@archipelagolab/lobi 1.0.5 → 1.0.6

package/dist/chunk-PLMOTQ42.js

@@ -0,0 +1,335 @@
+import {
+  decodeRecoveryKey
+} from "./chunk-RSA7PKZH.js";
+import {
+  formatMatrixErrorMessage,
+  formatMatrixErrorReason
+} from "./chunk-H5MLA6PA.js";
+import {
+  LogService
+} from "./chunk-YF5DYD3X.js";
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/matrix/sdk/recovery-key-store.ts
+init_shims();
+import fs from "node:fs";
+import path from "node:path";
+function isRepairableSecretStorageAccessError(err) {
+  const message = formatMatrixErrorReason(err);
+  if (!message) {
+    return false;
+  }
+  if (message.includes("getsecretstoragekey callback returned falsey")) {
+    return true;
+  }
+  if (message.includes("decrypting secret") && message.includes("bad mac")) {
+    return true;
+  }
+  return false;
+}
+var MatrixRecoveryKeyStore = class {
+  constructor(recoveryKeyPath) {
+    this.recoveryKeyPath = recoveryKeyPath;
+    this.secretStorageKeyCache = /* @__PURE__ */ new Map();
+    this.stagedRecoveryKey = null;
+    this.stagedCacheKeyIds = /* @__PURE__ */ new Set();
+  }
+  buildCryptoCallbacks() {
+    return {
+      getSecretStorageKey: async ({ keys }) => {
+        const requestedKeyIds = Object.keys(keys ?? {});
+        if (requestedKeyIds.length === 0) {
+          return null;
+        }
+        for (const keyId of requestedKeyIds) {
+          const cached = this.secretStorageKeyCache.get(keyId);
+          if (cached) {
+            return [keyId, new Uint8Array(cached.key)];
+          }
+        }
+        const staged = this.stagedRecoveryKey;
+        if (staged?.privateKeyBase64) {
+          const privateKey2 = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+          if (privateKey2.length > 0) {
+            const stagedKeyId = staged.keyId && requestedKeyIds.includes(staged.keyId) ? staged.keyId : requestedKeyIds[0];
+            if (stagedKeyId) {
+              this.rememberSecretStorageKey(stagedKeyId, privateKey2, staged.keyInfo);
+              this.stagedCacheKeyIds.add(stagedKeyId);
+              return [stagedKeyId, privateKey2];
+            }
+          }
+        }
+        const stored = this.loadStoredRecoveryKey();
+        if (!stored?.privateKeyBase64) {
+          return null;
+        }
+        const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
+        if (privateKey.length === 0) {
+          return null;
+        }
+        if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
+          this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);
+          return [stored.keyId, privateKey];
+        }
+        const firstRequestedKeyId = requestedKeyIds[0];
+        if (!firstRequestedKeyId) {
+          return null;
+        }
+        this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);
+        return [firstRequestedKeyId, privateKey];
+      },
+      cacheSecretStorageKey: (keyId, keyInfo, key) => {
+        const privateKey = new Uint8Array(key);
+        const normalizedKeyInfo = {
+          passphrase: keyInfo?.passphrase,
+          name: typeof keyInfo?.name === "string" ? keyInfo.name : void 0
+        };
+        this.rememberSecretStorageKey(keyId, privateKey, normalizedKeyInfo);
+        const stored = this.loadStoredRecoveryKey();
+        this.saveRecoveryKeyToDisk({
+          keyId,
+          keyInfo: normalizedKeyInfo,
+          privateKey,
+          encodedPrivateKey: stored?.encodedPrivateKey
+        });
+      }
+    };
+  }
+  getRecoveryKeySummary() {
+    const stored = this.loadStoredRecoveryKey();
+    if (!stored) {
+      return null;
+    }
+    return {
+      encodedPrivateKey: stored.encodedPrivateKey,
+      keyId: stored.keyId,
+      createdAt: stored.createdAt
+    };
+  }
+  resolveEncodedRecoveryKeyInput(params) {
+    const encodedPrivateKey = params.encodedPrivateKey.trim();
+    if (!encodedPrivateKey) {
+      throw new Error("Matrix recovery key is required");
+    }
+    let privateKey;
+    try {
+      privateKey = decodeRecoveryKey(encodedPrivateKey);
+    } catch (err) {
+      throw new Error(`Invalid Matrix recovery key: ${formatMatrixErrorMessage(err)}`, {
+        cause: err
+      });
+    }
+    const keyId = typeof params.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : null;
+    return {
+      encodedPrivateKey,
+      privateKey,
+      keyId,
+      keyInfo: params.keyInfo ?? this.loadStoredRecoveryKey()?.keyInfo
+    };
+  }
+  storeEncodedRecoveryKey(params) {
+    const prepared = this.resolveEncodedRecoveryKeyInput(params);
+    this.saveRecoveryKeyToDisk({
+      keyId: prepared.keyId,
+      keyInfo: prepared.keyInfo,
+      privateKey: prepared.privateKey,
+      encodedPrivateKey: prepared.encodedPrivateKey
+    });
+    if (prepared.keyId) {
+      this.rememberSecretStorageKey(prepared.keyId, prepared.privateKey, prepared.keyInfo);
+    }
+    return this.getRecoveryKeySummary() ?? {};
+  }
+  stageEncodedRecoveryKey(params) {
+    const prepared = this.resolveEncodedRecoveryKeyInput(params);
+    this.discardStagedRecoveryKey();
+    this.stagedRecoveryKey = {
+      version: 1,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      keyId: prepared.keyId,
+      encodedPrivateKey: prepared.encodedPrivateKey,
+      privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
+      keyInfo: prepared.keyInfo
+    };
+  }
+  commitStagedRecoveryKey(params) {
+    if (!this.stagedRecoveryKey) {
+      return this.getRecoveryKeySummary();
+    }
+    const staged = this.stagedRecoveryKey;
+    const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+    const keyId = typeof params?.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;
+    this.saveRecoveryKeyToDisk({
+      keyId,
+      keyInfo: params?.keyInfo ?? staged.keyInfo,
+      privateKey,
+      encodedPrivateKey: staged.encodedPrivateKey
+    });
+    this.clearStagedRecoveryKeyTracking();
+    return this.getRecoveryKeySummary();
+  }
+  discardStagedRecoveryKey() {
+    for (const keyId of this.stagedCacheKeyIds) {
+      this.secretStorageKeyCache.delete(keyId);
+    }
+    this.clearStagedRecoveryKeyTracking();
+  }
+  async bootstrapSecretStorageWithRecoveryKey(crypto, options = {}) {
+    let status = null;
+    const getSecretStorageStatus = crypto.getSecretStorageStatus;
+    if (typeof getSecretStorageStatus === "function") {
+      try {
+        status = await getSecretStorageStatus.call(crypto);
+      } catch (err) {
+        LogService.warn("MatrixClientLite", "Failed to read secret storage status:", err);
+      }
+    }
+    const hasDefaultSecretStorageKey = Boolean(status?.defaultKeyId);
+    const hasKnownInvalidSecrets = Object.values(status?.secretStorageKeyValidityMap ?? {}).some(
+      (valid) => !valid
+    );
+    let generatedRecoveryKey = false;
+    const storedRecovery = this.loadStoredRecoveryKey();
+    const stagedRecovery = this.stagedRecoveryKey;
+    const sourceRecovery = stagedRecovery ?? storedRecovery;
+    let recoveryKey = sourceRecovery ? {
+      keyInfo: sourceRecovery.keyInfo,
+      privateKey: new Uint8Array(Buffer.from(sourceRecovery.privateKeyBase64, "base64")),
+      encodedPrivateKey: sourceRecovery.encodedPrivateKey
+    } : null;
+    if (recoveryKey && status?.defaultKeyId) {
+      const defaultKeyId = status.defaultKeyId;
+      this.rememberSecretStorageKey(defaultKeyId, recoveryKey.privateKey, recoveryKey.keyInfo);
+      if (!stagedRecovery && storedRecovery && storedRecovery.keyId !== defaultKeyId) {
+        this.saveRecoveryKeyToDisk({
+          keyId: defaultKeyId,
+          keyInfo: recoveryKey.keyInfo,
+          privateKey: recoveryKey.privateKey,
+          encodedPrivateKey: recoveryKey.encodedPrivateKey
+        });
+      }
+    }
+    const ensureRecoveryKey = async () => {
+      if (recoveryKey) {
+        return recoveryKey;
+      }
+      if (typeof crypto.createRecoveryKeyFromPassphrase !== "function") {
+        throw new Error(
+          "Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)"
+        );
+      }
+      recoveryKey = await crypto.createRecoveryKeyFromPassphrase();
+      this.saveRecoveryKeyToDisk(recoveryKey);
+      generatedRecoveryKey = true;
+      return recoveryKey;
+    };
+    const shouldRecreateSecretStorage = options.forceNewSecretStorage === true || !hasDefaultSecretStorageKey || !recoveryKey && status?.ready === false || hasKnownInvalidSecrets;
+    if (hasKnownInvalidSecrets) {
+      recoveryKey = null;
+    }
+    const secretStorageOptions = {
+      setupNewKeyBackup: options.setupNewKeyBackup === true
+    };
+    if (shouldRecreateSecretStorage) {
+      secretStorageOptions.setupNewSecretStorage = true;
+      secretStorageOptions.createSecretStorageKey = ensureRecoveryKey;
+    }
+    try {
+      await crypto.bootstrapSecretStorage(secretStorageOptions);
+    } catch (err) {
+      const shouldRecreateWithoutRecoveryKey = options.allowSecretStorageRecreateWithoutRecoveryKey === true && hasDefaultSecretStorageKey && isRepairableSecretStorageAccessError(err);
+      if (!shouldRecreateWithoutRecoveryKey) {
+        throw err;
+      }
+      recoveryKey = null;
+      LogService.warn(
+        "MatrixClientLite",
+        "Secret storage exists on the server but local recovery material cannot unlock it; recreating secret storage during explicit bootstrap."
