@openclaw/matrix 2026.10.2 → 2026.10.5-beta.2

package/dist/.setup/{sdk-CgQGkCsS.mjs → sdk-Cfc6m7fY.mjs}

@@ -1,31 +1,33 @@
 import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
 import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
-import { r as assertMatrixSupportedStateFile } from "./retired-state-BXUQ2I-C.mjs";
-import { d as writeMatrixRecoveryKeyStateForPathAsync, l as readMatrixRecoveryKeyStateForPathAsync } from "./storage-D7agewjH.mjs";
+import { r as assertMatrixSupportedStateFile } from "./retired-state-DW5pLH05.mjs";
+import { d as writeMatrixRecoveryKeyStateForPathAsync, l as readMatrixRecoveryKeyStateForPathAsync } from "./storage-DkC6bHgA.mjs";
 import { n as withMatrixSendCurrentness, r as withoutMatrixSendCurrentness, t as captureMatrixSendCurrentness } from "./send-currentness-C2rMVVIQ.mjs";
-import { i as parseMxc, r as matrixEventToRaw } from "./event-helpers-CspuhE9k.mjs";
-import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-DKVS3_DO.mjs";
-import { i as createMatrixStartupAbortError, o as throwIfMatrixStartupAborted, r as awaitMatrixStartupWithAbort } from "./client-kmih04ng.mjs";
-import { n as createMatrixGuardedFetch, t as MatrixAuthedHttpClient } from "./http-client-DfJY5Ck0.mjs";
+import { i as parseMxc, r as matrixEventToRaw } from "./event-helpers-CxNgMQqH.mjs";
+import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-Bw4EHwKX.mjs";
+import { i as createMatrixStartupAbortError, o as throwIfMatrixStartupAborted, r as awaitMatrixStartupWithAbort } from "./client-vPPbaxNp.mjs";
+import { n as createMatrixGuardedFetch, t as MatrixAuthedHttpClient } from "./http-client-ByR4STVQ.mjs";
 import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.mjs";
 import { r as noop, t as LogService } from "./logger-CXQnpXCt.mjs";
 import { t as createMatrixJsSdkClientLogger } from "./logging-BKV8TYQq.mjs";
-import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-D7BlioUb.mjs";
+import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-D-xHScuo.mjs";
 import { createRequire } from "node:module";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { normalizeNullableString, normalizeStringEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import path from "node:path";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
+import { raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { captureChannelReadAuthority } from "openclaw/plugin-sdk/fetch-runtime";
+import { captureChannelReadAuthority, withEffectAuthority } from "openclaw/plugin-sdk/fetch-runtime";
 import { ClientEvent, EventType, Filter, MatrixError, MatrixEventEvent, MsgType, Preset, createClient } from "matrix-js-sdk/lib/matrix.js";
 import { EventEmitter } from "node:events";
 import { RoomEvent } from "matrix-js-sdk/lib/models/room.js";
 import { VerificationMethod } from "matrix-js-sdk/lib/types.js";
 import { SyncApi, SyncState } from "matrix-js-sdk/lib/sync.js";
+import { createDeferred as createDeferred$1 } from "openclaw/plugin-sdk/concurrency-runtime";
 import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";
 import { MatrixScheduler } from "matrix-js-sdk/lib/scheduler.js";
 import { EventStatus } from "matrix-js-sdk/lib/models/event-status.js";
@@ -205,79 +207,52 @@ async function waitForMatrixInitialSyncReady(params) {
 	if (isMatrixReadySyncState(params.state)) return;
 	if (isMatrixAccessTokenInvalidatedError(params.error)) throw params.error instanceof Error ? params.error : new Error("Matrix access token invalidated", { cause: params.error });
 	if (isMatrixTerminalSyncState(params.state)) throw new Error(`Matrix sync entered ${params.state} during startup`);
-	await new Promise((resolve, reject) => {
-		let settled = false;
-		let timeoutId;
-		const abortSignal = params.abortSignal;
-		const cleanup = () => {
-			params.emitter.off("sync.state", onSyncState);
-			params.emitter.off("sync.unexpected_error", onUnexpectedError);
-			abortSignal?.removeEventListener("abort", onAbort);
-			if (timeoutId) {
-				clearTimeout(timeoutId);
-				timeoutId = void 0;
-			}
-		};
-		const settle = (error) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			if (error) reject(error);
-			else resolve();
-		};
-		const onSyncState = (state, _prevState, error) => {
-			if (isMatrixReadySyncState(state)) {
