@archipelagolab/lobi 1.0.6 → 1.0.7

package/src/resolve-targets.test.ts

@@ -0,0 +1,178 @@
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import type { ChannelDirectoryEntry } from "../runtime-api.js";
+
+vi.mock("./directory-live.js", () => ({
+  listMatrixDirectoryPeersLive: vi.fn(),
+  listMatrixDirectoryGroupsLive: vi.fn(),
+}));
+
+let listMatrixDirectoryGroupsLive: typeof import("./directory-live.js").listMatrixDirectoryGroupsLive;
+let listMatrixDirectoryPeersLive: typeof import("./directory-live.js").listMatrixDirectoryPeersLive;
+let resolveMatrixTargets: typeof import("./resolve-targets.js").resolveMatrixTargets;
+
+async function resolveUserTarget(input = "Alice") {
+  const [result] = await resolveMatrixTargets({
+    cfg: {},
+    inputs: [input],
+    kind: "user",
+  });
+  return result;
+}
+
+describe("resolveMatrixTargets (users)", () => {
+  beforeAll(async () => {
+    ({ listMatrixDirectoryGroupsLive, listMatrixDirectoryPeersLive } =
+      await import("./directory-live.js"));
+    ({ resolveMatrixTargets } = await import("./resolve-targets.js"));
+  });
+
+  beforeEach(() => {
+    vi.mocked(listMatrixDirectoryPeersLive).mockReset();
+    vi.mocked(listMatrixDirectoryGroupsLive).mockReset();
+  });
+
+  it("resolves exact unique display name matches", async () => {
+    const matches: ChannelDirectoryEntry[] = [
+      { kind: "user", id: "@alice:example.org", name: "Alice" },
+    ];
+    vi.mocked(listMatrixDirectoryPeersLive).mockResolvedValue(matches);
+
+    const result = await resolveUserTarget();
+
+    expect(result?.resolved).toBe(true);
+    expect(result?.id).toBe("@alice:example.org");
+    expect(listMatrixDirectoryPeersLive).toHaveBeenCalledWith({
+      cfg: {},
+      accountId: undefined,
+      query: "Alice",
+      limit: 5,
+    });
+  });
+
+  it("does not resolve ambiguous or non-exact matches", async () => {
+    const matches: ChannelDirectoryEntry[] = [
+      { kind: "user", id: "@alice:example.org", name: "Alice" },
+      { kind: "user", id: "@alice:evil.example", name: "Alice" },
+    ];
+    vi.mocked(listMatrixDirectoryPeersLive).mockResolvedValue(matches);
+
+    const result = await resolveUserTarget();
+
+    expect(result?.resolved).toBe(false);
+    expect(result?.note).toMatch(/use full Matrix ID/i);
+  });
+
+  it("prefers exact group matches over first partial result", async () => {
+    const matches: ChannelDirectoryEntry[] = [
+      { kind: "group", id: "!one:example.org", name: "General", handle: "#general" },
+      { kind: "group", id: "!two:example.org", name: "Team", handle: "#team" },
+    ];
+    vi.mocked(listMatrixDirectoryGroupsLive).mockResolvedValue(matches);
+
+    const [result] = await resolveMatrixTargets({
+      cfg: {},
+      inputs: ["#team"],
+      kind: "group",
+    });
+
+    expect(result?.resolved).toBe(true);
+    expect(result?.id).toBe("!two:example.org");
+    expect(result?.note).toBeUndefined();
