@uniquedivine/tg-sai 0.0.3 → 0.0.5

package/provisioningRuntime.ts

@@ -0,0 +1,380 @@
+import { createHash, randomUUID } from "node:crypto"
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises"
+import { dirname, isAbsolute, join, resolve } from "node:path"
+import type { ChatMember } from "@mtcute/bun"
+import {
+  addChatMembers,
+  createInviteLink,
+  createSupergroup,
+  getChatMember,
+  getPrimaryInviteLink,
+  iterDialogs,
+} from "@mtcute/bun/methods.js"
+import { saiBot } from "./cfg"
+import { createMtcuteClient, promoteTargetAdmin } from "./mtcuteAdapter"
+import { configDir, strictProfileCredentials } from "./profiles"
+import { PROVISIONING_BOT_ID } from "./provisioning"
+import type {
+  JournalRecord,
+  Member,
+  ProvisionJournal,
+  ProvisionRequest,
+  ProvisioningLinks,
+  TelegramProvisioner,
+} from "./provisioning"
+
+interface PrimaryInvite {
+  link: string
+  isPrimary: boolean
+  isRevoked: boolean
+  isMyLink: boolean
+  endDate: Date | null
+}
+const COMPLETION_LINK_TIMEOUT_MS = 10_000
+
+/** Fetch completion links without creating invitations or sending messages. */
+export async function readProvisioningLinks(
+  chatId: number,
+  reader: {
+    history(
+      signal: AbortSignal,
+    ): Promise<readonly { id: number; chat: { id: number } }[]>
+    primaryInvite(signal: AbortSignal): Promise<PrimaryInvite>
+  },
+  timeoutMs = COMPLETION_LINK_TIMEOUT_MS,
+): Promise<ProvisioningLinks> {
+  // Bot API supergroup IDs encode the channel ID as -(10^12 + channel ID).
+  const channelId = -chatId - 1_000_000_000_000
+  if (!Number.isSafeInteger(chatId) || channelId <= 0) return {}
+  const bounded = async <T>(
+    read: (signal: AbortSignal) => Promise<T>,
+  ): Promise<T> => {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const controller = new AbortController()
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => read(controller.signal)),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            controller.abort()
+            reject(new Error("Completion link read timed out"))
+          }, timeoutMs)
+        }),
+      ])
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+  const [history, invite] = await Promise.allSettled([
+    bounded(reader.history),
+    bounded(reader.primaryInvite),
+  ])
+  const result: ProvisioningLinks = {}
+  if (history.status === "fulfilled") {
+    const message = history.value.find(
+      (value) =>
+        value.chat.id === chatId &&
+        Number.isSafeInteger(value.id) &&
+        value.id > 0 &&
+        value.id <= 2_147_483_647,
+    )
+    if (message) result.openGroupUrl = `https://t.me/c/${channelId}/${message.id}`
+  }
+  if (invite.status === "fulfilled") {
+    const link = invite.value
+    if (
+      link.isPrimary &&
+      link.isMyLink &&
+      !link.isRevoked &&
+      (!link.endDate || link.endDate.getTime() > Date.now()) &&
+      /^https:\/\/t\.me\/(?:\+|joinchat\/)[A-Za-z0-9_-]{5,128}$/.test(link.link)
+    )
+      result.primaryInviteLink = link.link
+  }
+  return result
+}
+
+// Fresh custody sessions do not have access hashes for numeric user IDs yet.
+// Handles discover the peer, but only the pinned numeric ID establishes identity.
+const DEFAULT_MEMBER_HANDLES = new Map<number, string>([
+  [1912700300, "uniquedivine"],
+  [7930936303, "corinnebernett"],
+  [5965882418, "lilnaptime"],
+  [472528179, "erickpinos"],
+])
+
+export async function resolveProvisioningPeer(
+  getUser: (peer: string | number) => Promise<{ id: number; isBot: boolean }>,
+  peer: string | number,
+): Promise<{ id: number; isBot: boolean }> {
+  const normalized = typeof peer === "string" ? peer.replace(/^@/, "") : peer
+  const numeric =
+    typeof normalized === "number"
+      ? normalized
+      : /^[0-9]+$/.test(normalized)
+        ? Number(normalized)
+        : undefined
+  const expectedId =
+    numeric ??
+    [...DEFAULT_MEMBER_HANDLES].find(
+      ([, handle]) => handle.toLowerCase() === String(normalized).toLowerCase(),
+    )?.[0]
+  const lookup =
+    expectedId === undefined
+      ? normalized
