@openclaw/matrix 2026.7.2-beta.2 → 2026.7.2-beta.3

package/dist/{account-selection-Bz00QTmQ.js → account-selection-kqquRzCf.js}

@@ -1,5 +1,5 @@
 import { n as listMatrixEnvAccountIds, t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
-import { t as isRecord } from "./record-shared-CvzjvHRn.js";
+import { t as isRecord$1 } from "./record-shared-CWWx6fvI.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { listCombinedAccountIds, listConfiguredAccountIds, resolveListedDefaultAccountId, resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-core";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
@@ -102,20 +102,20 @@ function hasConfiguredDefaultMatrixAccountSource(params) {
 	});
 }
 function resolveMatrixChannelConfig(cfg) {
-	return isRecord(cfg.channels?.matrix) ? cfg.channels.matrix : null;
+	return isRecord$1(cfg.channels?.matrix) ? cfg.channels.matrix : null;
 }
 function findMatrixAccountEntry(cfg, accountId) {
 	const channel = resolveMatrixChannelConfig(cfg);
 	if (!channel) return null;
-	const accounts = isRecord(channel.accounts) ? channel.accounts : null;
+	const accounts = isRecord$1(channel.accounts) ? channel.accounts : null;
 	if (!accounts) return null;
 	const entry = resolveNormalizedAccountEntry(accounts, accountId, normalizeAccountId);
-	return isRecord(entry) ? entry : null;
+	return isRecord$1(entry) ? entry : null;
 }
 function resolveConfiguredMatrixAccountIds(cfg, env = process.env) {
 	const channel = resolveMatrixChannelConfig(cfg);
 	const configuredAccountIds = listConfiguredAccountIds({
-		accounts: channel && isRecord(channel.accounts) ? channel.accounts : void 0,
+		accounts: channel && isRecord$1(channel.accounts) ? channel.accounts : void 0,
 		normalizeAccountId
 	});
 	if (hasConfiguredDefaultMatrixAccountSource({

package/dist/api.js

@@ -1,11 +1,11 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-kqquRzCf.js";
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
-import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-B4_I9iqO.js";
-import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-CYQRY2oG.js";
-import { t as matrixPlugin } from "./channel-B1woOUgk.js";
+import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-gUmSydsW.js";
+import { n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-XCdAx1nY.js";
+import { t as matrixPlugin } from "./channel-j331Xd7b.js";
 import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, n as getMatrixThreadBindingManager, p as setMatrixThreadBindingMaxAgeBySessionKey, s as resetMatrixThreadBindingsForTests } from "./thread-bindings-shared-CKnY4LSd.js";
-import { n as matrixOnboardingAdapter } from "./setup-surface-BjvRQzK6.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-U5ZroBeZ.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-CzUiTe_k.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-Cw194yEn.js";
 //#region extensions/matrix/api.ts
 const matrixSessionBindingAdapterChannels = ["matrix"];
 //#endregion

package/dist/{approval-handler.runtime-BQZdg_dJ.js → approval-handler.runtime-BEa98wwG.js}

@@ -1,9 +1,9 @@
-import { g as resolveMatrixAccount } from "./setup-core-CYQRY2oG.js";
-import { _ as shouldHandleMatrixApprovalRequest, g as isMatrixAnyApprovalClientEnabled } from "./channel-B1woOUgk.js";
+import { g as resolveMatrixAccount } from "./setup-core-XCdAx1nY.js";
+import { _ as shouldHandleMatrixApprovalRequest, g as isMatrixAnyApprovalClientEnabled } from "./channel-j331Xd7b.js";
 import { a as resolveMatrixTargetIdentity } from "./target-ids-B-5aQxwn.js";
-import { a as sendMessageMatrix, i as reactMatrixMessage, p as repairMatrixDirectRooms, s as sendSingleTextMessageMatrix } from "./send-yre1krm8.js";
+import { a as sendMessageMatrix, i as reactMatrixMessage, p as repairMatrixDirectRooms, s as sendSingleTextMessageMatrix } from "./send-BJbrdmNm.js";
 import { a as unregisterMatrixApprovalReactionTarget, n as listMatrixApprovalReactionBindings, r as registerMatrixApprovalReactionTarget, t as buildMatrixApprovalReactionHint } from "./approval-reactions-D-BxBK_L.js";
-import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-DCRbGLMh.js";
+import { n as editMatrixMessage, t as deleteMatrixMessage } from "./messages-3UBHfZrN.js";
 import { listMessageReceiptPlatformIds, resolveMessageReceiptPrimaryId } from "openclaw/plugin-sdk/channel-outbound";
 import { normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelApprovalNativeTargetKey } from "openclaw/plugin-sdk/approval-native-runtime";

package/dist/{approval-ids-De4IhOSN.js → approval-ids-Dfn7oQAm.js}

@@ -1,4 +1,4 @@
-import { a as normalizeMatrixUserId } from "./config-schema-BTSatSY3.js";
+import { a as normalizeMatrixUserId } from "./config-schema-B5GRV8wL.js";
 //#region extensions/matrix/src/approval-ids.ts
 function normalizeMatrixApproverId(value) {
 	return normalizeMatrixUserId(String(value)) || void 0;

package/dist/{approval-reaction-auth-BLJKPLku.js → approval-reaction-auth-kXkCJBGi.js}