+    expect(listMatrixDirectoryGroupsLive).toHaveBeenCalledWith({
+      cfg: {},
+      accountId: undefined,
+      query: "#team",
+      limit: 5,
+    });
+  });
+
+  it("threads accountId into live Matrix target lookups", async () => {
+    vi.mocked(listMatrixDirectoryPeersLive).mockResolvedValue([
+      { kind: "user", id: "@alice:example.org", name: "Alice" },
+    ]);
+    vi.mocked(listMatrixDirectoryGroupsLive).mockResolvedValue([
+      { kind: "group", id: "!team:example.org", name: "Team", handle: "#team" },
+    ]);
+
+    await resolveMatrixTargets({
+      cfg: {},
+      accountId: "ops",
+      inputs: ["Alice"],
+      kind: "user",
+    });
+    await resolveMatrixTargets({
+      cfg: {},
+      accountId: "ops",
+      inputs: ["#team"],
+      kind: "group",
+    });
+
+    expect(listMatrixDirectoryPeersLive).toHaveBeenCalledWith({
+      cfg: {},
+      accountId: "ops",
+      query: "Alice",
+      limit: 5,
+    });
+    expect(listMatrixDirectoryGroupsLive).toHaveBeenCalledWith({
+      cfg: {},
+      accountId: "ops",
+      query: "#team",
+      limit: 5,
+    });
+  });
+
+  it("reuses directory lookups for normalized duplicate inputs", async () => {
+    vi.mocked(listMatrixDirectoryPeersLive).mockResolvedValue([
+      { kind: "user", id: "@alice:example.org", name: "Alice" },
+    ]);
+    vi.mocked(listMatrixDirectoryGroupsLive).mockResolvedValue([
+      { kind: "group", id: "!team:example.org", name: "Team", handle: "#team" },
+    ]);
+
+    const userResults = await resolveMatrixTargets({
+      cfg: {},
+      inputs: ["Alice", " alice "],
+      kind: "user",
+    });
+    const groupResults = await resolveMatrixTargets({
+      cfg: {},
+      inputs: ["#team", "#team"],
+      kind: "group",
+    });
+
+    expect(userResults.every((entry) => entry.resolved)).toBe(true);
+    expect(groupResults.every((entry) => entry.resolved)).toBe(true);
+    expect(listMatrixDirectoryPeersLive).toHaveBeenCalledTimes(1);
+    expect(listMatrixDirectoryGroupsLive).toHaveBeenCalledTimes(1);
+  });
+
+  it("accepts prefixed fully qualified ids without directory lookups", async () => {
+    const userResults = await resolveMatrixTargets({
+      cfg: {},
+      inputs: ["matrix:user:@alice:example.org"],
+      kind: "user",
+    });
+    const groupResults = await resolveMatrixTargets({
+      cfg: {},
+      inputs: ["matrix:room:!team:example.org"],
+      kind: "group",
+    });
+
+    expect(userResults).toEqual([
+      {
+        input: "matrix:user:@alice:example.org",
+        resolved: true,
+        id: "@alice:example.org",
+      },
+    ]);
+    expect(groupResults).toEqual([
+      {
+        input: "matrix:room:!team:example.org",
+        resolved: true,
+        id: "!team:example.org",
+      },
+    ]);
+    expect(listMatrixDirectoryPeersLive).not.toHaveBeenCalled();
+    expect(listMatrixDirectoryGroupsLive).not.toHaveBeenCalled();
+  });
+});

