@openclaw/matrix 2026.5.27 → 2026.5.28-beta.2

package/dist/{monitor-DO1yiHWm.js → monitor-DjfcOAje.js}

@@ -1,25 +1,24 @@
 import { t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
 import { c as resolveMatrixAccountConfig, s as resolveMatrixAccountAllowlistConfig } from "./config-paths-ZBCMwSos.js";
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { m as resolveConfiguredMatrixBotUserIds } from "./setup-core-s8s_Qudu.js";
-import { a as buildAllowlistResolutionSummary, c as createTypingCallbacks, d as logInboundDrop, f as logTypingFailure, h as toLocationContext, i as addAllowlistUserEntriesFromConfigEntry, l as formatLocationText, m as summarizeMapping, n as resolveMatrixStoredSessionMeta, o as canonicalizeAllowlistWithResolvedIds, p as patchAllowlistUsersInConfigEntries, r as resolveMatrixRoomConfig, s as createReplyPrefixOptions, u as getAgentScopedMediaLocalRoots } from "./channel-BLuA_9If.js";
-import { a as normalizeMatrixUserId, i as normalizeMatrixAllowList, o as resolveMatrixAllowListMatch } from "./config-schema-DuSRVdwT.js";
+import { m as resolveConfiguredMatrixBotUserIds } from "./setup-core-BU4BO6DB.js";
+import { a as buildAllowlistResolutionSummary, c as createTypingCallbacks, d as logInboundDrop, f as logTypingFailure, h as toLocationContext, i as addAllowlistUserEntriesFromConfigEntry, l as formatLocationText, m as summarizeMapping, n as resolveMatrixStoredSessionMeta, o as canonicalizeAllowlistWithResolvedIds, p as patchAllowlistUsersInConfigEntries, r as resolveMatrixRoomConfig, s as createReplyPrefixOptions, u as getAgentScopedMediaLocalRoots } from "./channel-EfS9AcXo.js";
+import { a as normalizeMatrixUserId, i as normalizeMatrixAllowList, o as resolveMatrixAllowListMatch } from "./config-schema-CRsTmqKY.js";
 import { r as isMatrixNotFoundError, t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
 import { i as resolveMatrixStateFilePath } from "./storage-onzulLbU.js";
-import { D as parsePollStartContent, S as formatPollAsText, T as isPollStartType, _ as readJoinedMatrixMembers, a as sendMessageMatrix, f as promoteMatrixDirectRoomCandidate, g as isStrictDirectMembership, h as hasDirectMatrixMemberFlag, t as chunkMatrixText, v as MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY, w as isPollEventType } from "./send-DivaFHb1.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-CLjJrThw.js";
-import { t as createAsyncLock } from "./async-lock-BcLS4KOc.js";
-import { i as throwIfMatrixStartupAborted, o as LogService, r as isMatrixStartupAbortError } from "./startup-abort-Bs0Up_Qx.js";
-import { i as isMatrixMediaSizeLimitError, r as MatrixMediaSizeLimitError } from "./http-client-DJNugFzO.js";
-import { n as isMatrixReadySyncState, r as isMatrixTerminalSyncState, t as isMatrixDisconnectedSyncState } from "./sync-state-CWbp0QSY.js";
-import { a as resolveMatrixMessageBody, i as resolveMatrixMessageAttachment, n as formatMatrixMediaUnavailableText, r as formatMatrixMessageText, s as fetchMatrixPollSnapshot, t as formatMatrixMediaTooLargeText } from "./media-text-C6q1S0AJ.js";
+import { D as parsePollStartContent, S as formatPollAsText, T as isPollStartType, _ as readJoinedMatrixMembers, a as sendMessageMatrix, f as promoteMatrixDirectRoomCandidate, g as isStrictDirectMembership, h as hasDirectMatrixMemberFlag, t as chunkMatrixText, v as MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY, w as isPollEventType } from "./send-DX-aOjPW.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-DjC1mhh_.js";
+import { a as resolveMatrixMessageBody, i as resolveMatrixMessageAttachment, n as formatMatrixMediaUnavailableText, r as formatMatrixMessageText, s as fetchMatrixPollSnapshot, t as formatMatrixMediaTooLargeText } from "./media-text-ybU6tiB2.js";
