@openclaw/matrix 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/.setup/secret-contract-DxyzKSzf.mjs

@@ -0,0 +1,90 @@
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-aEBngJPa.mjs";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import { collectSecretInputAssignment, createChannelSecretContract, hasConfiguredSecretInputValue, hasOwnProperty, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/matrix/src/secret-contract.ts
+function accountSecretOwner(accountId) {
+	return {
+		ownerKind: "account",
+		ownerId: `matrix:${normalizeAccountId(accountId)}`,
+		requiredForGateway: false,
+		disposition: "isolate"
+	};
+}
+const channelSecrets = createChannelSecretContract({
+	channelKey: "matrix",
+	account: ["accessToken", "password"],
+	channel: ["accessToken", "password"],
+	collect(params) {
+		const { channel: matrix, surface } = params;
+		const envAccessTokenConfigured = normalizeSecretStringValue(params.context.env.MATRIX_ACCESS_TOKEN).length > 0;
+		const defaultScopedAccessTokenConfigured = normalizeSecretStringValue(params.context.env[getMatrixScopedEnvVarNames("default").accessToken]).length > 0;
+		const defaultScopedPasswordConfigured = normalizeSecretStringValue(params.context.env[getMatrixScopedEnvVarNames("default").password]).length > 0;
+		const defaultAccount = surface.hasExplicitAccounts ? surface.accounts.find(({ accountId }) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID) : void 0;
+		const defaultAccountEnabled = surface.channelEnabled && (defaultAccount?.enabled ?? true);
+		const defaultAccountAccessTokenConfigured = hasConfiguredSecretInputValue(defaultAccount?.account.accessToken, params.defaults);
+		const defaultAccountPasswordConfigured = hasConfiguredSecretInputValue(defaultAccount?.account.password, params.defaults);
+		const baseAccessTokenConfigured = hasConfiguredSecretInputValue(matrix.accessToken, params.defaults);
+		collectSecretInputAssignment({
+			value: matrix.accessToken,
+			path: "channels.matrix.accessToken",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: defaultAccountEnabled && !defaultAccountAccessTokenConfigured && !defaultScopedAccessTokenConfigured,
+			inactiveReason: "Matrix channel or default account is disabled, or default-account access-token auth overrides the top-level accessToken.",
+			owner: accountSecretOwner(DEFAULT_ACCOUNT_ID),
+			apply: (value) => {
+				matrix.accessToken = value;
+			}
+		});
+		collectSecretInputAssignment({
+			value: matrix.password,
+			path: "channels.matrix.password",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: defaultAccountEnabled && !(baseAccessTokenConfigured || envAccessTokenConfigured || defaultScopedAccessTokenConfigured || defaultAccountAccessTokenConfigured || defaultAccountPasswordConfigured || defaultScopedPasswordConfigured),
+			inactiveReason: "Matrix channel or default account is disabled, or higher-precedence default-account auth is configured.",
+			owner: accountSecretOwner(DEFAULT_ACCOUNT_ID),
+			apply: (value) => {
+				matrix.password = value;
+			}
+		});
+		if (!surface.hasExplicitAccounts) return;
+		for (const { accountId, account, enabled } of surface.accounts) {
+			if (hasOwnProperty(account, "accessToken")) collectSecretInputAssignment({
+				value: account.accessToken,
+				path: `channels.matrix.accounts.${accountId}.accessToken`,
+				expected: "string",
+				defaults: params.defaults,
+				context: params.context,
+				active: enabled,
+				inactiveReason: "Matrix account is disabled.",
+				owner: accountSecretOwner(accountId),
+				apply: (value) => {
+					account.accessToken = value;
+				}
+			});
+			if (!hasOwnProperty(account, "password")) continue;
+			const accountAccessTokenConfigured = hasConfiguredSecretInputValue(account.accessToken, params.defaults);
+			const scopedEnvAccessTokenConfigured = normalizeSecretStringValue(params.context.env[getMatrixScopedEnvVarNames(accountId).accessToken]).length > 0;
+			const inheritedDefaultAccountAccessTokenConfigured = normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID && (baseAccessTokenConfigured || envAccessTokenConfigured);
+			collectSecretInputAssignment({
+				value: account.password,
+				path: `channels.matrix.accounts.${accountId}.password`,
+				expected: "string",
+				defaults: params.defaults,
+				context: params.context,
+				active: enabled && !(accountAccessTokenConfigured || scopedEnvAccessTokenConfigured || inheritedDefaultAccountAccessTokenConfigured),
+				inactiveReason: "Matrix account is disabled or this account has an accessToken configured.",
+				owner: accountSecretOwner(accountId),
+				apply: (value) => {
+					account.password = value;
+				}
+			});
+		}
+	}
+});
+const { secretTargetRegistryEntries, collectRuntimeConfigAssignments } = channelSecrets;
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/.setup/secret-contract-api-Dukgvike.mjs

