },
-    );
+  const from = checkedSender(acct, cb);
   const plain = open(
     hexToBytes(cb.box, 'box'),
     hexToBytes(cb.nonce, 'nonce'),
@@ -214,10 +125,11 @@ export function normalizeThreema(action: string, env: Args): Normalized {
       action: 'send',
       args: { line: env.line, text: env.text, replyTo: env.replyTo, account: env.account },
     };
+  if (action === 'unreact') return { action: 'react', args: { ...env, action: 'removed' } };
   return { action, args: env };
 }
 
 export const handleCall = makeStation({
-  handlers: { accounts: listAccounts, send, callback },
+  handlers: { accounts: listAccounts, send, react, callback, listMembers },
   normalize: normalizeThreema,
 });

package/runtime/node_modules/@metro-labs/threema/src/api.ts

@@ -17,8 +17,8 @@ async function call(
 ): Promise<Response> {
   try {
     return await fetch(`${GATEWAY_API}${path}`, {
-      ...init,
       signal: AbortSignal.timeout(TIMEOUT_MS),
+      ...init,
     });
   } catch (err) {
     throw new TrainError(
@@ -102,6 +102,7 @@ export async function sendE2E(
   to: string,
   nonceHex: string,
   boxHex: string,
+  group = false,
 ): Promise<string> {
   const body = new URLSearchParams({
     from: c.gatewayId,
@@ -109,6 +110,7 @@ export async function sendE2E(
     nonce: nonceHex,
     box: boxHex,
     secret: c.secret,
+    ...(group ? { group: '1' } : {}),
   });
   const res = await call(
     '/send_e2e',
@@ -128,3 +130,23 @@ export async function sendE2E(
     );
   return messageId;
 }
+
+const BLOB_ID_RE = /^[0-9a-f]{32}$/;
+const BLOB_TIMEOUT_MS = 120_000;
+
+export async function uploadBlob(c: GatewayCreds, data: Uint8Array): Promise<string> {
+  const form = new FormData();
+  form.append('blob', new Blob([Buffer.from(data)]), 'blob');
+  const res = await call(`/upload_blob?${authQuery(c)}`, { method: 'POST', body: form, signal: AbortSignal.timeout(BLOB_TIMEOUT_MS) }, 'upload_blob');
+  if (!res.ok) throw refusal(res.status, 'blob');
+  const blobId = (await res.text()).trim().toLowerCase();
+  if (!BLOB_ID_RE.test(blobId)) throw new TrainError('threema_gateway_error', 'upload_blob: the Threema Gateway answered without a blob id');
+  return blobId;
+}
+
+export async function downloadBlob(c: GatewayCreds, blobId: string): Promise<Uint8Array> {
+  if (!BLOB_ID_RE.test(blobId)) throw new TrainError('threema_bad_blob', `'${blobId}' is not a blob id`, { retryable: false });
+  const res = await call(`/blobs/${blobId}?${authQuery(c)}`, { signal: AbortSignal.timeout(BLOB_TIMEOUT_MS) }, 'blob download');
+  if (!res.ok) throw refusal(res.status, `blob ${blobId}`);
+  return new Uint8Array(await res.arrayBuffer());
+}

package/runtime/node_modules/@metro-labs/threema/src/crypto.ts

@@ -1,14 +1,6 @@
 import { createHmac, randomInt, timingSafeEqual } from 'node:crypto';
 import nacl from 'tweetnacl';
 
-export const MSG_TEXT = 0x01;
-export const MSG_DELIVERY_RECEIPT = 0x80;
-export const MSG_TYPING = 0x90;
-
-export const RECEIPT_ACK = 0x03;
-export const RECEIPT_DECLINE = 0x04;
-
-const MESSAGE_ID_BYTES = 8;
 const HEX_RE = /^(?:[0-9a-fA-F]{2})*$/;
 
 export interface KeyPair {
@@ -63,38 +55,6 @@ export function open(
   return padded === null ? null : unpad(padded);
 }
 
-export function encodeText(text: string): Uint8Array {
-  const utf8 = Buffer.from(text, 'utf8');
-  const out = new Uint8Array(1 + utf8.length);
-  out[0] = MSG_TEXT;
-  out.set(utf8, 1);
-  return out;
-}
-
-export type Decoded =
-  | { kind: 'text'; text: string }
-  | { kind: 'receipt'; status: number; messageIds: string[] }
-  | { kind: 'typing' }
-  | { kind: 'other'; type: number };
-
-function receiptIds(body: Uint8Array): string[] {
-  const ids: string[] = [];
-  for (let at = 1; at + MESSAGE_ID_BYTES <= body.length; at += MESSAGE_ID_BYTES)
-    ids.push(bytesToHex(body.subarray(at, at + MESSAGE_ID_BYTES)));
-  return ids;
-}
-
-export function decode(plain: Uint8Array): Decoded {
-  const type = plain[0];
-  const body = plain.subarray(1);
-  if (type === MSG_TEXT)
-    return { kind: 'text', text: Buffer.from(body).toString('utf8') };
-  if (type === MSG_DELIVERY_RECEIPT)
-    return { kind: 'receipt', status: body[0] ?? 0, messageIds: receiptIds(body) };
-  if (type === MSG_TYPING) return { kind: 'typing' };
-  return { kind: 'other', type: type ?? -1 };
-}
-
 export interface CallbackFields {
   from: string;
   to: string;
@@ -130,3 +90,11 @@ export function unquote(text: string): { replyTo?: string; text: string } {
   const body = m?.[2];
   return replyTo === undefined || body === undefined ? { text } : { replyTo, text: body };
 }
+
+const FILE_NONCE = new Uint8Array([...new Array<number>(23).fill(0), 1]);
+
+export const newBlobKey = (): Uint8Array => nacl.randomBytes(nacl.secretbox.keyLength);
+
+export const sealBlob = (data: Uint8Array, key: Uint8Array): Uint8Array => nacl.secretbox(data, FILE_NONCE, key);
+
+export const openBlob = (data: Uint8Array, key: Uint8Array): Uint8Array | null => nacl.secretbox.open(data, FILE_NONCE, key);