-				settle();
-				return;
-			}
-			if (isMatrixAccessTokenInvalidatedError(error)) {
-				settle(error instanceof Error ? error : /* @__PURE__ */ new Error("Matrix access token invalidated"));
-				return;
-			}
-			if (isMatrixTerminalSyncState(state)) settle(new Error(error instanceof Error && error.message ? error.message : `Matrix sync entered ${state} during startup`));
-		};
-		const onUnexpectedError = settle;
-		const onAbort = () => {
-			settle(createMatrixStartupAbortError());
-		};
-		params.emitter.on("sync.state", onSyncState);
-		params.emitter.on("sync.unexpected_error", onUnexpectedError);
-		if (abortSignal?.aborted) {
-			onAbort();
+	const ready = createDeferred$1();
+	const settle = (error) => {
+		if (error) ready.reject(error);
+		else ready.resolve();
+	};
+	const onSyncState = (state, _prevState, error) => {
+		if (isMatrixReadySyncState(state)) {
+			settle();
 			return;
 		}
-		abortSignal?.addEventListener("abort", onAbort, { once: true });
-		timeoutId = setTimeout(() => {
-			settle(/* @__PURE__ */ new Error(`Matrix client did not reach a ready sync state within ${timeoutMs}ms`));
-		}, timeoutMs);
-		timeoutId.unref?.();
-	});
+		if (isMatrixAccessTokenInvalidatedError(error)) {
+			settle(error instanceof Error ? error : /* @__PURE__ */ new Error("Matrix access token invalidated"));
+			return;
+		}
+		if (isMatrixTerminalSyncState(state)) settle(new Error(error instanceof Error && error.message ? error.message : `Matrix sync entered ${state} during startup`));
+	};
+	params.emitter.on("sync.state", onSyncState);
+	params.emitter.on("sync.unexpected_error", settle);
+	try {
+		if (params.abortSignal?.aborted) throw createMatrixStartupAbortError();
+		await raceWithTimeout(ready.promise, timeoutMs, () => {
+			throw new Error(`Matrix client did not reach a ready sync state within ${timeoutMs}ms`);
+		}, {
+			ref: false,
+			signal: params.abortSignal,
+			onAbort: () => {
+				throw createMatrixStartupAbortError();
+			}
+		});
+	} finally {
+		params.emitter.off("sync.state", onSyncState);
+		params.emitter.off("sync.unexpected_error", settle);
+	}
 }
 //#endregion
 //#region extensions/matrix/src/matrix/sdk/idb-persistence-lock.ts
 const MATRIX_IDB_PERSIST_INTERVAL_MS = 6e4;
-const IDB_SNAPSHOT_LOCK_STALE_MS = 3e5;
-const IDB_SNAPSHOT_LOCK_RETRY_BASE = {
-	factor: 2,
-	minTimeout: 50,
-	maxTimeout: 5e3,
-	randomize: true
-};
-function resolveRetriesForMinimumWindowMs(retries, minimumWindowMs) {
-	const resolved = {
-		...retries,
-		retries: 0
-	};
-	let total = 0;
-	while (total < minimumWindowMs) {
-		total += Math.min(retries.maxTimeout, Math.max(retries.minTimeout, retries.minTimeout * retries.factor ** resolved.retries));
-		resolved.retries += 1;
-	}
-	return resolved;
-}
 const MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS = {
-	retries: resolveRetriesForMinimumWindowMs(IDB_SNAPSHOT_LOCK_RETRY_BASE, MATRIX_IDB_PERSIST_INTERVAL_MS),
-	stale: IDB_SNAPSHOT_LOCK_STALE_MS
+	retries: {
+		retries: 18,
+		factor: 2,
+		minTimeout: 50,
+		maxTimeout: 5e3,
+		randomize: true
+	},
+	stale: 3e5
 };
 //#endregion
 //#region extensions/matrix/src/matrix/sdk/live-room-readiness.ts
@@ -459,35 +434,33 @@ var MatrixRecoveryKeyStore = class {
 		this.closed = true;
 		await this.drainPendingPersistence();
 	}
-	buildCryptoCallbacks() {
-		const getSecretStorageKey = ({ keys }) => this.afterPersistence(async () => {
+	readSecretStorageKey(requestedKeys, allowCached) {
+		return this.afterPersistence(async () => {
 			if (this.closed) return null;
-			const requestedKeyIds = Object.keys(keys ?? {});
+			const requestedKeyIds = requestedKeys();
 			if (requestedKeyIds.length === 0) return null;
 			const staged = this.resolveStagedSecretStorageKey(requestedKeyIds);
 			if (staged) return staged;
-			for (const keyId of requestedKeyIds) {
+			if (allowCached) for (const keyId of requestedKeyIds) {
 				const cached = this.secretStorageKeyCache.get(keyId);
 				if (cached) return [keyId, new Uint8Array(cached)];
 			}
 			const pending = this.pendingPersistence;
 			const stored = await this.loadStoredRecoveryKey();
 			if (this.closed) return null;
-			if (pending !== this.pendingPersistence) return getSecretStorageKey({ keys });
