@openclaw/matrix 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{sdk-UzPd8tst.js → sdk-DjaQFCHc.js}

@@ -1,19 +1,25 @@
-import { n as formatMatrixErrorReason, r as isMatrixNotFoundError, t as formatMatrixErrorMessage } from "./errors-C47hvAF8.js";
-import { t as SqliteBackedMatrixSyncStore } from "./file-sync-store-DiiFsayX.js";
-import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-D0GCSDQq.js";
+import "./reaction-common-DkrQdBSZ.js";
+import { t as SqliteBackedMatrixSyncStore } from "./file-sync-store-DjskBX2o.js";
+import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-B_71hN6W.js";
 import { t as MATRIX_IDB_PERSIST_INTERVAL_MS } from "./idb-persistence-lock-DAJ49nZX.js";
-import { c as createMatrixStartupAbortError, u as throwIfMatrixStartupAborted } from "./shared-CUH5otj8.js";
+import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-DKVS3_DO.js";
+import { a as throwIfMatrixStartupAborted, r as createMatrixStartupAbortError } from "./client-CeGw0G5S.js";
 import { a as matrixEventToRaw, n as createMatrixGuardedFetch, o as parseMxc, t as MatrixAuthedHttpClient } from "./http-client-CycYxU9-.js";
 import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.js";
-import { t as createMatrixJsSdkClientLogger } from "./logging-DV-p52N0.js";
-import { n as isMatrixReadySyncState, r as isMatrixTerminalSyncState } from "./sync-state-CWbp0QSY.js";
-import { n as isRepairableSecretStorageAccessError, t as MatrixRecoveryKeyStore } from "./recovery-key-store-BNnHvXdk.js";
+import { t as createMatrixJsSdkClientLogger } from "./logging-DRjvUOIh.js";
+import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-DLj4vDeu.js";
+import { n as isRepairableSecretStorageAccessError, t as MatrixRecoveryKeyStore } from "./recovery-key-store-CognuDys.js";
+import { createRequire } from "node:module";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeNullableString, normalizeStringEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash } from "node:crypto";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
-import { ClientEvent, Filter, MatrixEventEvent, Preset, createClient } from "matrix-js-sdk/lib/matrix.js";
+import { ClientEvent, EventType, Filter, MatrixError, MatrixEventEvent, MsgType, Preset, createClient } from "matrix-js-sdk/lib/matrix.js";
 import { EventEmitter } from "node:events";
 import { VerificationMethod } from "matrix-js-sdk/lib/types.js";
+import { SyncApi, SyncState } from "matrix-js-sdk/lib/sync.js";
+import { EventStatus } from "matrix-js-sdk/lib/models/event-status.js";
 //#region extensions/matrix/src/matrix/sdk/client-device-info.ts
 async function resolveMatrixCrossSigningPublicationStatus(params) {
 	if (!params.userId) return {
@@ -78,8 +84,8 @@ function registerMatrixClientBridge(params) {
 	});
 	params.client.on(ClientEvent.Room, params.emitMembershipForRoom);
 	params.client.on(ClientEvent.Sync, (state, prevState, data) => {
-		params.setCurrentSyncState(state);
 		const error = data && typeof data === "object" && "error" in data ? data.error : void 0;
+		params.setCurrentSyncState(state, error);
 		params.emitter.emit("sync.state", state, prevState, error);
 	});
 	params.client.on(ClientEvent.SyncUnexpectedError, (error) => {
@@ -115,89 +121,81 @@ function refreshMatrixDmRoomIds(direct, dmRoomIds) {
 	return true;
 }
 //#endregion
-//#region extensions/matrix/src/matrix/sdk/client-support.ts
-const MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS = 1e4;
-const DEFAULT_MATRIX_LOCAL_TIMEOUT_MS = 6e4;
-function resolveMatrixLocalTimeoutMs(raw) {
-	if (typeof raw !== "number" || !Number.isFinite(raw)) return DEFAULT_MATRIX_LOCAL_TIMEOUT_MS;
-	return Math.max(1, Math.floor(raw));
+//#region extensions/matrix/src/matrix/sdk/client-sync-quiesce.ts
+const MATRIX_SYNC_QUIESCE_TIMEOUT_MS = 5e3;
+const MATRIX_JS_SDK_SYNC_VERSION = "41.9.0";
