@openclaw/matrix 2026.9.3 → 2026.9.5

package/dist/{sdk-CX9b0N8Q.js → .setup/sdk-BkKE4ANj.mjs}

@@ -1,31 +1,34 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { D as writeMatrixRecoveryKeyStateForPath, S as readMatrixRecoveryKeyStateForPath, f as migrateLegacyMatrixRecoveryKeyFilePathToStore, v as readLegacyMatrixRecoveryKeyFile } from "./storage-metadata-DYArLcq1.js";
-import { t as claimCurrentTokenStorageState } from "./storage-CV-pfV_2.js";
-import "./reaction-common-DkrQdBSZ.js";
-import { i as parseMxc, r as matrixEventToRaw } from "./event-helpers-CspuhE9k.js";
-import { i as openMatrixSyncCacheStoreOptions, l as writeMatrixSyncCacheStateToSyncStore, n as deleteMatrixSyncCacheStateFromSyncStore, o as readPersistedStoreFromSyncStore } from "./sync-cache-state-C-mhj3xb.js";
-import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-DKVS3_DO.js";
-import { a as throwIfMatrixStartupAborted, r as createMatrixStartupAbortError } from "./client-COLiUdWe.js";
-import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-B_71hN6W.js";
-import { n as createMatrixGuardedFetch, t as MatrixAuthedHttpClient } from "./http-client-BfPeF4CE.js";
-import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.js";
-import { t as createMatrixJsSdkClientLogger } from "./logging-DRjvUOIh.js";
-import { t as MATRIX_IDB_PERSIST_INTERVAL_MS } from "./idb-persistence-lock-B3fZXyF_.js";
-import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-DLj4vDeu.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
+import { D as writeMatrixRecoveryKeyStateForPathAsync, S as readMatrixRecoveryKeyStateForPathAsync, f as migrateLegacyMatrixRecoveryKeyFilePathToStoreAsync, v as readLegacyMatrixRecoveryKeyFile } from "./storage-metadata-BQJjHC_i.mjs";
+import { t as claimCurrentTokenStorageState } from "./storage-DJ-oUgmX.mjs";
+import { r as withoutMatrixSendCurrentness, t as captureMatrixSendCurrentness } from "./send-currentness-BrGXL7b8.mjs";
+import { i as parseMxc, r as matrixEventToRaw } from "./event-helpers-CspuhE9k.mjs";
+import { i as openMatrixSyncCacheStoreOptions, l as writeMatrixSyncCacheStateToSyncStore, n as deleteMatrixSyncCacheStateFromSyncStore, o as readPersistedStoreFromSyncStore } from "./sync-cache-state-CFiZIPhA.mjs";
+import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-DKVS3_DO.mjs";
+import { a as createMatrixStartupAbortError, i as awaitMatrixStartupWithAbort, s as throwIfMatrixStartupAborted } from "./client-DsJUnWlV.mjs";
+import { n as createMatrixGuardedFetch, t as MatrixAuthedHttpClient } from "./http-client-BJjo-iw5.mjs";
+import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.mjs";
+import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-xBjiRIp1.mjs";
+import { t as createMatrixJsSdkClientLogger } from "./logging-rgm8ep9H.mjs";
+import { t as MATRIX_IDB_PERSIST_INTERVAL_MS } from "./idb-persistence-lock-B3fZXyF_.mjs";
+import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-Bn9Bk0-H.mjs";
 import { createRequire } from "node:module";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeNullableString, normalizeStringEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
+import { captureChannelReadAuthority } from "openclaw/plugin-sdk/fetch-runtime";
 import { EventEmitter } from "node:events";
 import { ClientEvent, EventType, Filter, MatrixError, MatrixEventEvent, MemoryStore, MsgType, Preset, SyncAccumulator, createClient } from "matrix-js-sdk/lib/matrix.js";
 import { RoomEvent } from "matrix-js-sdk/lib/models/room.js";
 import { VerificationMethod } from "matrix-js-sdk/lib/types.js";
 import { SyncApi, SyncState } from "matrix-js-sdk/lib/sync.js";
 import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";
+import { MatrixScheduler } from "matrix-js-sdk/lib/scheduler.js";
 import { EventStatus } from "matrix-js-sdk/lib/models/event-status.js";
 //#region extensions/matrix/src/matrix/sdk/client-device-info.ts
 async function resolveMatrixCrossSigningPublicationStatus(params) {
@@ -326,7 +329,7 @@ var SqliteBackedMatrixSyncStore = class extends MemoryStore {
 					payload,
 					store: this.store
 				});
-				claimCurrentTokenStorageState({ rootDir: this.storageRootDir });
+				await claimCurrentTokenStorageState({ rootDir: this.storageRootDir });
 			});
 		} catch (err) {
 			this.dirty = true;
@@ -359,7 +362,7 @@ function openMatrixSyncCacheStore(storageRootDir) {
 //#endregion
 //#region extensions/matrix/src/matrix/sdk/client-sync-quiesce.ts
 const MATRIX_SYNC_QUIESCE_TIMEOUT_MS = 5e3;
-const MATRIX_JS_SDK_SYNC_VERSION = "42.2.0";
+const MATRIX_JS_SDK_SYNC_VERSION = "42.3.0";
 const matrixJsSdkPackage = createRequire(import.meta.url)("matrix-js-sdk/package.json");
 function requireMatrixClassicSyncInternals(syncApi) {
 	return syncApi;
@@ -426,6 +429,124 @@ async function quiesceMatrixClientSync(params) {
 	});
 }
 //#endregion
+//#region extensions/matrix/src/matrix/sdk/client-sync-ready.ts
+async function waitForMatrixInitialSyncReady(params) {
+	const timeoutMs = params.timeoutMs ?? 3e4;
+	if (isMatrixReadySyncState(params.state)) return;
+	if (isMatrixAccessTokenInvalidatedError(params.error)) throw params.error instanceof Error ? params.error : new Error("Matrix access token invalidated", { cause: params.error });
+	if (isMatrixTerminalSyncState(params.state)) throw new Error(`Matrix sync entered ${params.state} during startup`);
+	await new Promise((resolve, reject) => {
+		let settled = false;
+		let timeoutId;
+		const abortSignal = params.abortSignal;
+		const cleanup = () => {
+			params.emitter.off("sync.state", onSyncState);
+			params.emitter.off("sync.unexpected_error", onUnexpectedError);
+			abortSignal?.removeEventListener("abort", onAbort);
+			if (timeoutId) {
+				clearTimeout(timeoutId);
+				timeoutId = void 0;
+			}
+		};
+		const settleResolve = () => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve();
+		};
+		const settleReject = (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(error);
+		};
+		const onSyncState = (state, _prevState, error) => {
+			if (isMatrixReadySyncState(state)) {
+				settleResolve();
+				return;
+			}
+			if (isMatrixAccessTokenInvalidatedError(error)) {
+				settleReject(error instanceof Error ? error : /* @__PURE__ */ new Error("Matrix access token invalidated"));
+				return;
+			}
+			if (isMatrixTerminalSyncState(state)) settleReject(new Error(error instanceof Error && error.message ? error.message : `Matrix sync entered ${state} during startup`));
+		};
+		const onUnexpectedError = (error) => {
+			settleReject(error);
+		};
+		const onAbort = () => {
+			settleReject(createMatrixStartupAbortError());
+		};
+		params.emitter.on("sync.state", onSyncState);
+		params.emitter.on("sync.unexpected_error", onUnexpectedError);
+		if (abortSignal?.aborted) {
+			onAbort();
+			return;
+		}
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+		timeoutId = setTimeout(() => {
+			settleReject(/* @__PURE__ */ new Error(`Matrix client did not reach a ready sync state within ${timeoutMs}ms`));
