@openclaw/matrix 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/client-CeGw0G5S.js

@@ -0,0 +1,784 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, n as requiresExplicitMatrixDefaultAccount, o as resolveMatrixAccountStringValues } from "./account-selection-CWuhuFn1.js";
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.js";
+import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
+import { r as resolveScopedMatrixEnvConfig, t as resolveGlobalMatrixEnvConfig } from "./env-auth-MVS-Vv41.js";
+import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
+import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
+import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage, s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BsGuHngK.js";
+import { n as LogService } from "./logger-B_71hN6W.js";
+import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, normalizeOptionalAccountId, normalizeOptionalAccountId as normalizeOptionalAccountId$1 } from "openclaw/plugin-sdk/account-id";
+import { coerceSecretRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input-runtime";
+import { formatErrorMessage, toErrorObject, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
+import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
+import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork, ssrfPolicyFromDangerouslyAllowPrivateNetwork as ssrfPolicyFromDangerouslyAllowPrivateNetwork$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import fs from "node:fs";
+import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+//#region extensions/matrix/src/matrix/client/config.ts
+const loadMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-DjaQFCHc.js"), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
+	MatrixClient: sdkModule.MatrixClient,
+	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
+})));
+const MATRIX_AUTH_REQUEST_RETRY_RE = /\b(fetch failed|econnreset|econnrefused|enotfound|etimedout|ehostunreach|enetunreach|eai_again|und_err_|socket hang up|network|headers timeout|body timeout|connect timeout)\b/i;
+const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-B37cQknZ.js").then((n) => n.r));
+const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-nAV2-5uR.js"));
+const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("./config-secret-input.runtime-CwsP3--c.js"));
+function shouldRetryMatrixAuthRequest(err) {
+	return MATRIX_AUTH_REQUEST_RETRY_RE.test(formatErrorMessage(err));
+}
+function isAbortSignalTriggered(signal) {
+	return signal?.aborted === true;
+}
+function credentialsMatchBackfillAuthLineage(params) {
+	if (!params.stored) return true;
+	return params.stored.homeserver === params.auth.homeserver && params.stored.userId === params.auth.userId && params.stored.accessToken === params.auth.accessToken;
+}
+async function retryMatrixAuthRequest(label, run, signal) {
+	return await retryAsync(run, {
+		attempts: 3,
+		minDelayMs: 250,
+		maxDelayMs: 1500,
+		jitter: .1,
+		label,
+		shouldRetry: (err) => shouldRetryMatrixAuthRequest(err),
+		sleep: (ms) => sleepWithAbort(ms, signal)
+	});
+}
+async function fetchMatrixWhoamiIdentity(params) {
+	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixAuthClientDeps();
+	ensureMatrixSdkLoggingConfigured();
+	const tempClient = new MatrixClient(params.homeserver, params.accessToken, {
+		userId: params.userId,
+		ssrfPolicy: params.ssrfPolicy,
+		dispatcherPolicy: params.dispatcherPolicy
+	});
+	return await retryMatrixAuthRequest("matrix auth whoami", async () => await tempClient.doRequest("GET", "/_matrix/client/v3/account/whoami"), params.signal);
+}
+const MATRIX_CONFIG_STRING_FIELDS = [
+	"homeserver",
+	"userId",
+	"accessToken",
+	"password",
+	"deviceId",
+	"deviceName"
+];
+const MATRIX_AUTH_SECRET_FIELDS = ["accessToken", "password"];
+function readMatrixEnvSecretRef(params) {
+	const provider = params.cfg.secrets?.providers?.[params.ref.provider];
+	if (provider) {
+		if (provider.source !== "env") throw new Error(`Secret provider "${params.ref.provider}" has source "${provider.source}" but ref requests "env".`);
