@openclaw/matrix 2026.7.2-beta.5 → 2026.7.33

package/dist/.setup/client-DFBQtzCe.mjs

@@ -0,0 +1,916 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { a as resolveMatrixDefaultOrOnlyAccountId, n as requiresExplicitMatrixDefaultAccount, s as resolveMatrixAccountStringValues } from "./account-selection-BOQeTqax.mjs";
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-KzaYveuy.mjs";
+import { o as resolveMatrixBaseConfig, r as listNormalizedMatrixAccountIds, t as findMatrixAccountConfig } from "./account-config-BZWN9tGS.mjs";
+import { r as resolveScopedMatrixEnvConfig, t as resolveGlobalMatrixEnvConfig } from "./env-auth-CYJL1jNl.mjs";
+import { t as resolveMatrixConfigFieldPath } from "./config-paths-CnREYb1Y.mjs";
+import { t as resolveValidatedMatrixHomeserverUrl } from "./url-validation-GRHde6lq.mjs";
+import { d as writeStorageMeta, l as resolveMatrixStoragePaths, r as maybeMigrateLegacyStorage, s as repairCurrentTokenStorageMetaDeviceId } from "./storage-NGZq5zet.mjs";
+import { n as LogService } from "./logger-DpoogOgz.mjs";
+import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, normalizeOptionalAccountId, normalizeOptionalAccountId as normalizeOptionalAccountId$1 } from "openclaw/plugin-sdk/account-id";
+import { coerceSecretRef, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input-runtime";
+import fs from "node:fs";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { isPrivateNetworkOptInEnabled, ssrfPolicyFromDangerouslyAllowPrivateNetwork, ssrfPolicyFromDangerouslyAllowPrivateNetwork as ssrfPolicyFromDangerouslyAllowPrivateNetwork$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { resolveOptionalIntegerOption } from "openclaw/plugin-sdk/number-runtime";
+import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region extensions/matrix/src/matrix/client/config.ts
+const loadDefaultMatrixAuthClientDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-He1quVAq.mjs").then((n) => n.t), import("./logging-CgxQOJJP.mjs")]).then(([sdkModule, loggingModule]) => ({
+	MatrixClient: sdkModule.MatrixClient,
+	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
+})));
+const MATRIX_AUTH_REQUEST_RETRY_RE = /\b(fetch failed|econnreset|econnrefused|enotfound|etimedout|ehostunreach|enetunreach|eai_again|und_err_|socket hang up|network|headers timeout|body timeout|connect timeout)\b/i;
+async function loadMatrixAuthClientDeps() {
+	return await loadDefaultMatrixAuthClientDeps();
+}
+const loadMatrixCredentialsReadDeps = createLazyRuntimeModule(() => import("./credentials-read-CRHg6XPm.mjs").then((n) => n.r).then((credentialsReadModule) => ({
+	loadMatrixCredentials: credentialsReadModule.loadMatrixCredentials,
+	credentialsMatchConfig: credentialsReadModule.credentialsMatchConfig
+})));
+const loadMatrixCredentialsWriteRuntime = createLazyRuntimeModule(() => import("./credentials-write.runtime-dWuLafsk.mjs"));
+const loadMatrixSecretInputDeps = createLazyRuntimeModule(() => import("./config-secret-input.runtime-CwsP3--c.mjs").then((runtime) => ({ resolveConfiguredSecretInputString: runtime.resolveConfiguredSecretInputString })));
+function shouldRetryMatrixAuthRequest(err) {
+	return MATRIX_AUTH_REQUEST_RETRY_RE.test(formatErrorMessage(err));
+}
+function isAbortSignalTriggered(signal) {
+	return signal?.aborted === true;
+}
+function credentialsMatchBackfillAuthLineage(params) {
+	if (!params.stored) return true;
+	return params.stored.homeserver === params.auth.homeserver && params.stored.userId === params.auth.userId && params.stored.accessToken === params.auth.accessToken;
+}
+async function retryMatrixAuthRequest(label, run) {
+	return await retryAsync(run, {
+		attempts: 3,
+		minDelayMs: 250,
+		maxDelayMs: 1500,
+		jitter: .1,
+		label,
+		shouldRetry: (err) => shouldRetryMatrixAuthRequest(err)
+	});
+}
+async function fetchMatrixWhoamiIdentity(params) {
+	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixAuthClientDeps();
+	ensureMatrixSdkLoggingConfigured();
+	const tempClient = new MatrixClient(params.homeserver, params.accessToken, {
+		userId: params.userId,
+		ssrfPolicy: params.ssrfPolicy,
+		dispatcherPolicy: params.dispatcherPolicy
+	});
+	return await retryMatrixAuthRequest("matrix auth whoami", async () => {
+		return await tempClient.doRequest("GET", "/_matrix/client/v3/account/whoami");
+	});
+}
+function readEnvSecretRefFallback(params) {
+	const ref = coerceSecretRef(params.value, params.config?.secrets?.defaults);
+	if (!ref || ref.source !== "env" || !params.env) return;
+	const providerConfig = params.config?.secrets?.providers?.[ref.provider];
+	if (providerConfig) {
+		if (providerConfig.source !== "env") throw new Error(`Secret provider "${ref.provider}" has source "${providerConfig.source}" but ref requests "env".`);
+		if (providerConfig.allowlist && !providerConfig.allowlist.includes(ref.id)) throw new Error(`Environment variable "${ref.id}" is not allowlisted in secrets.providers.${ref.provider}.allowlist.`);
