matrix-nodejs-homeserver 0.2.0 → 0.3.1

package/dist/federation/index.js

@@ -1,5 +1,6 @@
 import { isObject } from "../core/json.js";
 import { unpaddedBase64, urlSafeBase64 } from "../core/crypto.js";
+import { M } from "../core/m.js";
 import { SUPPORTED_ROOM_VERSIONS, computeContentHash, computeReferenceHash, eventIdOf, finalisePdu, redact, roomVersionFeatures, splitStateKey, stateKey, stripState } from "../core/events.js";
 import { MatrixError, errors } from "../core/errors.js";
 import { parseId } from "../core/ids.js";
@@ -14,7 +15,7 @@ import { TransactionSender } from "./sender.js";
 const domainOf = (id) => id.slice(id.indexOf(":") + 1);
 /** Server ACL check (m.room.server_acl). */
 function serverAllowedByAcl(state, serverName) {
-	const acl = getState(state, "m.room.server_acl")?.content;
+	const acl = getState(state, M.ROOM.SERVER_ACL)?.content;
 	if (!isObject(acl)) return true;
 	const host = serverName.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
 	if (acl.allow_ip_literals === false && (/^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(":"))) return false;
@@ -37,7 +38,7 @@ var FederationService = class {
 	constructor(hs, options = {}) {
 		this.hs = hs;
 		this.options = options;
-		this.enabled = options.enabled !== false;
+		this.enabled = options.enabled === true;
 		this.fasterJoins = options.fasterJoins !== false;
 		this.client = new FederationClient(hs, { rejectUnauthorized: options.verifyTls !== false });
 		this.keyring = new KeyRing(hs);
@@ -57,7 +58,7 @@ var FederationService = class {
 		const out = { ...rest };
 		const f = roomVersionFeatures(version);
 		if (!f.legacyEventIds) delete out.event_id;
-		if (f.v12 && out.type === "m.room.create") delete out.room_id;
+		if (f.v12 && out.type === M.ROOM.CREATE) delete out.room_id;
 		return out;
 	}
 	computeEventId(raw, version) {
@@ -73,7 +74,7 @@ var FederationService = class {
 	async verifyPdu(raw, version, roomId) {
 		if (!isObject(raw) || typeof raw.type !== "string" || typeof raw.sender !== "string" || !isObject(raw.content)) throw errors.badJson("Malformed PDU");
 		const f = roomVersionFeatures(version);
-		if (!f.v12 || raw.type !== "m.room.create") {
+		if (!f.v12 || raw.type !== M.ROOM.CREATE) {
 			if (raw.room_id !== roomId) throw errors.badJson("PDU room_id mismatch");
 		}
 		const eventId = this.computeEventId(raw, version);
@@ -84,7 +85,7 @@ var FederationService = class {
 		if (f.legacyEventIds && domainOf(eventId) !== senderDomain && !await this.keyring.verifySignedBy(redacted, domainOf(eventId))) throw errors.forbidden(`Event ${eventId} is not signed by its origin`);
 		let joinAuthorisedSignatureValid;
 		const via = raw.content?.join_authorised_via_users_server;
-		if (f.restricted && raw.type === "m.room.member" && raw.content?.membership === "join" && typeof via === "string" && via.includes(":")) joinAuthorisedSignatureValid = await this.keyring.verifySignedBy(redacted, domainOf(via));
+		if (f.restricted && raw.type === M.ROOM.MEMBER && raw.content?.membership === "join" && typeof via === "string" && via.includes(":")) joinAuthorisedSignatureValid = await this.keyring.verifySignedBy(redacted, domainOf(via));
 		let pdu = {
 			...raw,
 			event_id: eventId
@@ -93,7 +94,7 @@ var FederationService = class {
 			...redact(raw, version),
 			event_id: eventId
 		};
-		if (f.v12 && pdu.type === "m.room.create") pdu.room_id = roomId;
+		if (f.v12 && pdu.type === M.ROOM.CREATE) pdu.room_id = roomId;
 		return {
 			pdu,
 			joinAuthorisedSignatureValid
@@ -104,7 +105,7 @@ var FederationService = class {
 		const servers = /* @__PURE__ */ new Set();
 		for (const [key, ev] of state) {
 			const [type, userId] = splitStateKey(key);
-			if (type === "m.room.member" && ev.content?.membership === "join") servers.add(domainOf(userId));
+			if (type === M.ROOM.MEMBER && ev.content?.membership === "join") servers.add(domainOf(userId));
 		}
 		servers.delete(this.hs.serverName);
 		for (const s of servers) if (!this.serverAllowed(s) || applyAcl && !serverAllowedByAcl(state, s)) servers.delete(s);
@@ -123,8 +124,8 @@ var FederationService = class {
 	onLocalEvent(pdu, state) {
 		if (!this.enabled) return;
 		(async () => {
-			const destinations = await this.roomDestinations(pdu.room_id, state, pdu.type !== "m.room.server_acl");
-			if (pdu.type === "m.room.member" && typeof pdu.state_key === "string" && !this.hs.isLocalUser(pdu.state_key)) destinations.add(domainOf(pdu.state_key));
+			const destinations = await this.roomDestinations(pdu.room_id, state, pdu.type !== M.ROOM.SERVER_ACL);