@@ -1,5 +1,5 @@
-import { g as resolveMatrixAccount } from "./setup-core-CYQRY2oG.js";
-import { t as normalizeMatrixApproverId } from "./approval-ids-De4IhOSN.js";
+import { g as resolveMatrixAccount } from "./setup-core-XCdAx1nY.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-Dfn7oQAm.js";
 import { resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
 //#region extensions/matrix/src/approval-reaction-auth.ts
 function normalizeMatrixExecApproverId(value) {

package/dist/auth-presence.js

@@ -1,26 +1,18 @@
-import { i as resolveMatrixCredentialsFilename, r as resolveMatrixCredentialsDir } from "./storage-paths-B4_I9iqO.js";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+import { c as normalizeMatrixStoredCredentials, t as MATRIX_CREDENTIALS_NAMESPACE } from "./credentials-read-DVmFCm7X.js";
+import { createPluginStateSyncKeyedStore } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/matrix/auth-presence.ts
-function listMatrixCredentialPaths(_cfg, env = process.env) {
-	const credentialsDir = resolveMatrixCredentialsDir(resolveStateDir(env, os.homedir));
-	const paths = /* @__PURE__ */ new Set([resolveMatrixCredentialsFilename(), resolveMatrixCredentialsFilename("default")]);
-	try {
-		const entries = fs.readdirSync(credentialsDir, { withFileTypes: true });
-		for (const entry of entries) if (entry.isFile() && /^credentials(?:-[a-z0-9._-]+)?\.json$/i.test(entry.name)) paths.add(entry.name);
-	} catch {}
-	return [...paths].map((filename) => path.join(credentialsDir, filename));
-}
 function hasAnyMatrixAuth(params, env = process.env) {
-	return listMatrixCredentialPaths(params && typeof params === "object" && "cfg" in params ? params.cfg : params, params && typeof params === "object" && "cfg" in params ? params.env ?? env : env).some((filePath) => {
-		try {
-			return fs.existsSync(filePath);
-		} catch {
-			return false;
-		}
-	});
+	const resolvedEnv = params && typeof params === "object" && "cfg" in params ? params.env ?? env : env;
+	try {
+		return createPluginStateSyncKeyedStore("matrix", {
+			namespace: MATRIX_CREDENTIALS_NAMESPACE,
+			maxEntries: 256,
+			overflowPolicy: "reject-new",
+			env: resolvedEnv
+		}).entries().some((entry) => normalizeMatrixStoredCredentials(entry.value) !== null);
+	} catch {
+		return false;
+	}
 }
 //#endregion
 export { hasAnyMatrixAuth };

