@openclaw/matrix 2026.7.2-beta.3 → 2026.7.2-beta.5

package/dist/session-binding-contract-api.js

@@ -1,4 +1,4 @@
 import { r as setMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { s as resetMatrixThreadBindingsForTests } from "./thread-bindings-shared-CKnY4LSd.js";
-import { t as createMatrixThreadBindingManager } from "./thread-bindings-Cw194yEn.js";
+import { t as createMatrixThreadBindingManager } from "./thread-bindings-D3RfVgAF.js";
 export { createMatrixThreadBindingManager, resetMatrixThreadBindingsForTests, setMatrixRuntime };

package/dist/{setup-bootstrap-DGPOOdz-.js → setup-bootstrap-BBGpPKgy.js}

@@ -1,7 +1,7 @@
 import { a as resolveMatrixAccountConfig, n as hasExplicitMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
-import "./setup-core-XCdAx1nY.js";
+import "./setup-core-a542Ernq.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { n as bootstrapMatrixVerification } from "./verification-DjxyWTNP.js";
+import { n as bootstrapMatrixVerification } from "./verification-ZdAXdmuh.js";
 //#region extensions/matrix/src/setup-bootstrap.ts
 async function maybeBootstrapNewEncryptedMatrixAccount(params) {
 	const accountConfig = resolveMatrixAccountConfig({

