matrix-nodejs-homeserver 0.0.0-stage → 0.3.1

package/dist/core/auth.js

@@ -0,0 +1,237 @@
+import { randomToken } from "./crypto.js";
+import { errors } from "./errors.js";
+import { generateDeviceId } from "./ids.js";
+//#region src/core/auth.ts
+var AuthService = class {
+	hs;
+	cache = /* @__PURE__ */ new Map();
+	constructor(hs) {
+		this.hs = hs;
+		hs.cluster.subscribe("auth", (msg) => {
+			if (msg?.from === hs.instanceId) return;
+			if (msg.token) this.cache.delete(msg.token);
+			if (msg.userId) {
+				for (const [t, s] of this.cache) if (s.userId === msg.userId) this.cache.delete(t);
+			}
+		});
+	}
+	async authenticate(token, ip) {
+		const cached = this.cache.get(token);
+		if (cached) return cached;
+		const row = await this.hs.db.findOne("access_tokens", [{
+			field: "token",
+			value: token
+		}]);
+		if (!row) {
+			if (this.hs.oauth) return this.hs.oauth.authenticate(token);
+			throw errors.unknownToken();
+		}
+		if (row.expires_ts !== null && row.expires_ts < Date.now()) throw errors.unknownToken("Access token expired", true);
+		const user = await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: row.user_id
+		}]);
+		if (!user || user.deactivated) throw errors.unknownToken();
+		const session = {
+			userId: row.user_id,
+			deviceId: row.device_id,
+			accessToken: token,
+			isGuest: !!user.is_guest,
+			isAdmin: !!user.is_admin,
+			locked: !!user.locked,
+			suspended: !!user.suspended
+		};
+		if (row.expires_ts === null) this.cache.set(token, session);
+		await this.hs.db.update("devices", [{
+			field: "user_id",
+			value: row.user_id
+		}, {
+			field: "device_id",
+			value: row.device_id
+		}], {
+			last_seen_ts: Date.now(),
+			last_seen_ip: ip
+		});
+		return session;
+	}
+	/** Create (or reuse) a device and issue a fresh access token for it. */
+	async createSession(userId, opts = {}) {
+		if ((await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}]))?.locked) throw errors.userLocked();
+		const deviceId = opts.deviceId || generateDeviceId();
+		if (await this.hs.db.findOne("devices", [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "device_id",
+			value: deviceId
+		}])) {
+			await this.revokeDeviceTokens(userId, deviceId);
+			if (opts.displayName) await this.hs.db.update("devices", [{
+				field: "user_id",
+				value: userId
+			}, {
+				field: "device_id",
+				value: deviceId
+			}], { display_name: opts.displayName });
+		} else {
+			await this.hs.db.create("devices", {
+				user_id: userId,
+				device_id: deviceId,
+				display_name: opts.displayName ?? null,
+				last_seen_ts: Date.now(),
+				last_seen_ip: null
+			});
+			await this.hs.keys.deviceChanged(userId);
+			await this.hs.audit.record({
+				action: "device_create",
+				actor: userId,
+				target: deviceId
+			});
+		}
+		return this.issueToken(userId, deviceId, !!opts.refreshToken);
+	}
+	async issueToken(userId, deviceId, withRefresh) {
+		const token = `mat_${randomToken()}`;
+		const lifetime = this.hs.config.accessTokenLifetimeMs;
+		const refresh = withRefresh ? `mar_${randomToken()}` : null;
+		await this.hs.db.create("access_tokens", {
+			token,
+			user_id: userId,
+			device_id: deviceId,
+			refresh_token: refresh,
+			expires_ts: refresh && lifetime ? Date.now() + lifetime : null
+		});
+		const out = {
+			user_id: userId,
+			device_id: deviceId,
+			access_token: token
+		};
+		if (refresh) {
+			out.refresh_token = refresh;
+			if (lifetime) out.expires_in_ms = lifetime;
+		}
+		return out;
+	}