@@ -0,0 +1,2 @@
+export { t as channelSecrets, n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DxyzKSzf.mjs";
+import "../secret-contract-api.js";

package/dist/.setup/{send-LCOuTVc1.mjs → send-BprM-Wmx.mjs}

@@ -23,7 +23,7 @@ import MarkdownIt from "markdown-it";
 import { isAutoLinkedFileRef } from "openclaw/plugin-sdk/text-autolink-runtime";
 import { parseBuffer } from "music-metadata";
 //#region extensions/matrix/src/matrix/send/client.ts
-const loadMatrixSendClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-D05xy1HB.mjs"));
+const loadMatrixSendClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-kOIDV4z_.mjs"));
 function resolveMediaMaxBytes(accountId, cfg) {
 	if (!cfg) throw new Error("Matrix media limits requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
 	const mediaMaxMb = resolveMatrixAccountConfig({
@@ -532,10 +532,6 @@ function buildTextContent$1(body) {
 		"org.matrix.msc1767.text": body
 	};
 }
-function buildPollFallbackText(question, answers) {
-	if (answers.length === 0) return question;
-	return `${question}\n${answers.map((answer, idx) => `${idx + 1}. ${answer}`).join("\n")}`;
-}
 function buildPollStartContent(poll) {
 	const normalized = normalizePollInput(poll);
 	const answers = normalized.options.map((option, idx) => ({
@@ -543,7 +539,7 @@ function buildPollStartContent(poll) {
 		...buildTextContent$1(option)
 	}));
 	const isMultiple = normalized.maxSelections > 1;
-	const fallbackText = buildPollFallbackText(normalized.question, normalized.options);
+	const fallbackText = `${normalized.question}\n${normalized.options.map((option, idx) => `${idx + 1}. ${option}`).join("\n")}`;
 	return {
 		[M_POLL_START]: {
 			question: buildTextContent$1(normalized.question),
@@ -1550,27 +1546,17 @@ function resolveMatrixMsgType(contentType) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/send/media.ts
-function buildMatrixMediaInfo(params) {
-	const base = {};
-	if (Number.isFinite(params.size)) base.size = params.size;
-	if (params.mimetype) base.mimetype = params.mimetype;
-	const info = params.imageInfo ? {
-		...base,
-		...params.imageInfo
-	} : base;
-	if (typeof params.durationMs === "number") return {
-		...info,
-		duration: params.durationMs
-	};
-	if (!params.imageInfo && Object.keys(info).length === 0) return;
-	return info;
-}
 function buildMediaContent(params) {
 	const base = {
 		msgtype: params.msgtype,
 		body: params.body,
 		filename: params.filename,
-		info: buildMatrixMediaInfo(params)
+		info: {
+			size: params.size,
+			...params.mimetype ? { mimetype: params.mimetype } : {},
+			...params.imageInfo,
+			...typeof params.durationMs === "number" ? { duration: params.durationMs } : {}
+		}
 	};
 	if (!params.file && params.url) base.url = params.url;
 	if (params.file) base.file = params.file;
@@ -1760,7 +1746,14 @@ async function sendMessageMatrix(to, message, opts) {
 			let textRelation = relation;
 			let pendingExtraContent = opts.extraContent;
 			const events = [];
-			const prepareContent = (content, receiptKind) => {
+			const prepareContent = async (content, receiptKind, markdown) => {
+				await enrichMatrixFormattedContent({
+					client,
+					content,
+					markdown,
+					preparedBody: markdown === convertedText ? singleEventBody : void 0,
+					tableMode
+				});
 				events.push({
 					content: withMatrixExtraContentFields(content, pendingExtraContent),
 					receiptKind
@@ -1796,7 +1789,7 @@ async function sendMessageMatrix(to, message, opts) {
 				}) : void 0;
 				const [firstChunk, ...rest] = chunks;
 				const captionMarkdown = useVoice ? "" : firstChunk ?? "";
-				const content = buildMediaContent({
+				await prepareContent(buildMediaContent({
 					msgtype,
 					body: useVoice ? "Voice message" : captionMarkdown || media.fileName || "(file)",
 					url: uploaded.url,
@@ -1808,29 +1801,13 @@ async function sendMessageMatrix(to, message, opts) {
 					relation,
 					isVoice: useVoice,
 					imageInfo
-				});
-				await enrichMatrixFormattedContent({
-					client,
-					content,
-					markdown: captionMarkdown,
-					preparedBody: captionMarkdown === convertedText ? singleEventBody : void 0,
-					tableMode
-				});
-				prepareContent(content, receiptKind);
+				}), receiptKind, captionMarkdown);
 				textChunks = useVoice ? chunks : rest;
 				textRelation = useVoice || threadId ? relation : void 0;
 			}
 			for (const chunk of textChunks) {
 				if (!chunk.trim()) continue;
-				const content = buildTextContent(chunk, textRelation);
-				await enrichMatrixFormattedContent({
-					client,
-					content,
-					markdown: chunk,
-					preparedBody: chunk === convertedText ? singleEventBody : void 0,
-					tableMode
-				});
-				prepareContent(content, "text");
+				await prepareContent(buildTextContent(chunk, textRelation), "text", chunk);
 			}
 			plannedEvents = durableIdentity ? createMatrixPlannedEvents({
 				identity: durableIdentity,