+const matrixJsSdkPackage = createRequire(import.meta.url)("matrix-js-sdk/package.json");
+function assertMatrixJsSdkSyncVersion() {
+	const version = matrixJsSdkPackage.version;
+	if (version !== MATRIX_JS_SDK_SYNC_VERSION) throw new Error(`Matrix sync quiesce requires matrix-js-sdk ${MATRIX_JS_SDK_SYNC_VERSION}; found ${String(version)}`);
 }
-function unresolvedMatrixRoomKeyBackupStatus() {
-	return {
-		serverVersion: null,
-		activeVersion: null,
-		trusted: null,
-		matchesDecryptionKey: null,
-		decryptionKeyCached: null,
-		keyLoadAttempted: false,
-		keyLoadError: null
-	};
-}
-function unresolvedMatrixDeviceVerificationStatus(params) {
-	return {
-		encryptionEnabled: true,
-		userId: params.userId,
-		deviceId: params.deviceId,
-		verified: false,
-		localVerified: false,
-		crossSigningVerified: false,
-		signedByOwner: false
-	};
-}
-async function resolveMatrixDiagnostic(promise, timeoutMs) {
-	return (await resolveMatrixDiagnosticResult(promise, timeoutMs)).value;
-}
-async function resolveMatrixDiagnosticResult(promise, timeoutMs) {
-	let timeoutId;
+async function quiesceMatrixClientSync(params) {
+	await params.syncStore?.freezeSyncCursorPersistence();
 	try {
-		const guarded = promise.then((value) => ({
-			error: null,
-			timedOut: false,
-			value
-		})).catch((error) => ({
-			error,
-			timedOut: false,
-			value: null
-		}));
-		const timeout = new Promise((resolve) => {
-			timeoutId = setTimeout(() => resolve({
-				error: null,
-				timedOut: true,
-				value: null
-			}), timeoutMs);
-			timeoutId.unref?.();
-		});
-		return await Promise.race([guarded, timeout]);
-	} finally {
-		if (timeoutId) clearTimeout(timeoutId);
+		assertMatrixJsSdkSyncVersion();
+	} catch (error) {
+		params.syncStore?.discardPendingSyncCursorPersistence();
+		throw error;
+	}
+	const syncApi = params.client.syncApi;
+	if (syncApi === void 0 && !params.started) return;
+	if (!(syncApi instanceof SyncApi)) {
+		params.syncStore?.discardPendingSyncCursorPersistence();
+		throw new Error(syncApi === void 0 ? "Matrix sync quiesce requires the classic matrix-js-sdk SyncApi, but none is active" : "Matrix sync quiesce rejected a sliding or unknown matrix-js-sdk sync implementation");
+	}
+	if (syncApi.getSyncState() === SyncState.Stopped) {
+		params.markStopped();
+		return;
 	}
+	await new Promise((resolve, reject) => {
+		let settled = false;
+		const settle = (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			params.emitter.off("sync.state", onSyncState);
+			if (error) reject(error);
+			else {
+				params.markStopped();
+				resolve();
+			}
+		};
+		const onSyncState = (state) => {
+			if (state === "STOPPED") settle();
+		};
+		const timeout = setTimeout(() => {
+			params.syncStore?.discardPendingSyncCursorPersistence();
+			settle(/* @__PURE__ */ new Error(`Matrix classic sync did not reach STOPPED within 5000ms`));
+		}, MATRIX_SYNC_QUIESCE_TIMEOUT_MS);
+		timeout.unref?.();
+		params.emitter.on("sync.state", onSyncState);
+		try {
+			syncApi.stop();
+		} catch (error) {
+			params.syncStore?.discardPendingSyncCursorPersistence();
+			settle(error instanceof Error ? error : new Error(String(error)));
+		}
+	});
 }
-function isMatrixAccessTokenInvalidatedError(error) {
-	if (!error || typeof error !== "object") return false;
-	const err = error;
-	const errcode = err.body?.errcode ?? err.data?.errcode;
-	if (err.statusCode === 401 && errcode === "M_UNKNOWN_TOKEN") return true;
-	const reason = formatMatrixErrorReason(error);
-	return reason.includes("m_unknown_token") || reason.includes("unknown token") || reason.includes("access token") && (reason.includes("invalid") || reason.includes("unrecognized") || reason.includes("unknown"));
-}
-const MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS = { allowAutomaticCrossSigningReset: false };
-const MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS = {
-	forceResetCrossSigning: true,