+      );
+      await crypto.bootstrapSecretStorage({
+        setupNewSecretStorage: true,
+        setupNewKeyBackup: options.setupNewKeyBackup === true,
+        createSecretStorageKey: ensureRecoveryKey
+      });
+    }
+    if (generatedRecoveryKey && this.recoveryKeyPath) {
+      LogService.warn(
+        "MatrixClientLite",
+        `Generated Matrix recovery key and saved it to ${this.recoveryKeyPath}. Keep this file secure.`
+      );
+    }
+  }
+  clearStagedRecoveryKeyTracking() {
+    this.stagedRecoveryKey = null;
+    this.stagedCacheKeyIds.clear();
+  }
+  rememberSecretStorageKey(keyId, key, keyInfo) {
+    if (!keyId.trim()) {
+      return;
+    }
+    this.secretStorageKeyCache.set(keyId, {
+      key: new Uint8Array(key),
+      keyInfo
+    });
+  }
+  loadStoredRecoveryKey() {
+    if (!this.recoveryKeyPath) {
+      return null;
+    }
+    try {
+      if (!fs.existsSync(this.recoveryKeyPath)) {
+        return null;
+      }
+      const raw = fs.readFileSync(this.recoveryKeyPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed.version !== 1 || typeof parsed.createdAt !== "string" || typeof parsed.privateKeyBase64 !== "string" || // pragma: allowlist secret
+      !parsed.privateKeyBase64.trim()) {
+        return null;
+      }
+      return {
+        version: 1,
+        createdAt: parsed.createdAt,
+        keyId: typeof parsed.keyId === "string" ? parsed.keyId : null,
+        encodedPrivateKey: typeof parsed.encodedPrivateKey === "string" ? parsed.encodedPrivateKey : void 0,
+        privateKeyBase64: parsed.privateKeyBase64,
+        keyInfo: parsed.keyInfo && typeof parsed.keyInfo === "object" ? {
+          passphrase: parsed.keyInfo.passphrase,
+          name: typeof parsed.keyInfo.name === "string" ? parsed.keyInfo.name : void 0
+        } : void 0
+      };
+    } catch {
+      return null;
+    }
+  }
+  saveRecoveryKeyToDisk(params) {
+    if (!this.recoveryKeyPath) {
+      return;
+    }
+    try {
+      const payload = {
+        version: 1,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        keyId: typeof params.keyId === "string" ? params.keyId : null,
+        encodedPrivateKey: params.encodedPrivateKey,
+        privateKeyBase64: Buffer.from(params.privateKey).toString("base64"),
+        keyInfo: params.keyInfo ? {
+          passphrase: params.keyInfo.passphrase,
+          name: params.keyInfo.name
+        } : void 0
+      };
+      fs.mkdirSync(path.dirname(this.recoveryKeyPath), { recursive: true });
+      fs.writeFileSync(this.recoveryKeyPath, JSON.stringify(payload, null, 2), "utf8");
+      fs.chmodSync(this.recoveryKeyPath, 384);
+    } catch (err) {
+      LogService.warn("MatrixClientLite", "Failed to persist recovery key:", err);
+    }
+  }
+};
+
+export {
+  isRepairableSecretStorageAccessError,
+  MatrixRecoveryKeyStore
+};
+//# sourceMappingURL=chunk-PLMOTQ42.js.map

package/dist/chunk-PLMOTQ42.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/sdk/recovery-key-store.ts"],
+  "sourcesContent": ["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { decodeRecoveryKey } from \"@archipelagolab/lobi-js-sdk/lib/crypto-api/recovery-key.js\";\nimport { formatMatrixErrorMessage, formatMatrixErrorReason } from \"../errors.js\";\nimport { LogService } from \"./logger.js\";\nimport type {\n  MatrixCryptoBootstrapApi,\n  MatrixCryptoCallbacks,\n  MatrixGeneratedSecretStorageKey,\n  MatrixSecretStorageStatus,\n  MatrixStoredRecoveryKey,\n} from \"./types.js\";\n\nexport function isRepairableSecretStorageAccessError(err: unknown): boolean {\n  const message = formatMatrixErrorReason(err);\n  if (!message) {\n    return false;\n  }\n  if (message.includes(\"getsecretstoragekey callback returned falsey\")) {\n    return true;\n  }\n  // The homeserver still has secret storage, but the local recovery key cannot\n  // authenticate/decrypt a required secret. During explicit bootstrap we can\n  // recreate secret storage and continue with a new local baseline.\n  if (message.includes(\"decrypting secret\") && message.includes(\"bad mac\")) {\n    return true;\n  }\n  return false;\n}\n\nexport class MatrixRecoveryKeyStore {\n  private readonly secretStorageKeyCache = new Map<\n    string,\n    { key: Uint8Array; keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"] }\n  >();\n  private stagedRecoveryKey: MatrixStoredRecoveryKey | null = null;\n  private readonly stagedCacheKeyIds = new Set<string>();\n\n  constructor(private readonly recoveryKeyPath?: string) {}\n\n  buildCryptoCallbacks(): MatrixCryptoCallbacks {\n    return {\n      getSecretStorageKey: async ({ keys }) => {\n        const requestedKeyIds = Object.keys(keys ?? {});\n        if (requestedKeyIds.length === 0) {\n          return null;\n        }\n\n        for (const keyId of requestedKeyIds) {\n          const cached = this.secretStorageKeyCache.get(keyId);\n          if (cached) {\n            return [keyId, new Uint8Array(cached.key)];\n          }\n        }\n\n        const staged = this.stagedRecoveryKey;\n        if (staged?.privateKeyBase64) {\n          const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, \"base64\"));\n          if (privateKey.length > 0) {\n            const stagedKeyId =\n              staged.keyId && requestedKeyIds.includes(staged.keyId)\n                ? staged.keyId\n                : requestedKeyIds[0];\n            if (stagedKeyId) {\n              this.rememberSecretStorageKey(stagedKeyId, privateKey, staged.keyInfo);\n              this.stagedCacheKeyIds.add(stagedKeyId);\n              return [stagedKeyId, privateKey];\n            }\n          }\n        }\n\n        const stored = this.loadStoredRecoveryKey();\n        if (!stored?.privateKeyBase64) {\n          