package/dist/.setup/{setup-bootstrap-CV-hHBXu.mjs → setup-bootstrap-DmznRqYe.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
-import "./setup-core-CKnNTfgD.mjs";
-import { n as bootstrapMatrixVerification } from "./verification-B3VswneT.mjs";
+import "./setup-core-DcCk1_Tv.mjs";
+import { n as bootstrapMatrixVerification } from "./verification--qUbmRd-.mjs";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/matrix/src/setup-bootstrap.ts
 async function maybeBootstrapNewEncryptedMatrixAccount(params) {
@@ -41,10 +41,6 @@ async function maybeBootstrapNewEncryptedMatrixAccount(params) {
 	}
 }
 async function runMatrixSetupBootstrapAfterConfigWrite(params) {
-	if (resolveMatrixAccountConfig({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).encryption !== true) return;
 	const bootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
 		previousCfg: params.previousCfg,
 		cfg: params.cfg,

package/dist/.setup/{setup-core-CKnNTfgD.mjs → setup-core-DcCk1_Tv.mjs}

@@ -1,7 +1,7 @@
 import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
 import { a as resolveConfiguredMatrixAccountIds, d as resolveScopedMatrixEnvConfig, f as resolveMatrixAccountStringValues, l as resolveGlobalMatrixEnvConfig, s as resolveMatrixDefaultOrOnlyAccountId, u as resolveMatrixEnvAuthReadiness } from "./account-selection-Bs_jCAaG.mjs";
 import { a as resolveMatrixAccountConfig, o as resolveMatrixBaseConfig, t as findMatrixAccountConfig } from "./account-config-CRsKoMqJ.mjs";
-import { a as loadMatrixCredentials, o as loadMatrixCredentialsAsync, r as credentialsMatchConfig, t as captureMatrixCredentialsEnv } from "./credentials-read-CqRiEAQa.mjs";
+import { a as loadMatrixCredentials, o as loadMatrixCredentialsAsync, r as credentialsMatchConfig, t as captureMatrixCredentialsEnv } from "./credentials-read-D2ULV55A.mjs";
 import { n as resolveMatrixConfigPath, r as shouldStoreMatrixAccountAtTopLevel, t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.mjs";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -125,6 +125,7 @@ function isMatrixAccountConfigured(prepared, stored) {
 	}) : false;
 	return prepared.hasHomeserver && (prepared.hasConfiguredAuth || hasStored);
 }
+/** @deprecated Use resolveMatrixAccountAsync. Final compatibility day: 2026-12-31. */
 function resolveMatrixAccount(params) {
 	const prepared = prepareMatrixAccount(params);
 	const stored = prepared.hasHomeserver && !prepared.hasConfiguredAuth ? loadMatrixCredentials(params.env ?? process.env, prepared.account.accountId) : null;
@@ -391,10 +392,6 @@ const COMMON_SINGLE_ACCOUNT_KEYS_TO_MOVE = /* @__PURE__ */ new Set([
 ]);
 const MATRIX_SINGLE_ACCOUNT_KEYS_TO_MOVE = new Set(matrixSingleAccountKeysToMove);
 const MATRIX_NAMED_ACCOUNT_PROMOTION_KEYS = new Set(matrixNamedAccountPromotionKeys);
-function cloneIfObject(value) {
-	if (value && typeof value === "object") return structuredClone(value);
-	return value;
-}
 function resolveExistingMatrixAccountKey(accounts, targetAccountId) {
 	const normalizedTargetAccountId = normalizeAccountId$1(targetAccountId);
 	return Object.keys(accounts).find((accountId) => normalizeAccountId$1(accountId) === normalizedTargetAccountId) ?? targetAccountId;
@@ -414,7 +411,7 @@ function moveSingleMatrixAccountConfigToNamedAccount(cfg) {
 	if (keysToMove.length === 0) return cfg;
 	const resolvedTargetAccountId = resolveExistingMatrixAccountKey(accounts, resolveSingleAccountPromotionTarget({ channel: base }));
 	const nextAccount = { ...accounts[resolvedTargetAccountId] };
-	for (const key of keysToMove) nextAccount[key] = cloneIfObject(base[key]);
+	for (const key of keysToMove) nextAccount[key] = structuredClone(base[key]);
 	return patchTopLevelChannelConfigSection({
 		cfg,
 		channel: channel$1,
@@ -555,7 +552,7 @@ function createMatrixSetupWizardProxy(loadWizardModule) {
 	};
 }
 const finishMatrixSetupAfterConfigWrite = async ({ previousCfg, cfg, accountId, runtime }) => {
-	const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-CV-hHBXu.mjs");
+	const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-DmznRqYe.mjs");
 	await runMatrixSetupBootstrapAfterConfigWrite({
 		previousCfg,
 		cfg,