+			if (pending !== this.pendingPersistence) return this.readSecretStorageKey(requestedKeys, allowCached);
 			if (!stored?.privateKeyBase64) return null;
 			const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
 			if (privateKey.length === 0) return null;
-			if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
-				this.rememberSecretStorageKey(stored.keyId, privateKey);
-				return [stored.keyId, privateKey];
-			}
-			const firstRequestedKeyId = requestedKeyIds[0];
-			if (!firstRequestedKeyId) return null;
-			this.rememberSecretStorageKey(firstRequestedKeyId, privateKey);
-			return [firstRequestedKeyId, privateKey];
+			const keyId = stored.keyId && requestedKeyIds.includes(stored.keyId) ? stored.keyId : requestedKeyIds[0];
+			if (!keyId) return null;
+			this.rememberSecretStorageKey(keyId, privateKey);
+			return [keyId, privateKey];
 		});
+	}
+	buildCryptoCallbacks() {
 		return {
-			getSecretStorageKey,
+			getSecretStorageKey: ({ keys }, _name) => this.readSecretStorageKey(() => Object.keys(keys ?? {}), true),
 			cacheSecretStorageKey: (keyId, keyInfo, key) => {
 				if (this.closed) return;
 				const privateKey = new Uint8Array(key);
@@ -514,24 +487,12 @@ var MatrixRecoveryKeyStore = class {
 		};
 	}
 	getSecretStorageKeyCandidate(keyId) {
-		return this.afterPersistence(async () => {
-			if (this.closed) return null;
+		return this.readSecretStorageKey(() => {
 			const normalizedKeyId = keyId.trim();
-			if (!normalizedKeyId) return null;
-			const staged = this.resolveStagedSecretStorageKey([normalizedKeyId]);
-			if (staged) return staged[1];
-			const pending = this.pendingPersistence;
-			const stored = await this.loadStoredRecoveryKey();
-			if (this.closed) return null;
-			if (pending !== this.pendingPersistence) return this.getSecretStorageKeyCandidate(keyId);
-			if (!stored?.privateKeyBase64) return null;
-			const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
-			if (privateKey.length === 0) return null;
-			this.rememberSecretStorageKey(normalizedKeyId, privateKey);
-			return privateKey;
-		});
+			return normalizedKeyId ? [normalizedKeyId] : [];
+		}, false).then((resolved) => resolved?.[1] ?? null);
 	}
-	resolveEncodedRecoveryKeyInput(params) {
+	stageEncodedRecoveryKey(params) {
 		const encodedPrivateKey = params.encodedPrivateKey.trim();
 		if (!encodedPrivateKey) throw new Error("Matrix recovery key is required");
 		let privateKey;
@@ -541,24 +502,16 @@ var MatrixRecoveryKeyStore = class {
 			throw new Error(`Invalid Matrix recovery key: ${formatErrorMessage(err)}`, { cause: err });
 		}
 		const keyId = typeof params.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : null;
-		return {
-			encodedPrivateKey,
-			privateKey,
-			keyId,
-			keyInfo: params.keyInfo
-		};
-	}
-	stageEncodedRecoveryKey(params) {
-		const prepared = this.resolveEncodedRecoveryKeyInput(params);
+		const preparedKeyInfo = params.keyInfo;
 		return this.enqueuePersistence(async () => {
-			const keyInfo = prepared.keyInfo ?? (await this.loadStoredRecoveryKey())?.keyInfo;
+			const keyInfo = preparedKeyInfo ?? (await this.loadStoredRecoveryKey())?.keyInfo;
 			this.clearStagedCache();
 			this.stagedRecoveryKey = {
 				version: 1,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-				keyId: prepared.keyId,
-				encodedPrivateKey: prepared.encodedPrivateKey,
-				privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
+				keyId,
+				encodedPrivateKey,
+				privateKeyBase64: Buffer.from(privateKey).toString("base64"),
 				keyInfo
 			};
 		});
@@ -592,9 +545,8 @@ var MatrixRecoveryKeyStore = class {
 	async bootstrapSecretStorageWithRecoveryKey(crypto, options = {}) {
 		await this.drainPendingPersistence();
 		let status = null;
-		const getSecretStorageStatus = crypto.getSecretStorageStatus;
-		if (typeof getSecretStorageStatus === "function") try {
-			status = await getSecretStorageStatus.call(crypto);
+		try {
+			status = await crypto.getSecretStorageStatus();
 		} catch (err) {
 			LogService.warn("MatrixClientLite", "Failed to read secret storage status:", err);
 		}
@@ -626,7 +578,6 @@ var MatrixRecoveryKeyStore = class {
 				if (stagedRecovery) this.stagedRecoveryKeyUsed = true;
 				return recoveryKey;
 			}
-			if (typeof crypto.createRecoveryKeyFromPassphrase !== "function") throw new Error("Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)");