 import { n as setActiveMatrixClient } from "./active-client-DXvz2gCo.js";
 import { t as isBunRuntime } from "./runtime-BefyhPWv.js";
-import { c as backfillMatrixAuthDeviceIdAfterStartup, i as resolveSharedMatrixClient, l as resolveMatrixAuth, n as releaseSharedClientInstance, u as resolveMatrixAuthContext } from "./shared-3K27tl8e.js";
-import "./client-QO7vDxm0.js";
-import { d as resolveDefaultGroupPolicy, h as warnMissingProviderGroupPolicyFallbackOnce, m as resolveThreadBindingMaxAgeMsForChannel, p as resolveThreadBindingIdleTimeoutMsForChannel, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveAllowlistProviderRuntimeGroupPolicy } from "./runtime-api-B-jlPE4A.js";
-import { t as resolveMatrixTargets } from "./resolve-targets-BPhBqXyj.js";
+import { _ as resolveMatrixAuthContext, f as LogService, g as resolveMatrixAuth, h as backfillMatrixAuthDeviceIdAfterStartup, i as resolveSharedMatrixClient, l as isMatrixStartupAbortError, n as releaseSharedClientInstance, u as throwIfMatrixStartupAborted } from "./shared-CZ622gSf.js";
+import "./client-D6nL0ymL.js";
+import { i as isMatrixMediaSizeLimitError, r as MatrixMediaSizeLimitError } from "./http-client-DJNugFzO.js";
+import { d as resolveDefaultGroupPolicy, h as warnMissingProviderGroupPolicyFallbackOnce, m as resolveThreadBindingMaxAgeMsForChannel, p as resolveThreadBindingIdleTimeoutMsForChannel, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveAllowlistProviderRuntimeGroupPolicy } from "./runtime-api-CsF7Kokd.js";
+import { t as resolveMatrixTargets } from "./resolve-targets-DaTQqtPq.js";
 import { t as formatMatrixEncryptedEventDisabledWarning } from "./encryption-guidance-CU-OAPMg.js";
+import { t as createAsyncLock } from "./async-lock-BcLS4KOc.js";
+import { n as isMatrixReadySyncState, r as isMatrixTerminalSyncState, t as isMatrixDisconnectedSyncState } from "./sync-state-CWbp0QSY.js";
 import { a as EventType, i as resolveMatrixThreadRouting, n as resolveMatrixReplyToEventId, o as RelationType, r as resolveMatrixThreadRootId, t as resolveMatrixInboundRoute } from "./route-DY6at4qJ.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringifiedEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelProgressDraftLineForEntry, createChannelProgressDraftGate, createPreviewMessageReceipt, defineFinalizableLivePreviewAdapter, deliverWithFinalizableLivePreviewAdapter, formatChannelProgressDraftLine, formatChannelProgressDraftLineForEntry, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, mergeChannelProgressDraftLine, normalizeChannelProgressDraftLineIdentity, resolveChannelProgressDraftMaxLines, waitUntilAbort } from "openclaw/plugin-sdk/channel-outbound";
@@ -27,6 +26,7 @@ import { CHANNEL_APPROVAL_NATIVE_RUNTIME_CONTEXT_CAPABILITY } from "openclaw/plu
 import { resolveInboundLastRouteSessionKey } from "openclaw/plugin-sdk/routing";
 import { buildChannelInboundEventContext, hasFinalInboundReplyDispatch, toInboundMediaFacts } from "openclaw/plugin-sdk/channel-inbound";
 import { loadSessionStore, resolveSessionStoreEntry } from "openclaw/plugin-sdk/session-store-runtime";
+import { parseStrictFiniteNumber, resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { readJsonFileWithFallback, writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { format } from "node:util";
 import { buildTtsSupplementMediaPayload, getReplyPayloadTtsSupplement } from "openclaw/plugin-sdk/reply-payload";
@@ -809,7 +809,7 @@ const SAS_NOTICE_RETRY_DELAY_MS = 750;
 const VERIFICATION_EVENT_STARTUP_GRACE_MS = 3e4;
 let matrixDirectRoomDepsPromise;
 async function loadMatrixDirectRoomDeps() {
-	matrixDirectRoomDepsPromise ??= Promise.all([import("./send-DivaFHb1.js").then((n) => n.d), import("./send-DivaFHb1.js").then((n) => n.m)]).then(([directManagementModule, directRoomModule]) => ({