+	async refresh(refreshToken) {
+		const row = await this.hs.db.findOne("access_tokens", [{
+			field: "refresh_token",
+			value: refreshToken
+		}]);
+		if (!row) throw errors.unknownToken("Unknown refresh token");
+		await this.hs.db.delete("access_tokens", [{
+			field: "token",
+			value: row.token
+		}]);
+		this.cache.delete(row.token);
+		return this.issueToken(row.user_id, row.device_id, true);
+	}
+	/** Drop cached sessions of a user (after admin/deactivation changes). */
+	async invalidateUser(userId) {
+		for (const [token, s] of this.cache) if (s.userId === userId) this.cache.delete(token);
+		await this.hs.cluster.publish("auth", {
+			from: this.hs.instanceId,
+			userId
+		});
+	}
+	/** Issue a short-lived single-use `m.login.token` for a user (SSO, or host-app sign-in). */
+	async createLoginToken(userId, ttlMs = 12e4) {
+		const token = `mlt_${randomToken()}`;
+		await this.hs.db.create("login_tokens", {
+			token,
+			user_id: userId,
+			expires_ts: Date.now() + ttlMs
+		});
+		return token;
+	}
+	/** Redeem a login token; returns the user ID or throws. */
+	async consumeLoginToken(token) {
+		const row = await this.hs.db.findOne("login_tokens", [{
+			field: "token",
+			value: token
+		}]);
+		if (row) await this.hs.db.delete("login_tokens", [{
+			field: "token",
+			value: token
+		}]);
+		if (!row || row.expires_ts < Date.now()) throw errors.forbidden("Invalid or expired login token");
+		return row.user_id;
+	}
+	async revokeToken(token) {
+		this.hs.oauth?.forget(token);
+		await this.hs.cluster.publish("auth", {
+			from: this.hs.instanceId,
+			token
+		});
+		this.cache.delete(token);
+		await this.hs.db.delete("access_tokens", [{
+			field: "token",
+			value: token
+		}]);
+	}
+	async revokeDeviceTokens(userId, deviceId) {
+		const rows = await this.hs.db.findMany("access_tokens", { where: [{
+			field: "user_id",
+			value: userId
+		}] });
+		for (const row of rows) if (row.device_id === deviceId) await this.revokeToken(row.token);
+	}
+	async deleteDevice(userId, deviceId) {
+		await this.revokeDeviceTokens(userId, deviceId);
+		const where = [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "device_id",
+			value: deviceId
+		}];
+		await this.hs.db.delete("devices", where);
+		await this.hs.db.delete("device_keys", where);
+		await this.hs.db.delete("one_time_keys", where);
+		await this.hs.db.delete("fallback_keys", where);
+		await this.hs.db.delete("to_device", where);
+		await this.hs.db.delete("pushers", where);
+		await this.hs.keys.deviceChanged(userId, deviceId);
+		await this.hs.audit.record({
+			action: "device_delete",
+			actor: userId,
+			target: deviceId
+		});
+		await this.hs.db.delete("account_data", [
+			{
+				field: "user_id",
+				value: userId
+			},
+			{
+				field: "room_id",
+				value: ""
+			},
+			{
+				field: "type",
+				value: `org.matrix.msc3890.local_notification_settings.${deviceId}`
+			}
+		]);
+		await this.hs.keys.markDeviceListChanged(userId);
+	}
+	async deleteAllDevices(userId, except) {
+		const devices = await this.hs.db.findMany("devices", { where: [{
+			field: "user_id",
+			value: userId
+		}] });
+		for (const d of devices) if (d.device_id !== except) await this.deleteDevice(userId, d.device_id);
+	}
+};
+/**
+* Suspended accounts (spec "Account suspension") may read, leave, redact their own events, manage
+* keys and devices, but not join, invite, send or change their profile. Rooms used to talk to the
+* server administration (the admin room, server notices) stay writable.