+      : (DEFAULT_MEMBER_HANDLES.get(expectedId) ?? expectedId)
+  const user = await getUser(lookup)
+  if (expectedId !== undefined && user.id !== expectedId)
+    throw new Error("Provisioning participant identity mismatch")
+  if (
+    expectedId !== undefined &&
+    DEFAULT_MEMBER_HANDLES.has(expectedId) &&
+    user.isBot
+  )
+    throw new Error("Default provisioning participant must be a user account")
+  return { id: user.id, isBot: user.isBot }
+}
+
+export function normalizeProvisioningMember(
+  value: Pick<ChatMember, "status" | "isMember" | "permissions"> | null,
+): Member {
+  const role =
+    value?.status === "creator"
+      ? "creator"
+      : value?.status === "admin"
+        ? "admin"
+        : value?.isMember
+          ? "member"
+          : "absent"
+  return {
+    role,
+    rights: Object.fromEntries(
+      Object.entries(value?.permissions ?? {}).filter(
+        (entry): entry is [string, boolean] => typeof entry[1] === "boolean",
+      ),
+    ),
+  }
+}
+
+/** Separate files and a process lock prevent account/session crossover. */
+export function accountPaths(
+  root: string,
+  userId: number,
+): { storage: string; lock: string } {
+  if (!Number.isSafeInteger(userId) || userId <= 0)
+    throw new Error("Invalid custody user ID")
+  const base = resolve(root, "provisioning", "accounts", String(userId))
+  return {
+    storage: join(base, "mtcute.session"),
+    lock: join(base, "worker.lock"),
+  }
+}
+export async function withAccountLock<T>(
+  lockPath: string,
+  operation: () => Promise<T>,
+): Promise<T> {
+  if (!isAbsolute(lockPath))
+    throw new Error("Absolute account lock path required")
+  await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 })
+  // The kernel releases flock when this process dies. Persistent lock metadata
+  // never authorizes deleting a live executor's lock or retrying group creation.
+  if (!Bun.which("flock"))
+    throw new Error("Custody worker requires the Linux flock utility")
+  const guard = Bun.spawn(
+    [
+      "flock",
+      "--exclusive",
+      "--nonblock",
+      lockPath,
+      "sh",
+      "-c",
+      "printf 'locked\\n'; cat >/dev/null",
+    ],
+    {
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  )
+  const reader = guard.stdout.getReader()
+  const first = await reader.read()
+  reader.releaseLock()
+  if (first.done || new TextDecoder().decode(first.value).trim() !== "locked") {
+    guard.stdin.end()
+    await guard.exited
+    throw new Error("Custody account is locked; another executor is active")
+  }
+  try {
+    return await operation()
+  } finally {
+    guard.stdin.end()
+    await guard.exited
+  }
+}
+
+export class FileProvisionJournal implements ProvisionJournal {
+  constructor(private root = configDir()) {}
+  private path(requestId: string): string {
+    return join(
+      resolve(this.root),
+      "provisioning",
+      "receipts",
+      `${createHash("sha256").update(requestId).digest("hex")}.json`,
+    )
+  }
+  async read(requestId: string): Promise<JournalRecord | null> {
+    try {
+      return JSON.parse(
+        await readFile(this.path(requestId), "utf8"),
+      ) as JournalRecord
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") return null
+      throw new Error("Cannot read provisioning recovery receipt")
+    }
+  }
+  async write(requestId: string, record: JournalRecord): Promise<void> {
+    const path = this.path(requestId)
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 })
+    const tmp = `${path}.${randomUUID()}.tmp`
+    const file = await open(tmp, "wx", 0o600)
+    try {
+      await file.writeFile(JSON.stringify(record))
+      await file.sync()
+    } finally {
+      await file.close()
+    }
+    await rename(tmp, path)
+    const directory = await open(dirname(path), "r")
+    try {
+      await directory.sync()
+    } finally {
+      await directory.close()
+    }
+  }
+}
+
+export async function withProvisionTelegram<T>(
+  request: ProvisionRequest,
+  operation: (telegram: TelegramProvisioner) => Promise<T>,
+): Promise<T> {
+  const credentials = await strictProfileCredentials(