+	matrixDirectRoomDepsPromise ??= Promise.all([import("./send-DX-aOjPW.js").then((n) => n.d), import("./send-DX-aOjPW.js").then((n) => n.m)]).then(([directManagementModule, directRoomModule]) => ({
 		inspectMatrixDirectRooms: directManagementModule.inspectMatrixDirectRooms,
 		isStrictDirectRoom: directRoomModule.isStrictDirectRoom
 	}));
@@ -1411,9 +1411,9 @@ function parseGeoUri(value) {
 	const [coordsPart, ...paramParts] = trimmed.slice(4).split(";");
 	const coords = coordsPart.split(",");
 	if (coords.length < 2) return null;
-	const latitude = Number.parseFloat(coords[0] ?? "");
-	const longitude = Number.parseFloat(coords[1] ?? "");
-	if (!Number.isFinite(latitude) || !Number.isFinite(longitude)) return null;
+	const latitude = parseStrictFiniteNumber(coords[0] ?? "");
+	const longitude = parseStrictFiniteNumber(coords[1] ?? "");
+	if (latitude === void 0 || longitude === void 0) return null;
 	const params = /* @__PURE__ */ new Map();
 	for (const part of paramParts) {
 		const segment = part.trim();
@@ -1427,11 +1427,10 @@ function parseGeoUri(value) {
 		params.set(key, valuePart ? decodeGeoUriParamValue(valuePart) : "");
 	}
 	const accuracyRaw = params.get("u");
-	const accuracy = accuracyRaw ? Number.parseFloat(accuracyRaw) : void 0;
 	return {
 		latitude,
 		longitude,
-		accuracy: Number.isFinite(accuracy) ? accuracy : void 0
+		accuracy: accuracyRaw ? parseStrictFiniteNumber(accuracyRaw) : void 0
 	};
 }
 function resolveMatrixLocation(params) {
@@ -2018,7 +2017,7 @@ let sessionBindingRuntimePromise;
 let matrixReactionEventsPromise;
 let matrixDraftStreamPromise;
 function loadMatrixSendModule() {
-	matrixSendModulePromise ??= import("./send-DivaFHb1.js").then((n) => n.l);
+	matrixSendModulePromise ??= import("./send-DX-aOjPW.js").then((n) => n.l);
 	return matrixSendModulePromise;
 }
 function loadAcpBindingRuntime() {
@@ -2030,11 +2029,11 @@ function loadSessionBindingRuntime() {
 	return sessionBindingRuntimePromise;
 }
 function loadMatrixReactionEvents() {
-	matrixReactionEventsPromise ??= import("./reaction-events-BefH3-Gu.js");
+	matrixReactionEventsPromise ??= import("./reaction-events-gK5X5uu5.js");
 	return matrixReactionEventsPromise;
 }
 function loadMatrixDraftStream() {
-	matrixDraftStreamPromise ??= import("./draft-stream-BBVqdEbn.js");
+	matrixDraftStreamPromise ??= import("./draft-stream-D7KMDYlS.js");
 	return matrixDraftStreamPromise;
 }
 async function matrixTextWouldActivateMentions(client, text) {
@@ -3760,9 +3759,9 @@ function createMatrixRoomInfoResolver(client) {
 let matrixStartupMaintenanceDepsPromise;
 async function loadMatrixStartupMaintenanceDeps() {
 	matrixStartupMaintenanceDepsPromise ??= Promise.all([
-		import("./setup-core-s8s_Qudu.js").then((n) => n.s),
+		import("./setup-core-BU4BO6DB.js").then((n) => n.s),
 		import("./device-health-D4LBxuPq.js"),
-		import("./setup-core-s8s_Qudu.js").then((n) => n.a),
+		import("./setup-core-BU4BO6DB.js").then((n) => n.a),
 		import("./legacy-crypto-restore-BgW3I87R.js"),
 		import("./startup-verification-BmTEngvU.js")
 	]).then(([configUpdateModule, deviceHealthModule, profileModule, legacyCryptoRestoreModule, startupVerificationModule]) => ({
@@ -4108,7 +4107,7 @@ async function monitorMatrixProvider(opts = {}) {
 		cfg,
 		accountId: effectiveAccountId
 	});
-	const resolvedInitialSyncLimit = typeof opts.initialSyncLimit === "number" ? Math.max(0, Math.floor(opts.initialSyncLimit)) : auth.initialSyncLimit;
+	const resolvedInitialSyncLimit = resolveOptionalIntegerOption(opts.initialSyncLimit, { min: 0 }) ?? auth.initialSyncLimit;
 	const authWithLimit = resolvedInitialSyncLimit === auth.initialSyncLimit ? auth : {
 		...auth,
 		initialSyncLimit: resolvedInitialSyncLimit

