@openclaw/matrix 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/.setup/crypto-state-store-D4wrCvFs.mjs

@@ -0,0 +1,185 @@
+import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
+import { c as updateMatrixKeyedState, d as writeMatrixStateChunks, l as chunkMatrixStateJson, o as resolveMatrixSqliteStateEnv, u as readMatrixStateChunks } from "./retired-state-DOCruzWd.mjs";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash, randomUUID } from "node:crypto";
+import path from "node:path";
+import { asSafeIntegerInRange } from "openclaw/plugin-sdk/number-runtime";
+import fs from "node:fs";
+//#region extensions/matrix/src/matrix/crypto-state-store.ts
+const STATE_KEY = "current";
+const RECOVERY_KEY_NAMESPACE = "recovery-key";
+const LEGACY_CRYPTO_MIGRATION_NAMESPACE = "legacy-crypto-migration";
+const IDB_SNAPSHOT_NAMESPACE = "idb-snapshot";
+const SMALL_STATE_MAX_ENTRIES = 10;
+const IDB_SNAPSHOT_MAX_ENTRIES = 2e4;
+const IDB_SNAPSHOT_MAX_CHUNKS = Math.floor(19999 / 2);
+const IDB_SNAPSHOT_CHUNK_BYTES = 24e3;
+const MATRIX_RECOVERY_KEY_FILENAME = "recovery-key.json";
+const MATRIX_IDB_SNAPSHOT_FILENAME = "crypto-idb-snapshot.json";
+var MatrixIdbSnapshotInvalidError = class extends Error {
+	constructor(reason) {
+		super(`Invalid Matrix crypto SQLite snapshot (${reason}); preserve the account state and restore a valid backup before retrying.`);
+		this.code = "matrix-idb-snapshot-invalid";
+		this.name = "MatrixIdbSnapshotInvalidError";
+	}
+};
+function openMatrixRecoveryKeyStoreOptions(storageRootDir) {
+	return {
+		namespace: RECOVERY_KEY_NAMESPACE,
+		maxEntries: SMALL_STATE_MAX_ENTRIES,
+		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
+	};
+}
+function openMatrixLegacyCryptoMigrationStoreOptions(storageRootDir) {
+	return {
+		namespace: LEGACY_CRYPTO_MIGRATION_NAMESPACE,
+		maxEntries: SMALL_STATE_MAX_ENTRIES,
+		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
+	};
+}
+function openMatrixIdbSnapshotStoreOptions(storageRootDir) {
+	return {
+		namespace: IDB_SNAPSHOT_NAMESPACE,
+		maxEntries: IDB_SNAPSHOT_MAX_ENTRIES,
+		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
+	};
+}
+async function readMatrixRecoveryKeyStateForPathAsync(recoveryKeyPath, stateRuntime) {
+	return normalizeMatrixStoredRecoveryKey(await stateRuntime.openKeyedStoreV2(openMatrixRecoveryKeyStoreOptions(path.dirname(recoveryKeyPath))).lookup(resolveRecoveryKeyStateKeyForPath(recoveryKeyPath)));
+}
+async function writeMatrixRecoveryKeyStateForPathAsync(params) {
+	const payload = normalizeMatrixStoredRecoveryKey(params.payload);
+	if (!payload) throw new Error("Invalid Matrix recovery key state");
+	const store = params.stateRuntime.openKeyedStoreV2(openMatrixRecoveryKeyStoreOptions(path.dirname(params.recoveryKeyPath)));
+	const key = resolveRecoveryKeyStateKeyForPath(params.recoveryKeyPath);
+	if (params.preserveEncodedPrivateKey) {
+		const update = (current) => normalizeMatrixStoredRecoveryKey({
+			...payload,
+			encodedPrivateKey: normalizeMatrixStoredRecoveryKey(current)?.encodedPrivateKey
+		}) ?? void 0;
+		await updateMatrixKeyedState(store, key, update);
+		return;
+	}
+	await store.register(key, payload);
+}
+async function readMatrixIdbSnapshotJson(storageRootDir, stateRuntime = getMatrixRuntime().state) {
+	const store = stateRuntime.openKeyedStoreV2(openMatrixIdbSnapshotStoreOptions(storageRootDir));
+	const meta = await store.lookup(idbMetaKey());
+	if (meta === void 0) {
+		if ((await store.entries()).length !== 0) throw new MatrixIdbSnapshotInvalidError("metadata is missing");
+		return null;
+	}
+	if (!isIdbSnapshotMeta(meta)) throw new MatrixIdbSnapshotInvalidError("metadata is malformed");
+	const chunks = await readMatrixStateChunks(store, Array.from({ length: meta.chunkCount }, (_, index) => idbChunkKey(meta.generation, index)), "snapshot-chunk");
