@openclaw/matrix 2026.7.2-beta.7 → 2026.7.34

package/dist/credentials-read-DVmFCm7X.js

@@ -1,77 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as getOptionalMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import "./storage-paths-gUmSydsW.js";
-import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { createPluginStateSyncKeyedStore } from "openclaw/plugin-sdk/runtime-doctor";
-//#region extensions/matrix/src/matrix/credentials-read.ts
-var credentials_read_exports = /* @__PURE__ */ __exportAll({
-	MATRIX_CREDENTIALS_MAX_ENTRIES: () => 256,
-	MATRIX_CREDENTIALS_NAMESPACE: () => MATRIX_CREDENTIALS_NAMESPACE,
-	clearMatrixCredentials: () => clearMatrixCredentials,
-	credentialsMatchConfig: () => credentialsMatchConfig,
-	isMatrixCredentialRevocation: () => isMatrixCredentialRevocation,
-	loadMatrixCredentials: () => loadMatrixCredentials,
-	matrixCredentialsStoreKey: () => matrixCredentialsStoreKey,
-	normalizeMatrixStoredCredentials: () => normalizeMatrixStoredCredentials,
-	openMatrixCredentialsStore: () => openMatrixCredentialsStore
-});
-const MATRIX_CREDENTIALS_NAMESPACE = "credentials";
-function matrixCredentialsStoreKey(accountId) {
-	return `account:${normalizeAccountId(accountId)}`;
-}
-function normalizeMatrixStoredCredentials(value, accountId) {
-	if (!value || typeof value !== "object") return null;
-	const parsed = value;
-	if (typeof parsed.homeserver !== "string" || !parsed.homeserver || typeof parsed.userId !== "string" || !parsed.userId || typeof parsed.accessToken !== "string" || !parsed.accessToken || typeof parsed.createdAt !== "string" || !parsed.createdAt) return null;
-	return {
-		accountId: normalizeAccountId(accountId ?? parsed.accountId),
-		homeserver: parsed.homeserver,
-		userId: parsed.userId,
-		accessToken: parsed.accessToken,
-		...typeof parsed.deviceId === "string" ? { deviceId: parsed.deviceId } : {},
-		createdAt: parsed.createdAt,
-		...typeof parsed.lastUsedAt === "string" ? { lastUsedAt: parsed.lastUsedAt } : {}
-	};
-}
-function isMatrixCredentialRevocation(value, accountId) {
-	if (!value || typeof value !== "object") return false;
-	const parsed = value;
-	return parsed.kind === "revoked" && typeof parsed.revokedAt === "string" && parsed.revokedAt.length > 0 && normalizeAccountId(parsed.accountId) === normalizeAccountId(accountId ?? parsed.accountId);
-}
-function openMatrixCredentialsStore(env = process.env) {
-	const runtime = getOptionalMatrixRuntime();
-	const resolvedEnv = env.OPENCLAW_STATE_DIR?.trim() || !runtime ? env : {
-		...env,
-		OPENCLAW_STATE_DIR: runtime.state.resolveStateDir(env)
-	};
-	return createPluginStateSyncKeyedStore("matrix", {
-		namespace: MATRIX_CREDENTIALS_NAMESPACE,
-		maxEntries: 256,
-		overflowPolicy: "reject-new",
-		env: resolvedEnv
-	});
-}
-function loadMatrixCredentials(env = process.env, accountId) {
-	const normalizedAccountId = normalizeAccountId(accountId);
-	const parsed = normalizeMatrixStoredCredentials(openMatrixCredentialsStore(env).lookup(matrixCredentialsStoreKey(accountId)), normalizedAccountId);
-	if (!parsed || parsed.accountId !== normalizedAccountId) return null;
-	const { accountId: _accountId, ...credentials } = parsed;
-	return credentials;
-}
-function clearMatrixCredentials(env = process.env, accountId) {
-	const normalizedAccountId = normalizeAccountId(accountId);
-	openMatrixCredentialsStore(env).register(matrixCredentialsStoreKey(normalizedAccountId), {