-	allowSecretStorageRecreateWithoutRecoveryKey: true,
-	strict: true
-};
-function createMatrixExplicitBootstrapOptions(params) {
+//#endregion
+//#region extensions/matrix/src/matrix/sdk/client-base.ts
+function resolveMessageWireDispatch(resource, init) {
+	if ((init?.method ?? (resource instanceof Request ? resource.method : "GET")).toUpperCase() !== "PUT") return null;
+	const rawUrl = typeof resource === "string" ? resource : resource instanceof URL ? resource.href : resource.url;
+	const segments = new URL(rawUrl).pathname.split("/").filter(Boolean);
+	const roomsIndex = segments.lastIndexOf("rooms");
+	if (roomsIndex < 0 || segments[roomsIndex + 2] !== "send" || segments.length !== roomsIndex + 5) return null;
+	const eventType = decodeURIComponent(segments[roomsIndex + 3] ?? "");
+	if (eventType !== "m.room.message" && eventType !== "m.room.encrypted") return null;
 	return {
-		forceResetCrossSigning: params?.forceResetCrossSigning === true,
-		allowAutomaticCrossSigningReset: params?.allowAutomaticCrossSigningReset !== false,
-		allowSecretStorageRecreateWithoutRecoveryKey: true,
-		strict: params?.strict !== false
+		roomId: decodeURIComponent(segments[roomsIndex + 1] ?? ""),
+		eventType,
+		transactionId: decodeURIComponent(segments[roomsIndex + 4] ?? ""),
+		requestPath: new URL(rawUrl).pathname
 	};
 }
-//#endregion
-//#region extensions/matrix/src/matrix/sdk/client-base.ts
 let loadedMatrixCryptoRuntime = null;
-const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-D9_6J5tZ.js").then((runtime) => {
+const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-Bnz3zEcS.js").then((runtime) => {
 	loadedMatrixCryptoRuntime = runtime;
 	return runtime;
 }));
@@ -213,6 +211,11 @@ var MatrixClientBase = class {
 		this.stopPersistPromise = null;
 		this.verificationSummaryListenerBound = false;
 		this.currentSyncState = null;
+		this.currentSyncError = void 0;
+		this.transactionScopeId = null;
+		this.transactionScopePromise = null;
+		this.messageWireDispatchGuards = /* @__PURE__ */ new Map();
+		this.sdkStopped = false;
 		this.dms = {
 			update: async () => {
 				return await this.refreshDmCache();
@@ -220,6 +223,9 @@ var MatrixClientBase = class {
 			isDm: (roomId) => this.dmRoomIds.has(roomId)
 		};
 		this.idbPersistTimer = null;
+		this.transactionScopeHomeserver = homeserver;
+		this.transactionScopeAccessTokenHash = createHash("sha256").update(accessToken).digest("hex");
+		this.transactionScopeDeviceId = opts.deviceId?.trim() || null;
 		this.httpClient = new MatrixAuthedHttpClient({
 			homeserver,
 			accessToken,
@@ -239,6 +245,10 @@ var MatrixClientBase = class {
 		this.autoBootstrapCrypto = opts.autoBootstrapCrypto !== false;
 		this.recoveryKeyStore = new MatrixRecoveryKeyStore(opts.recoveryKeyPath);
 		const cryptoCallbacks = this.encryptionEnabled ? this.recoveryKeyStore.buildCryptoCallbacks() : void 0;
+		const guardedFetch = createMatrixGuardedFetch({
+			ssrfPolicy: opts.ssrfPolicy,
+			dispatcherPolicy: opts.dispatcherPolicy
+		});
 		this.client = createClient({
 			baseUrl: homeserver,
 			accessToken,
@@ -246,9 +256,10 @@ var MatrixClientBase = class {
 			deviceId: opts.deviceId,
 			logger: createMatrixJsSdkClientLogger("MatrixClient"),
 			localTimeoutMs: this.localTimeoutMs,
-			fetchFn: createMatrixGuardedFetch({
-				ssrfPolicy: opts.ssrfPolicy,
-				dispatcherPolicy: opts.dispatcherPolicy
+			fetchFn: (async (resource, init) => {
+				const dispatch = resolveMessageWireDispatch(resource, init);
+				if (dispatch) await this.messageWireDispatchGuards.get(dispatch.transactionId)?.(dispatch);
+				return await guardedFetch(resource, init);
 			}),
 			store: this.syncStore,
 			cryptoCallbacks,
@@ -260,6 +271,16 @@ var MatrixClientBase = class {
 			]
 		});
 	}
+	async withMessageWireDispatchGuard(params) {
+		if (!params.transactionId || !params.guard) return await params.run();