+			if (pdu.type === M.ROOM.MEMBER && typeof pdu.state_key === "string" && !this.hs.isLocalUser(pdu.state_key)) destinations.add(domainOf(pdu.state_key));
 			if (!destinations.size) return;
 			const version = await this.hs.rooms.roomVersion(pdu.room_id) ?? "10";
 			await this.sender.sendPdu(destinations, this.toFederationPdu(pdu, version));
@@ -147,17 +148,17 @@ var FederationService = class {
 		return out;
 	}
 	async onTyping(roomId, userId, typing) {
-		if (this.hs.isLocalUser(userId)) await this.sendEduToRooms([roomId], "m.typing", {
+		if (this.hs.isLocalUser(userId)) await this.sendEduToRooms([roomId], M.TYPING, {
 			room_id: roomId,
 			user_id: userId,
 			typing
 		}, false);
 	}
 	async onReceipt(roomId, userId, receiptType, eventId, ts, threadId) {
-		if (!this.hs.isLocalUser(userId) || receiptType === "m.read.private") return;
+		if (!this.hs.isLocalUser(userId) || receiptType === M.READ.PRIVATE) return;
 		const data = { ts };
 		if (threadId) data.thread_id = threadId;
-		await this.sendEduToRooms([roomId], "m.receipt", { [roomId]: { [receiptType]: { [userId]: {
+		await this.sendEduToRooms([roomId], M.RECEIPT, { [roomId]: { [receiptType]: { [userId]: {
 			event_ids: [eventId],
 			data
 		} } } });
@@ -166,7 +167,7 @@ var FederationService = class {
 		if (!this.enabled || !this.hs.isLocalUser(userId)) return;
 		const servers = await this.serversSharingRooms(userId);
 		if (!servers.size) return;
-		await this.sender.sendEdu(servers, "m.presence", { push: [{
+		await this.sender.sendEdu(servers, M.PRESENCE, { push: [{
 			user_id: userId,
 			presence,
 			last_active_ago: 0,
@@ -217,7 +218,7 @@ var FederationService = class {
 				const d = devices.find((x) => x.device_id === u.deviceId);
 				if (d?.display_name) content.device_display_name = d.display_name;
 			}
-			await this.sender.sendEdu(servers, "m.device_list_update", content);
+			await this.sender.sendEdu(servers, M.DEVICE_LIST_UPDATE, content);
 		}
 	}
 	async onSigningKeyUpdate(userId) {
@@ -230,7 +231,7 @@ var FederationService = class {
 		}] });
 		const content = { user_id: userId };
 		for (const r of rows) if (r.key_type !== "user_signing") content[`${r.key_type}_key`] = r.key;
-		await this.sender.sendEdu(servers, "m.signing_key_update", content);
+		await this.sender.sendEdu(servers, M.SIGNING_KEY_UPDATE, content);
 	}
 	/** Deliver to-device messages addressed to remote users. */
 	async sendToDevice(sender, type, messages, messageId) {
@@ -241,7 +242,7 @@ var FederationService = class {
 			if (server === this.hs.serverName || !this.serverAllowed(server)) continue;
 			(byServer.get(server) ?? byServer.set(server, {}).get(server))[userId] = devices;
 		}
-		for (const [server, msgs] of byServer) await this.sender.sendEdu([server], "m.direct_to_device", {
+		for (const [server, msgs] of byServer) await this.sender.sendEdu([server], M.DIRECT_TO_DEVICE, {
 			sender,
 			type,
 			message_id: `${messageId}-${server}`,
@@ -301,7 +302,7 @@ var FederationService = class {
 	* rescinded or their knock being accepted/rejected.
 	*/
 	async handleOutOfRoomMembership(origin, roomId, raw) {
-		if (raw?.type !== "m.room.member" || typeof raw.state_key !== "string" || !this.hs.isLocalUser(raw.state_key)) throw errors.notFound("Unknown room");
+		if (raw?.type !== M.ROOM.MEMBER || typeof raw.state_key !== "string" || !this.hs.isLocalUser(raw.state_key)) throw errors.notFound("Unknown room");
 		const row = await this.hs.db.findOne("memberships", [{
 			field: "room_id",
 			value: roomId
@@ -311,7 +312,7 @@ var FederationService = class {
 		}]);
 		if (!row) throw errors.notFound("Unknown room");
 		const previous = await this.hs.rooms.getPdu(row.event_id);
-		const create = (previous?.unsigned?.invite_room_state ?? previous?.unsigned?.knock_room_state ?? []).find((e) => e?.type === "m.room.create");
+		const create = (previous?.unsigned?.invite_room_state ?? previous?.unsigned?.knock_room_state ?? []).find((e) => e?.type === M.ROOM.CREATE);
 		const version = typeof create?.content?.room_version === "string" ? create.content.room_version : "1";
 		const { pdu } = await this.verifyPdu(raw, version, roomId);
 		if (domainOf(pdu.sender) !== origin && domainOf(pdu.sender) !== domainOf(raw.state_key)) throw errors.forbidden("Unexpected sender");
@@ -571,7 +572,7 @@ var FederationService = class {
 			authPdus.push(p);
 		}
 		try {
-			const create = roomVersionFeatures(version).v12 && pdu.type !== "m.room.create" ? await this.hs.rooms.getPdu(`$${roomId.slice(1)}`) ?? void 0 : void 0;