package/runtime/node_modules/@metro-labs/threema/src/files.ts

@@ -0,0 +1,93 @@
+import { readFile } from 'node:fs/promises';
+import { emit, mintId } from '@metro-labs/core/stations/station-runtime';
+import { assertAttachmentSize, isImageMime, kindOf, saveBufferToCache } from '@metro-labs/core/stations/attachments';
+import { TrainError } from '@metro-labs/core/train-error';
+import type { Account } from './accounts.js';
+import { downloadBlob, uploadBlob } from './api.js';
+import { bytesToHex, hexToBytes, newBlobKey, openBlob, sealBlob } from './crypto.js';
+import { emitInbound, textEnvelope, type InboundMeta, type Room } from './format.js';
+import { encodeFile, encodeGroupFile, type FileData, type GroupRef } from './messages.js';
+
+export const MAX_BLOB_BYTES = 50 * 1024 * 1024;
+const SELF_URI = process.env.METRO_SELF_URI ?? '';
+
+export interface OutgoingFile {
+  path: string;
+  mime: string;
+  name: string;
+}
+
+export async function packFile(acct: Account, file: OutgoingFile, caption: string | null): Promise<FileData> {
+  const data = await readFile(file.path);
+  assertAttachmentSize(data.length);
+  if (data.length > MAX_BLOB_BYTES) throw new TrainError('threema_file_too_big', `Threema carries files up to 50 MB; ${file.name} is bigger`, { retryable: false });
+  const key = newBlobKey();
+  const blobId = await uploadBlob(acct.cfg, sealBlob(new Uint8Array(data), key));
+  return { blobId, key: bytesToHex(key), mime: file.mime, name: file.name, size: data.length, caption, media: isImageMime(file.mime) };
+}
+
+export const encodeFileFor = (group: GroupRef | null, file: FileData): Uint8Array => (group === null ? encodeFile(file) : encodeGroupFile(group, file));
+
+export const fileLabel = (file: OutgoingFile): string => kindOf(file.mime, file.path);
+
+function savedEnvelope(accountId: string, line: string, forId: string, file: FileData, path: string, bytes: number): Record<string, unknown> {
+  return {
+    kind: 'inbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'threema',
+    line,
+    from: SELF_URI,
+    text: `📎 saved: ${path}`,
+    payload: {
+      account: accountId,
+      contentType: 'attachmentSaved',
+      attachmentFor: forId,
+      index: 0,
+      kind: kindOf(file.mime, file.name),
+      attachmentPath: path,
+      localPath: path,
+      mime: file.mime,
+      name: file.name,
+      size: bytes,
+    },
+  };
+}
+
+function failedEnvelope(accountId: string, line: string, forId: string, file: FileData, reason: string): Record<string, unknown> {
+  return {
+    kind: 'inbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'threema',
+    line,
+    from: SELF_URI,
+    text: `📎 not fetched: ${reason}`,
+    payload: { account: accountId, contentType: 'attachmentFailed', attachmentFor: forId, index: 0, kind: kindOf(file.mime, file.name), reason },
+  };
+}
+
+async function fetchFile(acct: Account, m: InboundMeta, file: FileData): Promise<{ path: string; bytes: number }> {
+  const sealed = await downloadBlob(acct.cfg, file.blobId);
+  const plain = openBlob(sealed, hexToBytes(file.key, 'blob key'));
+  if (plain === null) throw new TrainError('threema_bad_blob', 'the file did not decrypt with the key in the message', { retryable: false });
+  const saved = await saveBufferToCache(plain, m.messageId, 0, { mime: file.mime, name: file.name });
+  return { path: saved.path, bytes: saved.bytes };
+}
+
+export function deliverFile(acct: Account, m: InboundMeta, file: FileData, room: Room, sentByUs: (id: string) => boolean): void {
+  const env = textEnvelope(acct.cfg.id, m, file.caption ?? '', sentByUs, room);
+  const line = String(env.line);
+  const forId = String(env.id);
+  const payload = { ...(env.payload as Record<string, unknown>), attachments: [{ kind: kindOf(file.mime, file.name), name: file.name, mime: file.mime, ...(file.size === null ? {} : { size: file.size }) }] };
+  emitInbound(acct.cfg.id, acct.cfg.owner, { ...env, payload });
+  fetchFile(acct, m, file)
+    .then(({ path, bytes }) => {
+      emit(savedEnvelope(acct.cfg.id, line, forId, file, path, bytes));
+    })
+    .catch((err: unknown) => {
+      const reason = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`threema[${acct.cfg.id}]: could not fetch ${file.name} from ${m.from}: ${reason}\n`);
+      emit(failedEnvelope(acct.cfg.id, line, forId, file, reason));
+    });
+}

package/runtime/node_modules/@metro-labs/threema/src/format.ts

@@ -1,5 +1,7 @@
 import { emit, mintId } from '@metro-labs/core/stations/station-runtime';
-import { RECEIPT_ACK, RECEIPT_DECLINE, unquote } from './crypto.js';
+import { unquote } from './crypto.js';
+import { groupKey } from './groups.js';
+import { RECEIPT_ACK, RECEIPT_DECLINE, type GroupRef } from './messages.js';
 
 const SELF_URI = process.env.METRO_SELF_URI ?? '';
 