+		}, timeoutMs);
+		timeoutId.unref?.();
+	});
+}
+//#endregion
+//#region extensions/matrix/src/matrix/sdk/message-wire-dispatch.ts
+function resolveMessageWireDispatch(resource, init) {
+	if ((init?.method ?? (resource instanceof Request ? resource.method : "GET")).toUpperCase() !== "PUT") return null;
+	const rawUrl = typeof resource === "string" ? resource : resource instanceof URL ? resource.href : resource.url;
+	const segments = new URL(rawUrl).pathname.split("/").filter(Boolean);
+	const roomsIndex = segments.lastIndexOf("rooms");
+	if (roomsIndex < 0 || segments[roomsIndex + 2] !== "send" || segments.length !== roomsIndex + 5) return null;
+	const eventType = decodeURIComponent(segments[roomsIndex + 3] ?? "");
+	if (eventType !== "m.room.message" && eventType !== "m.room.encrypted") return null;
+	return {
+		roomId: decodeURIComponent(segments[roomsIndex + 1] ?? ""),
+		eventType,
+		transactionId: decodeURIComponent(segments[roomsIndex + 4] ?? ""),
+		requestPath: new URL(rawUrl).pathname
+	};
+}
+var MatrixMessageWireDispatchGuards = class {
+	constructor() {
+		this.guards = /* @__PURE__ */ new Map();
+	}
+	captureCurrentness(resource, init, fallback) {
+		const dispatch = resolveMessageWireDispatch(resource, init);
+		const entry = dispatch ? this.guards.get(dispatch.transactionId) : void 0;
+		if (!entry) return fallback;
+		const assertCurrent = entry.assertCurrent;
+		return assertCurrent ? () => {
+			try {
+				assertCurrent();
+			} catch (error) {
+				entry.currentnessRejected = true;
+				throw error;
+			}
+		} : void 0;
+	}
+	wasCurrentnessRejected(transactionId) {
+		return transactionId !== void 0 && this.guards.get(transactionId)?.currentnessRejected === true;
+	}
+	beforeRequest(resource, init) {
+		const dispatch = resolveMessageWireDispatch(resource, init);
+		return dispatch ? Promise.resolve(this.guards.get(dispatch.transactionId)?.guard?.(dispatch)) : void 0;
+	}
+	async run(params) {
+		if (!params.transactionId || !params.guard && !params.assertCurrent) return await params.run();
+		if (this.guards.has(params.transactionId)) throw new Error(`Matrix transaction ${params.transactionId} already has a dispatch guard`);
+		this.guards.set(params.transactionId, {
+			guard: params.guard,
+			assertCurrent: params.assertCurrent
+		});
+		try {
+			return await params.run();
+		} finally {
+			this.guards.delete(params.transactionId);
+		}
+	}
+};
+//#endregion
 //#region extensions/matrix/src/matrix/sdk/recovery-key-store.ts
 function isRepairableSecretStorageAccessError(err) {
 	const message = formatMatrixErrorReason(err);
@@ -435,63 +556,95 @@ function isRepairableSecretStorageAccessError(err) {
 	return false;
 }
 var MatrixRecoveryKeyStore = class {
-	constructor(recoveryKeyPath) {
+	constructor(recoveryKeyPath, stateRuntime) {
 		this.secretStorageKeyCache = /* @__PURE__ */ new Map();
 		this.stagedRecoveryKey = null;
 		this.stagedRecoveryKeyUsed = false;
 		this.stagedCacheKeyIds = /* @__PURE__ */ new Set();
+		this.pendingPersistence = Promise.resolve();
+		this.closed = false;
 		this.recoveryKeyPath = recoveryKeyPath;
 		this.storageRootDir = recoveryKeyPath ? path.dirname(recoveryKeyPath) : void 0;
-		if (this.recoveryKeyPath) try {
-			migrateLegacyMatrixRecoveryKeyFilePathToStore(this.recoveryKeyPath);
-		} catch (err) {
-			this.legacyRecoveryKeyPathOnMigrationFailure = this.recoveryKeyPath;
-			LogService.warn("MatrixClientLite", "Failed to migrate Matrix recovery key state:", err);
+		if (recoveryKeyPath) {
+			this.stateRuntime = stateRuntime ?? getMatrixRuntime().state;
+			const runtime = this.stateRuntime;
+			this.enqueuePersistence(async () => {
+				try {
+					await migrateLegacyMatrixRecoveryKeyFilePathToStoreAsync(recoveryKeyPath, runtime);
+				} catch (err) {
+					this.legacyRecoveryKeyPathOnMigrationFailure = recoveryKeyPath;
+					LogService.warn("MatrixClientLite", "Failed to migrate Matrix recovery key state:", err);
+				}
+			});
+		}
+	}
+	enqueuePersistence(run) {
+		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error("Matrix recovery key store is closed"));
+		const pending = this.pendingPersistence.then(run);
+		this.pendingPersistence = pending.then(() => {}, () => {});
+		return pending;
+	}
+	async afterPersistence(read) {
+		for (;;) {
+			const pending = this.pendingPersistence;
+			await pending;
+			if (pending === this.pendingPersistence) return read();
 		}
 	}
+	async drainPendingPersistence() {
+		await this.afterPersistence(() => {});
+	}
+	async close() {
+		this.closed = true;
+		await this.drainPendingPersistence();
+	}
 	buildCryptoCallbacks() {
+		const getSecretStorageKey = ({ keys }) => this.afterPersistence(async () => {
+			if (this.closed) return null;
+			const requestedKeyIds = Object.keys(keys ?? {});
+			if (requestedKeyIds.length === 0) return null;
+			const staged = this.resolveStagedSecretStorageKey(requestedKeyIds);
+			if (staged) return staged;
+			for (const keyId of requestedKeyIds) {
+				const cached = this.secretStorageKeyCache.get(keyId);
+				if (cached) return [keyId, new Uint8Array(cached.key)];
+			}
+			const pending = this.pendingPersistence;
+			const stored = await this.loadStoredRecoveryKey();
+			if (this.closed) return null;
+			if (pending !== this.pendingPersistence) return getSecretStorageKey({ keys });
+			if (!stored?.privateKeyBase64) return null;
+			const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
+			if (privateKey.length === 0) return null;
+			if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
+				this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);
+				return [stored.keyId, privateKey];
+			}
+			const firstRequestedKeyId = requestedKeyIds[0];
+			if (!firstRequestedKeyId) return null;
+			this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);
+			return [firstRequestedKeyId, privateKey];
+		});
 		return {
-			getSecretStorageKey: async ({ keys }) => {
-				const requestedKeyIds = Object.keys(keys ?? {});
-				if (requestedKeyIds.length === 0) return null;
-				const staged = this.resolveStagedSecretStorageKey(requestedKeyIds);
-				if (staged) return staged;
-				for (const keyId of requestedKeyIds) {
-					const cached = this.secretStorageKeyCache.get(keyId);
-					if (cached) return [keyId, new Uint8Array(cached.key)];
-				}
-				const stored = this.loadStoredRecoveryKey();
-				if (!stored?.privateKeyBase64) return null;
-				const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
-				if (privateKey.length === 0) return null;
-				if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
-					this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);
-					return [stored.keyId, privateKey];
-				}
-				const firstRequestedKeyId = requestedKeyIds[0];
-				if (!firstRequestedKeyId) return null;
-				this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);
-				return [firstRequestedKeyId, privateKey];
-			},
+			getSecretStorageKey,