+*/
+async function assertNotSuspended(hs, session, roomId) {
+	if (!session.suspended) return;
+	if (roomId && (roomId === await hs.adminRoom?.roomId() || await hs.admin.isNoticeRoom(roomId))) return;
+	throw errors.userSuspended();
+}
+//#endregion
+export { AuthService, assertNotSuspended };

package/dist/core/authrules.d.ts

@@ -0,0 +1,4 @@
+import { PDU } from "./events.js";
+//#region src/core/authrules.d.ts
+export type StateMap = Map<string, PDU>;
+//#endregion

package/dist/core/authrules.js

@@ -0,0 +1,348 @@
+import { isObject } from "./json.js";
+import { publicKeyFromBase64, verifyJsonSignature } from "./crypto.js";
+import { M } from "./m.js";
+import { roomVersionFeatures, stateKey, versionNum } from "./events.js";
+import { errors } from "./errors.js";
+import { isValidUserId } from "./ids.js";
+//#region src/core/authrules.ts
+/** MSC3757: the user owning a state key of the form "@user:server" or "@user:server_suffix". */
+function ownerOfStateKey(stateKeyValue) {
+	const key = stateKeyValue;
+	if (!key.startsWith("@")) return null;
+	if (isValidUserId(stateKeyValue)) return stateKeyValue;
+	const colon = key.indexOf(":");
+	if (colon < 0) return null;
+	const underscore = key.indexOf("_", colon);
+	if (underscore < 0) return null;
+	const owner = key.slice(0, underscore);
+	return isValidUserId(owner) ? owner : null;
+}
+function getState(state, type, key = "") {
+	return state.get(stateKey(type, key));
+}
+function membershipOf(state, userId) {
+	return getState(state, M.ROOM.MEMBER, userId)?.content?.membership ?? "leave";
+}
+function roomCreator(state, roomVersion) {
+	const create = getState(state, M.ROOM.CREATE);
+	if (!create) return void 0;
+	return roomVersionFeatures(roomVersion).v11 ? create.sender : create.content.creator ?? create.sender;
+}
+const toInt = (v, fallback) => {
+	if (typeof v === "number" && Number.isFinite(v)) return Math.trunc(v);
+	if (typeof v === "string" && /^\s*[+-]?\d+\s*$/.test(v)) return Number.parseInt(v, 10);
+	return fallback;
+};
+/** v12+: the create event's sender plus `additional_creators`. Empty for older versions. */
+function roomCreators(state, roomVersion) {
+	if (!roomVersionFeatures(roomVersion).v12) return /* @__PURE__ */ new Set();
+	const create = getState(state, M.ROOM.CREATE);
+	if (!create) return /* @__PURE__ */ new Set();
+	const extra = Array.isArray(create.content?.additional_creators) ? create.content.additional_creators : [];
+	return /* @__PURE__ */ new Set([create.sender, ...extra.filter((u) => typeof u === "string")]);
+}
+function powerLevels(state, roomVersion) {
+	const pl = getState(state, M.ROOM.POWER_LEVELS)?.content;
+	const creators = roomCreators(state, roomVersion);
+	if (!pl) {
+		const creator = roomCreator(state, roomVersion);
+		return {
+			creators,
+			users: creator ? { [creator]: 100 } : {},
+			users_default: 0,
+			events: {},
+			events_default: 0,
+			state_default: 0,
+			ban: 50,
+			kick: 50,
+			redact: 50,
+			invite: 0,
+			notifications: { room: 50 }
+		};
+	}
+	const users = {};
+	if (isObject(pl.users)) for (const [u, v] of Object.entries(pl.users)) users[u] = toInt(v, 0);
+	const events = {};
+	if (isObject(pl.events)) for (const [e, v] of Object.entries(pl.events)) events[e] = toInt(v, 0);
+	const notifications = { room: 50 };
+	if (isObject(pl.notifications)) for (const [e, v] of Object.entries(pl.notifications)) notifications[e] = toInt(v, 50);
+	return {
+		creators,
+		users,
+		events,
+		notifications,
+		users_default: toInt(pl.users_default, 0),
+		events_default: toInt(pl.events_default, 0),
+		state_default: toInt(pl.state_default, 50),
+		ban: toInt(pl.ban, 50),
+		kick: toInt(pl.kick, 50),
+		redact: toInt(pl.redact, 50),
+		invite: toInt(pl.invite, 0)
+	};
+}
+function userLevel(pl, userId) {
+	if (pl.creators.has(userId)) return Infinity;
+	return pl.users[userId] ?? pl.users_default;
+}
+function requiredLevel(pl, type, isState) {
+	return pl.events[type] ?? (isState ? pl.state_default : pl.events_default);
+}