@@ -11,6 +13,9 @@ const REACTION_OF: Record<number, string> = {
 export const lineOf = (accountId: string, threemaId: string): string =>
   `metro://threema/${accountId}/${threemaId}`;
 
+export const groupLineOf = (accountId: string, group: GroupRef): string =>
+  `metro://threema/${accountId}/${groupKey(group)}`;
+
 const userOf = (accountId: string, threemaId: string): string =>
   `metro://threema/${accountId}/user/${threemaId}`;
 
@@ -22,6 +27,18 @@ export interface InboundMeta {
   nickname?: string;
 }
 
+export interface Room {
+  group: GroupRef | null;
+  name: string | null;
+}
+
+export const DIRECT: Room = { group: null, name: null };
+
+const MENTION_ALL = '@@@@@@@@';
+
+export const mentionsSelf = (text: string, self: string): boolean =>
+  text.includes(MENTION_ALL) || text.toUpperCase().includes(`@@${self.toUpperCase()}`);
+
 function tsOf(date: string): string {
   const seconds = Number(date);
   return Number.isFinite(seconds) && seconds > 0
@@ -33,19 +50,21 @@ function base(
   accountId: string,
   m: InboundMeta,
   type: string,
+  room: Room,
 ): Record<string, unknown> {
+  const group = room.group;
   return {
     kind: 'inbound',
     id: mintId(),
     ts: tsOf(m.date),
     station: 'threema',
-    line: lineOf(accountId, m.from),
-    line_name: m.nickname ?? m.from,
+    line: group === null ? lineOf(accountId, m.from) : groupLineOf(accountId, group),
+    line_name: group === null ? (m.nickname ?? m.from) : (room.name ?? groupKey(group)),
     from: userOf(accountId, m.from),
     from_name: m.nickname,
     from_display_name: m.nickname,
-    is_private: true,
-    payload: { from: m.from, to: m.to, nickname: m.nickname ?? null, type },
+    is_private: group === null,
+    payload: { from: m.from, to: m.to, nickname: m.nickname ?? null, type, ...(group === null ? {} : { group: groupKey(group) }) },
   };
 }
 
@@ -54,12 +73,14 @@ export function textEnvelope(
   m: InboundMeta,
   raw: string,
   sentByUs: (messageId: string) => boolean,
+  room: Room = DIRECT,
 ): Record<string, unknown> {
   const { replyTo, text } = unquote(raw);
   return {
-    ...base(accountId, m, 'text'),
+    ...base(accountId, m, 'text', room),
     message_id: m.messageId,
     text,
+    ...(room.group !== null && mentionsSelf(text, m.to) ? { mentions_self: true } : {}),
     ...(replyTo === undefined
       ? {}
       : {
@@ -70,22 +91,35 @@ export function textEnvelope(
   };
 }
 
-export function receiptEnvelope(
+export function reactionEnvelope(
   accountId: string,
   m: InboundMeta,
-  status: number,
+  emoji: string,
   targetId: string,
-): Record<string, unknown> | null {
-  const emoji = REACTION_OF[status];
-  if (emoji === undefined) return null;
+  removed: boolean,
+  room: Room = DIRECT,
+  type = 'reaction',
+): Record<string, unknown> {
   return {
-    ...base(accountId, m, 'receipt'),
+    ...base(accountId, m, type, room),
     message_id: `${m.messageId}:${targetId}`,
+    text: `[react ${emoji}${removed ? ' (removed)' : ''}]`,
     emoji,
-    event: { type: 'react', emoji, targetId },
+    event: { type: 'react', emoji, targetId, ...(removed ? { removed: true } : {}) },
   };
 }
 
+export function receiptEnvelope(
+  accountId: string,
+  m: InboundMeta,
+  status: number,
+  targetId: string,
+  room: Room = DIRECT,
+): Record<string, unknown> | null {
+  const emoji = REACTION_OF[status];
+  return emoji === undefined ? null : reactionEnvelope(accountId, m, emoji, targetId, false, room, 'receipt');
+}
+
 export function emitInbound(
   accountId: string,
   owner: string | undefined,
@@ -121,3 +155,28 @@ export function emitOutbound(
     payload: { account: accountId },
   });
 }
+
+export function emitOutboundReaction(
+  accountId: string,
+  line: string,
+  messageId: string,
+  emoji: string,
+  targetId: string,
+  removed: boolean,
+): void {
+  emit({
+    kind: 'outbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'threema',
+    line,
+    from: SELF_URI,
+    to: line,
+    message_id: messageId,
+    text: `[react ${emoji}${removed ? ' (removed)' : ''}]`,
+    emoji,
+    event: { type: 'react', emoji, targetId, ...(removed ? { removed: true } : {}) },
+    account: accountId,
+    payload: { account: accountId },
+  });
+}