 			cacheSecretStorageKey: (keyId, keyInfo, key) => {
+				if (this.closed) return;
 				const privateKey = new Uint8Array(key);
 				const normalizedKeyInfo = {
 					passphrase: keyInfo?.passphrase,
 					name: typeof keyInfo?.name === "string" ? keyInfo.name : void 0
 				};
 				this.rememberSecretStorageKey(keyId, privateKey, normalizedKeyInfo);
-				const stored = this.loadStoredRecoveryKey();
 				this.saveRecoveryKeyToDisk({
 					keyId,
 					keyInfo: normalizedKeyInfo,
-					privateKey,
-					encodedPrivateKey: stored?.encodedPrivateKey
-				});
+					privateKey
+				}, true);
 			}
 		};
 	}
-	getRecoveryKeySummary() {
-		const stored = this.loadStoredRecoveryKey();
+	async getRecoveryKeySummary() {
+		const stored = await this.afterPersistence(() => this.loadStoredRecoveryKey());
 		if (!stored) return null;
 		return {
 			encodedPrivateKey: stored.encodedPrivateKey,
@@ -500,16 +653,22 @@ var MatrixRecoveryKeyStore = class {
 		};
 	}
 	getSecretStorageKeyCandidate(keyId) {
-		const normalizedKeyId = keyId.trim();
-		if (!normalizedKeyId) return null;
-		const staged = this.resolveStagedSecretStorageKey([normalizedKeyId]);
-		if (staged) return staged[1];
-		const stored = this.loadStoredRecoveryKey();
-		if (!stored?.privateKeyBase64) return null;
-		const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
-		if (privateKey.length === 0) return null;
-		this.rememberSecretStorageKey(normalizedKeyId, privateKey, stored.keyInfo);
-		return privateKey;
+		return this.afterPersistence(async () => {
+			if (this.closed) return null;
+			const normalizedKeyId = keyId.trim();
+			if (!normalizedKeyId) return null;
+			const staged = this.resolveStagedSecretStorageKey([normalizedKeyId]);
+			if (staged) return staged[1];
+			const pending = this.pendingPersistence;
+			const stored = await this.loadStoredRecoveryKey();
+			if (this.closed) return null;
+			if (pending !== this.pendingPersistence) return this.getSecretStorageKeyCandidate(keyId);
+			if (!stored?.privateKeyBase64) return null;
+			const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
+			if (privateKey.length === 0) return null;
+			this.rememberSecretStorageKey(normalizedKeyId, privateKey, stored.keyInfo);
+			return privateKey;
+		});
 	}
 	resolveEncodedRecoveryKeyInput(params) {
 		const encodedPrivateKey = params.encodedPrivateKey.trim();
@@ -525,54 +684,52 @@ var MatrixRecoveryKeyStore = class {
 			encodedPrivateKey,
 			privateKey,
 			keyId,
-			keyInfo: params.keyInfo ?? this.loadStoredRecoveryKey()?.keyInfo
+			keyInfo: params.keyInfo
 		};
 	}
-	storeEncodedRecoveryKey(params) {
-		const prepared = this.resolveEncodedRecoveryKeyInput(params);
-		this.saveRecoveryKeyToDisk({
-			keyId: prepared.keyId,
-			keyInfo: prepared.keyInfo,
-			privateKey: prepared.privateKey,
-			encodedPrivateKey: prepared.encodedPrivateKey
-		});
-		if (prepared.keyId) this.rememberSecretStorageKey(prepared.keyId, prepared.privateKey, prepared.keyInfo);
-		return this.getRecoveryKeySummary() ?? {};
-	}
 	stageEncodedRecoveryKey(params) {
 		const prepared = this.resolveEncodedRecoveryKeyInput(params);
-		this.discardStagedRecoveryKey();
-		this.stagedRecoveryKey = {
-			version: 1,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			keyId: prepared.keyId,
-			encodedPrivateKey: prepared.encodedPrivateKey,
-			privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
-			keyInfo: prepared.keyInfo
-		};
+		return this.enqueuePersistence(async () => {
+			const keyInfo = prepared.keyInfo ?? (await this.loadStoredRecoveryKey())?.keyInfo;
+			this.clearStagedCache();
+			this.stagedRecoveryKey = {
+				version: 1,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				keyId: prepared.keyId,
+				encodedPrivateKey: prepared.encodedPrivateKey,
+				privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
+				keyInfo
+			};
+		});
 	}
 	hasStagedRecoveryKeyBeenUsed() {
 		return this.stagedRecoveryKeyUsed;
 	}
-	commitStagedRecoveryKey(params) {
-		if (!this.stagedRecoveryKey) return this.getRecoveryKeySummary();
-		const staged = this.stagedRecoveryKey;
-		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
-		const keyId = typeof params?.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;
-		this.saveRecoveryKeyToDisk({
-			keyId,
-			keyInfo: params?.keyInfo ?? staged.keyInfo,
-			privateKey,
-			encodedPrivateKey: staged.encodedPrivateKey
+	async commitStagedRecoveryKey(params) {
+		await this.enqueuePersistence(async () => {
+			if (!this.stagedRecoveryKey) return;
+			const staged = this.stagedRecoveryKey;
+			const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+			const keyId = typeof params?.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;
+			await this.persistRecoveryKey({
+				keyId,
+				keyInfo: params?.keyInfo ?? staged.keyInfo,
+				privateKey,
+				encodedPrivateKey: staged.encodedPrivateKey
+			});
+			this.clearStagedRecoveryKeyTracking();
 		});
-		this.clearStagedRecoveryKeyTracking();
 		return this.getRecoveryKeySummary();
 	}
 	discardStagedRecoveryKey() {
+		return this.enqueuePersistence(async () => this.clearStagedCache());
+	}
+	clearStagedCache() {
 		for (const keyId of this.stagedCacheKeyIds) this.secretStorageKeyCache.delete(keyId);
 		this.clearStagedRecoveryKeyTracking();
 	}
 	async bootstrapSecretStorageWithRecoveryKey(crypto, options = {}) {
+		await this.drainPendingPersistence();
 		let status = null;
 		const getSecretStorageStatus = crypto.getSecretStorageStatus;
 		if (typeof getSecretStorageStatus === "function") try {
@@ -583,7 +740,7 @@ var MatrixRecoveryKeyStore = class {
 		const hasDefaultSecretStorageKey = Boolean(status?.defaultKeyId);
 		const hasKnownInvalidSecrets = Object.values(status?.secretStorageKeyValidityMap ?? {}).some((valid) => !valid);
 		let generatedRecoveryKey = false;
-		const storedRecovery = this.loadStoredRecoveryKey();
+		const storedRecovery = await this.afterPersistence(() => this.loadStoredRecoveryKey());
 		const stagedRecovery = this.stagedRecoveryKey;
 		const sourceRecovery = options.forceNewRecoveryKey === true ? null : stagedRecovery ?? storedRecovery;
 		let recoveryKey = sourceRecovery ? {
@@ -595,7 +752,7 @@ var MatrixRecoveryKeyStore = class {
 			const defaultKeyId = status.defaultKeyId;
 			if (!stagedRecovery) {
 				this.rememberSecretStorageKey(defaultKeyId, recoveryKey.privateKey, recoveryKey.keyInfo);
-				if (storedRecovery && storedRecovery.keyId !== defaultKeyId) this.saveRecoveryKeyToDisk({
+				if (storedRecovery && storedRecovery.keyId !== defaultKeyId) await this.saveRecoveryKeyToDisk({
 					keyId: defaultKeyId,
 					keyInfo: recoveryKey.keyInfo,
 					privateKey: recoveryKey.privateKey,
@@ -610,7 +767,7 @@ var MatrixRecoveryKeyStore = class {
 			}
 			if (typeof crypto.createRecoveryKeyFromPassphrase !== "function") throw new Error("Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)");
 			recoveryKey = await crypto.createRecoveryKeyFromPassphrase();