+			const create = roomVersionFeatures(version).v12 && pdu.type !== M.ROOM.CREATE ? await this.hs.rooms.getPdu(`$${roomId.slice(1)}`) ?? void 0 : void 0;
 			checkAuth(pdu, authStateFromAuthEvents(pdu, authPdus, version, create), version);
 			return null;
 		} catch (err) {
@@ -592,7 +593,7 @@ var FederationService = class {
 		const content = edu?.content;
 		if (!isObject(content)) return;
 		switch (edu.edu_type) {
-			case "m.typing": {
+			case M.TYPING: {
 				const { room_id, user_id, typing } = content;
 				if (typeof user_id !== "string" || domainOf(user_id) !== origin || typeof room_id !== "string") return;
 				if (!await this.hs.rooms.exists(room_id) || !await this.mayActInRoom(room_id, user_id, origin)) return;
@@ -600,12 +601,12 @@ var FederationService = class {
 				await this.hs.typing.setTyping(room_id, user_id, !!typing, typeof content.timeout === "number" ? content.timeout : 3e4);
 				return;
 			}
-			case "m.receipt":
+			case M.RECEIPT:
 				for (const [roomId, byType] of Object.entries(content)) {
 					if (!isObject(byType) || !await this.hs.rooms.exists(roomId)) continue;
 					if (!serverAllowedByAcl(await this.hs.rooms.currentState(roomId), origin)) continue;
 					for (const [receiptType, byUser] of Object.entries(byType)) {
-						if (!["m.read", "m.read.private"].includes(receiptType) || !isObject(byUser)) continue;
+						if (receiptType !== M.READ._ && receiptType !== M.READ.PRIVATE || !isObject(byUser)) continue;
 						for (const [userId, r] of Object.entries(byUser)) {
 							if (domainOf(userId) !== origin || !isObject(r) || !Array.isArray(r.event_ids)) continue;
 							if (!await this.mayActInRoom(roomId, userId, origin)) continue;
@@ -625,7 +626,7 @@ var FederationService = class {
 					this.hs.notifier.notify(await this.hs.rooms.joinedMembers(roomId));
 				}
 				return;
-			case "m.presence":
+			case M.PRESENCE:
 				for (const p of Array.isArray(content.push) ? content.push : []) {
 					if (!isObject(p) || typeof p.user_id !== "string" || domainOf(p.user_id) !== origin) continue;
 					if (![
@@ -643,7 +644,7 @@ var FederationService = class {
 					this.hs.notifier.notify(await this.hs.rooms.usersSharingRooms(p.user_id));
 				}
 				return;
-			case "m.device_list_update": {
+			case M.DEVICE_LIST_UPDATE: {
 				const userId = content.user_id;
 				if (typeof userId !== "string" || domainOf(userId) !== origin || typeof content.device_id !== "string") return;
 				const known = await this.hs.db.findOne("remote_device_lists", [{
@@ -655,7 +656,7 @@ var FederationService = class {
 				if (known || content.deleted || isObject(content.keys)) await this.hs.keys.markDeviceListChanged(userId);
 				return;
 			}
-			case "m.signing_key_update": {
+			case M.SIGNING_KEY_UPDATE: {
 				const userId = content.user_id;
 				if (typeof userId !== "string" || domainOf(userId) !== origin) return;
 				for (const type of ["master", "self_signing"]) {
@@ -671,7 +672,7 @@ var FederationService = class {
 				await this.hs.keys.markDeviceListChanged(userId);
 				return;
 			}
-			case "m.direct_to_device": {
+			case M.DIRECT_TO_DEVICE: {
 				const { sender, type, message_id, messages } = content;
 				if (typeof sender !== "string" || domainOf(sender) !== origin || typeof type !== "string" || !isObject(messages)) return;
 				if (!await this.hs.cluster.setIfAbsent(`fedtodevice:${origin}|${message_id}`, true, 864e5)) return;
@@ -751,7 +752,7 @@ var FederationService = class {
 			const pdu = await this.hs.rooms.getPdu(id);
 			if (!pdu) continue;
 			stateIds[stateKey(pdu.type, pdu.state_key)] = id;
-			if (pdu.type === "m.room.create") create = pdu;
+			if (pdu.type === M.ROOM.CREATE) create = pdu;
 		}
 		if (!create) throw errors.badJson("send_join response lacks the create event");
 		if (!await this.hs.rooms.exists(roomId)) await this.hs.db.upsert("rooms", {
@@ -993,14 +994,14 @@ var FederationService = class {
 		const out = /* @__PURE__ */ new Set();
 		for (const [key, ev] of state) {
 			const [type, userId] = splitStateKey(key);
-			if (type === "m.room.member" && ev.content?.membership === "join") out.add(domainOf(userId));
+			if (type === M.ROOM.MEMBER && ev.content?.membership === "join") out.add(domainOf(userId));
 		}
 		return [...out];
 	}
 	isMembershipVisibleTo(state, server) {
 		for (const [key] of state) {
 			const [type, userId] = splitStateKey(key);
-			if (type === "m.room.member" && domainOf(userId) === server && membershipOf(state, userId) === "join") return true;
+			if (type === M.ROOM.MEMBER && domainOf(userId) === server && membershipOf(state, userId) === "join") return true;
 		}
 		return false;
 	}