package/dist/{channel-B1woOUgk.js → channel-j331Xd7b.js}

@@ -1,13 +1,13 @@
-import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-Bz00QTmQ.js";
+import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-kqquRzCf.js";
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, n as matrixSetupAdapter, p as listMatrixAccountIds, t as createMatrixSetupWizardProxy, u as namedAccountPromotionKeys } from "./setup-core-CYQRY2oG.js";
-import { a as normalizeMatrixUserId, n as DEFAULT_ACCOUNT_ID$2, r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-BTSatSY3.js";
-import { t as normalizeMatrixApproverId } from "./approval-ids-De4IhOSN.js";
+import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, n as matrixSetupAdapter, p as listMatrixAccountIds, t as createMatrixSetupWizardProxy, u as namedAccountPromotionKeys } from "./setup-core-XCdAx1nY.js";
+import { a as normalizeMatrixUserId, n as DEFAULT_ACCOUNT_ID$2, r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-B5GRV8wL.js";
+import { t as normalizeMatrixApproverId } from "./approval-ids-Dfn7oQAm.js";
 import { a as resolveMatrixTargetIdentity, i as resolveMatrixDirectUserId, n as normalizeMatrixMessagingTarget, r as normalizeMatrixResolvableTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-D2qTLe-C.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BA2Y6Crx.js";
 import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, p as setMatrixThreadBindingMaxAgeBySessionKey } from "./thread-bindings-shared-CKnY4LSd.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-OZoQf0kI.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-M3hRmGO-.js";
 import { n as resolveMatrixInboundConversation, t as defaultTopLevelPlacement } from "./thread-binding-api-DRbBZlhS.js";
 import { createLazyRuntimeModule, createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
@@ -127,7 +127,7 @@ const matrixMessageActions = {
 		return extractToolSend(args, "sendMessage");
 	},
 	handleAction: async (ctx) => {
-		const { handleMatrixAction } = await import("./tool-actions.runtime-BlfTr9b0.js");
+		const { handleMatrixAction } = await import("./tool-actions.runtime-C0jgWYhX.js");
 		const { action, params, cfg, accountId, mediaLocalRoots } = ctx;
 		const dispatch = async (actionParams) => await handleMatrixAction({
 			...actionParams,
@@ -601,7 +601,7 @@ const matrixNativeApprovalCapability = createApproverRestrictedNativeApprovalCap
 			approvalKind,
 			request
 		}),
-		load: async () => (await import("./approval-handler.runtime-BQZdg_dJ.js")).matrixApprovalNativeRuntime
+		load: async () => (await import("./approval-handler.runtime-BEa98wwG.js")).matrixApprovalNativeRuntime
 	})
 });
 const splitMatrixApprovalCapability = splitChannelApprovalCapability(matrixNativeApprovalCapability);
@@ -780,7 +780,7 @@ function resolveMatrixGroupToolPolicy(params) {
 }
 //#endregion
 //#region extensions/matrix/src/resolver.ts
-const loadMatrixChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./resolver.runtime-PPrv3ZHu.js"), "matrixResolverRuntime");
+const loadMatrixChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./resolver.runtime-CC0VVsAt.js"), "matrixResolverRuntime");
 const matrixResolverAdapter = { resolveTargets: async ({ cfg, accountId, inputs, kind, runtime }) => (await loadMatrixChannelRuntime$1()).resolveMatrixTargets({
 	cfg,
 	accountId,
@@ -906,9 +906,9 @@ function resolveMatrixOutboundSessionRoute(params) {
 //#endregion
 //#region extensions/matrix/src/channel.ts
 let matrixStartupLock = Promise.resolve();
-const loadMatrixSetupWizard = createLazyRuntimeNamedExport(() => import("./setup-surface-BjvRQzK6.js").then((n) => n.t), "matrixSetupWizard");
-const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BvJm9z0w.js"), "matrixChannelRuntime");
-const loadMatrixDoctorModule = createLazyRuntimeModule(() => import("./doctor-BGTs609f.js"));
+const loadMatrixSetupWizard = createLazyRuntimeNamedExport(() => import("./setup-surface-CzUiTe_k.js").then((n) => n.t), "matrixSetupWizard");
+const loadMatrixChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BIwlVfQw.js"), "matrixChannelRuntime");
+const loadMatrixDoctorModule = createLazyRuntimeModule(() => import("./doctor-DwUVm5Lw.js"));
 const meta = {
 	id: "matrix",
 	label: "Matrix",
@@ -1281,7 +1281,7 @@ const matrixPlugin = createChatChannelPlugin({
 			await previousLock;
 			let monitorMatrixProvider;
 			try {
-				monitorMatrixProvider = (await import("./monitor-C5EOF9et.js")).monitorMatrixProvider;
+				monitorMatrixProvider = (await import("./monitor-BtUIds8T.js")).monitorMatrixProvider;
 			} finally {
 				releaseLock();
 			}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as matrixPlugin } from "./channel-B1woOUgk.js";
+import { t as matrixPlugin } from "./channel-j331Xd7b.js";
 export { matrixPlugin };