+		if (this.messageWireDispatchGuards.has(params.transactionId)) throw new Error(`Matrix transaction ${params.transactionId} already has a dispatch guard`);
+		this.messageWireDispatchGuards.set(params.transactionId, params.guard);
+		try {
+			return await params.run();
+		} finally {
+			this.messageWireDispatchGuards.delete(params.transactionId);
+		}
+	}
 	on(eventName, listener) {
 		this.emitter.on(eventName, listener);
 		return this;
@@ -314,7 +335,7 @@ var MatrixClientBase = class {
 			client: this.client,
 			verificationManager: this.verificationManager,
 			recoveryKeyStore: this.recoveryKeyStore,
-			getRoomStateEvent: (roomId, eventType, stateKey = "") => this.getRoomStateEvent(roomId, eventType, stateKey),
+			isRoomEncrypted: async (roomId) => await this.getMessageWireEventType(roomId) === "m.room.encrypted",
 			downloadContent: (mxcUrl, opts) => this.downloadContent(mxcUrl, opts)
 		});
 		if (!this.verificationSummaryListenerBound) {
@@ -334,6 +355,7 @@ var MatrixClientBase = class {
 	async waitForInitialSyncReady(params = {}) {
 		const timeoutMs = params.timeoutMs ?? 3e4;
 		if (isMatrixReadySyncState(this.currentSyncState)) return;
+		if (isMatrixAccessTokenInvalidatedError(this.currentSyncError)) throw this.currentSyncError instanceof Error ? this.currentSyncError : new Error("Matrix access token invalidated", { cause: this.currentSyncError });
 		if (isMatrixTerminalSyncState(this.currentSyncState)) throw new Error(`Matrix sync entered ${this.currentSyncState} during startup`);
 		await new Promise((resolve, reject) => {
 			let settled = false;
@@ -365,6 +387,10 @@ var MatrixClientBase = class {
 					settleResolve();
 					return;
 				}
+				if (isMatrixAccessTokenInvalidatedError(error)) {
+					settleReject(error instanceof Error ? error : /* @__PURE__ */ new Error("Matrix access token invalidated"));
+					return;
+				}
 				if (isMatrixTerminalSyncState(state)) settleReject(new Error(error instanceof Error && error.message ? error.message : `Matrix sync entered ${state} during startup`));
 			};
 			const onUnexpectedError = (error) => {
@@ -388,6 +414,7 @@ var MatrixClientBase = class {
 	}
 	async startSyncSession(opts) {
 		if (this.started) return;
+		if (this.sdkStopped) throw new Error("Matrix client has been fully stopped and cannot be restarted; acquire a new shared client generation");
 		throwIfMatrixStartupAborted(opts.abortSignal);
 		await this.ensureCryptoSupportInitialized();
 		throwIfMatrixStartupAborted(opts.abortSignal);
@@ -425,43 +452,57 @@ var MatrixClientBase = class {
 		if (this.started) return;
 		await this.startSyncSession({ bootstrapCrypto: false });
 	}
-	stopSyncWithoutPersist() {
+	stopSdkClient() {
+		if (this.sdkStopped) return;
 		if (this.idbPersistTimer) {
 			clearInterval(this.idbPersistTimer);
 			this.idbPersistTimer = null;
 		}
 		this.currentSyncState = null;
+		this.currentSyncError = void 0;
 		this.client.stopClient();
+		this.sdkStopped = true;
 		this.started = false;
 	}
+	async quiesceSync() {
+		await quiesceMatrixClientSync({
+			client: this.client,
+			emitter: this.emitter,
+			markStopped: () => {
+				this.started = false;
+			},
+			started: this.started,
+			syncStore: this.syncStore
+		});
+	}
 	async drainPendingDecryptions(reason = "matrix client shutdown") {
 		await this.decryptBridge?.drainPendingDecryptions(reason);
 	}
 	stop() {
-		this.stopSyncWithoutPersist();
-		this.decryptBridge?.stop();
-		this.syncStore?.markCleanShutdown();
-		if (loadedMatrixCryptoRuntime) {
-			const { persistIdbToDisk } = loadedMatrixCryptoRuntime;
-			this.stopPersistPromise = Promise.all([persistIdbToDisk({
-				snapshotPath: this.idbSnapshotPath,
-				databasePrefix: this.cryptoDatabasePrefix
-			}).catch(noop), this.syncStore?.flush().catch(noop)]).then(() => void 0);
