@archipelagolab/lobi 1.0.1 → 1.0.6

package/dist/chunk-FVSH4Z6T.js

@@ -0,0 +1,173 @@
+import {
+  isMatrixStartupAbortError,
+  throwIfMatrixStartupAborted
+} from "./chunk-NIFG55CE.js";
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/matrix/monitor/startup.ts
+init_shims();
+var matrixStartupMaintenanceDepsPromise;
+async function loadMatrixStartupMaintenanceDeps() {
+  matrixStartupMaintenanceDepsPromise ??= Promise.all([
+    import("./src/matrix/config-update.js"),
+    import("./src/matrix/device-health.js"),
+    import("./src/matrix/profile.js"),
+    import("./src/matrix/monitor/legacy-crypto-restore.js"),
+    import("./src/matrix/monitor/startup-verification.js")
+  ]).then(
+    ([
+      configUpdateModule,
+      deviceHealthModule,
+      profileModule,
+      legacyCryptoRestoreModule,
+      startupVerificationModule
+    ]) => ({
+      updateMatrixAccountConfig: configUpdateModule.updateMatrixAccountConfig,
+      summarizeMatrixDeviceHealth: deviceHealthModule.summarizeMatrixDeviceHealth,
+      syncMatrixOwnProfile: profileModule.syncMatrixOwnProfile,
+      maybeRestoreLegacyMatrixBackup: legacyCryptoRestoreModule.maybeRestoreLegacyMatrixBackup,
+      ensureMatrixStartupVerification: startupVerificationModule.ensureMatrixStartupVerification
+    })
+  );
+  return await matrixStartupMaintenanceDepsPromise;
+}
+async function runMatrixStartupMaintenance(params, deps) {
+  const runtimeDeps = deps ?? await loadMatrixStartupMaintenanceDeps();
+  throwIfMatrixStartupAborted(params.abortSignal);
+  try {
+    const profileSync = await runtimeDeps.syncMatrixOwnProfile({
+      client: params.client,
+      userId: params.auth.userId,
+      displayName: params.accountConfig.name,
+      avatarUrl: params.accountConfig.avatarUrl,
+      loadAvatarFromUrl: async (url, maxBytes) => await params.loadWebMedia(url, maxBytes)
+    });
+    throwIfMatrixStartupAborted(params.abortSignal);
+    if (profileSync.displayNameUpdated) {
+      params.logger.info(`matrix: profile display name updated for ${params.auth.userId}`);
+    }
+    if (profileSync.avatarUpdated) {
+      params.logger.info(`matrix: profile avatar updated for ${params.auth.userId}`);
+    }
+    if (profileSync.convertedAvatarFromHttp && profileSync.resolvedAvatarUrl && params.accountConfig.avatarUrl !== profileSync.resolvedAvatarUrl) {
+      const latestCfg = params.loadConfig();
+      const updatedCfg = runtimeDeps.updateMatrixAccountConfig(latestCfg, params.accountId, {
+        avatarUrl: profileSync.resolvedAvatarUrl
+      });
+      await params.writeConfigFile(updatedCfg);
+      throwIfMatrixStartupAborted(params.abortSignal);
+      params.logVerboseMessage(
+        `matrix: persisted converted avatar URL for account ${params.accountId} (${profileSync.resolvedAvatarUrl})`
+      );
+    }
+  } catch (err) {
+    if (isMatrixStartupAbortError(err)) {
+      throw err;
+    }
+    params.logger.warn("matrix: failed to sync profile from config", { error: String(err) });
+  }
+  if (!(params.auth.encryption && params.client.crypto)) {
+    return;
+  }
+  try {
+    throwIfMatrixStartupAborted(params.abortSignal);
+    const deviceHealth = runtimeDeps.summarizeMatrixDeviceHealth(
+      await params.client.listOwnDevices()
+    );
+    if (deviceHealth.staleOpenClawDevices.length > 0) {
+      params.logger.warn(
+        `matrix: stale OpenClaw devices detected for ${params.auth.userId}: ${deviceHealth.staleOpenClawDevices.map((device) => device.deviceId).join(", ")}. Run 'openclaw matrix devices prune-stale --account ${params.effectiveAccountId}' to keep encrypted-room trust healthy.`
+      );
+    }
+  } catch (err) {
+    if (isMatrixStartupAbortError(err)) {
+      throw err;
+    }
+    params.logger.debug?.("Failed to inspect matrix device hygiene (non-fatal)", {
+      error: String(err)
+    });
+  }
+  try {
+    throwIfMatrixStartupAborted(params.abortSignal);
+    const startupVerification = await runtimeDeps.ensureMatrixStartupVerification({
+      client: params.client,
+      auth: params.auth,
+      accountConfig: params.accountConfig,
+      env: params.env
+    });
+    throwIfMatrixStartupAborted(params.abortSignal);
+    if (startupVerification.kind === "verified") {
+      params.logger.info("matrix: device is verified by its owner and ready for encrypted rooms");
+    } else if (startupVerification.kind === "disabled" || startupVerification.kind === "cooldown" || startupVerification.kind === "pending" || startupVerification.kind === "request-failed") {
+      params.logger.info(
+        "matrix: device not verified \u2014 run 'openclaw matrix verify device <key>' to enable E2EE"
+      );
+      if (startupVerification.kind === "pending") {
+        params.logger.info(
+          "matrix: startup verification request is already pending; finish it in another Matrix client"
+        );
+      } else if (startupVerification.kind === "cooldown") {
+        params.logVerboseMessage(
+          `matrix: skipped startup verification request due to cooldown (retryAfterMs=${startupVerification.retryAfterMs ?? 0})`
+        );
+      } else if (startupVerification.kind === "request-failed") {
+        params.logger.debug?.("Matrix startup verification request failed (non-fatal)", {
+          error: startupVerification.error ?? "unknown"
+        });
+      }
+    } else if (startupVerification.kind === "requested") {
+      params.logger.info(
+        "matrix: device not verified \u2014 requested verification in another Matrix client"
+      );
+    }
+  } catch (err) {
+    if (isMatrixStartupAbortError(err)) {
+      throw err;
+    }
+    params.logger.debug?.("Failed to resolve matrix verification status (non-fatal)", {
+      error: String(err)
+    });
+  }
+  try {
+    throwIfMatrixStartupAborted(params.abortSignal);
+    const legacyCryptoRestore = await runtimeDeps.maybeRestoreLegacyMatrixBackup({
+      client: params.client,
+      auth: params.auth,
+      env: params.env
+    });
+    throwIfMatrixStartupAborted(params.abortSignal);
+    if (legacyCryptoRestore.kind === "restored") {
+      params.logger.info(
+        `matrix: restored ${legacyCryptoRestore.imported}/${legacyCryptoRestore.total} room key(s) from legacy encrypted-state backup`