+	if (!chunks) throw new MatrixIdbSnapshotInvalidError("snapshot chunks are missing or malformed");
+	const snapshotJson = chunks.join("");
+	if (meta.digest !== digestText(snapshotJson)) throw new MatrixIdbSnapshotInvalidError("checksum mismatch");
+	return snapshotJson;
+}
+async function readMatrixIdbSnapshotOwnerGeneration(storageRootDir, stateRuntime = getMatrixRuntime().state) {
+	const meta = await stateRuntime.openKeyedStoreV2(openMatrixIdbSnapshotStoreOptions(storageRootDir)).lookup(idbMetaKey());
+	if (meta === void 0) return;
+	if (!isIdbSnapshotMeta(meta)) throw new MatrixIdbSnapshotInvalidError("metadata is malformed");
+	return meta.cleanOwnerGeneration;
+}
+/** Publish last, after the final snapshot and clean sync cursor have settled. */
+async function sealMatrixIdbSnapshotOwnerGeneration(storageRootDir, generation, stateRuntime = getMatrixRuntime().state) {
+	const store = stateRuntime.openKeyedStoreV2(openMatrixIdbSnapshotStoreOptions(storageRootDir));
+	const meta = await store.lookup(idbMetaKey());
+	if (!isIdbSnapshotMeta(meta)) throw new MatrixIdbSnapshotInvalidError("final metadata is missing or malformed");
+	await store.register(idbMetaKey(), {
+		...meta,
+		cleanOwnerGeneration: generation
+	});
+}
+async function hasMatrixIdbSnapshotState(storageRootDir) {
+	return isIdbSnapshotMeta(await getMatrixRuntime().state.openKeyedStoreV2(openMatrixIdbSnapshotStoreOptions(storageRootDir)).lookup(idbMetaKey()));
+}
+async function writeMatrixIdbSnapshotJson(params) {
+	const store = (params.stateRuntime ?? getMatrixRuntime().state).openKeyedStoreV2(openMatrixIdbSnapshotStoreOptions(params.storageRootDir));
+	const rows = buildIdbSnapshotRows(params.snapshotJson, params.databaseCount);
+	await writeMatrixStateChunks(store, rows, idbChunkKeyPrefix());
+}
+async function scoreMatrixCryptoStateInStore(storageRootDir) {
+	if (!matrixCryptoStateDatabaseExists(storageRootDir)) return 0;
+	let score = 0;
+	try {
+		const migration = await getMatrixRuntime().state.openKeyedStoreV2(openMatrixLegacyCryptoMigrationStoreOptions(storageRootDir)).lookup(STATE_KEY);
+		if (isRecord(migration) && migration.version === 1 && typeof migration.accountId === "string" && (migration.restoreStatus === "pending" || migration.restoreStatus === "completed" || migration.restoreStatus === "manual-action-required")) score += 3;
+	} catch {}
+	try {
+		if (await readMatrixRecoveryKeyStateForPathAsync(path.join(storageRootDir, "recovery-key.json"), getMatrixRuntime().state)) score += 2;
+	} catch {}
+	try {
+		if (await hasMatrixIdbSnapshotState(storageRootDir)) score += 2;
+	} catch {}
+	return score;
+}
+function matrixCryptoStateDatabaseExists(storageRootDir) {
+	return fs.existsSync(path.join(storageRootDir, "state", "openclaw.sqlite"));
+}
+function resolveRecoveryKeyStateKeyForPath(recoveryKeyPath) {
+	const basename = path.basename(recoveryKeyPath);
+	if (basename === "recovery-key.json") return STATE_KEY;
+	return `file:${createHash("sha256").update(basename, "utf8").digest("hex").slice(0, 32)}`;
+}
+function normalizeMatrixStoredRecoveryKey(value) {
+	if (!isRecord(value) || value.version !== 1 || typeof value.createdAt !== "string" || typeof value.privateKeyBase64 !== "string" || !value.privateKeyBase64.trim()) return null;
+	return {
+		version: 1,
+		createdAt: value.createdAt,
+		keyId: typeof value.keyId === "string" ? value.keyId : null,
+		...typeof value.encodedPrivateKey === "string" ? { encodedPrivateKey: value.encodedPrivateKey } : {},
+		privateKeyBase64: value.privateKeyBase64,
+		...isRecord(value.keyInfo) ? { keyInfo: {
+			...value.keyInfo.passphrase !== void 0 ? { passphrase: value.keyInfo.passphrase } : {},