package/runtime/node_modules/@metro-labs/threema/src/groups.ts

@@ -0,0 +1,95 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import type { GroupRef } from './messages.js';
+
+export const GROUP_RE = /^([A-Z0-9]{8}|\*[A-Z0-9]{7})-([0-9a-f]{16})$/i;
+
+export interface GroupRoster {
+  creator: string;
+  groupId: string;
+  members: string[];
+  name: string | null;
+}
+
+export const groupKey = (group: GroupRef): string => `${group.creator.toUpperCase()}-${group.groupId.toLowerCase()}`;
+
+export function parseGroupKey(resource: string): GroupRef | null {
+  const m = GROUP_RE.exec(resource);
+  return m === null ? null : { creator: (m[1] ?? '').toUpperCase(), groupId: (m[2] ?? '').toLowerCase() };
+}
+
+const groupsFile = (accountId: string): string =>
+  join(process.env.THREEMA_GROUPS_DIR ?? join(homedir(), '.metro'), `threema-groups-${accountId}.json`);
+
+function readRosters(accountId: string): Map<string, GroupRoster> {
+  try {
+    const raw: unknown = JSON.parse(readFileSync(groupsFile(accountId), 'utf8'));
+    const out = new Map<string, GroupRoster>();
+    if (Array.isArray(raw))
+      for (const entry of raw) {
+        const g = (entry ?? {}) as Partial<GroupRoster>;
+        if (typeof g.creator === 'string' && typeof g.groupId === 'string' && Array.isArray(g.members))
+          out.set(groupKey(g as GroupRef), { creator: g.creator, groupId: g.groupId, members: g.members.filter((m): m is string => typeof m === 'string'), name: typeof g.name === 'string' ? g.name : null });
+      }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+export class GroupStore {
+  private readonly rosters: Map<string, GroupRoster>;
+
+  constructor(
+    private readonly accountId: string,
+    private readonly self: string,
+  ) {
+    this.rosters = readRosters(accountId);
+  }
+
+  get(group: GroupRef): GroupRoster | undefined {
+    return this.rosters.get(groupKey(group));
+  }
+
+  list(): GroupRoster[] {
+    return [...this.rosters.values()];
+  }
+
+  setup(creator: string, groupId: string, members: string[]): GroupRoster {
+    const key = groupKey({ creator, groupId });
+    const held = this.rosters.get(key);
+    const roster: GroupRoster = { creator, groupId, members: [...new Set([creator, ...members])], name: held?.name ?? null };
+    this.rosters.set(key, roster);
+    this.save();
+    return roster;
+  }
+
+  rename(creator: string, groupId: string, name: string): void {
+    const held = this.rosters.get(groupKey({ creator, groupId }));
+    if (held === undefined) return;
+    held.name = name;
+    this.save();
+  }
+
+  leave(group: GroupRef, member: string): void {
+    const held = this.rosters.get(groupKey(group));
+    if (held === undefined) return;
+    if (member === this.self) this.rosters.delete(groupKey(group));
+    else held.members = held.members.filter((m) => m !== member);
+    this.save();
+  }
+
+  recipients(group: GroupRef): string[] | null {
+    const held = this.get(group);
+    return held === undefined ? null : held.members.filter((m) => m !== this.self);
+  }
+
+  private save(): void {
+    const path = groupsFile(this.accountId);
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${String(process.pid)}.tmp`;
+    writeFileSync(tmp, JSON.stringify(this.list()), { mode: 0o600 });
+    renameSync(tmp, path);
+  }
+}

package/runtime/node_modules/@metro-labs/threema/src/inbound.ts

@@ -0,0 +1,90 @@
+import type { Account } from './accounts.js';
+import {
+  DIRECT,
+  emitInbound,
+  reactionEnvelope,
+  receiptEnvelope,
+  textEnvelope,
+  type InboundMeta,
+  type Room,
+} from './format.js';
+import { deliverFile } from './files.js';
+import type { Decoded, GroupRef } from './messages.js';
+import { requestSync, sentByUs } from './outbound.js';
+
+const synced = new Set<string>();
+
+function roomOf(acct: Account, group: GroupRef | null): Room {
+  if (group === null) return DIRECT;
+  return { group, name: acct.groups.get(group)?.name ?? null };
+}
+
+function askForRoster(acct: Account, group: GroupRef): void {
+  const key = `${acct.cfg.id}:${group.creator}-${group.groupId}`;
+  if (acct.groups.get(group) !== undefined || synced.has(key)) return;
+  synced.add(key);
+  requestSync(acct, group).catch((err: unknown) => {
+    process.stderr.write(`threema[${acct.cfg.id}]: could not ask ${group.creator} for the group roster: ${err instanceof Error ? err.message : String(err)}\n`);
+  });
+}
+
+function reactions(acct: Account, m: InboundMeta, d: Extract<Decoded, { kind: 'receipt' }>): string {
+  let count = 0;
+  for (const target of d.messageIds) {
+    const env = receiptEnvelope(acct.cfg.id, m, d.status, target, roomOf(acct, d.group));
+    if (env === null) continue;
+    emitInbound(acct.cfg.id, acct.cfg.owner, env);
+    count += 1;
+  }
+  return count > 0 ? 'reaction' : `receipt:${String(d.status)}`;
+}
+
+function control(acct: Account, m: InboundMeta, d: Decoded): string | null {
+  if (d.kind === 'group-setup') {
+    acct.groups.setup(m.from, d.groupId, d.members);
+    return 'group-setup';
+  }
+  if (d.kind === 'group-rename') {
+    acct.groups.rename(m.from, d.groupId, d.name);
+    return 'group-rename';
+  }
+  if (d.kind === 'group-leave') {
+    acct.groups.leave(d.group, m.from);
+    return 'group-leave';
+  }
+  return null;
+}
+
+function chat(acct: Account, m: InboundMeta, d: Decoded): string | null {
+  const owner = acct.cfg.owner;
+  if (d.kind === 'text') {
+    emitInbound(acct.cfg.id, owner, textEnvelope(acct.cfg.id, m, d.text, sentByUs));
+    return 'text';
+  }
+  if (d.kind === 'group-text') {
+    askForRoster(acct, d.group);
+    emitInbound(acct.cfg.id, owner, textEnvelope(acct.cfg.id, m, d.text, sentByUs, roomOf(acct, d.group)));
+    return 'group-text';
+  }
+  if (d.kind === 'file') {
+    if (d.group !== null) askForRoster(acct, d.group);
+    deliverFile(acct, m, d.file, roomOf(acct, d.group), sentByUs);
+    return 'file';
+  }
+  if (d.kind === 'reaction') {
+    if (d.group !== null) askForRoster(acct, d.group);
+    emitInbound(acct.cfg.id, owner, reactionEnvelope(acct.cfg.id, m, d.emoji, d.messageId, d.removed, roomOf(acct, d.group)));
+    return 'reaction';
+  }
+  return null;
+}
+
+export function deliver(acct: Account, m: InboundMeta, d: Decoded): string {
+  const handled = control(acct, m, d) ?? chat(acct, m, d);
+  if (handled !== null) return handled;
+  if (d.kind === 'receipt') return reactions(acct, m, d);
+  if (d.kind === 'typing') return 'typing';
+  const type = d.kind === 'other' ? `0x${d.type.toString(16)}` : d.kind;
+  process.stderr.write(`threema[${acct.cfg.id}]: ignored a message of type ${type} from ${m.from}\n`);
+  return `ignored:${type}`;
+}