-			this.saveRecoveryKeyToDisk(recoveryKey);
+			await this.saveRecoveryKeyToDisk(recoveryKey);
 			generatedRecoveryKey = true;
 			return recoveryKey;
 		};
@@ -622,16 +779,24 @@ var MatrixRecoveryKeyStore = class {
 			secretStorageOptions.createSecretStorageKey = ensureRecoveryKey;
 		}
 		try {
-			await crypto.bootstrapSecretStorage(secretStorageOptions);
+			try {
+				await crypto.bootstrapSecretStorage(secretStorageOptions);
+			} finally {
+				await this.drainPendingPersistence();
+			}
 		} catch (err) {
 			if (!(options.allowSecretStorageRecreateWithoutRecoveryKey === true && hasDefaultSecretStorageKey && isRepairableSecretStorageAccessError(err))) throw err;
 			recoveryKey = null;
 			LogService.warn("MatrixClientLite", "Secret storage exists on the server but local recovery material cannot unlock it; recreating secret storage during explicit bootstrap.");
-			await crypto.bootstrapSecretStorage({
-				setupNewSecretStorage: true,
-				setupNewKeyBackup: options.setupNewKeyBackup === true,
-				createSecretStorageKey: ensureRecoveryKey
-			});
+			try {
+				await crypto.bootstrapSecretStorage({
+					setupNewSecretStorage: true,
+					setupNewKeyBackup: options.setupNewKeyBackup === true,
+					createSecretStorageKey: ensureRecoveryKey
+				});
+			} finally {
+				await this.drainPendingPersistence();
+			}
 		}
 		if (generatedRecoveryKey && this.storageRootDir) LogService.warn("MatrixClientLite", "Generated Matrix recovery key and saved it to Matrix SQLite state. Keep the displayed recovery key secure.");
 	}
@@ -662,17 +827,20 @@ var MatrixRecoveryKeyStore = class {
 			keyInfo
 		});
 	}
-	loadStoredRecoveryKey() {
-		if (!this.recoveryKeyPath) return null;
+	async loadStoredRecoveryKey() {
+		if (!this.recoveryKeyPath || !this.stateRuntime) return null;
 		try {
-			const stored = readMatrixRecoveryKeyStateForPath(this.recoveryKeyPath);
+			const stored = await readMatrixRecoveryKeyStateForPathAsync(this.recoveryKeyPath, this.stateRuntime);
 			if (stored) return stored;
 		} catch {}
 		if (this.legacyRecoveryKeyPathOnMigrationFailure) return readLegacyMatrixRecoveryKeyFile(this.legacyRecoveryKeyPathOnMigrationFailure);
 		return null;
 	}
-	saveRecoveryKeyToDisk(params) {
-		if (!this.recoveryKeyPath) return;
+	saveRecoveryKeyToDisk(params, preserveEncodedPrivateKey = false) {
+		return this.enqueuePersistence(() => this.persistRecoveryKey(params, preserveEncodedPrivateKey));
+	}
+	async persistRecoveryKey(params, preserveEncodedPrivateKey = false) {
+		if (!this.recoveryKeyPath || !this.stateRuntime) return;
 		try {
 			const payload = {
 				version: 1,
@@ -685,9 +853,11 @@ var MatrixRecoveryKeyStore = class {
 					name: params.keyInfo.name
 				} : void 0
 			};
-			writeMatrixRecoveryKeyStateForPath({
+			await writeMatrixRecoveryKeyStateForPathAsync({
 				recoveryKeyPath: this.recoveryKeyPath,
-				payload
+				payload,
+				stateRuntime: this.stateRuntime,
+				preserveEncodedPrivateKey
 			});
 		} catch (err) {
 			LogService.warn("MatrixClientLite", "Failed to persist recovery key:", err);
@@ -695,28 +865,60 @@ var MatrixRecoveryKeyStore = class {
 	}
 };
 //#endregion
+//#region extensions/matrix/src/matrix/sdk/send-scheduler.ts
+/** Keep SDK FIFO/backoff while settling a caller's pre-request rejection only for its event. */
+var MatrixSendScheduler = class extends MatrixScheduler {
+	constructor(wasCurrentnessRejected) {
+		super();
+		this.wasCurrentnessRejected = wasCurrentnessRejected;
+		this.queue = new MatrixScheduler();
+	}
+	setProcessFunction(processEvent) {
+		this.queue.setProcessFunction(async (event) => {
+			try {
+				return {
+					kind: "sent",
+					result: await withoutMatrixSendCurrentness(() => processEvent(event))
+				};
+			} catch (error) {
+				if (!this.wasCurrentnessRejected(event)) throw error;
+				return {
+					kind: "rejected",
+					error
+				};
+			}
+		});
+	}
+	queueEvent(event) {
+		const queued = this.queue.queueEvent(event);
+		return queued ? queued.then((outcome) => {
+			if (outcome.kind === "rejected") throw outcome.error;
+			return outcome.result;
+		}) : null;
+	}
+	getQueueForEvent(event) {
+		return this.queue.getQueueForEvent(event);
+	}
+	removeEventFromQueue(event) {
+		return this.queue.removeEventFromQueue(event);
+	}
+};
+//#endregion
 //#region extensions/matrix/src/matrix/sdk/client-base.ts
-function resolveMessageWireDispatch(resource, init) {
-	if ((init?.method ?? (resource instanceof Request ? resource.method : "GET")).toUpperCase() !== "PUT") return null;
-	const rawUrl = typeof resource === "string" ? resource : resource instanceof URL ? resource.href : resource.url;
-	const segments = new URL(rawUrl).pathname.split("/").filter(Boolean);
-	const roomsIndex = segments.lastIndexOf("rooms");
-	if (roomsIndex < 0 || segments[roomsIndex + 2] !== "send" || segments.length !== roomsIndex + 5) return null;
-	const eventType = decodeURIComponent(segments[roomsIndex + 3] ?? "");
-	if (eventType !== "m.room.message" && eventType !== "m.room.encrypted") return null;
-	return {
-		roomId: decodeURIComponent(segments[roomsIndex + 1] ?? ""),
-		eventType,
-		transactionId: decodeURIComponent(segments[roomsIndex + 4] ?? ""),
-		requestPath: new URL(rawUrl).pathname
-	};
-}
+const MATRIX_ENCRYPTED_STARTUP_TIMEOUT_MS = 6e4;
 let loadedMatrixCryptoRuntime = null;
-const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-BvunIYVn.js").then((runtime) => {
+const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-9oxuU30y.mjs").then((runtime) => {
 	loadedMatrixCryptoRuntime = runtime;
 	return runtime;
 }));
 var MatrixClientBase = class {
+	withClientCryptoWork(run, requestSignal) {
+		this.assertClientActive();
+		return withoutMatrixSendCurrentness(() => this.cryptoRequestOwner.run({
+			callerAuthority: captureChannelReadAuthority(),
+			requestSignal
+		}, run));
+	}
 	constructor(homeserver, accessToken, opts = {}) {
 		this.emitter = new EventEmitter();
 		this.bridgeRegistered = false;
@@ -732,11 +934,23 @@ var MatrixClientBase = class {
 		this.currentSyncError = void 0;
 		this.transactionScopeId = null;
 		this.transactionScopePromise = null;
-		this.messageWireDispatchGuards = /* @__PURE__ */ new Map();
+		this.messageWireDispatchGuards = new MatrixMessageWireDispatchGuards();
+		this.requestAbortController = new AbortController();
+		this.cryptoRequestOwner = new AsyncLocalStorage();
+		this.startupPromise = null;
+		this.cryptoInitializationPromise = null;
 		this.sdkStopped = false;
 		this.stopDiscardPromise = null;
 		this.idbPersistPromise = null;
 		this.idbPersistAbortController = null;
+		this.assertClientActive = () => {
+			this.requestAbortController.signal.throwIfAborted();
+		};
+		this.captureRequestAuthority = () => {
+			const readAuthority = captureChannelReadAuthority();
+			const cryptoOwner = this.cryptoRequestOwner.getStore();
+			return cryptoOwner && cryptoOwner.callerAuthority === readAuthority ? this.assertClientActive : readAuthority;