-		accountId: normalizedAccountId,
-		kind: "revoked",
-		revokedAt: (/* @__PURE__ */ new Date()).toISOString()
-	});
-}
-function credentialsMatchConfig(stored, config) {
-	if (!config.userId) {
-		if (!config.accessToken) return false;
-		return stored.homeserver === config.homeserver && stored.accessToken === config.accessToken;
-	}
-	return stored.homeserver === config.homeserver && stored.userId === config.userId;
-}
-//#endregion
-export { isMatrixCredentialRevocation as a, normalizeMatrixStoredCredentials as c, credentials_read_exports as i, openMatrixCredentialsStore as l, clearMatrixCredentials as n, loadMatrixCredentials as o, credentialsMatchConfig as r, matrixCredentialsStoreKey as s, MATRIX_CREDENTIALS_NAMESPACE as t };

package/dist/doctor-CM8ijNpW.js

@@ -1,64 +0,0 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BMSJkkAE.js";
-import { detectPluginInstallPathIssue, formatPluginInstallPathIssue, removePluginFromConfig } from "openclaw/plugin-sdk/runtime-doctor";
-//#region extensions/matrix/src/doctor.ts
-async function collectMatrixInstallPathWarnings(cfg) {
-	const issue = await detectPluginInstallPathIssue({
-		pluginId: "matrix",
-		install: cfg.plugins?.installs?.matrix
-	});
-	if (!issue) return [];
-	return formatPluginInstallPathIssue({
-		issue,
-		pluginLabel: "Matrix",
-		defaultInstallCommand: "openclaw plugins install @openclaw/matrix"
-	}).map((entry) => `- ${entry}`);
-}
-async function cleanStaleMatrixPluginConfig(cfg) {
-	const issue = await detectPluginInstallPathIssue({
-		pluginId: "matrix",
-		install: cfg.plugins?.installs?.matrix
-	});
-	if (!issue || issue.kind !== "missing-path") return {
-		config: cfg,
-		changes: []
-	};
-	const { config, actions } = removePluginFromConfig(cfg, "matrix");
-	const removed = [];
-	if (actions.install) removed.push("install record");
-	if (actions.loadPath) removed.push("load path");
-	if (actions.entry) removed.push("plugin entry");
-	if (actions.allowlist) removed.push("allowlist entry");
-	if (removed.length === 0) return {
-		config: cfg,
-		changes: []
-	};
-	return {
-		config,
-		changes: [`Removed stale Matrix plugin references (${removed.join(", ")}). The previous install path no longer exists: ${issue.path}`]
-	};
-}
-async function runMatrixDoctorSequence(params) {
-	const warningNotes = [];
-	const installWarnings = await collectMatrixInstallPathWarnings(params.cfg);
-	if (installWarnings.length > 0) warningNotes.push(installWarnings.join("\n"));
-	return {
-		changeNotes: [],
-		warningNotes
-	};
-}
-const matrixDoctor = {
-	dmAllowFromMode: "nestedOnly",
-	groupModel: "sender",
-	groupAllowFromFallbackToAllowFrom: false,
-	warnOnEmptyGroupSenderAllowlist: true,
-	legacyConfigRules,
-	normalizeCompatibilityConfig,
-	runConfigSequence: async ({ cfg, env, shouldRepair }) => await runMatrixDoctorSequence({
-		cfg,
-		env,
-		shouldRepair
-	}),
-	cleanStaleConfig: async ({ cfg }) => await cleanStaleMatrixPluginConfig(cfg)
-};
-//#endregion
-export { cleanStaleMatrixPluginConfig, collectMatrixInstallPathWarnings, matrixDoctor, runMatrixDoctorSequence };

package/dist/doctor-contract-BMSJkkAE.js

@@ -1,167 +0,0 @@
-import { t as isRecord } from "./record-shared-CWWx6fvI.js";
-import { defineChannelAliasMigration, defineKeyMoveMigration, hasLegacyAccountStreamingAliases, normalizeChannelConfigEntries, stripRetiredChannelKeys } from "openclaw/plugin-sdk/runtime-doctor";
