@openclaw/matrix 2026.7.2-beta.2 → 2026.7.2-beta.4

package/dist/{reaction-events-QUgxkQKQ.js → reaction-events-Cj6thhmc.js}

@@ -6,9 +6,9 @@ import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import { getSessionBindingService } from "openclaw/plugin-sdk/session-binding-runtime";
 //#region extensions/matrix/src/matrix/monitor/reaction-events.ts
-const loadApprovalReactionAuth = createLazyRuntimeModule(() => import("./approval-reaction-auth-BLJKPLku.js"));
+const loadApprovalReactionAuth = createLazyRuntimeModule(() => import("./approval-reaction-auth-DButmM13.js"));
 const loadExecApprovalResolver = createLazyRuntimeModule(() => import("./exec-approval-resolver-BCgqRtZS.js"));
-const loadMatrixSend = createLazyRuntimeModule(() => import("./send-yre1krm8.js").then((n) => n.l));
+const loadMatrixSend = createLazyRuntimeModule(() => import("./send-CZCmDQu8.js").then((n) => n.l));
 function buildMatrixApprovalTerminalText(result) {
 	const approval = result.approval;
 	const terminalLabel = approval.status === "allowed" ? approval.decision === "allow-always" ? "Allowed always" : "Allowed once" : approval.status === "denied" ? "Denied" : approval.status === "expired" ? "Expired" : "Cancelled";

package/dist/record-shared-CWWx6fvI.js

@@ -0,0 +1,2 @@
+import { isRecord as isRecord$1 } from "openclaw/plugin-sdk/string-coerce-runtime";
+export { isRecord$1 as t };

package/dist/{recovery-key-store-B2RglalK.js → recovery-key-store-0O8ARdT_.js}

@@ -1,5 +1,5 @@
 import { n as formatMatrixErrorReason, t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { A as writeMatrixRecoveryKeyStateForPath, C as readLegacyMatrixRecoveryKeyFile, E as readMatrixRecoveryKeyStateForPath, v as migrateLegacyMatrixRecoveryKeyFilePathToStore } from "./storage-DD-EnNJE.js";
+import { A as writeMatrixRecoveryKeyStateForPath, E as readMatrixRecoveryKeyStateForPath, S as readLegacyMatrixRecoveryKeyFile, _ as migrateLegacyMatrixRecoveryKeyFilePathToStore } from "./storage-BrkTJZov.js";
 import { n as LogService } from "./logger-D0GCSDQq.js";
 import path from "node:path";
 import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";

package/dist/{resolve-targets-Cx1VVArA.js → resolve-targets-Dn11HT76.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as normalizeMatrixMessagingTarget, t as isMatrixQualifiedUserId } from "./target-ids-B-5aQxwn.js";
-import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-0TyS9xep.js";
+import { n as listMatrixDirectoryGroupsLive, r as listMatrixDirectoryPeersLive } from "./directory-live-B6fbX6jf.js";
 import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/matrix/src/resolve-targets.ts
 var resolve_targets_exports = /* @__PURE__ */ __exportAll({ resolveMatrixTargets: () => resolveMatrixTargets });

package/dist/{resolver.runtime-PPrv3ZHu.js → resolver.runtime-Zguh0hH9.js}

@@ -1,4 +1,4 @@
-import { t as resolveMatrixTargets } from "./resolve-targets-Cx1VVArA.js";
+import { t as resolveMatrixTargets } from "./resolve-targets-Dn11HT76.js";
 //#region extensions/matrix/src/resolver.runtime.ts
 const matrixResolverRuntime = { resolveMatrixTargets };
 //#endregion