+	} else if (ref.provider !== (params.config?.secrets?.defaults?.env?.trim() || "default")) throw new Error(`Secret provider "${ref.provider}" is not configured (ref: ${ref.source}:${ref.provider}:${ref.id}).`);
+	const resolved = params.env[ref.id];
+	if (typeof resolved !== "string") return;
+	const trimmed = resolved.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function clean(value, path, opts) {
+	const ref = coerceSecretRef(value, opts?.config?.secrets?.defaults);
+	if (opts?.suppressSecretRef && ref) return "";
+	const normalizedValue = opts?.allowEnvSecretRefFallback ? ref?.source === "env" ? readEnvSecretRefFallback({
+		value,
+		env: opts.env,
+		config: opts.config
+	}) ?? value : ref ? "" : value : value;
+	return normalizeResolvedSecretInputString({
+		value: normalizedValue,
+		path,
+		defaults: opts?.config?.secrets?.defaults
+	}) ?? "";
+}
+function resolveMatrixBaseConfigFieldPath(field) {
+	return `channels.matrix.${field}`;
+}
+function shouldAllowEnvSecretRefFallback(field) {
+	return field === "accessToken" || field === "password";
+}
+function hasConfiguredSecretInputValue(value, cfg) {
+	return typeof value === "string" && value.trim().length > 0 || Boolean(coerceSecretRef(value, cfg.secrets?.defaults));
+}
+function hasConfiguredMatrixAccessTokenSource(params) {
+	const normalizedAccountId = normalizeAccountId$1(params.accountId);
+	const account = findMatrixAccountConfig(params.cfg, normalizedAccountId) ?? {};
+	const scopedAccessTokenVar = getMatrixScopedEnvVarNames(normalizedAccountId).accessToken;
+	if (hasConfiguredSecretInputValue(account.accessToken, params.cfg) || clean(params.env[scopedAccessTokenVar], scopedAccessTokenVar).length > 0) return true;
+	if (normalizedAccountId !== DEFAULT_ACCOUNT_ID$1) return false;
+	return hasConfiguredSecretInputValue(resolveMatrixBaseConfig(params.cfg).accessToken, params.cfg) || clean(params.env.MATRIX_ACCESS_TOKEN, "MATRIX_ACCESS_TOKEN").length > 0;
+}
+function resolveConfiguredMatrixAuthInput(params) {
+	const normalizedAccountId = normalizeAccountId$1(params.accountId);
+	const accountValue = (findMatrixAccountConfig(params.cfg, normalizedAccountId) ?? {})[params.field];
+	if (accountValue !== void 0) return {
+		value: accountValue,
+		path: resolveMatrixConfigFieldPath(params.cfg, normalizedAccountId, params.field)
+	};
+	const scopedKeys = getMatrixScopedEnvVarNames(normalizedAccountId);
+	const scopedValue = resolveScopedMatrixEnvConfig(normalizedAccountId, params.env)[params.field];
+	if (scopedValue !== void 0) return {
+		value: scopedValue,
+		path: params.field === "accessToken" ? scopedKeys.accessToken : scopedKeys.password
+	};
+	if (normalizedAccountId !== DEFAULT_ACCOUNT_ID$1) return;
+	const baseValue = resolveMatrixBaseConfig(params.cfg)[params.field];
+	if (baseValue !== void 0) return {
+		value: baseValue,
+		path: resolveMatrixBaseConfigFieldPath(params.field)
+	};
+	const globalValue = params.field === "accessToken" ? params.env.MATRIX_ACCESS_TOKEN : params.env.MATRIX_PASSWORD;
+	if (globalValue !== void 0) return {
+		value: globalValue,
+		path: params.field === "accessToken" ? "MATRIX_ACCESS_TOKEN" : "MATRIX_PASSWORD"
+	};
+}
+async function resolveConfiguredMatrixAuthSecretInput(params) {
+	const configured = resolveConfiguredMatrixAuthInput(params);
+	if (!configured) return;
+	if (!coerceSecretRef(configured.value, params.cfg.secrets?.defaults)) return normalizeResolvedSecretInputString({
+		value: configured.value,
+		path: configured.path,
+		defaults: params.cfg.secrets?.defaults
+	});
+	const { resolveConfiguredSecretInputString } = await loadMatrixSecretInputDeps();
+	const resolved = await resolveConfiguredSecretInputString({
+		config: params.cfg,
+		env: params.env,
+		value: configured.value,
+		path: configured.path,
+		unresolvedReasonStyle: "detailed"
+	});
+	if (resolved.value !== void 0) return resolved.value;
+	throw new Error(resolved.unresolvedRefReason ?? `${configured.path} SecretRef could not be resolved.`);
+}
+function readMatrixBaseConfigField(matrix, field, opts) {
+	return clean(matrix[field], resolveMatrixBaseConfigFieldPath(field), {
+		env: opts?.env,
+		config: opts?.config,
+		allowEnvSecretRefFallback: shouldAllowEnvSecretRefFallback(field),
+		suppressSecretRef: opts?.suppressSecretRef
+	});
+}
+function readMatrixAccountConfigField(cfg, accountId, account, field, opts) {
+	return clean(account[field], resolveMatrixConfigFieldPath(cfg, accountId, field), {
+		env: opts?.env,
+		config: opts?.config,
+		allowEnvSecretRefFallback: shouldAllowEnvSecretRefFallback(field),
+		suppressSecretRef: opts?.suppressSecretRef
+	});
+}
+function clampMatrixInitialSyncLimit(value) {
+	return resolveOptionalIntegerOption(value, { min: 0 });
+}
+function buildMatrixNetworkFields(params) {
+	const dispatcherPolicy = params.dispatcherPolicy ?? (params.proxy ? {
+		mode: "explicit-proxy",
+		proxyUrl: params.proxy
+	} : void 0);
+	if (!params.allowPrivateNetwork && !dispatcherPolicy) return {};
+	return {
+		...params.allowPrivateNetwork ? {