+			...typeof value.keyInfo.name === "string" ? { name: value.keyInfo.name } : {}
+		} } : {}
+	};
+}
+function buildIdbSnapshotRows(snapshotJson, databaseCount) {
+	const generation = randomUUID().replaceAll("-", "");
+	const chunks = chunkMatrixStateJson(snapshotJson, IDB_SNAPSHOT_CHUNK_BYTES, IDB_SNAPSHOT_MAX_CHUNKS, "Matrix IndexedDB snapshot exceeds SQLite chunk limit").map((data, index) => ({
+		key: idbChunkKey(generation, index),
+		value: {
+			kind: "snapshot-chunk",
+			index,
+			data
+		}
+	}));
+	return {
+		chunks,
+		meta: {
+			key: idbMetaKey(),
+			value: {
+				kind: "meta",
+				version: 1,
+				generation,
+				chunkCount: chunks.length,
+				digest: digestText(snapshotJson),
+				databaseCount,
+				persistedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		}
+	};
+}
+function idbMetaKey() {
+	return `${STATE_KEY}:meta`;
+}
+function idbChunkKeyPrefix() {
+	return `${STATE_KEY}:snapshot:`;
+}
+function idbChunkKey(generation, index) {
+	return `${idbChunkKeyPrefix()}${generation}:${index}`;
+}
+function digestText(value) {
+	return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function isIdbSnapshotMeta(value) {
+	return isRecord(value) && value.kind === "meta" && value.version === 1 && typeof value.generation === "string" && value.generation.trim() !== "" && asSafeIntegerInRange(value.chunkCount, {
+		min: 0,
+		max: IDB_SNAPSHOT_MAX_CHUNKS
+	}) !== void 0 && typeof value.digest === "string" && asSafeIntegerInRange(value.databaseCount, { min: 0 }) !== void 0 && typeof value.persistedAt === "string" && (value.cleanOwnerGeneration === void 0 || typeof value.cleanOwnerGeneration === "string" && /^[a-f0-9]{32}$/.test(value.cleanOwnerGeneration));
+}
+//#endregion
+export { readMatrixRecoveryKeyStateForPathAsync as a, writeMatrixIdbSnapshotJson as c, readMatrixIdbSnapshotOwnerGeneration as i, writeMatrixRecoveryKeyStateForPathAsync as l, MATRIX_RECOVERY_KEY_FILENAME as n, scoreMatrixCryptoStateInStore as o, readMatrixIdbSnapshotJson as r, sealMatrixIdbSnapshotOwnerGeneration as s, MATRIX_IDB_SNAPSHOT_FILENAME as t };

package/dist/.setup/crypto-store-ownership-Z_Y5WRKr.mjs

@@ -0,0 +1,174 @@
+import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
+import { i as readMatrixIdbSnapshotOwnerGeneration, s as sealMatrixIdbSnapshotOwnerGeneration } from "./crypto-state-store-D4wrCvFs.mjs";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { constants } from "node:fs";
+import fs$1 from "node:fs/promises";
+import { FILE_LOCK_STALE_ERROR_CODE, FILE_LOCK_TIMEOUT_ERROR_CODE, acquireFileLock } from "openclaw/plugin-sdk/file-lock";
+import { syncDirectory } from "@openclaw/fs-safe/durability";
+//#region extensions/matrix/src/matrix/sdk/crypto-store-ownership.ts
+const MATRIX_CRYPTO_STORE_OWNER_ACTIVE_ERROR_CODE = "matrix_crypto_store_owner_active";
+const GUARD_BYTES = 33;
+var MatrixCryptoStoreOwnerActiveError = class extends Error {
+	constructor(cause) {
+		super("Timed out waiting for exclusive Matrix crypto state ownership", { cause });
+		this.code = MATRIX_CRYPTO_STORE_OWNER_ACTIVE_ERROR_CODE;
+		this.name = "MatrixCryptoStoreOwnerActiveError";
+	}
+};
+const LOCK_OPTIONS = {
+	retries: {
+		retries: 0,
+		factor: 1,
+		minTimeout: 0,
+		maxTimeout: 0
+	},
+	stale: 0,
+	staleRecovery: "remove-if-definitely-stale"
+};
+function isContention(error) {
+	return error !== null && typeof error === "object" && "code" in error && (error.code === FILE_LOCK_TIMEOUT_ERROR_CODE || error.code === FILE_LOCK_STALE_ERROR_CODE);
+}
+function filesystemErrorCode(error) {
+	return error !== null && typeof error === "object" && "code" in error ? error.code : void 0;
+}
+function poisonPath(snapshotPath) {
+	return `${snapshotPath}.owner.poisoned`;
+}
+/** Doctor-only lock: inspect and recover refusal state without entering crypto. */