package/dist/runtime-api.js

@@ -1,9 +1,9 @@
-import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, i as resolveMatrixChannelConfig, n as requiresExplicitMatrixDefaultAccount, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds, t as findMatrixAccountEntry } from "./account-selection-kqquRzCf.js";
 import { n as listMatrixEnvAccountIds, r as resolveMatrixEnvAccountToken, t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
 import { r as setMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-B4_I9iqO.js";
+import { a as resolveMatrixCredentialsPath, i as resolveMatrixCredentialsFilename, n as resolveMatrixAccountStorageRoot, o as resolveMatrixHomeserverKey, r as resolveMatrixCredentialsDir, s as sanitizeMatrixPathSegment, t as hashMatrixAccessToken } from "./storage-paths-gUmSydsW.js";
 import { d as setMatrixThreadBindingIdleTimeoutBySessionKey, p as setMatrixThreadBindingMaxAgeBySessionKey } from "./thread-bindings-shared-CKnY4LSd.js";
-import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-DDbghaZH.js";
+import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-CcVJfvRM.js";
 import { assertHttpUrlTargetsPrivateNetwork, closeDispatcher, createPinnedDispatcher, resolvePinnedHostnameWithPolicy, ssrfPolicyFromDangerouslyAllowPrivateNetwork } from "openclaw/plugin-sdk/ssrf-runtime";
 import { writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { formatZonedTimestamp } from "openclaw/plugin-sdk/time-runtime";

package/dist/{sdk-1TXuSiXZ.js → sdk-DiRXiRRf.js}

@@ -1,13 +1,13 @@
 import { n as formatMatrixErrorReason, r as isMatrixNotFoundError, t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
+import { t as SqliteBackedMatrixSyncStore } from "./file-sync-store-DUEWCEjb.js";
 import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-D0GCSDQq.js";
-import { t as SqliteBackedMatrixSyncStore } from "./file-sync-store-CUE9WwD2.js";
 import { t as MATRIX_IDB_PERSIST_INTERVAL_MS } from "./idb-persistence-lock-DAJ49nZX.js";
-import { c as createMatrixStartupAbortError, u as throwIfMatrixStartupAborted } from "./shared-BfW4lxGu.js";
-import { a as matrixEventToRaw, n as createMatrixGuardedFetch, o as parseMxc, t as MatrixAuthedHttpClient } from "./http-client-Jw5_bwQo.js";
+import { c as createMatrixStartupAbortError, u as throwIfMatrixStartupAborted } from "./shared-C7Vm9RxI.js";
+import { a as matrixEventToRaw, n as createMatrixGuardedFetch, o as parseMxc, t as MatrixAuthedHttpClient } from "./http-client-DOyTG9l2.js";
 import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.js";
 import { createMatrixJsSdkClientLogger } from "./logging-QH-48Gr6.js";
 import { n as isMatrixReadySyncState, r as isMatrixTerminalSyncState } from "./sync-state-CWbp0QSY.js";
-import { n as isRepairableSecretStorageAccessError, t as MatrixRecoveryKeyStore } from "./recovery-key-store-B2RglalK.js";
+import { n as isRepairableSecretStorageAccessError, t as MatrixRecoveryKeyStore } from "./recovery-key-store-0O8ARdT_.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeNullableString, normalizeStringEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
@@ -94,7 +94,7 @@ function createMatrixExplicitBootstrapOptions(params) {
 	};
 }
 let loadedMatrixCryptoRuntime = null;
-const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-DoEB5RpM.js").then((runtime) => {
+const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-_j7TpS7k.js").then((runtime) => {
 	loadedMatrixCryptoRuntime = runtime;
 	return runtime;
 }));

