matrix-bot-sdk

This is a fork, published as @jeongsu816/matrix-bot-sdk. It is based on upstream turt2live/matrix-bot-sdk main and adds:

• Cross-signing, secret storage (4S) and key backup from upstream PR #396, exposed as public CryptoClient methods.
• Idempotent startup helpers: client.crypto.ensureCrossSigning() and client.crypto.ensureSecretStorage().
• @matrix-org/matrix-sdk-crypto-nodejs pinned to 0.6.1 (required for 4S).
• Dependency security fixes: request replaced by @cypress/request, sanitize-html ≥ 2.18.1. Requires Node.js ≥ 22.12.

import { passwordUiaCallback } from "@jeongsu816/matrix-bot-sdk";

// "already-signed" | "restored" | "bootstrapped" | "skipped-no-auth"
const result = await client.crypto.ensureCrossSigning({
    uiaCallback: password ? passwordUiaCallback(userId, password) : undefined,
    recoveryPassphrase,
});
if (recoveryPassphrase) {
    await client.crypto.ensureSecretStorage(recoveryPassphrase); // also sets up key backup
}

ensureCrossSigning creates a new identity (replacing the account's existing cross-signing keys) only when this device is not signed and the keys can't be restored from secret storage. Errors are thrown, so wrap it if cross-signing should not be fatal for your bot.

The rest of this README is from upstream.

TypeScript/JavaScript SDK for Matrix bots. For help and support, visit #matrix-bot-sdk:t2bot.io

Documentation

Documentation for the project is available here.

Matrix version support

The Matrix protocol is versioned to ensure endpoints and functionality can safely rotate in and out of the ecosystem. The bot-sdk will assume it is connected to a homeserver with support for at least one of the last 2 versions, at the time of the bot-sdk's release. This means that if you connect the bot-sdk to a homeserver which is 3 or more Matrix versions out of date, things might not work for you.

It is recommended to update the bot-sdk as frequently as spec releases themselves (or faster) to avoid this situation, and watch the repo for updates in the event a release is delayed.

Note: Currently the bot-sdk does not throw an error if the server appears to be incompatible, however this might change in the future.