+async function withMatrixCryptoStoreRecoveryLock(snapshotPath, inspect) {
+	const lock = await acquireFileLock(`${snapshotPath}.owner`, LOCK_OPTIONS);
+	try {
+		return await inspect(poisonPath(snapshotPath));
+	} finally {
+		await lock.release();
+	}
+}
+async function syncParentDirectory(filePath) {
+	try {
+		await syncDirectory(path.dirname(filePath));
+	} catch (error) {
+		const code = filesystemErrorCode(error);
+		if (process.platform !== "win32" || ![
+			"EINVAL",
+			"ENOTSUP",
+			"ENOSYS",
+			"EISDIR",
+			"EPERM",
+			"EACCES"
+		].includes(String(code))) throw error;
+	}
+}
+/** Null is a legacy/fresh store without a guard; empty means an invalid or old refusal marker. */
+async function readOwnerGuard(snapshotPath) {
+	const marker = poisonPath(snapshotPath);
+	let stat;
+	try {
+		stat = await fs$1.lstat(marker);
+	} catch (error) {
+		if (filesystemErrorCode(error) === "ENOENT") return null;
+		throw error;
+	}
+	if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Matrix crypto owner guard must be a regular file");
+	if (stat.size !== GUARD_BYTES) return "";
+	const file = await fs$1.open(marker, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+	try {
+		const bytes = Buffer.alloc(GUARD_BYTES);
+		const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+		const value = bytes.toString("utf8");
+		return bytesRead === GUARD_BYTES && /^[a-f0-9]{32}\n$/.test(value) ? value.trimEnd() : "";
+	} finally {
+		await file.close();
+	}
+}
+/** Flush the guard before Rust mutates state; retain its inode across clean generations. */
+async function writeOwnerGuard(snapshotPath, generation, create, onChanged = () => {}) {
+	const marker = poisonPath(snapshotPath);
+	const flags = constants.O_RDWR | (constants.O_NOFOLLOW ?? 0) | (create ? constants.O_CREAT | constants.O_EXCL : 0);
+	const file = await fs$1.open(marker, flags, 384);
+	try {
+		if (!(await file.stat()).isFile()) throw new Error("Matrix crypto owner guard must be a regular file");
+		onChanged();
+		await file.writeFile(`${generation}\n`, "ascii");
+		await file.truncate(GUARD_BYTES);
+		await file.sync();
+	} finally {
+		await file.close();
+	}
+	if (create) await syncParentDirectory(marker);
+}
+/** The caller holds custody. Snapshot checksum and schema validation remain the restore owner's job. */
+async function isMatrixCryptoStoreUnsafe(snapshotPath, stateRuntime = getMatrixRuntime().state) {
+	const guard = await readOwnerGuard(snapshotPath);
+	if (guard === "") return true;
+	const cleanGeneration = await readMatrixIdbSnapshotOwnerGeneration(path.dirname(snapshotPath), stateRuntime);
+	return guard === null ? cleanGeneration !== void 0 : guard !== cleanGeneration;
+}
+/** Doctor has already validated the snapshot and obtained explicit rollback consent under custody. */
+async function sealMatrixCryptoStoreRecovery(snapshotPath, stateRuntime = getMatrixRuntime().state) {
+	const guard = await readOwnerGuard(snapshotPath);
+	const generation = randomUUID().replaceAll("-", "");
+	await writeOwnerGuard(snapshotPath, generation, guard === null);
+	await sealMatrixIdbSnapshotOwnerGeneration(path.dirname(snapshotPath), generation, stateRuntime);
+}
+async function acquireMatrixCryptoStoreOwnership(snapshotPath, options = {}) {
+	const stateRuntime = options.stateRuntime ?? getMatrixRuntime().state;
+	let lock;
+	options.signal?.throwIfAborted();
+	try {
+		lock = await acquireFileLock(`${snapshotPath}.owner`, {
+			...LOCK_OPTIONS,
+			retries: {
+				retries: 25,
+				factor: 1,
+				minTimeout: 200,
+				maxTimeout: 200
+			}
+		});
+	} catch (error) {
+		if (isContention(error)) throw new MatrixCryptoStoreOwnerActiveError(error);
+		throw error;
+	}
+	let previousGuard;
+	try {
+		options.signal?.throwIfAborted();