+      );
+      if (legacyCryptoRestore.localOnlyKeys > 0) {
+        params.logger.warn(
+          `matrix: ${legacyCryptoRestore.localOnlyKeys} legacy local-only room key(s) were never backed up and could not be restored automatically`
+        );
+      }
+    } else if (legacyCryptoRestore.kind === "failed") {
+      params.logger.warn(
+        `matrix: failed restoring room keys from legacy encrypted-state backup: ${legacyCryptoRestore.error}`
+      );
+      if (legacyCryptoRestore.localOnlyKeys > 0) {
+        params.logger.warn(
+          `matrix: ${legacyCryptoRestore.localOnlyKeys} legacy local-only room key(s) were never backed up and may remain unavailable until manually recovered`
+        );
+      }
+    }
+  } catch (err) {
+    if (isMatrixStartupAbortError(err)) {
+      throw err;
+    }
+    params.logger.warn("matrix: failed restoring legacy encrypted-state backup", {
+      error: String(err)
+    });
+  }
+}
+
+export {
+  runMatrixStartupMaintenance
+};
+//# sourceMappingURL=chunk-FVSH4Z6T.js.map

package/dist/chunk-FVSH4Z6T.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/monitor/startup.ts"],
+  "sourcesContent": ["import type { RuntimeLogger } from \"../../runtime-api.js\";\nimport type { CoreConfig, MatrixConfig } from \"../../types.js\";\nimport type { MatrixAuth } from \"../client.js\";\nimport type { MatrixClient } from \"../sdk.js\";\nimport { isMatrixStartupAbortError, throwIfMatrixStartupAborted } from \"../startup-abort.js\";\n\ntype MatrixStartupClient = Pick<\n  MatrixClient,\n  | \"crypto\"\n  | \"getOwnDeviceVerificationStatus\"\n  | \"getUserProfile\"\n  | \"listOwnDevices\"\n  | \"restoreRoomKeyBackup\"\n  | \"setAvatarUrl\"\n  | \"setDisplayName\"\n  | \"uploadContent\"\n>;\n\nexport type MatrixStartupMaintenanceDeps = {\n  updateMatrixAccountConfig: typeof import(\"../config-update.js\").updateMatrixAccountConfig;\n  summarizeMatrixDeviceHealth: typeof import(\"../device-health.js\").summarizeMatrixDeviceHealth;\n  syncMatrixOwnProfile: typeof import(\"../profile.js\").syncMatrixOwnProfile;\n  maybeRestoreLegacyMatrixBackup: typeof import(\"./legacy-crypto-restore.js\").maybeRestoreLegacyMatrixBackup;\n  ensureMatrixStartupVerification: typeof import(\"./startup-verification.js\").ensureMatrixStartupVerification;\n};\n\nlet matrixStartupMaintenanceDepsPromise: Promise<MatrixStartupMaintenanceDeps> | undefined;\n\nasync function loadMatrixStartupMaintenanceDeps(): Promise<MatrixStartupMaintenanceDeps> {\n  matrixStartupMaintenanceDepsPromise ??= Promise.all([\n    import(\"../config-update.js\"),\n    import(\"../device-health.js\"),\n    import(\"../profile.js\"),\n    import(\"./legacy-crypto-restore.js\"),\n    import(\"./startup-verification.js\"),\n  ]).then(\n    ([\n      configUpdateModule,\n      deviceHealthModule,\n      profileModule,\n      legacyCryptoRestoreModule,\n      startupVerificationModule,\n    ]) => ({\n      updateMatrixAccountConfig: configUpdateModule.updateMatrixAccountConfig,\n      summarizeMatrixDeviceHealth: deviceHealthModule.summarizeMatrixDeviceHealth,\n      syncMatrixOwnProfile: profileModule.syncMatrixOwnProfile,\n      maybeRestoreLegacyMatrixBackup: legacyCryptoRestoreModule.maybeRestoreLegacyMatrixBackup,\n      ensureMatrixStartupVerification: startupVerificationModule.ensureMatrixStartupVerification,\n    }),\n  );\n  return await matrixStartupMaintenanceDepsPromise;\n}\n\nexport async function runMatrixStartupMaintenance(\n  params: {\n    client: MatrixStartupClient;\n    auth: MatrixAuth;\n    accountId: string;\n    effectiveAccountId: string;\n    accountConfig: MatrixConfig;\n    logger: RuntimeLogger;\n    logVerboseMessage: (message: string) => void;\n    loadConfig: () => CoreConfig;\n    writeConfigFile: (cfg: never) => Promise<void>;\n    loadWebMedia: (\n      url: string,\n      maxBytes: number,\n    ) => Promise<{ buffer: Buffer; contentType?: string; fileName?: string }>;\n    env?: NodeJS.ProcessEnv;\n    abortSignal?: AbortSignal;\n  },\n  deps?: MatrixStartupMaintenanceDeps,\n): Promise<void> {\n  const runtimeDeps = deps ?? (await loadMatrixStartupMaintenanceDeps());\n  throwIfMatrixStartupAborted(params.abortSignal);\n  try {\n    const profileSync = await runtimeDeps.syncMatrixOwnProfile({\n      client: params.client,\n      userId: params.auth.userId,\n      displayName: params.accountConfig.name,\n      avatarUrl: params.accountConfig.avatarUrl,\n      loadAvatarFromUrl: async (url, maxBytes) => await params.loadWebMedia(url, maxBytes),\n    });\n    throwIfMatrixStartupAborted(params.abortSignal);\n    if (profileSync.displayNameUpdated) {\n      params.logger.info(`matrix: profile display name updated for ${params.auth.userId}`);\n    }\n    if (profileSync.avatarUpdated) {\n      params.logger.info(`matrix: profile avatar updated for ${params.auth.userId}`);\n    }\n    if (\n      profileSync.convertedAvatarFromHttp &&\n      profileSync.resolvedAvatarUrl &&\n      params.accountConfig.avatarUrl !== profileSync.resolvedAvatarUrl\n    ) {\n      const latestCfg = params.loadConfig();\n      const updatedCfg = runtimeDeps.updateMatrixAccountConfig(latestCfg, params.accountId, {\n        avatarUrl: profileSync.resolvedAvatarUrl,\n      });\n      await params.writeConfigFile(updatedCfg as never);\n      throwIfMatrixStartupAborted(params.abortSignal);\n      params.logVerboseMessage(\n        `matrix: persisted converted avatar URL for account ${params.accountId} (${profileSync.resolvedAvatarUrl})`,\n      );\n    }\n  } catch (err) {\n    if (isMatrixStartupAbortError(err)) {\n      throw err;\n    }\n    params.logger.warn(\"matrix: failed to sync profile from config\", { error: String(err) });\n  }\n\n  if (!(params.auth.encryption && params.client.crypto)) {\n    return;\n  }\n\n  try {\n    throwIfMatrixStartupAborted(params.abortSignal);\n    const deviceHealth = runtimeDeps.summarizeMatrixDeviceHealth(\n      await params.client.listOwnDevices(),\n    );\n    if (deviceHealth.staleOpenClawDevices.length > 0) {\n      params.logger.warn(\n        `matrix: stale OpenClaw devices detected for ${params.auth.userId}: ${deviceHealth.staleOpenClawDevices.map((device) => device.deviceId).join(\", \")}. Run 'openclaw matrix devices prune-stale --account ${params.effectiveAccountId}' to keep encrypted-room trust healthy.