-import { hasLegacyFlatAllowPrivateNetworkAlias, migrateLegacyFlatAllowPrivateNetworkAlias } from "openclaw/plugin-sdk/ssrf-runtime";
-//#region extensions/matrix/src/doctor-contract.ts
-function parseMatrixStreamingMode(value) {
-	if (typeof value !== "string") return null;
-	const normalized = value.trim().toLowerCase();
-	return normalized === "partial" || normalized === "quiet" || normalized === "progress" || normalized === "off" ? normalized : null;
-}
-const streamingAliasMigration = defineChannelAliasMigration({
-	channelId: "matrix",
-	streaming: {
-		defaultMode: "off",
-		resolveMode: (entry) => {
-			const streaming = isRecord(entry.streaming) ? entry.streaming : null;
-			const parsed = parseMatrixStreamingMode(streaming ? streaming.mode : entry.streaming);
-			if (parsed) return parsed;
-			return entry.streaming === true ? "partial" : "off";
-		}
-	},
-	accountStreamingReplacesRoot: true
-});
-const roomAllowMigration = defineKeyMoveMigration({
-	scope: ["*"],
-	from: ["allow"],
-	to: ["enabled"],
-	sourceOwn: false,
-	match: (value) => typeof value === "boolean",
-	targetIsSet: (value) => typeof value === "boolean",
-	movedMessage: ({ sourcePath, targetPath, mappedValue }) => `Moved ${sourcePath} → ${targetPath} (${String(mappedValue)}).`,
-	existingMessage: ({ sourcePath, targetPath, targetValue }) => `Moved ${sourcePath} → ${targetPath} (${String(targetValue)}).`
-});
-function hasLegacyTrustedDmPolicy(value) {
-	const root = isRecord(value) ? value : null;
-	if (!root) return false;
-	return (isRecord(root.dm) ? root.dm : null)?.policy === "trusted";
-}
-function migrateLegacyTrustedDmPolicy(params) {
-	const dm = isRecord(params.entry.dm) ? params.entry.dm : null;
-	if (!dm || dm.policy !== "trusted") return {
-		entry: params.entry,
-		changed: false
-	};
-	const allowFromRaw = dm.allowFrom;
-	const allowFromEntries = Array.isArray(allowFromRaw) ? allowFromRaw.filter((entry) => typeof entry === "string" && entry.trim().length > 0).length : 0;
-	const nextPolicy = allowFromEntries > 0 ? "allowlist" : "pairing";
-	const nextDm = {
-		...dm,
-		policy: nextPolicy
-	};
-	params.changes.push(`Migrated ${params.pathPrefix}.dm.policy "trusted" → "${nextPolicy}" (legacy alias removed; ${allowFromEntries > 0 ? `preserved ${allowFromEntries} ${params.pathPrefix}.dm.allowFrom ${allowFromEntries === 1 ? "entry" : "entries"}` : "no allowFrom entries present, defaulting to pairing for safety"}).`);
-	return {
-		entry: {
-			...params.entry,
-			dm: nextDm
-		},
-		changed: true
-	};
-}
-const legacyConfigRules = [
-	...streamingAliasMigration.legacyConfigRules,
-	{
-		path: ["channels", "matrix"],
-		message: "channels.matrix.allowPrivateNetwork is legacy; use channels.matrix.network.dangerouslyAllowPrivateNetwork instead. Run \"openclaw doctor --fix\".",
-		match: (value) => hasLegacyFlatAllowPrivateNetworkAlias(isRecord(value) ? value : {})
-	},
-	{
-		path: [
-			"channels",
-			"matrix",
-			"accounts"
-		],
-		message: "channels.matrix.accounts.<id>.allowPrivateNetwork is legacy; use channels.matrix.accounts.<id>.network.dangerouslyAllowPrivateNetwork instead. Run \"openclaw doctor --fix\".",
-		match: (value) => hasLegacyAccountStreamingAliases(value, (account) => hasLegacyFlatAllowPrivateNetworkAlias(isRecord(account) ? account : {}))
-	},
-	{
-		path: [
-			"channels",
-			"matrix",
-			"groups"
-		],
-		message: "channels.matrix.groups.<room>.allow is legacy; use channels.matrix.groups.<room>.enabled instead. Run \"openclaw doctor --fix\".",