+    request.custodyProfile,
+    request.expectedUserId,
+  )
+  const paths = accountPaths(configDir(), request.expectedUserId)
+  return withAccountLock(paths.lock, async () => {
+    const client = await createMtcuteClient({
+      apiId: credentials.apiId,
+      apiHash: credentials.apiHash,
+      session: credentials.sessionString,
+      storage: paths.storage,
+    })
+    try {
+      if ((await client.getMe()).id !== request.expectedUserId)
+        throw new Error("Custody account identity mismatch")
+      const bot = await client.getUser(saiBot.handle)
+      if (bot.id !== PROVISIONING_BOT_ID || !bot.isBot)
+        throw new Error("Configured Sai bot identity mismatch")
+      const member = async (
+        chatId: number,
+        userId: number,
+      ): Promise<Member> => {
+        return normalizeProvisioningMember(
+          await getChatMember(client, { chatId, userId }),
+        )
+      }
+      const verifyMarker = async (
+        chatId: number,
+        marker: string,
+      ): Promise<boolean> => {
+        const chat = await client.getFullChat(chatId)
+        return (
+          chat.chatType === "supergroup" &&
+          !chat.isForum &&
+          chat.isCreator &&
+          chat.bio === marker
+        )
+      }
+      const linkClient = (abortSignal: AbortSignal) => client.withParams({
+        abortSignal,
+        timeout: COMPLETION_LINK_TIMEOUT_MS,
+        floodSleepThreshold: 0,
+        maxRetryCount: 0,
+      })
+      const adapter: TelegramProvisioner = {
+        self: async () => (await client.getMe()).id,
+        resolve: (peer) =>
+          resolveProvisioningPeer((value) => client.getUser(value), peer),
+        create: async (title, marker) =>
+          (
+            await createSupergroup(client, {
+              title,
+              description: marker,
+              forum: false,
+            })
+          ).id,
+        member,
+        add: async (chatId, userId) => {
+          const missing = await addChatMembers(client, chatId, userId, {
+            forwardCount: 0,
+          })
+          if (missing.length)
+            throw Object.assign(new Error("Participant privacy restriction"), {
+              text: "USER_PRIVACY_RESTRICTED",
+            })
+        },
+        inviteLink: async (chatId) => {
+          const expires = new Date(Date.now() + 24 * 60 * 60 * 1000)
+          const link = await createInviteLink(client, chatId, {
+            expires,
+            withApproval: true,
+          })
+          if (
+            !link.isMyLink ||
+            link.isRevoked ||
+            !link.approvalNeeded ||
+            !link.endDate
+          ) {
+            throw new Error(
+              "Controlled invitation properties were not confirmed",
+            )
+          }
+          return {
+            inviteLink: link.link,
+            expiresAt: link.endDate.toISOString(),
+          }
+        },
+        completionLinks: (chatId) =>
+          readProvisioningLinks(chatId, {
+            history: (abortSignal) =>
+              linkClient(abortSignal).getHistory(chatId, { limit: 1 }),
+            primaryInvite: (abortSignal) =>
+              getPrimaryInviteLink(linkClient(abortSignal), chatId),
+          }),
+        promote: async (chatId, userId, rights) =>
+          promoteTargetAdmin(client, { chatId, targetPeer: userId, rights }),
+        verifyMarker,
+        candidates: async (marker) => {
+          const candidates: number[] = []
+          for await (const dialog of iterDialogs(client, {
+            limit: 200,
+            archived: "keep",
+          })) {
+            const chat = dialog.peer
+            if (
+              chat.type !== "chat" ||
+              chat.chatType !== "supergroup" ||
+              !chat.isCreator
+            )
+              continue
+            if (await verifyMarker(chat.id, marker)) candidates.push(chat.id)
+          }
+          return candidates
+        },
+      }
+      return await operation(adapter)
+    } finally {
+      await client.disconnect()
+    }
+  })
+}