+		this.stopAndPersist().catch(() => this.stopWithoutPersist()).catch(noop);
+	}
+	async stopAndPersist() {
+		if (this.stopPersistPromise) {
+			await this.stopPersistPromise;
 			return;
 		}
-		this.stopPersistPromise = loadMatrixCryptoRuntime().then(async ({ persistIdbToDisk }) => {
-			await Promise.all([persistIdbToDisk({
+		this.stopPersistPromise = (async () => {
+			await this.quiesceSync();
+			this.stopSdkClient();
+			this.decryptBridge?.stop();
+			await (loadedMatrixCryptoRuntime ?? await loadMatrixCryptoRuntime()).persistIdbToDisk({
 				snapshotPath: this.idbSnapshotPath,
-				databasePrefix: this.cryptoDatabasePrefix
-			}).catch(noop), this.syncStore?.flush().catch(noop)]);
-		}).catch(noop).then(() => void 0);
-	}
-	async stopAndPersist() {
-		this.stop();
+				databasePrefix: this.cryptoDatabasePrefix,
+				strict: true
+			});
+			this.syncStore?.markCleanShutdown();
+			await this.syncStore?.flush();
+		})();
 		await this.stopPersistPromise;
 	}
 	stopWithoutPersist() {
-		this.stopSyncWithoutPersist();
+		this.syncStore?.discardPendingSyncCursorPersistence();
+		this.stopSdkClient();
 		this.decryptBridge?.stop();
 		this.stopPersistPromise = Promise.resolve();
 	}
@@ -537,6 +578,30 @@ var MatrixClientCore = class extends MatrixClientBase {
 		const joined = await this.doRequest("GET", "/_matrix/client/v3/joined_rooms");
 		return Array.isArray(joined.joined_rooms) ? joined.joined_rooms : [];
 	}
+	async getTransactionScopeId() {
+		if (this.transactionScopeId) return this.transactionScopeId;
+		const active = this.transactionScopePromise ?? (async () => {
+			const configuredUserId = this.client.getUserId()?.trim() || this.selfUserId;
+			const configuredDeviceId = this.transactionScopeDeviceId || this.client.getDeviceId()?.trim() || null;
+			const whoami = await this.doRequest("GET", "/_matrix/client/v3/account/whoami");
+			const userId = whoami.user_id?.trim() || null;
+			const deviceId = whoami.device_id?.trim() || null;
+			if (!userId) throw new Error("Matrix whoami did not return user_id");
+			if (configuredUserId && configuredUserId !== userId) throw new Error("Matrix access token user does not match the configured userId");
+			if (configuredDeviceId && deviceId && configuredDeviceId !== deviceId) throw new Error("Matrix access token device does not match the configured deviceId");
+			this.selfUserId = userId;
+			this.transactionScopeDeviceId = deviceId;
+			return createHash("sha256").update(this.transactionScopeHomeserver).update("\0").update(userId).update("\0").update(deviceId ?? "").update("\0").update(this.transactionScopeAccessTokenHash).digest("hex");
+		})();
+		this.transactionScopePromise = active;
+		try {
+			const resolved = await active;
+			this.transactionScopeId = resolved;
+			return resolved;
+		} finally {
+			if (this.transactionScopePromise === active) this.transactionScopePromise = null;
+		}
+	}
 	async getJoinedRoomMembers(roomId) {
 		const joined = (await this.client.getJoinedRoomMembers(roomId))?.joined;
 		if (!joined || typeof joined !== "object") return [];
@@ -577,13 +642,56 @@ var MatrixClientCore = class extends MatrixClientBase {
 			initial_state: initialState
 		})).room_id;
 	}
-	async sendMessage(roomId, content) {
+	async sendMessage(roomId, content, transactionId, beforeWireDispatch) {
 		return await this.runSerializedRoomSend(roomId, async () => {
-			return (await this.client.sendMessage(roomId, content)).event_id;
+			return await this.withMessageWireDispatchGuard({
+				transactionId,
+				guard: beforeWireDispatch,
+				run: async () => {
+					if (transactionId) {
+						const room = this.client.getRoom(roomId);
+						const existing = room?.getEventForTxnId?.(transactionId);
+						if (existing) {
+							const existingId = existing.getId();
+							if (existing.status === EventStatus.SENT && existingId && !existingId.startsWith("~")) return existingId;