package/dist/homeserver.d.ts

@@ -3,6 +3,7 @@ import { SigningKey } from "./core/crypto.js";
 import { PolicyServers } from "./core/policy.js";
 import { ThreepidOptions, ThreepidService } from "./core/threepid.js";
 import { IdentityServers } from "./core/identity.js";
+import { M } from "./core/m.js";
 import { AppServiceRegistration, AppServiceService } from "./core/appservices.js";
 import { AuthService } from "./core/auth.js";
 import { KeyService } from "./core/keys.js";
@@ -52,7 +53,7 @@ export interface HomeserverOptions {
   /** Contacts and page served at `/.well-known/matrix/support` (e.g. to appeal a locked account). */
   support?: {
     contacts?: {
-      role: "m.role.admin" | "m.role.security" | (string & {});
+      role: typeof M.ROLE.ADMIN | typeof M.ROLE.SECURITY | (string & {});
       matrix_id?: string;
       email_address?: string;
     }[];

package/dist/homeserver.js

@@ -1,4 +1,5 @@
 import { loadSigningKey, randomString } from "./core/crypto.js";
+import "./core/m.js";
 import { SUPPORTED_ROOM_VERSIONS } from "./core/events.js";
 import { PartialStateService } from "./core/partialstate.js";
 import { RoomService } from "./core/rooms.js";