`,\n      );\n    }\n  } catch (err) {\n    if (isMatrixStartupAbortError(err)) {\n      throw err;\n    }\n    params.logger.debug?.(\"Failed to inspect matrix device hygiene (non-fatal)\", {\n      error: String(err),\n    });\n  }\n\n  try {\n    throwIfMatrixStartupAborted(params.abortSignal);\n    const startupVerification = await runtimeDeps.ensureMatrixStartupVerification({\n      client: params.client,\n      auth: params.auth,\n      accountConfig: params.accountConfig,\n      env: params.env,\n    });\n    throwIfMatrixStartupAborted(params.abortSignal);\n    if (startupVerification.kind === \"verified\") {\n      params.logger.info(\"matrix: device is verified by its owner and ready for encrypted rooms\");\n    } else if (\n      startupVerification.kind === \"disabled\" ||\n      startupVerification.kind === \"cooldown\" ||\n      startupVerification.kind === \"pending\" ||\n      startupVerification.kind === \"request-failed\"\n    ) {\n      params.logger.info(\n        \"matrix: device not verified \u2014 run 'openclaw matrix verify device <key>' to enable E2EE\",\n      );\n      if (startupVerification.kind === \"pending\") {\n        params.logger.info(\n          \"matrix: startup verification request is already pending; finish it in another Matrix client\",\n        );\n      } else if (startupVerification.kind === \"cooldown\") {\n        params.logVerboseMessage(\n          `matrix: skipped startup verification request due to cooldown (retryAfterMs=${startupVerification.retryAfterMs ?? 0})`,\n        );\n      } else if (startupVerification.kind === \"request-failed\") {\n        params.logger.debug?.(\"Matrix startup verification request failed (non-fatal)\", {\n          error: startupVerification.error ?? \"unknown\",\n        });\n      }\n    } else if (startupVerification.kind === \"requested\") {\n      params.logger.info(\n        \"matrix: device not verified \u2014 requested verification in another Matrix client\",\n      );\n    }\n  } catch (err) {\n    if (isMatrixStartupAbortError(err)) {\n      throw err;\n    }\n    params.logger.debug?.(\"Failed to resolve matrix verification status (non-fatal)\", {\n      error: String(err),\n    });\n  }\n\n  try {\n    throwIfMatrixStartupAborted(params.abortSignal);\n    const legacyCryptoRestore = await runtimeDeps.maybeRestoreLegacyMatrixBackup({\n      client: params.client,\n      auth: params.auth,\n      env: params.env,\n    });\n    throwIfMatrixStartupAborted(params.abortSignal);\n    if (legacyCryptoRestore.kind === \"restored\") {\n      params.logger.info(\n        `matrix: restored ${legacyCryptoRestore.imported}/${legacyCryptoRestore.total} room key(s) from legacy encrypted-state backup`,\n      );\n      if (legacyCryptoRestore.localOnlyKeys > 0) {\n        params.logger.warn(\n          `matrix: ${legacyCryptoRestore.localOnlyKeys} legacy local-only room key(s) were never backed up and could not be restored automatically`,\n        );\n      }\n    } else if (legacyCryptoRestore.kind === \"failed\") {\n      params.logger.warn(\n        `matrix: failed restoring room keys from legacy encrypted-state backup: ${legacyCryptoRestore.error}`,\n      );\n      if (legacyCryptoRestore.localOnlyKeys > 0) {\n        params.logger.warn(\n          `matrix: ${legacyCryptoRestore.localOnlyKeys} legacy local-only room key(s) were never backed up and may remain unavailable until manually recovered`,\n        );\n      }\n    }\n  } catch (err) {\n    if (isMatrixStartupAbortError(err)) {\n      throw err;\n    }\n    params.logger.warn(\"matrix: failed restoring legacy encrypted-state backup\", {\n      error: String(err),\n    });\n  }\n}\n"],
+  "mappings": ";;;;;;;;;AAAA;AA0BA,IAAI;AAEJ,eAAe,mCAA0E;AACvF,0CAAwC,QAAQ,IAAI;AAAA,IAClD,OAAO,+BAAqB;AAAA,IAC5B,OAAO,+BAAqB;AAAA,IAC5B,OAAO,yBAAe;AAAA,IACtB,OAAO,+CAA4B;AAAA,IACnC,OAAO,8CAA2B;AAAA,EACpC,CAAC,EAAE;AAAA,IACD,CAAC;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,OAAO;AAAA,MACL,2BAA2B,mBAAmB;AAAA,MAC9C,6BAA6B,mBAAmB;AAAA,MAChD,sBAAsB,cAAc;AAAA,MACpC,gCAAgC,0BAA0B;AAAA,MAC1D,iCAAiC,0BAA0B;AAAA,IAC7D;AAAA,EACF;AACA,SAAO,MAAM;AACf;AAEA,eAAsB,4BACpB,QAiBA,MACe;AACf,QAAM,cAAc,QAAS,MAAM,iCAAiC;AACpE,8BAA4B,OAAO,WAAW;AAC9C,MAAI;AACF,UAAM,cAAc,MAAM,YAAY,qBAAqB;AAAA,MACzD,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO,KAAK;AAAA,MACpB,aAAa,OAAO,cAAc;AAAA,MAClC,WAAW,OAAO,cAAc;AAAA,MAChC,mBAAmB,OAAO,KAAK,aAAa,MAAM,OAAO,aAAa,KAAK,QAAQ;AAAA,IACrF,CAAC;AACD,gCAA4B,OAAO,WAAW;AAC9C,QAAI,YAAY,oBAAoB;AAClC,aAAO,OAAO,KAAK,4CAA4C,OAAO,KAAK,MAAM,EAAE;AAAA,IACrF;AACA,QAAI,YAAY,eAAe;AAC7B,aAAO,OAAO,KAAK,sCAAsC,OAAO,KAAK,MAAM,EAAE;AAAA,IAC/E;AACA,QACE,YAAY,2BACZ,YAAY,qBACZ,OAAO,cAAc,cAAc,YAAY,mBAC/C;AACA,YAAM,YAAY,OAAO,WAAW;AACpC,YAAM,aAAa,YAAY,0BAA0B,WAAW,OAAO,WAAW;AAAA,QACpF,WAAW,YAAY;AAAA,MACzB,CAAC;AACD,YAAM,OAAO,gBAAgB,UAAmB;AAChD,kCAA4B,OAAO,WAAW;AAC9C,aAAO;AAAA,QACL,sDAAsD,OAAO,SAAS,KAAK,YAAY,iBAAiB;AAAA,MAC1G;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,0BAA0B,GAAG,GAAG;AAClC,YAAM;AAAA,IACR;AACA,WAAO,OAAO,KAAK,8CAA8C,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;AAAA,EACzF;AAEA,MAAI,EAAE,OAAO,KAAK,cAAc,OAAO,OAAO,SAAS;AACrD;AAAA,EACF;AAEA,MAAI;AACF,gCAA4B,OAAO,WAAW;AAC9C,UAAM,eAAe,YAAY;AAAA,MAC/B,MAAM,OAAO,OAAO,eAAe;AAAA,IACrC;AACA,QAAI,aAAa,qBAAqB,SAAS,GAAG;AAChD,aAAO,OAAO;AAAA,QACZ,+CAA+C,OAAO,KAAK,MAAM,KAAK,aAAa,qBAAqB,IAAI,CAAC,WAAW,OAAO,QAAQ,EAAE,KAAK,IAAI,CAAC,wDAAwD,OAAO,kBAAkB;AAAA,MACtO;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,0BAA0B,GAAG,GAAG;AAClC,YAAM;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,uDAAuD;AAAA,MAC3E,OAAO,OAAO,GAAG;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,MAAI;AACF,gCAA4B,OAAO,WAAW;AAC9C,UAAM,sBAAsB,MAAM,YAAY,gCAAgC;AAAA,MAC5E,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,eAAe,OAAO;AAAA,MACtB,KAAK,OAAO;AAAA,IACd,CAAC;AACD,gCAA4B,OAAO,WAAW;AAC9C,QAAI,oBAAoB,SAAS,YAAY;AAC3C,aAAO,OAAO,KAAK,uEAAuE;AAAA,IAC5F,WACE,oBAAoB,SAAS,cAC7B,oBAAoB,SAAS,cAC7B,oBAAoB,SAAS,aAC7B,oBAAoB,SAAS,kBAC7B;AACA,aAAO,OAAO;AAAA,QACZ;AAAA,MACF;AACA,UAAI,oBAAoB,SAAS,WAAW;AAC1C,eAAO,OAAO