package/src/resolve-targets.ts

@@ -0,0 +1,175 @@
+import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime";
+import { listMatrixDirectoryGroupsLive, listMatrixDirectoryPeersLive } from "./directory-live.js";
+import { isMatrixQualifiedUserId, normalizeMatrixMessagingTarget } from "./matrix/target-ids.js";
+import type {
+  ChannelDirectoryEntry,
+  ChannelResolveKind,
+  ChannelResolveResult,
+  RuntimeEnv,
+} from "./runtime-api.js";
+
+function normalizeLookupQuery(query: string): string {
+  return normalizeOptionalLowercaseString(query) ?? "";
+}
+
+function findExactDirectoryMatches(
+  matches: ChannelDirectoryEntry[],
+  query: string,
+): ChannelDirectoryEntry[] {
+  const normalized = normalizeLookupQuery(query);
+  if (!normalized) {
+    return [];
+  }
+  return matches.filter((match) => {
+    const id = normalizeOptionalLowercaseString(match.id);
+    const name = normalizeOptionalLowercaseString(match.name);
+    const handle = normalizeOptionalLowercaseString(match.handle);
+    return normalized === id || normalized === name || normalized === handle;
+  });
+}
+
+function pickBestGroupMatch(
+  matches: ChannelDirectoryEntry[],
+  query: string,
+): { best?: ChannelDirectoryEntry; note?: string } {
+  if (matches.length === 0) {
+    return {};
+  }
+  const exact = findExactDirectoryMatches(matches, query);
+  if (exact.length > 1) {
+    return { best: exact[0], note: "multiple exact matches; chose first" };
+  }
+  if (exact.length === 1) {
+    return { best: exact[0] };
+  }
+  return {
+    best: matches[0],
+    note: matches.length > 1 ? "multiple matches; chose first" : undefined,
+  };
+}
+
+function pickBestUserMatch(
+  matches: ChannelDirectoryEntry[],
+  query: string,
+): ChannelDirectoryEntry | undefined {
+  if (matches.length === 0) {
+    return undefined;
+  }
+  const exact = findExactDirectoryMatches(matches, query);
+  if (exact.length === 1) {
+    return exact[0];
+  }
+  return undefined;
+}
+
+function describeUserMatchFailure(matches: ChannelDirectoryEntry[], query: string): string {
+  if (matches.length === 0) {
+    return "no matches";
+  }
+  const normalized = normalizeLookupQuery(query);
+  if (!normalized) {
+    return "empty input";
+  }
+  const exact = findExactDirectoryMatches(matches, normalized);
+  if (exact.length === 0) {
+    return "no exact match; use full Matrix ID";
+  }
+  if (exact.length > 1) {
+    return "multiple exact matches; use full Matrix ID";
+  }
+  return "no exact match; use full Matrix ID";
+}
+
+async function readCachedMatches(
+  cache: Map<string, ChannelDirectoryEntry[]>,
+  query: string,
+  lookup: (query: string) => Promise<ChannelDirectoryEntry[]>,
+): Promise<ChannelDirectoryEntry[]> {
+  const key = normalizeLookupQuery(query);
+  if (!key) {
+    return [];
+  }
+  const cached = cache.get(key);
+  if (cached) {
+    return cached;
+  }
+  const matches = await lookup(query.trim());
+  cache.set(key, matches);
+  return matches;
+}
+
+export async function resolveMatrixTargets(params: {
+  cfg: unknown;
+  accountId?: string | null;
+  inputs: string[];
+  kind: ChannelResolveKind;
+  runtime?: RuntimeEnv;
+}): Promise<ChannelResolveResult[]> {
+  const results: ChannelResolveResult[] = [];
+  const userLookupCache = new Map<string, ChannelDirectoryEntry[]>();
+  const groupLookupCache = new Map<string, ChannelDirectoryEntry[]>();
+
+  for (const input of params.inputs) {
+    const trimmed = input.trim();
+    if (!trimmed) {
+      results.push({ input, resolved: false, note: "empty input" });
+      continue;
+    }
+    if (params.kind === "user") {
+      const normalizedTarget = normalizeMatrixMessagingTarget(trimmed);
+      if (normalizedTarget && isMatrixQualifiedUserId(normalizedTarget)) {
+        results.push({ input, resolved: true, id: normalizedTarget });
+        continue;
+      }
+      try {
+        const matches = await readCachedMatches(userLookupCache, trimmed, (query) =>
+          listMatrixDirectoryPeersLive({
+            cfg: params.cfg,
+            accountId: params.accountId,
+            query,
+            limit: 5,
+          }),
+        );
+        const best = pickBestUserMatch(matches, trimmed);
+        results.push({
+          input,
+          resolved: Boolean(best?.id),
+          id: best?.id,
+          name: best?.name,
+          note: best ? undefined : describeUserMatchFailure(matches, trimmed),
+        });
+      } catch (err) {
+        params.runtime?.error?.(`matrix resolve failed: ${String(err)}`);
+        results.push({ input, resolved: false, note: "lookup failed" });
+      }
+      continue;
+    }
+    const normalizedTarget = normalizeMatrixMessagingTarget(trimmed);
+    if (normalizedTarget?.startsWith("!")) {
+      results.push({ input, resolved: true, id: normalizedTarget });
+      continue;
+    }
+    try {
+      const matches = await readCachedMatches(groupLookupCache, trimmed, (query) =>
+        listMatrixDirectoryGroupsLive({
+          cfg: params.cfg,
+          accountId: params.accountId,
+          query,
+          limit: 5,
+        }),
+      );
+      const { best, note } = pickBestGroupMatch(matches, trimmed);
+      results.push({
+        input,
+        resolved: Boolean(best?.id),
+        id: best?.id,
+        name: best?.name,
+        note,
+      });
+    } catch (err) {
+      params.runtime?.error?.(`matrix resolve failed: ${String(err)}`);
+      results.push({ input, resolved: false, note: "lookup failed" });
+    }
+  }
+  return results;
+}