package/dist/plugin-entry.handlers.runtime.js

@@ -3,7 +3,7 @@ import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runti
 //#region extensions/matrix/src/plugin-entry.runtime.ts
 let matrixVerificationRuntimePromise;
 function loadMatrixVerificationRuntime() {
-	matrixVerificationRuntimePromise ??= import("./verification-Dar6QON4.js").then((n) => n.y);
+	matrixVerificationRuntimePromise ??= import("./verification-CUSz9cFP.js").then((n) => n.y);
 	return matrixVerificationRuntimePromise;
 }
 function sendError(respond, err) {

package/dist/probe.runtime-BjFSknLp.js

@@ -0,0 +1,3 @@
+import { t as createMatrixClient } from "./create-client-D5Ie4y1a.js";
+import "./client-D6nL0ymL.js";
+export { createMatrixClient };

package/dist/{profile-update-B_LpeC8E.js → profile-update-B4HzVfDS.js}

@@ -1,6 +1,6 @@
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { c as resolveMatrixConfigPath, l as updateMatrixAccountConfig, o as syncMatrixOwnProfile } from "./setup-core-s8s_Qudu.js";
-import { n as withResolvedActionClient } from "./client-BgsOzckO.js";
+import { c as resolveMatrixConfigPath, l as updateMatrixAccountConfig, o as syncMatrixOwnProfile } from "./setup-core-BU4BO6DB.js";
+import { n as withResolvedActionClient } from "./client-DxQ7tWJq.js";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 //#region extensions/matrix/src/matrix/actions/profile.ts
 async function updateMatrixOwnProfile(opts = {}) {

package/dist/{reaction-events-BefH3-Gu.js → reaction-events-gK5X5uu5.js}

@@ -7,7 +7,7 @@ import { getSessionBindingService } from "openclaw/plugin-sdk/session-binding-ru
 let approvalReactionAuthPromise;
 let execApprovalResolverPromise;
 function loadApprovalReactionAuth() {
-	approvalReactionAuthPromise ??= import("./approval-reaction-auth-BvK3dXMH.js");
+	approvalReactionAuthPromise ??= import("./approval-reaction-auth-CstZA90i.js");
 	return approvalReactionAuthPromise;
 }
 function loadExecApprovalResolver() {