package/dist/{channel.runtime-BvJm9z0w.js → channel.runtime-BIwlVfQw.js}

@@ -1,18 +1,18 @@
-import { a as sendMessageMatrix, c as sendTypingMatrix, o as sendPollMatrix } from "./send-yre1krm8.js";
+import { a as sendMessageMatrix, c as sendTypingMatrix, o as sendPollMatrix } from "./send-BJbrdmNm.js";
 import { t as isBunRuntime } from "./runtime-BefyhPWv.js";
-import { f as resolveMatrixAuth } from "./shared-BfW4lxGu.js";
-import "./client-CPuYbNL8.js";
-import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-0TyS9xep.js";
+import { f as resolveMatrixAuth } from "./shared-DquM1oz6.js";
+import "./client-CA0PULls.js";
+import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-DiC-0XBC.js";
 import { p as resolveOutboundSendDep, r as chunkTextForOutbound } from "./runtime-api-D1xI_cvh.js";
-import { t as resolveMatrixTargets } from "./resolve-targets-Cx1VVArA.js";
+import { t as resolveMatrixTargets } from "./resolve-targets-DVoj-YxB.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { createReplyToFanout } from "openclaw/plugin-sdk/channel-outbound";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { renderMessagePresentationFallbackText } from "openclaw/plugin-sdk/interactive-runtime";
-import { resolvePayloadMediaUrls } from "openclaw/plugin-sdk/reply-payload";
+import { resolvePayloadMediaUrls, sendPayloadMediaSequence } from "openclaw/plugin-sdk/reply-payload";
 //#region extensions/matrix/src/matrix/probe.ts
-const loadMatrixProbeRuntimeDeps = createLazyRuntimeModule(() => import("./probe.runtime-BBvciVfo.js").then((runtimeModule) => ({ createMatrixClient: runtimeModule.createMatrixClient })));
+const loadMatrixProbeRuntimeDeps = createLazyRuntimeModule(() => import("./probe.runtime-sBV-Govx.js").then((runtimeModule) => ({ createMatrixClient: runtimeModule.createMatrixClient })));
 async function probeMatrix(params) {
 	const started = Date.now();
 	const result = {
@@ -160,12 +160,12 @@ const matrixChannelRuntime = {
 			const urls = resolvePayloadMediaUrls(payload);
 			const payloadText = resolveMatrixPayloadText(payload);
 			if (urls.length > 0) {
-				let lastResult;
-				for (let i = 0; i < urls.length; i++) {
-					const isFirst = i === 0;
-					lastResult = await send(to, isFirst ? payloadText : "", {
+				const lastResult = await sendPayloadMediaSequence({
+					text: payloadText,
+					mediaUrls: urls,
+					send: async ({ text, mediaUrl, isFirst }) => await send(to, text, {
 						cfg,
-						mediaUrl: urls[i],
+						mediaUrl,
 						mediaAccess,
 						mediaLocalRoots,
 						mediaReadFile,
@@ -175,9 +175,9 @@ const matrixChannelRuntime = {
 						audioAsVoice: payload.audioAsVoice ?? audioAsVoice,
 						extraContent: isFirst ? resolveMatrixExtraContent(payload) : void 0,
 						onDeliveryResult: resolveMatrixDeliveryProgress(onDeliveryResult)
-					});
-				}
-				return {
+					})
+				});
+				if (lastResult !== void 0) return {
 					channel: "matrix",
 					messageId: lastResult.messageId,
 					roomId: lastResult.roomId
@@ -185,7 +185,6 @@ const matrixChannelRuntime = {
 			}
 			const result = await send(to, payloadText, {
 				cfg,
-				mediaUrl: payload.mediaUrl,
 				mediaAccess,
 				mediaLocalRoots,
 				mediaReadFile,

package/dist/{cli-CLWOkMvw.js → cli-0EcKfqFw.js}

@@ -1,14 +1,14 @@
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { c as resolveMatrixConfigPath, g as resolveMatrixAccount, l as updateMatrixAccountConfig, n as matrixSetupAdapter } from "./setup-core-CYQRY2oG.js";
+import { c as resolveMatrixConfigPath, g as resolveMatrixAccount, l as updateMatrixAccountConfig, n as matrixSetupAdapter } from "./setup-core-XCdAx1nY.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as withResolvedActionClient } from "./client-BUai6s29.js";
-import { p as resolveMatrixAuthContext } from "./shared-BfW4lxGu.js";
-import "./client-CPuYbNL8.js";
+import { n as withResolvedActionClient } from "./client-BtG4quUl.js";
+import { p as resolveMatrixAuthContext } from "./shared-DquM1oz6.js";
+import "./client-CA0PULls.js";
 import { a as formatZonedTimestamp } from "./runtime-api-D1xI_cvh.js";
 import { isOpenClawManagedMatrixDevice, summarizeMatrixDeviceHealth } from "./device-health-D4LBxuPq.js";
-import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-DompcDyu.js";
-import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-CGnI9k1O.js";
+import { n as updateMatrixOwnProfile, t as applyMatrixProfileUpdate } from "./profile-update-Bh2XtJwN.js";
+import { a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, g as runMatrixSelfVerification, h as restoreMatrixRoomKeyBackup, l as getMatrixVerificationSas, m as resetMatrixRoomKeyBackup, n as bootstrapMatrixVerification, p as requestMatrixVerification, r as cancelMatrixVerification, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-DjxyWTNP.js";
 import { t as resolveMatrixRoomKeyBackupIssue } from "./backup-health-Dm_YMVFT.js";
 import { setMatrixSdkConsoleLogging, setMatrixSdkLogMode } from "./logging-QH-48Gr6.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
@@ -36,8 +36,9 @@ async function pruneMatrixStaleGatewayDevices(opts = {}) {
 //#endregion
 //#region extensions/matrix/src/cli.ts
 let matrixCliExitScheduled = false;
-const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-BUai6s29.js").then((n) => n.t));
-const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-yre1krm8.js").then((n) => n.d));
+const MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES = 1024 * 1024;
+const loadMatrixActionClientModule = createLazyRuntimeModule(() => import("./client-BtG4quUl.js").then((n) => n.t));
+const loadMatrixDirectManagementModule = createLazyRuntimeModule(() => import("./send-BJbrdmNm.js").then((n) => n.d));
 function scheduleMatrixCliExit() {
 	if (matrixCliExitScheduled || process.env.VITEST) return;
 	matrixCliExitScheduled = true;
@@ -54,8 +55,14 @@ function markCliFailure() {
 }
 async function readMatrixCliRecoveryKeyFromStdin() {
 	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-	const recoveryKey = Buffer.concat(chunks).toString("utf8").trim();
+	let totalBytes = 0;
+	for await (const chunk of process.stdin) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		totalBytes += buffer.byteLength;
+		if (totalBytes > MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES) throw new Error(`Matrix recovery key stdin exceeds ${MATRIX_CLI_RECOVERY_KEY_STDIN_MAX_BYTES} bytes.`);
+		chunks.push(buffer);
+	}
+	const recoveryKey = Buffer.concat(chunks, totalBytes).toString("utf8").trim();
 	if (!recoveryKey) throw new Error("Matrix recovery key was requested from stdin, but stdin was empty.");
 	return recoveryKey;
 }
@@ -205,7 +212,7 @@ async function addMatrixAccount(params) {
 		backupVersion: null
 	};
 	if (accountConfig.encryption === true) {
-		const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-DXVRCd4G.js");
+		const { maybeBootstrapNewEncryptedMatrixAccount } = await import("./setup-bootstrap-DGPOOdz-.js");
 		verificationBootstrap = await maybeBootstrapNewEncryptedMatrixAccount({
 			previousCfg: cfg,
 			cfg: updated,