 			recoveryKey = await crypto.createRecoveryKeyFromPassphrase();
 			await this.saveRecoveryKeyToDisk(recoveryKey);
 			generatedRecoveryKey = true;
@@ -763,7 +714,7 @@ var MatrixSendScheduler = class extends MatrixScheduler {
 //#region extensions/matrix/src/matrix/sdk/client-base.ts
 const MATRIX_ENCRYPTED_STARTUP_TIMEOUT_MS = 6e4;
 let loadedMatrixCryptoRuntime = null;
-const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-B2AjWo-i.mjs").then((runtime) => {
+const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-CpJ0b7vY.mjs").then((runtime) => {
 	loadedMatrixCryptoRuntime = runtime;
 	return runtime;
 }));
@@ -773,7 +724,7 @@ var MatrixClientBase = class {
 		return withoutMatrixSendCurrentness(() => this.cryptoRequestOwner.run({
 			callerAuthority: captureChannelReadAuthority(),
 			requestSignal
-		}, run));
+		}, () => withEffectAuthority(void 0, run)));
 	}
 	constructor(homeserver, accessToken, opts = {}) {
 		this.emitter = new EventEmitter();
@@ -905,26 +856,13 @@ var MatrixClientBase = class {
 		this.verificationManager ??= new runtime.MatrixVerificationManager({
 			onSummaryChanged: (summary) => this.emitter.emit("verification.summary", summary),
 			trustOwnDeviceAfterSas: async (deviceId) => {
-				const crypto = this.client.getCrypto();
-				if (typeof crypto?.crossSignDevice !== "function") return;
-				await crypto.crossSignDevice(deviceId);
+				await this.client.getCrypto()?.crossSignDevice(deviceId);
 			}
 		});
 		this.cryptoBootstrapper ??= new runtime.MatrixCryptoBootstrapper({
 			getUserId: () => this.getUserId(),
 			getPassword: () => this.password,
-			canUnlockSecretStorage: async () => {
-				const secretStorage = this.client.secretStorage;
-				if (!secretStorage || typeof secretStorage.getDefaultKeyId !== "function" || typeof secretStorage.getKey !== "function" || typeof secretStorage.checkKey !== "function") return false;
-				const defaultKeyId = await secretStorage.getDefaultKeyId();
-				if (!defaultKeyId) return false;
-				const keyTuple = await secretStorage.getKey(defaultKeyId);
-				const key = await this.recoveryKeyStore.getSecretStorageKeyCandidate(defaultKeyId);
-				if (!keyTuple || !key) return false;
-				const keyInfo = keyTuple[1];
-				if (!keyInfo.iv?.trim() || !keyInfo.mac?.trim()) return false;
-				return await secretStorage.checkKey(key, keyInfo);
-			},
+			canUnlockSecretStorage: async () => await this.checkSecretStorageKey() === true,
 			getDeviceId: () => this.client.getDeviceId(),
 			verificationManager: this.verificationManager,
 			recoveryKeyStore: this.recoveryKeyStore,
@@ -938,6 +876,19 @@ var MatrixClientBase = class {
 			downloadContent: (mxcUrl, opts) => this.downloadContent(mxcUrl, opts)
 		});
 	}
+	async checkSecretStorageKey(expectedKeyId) {
+		const secretStorage = this.client.secretStorage;
+		const defaultKeyId = await secretStorage.getDefaultKeyId();
+		if (expectedKeyId !== void 0 && defaultKeyId !== expectedKeyId) return false;
+		if (!defaultKeyId) return;
+		const keyTuple = await secretStorage.getKey(defaultKeyId);
+		const key = await this.recoveryKeyStore.getSecretStorageKeyCandidate(defaultKeyId);
+		if (!keyTuple || !key) return;
+		const keyInfo = keyTuple[1];
+		if (!keyInfo.iv?.trim() || !keyInfo.mac?.trim()) return;
+		const valid = await secretStorage.checkKey(key, keyInfo);
+		return await secretStorage.getDefaultKeyId() === defaultKeyId && valid;
+	}
 	async start(opts = {}) {
 		await this.startSyncSession({
 			bootstrapCrypto: true,
@@ -1452,7 +1403,7 @@ function isMatrixDeviceOwnerVerified(status) {
 	return status?.crossSigningVerified === true;
 }
 function isMatrixDeviceVerifiedInCurrentClient(status) {
-	return status?.isVerified?.() === true || status?.localVerified === true || isMatrixDeviceOwnerVerified(status);
+	return status?.isVerified() === true || status?.localVerified === true || isMatrixDeviceOwnerVerified(status);
 }
 async function trustMatrixOwnIdentity(crypto) {
 	const ownIdentity = typeof crypto.getOwnIdentity === "function" ? await crypto.getOwnIdentity().catch(() => void 0) : void 0;
@@ -1486,16 +1437,14 @@ var MatrixClientVerification = class extends MatrixClientCore {
 		let keyLoadError = null;