+		if (provider.allowlist && !provider.allowlist.includes(params.ref.id)) throw new Error(`Environment variable "${params.ref.id}" is not allowlisted in secrets.providers.${params.ref.provider}.allowlist.`);
+	} else if (params.ref.provider !== (params.cfg.secrets?.defaults?.env?.trim() || "default")) throw new Error(`Secret provider "${params.ref.provider}" is not configured (ref: env:${params.ref.provider}:${params.ref.id}).`);
+	return params.env[params.ref.id]?.trim() || void 0;
+}
+function readMatrixConfigString(params) {
+	const ref = coerceSecretRef(params.value, params.cfg.secrets?.defaults);
+	if (params.suppressSecretRef && ref) return "";
+	return normalizeResolvedSecretInputString({
+		value: params.allowEnvSecretRef ? ref?.source === "env" ? readMatrixEnvSecretRef({
+			ref,
+			cfg: params.cfg,
+			env: params.env
+		}) ?? params.value : ref ? "" : params.value : params.value,
+		path: params.path,
+		defaults: params.cfg.secrets?.defaults
+	}) ?? "";
+}
+function resolveMatrixBaseConfigFieldPath(field) {
+	return `channels.matrix.${field}`;
+}
+function hasConfiguredMatrixSecret(value, cfg) {
+	return typeof value === "string" && value.trim().length > 0 || Boolean(coerceSecretRef(value, cfg.secrets?.defaults));
+}
+async function resolveConfiguredMatrixAuthSecretInput(params) {
+	const configured = params.configured;
+	if (!configured) return;
+	if (!coerceSecretRef(configured.value, params.cfg.secrets?.defaults)) return normalizeResolvedSecretInputString({
+		value: configured.value,
+		path: configured.path,
+		defaults: params.cfg.secrets?.defaults
+	});
+	const { resolveConfiguredSecretInputString } = await loadMatrixSecretInputDeps();
+	const resolved = await resolveConfiguredSecretInputString({
+		config: params.cfg,
+		env: params.env,
+		value: configured.value,
+		path: configured.path,
+		unresolvedReasonStyle: "detailed"
+	});
+	if (resolved.value !== void 0) return resolved.value;
+	throw new Error(resolved.unresolvedRefReason ?? `${configured.path} SecretRef could not be resolved.`);
+}
+function clampMatrixInitialSyncLimit(value) {
+	return resolveOptionalIntegerOption(value, { min: 0 });
+}
+function buildMatrixNetworkFields(params) {
+	const dispatcherPolicy = params.dispatcherPolicy ?? (params.proxy ? {
+		mode: "explicit-proxy",
+		proxyUrl: params.proxy
+	} : void 0);
+	if (!params.allowPrivateNetwork && !dispatcherPolicy) return {};
+	return {
+		...params.allowPrivateNetwork ? {
+			allowPrivateNetwork: true,
+			ssrfPolicy: ssrfPolicyFromDangerouslyAllowPrivateNetwork$1(true)
+		} : {},
+		...dispatcherPolicy ? { dispatcherPolicy } : {}
+	};
+}
+function buildResolvedMatrixAuth(resolved, auth) {
+	return {
+		...auth,
+		deviceName: resolved.deviceName,
+		initialSyncLimit: resolved.initialSyncLimit,
+		encryption: resolved.encryption,
+		...buildMatrixNetworkFields({
+			allowPrivateNetwork: resolved.allowPrivateNetwork,
+			dispatcherPolicy: resolved.dispatcherPolicy
+		})
+	};
+}
+function hasScopedMatrixEnvConfig(accountId, env) {
+	const scoped = resolveScopedMatrixEnvConfig(accountId, env);
+	return Boolean(scoped.homeserver || scoped.userId || scoped.accessToken || scoped.password || scoped.deviceId || scoped.deviceName);
+}
+function readMatrixConfigStrings(params) {
+	return Object.fromEntries(MATRIX_CONFIG_STRING_FIELDS.map((field) => [field, readMatrixConfigString({
+		value: params.values[field],
+		path: params.path(field),
+		cfg: params.cfg,
+		env: params.env,
+		allowEnvSecretRef: MATRIX_AUTH_SECRET_FIELDS.includes(field),
+		suppressSecretRef: field === "password" && params.suppressPasswordSecretRef
+	})]));
+}
+function resolveMatrixAccountConfigSnapshot(cfg, accountId, env) {
+	const normalizedAccountId = normalizeAccountId$1(accountId);
+	const matrix = resolveMatrixBaseConfig(cfg);
+	const account = findMatrixAccountConfig(cfg, normalizedAccountId) ?? {};
+	const scopedKeys = getMatrixScopedEnvVarNames(normalizedAccountId);
+	const scopedEnv = resolveScopedMatrixEnvConfig(normalizedAccountId, env);
+	const globalEnv = resolveGlobalMatrixEnvConfig(env);
+	const authCandidates = (field) => [
+		{
+			value: account[field],