package/dist/{cli-metadata-9Naf7in0.js → cli-metadata-Xq1Xb15R.js}

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/matrix/src/cli-metadata.ts
 function registerMatrixCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerMatrixCli } = await import("./cli-CLWOkMvw.js");
+		const { registerMatrixCli } = await import("./cli-0EcKfqFw.js");
 		registerMatrixCli({ program });
 	}, { descriptors: [{
 		name: "matrix",

package/dist/cli-metadata.js

@@ -1,2 +1,2 @@
-import { n as registerMatrixCliMetadata, t as cli_metadata_default } from "./cli-metadata-9Naf7in0.js";
+import { n as registerMatrixCliMetadata, t as cli_metadata_default } from "./cli-metadata-Xq1Xb15R.js";
 export { cli_metadata_default as default, registerMatrixCliMetadata };

package/dist/{client-BUai6s29.js → client-BtG4quUl.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { u as resolveMatrixRoomId } from "./send-yre1krm8.js";
-import { n as withResolvedRuntimeMatrixClient } from "./client-bootstrap-CNVF73sF.js";
+import { u as resolveMatrixRoomId } from "./send-BJbrdmNm.js";
+import { n as withResolvedRuntimeMatrixClient } from "./client-bootstrap-Dk5EAn3n.js";
 //#region extensions/matrix/src/matrix/actions/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	withResolvedActionClient: () => withResolvedActionClient,

package/dist/{client-CPuYbNL8.js → client-CA0PULls.js}

@@ -3,8 +3,8 @@ import { t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
 import { i as resolveScopedMatrixEnvConfig, r as resolveMatrixEnvAuthReadiness, t as hasReadyMatrixEnvAuth } from "./env-auth-CQsYbz-p.js";
 import { n as validateMatrixHomeserverUrl, t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
 import { t as isBunRuntime } from "./runtime-BefyhPWv.js";
-import { d as backfillMatrixAuthDeviceIdAfterStartup, f as resolveMatrixAuth, i as resolveSharedMatrixClient, m as resolveMatrixConfigForAccount, n as releaseSharedClientInstance, o as stopSharedClientForAccount, p as resolveMatrixAuthContext, r as removeSharedClientInstance, s as stopSharedClientInstance, t as acquireSharedMatrixClient } from "./shared-BfW4lxGu.js";
-import { t as createMatrixClient } from "./create-client-85ttAWDP.js";
+import { d as backfillMatrixAuthDeviceIdAfterStartup, f as resolveMatrixAuth, i as resolveSharedMatrixClient, m as resolveMatrixConfigForAccount, n as releaseSharedClientInstance, o as stopSharedClientForAccount, p as resolveMatrixAuthContext, r as removeSharedClientInstance, s as stopSharedClientInstance, t as acquireSharedMatrixClient } from "./shared-DquM1oz6.js";
+import { t as createMatrixClient } from "./create-client-WQExaby_.js";
 //#region extensions/matrix/src/matrix/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
 	acquireSharedMatrixClient: () => acquireSharedMatrixClient,