;AAAA,UACZ;AAAA,QACF;AAAA,MACF,WAAW,oBAAoB,SAAS,YAAY;AAClD,eAAO;AAAA,UACL,8EAA8E,oBAAoB,gBAAgB,CAAC;AAAA,QACrH;AAAA,MACF,WAAW,oBAAoB,SAAS,kBAAkB;AACxD,eAAO,OAAO,QAAQ,0DAA0D;AAAA,UAC9E,OAAO,oBAAoB,SAAS;AAAA,QACtC,CAAC;AAAA,MACH;AAAA,IACF,WAAW,oBAAoB,SAAS,aAAa;AACnD,aAAO,OAAO;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,0BAA0B,GAAG,GAAG;AAClC,YAAM;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,4DAA4D;AAAA,MAChF,OAAO,OAAO,GAAG;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,MAAI;AACF,gCAA4B,OAAO,WAAW;AAC9C,UAAM,sBAAsB,MAAM,YAAY,+BAA+B;AAAA,MAC3E,QAAQ,OAAO;AAAA,MACf,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,IACd,CAAC;AACD,gCAA4B,OAAO,WAAW;AAC9C,QAAI,oBAAoB,SAAS,YAAY;AAC3C,aAAO,OAAO;AAAA,QACZ,oBAAoB,oBAAoB,QAAQ,IAAI,oBAAoB,KAAK;AAAA,MAC/E;AACA,UAAI,oBAAoB,gBAAgB,GAAG;AACzC,eAAO,OAAO;AAAA,UACZ,WAAW,oBAAoB,aAAa;AAAA,QAC9C;AAAA,MACF;AAAA,IACF,WAAW,oBAAoB,SAAS,UAAU;AAChD,aAAO,OAAO;AAAA,QACZ,0EAA0E,oBAAoB,KAAK;AAAA,MACrG;AACA,UAAI,oBAAoB,gBAAgB,GAAG;AACzC,eAAO,OAAO;AAAA,UACZ,WAAW,oBAAoB,aAAa;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,0BAA0B,GAAG,GAAG;AAClC,YAAM;AAAA,IACR;AACA,WAAO,OAAO,KAAK,0DAA0D;AAAA,MAC3E,OAAO,OAAO,GAAG;AAAA,IACnB,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/chunk-FVWBLEAD.js

@@ -0,0 +1,44 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// ../../node_modules/@archipelagolab/lobi-js-sdk/lib/crypto-api/verification.js
+init_shims();
+var VerificationRequestEvent = /* @__PURE__ */ (function(VerificationRequestEvent2) {
+  VerificationRequestEvent2["Change"] = "change";
+  return VerificationRequestEvent2;
+})({});
+var VerificationPhase = /* @__PURE__ */ (function(VerificationPhase2) {
+  VerificationPhase2[VerificationPhase2["Unsent"] = 1] = "Unsent";
+  VerificationPhase2[VerificationPhase2["Requested"] = 2] = "Requested";
+  VerificationPhase2[VerificationPhase2["Ready"] = 3] = "Ready";
+  VerificationPhase2[VerificationPhase2["Started"] = 4] = "Started";
+  VerificationPhase2[VerificationPhase2["Cancelled"] = 5] = "Cancelled";
+  VerificationPhase2[VerificationPhase2["Done"] = 6] = "Done";
+  return VerificationPhase2;
+})({});
+var VerifierEvent = /* @__PURE__ */ (function(VerifierEvent2) {
+  VerifierEvent2["Cancel"] = "cancel";
+  VerifierEvent2["ShowSas"] = "show_sas";
+  VerifierEvent2["ShowReciprocateQr"] = "show_reciprocate_qr";
+  return VerifierEvent2;
+})({});
+
+// ../../node_modules/@archipelagolab/lobi-js-sdk/lib/@types/membership.js
+init_shims();
+var KnownMembership = /* @__PURE__ */ (function(KnownMembership2) {
+  KnownMembership2["Ban"] = "ban";
+  KnownMembership2["Invite"] = "invite";
+  KnownMembership2["Join"] = "join";
+  KnownMembership2["Knock"] = "knock";
+  KnownMembership2["Leave"] = "leave";
+  return KnownMembership2;
+})({});
+
+export {
+  KnownMembership,
+  VerificationRequestEvent,
+  VerificationPhase,
+  VerifierEvent
+};
+//# sourceMappingURL=chunk-FVWBLEAD.js.map

package/dist/chunk-FVWBLEAD.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../node_modules/@archipelagolab/lobi-js-sdk/src/crypto-api/verification.ts", "../../../node_modules/@archipelagolab/lobi-js-sdk/src/@types/membership.ts"],
+  "sourcesContent": ["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { type LobiEvent } from \"../models/event.ts\";\nimport { type TypedEventEmitter } from \"../models/typed-event-emitter.ts\";\n\n/**\n * An incoming, or outgoing, request to verify a user or a device via cross-signing.\n */\nexport interface VerificationRequest extends TypedEventEmitter<\n    VerificationRequestEvent,\n    VerificationRequestEventHandlerMap\n> {\n    /**\n     * Unique ID for this verification request.\n     *\n     * An ID isn't assigned until the first message is sent, so this may be `undefined` in the early phases.\n     */\n    get transactionId(): string | undefined;\n\n    /**\n     * For an in-room verification, the ID of the room.\n     *\n     * For to-device verifictions, `undefined`.\n     */\n    get roomId(): string | undefined;\n\n    /**\n     * True if this request was initiated by the local client.\n     *\n     * For in-room verifications, the initiator is who sent the `m.key.verification.request` event.\n     * For to-device verifications, the initiator is who sent the `m.key.verification.start` event.\n     */\n    get initiatedByMe(): boolean;\n\n    /** The user id of the other party in this request */\n    get otherUserId(): string;\n\n    /** For verifications via to-device messages: the ID of the other device. Otherwise, undefined. */\n    get otherDeviceId(): string | undefined;\n\n    /** True if the other party in this request is one of this user's own devices. */\n    get isSelfVerification(): boolean;\n\n    /** current phase of the request. */\n    get phase(): VerificationPhase;\n\n    /** True if the request has sent its initial event and needs more events to complete\n     * (ie it is in phase `Requested`, `Ready` or `Started`).\n     */\n    get pending(): boolean;\n\n    /**\n     * True if we have started the process of sending an `m.key.verification.ready` (but have not necessarily received\n     * the remote echo which causes a transition to {@link VerificationPhase.Ready}.\n     */\n    get accepting(): boolean;\n\n    /**\n     * True if we have started the process of sending an `m.key.verification.cancel` (but have not necessarily received\n     * the remote echo which causes a transition to {@link VerificationPhase.Cancelled}).\n     */\n    get declining(): boolean;\n\n    /**\n     * The remaining number of ms before the request will be automatically cancelled.\n     *\n     * `null` indicates that there is no timeout\n     */\n    get timeout(): number | null;\n\n    /** once the phase is Started (and !initiatedByMe) or Ready: common methods supported by both sides */\n    get methods(): string[];\n\n    /** the method picked in the .start event */\n    get chosenMethod(): string | null;\n\n    /**\n     * Checks whether the other party supports a given verification method.\n     * This is useful when setting up the QR code UI, as it is somewhat asymmetrical:\n     * if the other party supports SCAN_QR, we should show a QR code in the UI, and vice versa.