package/src/resolver.ts

@@ -0,0 +1,21 @@
+import type { ChannelPlugin } from "openclaw/plugin-sdk/channel-core";
+import { createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
+import type { ResolvedMatrixAccount } from "./matrix/accounts.js";
+
+const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(
+  () => import("./channel.runtime.js"),
+  "matrixChannelRuntime",
+);
+
+type MatrixResolver = NonNullable<ChannelPlugin<ResolvedMatrixAccount>["resolver"]>;
+
+export const matrixResolverAdapter: MatrixResolver = {
+  resolveTargets: async ({ cfg, accountId, inputs, kind, runtime }) =>
+    (await loadMatrixChannelRuntime()).resolveMatrixTargets({
+      cfg,
+      accountId,
+      inputs,
+      kind,
+      runtime,
+    }),
+};

package/src/runtime-api.ts

@@ -0,0 +1,144 @@
+export {
+  DEFAULT_ACCOUNT_ID,
+  normalizeAccountId,
+  normalizeOptionalAccountId,
+} from "openclaw/plugin-sdk/account-id";
+export {
+  createActionGate,
+  jsonResult,
+  readNumberParam,
+  readReactionParams,
+  readStringArrayParam,
+  readStringParam,
+  ToolAuthorizationError,
+} from "openclaw/plugin-sdk/channel-actions";
+export { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-primitives";
+export type { ChannelPlugin } from "openclaw/plugin-sdk/channel-core";
+export type {
+  BaseProbeResult,
+  ChannelDirectoryEntry,
+  ChannelGroupContext,
+  ChannelMessageActionAdapter,
+  ChannelMessageActionContext,
+  ChannelMessageActionName,
+  ChannelMessageToolDiscovery,
+  ChannelOutboundAdapter,
+  ChannelResolveKind,
+  ChannelResolveResult,
+  ChannelToolSend,
+} from "openclaw/plugin-sdk/channel-contract";
+export {
+  formatLocationText,
+  logInboundDrop,
+  toLocationContext,
+  type NormalizedLocation,
+} from "openclaw/plugin-sdk/channel-inbound";
+export { resolveAckReaction, logTypingFailure } from "openclaw/plugin-sdk/channel-feedback";
+export type { ChannelSetupInput } from "openclaw/plugin-sdk/setup";
+export type {
+  OpenClawConfig,
+  ContextVisibilityMode,
+  DmPolicy,
+  GroupPolicy,
+} from "openclaw/plugin-sdk/config-runtime";
+export type { GroupToolPolicyConfig } from "openclaw/plugin-sdk/config-runtime";
+export type { WizardPrompter } from "openclaw/plugin-sdk/matrix-runtime-shared";
+export type { SecretInput } from "openclaw/plugin-sdk/secret-input";
+export {
+  GROUP_POLICY_BLOCKED_LABEL,
+  resolveAllowlistProviderRuntimeGroupPolicy,
+  resolveDefaultGroupPolicy,
+  warnMissingProviderGroupPolicyFallbackOnce,
+} from "openclaw/plugin-sdk/config-runtime";
+export {
+  addWildcardAllowFrom,
+  formatDocsLink,
+  hasConfiguredSecretInput,
+  mergeAllowFromEntries,
+  moveSingleAccountChannelSectionToDefaultAccount,
+  promptAccountId,
+  promptChannelAccessConfig,
+  splitSetupEntries,
+} from "openclaw/plugin-sdk/setup";
+export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+export {