return null;\n        }\n        const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, \"base64\"));\n        if (privateKey.length === 0) {\n          return null;\n        }\n\n        if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {\n          this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);\n          return [stored.keyId, privateKey];\n        }\n\n        const firstRequestedKeyId = requestedKeyIds[0];\n        if (!firstRequestedKeyId) {\n          return null;\n        }\n        this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);\n        return [firstRequestedKeyId, privateKey];\n      },\n      cacheSecretStorageKey: (keyId, keyInfo, key) => {\n        const privateKey = new Uint8Array(key);\n        const normalizedKeyInfo: MatrixStoredRecoveryKey[\"keyInfo\"] = {\n          passphrase: keyInfo?.passphrase,\n          name: typeof keyInfo?.name === \"string\" ? keyInfo.name : undefined,\n        };\n        this.rememberSecretStorageKey(keyId, privateKey, normalizedKeyInfo);\n\n        const stored = this.loadStoredRecoveryKey();\n        this.saveRecoveryKeyToDisk({\n          keyId,\n          keyInfo: normalizedKeyInfo,\n          privateKey,\n          encodedPrivateKey: stored?.encodedPrivateKey,\n        });\n      },\n    };\n  }\n\n  getRecoveryKeySummary(): {\n    encodedPrivateKey?: string;\n    keyId?: string | null;\n    createdAt?: string;\n  } | null {\n    const stored = this.loadStoredRecoveryKey();\n    if (!stored) {\n      return null;\n    }\n    return {\n      encodedPrivateKey: stored.encodedPrivateKey,\n      keyId: stored.keyId,\n      createdAt: stored.createdAt,\n    };\n  }\n\n  private resolveEncodedRecoveryKeyInput(params: {\n    encodedPrivateKey: string;\n    keyId?: string | null;\n    keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"];\n  }): {\n    encodedPrivateKey: string;\n    privateKey: Uint8Array;\n    keyId: string | null;\n    keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"];\n  } {\n    const encodedPrivateKey = params.encodedPrivateKey.trim();\n    if (!encodedPrivateKey) {\n      throw new Error(\"Matrix recovery key is required\");\n    }\n    let privateKey: Uint8Array;\n    try {\n      privateKey = decodeRecoveryKey(encodedPrivateKey);\n    } catch (err) {\n      throw new Error(`Invalid Matrix recovery key: ${formatMatrixErrorMessage(err)}`, {\n        cause: err,\n      });\n    }\n    const keyId =\n      typeof params.keyId === \"string\" && params.keyId.trim() ? params.keyId.trim() : null;\n    return {\n      encodedPrivateKey,\n      privateKey,\n      keyId,\n      keyInfo: params.keyInfo ?? this.loadStoredRecoveryKey()?.keyInfo,\n    };\n  }\n\n  storeEncodedRecoveryKey(params: {\n    encodedPrivateKey: string;\n    keyId?: string | null;\n    keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"];\n  }): {\n    encodedPrivateKey?: string;\n    keyId?: string | null;\n    createdAt?: string;\n  } {\n    const prepared = this.resolveEncodedRecoveryKeyInput(params);\n    this.saveRecoveryKeyToDisk({\n      keyId: prepared.keyId,\n      keyInfo: prepared.keyInfo,\n      privateKey: prepared.privateKey,\n      encodedPrivateKey: prepared.encodedPrivateKey,\n    });\n    if (prepared.keyId) {\n      this.rememberSecretStorageKey(prepared.keyId, prepared.privateKey, prepared.keyInfo);\n    }\n    return this.getRecoveryKeySummary() ?? {};\n  }\n\n  stageEncodedRecoveryKey(params: {\n    encodedPrivateKey: string;\n    keyId?: string | null;\n    keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"];\n  }): void {\n    const prepared = this.resolveEncodedRecoveryKeyInput(params);\n    this.discardStagedRecoveryKey();\n    this.stagedRecoveryKey = {\n      version: 1,\n      createdAt: new Date().toISOString(),\n      keyId: prepared.keyId,\n      encodedPrivateKey: prepared.encodedPrivateKey,\n      privateKeyBase64: Buffer.from(prepared.privateKey).toString(\"base64\"),\n      keyInfo: prepared.keyInfo,\n    };\n  }\n\n  commitStagedRecoveryKey(params?: {\n    keyId?: string | null;\n    keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"];\n  }): {\n    encodedPrivateKey?: string;\n    keyId?: string | null;\n    createdAt?: string;\n  } | null {\n    if (!this.stagedRecoveryKey) {\n      return this.getRecoveryKeySummary();\n    }\n    const staged = this.stagedRecoveryKey;\n    const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, \"base64\"));\n    const keyId =\n      typeof params?.keyId === \"string\" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;\n    this.saveRecoveryKeyToDisk({\n      keyId,\n      keyInfo: params?.keyInfo ?? staged.keyInfo,\n      privateKey,\n      encodedPrivateKey: staged.encodedPrivateKey,\n    });\n    this.clearStagedRecoveryKeyTracking();\n    return this.getRecoveryKeySummary();\n  }\n\n  discardStagedRecoveryKey(): void {\n    for (const keyId of this.stagedCacheKeyIds) {\n      this.secretStorageKeyCache.delete(keyId);\n    }\n    this.clearStagedRecoveryKeyTracking();\n  }\n\n  async bootstrapSecretStorageWithRecoveryKey(\n    crypto: MatrixCryptoBootstrapApi,\n    options: {\n      setupNewKeyBackup?: boolean;\n      allowSecretStorageRecreateWithoutRecoveryKey?: boolean;\n      forceNewSecretStorage?: boolean;\n    } = {},\n  ): Promise<void> {\n    let status: MatrixSecretStorageStatus | null = null;\n    const getSecretStorageStatus = crypto.getSecretStorageStatus; // pragma: allowlist secret\n    if (typeof getSecretStorageStatus === \"function\") {\n      try {\n        status = await getSecretStorageStatus.call(crypto);\n      } catch (err) {\n        LogService.warn(\"MatrixClientLite\", \"Failed to read secret storage status:\", err);\n      }\n    }\n\n    const