\n     * For methods that need to be supported by both ends, use the `methods` property.\n     *\n     * @param method - the method to check\n     * @returns true if the other party said they supported the method\n     */\n    otherPartySupportsMethod(method: string): boolean;\n\n    /**\n     * Accepts the request, sending a .ready event to the other party\n     *\n     * @returns Promise which resolves when the event has been sent.\n     */\n    accept(): Promise<void>;\n\n    /**\n     * Cancels the request, sending a cancellation to the other party\n     *\n     * @param params - Details for the cancellation, including `reason` (defaults to \"User declined\"), and `code`\n     *    (defaults to `m.user`). **Deprecated**: this parameter is ignored by the Rust cryptography implementation.\n     *\n     * @returns Promise which resolves when the event has been sent.\n     */\n    cancel(params?: { reason?: string; code?: string }): Promise<void>;\n\n    /**\n     * Send an `m.key.verification.start` event to start verification via a particular method.\n     *\n     * This is normally used when starting a verification via emojis (ie, `method` is set to `m.sas.v1`).\n     *\n     * @param method - the name of the verification method to use.\n     *\n     * @returns The verifier which will do the actual verification.\n     */\n    startVerification(method: string): Promise<Verifier>;\n\n    /**\n     * Start a QR code verification by providing a scanned QR code for this verification flow.\n     *\n     * Validates the QR code, and if it is ok, sends an `m.key.verification.start` event with `method` set to\n     * `m.reciprocate.v1`, to tell the other side the scan was successful.\n     *\n     * See also {@link VerificationRequest#startVerification} which can be used to start other verification methods.\n     *\n     * @param qrCodeData - the decoded QR code.\n     * @returns A verifier; call `.verify()` on it to wait for the other side to complete the verification flow.\n     */\n    scanQRCode(qrCodeData: Uint8ClampedArray): Promise<Verifier>;\n\n    /**\n     * The verifier which is doing the actual verification, once the method has been established.\n     * Only defined when the `phase` is Started.\n     */\n    get verifier(): Verifier | undefined;\n\n    /**\n     * Generate the data for a QR code allowing the other device to verify this one, if it supports it.\n     *\n     * Only returns data once `phase` is {@link VerificationPhase.Ready} and the other party can scan a QR code;\n     * otherwise returns `undefined`.\n     */\n    generateQRCode(): Promise<Uint8ClampedArray | undefined>;\n\n    /**\n     * If this request has been cancelled, the cancellation code (e.g `m.user`) which is responsible for cancelling\n     * this verification.\n     */\n    get cancellationCode(): string | null;\n\n    /**\n     * The id of the user that cancelled the request.\n     *\n     * Only defined when phase is Cancelled\n     */\n    get cancellingUserId(): string | undefined;\n}\n\n/** Events emitted by {@link VerificationRequest}. */\nexport enum VerificationRequestEvent {\n    /**\n     * Fires whenever the state of the request object has changed.\n     *\n     * There is no payload to the event.\n     */\n    Change = \"change\",\n}\n\n/**\n * Listener type map for {@link VerificationRequestEvent}s.\n *\n * @internal\n */\nexport type VerificationRequestEventHandlerMap = {\n    [VerificationRequestEvent.Change]: () => void;\n};\n\n/** The current phase of a verification request. */\nexport enum VerificationPhase {\n    /** Initial state: no event yet exchanged */\n    Unsent = 1,\n\n    /** An `m.key.verification.request` event has been sent or received */\n    Requested,\n\n    /** An `m.key.verification.ready` event has been sent or received, indicating the verification request is accepted. */\n    Ready,\n\n    /**\n     * The verification is in flight.\n     *\n     * This means that an `m.key.verification.start` event has been sent or received, choosing a verification method;\n     * however the verification has not yet completed or been cancelled.\n     */\n    Started,\n\n    /**\n     * An `m.key.verification.cancel` event has been sent or received at any time before the `done` event, cancelling\n     * the verification request\n     */\n    Cancelled,\n\n    /**\n     * The verification request is complete.\n     *\n     * Normally this means that `m.key.verification.done` events have been sent and received.\n     */\n    Done,\n}\n\n/**\n * A `Verifier` is responsible for performing the verification using a particular method, such as via QR code or SAS\n * (emojis).\n *\n * A verifier object can be created by calling `VerificationRequest.beginVerification`; one is also created\n * automatically when a `m.key.verification.start` event is received for an existing VerificationRequest.\n *\n * Once a verifier object is created, the verification can be started by calling the {@link Verifier#verify} method.\n */\nexport interface Verifier extends TypedEventEmitter<VerifierEvent, VerifierEventHandlerMap> {\n    /**\n     * Returns true if the verification has been cancelled, either by us or the other side.\n     */\n    get hasBeenCancelled(): boolean;\n\n    /**\n     * The ID of the other user in the verification process.\n     */\n    get userId(): string;\n\n    /**\n     * Start the key verification, if it has not already been started.\n     *\n     * This means sending a `m.key.verification.start` if we are the first responder, or a `m.key.verification.accept`\n     * if the other side has already sent a start event.\n     *\n     * @returns Promise which resolves when the verification has completed, or rejects if the verification is cancelled\n     *    or times out.\n     */\n    verify(): Promise<void>;\n\n    /**\n     * Cancel a verification.\n     *\n     * We will send an `m.key.verification.cancel` if the verification is still in flight. The verification promise\n     * will reject, and a {@link crypto-api.VerifierEvent.Cancel | VerifierEvent.Cancel} will be emitted.\n     *\n     * @param e - the reason for the cancellation.