@velanir/openclaw-participation-gate 0.1.0

package/dist/index.js

@@ -0,0 +1,2718 @@
+// src/api.ts
+import {
+  definePluginEntry
+} from "openclaw/plugin-sdk/plugin-entry";
+
+// ../../oct8-secrets/dist/index.js
+import { createHash, randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
+import fs from "fs/promises";
+import path from "path";
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var Oct8SecretsError = class extends Error {
+  constructor(message2, code = "OCT8_SECRETS_ERROR") {
+    super(message2);
+    this.code = code;
+    this.name = "Oct8SecretsError";
+  }
+};
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var KEY_ID_RE = /^[A-Za-z0-9._:-]{8,160}$/;
+function requiredString(env, key) {
+  const value = env[key]?.trim();
+  if (!value) {
+    throw new Oct8SecretsError(`${key} is required.`, "MISSING_ENV");
+  }
+  return value;
+}
+function normalizeBaseUrl(value, key) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Oct8SecretsError(`${key} must be a valid absolute URL.`, "INVALID_ENV");
+  }
+  if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+    throw new Oct8SecretsError(`${key} must use https outside local development.`, "INVALID_ENV");
+  }
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/+$/, "");
+}
+function readRuntimeSecretsEnv(env = process.env) {
+  const mode = env.OCT8_SECRETS_MODE?.trim();
+  if (mode && mode !== "runtime") {
+    throw new Oct8SecretsError("oct8-secrets-runtime-v2 only supports OCT8_SECRETS_MODE=runtime.", "UNSUPPORTED_MODE");
+  }
+  const apiUrl = normalizeBaseUrl(requiredString(env, "OCT8_API_URL"), "OCT8_API_URL");
+  const tokenIssuer = normalizeBaseUrl(env.OCT8_RUNTIME_TOKEN_ISSUER?.trim() || apiUrl, "OCT8_RUNTIME_TOKEN_ISSUER");
+  const runtimeIdentityId = requiredString(env, "OCT8_RUNTIME_IDENTITY_ID");
+  if (!UUID_RE.test(runtimeIdentityId)) {
+    throw new Oct8SecretsError("OCT8_RUNTIME_IDENTITY_ID must be a runtime identity UUID.", "INVALID_ENV");
+  }
+  const keyId = env.OCT8_RUNTIME_KEY_ID?.trim();
+  if (keyId && !KEY_ID_RE.test(keyId)) {
+    throw new Oct8SecretsError("OCT8_RUNTIME_KEY_ID must be 8-160 characters using letters, numbers, dots, underscores, colons, or hyphens.", "INVALID_ENV");
+  }
+  return {
+    apiUrl,
+    tokenIssuer,
+    runtimeIdentityId,
+    stateDir: requiredString(env, "OCT8_RUNTIME_STATE_DIR"),
+    ...env.OCT8_RUNTIME_ENROLLMENT_TOKEN?.trim() ? { enrollmentToken: env.OCT8_RUNTIME_ENROLLMENT_TOKEN.trim() } : {},
+    ...keyId ? { keyId } : {}
+  };
+}
+var base64url_exports = {};
+__export(base64url_exports, {
+  decode: () => decode,
+  encode: () => encode2
+});
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0);
+  const buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers) {
+    buf.set(buffer, i);
+    i += buffer.length;
+  }
+  return buf;
+}
+function encode(string) {
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127) {
+      throw new TypeError("non-ASCII string encountered in encode()");
+    }
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function encodeBase64(input) {
+  if (Uint8Array.prototype.toBase64) {
+    return input.toBase64();
+  }
+  const CHUNK_SIZE = 32768;
+  const arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE) {
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  }
+  return btoa(arr.join(""));
+}
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(encoded);
+  }
+  const binary = atob(encoded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function decode(input) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
+      alphabet: "base64url"
+    });
+  }
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
+  }
+  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return decodeBase64(encoded);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
+  }
+}
+function encode2(input) {
+  let unencoded = input;
+  if (typeof unencoded === "string") {
+    unencoded = encoder.encode(unencoded);
+  }
+  if (Uint8Array.prototype.toBase64) {
+    return unencoded.toBase64({ alphabet: "base64url", omitPadding: true });
+  }
+  return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+var isAlgorithm = (algorithm, name) => algorithm.name === name;
+function getHashLength(hash) {
+  return parseInt(hash.name.slice(4), 10);
+}
+function checkHashLength(algorithm, expected) {
+  const actual = getHashLength(algorithm.hash);
+  if (actual !== expected)
+    throw unusable(`SHA-${expected}`, "algorithm.hash");
+}
+function getNamedCurve(alg) {
+  switch (alg) {
+    case "ES256":
+      return "P-256";
+    case "ES384":
+      return "P-384";
+    case "ES512":
+      return "P-521";
+    default:
+      throw new Error("unreachable");
+  }
+}
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage)) {
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+  }
+}
+function checkSigCryptoKey(key, alg, usage) {
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512": {
+      if (!isAlgorithm(key.algorithm, "HMAC"))
+        throw unusable("HMAC");
+      checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+      break;
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5"))
+        throw unusable("RSASSA-PKCS1-v1_5");
+      checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+      break;
+    }
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      if (!isAlgorithm(key.algorithm, "RSA-PSS"))
+        throw unusable("RSA-PSS");
+      checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+      break;
+    }
+    case "Ed25519":
+    case "EdDSA": {
+      if (!isAlgorithm(key.algorithm, "Ed25519"))
+        throw unusable("Ed25519");
+      break;
+    }
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87": {
+      if (!isAlgorithm(key.algorithm, alg))
+        throw unusable(alg);
+      break;
+    }
+    case "ES256":
+    case "ES384":
+    case "ES512": {
+      if (!isAlgorithm(key.algorithm, "ECDSA"))
+        throw unusable("ECDSA");
+      const expected = getNamedCurve(alg);
+      const actual = key.algorithm.namedCurve;
+      if (actual !== expected)
+        throw unusable(expected, "algorithm.namedCurve");
+      break;
+    }
+    default:
+      throw new TypeError("CryptoKey does not support this operation");
+  }
+  checkUsage(key, usage);
+}
+function message(msg, actual, ...types) {
+  types = types.filter(Boolean);
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else if (types.length === 2) {
+    msg += `one of type ${types[0]} or ${types[1]}.`;
+  } else {
+    msg += `of type ${types[0]}.`;
+  }
+  if (actual == null) {
+    msg += ` Received ${actual}`;
+  } else if (typeof actual === "function" && actual.name) {
+    msg += ` Received function ${actual.name}`;
+  } else if (typeof actual === "object" && actual != null) {
+    if (actual.constructor?.name) {
+      msg += ` Received an instance of ${actual.constructor.name}`;
+    }
+  }
+  return msg;
+}
+var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message2, options) {
+    super(message2, options);
+    this.name = this.constructor.name;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JOSENotSupported = class extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWSInvalid = class extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+};
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function assertNotSet(value, name) {
+  if (value) {
+    throw new TypeError(`${name} can only be called once`);
+  }
+}
+var isObjectLike = (value) => typeof value === "object" && value !== null;
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
+  }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
+}
+function isDisjoint(...headers) {
+  const sources = headers.filter(Boolean);
+  if (sources.length === 0 || sources.length === 1) {
+    return true;
+  }
+  let acc;
+  for (const header of sources) {
+    const parameters = Object.keys(header);
+    if (!acc || acc.size === 0) {
+      acc = new Set(parameters);
+      continue;
+    }
+    for (const parameter of parameters) {
+      if (acc.has(parameter)) {
+        return false;
+      }
+      acc.add(parameter);
+    }
+  }
+  return true;
+}
+var isJWK = (key) => isObject(key) && typeof key.kty === "string";
+var isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
+var isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
+var isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
+function checkKeyLength(alg, key) {
+  if (alg.startsWith("RS") || alg.startsWith("PS")) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+      throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+    }
+  }
+}
+function subtleAlgorithm(alg, algorithm) {
+  const hash = `SHA-${alg.slice(-3)}`;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      return { hash, name: "HMAC" };
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      return { hash, name: "RSA-PSS", saltLength: parseInt(alg.slice(-3), 10) >> 3 };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { hash, name: "RSASSA-PKCS1-v1_5" };
+    case "ES256":
+    case "ES384":
+    case "ES512":
+      return { hash, name: "ECDSA", namedCurve: algorithm.namedCurve };
+    case "Ed25519":
+    case "EdDSA":
+      return { name: "Ed25519" };
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return { name: alg };
+    default:
+      throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  }
+}
+async function getSigKey(alg, key, usage) {
+  if (key instanceof Uint8Array) {
+    if (!alg.startsWith("HS")) {
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
+    return crypto.subtle.importKey("raw", key, { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" }, false, [usage]);
+  }
+  checkSigCryptoKey(key, alg, usage);
+  return key;
+}
+async function sign(alg, key, data) {
+  const cryptoKey = await getSigKey(alg, key, "sign");
+  checkKeyLength(alg, cryptoKey);
+  const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
+  return new Uint8Array(signature);
+}
+var unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
+function subtleMapping(jwk) {
+  let algorithm;
+  let keyUsages;
+  switch (jwk.kty) {
+    case "AKP": {
+      switch (jwk.alg) {
+        case "ML-DSA-44":
+        case "ML-DSA-65":
+        case "ML-DSA-87":
+          algorithm = { name: jwk.alg };
+          keyUsages = jwk.priv ? ["sign"] : ["verify"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "RSA": {
+      switch (jwk.alg) {
+        case "PS256":
+        case "PS384":
+        case "PS512":
+          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RS256":