+			allowPrivateNetwork: true,
+			ssrfPolicy: ssrfPolicyFromDangerouslyAllowPrivateNetwork$1(true)
+		} : {},
+		...dispatcherPolicy ? { dispatcherPolicy } : {}
+	};
+}
+function hasScopedMatrixEnvConfig(accountId, env) {
+	const scoped = resolveScopedMatrixEnvConfig(accountId, env);
+	return Boolean(scoped.homeserver || scoped.userId || scoped.accessToken || scoped.password || scoped.deviceId || scoped.deviceName);
+}
+function resolveMatrixConfigForAccount(cfg, accountId, env = process.env) {
+	const matrix = resolveMatrixBaseConfig(cfg);
+	const account = findMatrixAccountConfig(cfg, accountId) ?? {};
+	const normalizedAccountId = normalizeAccountId$1(accountId);
+	const suppressInactivePasswordSecretRef = hasConfiguredMatrixAccessTokenSource({
+		cfg,
+		env,
+		accountId: normalizedAccountId
+	});
+	const fieldReadOptions = {
+		env,
+		config: cfg
+	};
+	const scopedEnv = resolveScopedMatrixEnvConfig(normalizedAccountId, env);
+	const globalEnv = resolveGlobalMatrixEnvConfig(env);
+	const accountField = (field) => readMatrixAccountConfigField(cfg, normalizedAccountId, account, field, {
+		...fieldReadOptions,
+		suppressSecretRef: field === "password" ? suppressInactivePasswordSecretRef : void 0
+	});
+	const resolvedStrings = resolveMatrixAccountStringValues({
+		accountId: normalizedAccountId,
+		account: {
+			homeserver: accountField("homeserver"),
+			userId: accountField("userId"),
+			accessToken: accountField("accessToken"),
+			password: accountField("password"),
+			deviceId: accountField("deviceId"),
+			deviceName: accountField("deviceName")
+		},
+		scopedEnv,
+		channel: {
+			homeserver: readMatrixBaseConfigField(matrix, "homeserver", fieldReadOptions),
+			userId: readMatrixBaseConfigField(matrix, "userId", fieldReadOptions),
+			accessToken: readMatrixBaseConfigField(matrix, "accessToken", fieldReadOptions),
+			password: readMatrixBaseConfigField(matrix, "password", {
+				...fieldReadOptions,
+				suppressSecretRef: suppressInactivePasswordSecretRef
+			}),
+			deviceId: readMatrixBaseConfigField(matrix, "deviceId", fieldReadOptions),
+			deviceName: readMatrixBaseConfigField(matrix, "deviceName", fieldReadOptions)
+		},
+		globalEnv
+	});
+	const initialSyncLimit = clampMatrixInitialSyncLimit(account.initialSyncLimit) ?? clampMatrixInitialSyncLimit(matrix.initialSyncLimit);
+	const encryption = typeof account.encryption === "boolean" ? account.encryption : matrix.encryption ?? false;
+	const allowPrivateNetwork = isPrivateNetworkOptInEnabled(account) || isPrivateNetworkOptInEnabled(matrix) ? true : void 0;
+	return {
+		homeserver: resolvedStrings.homeserver,
+		userId: resolvedStrings.userId,
+		accessToken: resolvedStrings.accessToken || void 0,
+		password: resolvedStrings.password || void 0,
+		deviceId: resolvedStrings.deviceId || void 0,
+		deviceName: resolvedStrings.deviceName || void 0,
+		initialSyncLimit,
+		encryption,
+		...buildMatrixNetworkFields({
+			allowPrivateNetwork,
+			proxy: account.proxy ?? matrix.proxy
+		})
+	};
+}
+function resolveImplicitMatrixAccountId(cfg, env = process.env) {
+	if (requiresExplicitMatrixDefaultAccount(cfg, env)) return null;
+	return normalizeAccountId$1(resolveMatrixDefaultOrOnlyAccountId(cfg, env));
+}
+function resolveMatrixAuthContext(params) {
+	const cfg = requireRuntimeConfig(params.cfg, "Matrix auth context");
+	const env = params?.env ?? process.env;
+	const explicitAccountId = normalizeOptionalAccountId$1(params?.accountId);
+	const effectiveAccountId = explicitAccountId ?? resolveImplicitMatrixAccountId(cfg, env);
+	if (!effectiveAccountId) throw new Error("Multiple Matrix accounts are configured and channels.matrix.defaultAccount is not set. Set \"channels.matrix.defaultAccount\" to the intended account or pass --account <id>.");
+	if (explicitAccountId && explicitAccountId !== DEFAULT_ACCOUNT_ID$1 && !listNormalizedMatrixAccountIds(cfg).includes(explicitAccountId) && !hasScopedMatrixEnvConfig(explicitAccountId, env)) throw new Error(`Matrix account "${explicitAccountId}" is not configured. Add channels.matrix.accounts.${explicitAccountId} or define scoped ${getMatrixScopedEnvVarNames(explicitAccountId).accessToken.replace(/_ACCESS_TOKEN$/, "")}_* variables.`);
+	return {
+		cfg,
+		env,
+		accountId: effectiveAccountId,
+		resolved: resolveMatrixConfigForAccount(cfg, effectiveAccountId, env)
+	};
+}
+async function resolveMatrixAuth(params) {
+	if (!params?.cfg) throw new Error("Matrix auth requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
+	const { cfg, env, accountId, resolved } = resolveMatrixAuthContext({
+		cfg: params.cfg,
+		env: params.env,
+		accountId: params.accountId
+	});
+	const accessToken = await resolveConfiguredMatrixAuthSecretInput({
+		cfg,
+		env,
+		accountId,
+		field: "accessToken"
+	}) ?? resolved.accessToken;
+	const tokenAuthPassword = resolved.password;
+	const homeserver = await resolveValidatedMatrixHomeserverUrl(resolved.homeserver, { dangerouslyAllowPrivateNetwork: resolved.allowPrivateNetwork });