package/dist/http/handler.js

@@ -1,6 +1,6 @@
 import { canonicalJson } from "../core/json.js";
+import { UNSTABLE } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
-import { inputError } from "./input.js";
 //#region src/http/handler.ts
 const CORS_HEADERS = {
 	"access-control-allow-origin": "*",
@@ -95,7 +95,7 @@ async function dispatch(hs, request, url, options) {
 					const reg = hs.appservices.byToken(t);
 					if (reg) {
 						const userId = await hs.appservices.masquerade(reg, url.searchParams.get("user_id"));
-						const deviceId = url.searchParams.get("device_id") ?? url.searchParams.get("org.matrix.msc3202.device_id");
+						const deviceId = url.searchParams.get("device_id") ?? url.searchParams.get(UNSTABLE.ORG.MATRIX.MSC3202.DEVICE_ID);
 						if (deviceId && !await hs.db.findOne("devices", [{
 							field: "user_id",
 							value: userId
@@ -124,33 +124,12 @@ async function dispatch(hs, request, url, options) {
 			async optionalAuth() {
 				return token() ? ctx.auth() : null;
 			},
-			input: void 0,
 			async rateLimit(action) {
 				const s = token() ? await ctx.auth().catch(() => null) : null;
 				if (s?.isAdmin || s?.appservice && s.appservice.rate_limited === false) return;
 				await hs.rateLimits.check(action, s?.userId ?? ctx.ip ?? "unknown");
 			}
 		};
-		if (matched.input) {
-			const schema = matched.input;
-			let raw;
-			let readError;
-			try {
-				raw = await ctx.json();
-			} catch (err) {
-				readError = err;
-			}
-			let parsed = null;
-			Object.defineProperty(ctx, "input", { get() {
-				if (readError) throw readError;
-				if (!parsed) {
-					const result = schema.safeParse(raw);
-					if (!result.success) throw inputError(result.error);
-					parsed = { data: result.data };
-				}
-				return parsed.data;
-			} });
-		}
 		const result = await matched.handler(ctx);
 		if (result instanceof Response) return withCors(result);
 		return jsonResponse(result ?? {});

package/dist/http/input.js

@@ -1,8 +1,8 @@
 import { MatrixError } from "../core/errors.js";
-import { z } from "zod";
+import { looseObject } from "../vendor/zod/v4/classic/schemas.js";
 //#region src/http/input.ts
 /** A request body: a JSON object whose unknown keys are kept. */
-const body = (shape) => z.looseObject(shape);
+const body = (shape) => looseObject(shape);
 /**
 * Errors carry their Matrix errcode in the message, as `M_CODE: text`: `fail` builds the zod
 * error option for a field. Without one, a missing field is M_MISSING_PARAM and any other

package/dist/http/procedure.js

@@ -0,0 +1,25 @@
+import { inputError } from "./input.js";
+//#region src/http/procedure.ts
+function procedure(def) {
+	return async (ctx) => {
+		const session = def.auth === "user" ? await ctx.auth() : def.auth === "optional" ? await ctx.optionalAuth() : void 0;
+		const extra = def.guard ? await def.guard(ctx) : {};
+		if (def.rateLimit) await ctx.rateLimit(def.rateLimit);
+		let input;
+		if (def.input) {
+			const parsed = def.input.safeParse(await ctx.json());
+			if (!parsed.success) throw inputError(parsed.error);
+			input = parsed.data;
+		}
+		const result = await def.handler(Object.assign(ctx, extra, {
+			session,
+			input
+		}));
+		if (!def.output || result instanceof Response) return result;
+		const checked = def.output.safeParse(result);
+		if (!checked.success) throw new Error(`Response does not match the output schema: ${checked.error.message}`);
+		return checked.data;
+	};
+}
+//#endregion
+export { procedure };