package/dist/{setup-core-XCdAx1nY.js → setup-core-a542Ernq.js}

@@ -8,6 +8,8 @@ import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "opencl
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
+import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
+import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, addWildcardAllowFrom, applyAccountNameToChannelSection, normalizeAccountId as normalizeAccountId$2, normalizeAllowFromEntries, normalizeSecretInputString, prepareScopedSetupConfig } from "openclaw/plugin-sdk/setup";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { coerceSecretRef as coerceSecretRef$1 } from "openclaw/plugin-sdk/secret-ref-runtime";
@@ -135,7 +137,12 @@ function resolveMatrixAccount(params) {
 //#endregion
 //#region extensions/matrix/src/setup-contract.ts
 const matrixSingleAccountKeysToMove = [
+	"homeserver",
+	"userId",
+	"accessToken",
+	"password",
 	"deviceId",
+	"deviceName",
 	"avatarUrl",
 	"initialSyncLimit",
 	"encryption",
@@ -509,16 +516,17 @@ function moveSingleMatrixAccountConfigToNamedAccount(cfg) {
 	};
 }
 function validateMatrixSetupInput(params) {
-	const avatarUrl = resolveSetupAvatarUrl(params.input);
+	const input = params.input;
+	const avatarUrl = resolveSetupAvatarUrl(input);
 	if (avatarUrl && !isSupportedMatrixAvatarSource(avatarUrl)) return "Matrix avatar URL must be an mxc:// URI or an http(s) URL.";
-	if (params.input.useEnv) {
+	if (input.useEnv) {
 		const envReadiness = resolveMatrixEnvAuthReadiness(params.accountId, process.env);
 		return envReadiness.ready ? null : envReadiness.missingMessage;
 	}
-	if (!params.input.homeserver?.trim()) return "Matrix requires --homeserver";
-	const accessToken = params.input.accessToken?.trim();
-	const password = normalizeSecretInputString(params.input.password);
-	const userId = params.input.userId?.trim();
+	if (!input.homeserver?.trim()) return "Matrix requires --homeserver";
+	const accessToken = input.accessToken?.trim();
+	const password = normalizeSecretInputString(input.password);
+	const userId = input.userId?.trim();
 	if (!accessToken && !password) return "Matrix requires --access-token or --password";
 	if (!accessToken) {
 		if (!userId) return "Matrix requires --user-id when using --password";
@@ -527,15 +535,16 @@ function validateMatrixSetupInput(params) {
 	return null;
 }
 function applyMatrixSetupAccountConfig(params) {
+	const input = params.input;
 	const normalizedAccountId = normalizeAccountId$2(params.accountId);
 	const next = applyAccountNameToChannelSection({
 		cfg: normalizedAccountId !== DEFAULT_ACCOUNT_ID$2 ? moveSingleMatrixAccountConfigToNamedAccount(params.cfg) : params.cfg,
 		channelKey: channel$1,
 		accountId: normalizedAccountId,
-		name: params.input.name
+		name: input.name
 	});
-	const avatarUrl = resolveSetupAvatarUrl(params.input);
-	if (params.input.useEnv) return updateMatrixAccountConfig(next, normalizedAccountId, {
+	const avatarUrl = resolveSetupAvatarUrl(input);
+	if (input.useEnv) return updateMatrixAccountConfig(next, normalizedAccountId, {
 		enabled: true,
 		homeserver: null,
 		allowPrivateNetwork: null,
@@ -547,20 +556,20 @@ function applyMatrixSetupAccountConfig(params) {
 		deviceName: null,
 		avatarUrl
 	});
-	const accessToken = params.input.accessToken?.trim();
-	const password = normalizeSecretInputString(params.input.password);
-	const userId = params.input.userId?.trim();
+	const accessToken = input.accessToken?.trim();
+	const password = normalizeSecretInputString(input.password);
+	const userId = input.userId?.trim();
 	return updateMatrixAccountConfig(next, normalizedAccountId, {
 		enabled: true,
-		homeserver: params.input.homeserver?.trim(),
-		allowPrivateNetwork: typeof params.input.dangerouslyAllowPrivateNetwork === "boolean" ? params.input.dangerouslyAllowPrivateNetwork : typeof params.input.allowPrivateNetwork === "boolean" ? params.input.allowPrivateNetwork : void 0,
-		proxy: normalizeOptionalString(params.input.proxy),
+		homeserver: input.homeserver?.trim(),
+		allowPrivateNetwork: typeof input.dangerouslyAllowPrivateNetwork === "boolean" ? input.dangerouslyAllowPrivateNetwork : typeof input.allowPrivateNetwork === "boolean" ? input.allowPrivateNetwork : void 0,
+		proxy: normalizeOptionalString(input.proxy),
 		userId: password && !userId ? null : userId,
 		accessToken: accessToken || (password ? null : void 0),
 		password: password || (accessToken ? null : void 0),
-		deviceName: params.input.deviceName?.trim(),
+		deviceName: input.deviceName?.trim(),
 		avatarUrl,
-		initialSyncLimit: params.input.initialSyncLimit
+		initialSyncLimit: input.initialSyncLimit
 	});
 }
 //#endregion
@@ -578,19 +587,6 @@ function resolveMatrixSetupAccountId(params) {
 function resolveMatrixSetupWizardAccountId(cfg, accountId) {
 	return normalizeAccountId$2(accountId?.trim() || resolveDefaultMatrixAccountId(cfg) || DEFAULT_ACCOUNT_ID$2);
 }
-function setMatrixDmPolicy(cfg, policy, accountId) {
-	const resolvedAccountId = resolveMatrixSetupWizardAccountId(cfg, accountId);
-	const existing = resolveMatrixAccountConfig({
-		cfg,
-		accountId: resolvedAccountId
-	});
-	const allowFrom = resolveMatrixSetupDmAllowFrom(policy, existing.dm?.allowFrom);
-	return updateMatrixAccountConfig(cfg, resolvedAccountId, { dm: {
-		...existing.dm,
-		policy,
-		allowFrom
-	} });
-}
 function createMatrixSetupWizardProxy(loadWizardModule) {
 	let wizardPromise = null;
 	const loadWizard = () => {
@@ -610,28 +606,42 @@ function createMatrixSetupWizardProxy(loadWizardModule) {
 			return await (wizard.configureWhenConfigured ?? wizard.configureInteractive ?? wizard.configure)(ctx);