package/dist/.setup/setup-plugin-api-BU6UGksW.mjs

@@ -0,0 +1,2 @@
+export { n as matrixSetupPlugin } from "./channel.setup-Be8TYKMA.mjs";
+import "../setup-plugin-api.js";

package/dist/.setup/{startup-verification-CgfUb4yJ.mjs → startup-verification-UU8DUvi4.mjs}

@@ -1,9 +1,8 @@
 import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
-import { o as resolveMatrixSqliteStateEnv, r as assertMatrixSupportedStateFile } from "./retired-state-DW5pLH05.mjs";
-import { o as resolveMatrixStoragePaths, r as recordCurrentStorageMetaDeviceId } from "./storage-DkC6bHgA.mjs";
+import { o as resolveMatrixSqliteStateEnv, r as assertMatrixSupportedStateFile } from "./retired-state-DOCruzWd.mjs";
+import { o as resolveMatrixStoragePaths, r as recordCurrentStorageMetaDeviceId } from "./storage-l8V0XsGM.mjs";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import path from "node:path";
-import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/matrix/src/matrix/monitor/startup-verification.ts
 const STARTUP_VERIFICATION_STATE_FILENAME = "startup-verification.json";
 const STARTUP_VERIFICATION_NAMESPACE = "startup-verification";
@@ -11,20 +10,13 @@ const STARTUP_VERIFICATION_MAX_ENTRIES = 1e3;
 const DEFAULT_STARTUP_VERIFICATION_MODE = "if-unverified";
 const DEFAULT_STARTUP_VERIFICATION_COOLDOWN_HOURS = 24;
 const DEFAULT_STARTUP_VERIFICATION_FAILURE_COOLDOWN_MS = 36e5;
-function normalizeCooldownHours(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_STARTUP_VERIFICATION_COOLDOWN_HOURS;
-	return Math.max(0, value);
-}
 function createStartupVerificationStore(params) {
-	return getMatrixRuntime().state.openKeyedStore({
+	return getMatrixRuntime().state.openKeyedStoreV2({
 		namespace: STARTUP_VERIFICATION_NAMESPACE,
 		maxEntries: STARTUP_VERIFICATION_MAX_ENTRIES,
 		env: resolveMatrixSqliteStateEnv(params)
 	});
 }
-function resolveStartupVerificationTimestamp(nowMs) {
-	return timestampMsToIsoString(nowMs) ?? timestampMsToIsoString(Date.now()) ?? "1970-01-01T00:00:00.000Z";
-}
 function resolveStartupVerificationRetryAfterMs(params) {
 	if (!params.state || params.stateCooldownMs <= 0) return;
 	if (params.state.userId && params.verification.userId && params.state.userId !== params.verification.userId) return;
@@ -64,9 +56,9 @@ async function ensureMatrixStartupVerification(params) {
 		kind: "pending",
 		verification
 	};
-	const cooldownMs = normalizeCooldownHours(params.accountConfig.startupVerificationCooldownHours) * 60 * 60 * 1e3;
+	const cooldownMs = Math.max(0, params.accountConfig.startupVerificationCooldownHours ?? DEFAULT_STARTUP_VERIFICATION_COOLDOWN_HOURS) * 60 * 60 * 1e3;
 	const nowMs = params.nowMs ?? Date.now();
-	const attemptedAt = resolveStartupVerificationTimestamp(nowMs);
+	const attemptedAt = new Date(nowMs).toISOString();
 	const value = await createStartupVerificationStore(stateLocation).lookup(stateKey);
 	const state = value && typeof value === "object" ? value : null;
 	const retryAfterMs = resolveStartupVerificationRetryAfterMs({