+  assertHttpUrlTargetsPrivateNetwork,
+  closeDispatcher,
+  createPinnedDispatcher,
+  isPrivateOrLoopbackHost,
+  resolvePinnedHostnameWithPolicy,
+  ssrfPolicyFromDangerouslyAllowPrivateNetwork,
+  ssrfPolicyFromAllowPrivateNetwork,
+  type LookupFn,
+  type SsrFPolicy,
+} from "openclaw/plugin-sdk/ssrf-runtime";
+export { dispatchReplyFromConfigWithSettledDispatcher } from "openclaw/plugin-sdk/inbound-reply-dispatch";
+export {
+  ensureConfiguredAcpBindingReady,
+  resolveConfiguredAcpBindingRecord,
+} from "openclaw/plugin-sdk/acp-binding-runtime";
+export {
+  buildProbeChannelStatusSummary,
+  collectStatusIssuesFromLastError,
+  PAIRING_APPROVED_MESSAGE,
+} from "openclaw/plugin-sdk/channel-status";
+export {
+  getSessionBindingService,
+  resolveThreadBindingIdleTimeoutMsForChannel,
+  resolveThreadBindingMaxAgeMsForChannel,
+} from "openclaw/plugin-sdk/conversation-runtime";
+export { resolveOutboundSendDep } from "openclaw/plugin-sdk/outbound-runtime";
+export { resolveAgentIdFromSessionKey } from "openclaw/plugin-sdk/routing";
+export { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
+export { createChannelReplyPipeline } from "openclaw/plugin-sdk/channel-reply-pipeline";
+export { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
+export { normalizePollInput, type PollInput } from "openclaw/plugin-sdk/media-runtime";
+export { writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
+export {
+  buildChannelKeyCandidates,
+  resolveChannelEntryMatch,
+} from "openclaw/plugin-sdk/channel-targets";
+export {
+  evaluateGroupRouteAccessForPolicy,
+  resolveSenderScopedGroupPolicy,
+} from "openclaw/plugin-sdk/channel-policy";
+export {
+  formatZonedTimestamp,
+  type PluginRuntime,
+  type RuntimeLogger,
+} from "openclaw/plugin-sdk/matrix-runtime-shared";
+export type { ReplyPayload } from "openclaw/plugin-sdk/reply-runtime";
+// resolveMatrixAccountStringValues already comes from plugin-sdk/matrix.
+// Re-exporting auth-precedence here makes Jiti try to define the same export twice.
+
+export function buildTimeoutAbortSignal(params: { timeoutMs?: number; signal?: AbortSignal }): {
+  signal?: AbortSignal;
+  cleanup: () => void;
+} {
+  const { timeoutMs, signal } = params;
+  if (!timeoutMs && !signal) {
+    return { signal: undefined, cleanup: () => {} };
+  }
+  if (!timeoutMs) {
+    return { signal, cleanup: () => {} };
+  }
+
+  const controller = new AbortController();
+  const timeoutId = setTimeout(controller.abort.bind(controller), timeoutMs);
+  const onAbort = () => controller.abort();
+  if (signal) {
+    if (signal.aborted) {
+      controller.abort();
+    } else {
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+  }
+
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timeoutId);
+      signal?.removeEventListener("abort", onAbort);
+    },
+  };
+}