 		},
 		afterConfigWritten: async (ctx) => await (await loadWizard()).afterConfigWritten?.(ctx),
-		dmPolicy: {
+		dmPolicy: createChannelDmPolicy({
 			label: "Matrix",
 			channel,
-			policyKey: "channels.matrix.dm.policy",
-			allowFromKey: "channels.matrix.dm.allowFrom",
-			resolveConfigKeys: (cfg, accountId) => {
-				const resolvedAccountId = resolveMatrixSetupWizardAccountId(cfg, accountId);
+			policyPath: "dm.policy",
+			allowFromPath: "dm.allowFrom",
+			resolveAccount: (cfg, accountId) => {
+				const accountIdResolved = resolveMatrixSetupWizardAccountId(cfg, accountId);
+				const config = resolveMatrixAccountConfig({
+					cfg,
+					accountId: accountIdResolved
+				});
 				return {
-					policyKey: resolveMatrixConfigFieldPath(cfg, resolvedAccountId, "dm.policy"),
-					allowFromKey: resolveMatrixConfigFieldPath(cfg, resolvedAccountId, "dm.allowFrom")
+					accountId: accountIdResolved,
+					config: {
+						dmPolicy: config.dm?.policy,
+						allowFrom: config.dm?.allowFrom,
+						dm: config.dm
+					}
 				};
 			},
-			getCurrent: (cfg, accountId) => resolveMatrixAccountConfig({
-				cfg,
-				accountId: resolveMatrixSetupWizardAccountId(cfg, accountId)
-			}).dm?.policy ?? "pairing",
-			setPolicy: (cfg, policy, accountId) => setMatrixDmPolicy(cfg, policy, accountId),
+			resolveConfigKeys: ({ cfg, account }) => ({
+				policyKey: resolveMatrixConfigFieldPath(cfg, account.accountId, "dm.policy"),
+				allowFromKey: resolveMatrixConfigFieldPath(cfg, account.accountId, "dm.allowFrom")
+			}),
+			resolveAllowFrom: ({ policy, account }) => resolveMatrixSetupDmAllowFrom(policy, account.config.allowFrom),
+			buildPatch: ({ account, policy, allowFrom }) => ({ dm: {
+				...account.config.dm,
+				policy,
+				allowFrom
+			} }),
+			applyPatch: ({ cfg, account, patch }) => updateMatrixAccountConfig(cfg, account.accountId, patch),
 			promptAllowFrom: async (params) => {
 				const promptAllowFrom = (await loadWizard()).dmPolicy?.promptAllowFrom;
 				return promptAllowFrom ? await promptAllowFrom(params) : params.cfg;
 			}
-		},
+		}),
 		disable: (cfg) => ({
 			...cfg,
 			channels: {
@@ -645,6 +655,9 @@ function createMatrixSetupWizardProxy(loadWizardModule) {
 	};
 }
 const matrixSetupAdapter = {
+	singleAccountKeysToMove,
+	namedAccountPromotionKeys,
+	resolveSingleAccountPromotionTarget,
 	resolveAccountId: ({ accountId, input }) => resolveMatrixSetupAccountId({
 		accountId,
 		name: input?.name
@@ -669,7 +682,7 @@ const matrixSetupAdapter = {
 		input
 	}),
 	afterAccountConfigWritten: async ({ previousCfg, cfg, accountId, runtime }) => {
-		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-DGPOOdz-.js");
+		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-BBGpPKgy.js");
 		await runMatrixSetupBootstrapAfterConfigWrite({
 			previousCfg,
 			cfg,
@@ -678,5 +691,82 @@ const matrixSetupAdapter = {
 		});
 	}
 };
+const matrixSetupContract = defineChannelSetupContract({
+	fields: {
+		homeserver: {
+			kind: "string",
+			cli: {
+				flags: "--homeserver <url>",
+				description: "Matrix homeserver URL"
+			}
+		},
+		userId: {
+			kind: "string",
+			cli: {
+				flags: "--user-id <id>",
+				description: "Matrix user id"
+			}
+		},
+		accessToken: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--access-token <token>",
+				description: "Matrix access token"
+			}
+		},
+		password: {
+			kind: "string",
+			sensitive: true,
+			cli: {
+				flags: "--password <password>",
+				description: "Matrix password"
+			}
+		},
+		deviceName: {
+			kind: "string",
+			cli: {
+				flags: "--device-name <name>",
+				description: "Matrix device name"
+			}
+		},
+		avatarUrl: {
+			kind: "string",
+			cli: {
+				flags: "--avatar-url <url>",
+				description: "Matrix avatar URL"
+			}
+		},
+		initialSyncLimit: {
+			kind: "integer",
+			cli: {
+				flags: "--initial-sync-limit <n>",
+				description: "Matrix initial sync room limit"
+			}
+		},
+		proxy: {
+			kind: "string",
+			cli: {
+				flags: "--proxy <url>",
+				description: "Matrix proxy URL"
+			}
+		},
+		dangerouslyAllowPrivateNetwork: {
+			kind: "boolean",
+			cli: {
+				flags: "--dangerously-allow-private-network",
+				description: "Allow private-network Matrix homeservers"
+			}
+		},
+		useEnv: {
+			kind: "boolean",
+			cli: {
+				flags: "--use-env",
+				description: "Use Matrix environment credentials"
+			}
+		}
+	},
+	legacyAdapter: matrixSetupAdapter
+});
 //#endregion
-export { profile_exports as a, resolveMatrixConfigPath as c, resolveSingleAccountPromotionTarget as d, singleAccountKeysToMove as f, resolveMatrixAccount as g, resolveDefaultMatrixAccountId as h, moveSingleMatrixAccountConfigToNamedAccount as i, updateMatrixAccountConfig as l, resolveConfiguredMatrixBotUserIds as m, matrixSetupAdapter as n, syncMatrixOwnProfile as o, listMatrixAccountIds as p, resolveMatrixSetupDmAllowFrom as r, config_update_exports as s, createMatrixSetupWizardProxy as t, namedAccountPromotionKeys as u };
+export { resolveMatrixAccount as _, moveSingleMatrixAccountConfigToNamedAccount as a, config_update_exports as c, namedAccountPromotionKeys as d, resolveSingleAccountPromotionTarget as f, resolveDefaultMatrixAccountId as g, resolveConfiguredMatrixBotUserIds as h, resolveMatrixSetupDmAllowFrom as i, resolveMatrixConfigPath as l, listMatrixAccountIds as m, matrixSetupAdapter as n, profile_exports as o, singleAccountKeysToMove as p, matrixSetupContract as r, syncMatrixOwnProfile as s, createMatrixSetupWizardProxy as t, updateMatrixAccountConfig as u };