+			path: resolveMatrixConfigFieldPath(cfg, accountId, field)
+		},
+		{
+			value: scopedEnv[field],
+			path: scopedKeys[field]
+		},
+		...normalizedAccountId === DEFAULT_ACCOUNT_ID$1 ? [{
+			value: matrix[field],
+			path: resolveMatrixBaseConfigFieldPath(field)
+		}, {
+			value: globalEnv[field],
+			path: field === "accessToken" ? "MATRIX_ACCESS_TOKEN" : "MATRIX_PASSWORD"
+		}] : []
+	];
+	const accessTokenCandidates = authCandidates("accessToken");
+	const passwordCandidates = authCandidates("password");
+	const suppressPasswordSecretRef = accessTokenCandidates.some((source) => hasConfiguredMatrixSecret(source.value, cfg));
+	const resolvedStrings = resolveMatrixAccountStringValues({
+		accountId: normalizedAccountId,
+		account: readMatrixConfigStrings({
+			cfg,
+			env,
+			values: account,
+			path: (field) => resolveMatrixConfigFieldPath(cfg, normalizedAccountId, field),
+			suppressPasswordSecretRef
+		}),
+		scopedEnv,
+		channel: readMatrixConfigStrings({
+			cfg,
+			env,
+			values: matrix,
+			path: resolveMatrixBaseConfigFieldPath,
+			suppressPasswordSecretRef
+		}),
+		globalEnv
+	});
+	const accountInitialSyncLimit = clampMatrixInitialSyncLimit(account.initialSyncLimit);
+	const allowPrivateNetwork = isPrivateNetworkOptInEnabled(account) || isPrivateNetworkOptInEnabled(matrix) ? true : void 0;
+	return {
+		resolved: {
+			homeserver: resolvedStrings.homeserver,
+			userId: resolvedStrings.userId,
+			accessToken: resolvedStrings.accessToken || void 0,
+			password: resolvedStrings.password || void 0,
+			deviceId: resolvedStrings.deviceId || void 0,
+			deviceName: resolvedStrings.deviceName || void 0,
+			initialSyncLimit: accountInitialSyncLimit ?? clampMatrixInitialSyncLimit(matrix.initialSyncLimit),
+			encryption: typeof account.encryption === "boolean" ? account.encryption : matrix.encryption ?? false,
+			...buildMatrixNetworkFields({
+				allowPrivateNetwork,
+				proxy: account.proxy ?? matrix.proxy
+			})
+		},
+		authInputs: {
+			accessToken: accessTokenCandidates.find((source) => source.value !== void 0),
+			password: passwordCandidates.find((source) => source.value !== void 0)
+		}
+	};
+}
+function resolveImplicitMatrixAccountId(cfg, env = process.env) {
+	if (requiresExplicitMatrixDefaultAccount(cfg, env)) return null;
+	return normalizeAccountId$1(resolveMatrixDefaultOrOnlyAccountId(cfg, env));
+}
+function resolveMatrixAuthState(params) {
+	const cfg = requireRuntimeConfig(params.cfg, "Matrix auth context");
+	const env = params?.env ?? process.env;
+	const requestedAccountId = params?.accountId?.trim();
+	const explicitAccountId = normalizeOptionalAccountId$1(params?.accountId);
+	if (requestedAccountId && !explicitAccountId) throw new Error(`Matrix account id "${requestedAccountId}" is invalid.`);
+	const effectiveAccountId = explicitAccountId ?? resolveImplicitMatrixAccountId(cfg, env);
+	if (!effectiveAccountId) throw new Error("Multiple Matrix accounts are configured and channels.matrix.defaultAccount is not set. Set \"channels.matrix.defaultAccount\" to the intended account or pass --account <id>.");
+	if (explicitAccountId && explicitAccountId !== DEFAULT_ACCOUNT_ID$1 && !listNormalizedMatrixAccountIds(cfg).includes(explicitAccountId) && !hasScopedMatrixEnvConfig(explicitAccountId, env)) throw new Error(`Matrix account "${explicitAccountId}" is not configured. Add channels.matrix.accounts.${explicitAccountId} or define scoped ${getMatrixScopedEnvVarNames(explicitAccountId).accessToken.replace(/_ACCESS_TOKEN$/, "")}_* variables.`);
+	const matrix = resolveMatrixBaseConfig(cfg);
+	const account = findMatrixAccountConfig(cfg, effectiveAccountId);
+	if (matrix.enabled === false || account?.enabled === false) throw new Error(`Matrix account "${effectiveAccountId}" is disabled.`);
+	const snapshot = resolveMatrixAccountConfigSnapshot(cfg, effectiveAccountId, env);
+	return {
+		context: {
+			cfg,
+			env,
+			accountId: effectiveAccountId,
+			resolved: snapshot.resolved
+		},
+		authInputs: snapshot.authInputs
+	};
+}
+function resolveMatrixAuthContext(params) {
+	return resolveMatrixAuthState(params).context;
+}
