@openclaw/matrix 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/.setup/{crypto-runtime-CpJ0b7vY.mjs → crypto-runtime-D8yY7kjD.mjs}

@@ -1,25 +1,19 @@
-import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
 import { t as ensureMatrixCryptoRuntime } from "./deps-L_1bUAGL.mjs";
-import { n as RETIRED_MATRIX_STATE_REMEDIATION } from "./retired-state-DW5pLH05.mjs";
-import { c as readMatrixIdbSnapshotJson, u as writeMatrixIdbSnapshotJson } from "./storage-DkC6bHgA.mjs";
 import { r as noop, t as LogService } from "./logger-CXQnpXCt.mjs";
-import { a as isRepairableSecretStorageAccessError, i as trustMatrixOwnIdentity, n as isMatrixDeviceOwnerVerified, o as MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS, r as isMatrixDeviceVerifiedInCurrentClient } from "./sdk-Cfc6m7fY.mjs";
+import { a as isRepairableSecretStorageAccessError, i as trustMatrixOwnIdentity, n as isMatrixDeviceOwnerVerified, r as isMatrixDeviceVerifiedInCurrentClient } from "./sdk-ByU8So5S.mjs";
+import { persistIdbToDisk, resolveDefaultIdbSnapshotPath, restoreIdbFromDisk } from "./idb-persistence-BHTYPRe_.mjs";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
-import { formatErrorMessage, toErrorObject, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
-import { asOptionalObjectRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import path from "node:path";
-import { resolveDateTimestampMs, resolveTimestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
-import fs from "node:fs";
+import { formatErrorMessage, toStringifiedError } from "openclaw/plugin-sdk/error-runtime";
+import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
 import { raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { MatrixEventEvent } from "matrix-js-sdk/lib/matrix.js";
 import { VerificationMethod } from "matrix-js-sdk/lib/types.js";
 import "fake-indexeddb/auto";
-import { IDBDatabase, indexedDB } from "fake-indexeddb";
+import { IDBDatabase } from "fake-indexeddb";
 import { CryptoEvent } from "matrix-js-sdk/lib/crypto-api/CryptoEvent.js";
 import { DecryptionFailureCode } from "matrix-js-sdk/lib/crypto-api/index.js";
-import { withFileLock } from "openclaw/plugin-sdk/file-lock";
 import { VerificationPhase, VerificationRequestEvent, VerifierEvent } from "matrix-js-sdk/lib/crypto-api/verification.js";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 //#region extensions/matrix/src/matrix/sdk/fake-indexeddb-prune.ts
@@ -275,15 +269,7 @@ var MatrixCryptoBootstrapper = class {
 };
 //#endregion
 //#region extensions/matrix/src/matrix/sdk/crypto-facade.ts
-const matrixCryptoNodeRuntimeLoader = createLazyRuntimeModule(() => import("./crypto-node.runtime-6Aj_ltHQ.mjs"));
-async function loadMatrixCryptoNodeRuntime() {
-	try {
-		return await matrixCryptoNodeRuntimeLoader();
-	} catch (error) {
-		matrixCryptoNodeRuntimeLoader.clear();
-		throw error;
-	}
-}
+const loadMatrixCryptoNodeRuntime = createLazyRuntimeModule(() => import("./crypto-node.runtime-6Aj_ltHQ.mjs"));
 async function loadMatrixCryptoNodeBindings() {
 	await ensureMatrixCryptoRuntime();
 	return (await loadMatrixCryptoNodeRuntime()).loadMatrixCryptoNodeBindings();
@@ -374,13 +360,11 @@ var MatrixDecryptBridge = class {
 	constructor(deps) {
 		this.deps = deps;
 		this.trackedEncryptedEvents = /* @__PURE__ */ new WeakSet();
-		this.pendingSdkDecryptions = /* @__PURE__ */ new Set();
+		this.pendingDecryptions = /* @__PURE__ */ new Set();
 		this.decryptedMessageDedupe = /* @__PURE__ */ new Map();
 		this.decryptRetries = /* @__PURE__ */ new Map();
 		this.failedDecryptionsNotified = /* @__PURE__ */ new Set();
 		this.exhaustedDecryptRetries = /* @__PURE__ */ new Map();
-		this.activeRetryRuns = 0;
-		this.retryIdleResolvers = /* @__PURE__ */ new Set();
 		this.cryptoRetrySignalsBound = false;
 		this.quiescing = false;
 		this.stopped = false;
@@ -397,13 +381,7 @@ var MatrixDecryptBridge = class {
 		if (this.trackedEncryptedEvents.has(event)) return;