hasDefaultSecretStorageKey = Boolean(status?.defaultKeyId);\n    const hasKnownInvalidSecrets = Object.values(status?.secretStorageKeyValidityMap ?? {}).some(\n      (valid) => !valid,\n    );\n    let generatedRecoveryKey = false;\n    const storedRecovery = this.loadStoredRecoveryKey();\n    const stagedRecovery = this.stagedRecoveryKey;\n    const sourceRecovery = stagedRecovery ?? storedRecovery;\n    let recoveryKey: MatrixGeneratedSecretStorageKey | null = sourceRecovery\n      ? {\n          keyInfo: sourceRecovery.keyInfo,\n          privateKey: new Uint8Array(Buffer.from(sourceRecovery.privateKeyBase64, \"base64\")),\n          encodedPrivateKey: sourceRecovery.encodedPrivateKey,\n        }\n      : null;\n\n    if (recoveryKey && status?.defaultKeyId) {\n      const defaultKeyId = status.defaultKeyId;\n      this.rememberSecretStorageKey(defaultKeyId, recoveryKey.privateKey, recoveryKey.keyInfo);\n      if (!stagedRecovery && storedRecovery && storedRecovery.keyId !== defaultKeyId) {\n        this.saveRecoveryKeyToDisk({\n          keyId: defaultKeyId,\n          keyInfo: recoveryKey.keyInfo,\n          privateKey: recoveryKey.privateKey,\n          encodedPrivateKey: recoveryKey.encodedPrivateKey,\n        });\n      }\n    }\n\n    const ensureRecoveryKey = async (): Promise<MatrixGeneratedSecretStorageKey> => {\n      if (recoveryKey) {\n        return recoveryKey;\n      }\n      if (typeof crypto.createRecoveryKeyFromPassphrase !== \"function\") {\n        throw new Error(\n          \"Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)\",\n        );\n      }\n      recoveryKey = await crypto.createRecoveryKeyFromPassphrase();\n      this.saveRecoveryKeyToDisk(recoveryKey);\n      generatedRecoveryKey = true;\n      return recoveryKey;\n    };\n\n    const shouldRecreateSecretStorage =\n      options.forceNewSecretStorage === true ||\n      !hasDefaultSecretStorageKey ||\n      (!recoveryKey && status?.ready === false) ||\n      hasKnownInvalidSecrets;\n\n    if (hasKnownInvalidSecrets) {\n      // Existing secret storage keys can't decrypt required secrets. Generate a fresh recovery key.\n      recoveryKey = null;\n    }\n\n    const secretStorageOptions: {\n      createSecretStorageKey?: () => Promise<MatrixGeneratedSecretStorageKey>;\n      setupNewSecretStorage?: boolean;\n      setupNewKeyBackup?: boolean;\n    } = {\n      setupNewKeyBackup: options.setupNewKeyBackup === true,\n    };\n\n    if (shouldRecreateSecretStorage) {\n      secretStorageOptions.setupNewSecretStorage = true;\n      secretStorageOptions.createSecretStorageKey = ensureRecoveryKey;\n    }\n\n    try {\n      await crypto.bootstrapSecretStorage(secretStorageOptions);\n    } catch (err) {\n      const shouldRecreateWithoutRecoveryKey =\n        options.allowSecretStorageRecreateWithoutRecoveryKey === true &&\n        hasDefaultSecretStorageKey &&\n        isRepairableSecretStorageAccessError(err);\n      if (!shouldRecreateWithoutRecoveryKey) {\n        throw err;\n      }\n\n      recoveryKey = null;\n      LogService.warn(\n        \"MatrixClientLite\",\n        \"Secret storage exists on the server but local recovery material cannot unlock it; recreating secret storage during explicit bootstrap.\",\n      );\n      await crypto.bootstrapSecretStorage({\n        setupNewSecretStorage: true,\n        setupNewKeyBackup: options.setupNewKeyBackup === true,\n        createSecretStorageKey: ensureRecoveryKey,\n      });\n    }\n\n    if (generatedRecoveryKey && this.recoveryKeyPath) {\n      LogService.warn(\n        \"MatrixClientLite\",\n        `Generated Matrix recovery key and saved it to ${this.recoveryKeyPath}. Keep this file secure.`,\n      );\n    }\n  }\n\n  private clearStagedRecoveryKeyTracking(): void {\n    this.stagedRecoveryKey = null;\n    this.stagedCacheKeyIds.clear();\n  }\n\n  private rememberSecretStorageKey(\n    keyId: string,\n    key: Uint8Array,\n    keyInfo?: MatrixStoredRecoveryKey[\"keyInfo\"],\n  ): void {\n    if (!keyId.trim()) {\n      return;\n    }\n    this.secretStorageKeyCache.set(keyId, {\n      key: new Uint8Array(key),\n      keyInfo,\n    });\n  }\n\n  private loadStoredRecoveryKey(): MatrixStoredRecoveryKey | null {\n    if (!this.recoveryKeyPath) {\n      return null;\n    }\n    try {\n      if (!fs.existsSync(this.recoveryKeyPath)) {\n        return null;\n      }\n      const raw = fs.readFileSync(this.recoveryKeyPath, \"utf8\");\n      const parsed = JSON.parse(raw) as Partial<MatrixStoredRecoveryKey>;\n      if (\n        parsed.version !== 1 ||\n        typeof parsed.createdAt !== \"string\" ||\n        typeof parsed.privateKeyBase64 !== \"string\" || // pragma: allowlist secret\n        !parsed.privateKeyBase64.trim()\n      ) {\n        return null;\n      }\n      return {\n        version: 1,\n        createdAt: parsed.createdAt,\n        keyId: typeof parsed.keyId === \"string\" ? parsed.keyId : null,\n        encodedPrivateKey:\n          typeof parsed.encodedPrivateKey === \"string\" ? parsed.encodedPrivateKey : undefined,\n        privateKeyBase64: parsed.privateKeyBase64,\n        keyInfo:\n          parsed.keyInfo && typeof parsed.keyInfo === \"object\"\n            ? {\n                passphrase: parsed.keyInfo.passphrase,\n                name: typeof parsed.keyInfo.name === \"string\" ? parsed.keyInfo.name : undefined,\n              }\n            : undefined,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  private saveRecoveryKeyToDisk(params: MatrixGeneratedSecretStorageKey): void {\n    if (!this.recoveryKeyPath) {\n      return;\n    }\n    try {\n      const payload: MatrixStoredRecoveryKey = {\n        version: 1,\n        createdAt: new Date().toISOString(),\n        keyId: typeof params.keyId === \"string\" ? params.keyId : null,\n        encodedPrivateKey: params.encodedPrivateKey,\n        privateKeyBase64: Buffer.from(params.privateKey).toString(\"base64\"),\n        keyInfo: params.keyInfo\n          ? {\n              passphrase: params.keyInfo.passphrase,\n              name: params.keyInfo.name,\n            }\n          : undefined,\n      };\n      fs.mkdirSync(path.dirname(this.recoveryKeyPath), { recursive: true });\n      fs.writeFileSync(this.recoveryKeyPath, JSON.stringify(payload, null, 2), \"utf8\");\n      fs.chmodSync(this.recoveryKeyPath, 0o600);\n    } catch (err) {\n      LogService.warn(\"MatrixClientLite\", \"Failed to persist recovery key:\", err);\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;AAAA;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAYV,SAAS,qCAAqC,KAAuB;AAC1E,QAAM,UAAU,wBAAwB,GAAG;AAC3C,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS,8CAA8C,GAAG;AACpE,WAAO;AAAA,EACT;AAIA,MAAI,QAAQ,SAAS,mBAAmB,KAAK,QAAQ,SAAS,SAAS,GAAG;AACxE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,IAAM,yBAAN,MAA6B;AAAA,EAQlC,YAA6B,iBAA0B;AAA1B;AAP7B,SAAiB,wBAAwB,oBAAI,IAG3C;AACF,SAAQ,oBAAoD;AAC5D,SAAiB,oBAAoB,oBAAI,IAAY;AAAA,EAEG;AAAA,EAExD,uBAA8C;AAC5C,WAAO;AAAA,MACL,qBAAqB,OAAO,EAAE,KAAK,MAAM;AACvC,cAAM,kBAAkB,OAAO,KAAK,QAAQ,CAAC,CAAC;AAC9C,YAAI,gBAAgB,WAAW,GAAG;AAChC,iBAAO;AAAA,QACT;AAEA,mBAAW,SAAS,iBAAiB;AACnC,gBAAM,SAAS,KAAK,sBAAsB,IAAI,KAAK;AACnD,cAAI,QAAQ;AACV,mBAAO,CAAC,OAAO,IAAI,WAAW,OAAO,GAAG,CAAC;AAAA,UAC3C;AAAA,QACF;AAEA,cAAM,SAAS,KAAK;AACpB,YAAI,QAAQ,kBAAkB;AAC5B,gBAAMA,cAAa,IAAI,WAAW,OAAO,KAAK,OAAO,kBAAkB,QAAQ,CAAC;AAChF,cAAIA,YAAW,SAAS,GAAG;AACzB,kBAAM,cACJ,OAAO,SAAS,gBAAgB,SAAS,OAAO,KAAK,IACjD,OAAO,QACP,gBAAgB,CAAC;AACvB,gBAAI,aAAa;AACf,mBAAK,yBAAyB,aAAaA,aAAY,OAAO,OAAO;AACrE,mBAAK,kBAAkB,IAAI,WAAW;AACtC,qBAAO,CAAC,aAAaA,WAAU;AAAA,YACjC;AAAA,UACF;AAAA,QACF;AAEA,cAAM,SAAS,KAAK,sBAAsB;AAC1C,YAAI,CAAC,QAAQ,kBAAkB;AAC7B,iBAAO;AAAA,QACT;AACA,cAAM,aAAa,IAAI,WAAW,OAAO,KAAK,OAAO,kBAAkB,QAAQ,CAAC;AAChF,YAAI,WAAW,WAAW,GAAG;AAC3B,iBAAO;AAAA,QACT;AAEA,YAAI,OAAO,SAAS,gBAAgB,SAAS,OAAO,KAAK,GAAG;AAC1D,eAAK,yBAAyB,OAAO,OAAO,YAAY,OAAO,OAAO;AACtE,iBAAO,CAAC,OAAO,OAAO,UAAU;AAAA,QAClC;AAEA,cAAM,sBAAsB,gBAAgB,CAAC;AAC7C,YAAI,CAAC,qBAAqB;AACxB,iBAAO;AAAA,QACT;AACA,aAAK,yBAAyB,qBAAqB,YAAY,OAAO,OAAO;AAC7E,eAAO,CAAC,qBAAqB,UAAU;AAAA,MACzC;AAAA,MACA,uBAAuB,CAAC,OAAO,SAAS,QAAQ;AAC9C,cAAM,aAAa,IAAI,WAAW,GAAG;AACrC,cAAM,oBAAwD;AAAA,UAC5D,YAAY,SAAS;AAAA,UACrB,MAAM,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;AAAA,QAC3D;AACA,aAAK,yBAAyB,OAAO,YAAY,iBAAiB;AAElE,cAAM,SAAS,KAAK,sBAAsB;AAC1C,aAAK,sBAAsB;AAAA,UACzB;AAAA,UACA,SAAS;AAAA,UACT;AAAA,UACA,mBAAmB,QAAQ;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,wBAIS;AACP,UAAM,SAAS,KAAK,sBAAsB;AAC1C,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,mBAAmB,OAAO;AAAA,MAC1B,OAAO,OAAO;AAAA,MACd,WAAW,OAAO;AAAA,IACpB;AAAA,EACF;AAAA,EAEQ,+BAA+B,QASrC;AACA,UAAM,oBAAoB,OAAO,kBAAkB,KAAK;AACxD,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI;AACJ,QAAI;AACF,mBAAa,kBAAkB,iBAAiB;AAAA,IAClD,SAAS,KAAK;AACZ,YAAM,IAAI,MAAM,gCAAgC,yBAAyB,GAAG,CAAC,IAAI;AAAA,QAC/E,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,QACJ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,IAAI,OAAO,MAAM,KAAK,IAAI;AAClF,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,OAAO,WAAW,KAAK,sBAAsB,GAAG;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,wBAAwB,QAQtB;AACA,UAAM,WAAW,KAAK,+BAA+B,MAAM;AAC3D,SAAK,sBAAsB;AAAA,MACzB,OAAO,SAAS;AAAA,MAChB,SAAS,SAAS;AAAA,MAClB,YAAY,SAAS;AAAA,MACrB,mBAAmB,SAAS;AAAA,IAC9B,CAAC;AACD,QAAI,SAAS,OAAO;AAClB,WAAK,yBAAyB,SAAS,OAAO,SAAS,YAAY,SAAS,OAAO;AAAA,IACrF;AACA,WAAO,KAAK,sBAAsB,KAAK,CAAC;AAAA,EAC1C;AAAA,EAEA,wBAAwB,QAIf;AACP,UAAM,WAAW,KAAK,+BAA+B,MAAM;AAC3D,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB;AAAA,MACvB,SAAS;AAAA,MACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,OAAO,SAAS;AAAA,MAChB,mBAAmB,SAAS;AAAA,MAC5B,kBAAkB,OAAO,KAAK,SAAS,UAAU,EAAE,SAAS,QAAQ;AAAA,MACpE,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,wBAAwB,QAOf;AACP,QAAI,CAAC,KAAK,mBAAmB;AAC3B,aAAO,KAAK,sBAAsB;AAAA,IACpC;AACA,UAAM,SAAS,KAAK;AACpB,UAAM,aAAa,IAAI,WAAW,OAAO,KAAK,OAAO,kBAAkB,QAAQ,CAAC;AAChF,UAAM,QACJ,OAAO,QAAQ,UAAU,YAAY,OAAO,MAAM,KAAK,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO;AAC1F,SAAK,sBAAsB;AAAA,MACzB;AAAA,MACA,SAAS,QAAQ,WAAW,OAAO;AAAA,MACnC;AAAA,MACA,mBAAmB,OAAO;AAAA,IAC5B,CAAC;AACD,SAAK,+BAA+B;AACpC,WAAO,KAAK,sBAAsB;AAAA,EACpC;AAAA,EAEA,2BAAiC;AAC/B,eAAW,SAAS,KAAK,mBAAmB;AAC1C,WAAK,sBAAsB,OAAO,KAAK;AAAA,IACzC;AACA,SAAK,+BAA+B;AAAA,EACtC;AAAA,EAEA,MAAM,sCACJ,QACA,UAII,CAAC,GACU;AACf,QAAI,SAA2C;AAC/C,UAAM,yBAAyB,OAAO;AACtC,QAAI,OAAO,2BAA2B,YAAY;AAChD,UAAI;AACF,iBAAS,MAAM,uBAAuB,KAAK,MAAM;AAAA,MACnD,SAAS,KAAK;AACZ,mBAAW,KAAK,oBAAoB,yCAAyC,GAAG;AAAA,MAClF;AAAA,IACF;AAEA,UAAM,6BAA6B,QAAQ,QAAQ,YAAY;AAC/D,UAAM,yBAAyB,OAAO,OAAO,QAAQ,+BAA+B,CAAC,CAAC,EAAE;AAAA,MACtF,CAAC,UAAU,CAAC;AAAA,IACd;AACA,QAAI,uBAAuB;AAC3B,UAAM,iBAAiB,KAAK,sBAAsB;AAClD,UAAM,iBAAiB,KAAK;AAC5B,UAAM,iBAAiB,kBAAkB;AACzC,QAAI,cAAsD,iBACtD;AAAA,MACE,SAAS,eAAe;AAAA,MACxB,YAAY,IAAI,WAAW,OAAO,KAAK,eAAe,kBAAkB,QAAQ,CAAC;AAAA,MACjF,mBAAmB,eAAe;AAAA,IACpC,IACA;AAEJ,QAAI,eAAe,QAAQ,cAAc;AACvC,YAAM,eAAe,OAAO;AAC5B,WAAK,yBAAyB,cAAc,YAAY,YAAY,YAAY,OAAO;AACvF,UAAI,CAAC,kBAAkB,kBAAkB,eAAe,UAAU,cAAc;AAC9E,aAAK,sBAAsB;AAAA,UACzB,OAAO;AAAA,UACP,SAAS,YAAY;AAAA,UACrB,YAAY,YAAY;AAAA,UACxB,mBAAmB,YAAY;AAAA,QACjC,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,oBAAoB,YAAsD;AAC9E,UAAI,aAAa;AACf,eAAO;AAAA,MACT;AACA,UAAI,OAAO,OAAO,oCAAoC,YAAY;AAChE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,oBAAc,MAAM,OAAO,gCAAgC;AAC3D,WAAK,sBAAsB,WAAW;AACtC,6BAAuB;AACvB,aAAO;AAAA,IACT;AAEA,UAAM,8BACJ,QAAQ,0BAA0B,QAClC,CAAC,8BACA,CAAC,eAAe,QAAQ,UAAU,SACnC;AAEF,QAAI,wBAAwB;AAE1B,