package/dist/recovery-key-store-B3-wYrMU.js

@@ -0,0 +1,294 @@
+import { n as formatMatrixErrorReason, t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
+import { f as LogService } from "./shared-CZ622gSf.js";
+import { loadJsonFile, saveJsonFile } from "openclaw/plugin-sdk/json-store";
+import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";
+//#region extensions/matrix/src/matrix/sdk/idb-persistence-lock.ts
+const MATRIX_IDB_PERSIST_INTERVAL_MS = 6e4;
+const IDB_SNAPSHOT_LOCK_STALE_MS = 5 * 6e4;
+const IDB_SNAPSHOT_LOCK_RETRY_BASE = {
+	factor: 2,
+	minTimeout: 50,
+	maxTimeout: 5e3,
+	randomize: true
+};
+function computeRetryDelayMs(retries, attempt) {
+	return Math.min(retries.maxTimeout, Math.max(retries.minTimeout, retries.minTimeout * retries.factor ** attempt));
+}
+function computeMinimumRetryWindowMs(retries) {
+	let total = 0;
+	const attempts = Math.max(1, retries.retries + 1);
+	for (let attempt = 0; attempt < attempts - 1; attempt += 1) total += computeRetryDelayMs(retries, attempt);
+	return total;
+}
+function resolveRetriesForMinimumWindowMs(retries, minimumWindowMs) {
+	const resolved = {
+		...retries,
+		retries: 0
+	};
+	while (computeMinimumRetryWindowMs(resolved) < minimumWindowMs) resolved.retries += 1;
+	return resolved;
+}
+const MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS = {
+	retries: resolveRetriesForMinimumWindowMs(IDB_SNAPSHOT_LOCK_RETRY_BASE, MATRIX_IDB_PERSIST_INTERVAL_MS),
+	stale: IDB_SNAPSHOT_LOCK_STALE_MS
+};
+//#endregion
+//#region extensions/matrix/src/matrix/sdk/recovery-key-store.ts
+function isRepairableSecretStorageAccessError(err) {
+	const message = formatMatrixErrorReason(err);
+	if (!message) return false;
+	if (message.includes("getsecretstoragekey callback returned falsey")) return true;
+	if (message.includes("decrypting secret") && message.includes("bad mac")) return true;
+	return false;
+}
+var MatrixRecoveryKeyStore = class {
+	constructor(recoveryKeyPath) {
+		this.recoveryKeyPath = recoveryKeyPath;
+		this.secretStorageKeyCache = /* @__PURE__ */ new Map();
+		this.stagedRecoveryKey = null;
+		this.stagedRecoveryKeyUsed = false;
+		this.stagedCacheKeyIds = /* @__PURE__ */ new Set();
+	}
+	buildCryptoCallbacks() {
+		return {
+			getSecretStorageKey: async ({ keys }) => {
+				const requestedKeyIds = Object.keys(keys ?? {});
+				if (requestedKeyIds.length === 0) return null;
+				const staged = this.resolveStagedSecretStorageKey(requestedKeyIds);
+				if (staged) return staged;
+				for (const keyId of requestedKeyIds) {
+					const cached = this.secretStorageKeyCache.get(keyId);
+					if (cached) return [keyId, new Uint8Array(cached.key)];
+				}
+				const stored = this.loadStoredRecoveryKey();
+				if (!stored?.privateKeyBase64) return null;
+				const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
+				if (privateKey.length === 0) return null;
+				if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
+					this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);
+					return [stored.keyId, privateKey];
+				}
+				const firstRequestedKeyId = requestedKeyIds[0];
+				if (!firstRequestedKeyId) return null;
+				this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);
+				return [firstRequestedKeyId, privateKey];
+			},
+			cacheSecretStorageKey: (keyId, keyInfo, key) => {
+				const privateKey = new Uint8Array(key);
+				const normalizedKeyInfo = {
+					passphrase: keyInfo?.passphrase,
+					name: typeof keyInfo?.name === "string" ? keyInfo.name : void 0
+				};
+				this.rememberSecretStorageKey(keyId, privateKey, normalizedKeyInfo);
+				const stored = this.loadStoredRecoveryKey();
+				this.saveRecoveryKeyToDisk({
+					keyId,
+					keyInfo: normalizedKeyInfo,
+					privateKey,
+					encodedPrivateKey: stored?.encodedPrivateKey
+				});
+			}
+		};
+	}
+	getRecoveryKeySummary() {
+		const stored = this.loadStoredRecoveryKey();
+		if (!stored) return null;
+		return {
+			encodedPrivateKey: stored.encodedPrivateKey,
+			keyId: stored.keyId,
+			createdAt: stored.createdAt
+		};
+	}
+	resolveEncodedRecoveryKeyInput(params) {