+		if (await isMatrixCryptoStoreUnsafe(snapshotPath, stateRuntime)) throw new Error("Matrix crypto state has an unresolved unsafe final state (discarded, failed, or lost save); refusing another owner. Preserve the account state and run \"openclaw matrix doctor inspect\". Recovery guidance: https://docs.openclaw.ai/channels/matrix/encryption");
+		previousGuard = await readOwnerGuard(snapshotPath);
+	} catch (error) {
+		await lock.release();
+		throw error;
+	}
+	const generation = randomUUID().replaceAll("-", "");
+	let guardChanged = false;
+	let armPromise;
+	return {
+		armUnsafeState: async () => {
+			armPromise ??= writeOwnerGuard(snapshotPath, generation, previousGuard === null, () => {
+				guardChanged = true;
+			});
+			await armPromise;
+		},
+		cancelUnsafeState: async () => {
+			if (!guardChanged) return;
+			if (previousGuard === null) {
+				await fs$1.unlink(poisonPath(snapshotPath));
+				await syncParentDirectory(poisonPath(snapshotPath));
+			} else await writeOwnerGuard(snapshotPath, previousGuard, false);
+			guardChanged = false;
+			armPromise = void 0;
+		},
+		sealSafeState: async () => {
+			if (!guardChanged) return;
+			await armPromise;
+			try {
+				await sealMatrixIdbSnapshotOwnerGeneration(path.dirname(snapshotPath), generation, stateRuntime);
+			} catch (error) {
+				if (await readMatrixIdbSnapshotOwnerGeneration(path.dirname(snapshotPath), stateRuntime).catch(() => void 0) !== generation) throw error;
+			}
+			guardChanged = false;
+		},
+		release: () => lock.release()
+	};
+}
+//#endregion
+export { withMatrixCryptoStoreRecoveryLock as i, isMatrixCryptoStoreUnsafe as n, sealMatrixCryptoStoreRecovery as r, acquireMatrixCryptoStoreOwnership as t };

package/dist/.setup/crypto-unsafe-state-doctor-C8szCYmf.mjs

@@ -0,0 +1,54 @@
+import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
+import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
+import { r as readMatrixIdbSnapshotJson, t as MATRIX_IDB_SNAPSHOT_FILENAME } from "./crypto-state-store-D4wrCvFs.mjs";
+import { t as walkMatrixStateFiles } from "./state-layout-walk-BQMgMykU.mjs";
+import { i as withMatrixCryptoStoreRecoveryLock, n as isMatrixCryptoStoreUnsafe, r as sealMatrixCryptoStoreRecovery } from "./crypto-store-ownership-Z_Y5WRKr.mjs";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { FILE_LOCK_TIMEOUT_ERROR_CODE } from "openclaw/plugin-sdk/file-lock";
+//#region extensions/matrix/src/matrix/crypto-unsafe-state-doctor.ts
+var crypto_unsafe_state_doctor_exports = /* @__PURE__ */ __exportAll({
+	listMatrixCryptoUnsafeState: () => listMatrixCryptoUnsafeState,
+	recoverMatrixCryptoUnsafeState: () => recoverMatrixCryptoUnsafeState
+});
+const MARKER_NAME = `${MATRIX_IDB_SNAPSHOT_FILENAME}.owner.poisoned`;
+async function listMatrixCryptoUnsafeState(stateDir, stateRuntime) {
+	const { entries, failedDirs } = await walkMatrixStateFiles(stateDir, (name, depth) => (depth === 0 || depth === 4) && name === MARKER_NAME || depth === 5 && name === "openclaw.sqlite", [0, 4]);
+	if (failedDirs.length > 0) throw failedDirs[0].error;
+	const roots = new Set(entries.map((entry) => path.basename(entry.path) === MARKER_NAME ? path.dirname(entry.path) : path.dirname(path.dirname(entry.path))));
+	const abandoned = [];
+	for (const root of roots) {
+		const snapshotPath = path.join(root, MATRIX_IDB_SNAPSHOT_FILENAME);
+		try {
+			if (await withMatrixCryptoStoreRecoveryLock(snapshotPath, () => isMatrixCryptoStoreUnsafe(snapshotPath, stateRuntime ?? getMatrixRuntime().state))) abandoned.push(root);
+		} catch (error) {
+			if (error !== null && typeof error === "object" && "code" in error && error.code === FILE_LOCK_TIMEOUT_ERROR_CODE) continue;
+			throw error;
+		}
+	}
+	return abandoned.toSorted();
+}
