# swarm-matrix-client

The client-server API calls against a Matrix homeserver, shared by the binaries
that make them: `swarm-matrix-ctl` (inside the matrix container, for a hive's
sender account) and `swarm-controller` (for each agent's account, with the
swarm's own appservice token).

Three appservice calls: register an account as the appservice, log
in to an existing one as the appservice, and ask a token who it is. Both mints
pin the device id `hyperhive-<localpart>`, so a second login **replaces** that
device's token instead of adding a device.

`swarm-controller` also logs an operator-linked account in with its password
(`password_login`) and invalidates its token (`logout`) on whatever homeserver
the operator names. Neither call is an appservice call, so neither carries the
appservice token.

`hive-c0re` provisions the hive Space and chat room with the room calls
(`joined_rooms`, `room_state`, `put_state`, `create_room`, `invite`,
`resolve_alias`), and `hive-matrix-mcp` recovers a session's user and device id
with `whoami_session`. Each takes the caller's `reqwest::Client`, so the caller
sets its own timeout; `client()` is the 10 second default.

## 🩸 A secret is a path, never a value

Every error here is built from the response's status and its `errcode`, never
its body: a successful `/register` or `/login` body is an access token, and an
error body is one malformed response away from being the same bytes.