package/dist/.setup/state-layout-walk-BQMgMykU.mjs

@@ -0,0 +1,27 @@
+import { c as resolveMatrixStateLayoutChildDepth } from "./storage-paths-B51JM-pC.mjs";
+import path from "node:path";
+import { hasNodeErrorCode } from "@openclaw/fs-safe/path";
+import { walkDirectory } from "@openclaw/fs-safe/walk";
+//#region extensions/matrix/src/matrix/state-layout-walk.ts
+/** Traverse only shipped Matrix layouts; archives and unrelated descendants stay unopened. */
+async function walkMatrixStateFiles(stateDir, includeFile, stateRootDepths = []) {
+	const matrixRoot = path.resolve(stateDir, "matrix");
+	const depths = /* @__PURE__ */ new Map([[matrixRoot, 0]]);
+	const result = await walkDirectory(matrixRoot, {
+		symlinks: "skip",
+		include: (entry) => entry.kind === "file" && includeFile(entry.name, depths.get(path.dirname(entry.path))),
+		descend: (entry) => {
+			const parentDepth = depths.get(path.dirname(entry.path));
+			const depth = entry.name === "state" && stateRootDepths.includes(parentDepth) ? 5 : resolveMatrixStateLayoutChildDepth(parentDepth, entry.name);
+			if (depth === null) return false;
+			depths.set(entry.path, depth);
+			return true;
+		}
+	});
+	return {
+		entries: result.entries,
+		failedDirs: result.failedDirs.filter((failure) => failure.path !== matrixRoot || !hasNodeErrorCode(failure.error, "ENOENT"))
+	};
+}
+//#endregion
+export { walkMatrixStateFiles as t };