package/dist/setup-plugin-api.js

@@ -1,5 +1,5 @@
-import { g as resolveMatrixAccount, n as matrixSetupAdapter, t as createMatrixSetupWizardProxy } from "./setup-core-XCdAx1nY.js";
-import { r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-B5GRV8wL.js";
+import { _ as resolveMatrixAccount, n as matrixSetupAdapter, r as matrixSetupContract, t as createMatrixSetupWizardProxy } from "./setup-core-a542Ernq.js";
+import { r as matrixConfigAdapter, t as MatrixChannelConfigSchema } from "./config-schema-BShrVROw.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 const matrixSetupPlugin = {
 	id: "matrix",
@@ -13,8 +13,9 @@ const matrixSetupPlugin = {
 		order: 70,
 		quickstartAllowFrom: true
 	},
-	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-CzUiTe_k.js").then((n) => n.t)).matrixSetupWizard })),
+	setupWizard: createMatrixSetupWizardProxy(async () => ({ matrixSetupWizard: (await import("./setup-surface-BJrCI6KT.js").then((n) => n.t)).matrixSetupWizard })),
 	setup: matrixSetupAdapter,
+	setupContract: matrixSetupContract,
 	capabilities: {
 		chatTypes: [
 			"direct",

package/dist/{setup-surface-CzUiTe_k.js → setup-surface-BJrCI6KT.js}

@@ -2,12 +2,13 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as requiresExplicitMatrixDefaultAccount } from "./account-selection-kqquRzCf.js";
 import { a as resolveMatrixAccountConfig } from "./account-config-BZWN9tGS.js";
 import { r as resolveMatrixEnvAuthReadiness } from "./env-auth-CQsYbz-p.js";
-import { g as resolveMatrixAccount, h as resolveDefaultMatrixAccountId, i as moveSingleMatrixAccountConfigToNamedAccount, l as updateMatrixAccountConfig, p as listMatrixAccountIds, r as resolveMatrixSetupDmAllowFrom } from "./setup-core-XCdAx1nY.js";
+import { _ as resolveMatrixAccount, a as moveSingleMatrixAccountConfigToNamedAccount, g as resolveDefaultMatrixAccountId, i as resolveMatrixSetupDmAllowFrom, m as listMatrixAccountIds, u as updateMatrixAccountConfig } from "./setup-core-a542Ernq.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { n as validateMatrixHomeserverUrl, r as isPrivateOrLoopbackHost, t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
 import { n as ensureMatrixSdkInstalled, r as isMatrixSdkAvailable } from "./deps-CcVJfvRM.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringifiedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
+import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
 import { formatDocsLink, hasConfiguredSecretInput, mergeAllowFromEntries, normalizeAccountId as normalizeAccountId$1, promptAccountId, promptChannelAccessConfig, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { isPrivateNetworkOptInEnabled } from "openclaw/plugin-sdk/ssrf-policy";
 //#region extensions/matrix/src/onboarding.ts
@@ -38,19 +39,6 @@ function normalizeMatrixInviteAutoJoinTargets(entries) {
 function resolveMatrixOnboardingAccountId(cfg, accountId) {
 	return normalizeAccountId$1(normalizeOptionalString(accountId) || resolveDefaultMatrixAccountId(cfg) || DEFAULT_ACCOUNT_ID);
 }
-function setMatrixDmPolicy(cfg, policy, accountId) {
-	const resolvedAccountId = resolveMatrixOnboardingAccountId(cfg, accountId);
-	const existing = resolveMatrixAccountConfig({
-		cfg,
-		accountId: resolvedAccountId
-	});
-	const allowFrom = resolveMatrixSetupDmAllowFrom(policy, existing.dm?.allowFrom);
-	return updateMatrixAccountConfig(cfg, resolvedAccountId, { dm: {
-		...existing.dm,
-		policy,
-		allowFrom
-	} });
-}
 async function noteMatrixAuthHelp(prompter) {
 	await prompter.note([
 		"Matrix requires a homeserver URL.",
@@ -105,7 +93,7 @@ async function promptMatrixAllowFrom(params) {
 			pending.push(part);
 		}
 		if (pending.length > 0) {
-			const { resolveMatrixTargets } = await import("./resolve-targets-DVoj-YxB.js").then((n) => n.n);
+			const { resolveMatrixTargets } = await import("./resolve-targets-nNMcrV3W.js").then((n) => n.n);
 			const results = await resolveMatrixTargets({
 				cfg,
 				accountId,
@@ -233,7 +221,7 @@ async function configureMatrixAccessPrompts(params) {
 					resolvedIds.push(cleaned);
 					continue;
 				}
-				const { listMatrixDirectoryGroupsLive } = await import("./directory-live-DiC-0XBC.js").then((n) => n.t);
+				const { listMatrixDirectoryGroupsLive } = await import("./directory-live-YRgYDx2w.js").then((n) => n.t);
 				const matches = await listMatrixDirectoryGroupsLive({
 					cfg: next,
 					accountId: params.accountId,
@@ -258,25 +246,39 @@ async function configureMatrixAccessPrompts(params) {
 		accountId: params.accountId
 	});
 }
-const dmPolicy = {
+const dmPolicy = createChannelDmPolicy({
 	label: "Matrix",
 	channel,
-	policyKey: "channels.matrix.dm.policy",
-	allowFromKey: "channels.matrix.dm.allowFrom",
-	resolveConfigKeys: (cfg, accountId) => {
-		const effectiveAccountId = resolveMatrixOnboardingAccountId(cfg, accountId);
+	policyPath: "dm.policy",
+	allowFromPath: "dm.allowFrom",
+	resolveAccount: (cfg, accountId) => {
+		const accountIdResolved = resolveMatrixOnboardingAccountId(cfg, accountId);
+		const config = resolveMatrixAccountConfig({
+			cfg,
+			accountId: accountIdResolved
+		});
 		return {
-			policyKey: resolveMatrixConfigFieldPath(cfg, effectiveAccountId, "dm.policy"),
-			allowFromKey: resolveMatrixConfigFieldPath(cfg, effectiveAccountId, "dm.allowFrom")
+			accountId: accountIdResolved,
+			config: {
+				dmPolicy: config.dm?.policy,
+				allowFrom: config.dm?.allowFrom,
+				dm: config.dm
+			}
 		};
 	},
-	getCurrent: (cfg, accountId) => resolveMatrixAccountConfig({
-		cfg,
-		accountId: resolveMatrixOnboardingAccountId(cfg, accountId)
-	}).dm?.policy ?? "pairing",
-	setPolicy: (cfg, policy, accountId) => setMatrixDmPolicy(cfg, policy, accountId),
+	resolveConfigKeys: ({ cfg, account }) => ({
+		policyKey: resolveMatrixConfigFieldPath(cfg, account.accountId, "dm.policy"),
+		allowFromKey: resolveMatrixConfigFieldPath(cfg, account.accountId, "dm.allowFrom")
+	}),
+	resolveAllowFrom: ({ policy, account }) => resolveMatrixSetupDmAllowFrom(policy, account.config.allowFrom),
+	buildPatch: ({ account, policy, allowFrom }) => ({ dm: {
+		...account.config.dm,
+		policy,
+		allowFrom
+	} }),
+	applyPatch: ({ cfg, account, patch }) => updateMatrixAccountConfig(cfg, account.accountId, patch),
 	promptAllowFrom: promptMatrixAllowFrom
-};
+});
 async function runMatrixConfigure(params) {
 	let next = params.cfg;
 	await ensureMatrixSdkInstalled({
@@ -387,6 +389,7 @@ async function runMatrixConfigure(params) {
 	}) === "token") {
 		accessToken = normalizeStringifiedOptionalString(await params.prompter.text({
 			message: "Matrix access token",
+			sensitive: true,
 			validate: (value) => normalizeOptionalString(value) ? void 0 : "Required"
 		})) ?? "";
 		password = void 0;
@@ -404,6 +407,7 @@ async function runMatrixConfigure(params) {
 		})) ?? "";
 		password = normalizeStringifiedOptionalString(await params.prompter.text({
 			message: "Matrix password",
+			sensitive: true,
 			validate: (value) => normalizeOptionalString(value) ? void 0 : "Required"
 		})) ?? "";
 		accessToken = void 0;
@@ -508,7 +512,7 @@ const matrixOnboardingAdapter = {
 		});
 	},
 	afterConfigWritten: async ({ previousCfg, cfg, accountId, runtime }) => {
-		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-DGPOOdz-.js");
+		const { runMatrixSetupBootstrapAfterConfigWrite } = await import("./setup-bootstrap-BBGpPKgy.js");
 		await runMatrixSetupBootstrapAfterConfigWrite({
 			previousCfg,
 			cfg,

package/dist/{shared-DquM1oz6.js → shared-CUH5otj8.js}

@@ -5,18 +5,18 @@ import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as
 import { i as resolveScopedMatrixEnvConfig, n as resolveGlobalMatrixEnvConfig } from "./env-auth-CQsYbz-p.js";
 import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.js";
 import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.js";
-import { s as repairCurrentTokenStorageMetaDeviceId } from "./storage-CzHxeF5E.js";
+import { s as repairCurrentTokenStorageMetaDeviceId } from "./storage-BvAkgzvT.js";
 import { n as LogService } from "./logger-D0GCSDQq.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, normalizeOptionalAccountId, normalizeOptionalAccountId as normalizeOptionalAccountId$1 } from "openclaw/plugin-sdk/account-id";
 import { coerceSecretRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input-runtime";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { formatErrorMessage, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork as ssrfPolicyFromDangerouslyAllowPrivateNetwork$1 } from "openclaw/plugin-sdk/ssrf-runtime";
 import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 //#region extensions/matrix/src/matrix/client/config.ts
-const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-CIDZXWpZ.js"), import("./logging-QH-48Gr6.js")]).then(([sdkModule, loggingModule]) => ({
+const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-UzPd8tst.js"), import("./logging-DV-p52N0.js").then((n) => n.n)]).then(([sdkModule, loggingModule]) => ({
 	MatrixClient: sdkModule.MatrixClient,
 	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
 })));
@@ -470,17 +470,10 @@ async function awaitMatrixStartupWithAbort(promise, abortSignal) {
 			resolve(value);
 		}, (error) => {
 			abortSignal.removeEventListener("abort", onAbort);
-			reject(toLintErrorObject(error, "Non-Error rejection"));
+			reject(toErrorObject(error, "Non-Error rejection"));
 		});
 	});
 }
-function toLintErrorObject(value, fallbackMessage) {
-	if (value instanceof Error) return value;
-	if (typeof value === "string") return new Error(value);
-	const error = new Error(fallbackMessage, { cause: value });
-	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
-	return error;
-}
 //#endregion
 //#region extensions/matrix/src/matrix/client/shared.ts
 var shared_exports = /* @__PURE__ */ __exportAll({
@@ -492,7 +485,7 @@ var shared_exports = /* @__PURE__ */ __exportAll({
 	stopSharedClientForAccount: () => stopSharedClientForAccount,
 	stopSharedClientInstance: () => stopSharedClientInstance
 });
-const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-WQExaby_.js").then((n) => n.n).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => import("./create-client-f-CkRllE.js").then((n) => n.n).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
 const sharedClientStates = /* @__PURE__ */ new Map();
 const sharedClientPromises = /* @__PURE__ */ new Map();
 function serializeDispatcherPolicyKey(auth) {