\n     */\n    cancel(e: Error): void;\n\n    /**\n     * Get the details for an SAS verification, if one is in progress\n     *\n     * Returns `null`, unless this verifier is for a SAS-based verification and we are waiting for the user to confirm\n     * the SAS matches.\n     */\n    getShowSasCallbacks(): ShowSasCallbacks | null;\n\n    /**\n     * Get the details for reciprocating QR code verification, if one is in progress\n     *\n     * Returns `null`, unless this verifier is for reciprocating a QR-code-based verification (ie, the other user has\n     * already scanned our QR code), and we are waiting for the user to confirm.\n     */\n    getReciprocateQrCodeCallbacks(): ShowQrCodeCallbacks | null;\n}\n\n/** Events emitted by {@link Verifier} */\nexport enum VerifierEvent {\n    /**\n     * The verification has been cancelled, by us or the other side.\n     *\n     * The payload is either an {@link Error}, or an (incoming or outgoing) {@link LobiEvent}, depending on\n     * unspecified reasons.\n     */\n    Cancel = \"cancel\",\n\n    /**\n     * SAS data has been exchanged and should be displayed to the user.\n     *\n     * The payload is the {@link ShowSasCallbacks} object.\n     */\n    ShowSas = \"show_sas\",\n\n    /**\n     * The user should confirm if the other side has scanned our QR code.\n     *\n     * The payload is the {@link ShowQrCodeCallbacks} object.\n     */\n    ShowReciprocateQr = \"show_reciprocate_qr\",\n}\n\n/** Listener type map for {@link VerifierEvent}s. */\nexport type VerifierEventHandlerMap = {\n    [VerifierEvent.Cancel]: (e: Error | LobiEvent) => void;\n    [VerifierEvent.ShowSas]: (sas: ShowSasCallbacks) => void;\n    [VerifierEvent.ShowReciprocateQr]: (qr: ShowQrCodeCallbacks) => void;\n};\n\n/**\n * Callbacks for user actions to confirm that the other side has scanned our QR code.\n *\n * This is exposed as the payload of a `VerifierEvent.ShowReciprocateQr` event, or can be retrieved directly from the\n * verifier as `reciprocateQREvent`.\n */\nexport interface ShowQrCodeCallbacks {\n    /** The user confirms that the verification data matches */\n    confirm(): void;\n\n    /** Cancel the verification flow */\n    cancel(): void;\n}\n\n/**\n * Callbacks for user actions while a SAS is displayed.\n *\n * This is exposed as the payload of a `VerifierEvent.ShowSas` event, or directly from the verifier as `sasEvent`.\n */\nexport interface ShowSasCallbacks {\n    /** The generated SAS to be shown to the user */\n    sas: GeneratedSas;\n\n    /** Function to call if the user confirms that the SAS matches.\n     *\n     * @returns A Promise that completes once the m.key.verification.mac is queued.\n     */\n    confirm(): Promise<void>;\n\n    /**\n     * Function to call if the user finds the SAS does not match.\n     *\n     * Sends an `m.key.verification.cancel` event with a `m.mismatched_sas` error code.\n     */\n    mismatch(): void;\n\n    /** Cancel the verification flow */\n    cancel(): void;\n}\n\n/** A generated SAS to be shown to the user, in alternative formats */\nexport interface GeneratedSas {\n    /**\n     * The SAS as three numbers between 0 and 8191.\n     *\n     * Only populated if the `decimal` SAS method was negotiated.\n     */\n    decimal?: [number, number, number];\n\n    /**\n     * The SAS as seven emojis.\n     *\n     * Only populated if the `emoji` SAS method was negotiated.\n     */\n    emoji?: EmojiMapping[];\n}\n\n/**\n * An emoji for the generated SAS. A tuple `[emoji, name]` where `emoji` is the emoji itself and `name` is the\n * English name.\n */\nexport type EmojiMapping = [emoji: string, name: string];\n\n/**\n * True if the request is in a state where it can be accepted (ie, that we're in phases {@link VerificationPhase.Unsent}\n * or {@link VerificationPhase.Requested}, and that we're not in the process of sending a `ready` or `cancel`).\n */\nexport function canAcceptVerificationRequest(req: VerificationRequest): boolean {\n    return req.phase < VerificationPhase.Ready && !req.accepting && !req.declining;\n}\n", "/*\nCopyright 2024 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Well-known values (from the spec or MSCs) that are allowed in the\n * {@link Membership} type.\n */\nexport enum KnownMembership {\n    /**\n     * The user has been banned from the room, and is no longer allowed to join\n     * it until they are un-banned from the room (by having their membership\n     * state set to a value other than ban).\n     */\n    Ban = \"ban\",\n    /**\n     * The user has been invited to join a room, but has not yet joined it.\n     * They may not participate in the room until they join.\n     * */\n    Invite = \"invite\",\n    /**\n     * The user has joined the room (possibly after accepting an invite), and\n     * may participate in it.\n     */\n    Join = \"join\",\n    /**\n     * The user has knocked on the room, requesting permission to participate.\n     * They may not participate in the room until they join.\n     */\n    Knock = \"knock\",\n    /**\n     * The user was once joined to the room, but has since left (possibly by\n     * choice, or possibly by being kicked).\n     */\n    Leave = \"leave\",\n}\n\n/**\n * The membership state for a user in a room [1]. A value from\n * {@link KnownMembership} should be used where available, but all string values\n * are allowed to provide flexibility for upcoming spec changes or proposals.\n *\n * [1] https://spec.matrix.org/latest/client-server-api/#mroommember\n */\nexport type Membership = KnownMembership | string;\n"],
+  "mappings": ";;;;;AAAA;AA2KA,IAAYA,2BAAwB,0BAAxBA,2BAAwB;AAAxBA,EAAAA,0BAAwB,QAAA,IAAA;AAAA,SAAxBA;AAAwB,GAAA,CAAA,CAAA;AAmBpC,IAAYC,oBAAiB,0BAAjBA,oBAAiB;AAAjBA,EAAAA,mBAAAA,mBAAiB,QAAA,IAAA,CAAA,IAAA;AAAjBA,EAAAA,mBAAAA,mBAAiB,WAAA,IAAA,CAAA,IAAA;AAAjBA,EAAAA,mBAAAA,mBAAiB,OAAA,IAAA,CAAA,IAAA;AAAjBA,EAAAA,mBAAAA,mBAAiB,SAAA,IAAA,CAAA,IAAA;AAAjBA,EAAAA,mBAAAA,mBAAiB,WAAA,IAAA,CAAA,IAAA;AAAjBA,EAAAA,mBAAAA,mBAAiB,MAAA,IAAA,CAAA,IAAA;AAAA,SAAjBA;AAAiB,GAAA,CAAA,CAAA;AA2F7B,IAAYC,gBAAa,0BAAbA,gBAAa;AAAbA,EAAAA,eAAa,QAAA,IAAA;AAAbA,EAAAA,eAAa,SAAA,IAAA;AAAbA,EAAAA,eAAa,mBAAA,IAAA;AAAA,SAAbA;AAAa,GAAA,CAAA,CAAA;;;ACzRzB;AAoBA,IAAYC,kBAAe,0BAAfA,kBAAe;AAAfA,EAAAA,iBAAe,KAAA,IAAA;AAAfA,EAAAA,iBAAe,QAAA,IAAA;AAAfA,EAAAA,iBAAe,MAAA,IAAA;AAAfA,EAAAA,iBAAe,OAAA,IAAA;AAAfA,EAAAA,iBAAe,OAAA,IAAA;AAAA,SAAfA;AAAe,GAAA,CAAA,CAAA;",