 		this.trackedEncryptedEvents.add(event);
 		const sdkDecryption = event.getDecryptionPromise();
-		if (sdkDecryption) {
-			this.pendingSdkDecryptions.add(sdkDecryption);
-			const forgetSdkDecryption = () => {
-				this.pendingSdkDecryptions.delete(sdkDecryption);
-			};
-			sdkDecryption.then(forgetSdkDecryption, forgetSdkDecryption);
-		}
+		if (sdkDecryption) this.trackDecryption(sdkDecryption);
 		event.on(MatrixEventEvent.Decrypted, (decryptedEvent, err) => {
 			this.handleEncryptedEventDecrypted({
 				roomId,
@@ -471,14 +449,13 @@ var MatrixDecryptBridge = class {
 		this.quiescing = true;
 		this.stopped = true;
 		for (const retryKey of this.decryptRetries.keys()) this.clearDecryptRetry(retryKey);
-		this.pendingSdkDecryptions.clear();
+		this.pendingDecryptions.clear();
 		this.exhaustedDecryptRetries.clear();
 	}
 	async drainPendingDecryptions(_reason) {
 		this.quiescing = true;
-		const pendingSdkDecryptions = Array.from(this.pendingSdkDecryptions);
 		this.startPendingRetries(Array.from(this.decryptRetries.entries()));
-		await raceWithTimeout(Promise.all([Promise.allSettled(pendingSdkDecryptions), this.waitForActiveRetryRunsToFinish()]), MATRIX_DECRYPT_DRAIN_TIMEOUT_MS, () => {
+		await raceWithTimeout(Promise.allSettled(this.pendingDecryptions), MATRIX_DECRYPT_DRAIN_TIMEOUT_MS, () => {
 			throw new Error(`Matrix decryption drain did not finish within ${MATRIX_DECRYPT_DRAIN_TIMEOUT_MS}ms`);
 		}, { ref: false });
 	}
@@ -559,19 +536,26 @@ var MatrixDecryptBridge = class {
 		}, delayMs);
 		this.decryptRetries.set(retryKey, next);
 	}
-	async runDecryptRetry(retryKey) {
+	trackDecryption(pending) {
+		this.pendingDecryptions.add(pending);
+		const forget = () => this.pendingDecryptions.delete(pending);
+		pending.then(forget, forget);
+	}
+	runDecryptRetry(retryKey) {
+		const pending = this.attemptDecryptRetry(retryKey);
+		this.trackDecryption(pending);
+		return pending;
+	}
+	async attemptDecryptRetry(retryKey) {
 		const state = this.decryptRetries.get(retryKey);
 		if (!state || state.inFlight) return;
 		state.inFlight = true;
 		state.timer = null;
-		this.activeRetryRuns += 1;
 		const retryEvent = state.event;
 		const retryCrypto = this.deps.client.getCrypto?.();
 		const canAttemptDecryption = retryCrypto !== void 0 && retryCrypto !== null && typeof retryEvent.attemptDecryption === "function";
 		if (!(canAttemptDecryption || typeof this.deps.client.decryptEventIfNeeded === "function")) {
 			this.clearDecryptRetry(retryKey);
-			this.activeRetryRuns = Math.max(0, this.activeRetryRuns - 1);
-			this.resolveRetryIdleIfNeeded();
 			return;
 		}
 		try {
@@ -579,8 +563,6 @@ var MatrixDecryptBridge = class {
 			else await this.deps.client.decryptEventIfNeeded?.(state.event, { isRetry: true });
 		} catch {} finally {
 			state.inFlight = false;
-			this.activeRetryRuns = Math.max(0, this.activeRetryRuns - 1);
-			this.resolveRetryIdleIfNeeded();
 		}
 		if (this.decryptRetries.get(retryKey) !== state) return;
 		if (this.stopped || this.quiescing && state.event.isDecryptionFailure()) {
@@ -623,210 +605,8 @@ var MatrixDecryptBridge = class {
 		for (const [key, createdAt] of this.decryptedMessageDedupe) if (now - createdAt > ttlMs) this.decryptedMessageDedupe.delete(key);
 		pruneMapToMaxSize(this.decryptedMessageDedupe, 2048);
 	}
-	async waitForActiveRetryRunsToFinish() {
-		if (this.activeRetryRuns === 0) return;
-		await new Promise((resolve) => {
-			this.retryIdleResolvers.add(resolve);
-		});
-	}
-	resolveRetryIdleIfNeeded() {
-		if (this.activeRetryRuns !== 0) return;
-		for (const resolve of this.retryIdleResolvers) resolve();
-		this.retryIdleResolvers.clear();
-	}
 };
 //#endregion
-//#region extensions/matrix/src/matrix/sdk/idb-persistence.ts
-const LEGACY_SNAPSHOT_DIAGNOSTIC = {
-	code: "matrix-idb-snapshot-requires-doctor",
-	message: "Matrix IndexedDB snapshot exists outside canonical SQLite state",
-	remediation: RETIRED_MATRIX_STATE_REMEDIATION
-};
-var MatrixIdbSnapshotMigrationRequiredError = class extends Error {