+		};
 		this.dms = {
 			update: async () => {
 				return await this.refreshDmCache();
@@ -751,7 +965,10 @@ var MatrixClientBase = class {
 			homeserver,
 			accessToken,
 			ssrfPolicy: opts.ssrfPolicy,
-			dispatcherPolicy: opts.dispatcherPolicy
+			dispatcherPolicy: opts.dispatcherPolicy,
+			captureRequestAuthority: this.captureRequestAuthority,
+			captureSendCurrentness: () => captureMatrixSendCurrentness(this),
+			signal: this.requestAbortController.signal
 		});
 		this.localTimeoutMs = resolveMatrixLocalTimeoutMs(opts.localTimeoutMs);
 		this.initialSyncLimit = opts.initialSyncLimit;
@@ -762,13 +979,22 @@ var MatrixClientBase = class {
 		this.syncStore = opts.storageRootDir ? new SqliteBackedMatrixSyncStore(opts.storageRootDir) : void 0;
 		this.idbSnapshotPath = opts.idbSnapshotPath;
 		this.cryptoDatabasePrefix = opts.cryptoDatabasePrefix;
+		this.stateRuntime = opts.stateRuntime;
 		this.selfUserId = opts.userId?.trim() || null;
 		this.autoBootstrapCrypto = opts.autoBootstrapCrypto !== false;
-		this.recoveryKeyStore = new MatrixRecoveryKeyStore(opts.recoveryKeyPath);
+		this.recoveryKeyStore = new MatrixRecoveryKeyStore(opts.recoveryKeyPath, opts.stateRuntime);
 		const cryptoCallbacks = this.encryptionEnabled ? this.recoveryKeyStore.buildCryptoCallbacks() : void 0;
 		const guardedFetch = createMatrixGuardedFetch({
+			captureRequestSignal: () => this.cryptoRequestOwner.getStore()?.requestSignal,
 			ssrfPolicy: opts.ssrfPolicy,
-			dispatcherPolicy: opts.dispatcherPolicy
+			dispatcherPolicy: opts.dispatcherPolicy,
+			captureRequestAuthority: this.captureRequestAuthority,
+			captureSendCurrentness: (resource, init) => this.messageWireDispatchGuards.captureCurrentness(resource, init, captureMatrixSendCurrentness(this)),
+			signal: this.requestAbortController.signal,
+			beforeRequest: async (resource, init) => {
+				await this.recoveryKeyStore.drainPendingPersistence();
+				await this.messageWireDispatchGuards.beforeRequest(resource, init);
+			}
 		});
 		this.client = createClient({
 			baseUrl: homeserver,
@@ -777,11 +1003,8 @@ var MatrixClientBase = class {
 			deviceId: opts.deviceId,
 			logger: createMatrixJsSdkClientLogger("MatrixClient"),
 			localTimeoutMs: this.localTimeoutMs,
-			fetchFn: (async (resource, init) => {
-				const dispatch = resolveMessageWireDispatch(resource, init);
-				if (dispatch) await this.messageWireDispatchGuards.get(dispatch.transactionId)?.(dispatch);
-				return await guardedFetch(resource, init);
-			}),
+			fetchFn: guardedFetch,
+			scheduler: new MatrixSendScheduler((event) => this.messageWireDispatchGuards.wasCurrentnessRejected(event.getTxnId())),
 			store: this.syncStore,
 			cryptoCallbacks,
 			verificationMethods: [
@@ -791,16 +1014,11 @@ var MatrixClientBase = class {
 				VerificationMethod.Reciprocate
 			]
 		});
-	}
-	async withMessageWireDispatchGuard(params) {
-		if (!params.transactionId || !params.guard) return await params.run();
-		if (this.messageWireDispatchGuards.has(params.transactionId)) throw new Error(`Matrix transaction ${params.transactionId} already has a dispatch guard`);
-		this.messageWireDispatchGuards.set(params.transactionId, params.guard);
-		try {
-			return await params.run();
-		} finally {
-			this.messageWireDispatchGuards.delete(params.transactionId);
-		}
+		const decryptEventIfNeeded = this.client.decryptEventIfNeeded.bind(this.client);
+		this.client.decryptEventIfNeeded = (event, options) => {
+			this.captureRequestAuthority()?.();
+			return this.withClientCryptoWork(() => decryptEventIfNeeded(event, options));
+		};
 	}
 	on(eventName, listener) {
 		this.emitter.on(eventName, listener);
@@ -841,7 +1059,7 @@ var MatrixClientBase = class {
 				const defaultKeyId = await secretStorage.getDefaultKeyId();
 				if (!defaultKeyId) return false;
 				const keyTuple = await secretStorage.getKey(defaultKeyId);
-				const key = this.recoveryKeyStore.getSecretStorageKeyCandidate(defaultKeyId);
+				const key = await this.recoveryKeyStore.getSecretStorageKeyCandidate(defaultKeyId);
 				if (!keyTuple || !key) return false;
 				const keyInfo = keyTuple[1];
 				if (!keyInfo.iv?.trim() || !keyInfo.mac?.trim()) return false;
@@ -874,98 +1092,84 @@ var MatrixClientBase = class {
 		});
 	}
 	async waitForInitialSyncReady(params = {}) {
-		const timeoutMs = params.timeoutMs ?? 3e4;
-		if (isMatrixReadySyncState(this.currentSyncState)) return;
-		if (isMatrixAccessTokenInvalidatedError(this.currentSyncError)) throw this.currentSyncError instanceof Error ? this.currentSyncError : new Error("Matrix access token invalidated", { cause: this.currentSyncError });
-		if (isMatrixTerminalSyncState(this.currentSyncState)) throw new Error(`Matrix sync entered ${this.currentSyncState} during startup`);
-		await new Promise((resolve, reject) => {
-			let settled = false;
-			let timeoutId;
-			const abortSignal = params.abortSignal;
-			const cleanup = () => {
-				this.off("sync.state", onSyncState);
-				this.off("sync.unexpected_error", onUnexpectedError);
-				abortSignal?.removeEventListener("abort", onAbort);
-				if (timeoutId) {
-					clearTimeout(timeoutId);
-					timeoutId = void 0;
-				}
-			};
-			const settleResolve = () => {
-				if (settled) return;
-				settled = true;
-				cleanup();
-				resolve();
-			};
-			const settleReject = (error) => {
-				if (settled) return;
-				settled = true;
-				cleanup();
-				reject(error);
-			};
-			const onSyncState = (state, _prevState, error) => {
-				if (isMatrixReadySyncState(state)) {
-					settleResolve();
-					return;
-				}
-				if (isMatrixAccessTokenInvalidatedError(error)) {
-					settleReject(error instanceof Error ? error : /* @__PURE__ */ new Error("Matrix access token invalidated"));
-					return;
-				}
-				if (isMatrixTerminalSyncState(state)) settleReject(new Error(error instanceof Error && error.message ? error.message : `Matrix sync entered ${state} during startup`));
-			};
-			const onUnexpectedError = (error) => {
-				settleReject(error);
-			};
-			const onAbort = () => {
-				settleReject(createMatrixStartupAbortError());
-			};
-			this.on("sync.state", onSyncState);
-			this.on("sync.unexpected_error", onUnexpectedError);
-			if (abortSignal?.aborted) {
-				onAbort();
-				return;
-			}
-			abortSignal?.addEventListener("abort", onAbort, { once: true });
-			timeoutId = setTimeout(() => {
-				settleReject(/* @__PURE__ */ new Error(`Matrix client did not reach a ready sync state within ${timeoutMs}ms`));
-			}, timeoutMs);
-			timeoutId.unref?.();
+		await waitForMatrixInitialSyncReady({
+			...params,
+			emitter: this.emitter,
+			state: this.currentSyncState,
+			error: this.currentSyncError
 		});
 	}
 	async startSyncSession(opts) {
 		if (this.started) return;
 		if (this.sdkStopped) throw new Error("Matrix client has been fully stopped and cannot be restarted; acquire a new shared client generation");
-		throwIfMatrixStartupAborted(opts.abortSignal);