oBAAc;AAAA,IAChB;AAEA,UAAM,uBAIF;AAAA,MACF,mBAAmB,QAAQ,sBAAsB;AAAA,IACnD;AAEA,QAAI,6BAA6B;AAC/B,2BAAqB,wBAAwB;AAC7C,2BAAqB,yBAAyB;AAAA,IAChD;AAEA,QAAI;AACF,YAAM,OAAO,uBAAuB,oBAAoB;AAAA,IAC1D,SAAS,KAAK;AACZ,YAAM,mCACJ,QAAQ,iDAAiD,QACzD,8BACA,qCAAqC,GAAG;AAC1C,UAAI,CAAC,kCAAkC;AACrC,cAAM;AAAA,MACR;AAEA,oBAAc;AACd,iBAAW;AAAA,QACT;AAAA,QACA;AAAA,MACF;AACA,YAAM,OAAO,uBAAuB;AAAA,QAClC,uBAAuB;AAAA,QACvB,mBAAmB,QAAQ,sBAAsB;AAAA,QACjD,wBAAwB;AAAA,MAC1B,CAAC;AAAA,IACH;AAEA,QAAI,wBAAwB,KAAK,iBAAiB;AAChD,iBAAW;AAAA,QACT;AAAA,QACA,iDAAiD,KAAK,eAAe;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iCAAuC;AAC7C,SAAK,oBAAoB;AACzB,SAAK,kBAAkB,MAAM;AAAA,EAC/B;AAAA,EAEQ,yBACN,OACA,KACA,SACM;AACN,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB;AAAA,IACF;AACA,SAAK,sBAAsB,IAAI,OAAO;AAAA,MACpC,KAAK,IAAI,WAAW,GAAG;AAAA,MACvB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,wBAAwD;AAC9D,QAAI,CAAC,KAAK,iBAAiB;AACzB,aAAO;AAAA,IACT;AACA,QAAI;AACF,UAAI,CAAC,GAAG,WAAW,KAAK,eAAe,GAAG;AACxC,eAAO;AAAA,MACT;AACA,YAAM,MAAM,GAAG,aAAa,KAAK,iBAAiB,MAAM;AACxD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UACE,OAAO,YAAY,KACnB,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,qBAAqB;AAAA,MACnC,CAAC,OAAO,iBAAiB,KAAK,GAC9B;AACA,eAAO;AAAA,MACT;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,QACzD,mBACE,OAAO,OAAO,sBAAsB,WAAW,OAAO,oBAAoB;AAAA,QAC5E,kBAAkB,OAAO;AAAA,QACzB,SACE,OAAO,WAAW,OAAO,OAAO,YAAY,WACxC;AAAA,UACE,YAAY,OAAO,QAAQ;AAAA,UAC3B,MAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,QAAQ,OAAO;AAAA,QACxE,IACA;AAAA,MACR;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,sBAAsB,QAA+C;AAC3E,QAAI,CAAC,KAAK,iBAAiB;AACzB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAmC;AAAA,QACvC,SAAS;AAAA,QACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,QACzD,mBAAmB,OAAO;AAAA,QAC1B,kBAAkB,OAAO,KAAK,OAAO,UAAU,EAAE,SAAS,QAAQ;AAAA,QAClE,SAAS,OAAO,UACZ;AAAA,UACE,YAAY,OAAO,QAAQ;AAAA,UAC3B,MAAM,OAAO,QAAQ;AAAA,QACvB,IACA;AAAA,MACN;AACA,SAAG,UAAU,KAAK,QAAQ,KAAK,eAAe,GAAG,EAAE,WAAW,KAAK,CAAC;AACpE,SAAG,cAAc,KAAK,iBAAiB,KAAK,UAAU,SAAS,MAAM,CAAC,GAAG,MAAM;AAC/E,SAAG,UAAU,KAAK,iBAAiB,GAAK;AAAA,IAC1C,SAAS,KAAK;AACZ,iBAAW,KAAK,oBAAoB,mCAAmC,GAAG;AAAA,IAC5E;AAAA,EACF;AACF;",
+  "names": ["privateKey"]
+}

package/dist/chunk-Q6H5OV2R.js

@@ -0,0 +1,180 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/matrix/deps.ts
+init_shims();
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+var REQUIRED_MATRIX_PACKAGES = [
+  "@archipelagolab/lobi-js-sdk",
+  "@matrix-org/matrix-sdk-crypto-nodejs",
+  "@matrix-org/matrix-sdk-crypto-wasm"
+];
+function resolveMissingMatrixPackages() {
+  try {
+    const req = createRequire(import.meta.url);
+    return REQUIRED_MATRIX_PACKAGES.filter((pkg) => {
+      try {
+        req.resolve(pkg);
+        return false;
+      } catch {
+        return true;
+      }
+    });
+  } catch {
+    return [...REQUIRED_MATRIX_PACKAGES];
+  }
+}
+function isMatrixSdkAvailable() {
+  return resolveMissingMatrixPackages().length === 0;
+}
+function resolvePluginRoot() {
+  const currentDir = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(currentDir, "..", "..");
+}
+async function runFixedCommandWithTimeout(params) {
+  return await new Promise((resolve) => {
+    const [command, ...args] = params.argv;
+    if (!command) {
+      resolve({
+        code: 1,
+        stdout: "",
+        stderr: "command is required"
+      });
+      return;
+    }
+    const proc = spawn(command, args, {
+      cwd: params.cwd,
+      env: { ...process.env, ...params.env },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let timer = null;
+    const finalize = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timer) {
+        clearTimeout(timer);
+      }
+      resolve(result);
+    };
+    proc.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    timer = setTimeout(() => {
+      proc.kill("SIGKILL");
+      finalize({
+        code: 124,
+        stdout,
+        stderr: stderr || `command timed out after ${params.timeoutMs}ms`
+      });
+    }, params.timeoutMs);
+    proc.on("error", (err) => {
+      finalize({
+        code: 1,
+        stdout,
+        stderr: err.message
+      });
+    });
+    proc.on("close", (code) => {
+      finalize({
+        code: code ?? 1,
+        stdout,
+        stderr
+      });
+    });
+  });
+}
+function defaultRequireFn(id) {
+  return createRequire(import.meta.url)(id);
+}
+function defaultResolveFn(id) {
+  return createRequire(import.meta.url).resolve(id);
+}
+function isMissingMatrixCryptoRuntimeError(error) {
+  const message = formatErrorMessage(error);
+  return message.includes("@matrix-org/matrix-sdk-crypto-nodejs-") || message.includes("matrix-sdk-crypto-nodejs") || message.includes("download-lib.js");
+}
+async function ensureMatrixCryptoRuntime(params = {}) {
+  const requireFn = params.requireFn ?? defaultRequireFn;
+  try {
+    requireFn("@matrix-org/matrix-sdk-crypto-nodejs");
+    return;
+  } catch (err) {
+    if (!isMissingMatrixCryptoRuntimeError(err)) {
+      throw err;
+    }
+  }
+  const resolveFn = params.resolveFn ?? defaultResolveFn;
+  const scriptPath = resolveFn("@matrix-org/matrix-sdk-crypto-nodejs/download-lib.js");
+  params.log?.("matrix: bootstrapping native crypto runtime");
+  const runCommand = params.runCommand ?? runFixedCommandWithTimeout;
+  const nodeExecutable = params.nodeExecutable ?? process.execPath;
+  const result = await runCommand({
+    argv: [nodeExecutable, scriptPath],
+    cwd: path.dirname(scriptPath),
+    timeoutMs: 3e5,
+    env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" }
+  });
+  if (result.code !== 0) {
+    throw new Error(
+      result.stderr.trim() || result.stdout.trim() || "Matrix crypto runtime bootstrap failed."