package/dist/{startup-verification-CA00kebL.js → startup-verification-wm3_i88s.js}

@@ -1,6 +1,6 @@
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { M as resolveMatrixSqliteStateEnv, l as resolveMatrixStoragePaths, o as recordCurrentStorageMetaDeviceId } from "./storage-CzHxeF5E.js";
+import { M as resolveMatrixSqliteStateEnv, l as resolveMatrixStoragePaths, o as recordCurrentStorageMetaDeviceId } from "./storage-BvAkgzvT.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";

package/dist/{storage-CzHxeF5E.js → storage-BvAkgzvT.js}

@@ -123,8 +123,8 @@ function writeMatrixIdbSnapshotJson(params) {
 		store: openSyncStore(openMatrixIdbSnapshotStoreOptions(params.storageRootDir))
 	});
 }
-async function hasMatrixIdbSnapshotStateInStore(params) {
-	return await readIdbSnapshotJsonFromAsyncStore(params.store) !== null;
+async function readMatrixIdbSnapshotJsonFromStore(params) {
+	return await readIdbSnapshotJsonFromAsyncStore(params.store);
 }
 async function writeMatrixIdbSnapshotJsonToStore(params) {
 	const rows = buildIdbSnapshotRows(params.snapshotJson, params.databaseCount);
@@ -362,9 +362,8 @@ function openMatrixStorageMetaStoreOptions(storageRootDir) {
 function openStorageMetaStore(rootDir) {
 	return getMatrixRuntime().state.openSyncKeyedStore(openMatrixStorageMetaStoreOptions(rootDir));
 }
-function scoreStorageRoot(rootDir) {
+function scoreStorageRoot(rootDir, metadata = readStoredRootMetadata(rootDir)) {
 	let score = 0;
-	const metadata = readStoredRootMetadata(rootDir);
 	if (Object.keys(metadata).length > 0) score += 1;
 	if (metadata.currentTokenStateClaimed === true) score += 8;
 	if (fs.existsSync(path.join(rootDir, "crypto"))) score += 8;
@@ -417,8 +416,16 @@ function isCompatibleStorageRoot(params) {
 	return true;
 }
 function resolvePreferredMatrixStorageRoot(params) {
+	const canonical = {
+		rootDir: params.canonicalRootDir,
+		tokenHash: params.canonicalTokenHash
+	};
+	const deviceId = params.deviceId?.trim();
+	if (!deviceId) return canonical;
+	const canonicalMetadata = readStoredRootMetadata(params.canonicalRootDir);
+	if (canonicalMetadata.accessTokenHash === params.canonicalTokenHash && canonicalMetadata.deviceId?.trim() === deviceId && canonicalMetadata.currentTokenStateClaimed === true) return canonical;
 	const parentDir = path.dirname(params.canonicalRootDir);
-	const bestCurrentScore = scoreStorageRoot(params.canonicalRootDir);
+	const bestCurrentScore = scoreStorageRoot(params.canonicalRootDir, canonicalMetadata);
 	const bestCurrentMtimeMs = resolveStorageRootMtimeMs(params.canonicalRootDir);
 	let best = {
 		rootDir: params.canonicalRootDir,
@@ -426,10 +433,6 @@ function resolvePreferredMatrixStorageRoot(params) {
 		score: bestCurrentScore,
 		mtimeMs: bestCurrentMtimeMs
 	};
-	if (!params.deviceId?.trim()) return {
-		rootDir: best.rootDir,
-		tokenHash: best.tokenHash
-	};
 	let siblingEntries;
 	try {
 		siblingEntries = fs.readdirSync(parentDir, { withFileTypes: true });
@@ -450,8 +453,8 @@ function resolvePreferredMatrixStorageRoot(params) {
 			homeserver: params.homeserver,
 			userId: params.userId,
 			accountKey: params.accountKey,
-			deviceId: params.deviceId,
-			requireExplicitDeviceMatch: Boolean(params.deviceId)
+			deviceId,
+			requireExplicitDeviceMatch: true
 		})) continue;
 		const candidateScore = scoreStorageRoot(candidateRootDir);
 		if (candidateScore <= 0) continue;
@@ -463,15 +466,12 @@ function resolvePreferredMatrixStorageRoot(params) {
 			mtimeMs: resolveStorageRootMtimeMs(candidateRootDir)
 		});
 	}
-	const canonicalMetadata = readStoredRootMetadata(params.canonicalRootDir);
-	if (!(canonicalMetadata.accessTokenHash === params.canonicalTokenHash && canonicalMetadata.deviceId?.trim() === params.deviceId.trim() && canonicalMetadata.currentTokenStateClaimed === true)) {