+        case "RS384":
+        case "RS512":
+          algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RSA-OAEP":
+        case "RSA-OAEP-256":
+        case "RSA-OAEP-384":
+        case "RSA-OAEP-512":
+          algorithm = {
+            name: "RSA-OAEP",
+            hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+          };
+          keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "EC": {
+      switch (jwk.alg) {
+        case "ES256":
+        case "ES384":
+        case "ES512":
+          algorithm = {
+            name: "ECDSA",
+            namedCurve: { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[jwk.alg]
+          };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: "ECDH", namedCurve: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "OKP": {
+      switch (jwk.alg) {
+        case "Ed25519":
+        case "EdDSA":
+          algorithm = { name: "Ed25519" };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    default:
+      throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+  }
+  return { algorithm, keyUsages };
+}
+async function jwkToKey(jwk) {
+  if (!jwk.alg) {
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  }
+  const { algorithm, keyUsages } = subtleMapping(jwk);
+  const keyData = { ...jwk };
+  if (keyData.kty !== "AKP") {
+    delete keyData.alg;
+  }
+  delete keyData.use;
+  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+}
+var unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
+var cache;
+var handleJWK = async (key, jwk, alg, freeze = false) => {
+  cache ||= /* @__PURE__ */ new WeakMap();
+  let cached = cache.get(key);
+  if (cached?.[alg]) {
+    return cached[alg];
+  }
+  const cryptoKey = await jwkToKey({ ...jwk, alg });
+  if (freeze)
+    Object.freeze(key);
+  if (!cached) {
+    cache.set(key, { [alg]: cryptoKey });
+  } else {
+    cached[alg] = cryptoKey;
+  }
+  return cryptoKey;
+};
+var handleKeyObject = (keyObject, alg) => {
+  cache ||= /* @__PURE__ */ new WeakMap();
+  let cached = cache.get(keyObject);
+  if (cached?.[alg]) {
+    return cached[alg];
+  }
+  const isPublic = keyObject.type === "public";
+  const extractable = isPublic ? true : false;
+  let cryptoKey;
+  if (keyObject.asymmetricKeyType === "x25519") {
+    switch (alg) {
+      case "ECDH-ES":
+      case "ECDH-ES+A128KW":
+      case "ECDH-ES+A192KW":
+      case "ECDH-ES+A256KW":
+        break;
+      default:
+        throw new TypeError(unusableForAlg);
+    }
+    cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
+  }
+  if (keyObject.asymmetricKeyType === "ed25519") {
+    if (alg !== "EdDSA" && alg !== "Ed25519") {
+      throw new TypeError(unusableForAlg);
+    }
+    cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+      isPublic ? "verify" : "sign"
+    ]);
+  }
+  switch (keyObject.asymmetricKeyType) {
+    case "ml-dsa-44":
+    case "ml-dsa-65":
+    case "ml-dsa-87": {
+      if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
+        throw new TypeError(unusableForAlg);
+      }
+      cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+        isPublic ? "verify" : "sign"
+      ]);
+    }
+  }
+  if (keyObject.asymmetricKeyType === "rsa") {
+    let hash;
+    switch (alg) {
+      case "RSA-OAEP":
+        hash = "SHA-1";
+        break;
+      case "RS256":
+      case "PS256":
+      case "RSA-OAEP-256":
+        hash = "SHA-256";
+        break;
+      case "RS384":
+      case "PS384":
+      case "RSA-OAEP-384":
+        hash = "SHA-384";
+        break;
+      case "RS512":
+      case "PS512":
+      case "RSA-OAEP-512":
+        hash = "SHA-512";
+        break;
+      default:
+        throw new TypeError(unusableForAlg);
+    }
+    if (alg.startsWith("RSA-OAEP")) {
+      return keyObject.toCryptoKey({
+        name: "RSA-OAEP",
+        hash
+      }, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
+    }
+    cryptoKey = keyObject.toCryptoKey({
+      name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+      hash
+    }, extractable, [isPublic ? "verify" : "sign"]);
+  }
+  if (keyObject.asymmetricKeyType === "ec") {
+    const nist = /* @__PURE__ */ new Map([
+      ["prime256v1", "P-256"],
+      ["secp384r1", "P-384"],
+      ["secp521r1", "P-521"]
+    ]);
+    const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);
+    if (!namedCurve) {
+      throw new TypeError(unusableForAlg);
+    }
+    const expectedCurve = { ES256: "P-256", ES384: "P-384", ES512: "P-521" };
+    if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {
+      cryptoKey = keyObject.toCryptoKey({
+        name: "ECDSA",
+        namedCurve
+      }, extractable, [isPublic ? "verify" : "sign"]);
+    }
+    if (alg.startsWith("ECDH-ES")) {
+      cryptoKey = keyObject.toCryptoKey({
+        name: "ECDH",
+        namedCurve
+      }, extractable, isPublic ? [] : ["deriveBits"]);
+    }
+  }
+  if (!cryptoKey) {
+    throw new TypeError(unusableForAlg);
+  }
+  if (!cached) {
+    cache.set(keyObject, { [alg]: cryptoKey });
+  } else {
+    cached[alg] = cryptoKey;
+  }
+  return cryptoKey;
+};
+async function normalizeKey(key, alg) {
+  if (key instanceof Uint8Array) {
+    return key;
+  }
+  if (isCryptoKey(key)) {
+    return key;
+  }
+  if (isKeyObject(key)) {
+    if (key.type === "secret") {
+      return key.export();
+    }
+    if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") {
+      try {
+        return handleKeyObject(key, alg);
+      } catch (err) {
+        if (err instanceof TypeError) {
+          throw err;
+        }
+      }
+    }
+    let jwk = key.export({ format: "jwk" });
+    return handleJWK(key, jwk, alg);
+  }
+  if (isJWK(key)) {
+    if (key.k) {
+      return decode(key.k);
+    }
+    return handleJWK(key, key, alg, true);
+  }
+  throw new Error("unreachable");
+}
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk)) {
+    throw new TypeError("JWK must be an object");
+  }
+  let ext;
+  alg ??= jwk.alg;
+  ext ??= options?.extractable ?? jwk.ext;
+  switch (jwk.kty) {
+    case "oct":
+      if (typeof jwk.k !== "string" || !jwk.k) {
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      }
+      return decode(jwk.k);
+    case "RSA":
+      if ("oth" in jwk && jwk.oth !== void 0) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      }
+      return jwkToKey({ ...jwk, alg, ext });
+    case "AKP": {
+      if (typeof jwk.alg !== "string" || !jwk.alg) {
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      }
+      if (alg !== void 0 && alg !== jwk.alg) {
+        throw new TypeError("JWK alg and alg option value mismatch");
+      }
+      return jwkToKey({ ...jwk, ext });
+    }
+    case "EC":
+    case "OKP":
+      return jwkToKey({ ...jwk, alg, ext });
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+async function keyToJWK(key) {
+  if (isKeyObject(key)) {
+    if (key.type === "secret") {
+      key = key.export();
+    } else {
+      return key.export({ format: "jwk" });
+    }
+  }
+  if (key instanceof Uint8Array) {
+    return {
+      kty: "oct",
+      k: encode2(key)
+    };
+  }
+  if (!isCryptoKey(key)) {
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+  }
+  if (!key.extractable) {
+    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+  }
+  const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey("jwk", key);
+  if (jwk.kty === "AKP") {
+    ;
+    jwk.alg = alg;
+  }
+  return jwk;
+}
+async function exportJWK(key) {
+  return keyToJWK(key);
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  }
+  if (!protectedHeader || protectedHeader.crit === void 0) {
+    return /* @__PURE__ */ new Set();
+  }
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  }
+  let recognized;
+  if (recognizedOption !== void 0) {
+    recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
+  } else {
+    recognized = recognizedDefault;
+  }
+  for (const parameter of protectedHeader.crit) {
+    if (!recognized.has(parameter)) {
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    }
+    if (joseHeader[parameter] === void 0) {
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    }
+    if (recognized.get(parameter) && protectedHeader[parameter] === void 0) {
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+    }
+  }
+  return new Set(protectedHeader.crit);
+}
+var tag = (key) => key?.[Symbol.toStringTag];
+var jwkMatchesOp = (alg, key, usage) => {
+  if (key.use !== void 0) {
+    let expected;
+    switch (usage) {
+      case "sign":
+      case "verify":
+        expected = "sig";
+        break;
+      case "encrypt":
+      case "decrypt":
+        expected = "enc";
+        break;
+    }
+    if (key.use !== expected) {
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+    }
+  }
+  if (key.alg !== void 0 && key.alg !== alg) {
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  }
+  if (Array.isArray(key.key_ops)) {
+    let expectedKeyOp;
+    switch (true) {
+      case (usage === "sign" || usage === "verify"):
+      case alg === "dir":
+      case alg.includes("CBC-HS"):
+        expectedKeyOp = usage;
+        break;
+      case alg.startsWith("PBES2"):
+        expectedKeyOp = "deriveBits";
+        break;
+      case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
+        if (!alg.includes("GCM") && alg.endsWith("KW")) {
+          expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
+        } else {
+          expectedKeyOp = usage;
+        }
+        break;
+      case (usage === "encrypt" && alg.startsWith("RSA")):
+        expectedKeyOp = "wrapKey";
+        break;
+      case usage === "decrypt":
+        expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
+        break;
+    }
+    if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+    }
+  }
+  return true;
+};
+var symmetricTypeCheck = (alg, key, usage) => {
+  if (key instanceof Uint8Array)
+    return;
+  if (isJWK(key)) {
+    if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+      return;
+    throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+  }
+  if (!isKeyLike(key)) {
+    throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
+  }
+  if (key.type !== "secret") {
+    throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+  }
+};
+var asymmetricTypeCheck = (alg, key, usage) => {
+  if (isJWK(key)) {
+    switch (usage) {
+      case "decrypt":
+      case "sign":
+        if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+          return;
+        throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
+      case "encrypt":
