@openclaw/matrix 2026.7.2-beta.2 → 2026.7.2-beta.4

package/dist/{directory-live-0TyS9xep.js → directory-live-B6fbX6jf.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
-import { f as resolveMatrixAuth } from "./shared-BfW4lxGu.js";
-import "./client-CPuYbNL8.js";
-import { t as MatrixAuthedHttpClient } from "./http-client-Jw5_bwQo.js";
+import { f as resolveMatrixAuth } from "./shared-C7Vm9RxI.js";
+import "./client-Dg8dk8NW.js";
+import { t as MatrixAuthedHttpClient } from "./http-client-DOyTG9l2.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/directory-live.ts
 var directory_live_exports = /* @__PURE__ */ __exportAll({

package/dist/{doctor-BGTs609f.js → doctor-C0LPJGTz.js}

@@ -1,4 +1,4 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-D2qTLe-C.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-CWVdlRQR.js";
 import { detectPluginInstallPathIssue, formatPluginInstallPathIssue, removePluginFromConfig } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/matrix/src/doctor.ts
 async function collectMatrixInstallPathWarnings(cfg) {

package/dist/doctor-contract-CWVdlRQR.js

@@ -0,0 +1,183 @@
+import { t as isRecord } from "./record-shared-CWWx6fvI.js";
+import { defineChannelAliasMigration, hasLegacyAccountStreamingAliases, normalizeChannelConfigEntries, stripRetiredChannelKeys } from "openclaw/plugin-sdk/runtime-doctor";
+import { hasLegacyFlatAllowPrivateNetworkAlias, migrateLegacyFlatAllowPrivateNetworkAlias } from "openclaw/plugin-sdk/ssrf-runtime";
+//#region extensions/matrix/src/doctor-contract.ts
+function parseMatrixStreamingMode(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim().toLowerCase();
+	return normalized === "partial" || normalized === "quiet" || normalized === "progress" || normalized === "off" ? normalized : null;
+}
+const streamingAliasMigration = defineChannelAliasMigration({
+	channelId: "matrix",
+	streaming: {
+		defaultMode: "off",
+		resolveMode: (entry) => {
+			const streaming = isRecord(entry.streaming) ? entry.streaming : null;
+			const parsed = parseMatrixStreamingMode(streaming ? streaming.mode : entry.streaming);
+			if (parsed) return parsed;
+			return entry.streaming === true ? "partial" : "off";
+		}
+	},
+	accountStreamingReplacesRoot: true
+});
+function hasLegacyMatrixRoomAllowAlias(value) {
+	const room = isRecord(value) ? value : null;
+	return Boolean(room && typeof room.allow === "boolean");
+}
+function hasLegacyMatrixRoomMapAllowAliases(value) {
+	const rooms = isRecord(value) ? value : null;
+	return Boolean(rooms && Object.values(rooms).some((room) => hasLegacyMatrixRoomAllowAlias(room)));
+}
+function hasLegacyTrustedDmPolicy(value) {
+	const root = isRecord(value) ? value : null;
+	if (!root) return false;
+	return (isRecord(root.dm) ? root.dm : null)?.policy === "trusted";
+}
+function migrateLegacyTrustedDmPolicy(params) {
+	const dm = isRecord(params.entry.dm) ? params.entry.dm : null;
+	if (!dm || dm.policy !== "trusted") return {
+		entry: params.entry,
+		changed: false
+	};
+	const allowFromRaw = dm.allowFrom;
+	const allowFromEntries = Array.isArray(allowFromRaw) ? allowFromRaw.filter((entry) => typeof entry === "string" && entry.trim().length > 0).length : 0;
+	const nextPolicy = allowFromEntries > 0 ? "allowlist" : "pairing";
+	const nextDm = {
+		...dm,
+		policy: nextPolicy
+	};
+	params.changes.push(`Migrated ${params.pathPrefix}.dm.policy "trusted" → "${nextPolicy}" (legacy alias removed; ${allowFromEntries > 0 ? `preserved ${allowFromEntries} ${params.pathPrefix}.dm.allowFrom ${allowFromEntries === 1 ? "entry" : "entries"}` : "no allowFrom entries present, defaulting to pairing for safety"}).`);
+	return {
+		entry: {
+			...params.entry,
+			dm: nextDm
+		},
+		changed: true
+	};
+}
+function normalizeMatrixRoomAllowAliases(params) {
+	let changed = false;
+	const nextRooms = { ...params.rooms };
+	for (const [roomId, roomValue] of Object.entries(params.rooms)) {
+		const room = isRecord(roomValue) ? roomValue : null;
+		if (!room || typeof room.allow !== "boolean") continue;
+		const nextRoom = { ...room };