package/dist/http/router.d.ts

@@ -1,10 +1,9 @@
 import { Session } from "../core/auth.js";
 import { RateLimitAction } from "../core/ratelimit.js";
 import { Homeserver } from "../homeserver.js";
-import { z } from "zod";
 //#region src/http/router.d.ts
 export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE";
-export interface RequestContext<I = unknown> {
+export interface RequestContext {
   hs: Homeserver;
   request: Request;
   url: URL;
@@ -23,38 +22,22 @@ export interface RequestContext<I = unknown> {
   accessToken(): string | null;
   /** Apply the rate limit for `action` to the requesting user (or IP when unauthenticated). */
   rateLimit(action: RateLimitAction): Promise<void>;
-  /**
-   * The request body parsed with the route's `input` schema (undefined for routes without one).
-   * Validated on first access, which throws the Matrix error for an invalid body: read it where
-   * the handler needs the body, after authenticating.
-   */
-  input: I;
 }
 export type HandlerResult = Response | object | void;
-export type Handler<I = any> = (ctx: RequestContext<I>) => Promise<HandlerResult> | HandlerResult;
-/** Per-route options. `input` validates and parses the JSON body before the handler runs. */
-export interface RouteOptions<S extends z.ZodType = z.ZodType> {
-  input?: S;
-}
-/** A route's handler, with the body type its `input` schema produces. */
-type Routed<S> = S extends z.ZodType ? Handler<z.output<S>> : Handler;
+/** What the router calls; endpoints build one with `procedure()` (see http/procedure.ts). */
+export type Handler = (ctx: RequestContext) => Promise<HandlerResult> | HandlerResult;
 export declare class Router {
   private routes;
-  add<S extends z.ZodType | undefined = undefined>(method: HttpMethod, path: string, handler: Routed<S>, options?: RouteOptions<NonNullable<S>>): void;
-  get(path: string, h: Handler): void;
-  post<S extends z.ZodType>(path: string, options: RouteOptions<S>, h: Routed<S>): void;
-  post(path: string, h: Handler): void;
-  put<S extends z.ZodType>(path: string, options: RouteOptions<S>, h: Routed<S>): void;
-  put(path: string, h: Handler): void;
-  delete(path: string, h: Handler): void;
+  add(method: HttpMethod, path: string, handler: Handler): void;
+  get: (path: string, h: Handler) => void;
+  post: (path: string, h: Handler) => void;
+  put: (path: string, h: Handler) => void;
+  delete: (path: string, h: Handler) => void;
   /** Register a client-server API route under both `r0` and `v3` (or the given versions). */
-  client<S extends z.ZodType>(method: HttpMethod, path: string, options: RouteOptions<S>, handler: Routed<S>, versions?: string[]): void;
   client(method: HttpMethod, path: string, handler: Handler, versions?: string[]): void;
   match(method: string, pathname: string): {
     handler: Handler;
     params: Record<string, string>;
-    input?: z.ZodType;
   } | "method" | null;
 }
-//#endregion
-export {};
+//#endregion

package/dist/http/router.js

@@ -1,39 +1,20 @@
 //#region src/http/router.ts
 var Router = class {
 	routes = [];
-	add(method, path, handler, options = {}) {
+	add(method, path, handler) {
 		this.routes.push({
 			method,
 			segments: path.split("/").filter(Boolean),
-			handler,
-			input: options.input
+			handler
 		});
 	}
-	get(path, h) {
-		this.add("GET", path, h);
-	}
-	post(path, a, b) {
-		if (typeof a === "function") this.add("POST", path, a);
-		else this.add("POST", path, b, a);
-	}
-	put(path, a, b) {
-		if (typeof a === "function") this.add("PUT", path, a);
-		else this.add("PUT", path, b, a);
-	}
-	delete(path, h) {
-		this.add("DELETE", path, h);
-	}
-	client(method, path, a, b, c) {
-		const [options, handler, versions] = typeof a === "function" ? [
-			{},
-			a,
-			b ?? ["r0", "v3"]
-		] : [
-			a,
-			b,
-			c ?? ["r0", "v3"]
-		];
-		for (const v of versions) this.add(method, `/_matrix/client/${v}${path}`, handler, options);
+	get = (path, h) => this.add("GET", path, h);
+	post = (path, h) => this.add("POST", path, h);
+	put = (path, h) => this.add("PUT", path, h);
+	delete = (path, h) => this.add("DELETE", path, h);
+	/** Register a client-server API route under both `r0` and `v3` (or the given versions). */
+	client(method, path, handler, versions = ["r0", "v3"]) {
+		for (const v of versions) this.add(method, `/_matrix/client/${v}${path}`, handler);
 	}
 	match(method, pathname) {
 		const parts = pathname.split("/").filter(Boolean);
@@ -47,8 +28,7 @@ var Router = class {
 			}
 			return {
 				handler: route.handler,
-				params,
-				input: route.input
+				params
 			};
 		}
 		return methodMismatch ? "method" : null;