+  "names": ["VerificationRequestEvent", "VerificationPhase", "VerifierEvent", "KnownMembership"]
+}

package/dist/chunk-FYRKBNTI.js

@@ -0,0 +1,18 @@
+import {
+  init_shims
+} from "./chunk-7FLQSTPG.js";
+
+// src/matrix/sdk/read-response-with-limit.ts
+init_shims();
+import { readResponseWithLimit as readSharedResponseWithLimit } from "openclaw/plugin-sdk/media-runtime";
+async function readResponseWithLimit(res, maxBytes, opts) {
+  return await readSharedResponseWithLimit(res, maxBytes, {
+    ...opts,
+    onIdleTimeout: opts?.onIdleTimeout ?? (({ chunkTimeoutMs }) => new Error(`Matrix media download stalled: no data received for ${chunkTimeoutMs}ms`))
+  });
+}
+
+export {
+  readResponseWithLimit
+};
+//# sourceMappingURL=chunk-FYRKBNTI.js.map

package/dist/chunk-FYRKBNTI.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/sdk/read-response-with-limit.ts"],
+  "sourcesContent": ["import { readResponseWithLimit as readSharedResponseWithLimit } from \"openclaw/plugin-sdk/media-runtime\";\n\nexport async function readResponseWithLimit(\n  res: Response,\n  maxBytes: number,\n  opts?: {\n    onOverflow?: (params: { size: number; maxBytes: number; res: Response }) => Error;\n    chunkTimeoutMs?: number;\n    onIdleTimeout?: (params: { chunkTimeoutMs: number }) => Error;\n  },\n): Promise<Buffer> {\n  return await readSharedResponseWithLimit(res, maxBytes, {\n    ...opts,\n    onIdleTimeout:\n      opts?.onIdleTimeout ??\n      (({ chunkTimeoutMs }) =>\n        new Error(`Matrix media download stalled: no data received for ${chunkTimeoutMs}ms`)),\n  });\n}\n"],
+  "mappings": ";;;;;AAAA;AAAA,SAAS,yBAAyB,mCAAmC;AAErE,eAAsB,sBACpB,KACA,UACA,MAKiB;AACjB,SAAO,MAAM,4BAA4B,KAAK,UAAU;AAAA,IACtD,GAAG;AAAA,IACH,eACE,MAAM,kBACL,CAAC,EAAE,eAAe,MACjB,IAAI,MAAM,uDAAuD,cAAc,IAAI;AAAA,EACzF,CAAC;AACH;",
+  "names": []
+}

package/dist/chunk-FYSARMGS.js

@@ -0,0 +1,93 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/migration-snapshot-backup.ts
+init_shims();
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
+import { resolveRequiredHomeDir } from "openclaw/plugin-sdk/provider-auth";
+import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+var MATRIX_MIGRATION_SNAPSHOT_DIRNAME = "openclaw-migrations";
+function loadSnapshotMarker(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) {
+      return null;
+    }
+    const parsed = JSON.parse(
+      fs.readFileSync(filePath, "utf8")
+    );
+    if (parsed.version !== 1 || typeof parsed.createdAt !== "string" || typeof parsed.archivePath !== "string" || typeof parsed.trigger !== "string") {
+      return null;
+    }
+    return {
+      version: 1,
+      createdAt: parsed.createdAt,
+      archivePath: parsed.archivePath,
+      trigger: parsed.trigger,
+      includeWorkspace: parsed.includeWorkspace === true
+    };
+  } catch {
+    return null;
+  }
+}
+function resolveMatrixMigrationSnapshotMarkerPath(env = process.env) {
+  const stateDir = resolveStateDir(env, os.homedir);
+  return path.join(stateDir, "matrix", "migration-snapshot.json");
+}
+function resolveMatrixMigrationSnapshotOutputDir(env = process.env) {
+  const homeDir = resolveRequiredHomeDir(env, os.homedir);
+  return path.join(homeDir, "Backups", MATRIX_MIGRATION_SNAPSHOT_DIRNAME);
+}
+async function maybeCreateMatrixMigrationSnapshot(params) {
+  const env = params.env ?? process.env;
+  const createBackupArchive = params.createBackupArchive ?? (await import("openclaw/plugin-sdk/runtime")).createBackupArchive;
+  const markerPath = resolveMatrixMigrationSnapshotMarkerPath(env);
+  const existingMarker = loadSnapshotMarker(markerPath);
+  if (existingMarker?.archivePath && fs.existsSync(existingMarker.archivePath)) {
+    params.log?.info?.(
+      `matrix: reusing existing pre-migration backup snapshot: ${existingMarker.archivePath}`
+    );
+    return {
+      created: false,
+      archivePath: existingMarker.archivePath,
+      markerPath
+    };
+  }
+  if (existingMarker?.archivePath && !fs.existsSync(existingMarker.archivePath)) {
+    params.log?.warn?.(
+      `matrix: previous migration snapshot is missing (${existingMarker.archivePath}); creating a replacement backup before continuing`
+    );
+  }
+  const snapshot = await createBackupArchive({
+    output: (() => {
+      const outputDir = params.outputDir ?? resolveMatrixMigrationSnapshotOutputDir(env);
+      fs.mkdirSync(outputDir, { recursive: true });
+      return outputDir;
+    })(),
+    includeWorkspace: false
+  });
+  const marker = {
+    version: 1,
+    createdAt: snapshot.createdAt,
+    archivePath: snapshot.archivePath,
+    trigger: params.trigger,
+    includeWorkspace: snapshot.includeWorkspace
+  };
+  await writeJsonFileAtomically(markerPath, marker);
+  params.log?.info?.(`matrix: created pre-migration backup snapshot: ${snapshot.archivePath}`);
+  return {
+    created: true,
+    archivePath: snapshot.archivePath,
+    markerPath
+  };
+}
+
+export {
+  resolveMatrixMigrationSnapshotMarkerPath,
+  resolveMatrixMigrationSnapshotOutputDir,
+  maybeCreateMatrixMigrationSnapshot
+};
+//# sourceMappingURL=chunk-FYSARMGS.js.map

package/dist/chunk-FYSARMGS.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/migration-snapshot-backup.ts"],
+  "sourcesContent": ["import fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { writeJsonFileAtomically } from \"openclaw/plugin-sdk/json-store\";\nimport { resolveRequiredHomeDir } from \"openclaw/plugin-sdk/provider-auth\";\nimport { resolveStateDir } from \"openclaw/plugin-sdk/state-paths\";\n\nconst MATRIX_MIGRATION_SNAPSHOT_DIRNAME = \"openclaw-migrations\";\n\ntype MatrixMigrationSnapshotMarker = {\n  version: 1;\n  createdAt: string;\n  archivePath: string;\n  trigger: string;\n  includeWorkspace: boolean;\n};\n\nexport type MatrixMigrationSnapshotResult = {\n  created: boolean;\n  archivePath: string;\n  markerPath: string;\n};\n\nfunction loadSnapshotMarker(filePath: string): MatrixMigrationSnapshotMarker | null {\n  try {\n    if (!fs.existsSync(filePath)) {\n      return null;\n    }\n    const parsed = JSON.parse(\n      fs.readFileSync(filePath, \"utf8\"),\n    ) as Partial<MatrixMigrationSnapshotMarker>;\n    if (\n      parsed.version !