+		if (typeof nextRoom.enabled !== "boolean") nextRoom.enabled = room.allow;
+		delete nextRoom.allow;
+		nextRooms[roomId] = nextRoom;
+		changed = true;
+		params.changes.push(`Moved ${params.pathPrefix}.${roomId}.allow → ${params.pathPrefix}.${roomId}.enabled (${String(nextRoom.enabled)}).`);
+	}
+	return {
+		rooms: nextRooms,
+		changed
+	};
+}
+const legacyConfigRules = [
+	...streamingAliasMigration.legacyConfigRules,
+	{
+		path: ["channels", "matrix"],
+		message: "channels.matrix.allowPrivateNetwork is legacy; use channels.matrix.network.dangerouslyAllowPrivateNetwork instead. Run \"openclaw doctor --fix\".",
+		match: (value) => hasLegacyFlatAllowPrivateNetworkAlias(isRecord(value) ? value : {})
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"accounts"
+		],
+		message: "channels.matrix.accounts.<id>.allowPrivateNetwork is legacy; use channels.matrix.accounts.<id>.network.dangerouslyAllowPrivateNetwork instead. Run \"openclaw doctor --fix\".",
+		match: (value) => hasLegacyAccountStreamingAliases(value, (account) => hasLegacyFlatAllowPrivateNetworkAlias(isRecord(account) ? account : {}))
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"groups"
+		],
+		message: "channels.matrix.groups.<room>.allow is legacy; use channels.matrix.groups.<room>.enabled instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixRoomMapAllowAliases
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"rooms"
+		],
+		message: "channels.matrix.rooms.<room>.allow is legacy; use channels.matrix.rooms.<room>.enabled instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyMatrixRoomMapAllowAliases
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"accounts"
+		],
+		message: "channels.matrix.accounts.<id>.{groups,rooms}.<room>.allow is legacy; use channels.matrix.accounts.<id>.{groups,rooms}.<room>.enabled instead. Run \"openclaw doctor --fix\".",
+		match: (value) => hasLegacyAccountStreamingAliases(value, (account) => {
+			if (!isRecord(account)) return false;
+			return hasLegacyMatrixRoomMapAllowAliases(account.groups) || hasLegacyMatrixRoomMapAllowAliases(account.rooms);
+		})
+	},
+	{
+		path: ["channels", "matrix"],
+		message: "channels.matrix.dm.policy \"trusted\" is legacy; use \"allowlist\" (with allowFrom entries) or \"pairing\" instead. Run \"openclaw doctor --fix\".",
+		match: hasLegacyTrustedDmPolicy
+	},
+	{
+		path: [
+			"channels",
+			"matrix",
+			"accounts"
+		],
+		message: "channels.matrix.accounts.<id>.dm.policy \"trusted\" is legacy; use \"allowlist\" (with allowFrom entries) or \"pairing\" instead. Run \"openclaw doctor --fix\".",
+		match: (value) => hasLegacyAccountStreamingAliases(value, hasLegacyTrustedDmPolicy)
+	}
+];
+function normalizeMatrixEntry(params) {
+	const network = migrateLegacyFlatAllowPrivateNetworkAlias(params);
+	const dmPolicy = migrateLegacyTrustedDmPolicy({
+		...params,
+		entry: network.entry
+	});
+	let entry = dmPolicy.entry;
+	let changed = network.changed || dmPolicy.changed;
+	for (const key of ["groups", "rooms"]) {
+		const rooms = isRecord(entry[key]) ? entry[key] : null;
+		if (!rooms) continue;
+		const normalized = normalizeMatrixRoomAllowAliases({
+			rooms,
+			pathPrefix: `${params.pathPrefix}.${key}`,
+			changes: params.changes
+		});
+		if (normalized.changed) {
+			entry = Object.assign({}, entry, { [key]: normalized.rooms });
+			changed = true;
+		}
+	}
+	return {
+		entry,
+		changed
+	};
+}
+function normalizeCompatibilityConfig({ cfg }) {
+	const changes = [];
+	const withoutJunkStreamMode = stripRetiredChannelKeys({
+		cfg,
+		channelId: "matrix",
+		keys: /* @__PURE__ */ new Set(["streamMode"]),
+		scope: "root-and-accounts",
+		onRemove: ({ key, pathPrefix }) => changes.push(`Removed ${pathPrefix}.${key} (never read by the Matrix runtime).`)
+	}).config;
+	return normalizeChannelConfigEntries({
+		cfg: streamingAliasMigration.normalizeChannelConfig({
+			cfg: withoutJunkStreamMode,
+			changes
+		}).config,
+		channelId: "matrix",
+		changes,
+		normalizeEntry: normalizeMatrixEntry
+	});
+}
+//#endregion
+export { normalizeCompatibilityConfig as n, legacyConfigRules as t };

package/dist/doctor-contract-api.js

@@ -1,14 +1,104 @@
-import { t as isRecord } from "./record-shared-CvzjvHRn.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-D2qTLe-C.js";
-import { O as writeMatrixIdbSnapshotJsonToStore, S as readLegacyMatrixLegacyCryptoMigrationState, _ as hasMatrixRecoveryKeyStateInStore, a as openMatrixStorageMetaStoreOptions, b as openMatrixLegacyCryptoMigrationStoreOptions, f as MATRIX_IDB_SNAPSHOT_FILENAME, g as hasMatrixLegacyCryptoMigrationStateInStore, h as hasMatrixIdbSnapshotStateInStore, i as normalizeMatrixStorageMetadata, j as writeMatrixRecoveryKeyStateToStore, k as writeMatrixLegacyCryptoMigrationStateToStore, m as MATRIX_RECOVERY_KEY_FILENAME, n as hasMatrixStorageMetaStateInStore, p as MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME, u as writeMatrixStorageMetaStateToStore, w as readLegacyMatrixRecoveryKeyState, x as openMatrixRecoveryKeyStoreOptions, y as openMatrixIdbSnapshotStoreOptions } from "./storage-DD-EnNJE.js";
-import { a as readLegacyMatrixSyncCacheState, i as openMatrixSyncCacheStoreOptions, o as writeMatrixSyncCacheStateToStore, r as hasMatrixSyncCacheStateInStore } from "./file-sync-store-CUE9WwD2.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, n as requiresExplicitMatrixDefaultAccount } from "./account-selection-kqquRzCf.js";
+import { t as isRecord$1 } from "./record-shared-CWWx6fvI.js";
+import { r as resolveMatrixCredentialsDir } from "./storage-paths-gUmSydsW.js";
+import { a as isMatrixCredentialRevocation, c as normalizeMatrixStoredCredentials, s as matrixCredentialsStoreKey, t as MATRIX_CREDENTIALS_NAMESPACE } from "./credentials-read-DVmFCm7X.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-CWVdlRQR.js";
+import { C as readLegacyMatrixRecoveryKeyState, O as writeMatrixIdbSnapshotJsonToStore, T as readMatrixIdbSnapshotJsonFromStore, a as openMatrixStorageMetaStoreOptions, b as openMatrixRecoveryKeyStoreOptions, f as MATRIX_IDB_SNAPSHOT_FILENAME, g as hasMatrixRecoveryKeyStateInStore, h as hasMatrixLegacyCryptoMigrationStateInStore, i as normalizeMatrixStorageMetadata, j as writeMatrixRecoveryKeyStateToStore, k as writeMatrixLegacyCryptoMigrationStateToStore, m as MATRIX_RECOVERY_KEY_FILENAME, n as hasMatrixStorageMetaStateInStore, p as MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME, u as writeMatrixStorageMetaStateToStore, v as openMatrixIdbSnapshotStoreOptions, x as readLegacyMatrixLegacyCryptoMigrationState, y as openMatrixLegacyCryptoMigrationStoreOptions } from "./storage-BrkTJZov.js";
+import { a as readLegacyMatrixSyncCacheState, i as openMatrixSyncCacheStoreOptions, o as writeMatrixSyncCacheStateToStore, r as hasMatrixSyncCacheStateInStore } from "./file-sync-store-DUEWCEjb.js";
+import { n as MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS } from "./idb-persistence-lock-DAJ49nZX.js";
+import { r as readLegacyMatrixIdbSnapshotStateUnlocked, t as isValidMatrixIdbSnapshotJson } from "./idb-persistence-C6zQfW2w.js";
 import { a as resolveMatrixInboundDedupeStateNamespace, n as MATRIX_INBOUND_DEDUPE_TTL_MS, r as buildMatrixInboundDedupeEventKey } from "./inbound-dedupe-CaBLblef.js";
-import { r as readLegacyMatrixIdbSnapshotState } from "./idb-persistence-BiHEEzD7.js";
-import path from "node:path";
-import { createHash } from "node:crypto";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { archiveLegacyStateSource } from "openclaw/plugin-sdk/runtime-doctor";
-import fs from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import path from "node:path";
+import fs from "node:fs";
+import fs$1 from "node:fs/promises";
+import { isDeepStrictEqual } from "node:util";
+import { withFileLock } from "openclaw/plugin-sdk/file-lock";
 import { createPersistentDedupeImportEntry } from "openclaw/plugin-sdk/persistent-dedupe";
+//#region extensions/matrix/src/matrix/crypto-snapshot-doctor.ts
+async function migrateLegacyMatrixIdbSnapshot(params) {
+	const snapshotPath = path.join(params.storageRootDir, MATRIX_IDB_SNAPSHOT_FILENAME);