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { ThreepidEmail, ThreepidOptions, ThreepidPurpose, ThreepidSms } from "./core/threepid.js";
+import { M, UNSTABLE } from "./core/m.js";
 import { AppServiceRegistration, loadAppServiceRegistrations, parseAppServiceRegistration } from "./core/appservices.js";
 import { ClusterAdapter, localCluster } from "./core/cluster.js";
 import { DatabaseAdapter, FieldDef, FindManyOptions, ModelDef, Operator, Row, Schema, WhereClause } from "./storage/types.js";
@@ -22,4 +23,4 @@ import { MysqlPoolLike, PgPoolLike, SqlAdapterOptions, SqlDialect, SqlExecutor,
 import { schema } from "./storage/schema.js";
 import { S3MediaOptions, s3Media } from "./adapters/s3.js";
 import { PgClusterPoolLike, RedisLike, RedisSubscriberLike, postgresCluster, redisCluster } from "./adapters/cluster.js";
-export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type RedisLike, type RedisSubscriberLike, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, redisCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type RedisLike, type RedisSubscriberLike, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, redisCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/index.js

@@ -1,3 +1,4 @@
+import { M, UNSTABLE } from "./core/m.js";
 import { MatrixError } from "./core/errors.js";
 import { localCluster } from "./core/cluster.js";
 import { loadAppServiceRegistrations, parseAppServiceRegistration } from "./core/appservices.js";
@@ -11,4 +12,4 @@ import { getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, g
 import { mysqlAdapter, postgresAdapter, sqlAdapter, sqliteAdapter } from "./storage/sql.js";
 import { s3Media } from "./adapters/s3.js";
 import { postgresCluster, redisCluster } from "./adapters/cluster.js";
-export { Homeserver, MatrixError, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, redisCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, redisCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/vendor/zod/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/vendor/zod/v4/classic/errors.js

@@ -0,0 +1,54 @@
+import { jsonStringifyReplacer } from "../core/util.js";
+import { $constructor } from "../core/core.js";
+import { $ZodError, flattenError, formatError } from "../core/errors.js";
+//#region node_modules/zod/v4/classic/errors.js
+const _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
+function _lazyMethod(proto, key, make) {
+	Object.defineProperty(proto, key, {
+		configurable: true,
+		enumerable: false,
+		get() {
+			const value = make(this);
+			Object.defineProperty(this, key, {
+				value,
+				configurable: true,
+				writable: true
+			});
+			return value;
+		},
+		set(value) {
+			Object.defineProperty(this, key, {
+				value,
+				configurable: true,
+				writable: true
+			});
+		}
+	});
+}
+const initializer = (inst, issues) => {
+	$ZodError.init(inst, issues);
+	inst.name = "ZodError";
+	const proto = Object.getPrototypeOf(inst);
+	if (_installedErrorProtos.has(proto)) return;
+	_installedErrorProtos.add(proto);
+	_lazyMethod(proto, "format", (self) => (mapper) => formatError(self, mapper));
+	_lazyMethod(proto, "flatten", (self) => (mapper) => flattenError(self, mapper));
+	_lazyMethod(proto, "addIssue", (self) => (issue) => {
+		self.issues.push(issue);
+		self.message = JSON.stringify(self.issues, jsonStringifyReplacer, 2);
+	});
+	_lazyMethod(proto, "addIssues", (self) => (issues) => {
+		self.issues.push(...issues);
+		self.message = JSON.stringify(self.issues, jsonStringifyReplacer, 2);
+	});
+	Object.defineProperty(proto, "isEmpty", {
+		configurable: true,
+		enumerable: false,
+		get() {
+			return this.issues.length === 0;
+		}
+	});
+};
+const ZodRealError = /*@__PURE__*/ $constructor("ZodError", initializer, void 0, { Parent: Error });
+//#endregion
+export { ZodRealError };

package/dist/vendor/zod/v4/classic/parse.js

@@ -0,0 +1,17 @@
+import { _decode, _decodeAsync, _encode, _encodeAsync, _parse, _parseAsync, _safeDecode, _safeDecodeAsync, _safeEncode, _safeEncodeAsync, _safeParse, _safeParseAsync } from "../core/parse.js";
+import { ZodRealError } from "./errors.js";
+//#region node_modules/zod/v4/classic/parse.js
+const parse = /* @__PURE__ */ _parse(ZodRealError);
+const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
+const safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
+const safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);
+const encode = /* @__PURE__ */ _encode(ZodRealError);
+const decode = /* @__PURE__ */ _decode(ZodRealError);
+const encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
+const decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
+const safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);
+const safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);
+const safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
+const safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
+//#endregion
+export { decode, decodeAsync, encode, encodeAsync, parse, parseAsync, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync };