@archipelagolab/lobi 1.0.1 → 1.0.6

package/dist/chunk-ERXO3674.js

@@ -0,0 +1,54 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/matrix/sdk/idb-persistence-lock.ts
+init_shims();
+var MATRIX_IDB_PERSIST_INTERVAL_MS = 6e4;
+var IDB_SNAPSHOT_LOCK_STALE_MS = 5 * 6e4;
+var IDB_SNAPSHOT_LOCK_RETRY_BASE = {
+  factor: 2,
+  minTimeout: 50,
+  maxTimeout: 5e3,
+  randomize: true
+};
+function computeRetryDelayMs(retries, attempt) {
+  return Math.min(
+    retries.maxTimeout,
+    Math.max(retries.minTimeout, retries.minTimeout * retries.factor ** attempt)
+  );
+}
+function computeMinimumRetryWindowMs(retries) {
+  let total = 0;
+  const attempts = Math.max(1, retries.retries + 1);
+  for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
+    total += computeRetryDelayMs(retries, attempt);
+  }
+  return total;
+}
+function resolveRetriesForMinimumWindowMs(retries, minimumWindowMs) {
+  const resolved = {
+    ...retries,
+    retries: 0
+  };
+  while (computeMinimumRetryWindowMs(resolved) < minimumWindowMs) {
+    resolved.retries += 1;
+  }
+  return resolved;
+}
+var MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS = {
+  // Wait longer than one periodic persist interval so a concurrent restore
+  // or large snapshot dump finishes instead of forcing warn-and-continue.
+  retries: resolveRetriesForMinimumWindowMs(
+    IDB_SNAPSHOT_LOCK_RETRY_BASE,
+    MATRIX_IDB_PERSIST_INTERVAL_MS
+  ),
+  stale: IDB_SNAPSHOT_LOCK_STALE_MS
+};
+
+export {
+  MATRIX_IDB_PERSIST_INTERVAL_MS,
+  computeMinimumRetryWindowMs,
+  MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS
+};
+//# sourceMappingURL=chunk-ERXO3674.js.map

package/dist/chunk-ERXO3674.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/sdk/idb-persistence-lock.ts"],
+  "sourcesContent": ["import type { FileLockOptions } from \"openclaw/plugin-sdk/infra-runtime\";\n\nexport const MATRIX_IDB_PERSIST_INTERVAL_MS = 60_000;\n\nconst IDB_SNAPSHOT_LOCK_STALE_MS = 5 * 60_000;\nconst IDB_SNAPSHOT_LOCK_RETRY_BASE = {\n  factor: 2,\n  minTimeout: 50,\n  maxTimeout: 5_000,\n  randomize: true,\n} satisfies Omit<FileLockOptions[\"retries\"], \"retries\">;\n\nfunction computeRetryDelayMs(retries: FileLockOptions[\"retries\"], attempt: number): number {\n  return Math.min(\n    retries.maxTimeout,\n    Math.max(retries.minTimeout, retries.minTimeout * retries.factor ** attempt),\n  );\n}\n\nexport function computeMinimumRetryWindowMs(retries: FileLockOptions[\"retries\"]): number {\n  let total = 0;\n  const attempts = Math.max(1, retries.retries + 1);\n  for (let attempt = 0; attempt < attempts - 1; attempt += 1) {\n    total += computeRetryDelayMs(retries, attempt);\n  }\n  return total;\n}\n\nfunction resolveRetriesForMinimumWindowMs(\n  retries: Omit<FileLockOptions[\"retries\"], \"retries\">,\n  minimumWindowMs: number,\n): FileLockOptions[\"retries\"] {\n  const resolved: FileLockOptions[\"retries\"] = {\n    ...retries,\n    retries: 0,\n  };\n  while (computeMinimumRetryWindowMs(resolved) < minimumWindowMs) {\n    resolved.retries += 1;\n  }\n  return resolved;\n}\n\nexport const MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS: FileLockOptions = {\n  // Wait longer than one periodic persist interval so a concurrent restore\n  // or large snapshot dump finishes instead of forcing warn-and-continue.\n  retries: resolveRetriesForMinimumWindowMs(\n    IDB_SNAPSHOT_LOCK_RETRY_BASE,\n    MATRIX_IDB_PERSIST_INTERVAL_MS,\n  ),\n  stale: IDB_SNAPSHOT_LOCK_STALE_MS,\n};\n"],
+  "mappings": ";;;;;AAAA;AAEO,IAAM,iCAAiC;AAE9C,IAAM,6BAA6B,IAAI;AACvC,IAAM,+BAA+B;AAAA,EACnC,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AACb;AAEA,SAAS,oBAAoB,SAAqC,SAAyB;AACzF,SAAO,KAAK;AAAA,IACV,QAAQ;AAAA,IACR,KAAK,IAAI,QAAQ,YAAY,QAAQ,aAAa,QAAQ,UAAU,OAAO;AAAA,EAC7E;AACF;AAEO,SAAS,4BAA4B,SAA6C;AACvF,MAAI,QAAQ;AACZ,QAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,UAAU,CAAC;AAChD,WAAS,UAAU,GAAG,UAAU,WAAW,GAAG,WAAW,GAAG;AAC1D,aAAS,oBAAoB,SAAS,OAAO;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,iCACP,SACA,iBAC4B;AAC5B,QAAM,WAAuC;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS;AAAA,EACX;AACA,SAAO,4BAA4B,QAAQ,IAAI,iBAAiB;AAC9D,aAAS,WAAW;AAAA,EACtB;AACA,SAAO;AACT;AAEO,IAAM,mCAAoD;AAAA;AAAA;AAAA,EAG/D,SAAS;AAAA,IACP;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AACT;",
+  "names": []
+}

package/dist/chunk-EVFWZGFL.js

@@ -0,0 +1,235 @@
+import {
+  getMatrixApprovalAuthApprovers
+} from "./chunk-E5HPDHCW.js";
+import {
+  normalizeMatrixApproverId
+} from "./chunk-LVMK2GPM.js";
+import {
+  listMatrixAccountIds,
+  resolveMatrixAccount
+} from "./chunk-MIFIM4PI.js";
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/exec-approvals.ts
+init_shims();
+import { resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
+import {
+  createChannelExecApprovalProfile,
+  getExecApprovalReplyMetadata,
+  isChannelExecApprovalClientEnabledFromConfig,
+  isChannelExecApprovalTargetRecipient,
+  matchesApprovalRequestFilters
+} from "openclaw/plugin-sdk/approval-client-runtime";
+import { resolveApprovalRequestChannelAccountId } from "openclaw/plugin-sdk/approval-native-runtime";
+import { normalizeAccountId } from "openclaw/plugin-sdk/routing";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
+function normalizeMatrixExecApproverId(value) {
+  const normalized = normalizeMatrixApproverId(value);
+  return normalized === "*" ? void 0 : normalized;
+}
+function resolveMatrixExecApprovalConfig(params) {
+  const account = resolveMatrixAccount(params);
+  const config = account.config.execApprovals;
+  if (!config) {
+    return void 0;
+  }
+  return {
+    ...config,
+    enabled: account.enabled && account.configured ? config.enabled : false
+  };
+}
+function countMatrixExecApprovalEligibleAccounts(params) {
+  return listMatrixAccountIds(params.cfg).filter((accountId) => {
+    const account = resolveMatrixAccount({ cfg: params.cfg, accountId });
+    if (!account.enabled || !account.configured) {
+      return false;
+    }
+    const config = resolveMatrixExecApprovalConfig({
+      cfg: params.cfg,
+      accountId
+    });
+    const filters = config?.enabled ? {
+      agentFilter: config.agentFilter,
+      sessionFilter: config.sessionFilter
+    } : {
+      agentFilter: void 0,
+      sessionFilter: void 0
+    };
+    return isChannelExecApprovalClientEnabledFromConfig({
+      enabled: config?.enabled,
+      approverCount: getMatrixApprovalApprovers({
+        cfg: params.cfg,
+        accountId,
+        approvalKind: params.approvalKind
+      }).length
+    }) && matchesApprovalRequestFilters({
+      request: params.request.request,
+      agentFilter: filters.agentFilter,
+      sessionFilter: filters.sessionFilter
+    });
+  }).length;
+}
+function matchesMatrixRequestAccount(params) {
+  const turnSourceChannel = normalizeLowercaseStringOrEmpty(
+    params.request.request.turnSourceChannel
+  );
+  const boundAccountId = resolveApprovalRequestChannelAccountId({
+    cfg: params.cfg,
+    request: params.request,
+    channel: "matrix"
+  });
+  if (turnSourceChannel && turnSourceChannel !== "matrix" && !boundAccountId) {
+    return countMatrixExecApprovalEligibleAccounts({
+      cfg: params.cfg,
+      request: params.request,
+      approvalKind: params.approvalKind
+    }) <= 1;
+  }
+  return !boundAccountId || !params.accountId || normalizeAccountId(boundAccountId) === normalizeAccountId(params.accountId);
+}
+function getMatrixExecApprovalApprovers(params) {
+  const account = resolveMatrixAccount(params).config;
+  return resolveApprovalApprovers({
+    explicit: account.execApprovals?.approvers,
+    allowFrom: account.dm?.allowFrom,
+    normalizeApprover: normalizeMatrixExecApproverId
+  });
+}
+function resolveMatrixApprovalKind(request) {
+  return request.id.startsWith("plugin:") ? "plugin" : "exec";
+}
+function getMatrixApprovalApprovers(params) {
+  if (params.approvalKind === "plugin") {
+    return getMatrixApprovalAuthApprovers({
+      cfg: params.cfg,
+      accountId: params.accountId
+    });
+  }
+  return getMatrixExecApprovalApprovers(params);
+}
+function isMatrixExecApprovalTargetRecipient(params) {
+  return isChannelExecApprovalTargetRecipient({
+    ...params,
+    channel: "matrix",
+    normalizeSenderId: normalizeMatrixApproverId,
+    matchTarget: ({ target, normalizedSenderId }) => normalizeMatrixApproverId(target.to) === normalizedSenderId
+  });
+}
+var matrixExecApprovalProfile = createChannelExecApprovalProfile({
+  resolveConfig: resolveMatrixExecApprovalConfig,
+  resolveApprovers: getMatrixExecApprovalApprovers,
+  normalizeSenderId: normalizeMatrixApproverId,
+  isTargetRecipient: isMatrixExecApprovalTargetRecipient,
+  matchesRequestAccount: (params) => matchesMatrixRequestAccount({
+    ...params,
+    approvalKind: "exec"
+  })
+});
+var isMatrixExecApprovalClientEnabled = matrixExecApprovalProfile.isClientEnabled;
+var isMatrixExecApprovalApprover = matrixExecApprovalProfile.isApprover;
+var isMatrixExecApprovalAuthorizedSender = matrixExecApprovalProfile.isAuthorizedSender;
+var resolveMatrixExecApprovalTarget = matrixExecApprovalProfile.resolveTarget;
+var shouldHandleMatrixExecApprovalRequest = matrixExecApprovalProfile.shouldHandleRequest;
+function isMatrixApprovalClientEnabled(params) {
+  if (params.approvalKind === "exec") {
+    return isMatrixExecApprovalClientEnabled(params);
+  }
+  const config = resolveMatrixExecApprovalConfig(params);
+  return isChannelExecApprovalClientEnabledFromConfig({
+    enabled: config?.enabled,
+    approverCount: getMatrixApprovalApprovers(params).length
+  });
+}
+function isMatrixAnyApprovalClientEnabled(params) {
+  return isMatrixApprovalClientEnabled({
+    ...params,
+    approvalKind: "exec"
+  }) || isMatrixApprovalClientEnabled({
+    ...params,
+    approvalKind: "plugin"
+  });
+}
+function shouldHandleMatrixApprovalRequest(params) {
+  const approvalKind = resolveMatrixApprovalKind(params.request);
+  if (!matchesMatrixRequestAccount({
+    ...params,
+    approvalKind
+  })) {
+    return false;
+  }
+  const config = resolveMatrixExecApprovalConfig(params);
+  if (!isChannelExecApprovalClientEnabledFromConfig({
+    enabled: config?.enabled,
+    approverCount: getMatrixApprovalApprovers({
+      ...params,
+      approvalKind
+    }).length
+  })) {
+    return false;
+  }
+  return matchesApprovalRequestFilters({
+    request: params.request.request,
+    agentFilter: config?.agentFilter,
+    sessionFilter: config?.sessionFilter
+  });
+}
+function buildFilterCheckRequest(params) {
+  if (params.metadata.approvalKind === "plugin") {
+    return {
+      id: params.metadata.approvalId,
+      request: {
+        title: "Plugin Approval Required",
+        description: "",
+        agentId: params.metadata.agentId ?? null,
+        sessionKey: params.metadata.sessionKey ?? null
+      },
+      createdAtMs: 0,
+      expiresAtMs: 0
+    };
+  }
+  return {
+    id: params.metadata.approvalId,
+    request: {
+      command: "",
+      agentId: params.metadata.agentId ?? null,
+      sessionKey: params.metadata.sessionKey ?? null
+    },
+    createdAtMs: 0,
+    expiresAtMs: 0
+  };
+}
+function shouldSuppressLocalMatrixExecApprovalPrompt(params) {
+  if (!matrixExecApprovalProfile.shouldSuppressLocalPrompt(params)) {
+    return false;
+  }
+  const metadata = getExecApprovalReplyMetadata(params.payload);
+  if (!metadata) {
+    return false;
+  }
+  const request = buildFilterCheckRequest({
+    metadata
+  });