-		for (const candidate of compatiblePopulatedSiblings) if (candidate.score > best.score || best.rootDir !== params.canonicalRootDir && candidate.score === best.score && candidate.mtimeMs > best.mtimeMs) best = {
-			rootDir: candidate.rootDir,
-			tokenHash: candidate.tokenHash,
-			score: candidate.score,
-			mtimeMs: candidate.mtimeMs
-		};
-	}
+	for (const candidate of compatiblePopulatedSiblings) if (candidate.score > best.score || best.rootDir !== params.canonicalRootDir && candidate.score === best.score && candidate.mtimeMs > best.mtimeMs) best = {
+		rootDir: candidate.rootDir,
+		tokenHash: candidate.tokenHash,
+		score: candidate.score,
+		mtimeMs: candidate.mtimeMs
+	};
 	if (populatedTokenHashes.length > 1) getMatrixRuntime().logging.getChildLogger({ module: "matrix-storage" }).warn("matrix: multiple populated token-hash storage roots detected", {
 		parentDir,
 		canonicalTokenHash: params.canonicalTokenHash,
@@ -526,12 +526,11 @@ function resolveMatrixStateFilePath(params) {
 }
 async function maybeMigrateLegacyStorage(params) {
 	const hasAccountScopedLegacyStorageFile = fs.existsSync(params.storagePaths.storagePath);
-	const syncCache = hasAccountScopedLegacyStorageFile ? await import("./file-sync-store-CPkgnSXp.js").then((n) => n.n) : null;
+	const syncCache = hasAccountScopedLegacyStorageFile ? await import("./file-sync-store-DiiFsayX.js").then((n) => n.n) : null;
 	const hasAccountScopedLegacyStorage = hasAccountScopedLegacyStorageFile && await syncCache?.readLegacyMatrixSyncCacheState(params.storagePaths.rootDir) !== null;
 	const hasAccountScopedRecoveryKey = fs.existsSync(params.storagePaths.recoveryKeyPath);
-	const hasAccountScopedIdbSnapshot = fs.existsSync(params.storagePaths.idbSnapshotPath);
 	const hasAccountScopedLegacyCryptoMigration = fs.existsSync(path.join(params.storagePaths.rootDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME));
-	if (!hasAccountScopedLegacyStorage && !hasAccountScopedRecoveryKey && !hasAccountScopedIdbSnapshot && !hasAccountScopedLegacyCryptoMigration) return;
+	if (!hasAccountScopedLegacyStorage && !hasAccountScopedRecoveryKey && !hasAccountScopedLegacyCryptoMigration) return;
 	const logger = getMatrixRuntime().logging.getChildLogger({ module: "matrix-storage" });
 	fs.mkdirSync(params.storagePaths.rootDir, { recursive: true });
 	const moved = [];
@@ -562,12 +561,6 @@ async function maybeMigrateLegacyStorage(params) {
 				label: "legacy crypto migration"
 			});
 		}
-		if (hasAccountScopedIdbSnapshot) await migrateLegacyIdbSnapshotToSqlite({
-			storageRootDir: params.storagePaths.rootDir,
-			snapshotPath: params.storagePaths.idbSnapshotPath,
-			moved,
-			pendingArchives
-		});
 	} catch (err) {
 		const rollbackError = rollbackLegacyMoves(moved);
 		throw new Error(rollbackError ? `Failed migrating legacy Matrix client storage: ${String(err)}. Rollback also failed: ${rollbackError}` : `Failed migrating legacy Matrix client storage: ${String(err)}`, { cause: err });
@@ -579,34 +572,8 @@ async function maybeMigrateLegacyStorage(params) {
 	if (moved.length > 0) logger.info(`matrix: migrated legacy client storage into ${params.storagePaths.rootDir}\n${moved.map((entry) => `- ${entry.label}: ${entry.sourcePath} -> ${entry.targetPath}`).join("\n")}`);
 	if (skippedExistingTargets.length > 0) logger.warn?.(`matrix: legacy client storage files were left in place because their migrated targets already existed.\n${skippedExistingTargets.join("\n")}`);
 }
-async function migrateLegacyIdbSnapshotToSqlite(params) {
-	if (readMatrixIdbSnapshotJson(params.storageRootDir)) {
-		params.pendingArchives.push({
-			sourcePath: params.snapshotPath,
-			label: "IndexedDB snapshot"
-		});
-		return;
-	}
-	const { readLegacyMatrixIdbSnapshotState } = await import("./idb-persistence-Dyy6ipgU.js").then((n) => n.t);