+const sameDomain = (a, b) => a.slice(a.indexOf(":") + 1) === b.slice(b.indexOf(":") + 1);
+const domainOf = (id) => id.slice(id.indexOf(":") + 1);
+/** The (type, state_key) pairs an event's auth_events may reference (spec "auth events selection"). */
+function authEventKeys(event, roomVersion) {
+	if (event.type === M.ROOM.CREATE) return [];
+	const keys = [stateKey(M.ROOM.POWER_LEVELS, ""), stateKey(M.ROOM.MEMBER, event.sender)];
+	if (!roomVersionFeatures(roomVersion).v12) keys.unshift(stateKey(M.ROOM.CREATE, ""));
+	if (event.type === M.ROOM.MEMBER && typeof event.state_key === "string") {
+		keys.push(stateKey(M.ROOM.MEMBER, event.state_key));
+		const membership = event.content?.membership;
+		if ([
+			"join",
+			"invite",
+			"knock"
+		].includes(membership)) keys.push(stateKey(M.ROOM.JOIN_RULES, ""));
+		const token = event.content?.third_party_invite?.signed?.token;
+		if (membership === "invite" && typeof token === "string") keys.push(stateKey(M.ROOM.THIRD_PARTY_INVITE, token));
+		const via = event.content?.join_authorised_via_users_server;
+		if (membership === "join" && typeof via === "string" && roomVersionFeatures(roomVersion).restricted) keys.push(stateKey(M.ROOM.MEMBER, via));
+	}
+	return [...new Set(keys)];
+}
+/**
+* Build the auth state for an event from its auth_events, validating rule 2 of the
+* authorization rules (no duplicates, only expected types). For v12 the create event
+* (identified by the room ID) must be supplied separately.
+*/
+function authStateFromAuthEvents(event, authEvents, roomVersion, createEvent) {
+	const allowed = new Set(authEventKeys(event, roomVersion));
+	const state = /* @__PURE__ */ new Map();
+	for (const ev of authEvents) {
+		if (ev.state_key === void 0) throw errors.forbidden("Auth event is not a state event");
+		const key = stateKey(ev.type, ev.state_key);
+		if (state.has(key)) throw errors.forbidden("Duplicate auth event");
+		if (!allowed.has(key)) throw errors.forbidden(`Unexpected auth event ${ev.type}`);
+		if (roomVersionFeatures(roomVersion).v12 && ev.type === M.ROOM.CREATE) throw errors.forbidden("Create event must not be in auth_events");
+		state.set(key, ev);
+	}
+	if (createEvent) state.set(stateKey(M.ROOM.CREATE, ""), createEvent);
+	return state;
+}
+/**
+* The Matrix authorization rules: throws M_FORBIDDEN if `event` is not allowed
+* given `state` (either its auth events or the state before it).
+*/
+function checkAuth(event, state, roomVersion, opts = {}) {
+	const features = roomVersionFeatures(roomVersion);
+	const n = versionNum(roomVersion);
+	const deny = (msg) => {
+		throw errors.forbidden(msg);
+	};
+	if (event.type === M.ROOM.CREATE) {
+		if (state.size > 0 || Array.isArray(event.prev_events) && event.prev_events.length > 0) deny("Create event must be the first event");
+		if (!features.v12 && event.room_id && !sameDomain(event.room_id, event.sender)) deny("Room ID domain must match the creator");
+		const rv = event.content?.room_version;
+		if (rv !== void 0 && (typeof rv !== "string" || !Number.isFinite(versionNum(rv)))) deny("Unknown room version");
+		if (!features.v11 && typeof event.content?.creator !== "string") deny("Create event lacks a creator");
+		if (features.v12) {
+			const extra = event.content?.additional_creators;
+			if (extra !== void 0 && (!Array.isArray(extra) || !extra.every(isValidUserId))) deny("Invalid additional_creators");
+		}
+		return;
+	}
+	const create = getState(state, M.ROOM.CREATE);
+	if (!create) deny("No create event in room");
+	if (create.content?.[M.FEDERATE] === false && !sameDomain(event.sender, create.sender)) deny("Room is not federated");
+	if (n <= 5 && event.type === M.ROOM.ALIASES) {
+		if (event.state_key === void 0) deny("Aliases event lacks a state key");
+		if (event.state_key !== domainOf(event.sender)) deny("Aliases state key must be the sender's domain");
+		return;
+	}
+	const pl = powerLevels(state, roomVersion);
+	const senderMembership = membershipOf(state, event.sender);
+	const senderLevel = userLevel(pl, event.sender);
+	if (event.type === M.ROOM.MEMBER) {