-		await this.ensureCryptoSupportInitialized();
-		throwIfMatrixStartupAborted(opts.abortSignal);
-		this.registerBridge();
-		await this.initializeCryptoIfNeeded(opts.abortSignal);
-		throwIfMatrixStartupAborted(opts.abortSignal);
-		await this.client.startClient({
-			initialSyncLimit: this.initialSyncLimit,
-			...this.syncFilter ? { filter: Filter.fromJson(this.selfUserId, "", this.syncFilter) } : {}
-		});
-		await this.waitForInitialSyncReady({
-			abortSignal: opts.abortSignal,
-			timeoutMs: opts.readyTimeoutMs
-		});
-		throwIfMatrixStartupAborted(opts.abortSignal);
-		if (opts.bootstrapCrypto && this.autoBootstrapCrypto) await this.bootstrapCryptoIfNeeded(opts.abortSignal);
-		throwIfMatrixStartupAborted(opts.abortSignal);
-		this.started = true;
-		this.emitOutstandingInviteEvents();
-		await this.refreshDmCache().catch(noop);
+		const assertCurrent = this.captureRequestAuthority();
+		assertCurrent?.();
+		this.assertClientActive();
+		if (this.startupPromise) {
+			await awaitMatrixStartupWithAbort(this.startupPromise, opts.abortSignal);
+			return;
+		}
+		const deadline = new AbortController();
+		const signal = AbortSignal.any([
+			this.requestAbortController.signal,
+			deadline.signal,
+			...opts.abortSignal ? [opts.abortSignal] : []
+		]);
+		const timeout = this.encryptionEnabled ? setTimeout(() => deadline.abort(), opts.readyTimeoutMs ?? MATRIX_ENCRYPTED_STARTUP_TIMEOUT_MS) : void 0;
+		timeout?.unref?.();
+		const checkActive = () => {
+			throwIfMatrixStartupAborted(signal);
+			assertCurrent?.();
+			this.assertClientActive();
+		};
+		const startup = (async () => {
+			throwIfMatrixStartupAborted(signal);
+			await this.ensureCryptoSupportInitialized();
+			checkActive();
+			throwIfMatrixStartupAborted(signal);
+			this.registerBridge();
+			await this.withClientCryptoWork(() => this.initializeCryptoIfNeeded(signal), signal);
+			checkActive();
+			throwIfMatrixStartupAborted(signal);
+			await this.withClientCryptoWork(() => this.client.startClient({
+				initialSyncLimit: this.initialSyncLimit,
+				...this.syncFilter ? { filter: Filter.fromJson(this.selfUserId, "", this.syncFilter) } : {}
+			}));
+			await this.waitForInitialSyncReady({
+				abortSignal: signal,
+				timeoutMs: opts.readyTimeoutMs
+			});
+			checkActive();
+			throwIfMatrixStartupAborted(signal);
+			if (this.encryptionEnabled && this.cryptoInitialized) {
+				const { reconcileJoinedRoomEncryption } = await import("./joined-room-encryption-BCtxQ3hR.mjs");
+				checkActive();
+				await this.withClientCryptoWork(() => reconcileJoinedRoomEncryption(this.client, signal, checkActive), signal);
+				checkActive();
+			}
+			clearTimeout(timeout);
+			if (opts.bootstrapCrypto && this.autoBootstrapCrypto) await this.bootstrapCryptoIfNeeded(signal);
+			throwIfMatrixStartupAborted(signal);
+			this.started = true;
+			this.emitOutstandingInviteEvents();
+			await this.refreshDmCache().catch(noop);
+		})();
+		this.startupPromise = startup;
+		startup.finally(() => {
+			clearTimeout(timeout);
+			if (this.startupPromise === startup) this.startupPromise = null;
+		}).catch(noop);
+		await awaitMatrixStartupWithAbort(startup, signal);
 	}
 	async prepareForOneOff() {
+		const assertCurrent = this.captureRequestAuthority();
+		assertCurrent?.();
+		this.assertClientActive();
 		if (!this.encryptionEnabled) return;
 		await this.ensureCryptoSupportInitialized();
-		await this.initializeCryptoIfNeeded();
-		if (!this.crypto) return;
-		try {
-			const joinedRooms = await this.getJoinedRooms();
-			await this.crypto.prepare(joinedRooms);
-		} catch {}
+		assertCurrent?.();
+		await this.withClientCryptoWork(() => this.initializeCryptoIfNeeded());
+		assertCurrent?.();
 	}
 	hasPersistedSyncState() {
 		return this.syncStore?.hasSavedSyncFromCleanShutdown() === true;
@@ -978,8 +1182,8 @@ var MatrixClientBase = class {
 		if (this.sdkStopped) return;
 		this.currentSyncState = null;
 		this.currentSyncError = void 0;
-		this.client.stopClient();
 		this.sdkStopped = true;
+		this.client.stopClient();
 		this.started = false;
 	}
 	async quiesceSync() {
@@ -995,34 +1199,44 @@ var MatrixClientBase = class {
 		await this.syncQuiescePromise;
 	}
 	async drainPendingDecryptions(reason = "matrix client shutdown") {
-		await this.decryptBridge?.drainPendingDecryptions(reason);
+		await this.withClientCryptoWork(() => this.decryptBridge?.drainPendingDecryptions(reason));
 	}
 	stop() {
 		this.stopAndPersist().catch(() => this.stopWithoutPersist()).catch(noop);
 	}
 	async stopClientGeneration(persist) {
-		if (persist) await this.quiesceSync();
-		else {
-			await this.quiesceSync().catch(noop);
-			this.syncStore?.discardPendingSyncCursorPersistence();
-		}
-		if (this.idbPersistTimer) {
-			clearInterval(this.idbPersistTimer);
+		try {
+			if (persist) await this.quiesceSync();
+			else {
+				await this.quiesceSync().catch(noop);
+				this.syncStore?.discardPendingSyncCursorPersistence();
+			}
+			this.requestAbortController.abort(/* @__PURE__ */ new Error("Matrix client generation is no longer active."));
+			await this.startupPromise?.catch(noop);
+			await this.cryptoInitializationPromise?.catch(noop);
+			clearInterval(this.idbPersistTimer ?? void 0);
 			this.idbPersistTimer = null;
-		}
-		this.idbPersistAbortController?.abort();
-		const activePeriodicPersist = this.idbPersistPromise;
-		this.stopSdkClient();
-		this.decryptBridge?.stop();
-		await activePeriodicPersist;
-		if (persist) {
-			await (loadedMatrixCryptoRuntime ?? await loadMatrixCryptoRuntime()).persistIdbToDisk({
-				snapshotPath: this.idbSnapshotPath,
-				databasePrefix: this.cryptoDatabasePrefix,
-				strict: true
-			});
-			this.syncStore?.markCleanShutdown();
-			await this.syncStore?.flush();
+			this.idbPersistAbortController?.abort();
+			const activePeriodicPersist = this.idbPersistPromise;
+			try {
+				this.stopSdkClient();
+				this.decryptBridge?.stop();
+			} finally {
+				this.cryptoRequestOwner.disable();
+			}
+			await Promise.all([this.recoveryKeyStore.close(), activePeriodicPersist]);
+			if (persist) {
+				await (loadedMatrixCryptoRuntime ?? await loadMatrixCryptoRuntime()).persistIdbToDisk({
+					snapshotPath: this.idbSnapshotPath,
+					databasePrefix: this.cryptoDatabasePrefix,
+					strict: true,
+					stateRuntime: this.stateRuntime
+				});
+				this.syncStore?.markCleanShutdown();
+				await this.syncStore?.flush();
+			}
+		} finally {
+			await this.recoveryKeyStore.close();
 		}
 	}
 	async stopAndPersist() {
@@ -1056,10 +1270,25 @@ var MatrixClientBase = class {
 		this.cryptoBootstrapped = true;
 	}
 	async initializeCryptoIfNeeded(abortSignal) {
-		if (!this.encryptionEnabled || this.cryptoInitialized) return;
+		if (!this.encryptionEnabled) return;
+		if (this.cryptoInitializationPromise) {
+			await this.cryptoInitializationPromise;
+			throwIfMatrixStartupAborted(abortSignal);
+			return;
+		}
+		if (this.cryptoInitialized) return;