package/runtime/node_modules/@metro-labs/threema/src/messages.ts

@@ -0,0 +1,264 @@
+import { bytesToHex, hexToBytes } from './crypto.js';
+
+export const MSG_TEXT = 0x01;
+export const MSG_FILE = 0x17;
+export const MSG_GROUP_TEXT = 0x41;
+export const MSG_GROUP_FILE = 0x46;
+export const MSG_GROUP_SETUP = 0x4a;
+export const MSG_GROUP_RENAME = 0x4b;
+export const MSG_GROUP_LEAVE = 0x4c;
+export const MSG_GROUP_REQUEST_SYNC = 0x51;
+export const MSG_DELIVERY_RECEIPT = 0x80;
+export const MSG_GROUP_DELIVERY_RECEIPT = 0x81;
+export const MSG_REACTION = 0x82;
+export const MSG_GROUP_REACTION = 0x83;
+export const MSG_TYPING = 0x90;
+
+export const RECEIPT_ACK = 0x03;
+export const RECEIPT_DECLINE = 0x04;
+
+export const ID_BYTES = 8;
+const MESSAGE_ID_BYTES = 8;
+const PROTO_MESSAGE_ID = 0x09;
+const PROTO_APPLY = 0x12;
+const PROTO_WITHDRAW = 0x1a;
+
+export interface GroupRef {
+  creator: string;
+  groupId: string;
+}
+
+export interface FileData {
+  blobId: string;
+  key: string;
+  mime: string;
+  name: string;
+  size: number | null;
+  caption: string | null;
+  media: boolean;
+}
+
+export type Decoded =
+  | { kind: 'text'; text: string }
+  | { kind: 'file'; group: GroupRef | null; file: FileData }
+  | { kind: 'group-text'; group: GroupRef; text: string }
+  | { kind: 'group-setup'; groupId: string; members: string[] }
+  | { kind: 'group-rename'; groupId: string; name: string }
+  | { kind: 'group-leave'; group: GroupRef }
+  | { kind: 'receipt'; group: GroupRef | null; status: number; messageIds: string[] }
+  | { kind: 'reaction'; group: GroupRef | null; messageId: string; emoji: string; removed: boolean }
+  | { kind: 'typing' }
+  | { kind: 'other'; type: number };
+
+const ascii = (bytes: Uint8Array): string => Buffer.from(bytes).toString('ascii');
+const utf8 = (bytes: Uint8Array): string => Buffer.from(bytes).toString('utf8');
+
+const groupHeader = (group: GroupRef): Uint8Array =>
+  new Uint8Array([...Buffer.from(group.creator, 'ascii'), ...hexToBytes(group.groupId, 'group id')]);
+
+const readGroup = (body: Uint8Array): GroupRef | null =>
+  body.length < ID_BYTES * 2 ? null : { creator: ascii(body.subarray(0, ID_BYTES)), groupId: bytesToHex(body.subarray(ID_BYTES, ID_BYTES * 2)) };
+
+function ids(body: Uint8Array, from: number): string[] {
+  const out: string[] = [];
+  for (let at = from; at + MESSAGE_ID_BYTES <= body.length; at += MESSAGE_ID_BYTES) out.push(bytesToHex(body.subarray(at, at + MESSAGE_ID_BYTES)));
+  return out;
+}
+
+const members = (body: Uint8Array, from: number): string[] => {
+  const out: string[] = [];
+  for (let at = from; at + ID_BYTES <= body.length; at += ID_BYTES) out.push(ascii(body.subarray(at, at + ID_BYTES)));
+  return out;
+};
+
+function concat(...parts: Uint8Array[]): Uint8Array {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+
+const typed = (type: number, ...parts: Uint8Array[]): Uint8Array => concat(new Uint8Array([type]), ...parts);
+
+export const encodeText = (text: string): Uint8Array => typed(MSG_TEXT, Buffer.from(text, 'utf8'));
+
+export const encodeGroupText = (group: GroupRef, text: string): Uint8Array => typed(MSG_GROUP_TEXT, groupHeader(group), Buffer.from(text, 'utf8'));
+
+const fileJson = (f: FileData): Uint8Array =>
+  Buffer.from(
+    JSON.stringify({
+      b: f.blobId,
+      k: f.key,
+      m: f.mime,
+      n: f.name,
+      ...(f.size === null ? {} : { s: f.size }),
+      i: f.media ? 1 : 0,
+      j: f.media ? 1 : 0,
+      ...(f.caption === null ? {} : { d: f.caption }),
+    }),
+    'utf8',
+  );
+
+export const encodeFile = (f: FileData): Uint8Array => typed(MSG_FILE, fileJson(f));
+
+export const encodeGroupFile = (group: GroupRef, f: FileData): Uint8Array => typed(MSG_GROUP_FILE, groupHeader(group), fileJson(f));
+
+const HEX_RE = /^[0-9a-f]+$/i;
+
+const str = (v: unknown, fallback: string): string => (typeof v === 'string' && v !== '' ? v : fallback);
+const num = (v: unknown): number | null => (typeof v === 'number' ? v : null);
+const hexOf = (v: unknown, length: number): string | null => {
+  const text = typeof v === 'string' ? v.toLowerCase() : '';
+  return text.length === length && HEX_RE.test(text) ? text : null;
+};
+
+function parseJson(raw: Uint8Array): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(utf8(raw));
+    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function decodeFileJson(raw: Uint8Array): FileData | null {
+  const o = parseJson(raw);
+  if (o === null) return null;
+  const blobId = hexOf(o.b, 32);
+  const key = hexOf(o.k, 64);
+  if (blobId === null || key === null) return null;
+  const rendering = num(o.j) ?? num(o.i) ?? 0;
+  return {
+    blobId,
+    key,
+    mime: str(o.m, 'application/octet-stream'),
+    name: str(o.n, 'file'),
+    size: num(o.s),
+    caption: typeof o.d === 'string' && o.d !== '' ? o.d : null,
+    media: rendering === 1,
+  };
+}
+
+export const encodeGroupSyncRequest = (groupId: string): Uint8Array => typed(MSG_GROUP_REQUEST_SYNC, hexToBytes(groupId, 'group id'));
+