-	constructor() {
-		super(`${LEGACY_SNAPSHOT_DIAGNOSTIC.message}; ${LEGACY_SNAPSHOT_DIAGNOSTIC.remediation}`);
-		this.code = LEGACY_SNAPSHOT_DIAGNOSTIC.code;
-		this.remediation = LEGACY_SNAPSHOT_DIAGNOSTIC.remediation;
-		this.name = "MatrixIdbSnapshotMigrationRequiredError";
-	}
-};
-function isValidIdbIndexSnapshot(value) {
-	const candidate = asOptionalObjectRecord(value);
-	return typeof candidate?.name === "string" && (typeof candidate.keyPath === "string" || Array.isArray(candidate.keyPath) && candidate.keyPath.every((entry) => typeof entry === "string")) && typeof candidate.multiEntry === "boolean" && typeof candidate.unique === "boolean";
-}
-function isValidIdbRecordSnapshot(value) {
-	const candidate = asOptionalObjectRecord(value);
-	return Boolean(candidate && "key" in candidate && "value" in candidate);
-}
-function isValidIdbStoreSnapshot(value) {
-	const candidate = asOptionalObjectRecord(value);
-	const keyPath = candidate?.keyPath;
-	const validKeyPath = keyPath === null || typeof keyPath === "string" || Array.isArray(keyPath) && keyPath.every((entry) => typeof entry === "string");
-	return typeof candidate?.name === "string" && validKeyPath && typeof candidate.autoIncrement === "boolean" && Array.isArray(candidate.indexes) && candidate.indexes.every((entry) => isValidIdbIndexSnapshot(entry)) && Array.isArray(candidate.records) && candidate.records.every((entry) => isValidIdbRecordSnapshot(entry));
-}
-function isValidIdbDatabaseSnapshot(value) {
-	const candidate = asOptionalObjectRecord(value);
-	return typeof candidate?.name === "string" && typeof candidate.version === "number" && Number.isFinite(candidate.version) && candidate.version > 0 && Array.isArray(candidate.stores) && candidate.stores.every((entry) => isValidIdbStoreSnapshot(entry));
-}
-function parseSnapshotPayload(data) {
-	const parsed = JSON.parse(data);
-	if (!Array.isArray(parsed) || parsed.length === 0) return null;
-	if (!parsed.every((entry) => isValidIdbDatabaseSnapshot(entry))) throw new Error("Malformed IndexedDB snapshot payload");
-	return parsed;
-}
-function idbReq(req) {
-	return new Promise((resolve, reject) => {
-		req.addEventListener("success", () => resolve(req.result), { once: true });
-		req.addEventListener("error", () => reject(toErrorObject(req.error, "Non-Error rejection")), { once: true });
-	});
-}
-async function dumpIndexedDatabases(databasePrefix) {
-	const idb = indexedDB;
-	const dbList = await idb.databases();
-	const snapshot = [];
-	const expectedPrefix = databasePrefix ? `${databasePrefix}::` : null;
-	for (const { name, version } of dbList) {
-		if (!name || !version) continue;
-		if (expectedPrefix && !name.startsWith(expectedPrefix)) continue;
-		const db = await idbReq(idb.open(name, version));
-		const stores = [];
-		for (const storeName of db.objectStoreNames) {
-			const store = db.transaction(storeName, "readonly").objectStore(storeName);
-			const storeInfo = {
-				name: storeName,
-				keyPath: store.keyPath,
-				autoIncrement: store.autoIncrement,
-				indexes: [],
-				records: []
-			};
-			for (const idxName of store.indexNames) {
-				const idx = store.index(idxName);
-				storeInfo.indexes.push({
-					name: idxName,
-					keyPath: idx.keyPath,
-					multiEntry: idx.multiEntry,
-					unique: idx.unique
-				});
-			}
-			const keys = await idbReq(store.getAllKeys());
-			const values = await idbReq(store.getAll());
-			storeInfo.records = keys.map((k, i) => ({
-				key: k,
-				value: values[i]
-			}));
-			stores.push(storeInfo);
-		}
-		snapshot.push({
-			name,
-			version,
-			stores
-		});
-		db.close();
-	}
-	return snapshot;
-}
-async function restoreIndexedDatabases(snapshot) {
-	const idb = indexedDB;
-	for (const dbSnap of snapshot) {
-		const request = idb.open(dbSnap.name, dbSnap.version);
-		request.addEventListener("upgradeneeded", () => {
-			const db = request.result;
-			for (const storeSnap of dbSnap.stores) {
-				const opts = {};