+		const initialization = this.initializeCrypto(abortSignal ? AbortSignal.any([abortSignal, this.requestAbortController.signal]) : this.requestAbortController.signal);
+		this.cryptoInitializationPromise = initialization;
+		try {
+			await initialization;
+		} finally {
+			if (this.cryptoInitializationPromise === initialization) this.cryptoInitializationPromise = null;
+		}
+	}
+	async initializeCrypto(abortSignal) {
 		throwIfMatrixStartupAborted(abortSignal);
 		const { persistIdbToDisk, restoreIdbFromDisk } = await loadMatrixCryptoRuntime();
-		await restoreIdbFromDisk(this.idbSnapshotPath);
+		await restoreIdbFromDisk(this.idbSnapshotPath, this.stateRuntime);
 		throwIfMatrixStartupAborted(abortSignal);
 		try {
 			await this.client.initRustCrypto({ cryptoDatabasePrefix: this.cryptoDatabasePrefix });
@@ -1068,7 +1297,8 @@ var MatrixClientBase = class {
 			await persistIdbToDisk({
 				snapshotPath: this.idbSnapshotPath,
 				databasePrefix: this.cryptoDatabasePrefix,
-				abortSignal
+				abortSignal,
+				stateRuntime: this.stateRuntime
 			});
 			throwIfMatrixStartupAborted(abortSignal);
 			this.idbPersistTimer = setInterval(() => {
@@ -1078,7 +1308,8 @@ var MatrixClientBase = class {
 				this.idbPersistPromise = persistIdbToDisk({
 					snapshotPath: this.idbSnapshotPath,
 					databasePrefix: this.cryptoDatabasePrefix,
-					abortSignal: abortController.signal
+					abortSignal: abortController.signal,
+					stateRuntime: this.stateRuntime
 				}).catch(noop).finally(() => {
 					this.idbPersistPromise = null;
 					this.idbPersistAbortController = null;
@@ -1117,8 +1348,9 @@ var MatrixClientCore = class extends MatrixClientBase {
 		return Array.isArray(joined.joined_rooms) ? joined.joined_rooms : [];
 	}
 	async getTransactionScopeId() {
+		captureMatrixSendCurrentness(this)?.();
 		if (this.transactionScopeId) return this.transactionScopeId;
-		const active = this.transactionScopePromise ?? (async () => {
+		const active = this.transactionScopePromise ?? withoutMatrixSendCurrentness(async () => {
 			const configuredUserId = this.client.getUserId()?.trim() || this.selfUserId;
 			const configuredDeviceId = this.transactionScopeDeviceId || this.client.getDeviceId()?.trim() || null;
 			const whoami = await this.doRequest("GET", "/_matrix/client/v3/account/whoami");
@@ -1130,7 +1362,7 @@ var MatrixClientCore = class extends MatrixClientBase {
 			this.selfUserId = userId;
 			this.transactionScopeDeviceId = deviceId;
 			return createHash("sha256").update(this.transactionScopeHomeserver).update("\0").update(userId).update("\0").update(deviceId ?? "").update("\0").update(this.transactionScopeAccessTokenHash).digest("hex");
-		})();
+		});
 		this.transactionScopePromise = active;
 		try {
 			const resolved = await active;
@@ -1181,14 +1413,17 @@ var MatrixClientCore = class extends MatrixClientBase {
 		})).room_id;
 	}
 	async sendMessage(roomId, content, transactionId, beforeWireDispatch) {
+		const assertCurrent = captureMatrixSendCurrentness(this);
+		const wireTransactionId = transactionId ?? (beforeWireDispatch || assertCurrent ? this.client.makeTxnId() : void 0);
 		return await this.runSerializedRoomSend(roomId, async () => {
-			return await this.withMessageWireDispatchGuard({
-				transactionId,
+			return await this.messageWireDispatchGuards.run({
+				transactionId: wireTransactionId,
 				guard: beforeWireDispatch,
+				assertCurrent,
 				run: async () => {
-					if (transactionId) {
+					if (wireTransactionId) {
 						const room = this.client.getRoom(roomId);
-						const existing = room?.getEventForTxnId?.(transactionId);
+						const existing = room?.getEventForTxnId?.(wireTransactionId);
 						if (existing) {
 							const existingId = existing.getId();
 							if (existing.status === EventStatus.SENT && existingId && !existingId.startsWith("~")) return existingId;
@@ -1196,11 +1431,11 @@ var MatrixClientCore = class extends MatrixClientBase {
 								await this.prepareRoomForMessageSend(roomId, existing.getContent());
 								return (await this.client.resendEvent(existing, room)).event_id;
 							}
-							throw new Error(`Matrix transaction ${transactionId} is already active with status ${existing.status ?? "unknown"}`);
+							throw new Error(`Matrix transaction ${wireTransactionId} is already active with status ${existing.status ?? "unknown"}`);
 						}
 					}
 					await this.prepareRoomForMessageSend(roomId, content);
-					return (await this.client.sendMessage(roomId, content, transactionId)).event_id;
+					return (await this.client.sendMessage(roomId, content, wireTransactionId)).event_id;
 				}
 			});
 		});
@@ -1348,6 +1583,9 @@ var MatrixClientCore = class extends MatrixClientBase {
 //#region extensions/matrix/src/matrix/sdk/client-verification.ts
 const normalizeNullableVerificationString = normalizeNullableString;
 var MatrixClientVerification = class extends MatrixClientCore {
+	async refreshOwnDeviceKeys() {
+		await this.client.getCrypto()?.userHasCrossSigningKeys(await this.getUserId(), true);
+	}
 	async getRoomKeyBackupStatus() {
 		if (!this.encryptionEnabled) return {
 			serverVersion: null,
@@ -1427,7 +1665,7 @@ var MatrixClientVerification = class extends MatrixClientCore {
 		};
 	}
 	async getOwnDeviceVerificationStatus() {
-		const recoveryKey = this.recoveryKeyStore.getRecoveryKeySummary();
+		const recoveryKey = await this.recoveryKeyStore.getRecoveryKeySummary();
 		const userId = this.client.getUserId() ?? this.selfUserId ?? null;
 		const deviceId = this.client.getDeviceId()?.trim() || null;
 		const diagnosticTimeoutMs = Math.min(this.localTimeoutMs, MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS);
@@ -1582,22 +1820,22 @@ var MatrixClient = class extends MatrixClientVerification {
 		let stagedKeyId;
 		try {
 			stagedKeyId = await this.resolveDefaultSecretStorageKeyId(crypto) ?? null;
-			this.recoveryKeyStore.stageEncodedRecoveryKey({
+			await this.recoveryKeyStore.stageEncodedRecoveryKey({
 				encodedPrivateKey: trimmedRecoveryKey,
 				keyId: stagedKeyId
 			});
 		} catch (err) {
 			return await fail(formatErrorMessage(err));
 		}
-		const storedRecoveryKeyMatches = this.recoveryKeyStore.getRecoveryKeySummary()?.encodedPrivateKey?.trim() === trimmedRecoveryKey;
+		const storedRecoveryKeyMatches = (await this.recoveryKeyStore.getRecoveryKeySummary())?.encodedPrivateKey?.trim() === trimmedRecoveryKey;
 		if (backupUsableBeforeStagedRecovery && storedRecoveryKeyMatches) {
 			const status = await this.getOwnDeviceVerificationStatus();
 			const backupUsable = resolveMatrixRoomKeyBackupReadinessError(status.backup, { requireServerBackup: true }) === null;
 			const backupError = resolveMatrixRoomKeyBackupReadinessError(status.backup, { requireServerBackup: false });
 			const recoveryKeyAccepted = backupUsable;
 			if (!status.verified) {
-				if (recoveryKeyAccepted) this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
-				else this.recoveryKeyStore.discardStagedRecoveryKey();