+function varint(n: number): Uint8Array {
+  const out: number[] = [];
+  let rest = n;
+  while (rest >= 0x80) {
+    out.push((rest & 0x7f) | 0x80);
+    rest = Math.floor(rest / 0x80);
+  }
+  out.push(rest);
+  return new Uint8Array(out);
+}
+
+export function encodeReactionProto(messageId: string, emoji: string, removed: boolean): Uint8Array {
+  const emojiBytes = Buffer.from(emoji, 'utf8');
+  return concat(
+    new Uint8Array([PROTO_MESSAGE_ID]),
+    hexToBytes(messageId, 'message id'),
+    new Uint8Array([removed ? PROTO_WITHDRAW : PROTO_APPLY]),
+    varint(emojiBytes.length),
+    emojiBytes,
+  );
+}
+
+export const encodeReaction = (messageId: string, emoji: string, removed: boolean): Uint8Array =>
+  typed(MSG_REACTION, encodeReactionProto(messageId, emoji, removed));
+
+export const encodeGroupReaction = (group: GroupRef, messageId: string, emoji: string, removed: boolean): Uint8Array =>
+  typed(MSG_GROUP_REACTION, groupHeader(group), encodeReactionProto(messageId, emoji, removed));
+
+function readVarint(body: Uint8Array, at: number): { value: number; next: number } | null {
+  let value = 0;
+  let shift = 1;
+  for (let i = at; i < body.length; i++) {
+    const byte = body[i] ?? 0;
+    value += (byte & 0x7f) * shift;
+    if (byte < 0x80) return { value, next: i + 1 };
+    shift *= 0x80;
+  }
+  return null;
+}
+
+interface ProtoField {
+  tag: number;
+  bytes: Uint8Array;
+  next: number;
+}
+
+function readField(body: Uint8Array, at: number): ProtoField | null {
+  const tag = body[at] ?? 0;
+  if (tag === PROTO_MESSAGE_ID)
+    return at + 1 + MESSAGE_ID_BYTES > body.length ? null : { tag, bytes: body.subarray(at + 1, at + 1 + MESSAGE_ID_BYTES), next: at + 1 + MESSAGE_ID_BYTES };
+  if (tag !== PROTO_APPLY && tag !== PROTO_WITHDRAW) return null;
+  const len = readVarint(body, at + 1);
+  if (len === null || len.next + len.value > body.length) return null;
+  return { tag, bytes: body.subarray(len.next, len.next + len.value), next: len.next + len.value };
+}
+
+export function decodeReactionProto(body: Uint8Array): { messageId: string; emoji: string; removed: boolean } | null {
+  let messageId: string | null = null;
+  let emoji = '';
+  let removed = false;
+  for (let at = 0; at < body.length; ) {
+    const field = readField(body, at);
+    if (field === null) return null;
+    if (field.tag === PROTO_MESSAGE_ID) messageId = bytesToHex(field.bytes);
+    else {
+      emoji = utf8(field.bytes);
+      removed = field.tag === PROTO_WITHDRAW;
+    }
+    at = field.next;
+  }
+  return messageId === null || emoji === '' ? null : { messageId, emoji, removed };
+}
+
+function decodeGroup(type: number, body: Uint8Array): Decoded {
+  const group = readGroup(body);
+  if (group === null) return { kind: 'other', type };
+  const rest = body.subarray(ID_BYTES * 2);
+  if (type === MSG_GROUP_TEXT) return { kind: 'group-text', group, text: utf8(rest) };
+  if (type === MSG_GROUP_FILE) {
+    const file = decodeFileJson(rest);
+    return file === null ? { kind: 'other', type } : { kind: 'file', group, file };
+  }
+  if (type === MSG_GROUP_LEAVE) return { kind: 'group-leave', group };
+  if (type === MSG_GROUP_DELIVERY_RECEIPT) return { kind: 'receipt', group, status: rest[0] ?? 0, messageIds: ids(rest, 1) };
+  const reaction = decodeReactionProto(rest);
+  return reaction === null ? { kind: 'other', type } : { kind: 'reaction', group, ...reaction };
+}
+
+const GROUP_TYPES = new Set([MSG_GROUP_TEXT, MSG_GROUP_FILE, MSG_GROUP_LEAVE, MSG_GROUP_DELIVERY_RECEIPT, MSG_GROUP_REACTION]);
+const DIRECT_TYPES = new Set([MSG_TEXT, MSG_FILE, MSG_TYPING, MSG_DELIVERY_RECEIPT, MSG_REACTION]);
+
+function decodeControl(type: number, body: Uint8Array): Decoded {
+  if (body.length < ID_BYTES) return { kind: 'other', type };
+  const groupId = bytesToHex(body.subarray(0, ID_BYTES));
+  if (type === MSG_GROUP_SETUP) return { kind: 'group-setup', groupId, members: members(body, ID_BYTES) };
+  return { kind: 'group-rename', groupId, name: utf8(body.subarray(ID_BYTES)) };
+}
+
+function decodeDirect(type: number, body: Uint8Array): Decoded {
+  if (type === MSG_TEXT) return { kind: 'text', text: utf8(body) };
+  if (type === MSG_FILE) {
+    const file = decodeFileJson(body);
+    return file === null ? { kind: 'other', type } : { kind: 'file', group: null, file };
+  }
+  if (type === MSG_TYPING) return { kind: 'typing' };
+  if (type === MSG_DELIVERY_RECEIPT) return { kind: 'receipt', group: null, status: body[0] ?? 0, messageIds: ids(body, 1) };
+  const reaction = decodeReactionProto(body);
+  return reaction === null ? { kind: 'other', type } : { kind: 'reaction', group: null, ...reaction };
+}
+
+export function decode(plain: Uint8Array): Decoded {
+  const type = plain[0] ?? -1;
+  const body = plain.subarray(1);
+  if (DIRECT_TYPES.has(type)) return decodeDirect(type, body);
+  if (type === MSG_GROUP_SETUP || type === MSG_GROUP_RENAME) return decodeControl(type, body);
+  if (GROUP_TYPES.has(type)) return decodeGroup(type, body);
+  return { kind: 'other', type };
+}