package/dist/{client-bootstrap-CNVF73sF.js → client-bootstrap-Dk5EAn3n.js}

@@ -8,7 +8,7 @@ var client_bootstrap_exports = /* @__PURE__ */ __exportAll({
 	resolveRuntimeMatrixClientWithReadiness: () => resolveRuntimeMatrixClientWithReadiness,
 	withResolvedRuntimeMatrixClient: () => withResolvedRuntimeMatrixClient
 });
-const loadMatrixSharedClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./client-CPuYbNL8.js").then((n) => n.t), import("./shared-BfW4lxGu.js").then((n) => n.a)]).then(([clientModule, sharedModule]) => ({
+const loadMatrixSharedClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./client-CA0PULls.js").then((n) => n.t), import("./shared-DquM1oz6.js").then((n) => n.a)]).then(([clientModule, sharedModule]) => ({
 	acquireSharedMatrixClient: clientModule.acquireSharedMatrixClient,
 	resolveMatrixAuthContext: clientModule.resolveMatrixAuthContext,
 	releaseSharedClientInstance: sharedModule.releaseSharedClientInstance

package/dist/{config-schema-BTSatSY3.js → config-schema-B5GRV8wL.js}

@@ -1,5 +1,5 @@
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import { g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, p as listMatrixAccountIds } from "./setup-core-CYQRY2oG.js";
+import { g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, p as listMatrixAccountIds } from "./setup-core-XCdAx1nY.js";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChannelConfigUiHints } from "openclaw/plugin-sdk/channel-core";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/contract-api.js

@@ -1,3 +1,3 @@
-import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, n as matrixSetupAdapter, u as namedAccountPromotionKeys } from "./setup-core-CYQRY2oG.js";
-import { n as matrixOnboardingAdapter } from "./setup-surface-BjvRQzK6.js";
+import { d as resolveSingleAccountPromotionTarget, f as singleAccountKeysToMove, n as matrixSetupAdapter, u as namedAccountPromotionKeys } from "./setup-core-XCdAx1nY.js";
+import { n as matrixOnboardingAdapter } from "./setup-surface-CzUiTe_k.js";
 export { matrixSetupAdapter, matrixOnboardingAdapter as matrixSetupWizard, namedAccountPromotionKeys, resolveSingleAccountPromotionTarget, singleAccountKeysToMove };

package/dist/{create-client-85ttAWDP.js → create-client-WQExaby_.js}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage } from "./storage-DD-EnNJE.js";
-import "./shared-BfW4lxGu.js";
+import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage } from "./storage-CzHxeF5E.js";
+import "./shared-DquM1oz6.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import fs from "node:fs";
 import { ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
+import fs from "node:fs";
 //#region extensions/matrix/src/matrix/client/create-client.ts
 var create_client_exports = /* @__PURE__ */ __exportAll({ createMatrixClient: () => createMatrixClient });
-const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-1TXuSiXZ.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
+const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-CIDZXWpZ.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));

package/dist/credentials-W2EmwRhu.js

@@ -0,0 +1,65 @@
+import { a as resolveMatrixCredentialsPath, r as resolveMatrixCredentialsDir } from "./storage-paths-gUmSydsW.js";
+import { a as isMatrixCredentialRevocation, c as normalizeMatrixStoredCredentials, l as openMatrixCredentialsStore, n as clearMatrixCredentials, o as loadMatrixCredentials, r as credentialsMatchConfig, s as matrixCredentialsStoreKey } from "./credentials-read-DVmFCm7X.js";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+//#region extensions/matrix/src/matrix/credentials.ts
+function requireCredentialStoreUpdate(store) {
+	if (!store.update) throw new Error("Matrix credentials require atomic plugin-state updates");
+	return store.update;
+}
+async function saveMatrixCredentials(credentials, env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	const store = openMatrixCredentialsStore(env);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	requireCredentialStoreUpdate(store)(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
+		return {
+			accountId: normalizedAccountId,
+			homeserver: credentials.homeserver,
+			userId: credentials.userId,
+			accessToken: credentials.accessToken,
+			...typeof credentials.deviceId === "string" ? { deviceId: credentials.deviceId } : {},
+			createdAt: existing?.createdAt ?? now,
+			lastUsedAt: now
+		};
+	});
+}
+async function saveBackfilledMatrixDeviceId(credentials, env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	const store = openMatrixCredentialsStore(env);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	let result = "saved";
+	requireCredentialStoreUpdate(store)(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+		if (isMatrixCredentialRevocation(current, normalizedAccountId)) {
+			result = "skipped";
+			return current;
+		}
+		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
+		if (existing && (existing.homeserver !== credentials.homeserver || existing.userId !== credentials.userId || existing.accessToken !== credentials.accessToken)) {
+			result = "skipped";
+			return existing;
+		}
+		return {
+			accountId: normalizedAccountId,
+			homeserver: credentials.homeserver,
+			userId: credentials.userId,
+			accessToken: credentials.accessToken,
+			...typeof credentials.deviceId === "string" ? { deviceId: credentials.deviceId } : {},
+			createdAt: existing?.createdAt ?? now,
+			lastUsedAt: now
+		};
+	});
+	return result;
+}
+async function touchMatrixCredentials(env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	requireCredentialStoreUpdate(openMatrixCredentialsStore(env))(matrixCredentialsStoreKey(normalizedAccountId), (current) => {
+		if (isMatrixCredentialRevocation(current, normalizedAccountId)) return current;
+		const existing = normalizeMatrixStoredCredentials(current, normalizedAccountId);
+		return existing ? {
+			...existing,
+			lastUsedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : void 0;
+	});
+}
+//#endregion
+export { clearMatrixCredentials, credentialsMatchConfig, loadMatrixCredentials, resolveMatrixCredentialsDir, resolveMatrixCredentialsPath, saveBackfilledMatrixDeviceId, saveMatrixCredentials, touchMatrixCredentials };