+      case "verify":
+        if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+          return;
+        throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
+    }
+  }
+  if (!isKeyLike(key)) {
+    throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  }
+  if (key.type === "secret") {
+    throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+  }
+  if (key.type === "public") {
+    switch (usage) {
+      case "sign":
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+      case "decrypt":
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+    }
+  }
+  if (key.type === "private") {
+    switch (usage) {
+      case "verify":
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+      case "encrypt":
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+    }
+  }
+};
+function checkKeyType(alg, key, usage) {
+  switch (alg.substring(0, 2)) {
+    case "A1":
+    case "A2":
+    case "di":
+    case "HS":
+    case "PB":
+      symmetricTypeCheck(alg, key, usage);
+      break;
+    default:
+      asymmetricTypeCheck(alg, key, usage);
+  }
+}
+var epoch = (date) => Math.floor(date.getTime() / 1e3);
+var minute = 60;
+var hour = minute * 60;
+var day = hour * 24;
+var week = day * 7;
+var year = day * 365.25;
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+function secs(str) {
+  const matched = REGEX.exec(str);
+  if (!matched || matched[4] && matched[1]) {
+    throw new TypeError("Invalid time period format");
+  }
+  const value = parseFloat(matched[2]);
+  const unit = matched[3].toLowerCase();
+  let numericDate;
+  switch (unit) {
+    case "sec":
+    case "secs":
+    case "second":
+    case "seconds":
+    case "s":
+      numericDate = Math.round(value);
+      break;
+    case "minute":
+    case "minutes":
+    case "min":
+    case "mins":
+    case "m":
+      numericDate = Math.round(value * minute);
+      break;
+    case "hour":
+    case "hours":
+    case "hr":
+    case "hrs":
+    case "h":
+      numericDate = Math.round(value * hour);
+      break;
+    case "day":
+    case "days":
+    case "d":
+      numericDate = Math.round(value * day);
+      break;
+    case "week":
+    case "weeks":
+    case "w":
+      numericDate = Math.round(value * week);
+      break;
+    default:
+      numericDate = Math.round(value * year);
+      break;
+  }
+  if (matched[1] === "-" || matched[4] === "ago") {
+    return -numericDate;
+  }
+  return numericDate;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input)) {
+    throw new TypeError(`Invalid ${label} input`);
+  }
+  return input;
+}
+var JWTClaimsBuilder = class {
+  #payload;
+  constructor(payload) {
+    if (!isObject(payload)) {
+      throw new TypeError("JWT Claims Set MUST be an object");
+    }
+    this.#payload = structuredClone(payload);
+  }
+  data() {
+    return encoder.encode(JSON.stringify(this.#payload));
+  }
+  get iss() {
+    return this.#payload.iss;
+  }
+  set iss(value) {
+    this.#payload.iss = value;
+  }
+  get sub() {
+    return this.#payload.sub;
+  }
+  set sub(value) {
+    this.#payload.sub = value;
+  }
+  get aud() {
+    return this.#payload.aud;
+  }
+  set aud(value) {
+    this.#payload.aud = value;
+  }
+  set jti(value) {
+    this.#payload.jti = value;
+  }
+  set nbf(value) {
+    if (typeof value === "number") {
+      this.#payload.nbf = validateInput("setNotBefore", value);
+    } else if (value instanceof Date) {
+      this.#payload.nbf = validateInput("setNotBefore", epoch(value));
+    } else {
+      this.#payload.nbf = epoch(/* @__PURE__ */ new Date()) + secs(value);
+    }
+  }
+  set exp(value) {
+    if (typeof value === "number") {
+      this.#payload.exp = validateInput("setExpirationTime", value);
+    } else if (value instanceof Date) {
+      this.#payload.exp = validateInput("setExpirationTime", epoch(value));
+    } else {
+      this.#payload.exp = epoch(/* @__PURE__ */ new Date()) + secs(value);
+    }
+  }
+  set iat(value) {
+    if (value === void 0) {
+      this.#payload.iat = epoch(/* @__PURE__ */ new Date());
+    } else if (value instanceof Date) {
+      this.#payload.iat = validateInput("setIssuedAt", epoch(value));
+    } else if (typeof value === "string") {
+      this.#payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
+    } else {
+      this.#payload.iat = validateInput("setIssuedAt", value);
+    }
+  }
+};
+var FlattenedSign = class {
+  #payload;
+  #protectedHeader;
+  #unprotectedHeader;
+  constructor(payload) {
+    if (!(payload instanceof Uint8Array)) {
+      throw new TypeError("payload must be an instance of Uint8Array");
+    }
+    this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    assertNotSet(this.#protectedHeader, "setProtectedHeader");
+    this.#protectedHeader = protectedHeader;
+    return this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
+    this.#unprotectedHeader = unprotectedHeader;
+    return this;
+  }
+  async sign(key, options) {
+    if (!this.#protectedHeader && !this.#unprotectedHeader) {
+      throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+    }
+    if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) {
+      throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+    }
+    const joseHeader = {
+      ...this.#protectedHeader,
+      ...this.#unprotectedHeader
+    };
+    const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, this.#protectedHeader, joseHeader);
+    let b64 = true;
+    if (extensions.has("b64")) {
+      b64 = this.#protectedHeader.b64;
+      if (typeof b64 !== "boolean") {
+        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+      }
+    }
+    const { alg } = joseHeader;
+    if (typeof alg !== "string" || !alg) {
+      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    checkKeyType(alg, key, "sign");
+    let payloadS;
+    let payloadB;
+    if (b64) {
+      payloadS = encode2(this.#payload);
+      payloadB = encode(payloadS);
+    } else {
+      payloadB = this.#payload;
+      payloadS = "";
+    }
+    let protectedHeaderString;
+    let protectedHeaderBytes;
+    if (this.#protectedHeader) {
+      protectedHeaderString = encode2(JSON.stringify(this.#protectedHeader));
+      protectedHeaderBytes = encode(protectedHeaderString);
+    } else {
+      protectedHeaderString = "";
+      protectedHeaderBytes = new Uint8Array();
+    }
+    const data = concat(protectedHeaderBytes, encode("."), payloadB);
+    const k = await normalizeKey(key, alg);
+    const signature = await sign(alg, k, data);
+    const jws = {
+      signature: encode2(signature),
+      payload: payloadS
+    };
+    if (this.#unprotectedHeader) {
+      jws.header = this.#unprotectedHeader;
+    }
+    if (this.#protectedHeader) {
+      jws.protected = protectedHeaderString;
+    }
+    return jws;
+  }
+};
+var CompactSign = class {
+  #flattened;
+  constructor(payload) {
+    this.#flattened = new FlattenedSign(payload);
+  }
+  setProtectedHeader(protectedHeader) {
+    this.#flattened.setProtectedHeader(protectedHeader);
+    return this;
+  }
+  async sign(key, options) {
+    const jws = await this.#flattened.sign(key, options);
+    if (jws.payload === void 0) {
+      throw new TypeError("use the flattened module for creating JWS with b64: false");
+    }
+    return `${jws.protected}.${jws.payload}.${jws.signature}`;
+  }
+};
+var SignJWT = class {
+  #protectedHeader;
+  #jwt;
+  constructor(payload = {}) {
+    this.#jwt = new JWTClaimsBuilder(payload);
+  }
+  setIssuer(issuer) {
+    this.#jwt.iss = issuer;
+    return this;
+  }
+  setSubject(subject) {
+    this.#jwt.sub = subject;
+    return this;
+  }
+  setAudience(audience) {
+    this.#jwt.aud = audience;
+    return this;
+  }
+  setJti(jwtId) {
+    this.#jwt.jti = jwtId;
+    return this;
+  }
+  setNotBefore(input) {
+    this.#jwt.nbf = input;
+    return this;
+  }
+  setExpirationTime(input) {
+    this.#jwt.exp = input;
+    return this;
+  }
+  setIssuedAt(input) {
+    this.#jwt.iat = input;
+    return this;
+  }
+  setProtectedHeader(protectedHeader) {
+    this.#protectedHeader = protectedHeader;
+    return this;
+  }
+  async sign(key, options) {
+    const sig = new CompactSign(this.#jwt.data());
+    sig.setProtectedHeader(this.#protectedHeader);
+    if (Array.isArray(this.#protectedHeader?.crit) && this.#protectedHeader.crit.includes("b64") && this.#protectedHeader.b64 === false) {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    }
+    return sig.sign(key, options);
+  }
+};
+function getModulusLengthOption(options) {
+  const modulusLength = options?.modulusLength ?? 2048;
+  if (typeof modulusLength !== "number" || modulusLength < 2048) {
+    throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+  }
+  return modulusLength;
+}
+async function generateKeyPair(alg, options) {
+  let algorithm;
+  let keyUsages;
+  switch (alg) {
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      algorithm = {
+        name: "RSA-PSS",
+        hash: `SHA-${alg.slice(-3)}`,
+        publicExponent: Uint8Array.of(1, 0, 1),
+        modulusLength: getModulusLengthOption(options)
+      };
+      keyUsages = ["sign", "verify"];
+      break;
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      algorithm = {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: `SHA-${alg.slice(-3)}`,
+        publicExponent: Uint8Array.of(1, 0, 1),
+        modulusLength: getModulusLengthOption(options)
+      };
+      keyUsages = ["sign", "verify"];
+      break;
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512":
+      algorithm = {
+        name: "RSA-OAEP",
+        hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
+        publicExponent: Uint8Array.of(1, 0, 1),
+        modulusLength: getModulusLengthOption(options)
+      };
+      keyUsages = ["decrypt", "unwrapKey", "encrypt", "wrapKey"];
+      break;
+    case "ES256":
+      algorithm = { name: "ECDSA", namedCurve: "P-256" };
+      keyUsages = ["sign", "verify"];
+      break;
+    case "ES384":
+      algorithm = { name: "ECDSA", namedCurve: "P-384" };
+      keyUsages = ["sign", "verify"];
+      break;
+    case "ES512":
+      algorithm = { name: "ECDSA", namedCurve: "P-521" };
+      keyUsages = ["sign", "verify"];
+      break;
+    case "Ed25519":
+    case "EdDSA": {
+      keyUsages = ["sign", "verify"];
+      algorithm = { name: "Ed25519" };
+      break;
+    }
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87": {
+      keyUsages = ["sign", "verify"];
+      algorithm = { name: alg };