 		if (serverVersion && (shouldLoadBackupKey || shouldActivateBackup)) {
 			if (shouldLoadBackupKey) {
-				if (typeof crypto.loadSessionBackupPrivateKeyFromSecretStorage === "function") {
-					keyLoadAttempted = true;
-					try {
-						await crypto.loadSessionBackupPrivateKeyFromSecretStorage();
-					} catch (err) {
-						keyLoadError = formatErrorMessage(err);
-					}
-				} else keyLoadError = "Matrix crypto backend does not support loading backup keys from secret storage";
+				keyLoadAttempted = true;
+				try {
+					await crypto.loadSessionBackupPrivateKeyFromSecretStorage();
+				} catch (err) {
+					keyLoadError = formatErrorMessage(err);
+				}
 			}
-			if (!keyLoadError) await this.enableTrustedRoomKeyBackupIfPossible(crypto);
+			if (!keyLoadError) await crypto.checkKeyBackupAndEnable();
 			({activeVersion, decryptionKeyCached} = await this.resolveRoomKeyBackupLocalState(crypto));
 			({serverVersion, trusted, matchesDecryptionKey} = await this.resolveRoomKeyBackupTrustState(crypto, serverVersion));
 		}
@@ -1521,7 +1470,7 @@ var MatrixClientVerification = class extends MatrixClientCore {
 		};
 		const crypto = this.client.getCrypto();
 		let deviceStatus = null;
-		if (crypto && normalizedUserId && normalizedDeviceId && typeof crypto.getDeviceVerificationStatus === "function") deviceStatus = await crypto.getDeviceVerificationStatus(normalizedUserId, normalizedDeviceId).catch(() => null);
+		if (crypto && normalizedUserId && normalizedDeviceId) deviceStatus = await crypto.getDeviceVerificationStatus(normalizedUserId, normalizedDeviceId).catch(() => null);
 		const { isMatrixDeviceVerifiedInCurrentClient } = await loadMatrixCryptoRuntime();
 		return {
 			encryptionEnabled: true,
@@ -1567,19 +1516,12 @@ var MatrixClientVerification = class extends MatrixClientCore {
 		const crypto = this.client.getCrypto();
 		if (crypto) await trustMatrixOwnIdentity(crypto);
 	}
-	async resolveActiveRoomKeyBackupVersion(crypto) {
-		if (typeof crypto.getActiveSessionBackupVersion !== "function") return null;
-		const version = await crypto.getActiveSessionBackupVersion().catch(() => null);
-		return normalizeNullableString(version);
-	}
 	async resolveCachedRoomKeyBackupDecryptionKey(crypto) {
-		const read = Reflect.get(crypto, "getSessionBackupPrivateKey");
-		if (typeof read !== "function") return null;
-		const key = await read.call(crypto).catch(() => null);
+		const key = await crypto.getSessionBackupPrivateKey().catch(() => null);
 		return key ? key.length > 0 : false;
 	}
 	async resolveRoomKeyBackupLocalState(crypto) {
-		const [activeVersion, decryptionKeyCached] = await Promise.all([this.resolveActiveRoomKeyBackupVersion(crypto), this.resolveCachedRoomKeyBackupDecryptionKey(crypto)]);
+		const [activeVersion, decryptionKeyCached] = await Promise.all([crypto.getActiveSessionBackupVersion().then(normalizeNullableString, () => null), this.resolveCachedRoomKeyBackupDecryptionKey(crypto)]);
 		return {
 			activeVersion,
 			decryptionKeyCached
@@ -1587,38 +1529,25 @@ var MatrixClientVerification = class extends MatrixClientCore {
 	}
 	async shouldForceSecretStorageRecreationForBackupReset(crypto) {
 		if (await this.resolveCachedRoomKeyBackupDecryptionKey(crypto) !== false) return false;
-		const loadSessionBackupPrivateKeyFromSecretStorage = crypto.loadSessionBackupPrivateKeyFromSecretStorage;
-		if (typeof loadSessionBackupPrivateKeyFromSecretStorage !== "function") return false;
 		try {
-			await loadSessionBackupPrivateKeyFromSecretStorage.call(crypto);
+			await crypto.loadSessionBackupPrivateKeyFromSecretStorage();
 			return false;
 		} catch (err) {
 			return isRepairableSecretStorageAccessError(err);
 		}
 	}
 	async resolveRoomKeyBackupTrustState(crypto, fallbackVersion) {
-		let serverVersion = fallbackVersion;
-		let trusted = null;
-		let matchesDecryptionKey = null;
-		if (typeof crypto.getKeyBackupInfo === "function") {
-			const info = await crypto.getKeyBackupInfo().catch(() => null);
-			serverVersion = normalizeNullableString(info?.version) ?? serverVersion;
-			if (info && typeof crypto.isKeyBackupTrusted === "function") {
-				const trustInfo = await crypto.isKeyBackupTrusted(info).catch(() => null);
-				trusted = typeof trustInfo?.trusted === "boolean" ? trustInfo.trusted : null;