+	try {
+		await withFileLock(snapshotPath, MATRIX_IDB_SNAPSHOT_LOCK_OPTIONS, () => migrateLegacyMatrixIdbSnapshotLocked(params));
+	} catch (err) {
+		params.warnings.push(`Failed locking Matrix IndexedDB snapshot for ${params.storageRootDir}: ${String(err)}; left legacy source in place`);
+	}
+}
+async function migrateLegacyMatrixIdbSnapshotLocked(params) {
+	const sourcePath = path.join(params.storageRootDir, MATRIX_IDB_SNAPSHOT_FILENAME);
+	let snapshot;
+	try {
+		snapshot = readLegacyMatrixIdbSnapshotStateUnlocked(params.storageRootDir);
+	} catch (err) {
+		params.warnings.push(`Failed reading Matrix IndexedDB snapshot legacy source for ${params.storageRootDir}: ${String(err)}; left source in place`);
+		return;
+	}
+	if (!snapshot) {
+		if (!fs.existsSync(sourcePath)) return;
+		const archived = await archiveLegacyMatrixIdbSnapshot(params);
+		params.warnings.push(archived ? `Matrix IndexedDB snapshot legacy source is invalid for ${params.storageRootDir}; archived without import` : `Matrix IndexedDB snapshot legacy source is invalid for ${params.storageRootDir}; left active because archival failed`);
+		return;
+	}
+	const snapshotJson = JSON.stringify(snapshot);
+	const store = params.context.openPluginStateKeyedStore(openMatrixIdbSnapshotStoreOptions(params.storageRootDir));
+	let persisted;
+	let hadPartialState;
+	try {
+		persisted = await readMatrixIdbSnapshotJsonFromStore({ store });
+		const persistedIsValid = persisted ? isValidMatrixIdbSnapshotJson(persisted) : false;
+		hadPartialState = !persistedIsValid && (await store.entries()).length > 0;
+		if (!persistedIsValid) persisted = null;
+	} catch (err) {
+		params.warnings.push(`Failed inspecting Matrix IndexedDB snapshot SQLite state for ${params.storageRootDir}: ${String(err)}; left legacy source in place`);
+		return;
+	}
+	if (persisted && !snapshotContentMatches(persisted, snapshot)) {
+		if (await archiveLegacyMatrixIdbSnapshot(params)) params.notices.push(`Kept the canonical Matrix IndexedDB snapshot in SQLite and archived a differing legacy source for ${params.storageRootDir}`);
+		return;
+	}
+	if (!persisted) {
+		try {
+			await writeMatrixIdbSnapshotJsonToStore({
+				snapshotJson,
+				databaseCount: snapshot.length,
+				store
+			});
+			persisted = await readMatrixIdbSnapshotJsonFromStore({ store });
+		} catch (err) {
+			params.warnings.push(`Failed importing Matrix IndexedDB snapshot for ${params.storageRootDir}: ${String(err)}; left legacy source in place`);
+			return;
+		}
+		if (!persisted || !snapshotContentMatches(persisted, snapshot)) {
+			params.warnings.push(`Failed verifying Matrix IndexedDB snapshot for ${params.storageRootDir}; left legacy source in place`);
+			return;
+		}
+		params.changes.push(hadPartialState ? `Repaired partial or invalid Matrix IndexedDB snapshot SQLite state for ${params.storageRootDir}` : `Migrated Matrix IndexedDB snapshot JSON to SQLite for ${params.storageRootDir}`);
+	}
+	await archiveLegacyMatrixIdbSnapshot(params);
+}
+function snapshotContentMatches(persistedJson, snapshot) {
+	try {
+		return isDeepStrictEqual(JSON.parse(persistedJson), snapshot);
+	} catch {
+		return false;
+	}
+}
+async function archiveLegacyMatrixIdbSnapshot(params) {
+	const sourcePath = path.join(params.storageRootDir, MATRIX_IDB_SNAPSHOT_FILENAME);
+	const archivePath = `${sourcePath}.migrated-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID()}`;
+	try {
+		await fs$1.rename(sourcePath, archivePath);
+		params.changes.push(`Archived Matrix IndexedDB snapshot legacy source -> ${archivePath}`);
+		return true;
+	} catch (err) {
+		params.warnings.push(`Failed archiving Matrix IndexedDB snapshot legacy source: ${String(err)}`);
+		return false;
+	}
+}
+//#endregion
 //#region extensions/matrix/src/matrix/monitor/inbound-dedupe-migration.ts
 const LEGACY_SQLITE_NAMESPACE = "inbound-dedupe";
 const LEGACY_SQLITE_MAX_ENTRIES = 2e4;
@@ -24,7 +114,7 @@ async function collectMatrixInboundDedupeSources(stateDir) {
 	async function visit(dir) {