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      keyUsages = ["deriveBits"];
+      const crv = options?.crv ?? "P-256";
+      switch (crv) {
+        case "P-256":
+        case "P-384":
+        case "P-521": {
+          algorithm = { name: "ECDH", namedCurve: crv };
+          break;
+        }
+        case "X25519":
+          algorithm = { name: "X25519" };
+          break;
+        default:
+          throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+      }
+      break;
+    }
+    default:
+      throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  }
+  return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+}
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var ASSERTION_TTL_SECONDS = 60;
+var DPOP_PROOF_TYP = "dpop+jwt";
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function accessTokenHash(accessToken) {
+  return base64url_exports.encode(createHash("sha256").update(accessToken, "ascii").digest());
+}
+function publicDpopJwk(publicKeyJwk) {
+  return {
+    ...publicKeyJwk,
+    alg: "ES256",
+    use: "sig"
+  };
+}
+async function signRuntimeAssertion(params) {
+  const now = nowSeconds();
+  return new SignJWT({ jti: randomUUID() }).setProtectedHeader({ alg: "ES256", kid: params.key.keyId }).setIssuer(params.runtimeIdentityId).setSubject(params.runtimeIdentityId).setAudience(params.audience).setIssuedAt(now).setExpirationTime(now + ASSERTION_TTL_SECONDS).sign(params.key.privateKey);
+}
+async function signDpopProof(params) {
+  const now = nowSeconds();
+  const payload = {
+    htm: params.method,
+    htu: params.htu,
+    jti: randomUUID()
+  };
+  if (params.accessToken) {
+    payload.ath = accessTokenHash(params.accessToken);
+  }
+  return new SignJWT(payload).setProtectedHeader({
+    typ: DPOP_PROOF_TYP,
+    alg: "ES256",
+    jwk: publicDpopJwk(params.key.publicKeyJwk)
+  }).setIssuedAt(now).sign(params.key.privateKey);
+}
+var PRIVATE_KEY_FILE = "private-key.jwk";
+var RUNTIME_METADATA_FILE = "runtime.json";
+var PRIVATE_JWK_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function runtimeStatePaths(stateDir) {
+  const root = path.join(stateDir, "oct8-secrets");
+  return {
+    root,
+    privateKeyPath: path.join(root, PRIVATE_KEY_FILE),
+    runtimeMetadataPath: path.join(root, RUNTIME_METADATA_FILE)
+  };
+}
+async function ensureStateRoot(root) {
+  await fs.mkdir(root, { recursive: true, mode: 448 });
+  await fs.chmod(root, 448).catch(() => void 0);
+}
+async function readJsonFile(pathname) {
+  try {
+    return JSON.parse(await fs.readFile(pathname, "utf8"));
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") {
+      return void 0;
+    }
+    throw new Oct8SecretsError(`Failed to read runtime state file ${path.basename(pathname)}.`, "STATE_READ_FAILED");
+  }
+}
+function isNodeError(error) {
+  return error instanceof Error && "code" in error;
+}
+async function createJsonFileExclusive(pathname, value) {
+  let handle;
+  try {
+    handle = await fs.open(pathname, "wx", 384);
+  } catch (error) {
+    if (isNodeError(error) && error.code === "EEXIST") {
+      return "exists";
+    }
+    throw new Oct8SecretsError(`Failed to create runtime state file ${path.basename(pathname)}.`, "STATE_WRITE_FAILED");
+  }
+  try {
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}
+`, "utf8");
+  } finally {
+    await handle.close();
+  }
+  await fs.chmod(pathname, 384).catch(() => void 0);
+  return "created";
+}
+function publicJwkFromPrivate(privateJwk) {
+  const publicJwk = Object.fromEntries(
+    Object.entries(privateJwk).filter(([key]) => !PRIVATE_JWK_FIELDS.has(key))
+  );
+  return {
+    ...publicJwk,
+    kty: "EC",
+    crv: "P-256",
+    kid: privateJwk.kid,
+    alg: "ES256",
+    use: "sig"
+  };
+}
+function assertPrivateRuntimeJwk(value) {
+  if (!isRecord3(value)) {
+    throw new Oct8SecretsError("Runtime private key state must be a JSON object.", "INVALID_STATE");
+  }
+  if (value.kty !== "EC" || value.crv !== "P-256" || value.alg !== "ES256" || value.use !== "sig" || typeof value.kid !== "string" || typeof value.d !== "string" || typeof value.x !== "string" || typeof value.y !== "string") {
+    throw new Oct8SecretsError("Runtime private key state is not an ES256 private JWK.", "INVALID_STATE");
+  }
+  return value;
+}
+async function generatePrivateRuntimeJwk(keyId) {
+  const { privateKey } = await generateKeyPair("ES256", { extractable: true });
+  const exported = await exportJWK(privateKey);
+  return {
+    ...exported,
+    kty: "EC",
+    crv: "P-256",
+    kid: keyId,
+    alg: "ES256",
+    use: "sig"
+  };
+}
+async function loadRuntimeKey(env) {
+  const paths = runtimeStatePaths(env.stateDir);
+  await ensureStateRoot(paths.root);
+  const stored = await readJsonFile(paths.privateKeyPath);
+  let privateJwk;
+  if (stored === void 0) {
+    privateJwk = await generatePrivateRuntimeJwk(env.keyId ?? `oct8-runtime-${randomUUID2()}`);
+    const result = await createJsonFileExclusive(paths.privateKeyPath, privateJwk);
+    if (result === "exists") {
+      privateJwk = assertPrivateRuntimeJwk(await readJsonFile(paths.privateKeyPath));
+    }
+  } else {
+    privateJwk = assertPrivateRuntimeJwk(stored);
+  }
+  if (env.keyId && privateJwk.kid !== env.keyId) {
+    throw new Oct8SecretsError("OCT8_RUNTIME_KEY_ID does not match the stored runtime key.", "INVALID_STATE");
+  }
+  const privateKey = await importJWK(privateJwk, "ES256");
+  return {
+    keyId: privateJwk.kid,
+    algorithm: "ES256",
+    privateKey,
+    publicKeyJwk: publicJwkFromPrivate(privateJwk)
+  };
+}
+
+// src/runtime-auth.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+var TOKEN_REFRESH_SKEW_MS = 3e4;
+var PARTICIPATION_CONTEXT_SCOPE = "participation-context:read";
+function runtimeUrl(baseUrl, path3) {
+  const normalizedPath = path3.startsWith("/") ? path3 : `/${path3}`;
+  return `${baseUrl.replace(/\/+$/, "")}${normalizedPath}`;
+}
+function participationContextHtu(tokenIssuer, requestUrl) {
+  const parsed = new URL(requestUrl);
+  return runtimeUrl(tokenIssuer, parsed.pathname);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function parseJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+async function fetchWithTimeout(fetchImpl, url, init) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+  try {
+    return await fetchImpl(url, {
+      ...init,
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function apiErrorMessage(response) {
+  const statusText = response.statusText ? ` ${response.statusText}` : "";
+  return `Runtime token request failed with ${response.status}${statusText}.`;
+}
+var RuntimeParticipationContextAuthClient = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  runtimeEnv;
+  keyPromise;
+  token;
+  async authorizationHeaders(requestUrl) {
+    const accessToken = await this.accessToken();
+    const env = this.env();
+    const key = await this.key();
+    const dpopProof = await signDpopProof({
+      key,
+      method: "GET",
+      htu: participationContextHtu(env.tokenIssuer, requestUrl),
+      accessToken
+    });
+    return {
+      Authorization: `DPoP ${accessToken}`,
+      DPoP: dpopProof
+    };
+  }
+  env() {
+    this.runtimeEnv ??= readRuntimeSecretsEnv(this.options.env);
+    return this.runtimeEnv;
+  }
+  key() {
+    this.keyPromise ??= loadRuntimeKey(this.env());
+    return this.keyPromise;
+  }
+  now() {
+    return this.options.now?.() ?? Date.now();
+  }
+  async accessToken() {
+    const now = this.now();
+    if (this.token && this.token.expiresAtMs - TOKEN_REFRESH_SKEW_MS > now) {
+      return this.token.accessToken;
+    }
+    const env = this.env();
+    const key = await this.key();
+    const endpoint = runtimeUrl(env.apiUrl, "/v1/runtime/token");
+    const audience = runtimeUrl(env.tokenIssuer, "/v1/runtime/token");
+    const clientAssertion = await signRuntimeAssertion({
+      key,
+      runtimeIdentityId: env.runtimeIdentityId,
+      audience
+    });
+    const dpopProof = await signDpopProof({
+      key,
+      method: "POST",
+      htu: audience
+    });
+    const form = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: env.runtimeIdentityId,
+      client_assertion_type: CLIENT_ASSERTION_TYPE,
+      client_assertion: clientAssertion,
+      scope: PARTICIPATION_CONTEXT_SCOPE
+    });
+    const response = await fetchWithTimeout(this.options.fetchImpl ?? fetch, endpoint, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded",
+        DPoP: dpopProof
+      },
+      body: form.toString()
+    });
+    const payload = await parseJson(response);
+    if (!response.ok) {
+      throw new Error(apiErrorMessage(response));
+    }
+    if (!isRecord(payload) || typeof payload.access_token !== "string" || payload.token_type !== "DPoP" || payload.scope !== PARTICIPATION_CONTEXT_SCOPE || typeof payload.expires_in !== "number" || !Number.isFinite(payload.expires_in) || payload.expires_in <= 0) {
+      throw new Error("Runtime token response was invalid.");
+    }
+    this.token = {
+      accessToken: payload.access_token,
+      expiresAtMs: now + payload.expires_in * 1e3
+    };
+    return payload.access_token;
+  }
+};
+function createRuntimeParticipationContextAuthClient(options) {
+  return new RuntimeParticipationContextAuthClient(options);
+}
+
+// src/context.ts
+var CONTEXT_FETCH_TIMEOUT_MS = 5e3;
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function readNames(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const names = value.map(readString).filter((entry) => Boolean(entry));
+  return [...new Set(names)];
+}
+function parseIdentity(value) {
+  if (!isRecord2(value)) {
+    return void 0;
+  }
+  const id = readString(value.id);
+  const names = readNames(value.names);
+  if (!id || names.length === 0) {
+    return void 0;
+  }
+  const roleSummary = readString(value.roleSummary);
+  return {
+    id,
+    names,
+    ...roleSummary ? { roleSummary } : {}
+  };
+}
+function parseParticipationContext(payload) {
+  const candidate = isRecord2(payload) && isRecord2(payload.data) ? payload.data : payload;
+  if (!isRecord2(candidate)) {
+    throw new Error("participation context response must be an object");
+  }
+  const self = parseIdentity(candidate.self);
+  if (!self) {
+    throw new Error("participation context response is missing self identity");
+  }
+  const coworkers = Array.isArray(candidate.coworkers) ? candidate.coworkers.map(parseIdentity).filter((entry) => Boolean(entry)).filter((entry) => entry.id !== self.id) : [];
+  return { self, coworkers };
+}
+function buildParticipationContextUrl(config) {