-				matchesDecryptionKey = typeof trustInfo?.matchesDecryptionKey === "boolean" ? trustInfo.matchesDecryptionKey : null;
-			}
-		}
+		const info = await crypto.getKeyBackupInfo().catch(() => null);
+		const serverVersion = normalizeNullableString(info?.version) ?? fallbackVersion;
+		const trustInfo = info ? await crypto.isKeyBackupTrusted(info).catch(() => null) : null;
 		return {
 			serverVersion,
-			trusted,
-			matchesDecryptionKey
+			trusted: trustInfo?.trusted ?? null,
+			matchesDecryptionKey: trustInfo?.matchesDecryptionKey ?? null
 		};
 	}
 	async resolveDefaultSecretStorageKeyId(crypto) {
-		const getSecretStorageStatus = crypto?.getSecretStorageStatus;
-		if (typeof getSecretStorageStatus !== "function") return;
-		return (await getSecretStorageStatus.call(crypto).catch(() => null))?.defaultKeyId;
+		return (await crypto?.getSecretStorageStatus().catch(() => null))?.defaultKeyId;
 	}
 	async resolveRoomKeyBackupVersion() {
 		try {
@@ -1628,10 +1557,6 @@ var MatrixClientVerification = class extends MatrixClientCore {
 			return null;
 		}
 	}
-	async enableTrustedRoomKeyBackupIfPossible(crypto) {
-		if (typeof crypto.checkKeyBackupAndEnable !== "function") return;
-		await crypto.checkKeyBackupAndEnable();
-	}
 	async ensureRoomKeyBackupEnabled(crypto) {
 		if (await this.resolveRoomKeyBackupVersion()) return;
 		LogService.info("MatrixClientLite", "No room key backup version found on server, creating one via secret storage bootstrap");
@@ -1699,14 +1624,13 @@ var MatrixClient = class extends MatrixClientVerification {
 			const cryptoBootstrapper = this.cryptoBootstrapper;
 			if (!cryptoBootstrapper) return await fail("Matrix crypto bootstrapper is not available");
 			await cryptoBootstrapper.bootstrap(crypto, { allowAutomaticCrossSigningReset: false });
-			await this.enableTrustedRoomKeyBackupIfPossible(crypto);
+			await crypto.checkKeyBackupAndEnable();
 			const status = await this.getOwnDeviceVerificationStatus();
 			const backupUsable = resolveMatrixRoomKeyBackupReadinessError(status.backup, { requireServerBackup: true }) === null;
 			const stagedRecoveryKeyUsed = this.recoveryKeyStore.hasStagedRecoveryKeyBeenUsed();
-			const secretStorageStatus = typeof crypto.getSecretStorageStatus === "function" ? await crypto.getSecretStorageStatus().catch(() => null) : null;
-			const stagedRecoveryKeyConfirmedBySecretStorage = Boolean(stagedKeyId) && secretStorageStatus?.secretStorageKeyValidityMap?.[stagedKeyId ?? ""] === true;
-			const stagedRecoveryKeyRejectedBySecretStorage = Boolean(stagedKeyId) && secretStorageStatus?.secretStorageKeyValidityMap?.[stagedKeyId ?? ""] === false;
-			return await settleRecoveryKey(status, stagedRecoveryKeyUsed && (stagedRecoveryKeyConfirmedBySecretStorage || stagedRecoveryKeyUsed && !stagedRecoveryKeyRejectedBySecretStorage && !stagedRecoveryKeyConfirmedBySecretStorage && !backupUsableBeforeStagedRecovery && backupUsable) || storedRecoveryKeyMatches && backupUsable);
+			const stagedKeyValid = await this.checkSecretStorageKey(stagedKeyId ?? void 0).catch(() => void 0);
+			const stagedRecoveryKeyConfirmedBySecretStorage = stagedKeyValid === true;
+			return await settleRecoveryKey(status, stagedRecoveryKeyUsed && (stagedRecoveryKeyConfirmedBySecretStorage || stagedRecoveryKeyUsed && !(stagedKeyValid === false) && !stagedRecoveryKeyConfirmedBySecretStorage && !backupUsableBeforeStagedRecovery && backupUsable) || storedRecoveryKeyMatches && backupUsable);
 		} catch (err) {
 			await this.recoveryKeyStore.discardStagedRecoveryKey();
 			return await fail(formatErrorMessage(err));
@@ -1746,18 +1670,14 @@ var MatrixClient = class extends MatrixClientVerification {
 				await this.recoveryKeyStore.discardStagedRecoveryKey();
 				return await fail(backupError);
 			}
-			if (typeof crypto.restoreKeyBackup !== "function") {
-				await this.recoveryKeyStore.discardStagedRecoveryKey();
-				return await fail("Matrix crypto backend does not support full key backup restore");
-			}
 			const restore = await crypto.restoreKeyBackup();
 			if (rawRecoveryKey) await this.recoveryKeyStore.commitStagedRecoveryKey({ keyId: await this.resolveDefaultSecretStorageKeyId(crypto) });
 			const finalBackup = await this.getRoomKeyBackupStatus();
 			return {
 				success: true,
 				backupVersion: backup.serverVersion,