-				if (storeSnap.keyPath !== null) opts.keyPath = storeSnap.keyPath;
-				if (storeSnap.autoIncrement) opts.autoIncrement = true;
-				const store = db.createObjectStore(storeSnap.name, opts);
-				for (const idx of storeSnap.indexes) store.createIndex(idx.name, idx.keyPath, {
-					unique: idx.unique,
-					multiEntry: idx.multiEntry
-				});
-			}
-		});
-		const db = await idbReq(request);
-		try {
-			for (const storeSnap of dbSnap.stores) {
-				if (storeSnap.records.length === 0) continue;
-				const tx = db.transaction(storeSnap.name, "readwrite");
-				const store = tx.objectStore(storeSnap.name);
-				for (const rec of storeSnap.records) if (storeSnap.keyPath !== null) store.put(rec.value);
-				else store.put(rec.value, rec.key);
-				await new Promise((resolve, reject) => {
-					tx.addEventListener("complete", () => resolve(), { once: true });
-					tx.addEventListener("abort", () => reject(toErrorObject(tx.error, "IndexedDB restore transaction aborted")), { once: true });
-				});
-			}
-		} finally {
-			db.close();
-		}
-	}
-}
-function resolveDefaultIdbSnapshotPath() {
-	const stateDir = process.env.OPENCLAW_STATE_DIR || path.join(process.env.HOME || "/tmp", ".openclaw");
-	return path.join(stateDir, "matrix", "crypto-idb-snapshot.json");
-}
-async function readCanonicalSnapshotJson(snapshotPath, stateRuntime) {
-	throwIfLegacySnapshotNeedsDoctor(snapshotPath);
-	return await readMatrixIdbSnapshotJson(path.dirname(snapshotPath), stateRuntime);
-}
-async function restoreIdbFromDisk(snapshotPath, stateRuntime) {
-	const resolvedPath = snapshotPath ?? resolveDefaultIdbSnapshotPath();
-	let callbackStarted = false;
-	try {
-		const snapshotStateRuntime = stateRuntime ?? getMatrixRuntime().state;
-		return await withFileLock(resolvedPath, MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS, async () => {
-			callbackStarted = true;
-			const storedSnapshotJson = await readCanonicalSnapshotJson(resolvedPath, snapshotStateRuntime);
-			if (!storedSnapshotJson) return false;
-			const snapshot = parseSnapshotPayload(storedSnapshotJson);
-			if (!snapshot) return false;
-			await restoreIndexedDatabases(snapshot);
-			LogService.info("IdbPersistence", `Restored ${snapshot.length} IndexedDB database(s) from Matrix SQLite state`);
-			return true;
-		});
-	} catch (err) {
-		if (err instanceof MatrixIdbSnapshotMigrationRequiredError) throw err;
-		if (!callbackStarted && fs.existsSync(resolvedPath)) throwLegacySnapshotMigrationRequired();
-		LogService.warn("IdbPersistence", "Failed to restore IndexedDB snapshot from SQLite:", err);
-		return false;
-	}
-}
-async function persistIdbToDisk(params) {
-	const snapshotPath = params?.snapshotPath ?? resolveDefaultIdbSnapshotPath();
-	let callbackStarted = false;
-	try {
-		const stateRuntime = params?.stateRuntime ?? getMatrixRuntime().state;
-		fs.mkdirSync(path.dirname(snapshotPath), { recursive: true });
-		const persistedCount = await withFileLock(snapshotPath, MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS, async () => {
-			callbackStarted = true;
-			const storageRootDir = path.dirname(snapshotPath);
-			await readCanonicalSnapshotJson(snapshotPath, stateRuntime);
-			const snapshot = await dumpIndexedDatabases(params?.databasePrefix);
-			if (params?.abortSignal?.aborted || snapshot.length === 0) return 0;
-			await writeMatrixIdbSnapshotJson({
-				storageRootDir,
-				snapshotJson: JSON.stringify(snapshot),
-				databaseCount: snapshot.length,
-				stateRuntime
-			});
-			return snapshot.length;
-		});
-		if (persistedCount === 0) return;
-		LogService.debug("IdbPersistence", `Persisted ${persistedCount} IndexedDB database(s) to Matrix SQLite state`);
-	} catch (err) {
-		if (err instanceof MatrixIdbSnapshotMigrationRequiredError) throw err;
-		if (!callbackStarted && fs.existsSync(snapshotPath)) throwLegacySnapshotMigrationRequired();
-		LogService.warn("IdbPersistence", "Failed to persist IndexedDB snapshot:", err);