+  if (!config.baseUrl) {
+    throw new Error("platform context baseUrl is not configured");
+  }
+  if (!config.coworkerId) {
+    throw new Error("platform context coworkerId is not configured");
+  }
+  const path3 = config.endpointPath.replace(
+    "{coworkerId}",
+    encodeURIComponent(config.coworkerId)
+  );
+  return new URL(path3, config.baseUrl.endsWith("/") ? config.baseUrl : `${config.baseUrl}/`).href;
+}
+async function fetchJsonWithTimeout(fetchImpl, url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, {
+      ...init,
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`platform context request failed with ${response.status}`);
+    }
+    return await response.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function createStaticParticipationContextProvider(context) {
+  return {
+    async load() {
+      if (!context) {
+        throw new Error("static participation context is not configured");
+      }
+      return context;
+    }
+  };
+}
+function createPlatformParticipationContextProvider(config, options = {}) {
+  let cached;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const runtimeAuthClient = options.runtimeAuthClient ?? createRuntimeParticipationContextAuthClient();
+  return {
+    async load() {
+      const now = Date.now();
+      if (cached && cached.expiresAt > now) {
+        return cached.context;
+      }
+      const url = buildParticipationContextUrl(config.platform);
+      const headers = {
+        Accept: "application/json"
+      };
+      if (config.platform.authMode === "static-token") {
+        if (!config.platform.token) {
+          throw new Error("static platform context token is not configured");
+        }
+        headers.Authorization = `Bearer ${config.platform.token}`;
+        if (config.platform.coworkerId) {
+          headers["X-Velanir-Coworker-Id"] = config.platform.coworkerId;
+        }
+      } else {
+        Object.assign(headers, await runtimeAuthClient.authorizationHeaders(url));
+      }
+      const payload = await fetchJsonWithTimeout(
+        fetchImpl,
+        url,
+        { method: "GET", headers },
+        CONTEXT_FETCH_TIMEOUT_MS
+      );
+      const context = parseParticipationContext(payload);
+      cached = {
+        context,
+        expiresAt: now + config.context.refreshMs
+      };
+      return context;
+    }
+  };
+}
+function createParticipationContextProvider(config) {
+  if (config.context.source === "static") {
+    return createStaticParticipationContextProvider(config.staticContext);
+  }
+  return createPlatformParticipationContextProvider(config);
+}
+
+// src/config.ts
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_MAX_OUTPUT_TOKENS = 32;
+var DEFAULT_CLASSIFIER_THRESHOLD = 0.7;
+var DEFAULT_MAX_MESSAGES = 5;
+var DEFAULT_REFRESH_MS = 5 * 60 * 1e3;
+var DEFAULT_PLATFORM_ENDPOINT_PATH = "/v1/runtime/coworkers/{coworkerId}/participation-context";
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString2(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function readPositiveInteger(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+}
+function readRatio(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1 ? value : fallback;
+}
+function normalizeMode(value) {
+  return value === "enforce" ? "enforce" : "shadow";
+}
+function normalizeContextSource(value) {
+  return value === "static" ? "static" : "platform";
+}
+function normalizePlatformAuthMode(value) {
+  return value === "static-token" ? "static-token" : "runtime";
+}
+function normalizeClassifier(value) {
+  const record = isRecord4(value) ? value : {};
+  return {
+    provider: readString2(record.provider),
+    model: readString2(record.model),
+    authProfileId: readString2(record.authProfileId),
+    timeoutMs: readPositiveInteger(record.timeoutMs, DEFAULT_TIMEOUT_MS) || DEFAULT_TIMEOUT_MS,
+    maxOutputTokens: readPositiveInteger(record.maxOutputTokens, DEFAULT_MAX_OUTPUT_TOKENS) || DEFAULT_MAX_OUTPUT_TOKENS,
+    threshold: readRatio(record.threshold, DEFAULT_CLASSIFIER_THRESHOLD)
+  };
+}
+function normalizePlatform(value, env) {
+  const record = isRecord4(value) ? value : {};
+  const authMode = normalizePlatformAuthMode(record.authMode);
+  return {
+    authMode,
+    baseUrl: readString2(record.baseUrl) ?? readString2(env.OCT8_API_URL),
+    coworkerId: readString2(record.coworkerId) ?? readString2(env.OCT8_COWORKER_ID),
+    token: authMode === "static-token" ? readString2(record.token) ?? readString2(env.OCT8_PARTICIPATION_CONTEXT_TOKEN) : void 0,
+    endpointPath: readString2(record.endpointPath) ?? DEFAULT_PLATFORM_ENDPOINT_PATH
+  };
+}
+function normalizeNames(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const names = value.map(readString2).filter((entry) => Boolean(entry));
+  return [...new Set(names)];
+}
+function normalizeIdentity(value) {
+  if (!isRecord4(value)) {
+    return void 0;
+  }
+  const id = readString2(value.id);
+  const names = normalizeNames(value.names);
+  if (!id || names.length === 0) {
+    return void 0;
+  }
+  const roleSummary = readString2(value.roleSummary);
+  return {
+    id,
+    names,
+    ...roleSummary ? { roleSummary } : {}
+  };
+}
+function normalizeStaticContext(value) {
+  if (!isRecord4(value)) {
+    return void 0;
+  }
+  const self = normalizeIdentity(value.self);
+  if (!self) {
+    return void 0;
+  }
+  const coworkers = Array.isArray(value.coworkers) ? value.coworkers.map(normalizeIdentity).filter((entry) => Boolean(entry)) : [];
+  return {
+    self,
+    coworkers: coworkers.filter((entry) => entry.id !== self.id)
+  };
+}
+function normalizeConfig(pluginConfig, env = process.env) {
+  const record = isRecord4(pluginConfig) ? pluginConfig : {};
+  const contextRecord = isRecord4(record.context) ? record.context : {};
+  const loggingRecord = isRecord4(record.logging) ? record.logging : {};
+  return {
+    mode: normalizeMode(record.mode),
+    classifier: normalizeClassifier(record.classifier),
+    context: {
+      source: normalizeContextSource(contextRecord.source),
+      maxMessages: readPositiveInteger(contextRecord.maxMessages, DEFAULT_MAX_MESSAGES),
+      refreshMs: readPositiveInteger(contextRecord.refreshMs, DEFAULT_REFRESH_MS) || DEFAULT_REFRESH_MS
+    },
+    platform: normalizePlatform(record.platform, env),
+    staticContext: normalizeStaticContext(record.staticContext),
+    logging: {
+      decisions: loggingRecord.decisions !== false,
+      includeContent: loggingRecord.includeContent === true,
+      classifierDebug: loggingRecord.classifierDebug === true
+    }
+  };
+}
+
+// src/classifier.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/embedded-model.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import fs2 from "fs/promises";
+import os from "os";
+import path2 from "path";
+function collectAssistantText(result) {
+  if (typeof result === "string") {
+    return result.trim();
+  }
+  if (!result || typeof result !== "object") {
+    return "";
+  }
+  const payloads = result.payloads;
+  if (!Array.isArray(payloads)) {
+    return "";
+  }
+  return payloads.map((payload) => {
+    if (!payload || typeof payload !== "object") {
+      return "";
+    }
+    const record = payload;
+    return record.isError === true || typeof record.text !== "string" ? "" : record.text;
+  }).filter(Boolean).join("\n").trim();
+}
+async function runEmbeddedClassifierModel(params) {
+  const agentRuntime = params.api.runtime?.agent;
+  const runEmbeddedAgent = agentRuntime?.runEmbeddedAgent ?? agentRuntime?.runEmbeddedPiAgent;
+  if (typeof runEmbeddedAgent !== "function") {
+    throw new Error("OpenClaw embedded agent runtime is unavailable");
+  }
+  const provider = params.config.classifier.provider;
+  const model = params.config.classifier.model;
+  if (!provider || !model) {
+    throw new Error("classifier provider/model is not configured");
+  }
+  let tmpDir;
+  try {
+    tmpDir = await fs2.mkdtemp(path2.join(os.tmpdir(), "velanir-participation-gate-"));
+    const runId = `participation-gate-${randomUUID3()}`;
+    const result = await runEmbeddedAgent({
+      sessionId: runId,
+      sessionFile: path2.join(tmpDir, "session.json"),
+      workspaceDir: agentRuntime?.resolveAgentWorkspaceDir?.(params.api.config) ?? process.cwd(),
+      config: params.api.config,
+      prompt: params.prompt,
+      timeoutMs: params.config.classifier.timeoutMs,
+      runId,
+      modelRun: true,
+      provider,
+      model,
+      authProfileId: params.config.classifier.authProfileId,
+      authProfileIdSource: params.config.classifier.authProfileId ? "user" : "auto",
+      explicitStreamParamsOnly: true,
+      streamParams: {
+        maxTokens: params.config.classifier.maxOutputTokens
+      },
+      disableTools: true,
+      disableMessageTool: true,
+      thinkLevel: "off",
+      reasoningLevel: "off",
+      verboseLevel: "off",
+      fastMode: true,
+      bootstrapContextMode: "lightweight"
+    });
+    const text = collectAssistantText(result);
+    if (!text) {
+      throw new Error("classifier returned empty output");
+    }
+    return text;
+  } finally {
+    if (tmpDir) {
+      await fs2.rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    }
+  }
+}
+
+// src/classifier.ts
+var CLASSIFIER_PROMPT_VERSION = "participation-score-v2";
+function stripCodeFences(value) {
+  const trimmed = value.trim();
+  const match = /^```(?:json)?\s*([\s\S]*?)\s*```$/i.exec(trimmed);
+  return (match?.[1] ?? trimmed).trim();
+}
+function hashValue(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function trimForPrompt(value, maxLength = 1200) {
+  const normalized = value.replace(/\s+/g, " ").trim();
+  if (normalized.length <= maxLength) {
+    return normalized;
+  }
+  return `${normalized.slice(0, maxLength - 3)}...`;
+}
+function formatIdentity(identity) {
+  const role = identity.roleSummary ? ` Role: ${identity.roleSummary}` : "";
+  return `- ${identity.names.join(", ")}.${role}`;
+}
+function buildContextSection(context) {
+  const coworkers = context.coworkers.length ? context.coworkers.map(formatIdentity).join("\n") : "- None known.";
+  return [
+    "This digital coworker:",
+    formatIdentity(context.self),
+    "",
+    "Other digital coworkers in this organization:",
+    coworkers
+  ].join("\n");
+}
+function formatFact(name, value) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  return `- ${name}: ${String(value)}`;
+}
+function buildConversationSection(input) {
+  const facts = [
+    formatFact("provider", input.conversation.provider),