package/dist/{secret-contract-OZoQf0kI.js → secret-contract-M3hRmGO-.js}

@@ -2,6 +2,14 @@ import { t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { collectSecretInputAssignment, createChannelSecretTargetRegistryEntries, getChannelSurface, hasConfiguredSecretInputValue, hasOwnProperty, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 //#region extensions/matrix/src/secret-contract.ts
+function accountSecretOwner(accountId) {
+	return {
+		ownerKind: "account",
+		ownerId: `matrix:${normalizeAccountId(accountId)}`,
+		requiredForGateway: false,
+		disposition: "isolate"
+	};
+}
 const secretTargetRegistryEntries = createChannelSecretTargetRegistryEntries({
 	channelKey: "matrix",
 	account: ["accessToken", "password"],
@@ -13,7 +21,11 @@ function collectRuntimeConfigAssignments(params) {
 	const { channel: matrix, surface } = resolved;
 	const envAccessTokenConfigured = normalizeSecretStringValue(params.context.env.MATRIX_ACCESS_TOKEN).length > 0;
 	const defaultScopedAccessTokenConfigured = normalizeSecretStringValue(params.context.env[getMatrixScopedEnvVarNames("default").accessToken]).length > 0;
-	const defaultAccountAccessTokenConfigured = surface.accounts.some(({ accountId, account }) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID && hasConfiguredSecretInputValue(account.accessToken, params.defaults));
+	const defaultScopedPasswordConfigured = normalizeSecretStringValue(params.context.env[getMatrixScopedEnvVarNames("default").password]).length > 0;
+	const defaultAccount = surface.hasExplicitAccounts ? surface.accounts.find(({ accountId }) => normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID) : void 0;
+	const defaultAccountEnabled = surface.channelEnabled && (defaultAccount?.enabled ?? true);
+	const defaultAccountAccessTokenConfigured = hasConfiguredSecretInputValue(defaultAccount?.account.accessToken, params.defaults);
+	const defaultAccountPasswordConfigured = hasConfiguredSecretInputValue(defaultAccount?.account.password, params.defaults);
 	const baseAccessTokenConfigured = hasConfiguredSecretInputValue(matrix.accessToken, params.defaults);
 	collectSecretInputAssignment({
 		value: matrix.accessToken,
@@ -21,8 +33,9 @@ function collectRuntimeConfigAssignments(params) {
 		expected: "string",
 		defaults: params.defaults,
 		context: params.context,
-		active: surface.channelEnabled,
-		inactiveReason: "Matrix channel is disabled.",
+		active: defaultAccountEnabled && !defaultAccountAccessTokenConfigured && !defaultScopedAccessTokenConfigured,
+		inactiveReason: "Matrix channel or default account is disabled, or default-account access-token auth overrides the top-level accessToken.",
+		owner: accountSecretOwner(DEFAULT_ACCOUNT_ID),
 		apply: (value) => {
 			matrix.accessToken = value;
 		}
@@ -33,8 +46,9 @@ function collectRuntimeConfigAssignments(params) {
 		expected: "string",
 		defaults: params.defaults,
 		context: params.context,
-		active: surface.channelEnabled && !(baseAccessTokenConfigured || envAccessTokenConfigured || defaultScopedAccessTokenConfigured || defaultAccountAccessTokenConfigured),
-		inactiveReason: "Matrix channel is disabled or access-token auth is configured for the default Matrix account.",
+		active: defaultAccountEnabled && !(baseAccessTokenConfigured || envAccessTokenConfigured || defaultScopedAccessTokenConfigured || defaultAccountAccessTokenConfigured || defaultAccountPasswordConfigured || defaultScopedPasswordConfigured),
+		inactiveReason: "Matrix channel or default account is disabled, or higher-precedence default-account auth is configured.",
+		owner: accountSecretOwner(DEFAULT_ACCOUNT_ID),
 		apply: (value) => {
 			matrix.password = value;
 		}
@@ -49,6 +63,7 @@ function collectRuntimeConfigAssignments(params) {
 			context: params.context,
 			active: enabled,
 			inactiveReason: "Matrix account is disabled.",
+			owner: accountSecretOwner(accountId),
 			apply: (value) => {
 				account.accessToken = value;
 			}
@@ -65,6 +80,7 @@ function collectRuntimeConfigAssignments(params) {
 			context: params.context,
 			active: enabled && !(accountAccessTokenConfigured || scopedEnvAccessTokenConfigured || inheritedDefaultAccountAccessTokenConfigured),
 			inactiveReason: "Matrix account is disabled or this account has an accessToken configured.",
+			owner: accountSecretOwner(accountId),
 			apply: (value) => {
 				account.password = value;
 			}

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-OZoQf0kI.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-M3hRmGO-.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/{send-yre1krm8.js → send-CZCmDQu8.js}

@@ -9,6 +9,7 @@ import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeOpti
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
 import { normalizePollInput } from "openclaw/plugin-sdk/poll-runtime";
+import { isVoiceMessageCompatibleAudio } from "openclaw/plugin-sdk/media-runtime";
 import MarkdownIt from "markdown-it";
 import { isAutoLinkedFileRef } from "openclaw/plugin-sdk/text-autolink-runtime";
 import { parseBuffer } from "music-metadata";
@@ -228,7 +229,7 @@ function buildPollResponseContent(pollEventId, answerIds) {
 }
 //#endregion
 //#region extensions/matrix/src/matrix/send/client.ts
-const loadMatrixSendClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-CNVF73sF.js").then((n) => n.t));
+const loadMatrixSendClientRuntime = createLazyRuntimeModule(() => import("./client-bootstrap-ZAaO9fZ-.js").then((n) => n.t));
 function resolveMediaMaxBytes(accountId, cfg) {
 	if (!cfg) throw new Error("Matrix media limits requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
 	const matrixCfg = resolveMatrixAccountConfig({
@@ -670,7 +671,7 @@ function resolveMatrixVoiceDecision(opts) {
 	return { useVoice: false };
 }
 function isMatrixVoiceCompatibleAudio(opts) {
-	return getCore$2().media.isVoiceCompatibleAudio({
+	return isVoiceMessageCompatibleAudio({
 		contentType: opts.contentType,
 		fileName: opts.fileName
 	});
@@ -1310,7 +1311,7 @@ async function sendMessageMatrix(to, message, opts) {
 				buffer: media.buffer,
 				contentType: media.contentType,
 				fileName: media.fileName,
-				kind: media.kind ?? "unknown"
+				kind: media.kind === "sticker" ? "unknown" : media.kind ?? "unknown"
 			});
 			const baseMsgType = resolveMatrixMsgType(media.contentType, media.fileName);
 			const { useVoice } = resolveMatrixVoiceDecision({

package/dist/session-binding-contract-api.js

@@ -1,4 +1,4 @@
 import { r as setMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { s as resetMatrixThreadBindingsForTests } from "./thread-bindings-shared-CKnY4LSd.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-U5ZroBeZ.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-BcYBELC7.js";
 export { createMatrixThreadBindingManager, resetMatrixThreadBindingsForTests, setMatrixRuntime };

package/dist/{setup-bootstrap-DXVRCd4G.js → setup-bootstrap-C9w01xQK.js}

@@ -1,7 +1,7 @@
 import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import "./setup-core-CYQRY2oG.js";
+import "./setup-core-D6gyoyeg.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as bootstrapMatrixVerification } from "./verification-CGnI9k1O.js";
+import { n as bootstrapMatrixVerification } from "./verification-DhMBWxOJ.js";
 //#region extensions/matrix/src/setup-bootstrap.ts
 async function maybeBootstrapNewEncryptedMatrixAccount(params) {
 	const accountConfig = resolveMatrixAccountConfig({

package/dist/{setup-core-CYQRY2oG.js → setup-core-D6gyoyeg.js}

@@ -1,13 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as resolveMatrixDefaultOrOnlyAccountId, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds } from "./account-selection-kqquRzCf.js";
 import { a as resolveMatrixAccountConfig, o as resolveMatrixBaseConfig, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { i as resolveScopedMatrixEnvConfig, n as resolveGlobalMatrixEnvConfig, r as resolveMatrixEnvAuthReadiness } from "./env-auth-CQsYbz-p.js";
-import { i as loadMatrixCredentials, n as credentialsMatchConfig } from "./credentials-read-CwNJrmwu.js";
+import { o as loadMatrixCredentials, r as credentialsMatchConfig } from "./credentials-read-DVmFCm7X.js";
 import { n as resolveMatrixConfigPath$1, r as shouldStoreMatrixAccountAtTopLevel, t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
+import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, addWildcardAllowFrom, applyAccountNameToChannelSection, normalizeAccountId as normalizeAccountId$2, normalizeAllowFromEntries, normalizeSecretInputString, prepareScopedSetupConfig } from "openclaw/plugin-sdk/setup";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { coerceSecretRef as coerceSecretRef$1 } from "openclaw/plugin-sdk/secret-ref-runtime";
@@ -135,7 +136,12 @@ function resolveMatrixAccount(params) {
 //#endregion
 //#region extensions/matrix/src/setup-contract.ts
 const matrixSingleAccountKeysToMove = [
+	"homeserver",
+	"userId",
+	"accessToken",
+	"password",
 	"deviceId",
+	"deviceName",
 	"avatarUrl",
 	"initialSyncLimit",
 	"encryption",
@@ -509,16 +515,17 @@ function moveSingleMatrixAccountConfigToNamedAccount(cfg) {
 	};
 }
 function validateMatrixSetupInput(params) {
-	const avatarUrl = resolveSetupAvatarUrl(params.input);
+	const input = params.input;
+	const avatarUrl = resolveSetupAvatarUrl(input);
 	if (avatarUrl && !isSupportedMatrixAvatarSource(avatarUrl)) return "Matrix avatar URL must be an mxc:// URI or an http(s) URL.";
-	if (params.input.useEnv) {
+	if (input.useEnv) {
 		const envReadiness = resolveMatrixEnvAuthReadiness(params.accountId, process.env);
 		return envReadiness.ready ? null : envReadiness.missingMessage;
 	}
-	if (!params.input.homeserver?.trim()) return "Matrix requires --homeserver";
-	const accessToken = params.input.accessToken?.trim();
-	const password = normalizeSecretInputString(params.input.password);
-	const userId = params.input.userId?.trim();
+	if (!input.homeserver?.trim()) return "Matrix requires --homeserver";
+	const accessToken = input.accessToken?.trim();
+	const password = normalizeSecretInputString(input.password);
+	const userId = input.userId?.trim();
 	if (!accessToken && !password) return "Matrix requires --access-token or --password";
 	if (!accessToken) {
 		if (!userId) return "Matrix requires --user-id when using --password";
@@ -527,15 +534,16 @@ function validateMatrixSetupInput(params) {
 	return null;
 }
 function applyMatrixSetupAccountConfig(params) {
+	const input = params.input;
 	const normalizedAccountId = normalizeAccountId$2(params.accountId);
 	const next = applyAccountNameToChannelSection({
 		cfg: normalizedAccountId !== DEFAULT_ACCOUNT_ID$2 ? moveSingleMatrixAccountConfigToNamedAccount(params.cfg) : params.cfg,
 		channelKey: channel$1,
 		accountId: normalizedAccountId,
-		name: params.input.name
+		name: input.name
 	});
-	const avatarUrl = resolveSetupAvatarUrl(params.input);
-	if (params.input.useEnv) return updateMatrixAccountConfig(next, normalizedAccountId, {
+	const avatarUrl = resolveSetupAvatarUrl(input);
+	if (input.useEnv) return updateMatrixAccountConfig(next, normalizedAccountId, {
 		enabled: true,
 		homeserver: null,
 		allowPrivateNetwork: null,
@@ -547,20 +555,20 @@ function applyMatrixSetupAccountConfig(params) {
 		deviceName: null,
 		avatarUrl
 	});
-	const accessToken = params.input.accessToken?.trim();
-	const password = normalizeSecretInputString(params.input.password);
-	const userId = params.input.userId?.trim();
+	const accessToken = input.accessToken?.trim();
+	const password = normalizeSecretInputString(input.password);
+	const userId = input.userId?.trim();
 	return updateMatrixAccountConfig(next, normalizedAccountId, {
 		enabled: true,
-		homeserver: params.input.homeserver?.trim(),
-		allowPrivateNetwork: typeof params.input.dangerouslyAllowPrivateNetwork === "boolean" ? params.input.dangerouslyAllowPrivateNetwork : typeof params.input.allowPrivateNetwork === "boolean" ? params.input.allowPrivateNetwork : void 0,
-		proxy: normalizeOptionalString(params.input.proxy),
+		homeserver: input.homeserver?.trim(),
+		allowPrivateNetwork: typeof input.dangerouslyAllowPrivateNetwork === "boolean" ? input.dangerouslyAllowPrivateNetwork : typeof input.allowPrivateNetwork === "boolean" ? input.allowPrivateNetwork : void 0,
+		proxy: normalizeOptionalString(input.proxy),
 		userId: password && !userId ? null : userId,
 		accessToken: accessToken || (password ? null : void 0),
 		password: password || (accessToken ? null : void 0),
-		deviceName: params.input.deviceName?.trim(),
+		deviceName: input.deviceName?.trim(),
 		avatarUrl,
-		initialSyncLimit: params.input.initialSyncLimit
+		initialSyncLimit: input.initialSyncLimit
 	});
 }
 //#endregion
@@ -645,6 +653,9 @@ function createMatrixSetupWizardProxy(loadWizardModule) {
 	};
 }
 const matrixSetupAdapter = {
+	singleAccountKeysToMove,
+	namedAccountPromotionKeys,
+	resolveSingleAccountPromotionTarget,
 	resolveAccountId: ({ accountId, input }) => resolveMatrixSetupAccountId({
 		accountId,
 		name: input?.name
@@ -669,7 +680,7 @@ const matrixSetupAdapter = {
 		input
 	}),
 	afterAccountConfigWritten: async ({ previousCfg, cfg, accountId, runtime }) => {
-		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-DXVRCd4G.js");
+		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-C9w01xQK.js");
 		await runMatrixSetupBootstrapAfterConfigWrite({
 			previousCfg,
 			cfg,
@@ -678,5 +689,82 @@ const matrixSetupAdapter = {
 		});
 	}
 };
+const matrixSetupContract = defineChannelSetupContract({
+	fields: {
+		homeserver: {
+			kind: "string",
+			cli: {
+				flags: "--homeserver <url>",
+				description: "Matrix homeserver URL"
+			}
+		},
+		userId: {
+			kind: "string",
+			cli: {
+				flags: "--user-id <id>",
+				description: "Matrix user id"
+			}
+		},
+		accessToken: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--access-token <token>",
+				description: "Matrix access token"
+			}
+		},
+		password: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--password <password>",
+				description: "Matrix password"
+			}
+		},
+		deviceName: {
+			kind: "string",
+			cli: {
+				flags: "--device-name <name>",
+				description: "Matrix device name"
+			}
+		},
+		avatarUrl: {
+			kind: "string",
+			cli: {
+				flags: "--avatar-url <url>",
+				description: "Matrix avatar URL"
+			}
+		},
+		initialSyncLimit: {
+			kind: "integer",
+			cli: {
+				flags: "--initial-sync-limit <n>",
+				description: "Matrix initial sync room limit"
+			}
+		},
+		proxy: {
+			kind: "string",
+			cli: {
+				flags: "--proxy <url>",
+				description: "Matrix proxy URL"
+			}
+		},
+		dangerouslyAllowPrivateNetwork: {
+			kind: "boolean",
+			cli: {
+				flags: "--dangerously-allow-private-network",
+				description: "Allow private-network Matrix homeservers"
+			}
+		},
+		useEnv: {
+			kind: "boolean",
+			cli: {
+				flags: "--use-env",
+				description: "Use Matrix environment credentials"
+			}
+		}
+	},
+	legacyAdapter: matrixSetupAdapter
+});
 //#endregion
-export { profile_exports as a, resolveMatrixConfigPath as c, resolveSingleAccountPromotionTarget as d, singleAccountKeysToMove as f, resolveMatrixAccount as g, resolveDefaultMatrixAccountId as h, moveSingleMatrixAccountConfigToNamedAccount as i, updateMatrixAccountConfig as l, resolveConfiguredMatrixBotUserIds as m, matrixSetupAdapter as n, syncMatrixOwnProfile as o, listMatrixAccountIds as p, resolveMatrixSetupDmAllowFrom as r, config_update_exports as s, createMatrixSetupWizardProxy as t, namedAccountPromotionKeys as u };
+export { resolveMatrixAccount as _, moveSingleMatrixAccountConfigToNamedAccount as a, config_update_exports as c, namedAccountPromotionKeys as d, resolveSingleAccountPromotionTarget as f, resolveDefaultMatrixAccountId as g, resolveConfiguredMatrixBotUserIds as h, resolveMatrixSetupDmAllowFrom as i, resolveMatrixConfigPath as l, listMatrixAccountIds as m, matrixSetupAdapter as n, profile_exports as o, singleAccountKeysToMove as p, matrixSetupContract as r, syncMatrixOwnProfile as s, createMatrixSetupWizardProxy as t, updateMatrixAccountConfig as u };