package/dist/.setup/{storage-DkC6bHgA.mjs → storage-l8V0XsGM.mjs}

@@ -1,165 +1,12 @@
 import { t as getMatrixRuntime } from "./runtime-1kn1P6io.mjs";
 import { n as isMatrixActiveTokenRootDirectory, r as resolveMatrixAccountStorageRoot } from "./storage-paths-B51JM-pC.mjs";
-import { c as updateMatrixKeyedState, d as writeMatrixStateChunks, i as assertMatrixSupportedStateRoot, l as chunkMatrixStateJson, o as resolveMatrixSqliteStateEnv, r as assertMatrixSupportedStateFile, u as readMatrixStateChunks } from "./retired-state-DW5pLH05.mjs";
+import { c as updateMatrixKeyedState, i as assertMatrixSupportedStateRoot, o as resolveMatrixSqliteStateEnv, r as assertMatrixSupportedStateFile } from "./retired-state-DOCruzWd.mjs";
+import { n as MATRIX_RECOVERY_KEY_FILENAME, o as scoreMatrixCryptoStateInStore, t as MATRIX_IDB_SNAPSHOT_FILENAME } from "./crypto-state-store-D4wrCvFs.mjs";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { createHash, randomUUID } from "node:crypto";
 import path from "node:path";
-import { asSafeIntegerInRange } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs";
 import os from "node:os";
-//#region extensions/matrix/src/matrix/crypto-state-store.ts
-const STATE_KEY = "current";
-const RECOVERY_KEY_NAMESPACE = "recovery-key";
-const LEGACY_CRYPTO_MIGRATION_NAMESPACE = "legacy-crypto-migration";
-const IDB_SNAPSHOT_NAMESPACE = "idb-snapshot";
-const SMALL_STATE_MAX_ENTRIES = 10;
-const IDB_SNAPSHOT_MAX_ENTRIES = 2e4;
-const IDB_SNAPSHOT_MAX_CHUNKS = Math.floor(19999 / 2);
-const IDB_SNAPSHOT_CHUNK_BYTES = 24e3;
-const MATRIX_RECOVERY_KEY_FILENAME = "recovery-key.json";
-const MATRIX_IDB_SNAPSHOT_FILENAME = "crypto-idb-snapshot.json";
-function openMatrixRecoveryKeyStoreOptions(storageRootDir) {
-	return {
-		namespace: RECOVERY_KEY_NAMESPACE,
-		maxEntries: SMALL_STATE_MAX_ENTRIES,
-		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
-	};
-}
-function openMatrixLegacyCryptoMigrationStoreOptions(storageRootDir) {
-	return {
-		namespace: LEGACY_CRYPTO_MIGRATION_NAMESPACE,
-		maxEntries: SMALL_STATE_MAX_ENTRIES,
-		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
-	};
-}
-function openMatrixIdbSnapshotStoreOptions(storageRootDir) {
-	return {
-		namespace: IDB_SNAPSHOT_NAMESPACE,
-		maxEntries: IDB_SNAPSHOT_MAX_ENTRIES,
-		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
-	};
-}
-async function readMatrixRecoveryKeyStateForPathAsync(recoveryKeyPath, stateRuntime) {
-	return normalizeMatrixStoredRecoveryKey(await stateRuntime.openKeyedStore(openMatrixRecoveryKeyStoreOptions(path.dirname(recoveryKeyPath))).lookup(resolveRecoveryKeyStateKeyForPath(recoveryKeyPath)));
-}
-async function writeMatrixRecoveryKeyStateForPathAsync(params) {
-	const payload = normalizeMatrixStoredRecoveryKey(params.payload);
-	if (!payload) throw new Error("Invalid Matrix recovery key state");
-	const store = params.stateRuntime.openKeyedStore(openMatrixRecoveryKeyStoreOptions(path.dirname(params.recoveryKeyPath)));
-	const key = resolveRecoveryKeyStateKeyForPath(params.recoveryKeyPath);
-	if (params.preserveEncodedPrivateKey) {
-		const update = (current) => normalizeMatrixStoredRecoveryKey({
-			...payload,
-			encodedPrivateKey: normalizeMatrixStoredRecoveryKey(current)?.encodedPrivateKey
-		}) ?? void 0;
-		await updateMatrixKeyedState(store, key, update, async () => {
-			if (!store.update) throw new Error("Matrix recovery key store does not support atomic updates");
-			return await store.update(key, update);
-		});
-		return;
-	}
-	await store.register(key, payload);
-}
-async function readMatrixIdbSnapshotJson(storageRootDir, stateRuntime = getMatrixRuntime().state) {
-	const store = stateRuntime.openKeyedStore(openMatrixIdbSnapshotStoreOptions(storageRootDir));
-	const meta = await store.lookup(idbMetaKey());
-	if (!isIdbSnapshotMeta(meta)) return null;
-	const chunks = await readMatrixStateChunks(store, Array.from({ length: meta.chunkCount }, (_, index) => idbChunkKey(meta.generation, index)), "snapshot-chunk");
-	if (!chunks) return null;
-	const snapshotJson = chunks.join("");
-	return meta.digest === digestText(snapshotJson) ? snapshotJson : null;
-}
-async function hasMatrixIdbSnapshotState(storageRootDir) {
-	return isIdbSnapshotMeta(await getMatrixRuntime().state.openKeyedStore(openMatrixIdbSnapshotStoreOptions(storageRootDir)).lookup(idbMetaKey()));
-}
-async function writeMatrixIdbSnapshotJson(params) {
-	const store = (params.stateRuntime ?? getMatrixRuntime().state).openKeyedStore(openMatrixIdbSnapshotStoreOptions(params.storageRootDir));
-	const rows = buildIdbSnapshotRows(params.snapshotJson, params.databaseCount);
-	await writeMatrixStateChunks(store, rows, idbChunkKeyPrefix());
-}
-async function scoreMatrixCryptoStateInStore(storageRootDir) {
-	if (!matrixCryptoStateDatabaseExists(storageRootDir)) return 0;
-	let score = 0;
-	try {
-		const migration = await getMatrixRuntime().state.openKeyedStore(openMatrixLegacyCryptoMigrationStoreOptions(storageRootDir)).lookup(STATE_KEY);
-		if (isRecord(migration) && migration.version === 1 && typeof migration.accountId === "string" && (migration.restoreStatus === "pending" || migration.restoreStatus === "completed" || migration.restoreStatus === "manual-action-required")) score += 3;
-	} catch {}
-	try {
-		if (await readMatrixRecoveryKeyStateForPathAsync(path.join(storageRootDir, "recovery-key.json"), getMatrixRuntime().state)) score += 2;
-	} catch {}
-	try {
-		if (await hasMatrixIdbSnapshotState(storageRootDir)) score += 2;
-	} catch {}
-	return score;
-}
-function matrixCryptoStateDatabaseExists(storageRootDir) {
-	return fs.existsSync(path.join(storageRootDir, "state", "openclaw.sqlite"));
-}
-function resolveRecoveryKeyStateKeyForPath(recoveryKeyPath) {
-	const basename = path.basename(recoveryKeyPath);