package/runtimeAssets.d.ts

@@ -0,0 +1,4 @@
+declare module "*.wasm" {
+  const path: string
+  export default path
+}

package/runtimeHealth.ts

@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto"
+import { gzipSync, inflateSync } from "node:zlib"
+import { createTelegramCryptoProvider, verifyRuntimeAssets } from "./telegramRuntime"
+import { createMtcuteClient, createMtcuteRuntimeClient } from "./mtcuteAdapter"
+import { mkdtemp, rm } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { configDir, strictProfileCredentials } from "./profiles"
+import { accountPaths, withAccountLock } from "./provisioningRuntime"
+
+export const HEALTH_CUSTODY_USER_ID = 8274304175
+export interface RuntimeHealthCheck {
+  name: string
+  ok: boolean
+  reason?: string
+}
+export interface RuntimeHealthResult {
+  ok: boolean
+  mode: "offline" | "online"
+  checks: RuntimeHealthCheck[]
+  userId?: number
+}
+export interface RuntimeHealthOptions {
+  online?: boolean
+  custodyProfile?: string
+  timeoutMs?: number
+}
+
+async function bounded<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new Error("Health operation timed out")), timeoutMs)
+      }),
+    ])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** Initialize the same provider passed to TelegramClient, without credentials or I/O to Telegram. */
+export async function checkOfflineTelegramRuntime(): Promise<RuntimeHealthResult> {
+  const checks: RuntimeHealthCheck[] = []
+  try {
+    await verifyRuntimeAssets()
+    const crypto = createTelegramCryptoProvider()
+    await crypto.initialize()
+    checks.push({ name: "telegram_runtime_assets", ok: true })
+    const key = new Uint8Array(32).fill(7)
+    const iv = new Uint8Array(32).fill(3)
+    const input = Uint8Array.from({ length: 32 }, (_, i) => i)
+    const encrypted = crypto.createAesIge(key, iv).encrypt(input)
+    const decrypted = crypto.createAesIge(key, iv).decrypt(encrypted)
+    if (!Buffer.from(decrypted).equals(Buffer.from(input)) ||
+        Buffer.from(encrypted).equals(Buffer.from(input)))
+      throw new Error("Telegram crypto roundtrip failed")
+    const sample = new TextEncoder().encode("tg-sai compiled runtime readiness")
+    if (Buffer.from(crypto.sha256(sample)).toString("hex") !==
+        createHash("sha256").update(sample).digest("hex"))
+      throw new Error("Telegram hash check failed")
+    checks.push({ name: "telegram_crypto", ok: true })
+    const compressed = crypto.gzip(sample, 4096)
+    if (!compressed || !Buffer.from(inflateSync(compressed)).equals(Buffer.from(sample)) ||
+        !Buffer.from(crypto.gunzip(gzipSync(sample))).equals(Buffer.from(sample)))
+      throw new Error("Telegram compression check failed")
+    checks.push({ name: "telegram_compression", ok: true })
+    const directory = await mkdtemp(join(tmpdir(), "tg-sai-runtime-health-"))
+    const client = createMtcuteRuntimeClient({ apiId: 1, apiHash: "0".repeat(32),
+      storage: join(directory, "session") })
+    try {
+      // prepare initializes the real client storage and crypto, without connect/getMe.
+      await client.prepare()
+      checks.push({ name: "telegram_client_prepare", ok: true })
+    } finally {
+      try { await client.destroy() } finally { await rm(directory, { recursive: true, force: true }) }
+    }
+    return { ok: true, mode: "offline", checks }
+  } catch {
+    // Dependency errors can contain paths and imported source. Keep readiness output bounded.
+    checks.push({ name: "telegram_runtime", ok: false, reason: "telegram_runtime_initialization_failed" })
+    return { ok: false, mode: "offline", checks }
+  }
+}
+
+/** Explicit online mode checks only the pinned custody identity under the worker's account lock. */
+export async function checkTelegramRuntimeHealth(
+  options: RuntimeHealthOptions = {},
+): Promise<RuntimeHealthResult> {
+  const offline = await checkOfflineTelegramRuntime()
+  if (!offline.ok || !options.online) return offline
+  const result: RuntimeHealthResult = { ...offline, mode: "online" }
+  if (!options.custodyProfile?.trim()) {
+    result.ok = false
+    result.checks.push({ name: "custody_identity", ok: false, reason: "explicit_custody_profile_required" })
+    return result
+  }
+  const timeoutMs = options.timeoutMs ?? 20000
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1000 || timeoutMs > 60000)
+    throw new Error("Health timeout must be 1000 through 60000ms")
+  try {
+    const credentials = await strictProfileCredentials(options.custodyProfile, HEALTH_CUSTODY_USER_ID)
+    const paths = accountPaths(configDir(), HEALTH_CUSTODY_USER_ID)
+    await withAccountLock(paths.lock, async () => {
+      const client = await createMtcuteClient({ apiId: credentials.apiId,
+        apiHash: credentials.apiHash, session: credentials.sessionString, storage: paths.storage })
+      try {
+        const me = await bounded(client.getMe(), timeoutMs)
+        if (me.id !== HEALTH_CUSTODY_USER_ID || me.isBot)
+          throw new Error("Custody identity mismatch")
+        result.userId = me.id
+      } finally {
+        await bounded(client.destroy(), 10000)
+      }
+    })
+    result.checks.push({ name: "custody_identity", ok: true })
+    return result
+  } catch {
+    result.ok = false
+    result.checks.push({ name: "custody_identity", ok: false,
+      reason: "custody_identity_check_failed_or_account_locked" })
+    return result
+  }
+}