+							if (existing.status === EventStatus.NOT_SENT && room) {
+								await this.prepareRoomForMessageSend(roomId, existing.getContent());
+								return (await this.client.resendEvent(existing, room)).event_id;
+							}
+							throw new Error(`Matrix transaction ${transactionId} is already active with status ${existing.status ?? "unknown"}`);
+						}
+					}
+					await this.prepareRoomForMessageSend(roomId, content);
+					return (await this.client.sendMessage(roomId, content, transactionId)).event_id;
+				}
+			});
 		});
 	}
+	async getMessageWireEventType(roomId) {
+		if (this.client.getRoom(roomId)?.hasEncryptionStateEvent() === true) return "m.room.encrypted";
+		const crypto = this.client.getCrypto();
+		if (crypto && await crypto.isEncryptionEnabledInRoom(roomId)) return "m.room.encrypted";
+		try {
+			await this.getRoomStateEvent(roomId, "m.room.encryption", "");
+			return "m.room.encrypted";
+		} catch (error) {
+			if (error instanceof MatrixError && error.httpStatus === 404 && error.errcode === "M_NOT_FOUND") return "m.room.message";
+			throw error;
+		}
+	}
+	async prepareRoomForMessageSend(roomId, content) {
+		if (await this.getMessageWireEventType(roomId) === "m.room.message") return "m.room.message";
+		const crypto = this.client.getCrypto();
+		if (!crypto) throw new Error("Encrypted Matrix room: enable encryption before sending messages");
+		const room = this.client.getRoom(roomId);
+		if (!room || !room.hasEncryptionStateEvent() && !await crypto.isEncryptionEnabledInRoom(roomId)) throw new Error("Encrypted Matrix room is not ready: wait for room sync before sending");
+		if (content && ((content.msgtype === MsgType.Image || content.msgtype === MsgType.Audio || content.msgtype === MsgType.Video || content.msgtype === MsgType.File) && typeof content.url === "string" || content.info && "thumbnail_url" in content.info && typeof content.info.thumbnail_url === "string")) throw new Error("Encrypted Matrix room contains unencrypted media; retry the send");
+		return "m.room.encrypted";
+	}
 	async sendEvent(roomId, eventType, content) {
 		return await this.runSerializedRoomSend(roomId, async () => {
+			if (eventType === EventType.RoomMessageEncrypted.toString() || eventType === EventType.RoomRedaction.toString()) throw new Error(eventType === EventType.RoomRedaction.toString() ? "Matrix redaction wire events must use redactEvent" : "Matrix encrypted wire events must be generated by the SDK");
+			if (eventType !== "m.reaction") await this.prepareRoomForMessageSend(roomId, content);
 			return (await this.client.sendEvent(roomId, eventType, content)).event_id;
 		});
 	}
@@ -698,7 +806,7 @@ var MatrixClientCore = class extends MatrixClientBase {
 };
 //#endregion
 //#region extensions/matrix/src/matrix/sdk/client-verification.ts
-const normalizeOptionalString$1 = normalizeNullableString;
+const normalizeNullableVerificationString = normalizeNullableString;
 var MatrixClientVerification = class extends MatrixClientCore {
 	async getRoomKeyBackupStatus() {
 		if (!this.encryptionEnabled) return {
@@ -733,7 +841,7 @@ var MatrixClientVerification = class extends MatrixClientCore {
 				try {
 					await crypto.loadSessionBackupPrivateKeyFromSecretStorage();
 				} catch (err) {
-					keyLoadError = formatMatrixErrorMessage(err);
+					keyLoadError = formatErrorMessage(err);
 				}
 			} else keyLoadError = "Matrix crypto backend does not support loading backup keys from secret storage";
 			if (!keyLoadError) await this.enableTrustedRoomKeyBackupIfPossible(crypto);
@@ -830,7 +938,7 @@ var MatrixClientVerification = class extends MatrixClientCore {
 	async resolveActiveRoomKeyBackupVersion(crypto) {
 		if (typeof crypto.getActiveSessionBackupVersion !== "function") return null;
 		const version = await crypto.getActiveSessionBackupVersion().catch(() => null);
-		return normalizeOptionalString$1(version);