-	if (basename === "recovery-key.json") return STATE_KEY;
-	return `file:${createHash("sha256").update(basename, "utf8").digest("hex").slice(0, 32)}`;
-}
-function normalizeMatrixStoredRecoveryKey(value) {
-	if (!isRecord(value) || value.version !== 1 || typeof value.createdAt !== "string" || typeof value.privateKeyBase64 !== "string" || !value.privateKeyBase64.trim()) return null;
-	return {
-		version: 1,
-		createdAt: value.createdAt,
-		keyId: typeof value.keyId === "string" ? value.keyId : null,
-		...typeof value.encodedPrivateKey === "string" ? { encodedPrivateKey: value.encodedPrivateKey } : {},
-		privateKeyBase64: value.privateKeyBase64,
-		...isRecord(value.keyInfo) ? { keyInfo: {
-			...value.keyInfo.passphrase !== void 0 ? { passphrase: value.keyInfo.passphrase } : {},
-			...typeof value.keyInfo.name === "string" ? { name: value.keyInfo.name } : {}
-		} } : {}
-	};
-}
-function buildIdbSnapshotRows(snapshotJson, databaseCount) {
-	const generation = randomUUID().replaceAll("-", "");
-	const chunks = chunkMatrixStateJson(snapshotJson, IDB_SNAPSHOT_CHUNK_BYTES, IDB_SNAPSHOT_MAX_CHUNKS, "Matrix IndexedDB snapshot exceeds SQLite chunk limit").map((data, index) => ({
-		key: idbChunkKey(generation, index),
-		value: {
-			kind: "snapshot-chunk",
-			index,
-			data
-		}
-	}));
-	return {
-		chunks,
-		meta: {
-			key: idbMetaKey(),
-			value: {
-				kind: "meta",
-				version: 1,
-				generation,
-				chunkCount: chunks.length,
-				digest: digestText(snapshotJson),
-				databaseCount,
-				persistedAt: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		}
-	};
-}
-function idbMetaKey() {
-	return `${STATE_KEY}:meta`;
-}
-function idbChunkKeyPrefix() {
-	return `${STATE_KEY}:snapshot:`;
-}
-function idbChunkKey(generation, index) {
-	return `${idbChunkKeyPrefix()}${generation}:${index}`;
-}
-function digestText(value) {
-	return createHash("sha256").update(value, "utf8").digest("hex");
-}
-function isIdbSnapshotMeta(value) {
-	return isRecord(value) && value.kind === "meta" && value.version === 1 && typeof value.generation === "string" && value.generation.trim() !== "" && asSafeIntegerInRange(value.chunkCount, {
-		min: 0,
-		max: IDB_SNAPSHOT_MAX_CHUNKS
-	}) !== void 0 && typeof value.digest === "string" && asSafeIntegerInRange(value.databaseCount, { min: 0 }) !== void 0 && typeof value.persistedAt === "string";
-}
-//#endregion
 //#region extensions/matrix/src/matrix/client/storage-metadata.ts
 const STORAGE_META_NAMESPACE = "storage-meta";
 const STORAGE_META_STATE_KEY = "current";
@@ -193,7 +40,7 @@ function normalizeMatrixStorageMetadata(value) {
 const DEFAULT_ACCOUNT_KEY = "default";
 const STORAGE_META_FILENAME = "storage-meta.json";
 function openStorageMetaStore(rootDir) {
-	return getMatrixRuntime().state.openKeyedStore(openMatrixStorageMetaStoreOptions(rootDir));
+	return getMatrixRuntime().state.openKeyedStoreV2(openMatrixStorageMetaStoreOptions(rootDir));
 }
 async function scoreStorageRoot(rootDir, metadata) {
 	let score = 0;
@@ -336,7 +183,7 @@ async function maybeMigrateLegacyStorage({ storagePaths }) {
 	const { rootDir, storagePath } = storagePaths;
 	await assertMatrixSupportedStateRoot(rootDir);
 	if (!fs.existsSync(storagePath)) return;
-	const syncCache = await import("./sync-cache-state-D4G-fi3t.mjs").then((n) => n.o);
+	const syncCache = await import("./sync-cache-state-Cnm4TCEI.mjs").then((n) => n.o);
 	if (!await syncCache.readLegacyMatrixSyncCacheState(rootDir)) return;
 	const logger = getMatrixRuntime().logging.getChildLogger({ module: "matrix-storage" });
 	fs.mkdirSync(rootDir, { recursive: true });
@@ -344,7 +191,7 @@ async function maybeMigrateLegacyStorage({ storagePaths }) {
 	try {
 		const persisted = await syncCache.readLegacyMatrixSyncCacheState(rootDir);
 		if (!persisted) return;
-		const store = getMatrixRuntime().state.openKeyedStore(syncCache.openMatrixSyncCacheStoreOptions(rootDir));
+		const store = getMatrixRuntime().state.openKeyedStoreV2(syncCache.openMatrixSyncCacheStoreOptions(rootDir));
 		if (!await syncCache.hasMatrixSyncCacheStateInStore({
 			storageRootDir: rootDir,
 			store
@@ -382,13 +229,7 @@ async function mutateStorageMeta(rootDir, mutation) {
 	try {
 		const store = openStorageMetaStore(rootDir);
 		const decode = (value) => normalizeMatrixStorageMetadata(value) ?? {};
-		return await updateMatrixKeyedState(store, STORAGE_META_STATE_KEY, (current) => prepareStorageMetaMutation(decode(current), mutation) ?? void 0, () => {
-			const legacyStore = getMatrixRuntime().state.openSyncKeyedStore(openMatrixStorageMetaStoreOptions(rootDir));
-			const next = prepareStorageMetaMutation(decode(legacyStore.lookup(STORAGE_META_STATE_KEY)), mutation);
-			if (!next) return false;
-			legacyStore.register(STORAGE_META_STATE_KEY, next);
-			return true;
-		}, "skip");
+		return await updateMatrixKeyedState(store, STORAGE_META_STATE_KEY, (current) => prepareStorageMetaMutation(decode(current), mutation) ?? void 0, "skip");
 	} catch {
 		return false;
 	}
@@ -436,4 +277,4 @@ async function repairCurrentTokenStorageMetaDeviceId(params) {
 	});
 }
 //#endregion
-export { resolveMatrixStateFilePath as a, readMatrixIdbSnapshotJson as c, writeMatrixRecoveryKeyStateForPathAsync as d, repairCurrentTokenStorageMetaDeviceId as i, readMatrixRecoveryKeyStateForPathAsync as l, maybeMigrateLegacyStorage as n, resolveMatrixStoragePaths as o, recordCurrentStorageMetaDeviceId as r, writeStorageMeta as s, claimCurrentTokenStorageState as t, writeMatrixIdbSnapshotJson as u };
+export { resolveMatrixStateFilePath as a, repairCurrentTokenStorageMetaDeviceId as i, maybeMigrateLegacyStorage as n, resolveMatrixStoragePaths as o, recordCurrentStorageMetaDeviceId as r, writeStorageMeta as s, claimCurrentTokenStorageState as t };