package/dist/credentials-read-DVmFCm7X.js

@@ -0,0 +1,77 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { n as getOptionalMatrixRuntime } from "./runtime-6S3DNFNv.js";
+import "./storage-paths-gUmSydsW.js";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import { createPluginStateSyncKeyedStore } from "openclaw/plugin-sdk/runtime-doctor";
+//#region extensions/matrix/src/matrix/credentials-read.ts
+var credentials_read_exports = /* @__PURE__ */ __exportAll({
+	MATRIX_CREDENTIALS_MAX_ENTRIES: () => 256,
+	MATRIX_CREDENTIALS_NAMESPACE: () => MATRIX_CREDENTIALS_NAMESPACE,
+	clearMatrixCredentials: () => clearMatrixCredentials,
+	credentialsMatchConfig: () => credentialsMatchConfig,
+	isMatrixCredentialRevocation: () => isMatrixCredentialRevocation,
+	loadMatrixCredentials: () => loadMatrixCredentials,
+	matrixCredentialsStoreKey: () => matrixCredentialsStoreKey,
+	normalizeMatrixStoredCredentials: () => normalizeMatrixStoredCredentials,
+	openMatrixCredentialsStore: () => openMatrixCredentialsStore
+});
+const MATRIX_CREDENTIALS_NAMESPACE = "credentials";
+function matrixCredentialsStoreKey(accountId) {
+	return `account:${normalizeAccountId(accountId)}`;
+}
+function normalizeMatrixStoredCredentials(value, accountId) {
+	if (!value || typeof value !== "object") return null;
+	const parsed = value;
+	if (typeof parsed.homeserver !== "string" || !parsed.homeserver || typeof parsed.userId !== "string" || !parsed.userId || typeof parsed.accessToken !== "string" || !parsed.accessToken || typeof parsed.createdAt !== "string" || !parsed.createdAt) return null;
+	return {
+		accountId: normalizeAccountId(accountId ?? parsed.accountId),
+		homeserver: parsed.homeserver,
+		userId: parsed.userId,
+		accessToken: parsed.accessToken,
+		...typeof parsed.deviceId === "string" ? { deviceId: parsed.deviceId } : {},
+		createdAt: parsed.createdAt,
+		...typeof parsed.lastUsedAt === "string" ? { lastUsedAt: parsed.lastUsedAt } : {}
+	};
+}
+function isMatrixCredentialRevocation(value, accountId) {
+	if (!value || typeof value !== "object") return false;
+	const parsed = value;
+	return parsed.kind === "revoked" && typeof parsed.revokedAt === "string" && parsed.revokedAt.length > 0 && normalizeAccountId(parsed.accountId) === normalizeAccountId(accountId ?? parsed.accountId);
+}
+function openMatrixCredentialsStore(env = process.env) {
+	const runtime = getOptionalMatrixRuntime();
+	const resolvedEnv = env.OPENCLAW_STATE_DIR?.trim() || !runtime ? env : {
+		...env,
+		OPENCLAW_STATE_DIR: runtime.state.resolveStateDir(env)
+	};
+	return createPluginStateSyncKeyedStore("matrix", {
+		namespace: MATRIX_CREDENTIALS_NAMESPACE,
+		maxEntries: 256,
+		overflowPolicy: "reject-new",
+		env: resolvedEnv
+	});
+}
+function loadMatrixCredentials(env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	const parsed = normalizeMatrixStoredCredentials(openMatrixCredentialsStore(env).lookup(matrixCredentialsStoreKey(accountId)), normalizedAccountId);
+	if (!parsed || parsed.accountId !== normalizedAccountId) return null;
+	const { accountId: _accountId, ...credentials } = parsed;
+	return credentials;
+}
+function clearMatrixCredentials(env = process.env, accountId) {
+	const normalizedAccountId = normalizeAccountId(accountId);
+	openMatrixCredentialsStore(env).register(matrixCredentialsStoreKey(normalizedAccountId), {
+		accountId: normalizedAccountId,
+		kind: "revoked",
+		revokedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+function credentialsMatchConfig(stored, config) {
+	if (!config.userId) {
+		if (!config.accessToken) return false;
+		return stored.homeserver === config.homeserver && stored.accessToken === config.accessToken;
+	}
+	return stored.homeserver === config.homeserver && stored.userId === config.userId;
+}
+//#endregion
+export { isMatrixCredentialRevocation as a, normalizeMatrixStoredCredentials as c, credentials_read_exports as i, openMatrixCredentialsStore as l, clearMatrixCredentials as n, loadMatrixCredentials as o, credentialsMatchConfig as r, matrixCredentialsStoreKey as s, MATRIX_CREDENTIALS_NAMESPACE as t };