+	const { loadMatrixCredentials, credentialsMatchConfig } = await loadMatrixCredentialsReadDeps();
+	const cached = loadMatrixCredentials(env, accountId);
+	const cachedCredentials = cached && credentialsMatchConfig(cached, {
+		homeserver,
+		userId: resolved.userId || "",
+		accessToken
+	}) ? cached : null;
+	if (accessToken) {
+		let userId = resolved.userId;
+		const hasMatchingCachedToken = cachedCredentials?.accessToken === accessToken;
+		let knownDeviceId = hasMatchingCachedToken ? cachedCredentials?.deviceId || resolved.deviceId : resolved.deviceId;
+		if (!userId) {
+			const whoami = await fetchMatrixWhoamiIdentity({
+				homeserver,
+				accessToken,
+				userId,
+				ssrfPolicy: resolved.ssrfPolicy,
+				dispatcherPolicy: resolved.dispatcherPolicy
+			});
+			const fetchedUserId = whoami.user_id?.trim();
+			if (!fetchedUserId) throw new Error("Matrix whoami did not return user_id");
+			userId = fetchedUserId;
+			knownDeviceId = knownDeviceId || whoami.device_id?.trim() || resolved.deviceId;
+		}
+		if (!cachedCredentials || !hasMatchingCachedToken || cachedCredentials.userId !== userId || (cachedCredentials.deviceId || void 0) !== knownDeviceId) {
+			const { saveMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+			await saveMatrixCredentials({
+				homeserver,
+				userId,
+				accessToken,
+				deviceId: knownDeviceId
+			}, env, accountId);
+		} else if (hasMatchingCachedToken) {
+			const { touchMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+			await touchMatrixCredentials(env, accountId);
+		}
+		return {
+			accountId,
+			homeserver,
+			userId,
+			accessToken,
+			password: tokenAuthPassword,
+			deviceId: knownDeviceId,
+			deviceName: resolved.deviceName,
+			initialSyncLimit: resolved.initialSyncLimit,
+			encryption: resolved.encryption,
+			...buildMatrixNetworkFields({
+				allowPrivateNetwork: resolved.allowPrivateNetwork,
+				dispatcherPolicy: resolved.dispatcherPolicy
+			})
+		};
+	}
+	if (cachedCredentials) {
+		const { touchMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+		await touchMatrixCredentials(env, accountId);
+		return {
+			accountId,
+			homeserver: cachedCredentials.homeserver,
+			userId: cachedCredentials.userId,
+			accessToken: cachedCredentials.accessToken,
+			password: tokenAuthPassword,
+			deviceId: cachedCredentials.deviceId || resolved.deviceId,
+			deviceName: resolved.deviceName,
+			initialSyncLimit: resolved.initialSyncLimit,
+			encryption: resolved.encryption,
+			...buildMatrixNetworkFields({
+				allowPrivateNetwork: resolved.allowPrivateNetwork,
+				dispatcherPolicy: resolved.dispatcherPolicy
+			})
+		};
+	}
+	if (!resolved.userId) throw new Error("Matrix userId is required when no access token is configured (matrix.userId)");
+	const password = await resolveConfiguredMatrixAuthSecretInput({
+		cfg,
+		env,
+		accountId,
+		field: "password"
+	}) ?? resolved.password;
+	if (!password) throw new Error("Matrix password is required when no access token is configured (matrix.password)");
+	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixAuthClientDeps();
+	ensureMatrixSdkLoggingConfigured();
+	const loginClient = new MatrixClient(homeserver, "", {
+		ssrfPolicy: resolved.ssrfPolicy,
+		dispatcherPolicy: resolved.dispatcherPolicy
+	});
+	const login = await retryMatrixAuthRequest("matrix auth login", async () => {
+		return await loginClient.doRequest("POST", "/_matrix/client/v3/login", void 0, {
+			type: "m.login.password",
+			identifier: {
+				type: "m.id.user",
+				user: resolved.userId
+			},
+			password,
+			device_id: resolved.deviceId,
+			initial_device_display_name: resolved.deviceName ?? "OpenClaw Gateway"
+		});
+	});
+	const loginAccessToken = login.access_token?.trim();
+	if (!loginAccessToken) throw new Error("Matrix login did not return an access token");
+	const auth = {
+		accountId,
+		homeserver,
+		userId: login.user_id ?? resolved.userId,
+		accessToken: loginAccessToken,
+		password,
+		deviceId: login.device_id ?? resolved.deviceId,
+		deviceName: resolved.deviceName,
+		initialSyncLimit: resolved.initialSyncLimit,
+		encryption: resolved.encryption,
+		...buildMatrixNetworkFields({
+			allowPrivateNetwork: resolved.allowPrivateNetwork,
+			dispatcherPolicy: resolved.dispatcherPolicy
+		})
+	};
+	const { saveMatrixCredentials } = await loadMatrixCredentialsWriteRuntime();
+	await saveMatrixCredentials({
+		homeserver: auth.homeserver,
+		userId: auth.userId,
+		accessToken: auth.accessToken,
+		deviceId: auth.deviceId
+	}, env, accountId);
+	return auth;
+}
+async function backfillMatrixAuthDeviceIdAfterStartup(params) {
+	const knownDeviceId = params.auth.deviceId?.trim();
+	if (knownDeviceId) return knownDeviceId;
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	const deviceId = (await fetchMatrixWhoamiIdentity({
+		homeserver: params.auth.homeserver,
+		accessToken: params.auth.accessToken,
+		userId: params.auth.userId,