-		if (params?.strict) throw err;
-	}
-}
-function throwIfLegacySnapshotNeedsDoctor(snapshotPath) {
-	if (fs.existsSync(snapshotPath)) throwLegacySnapshotMigrationRequired();
-}
-function throwLegacySnapshotMigrationRequired() {
-	LogService.warn("IdbPersistence", LEGACY_SNAPSHOT_DIAGNOSTIC);
-	throw new MatrixIdbSnapshotMigrationRequiredError();
-}
-//#endregion
 //#region extensions/matrix/src/matrix/sdk/verification-manager.ts
 const MAX_TRACKED_VERIFICATION_SESSIONS = 256;
 const TERMINAL_SESSION_RETENTION_MS = 864e5;
@@ -846,23 +626,11 @@ var MatrixVerificationManager = class {
 			return fallback;
 		}
 	}
-	readVerificationRequestIdentity(request) {
-		return {
-			transactionId: this.readRequestValue(() => request.transactionId?.trim() ?? "", ""),
-			roomId: this.readRequestValue(() => request.roomId ?? "", ""),
-			otherUserId: this.readRequestValue(() => request.otherUserId, ""),
-			otherDeviceId: this.readRequestValue(() => request.otherDeviceId ?? "", ""),
-			isSelfVerification: this.readRequestValue(() => request.isSelfVerification, false),
-			initiatedByMe: this.readRequestValue(() => request.initiatedByMe, false)
-		};
-	}
 	isSameLogicalVerificationRequest(left, right) {
-		const leftIdentity = this.readVerificationRequestIdentity(left);
-		const rightIdentity = this.readVerificationRequestIdentity(right);
-		return leftIdentity.transactionId !== "" && leftIdentity.transactionId === rightIdentity.transactionId && leftIdentity.roomId === rightIdentity.roomId && leftIdentity.otherUserId === rightIdentity.otherUserId && this.isSameOptionalIdentityValue(leftIdentity.otherDeviceId, rightIdentity.otherDeviceId) && leftIdentity.isSelfVerification === rightIdentity.isSelfVerification && leftIdentity.initiatedByMe === rightIdentity.initiatedByMe;
-	}
-	isSameOptionalIdentityValue(left, right) {
-		return left === "" || right === "" || left === right;
+		const transactionId = left.transactionId?.trim();
+		const leftDeviceId = left.otherDeviceId;
+		const rightDeviceId = right.otherDeviceId;
+		return Boolean(transactionId) && transactionId === right.transactionId?.trim() && (left.roomId ?? "") === (right.roomId ?? "") && left.otherUserId === right.otherUserId && (!leftDeviceId || !rightDeviceId || leftDeviceId === rightDeviceId) && left.isSelfVerification === right.isSelfVerification && left.initiatedByMe === right.initiatedByMe;
 	}
 	pruneVerificationSessions(nowMs) {
 		for (const [id, session] of this.verificationSessions) {
@@ -879,7 +647,7 @@ var MatrixVerificationManager = class {
 		this.opts.onSummaryChanged?.(summary);
 	}
 	touchVerificationSession(session) {
-		session.updatedAtMs = resolveDateTimestampMs(Date.now());
+		session.updatedAtMs = Date.now();
 		this.emitVerificationSummary(session);
 	}
 	observeVerificationOperation(session, operation, onError) {
@@ -897,8 +665,8 @@ var MatrixVerificationManager = class {
 	buildVerificationSummary(session) {
 		const request = session.request;
 		const phase = this.readRequestValue(() => request.phase, VerificationPhase.Requested);
-		const accepting = this.readRequestValue(() => request.accepting, false);
-		const declining = this.readRequestValue(() => request.declining, false);
+		const accepting = request.accepting;
+		const declining = request.declining;
 		const pending = this.readRequestValue(() => request.pending, false);
 		const methods = this.readRequestValue(() => request.methods, []).slice();
 		const sasCallbacks = session.sasCallbacks ?? session.activeVerifier?.getShowSasCallbacks();
@@ -906,12 +674,12 @@ var MatrixVerificationManager = class {
 		const canAccept = phase < VerificationPhase.Ready && !accepting && !declining;
 		return {
 			id: session.id,
-			transactionId: this.readRequestValue(() => request.transactionId, void 0),
-			roomId: this.readRequestValue(() => request.roomId, void 0),
-			otherUserId: this.readRequestValue(() => request.otherUserId, "unknown"),
-			otherDeviceId: this.readRequestValue(() => request.otherDeviceId, void 0),