== 1 ||\n      typeof parsed.createdAt !== \"string\" ||\n      typeof parsed.archivePath !== \"string\" ||\n      typeof parsed.trigger !== \"string\"\n    ) {\n      return null;\n    }\n    return {\n      version: 1,\n      createdAt: parsed.createdAt,\n      archivePath: parsed.archivePath,\n      trigger: parsed.trigger,\n      includeWorkspace: parsed.includeWorkspace === true,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function resolveMatrixMigrationSnapshotMarkerPath(\n  env: NodeJS.ProcessEnv = process.env,\n): string {\n  const stateDir = resolveStateDir(env, os.homedir);\n  return path.join(stateDir, \"matrix\", \"migration-snapshot.json\");\n}\n\nexport function resolveMatrixMigrationSnapshotOutputDir(\n  env: NodeJS.ProcessEnv = process.env,\n): string {\n  const homeDir = resolveRequiredHomeDir(env, os.homedir);\n  return path.join(homeDir, \"Backups\", MATRIX_MIGRATION_SNAPSHOT_DIRNAME);\n}\n\nexport async function maybeCreateMatrixMigrationSnapshot(params: {\n  trigger: string;\n  env?: NodeJS.ProcessEnv;\n  outputDir?: string;\n  createBackupArchive?: typeof import(\"openclaw/plugin-sdk/runtime\").createBackupArchive;\n  log?: { info?: (message: string) => void; warn?: (message: string) => void };\n}): Promise<MatrixMigrationSnapshotResult> {\n  const env = params.env ?? process.env;\n  const createBackupArchive =\n    params.createBackupArchive ?? (await import(\"openclaw/plugin-sdk/runtime\")).createBackupArchive;\n  const markerPath = resolveMatrixMigrationSnapshotMarkerPath(env);\n  const existingMarker = loadSnapshotMarker(markerPath);\n  if (existingMarker?.archivePath && fs.existsSync(existingMarker.archivePath)) {\n    params.log?.info?.(\n      `matrix: reusing existing pre-migration backup snapshot: ${existingMarker.archivePath}`,\n    );\n    return {\n      created: false,\n      archivePath: existingMarker.archivePath,\n      markerPath,\n    };\n  }\n  if (existingMarker?.archivePath && !fs.existsSync(existingMarker.archivePath)) {\n    params.log?.warn?.(\n      `matrix: previous migration snapshot is missing (${existingMarker.archivePath}); creating a replacement backup before continuing`,\n    );\n  }\n\n  const snapshot = await createBackupArchive({\n    output: (() => {\n      const outputDir = params.outputDir ?? resolveMatrixMigrationSnapshotOutputDir(env);\n      fs.mkdirSync(outputDir, { recursive: true });\n      return outputDir;\n    })(),\n    includeWorkspace: false,\n  });\n\n  const marker: MatrixMigrationSnapshotMarker = {\n    version: 1,\n    createdAt: snapshot.createdAt,\n    archivePath: snapshot.archivePath,\n    trigger: params.trigger,\n    includeWorkspace: snapshot.includeWorkspace,\n  };\n  await writeJsonFileAtomically(markerPath, marker);\n  params.log?.info?.(`matrix: created pre-migration backup snapshot: ${snapshot.archivePath}`);\n  return {\n    created: true,\n    archivePath: snapshot.archivePath,\n    markerPath,\n  };\n}\n"],
+  "mappings": ";;;;;AAAA;AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAEhC,IAAM,oCAAoC;AAgB1C,SAAS,mBAAmB,UAAwD;AAClF,MAAI;AACF,QAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,SAAS,KAAK;AAAA,MAClB,GAAG,aAAa,UAAU,MAAM;AAAA,IAClC;AACA,QACE,OAAO,YAAY,KACnB,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,YAAY,UAC1B;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,SAAS,OAAO;AAAA,MAChB,kBAAkB,OAAO,qBAAqB;AAAA,IAChD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yCACd,MAAyB,QAAQ,KACzB;AACR,QAAM,WAAW,gBAAgB,KAAK,GAAG,OAAO;AAChD,SAAO,KAAK,KAAK,UAAU,UAAU,yBAAyB;AAChE;AAEO,SAAS,wCACd,MAAyB,QAAQ,KACzB;AACR,QAAM,UAAU,uBAAuB,KAAK,GAAG,OAAO;AACtD,SAAO,KAAK,KAAK,SAAS,WAAW,iCAAiC;AACxE;AAEA,eAAsB,mCAAmC,QAMd;AACzC,QAAM,MAAM,OAAO,OAAO,QAAQ;AAClC,QAAM,sBACJ,OAAO,wBAAwB,MAAM,OAAO,6BAA6B,GAAG;AAC9E,QAAM,aAAa,yCAAyC,GAAG;AAC/D,QAAM,iBAAiB,mBAAmB,UAAU;AACpD,MAAI,gBAAgB,eAAe,GAAG,WAAW,eAAe,WAAW,GAAG;AAC5E,WAAO,KAAK;AAAA,MACV,2DAA2D,eAAe,WAAW;AAAA,IACvF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,eAAe;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,eAAe,CAAC,GAAG,WAAW,eAAe,WAAW,GAAG;AAC7E,WAAO,KAAK;AAAA,MACV,mDAAmD,eAAe,WAAW;AAAA,IAC/E;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,oBAAoB;AAAA,IACzC,SAAS,MAAM;AACb,YAAM,YAAY,OAAO,aAAa,wCAAwC,GAAG;AACjF,SAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,aAAO;AAAA,IACT,GAAG;AAAA,IACH,kBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,SAAwC;AAAA,IAC5C,SAAS;AAAA,IACT,WAAW,SAAS;AAAA,IACpB,aAAa,SAAS;AAAA,IACtB,SAAS,OAAO;AAAA,IAChB,kBAAkB,SAAS;AAAA,EAC7B;AACA,QAAM,wBAAwB,YAAY,MAAM;AAChD,SAAO,KAAK,OAAO,kDAAkD,SAAS,WAAW,EAAE;AAC3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,aAAa,SAAS;AAAA,IACtB;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/chunk-FZJOJ6P4.js

@@ -0,0 +1,28 @@
+import {
+  init_shims
+} from "./chunk-G4TIS2SC.js";
+
+// src/matrix/client/config-runtime-api.ts
+init_shims();
+import {
+  DEFAULT_ACCOUNT_ID,
+  normalizeAccountId,
+  normalizeOptionalAccountId
+} from "openclaw/plugin-sdk/account-id";
+import {
+  assertHttpUrlTargetsPrivateNetwork,
+  isPrivateNetworkOptInEnabled,
+  ssrfPolicyFromDangerouslyAllowPrivateNetwork,
+  ssrfPolicyFromAllowPrivateNetwork
+} from "openclaw/plugin-sdk/ssrf-runtime";
+
+export {
+  DEFAULT_ACCOUNT_ID,
+  normalizeAccountId,
+  normalizeOptionalAccountId,
+  assertHttpUrlTargetsPrivateNetwork,
+  isPrivateNetworkOptInEnabled,
+  ssrfPolicyFromDangerouslyAllowPrivateNetwork,
+  ssrfPolicyFromAllowPrivateNetwork
+};
+//# sourceMappingURL=chunk-FZJOJ6P4.js.map

package/dist/chunk-FZJOJ6P4.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/matrix/client/config-runtime-api.ts"],
+  "sourcesContent": ["export {\n  DEFAULT_ACCOUNT_ID,\n  normalizeAccountId,\n  normalizeOptionalAccountId,\n} from \"openclaw/plugin-sdk/account-id\";\nexport { isPrivateOrLoopbackHost } from \"./private-network-host.js\";\nexport {\n  assertHttpUrlTargetsPrivateNetwork,\n  isPrivateNetworkOptInEnabled,\n  ssrfPolicyFromDangerouslyAllowPrivateNetwork,\n  ssrfPolicyFromAllowPrivateNetwork,\n  type LookupFn,\n  type SsrFPolicy,\n} from \"openclaw/plugin-sdk/ssrf-runtime\";\n"],
+  "mappings": ";;;;;AAAA;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;",
+  "names": []
+}