+		ssrfPolicy: params.auth.ssrfPolicy,
+		dispatcherPolicy: params.auth.dispatcherPolicy
+	})).device_id?.trim();
+	if (!deviceId) return;
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	const env = params.env ?? process.env;
+	const { loadMatrixCredentials } = await loadMatrixCredentialsReadDeps();
+	if (!credentialsMatchBackfillAuthLineage({
+		stored: loadMatrixCredentials(env, params.auth.accountId),
+		auth: params.auth
+	})) return;
+	if (!repairCurrentTokenStorageMetaDeviceId({
+		homeserver: params.auth.homeserver,
+		userId: params.auth.userId,
+		accessToken: params.auth.accessToken,
+		accountId: params.auth.accountId,
+		deviceId,
+		env: params.env
+	})) throw new Error("Matrix deviceId backfill failed to repair current-token storage metadata");
+	if (isAbortSignalTriggered(params.abortSignal)) return;
+	return await (await loadMatrixCredentialsWriteRuntime()).saveBackfilledMatrixDeviceId({
+		homeserver: params.auth.homeserver,
+		userId: params.auth.userId,
+		accessToken: params.auth.accessToken,
+		deviceId
+	}, env, params.auth.accountId) === "saved" ? deviceId : void 0;
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client/create-client.ts
+var create_client_exports = /* @__PURE__ */ __exportAll({ createMatrixClient: () => createMatrixClient });
+const loadMatrixCreateClientRuntimeDeps = createLazyRuntimeModule(() => Promise.all([import("./sdk-He1quVAq.mjs").then((n) => n.t), import("./logging-CgxQOJJP.mjs")]).then(([sdkModule, loggingModule]) => ({
+	MatrixClient: sdkModule.MatrixClient,
+	ensureMatrixSdkLoggingConfigured: loggingModule.ensureMatrixSdkLoggingConfigured
+})));
+async function createMatrixClient(params) {
+	const { MatrixClient, ensureMatrixSdkLoggingConfigured } = await loadMatrixCreateClientRuntimeDeps();
+	ensureMatrixSdkLoggingConfigured();
+	const homeserver = await resolveValidatedMatrixHomeserverUrl(params.homeserver, { dangerouslyAllowPrivateNetwork: params.allowPrivateNetwork });
+	const matrixClientUserId = normalizeOptionalString(params.userId);
+	const userId = matrixClientUserId ?? "unknown";
+	const storagePaths = params.persistStorage !== false ? resolveMatrixStoragePaths({
+		homeserver,
+		userId,
+		accessToken: params.accessToken,
+		accountId: params.accountId,
+		deviceId: params.deviceId,
+		env: process.env
+	}) : null;
+	if (storagePaths) {
+		await maybeMigrateLegacyStorage({
+			storagePaths,
+			env: process.env
+		});
+		fs.mkdirSync(storagePaths.rootDir, { recursive: true });
+		writeStorageMeta({
+			storagePaths,
+			homeserver,
+			userId,
+			accountId: params.accountId,
+			deviceId: params.deviceId
+		});
+	}
+	const cryptoDatabasePrefix = storagePaths ? `openclaw-matrix-${storagePaths.accountKey}-${storagePaths.tokenHash}` : void 0;
+	return new MatrixClient(homeserver, params.accessToken, {
+		userId: matrixClientUserId,
+		password: params.password,
+		deviceId: params.deviceId,
+		encryption: params.encryption,
+		localTimeoutMs: params.localTimeoutMs,
+		initialSyncLimit: params.initialSyncLimit,
+		storageRootDir: storagePaths?.rootDir,
+		recoveryKeyPath: storagePaths?.recoveryKeyPath,
+		idbSnapshotPath: storagePaths?.idbSnapshotPath,
+		cryptoDatabasePrefix,
+		autoBootstrapCrypto: params.autoBootstrapCrypto,
+		ssrfPolicy: params.ssrfPolicy ?? ssrfPolicyFromDangerouslyAllowPrivateNetwork(params.allowPrivateNetwork),
+		dispatcherPolicy: params.dispatcherPolicy
+	});
+}
+//#endregion
+//#region extensions/matrix/src/matrix/monitor/task-runner.ts
+const monitorTaskSignal = new AsyncLocalStorage();
+function getMatrixMonitorTaskSignal() {
+	return monitorTaskSignal.getStore();
+}
+function createMatrixMonitorTaskRunner(params) {
+	const inFlight = /* @__PURE__ */ new Map();
+	let closed = false;
+	const runDetachedTask = (label, task) => {
+		if (closed) return Promise.resolve();
+		const controller = new AbortController();
+		const trackedTask = monitorTaskSignal.run(controller.signal, () => Promise.resolve().then(task)).catch((error) => {
+			const message = String(error);
+			params.logVerboseMessage(`matrix: ${label} failed (${message})`);
+			params.logger.warn("matrix background task failed", {
+				task: label,
+				error: message
+			});
+		}).finally(() => {
+			controller.abort();
+			inFlight.delete(trackedTask);
+		});
+		inFlight.set(trackedTask, controller);
+		return trackedTask;
+	};
+	const waitForIdle = async () => {
+		while (inFlight.size > 0) await Promise.allSettled(Array.from(inFlight.keys()));
+	};
+	return {
+		close: () => {
+			closed = true;
+			for (const controller of inFlight.values()) controller.abort();
+		},
+		runDetachedTask,
+		waitForIdle
+	};
+}
+//#endregion
+//#region extensions/matrix/src/matrix/startup-abort.ts
+function createMatrixStartupAbortError() {
+	const error = /* @__PURE__ */ new Error("Matrix startup aborted");
+	error.name = "AbortError";
+	return error;
+}
+function throwIfMatrixStartupAborted(abortSignal) {
+	if (abortSignal?.aborted === true) throw createMatrixStartupAbortError();