+  return shouldHandleMatrixApprovalRequest({
+    cfg: params.cfg,
+    accountId: params.accountId,
+    request
+  });
+}
+
+export {
+  getMatrixExecApprovalApprovers,
+  getMatrixApprovalApprovers,
+  isMatrixExecApprovalTargetRecipient,
+  isMatrixExecApprovalClientEnabled,
+  isMatrixExecApprovalApprover,
+  isMatrixExecApprovalAuthorizedSender,
+  resolveMatrixExecApprovalTarget,
+  shouldHandleMatrixExecApprovalRequest,
+  isMatrixApprovalClientEnabled,
+  isMatrixAnyApprovalClientEnabled,
+  shouldHandleMatrixApprovalRequest,
+  shouldSuppressLocalMatrixExecApprovalPrompt
+};
+//# sourceMappingURL=chunk-EVFWZGFL.js.map

package/dist/chunk-EVFWZGFL.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/exec-approvals.ts"],
+  "sourcesContent": ["import { resolveApprovalApprovers } from \"openclaw/plugin-sdk/approval-auth-runtime\";\nimport {\n  createChannelExecApprovalProfile,\n  getExecApprovalReplyMetadata,\n  isChannelExecApprovalClientEnabledFromConfig,\n  isChannelExecApprovalTargetRecipient,\n  matchesApprovalRequestFilters,\n} from \"openclaw/plugin-sdk/approval-client-runtime\";\nimport { resolveApprovalRequestChannelAccountId } from \"openclaw/plugin-sdk/approval-native-runtime\";\nimport type { OpenClawConfig } from \"openclaw/plugin-sdk/config-runtime\";\nimport type { ExecApprovalRequest, PluginApprovalRequest } from \"openclaw/plugin-sdk/infra-runtime\";\nimport type { ReplyPayload } from \"openclaw/plugin-sdk/reply-runtime\";\nimport { normalizeAccountId } from \"openclaw/plugin-sdk/routing\";\nimport { normalizeLowercaseStringOrEmpty } from \"openclaw/plugin-sdk/text-runtime\";\nimport { getMatrixApprovalAuthApprovers } from \"./approval-auth.js\";\nimport { normalizeMatrixApproverId } from \"./approval-ids.js\";\nimport { listMatrixAccountIds, resolveMatrixAccount } from \"./matrix/accounts.js\";\nimport type { CoreConfig } from \"./types.js\";\n\ntype ApprovalRequest = ExecApprovalRequest | PluginApprovalRequest;\ntype ApprovalKind = \"exec\" | \"plugin\";\n\nexport { normalizeMatrixApproverId };\n\nfunction normalizeMatrixExecApproverId(value: string | number): string | undefined {\n  const normalized = normalizeMatrixApproverId(value);\n  return normalized === \"*\" ? undefined : normalized;\n}\n\nfunction resolveMatrixExecApprovalConfig(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n}) {\n  const account = resolveMatrixAccount(params);\n  const config = account.config.execApprovals;\n  if (!config) {\n    return undefined;\n  }\n  return {\n    ...config,\n    enabled: account.enabled && account.configured ? config.enabled : false,\n  };\n}\n\nfunction countMatrixExecApprovalEligibleAccounts(params: {\n  cfg: OpenClawConfig;\n  request: ApprovalRequest;\n  approvalKind: ApprovalKind;\n}): number {\n  return listMatrixAccountIds(params.cfg).filter((accountId) => {\n    const account = resolveMatrixAccount({ cfg: params.cfg, accountId });\n    if (!account.enabled || !account.configured) {\n      return false;\n    }\n    const config = resolveMatrixExecApprovalConfig({\n      cfg: params.cfg,\n      accountId,\n    });\n    const filters = config?.enabled\n      ? {\n          agentFilter: config.agentFilter,\n          sessionFilter: config.sessionFilter,\n        }\n      : {\n          agentFilter: undefined,\n          sessionFilter: undefined,\n        };\n    return (\n      isChannelExecApprovalClientEnabledFromConfig({\n        enabled: config?.enabled,\n        approverCount: getMatrixApprovalApprovers({\n          cfg: params.cfg,\n          accountId,\n          approvalKind: params.approvalKind,\n        }).length,\n      }) &&\n      matchesApprovalRequestFilters({\n        request: params.request.request,\n        agentFilter: filters.agentFilter,\n        sessionFilter: filters.sessionFilter,\n      })\n    );\n  }).length;\n}\n\nfunction matchesMatrixRequestAccount(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n  request: ApprovalRequest;\n  approvalKind: ApprovalKind;\n}): boolean {\n  const turnSourceChannel = normalizeLowercaseStringOrEmpty(\n    params.request.request.turnSourceChannel,\n  );\n  const boundAccountId = resolveApprovalRequestChannelAccountId({\n    cfg: params.cfg,\n    request: params.request,\n    channel: \"matrix\",\n  });\n  if (turnSourceChannel && turnSourceChannel !== \"matrix\" && !boundAccountId) {\n    return (\n      countMatrixExecApprovalEligibleAccounts({\n        cfg: params.cfg,\n        request: params.request,\n        approvalKind: params.approvalKind,\n      }) <= 1\n    );\n  }\n  return (\n    !boundAccountId ||\n    !params.accountId ||\n    normalizeAccountId(boundAccountId) === normalizeAccountId(params.accountId)\n  );\n}\n\nexport function getMatrixExecApprovalApprovers(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n}): string[] {\n  const account = resolveMatrixAccount(params).config;\n  return resolveApprovalApprovers({\n    explicit: account.execApprovals?.approvers,\n    allowFrom: account.dm?.allowFrom,\n    normalizeApprover: normalizeMatrixExecApproverId,\n  });\n}\n\nfunction resolveMatrixApprovalKind(request: ApprovalRequest): ApprovalKind {\n  return request.id.startsWith(\"plugin:\") ? \"plugin\" : \"exec\";\n}\n\nexport function getMatrixApprovalApprovers(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n  approvalKind: ApprovalKind;\n}): string[] {\n  if (params.approvalKind === \"plugin\") {\n    return getMatrixApprovalAuthApprovers({\n      cfg: params.cfg as CoreConfig,\n      accountId: params.accountId,\n    });\n  }\n  return getMatrixExecApprovalApprovers(params);\n}\n\nexport function isMatrixExecApprovalTargetRecipient(params: {\n  cfg: OpenClawConfig;\n  senderId?: string | null;\n  accountId?: string | null;\n}): boolean {\n  return isChannelExecApprovalTargetRecipient({\n    ...params,\n    channel: \"matrix\",\n    normalizeSenderId: normalizeMatrixApproverId,\n    matchTarget: ({ target, normalizedSenderId }) =>\n      normalizeMatrixApproverId(target.to) === normalizedSenderId,\n  });\n}\n\nconst matrixExecApprovalProfile = createChannelExecApprovalProfile({\n  resolveConfig: resolveMatrixExecApprovalConfig,\n  resolveApprovers: getMatrixExecApprovalApprovers,\n  normalizeSenderId: normalizeMatrixApproverId,\n  isTargetRecipient: isMatrixExecApprovalTargetRecipient,\n  matchesRequestAccount: (params) =>\n    matchesMatrixRequestAccount({\n      ...params,\n      approvalKind: \"exec\",\n    }),\n});\n\nexport const isMatrixExecApprovalClientEnabled = matrixExecApprovalProfile.isClientEnabled;\nexport const isMatrixExecApprovalApprover = matrixExecApprovalProfile.isApprover;\nexport const isMatrixExecApprovalAuthorizedSender = matrixExecApprovalProfile.isAuthorizedSender;\nexport const resolveMatrixExecApprovalTarget = matrixExecApprovalProfile.resolveTarget;\nexport const shouldHandleMatrixExecApprovalRequest = matrixExecApprovalProfile.shouldHandleRequest;\n\nexport function isMatrixApprovalClientEnabled(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n  approvalKind: ApprovalKind;\n}): boolean {\n  if (params.approvalKind === \"exec\") {\n    return isMatrixExecApprovalClientEnabled(params);\n  }\n  const config = resolveMatrixExecApprovalConfig(params);\n  return isChannelExecApprovalClientEnabledFromConfig({\n    enabled: config?.enabled,\n    approverCount: getMatrixApprovalApprovers(params).length,\n  });\n}\n\nexport function isMatrixAnyApprovalClientEnabled(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n}): boolean {\n  return (\n    isMatrixApprovalClientEnabled({\n      ...params,\n      approvalKind: \"exec\",\n    }) ||\n    isMatrixApprovalClientEnabled({\n      ...params,\n      approvalKind: \"plugin\",\n    })\n  );\n}\n\nexport function shouldHandleMatrixApprovalRequest(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n  request: ApprovalRequest;\n}): boolean {\n  const approvalKind = resolveMatrixApprovalKind(params.request);\n  if (\n    !matchesMatrixRequestAccount({\n      ...params,\n      approvalKind,\n    })\n  ) {\n    return false;\n  }\n  const config = resolveMatrixExecApprovalConfig(params);\n  if (\n    !isChannelExecApprovalClientEnabledFromConfig({\n      enabled: config?.enabled,\n      approverCount: getMatrixApprovalApprovers({\n        ...params,\n        approvalKind,\n      }).length,\n    })\n  ) {\n    return false;\n  }\n  return matchesApprovalRequestFilters({\n    request: params.request.request,\n    agentFilter: config?.agentFilter,\n    sessionFilter: config?.sessionFilter,\n  });\n}\n\nfunction buildFilterCheckRequest(params: {\n  metadata: NonNullable<ReturnType<typeof getExecApprovalReplyMetadata>>;\n}): ApprovalRequest {\n  if (params.metadata.approvalKind === \"plugin\") {\n    return {\n      id: params.metadata.approvalId,\n      request: {\n        title: \"Plugin Approval Required\",\n        description: \"\",\n        agentId: params.metadata.agentId ?? null,\n        sessionKey: params.metadata.sessionKey ?? null,\n      },\n      createdAtMs: 0,\n      expiresAtMs: 0,\n    };\n  }\n  return {\n    id: params.metadata.approvalId,\n    request: {\n      command: \"\",\n      agentId: params.metadata.agentId ?? null,\n      sessionKey: params.metadata.sessionKey ?? null,\n    },\n    createdAtMs: 0,\n    expiresAtMs: 0,\n  };\n}\n\nexport function shouldSuppressLocalMatrixExecApprovalPrompt(params: {\n  cfg: OpenClawConfig;\n  accountId?: string | null;\n  payload: ReplyPayload;\n}): boolean {\n  if (!matrixExecApprovalProfile.shouldSuppressLocalPrompt(params)) {\n    return false;\n  }\n  const metadata = getExecApprovalReplyMetadata(params.payload);\n  if (!metadata) {\n    return false;\n  }\n  const request = buildFilterCheckRequest({\n    metadata,\n  });\n  return shouldHandleMatrixApprovalRequest({\n    cfg: params.cfg,\n    accountId: params.accountId,\n    request,\n  });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;AAAA;AAAA,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8CAA8C;AAIvD,SAAS,0BAA0B;AACnC,SAAS,uCAAuC;AAWhD,SAAS,8BAA8B,OAA4C;AACjF,QAAM,aAAa,0BAA0B,KAAK;AAClD,SAAO,eAAe,MAAM,SAAY;AAC1C;AAEA,SAAS,gCAAgC,QAGtC;AACD,QAAM,UAAU,qBAAqB,MAAM;AAC3C,QAAM,SAAS,QAAQ,OAAO;AAC9B,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,QAAQ,WAAW,QAAQ,aAAa,OAAO,UAAU;AAAA,EACpE;AACF;AAEA,SAAS,wCAAwC,QAItC;AACT,SAAO,qBAAqB,OAAO,GAAG,EAAE,OAAO,CAAC,cAAc;AAC5D,UAAM,UAAU,qBAAqB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC;AACnE,QAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,YAAY;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,SAAS,gCAAgC;AAAA,MAC7C,KAAK,OAAO;AAAA,MACZ;AAAA,IACF,CAAC;AACD,UAAM,UAAU,QAAQ,UACpB;AAAA,MACE,aAAa,OAAO;AAAA,MACpB,eAAe,OAAO;AAAA,IACxB,IACA;AAAA,MACE,aAAa;AAAA,MACb,eAAe;AAAA,IACjB;AACJ,WACE,6CAA6C;AAAA,MAC3C,SAAS,QAAQ;AAAA,MACjB,eAAe,2BAA2B;AAAA,QACxC,KAAK,OAAO;AAAA,QACZ;AAAA,QACA,cAAc,OAAO;AAAA,MACvB,CAAC,EAAE;AAAA,IACL,CAAC,KACD,8BAA8B;AAAA,MAC5B,SAAS,OAAO,QAAQ;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,eAAe,QAAQ;AAAA,IACzB,CAAC;AAAA,EAEL,CAAC,EAAE;AACL;AAEA,SAAS,4BAA4B,QAKzB;AACV,QAAM,oBAAoB;AAAA,IACxB,OAAO,QAAQ,QAAQ;AAAA,EACzB;AACA,QAAM,iBAAiB,uCAAuC;AAAA,IAC5D,KAAK,OAAO;AAAA,IACZ,SAAS,OAAO;AAAA,IAChB,SAAS;AAAA,EACX,CAAC;AACD,MAAI,qBAAqB,sBAAsB,YAAY,CAAC,gBAAgB;AAC1E,WACE,wCAAwC;AAAA,MACtC,KAAK,OAAO;AAAA,MACZ,SAAS,OAAO;AAAA,MAChB,cAAc,OAAO;AAAA,IACvB,CAAC,KAAK;AAAA,EAEV;AACA,SACE,CAAC,kBACD,CAAC,OAAO,aACR,mBAAmB,cAAc,MAAM,mBAAmB,OAAO,SAAS;AAE9E;AAEO,SAAS,+BAA+B,QAGlC;AACX,QAAM,UAAU,qBAAqB,MAAM,EAAE;AAC7C,SAAO,yBAAyB;AAAA,IAC9B,UAAU,QAAQ,eAAe;AAAA,IACjC,WAAW,QAAQ,IAAI;AAAA,IACvB,mBAAmB;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,0BAA0B,SAAwC;AACzE,SAAO,QAAQ,GAAG,WAAW,SAAS,IAAI,WAAW;AACvD;AAEO,SAAS,2BAA2B,QAI9B;AACX,MAAI,OAAO,iBAAiB,UAAU;AACpC,WAAO,+BAA+B;AAAA,MACpC,KAAK,OAAO;AAAA,MACZ,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,+BAA+B,MAAM;AAC9C;AAEO,SAAS,oCAAoC,QAIxC;AACV,SAAO,qCAAqC;AAAA,IAC1C,GAAG;AAAA,IACH,SAAS;AAAA,IACT,mBAAmB;AAAA,IACnB,aAAa,CAAC,EAAE,QAAQ,mBAAmB,MACzC,0BAA0B,OAAO,EAAE,MAAM;AAAA,EAC7C,CAAC;AACH;AAEA,IAAM,4BAA4B,iCAAiC;AAAA,EACjE,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,uBAAuB,CAAC,WACtB,4BAA4B;AAAA,IAC1B,GAAG;AAAA,IACH,cAAc;AAAA,EAChB,CAAC;AACL,CAAC;AAEM,IAAM,oCAAoC,0BAA0B;AACpE,IAAM,+BAA+B,0BAA0B;AAC/D,IAAM,uCAAuC,0BAA0B;AACvE,IAAM,kCAAkC,0BAA0B;AAClE,IAAM,wCAAwC,0BAA0B;AAExE,SAAS,8BAA8B,QAIlC;AACV,MAAI,OAAO,iBAAiB,QAAQ;AAClC,WAAO,kCAAkC,MAAM;AAAA,EACjD;AACA,QAAM,SAAS,gCAAgC,MAAM;AACrD,SAAO,6CAA6C;AAAA,IAClD,SAAS,QAAQ;AAAA,IACjB,eAAe,2BAA2B,MAAM,EAAE;AAAA,EACpD,CAAC;AACH;AAEO,SAAS,iCAAiC,QAGrC;AACV,SACE,8BAA8B;AAAA,IAC5B,GAAG;AAAA,IACH,cAAc;AAAA,EAChB,CAAC,KACD,8BAA8B;AAAA,IAC5B,GAAG;AAAA,IACH,cAAc;AAAA,EAChB,CAAC;AAEL;AAEO,SAAS,kCAAkC,QAItC;AACV,QAAM,eAAe,0BAA0B,OAAO,OAAO;AAC7D,MACE,CAAC,4BAA4B;AAAA,IAC3B,GAAG;AAAA,IACH;AAAA,EACF,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,gCAAgC,MAAM;AACrD,MACE,CAAC,6CAA6C;AAAA,IAC5C,SAAS,QAAQ;AAAA,IACjB,eAAe,2BAA2B;AAAA,MACxC,GAAG;AAAA,MACH;AAAA,IACF,CAAC,EAAE;AAAA,EACL,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,SAAO,8BAA8B;AAAA,IACnC,SAAS,OAAO,QAAQ;AAAA,IACxB,aAAa,QAAQ;AAAA,IACrB,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEA,SAAS,wBAAwB,QAEb;AAClB,MAAI,OAAO,SAAS,iBAAiB,UAAU;AAC7C,WAAO;AAAA,MACL,IAAI,OAAO,SAAS;AAAA,MACpB,SAAS;AAAA,QACP,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS,OAAO,SAAS,WAAW;AAAA,QACpC,YAAY,OAAO,SAAS,cAAc;AAAA,MAC5C;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,OAAO,SAAS;AAAA,IACpB,SAAS;AAAA,MACP,SAAS;AAAA,MACT,SAAS,OAAO,SAAS,WAAW;AAAA,MACpC,YAAY,OAAO,SAAS,cAAc;AAAA,IAC5C;AAAA,IACA,aAAa;AAAA,IACb,aAAa;AAAA,EACf;AACF;AAEO,SAAS,4CAA4C,QAIhD;AACV,MAAI,CAAC,0BAA0B,0BAA0B,MAAM,GAAG;AAChE,WAAO;AAAA,EACT;AACA,QAAM,WAAW,6BAA6B,OAAO,OAAO;AAC5D,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,QAAM,UAAU,wBAAwB;AAAA,IACtC;AAAA,EACF,CAAC;AACD,SAAO,kCAAkC;AAAA,IACvC,KAAK,OAAO;AAAA,IACZ,WAAW,OAAO;AAAA,IAClB;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/chunk-EVPBRKMZ.js

@@ -0,0 +1,45 @@
+import {
+  summarizeMatrixDeviceHealth
+} from "./chunk-2Q626TDO.js";
+import {
+  withStartedActionClient
+} from "./chunk-REVXXWAS.js";
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/matrix/actions/devices.ts
+init_shims();
+async function listMatrixOwnDevices(opts = {}) {
+  return await withStartedActionClient(opts, async (client) => await client.listOwnDevices());
+}
+async function pruneMatrixStaleGatewayDevices(opts = {}) {
+  return await withStartedActionClient(opts, async (client) => {
+    const devices = await client.listOwnDevices();
+    const health = summarizeMatrixDeviceHealth(devices);
+    const staleGatewayDeviceIds = health.staleOpenClawDevices.map((device) => device.deviceId);
+    const deleted = staleGatewayDeviceIds.length > 0 ? await client.deleteOwnDevices(staleGatewayDeviceIds) : {
+      currentDeviceId: devices.find((device) => device.current)?.deviceId ?? null,
+      deletedDeviceIds: [],
+      remainingDevices: devices
+    };
+    return {
+      before: devices,
+      staleGatewayDeviceIds,
+      ...deleted
+    };
+  });
+}
+async function getMatrixDeviceHealth(opts = {}) {
+  return await withStartedActionClient(
+    opts,
+    async (client) => summarizeMatrixDeviceHealth(await client.listOwnDevices())
+  );
+}
+
+export {
+  listMatrixOwnDevices,
+  pruneMatrixStaleGatewayDevices,
+  getMatrixDeviceHealth
+};
+//# sourceMappingURL=chunk-EVPBRKMZ.js.map

package/dist/chunk-EVPBRKMZ.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/actions/devices.ts"],
+  "sourcesContent": ["import { summarizeMatrixDeviceHealth } from \"../device-health.js\";\nimport { withStartedActionClient } from \"./client.js\";\nimport type { MatrixActionClientOpts } from \"./types.js\";\n\nexport async function listMatrixOwnDevices(opts: MatrixActionClientOpts = {}) {\n  return await withStartedActionClient(opts, async (client) => await client.listOwnDevices());\n}\n\nexport async function pruneMatrixStaleGatewayDevices(opts: MatrixActionClientOpts = {}) {\n  return await withStartedActionClient(opts, async (client) => {\n    const devices = await client.listOwnDevices();\n    const health = summarizeMatrixDeviceHealth(devices);\n    const staleGatewayDeviceIds = health.staleOpenClawDevices.map((device) => device.deviceId);\n    const deleted =\n      staleGatewayDeviceIds.length > 0\n        ? await client.deleteOwnDevices(staleGatewayDeviceIds)\n        : {\n            currentDeviceId: devices.find((device) => device.current)?.deviceId ?? null,\n            deletedDeviceIds: [] as string[],\n            remainingDevices: devices,\n          };\n    return {\n      before: devices,\n      staleGatewayDeviceIds,\n      ...deleted,\n    };\n  });\n}\n\nexport async function getMatrixDeviceHealth(opts: MatrixActionClientOpts = {}) {\n  return await withStartedActionClient(opts, async (client) =>\n    summarizeMatrixDeviceHealth(await client.listOwnDevices()),\n  );\n}\n"],
+  "mappings": ";;;;;;;;;;;AAAA;AAIA,eAAsB,qBAAqB,OAA+B,CAAC,GAAG;AAC5E,SAAO,MAAM,wBAAwB,MAAM,OAAO,WAAW,MAAM,OAAO,eAAe,CAAC;AAC5F;AAEA,eAAsB,+BAA+B,OAA+B,CAAC,GAAG;AACtF,SAAO,MAAM,wBAAwB,MAAM,OAAO,WAAW;AAC3D,UAAM,UAAU,MAAM,OAAO,eAAe;AAC5C,UAAM,SAAS,4BAA4B,OAAO;AAClD,UAAM,wBAAwB,OAAO,qBAAqB,IAAI,CAAC,WAAW,OAAO,QAAQ;AACzF,UAAM,UACJ,sBAAsB,SAAS,IAC3B,MAAM,OAAO,iBAAiB,qBAAqB,IACnD;AAAA,MACE,iBAAiB,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,GAAG,YAAY;AAAA,MACvE,kBAAkB,CAAC;AAAA,MACnB,kBAAkB;AAAA,IACpB;AACN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA,GAAG;AAAA,IACL;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,sBAAsB,OAA+B,CAAC,GAAG;AAC7E,SAAO,MAAM;AAAA,IAAwB;AAAA,IAAM,OAAO,WAChD,4BAA4B,MAAM,OAAO,eAAe,CAAC;AAAA,EAC3D;AACF;",
+  "names": []
+}

package/dist/chunk-F43CC2X2.js

@@ -0,0 +1,49 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/matrix/monitor/runtime-api.ts
+init_shims();
+import { ensureConfiguredAcpBindingReady } from "openclaw/plugin-sdk/acp-binding-runtime";
+import {
+  addAllowlistUserEntriesFromConfigEntry,
+  buildAllowlistResolutionSummary,
+  canonicalizeAllowlistWithResolvedIds,
+  formatAllowlistMatchMeta,
+  patchAllowlistUsersInConfigEntries,
+  summarizeMapping
+} from "openclaw/plugin-sdk/allow-from";
+import { createReplyPrefixOptions } from "openclaw/plugin-sdk/channel-reply-pipeline";
+import { createTypingCallbacks } from "openclaw/plugin-sdk/channel-reply-pipeline";
+import {
+  formatLocationText,
+  logInboundDrop,
+  toLocationContext
+} from "openclaw/plugin-sdk/channel-inbound";
+import { getAgentScopedMediaLocalRoots } from "openclaw/plugin-sdk/agent-media-payload";
+import { logTypingFailure, resolveAckReaction } from "openclaw/plugin-sdk/channel-feedback";
+import {
+  buildChannelKeyCandidates,
+  resolveChannelEntryMatch
+} from "openclaw/plugin-sdk/channel-targets";
+
+export {
+  ensureConfiguredAcpBindingReady,
+  addAllowlistUserEntriesFromConfigEntry,
+  buildAllowlistResolutionSummary,
+  canonicalizeAllowlistWithResolvedIds,
+  formatAllowlistMatchMeta,
+  patchAllowlistUsersInConfigEntries,
+  summarizeMapping,
+  createReplyPrefixOptions,
+  createTypingCallbacks,
+  formatLocationText,
+  logInboundDrop,
+  toLocationContext,
+  getAgentScopedMediaLocalRoots,
+  logTypingFailure,
+  resolveAckReaction,
+  buildChannelKeyCandidates,
+  resolveChannelEntryMatch
+};
+//# sourceMappingURL=chunk-F43CC2X2.js.map

package/dist/chunk-F43CC2X2.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/monitor/runtime-api.ts"],
+  "sourcesContent": ["// Narrow Matrix monitor helper seam.\n// Keep monitor internals off the broad package runtime-api barrel so monitor\n// tests and shared workers do not pull unrelated Matrix helper surfaces.\n\nexport { ensureConfiguredAcpBindingReady } from \"openclaw/plugin-sdk/acp-binding-runtime\";\nexport type { NormalizedLocation } from \"openclaw/plugin-sdk/channel-inbound\";\nexport type { PluginRuntime, RuntimeLogger } from \"openclaw/plugin-sdk/plugin-runtime\";\nexport type { BlockReplyContext, ReplyPayload } from \"openclaw/plugin-sdk/reply-runtime\";\nexport type { MarkdownTableMode, OpenClawConfig } from \"openclaw/plugin-sdk/config-runtime\";\nexport type { RuntimeEnv } from \"openclaw/plugin-sdk/runtime\";\nexport {\n  addAllowlistUserEntriesFromConfigEntry,\n  buildAllowlistResolutionSummary,\n  canonicalizeAllowlistWithResolvedIds,\n  formatAllowlistMatchMeta,\n  patchAllowlistUsersInConfigEntries,\n  summarizeMapping,\n} from \"openclaw/plugin-sdk/allow-from\";\nexport { createReplyPrefixOptions } from \"openclaw/plugin-sdk/channel-reply-pipeline\";\nexport { createTypingCallbacks } from \"openclaw/plugin-sdk/channel-reply-pipeline\";\nexport {\n  formatLocationText,\n  logInboundDrop,\n  toLocationContext,\n} from \"openclaw/plugin-sdk/channel-inbound\";\nexport { getAgentScopedMediaLocalRoots } from \"openclaw/plugin-sdk/agent-media-payload\";\nexport { logTypingFailure, resolveAckReaction } from \"openclaw/plugin-sdk/channel-feedback\";\nexport {\n  buildChannelKeyCandidates,\n  resolveChannelEntryMatch,\n} from \"openclaw/plugin-sdk/channel-targets\";\n"],
+  "mappings": ";;;;;AAAA;AAIA,SAAS,uCAAuC;AAMhD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAC9C,SAAS,kBAAkB,0BAA0B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OACK;",
+  "names": []
+}

package/dist/chunk-F64TXVJJ.js

@@ -0,0 +1,158 @@
+import {
+  getLobiScopedEnvVarNames
+} from "./chunk-HJ5E2JRL.js";
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/secret-contract.ts
+init_shims();
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import {
+  collectSecretInputAssignment,
+  getChannelSurface,
+  hasConfiguredSecretInputValue,
+  hasOwnProperty,
+  normalizeSecretStringValue
+} from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+var secretTargetRegistryEntries = [
+  {
+    id: "channels.lobi.accounts.*.accessToken",
+    targetType: "channels.lobi.accounts.*.accessToken",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.accounts.*.accessToken",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true
+  },
+  {
+    id: "channels.lobi.accounts.*.password",
+    targetType: "channels.lobi.accounts.*.password",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.accounts.*.password",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true
+  },
+  {
+    id: "channels.lobi.accessToken",
+    targetType: "channels.lobi.accessToken",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.accessToken",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true
+  },
+  {
+    id: "channels.lobi.password",
+    targetType: "channels.lobi.password",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.password",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true
+  }
+];
+function collectRuntimeConfigAssignments(params) {
+  const resolved = getChannelSurface(params.config, "matrix");
+  if (!resolved) {
+    return;
+  }
+  const { channel: matrix, surface } = resolved;
+  const envAccessTokenConfigured = normalizeSecretStringValue(params.context.env.LOBI_ACCESS_TOKEN).length > 0;
+  const defaultScopedAccessTokenConfigured = normalizeSecretStringValue(
+    params.context.env[getLobiScopedEnvVarNames("default").accessToken]
+  ).length > 0;
+  const defaultAccountAccessTokenConfigured = surface.accounts.some(
+    ({ accountId, account }) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID && hasConfiguredSecretInputValue(account.accessToken, params.defaults)
+  );
+  const baseAccessTokenConfigured = hasConfiguredSecretInputValue(
+    matrix.accessToken,
+    params.defaults
+  );
+  collectSecretInputAssignment({
+    value: matrix.accessToken,
+    path: "channels.lobi.accessToken",
+    expected: "string",
+    defaults: params.defaults,
+    context: params.context,
+    active: surface.channelEnabled,
+    inactiveReason: "Matrix channel is disabled.",
+    apply: (value) => {
+      matrix.accessToken = value;
+    }
+  });
+  collectSecretInputAssignment({
+    value: matrix.password,
+    path: "channels.lobi.password",
+    expected: "string",
+    defaults: params.defaults,
+    context: params.context,
+    active: surface.channelEnabled && !(baseAccessTokenConfigured || envAccessTokenConfigured || defaultScopedAccessTokenConfigured || defaultAccountAccessTokenConfigured),
+    inactiveReason: "Matrix channel is disabled or access-token auth is configured for the default Matrix account.",
+    apply: (value) => {
+      matrix.password = value;
+    }
+  });
+  if (!surface.hasExplicitAccounts) {
+    return;
+  }
+  for (const { accountId, account, enabled } of surface.accounts) {
+    if (hasOwnProperty(account, "accessToken")) {
+      collectSecretInputAssignment({
+        value: account.accessToken,
+        path: `channels.lobi.accounts.${accountId}.accessToken`,
+        expected: "string",
+        defaults: params.defaults,
+        context: params.context,
+        active: enabled,
+        inactiveReason: "Matrix account is disabled.",
+        apply: (value) => {
+          account.accessToken = value;
+        }
+      });
+    }
+    if (!hasOwnProperty(account, "password")) {
+      continue;
+    }
+    const accountAccessTokenConfigured = hasConfiguredSecretInputValue(
+      account.accessToken,
+      params.defaults
+    );
+    const scopedEnvAccessTokenConfigured = normalizeSecretStringValue(
+      params.context.env[getLobiScopedEnvVarNames(accountId).accessToken]
+    ).length > 0;
+    const inheritedDefaultAccountAccessTokenConfigured = normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID && (baseAccessTokenConfigured || envAccessTokenConfigured);
+    collectSecretInputAssignment({
+      value: account.password,
+      path: `channels.lobi.accounts.${accountId}.password`,
+      expected: "string",
+      defaults: params.defaults,
+      context: params.context,
+      active: enabled && !(accountAccessTokenConfigured || scopedEnvAccessTokenConfigured || inheritedDefaultAccountAccessTokenConfigured),
+      inactiveReason: "Matrix account is disabled or this account has an accessToken configured.",
+      apply: (value) => {
+        account.password = value;
+      }
+    });
+  }
+}
+var channelSecrets = {
+  secretTargetRegistryEntries,
+  collectRuntimeConfigAssignments
+};
+
+export {
+  secretTargetRegistryEntries,
+  collectRuntimeConfigAssignments,
+  channelSecrets
+};
+//# sourceMappingURL=chunk-F64TXVJJ.js.map

package/dist/chunk-F64TXVJJ.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/secret-contract.ts"],
+  "sourcesContent": ["import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from \"openclaw/plugin-sdk/account-id\";\nimport {\n  collectSecretInputAssignment,\n  getChannelSurface,\n  hasConfiguredSecretInputValue,\n  hasOwnProperty,\n  normalizeSecretStringValue,\n  type ResolverContext,\n  type SecretDefaults,\n  type SecretTargetRegistryEntry,\n} from \"openclaw/plugin-sdk/channel-secret-basic-runtime\";\nimport { getLobiScopedEnvVarNames as getMatrixScopedEnvVarNames } from \"./env-vars.js\";\n\nexport const secretTargetRegistryEntries = [\n  {\n    id: \"channels.lobi.accounts.*.accessToken\",\n    targetType: \"channels.lobi.accounts.*.accessToken\",\n    configFile: \"openclaw.json\",\n    pathPattern: \"channels.lobi.accounts.*.accessToken\",\n    secretShape: \"secret_input\",\n    expectedResolvedValue: \"string\",\n    includeInPlan: true,\n    includeInConfigure: true,\n    includeInAudit: true,\n  },\n  {\n    id: \"channels.lobi.accounts.*.password\",\n    targetType: \"channels.lobi.accounts.*.password\",\n    configFile: \"openclaw.json\",\n    pathPattern: \"channels.lobi.accounts.*.password\",\n    secretShape: \"secret_input\",\n    expectedResolvedValue: \"string\",\n    includeInPlan: true,\n    includeInConfigure: true,\n    includeInAudit: true,\n  },\n  {\n    id: \"channels.lobi.accessToken\",\n    targetType: \"channels.lobi.accessToken\",\n    configFile: \"openclaw.json\",\n    pathPattern: \"channels.lobi.accessToken\",\n    secretShape: \"secret_input\",\n    expectedResolvedValue: \"string\",\n    includeInPlan: true,\n    includeInConfigure: true,\n    includeInAudit: true,\n  },\n  {\n    id: \"channels.lobi.password\",\n    targetType: \"channels.lobi.password\",\n    configFile: \"openclaw.json\",\n    pathPattern: \"channels.lobi.password\",\n    secretShape: \"secret_input\",\n    expectedResolvedValue: \"string\",\n    includeInPlan: true,\n    includeInConfigure: true,\n    includeInAudit: true,\n  },\n] satisfies SecretTargetRegistryEntry[];\n\nexport function collectRuntimeConfigAssignments(params: {\n  config: { channels?: Record<string, unknown> };\n  defaults?: SecretDefaults;\n  context: ResolverContext;\n}): void {\n  const resolved = getChannelSurface(params.config, \"matrix\");\n  if (!resolved) {\n    return;\n  }\n  const { channel: matrix, surface } = resolved;\n  const envAccessTokenConfigured =\n    normalizeSecretStringValue(params.context.env.LOBI_ACCESS_TOKEN).length > 0;\n  const defaultScopedAccessTokenConfigured =\n    normalizeSecretStringValue(\n      params.context.env[getMatrixScopedEnvVarNames(\"default\").accessToken],\n    ).length > 0;\n  const defaultAccountAccessTokenConfigured = surface.accounts.some(\n    ({ accountId, account }) =>\n      normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID &&\n      hasConfiguredSecretInputValue(account.accessToken, params.defaults),\n  );\n  const baseAccessTokenConfigured = hasConfiguredSecretInputValue(\n    matrix.accessToken,\n    params.defaults,\n  );\n  collectSecretInputAssignment({\n    value: matrix.accessToken,\n    path: \"channels.lobi.accessToken\",\n    expected: \"string\",\n    defaults: params.defaults,\n    context: params.context,\n    active: surface.channelEnabled,\n    inactiveReason: \"Matrix channel is disabled.\",\n    apply: (value) => {\n      matrix.accessToken = value;\n    },\n  });\n  collectSecretInputAssignment({\n    value: matrix.password,\n    path: \"channels.lobi.password\",\n    expected: \"string\",\n    defaults: params.defaults,\n    context: params.context,\n    active:\n      surface.channelEnabled &&\n      !(\n        baseAccessTokenConfigured ||\n        envAccessTokenConfigured ||\n        defaultScopedAccessTokenConfigured ||\n        defaultAccountAccessTokenConfigured\n      ),\n    inactiveReason:\n      \"Matrix channel is disabled or access-token auth is configured for the default Matrix account.\",\n    apply: (value) => {\n      matrix.password = value;\n    },\n  });\n  if (!surface.hasExplicitAccounts) {\n    return;\n  }\n  for (const { accountId, account, enabled } of surface.accounts) {\n    if (hasOwnProperty(account, \"accessToken\")) {\n      collectSecretInputAssignment({\n        value: account.accessToken,\n        path: `channels.lobi.accounts.${accountId}.accessToken`,\n        expected: \"string\",\n        defaults: params.defaults,\n        context: params.context,\n        active: enabled,\n        inactiveReason: \"Matrix account is disabled.\",\n        apply: (value) => {\n          account.accessToken = value;\n        },\n      });\n    }\n    if (!hasOwnProperty(account, \"password\")) {\n      continue;\n    }\n    const accountAccessTokenConfigured = hasConfiguredSecretInputValue(\n      account.accessToken,\n      params.defaults,\n    );\n    const scopedEnvAccessTokenConfigured =\n      normalizeSecretStringValue(\n        params.context.env[getMatrixScopedEnvVarNames(accountId).accessToken],\n      ).length > 0;\n    const inheritedDefaultAccountAccessTokenConfigured =\n      normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID &&\n      (baseAccessTokenConfigured || envAccessTokenConfigured);\n    collectSecretInputAssignment({\n      value: account.password,\n      path: `channels.lobi.accounts.${accountId}.password`,\n      expected: \"string\",\n      defaults: params.defaults,\n      context: params.context,\n      active:\n        enabled &&\n        !(\n          accountAccessTokenConfigured ||\n          scopedEnvAccessTokenConfigured ||\n          inheritedDefaultAccountAccessTokenConfigured\n        ),\n      inactiveReason: \"Matrix account is disabled or this account has an accessToken configured.\",\n      apply: (value) => {\n        account.password = value;\n      },\n    });\n  }\n}\n\nexport const channelSecrets = {\n  secretTargetRegistryEntries,\n  collectRuntimeConfigAssignments,\n};\n"],
+  "mappings": ";;;;;;;;AAAA;AAAA,SAAS,oBAAoB,0BAA0B;AACvD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAGA,IAAM,8BAA8B;AAAA,EACzC;AAAA,IACE,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,oBAAoB;AAAA,IACpB,gBAAgB;AAAA,EAClB;AACF;AAEO,SAAS,gCAAgC,QAIvC;AACP,QAAM,WAAW,kBAAkB,OAAO,QAAQ,QAAQ;AAC1D,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,QAAM,EAAE,SAAS,QAAQ,QAAQ,IAAI;AACrC,QAAM,2BACJ,2BAA2B,OAAO,QAAQ,IAAI,iBAAiB,EAAE,SAAS;AAC5E,QAAM,qCACJ;AAAA,IACE,OAAO,QAAQ,IAAI,yBAA2B,SAAS,EAAE,WAAW;AAAA,EACtE,EAAE,SAAS;AACb,QAAM,sCAAsC,QAAQ,SAAS;AAAA,IAC3D,CAAC,EAAE,WAAW,QAAQ,MACpB,mBAAmB,SAAS,MAAM,sBAClC,8BAA8B,QAAQ,aAAa,OAAO,QAAQ;AAAA,EACtE;AACA,QAAM,4BAA4B;AAAA,IAChC,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AACA,+BAA6B;AAAA,IAC3B,OAAO,OAAO;AAAA,IACd,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,IAChB,QAAQ,QAAQ;AAAA,IAChB,gBAAgB;AAAA,IAChB,OAAO,CAAC,UAAU;AAChB,aAAO,cAAc;AAAA,IACvB;AAAA,EACF,CAAC;AACD,+BAA6B;AAAA,IAC3B,OAAO,OAAO;AAAA,IACd,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,IAChB,QACE,QAAQ,kBACR,EACE,6BACA,4BACA,sCACA;AAAA,IAEJ,gBACE;AAAA,IACF,OAAO,CAAC,UAAU;AAChB,aAAO,WAAW;AAAA,IACpB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,QAAQ,qBAAqB;AAChC;AAAA,EACF;AACA,aAAW,EAAE,WAAW,SAAS,QAAQ,KAAK,QAAQ,UAAU;AAC9D,QAAI,eAAe,SAAS,aAAa,GAAG;AAC1C,mCAA6B;AAAA,QAC3B,OAAO,QAAQ;AAAA,QACf,MAAM,0BAA0B,SAAS;AAAA,QACzC,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,QACjB,SAAS,OAAO;AAAA,QAChB,QAAQ;AAAA,QACR,gBAAgB;AAAA,QAChB,OAAO,CAAC,UAAU;AAChB,kBAAQ,cAAc;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,CAAC,eAAe,SAAS,UAAU,GAAG;AACxC;AAAA,IACF;AACA,UAAM,+BAA+B;AAAA,MACnC,QAAQ;AAAA,MACR,OAAO;AAAA,IACT;AACA,UAAM,iCACJ;AAAA,MACE,OAAO,QAAQ,IAAI,yBAA2B,SAAS,EAAE,WAAW;AAAA,IACtE,EAAE,SAAS;AACb,UAAM,+CACJ,mBAAmB,SAAS,MAAM,uBACjC,6BAA6B;AAChC,iCAA6B;AAAA,MAC3B,OAAO,QAAQ;AAAA,MACf,MAAM,0BAA0B,SAAS;AAAA,MACzC,UAAU;AAAA,MACV,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,QACE,WACA,EACE,gCACA,kCACA;AAAA,MAEJ,gBAAgB;AAAA,MAChB,OAAO,CAAC,UAAU;AAChB,gBAAQ,WAAW;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AACF;",
+  "names": []
+}