-		match: roomAllowMigration.hasLegacy
-	},
-	{
-		path: [
-			"channels",
-			"matrix",
-			"rooms"
-		],
-		message: "channels.matrix.rooms.<room>.allow is legacy; use channels.matrix.rooms.<room>.enabled instead. Run \"openclaw doctor --fix\".",
-		match: roomAllowMigration.hasLegacy
-	},
-	{
-		path: [
-			"channels",
-			"matrix",
-			"accounts"
-		],
-		message: "channels.matrix.accounts.<id>.{groups,rooms}.<room>.allow is legacy; use channels.matrix.accounts.<id>.{groups,rooms}.<room>.enabled instead. Run \"openclaw doctor --fix\".",
-		match: (value) => hasLegacyAccountStreamingAliases(value, (account) => {
-			if (!isRecord(account)) return false;
-			return roomAllowMigration.hasLegacy(account.groups) || roomAllowMigration.hasLegacy(account.rooms);
-		})
-	},
-	{
-		path: ["channels", "matrix"],
-		message: "channels.matrix.dm.policy \"trusted\" is legacy; use \"allowlist\" (with allowFrom entries) or \"pairing\" instead. Run \"openclaw doctor --fix\".",
-		match: hasLegacyTrustedDmPolicy
-	},
-	{
-		path: [
-			"channels",
-			"matrix",
-			"accounts"
-		],
-		message: "channels.matrix.accounts.<id>.dm.policy \"trusted\" is legacy; use \"allowlist\" (with allowFrom entries) or \"pairing\" instead. Run \"openclaw doctor --fix\".",
-		match: (value) => hasLegacyAccountStreamingAliases(value, hasLegacyTrustedDmPolicy)
-	}
-];
-function normalizeMatrixEntry(params) {
-	const network = migrateLegacyFlatAllowPrivateNetworkAlias(params);
-	const dmPolicy = migrateLegacyTrustedDmPolicy({
-		...params,
-		entry: network.entry
-	});
-	let entry = dmPolicy.entry;
-	let changed = network.changed || dmPolicy.changed;
-	for (const section of ["groups", "rooms"]) {
-		const roomMap = isRecord(entry[section]) ? entry[section] : null;
-		if (!roomMap) continue;
-		const normalized = roomAllowMigration.normalize({
-			entry: roomMap,
-			pathPrefix: `${params.pathPrefix}.${section}`,
-			changes: params.changes
-		});
-		if (normalized.changed) {
-			entry = Object.assign({}, entry, { [section]: normalized.entry });
-			changed = true;
-		}
-	}
-	return {
-		entry,
-		changed
-	};
-}
-function normalizeCompatibilityConfig({ cfg }) {
-	const changes = [];
-	const withoutJunkStreamMode = stripRetiredChannelKeys({
-		cfg,
-		channelId: "matrix",
-		keys: /* @__PURE__ */ new Set(["streamMode"]),
-		scope: "root-and-accounts",
-		onRemove: ({ key, pathPrefix }) => changes.push(`Removed ${pathPrefix}.${key} (never read by the Matrix runtime).`)
-	}).config;
-	return normalizeChannelConfigEntries({
-		cfg: streamingAliasMigration.normalizeChannelConfig({
-			cfg: withoutJunkStreamMode,
-			changes
-		}).config,
-		channelId: "matrix",
-		changes,
-		normalizeEntry: normalizeMatrixEntry
-	});
-}
-//#endregion
-export { normalizeCompatibilityConfig as n, legacyConfigRules as t };

package/dist/inbound-dedupe-CaBLblef.js

@@ -1,48 +0,0 @@
-import { n as LogService } from "./logger-D0GCSDQq.js";
-import { createChannelReplayGuard, resolvePersistentDedupePluginStateNamespace } from "openclaw/plugin-sdk/persistent-dedupe";
-//#region extensions/matrix/src/matrix/monitor/inbound-dedupe.ts
-const MATRIX_INBOUND_DEDUPE_PLUGIN_ID = "matrix";
-const MATRIX_INBOUND_DEDUPE_NAMESPACE_PREFIX = "matrix.inbound-dedupe";
-const MATRIX_INBOUND_DEDUPE_NAMESPACE = "global";
-const MATRIX_INBOUND_DEDUPE_TTL_MS = 720 * 60 * 60 * 1e3;
-const MATRIX_INBOUND_DEDUPE_MEMORY_MAX = 5e3;
-const MATRIX_INBOUND_DEDUPE_STATE_MAX_ENTRIES = 2e4;