+}
+function isMatrixStartupAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+async function awaitMatrixStartupWithAbort(promise, abortSignal) {
+	if (!abortSignal) return await promise;
+	if (abortSignal.aborted) throw createMatrixStartupAbortError();
+	return await new Promise((resolve, reject) => {
+		const onAbort = () => {
+			abortSignal.removeEventListener("abort", onAbort);
+			reject(createMatrixStartupAbortError());
+		};
+		abortSignal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			abortSignal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			abortSignal.removeEventListener("abort", onAbort);
+			reject(toLintErrorObject(error, "Non-Error rejection"));
+		});
+	});
+}
+function toLintErrorObject(value, fallbackMessage) {
+	if (value instanceof Error) return value;
+	if (typeof value === "string") return new Error(value);
+	const error = new Error(fallbackMessage, { cause: value });
+	if (typeof value === "object" && value !== null || typeof value === "function") Object.assign(error, value);
+	return error;
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client/shared.ts
+const loadMatrixCreateClientDeps = createLazyRuntimeModule(() => Promise.resolve().then(() => create_client_exports).then((runtime) => ({ createMatrixClient: runtime.createMatrixClient })));
+const MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS = 5e3;
+const sharedClientStates = /* @__PURE__ */ new Map();
+const sharedClientPromises = /* @__PURE__ */ new Map();
+function serializeDispatcherPolicyKey(auth) {
+	return JSON.stringify(auth.dispatcherPolicy ?? null);
+}
+function buildSharedClientKey(auth) {
+	return [
+		auth.homeserver,
+		auth.userId,
+		auth.accessToken,
+		auth.encryption ? "e2ee" : "plain",
+		auth.allowPrivateNetwork ? "private-net" : "strict-net",
+		serializeDispatcherPolicyKey(auth),
+		auth.accountId
+	].join("|");
+}
+async function createSharedMatrixClient(params) {
+	const { createMatrixClient } = await loadMatrixCreateClientDeps();
+	const client = await createMatrixClient({
+		homeserver: params.auth.homeserver,
+		userId: params.auth.userId,
+		accessToken: params.auth.accessToken,
+		password: params.auth.password,
+		deviceId: params.auth.deviceId,
+		encryption: params.auth.encryption,
+		localTimeoutMs: params.timeoutMs,
+		initialSyncLimit: params.auth.initialSyncLimit,
+		accountId: params.auth.accountId,
+		allowPrivateNetwork: params.auth.allowPrivateNetwork,
+		ssrfPolicy: params.auth.ssrfPolicy,
+		dispatcherPolicy: params.auth.dispatcherPolicy
+	});
+	return {
+		auth: params.auth,
+		client,
+		key: buildSharedClientKey(params.auth),
+		started: false,
+		cryptoReady: false,
+		startAbortController: null,
+		startPromise: null,
+		phase: "open",
+		leases: /* @__PURE__ */ new Set(),
+		monitorRetirementPromises: /* @__PURE__ */ new Set(),
+		noLeases: createDeferred(),
+		retirementPromise: null,
+		poisonError: null,
+		releaseMode: "discard"
+	};
+}
+function deleteSharedClientState(state) {
+	if (sharedClientStates.get(state.key) === state) sharedClientStates.delete(state.key);
+	sharedClientPromises.delete(state.key);
+}
+async function ensureSharedClientStarted(state, abortSignal) {
+	if (state.started) return;
+	if (state.startPromise) {
+		await awaitMatrixStartupWithAbort(state.startPromise, abortSignal);
+		return;
+	}
+	const startAbortController = new AbortController();
+	state.startAbortController = startAbortController;
+	const guardedStart = (async () => {
+		if (state.auth.encryption && !state.cryptoReady) try {
+			const joinedRooms = await state.client.getJoinedRooms();
+			if (state.client.crypto) {
+				await state.client.crypto.prepare(joinedRooms);
+				state.cryptoReady = true;
+			}
+		} catch (err) {
+			LogService.warn("MatrixClientLite", "Failed to prepare crypto:", err);
+		}
+		await state.client.start({ abortSignal: startAbortController.signal });
+		throwIfMatrixStartupAborted(startAbortController.signal);
+		if (state.phase !== "open") throwIfMatrixStartupAborted(AbortSignal.abort());
+		state.started = true;
+	})().finally(() => {
+		if (state.startPromise === guardedStart) {
+			state.startPromise = null;
+			state.startAbortController = null;
+		}
+	});
+	state.startPromise = guardedStart;
+	await awaitMatrixStartupWithAbort(guardedStart, abortSignal);
+}
+async function resolveSharedMatrixAuth(params) {
+	const requestedAccountId = normalizeOptionalAccountId(params.accountId);
+	if (params.auth && requestedAccountId && requestedAccountId !== params.auth.accountId) throw new Error(`Matrix shared client account mismatch: requested ${requestedAccountId}, auth resolved ${params.auth.accountId}`);
+	if (params.auth) return params.auth;
+	if (!params.cfg) throw new Error("Matrix shared client requires a resolved runtime config. Load and resolve config at the command or gateway boundary, then pass cfg through the runtime path.");
+	const authContext = resolveMatrixAuthContext({
+		cfg: params.cfg,
+		env: params.env,