-			isSelfVerification: this.readRequestValue(() => request.isSelfVerification, false),
-			initiatedByMe: this.readRequestValue(() => request.initiatedByMe, false),
+			transactionId: request.transactionId,
+			roomId: request.roomId,
+			otherUserId: request.otherUserId,
+			otherDeviceId: request.otherDeviceId,
+			isSelfVerification: request.isSelfVerification,
+			initiatedByMe: request.initiatedByMe,
 			phase,
 			phaseName: VerificationPhase[phase]?.toLowerCase() ?? `unknown(${phase})`,
 			pending,
@@ -926,15 +694,15 @@ var MatrixVerificationManager = class {
 			hasReciprocateQr: Boolean(session.reciprocateQrCallbacks),
 			completed: phase === VerificationPhase.Done,
 			error: session.error,
-			createdAt: resolveTimestampMsToIsoString(session.createdAtMs),
-			updatedAt: resolveTimestampMsToIsoString(session.updatedAtMs)
+			createdAt: new Date(session.createdAtMs).toISOString(),
+			updatedAt: new Date(session.updatedAtMs).toISOString()
 		};
 	}
 	findVerificationSession(id) {
 		const direct = this.verificationSessions.get(id);
 		if (direct) return direct;
 		const transactionMatches = Array.from(this.verificationSessions.values()).filter((session) => {
-			return this.readRequestValue(() => session.request.transactionId?.trim(), "") === id;
+			return session.request.transactionId?.trim() === id;
 		});
 		if (transactionMatches.length === 1) return expectDefined(transactionMatches[0], "single Matrix verification session");
 		if (transactionMatches.length > 1) throw new Error(`Matrix verification request id is ambiguous for transaction ${id}; use the verification id instead`);
@@ -954,11 +722,11 @@ var MatrixVerificationManager = class {
 	maybeAutoAcceptInboundRequest(session) {
 		if (session.acceptRequested) return;
 		const request = session.request;
-		const isSelfVerification = this.readRequestValue(() => request.isSelfVerification, false);
-		const initiatedByMe = this.readRequestValue(() => request.initiatedByMe, false);
+		const isSelfVerification = request.isSelfVerification;
+		const initiatedByMe = request.initiatedByMe;
 		const phase = this.readRequestValue(() => request.phase, VerificationPhase.Requested);
-		const accepting = this.readRequestValue(() => request.accepting, false);
-		const declining = this.readRequestValue(() => request.declining, false);
+		const accepting = request.accepting;
+		const declining = request.declining;
 		if (isSelfVerification || initiatedByMe) return;
 		if (phase !== VerificationPhase.Requested || accepting || declining) return;
 		session.acceptRequested = true;
@@ -968,8 +736,8 @@ var MatrixVerificationManager = class {
 	}
 	maybeAutoStartInboundSas(session) {
 		if (session.activeVerifier || session.verifyStarted || session.startRequested) return;
-		if (this.readRequestValue(() => session.request.initiatedByMe, true)) return;
-		if (!this.readRequestValue(() => session.request.isSelfVerification, false)) return;
+		if (session.request.initiatedByMe) return;
+		if (!session.request.isSelfVerification) return;
 		const phase = this.readRequestValue(() => session.request.phase, VerificationPhase.Requested);
 		if (phase < VerificationPhase.Ready || phase >= VerificationPhase.Cancelled) return;
 		const methods = this.readRequestValue(() => session.request.methods, []);
@@ -1021,7 +789,7 @@ var MatrixVerificationManager = class {
 	}
 	maybeAutoConfirmSas(session) {
 		if (session.sasAutoConfirmStarted || session.sasAutoConfirmTimer) return;
-		if (this.readRequestValue(() => session.request.initiatedByMe, true)) return;
+		if (session.request.initiatedByMe) return;
 		const callbacks = session.sasCallbacks ?? session.activeVerifier?.getShowSasCallbacks();
 		if (!callbacks) return;
 		session.sasCallbacks = callbacks;
@@ -1042,8 +810,8 @@ var MatrixVerificationManager = class {
 		session.verifyPromise = this.observeVerificationOperation(session, session.activeVerifier.verify());
 	}
 	async trustOwnDeviceAfterConfirmedSas(session) {