+async function resolveMatrixAuth(params) {
+	if (!params?.cfg) throw new Error("Matrix auth requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
+	const { context, authInputs } = resolveMatrixAuthState({
+		cfg: params.cfg,
+		env: params.env,
+		accountId: params.accountId
+	});
+	const { cfg, env, accountId, resolved } = context;
+	const accessToken = await resolveConfiguredMatrixAuthSecretInput({
+		cfg,
+		env,
+		configured: authInputs.accessToken
+	}) ?? resolved.accessToken;
+	const tokenAuthPassword = resolved.password;
+	const homeserver = await resolveValidatedMatrixHomeserverUrl(resolved.homeserver, { dangerouslyAllowPrivateNetwork: resolved.allowPrivateNetwork });
+	const { loadMatrixCredentials, credentialsMatchConfig } = await loadMatrixCredentialsReadDeps();
+	const cached = loadMatrixCredentials(env, accountId);
+	const cachedCredentials = cached && credentialsMatchConfig(cached, {
+		homeserver,
+		userId: resolved.userId || "",
+		accessToken
+	}) ? cached : null;
+	if (accessToken) {
+		let userId = resolved.userId;
+		const hasMatchingCachedToken = cachedCredentials?.accessToken === accessToken;
+		let knownDeviceId = hasMatchingCachedToken ? cachedCredentials?.deviceId || resolved.deviceId : resolved.deviceId;
+		if (!userId) {
+			const whoami = await fetchMatrixWhoamiIdentity({
+				homeserver,
+				accessToken,
+				userId,
+				ssrfPolicy: resolved.ssrfPolicy,
+				dispatcherPolicy: resolved.dispatcherPolicy
+			});
+			const fetchedUserId = whoami.user_id?.trim();
+			if (!fetchedUserId) throw new Error("Matrix whoami did not return user_id");
+			userId = fetchedUserId;
+			knownDeviceId = knownDeviceId || whoami.device_id?.trim() || resolved.deviceId;
+		}
+		if (!cachedCredentials || !hasMatchingCachedToken || cachedCredentials.userId !== userId || (cachedCredentials.deviceId || void 0) !== knownDeviceId) {
+			const { saveMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+			await saveMatrixCredentials({
+				homeserver,
+				userId,
+				accessToken,
+				deviceId: knownDeviceId
+			}, env, accountId);
+		} else if (hasMatchingCachedToken) {
+			const { touchMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+			await touchMatrixCredentials(env, accountId);
+		}
+		return buildResolvedMatrixAuth(resolved, {
+			accountId,
+			homeserver,
+			userId,
+			accessToken,
+			password: tokenAuthPassword,
+			deviceId: knownDeviceId
+		});
+	}
+	if (cachedCredentials) {
+		const { touchMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+		await touchMatrixCredentials(env, accountId);
+		return buildResolvedMatrixAuth(resolved, {
+			accountId,
+			homeserver: cachedCredentials.homeserver,
+			userId: cachedCredentials.userId,
+			accessToken: cachedCredentials.accessToken,
+			password: tokenAuthPassword,
+			deviceId: cachedCredentials.deviceId || resolved.deviceId
+		});
+	}
+	if (!resolved.userId) throw new Error("Matrix userId is required when no access token is configured (matrix.userId)");
+	const password = await resolveConfiguredMatrixAuthSecretInput({
+		cfg,
+		env,
+		configured: authInputs.password
+	}) ?? resolved.password;
+	if (!password) throw new Error("Matrix password is required when no access token is configured (matrix.password)");
+	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixAuthClientDeps();
+	ensureMatrixSdkLoggingConfigured();
+	const loginClient = new MatrixClient(homeserver, "", {
+		ssrfPolicy: resolved.ssrfPolicy,
+		dispatcherPolicy: resolved.dispatcherPolicy
+	});
+	const login = await retryMatrixAuthRequest("matrix auth login", async () => await loginClient.doRequest("POST", "/_matrix/client/v3/login", void 0, {
+		type: "m.login.password",
+		identifier: {
+			type: "m.id.user",
+			user: resolved.userId
+		},
+		password,
+		device_id: resolved.deviceId,
+		initial_device_display_name: resolved.deviceName ?? "OpenClaw Gateway"
+	}));
+	const loginAccessToken = login.access_token?.trim();
+	if (!loginAccessToken) throw new Error("Matrix login did not return an access token");
+	const auth = buildResolvedMatrixAuth(resolved, {
+		accountId,
+		homeserver,
+		userId: login.user_id ?? resolved.userId,