+		const target = event.state_key;
+		const membership = event.content?.membership;
+		if (typeof target !== "string" || typeof membership !== "string") deny("Member event lacks state_key or membership");
+		const targetMembership = membershipOf(state, target);
+		const joinRule = getState(state, M.ROOM.JOIN_RULES)?.content?.join_rule ?? "invite";
+		const via = event.content?.join_authorised_via_users_server;
+		switch (membership) {
+			case "join": {
+				const prev = Array.isArray(event.prev_events) ? event.prev_events.map((p) => Array.isArray(p) ? p[0] : p) : [];
+				const creator = roomCreator(state, roomVersion);
+				if (prev.length === 1 && prev[0] === create.event_id && target === creator && event.sender === target) return;
+				if (state.size === 1 && creator === target && event.sender === target) return;
+				if (event.sender !== target) deny("Cannot force another user to join");
+				if (targetMembership === "ban") deny("User is banned from the room");
+				if (joinRule === "invite" || features.knock && joinRule === "knock") {
+					if (targetMembership === "join" || targetMembership === "invite") return;
+					deny("You are not invited to this room");
+				}
+				if (features.restricted && joinRule === "restricted" || features.knockRestricted && joinRule === "knock_restricted") {
+					if (targetMembership === "join" || targetMembership === "invite") return;
+					if (typeof via === "string" && opts.joinAuthorisedSignatureValid === false) deny("join_authorised_via_users_server is not signed by that server");
+					if (typeof via === "string" && membershipOf(state, via) === "join" && userLevel(pl, via) >= pl.invite) return;
+					deny("Join not authorised by restricted join rules");
+				}
+				if (joinRule === "public") return;
+				deny("You are not allowed to join this room");
+				break;
+			}
+			case "invite":
+				if (event.content?.third_party_invite !== void 0) {
+					if (targetMembership === "ban") deny("User is banned");
+					if (!checkThirdPartyInvite(event, state)) deny("Invalid third party invite");
+					return;
+				}
+				if (senderMembership !== "join") deny("Sender not in room");
+				if (targetMembership === "join" || targetMembership === "ban") deny(`User is already ${targetMembership === "join" ? "joined" : "banned"}`);
+				if (senderLevel >= pl.invite) return;
+				deny("Insufficient power level to invite");
+				break;
+			case "leave":
+				if (event.sender === target) {
+					if (targetMembership === "join" || targetMembership === "invite" || features.knock && targetMembership === "knock") return;
+					deny("User is not in the room");
+				}
+				if (senderMembership !== "join") deny("Sender not in room");
+				if (targetMembership === "ban" && senderLevel < pl.ban) deny("Insufficient power level to unban");
+				if (senderLevel >= pl.kick && userLevel(pl, target) < senderLevel) return;
+				deny("Insufficient power level to kick");
+				break;
+			case "ban":
+				if (senderMembership !== "join") deny("Sender not in room");
+				if (senderLevel >= pl.ban && userLevel(pl, target) < senderLevel) return;
+				deny("Insufficient power level to ban");
+				break;
+			case "knock":
+				if (!features.knock) deny("Knocking is not supported in this room version");
+				if (joinRule !== "knock" && !(features.knockRestricted && joinRule === "knock_restricted")) deny("Room does not allow knocking");
+				if (event.sender !== target) deny("Cannot knock on behalf of another user");
+				if (targetMembership === "ban" || targetMembership === "join" || targetMembership === "invite") deny(`Cannot knock while ${targetMembership}`);
+				return;
+			default: deny("Unknown membership");
+		}
+		return;
+	}
+	if (senderMembership !== "join") deny("You are not joined to this room");
+	if (event.type === M.ROOM.THIRD_PARTY_INVITE) {
+		if (senderLevel >= pl.invite) return;
+		deny("Insufficient power level to invite");
+	}
+	const isState = event.state_key !== void 0;
+	if (senderLevel < requiredLevel(pl, event.type, isState)) deny("Insufficient power level to send this event");