+		accountId: params.accountId
+	});
+	return await resolveMatrixAuth({
+		cfg: authContext.cfg,
+		env: authContext.env,
+		accountId: authContext.accountId
+	});
+}
+async function resolveOpenSharedMatrixClientState(params) {
+	const auth = await resolveSharedMatrixAuth(params);
+	const key = buildSharedClientKey(auth);
+	while (true) {
+		const existing = sharedClientStates.get(key);
+		if (existing?.poisonError) throw existing.poisonError;
+		if (existing?.phase === "open") return existing;
+		if (existing?.retirementPromise) {
+			await awaitMatrixStartupWithAbort(existing.retirementPromise, params.abortSignal);
+			continue;
+		}
+		const pending = sharedClientPromises.get(key);
+		if (pending) {
+			await awaitMatrixStartupWithAbort(pending, params.abortSignal);
+			continue;
+		}
+		const creationPromise = createSharedMatrixClient({
+			auth,
+			timeoutMs: params.timeoutMs
+		});
+		sharedClientPromises.set(key, creationPromise);
+		try {
+			const created = await creationPromise;
+			sharedClientStates.set(key, created);
+			return created;
+		} finally {
+			sharedClientPromises.delete(key);
+		}
+	}
+}
+async function runMonitorRetirement(retirement) {
+	if (!retirement) return;
+	retirement.closeTaskAdmission();
+	retirement.detachListeners();
+	await retirement.waitForTasks();
+	await retirement.cleanup();
+}
+function retireMonitorLease(state, lease) {
+	if (lease.monitorRetirementPromise) return lease.monitorRetirementPromise;
+	lease.monitorRetirementPromise = runMonitorRetirement(lease.monitorRetirement ?? void 0);
+	state.monitorRetirementPromises.add(lease.monitorRetirementPromise);
+	return lease.monitorRetirementPromise;
+}
+async function retireMonitorLeases(state, leases) {
+	for (const lease of leases) retireMonitorLease(state, lease);
+	const failure = (await Promise.allSettled(state.monitorRetirementPromises)).find((result) => result.status === "rejected");
+	if (failure?.status === "rejected") throw failure.reason;
+}
+function toRetirementError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+function mergeReleaseMode(current, requested) {
+	if (current === "persist" || requested === "persist") return "persist";
+	if (current === "stop" || requested === "stop") return "stop";
+	return "discard";
+}
+function abortTransientLeases(state) {
+	for (const lease of state.leases) if (lease.role === "transient") lease.abortController.abort();
+}
+async function waitForRetirementDrain(state, task, isPending, timeoutMessage) {
+	if (!isPending()) return;
+	let deadline;
+	try {
+		await Promise.race([task, new Promise((_, reject) => {
+			deadline = setTimeout(() => {
+				if (!isPending()) return;
+				state.phase = "late-drain";
+				reject(new Error(timeoutMessage));
+			}, MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS);
+			deadline.unref?.();
+		})]);
+	} finally {
+		if (deadline) clearTimeout(deadline);
+	}
+}
+function beginGenerationRetirement(params) {
+	const { state } = params;
+	if (state.retirementPromise) return state.retirementPromise;
+	state.phase = "quiescing";
+	state.startAbortController?.abort();
+	const result = createDeferred();
+	state.retirementPromise = result.promise;
+	Promise.resolve().then(async () => {
+		let canReplacePoisonedGeneration = false;
+		const startup = state.startPromise;
+		if (startup) try {
+			await waitForRetirementDrain(state, startup.catch(() => void 0), () => state.startPromise === startup, `Matrix client startup did not settle within ${MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS}ms during retirement`);
+		} catch (error) {
+			state.poisonError = toRetirementError(error);
+			result.reject(state.poisonError);
+			await Promise.allSettled([
+				startup.catch(() => void 0).then(() => {
+					state.started = false;
+					state.client.stopWithoutPersist();
+				}),
+				retireMonitorLeases(state, params.monitorLeases ?? []),
+				state.noLeases.promise
+			]);
+			deleteSharedClientState(state);
+			throw state.poisonError;
+		}
+		try {
+			await state.client.quiesceSync();
+			state.started = false;
+			await state.client.drainPendingDecryptions("matrix monitor sync quiesce");
+		} catch (error) {
+			state.poisonError = toRetirementError(error);
+			canReplacePoisonedGeneration = true;
+		}
+		try {
+			await retireMonitorLeases(state, params.monitorLeases ?? []);
+		} catch (error) {
+			state.poisonError ??= toRetirementError(error);
+			canReplacePoisonedGeneration = false;
+		}
+		state.phase = "closing";
+		let lateLeaseDrain = null;
+		try {
+			await waitForRetirementDrain(state, state.noLeases.promise, () => state.leases.size > 0, `Matrix transient leases did not drain within ${MATRIX_RETIREMENT_DRAIN_TIMEOUT_MS}ms`);
+		} catch (error) {
+			state.poisonError ??= toRetirementError(error);
+			canReplacePoisonedGeneration = false;
+			result.reject(state.poisonError);
+			lateLeaseDrain = state.noLeases.promise;
+		}
+		if (state.poisonError) {