package/dist/.setup/{subagent-hooks-D8jyeQsO.mjs → subagent-hooks-CSY4iwa_.mjs}

@@ -1,4 +1,4 @@
-import { a as listBindingsForAccount, i as listAllBindings, n as getMatrixThreadBindingManager, o as removeBindingRecord, s as resolveBindingKey } from "./thread-bindings-shared-CbsFNbAY.mjs";
+import { a as listBindingsForAccount, i as listAllBindings, n as getMatrixThreadBindingManager, s as resolveBindingKey } from "./thread-bindings-shared-CPjUA0Ib.mjs";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { getSessionBindingService } from "openclaw/plugin-sdk/conversation-binding-runtime";
 //#region extensions/matrix/src/matrix/subagent-hooks.ts
@@ -21,12 +21,13 @@ async function handleMatrixSubagentEnded(event) {
 			})).some((entry) => entry.bindingId === bindingId)) removedBindingKeys.add(bindingId);
 		}
 	}
-	const affectedAccountIds = /* @__PURE__ */ new Set();
-	for (const binding of matching) {
-		if (removedBindingKeys.has(resolveBindingKey(binding))) continue;
-		if (removeBindingRecord(binding)) affectedAccountIds.add(binding.accountId);
+	const pendingByAccount = /* @__PURE__ */ new Map();
+	for (const binding of matching) if (!removedBindingKeys.has(resolveBindingKey(binding))) {
+		const pending = pendingByAccount.get(binding.accountId) ?? [];
+		pending.push(binding);
+		pendingByAccount.set(binding.accountId, pending);
 	}
-	for (const acctId of affectedAccountIds) await getMatrixThreadBindingManager(acctId)?.persist();
+	for (const [bindingAccountId, pending] of pendingByAccount) await getMatrixThreadBindingManager(bindingAccountId)?.removeBindingsAsync(pending);
 }
 function handleMatrixSubagentDeliveryTarget(event) {
 	if (!event.expectsCompletionMessage) return;

package/dist/.setup/{sync-cache-state-D4G-fi3t.mjs → sync-cache-state-Cnm4TCEI.mjs}

@@ -1,5 +1,5 @@
 import { i as __exportAll } from "./doctor-contract-CsTNmbMa.mjs";
-import { d as writeMatrixStateChunks, l as chunkMatrixStateJson, o as resolveMatrixSqliteStateEnv, u as readMatrixStateChunks } from "./retired-state-DW5pLH05.mjs";
+import { d as writeMatrixStateChunks, l as chunkMatrixStateJson, o as resolveMatrixSqliteStateEnv, u as readMatrixStateChunks } from "./retired-state-DOCruzWd.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import path from "node:path";