+	if (isState && event.state_key.startsWith("@") && event.state_key !== event.sender) {
+		if (!features.ownedState) deny("State keys starting with @ are reserved for that user");
+		const owner = ownerOfStateKey(event.state_key);
+		if (!owner) deny("Malformed user-owned state key");
+		if (owner !== event.sender && senderLevel <= userLevel(pl, owner)) deny("This state key belongs to another user");
+	}
+	if (event.type === M.ROOM.POWER_LEVELS && isState) {
+		if (isObject(event.content?.users)) for (const u of Object.keys(event.content.users)) {
+			if (!isValidUserId(u)) deny("Power level users must be valid user IDs");
+			if (pl.creators.has(u)) deny("Room creators cannot be given a power level");
+		}
+		if (getState(state, M.ROOM.POWER_LEVELS)) checkPowerLevelChange(event, pl, senderLevel, features.integerPowerLevels, n >= 6, deny);
+		else checkPowerLevelShape(event, features.integerPowerLevels, deny);
+		return;
+	}
+	if (n <= 2 && event.type === M.ROOM.REDACTION) {
+		if (senderLevel >= pl.redact) return;
+		const redacts = event.redacts;
+		if (typeof redacts === "string" && redacts.includes(":") && domainOf(redacts) === domainOf(event.sender)) return;
+		deny("Insufficient power level to redact");
+	}
+}
+function checkThirdPartyInvite(event, state) {
+	const signed = event.content?.third_party_invite?.signed;
+	if (!isObject(signed) || typeof signed.mxid !== "string" || typeof signed.token !== "string") return false;
+	if (signed.mxid !== event.state_key) return false;
+	const invite = getState(state, M.ROOM.THIRD_PARTY_INVITE, signed.token);
+	if (!invite || invite.sender !== event.sender) return false;
+	const keys = [];
+	if (typeof invite.content?.public_key === "string") keys.push(invite.content.public_key);
+	for (const k of Array.isArray(invite.content?.public_keys) ? invite.content.public_keys : []) if (typeof k?.public_key === "string") keys.push(k.public_key);
+	for (const key of keys) {
+		let pub;
+		try {
+			pub = publicKeyFromBase64(key);
+		} catch {
+			continue;
+		}
+		for (const [server, sigs] of Object.entries(isObject(signed.signatures) ? signed.signatures : {})) for (const keyId of Object.keys(isObject(sigs) ? sigs : {})) if (verifyJsonSignature(signed, server, keyId, pub)) return true;
+	}
+	return false;
+}
+function checkPowerLevelShape(event, integerOnly, deny) {
+	if (!integerOnly) return;
+	const c = event.content ?? {};
+	const isInt = (v) => typeof v === "number" && Number.isInteger(v);
+	for (const key of [
+		"users_default",
+		"events_default",
+		"state_default",
+		"ban",
+		"redact",
+		"kick",
+		"invite"
+	]) if (key in c && !isInt(c[key])) deny(`${key} must be an integer`);
+	for (const map of [
+		"users",
+		"events",
+		"notifications"
+	]) {
+		if (map in c && !isObject(c[map])) deny(`${map} must be an object`);
+		if (isObject(c[map])) {
+			for (const v of Object.values(c[map])) if (!isInt(v)) deny(`${map} values must be integers`);
+		}
+	}
+}
+function checkPowerLevelChange(event, current, senderLevel, integerOnly, checkNotifications, deny) {
+	const c = event.content ?? {};
+	checkPowerLevelShape(event, integerOnly, deny);
+	if (!integerOnly) {
+		for (const map of [
+			"users",
+			"events",
+			"notifications"
+		]) if (map in c && !isObject(c[map])) deny(`${map} must be an object`);
+	}
+	const next = {
+		users_default: toInt(c.users_default, 0),
+		events_default: toInt(c.events_default, 0),
+		state_default: toInt(c.state_default, 50),
+		ban: toInt(c.ban, 50),
+		redact: toInt(c.redact, 50),
+		kick: toInt(c.kick, 50),
+		invite: toInt(c.invite, 0)
+	};
+	for (const key of Object.keys(next)) {
+		const old = current[key];
+		if (old !== next[key] && (old > senderLevel || next[key] > senderLevel)) deny(`Cannot change ${key} beyond your own level`);
+	}
+	const compareMap = (oldMap, newMap, isUsers) => {
+		const keys = /* @__PURE__ */ new Set([...Object.keys(oldMap), ...Object.keys(newMap ?? {})]);
+		for (const k of keys) {
+			const o = oldMap[k];