-		if (!this.readRequestValue(() => session.request.isSelfVerification, false)) return;
-		const deviceId = this.readRequestValue(() => session.request.otherDeviceId?.trim(), "");
+		if (!session.request.isSelfVerification) return;
+		const deviceId = session.request.otherDeviceId?.trim();
 		if (!deviceId || !this.opts.trustOwnDeviceAfterSas) return;
 		await this.opts.trustOwnDeviceAfterSas(deviceId);
 	}
@@ -1054,7 +822,7 @@ var MatrixVerificationManager = class {
 			this.touchVerificationSession(existing);
 			return this.buildVerificationSummary(existing);
 		}
-		if (this.readVerificationRequestIdentity(request).transactionId) {
+		if (request.transactionId?.trim()) {
 			for (const existing of this.verificationSessions.values()) if (this.isSameLogicalVerificationRequest(existing.request, request)) {
 				existing.request = request;
 				this.ensureVerificationRequestTracked(existing);
@@ -1063,7 +831,7 @@ var MatrixVerificationManager = class {
 				return this.buildVerificationSummary(existing);
 			}
 		}
-		const now = resolveDateTimestampMs(Date.now());
+		const now = Date.now();
 		const session = {
 			id: `verification-${++this.verificationSessionCounter}`,
 			request,
@@ -1131,10 +899,8 @@ var MatrixVerificationManager = class {
 	}
 	async confirmVerificationSas(id) {
 		const session = this.findVerificationSession(id);
-		const callbacks = session.sasCallbacks ?? session.activeVerifier?.getShowSasCallbacks();
-		if (!callbacks) throw new Error("Matrix SAS confirmation is not available for this verification request");
+		const callbacks = this.requireSasCallbacks(session, "confirmation");
 		this.clearSasAutoConfirmTimer(session);
-		session.sasCallbacks = callbacks;
 		session.sasAutoConfirmStarted = true;
 		await this.confirmSasForSession(session, callbacks);
 		await session.verifyPromise;
@@ -1143,10 +909,8 @@ var MatrixVerificationManager = class {
 	}
 	mismatchVerificationSas(id) {
 		const session = this.findVerificationSession(id);
-		const callbacks = session.sasCallbacks ?? session.activeVerifier?.getShowSasCallbacks();
-		if (!callbacks) throw new Error("Matrix SAS mismatch is not available for this verification request");
+		const callbacks = this.requireSasCallbacks(session, "mismatch");
 		this.clearSasAutoConfirmTimer(session);
-		session.sasCallbacks = callbacks;
 		callbacks.mismatch();
 		this.touchVerificationSession(session);
 		return this.buildVerificationSummary(session);
@@ -1162,17 +926,131 @@ var MatrixVerificationManager = class {
 	}
 	getVerificationSas(id) {
 		const session = this.findVerificationSession(id);
-		const callbacks = session.sasCallbacks ?? session.activeVerifier?.getShowSasCallbacks();
-		if (!callbacks) throw new Error("Matrix SAS data is not available for this verification request");
-		session.sasCallbacks = callbacks;
+		const callbacks = this.requireSasCallbacks(session, "data");
 		return {
 			decimal: callbacks.sas.decimal,
 			emoji: callbacks.sas.emoji
 		};
 	}
+	requireSasCallbacks(session, operation) {
+		const callbacks = session.sasCallbacks ?? session.activeVerifier?.getShowSasCallbacks();
+		if (!callbacks) throw new Error(`Matrix SAS ${operation} is not available for this verification request`);
+		session.sasCallbacks = callbacks;
+		return callbacks;
+	}
 };
 //#endregion
+//#region extensions/matrix/src/matrix/sdk/indexeddb-session.ts
+const registry = resolveGlobalSingleton(Symbol.for("openclaw.matrix.sdkIndexedDbSessions"), () => ({ sessions: /* @__PURE__ */ new Map() }));
+const sessions = registry.sessions;
+function retiredError() {
+	return new DOMException("Matrix crypto IndexedDB generation has retired", "InvalidStateError");
+}
+function trackTransaction(session, transaction) {
+	let settle;
+	const pending = new Promise((resolve) => {
+		settle = resolve;
+	});
+	session.transactions.add(pending);
+	const complete = () => {
+		session.transactions.delete(pending);
+		settle();
+	};