 		let entries;
 		try {
-			entries = await fs.readdir(dir, { withFileTypes: true });
+			entries = await fs$1.readdir(dir, { withFileTypes: true });
 		} catch {
 			return;
 		}
@@ -71,7 +161,7 @@ function normalizeLegacyTimestamp(raw) {
 	return Math.max(0, Math.floor(raw));
 }
 function parseLegacySqliteRow(row) {
-	const value = isRecord(row.value) ? row.value : {};
+	const value = isRecord$1(row.value) ? row.value : {};
 	const roomId = typeof value.roomId === "string" ? value.roomId.trim() : "";
 	const eventId = typeof value.eventId === "string" ? value.eventId.trim() : "";
 	const ts = normalizeLegacyTimestamp(value.ts);
@@ -108,7 +198,7 @@ async function retireLegacyInboundDedupeSqliteRows(io, storageRootDir) {
 }
 async function resolveJsonRootAccountId(storageRootDir) {
 	for (const filename of [STORAGE_META_FILENAME, `${STORAGE_META_FILENAME}.migrated`]) try {
-		const metadata = normalizeMatrixStorageMetadata(JSON.parse(await fs.readFile(path.join(storageRootDir, filename), "utf8")));
+		const metadata = normalizeMatrixStorageMetadata(JSON.parse(await fs$1.readFile(path.join(storageRootDir, filename), "utf8")));
 		if (metadata?.accountId) return metadata.accountId;
 	} catch {}
 	return "default";
@@ -120,18 +210,18 @@ async function resolveJsonRootAccountId(storageRootDir) {
 */
 async function readLegacyInboundDedupeJsonSource(storageRootDir) {
 	const jsonPath = path.join(storageRootDir, MATRIX_LEGACY_INBOUND_DEDUPE_FILENAME);
-	const raw = await fs.readFile(jsonPath, "utf8");
+	const raw = await fs$1.readFile(jsonPath, "utf8");
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch {
 		return null;
 	}
-	if (!isRecord(parsed) || parsed.version !== LEGACY_JSON_VERSION || !Array.isArray(parsed.entries)) return null;
+	if (!isRecord$1(parsed) || parsed.version !== LEGACY_JSON_VERSION || !Array.isArray(parsed.entries)) return null;
 	const accountId = await resolveJsonRootAccountId(storageRootDir);
 	const markers = [];
 	for (const entry of parsed.entries) {
-		if (!isRecord(entry) || typeof entry.key !== "string") continue;
+		if (!isRecord$1(entry) || typeof entry.key !== "string") continue;
 		const separator = entry.key.indexOf("|");
 		if (separator <= 0) continue;
 		const roomId = entry.key.slice(0, separator).trim();
@@ -199,13 +289,46 @@ async function importNewestInboundDedupeMarkers(params) {
 //#region extensions/matrix/doctor-contract-api.ts
 const MATRIX_SYNC_CACHE_FILENAME = "bot-storage.json";
 const MATRIX_STORAGE_META_FILENAME = "storage-meta.json";
-async function collectLegacyMatrixStateRoots(stateDir, filename) {
+async function collectLegacyMatrixCredentialSources(params) {
+	const credentialsDir = resolveMatrixCredentialsDir(params.stateDir);
+	let entries;
+	try {
+		entries = await fs$1.readdir(credentialsDir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	return entries.filter((entry) => entry.isFile() && /^credentials(?:-[a-z0-9._-]+)?\.json$/iu.test(entry.name)).toSorted((left, right) => {
+		if (left.name === "credentials.json") return 1;
+		if (right.name === "credentials.json") return -1;
+		return left.name.localeCompare(right.name);
+	}).map((entry) => {
+		const namedAccount = /^credentials(?:-([a-z0-9._-]+))?\.json$/iu.exec(entry.name)?.[1];
+		return {
+			accountId: namedAccount ? normalizeAccountId(namedAccount) : requiresExplicitMatrixDefaultAccount(params.config, params.env) ? null : normalizeAccountId(resolveMatrixDefaultOrOnlyAccountId(params.config, params.env)),
+			filePath: path.join(credentialsDir, entry.name)
+		};
+	});
+}
+async function readLegacyMatrixCredentials(source) {
+	if (!source.accountId) return null;
+	try {
+		const raw = JSON.parse(await fs$1.readFile(source.filePath, "utf8"));
+		const createdAt = isRecord(raw) && typeof raw.createdAt === "string" && raw.createdAt ? raw.createdAt : (await fs$1.stat(source.filePath)).mtime.toISOString();
+		return normalizeMatrixStoredCredentials(isRecord(raw) ? {
+			...raw,
+			createdAt
+		} : raw, source.accountId);