-function resolveMatrixInboundDedupeAccountId(accountId) {
-	return accountId.trim() || "default";
-}
-function buildMatrixInboundDedupeEventKey(params) {
-	const roomId = params.roomId.trim();
-	const eventId = params.eventId.trim();
-	if (!roomId || !eventId) return null;
-	return `${resolveMatrixInboundDedupeAccountId(params.accountId)}\0${roomId}\0${eventId}`;
-}
-/** Persisted plugin-state namespace holding the inbound dedupe rows. */
-function resolveMatrixInboundDedupeStateNamespace() {
-	return resolvePersistentDedupePluginStateNamespace({
-		namespace: MATRIX_INBOUND_DEDUPE_NAMESPACE,
-		namespacePrefix: MATRIX_INBOUND_DEDUPE_NAMESPACE_PREFIX
-	});
-}
-function createMatrixInboundEventDeduper(params) {
-	const accountId = params.auth.accountId;
-	return createChannelReplayGuard({
-		dedupe: {
-			pluginId: MATRIX_INBOUND_DEDUPE_PLUGIN_ID,
-			namespacePrefix: MATRIX_INBOUND_DEDUPE_NAMESPACE_PREFIX,
-			ttlMs: MATRIX_INBOUND_DEDUPE_TTL_MS,
-			memoryMaxSize: MATRIX_INBOUND_DEDUPE_MEMORY_MAX,
-			stateMaxEntries: MATRIX_INBOUND_DEDUPE_STATE_MAX_ENTRIES,
-			...params.env ? { env: params.env } : {},
-			onDiskError: (err) => {
-				LogService.warn("MatrixInboundDedupe", "Matrix inbound dedupe persistence failed:", err);
-			}
-		},
-		buildReplayKey: (event) => buildMatrixInboundDedupeEventKey({
-			accountId,
-			...event
-		}),
-		namespace: () => MATRIX_INBOUND_DEDUPE_NAMESPACE
-	});
-}
-//#endregion
-export { resolveMatrixInboundDedupeStateNamespace as a, createMatrixInboundEventDeduper as i, MATRIX_INBOUND_DEDUPE_TTL_MS as n, buildMatrixInboundDedupeEventKey as r, MATRIX_INBOUND_DEDUPE_STATE_MAX_ENTRIES as t };

package/dist/probe.runtime-BuieqmS3.js

@@ -1,3 +0,0 @@
-import { t as createMatrixClient } from "./create-client-BmSU-q-D.js";
-import "./client-Dbso3-0V.js";
-export { createMatrixClient };

package/dist/record-shared-CWWx6fvI.js

@@ -1,2 +0,0 @@
-import { isRecord as isRecord$1 } from "openclaw/plugin-sdk/string-coerce-runtime";
-export { isRecord$1 as t };

package/dist/recovery-key-store-BNnHvXdk.js

@@ -1,275 +0,0 @@
-import { n as formatMatrixErrorReason, t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { A as writeMatrixRecoveryKeyStateForPath, E as readMatrixRecoveryKeyStateForPath, S as readLegacyMatrixRecoveryKeyFile, _ as migrateLegacyMatrixRecoveryKeyFilePathToStore } from "./storage-BvAkgzvT.js";
-import { n as LogService } from "./logger-D0GCSDQq.js";
-import path from "node:path";
-import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";
-//#region extensions/matrix/src/matrix/sdk/recovery-key-store.ts
-function isRepairableSecretStorageAccessError(err) {
-	const message = formatMatrixErrorReason(err);
-	if (!message) return false;
-	if (message.includes("getsecretstoragekey callback returned falsey")) return true;
-	if (message.includes("decrypting secret") && message.includes("bad mac")) return true;
-	return false;
-}
-var MatrixRecoveryKeyStore = class {
-	constructor(recoveryKeyPath) {
-		this.secretStorageKeyCache = /* @__PURE__ */ new Map();
-		this.stagedRecoveryKey = null;
-		this.stagedRecoveryKeyUsed = false;
-		this.stagedCacheKeyIds = /* @__PURE__ */ new Set();
-		this.recoveryKeyPath = recoveryKeyPath;
-		this.storageRootDir = recoveryKeyPath ? path.dirname(recoveryKeyPath) : void 0;
-		if (this.recoveryKeyPath) try {
-			migrateLegacyMatrixRecoveryKeyFilePathToStore(this.recoveryKeyPath);
-		} catch (err) {