+		const encodedPrivateKey = params.encodedPrivateKey.trim();
+		if (!encodedPrivateKey) throw new Error("Matrix recovery key is required");
+		let privateKey;
+		try {
+			privateKey = decodeRecoveryKey(encodedPrivateKey);
+		} catch (err) {
+			throw new Error(`Invalid Matrix recovery key: ${formatMatrixErrorMessage(err)}`, { cause: err });
+		}
+		const keyId = typeof params.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : null;
+		return {
+			encodedPrivateKey,
+			privateKey,
+			keyId,
+			keyInfo: params.keyInfo ?? this.loadStoredRecoveryKey()?.keyInfo
+		};
+	}
+	storeEncodedRecoveryKey(params) {
+		const prepared = this.resolveEncodedRecoveryKeyInput(params);
+		this.saveRecoveryKeyToDisk({
+			keyId: prepared.keyId,
+			keyInfo: prepared.keyInfo,
+			privateKey: prepared.privateKey,
+			encodedPrivateKey: prepared.encodedPrivateKey
+		});
+		if (prepared.keyId) this.rememberSecretStorageKey(prepared.keyId, prepared.privateKey, prepared.keyInfo);
+		return this.getRecoveryKeySummary() ?? {};
+	}
+	stageEncodedRecoveryKey(params) {
+		const prepared = this.resolveEncodedRecoveryKeyInput(params);
+		this.discardStagedRecoveryKey();
+		this.stagedRecoveryKey = {
+			version: 1,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			keyId: prepared.keyId,
+			encodedPrivateKey: prepared.encodedPrivateKey,
+			privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
+			keyInfo: prepared.keyInfo
+		};
+	}
+	hasStagedRecoveryKeyBeenUsed() {
+		return this.stagedRecoveryKeyUsed;
+	}
+	commitStagedRecoveryKey(params) {
+		if (!this.stagedRecoveryKey) return this.getRecoveryKeySummary();
+		const staged = this.stagedRecoveryKey;
+		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+		const keyId = typeof params?.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;
+		this.saveRecoveryKeyToDisk({
+			keyId,
+			keyInfo: params?.keyInfo ?? staged.keyInfo,
+			privateKey,
+			encodedPrivateKey: staged.encodedPrivateKey
+		});
+		this.clearStagedRecoveryKeyTracking();
+		return this.getRecoveryKeySummary();
+	}
+	discardStagedRecoveryKey() {
+		for (const keyId of this.stagedCacheKeyIds) this.secretStorageKeyCache.delete(keyId);
+		this.clearStagedRecoveryKeyTracking();
+	}
+	async bootstrapSecretStorageWithRecoveryKey(crypto, options = {}) {
+		let status = null;
+		const getSecretStorageStatus = crypto.getSecretStorageStatus;
+		if (typeof getSecretStorageStatus === "function") try {
+			status = await getSecretStorageStatus.call(crypto);
+		} catch (err) {
+			LogService.warn("MatrixClientLite", "Failed to read secret storage status:", err);
+		}
+		const hasDefaultSecretStorageKey = Boolean(status?.defaultKeyId);
+		const hasKnownInvalidSecrets = Object.values(status?.secretStorageKeyValidityMap ?? {}).some((valid) => !valid);
+		let generatedRecoveryKey = false;
+		const storedRecovery = this.loadStoredRecoveryKey();
+		const stagedRecovery = this.stagedRecoveryKey;
+		const sourceRecovery = options.forceNewRecoveryKey === true ? null : stagedRecovery ?? storedRecovery;
+		let recoveryKey = sourceRecovery ? {
+			keyInfo: sourceRecovery.keyInfo,
+			privateKey: new Uint8Array(Buffer.from(sourceRecovery.privateKeyBase64, "base64")),
+			encodedPrivateKey: sourceRecovery.encodedPrivateKey
+		} : null;
+		if (recoveryKey && status?.defaultKeyId) {
+			const defaultKeyId = status.defaultKeyId;
+			if (!stagedRecovery) {
+				this.rememberSecretStorageKey(defaultKeyId, recoveryKey.privateKey, recoveryKey.keyInfo);
+				if (storedRecovery && storedRecovery.keyId !== defaultKeyId) this.saveRecoveryKeyToDisk({
+					keyId: defaultKeyId,
+					keyInfo: recoveryKey.keyInfo,
+					privateKey: recoveryKey.privateKey,
+					encodedPrivateKey: recoveryKey.encodedPrivateKey
+				});
+			}
+		}
+		const ensureRecoveryKey = async () => {
+			if (recoveryKey) {
+				if (stagedRecovery) this.stagedRecoveryKeyUsed = true;
+				return recoveryKey;
+			}
+			if (typeof crypto.createRecoveryKeyFromPassphrase !== "function") throw new Error("Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)");
+			recoveryKey = await crypto.createRecoveryKeyFromPassphrase();