+	} catch {
+		return null;
+	}
+}
+async function collectLegacyMatrixStateRoots(stateDir, filename, options) {
 	const matrixRoot = path.join(stateDir, "matrix");
 	const roots = [];
 	async function visit(dir) {
 		let entries;
 		try {
-			entries = await fs.readdir(dir, { withFileTypes: true });
+			entries = await fs$1.readdir(dir, { withFileTypes: true });
 		} catch {
 			return;
 		}
@@ -219,14 +342,14 @@ async function collectLegacyMatrixStateRoots(stateDir, filename) {
 		}
 	}
 	await visit(matrixRoot);
-	return roots.filter((root) => path.resolve(root) !== path.resolve(matrixRoot)).toSorted();
+	return roots.filter((root) => options?.includeMatrixRoot || path.resolve(root) !== path.resolve(matrixRoot)).toSorted();
 }
 async function collectLegacySyncCacheRoots(stateDir) {
 	return collectLegacyMatrixStateRoots(stateDir, MATRIX_SYNC_CACHE_FILENAME);
 }
 async function readLegacyMatrixStorageMetadata(storageRootDir) {
 	try {
-		return normalizeMatrixStorageMetadata(JSON.parse(await fs.readFile(path.join(storageRootDir, MATRIX_STORAGE_META_FILENAME), "utf8")));
+		return normalizeMatrixStorageMetadata(JSON.parse(await fs$1.readFile(path.join(storageRootDir, MATRIX_STORAGE_META_FILENAME), "utf8")));
 	} catch {
 		return null;
 	}
@@ -249,6 +372,74 @@ async function archiveLegacyMatrixStateFile(params) {
 	if (params.notice && params.warnings.length === warningCount) params.notices?.push(params.notice);
 }
 const stateMigrations = [
+	{
+		id: "matrix-credentials-json-to-plugin-state",
+		label: "Matrix credentials",
+		async detectLegacyState(params) {
+			const sources = await collectLegacyMatrixCredentialSources(params);
+			return sources.length > 0 ? { preview: [`Matrix credential JSON can migrate to SQLite (${sources.length} ${sources.length === 1 ? "file" : "files"})`] } : null;
+		},
+		async migrateLegacyState(params) {
+			const changes = [];
+			const warnings = [];
+			const sources = await collectLegacyMatrixCredentialSources(params);
+			const store = params.context.openPluginStateKeyedStore({
+				namespace: MATRIX_CREDENTIALS_NAMESPACE,
+				maxEntries: 256,
+				overflowPolicy: "reject-new"
+			});
+			for (const source of sources) {
+				if (!source.accountId) {
+					warnings.push(`Left ambiguous Matrix credential legacy source in place because no default account is selected: ${source.filePath}`);
+					continue;
+				}
+				const credentials = await readLegacyMatrixCredentials(source);
+				if (!credentials) {
+					warnings.push(`Left invalid Matrix credential legacy source in place: ${source.filePath}`);
+					continue;
+				}
+				const key = matrixCredentialsStoreKey(source.accountId);
+				const stored = await store.lookup(key);
+				if (isMatrixCredentialRevocation(stored, source.accountId)) {
+					changes.push(`Archived revoked Matrix credential legacy source for account ${source.accountId}`);
+					await archiveLegacyStateSource({
+						filePath: source.filePath,
+						label: "Matrix credentials",
+						changes,
+						warnings
+					});
+					continue;
+				}
+				const existing = normalizeMatrixStoredCredentials(stored, source.accountId);
+				if (existing && JSON.stringify(existing) !== JSON.stringify(credentials)) {
+					warnings.push(`Kept existing Matrix credentials for account ${source.accountId}; left differing legacy source in place`);
+					continue;
+				}
+				if (!existing) try {
+					await store.registerIfAbsent(key, credentials);
+				} catch (error) {
+					warnings.push(`Failed importing Matrix credentials for account ${source.accountId}: ${String(error)}; left legacy source in place`);
+					continue;
+				}
+				const persisted = normalizeMatrixStoredCredentials(await store.lookup(key), source.accountId);
+				if (!persisted || JSON.stringify(persisted) !== JSON.stringify(credentials)) {
+					warnings.push(`Failed verifying Matrix credentials for account ${source.accountId}; left legacy source in place`);
+					continue;
+				}
+				changes.push(`Migrated Matrix credentials for account ${source.accountId} to SQLite`);