package/dist/setup-plugin-api.js

@@ -1,5 +1,5 @@
-import { g as resolveMatrixAccount, n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-CYQRY2oG.js";
-import { r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-BTSatSY3.js";
+import { _ as resolveMatrixAccount, n as matrixSetupAdapter, r as matrixSetupContract, t as createMatrixSetupWizardProxy } from "./setup-core-D6gyoyeg.js";
+import { r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-CggnuwnJ.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 const matrixSetupPlugin = {
 	id: "matrix",
@@ -13,8 +13,9 @@ const matrixSetupPlugin = {
 		order: 70,
 		quickstartAllowFrom: true
 	},
-	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-BjvRQzK6.js").then((n) => n.t)).matrixSetupWizard })),
+	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-DZIEWtQC.js").then((n) => n.t)).matrixSetupWizard })),
 	setup: matrixSetupAdapter,
+	setupContract: matrixSetupContract,
 	capabilities: {
 		chatTypes: [
 			"direct",

package/dist/{setup-surface-BjvRQzK6.js → setup-surface-DZIEWtQC.js}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-Bz00QTmQ.js";
+import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-kqquRzCf.js";
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { r as resolveMatrixEnvAuthReadiness } from "./env-auth-CQsYbz-p.js";
-import { g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, i as moveSingleMatrixAccountConfigToNamedAccount, l as updateMatrixAccountConfig, p as listMatrixAccountIds, r as resolveMatrixSetupDmAllowFrom } from "./setup-core-CYQRY2oG.js";
+import { _ as resolveMatrixAccount, a as moveSingleMatrixAccountConfigToNamedAccount, g as resolveDefaultMatrixAccountId, i as resolveMatrixSetupDmAllowFrom, m as listMatrixAccountIds, u as updateMatrixAccountConfig } from "./setup-core-D6gyoyeg.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { n as validateMatrixHomeserverUrl, r as isPrivateOrLoopbackHost, t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-DDbghaZH.js";
+import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-CcVJfvRM.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringifiedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { formatDocsLink, hasConfiguredSecretInput, mergeAllowFromEntries, normalizeAccountId as normalizeAccountId$1, promptAccountId, promptChannelAccessConfig, splitSetupEntries } from "openclaw/plugin-sdk/setup";
@@ -105,7 +105,7 @@ async function promptMatrixAllowFrom(params) {
 			pending.push(part);
 		}
 		if (pending.length > 0) {
-			const { resolveMatrixTargets } = await import("./resolve-targets-Cx1VVArA.js").then((n) => n.n);
+			const { resolveMatrixTargets } = await import("./resolve-targets-Dn11HT76.js").then((n) => n.n);
 			const results = await resolveMatrixTargets({
 				cfg,
 				accountId,
@@ -233,7 +233,7 @@ async function configureMatrixAccessPrompts(params) {
 					resolvedIds.push(cleaned);
 					continue;
 				}
-				const { listMatrixDirectoryGroupsLive } = await import("./directory-live-0TyS9xep.js").then((n) => n.t);
+				const { listMatrixDirectoryGroupsLive } = await import("./directory-live-B6fbX6jf.js").then((n) => n.t);
 				const matches = await listMatrixDirectoryGroupsLive({
 					cfg: next,
 					accountId: params.accountId,
@@ -387,6 +387,7 @@ async function runMatrixConfigure(params) {
 	}) === "token") {
 		accessToken = normalizeStringifiedOptionalString(await params.prompter.text({
 			message: "Matrix access token",
+			sensitive: true,
 			validate: (value) => normalizeOptionalString(value) ? void 0 : "Required"
 		})) ?? "";
 		password = void 0;
@@ -404,6 +405,7 @@ async function runMatrixConfigure(params) {
 		})) ?? "";
 		password = normalizeStringifiedOptionalString(await params.prompter.text({
 			message: "Matrix password",
+			sensitive: true,
 			validate: (value) => normalizeOptionalString(value) ? void 0 : "Required"
 		})) ?? "";
 		accessToken = void 0;
@@ -508,7 +510,7 @@ const matrixOnboardingAdapter = {
 		});
 	},
 	afterConfigWritten: async ({ previousCfg, cfg, accountId, runtime }) => {
-		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-DXVRCd4G.js");
+		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-C9w01xQK.js");
 		await runMatrixSetupBootstrapAfterConfigWrite({
 			previousCfg,
 			cfg,