+/** A valid snapshot is a rollback point, not proof that the failed owner's last keys were saved. */
+async function recoverMatrixCryptoUnsafeState(params) {
+	if (!params.acceptSnapshotRollback) throw new Error("Matrix crypto recovery requires explicit --accept-snapshot-rollback.");
+	const snapshotPath = path.join(params.storageRootDir, MATRIX_IDB_SNAPSHOT_FILENAME);
+	await withMatrixCryptoStoreRecoveryLock(snapshotPath, async () => {
+		try {
+			await fs.access(path.join(params.storageRootDir, "state", "openclaw.sqlite"));
+		} catch (error) {
+			if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") throw new Error("Matrix crypto SQLite snapshot is absent; refusal remains in place.", { cause: error });
+			throw error;
+		}
+		const snapshot = await readMatrixIdbSnapshotJson(params.storageRootDir, getMatrixRuntime().state);
+		if (!snapshot) throw new Error("Matrix crypto SQLite snapshot is absent or invalid; refusal remains in place.");
+		const { validateMatrixIdbSnapshotJson } = await import("./idb-persistence-BHTYPRe_.mjs");
+		try {
+			await validateMatrixIdbSnapshotJson(snapshot);
+		} catch (error) {
+			throw new Error("Matrix crypto SQLite snapshot cannot be replayed; refusal remains in place.", { cause: error });
+		}
+		await sealMatrixCryptoStoreRecovery(snapshotPath, getMatrixRuntime().state);
+	});
+}
+//#endregion
+export { listMatrixCryptoUnsafeState as n, recoverMatrixCryptoUnsafeState as r, crypto_unsafe_state_doctor_exports as t };

package/dist/.setup/{directory-live-B1WbfSHo.mjs → directory-live-BpSz-FQB.mjs}

@@ -1,6 +1,6 @@
 import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
 import { i as normalizeMatrixMessagingTarget, n as isMatrixQualifiedUserId } from "./target-ids-HhcaKX1n.mjs";
-import { u as resolveMatrixAuth } from "./client-vPPbaxNp.mjs";
+import { u as resolveMatrixAuth } from "./client-C4Gibhzl.mjs";
 import { t as MatrixAuthedHttpClient } from "./http-client-ByR4STVQ.mjs";
 import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/directory-live.ts

package/dist/.setup/{draft-stream-Bdrh7dRt.mjs → draft-stream-DYf0th1n.mjs}

@@ -1,5 +1,5 @@
 import { _ as MsgType } from "./direct-management-B3wYhx_M.mjs";
-import { a as sendSingleTextMessageMatrix, f as prepareMatrixSingleText, t as editMessageMatrix } from "./send-LCOuTVc1.mjs";
+import { a as sendSingleTextMessageMatrix, f as prepareMatrixSingleText, t as editMessageMatrix } from "./send-BprM-Wmx.mjs";
 import { createFinalizableDraftLifecycle } from "openclaw/plugin-sdk/channel-outbound";
 //#region extensions/matrix/src/matrix/draft-stream.ts
 const DEFAULT_THROTTLE_MS = 1e3;

package/dist/.setup/{exec-approvals-BgNWWJg1.mjs → exec-approvals-DaM-5OA5.mjs}

@@ -1,9 +1,9 @@
 import { a as resolveMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
-import { _ as resolveMatrixAccount, g as resolveDefaultMatrixAccountId } from "./setup-core-CKnNTfgD.mjs";
-import { i as normalizeMatrixUserId } from "./channel.setup-CwuYD_CT.mjs";
-import { doesApprovalRequestSelectChannelAccount } from "openclaw/plugin-sdk/approval-native-runtime";
+import { g as resolveDefaultMatrixAccountId, v as resolveMatrixAccountAsync } from "./setup-core-DcCk1_Tv.mjs";
+import { i as normalizeMatrixUserId } from "./channel.setup-Be8TYKMA.mjs";
+import { doesApprovalRequestSelectChannelAccountAsync } from "openclaw/plugin-sdk/approval-native-runtime";
 import { createChannelApprovalAuth, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
-import { createChannelExecApprovalProfile, getExecApprovalReplyMetadata, isChannelExecApprovalClientEnabledFromConfig, isChannelExecApprovalTargetRecipient, matchesApprovalRequestFilters } from "openclaw/plugin-sdk/approval-client-runtime";