+		accessToken: loginAccessToken,
+		password,
+		deviceId: login.device_id ?? resolved.deviceId
+	});
+	const { saveMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+	await saveMatrixCredentials({
+		homeserver: auth.homeserver,
+		userId: auth.userId,
+		accessToken: auth.accessToken,
+		deviceId: auth.deviceId
+	}, env, accountId);
+	return auth;
+}
+async function backfillMatrixAuthDeviceIdAfterStartup(params) {
+	const knownDeviceId = params.auth.deviceId?.trim();
+	if (knownDeviceId) return knownDeviceId;
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	let whoami;
+	try {
+		whoami = await fetchMatrixWhoamiIdentity({
+			homeserver: params.auth.homeserver,
+			accessToken: params.auth.accessToken,
+			userId: params.auth.userId,
+			ssrfPolicy: params.auth.ssrfPolicy,
+			dispatcherPolicy: params.auth.dispatcherPolicy,
+			signal: params.abortSignal
+		});
+	} catch (err) {
+		if (isAbortSignalTriggered(params.abortSignal)) return;
+		throw err;
+	}
+	const deviceId = whoami.device_id?.trim();
+	if (!deviceId) return;
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	const env = params.env ?? process.env;
+	const { loadMatrixCredentials } = await loadMatrixCredentialsReadDeps();
+	if (!credentialsMatchBackfillAuthLineage({
+		stored: loadMatrixCredentials(env, params.auth.accountId),
+		auth: params.auth
+	})) return;
+	if (!repairCurrentTokenStorageMetaDeviceId({
+		homeserver: params.auth.homeserver,
+		userId: params.auth.userId,
+		accessToken: params.auth.accessToken,
+		accountId: params.auth.accountId,
+		deviceId,
+		env: params.env
+	})) throw new Error("Matrix deviceId backfill failed to repair current-token storage metadata");
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	return await (await loadMatrixCredentialsWriteRuntime()).saveBackfilledMatrixDeviceId({
+		homeserver: params.auth.homeserver,
+		userId: params.auth.userId,
+		accessToken: params.auth.accessToken,
+		deviceId
+	}, env, params.auth.accountId) === "saved" ? deviceId : void 0;
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client/create-client.ts
+var create_client_exports = /* @__PURE__ */ __exportAll({ createMatrixClient: () => createMatrixClient });
+const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-DjaQFCHc.js"), import("./logging-DRjvUOIh.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
+	MatrixClient: sdkModule.MatrixClient,
+	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
+})));
+async function createMatrixClient(params) {
+	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixCreateClientRuntimeDeps();
+	ensureMatrixSdkLoggingConfigured();
+	const homeserver = await resolveValidatedMatrixHomeserverUrl(params.homeserver, { dangerouslyAllowPrivateNetwork: params.allowPrivateNetwork });
+	const matrixClientUserId = normalizeOptionalString(params.userId);
+	const userId = matrixClientUserId ?? "unknown";
+	const storagePaths = params.persistStorage !== false ? resolveMatrixStoragePaths({
+		homeserver,
+		userId,
+		accessToken: params.accessToken,
+		accountId: params.accountId,
+		deviceId: params.deviceId,
+		env: process.env
+	}) : null;
+	if (storagePaths) {
+		await maybeMigrateLegacyStorage({
+			storagePaths,
+			env: process.env
+		});
+		fs.mkdirSync(storagePaths.rootDir, { recursive: true });
+		writeStorageMeta({
+			storagePaths,
+			homeserver,
+			userId,
+			accountId: params.accountId,
+			deviceId: params.deviceId
+		});
+	}
+	const cryptoDatabasePrefix = storagePaths ? `openclaw-matrix-${storagePaths.accountKey}-${storagePaths.tokenHash}` : void 0;
+	return new MatrixClient(homeserver, params.accessToken, {
+		userId: matrixClientUserId,
+		password: params.password,
+		deviceId: params.deviceId,
+		encryption: params.encryption,
+		localTimeoutMs: params.localTimeoutMs,
+		initialSyncLimit: params.initialSyncLimit,
+		storageRootDir: storagePaths?.rootDir,
+		recoveryKeyPath: storagePaths?.recoveryKeyPath,
+		idbSnapshotPath: storagePaths?.idbSnapshotPath,
+		cryptoDatabasePrefix,
+		autoBootstrapCrypto: params.autoBootstrapCrypto,
+		ssrfPolicy: params.ssrfPolicy ?? ssrfPolicyFromDangerouslyAllowPrivateNetwork(params.allowPrivateNetwork),