-	const snapshot = await readLegacyMatrixIdbSnapshotState(params.storageRootDir);
-	if (!snapshot) return;
-	writeMatrixIdbSnapshotJson({
-		storageRootDir: params.storageRootDir,
-		snapshotJson: JSON.stringify(snapshot),
-		databaseCount: snapshot.length
-	});
-	params.moved.push({
-		sourcePath: params.snapshotPath,
-		targetPath: `${params.storageRootDir} SQLite IndexedDB snapshot state`,
-		label: "IndexedDB snapshot"
-	});
-	params.pendingArchives.push({
-		sourcePath: params.snapshotPath,
-		label: "IndexedDB snapshot"
-	});
-}
 async function migrateLegacySyncCacheToSqlite(params) {
-	const syncCache = await import("./file-sync-store-CPkgnSXp.js").then((n) => n.n);
+	const syncCache = await import("./file-sync-store-DiiFsayX.js").then((n) => n.n);
 	const persisted = await syncCache.readLegacyMatrixSyncCacheState(params.sourceRootDir);
 	if (!persisted) return;
 	const store = getMatrixRuntime().state.openKeyedStore(syncCache.openMatrixSyncCacheStoreOptions(params.targetRootDir));
@@ -715,4 +682,4 @@ function repairCurrentTokenStorageMetaDeviceId(params) {
 	});
 }
 //#endregion
-export { writeMatrixRecoveryKeyStateForPath as A, readLegacyMatrixRecoveryKeyFile as C, writeMatrixIdbSnapshotJson as D, readMatrixRecoveryKeyStateForPath as E, resolveMatrixSqliteStateEnv as M, resolveMatrixSqliteStateKey as N, writeMatrixIdbSnapshotJsonToStore as O, readLegacyMatrixLegacyCryptoMigrationState as S, readMatrixIdbSnapshotJson as T, hasMatrixRecoveryKeyStateInStore as _, openMatrixStorageMetaStoreOptions as a, openMatrixLegacyCryptoMigrationStoreOptions as b, resolveMatrixStateFilePath as c, writeStorageMeta as d, MATRIX_IDB_SNAPSHOT_FILENAME as f, hasMatrixLegacyCryptoMigrationStateInStore as g, hasMatrixIdbSnapshotStateInStore as h, normalizeMatrixStorageMetadata as i, writeMatrixRecoveryKeyStateToStore as j, writeMatrixLegacyCryptoMigrationStateToStore as k, resolveMatrixStoragePaths as l, MATRIX_RECOVERY_KEY_FILENAME as m, hasMatrixStorageMetaStateInStore as n, recordCurrentStorageMetaDeviceId as o, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME as p, maybeMigrateLegacyStorage as r, repairCurrentTokenStorageMetaDeviceId as s, claimCurrentTokenStorageState as t, writeMatrixStorageMetaStateToStore as u, migrateLegacyMatrixRecoveryKeyFilePathToStore as v, readLegacyMatrixRecoveryKeyState as w, openMatrixRecoveryKeyStoreOptions as x, openMatrixIdbSnapshotStoreOptions as y };
+export { writeMatrixRecoveryKeyStateForPath as A, readLegacyMatrixRecoveryKeyState as C, writeMatrixIdbSnapshotJson as D, readMatrixRecoveryKeyStateForPath as E, resolveMatrixSqliteStateEnv as M, resolveMatrixSqliteStateKey as N, writeMatrixIdbSnapshotJsonToStore as O, readLegacyMatrixRecoveryKeyFile as S, readMatrixIdbSnapshotJsonFromStore as T, migrateLegacyMatrixRecoveryKeyFilePathToStore as _, openMatrixStorageMetaStoreOptions as a, openMatrixRecoveryKeyStoreOptions as b, resolveMatrixStateFilePath as c, writeStorageMeta as d, MATRIX_IDB_SNAPSHOT_FILENAME as f, hasMatrixRecoveryKeyStateInStore as g, hasMatrixLegacyCryptoMigrationStateInStore as h, normalizeMatrixStorageMetadata as i, writeMatrixRecoveryKeyStateToStore as j, writeMatrixLegacyCryptoMigrationStateToStore as k, resolveMatrixStoragePaths as l, MATRIX_RECOVERY_KEY_FILENAME as m, hasMatrixStorageMetaStateInStore as n, recordCurrentStorageMetaDeviceId as o, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME as p, maybeMigrateLegacyStorage as r, repairCurrentTokenStorageMetaDeviceId as s, claimCurrentTokenStorageState as t, writeMatrixStorageMetaStateToStore as u, openMatrixIdbSnapshotStoreOptions as v, readMatrixIdbSnapshotJson as w, readLegacyMatrixLegacyCryptoMigrationState as x, openMatrixLegacyCryptoMigrationStoreOptions as y };