package/runtimeHealthCli.ts

@@ -0,0 +1,46 @@
+import type { Command } from "commander"
+import { checkTelegramRuntimeHealth } from "./runtimeHealth"
+
+export function addRuntimeHealthCommands(program: Command, legacyLocal?: () => Promise<void>): void {
+  const health = program.command("health")
+    .description("Check Telegram runtime readiness; defaults to offline crypto/compression checks")
+    .option("--offline", "Initialize the actual Telegram runtime without credentials or network access")
+    .option("--online", "Also verify custody getMe under the account lock; no Telegram writes")
+    .option("--custody-profile <name>", "Explicit saved custody profile for user 8274304175")
+    .option("--timeout-ms <ms>", "Online identity timeout, 1000 through 60000", "20000")
+    .option("--json", "Print a machine-readable readiness result")
+    .addHelpText("after", `
+Examples:
+  tg-sai health
+  tg-sai health --offline --json
+  tg-sai health --online --custody-profile SaiTeam_AI --json
+
+Offline success proves runtime initialization, not Telegram authentication.
+Online mode checks the custody account only and refuses personal-profile fallback.
+`)
+  if (legacyLocal)
+    health.option("--local", "Run the earlier active-profile and workstation diagnostics, including getMe")
+  health.action(async (options: { offline?: boolean; online?: boolean;
+    custodyProfile?: string; timeoutMs: string; json?: boolean; local?: boolean }) => {
+    if (options.offline && options.online)
+      throw new Error("Choose --offline or --online")
+    if (options.local) {
+      if (options.offline || options.online || options.custodyProfile || options.json)
+        throw new Error("--local cannot be combined with runtime health options")
+      await legacyLocal!()
+      return
+    }
+    if (options.custodyProfile && !options.online)
+      throw new Error("--custody-profile requires explicit --online")
+    const result = await checkTelegramRuntimeHealth({ online: options.online,
+      custodyProfile: options.custodyProfile, timeoutMs: Number(options.timeoutMs) })
+    if (options.json) console.log(JSON.stringify(result))
+    else {
+      console.log(`mode: ${result.mode}`)
+      for (const check of result.checks)
+        console.log(`${check.name}: ${check.ok ? "ok" : check.reason ?? "failed"}`)
+      console.log(`ready: ${result.ok}`)
+    }
+    process.exitCode = result.ok ? 0 : 1
+  })
+}

package/session_string_generator.py

@@ -69,6 +69,11 @@ def _parse_args() -> argparse.Namespace:
     return parser.parse_args()
 
 
+def _is_wrapper_mode(args: argparse.Namespace) -> bool:
+    """Return True when tg-sai is calling this helper internally."""
+    return bool(args.session_output and args.no_env_write)
+
+
 def _render_qr(qr) -> None:
     import qrcode
 