+		dispatcherPolicy: params.dispatcherPolicy
+	});
+}
+//#endregion
+//#region extensions/matrix/src/matrix/startup-abort.ts
+function createMatrixStartupAbortError() {
+	const error = /* @__PURE__ */ new Error("Matrix startup aborted");
+	error.name = "AbortError";
+	return error;
+}
+function throwIfMatrixStartupAborted(abortSignal) {
+	if (abortSignal?.aborted === true) throw createMatrixStartupAbortError();
+}
+function isMatrixStartupAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+async function awaitMatrixStartupWithAbort(promise, abortSignal) {
+	if (!abortSignal) return await promise;
+	if (abortSignal.aborted) throw createMatrixStartupAbortError();
+	return await new Promise((resolve, reject) => {
+		const onAbort = () => {
+			abortSignal.removeEventListener("abort", onAbort);
+			reject(createMatrixStartupAbortError());
+		};
+		abortSignal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			abortSignal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			abortSignal.removeEventListener("abort", onAbort);
+			reject(toErrorObject(error, "Non-Error rejection"));
+		});
+	});
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client/shared.ts
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => Promise.resolve().then(() => create_client_exports).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
+const MATRIX_TRANSIENT_LEASE_DRAIN_TIMEOUT_MS = 5e3;
+const sharedClientStates = /* @__PURE__ */ new Map();
+const sharedClientPromises = /* @__PURE__ */ new Map();
+function buildSharedClientKey(auth) {
+	return JSON.stringify([
+		auth.homeserver,
+		auth.userId,
+		auth.accessToken,
+		auth.encryption ? "e2ee" : "plain",
+		auth.allowPrivateNetwork ? "private-net" : "strict-net",
+		auth.dispatcherPolicy ?? null,
+		auth.accountId
+	]);
+}
+async function createSharedMatrixClient(params) {
+	const { createMatrixClient } = await loadMatrixCreateClientDeps();
+	const client = await createMatrixClient({
+		homeserver: params.auth.homeserver,
+		userId: params.auth.userId,
+		accessToken: params.auth.accessToken,
+		password: params.auth.password,
+		deviceId: params.auth.deviceId,
+		encryption: params.auth.encryption,
+		localTimeoutMs: params.timeoutMs,
+		initialSyncLimit: params.auth.initialSyncLimit,
+		accountId: params.auth.accountId,
+		allowPrivateNetwork: params.auth.allowPrivateNetwork,
+		ssrfPolicy: params.auth.ssrfPolicy,
+		dispatcherPolicy: params.auth.dispatcherPolicy
+	});
+	return {
+		auth: params.auth,
+		client,
+		key: buildSharedClientKey(params.auth),
+		started: false,
+		cryptoReady: false,
+		startPromise: null,
+		phase: "open",
+		leases: /* @__PURE__ */ new Set(),
+		monitorRetirementPromises: /* @__PURE__ */ new Set(),
+		noLeases: createDeferred(),
+		retirementPromise: null,
+		poisonError: null,
+		releaseMode: "discard"
+	};
+}
+function deleteSharedClientState(state) {
+	if (sharedClientStates.get(state.key) === state) sharedClientStates.delete(state.key);
+	sharedClientPromises.delete(state.key);
+}
+async function ensureSharedClientStarted(state, abortSignal) {
+	if (state.started) return;
+	if (state.startPromise) {
+		await awaitMatrixStartupWithAbort(state.startPromise, abortSignal);
+		return;
+	}
+	const guardedStart = (async () => {
+		if (state.auth.encryption && !state.cryptoReady) try {
+			const joinedRooms = await state.client.getJoinedRooms();
+			if (state.client.crypto) {
+				await state.client.crypto.prepare(joinedRooms);
+				state.cryptoReady = true;
+			}
+		} catch (err) {
+			LogService.warn("MatrixClientLite", "Failed to prepare crypto:", err);
+		}
+		await awaitMatrixStartupWithAbort(state.client.start({ abortSignal }), abortSignal);
+		state.started = true;
+	})().finally(() => {
+		if (state.startPromise === guardedStart) state.startPromise = null;
+	});
+	state.startPromise = guardedStart;
+	await awaitMatrixStartupWithAbort(guardedStart, abortSignal);
+}
+async function resolveSharedMatrixAuth(params) {
+	const requestedAccountId = normalizeOptionalAccountId(params.accountId);