package/src/runtime.ts

@@ -0,0 +1,7 @@
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+import type { PluginRuntime } from "./runtime-api.js";
+
+const { setRuntime: setMatrixRuntime, getRuntime: getMatrixRuntime } =
+  createPluginRuntimeStore<PluginRuntime>("Matrix runtime not initialized");
+
+export { getMatrixRuntime, setMatrixRuntime };

package/src/secret-contract.ts

@@ -0,0 +1,174 @@
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import {
+  collectSecretInputAssignment,
+  getChannelSurface,
+  hasConfiguredSecretInputValue,
+  hasOwnProperty,
+  normalizeSecretStringValue,
+  type ResolverContext,
+  type SecretDefaults,
+  type SecretTargetRegistryEntry,
+} from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+import { getMatrixScopedEnvVarNames } from "./env-vars.js";
+
+export const secretTargetRegistryEntries = [
+  {
+    id: "channels.lobi.accounts.*.accessToken",
+    targetType: "channels.lobi.accounts.*.accessToken",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.accounts.*.accessToken",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true,
+  },
+  {
+    id: "channels.lobi.accounts.*.password",
+    targetType: "channels.lobi.accounts.*.password",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.accounts.*.password",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true,
+  },
+  {
+    id: "channels.lobi.accessToken",
+    targetType: "channels.lobi.accessToken",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.accessToken",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true,
+  },
+  {
+    id: "channels.lobi.password",
+    targetType: "channels.lobi.password",
+    configFile: "openclaw.json",
+    pathPattern: "channels.lobi.password",
+    secretShape: "secret_input",
+    expectedResolvedValue: "string",
+    includeInPlan: true,
+    includeInConfigure: true,
+    includeInAudit: true,
+  },
+] satisfies SecretTargetRegistryEntry[];
+
+export function collectRuntimeConfigAssignments(params: {
+  config: { channels?: Record<string, unknown> };
+  defaults?: SecretDefaults;
+  context: ResolverContext;
+}): void {
+  const resolved = getChannelSurface(params.config, "matrix");
+  if (!resolved) {
+    return;
+  }
+  const { channel: matrix, surface } = resolved;
+  const envAccessTokenConfigured =
+    normalizeSecretStringValue(params.context.env.MATRIX_ACCESS_TOKEN).length > 0;
+  const defaultScopedAccessTokenConfigured =
+    normalizeSecretStringValue(
+      params.context.env[getMatrixScopedEnvVarNames("default").accessToken],
+    ).length > 0;
+  const defaultAccountAccessTokenConfigured = surface.accounts.some(
+    ({ accountId, account }) =>
+      normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID &&
+      hasConfiguredSecretInputValue(account.accessToken, params.defaults),
+  );
+  const baseAccessTokenConfigured = hasConfiguredSecretInputValue(
+    matrix.accessToken,
+    params.defaults,
+  );
+  collectSecretInputAssignment({
+    value: matrix.accessToken,
+    path: "channels.lobi.accessToken",
+    expected: "string",
+    defaults: params.defaults,
+    context: params.context,
+    active: surface.channelEnabled,
+    inactiveReason: "Matrix channel is disabled.",
+    apply: (value) => {
+      matrix.accessToken = value;
+    },
+  });
+  collectSecretInputAssignment({
+    value: matrix.password,
+    path: "channels.lobi.password",
+    expected: "string",
+    defaults: params.defaults,
+    context: params.context,
+    active:
+      surface.channelEnabled &&
+      !(
+        baseAccessTokenConfigured ||
+        envAccessTokenConfigured ||
+        defaultScopedAccessTokenConfigured ||
+        defaultAccountAccessTokenConfigured
+      ),
+    inactiveReason:
+      "Matrix channel is disabled or access-token auth is configured for the default Matrix account.",
+    apply: (value) => {
+      matrix.password = value;
+    },
+  });
+  if (!surface.hasExplicitAccounts) {
+    return;
+  }
+  for (const { accountId, account, enabled } of surface.accounts) {
+    if (hasOwnProperty(account, "accessToken")) {
+      collectSecretInputAssignment({
+        value: account.accessToken,
+        path: `channels.lobi.accounts.${accountId}.accessToken`,
+        expected: "string",
+        defaults: params.defaults,
+        context: params.context,
+        active: enabled,
+        inactiveReason: "Matrix account is disabled.",
+        apply: (value) => {
+          account.accessToken = value;
+        },
+      });
+    }
+    if (!hasOwnProperty(account, "password")) {
+      continue;
+    }
+    const accountAccessTokenConfigured = hasConfiguredSecretInputValue(
+      account.accessToken,
+      params.defaults,
+    );
+    const scopedEnvAccessTokenConfigured =
+      normalizeSecretStringValue(
+        params.context.env[getMatrixScopedEnvVarNames(accountId).accessToken],
+      ).length > 0;
+    const inheritedDefaultAccountAccessTokenConfigured =
+      normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID &&
+      (baseAccessTokenConfigured || envAccessTokenConfigured);
+    collectSecretInputAssignment({
+      value: account.password,
+      path: `channels.lobi.accounts.${accountId}.password`,
+      expected: "string",
+      defaults: params.defaults,
+      context: params.context,
+      active:
+        enabled &&
+        !(
+          accountAccessTokenConfigured ||
+          scopedEnvAccessTokenConfigured ||
+          inheritedDefaultAccountAccessTokenConfigured
+        ),
+      inactiveReason: "Matrix account is disabled or this account has an accessToken configured.",
+      apply: (value) => {
+        account.password = value;
+      },
+    });
+  }
+}
+
+export const channelSecrets = {
+  secretTargetRegistryEntries,
+  collectRuntimeConfigAssignments,
+};