+    );
+  }
+  requireFn("@matrix-org/matrix-sdk-crypto-nodejs");
+}
+async function ensureMatrixSdkInstalled(params) {
+  if (isMatrixSdkAvailable()) {
+    return;
+  }
+  const confirm = params.confirm;
+  if (confirm) {
+    const ok = await confirm(
+      "Matrix requires @archipelagolab/lobi-js-sdk, @matrix-org/matrix-sdk-crypto-nodejs, and @matrix-org/matrix-sdk-crypto-wasm. Install now?"
+    );
+    if (!ok) {
+      throw new Error(
+        "Matrix requires @archipelagolab/lobi-js-sdk, @matrix-org/matrix-sdk-crypto-nodejs, and @matrix-org/matrix-sdk-crypto-wasm (install dependencies first)."
+      );
+    }
+  }
+  const root = resolvePluginRoot();
+  const command = fs.existsSync(path.join(root, "pnpm-lock.yaml")) ? ["pnpm", "install"] : ["npm", "install", "--omit=dev", "--silent"];
+  params.runtime.log?.(`matrix: installing dependencies via ${command[0]} (${root})\u2026`);
+  const result = await runFixedCommandWithTimeout({
+    argv: command,
+    cwd: root,
+    timeoutMs: 3e5,
+    env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" }
+  });
+  if (result.code !== 0) {
+    throw new Error(
+      result.stderr.trim() || result.stdout.trim() || "Matrix dependency install failed."
+    );
+  }
+  if (!isMatrixSdkAvailable()) {
+    const missing = resolveMissingMatrixPackages();
+    throw new Error(
+      missing.length > 0 ? `Matrix dependency install completed but required packages are still missing: ${missing.join(", ")}` : "Matrix dependency install completed but Matrix dependencies are still missing."
+    );
+  }
+}
+
+export {
+  isMatrixSdkAvailable,
+  ensureMatrixCryptoRuntime,
+  ensureMatrixSdkInstalled
+};
+//# sourceMappingURL=chunk-Q6H5OV2R.js.map

package/dist/chunk-Q6H5OV2R.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/deps.ts"],
+  "sourcesContent": ["import { spawn } from \"node:child_process\";\nimport fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { formatErrorMessage } from \"openclaw/plugin-sdk/error-runtime\";\nimport type { RuntimeEnv } from \"../runtime-api.js\";\n\nconst REQUIRED_MATRIX_PACKAGES = [\n  \"@archipelagolab/lobi-js-sdk\",\n  \"@matrix-org/matrix-sdk-crypto-nodejs\",\n  \"@matrix-org/matrix-sdk-crypto-wasm\",\n];\n\ntype MatrixCryptoRuntimeDeps = {\n  requireFn?: (id: string) => unknown;\n  runCommand?: (params: {\n    argv: string[];\n    cwd: string;\n    timeoutMs: number;\n    env?: NodeJS.ProcessEnv;\n  }) => Promise<CommandResult>;\n  resolveFn?: (id: string) => string;\n  nodeExecutable?: string;\n  log?: (message: string) => void;\n};\n\nfunction resolveMissingMatrixPackages(): string[] {\n  try {\n    const req = createRequire(import.meta.url);\n    return REQUIRED_MATRIX_PACKAGES.filter((pkg) => {\n      try {\n        req.resolve(pkg);\n        return false;\n      } catch {\n        return true;\n      }\n    });\n  } catch {\n    return [...REQUIRED_MATRIX_PACKAGES];\n  }\n}\n\nexport function isMatrixSdkAvailable(): boolean {\n  return resolveMissingMatrixPackages().length === 0;\n}\n\nfunction resolvePluginRoot(): string {\n  const currentDir = path.dirname(fileURLToPath(import.meta.url));\n  return path.resolve(currentDir, \"..\", \"..\");\n}\n\ntype CommandResult = {\n  code: number;\n  stdout: string;\n  stderr: string;\n};\n\nasync function runFixedCommandWithTimeout(params: {\n  argv: string[];\n  cwd: string;\n  timeoutMs: number;\n  env?: NodeJS.ProcessEnv;\n}): Promise<CommandResult> {\n  return await new Promise((resolve) => {\n    const [command, ...args] = params.argv;\n    if (!command) {\n      resolve({\n        code: 1,\n        stdout: \"\",\n        stderr: \"command is required\",\n      });\n      return;\n    }\n\n    const proc = spawn(command, args, {\n      cwd: params.cwd,\n      env: { ...process.env, ...params.env },\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n\n    let stdout = \"\";\n    let stderr = \"\";\n    let settled = false;\n    let timer: NodeJS.Timeout | null = null;\n\n    const finalize = (result: CommandResult) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      if (timer) {\n        clearTimeout(timer);\n      }\n      resolve(result);\n    };\n\n    proc.stdout?.on(\"data\", (chunk: Buffer | string) => {\n      stdout += chunk.toString();\n    });\n    proc.stderr?.on(\"data\", (chunk: Buffer | string) => {\n      stderr += chunk.toString();\n    });\n\n    timer = setTimeout(() => {\n      proc.kill(\"SIGKILL\");\n      finalize({\n        code: 124,\n        stdout,\n        stderr: stderr || `command timed out after ${params.timeoutMs}ms`,\n      });\n    }, params.timeoutMs);\n\n    proc.on(\"error\", (err) => {\n      finalize({\n        code: 1,\n        stdout,\n        stderr: err.message,\n      });\n    });\n\n    proc.on(\"close\", (code) => {\n      finalize({\n        code: code ?? 1,\n        stdout,\n        stderr,\n      });\n    });\n  });\n}\n\nfunction defaultRequireFn(id: string): unknown {\n  return createRequire(import.meta.url)(id);\n}\n\nfunction defaultResolveFn(id: string): string {\n  return createRequire(import.meta.url).resolve(id);\n}\n\nfunction isMissingMatrixCryptoRuntimeError(error: unknown): boolean {\n  const message = formatErrorMessage(error);\n  return (\n    message.includes(\"@matrix-org/matrix-sdk-crypto-nodejs-\") ||\n    message.includes(\"matrix-sdk-crypto-nodejs\") ||\n    message.includes(\"download-lib.js\")\n  );\n}\n\nexport async function ensureMatrixCryptoRuntime(\n  params: MatrixCryptoRuntimeDeps = {},\n): Promise<void> {\n  const requireFn = params.requireFn ?? defaultRequireFn;\n  try {\n    requireFn(\"@matrix-org/matrix-sdk-crypto-nodejs\");\n    return;\n  } catch (err) {\n    if (!isMissingMatrixCryptoRuntimeError(err)) {\n      throw err;\n    }\n  }\n\n  const resolveFn = params.resolveFn ?? defaultResolveFn;\n  const scriptPath = resolveFn(\"@matrix-org/matrix-sdk-crypto-nodejs/download-lib.js\");\n  params.log?.