+				await archiveLegacyStateSource({
+					filePath: source.filePath,
+					label: "Matrix credentials",
+					changes,
+					warnings
+				});
+			}
+			return {
+				changes,
+				warnings
+			};
+		}
+	},
 	{
 		id: "matrix-inbound-dedupe-to-claimable-dedupe",
 		label: "Matrix inbound dedupe markers",
@@ -486,74 +677,23 @@ const stateMigrations = [
 			};
 		}
 	},
-	{
-		id: "matrix-idb-snapshot-json-to-plugin-state",
-		label: "Matrix IndexedDB snapshot",
-		async detectLegacyState(params) {
-			const previews = [];
-			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_IDB_SNAPSHOT_FILENAME)) {
-				if (!await readLegacyMatrixIdbSnapshotState(storageRootDir)) continue;
-				previews.push(`Matrix IndexedDB snapshot JSON can migrate to SQLite: ${storageRootDir}`);
-			}
-			return previews.length > 0 ? { preview: previews } : null;
-		},
-		async migrateLegacyState(params) {
-			const changes = [];
-			const warnings = [];
-			const notices = [];
-			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_IDB_SNAPSHOT_FILENAME)) {
-				const snapshot = await readLegacyMatrixIdbSnapshotState(storageRootDir);
-				if (!snapshot) continue;
-				const store = params.context.openPluginStateKeyedStore(openMatrixIdbSnapshotStoreOptions(storageRootDir));
-				if (await hasMatrixIdbSnapshotStateInStore({ store })) {
-					await archiveLegacyMatrixStateFile({
-						storageRootDir,
-						filename: MATRIX_IDB_SNAPSHOT_FILENAME,
-						label: "Matrix IndexedDB snapshot",
-						changes,
-						warnings,
-						notices,
-						notice: `Kept existing Matrix IndexedDB snapshot in SQLite and archived the legacy source for ${storageRootDir}`
-					});
-					continue;
-				}
-				await writeMatrixIdbSnapshotJsonToStore({
-					snapshotJson: JSON.stringify(snapshot),
-					databaseCount: snapshot.length,
-					store
-				});
-				changes.push(`Migrated Matrix IndexedDB snapshot JSON to SQLite for ${storageRootDir}`);
-				await archiveLegacyMatrixStateFile({
-					storageRootDir,
-					filename: MATRIX_IDB_SNAPSHOT_FILENAME,
-					label: "Matrix IndexedDB snapshot",
-					changes,
-					warnings
-				});
-			}
-			return {
-				changes,
-				warnings,
-				...notices.length > 0 ? { notices } : {}
-			};
-		}
-	},
 	{
 		id: "matrix-legacy-crypto-migration-json-to-plugin-state",
-		label: "Matrix legacy crypto migration",
+		label: "Matrix legacy crypto state",
 		async detectLegacyState(params) {
 			const previews = [];
-			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME)) {
+			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME, { includeMatrixRoot: true })) {
 				if (!readLegacyMatrixLegacyCryptoMigrationState(storageRootDir)) continue;
 				previews.push(`Matrix legacy crypto migration JSON can migrate to SQLite: ${storageRootDir}`);
 			}
+			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_IDB_SNAPSHOT_FILENAME, { includeMatrixRoot: true })) previews.push(`Matrix IndexedDB snapshot JSON can migrate to SQLite: ${storageRootDir}`);
 			return previews.length > 0 ? { preview: previews } : null;
 		},
 		async migrateLegacyState(params) {
 			const changes = [];
 			const warnings = [];
 			const notices = [];
-			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME)) {
+			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME, { includeMatrixRoot: true })) {
 				const state = readLegacyMatrixLegacyCryptoMigrationState(storageRootDir);
 				if (!state) continue;
 				const store = params.context.openPluginStateKeyedStore(openMatrixLegacyCryptoMigrationStoreOptions(storageRootDir));
@@ -582,6 +722,13 @@ const stateMigrations = [
 					warnings
 				});
 			}
+			for (const storageRootDir of await collectLegacyMatrixStateRoots(params.stateDir, MATRIX_IDB_SNAPSHOT_FILENAME, { includeMatrixRoot: true })) await migrateLegacyMatrixIdbSnapshot({
+				storageRootDir,
+				context: params.context,
+				changes,
+				notices,
+				warnings
+			});
 			return {
 				changes,
 				warnings,