+import { createChannelExecApprovalProfileAsync, getExecApprovalReplyMetadata, isChannelExecApprovalClientEnabledFromConfig, isChannelExecApprovalTargetRecipient, matchesApprovalRequestFilters } from "openclaw/plugin-sdk/approval-client-runtime";
 //#region extensions/matrix/src/approval-ids.ts
 function normalizeMatrixApproverId(value) {
 	return normalizeMatrixUserId(String(value)) || void 0;
@@ -29,18 +29,10 @@ function normalizeMatrixExecApproverId(value) {
 	return normalized === "*" ? void 0 : normalized;
 }
 function resolveMatrixExecApprovalConfig(params) {
-	const account = resolveMatrixAccount(params);
-	const config = account.config.execApprovals;
-	if (!config) return;
-	return {
-		...config,
-		enabled: account.enabled && account.configured ? config.enabled : false
-	};
-}
-function isMatrixExecApprovalAccountEligible(params) {
-	const account = resolveMatrixAccount(params);
-	if (!account.enabled || !account.configured) return false;
-	return matchesMatrixApprovalConfig(params);
+	return resolveMatrixAccountConfig({
+		cfg: params.cfg,
+		accountId: params.accountId ?? resolveDefaultMatrixAccountId(params.cfg)
+	}).execApprovals;
 }
 function matchesMatrixApprovalConfig(params) {
 	const config = resolveMatrixExecApprovalConfig(params);
@@ -53,16 +45,17 @@ function matchesMatrixApprovalConfig(params) {
 		sessionFilter: config?.sessionFilter
 	});
 }
-function matchesMatrixRequestAccount(params) {
+async function matchesMatrixRequestAccount(params) {
 	const accountId = params.accountId ?? resolveDefaultMatrixAccountId(params.cfg);
-	return doesApprovalRequestSelectChannelAccount({
+	const account = await resolveMatrixAccountAsync({
+		...params,
+		accountId
+	});
+	return doesApprovalRequestSelectChannelAccountAsync({
 		...params,
 		channel: "matrix",
 		defaultAccountId: resolveDefaultMatrixAccountId(params.cfg),
-		eligibleAccountIds: isMatrixExecApprovalAccountEligible({
-			...params,
-			accountId
-		}) ? [accountId] : []
+		eligibleAccountIds: account.enabled && account.configured && matchesMatrixApprovalConfig(params) ? [accountId] : []
 	});
 }
 function getMatrixExecApprovalApprovers(params) {
@@ -91,39 +84,36 @@ function isMatrixExecApprovalTargetRecipient(params) {
 		matchTarget: ({ target, normalizedSenderId }) => normalizeMatrixApproverId(target.to) === normalizedSenderId
 	});
 }
-const matrixExecApprovalProfile = createChannelExecApprovalProfile({
+const matrixExecApprovalProfile = createChannelExecApprovalProfileAsync({
 	resolveConfig: resolveMatrixExecApprovalConfig,
 	resolveApprovers: getMatrixExecApprovalApprovers,
 	normalizeSenderId: normalizeMatrixApproverId,
-	isTargetRecipient: isMatrixExecApprovalTargetRecipient,
-	matchesRequestAccount: (params) => matchesMatrixRequestAccount({
-		...params,
-		approvalKind: "exec"
-	})
+	isTargetRecipient: isMatrixExecApprovalTargetRecipient
 });
-const isMatrixExecApprovalClientEnabled = matrixExecApprovalProfile.isClientEnabled;
 const isMatrixExecApprovalAuthorizedSender = matrixExecApprovalProfile.isAuthorizedSender;
 const resolveMatrixExecApprovalTarget = matrixExecApprovalProfile.resolveTarget;
-function isMatrixApprovalClientEnabled(params) {
-	if (params.approvalKind === "exec" || params.approvalKind === "system-agent") return isMatrixExecApprovalClientEnabled(params);
-	const config = resolveMatrixExecApprovalConfig(params);
+async function isMatrixApprovalClientEnabled(params) {
+	const account = await resolveMatrixAccountAsync(params);
+	if (!account.enabled || !account.configured) return false;
+	const config = account.config.execApprovals;
 	return isChannelExecApprovalClientEnabledFromConfig({
 		enabled: config?.enabled,
 		approverCount: getMatrixApprovalApprovers(params).length
 	});
 }
-function isMatrixAnyApprovalClientEnabled(params) {
-	return isMatrixApprovalClientEnabled({