-			this.legacyRecoveryKeyPathOnMigrationFailure = this.recoveryKeyPath;
-			LogService.warn("MatrixClientLite", "Failed to migrate Matrix recovery key state:", err);
-		}
-	}
-	buildCryptoCallbacks() {
-		return {
-			getSecretStorageKey: async ({ keys }) => {
-				const requestedKeyIds = Object.keys(keys ?? {});
-				if (requestedKeyIds.length === 0) return null;
-				const staged = this.resolveStagedSecretStorageKey(requestedKeyIds);
-				if (staged) return staged;
-				for (const keyId of requestedKeyIds) {
-					const cached = this.secretStorageKeyCache.get(keyId);
-					if (cached) return [keyId, new Uint8Array(cached.key)];
-				}
-				const stored = this.loadStoredRecoveryKey();
-				if (!stored?.privateKeyBase64) return null;
-				const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
-				if (privateKey.length === 0) return null;
-				if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
-					this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);
-					return [stored.keyId, privateKey];
-				}
-				const firstRequestedKeyId = requestedKeyIds[0];
-				if (!firstRequestedKeyId) return null;
-				this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);
-				return [firstRequestedKeyId, privateKey];
-			},
-			cacheSecretStorageKey: (keyId, keyInfo, key) => {
-				const privateKey = new Uint8Array(key);
-				const normalizedKeyInfo = {
-					passphrase: keyInfo?.passphrase,
-					name: typeof keyInfo?.name === "string" ? keyInfo.name : void 0
-				};
-				this.rememberSecretStorageKey(keyId, privateKey, normalizedKeyInfo);
-				const stored = this.loadStoredRecoveryKey();
-				this.saveRecoveryKeyToDisk({
-					keyId,
-					keyInfo: normalizedKeyInfo,
-					privateKey,
-					encodedPrivateKey: stored?.encodedPrivateKey
-				});
-			}
-		};
-	}
-	getRecoveryKeySummary() {
-		const stored = this.loadStoredRecoveryKey();
-		if (!stored) return null;
-		return {
-			encodedPrivateKey: stored.encodedPrivateKey,
-			keyId: stored.keyId,
-			createdAt: stored.createdAt
-		};
-	}
-	getSecretStorageKeyCandidate(keyId) {
-		const normalizedKeyId = keyId.trim();
-		if (!normalizedKeyId) return null;
-		const staged = this.resolveStagedSecretStorageKey([normalizedKeyId]);
-		if (staged) return staged[1];
-		const stored = this.loadStoredRecoveryKey();
-		if (!stored?.privateKeyBase64) return null;
-		const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
-		if (privateKey.length === 0) return null;
-		this.rememberSecretStorageKey(normalizedKeyId, privateKey, stored.keyInfo);
-		return privateKey;
-	}
-	resolveEncodedRecoveryKeyInput(params) {
-		const encodedPrivateKey = params.encodedPrivateKey.trim();
-		if (!encodedPrivateKey) throw new Error("Matrix recovery key is required");
-		let privateKey;
-		try {
-			privateKey = decodeRecoveryKey(encodedPrivateKey);
-		} catch (err) {
-			throw new Error(`Invalid Matrix recovery key: ${formatMatrixErrorMessage(err)}`, { cause: err });
-		}
-		const keyId = typeof params.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : null;
-		return {
-			encodedPrivateKey,
-			privateKey,
-			keyId,
-			keyInfo: params.keyInfo ?? this.loadStoredRecoveryKey()?.keyInfo
-		};
-	}
-	storeEncodedRecoveryKey(params) {
-		const prepared = this.resolveEncodedRecoveryKeyInput(params);
-		this.saveRecoveryKeyToDisk({
-			keyId: prepared.keyId,
-			keyInfo: prepared.keyInfo,
-			privateKey: prepared.privateKey,
-			encodedPrivateKey: prepared.encodedPrivateKey