-				imported: typeof restore.imported === "number" ? restore.imported : 0,
-				total: typeof restore.total === "number" ? restore.total : 0,
+				imported: restore.imported,
+				total: restore.total,
 				loadedFromSecretStorage,
 				restoredAt: (/* @__PURE__ */ new Date()).toISOString(),
 				backup: finalBackup
@@ -1803,7 +1723,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				forceNewRecoveryKey: options.rotateRecoveryKey === true,
 				allowSecretStorageRecreateWithoutRecoveryKey: true
 			});
-			await this.enableTrustedRoomKeyBackupIfPossible(crypto);
+			await crypto.checkKeyBackupAndEnable();
 			const backup = await this.getRoomKeyBackupStatus();
 			const createdVersion = backup.serverVersion;
 			if (!createdVersion) return await fail("Matrix room key backup is still missing after reset.");

package/dist/.setup/{secret-contract-JlB6VmI3.mjs → secret-contract-DSBRvhdZ.mjs}

@@ -1,4 +1,4 @@
-import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.mjs";
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-aEBngJPa.mjs";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { collectSecretInputAssignment, createChannelSecretTargetRegistryEntries, getChannelSurface, hasConfiguredSecretInputValue, hasOwnProperty, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 //#region extensions/matrix/src/secret-contract.ts

package/dist/.setup/{secret-contract-api-B-iJoQEv.mjs → secret-contract-api-DzEJ-X7n.mjs}

@@ -1,3 +1,3 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-JlB6VmI3.mjs";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-DSBRvhdZ.mjs";
 import "../secret-contract-api.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/.setup/{send-B1Y2L4wj.mjs → send-LCOuTVc1.mjs}

@@ -1,17 +1,17 @@
 import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
 import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
 import { a as resolveMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
-import { i as normalizeMatrixResolvableTarget, t as isMatrixQualifiedUserId } from "./target-ids-Nwx7cMVE.mjs";
+import { a as normalizeMatrixResolvableTarget, n as isMatrixQualifiedUserId } from "./target-ids-HhcaKX1n.mjs";
 import { n as withMatrixSendCurrentness, o as buildMatrixReactionContent, t as captureMatrixSendCurrentness } from "./send-currentness-C2rMVVIQ.mjs";
-import { _ as MsgType, d as buildMatrixMessageRelation, f as resolveMatrixReplyToEventId, g as MSC4357_LIVE_KEY, l as isStrictDirectRoom, m as EventType, n as inspectMatrixDirectRooms, p as resolveMatrixThreadRootId, r as persistMatrixDirectRoomMapping, v as RelationType } from "./direct-management-DJtQhLKH.mjs";
-import { n as getMatrixEventProjection } from "./event-helpers-CspuhE9k.mjs";
+import { _ as MsgType, d as buildMatrixMessageRelation, f as resolveMatrixReplyToEventId, g as MSC4357_LIVE_KEY, l as isStrictDirectRoom, m as EventType, n as inspectMatrixDirectRooms, p as resolveMatrixThreadRootId, r as persistMatrixDirectRoomMapping, v as RelationType } from "./direct-management-B3wYhx_M.mjs";
+import { n as getMatrixEventProjection } from "./event-helpers-CxNgMQqH.mjs";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-outbound";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { asFiniteNumber, asNullableObjectRecord, asNullableRecord, isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeOptionalStringifiedId } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { FormatCapabilityProfile, convertMarkdownTables, findCodeRegions, isInsideCode, markdownToIR, renderMarkdownWithMarkers, tokenizeHtmlTags } from "openclaw/plugin-sdk/text-chunking";
 import { createHash } from "node:crypto";
 import path from "node:path";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { isVoiceMessageCompatibleAudio } from "openclaw/plugin-sdk/media-runtime";
 import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -23,12 +23,11 @@ import MarkdownIt from "markdown-it";
 import { isAutoLinkedFileRef } from "openclaw/plugin-sdk/text-autolink-runtime";
 import { parseBuffer } from "music-metadata";
 //#region extensions/matrix/src/matrix/send/client.ts
-const loadMatrixSendClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-CZvJjr29.mjs"));
+const loadMatrixSendClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-D05xy1HB.mjs"));