(\"matrix: bootstrapping native crypto runtime\");\n  const runCommand = params.runCommand ?? runFixedCommandWithTimeout;\n  const nodeExecutable = params.nodeExecutable ?? process.execPath;\n  const result = await runCommand({\n    argv: [nodeExecutable, scriptPath],\n    cwd: path.dirname(scriptPath),\n    timeoutMs: 300_000,\n    env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: \"0\" },\n  });\n  if (result.code !== 0) {\n    throw new Error(\n      result.stderr.trim() || result.stdout.trim() || \"Matrix crypto runtime bootstrap failed.\",\n    );\n  }\n\n  requireFn(\"@matrix-org/matrix-sdk-crypto-nodejs\");\n}\n\nexport async function ensureMatrixSdkInstalled(params: {\n  runtime: RuntimeEnv;\n  confirm?: (message: string) => Promise<boolean>;\n}): Promise<void> {\n  if (isMatrixSdkAvailable()) {\n    return;\n  }\n  const confirm = params.confirm;\n  if (confirm) {\n    const ok = await confirm(\n      \"Matrix requires @archipelagolab/lobi-js-sdk, @matrix-org/matrix-sdk-crypto-nodejs, and @matrix-org/matrix-sdk-crypto-wasm. Install now?\",\n    );\n    if (!ok) {\n      throw new Error(\n        \"Matrix requires @archipelagolab/lobi-js-sdk, @matrix-org/matrix-sdk-crypto-nodejs, and @matrix-org/matrix-sdk-crypto-wasm (install dependencies first).\",\n      );\n    }\n  }\n\n  const root = resolvePluginRoot();\n  const command = fs.existsSync(path.join(root, \"pnpm-lock.yaml\"))\n    ? [\"pnpm\", \"install\"]\n    : [\"npm\", \"install\", \"--omit=dev\", \"--silent\"];\n  params.runtime.log?.(`matrix: installing dependencies via ${command[0]} (${root})\u2026`);\n  const result = await runFixedCommandWithTimeout({\n    argv: command,\n    cwd: root,\n    timeoutMs: 300_000,\n    env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: \"0\" },\n  });\n  if (result.code !== 0) {\n    throw new Error(\n      result.stderr.trim() || result.stdout.trim() || \"Matrix dependency install failed.\",\n    );\n  }\n  if (!isMatrixSdkAvailable()) {\n    const missing = resolveMissingMatrixPackages();\n    throw new Error(\n      missing.length > 0\n        ? `Matrix dependency install completed but required packages are still missing: ${missing.join(\", \")}`\n        : \"Matrix dependency install completed but Matrix dependencies are still missing.\",\n    );\n  }\n}\n"],
+  "mappings": ";;;;;AAAA;AAAA,SAAS,aAAa;AACtB,OAAO,QAAQ;AACf,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AAGnC,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAeA,SAAS,+BAAyC;AAChD,MAAI;AACF,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAO,yBAAyB,OAAO,CAAC,QAAQ;AAC9C,UAAI;AACF,YAAI,QAAQ,GAAG;AACf,eAAO;AAAA,MACT,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,CAAC,GAAG,wBAAwB;AAAA,EACrC;AACF;AAEO,SAAS,uBAAgC;AAC9C,SAAO,6BAA6B,EAAE,WAAW;AACnD;AAEA,SAAS,oBAA4B;AACnC,QAAM,aAAa,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AAC9D,SAAO,KAAK,QAAQ,YAAY,MAAM,IAAI;AAC5C;AAQA,eAAe,2BAA2B,QAKf;AACzB,SAAO,MAAM,IAAI,QAAQ,CAAC,YAAY;AACpC,UAAM,CAAC,SAAS,GAAG,IAAI,IAAI,OAAO;AAClC,QAAI,CAAC,SAAS;AACZ,cAAQ;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,MAAM;AAAA,MAChC,KAAK,OAAO;AAAA,MACZ,KAAK,EAAE,GAAG,QAAQ,KAAK,GAAG,OAAO,IAAI;AAAA,MACrC,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AAED,QAAI,SAAS;AACb,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,QAA+B;AAEnC,UAAM,WAAW,CAAC,WAA0B;AAC1C,UAAI,SAAS;AACX;AAAA,MACF;AACA,gBAAU;AACV,UAAI,OAAO;AACT,qBAAa,KAAK;AAAA,MACpB;AACA,cAAQ,MAAM;AAAA,IAChB;AAEA,SAAK,QAAQ,GAAG,QAAQ,CAAC,UAA2B;AAClD,gBAAU,MAAM,SAAS;AAAA,IAC3B,CAAC;AACD,SAAK,QAAQ,GAAG,QAAQ,CAAC,UAA2B;AAClD,gBAAU,MAAM,SAAS;AAAA,IAC3B,CAAC;AAED,YAAQ,WAAW,MAAM;AACvB,WAAK,KAAK,SAAS;AACnB,eAAS;AAAA,QACP,MAAM;AAAA,QACN;AAAA,QACA,QAAQ,UAAU,2BAA2B,OAAO,SAAS;AAAA,MAC/D,CAAC;AAAA,IACH,GAAG,OAAO,SAAS;AAEnB,SAAK,GAAG,SAAS,CAAC,QAAQ;AACxB,eAAS;AAAA,QACP,MAAM;AAAA,QACN;AAAA,QACA,QAAQ,IAAI;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AAED,SAAK,GAAG,SAAS,CAAC,SAAS;AACzB,eAAS;AAAA,QACP,MAAM,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,iBAAiB,IAAqB;AAC7C,SAAO,cAAc,YAAY,GAAG,EAAE,EAAE;AAC1C;AAEA,SAAS,iBAAiB,IAAoB;AAC5C,SAAO,cAAc,YAAY,GAAG,EAAE,QAAQ,EAAE;AAClD;AAEA,SAAS,kCAAkC,OAAyB;AAClE,QAAM,UAAU,mBAAmB,KAAK;AACxC,SACE,QAAQ,SAAS,uCAAuC,KACxD,QAAQ,SAAS,0BAA0B,KAC3C,QAAQ,SAAS,iBAAiB;AAEtC;AAEA,eAAsB,0BACpB,SAAkC,CAAC,GACpB;AACf,QAAM,YAAY,OAAO,aAAa;AACtC,MAAI;AACF,cAAU,sCAAsC;AAChD;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,CAAC,kCAAkC,GAAG,GAAG;AAC3C,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,aAAa,UAAU,sDAAsD;AACnF,SAAO,MAAM,6CAA6C;AAC1D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,iBAAiB,OAAO,kBAAkB,QAAQ;AACxD,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B,MAAM,CAAC,gBAAgB,UAAU;AAAA,IACjC,KAAK,KAAK,QAAQ,UAAU;AAAA,IAC5B,WAAW;AAAA,IACX,KAAK,EAAE,iCAAiC,IAAI;AAAA,EAC9C,CAAC;AACD,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,EACF;AAEA,YAAU,sCAAsC;AAClD;AAEA,eAAsB,yBAAyB,QAG7B;AAChB,MAAI,qBAAqB,GAAG;AAC1B;AAAA,EACF;AACA,QAAM,UAAU,OAAO;AACvB,MAAI,SAAS;AACX,UAAM,KAAK,MAAM;AAAA,MACf;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,kBAAkB;AAC/B,QAAM,UAAU,GAAG,WAAW,KAAK,KAAK,MAAM,gBAAgB,CAAC,IAC3D,CAAC,QAAQ,SAAS,IAClB,CAAC,OAAO,WAAW,cAAc,UAAU;AAC/C,SAAO,QAAQ,MAAM,uCAAuC,QAAQ,CAAC,CAAC,KAAK,IAAI,SAAI;AACnF,QAAM,SAAS,MAAM,2BAA2B;AAAA,IAC9C,MAAM;AAAA,IACN,KAAK;AAAA,IACL,WAAW;AAAA,IACX,KAAK,EAAE,iCAAiC,IAAI;AAAA,EAC9C,CAAC;AACD,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI;AAAA,MACR,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK;AAAA,IAClD;AAAA,EACF;AACA,MAAI,CAAC,qBAAqB,GAAG;AAC3B,UAAM,UAAU,6BAA6B;AAC7C,UAAM,IAAI;AAAA,MACR,QAAQ,SAAS,IACb,gFAAgF,QAAQ,KAAK,IAAI,CAAC,KAClG;AAAA,IACN;AAAA,EACF;AACF;",
+  "names": []
+}