+    formatFact("surface", input.conversation.surface),
+    formatFact("chatType", input.conversation.chatType),
+    formatFact("channelId", input.conversation.channelId),
+    formatFact("conversationId", input.conversation.conversationId),
+    formatFact("conversationLabel", input.conversation.conversationLabel),
+    formatFact("groupSubject", input.conversation.groupSubject),
+    formatFact("sessionKey", input.conversation.sessionKey),
+    formatFact("senderName", input.conversation.senderName),
+    formatFact("senderId", input.conversation.senderId),
+    formatFact("wasMentioned", input.conversation.wasMentioned),
+    formatFact("isThread", input.conversation.isThread),
+    formatFact("messageThreadId", input.conversation.messageThreadId),
+    formatFact("parentSessionKey", input.conversation.parentSessionKey),
+    formatFact("threadLabel", input.conversation.threadLabel),
+    formatFact("isFirstThreadTurn", input.conversation.isFirstThreadTurn)
+  ].filter((entry) => Boolean(entry));
+  return `Conversation facts:
+${facts.length ? facts.join("\n") : "- None available."}`;
+}
+function buildThreadSection(input) {
+  const starter = input.thread?.starterBody ? trimForPrompt(input.thread.starterBody) : void 0;
+  const history = input.thread?.historyBody ? trimForPrompt(input.thread.historyBody, 1800) : void 0;
+  if (!starter && !history) {
+    return "Thread context:\n- No thread context available.";
+  }
+  return [
+    "Thread context:",
+    starter ? `- Starter: ${starter}` : void 0,
+    history ? `- Recent thread history: ${history}` : void 0
+  ].filter((entry) => Boolean(entry)).join("\n");
+}
+function formatHistoryMessage(message2) {
+  const sender = message2.senderName ?? message2.senderId ?? "unknown";
+  const role = message2.role === "assistant" ? "assistant" : "user";
+  const timestamp = message2.timestamp ? ` at ${message2.timestamp}` : "";
+  return `- ${role} ${sender}${timestamp}: ${trimForPrompt(message2.content, 700)}`;
+}
+function buildRecentMessagesSection(input) {
+  if (input.recentMessages.length === 0) {
+    return "Recent conversation:\n- No recent messages available.";
+  }
+  return `Recent conversation:
+${input.recentMessages.map(formatHistoryMessage).join("\n")}`;
+}
+function buildCurrentMessageSection(input) {
+  const sender = input.currentMessage.senderName ?? input.currentMessage.senderId;
+  return [
+    "Current message:",
+    sender ? `${sender}: ${trimForPrompt(input.currentMessage.content, 1200)}` : trimForPrompt(input.currentMessage.content, 1200)
+  ].join("\n");
+}
+function buildClassifierPrompt(input) {
+  return [
+    "You decide whether this digital coworker should participate in the current shared group, channel, room, or thread turn.",
+    "The goal is useful participation, not name matching. Decide from the conversation context, current request, thread ownership, prior replies, and the coworker's role.",
+    "Direct messages are admitted before this classifier; this classifier handles shared rooms, channels, groups, and threads.",
+    "",
+    buildContextSection(input.context),
+    "",
+    buildConversationSection(input),
+    "",
+    buildThreadSection(input),
+    "",
+    buildRecentMessagesSection(input),
+    "",
+    buildCurrentMessageSection(input),
+    "",
+    "Return exactly one complete minified JSON object with this exact shape:",
+    '{"participationScore":0.0}',
+    "",
+    "Score guidance:",
+    "- 1.0 means this coworker clearly should reply now.",
+    "- 0.7 or higher means this coworker should participate.",
+    "- Below 0.7 means this coworker should stay silent.",
+    "- Use 0.9 or higher for direct requests to this coworker, clear follow-ups after this coworker replied, or requests where this coworker is the responsible participant.",
+    "- Use 0.7 or higher for open channel asks such as 'can someone', 'does anyone know', or 'could the digital coworker in this channel' when this coworker can help.",
+    "- Use 0.8 or higher when the message is in a thread where this coworker already answered or owns the thread context.",
+    "- Use below 0.7 for ambient chat, messages clearly meant for another person, acknowledgements that do not need a reply, or interruptions.",
+    "",
+    "Do not include markdown, code fences, prose outside JSON, or extra keys."
+  ].join("\n");
+}
+function buildClassifierRetryPrompt(params) {
+  return [
+    buildClassifierPrompt(params.input),
+    "",
+    "The previous classifier response was invalid JSON.",
+    params.parseError ? `Previous parse error: ${trimForPrompt(params.parseError, 240)}` : void 0,
+    "Repair the response now. Return exactly one complete minified JSON object and nothing else.",
+    '{"participationScore":0.0}'
+  ].filter((line) => Boolean(line)).join("\n");
+}
+function normalizeScore(value) {
+  const score = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+  if (!Number.isFinite(score) || score < 0 || score > 1) {
+    return void 0;
+  }
+  return score;
+}
+function failOpen(parseError) {
+  return {
+    participationScore: 1,
+    parseStatus: "malformed",
+    parseError
+  };
+}
+function recoverParticipationScore(output) {
+  const stripped = stripCodeFences(output);
+  const match = /["']?participationScore["']?\s*:\s*["']?(-?(?:\d+(?:\.\d+)?|\.\d+))["']?/i.exec(stripped);
+  return match ? normalizeScore(match[1]) : void 0;
+}
+function extractFirstJsonObject(value) {
+  const start = value.indexOf("{");
+  if (start < 0) {
+    return void 0;
+  }
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let index = start; index < value.length; index += 1) {
+    const char = value[index];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      continue;
+    }
+    if (char === "{") {
+      depth += 1;
+      continue;
+    }
+    if (char === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        return value.slice(start, index + 1);
+      }
+    }
+  }
+  return void 0;
+}
+function parseJsonObject(output) {
+  const stripped = stripCodeFences(output);
+  try {
+    return { parsed: JSON.parse(stripped) };
+  } catch (error) {
+    const primaryError = error instanceof Error ? error.message : String(error);
+    const extracted = extractFirstJsonObject(stripped);
+    if (extracted && extracted !== stripped) {
+      try {
+        return { parsed: JSON.parse(extracted) };
+      } catch (extractError) {
+        return {
+          parseError: extractError instanceof Error ? extractError.message : String(extractError)
+        };
+      }
+    }
+    return { parseError: primaryError };
+  }
+}
+function parseClassifierDecision(output) {
+  const { parsed, parseError } = parseJsonObject(output);
+  if (parseError) {
+    const recoveredScore = recoverParticipationScore(output);
+    if (recoveredScore !== void 0) {
+      return {
+        participationScore: recoveredScore,
+        parseStatus: "recovered_score",
+        parseError
+      };
+    }
+    return failOpen(parseError);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return failOpen("not_object");
+  }
+  const record = parsed;
+  if (typeof record.shouldRespond === "boolean" && record.participationScore === void 0) {
+    return {
+      participationScore: record.shouldRespond ? 1 : 0,
+      parseStatus: "legacy_boolean"
+    };
+  }
+  const participationScore = normalizeScore(record.participationScore);
+  if (participationScore === void 0) {
+    return failOpen("invalid_score");
+  }
+  return {
+    participationScore,
+    parseStatus: "valid_json"
+  };
+}
+async function classifyParticipation(params) {
+  const inputHash = hashValue(stableStringify(params.input));
+  const firstPrompt = buildClassifierPrompt(params.input);
+  const firstAttempt = await runClassifierAttempt({
+    api: params.api,
+    config: params.config,
+    prompt: firstPrompt,
+    attempt: 1
+  });
+  const attempts = [firstAttempt];
+  let finalAttempt = firstAttempt;
+  if (firstAttempt.parseStatus === "malformed") {
+    const retryPrompt = buildClassifierRetryPrompt({
+      input: params.input,
+      parseError: firstAttempt.parseError
+    });
+    finalAttempt = await runClassifierAttempt({
+      api: params.api,
+      config: params.config,
+      prompt: retryPrompt,
+      attempt: 2
+    });
+    attempts.push(finalAttempt);
+  }
+  return {
+    participationScore: finalAttempt.participationScore,
+    parseStatus: finalAttempt.parseStatus,
+    parseError: finalAttempt.parseError,
+    rawOutput: finalAttempt.rawOutput,
+    prompt: finalAttempt.prompt,
+    promptVersion: CLASSIFIER_PROMPT_VERSION,
+    promptHash: finalAttempt.promptHash,
+    inputHash,
+    outputHash: finalAttempt.outputHash,
+    outputLength: finalAttempt.outputLength,
+    attempts
+  };
+}
+async function runClassifierAttempt(params) {
+  const output = await runEmbeddedClassifierModel({
+    api: params.api,
+    config: params.config,
+    prompt: params.prompt
+  });
+  const parsed = parseClassifierDecision(output);
+  return {
+    attempt: params.attempt,
+    prompt: params.prompt,
+    promptHash: hashValue(params.prompt),
+    rawOutput: output,
+    outputHash: hashValue(output),
+    outputLength: output.length,
+    ...parsed
+  };
+}
+
+// src/message.ts
+var THREAD_HISTORY_ENVELOPE_RE = /^\s*\[Thread history\]\s*([\s\S]*?)\s*\[\/Thread history\]\s*([\s\S]*)$/i;
+function nonBlank(value) {
+  const text = value?.trim();
+  return text ? text : void 0;
+}
+function threadHistoryText(event) {
+  const explicit = nonBlank(event.threadHistoryBody);
+  if (explicit) {
+    return explicit;
+  }
+  const body = event.body;
+  if (!body) {
+    return void 0;
+  }
+  const match = THREAD_HISTORY_ENVELOPE_RE.exec(body);
+  return nonBlank(match?.[1]);
+}
+function stripThreadHistoryEnvelope(body) {
+  if (!body) {
+    return "";
+  }
+  const match = THREAD_HISTORY_ENVELOPE_RE.exec(body);
+  return (match?.[2] ?? body).trim();
+}
+function messageText(event) {
+  for (const value of [event.rawBody, event.content]) {
+    const text = nonBlank(value);
+    if (text) {
+      return text;
+    }
+  }
+  return stripThreadHistoryEnvelope(event.body);
+}
+
+// src/decision.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function namePattern(name) {
+  const trimmed = name.trim();
+  if (trimmed.length < 2) {
+    return void 0;
+  }
+  return escapeRegExp(trimmed).replace(/\s+/g, "\\s+");
+}
+function matchesAnyPattern(text, patterns) {
+  return patterns.some((pattern) => pattern.test(text));
+}
+function buildDirectAddressPatterns(name) {