package/dist/{shared-BfW4lxGu.js → shared-C7Vm9RxI.js}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as resolveMatrixDefaultOrOnlyAccountId, n as requiresExplicitMatrixDefaultAccount, o as resolveMatrixAccountStringValues } from "./account-selection-Bz00QTmQ.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, n as requiresExplicitMatrixDefaultAccount, o as resolveMatrixAccountStringValues } from "./account-selection-kqquRzCf.js";
 import { t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
 import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { i as resolveScopedMatrixEnvConfig, n as resolveGlobalMatrixEnvConfig } from "./env-auth-CQsYbz-p.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { s as repairCurrentTokenStorageMetaDeviceId } from "./storage-DD-EnNJE.js";
+import { s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BrkTJZov.js";
 import { n as LogService } from "./logger-D0GCSDQq.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, normalizeOptionalAccountId, normalizeOptionalAccountId as normalizeOptionalAccountId$1 } from "openclaw/plugin-sdk/account-id";
@@ -16,7 +16,7 @@ import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 //#region extensions/matrix/src/matrix/client/config.ts
-const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-1TXuSiXZ.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
+const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-DiRXiRRf.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
@@ -24,11 +24,11 @@ const MATRIX_AUTH_REQUEST_RETRY_RE = /\b(fetch failed|econnreset|econnrefused|en
 async function loadMatrixAuthClientDeps() {
 	return await loadDefaultMatrixAuthClientDeps();
 }
-const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-CwNJrmwu.js").then((n) => n.r).then((credentialsReadModule) => ({
+const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-DVmFCm7X.js").then((n) => n.i).then((credentialsReadModule) => ({
 	loadMatrixCredentials: credentialsReadModule.loadMatrixCredentials,
 	credentialsMatchConfig: credentialsReadModule.credentialsMatchConfig
 })));
-const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-BDtpqvj0.js"));
+const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-Be9zNSUw.js"));
 const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("./config-secret-input.runtime-CwsP3--c.js").then((runtime) => ({ resolveConfiguredSecretInputString: runtime.resolveConfiguredSecretInputString })));
 function shouldRetryMatrixAuthRequest(err) {
 	return MATRIX_AUTH_REQUEST_RETRY_RE.test(formatErrorMessage(err));
@@ -492,7 +492,7 @@ var shared_exports = /* @__PURE__ */ __exportAll({
 	stopSharedClientForAccount: () => stopSharedClientForAccount,
 	stopSharedClientInstance: () => stopSharedClientInstance
 });
-const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-85ttAWDP.js").then((n) => n.n).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-Und1YmJ2.js").then((n) => n.n).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
 const sharedClientStates = /* @__PURE__ */ new Map();
 const sharedClientPromises = /* @__PURE__ */ new Map();
 function serializeDispatcherPolicyKey(auth) {

package/dist/{startup-verification-DSiyDKM5.js → startup-verification-D1nscMh8.js}

@@ -1,8 +1,8 @@
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { M as resolveMatrixSqliteStateEnv, l as resolveMatrixStoragePaths, o as recordCurrentStorageMetaDeviceId } from "./storage-DD-EnNJE.js";
-import path from "node:path";
+import { M as resolveMatrixSqliteStateEnv, l as resolveMatrixStoragePaths, o as recordCurrentStorageMetaDeviceId } from "./storage-BrkTJZov.js";
 import { createHash } from "node:crypto";
+import path from "node:path";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs/promises";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";