+			this.saveRecoveryKeyToDisk(recoveryKey);
+			generatedRecoveryKey = true;
+			return recoveryKey;
+		};
+		const shouldRecreateSecretStorage = options.forceNewSecretStorage === true || !hasDefaultSecretStorageKey || !recoveryKey && status?.ready === false || hasKnownInvalidSecrets;
+		if (hasKnownInvalidSecrets) recoveryKey = null;
+		const secretStorageOptions = { setupNewKeyBackup: options.setupNewKeyBackup === true };
+		if (shouldRecreateSecretStorage) {
+			secretStorageOptions.setupNewSecretStorage = true;
+			secretStorageOptions.createSecretStorageKey = ensureRecoveryKey;
+		}
+		try {
+			await crypto.bootstrapSecretStorage(secretStorageOptions);
+		} catch (err) {
+			if (!(options.allowSecretStorageRecreateWithoutRecoveryKey === true && hasDefaultSecretStorageKey && isRepairableSecretStorageAccessError(err))) throw err;
+			recoveryKey = null;
+			LogService.warn("MatrixClientLite", "Secret storage exists on the server but local recovery material cannot unlock it; recreating secret storage during explicit bootstrap.");
+			await crypto.bootstrapSecretStorage({
+				setupNewSecretStorage: true,
+				setupNewKeyBackup: options.setupNewKeyBackup === true,
+				createSecretStorageKey: ensureRecoveryKey
+			});
+		}
+		if (generatedRecoveryKey && this.recoveryKeyPath) LogService.warn("MatrixClientLite", `Generated Matrix recovery key and saved it to ${this.recoveryKeyPath}. Keep this file secure.`);
+	}
+	clearStagedRecoveryKeyTracking() {
+		this.stagedRecoveryKey = null;
+		this.stagedRecoveryKeyUsed = false;
+		this.stagedCacheKeyIds.clear();
+	}
+	resolveStagedSecretStorageKey(requestedKeyIds) {
+		const staged = this.stagedRecoveryKey;
+		if (!staged?.privateKeyBase64) return null;
+		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+		if (privateKey.length === 0) return null;
+		const keyId = staged.keyId && requestedKeyIds.includes(staged.keyId) ? staged.keyId : requestedKeyIds[0];
+		if (!keyId) return null;
+		this.rememberStagedSecretStorageKey(keyId, privateKey, staged.keyInfo);
+		this.stagedCacheKeyIds.add(keyId);
+		return [keyId, privateKey];
+	}
+	rememberStagedSecretStorageKey(keyId, key, keyInfo) {
+		this.stagedRecoveryKeyUsed = true;
+		this.rememberSecretStorageKey(keyId, key, keyInfo);
+	}
+	rememberSecretStorageKey(keyId, key, keyInfo) {
+		if (!keyId.trim()) return;
+		this.secretStorageKeyCache.set(keyId, {
+			key: new Uint8Array(key),
+			keyInfo
+		});
+	}
+	loadStoredRecoveryKey() {
+		if (!this.recoveryKeyPath) return null;
+		try {
+			const parsed = loadJsonFile(this.recoveryKeyPath);
+			if (parsed?.version !== 1 || typeof parsed.createdAt !== "string" || typeof parsed.privateKeyBase64 !== "string" || !parsed.privateKeyBase64.trim()) return null;
+			return {
+				version: 1,
+				createdAt: parsed.createdAt,
+				keyId: typeof parsed.keyId === "string" ? parsed.keyId : null,
+				encodedPrivateKey: typeof parsed.encodedPrivateKey === "string" ? parsed.encodedPrivateKey : void 0,
+				privateKeyBase64: parsed.privateKeyBase64,
+				keyInfo: parsed.keyInfo && typeof parsed.keyInfo === "object" ? {
+					passphrase: parsed.keyInfo.passphrase,
+					name: typeof parsed.keyInfo.name === "string" ? parsed.keyInfo.name : void 0
+				} : void 0
+			};
+		} catch {
+			return null;
+		}
+	}
+	saveRecoveryKeyToDisk(params) {
+		if (!this.recoveryKeyPath) return;
+		try {
+			const payload = {
+				version: 1,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				keyId: typeof params.keyId === "string" ? params.keyId : null,
+				encodedPrivateKey: params.encodedPrivateKey,
+				privateKeyBase64: Buffer.from(params.privateKey).toString("base64"),
+				keyInfo: params.keyInfo ? {
+					passphrase: params.keyInfo.passphrase,
+					name: params.keyInfo.name
+				} : void 0
+			};
+			saveJsonFile(this.recoveryKeyPath, payload);
+		} catch (err) {
+			LogService.warn("MatrixClientLite", "Failed to persist recovery key:", err);
+		}
+	}
+};
+//#endregion
+export { MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS as i, isRepairableSecretStorageAccessError as n, MATRIX_IDB_PERSIST_INTERVAL_MS as r, MatrixRecoveryKeyStore as t };