+  const pattern = namePattern(name);
+  if (!pattern) {
+    return [];
+  }
+  const left = "(^|[^A-Za-z0-9_])";
+  const right = "(?=$|[^A-Za-z0-9_])";
+  const sentenceStart = "(^|[.!?][\\s\\n]+)";
+  const requestAfterName = "(I\\s+(need|want|would\\s+like)\\s+you|we\\s+(need|want)\\s+you)";
+  return [
+    new RegExp(`${left}@${pattern}${right}`, "i"),
+    new RegExp(`(^|[\\s\\n])${pattern}\\s*[:,]`, "i"),
+    new RegExp(`${left}(hey|hi|hello|yo)\\s+${pattern}${right}`, "i"),
+    new RegExp(`${sentenceStart}${pattern}\\s+${requestAfterName}${right}`, "i"),
+    new RegExp(
+      `${left}${pattern}\\s+(can|could|would|will|please|do|take|help|look|check|own|handle|review|summarize|find|send|create|update)${right}`,
+      "i"
+    ),
+    new RegExp(`${left}(can|could|would|will)\\s+${pattern}\\s+`, "i")
+  ];
+}
+function messageClearlyAddressesIdentity(content, identity) {
+  if (!content.trim()) {
+    return false;
+  }
+  return identity.names.some((name) => matchesAnyPattern(content, buildDirectAddressPatterns(name)));
+}
+function messageClearlyAddressesAnotherCoworker(content, context) {
+  return context.coworkers.some((coworker) => messageClearlyAddressesIdentity(content, coworker));
+}
+function decision(shouldRespond, reason, source, startedAt, error, metadata) {
+  const message2 = error instanceof Error ? error.message : error ? String(error) : void 0;
+  return {
+    shouldRespond,
+    reason,
+    source,
+    latencyMs: Date.now() - startedAt,
+    ...message2 ? { error: message2 } : {},
+    ...metadata
+  };
+}
+function messageIsThread(event, ctx) {
+  const sessionKey = ctx.sessionKey ?? event.sessionKey ?? "";
+  return Boolean(
+    event.messageThreadId || ctx.messageThreadId || event.parentSessionKey || ctx.parentSessionKey || event.threadStarterBody || threadHistoryText(event) || sessionKey.includes(":thread:") || sessionKey.includes("thread")
+  );
+}
+function eventRecentMessages(event, maxMessages) {
+  if (!Array.isArray(event.inboundHistory) || maxMessages <= 0) {
+    return [];
+  }
+  return event.inboundHistory.filter((message2) => message2.content.trim().length > 0).slice(-maxMessages);
+}
+function providerIsSlack(event, ctx) {
+  const provider = event.provider ?? ctx.provider ?? event.surface ?? ctx.surface ?? event.channel;
+  return provider?.toLowerCase() === "slack";
+}
+function mergeRecentMessages(params) {
+  if (params.inboundHistory.length === 0) {
+    return params.localHistory;
+  }
+  if (providerIsSlack(params.event, params.ctx)) {
+    return params.inboundHistory;
+  }
+  const merged = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const message2 of [...params.localHistory, ...params.inboundHistory]) {
+    const key = [
+      message2.role ?? "user",
+      message2.senderId ?? "",
+      message2.senderName ?? "",
+      message2.timestamp ?? "",
+      message2.content
+    ].join("\0");
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    merged.push(message2);
+  }
+  return merged.slice(-params.maxMessages);
+}
+function buildClassifierInput(params) {
+  const inboundHistory = eventRecentMessages(params.event, params.maxMessages);
+  const threadHistoryBody = threadHistoryText(params.event);
+  return {
+    context: params.context,
+    conversation: {
+      provider: params.event.provider ?? params.ctx.provider,
+      surface: params.event.surface ?? params.ctx.surface,
+      chatType: params.event.chatType ?? params.ctx.chatType ?? (params.event.isGroup ? "group" : "dm"),
+      channelId: params.ctx.channelId ?? params.event.channel,
+      conversationId: params.ctx.conversationId,
+      conversationLabel: params.event.conversationLabel ?? params.ctx.conversationLabel,
+      groupSubject: params.event.groupSubject ?? params.ctx.groupSubject,
+      sessionKey: params.ctx.sessionKey ?? params.event.sessionKey,
+      senderId: params.event.senderId ?? params.ctx.senderId,
+      senderName: params.event.senderName ?? params.ctx.senderName,
+      wasMentioned: params.event.wasMentioned ?? params.ctx.wasMentioned,
+      isThread: messageIsThread(params.event, params.ctx),
+      messageThreadId: params.event.messageThreadId ?? params.ctx.messageThreadId,
+      parentSessionKey: params.event.parentSessionKey ?? params.ctx.parentSessionKey,
+      threadLabel: params.event.threadLabel,
+      isFirstThreadTurn: params.event.isFirstThreadTurn
+    },
+    thread: params.event.threadStarterBody || threadHistoryBody ? {
+      starterBody: params.event.threadStarterBody,
+      historyBody: threadHistoryBody
+    } : void 0,
+    recentMessages: mergeRecentMessages({
+      event: params.event,
+      ctx: params.ctx,
+      inboundHistory,
+      localHistory: params.recentMessages,
+      maxMessages: params.maxMessages
+    }),
+    currentMessage: {
+      senderId: params.event.senderId ?? params.ctx.senderId,
+      senderName: params.event.senderName ?? params.ctx.senderName,
+      content: params.content,
+      timestamp: params.event.timestamp
+    }
+  };
+}
+async function decideParticipation(params) {
+  const startedAt = Date.now();
+  const classify = params.classify ?? classifyParticipation;
+  if (params.event.isGroup !== true) {
+    return decision(true, "dm", "rule", startedAt);
+  }
+  const content = messageText(params.event);
+  if (!content) {
+    return decision(true, "empty_message", "rule", startedAt);
+  }
+  const recentMessages = params.history.recent(
+    params.event,
+    params.ctx,
+    params.config.context.maxMessages
+  );
+  let context;
+  try {
+    context = await params.contextProvider.load();
+  } catch (error) {
+    params.history.recordInbound(params.event, params.ctx, params.config.context.maxMessages);
+    return decision(true, "context_unavailable", "fallback", startedAt, error);
+  }
+  try {
+    if (messageClearlyAddressesIdentity(content, context.self)) {
+      return decision(true, "direct_address_self", "rule", startedAt);
+    }
+    if (messageClearlyAddressesAnotherCoworker(content, context)) {
+      return decision(false, "direct_address_other_coworker", "rule", startedAt);
+    }
+    const classifierInput = buildClassifierInput({
+      context,
+      event: params.event,
+      ctx: params.ctx,
+      content,
+      recentMessages,
+      maxMessages: params.config.context.maxMessages
+    });
+    const classifierDecision = await classify({
+      api: params.api,
+      config: params.config,
+      input: classifierInput
+    });
+    const classifierFields = {
+      participationScore: classifierDecision.participationScore,
+      threshold: params.config.classifier.threshold,
+      classifierPromptVersion: classifierDecision.promptVersion,
+      classifierPromptHash: classifierDecision.promptHash,
+      classifierInputHash: classifierDecision.inputHash,
+      classifierParseStatus: classifierDecision.parseStatus,
+      classifierAttemptCount: classifierDecision.attempts.length,
+      classifierOutputHash: classifierDecision.outputHash,
+      classifierOutputLength: classifierDecision.outputLength,
+      classifierParseError: classifierDecision.parseError,
+      classifierRecentMessageCount: classifierInput.recentMessages.length,
+      classifierThreadContext: Boolean(classifierInput.thread?.starterBody || classifierInput.thread?.historyBody),
+      classifierCurrentMessageLength: classifierInput.currentMessage.content.length,
+      ...params.config.logging.classifierDebug ? {
+        classifierRawOutput: classifierDecision.rawOutput,
+        classifierPrompt: classifierDecision.prompt,
+        classifierInput,
+        classifierAttempts: classifierDecision.attempts
+      } : {}
+    };
+    if (classifierDecision.parseStatus === "malformed") {
+      return decision(
+        true,
+        "classifier_malformed",
+        "fallback",
+        startedAt,
+        void 0,
+        classifierFields
+      );
+    }
+    const shouldRespond = classifierDecision.participationScore >= params.config.classifier.threshold;
+    return decision(
+      shouldRespond,
+      shouldRespond ? "classifier_true" : "classifier_false",
+      "classifier",
+      startedAt,
+      void 0,
+      classifierFields
+    );
+  } catch (error) {
+    return decision(true, "classifier_error", "fallback", startedAt, error);
+  } finally {
+    params.history.recordInbound(params.event, params.ctx, params.config.context.maxMessages);
+  }
+}
+
+// src/history.ts
+function normalizeKey2(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  for (const prefix of ["conversation:", "channel:", "chat:", "user:"]) {
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.slice(prefix.length);
+    }
+  }
+  return trimmed;
+}
+function stripTeamsMessageId(value) {
+  return value.replace(/;messageid=[^;]+/i, "");
+}
+function teamsThreadKey(conversationId, threadId) {
+  const normalizedConversationId = normalizeKey2(conversationId);
+  const normalizedThreadId = normalizeKey2(threadId);
+  if (!normalizedConversationId || !normalizedThreadId) {
+    return void 0;
+  }
+  return `${stripTeamsMessageId(normalizedConversationId)};messageid=${normalizedThreadId}`;
+}
+function addKey(keys, value) {
+  const key = normalizeKey2(value);
+  if (key && !keys.includes(key)) {
+    keys.push(key);
+  }
+}
+function addTargetKeys(keys, value) {
+  const key = normalizeKey2(value);
+  if (!key) {
+    return;
+  }
+  addKey(keys, key);
+  const baseKey = stripTeamsMessageId(key);
+  if (baseKey !== key) {
+    addKey(keys, baseKey);
+  }
+}
+function inboundKeys(event, ctx) {
+  const keys = [];
+  const conversationId = ctx.conversationId ?? event.channel ?? ctx.channelId;
+  const threadId = event.messageThreadId ?? ctx.messageThreadId;
+  addKey(keys, ctx.sessionKey);
+  addKey(keys, event.sessionKey);
+  addKey(keys, teamsThreadKey(conversationId, threadId));
+  addKey(keys, ctx.parentSessionKey);
+  addKey(keys, event.parentSessionKey);
+  addTargetKeys(keys, conversationId);
+  addTargetKeys(keys, event.channel);
+  addTargetKeys(keys, ctx.channelId);
+  return keys.length > 0 ? keys : ["unknown"];
+}
+function outboundKeys(event, ctx) {
+  const keys = [];
+  addKey(keys, ctx.sessionKey);
+  addKey(keys, event.sessionKey);
+  addTargetKeys(keys, event.to);
+  addTargetKeys(keys, ctx.conversationId);
+  addTargetKeys(keys, ctx.channelId);
+  return keys.length > 0 ? keys : ["unknown"];
+}
+function publicMessages(messages, maxMessages) {
+  return messages.sort((left, right) => left.sequence - right.sequence).slice(-maxMessages).map(({ sequence: _sequence, ...message2 }) => message2);