-		});
-		if (prepared.keyId) this.rememberSecretStorageKey(prepared.keyId, prepared.privateKey, prepared.keyInfo);
-		return this.getRecoveryKeySummary() ?? {};
-	}
-	stageEncodedRecoveryKey(params) {
-		const prepared = this.resolveEncodedRecoveryKeyInput(params);
-		this.discardStagedRecoveryKey();
-		this.stagedRecoveryKey = {
-			version: 1,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			keyId: prepared.keyId,
-			encodedPrivateKey: prepared.encodedPrivateKey,
-			privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
-			keyInfo: prepared.keyInfo
-		};
-	}
-	hasStagedRecoveryKeyBeenUsed() {
-		return this.stagedRecoveryKeyUsed;
-	}
-	commitStagedRecoveryKey(params) {
-		if (!this.stagedRecoveryKey) return this.getRecoveryKeySummary();
-		const staged = this.stagedRecoveryKey;
-		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
-		const keyId = typeof params?.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;
-		this.saveRecoveryKeyToDisk({
-			keyId,
-			keyInfo: params?.keyInfo ?? staged.keyInfo,
-			privateKey,
-			encodedPrivateKey: staged.encodedPrivateKey
-		});
-		this.clearStagedRecoveryKeyTracking();
-		return this.getRecoveryKeySummary();
-	}
-	discardStagedRecoveryKey() {
-		for (const keyId of this.stagedCacheKeyIds) this.secretStorageKeyCache.delete(keyId);
-		this.clearStagedRecoveryKeyTracking();
-	}
-	async bootstrapSecretStorageWithRecoveryKey(crypto, options = {}) {
-		let status = null;
-		const getSecretStorageStatus = crypto.getSecretStorageStatus;
-		if (typeof getSecretStorageStatus === "function") try {
-			status = await getSecretStorageStatus.call(crypto);
-		} catch (err) {
-			LogService.warn("MatrixClientLite", "Failed to read secret storage status:", err);
-		}
-		const hasDefaultSecretStorageKey = Boolean(status?.defaultKeyId);
-		const hasKnownInvalidSecrets = Object.values(status?.secretStorageKeyValidityMap ?? {}).some((valid) => !valid);
-		let generatedRecoveryKey = false;
-		const storedRecovery = this.loadStoredRecoveryKey();
-		const stagedRecovery = this.stagedRecoveryKey;
-		const sourceRecovery = options.forceNewRecoveryKey === true ? null : stagedRecovery ?? storedRecovery;
-		let recoveryKey = sourceRecovery ? {
-			keyInfo: sourceRecovery.keyInfo,
-			privateKey: new Uint8Array(Buffer.from(sourceRecovery.privateKeyBase64, "base64")),
-			encodedPrivateKey: sourceRecovery.encodedPrivateKey
-		} : null;
-		if (recoveryKey && status?.defaultKeyId) {
-			const defaultKeyId = status.defaultKeyId;
-			if (!stagedRecovery) {
-				this.rememberSecretStorageKey(defaultKeyId, recoveryKey.privateKey, recoveryKey.keyInfo);
-				if (storedRecovery && storedRecovery.keyId !== defaultKeyId) this.saveRecoveryKeyToDisk({
-					keyId: defaultKeyId,
-					keyInfo: recoveryKey.keyInfo,
-					privateKey: recoveryKey.privateKey,
-					encodedPrivateKey: recoveryKey.encodedPrivateKey
-				});
-			}
-		}
-		const ensureRecoveryKey = async () => {
-			if (recoveryKey) {
-				if (stagedRecovery) this.stagedRecoveryKeyUsed = true;
-				return recoveryKey;
-			}
-			if (typeof crypto.createRecoveryKeyFromPassphrase !== "function") throw new Error("Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)");
-			recoveryKey = await crypto.createRecoveryKeyFromPassphrase();
-			this.saveRecoveryKeyToDisk(recoveryKey);
-			generatedRecoveryKey = true;
-			return recoveryKey;
-		};