+	if (params.auth && requestedAccountId && requestedAccountId !== params.auth.accountId) throw new Error(`Matrix shared client account mismatch: requested ${requestedAccountId}, auth resolved ${params.auth.accountId}`);
+	if (params.auth) return params.auth;
+	if (!params.cfg) throw new Error("Matrix shared client requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
+	const authContext = resolveMatrixAuthContext({
+		cfg: params.cfg,
+		env: params.env,
+		accountId: params.accountId
+	});
+	return await resolveMatrixAuth({
+		cfg: authContext.cfg,
+		env: authContext.env,
+		accountId: authContext.accountId
+	});
+}
+async function resolveOpenSharedMatrixClientState(params) {
+	const auth = await resolveSharedMatrixAuth(params);
+	const key = buildSharedClientKey(auth);
+	while (true) {
+		const existing = sharedClientStates.get(key);
+		if (existing?.poisonError) throw existing.poisonError;
+		if (existing?.phase === "open") return existing;
+		if (existing?.retirementPromise) {
+			await awaitMatrixStartupWithAbort(existing.retirementPromise, params.abortSignal);
+			continue;
+		}
+		const pending = sharedClientPromises.get(key);
+		if (pending) {
+			await awaitMatrixStartupWithAbort(pending, params.abortSignal);
+			continue;
+		}
+		const creationPromise = createSharedMatrixClient({
+			auth,
+			timeoutMs: params.timeoutMs
+		});
+		sharedClientPromises.set(key, creationPromise);
+		try {
+			const created = await creationPromise;
+			sharedClientStates.set(key, created);
+			return created;
+		} finally {
+			sharedClientPromises.delete(key);
+		}
+	}
+}
+async function runMonitorRetirement(retirement) {
+	if (!retirement) return;
+	retirement.closeTaskAdmission();
+	retirement.detachListeners();
+	await retirement.waitForTasks();
+	await retirement.cleanup();
+}
+function retireMonitorLease(state, lease) {
+	if (lease.monitorRetirementPromise) return lease.monitorRetirementPromise;
+	lease.monitorRetirementPromise = runMonitorRetirement(lease.monitorRetirement ?? void 0);
+	state.monitorRetirementPromises.add(lease.monitorRetirementPromise);
+	return lease.monitorRetirementPromise;
+}
+async function retireMonitorLeases(state, leases) {
+	for (const lease of leases) retireMonitorLease(state, lease);
+	const failure = (await Promise.allSettled(state.monitorRetirementPromises)).find((result) => result.status === "rejected");
+	if (failure?.status === "rejected") throw failure.reason;
+}
+function mergeReleaseMode(current, requested) {
+	if (current === "persist" || requested === "persist") return "persist";
+	if (current === "stop" || requested === "stop") return "stop";
+	return "discard";
+}
+function abortTransientLeases(state) {
+	for (const lease of state.leases) if (lease.role === "transient") lease.abortController.abort();
+}
+function forceReleaseLeases(state, releasePromise = Promise.resolve()) {
+	for (const lease of state.leases) {
+		lease.abortController.abort();
+		lease.releasePromise ??= releasePromise;
+	}
+	state.leases.clear();
+	state.noLeases.resolve();
+}
+async function waitForLeaseDrain(state) {
+	if (state.leases.size === 0) return;
+	let deadline;
+	try {
+		await Promise.race([state.noLeases.promise, new Promise((_, reject) => {
+			deadline = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`Matrix transient leases did not drain within ${MATRIX_TRANSIENT_LEASE_DRAIN_TIMEOUT_MS}ms`));
+			}, MATRIX_TRANSIENT_LEASE_DRAIN_TIMEOUT_MS);
+			deadline.unref?.();
+		})]);
+	} finally {
+		if (deadline) clearTimeout(deadline);
+	}
+}
+function beginGenerationRetirement(params) {
+	const { state } = params;
+	if (state.retirementPromise) return state.retirementPromise;
+	state.phase = "quiescing";
+	state.retirementPromise = Promise.resolve().then(async () => {
+		try {
+			await state.client.quiesceSync();
+			state.started = false;
+			await state.client.drainPendingDecryptions("matrix monitor sync quiesce");
+		} catch (error) {
+			state.poisonError = toStringifiedError(error);
+		}
+		try {
+			await retireMonitorLeases(state, params.monitorLeases ?? []);
+		} catch (error) {
+			state.poisonError ??= toStringifiedError(error);
+		}
+		state.phase = "closing";