+}
+function createParticipationHistoryStore() {
+  const messagesByConversation = /* @__PURE__ */ new Map();
+  let nextSequence = 1;
+  function recordForKeys(keys, message2, maxMessages) {
+    const stored = {
+      ...message2,
+      sequence: nextSequence
+    };
+    nextSequence += 1;
+    for (const key of keys) {
+      const current = messagesByConversation.get(key) ?? [];
+      current.push(stored);
+      if (current.length > maxMessages) {
+        current.splice(0, current.length - maxMessages);
+      }
+      messagesByConversation.set(key, current);
+    }
+  }
+  function recordInbound(event, ctx, maxMessages) {
+    if (maxMessages <= 0 || event.isGroup !== true) {
+      return false;
+    }
+    const content = messageText(event);
+    if (!content) {
+      return false;
+    }
+    recordForKeys(
+      inboundKeys(event, ctx),
+      {
+        role: "user",
+        senderId: event.senderId ?? ctx.senderId,
+        senderName: event.senderName ?? ctx.senderName,
+        content,
+        timestamp: event.timestamp
+      },
+      maxMessages
+    );
+    return true;
+  }
+  return {
+    recent(event, ctx, maxMessages) {
+      if (maxMessages <= 0) {
+        return [];
+      }
+      const seen = /* @__PURE__ */ new Set();
+      const messages = [];
+      for (const key of inboundKeys(event, ctx)) {
+        for (const message2 of messagesByConversation.get(key) ?? []) {
+          if (!seen.has(message2)) {
+            seen.add(message2);
+            messages.push(message2);
+          }
+        }
+      }
+      return publicMessages(messages, maxMessages);
+    },
+    recordInbound,
+    recordOutbound(event, ctx, maxMessages) {
+      if (maxMessages <= 0 || event.success !== true) {
+        return false;
+      }
+      const content = event.content?.trim();
+      if (!content) {
+        return false;
+      }
+      recordForKeys(
+        outboundKeys(event, ctx),
+        {
+          role: "assistant",
+          senderId: "self",
+          senderName: "This coworker",
+          content
+        },
+        maxMessages
+      );
+      return true;
+    },
+    record(event, ctx, maxMessages) {
+      return recordInbound(event, ctx, maxMessages);
+    }
+  };
+}
+
+// src/logging.ts
+function eventContent(event) {
+  return messageText(event);
+}
+function field(name, value) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  return `${name}=${String(value)}`;
+}
+function scoreField(value) {
+  return typeof value === "number" ? value.toFixed(3) : void 0;
+}
+function contentLoggingEnabled(config) {
+  return config.logging.includeContent === true;
+}
+function logParticipationDecision(params) {
+  if (!params.config.logging.decisions) {
+    return;
+  }
+  const outcome = params.decision.shouldRespond ? "respond" : params.config.mode === "enforce" ? "skip" : "would_skip";
+  const parts = [
+    "velanir-participation-gate:",
+    field("mode", params.config.mode),
+    field("outcome", outcome),
+    field("reason", params.decision.reason),
+    field("source", params.decision.source),
+    field("channel", params.ctx.channelId ?? params.event.channel),
+    field("conversation", params.ctx.conversationId),
+    field("session", params.ctx.sessionKey ?? params.event.sessionKey),
+    field("sender", params.event.senderId ?? params.ctx.senderId),
+    field("latencyMs", params.decision.latencyMs),
+    field("provider", params.config.classifier.provider),
+    field("model", params.config.classifier.model),
+    field("score", scoreField(params.decision.participationScore)),
+    field("threshold", scoreField(params.decision.threshold)),
+    field("promptVersion", params.decision.classifierPromptVersion),
+    field("promptHash", params.decision.classifierPromptHash),
+    field("inputHash", params.decision.classifierInputHash),
+    field("parseStatus", params.decision.classifierParseStatus),
+    field("attemptCount", params.decision.classifierAttemptCount),
+    field("outputHash", params.decision.classifierOutputHash),
+    field("outputLength", params.decision.classifierOutputLength),
+    field("recentMessages", params.decision.classifierRecentMessageCount),
+    field("threadContext", params.decision.classifierThreadContext),
+    field("currentLength", params.decision.classifierCurrentMessageLength),
+    contentLoggingEnabled(params.config) ? field("parseError", params.decision.classifierParseError) : void 0,
+    field("error", params.decision.error),
+    contentLoggingEnabled(params.config) ? field("content", JSON.stringify(eventContent(params.event))) : void 0
+  ].filter((entry) => Boolean(entry));
+  params.logger?.info?.(parts.join(" "));
+  if (params.config.logging.classifierDebug && (params.decision.source === "classifier" || params.decision.classifierAttempts)) {
+    const record = {
+      promptVersion: params.decision.classifierPromptVersion,
+      promptHash: params.decision.classifierPromptHash,
+      inputHash: params.decision.classifierInputHash,
+      provider: params.config.classifier.provider,
+      model: params.config.classifier.model,
+      score: params.decision.participationScore,
+      threshold: params.decision.threshold,
+      parseStatus: params.decision.classifierParseStatus,
+      attemptCount: params.decision.classifierAttemptCount,
+      outputHash: params.decision.classifierOutputHash,
+      outputLength: params.decision.classifierOutputLength,
+      recentMessages: params.decision.classifierRecentMessageCount,
+      threadContext: params.decision.classifierThreadContext,
+      currentMessageLength: params.decision.classifierCurrentMessageLength,
+      outcome
+    };
+    if (params.decision.classifierAttempts) {
+      record.attempts = params.decision.classifierAttempts.map((attempt) => ({
+        attempt: attempt.attempt,
+        promptHash: attempt.promptHash,
+        outputHash: attempt.outputHash,
+        outputLength: attempt.outputLength,
+        parseStatus: attempt.parseStatus,
+        ...contentLoggingEnabled(params.config) ? {
+          parseError: attempt.parseError,
+          prompt: attempt.prompt,
+          rawOutput: attempt.rawOutput
+        } : {}
+      }));
+    }
+    if (contentLoggingEnabled(params.config)) {
+      record.parseError = params.decision.classifierParseError;
+      record.prompt = params.decision.classifierPrompt;
+      record.input = params.decision.classifierInput;
+      record.rawOutput = params.decision.classifierRawOutput;
+    }
+    params.logger?.info?.(
+      `velanir-participation-gate-classifier-debug: ${JSON.stringify(record)}`
+    );
+  }
+}
+function logParticipationHistoryEvent(params) {
+  if (!params.config.logging.decisions) {
+    return;
+  }
+  const parts = [
+    "velanir-participation-gate-history:",
+    field("event", params.event),
+    ...Object.entries(params.fields).map(([name, value]) => field(name, value)),
+    contentLoggingEnabled(params.config) ? field("content", JSON.stringify(params.content ?? "")) : void 0
+  ].filter((entry) => Boolean(entry));
+  params.logger?.info?.(parts.join(" "));
+}
+
+// src/index.ts
+var PLUGIN_ID = "velanir-participation-gate";
+var index_default = definePluginEntry({
+  id: PLUGIN_ID,
+  name: "Velanir Participation Gate",
+  description: "Decides whether a digital coworker should respond in group and channel conversations before the main agent runs.",
+  register(api) {
+    const runtimeApi = api;
+    const config = normalizeConfig(runtimeApi.pluginConfig);
+    const contextProvider = createParticipationContextProvider(config);
+    const history = createParticipationHistoryStore();
+    api.on(
+      "before_dispatch",
+      async (event, ctx) => {
+        const beforeDispatchEvent = event;
+        const beforeDispatchContext = ctx;
+        if (beforeDispatchEvent.wasMentioned === true || beforeDispatchContext.wasMentioned === true) {
+          const recorded = history.recordInbound(
+            beforeDispatchEvent,
+            beforeDispatchContext,
+            config.context.maxMessages
+          );
+          logParticipationHistoryEvent({
+            logger: runtimeApi.logger,
+            config,
+            event: "mention_bypass_inbound",
+            fields: {
+              recorded,
+              provider: beforeDispatchEvent.provider ?? beforeDispatchContext.provider,
+              channel: beforeDispatchContext.channelId ?? beforeDispatchEvent.channel,
+              conversation: beforeDispatchContext.conversationId,
+              session: beforeDispatchContext.sessionKey ?? beforeDispatchEvent.sessionKey,
+              thread: beforeDispatchEvent.messageThreadId ?? beforeDispatchContext.messageThreadId,
+              sender: beforeDispatchEvent.senderId ?? beforeDispatchContext.senderId
+            },
+            content: messageText(beforeDispatchEvent)
+          });
+          return void 0;
+        }
+        const decision2 = await decideParticipation({
+          api: runtimeApi,
+          config,
+          event: beforeDispatchEvent,
+          ctx: beforeDispatchContext,
+          contextProvider,
+          history
+        });
+        logParticipationDecision({
+          logger: runtimeApi.logger,
+          config,
+          decision: decision2,
+          event: beforeDispatchEvent,
+          ctx: beforeDispatchContext
+        });
+        if (!decision2.shouldRespond && config.mode === "enforce") {
+          return { handled: true };
+        }
+        return void 0;
+      },
+      { timeoutMs: config.classifier.timeoutMs + 2e3 }
+    );
+    api.on("message_sent", (event, ctx) => {
+      const messageSentEvent = event;
+      const messageSentContext = ctx;
+      const recorded = history.recordOutbound(messageSentEvent, messageSentContext, config.context.maxMessages);
+      logParticipationHistoryEvent({
+        logger: runtimeApi.logger,
+        config,
+        event: "message_sent_outbound",
+        fields: {
+          recorded,
+          success: messageSentEvent.success,
+          channel: messageSentContext.channelId,
+          conversation: messageSentContext.conversationId ?? messageSentEvent.to,
+          session: messageSentContext.sessionKey ?? messageSentEvent.sessionKey,
+          messageId: messageSentEvent.messageId ?? messageSentContext.messageId
+        },
+        content: messageSentEvent.content
+      });
+      return void 0;
+    });
+  }
+});
+export {
+  PLUGIN_ID,
+  index_default as default
+};