+	transaction.addEventListener("complete", complete, { once: true });
+	transaction.addEventListener("abort", complete, { once: true });
+}
+function admitConnection(session, database) {
+	if (session.connections.has(database)) return;
+	session.connections.add(database);
+	const transaction = database.transaction.bind(database);
+	database.transaction = (...args) => {
+		if (session.state !== "active") throw retiredError();
+		const result = transaction(...args);
+		trackTransaction(session, result);
+		return result;
+	};
+}
+function openForSession(factory, session, name, version) {
+	if (session.state !== "active") throw retiredError();
+	const request = factory.open(name, version);
+	let settle;
+	const pending = new Promise((resolve) => {
+		settle = resolve;
+	});
+	session.pendingOpens.add(pending);
+	const complete = () => {
+		session.pendingOpens.delete(pending);
+		settle();
+	};
+	request.addEventListener("upgradeneeded", () => {
+		admitConnection(session, request.result);
+		if (session.state !== "active") request.transaction?.abort();
+		else if (request.transaction) trackTransaction(session, request.transaction);
+	});
+	request.addEventListener("success", () => {
+		try {
+			admitConnection(session, request.result);
+			if (session.state !== "active") request.result.close();
+		} catch (error) {
+			session.failure = { error };
+			session.state = "failed";
+		} finally {
+			complete();
+		}
+	}, { once: true });
+	request.addEventListener("error", complete, { once: true });
+	return request;
+}
+function installSdkFactory() {
+	if (registry.factory) return;
+	const factory = globalThis.indexedDB;
+	registry.factory = new Proxy(factory, { get(target, key) {
+		if (key === "open") return (name, version) => {
+			const session = sessions.get(name);
+			return session ? openForSession(target, session, name, version) : target.open(name, version);
+		};
+		const value = Reflect.get(target, key, target);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+	globalThis.indexedDB = registry.factory;
+}
+/** Own SDK connections through stop; the physical store lock owns publication. */
+function beginMatrixSdkIndexedDbSession(databasePrefix = "matrix-js-sdk") {
+	installSdkFactory();
+	const names = [`${databasePrefix}::matrix-sdk-crypto`, `${databasePrefix}::matrix-sdk-crypto-meta`];
+	if (names.some((name) => {
+		const previous = sessions.get(name);
+		return previous && previous.state !== "retired";
+	})) throw new Error("Matrix SDK IndexedDB generation is still active or failed retirement");
+	const session = {
+		state: "active",
+		connections: /* @__PURE__ */ new Set(),
+		pendingOpens: /* @__PURE__ */ new Set(),
+		transactions: /* @__PURE__ */ new Set()
+	};
+	for (const name of names) sessions.set(name, session);
+	let retirement;
+	return { retire: () => {
+		retirement ??= (async () => {
+			session.state = "retiring";
+			try {
+				for (const connection of session.connections) connection.close();
+				await Promise.all(session.pendingOpens);
+				for (const connection of session.connections) connection.close();
+				await Promise.all(session.transactions);
+				if (session.failure) throw session.failure.error;
+				session.state = "retired";
+				session.connections.clear();
+			} catch (error) {
+				session.state = "failed";
+				throw error;
+			}
+		})();
+		return retirement;
+	} };
+}
+//#endregion
 //#region extensions/matrix/src/matrix/sdk/crypto-runtime.ts
 installFakeIndexedDbTransactionPruner();
 //#endregion
-export { MatrixCryptoBootstrapper, MatrixDecryptBridge, MatrixVerificationManager, createMatrixCryptoFacade, isMatrixDeviceOwnerVerified, isMatrixDeviceVerifiedInCurrentClient, persistIdbToDisk, restoreIdbFromDisk };
+export { MatrixCryptoBootstrapper, MatrixDecryptBridge, MatrixVerificationManager, beginMatrixSdkIndexedDbSession, createMatrixCryptoFacade, isMatrixDeviceOwnerVerified, isMatrixDeviceVerifiedInCurrentClient, persistIdbToDisk, resolveDefaultIdbSnapshotPath, restoreIdbFromDisk };