+				if (recoveryKeyAccepted) await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
+				else await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return {
 					success: false,
 					recoveryKeyAccepted,
@@ -1608,7 +1846,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				};
 			}
 			if (backupError) {
-				this.recoveryKeyStore.discardStagedRecoveryKey();
+				await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return {
 					success: false,
 					recoveryKeyAccepted,
@@ -1618,7 +1856,7 @@ var MatrixClient = class extends MatrixClientVerification {
 					...status
 				};
 			}
-			this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
+			await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
 			return {
 				success: true,
 				recoveryKeyAccepted: true,
@@ -1643,8 +1881,8 @@ var MatrixClient = class extends MatrixClientVerification {
 			const stagedRecoveryKeyValidated = stagedRecoveryKeyUsed && (stagedRecoveryKeyConfirmedBySecretStorage || stagedRecoveryKeyUsed && !stagedRecoveryKeyRejectedBySecretStorage && !stagedRecoveryKeyConfirmedBySecretStorage && !backupUsableBeforeStagedRecovery && backupUsable) || storedRecoveryKeyMatches && backupUsable;
 			const recoveryKeyAccepted = stagedRecoveryKeyValidated && (status.verified || backupUsable);
 			if (!status.verified) {
-				if (backupUsable && stagedRecoveryKeyValidated) this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
-				else this.recoveryKeyStore.discardStagedRecoveryKey();
+				if (backupUsable && stagedRecoveryKeyValidated) await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
+				else await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return {
 					success: false,
 					recoveryKeyAccepted,
@@ -1655,7 +1893,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				};
 			}
 			if (backupError) {
-				this.recoveryKeyStore.discardStagedRecoveryKey();
+				await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return {
 					success: false,
 					recoveryKeyAccepted,
@@ -1666,7 +1904,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				};
 			}
 			if (!stagedRecoveryKeyValidated) {
-				this.recoveryKeyStore.discardStagedRecoveryKey();
+				await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return {
 					success: false,
 					recoveryKeyAccepted: false,
@@ -1676,7 +1914,7 @@ var MatrixClient = class extends MatrixClientVerification {
 					...status
 				};
 			}
-			this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
+			await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: stagedKeyId });
 			const committedStatus = await this.getOwnDeviceVerificationStatus();
 			return {
 				success: true,
@@ -1687,7 +1925,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				...committedStatus
 			};
 		} catch (err) {
-			this.recoveryKeyStore.discardStagedRecoveryKey();
+			await this.recoveryKeyStore.discardStagedRecoveryKey();
 			return await fail(formatErrorMessage(err));
 		}
 	}
@@ -1711,7 +1949,7 @@ var MatrixClient = class extends MatrixClientVerification {
 		if (!crypto) return await fail("Matrix crypto is not available (start client with encryption enabled)");
 		try {
 			const rawRecoveryKey = params.recoveryKey?.trim();
-			if (rawRecoveryKey) this.recoveryKeyStore.stageEncodedRecoveryKey({
+			if (rawRecoveryKey) await this.recoveryKeyStore.stageEncodedRecoveryKey({
 				encodedPrivateKey: rawRecoveryKey,
 				keyId: await this.resolveDefaultSecretStorageKeyId(crypto)
 			});
@@ -1722,15 +1960,15 @@ var MatrixClient = class extends MatrixClientVerification {
 				requireServerBackup: true
 			});
 			if (backupError) {
-				this.recoveryKeyStore.discardStagedRecoveryKey();
+				await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return await fail(backupError);
 			}
 			if (typeof crypto.restoreKeyBackup !== "function") {
-				this.recoveryKeyStore.discardStagedRecoveryKey();
+				await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return await fail("Matrix crypto backend does not support full key backup restore");
 			}
 			const restore = await crypto.restoreKeyBackup();
-			if (rawRecoveryKey) this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: await this.resolveDefaultSecretStorageKeyId(crypto) });
+			if (rawRecoveryKey) await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: await this.resolveDefaultSecretStorageKeyId(crypto) });
 			const finalBackup = await this.getRoomKeyBackupStatus();
 			return {
 				success: true,
@@ -1742,7 +1980,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				backup: finalBackup
 			};
 		} catch (err) {
-			this.recoveryKeyStore.discardStagedRecoveryKey();
+			await this.recoveryKeyStore.discardStagedRecoveryKey();
 			return await fail(formatErrorMessage(err));
 		}
 	}
@@ -1764,6 +2002,7 @@ var MatrixClient = class extends MatrixClientVerification {
 		await this.ensureStartedForCryptoControlPlane();
 		const crypto = this.client.getCrypto();
 		if (!crypto) return await fail("Matrix crypto is not available (start client with encryption enabled)");
+		await this.recoveryKeyStore.drainPendingPersistence();
 		previousVersion = await this.resolveRoomKeyBackupVersion();
 		const forceNewSecretStorage = options.rotateRecoveryKey === true || await this.shouldForceSecretStorageRecreationForBackupReset(crypto);
 		try {
@@ -1827,7 +2066,7 @@ var MatrixClient = class extends MatrixClientVerification {
 			const crypto = this.client.getCrypto();
 			if (!crypto) throw new Error("Matrix crypto is not available (start client with encryption enabled)");
 			rawRecoveryKey = params?.recoveryKey?.trim();
-			if (rawRecoveryKey) this.recoveryKeyStore.stageEncodedRecoveryKey({
+			if (rawRecoveryKey) await this.recoveryKeyStore.stageEncodedRecoveryKey({
 				encodedPrivateKey: rawRecoveryKey,
 				keyId: await this.resolveDefaultSecretStorageKeyId(crypto)
 			});
@@ -1839,7 +2078,7 @@ var MatrixClient = class extends MatrixClientVerification {
 			}));
 			await this.ensureRoomKeyBackupEnabled(crypto);
 		} catch (err) {
-			this.recoveryKeyStore.discardStagedRecoveryKey();
+			await this.recoveryKeyStore.discardStagedRecoveryKey();
 			bootstrapError = formatErrorMessage(err);
 		}
 		const verification = await this.getOwnDeviceVerificationStatus();
@@ -1850,8 +2089,8 @@ var MatrixClient = class extends MatrixClientVerification {
 			requireServerBackup: true
 		}) : null;
 		const success = verificationError === null && backupError === null;
-		if (success) this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: await this.resolveDefaultSecretStorageKeyId(this.client.getCrypto()) });
-		else this.recoveryKeyStore.discardStagedRecoveryKey();
+		if (success) await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: await this.resolveDefaultSecretStorageKeyId(this.client.getCrypto()) });
+		else await this.recoveryKeyStore.discardStagedRecoveryKey();
 		return {
 			success,
 			error: success ? void 0 : backupError ?? verificationError ?? void 0,