package/dist/{resolve-targets-BPhBqXyj.js → resolve-targets-DaTQqtPq.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
-import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-2-Vb6nss.js";
+import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-kLKfwyDt.js";
 import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/resolve-targets.ts
 var resolve_targets_exports = /* @__PURE__ */ __exportAll({ resolveMatrixTargets: () => resolveMatrixTargets });

package/dist/{resolver.runtime-BOS3foyc.js → resolver.runtime-Dj10Iq3r.js}

@@ -1,4 +1,4 @@
-import { t as resolveMatrixTargets } from "./resolve-targets-BPhBqXyj.js";
+import { t as resolveMatrixTargets } from "./resolve-targets-DaTQqtPq.js";
 //#region extensions/matrix/src/resolver.runtime.ts
 const matrixResolverRuntime = { resolveMatrixTargets };
 //#endregion

package/dist/{runtime-api-B-jlPE4A.js → runtime-api-CsF7Kokd.js}

@@ -3,7 +3,7 @@ import "openclaw/plugin-sdk/account-id";
 import { resolveThreadBindingIdleTimeoutMsForChannel, resolveThreadBindingMaxAgeMsForChannel } from "openclaw/plugin-sdk/conversation-runtime";
 import { resolveOutboundSendDep } from "openclaw/plugin-sdk/channel-outbound";
 import { chunkTextForOutbound as chunkTextForOutbound$1 } from "openclaw/plugin-sdk/text-chunking";
-import { createActionGate as createActionGate$1, jsonResult, readNumberParam as readNumberParam$1, readReactionParams, readStringArrayParam, readStringParam as readStringParam$1 } from "openclaw/plugin-sdk/channel-actions";
+import { createActionGate as createActionGate$1, jsonResult, readPositiveIntegerParam as readPositiveIntegerParam$1, readReactionParams, readStringArrayParam, readStringParam as readStringParam$1 } from "openclaw/plugin-sdk/channel-actions";
 import "openclaw/plugin-sdk/routing";
 import "openclaw/plugin-sdk/channel-status";
 import "openclaw/plugin-sdk/channel-config-primitives";
@@ -18,4 +18,4 @@ import { formatZonedTimestamp } from "openclaw/plugin-sdk/time-runtime";
 import "openclaw/plugin-sdk/channel-feedback";
 import { GROUP_POLICY_BLOCKED_LABEL, resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
 import "openclaw/plugin-sdk/acp-binding-runtime";
-export { jsonResult as a, readStringArrayParam as c, resolveDefaultGroupPolicy as d, resolveOutboundSendDep as f, warnMissingProviderGroupPolicyFallbackOnce as h, formatZonedTimestamp as i, readStringParam$1 as l, resolveThreadBindingMaxAgeMsForChannel as m, chunkTextForOutbound$1 as n, readNumberParam$1 as o, resolveThreadBindingIdleTimeoutMsForChannel as p, createActionGate$1 as r, readReactionParams as s, GROUP_POLICY_BLOCKED_LABEL as t, resolveAllowlistProviderRuntimeGroupPolicy as u };
+export { jsonResult as a, readStringArrayParam as c, resolveDefaultGroupPolicy as d, resolveOutboundSendDep as f, warnMissingProviderGroupPolicyFallbackOnce as h, formatZonedTimestamp as i, readStringParam$1 as l, resolveThreadBindingMaxAgeMsForChannel as m, chunkTextForOutbound$1 as n, readPositiveIntegerParam$1 as o, resolveThreadBindingIdleTimeoutMsForChannel as p, createActionGate$1 as r, readReactionParams as s, GROUP_POLICY_BLOCKED_LABEL as t, resolveAllowlistProviderRuntimeGroupPolicy as u };

package/dist/runtime-api.js

@@ -3,7 +3,7 @@ import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConf
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-KzaYveuy.js";
 import { r as setMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { a as resolveMatrixCredentialsPath, c as resolveMatrixLegacyFlatStoreRoot, i as resolveMatrixCredentialsFilename, l as sanitizeMatrixPathSegment, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as resolveMatrixLegacyFlatStoragePaths, t as hashMatrixAccessToken } from "./storage-paths-BV2Z7bns.js";
-import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-CAdiytPJ.js";
+import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-BVWGd2XS.js";
 import { assertHttpUrlTargetsPrivateNetwork, closeDispatcher, createPinnedDispatcher, resolvePinnedHostnameWithPolicy, ssrfPolicyFromAllowPrivateNetwork, ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
 import { writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { formatZonedTimestamp } from "openclaw/plugin-sdk/time-runtime";

package/dist/runtime-heavy-api.js

@@ -1,3 +1,3 @@
-import { a as detectLegacyMatrixCrypto, i as autoPrepareLegacyMatrixCrypto, n as hasPendingMatrixMigration, o as autoMigrateLegacyMatrixState, r as resolveMatrixMigrationStatus, s as detectLegacyMatrixState, t as hasActionableMatrixMigration } from "./matrix-migration.runtime-BhJb4ZII.js";
+import { a as detectLegacyMatrixCrypto, i as autoPrepareLegacyMatrixCrypto, n as hasPendingMatrixMigration, o as autoMigrateLegacyMatrixState, r as resolveMatrixMigrationStatus, s as detectLegacyMatrixState, t as hasActionableMatrixMigration } from "./matrix-migration.runtime-CZOep_JX.js";
 import { t as maybeCreateMatrixMigrationSnapshot } from "./migration-snapshot-backup-YcCrSjbE.js";
 export { autoMigrateLegacyMatrixState, autoPrepareLegacyMatrixCrypto, detectLegacyMatrixCrypto, detectLegacyMatrixState, hasActionableMatrixMigration, hasPendingMatrixMigration, maybeCreateMatrixMigrationSnapshot, resolveMatrixMigrationStatus };