+			const decryptionsDrained = await state.client.drainPendingDecryptions("matrix poisoned client shutdown").then(() => true, () => false);
+			state.client.stopWithoutPersist();
+			await lateLeaseDrain;
+			if (lateLeaseDrain || canReplacePoisonedGeneration && decryptionsDrained) deleteSharedClientState(state);
+			throw state.poisonError;
+		}
+		try {
+			await state.client.drainPendingDecryptions("matrix shared client final shutdown");
+		} catch (error) {
+			state.poisonError = toRetirementError(error);
+			try {
+				state.client.stopWithoutPersist();
+			} finally {
+				deleteSharedClientState(state);
+			}
+			throw state.poisonError;
+		}
+		try {
+			if (state.releaseMode === "persist") await state.client.stopAndPersist();
+			else if (state.releaseMode === "discard") state.client.stopWithoutPersist();
+			else await state.client.stopAndPersist().catch(() => state.client.stopWithoutPersist());
+		} finally {
+			await lateLeaseDrain;
+			deleteSharedClientState(state);
+		}
+	}).then(result.resolve, result.reject);
+	abortTransientLeases(state);
+	return state.retirementPromise;
+}
+function createSharedMatrixClientLease(state, role) {
+	if (state.phase !== "open" || state.poisonError) return null;
+	const leaseState = {
+		abortController: new AbortController(),
+		monitorRetirement: null,
+		monitorRetirementPromise: null,
+		role,
+		releasePromise: null
+	};
+	state.leases.add(leaseState);
+	return {
+		abortSignal: leaseState.abortController.signal,
+		client: state.client,
+		role,
+		registerMonitorRetirement: (retirement) => {
+			if (role !== "monitor") throw new Error("Matrix transient leases cannot register monitor retirement");
+			if (leaseState.releasePromise || state.phase !== "open") throw new Error("Matrix monitor lease is already retiring");
+			if (leaseState.monitorRetirement && leaseState.monitorRetirement !== retirement) throw new Error("Matrix monitor retirement is already registered");
+			leaseState.monitorRetirement = retirement;
+		},
+		start: async (abortSignal) => {
+			if (leaseState.releasePromise) throw new Error("Matrix client lease has already been released");
+			if (state.phase !== "open") throw new Error("Matrix client generation is retiring");
+			await ensureSharedClientStarted(state, abortSignal ? AbortSignal.any([abortSignal, leaseState.abortController.signal]) : leaseState.abortController.signal);
+		},
+		release: (releaseParams = {}) => {
+			if (leaseState.releasePromise) return leaseState.releasePromise;
+			state.releaseMode = mergeReleaseMode(state.releaseMode, releaseParams.mode ?? "stop");
+			state.leases.delete(leaseState);
+			if (state.leases.size === 0) state.noLeases.resolve();
+			if (state.phase === "late-drain") {
+				leaseState.releasePromise = Promise.resolve();
+				return leaseState.releasePromise;
+			}
+			const finalMonitor = role === "monitor" && !Array.from(state.leases).some((lease) => lease.role === "monitor");
+			if (role === "monitor" && !finalMonitor) {
+				leaseState.releasePromise = retireMonitorLease(state, leaseState);
+				return leaseState.releasePromise;
+			}
+			if (!(state.phase === "open" && (finalMonitor || state.leases.size === 0))) {
+				leaseState.releasePromise = state.poisonError ? Promise.reject(state.poisonError) : Promise.resolve();
+				return leaseState.releasePromise;
+			}
+			leaseState.releasePromise = beginGenerationRetirement({
+				state,
+				monitorLeases: role === "monitor" ? [leaseState] : void 0
+			});
+			return leaseState.releasePromise;
+		}
+	};
+}
+async function acquireSharedMatrixClient(params = {}) {
+	const taskSignal = getMatrixMonitorTaskSignal();
+	const abortSignal = taskSignal && params.abortSignal ? AbortSignal.any([taskSignal, params.abortSignal]) : taskSignal ?? params.abortSignal;
+	const acquisition = {
+		...params,
+		abortSignal
+	};
+	while (true) {
+		throwIfMatrixStartupAborted(abortSignal);
+		const state = await resolveOpenSharedMatrixClientState(acquisition);
+		if (abortSignal?.aborted) {
+			if (state.phase === "open" && state.leases.size === 0) await beginGenerationRetirement({ state });
+			throwIfMatrixStartupAborted(abortSignal);
+		}
+		const lease = createSharedMatrixClientLease(state, params.role ?? "transient");
+		if (!lease) continue;
+		if (params.startClient !== false) try {
+			await lease.start(abortSignal);
+		} catch (error) {
+			await lease.release({ mode: "stop" }).catch(() => void 0);
+			throw error;
+		}
+		return lease;
+	}
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client.ts
+var client_exports = /* @__PURE__ */ __exportAll({
+	acquireSharedMatrixClient: () => acquireSharedMatrixClient,
+	resolveMatrixAuthContext: () => resolveMatrixAuthContext
+});
+//#endregion
+export { throwIfMatrixStartupAborted as a, backfillMatrixAuthDeviceIdAfterStartup as c, isMatrixStartupAbortError as i, resolveMatrixAuth as l, acquireSharedMatrixClient as n, createMatrixMonitorTaskRunner as o, createMatrixStartupAbortError as r, createMatrixClient as s, client_exports as t, resolveMatrixAuthContext as u };