package/runtime/node_modules/@metro-labs/threema/src/outbound.ts

@@ -0,0 +1,160 @@
+import { TrainError } from '@metro-labs/core/train-error';
+import { respond } from '@metro-labs/core/stations/station-runtime';
+import { publicKeyFor, targetOf, type Account, type Target } from './accounts.js';
+import { sendE2E } from './api.js';
+import { bytesToHex, quoted, seal } from './crypto.js';
+import { encodeFileFor, fileLabel, packFile, type OutgoingFile } from './files.js';
+import { emitOutbound, emitOutboundReaction } from './format.js';
+import { MESSAGE_ID_RE } from './ids.js';
+import {
+  encodeGroupReaction,
+  encodeGroupSyncRequest,
+  encodeGroupText,
+  encodeReaction,
+  encodeText,
+  type GroupRef,
+} from './messages.js';
+
+export const MAX_TEXT_BYTES = 3500;
+const SENT_MAX = 2000;
+
+type Args = Record<string, unknown>;
+
+const sentIds = new Set<string>();
+
+export function noteSent(messageId: string): void {
+  sentIds.add(messageId);
+  while (sentIds.size > SENT_MAX) {
+    const oldest = sentIds.values().next();
+    if (oldest.done) break;
+    sentIds.delete(oldest.value);
+  }
+}
+
+export const sentByUs = (messageId: string): boolean => sentIds.has(messageId);
+
+async function deliver(acct: Account, to: string, plain: Uint8Array, group: boolean): Promise<string> {
+  const { nonce, box } = seal(plain, await publicKeyFor(acct, to), acct.keys);
+  const messageId = await sendE2E(acct.cfg, to, bytesToHex(nonce), bytesToHex(box), group);
+  noteSent(messageId);
+  return messageId;
+}
+
+function recipientsOf(acct: Account, group: GroupRef): string[] {
+  const members = acct.groups.recipients(group);
+  if (members === null)
+    throw new TrainError(
+      'threema_unknown_group',
+      'metro has not received this group\'s member list yet; it asked the group creator for it, try again in a moment',
+      { retryable: true },
+    );
+  return members;
+}
+
+export async function requestSync(acct: Account, group: GroupRef): Promise<void> {
+  await deliver(acct, group.creator, encodeGroupSyncRequest(group.groupId), true);
+}
+
+async function fanOut(acct: Account, target: Target, direct: Uint8Array, grouped: (g: GroupRef) => Uint8Array): Promise<string[]> {
+  if (target.kind === 'user') return [await deliver(acct, target.id, direct, false)];
+  const ids: string[] = [];
+  for (const member of recipientsOf(acct, target.group)) ids.push(await deliver(acct, member, grouped(target.group), true));
+  if (ids.length === 0) throw new TrainError('threema_empty_group', 'nobody else is in this group', { retryable: false });
+  return ids;
+}
+
+interface SendArgs {
+  line: string;
+  text?: unknown;
+  replyTo?: unknown;
+  account?: string;
+  attachments?: unknown;
+}
+
+const filesOf = (raw: unknown): OutgoingFile[] =>
+  (Array.isArray(raw) ? raw : [])
+    .map((a) => (a ?? {}) as Record<string, unknown>)
+    .filter((a) => typeof a.path === 'string' && a.path !== '')
+    .map((a) => ({ path: String(a.path), mime: typeof a.mime === 'string' && a.mime !== '' ? a.mime : 'application/octet-stream', name: typeof a.name === 'string' && a.name !== '' ? a.name : 'file' }));
+
+function textOf(a: SendArgs, files: OutgoingFile[]): string {
+  const text = typeof a.text === 'string' ? a.text : '';
+  if (text === '' && files.length === 0)
+    throw new TrainError('threema_text_required', 'give some text or a file to send', { retryable: false });
+  return text;
+}
+
+async function sendFiles(acct: Account, target: Target, files: OutgoingFile[], caption: string | null): Promise<{ ids: string[]; labels: string[] }> {
+  const ids: string[] = [];