+			const nv = newMap?.[k] === void 0 ? void 0 : toInt(newMap[k], 0);
+			if (o === nv) continue;
+			if (isUsers) {
+				if (k !== event.sender && o !== void 0 && o >= senderLevel) deny("Cannot change the level of a user with equal or higher power");
+				if (nv !== void 0 && nv > senderLevel) deny("Cannot set a level above your own");
+			} else {
+				if (o !== void 0 && o > senderLevel) deny("Cannot change a level above your own");
+				if (nv !== void 0 && nv > senderLevel) deny("Cannot set a level above your own");
+			}
+		}
+	};
+	compareMap(current.users, c.users ?? {}, true);
+	compareMap(current.events, c.events ?? {}, false);
+	if (checkNotifications) compareMap({ ...current.notifications }, {
+		room: 50,
+		...c.notifications
+	}, false);
+}
+//#endregion
+export { authEventKeys, authStateFromAuthEvents, checkAuth, getState, membershipOf, ownerOfStateKey, powerLevels, requiredLevel, roomCreator, roomCreators, userLevel };

package/dist/core/cluster.d.ts

@@ -0,0 +1,66 @@
+//#region src/core/cluster.d.ts
+/**
+ * Coordination between homeserver instances sharing one database. The default
+ * (`localCluster()`) keeps everything in process; use `postgresCluster()` or
+ * `redisCluster()` to run several instances behind a load balancer.
+ */
+export interface ClusterAdapter {
+  /** Allocate the next value of a cluster-wide, strictly increasing sequence. */
+  nextId(sequence: string): Promise<number>;
+  /** Current (latest allocated) value of a sequence. */
+  currentId(sequence: string): Promise<number>;
+  /** Ensure a sequence is at least `value` (used at startup with existing data). */
+  advance(sequence: string, value: number): Promise<void>;
+  /** Run `fn` while holding a cluster-wide mutex for `key`. */
+  lock<T>(key: string, fn: () => Promise<T>): Promise<T>;
+  publish(channel: string, message: unknown): Promise<void>;
+  subscribe(channel: string, handler: (message: any) => void): void;
+  /** Ephemeral shared key-value storage. */
+  get<T = unknown>(key: string): Promise<T | null>;
+  set(key: string, value: unknown, ttlMs?: number): Promise<void>;
+  /** Set only if the key is absent (or expired). Returns true when the value was set. */
+  setIfAbsent(key: string, value: unknown, ttlMs?: number): Promise<boolean>;
+  delete(key: string): Promise<void>;
+  /** All live entries whose key starts with `prefix`. */
+  entries<T = unknown>(prefix: string): Promise<[string, T][]>;
+  close?(): Promise<void>;
+}
+/** In-process cluster adapter: a single homeserver instance. */
+export declare function localCluster(): ClusterAdapter;
+export interface StreamLease {
+  id: number;
+  /** Mark the position as persisted (or abandoned). */
+  done(): Promise<void>;
+}
+/**
+ * Stream positions with multiple writers. Positions are allocated from a global
+ * sequence; readers only see positions up to which every writer has finished, so
+ * an event committed late with a lower position can never be skipped by /sync.
+ *
+ * Each writer publishes `{ busy, pos }`: when busy, all of its positions ≤ pos are
+ * persisted. Readers use min(global, busy writers' pos).
+ */
+export declare class StreamManager {
+  private cluster;
+  private instanceId;
+  private inflight;
+  private published;
+  private transition;
+  private heartbeat;
+  private positionCache;
+  constructor(cluster: ClusterAdapter, instanceId: string);
+  private key;
+  private publishState;
+  /** Allocate a position. The caller must call `done()` once its writes are committed. */
+  allocate(): Promise<StreamLease>;
+  /** Allocate a position, run `fn` with it, then complete it. */
+  write<T>(fn: (id: number) => Promise<T>): Promise<T>;
+  /** A fresh decreasing position for backfilled (historical) events. */
+  backfillId(): Promise<number>;
+  /** The highest position below which everything is persisted, cluster-wide. */
+  position(): Promise<number>;
+  advanceTo(value: number): Promise<void>;
+  lowerBackfillTo(value: number): Promise<void>;
+  stop(): Promise<void>;
+}
+//#endregion