-		...params,
-		approvalKind: "exec"
-	}) || isMatrixApprovalClientEnabled({
-		...params,
-		approvalKind: "plugin"
+async function isMatrixAnyApprovalClientEnabled(params) {
+	const account = await resolveMatrixAccountAsync(params);
+	return account.enabled && account.configured && isChannelExecApprovalClientEnabledFromConfig({
+		enabled: account.config.execApprovals?.enabled,
+		approverCount: getMatrixExecApprovalApprovers(params).length + getMatrixApprovalApprovers({
+			...params,
+			approvalKind: "plugin"
+		}).length
 	});
 }
-function shouldHandleMatrixApprovalRequest(params) {
+async function shouldHandleMatrixApprovalRequest(params) {
 	if (params.approvalKind !== "exec" && params.approvalKind !== "plugin" && params.approvalKind !== "system-agent") return false;
-	if (!matchesMatrixRequestAccount(params)) return false;
+	if (!await matchesMatrixRequestAccount(params)) return false;
 	return matchesMatrixApprovalConfig(params);
 }
 function buildFilterCheckRequest(params) {
@@ -151,7 +141,7 @@ function buildFilterCheckRequest(params) {
 		expiresAtMs: 0
 	};
 }
-function shouldSuppressLocalMatrixExecApprovalPrompt(params) {
+async function shouldSuppressLocalMatrixExecApprovalPrompt(params) {
 	if (!matrixExecApprovalProfile.shouldSuppressLocalPrompt(params)) return false;
 	const metadata = getExecApprovalReplyMetadata(params.payload);
 	if (!metadata) return false;
@@ -164,4 +154,4 @@ function shouldSuppressLocalMatrixExecApprovalPrompt(params) {
 	});
 }
 //#endregion
-export { isMatrixExecApprovalAuthorizedSender as a, shouldHandleMatrixApprovalRequest as c, matrixApprovalAuth as d, normalizeMatrixApproverId as f, isMatrixApprovalClientEnabled as i, shouldSuppressLocalMatrixExecApprovalPrompt as l, getMatrixExecApprovalApprovers as n, isMatrixExecApprovalClientEnabled as o, isMatrixAnyApprovalClientEnabled as r, resolveMatrixExecApprovalTarget as s, getMatrixApprovalApprovers as t, getMatrixApprovalAuthApprovers as u };
+export { isMatrixExecApprovalAuthorizedSender as a, shouldSuppressLocalMatrixExecApprovalPrompt as c, normalizeMatrixApproverId as d, isMatrixApprovalClientEnabled as i, getMatrixApprovalAuthApprovers as l, getMatrixExecApprovalApprovers as n, resolveMatrixExecApprovalTarget as o, isMatrixAnyApprovalClientEnabled as r, shouldHandleMatrixApprovalRequest as s, getMatrixApprovalApprovers as t, matrixApprovalAuth as u };

package/dist/.setup/{file-sync-store-BdKx_gMi.mjs → file-sync-store-CUH8EAJq.mjs}

@@ -1,6 +1,6 @@
 import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
-import { t as claimCurrentTokenStorageState } from "./storage-DkC6bHgA.mjs";
-import { a as readPersistedStoreFromStore, r as openMatrixSyncCacheStoreOptions, s as writeMatrixSyncCacheStateToStore, t as deleteMatrixSyncCacheStateFromStore } from "./sync-cache-state-D4G-fi3t.mjs";
+import { t as claimCurrentTokenStorageState } from "./storage-l8V0XsGM.mjs";
+import { a as readPersistedStoreFromStore, r as openMatrixSyncCacheStoreOptions, s as writeMatrixSyncCacheStateToStore, t as deleteMatrixSyncCacheStateFromStore } from "./sync-cache-state-Cnm4TCEI.mjs";
 import { t as LogService } from "./logger-CXQnpXCt.mjs";
 import { MemoryStore, SyncAccumulator } from "matrix-js-sdk/lib/matrix.js";
 import { createAsyncLock } from "openclaw/plugin-sdk/async-lock-runtime";
@@ -19,7 +19,7 @@ var SqliteBackedMatrixSyncStore = class SqliteBackedMatrixSyncStore extends Memo
 		let persisted = null;
 		let unavailableError;
 		try {
-			store = getMatrixRuntime().state.openKeyedStore(openMatrixSyncCacheStoreOptions(storageRootDir));
+			store = getMatrixRuntime().state.openKeyedStoreV2(openMatrixSyncCacheStoreOptions(storageRootDir));
 			persisted = await readPersistedStoreFromStore({
 				storageRootDir,
 				store