 function resolveMediaMaxBytes(accountId, cfg) {
 	if (!cfg) throw new Error("Matrix media limits requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
-	const resolvedCfg = requireRuntimeConfig(cfg, "Matrix media limits");
 	const mediaMaxMb = resolveMatrixAccountConfig({
-		cfg: resolvedCfg,
+		cfg,
 		accountId
 	}).mediaMaxMb;
 	return typeof mediaMaxMb === "number" && mediaMaxMb > 0 ? mediaMaxMb * 1024 * 1024 : void 0;
@@ -209,7 +208,7 @@ function isPlan(value) {
 function decodePlan(bytes) {
 	let value;
 	try {
-		value = JSON.parse(new TextDecoder().decode(bytes));
+		value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
 	} catch {
 		throw new MatrixDeliveryPlanInvariantError("Matrix durable delivery plan is invalid JSON");
 	}
@@ -297,8 +296,7 @@ function assertCompletePartTopology(plans) {
 	const partCount = plans[0]?.partCount;
 	if (!partCount) throw new MatrixDeliveryPlanInvariantError("Matrix ambiguous delivery has no event plan");
 	if (plans.some((plan) => plan.partCount !== partCount)) throw new MatrixDeliveryPlanInvariantError("Matrix durable delivery plan part topology is inconsistent");
-	const storedParts = new Set(plans.map((plan) => plan.partIndex));
-	if (storedParts.size !== partCount || Array.from({ length: partCount }, (_, partIndex) => partIndex).some((partIndex) => !storedParts.has(partIndex))) throw new MatrixDeliveryPlanInvariantError("Matrix ambiguous delivery has an incomplete event plan");
+	if (new Set(plans.map((plan) => plan.partIndex)).size !== partCount) throw new MatrixDeliveryPlanInvariantError("Matrix ambiguous delivery has an incomplete event plan");
 }
 async function requireTransactionScope(client) {
 	const scope = (await client.getTransactionScopeId()).trim();
@@ -387,14 +385,6 @@ async function cleanupMatrixDeliveryPlans(ctx) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/poll-types.ts
-/**
-* Matrix Poll Types (MSC3381)
-*
-* Defines types for Matrix poll events:
-* - m.poll.start - Creates a new poll
-* - m.poll.response - Records a vote
-* - m.poll.end - Closes a poll
-*/
 const M_POLL_START = "m.poll.start";
 const M_POLL_RESPONSE = "m.poll.response";
 const M_POLL_END = "m.poll.end";
@@ -713,22 +703,13 @@ function findInlineMetadataRanges(markdown, references) {
 		}
 		if (markdown[index] === "]" && !isMarkdownEscaped(markdown, index)) labelStack.pop();
 		if (markdown[index] === "<") {
-			const autolink = /^<[A-Za-z][A-Za-z0-9+.-]{1,31}:[^<>\s]*>/u.exec(markdown.slice(index));
+			const autolink = /^<(?:[A-Za-z][A-Za-z0-9+.-]{1,31}:[^<>\s]*|[^<>\s@]+@[^<>\s@]+)>/u.exec(markdown.slice(index));
 			if (autolink && !isMarkdownEscaped(markdown, index)) {
 				ranges.push({
 					start: index,
 					end: index + autolink[0].length
 				});
 				index += autolink[0].length - 1;
-				continue;
-			}
-			const emailAutolink = /^<[^<>\s@]+@[^<>\s@]+>/u.exec(markdown.slice(index));
-			if (emailAutolink && !isMarkdownEscaped(markdown, index)) {
-				ranges.push({
-					start: index,
-					end: index + emailAutolink[0].length
-				});
-				index += emailAutolink[0].length - 1;
 			}
 		}
 	}
@@ -1360,8 +1341,7 @@ function chunkMatrixText(text, opts) {
 		...preparedText,
 		chunks: preparedText.convertedText ? [preparedText.convertedText] : []
 	};
-	const cfg = requireRuntimeConfig(opts.cfg, "Matrix text chunking");
-	const chunkMode = getMatrixRuntime().channel.text.resolveChunkMode(cfg, "matrix", opts.accountId);
+	const chunkMode = getMatrixRuntime().channel.text.resolveChunkMode(opts.cfg, "matrix", opts.accountId);
 	const analysis = analyzeMatrixSpoilers(preparedText.convertedText);
 	const collisionRedacted = analysis.metadataCollision ? renderMatrixBody(analysis) : void 0;
 	const chunkSegment = (segmentText) => {

package/dist/.setup/{setup-bootstrap-UNIGyKnk.mjs → setup-bootstrap-CV-hHBXu.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
-import "./accounts-C_r0UlEm.mjs";
-import { n as bootstrapMatrixVerification } from "./verification-kMlFYUn0.mjs";
+import "./setup-core-CKnNTfgD.mjs";
+import { n as bootstrapMatrixVerification } from "./verification-B3VswneT.mjs";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/matrix/src/setup-bootstrap.ts
 async function maybeBootstrapNewEncryptedMatrixAccount(params) {