package/dist/{credentials-write.runtime-BDtpqvj0.js → credentials-write.runtime-Be9zNSUw.js}

@@ -1,6 +1,6 @@
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/matrix/src/matrix/credentials-write.runtime.ts
-const loadMatrixCredentialsRuntime = createLazyRuntimeModule(() => import("./credentials-CncWUieb.js"));
+const loadMatrixCredentialsRuntime = createLazyRuntimeModule(() => import("./credentials-W2EmwRhu.js"));
 async function saveMatrixCredentials(...args) {
 	return (await loadMatrixCredentialsRuntime()).saveMatrixCredentials(...args);
 }

package/dist/{crypto-runtime-DoEB5RpM.js → crypto-runtime-CAff-n15.js}

@@ -1,8 +1,8 @@
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { t as ensureMatrixCryptoRuntime } from "./deps-DDbghaZH.js";
+import { t as ensureMatrixCryptoRuntime } from "./deps-CcVJfvRM.js";
 import { n as LogService, r as noop } from "./logger-D0GCSDQq.js";
-import { i as restoreIdbFromDisk, n as persistIdbToDisk } from "./idb-persistence-BiHEEzD7.js";
-import { n as isRepairableSecretStorageAccessError } from "./recovery-key-store-B2RglalK.js";
+import { i as restoreIdbFromDisk, n as persistIdbToDisk } from "./idb-persistence-Dyy6ipgU.js";
+import { n as isRepairableSecretStorageAccessError } from "./recovery-key-store-CW6eePfp.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { resolveDateTimestampMs, resolveTimestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { MatrixEventEvent } from "matrix-js-sdk/lib/matrix.js";

package/dist/{directory-live-0TyS9xep.js → directory-live-DiC-0XBC.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
-import { f as resolveMatrixAuth } from "./shared-BfW4lxGu.js";
-import "./client-CPuYbNL8.js";
-import { t as MatrixAuthedHttpClient } from "./http-client-Jw5_bwQo.js";
+import { f as resolveMatrixAuth } from "./shared-DquM1oz6.js";
+import "./client-CA0PULls.js";
+import { t as MatrixAuthedHttpClient } from "./http-client-BmrgOZTL.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/directory-live.ts
 var directory_live_exports = /* @__PURE__ */ __exportAll({

package/dist/{doctor-BGTs609f.js → doctor-DwUVm5Lw.js}

@@ -1,4 +1,4 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-D2qTLe-C.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BA2Y6Crx.js";
 import { detectPluginInstallPathIssue, formatPluginInstallPathIssue, removePluginFromConfig } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/matrix/src/doctor.ts
 async function collectMatrixInstallPathWarnings(cfg) {

package/dist/{doctor-contract-D2qTLe-C.js → doctor-contract-BA2Y6Crx.js}

@@ -1,4 +1,4 @@
-import { t as isRecord } from "./record-shared-CvzjvHRn.js";
+import { t as isRecord } from "./record-shared-CWWx6fvI.js";
 import { defineChannelAliasMigration } from "openclaw/plugin-sdk/runtime-doctor";
 import { hasLegacyFlatAllowPrivateNetworkAlias, migrateLegacyFlatAllowPrivateNetworkAlias } from "openclaw/plugin-sdk/ssrf-runtime";
 //#region extensions/matrix/src/doctor-contract.ts