+  const labels: string[] = [];
+  for (const [i, file] of files.entries()) {
+    const packed = await packFile(acct, file, i === 0 ? caption : null);
+    const sent = await fanOut(acct, target, encodeFileFor(null, packed), (g) => encodeFileFor(g, packed));
+    ids.push(...sent);
+    labels.push(fileLabel(file));
+  }
+  return { ids, labels };
+}
+
+function messageIdOf(raw: unknown, field: string): string {
+  const id = typeof raw === 'string' ? raw.toLowerCase() : '';
+  if (!MESSAGE_ID_RE.test(id))
+    throw new TrainError('threema_bad_message_id', `${field} must be a Threema message id, 16 hex characters`, { retryable: false });
+  return id;
+}
+
+const replyTargetOf = (raw: unknown): string | undefined => (raw === undefined || raw === null || raw === '' ? undefined : messageIdOf(raw, 'replyTo'));
+
+function bodyOf(text: string, replyTo: string | undefined): string {
+  const body = replyTo === undefined ? text : quoted(replyTo, text);
+  if (Buffer.byteLength(body, 'utf8') > MAX_TEXT_BYTES)
+    throw new TrainError('threema_message_too_long', `Threema carries at most ${MAX_TEXT_BYTES} bytes of text per message; split it up`, { retryable: false });
+  return body;
+}
+
+interface Sent {
+  ids: string[];
+  labels: string[];
+}
+
+const resultOf = (acct: Account, sent: Sent): Record<string, unknown> => ({
+  messageId: sent.ids[0] ?? '',
+  account: acct.cfg.id,
+  ...(sent.ids.length > 1 ? { messageIds: sent.ids } : {}),
+  ...(sent.labels.length > 0 ? { attachments: sent.labels } : {}),
+});
+
+export async function send(id: string, args: Args): Promise<void> {
+  const a = args as unknown as SendArgs;
+  const files = filesOf(a.attachments);
+  const text = textOf(a, files);
+  const replyTo = replyTargetOf(a.replyTo);
+  const { acct, target } = targetOf(a.line, a.account);
+  const body = bodyOf(text, replyTo);
+  const sent: Sent =
+    files.length === 0
+      ? { ids: await fanOut(acct, target, encodeText(body), (g) => encodeGroupText(g, body)), labels: [] }
+      : await sendFiles(acct, target, files, body === '' ? null : body);
+  emitOutbound(acct.cfg.id, a.line, sent.ids[0] ?? '', text === '' ? `[${sent.labels.join(', ')}]` : text, replyTo);
+  respond(id, { result: resultOf(acct, sent) });
+}
+
+interface ReactArgs {
+  line: string;
+  messageId?: unknown;
+  emoji?: unknown;
+  account?: string;
+  action?: unknown;
+}
+
+export async function react(id: string, args: Args): Promise<void> {
+  const a = args as unknown as ReactArgs;
+  const emoji = typeof a.emoji === 'string' ? a.emoji.trim() : '';
+  if (emoji === '') throw new TrainError('threema_emoji_required', 'react needs an emoji', { retryable: false });
+  const messageId = messageIdOf(a.messageId, 'messageId');
+  const removed = a.action === 'removed';
+  const { acct, target } = targetOf(a.line, a.account);
+  const ids = await fanOut(acct, target, encodeReaction(messageId, emoji, removed), (g) => encodeGroupReaction(g, messageId, emoji, removed));
+  emitOutboundReaction(acct.cfg.id, a.line, ids[0] ?? '', emoji, messageId, removed);
+  respond(id, { result: { messageId: ids[0] ?? '', account: acct.cfg.id, emoji, removed } });
+}

package/runtime/node_modules/@metro-labs/threema/src/station.ts

@@ -4,7 +4,7 @@ export const threemaStation: Station = {
   name: 'threema',
   hasAccounts: true,
   hasTrain: true,
-  messageVerbs: new Set<Verb>(['send', 'reply']),
-  attachmentMode: 'none',
+  messageVerbs: new Set<Verb>(['send', 'reply', 'react', 'unreact']),
+  attachmentMode: 'canonical',
   tools: [],
 };

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.156"
+  "version": "0.1.0-beta.158"
 }