package/dist/{draft-stream-GOdPZMBm.js → draft-stream-BfibauH1.js}

@@ -1,4 +1,4 @@
-import { n as editMessageMatrix, r as prepareMatrixSingleText, s as sendSingleTextMessageMatrix, y as MsgType } from "./send-yre1krm8.js";
+import { n as editMessageMatrix, r as prepareMatrixSingleText, s as sendSingleTextMessageMatrix, y as MsgType } from "./send-CZCmDQu8.js";
 import { createDraftStreamLoop } from "openclaw/plugin-sdk/channel-outbound";
 //#region extensions/matrix/src/matrix/draft-stream.ts
 const DEFAULT_THROTTLE_MS = 1e3;

package/dist/{encryption-guidance-BFfgq7c7.js → encryption-guidance-CbEFe38F.js}

@@ -1,4 +1,4 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId } from "./account-selection-kqquRzCf.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 //#region extensions/matrix/src/matrix/encryption-guidance.ts

package/dist/{file-sync-store-CUE9WwD2.js → file-sync-store-DUEWCEjb.js}

@@ -1,13 +1,30 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { t as isRecord } from "./record-shared-CvzjvHRn.js";
+import { t as isRecord } from "./record-shared-CWWx6fvI.js";
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { M as resolveMatrixSqliteStateEnv, t as claimCurrentTokenStorageState } from "./storage-DD-EnNJE.js";
-import { t as createAsyncLock } from "./async-lock-BcLS4KOc.js";
+import { M as resolveMatrixSqliteStateEnv, t as claimCurrentTokenStorageState } from "./storage-BrkTJZov.js";
 import { n as LogService } from "./logger-D0GCSDQq.js";
-import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
+import path from "node:path";
 import fs from "node:fs/promises";
 import { Category, MemoryStore, SyncAccumulator } from "matrix-js-sdk/lib/matrix.js";
+//#region extensions/matrix/src/matrix/async-lock.ts
+function createAsyncLock() {
+	let lock = Promise.resolve();
+	return async function withLock(fn) {
+		const previous = lock;
+		let release;
+		lock = new Promise((resolve) => {
+			release = resolve;
+		});
+		await previous;
+		try {
+			return await fn();
+		} finally {
+			release?.();
+		}
+	};
+}
+//#endregion
 //#region extensions/matrix/src/matrix/client/file-sync-store.ts
 var file_sync_store_exports = /* @__PURE__ */ __exportAll({
 	SqliteBackedMatrixSyncStore: () => SqliteBackedMatrixSyncStore,

package/dist/helper-api.js

@@ -1,4 +1,4 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-kqquRzCf.js";
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
-import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-B4_I9iqO.js";
+import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-gUmSydsW.js";
 export { findMatrixAccountEntry, getMatrixScopedEnvVarNames, hashMatrixAccessToken, listMatrixEnvAccountIds, requiresExplicitMatrixDefaultAccount, resolveConfiguredMatrixAccountIds, resolveMatrixAccountStorageRoot, resolveMatrixChannelConfig, resolveMatrixCredentialsDir, resolveMatrixCredentialsFilename, resolveMatrixCredentialsPath, resolveMatrixDefaultOrOnlyAccountId, resolveMatrixEnvAccountToken, resolveMatrixHomeserverKey, sanitizeMatrixPathSegment };