@@ -149,6 +154,7 @@ def _phone_login(client: TelegramClient) -> None:
 
 def main() -> None:
     args = _parse_args()
+    wrapper_mode = _is_wrapper_mode(args)
 
     api_id = os.getenv("TELEGRAM_API_ID")
     api_hash = os.getenv("TELEGRAM_API_HASH")
@@ -164,16 +170,20 @@ def main() -> None:
         print("Error: TELEGRAM_API_ID must be an integer")
         sys.exit(1)
 
-    print("\n----- Telegram Session String Generator -----\n")
-    print("This script will generate a session string for your Telegram account.")
-    print("The generated session string can be added to your tg-sai profile.")
-    print("\nYour credentials are only used for local Telegram authentication.\n")
+    if not wrapper_mode:
+        print("\n----- Telegram Session String Generator -----\n")
+        print("This script will generate a session string for your Telegram account.")
+        print("The generated session string can be added to your tg-sai profile.")
+        print("\nYour credentials are only used for local Telegram authentication.\n")
 
-    label = (
-        input("Account label (optional, e.g. 'work', 'personal'; leave empty for default): ")
-        .strip()
-        .lower()
-    )
+    if wrapper_mode:
+        label = ""
+    else:
+        label = (
+            input("Account label (optional, e.g. 'work', 'personal'; leave empty for default): ")
+            .strip()
+            .lower()
+        )
 
     if args.qr:
         method = "1"
@@ -207,25 +217,27 @@ def main() -> None:
         else:
             env_var = "TELEGRAM_SESSION_STRING"
 
-        print("\nAuthentication successful!")
-        print("\n----- Your Session String -----")
-        print(f"\n{session_string}\n")
-        print("Save this in tg-sai with:")
-        print(
-            "just tg-sai profile add "
-            "--name <name> "
-            f"--api-id {api_id_int} "
-            f"--api-hash {api_hash} "
-            "--session-string '<session string>'"
-        )
-        print("\nOr add this to an .env file as:")
-        print(f"{env_var}={session_string}")
-        print("\nIMPORTANT: Keep this string private and never share it with anyone!")
-
         if args.session_output:
             with open(args.session_output, "w", encoding="utf-8") as file:
                 file.write(f"{session_string}\n")
 
+        if wrapper_mode:
+            print("\nAuthentication successful. Session captured by tg-sai.")
+        else:
+            print("\nAuthentication successful!")
+            print("\n----- Your Session String -----")
+            print(f"\n{session_string}\n")
+            print("Save this in tg-sai with:")
+            print(
+                "tg-sai profile add "
+                f"--api-id {api_id_int} "
+                f"--api-hash {api_hash} "
+                "--session-string '<session string>'"
+            )
+            print("\nOr add this to an .env file as:")
+            print(f"{env_var}={session_string}")
+            print("\nIMPORTANT: Keep this string private and never share it with anyone!")
+
         if args.no_env_write:
             choice = "n"
         else:

package/telegramRuntime.ts

@@ -0,0 +1,25 @@
+import { BunCryptoProvider } from "@mtcute/bun"
+import { initSync, SIMD_AVAILABLE } from "@mtcute/wasm"
+import wasmPath from "@mtcute/wasm/mtcute.wasm" with { type: "file" }
+import simdWasmPath from "@mtcute/wasm/mtcute-simd.wasm" with { type: "file" }
+
+/** Static file imports make Bun embed both lazily loaded dependency assets. */
+export class EmbeddedTelegramCryptoProvider extends BunCryptoProvider {
+  override async initialize(): Promise<void> {
+    const bytes = await Bun.file(SIMD_AVAILABLE ? simdWasmPath : wasmPath).arrayBuffer()
+    initSync(bytes)
+  }
+}
+
+/** The client and readiness check must use this same concrete provider. */
+export function createTelegramCryptoProvider(): EmbeddedTelegramCryptoProvider {
+  return new EmbeddedTelegramCryptoProvider()
+}
+
+export async function verifyRuntimeAssets(): Promise<void> {
+  // Read both files so missing fallback assets fail even on a SIMD-capable host.
+  for (const path of [wasmPath, simdWasmPath]) {
+    const bytes = await Bun.file(path).arrayBuffer()
+    if (!bytes.byteLength) throw new Error("Empty Telegram runtime asset")
+  }
+}