-		const shouldRecreateSecretStorage = options.forceNewSecretStorage === true || !hasDefaultSecretStorageKey || !recoveryKey && status?.ready === false || hasKnownInvalidSecrets;
-		if (hasKnownInvalidSecrets) recoveryKey = null;
-		const secretStorageOptions = { setupNewKeyBackup: options.setupNewKeyBackup === true };
-		if (shouldRecreateSecretStorage) {
-			secretStorageOptions.setupNewSecretStorage = true;
-			secretStorageOptions.createSecretStorageKey = ensureRecoveryKey;
-		}
-		try {
-			await crypto.bootstrapSecretStorage(secretStorageOptions);
-		} catch (err) {
-			if (!(options.allowSecretStorageRecreateWithoutRecoveryKey === true && hasDefaultSecretStorageKey && isRepairableSecretStorageAccessError(err))) throw err;
-			recoveryKey = null;
-			LogService.warn("MatrixClientLite", "Secret storage exists on the server but local recovery material cannot unlock it; recreating secret storage during explicit bootstrap.");
-			await crypto.bootstrapSecretStorage({
-				setupNewSecretStorage: true,
-				setupNewKeyBackup: options.setupNewKeyBackup === true,
-				createSecretStorageKey: ensureRecoveryKey
-			});
-		}
-		if (generatedRecoveryKey && this.storageRootDir) LogService.warn("MatrixClientLite", "Generated Matrix recovery key and saved it to Matrix SQLite state. Keep the displayed recovery key secure.");
-	}
-	clearStagedRecoveryKeyTracking() {
-		this.stagedRecoveryKey = null;
-		this.stagedRecoveryKeyUsed = false;
-		this.stagedCacheKeyIds.clear();
-	}
-	resolveStagedSecretStorageKey(requestedKeyIds) {
-		const staged = this.stagedRecoveryKey;
-		if (!staged?.privateKeyBase64) return null;
-		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
-		if (privateKey.length === 0) return null;
-		const keyId = staged.keyId && requestedKeyIds.includes(staged.keyId) ? staged.keyId : requestedKeyIds[0];
-		if (!keyId) return null;
-		this.rememberStagedSecretStorageKey(keyId, privateKey, staged.keyInfo);
-		this.stagedCacheKeyIds.add(keyId);
-		return [keyId, privateKey];
-	}
-	rememberStagedSecretStorageKey(keyId, key, keyInfo) {
-		this.stagedRecoveryKeyUsed = true;
-		this.rememberSecretStorageKey(keyId, key, keyInfo);
-	}
-	rememberSecretStorageKey(keyId, key, keyInfo) {
-		if (!keyId.trim()) return;
-		this.secretStorageKeyCache.set(keyId, {
-			key: new Uint8Array(key),
-			keyInfo
-		});
-	}
-	loadStoredRecoveryKey() {
-		if (!this.recoveryKeyPath) return null;
-		try {
-			const stored = readMatrixRecoveryKeyStateForPath(this.recoveryKeyPath);
-			if (stored) return stored;
-		} catch {}
-		if (this.legacyRecoveryKeyPathOnMigrationFailure) return readLegacyMatrixRecoveryKeyFile(this.legacyRecoveryKeyPathOnMigrationFailure);
-		return null;
-	}
-	saveRecoveryKeyToDisk(params) {
-		if (!this.recoveryKeyPath) return;
-		try {
-			const payload = {
-				version: 1,
-				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-				keyId: typeof params.keyId === "string" ? params.keyId : null,
-				encodedPrivateKey: params.encodedPrivateKey,
-				privateKeyBase64: Buffer.from(params.privateKey).toString("base64"),
-				keyInfo: params.keyInfo ? {
-					passphrase: params.keyInfo.passphrase,
-					name: params.keyInfo.name
-				} : void 0
-			};
-			writeMatrixRecoveryKeyStateForPath({
-				recoveryKeyPath: this.recoveryKeyPath,
-				payload
-			});
-		} catch (err) {
-			LogService.warn("MatrixClientLite", "Failed to persist recovery key:", err);
-		}
-	}
-};
-//#endregion
-export { isRepairableSecretStorageAccessError as n, MatrixRecoveryKeyStore as t };