+		try {
+			await waitForLeaseDrain(state);
+		} catch (error) {
+			state.poisonError ??= toStringifiedError(error);
+			forceReleaseLeases(state);
+		}
+		if (state.poisonError) {
+			await state.client.drainPendingDecryptions("matrix poisoned client shutdown").catch(() => void 0);
+			state.client.stopWithoutPersist();
+			throw state.poisonError;
+		}
+		try {
+			await state.client.drainPendingDecryptions("matrix shared client final shutdown");
+		} catch (error) {
+			state.poisonError = toStringifiedError(error);
+			try {
+				state.client.stopWithoutPersist();
+			} finally {
+				deleteSharedClientState(state);
+			}
+			throw state.poisonError;
+		}
+		try {
+			if (state.releaseMode === "persist") await state.client.stopAndPersist();
+			else if (state.releaseMode === "discard") state.client.stopWithoutPersist();
+			else await state.client.stopAndPersist().catch(() => state.client.stopWithoutPersist());
+		} finally {
+			deleteSharedClientState(state);
+		}
+	});
+	abortTransientLeases(state);
+	return state.retirementPromise;
+}
+function createSharedMatrixClientLease(state, role) {
+	const leaseState = {
+		abortController: new AbortController(),
+		monitorRetirement: null,
+		monitorRetirementPromise: null,
+		role,
+		releasePromise: null
+	};
+	state.leases.add(leaseState);
+	return {
+		abortSignal: leaseState.abortController.signal,
+		client: state.client,
+		role,
+		registerMonitorRetirement: (retirement) => {
+			if (role !== "monitor") throw new Error("Matrix transient leases cannot register monitor retirement");
+			if (leaseState.releasePromise || state.phase !== "open") throw new Error("Matrix monitor lease is already retiring");
+			if (leaseState.monitorRetirement && leaseState.monitorRetirement !== retirement) throw new Error("Matrix monitor retirement is already registered");
+			leaseState.monitorRetirement = retirement;
+		},
+		start: async (abortSignal) => {
+			if (leaseState.releasePromise) throw new Error("Matrix client lease has already been released");
+			if (state.phase !== "open") throw new Error("Matrix client generation is retiring");
+			await ensureSharedClientStarted(state, abortSignal ? AbortSignal.any([abortSignal, leaseState.abortController.signal]) : leaseState.abortController.signal);
+		},
+		release: (releaseParams = {}) => {
+			if (leaseState.releasePromise) return leaseState.releasePromise;
+			state.releaseMode = mergeReleaseMode(state.releaseMode, releaseParams.mode ?? "stop");
+			state.leases.delete(leaseState);
+			if (state.leases.size === 0) state.noLeases.resolve();
+			const finalMonitor = role === "monitor" && !Array.from(state.leases).some((lease) => lease.role === "monitor");
+			if (role === "monitor" && !finalMonitor) {
+				leaseState.releasePromise = retireMonitorLease(state, leaseState);
+				return leaseState.releasePromise;
+			}
+			if (!(finalMonitor || state.leases.size === 0)) {
+				leaseState.releasePromise = Promise.resolve();
+				return leaseState.releasePromise;
+			}
+			leaseState.releasePromise = beginGenerationRetirement({
+				state,
+				monitorLeases: role === "monitor" ? [leaseState] : void 0
+			});
+			return leaseState.releasePromise;
+		}
+	};
+}
+async function acquireSharedMatrixClient(params = {}) {
+	const lease = createSharedMatrixClientLease(await resolveOpenSharedMatrixClientState(params), params.role ?? "transient");
+	if (params.startClient !== false) try {
+		await lease.start(params.abortSignal);
+	} catch (error) {
+		await lease.release({ mode: "stop" }).catch(() => void 0);
+		throw error;
+	}
+	return lease;
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client.ts
+var client_exports = /* @__PURE__ */ __exportAll({
+	acquireSharedMatrixClient: () => acquireSharedMatrixClient,
+	resolveMatrixAuthContext: () => resolveMatrixAuthContext
+});
+//#endregion
+export { throwIfMatrixStartupAborted as a, resolveMatrixAuth as c, isMatrixStartupAbortError as i, resolveMatrixAuthContext as l, acquireSharedMatrixClient as n, createMatrixClient as o, createMatrixStartupAbortError as r, backfillMatrixAuthDeviceIdAfterStartup as s, client_exports as t };