+		return normalizeNullableVerificationString(version);
 	}
 	async resolveCachedRoomKeyBackupDecryptionKey(crypto) {
 		const read = Reflect.get(crypto, "getSessionBackupPrivateKey");
@@ -862,7 +970,7 @@ var MatrixClientVerification = class extends MatrixClientCore {
 		let matchesDecryptionKey = null;
 		if (typeof crypto.getKeyBackupInfo === "function") {
 			const info = await crypto.getKeyBackupInfo().catch(() => null);
-			serverVersion = normalizeOptionalString$1(info?.version) ?? serverVersion;
+			serverVersion = normalizeNullableVerificationString(info?.version) ?? serverVersion;
 			if (info && typeof crypto.isKeyBackupTrusted === "function") {
 				const trustInfo = await crypto.isKeyBackupTrusted(info).catch(() => null);
 				trusted = typeof trustInfo?.trusted === "boolean" ? trustInfo.trusted : null;
@@ -883,7 +991,7 @@ var MatrixClientVerification = class extends MatrixClientCore {
 	async resolveRoomKeyBackupVersion() {
 		try {
 			const response = await this.doRequest("GET", "/_matrix/client/v3/room_keys/version");
-			return normalizeOptionalString$1(response.version);
+			return normalizeNullableVerificationString(response.version);
 		} catch {
 			return null;
 		}
@@ -932,7 +1040,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				keyId: stagedKeyId
 			});
 		} catch (err) {
-			return await fail(formatMatrixErrorMessage(err));
+			return await fail(formatErrorMessage(err));
 		}
 		const storedRecoveryKeyMatches = this.recoveryKeyStore.getRecoveryKeySummary()?.encodedPrivateKey?.trim() === trimmedRecoveryKey;
 		if (backupUsableBeforeStagedRecovery && storedRecoveryKeyMatches) {
@@ -1033,7 +1141,7 @@ var MatrixClient = class extends MatrixClientVerification {
 			};
 		} catch (err) {
 			this.recoveryKeyStore.discardStagedRecoveryKey();
-			return await fail(formatMatrixErrorMessage(err));
+			return await fail(formatErrorMessage(err));
 		}
 	}
 	async restoreRoomKeyBackup(params = {}) {
@@ -1088,7 +1196,7 @@ var MatrixClient = class extends MatrixClientVerification {
 			};
 		} catch (err) {
 			this.recoveryKeyStore.discardStagedRecoveryKey();
-			return await fail(formatMatrixErrorMessage(err));
+			return await fail(formatErrorMessage(err));
 		}
 	}
 	async resetRoomKeyBackup(options = {}) {
@@ -1143,7 +1251,7 @@ var MatrixClient = class extends MatrixClientVerification {
 				backup
 			};
 		} catch (err) {
-			return await fail(formatMatrixErrorMessage(err));
+			return await fail(formatErrorMessage(err));
 		}
 	}
 	async getOwnCrossSigningPublicationStatus() {
@@ -1185,7 +1293,7 @@ var MatrixClient = class extends MatrixClientVerification {
 			await this.ensureRoomKeyBackupEnabled(crypto);
 		} catch (err) {
 			this.recoveryKeyStore.discardStagedRecoveryKey();
-			bootstrapError = formatMatrixErrorMessage(err);
+			bootstrapError = formatErrorMessage(err);
 		}
 		const verification = await this.getOwnDeviceVerificationStatus();
 		const crossSigning = await this.getOwnCrossSigningPublicationStatus();
@@ -1249,8 +1357,9 @@ var MatrixClient = class extends MatrixClientVerification {
 			emitter: this.emitter,
 			emitMembershipForRoom: (room) => this.emitMembershipForRoom(room),
 			getSelfUserId: () => this.client.getUserId() ?? this.selfUserId ?? "",
-			setCurrentSyncState: (state) => {
+			setCurrentSyncState: (state, error) => {
 				this.currentSyncState = state;
+				this.currentSyncError = error;
 			}
 		});
 	}

package/dist/{secret-contract-M3hRmGO-.js → secret-contract-CufozuyJ.js}

@@ -1,4 +1,4 @@
-import { t as getMatrixScopedEnvVarNames } from "./env-vars-B0NxQnPk.js";
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { collectSecretInputAssignment, createChannelSecretTargetRegistryEntries, getChannelSurface, hasConfiguredSecretInputValue, hasOwnProperty, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 //#region extensions/matrix/src/secret-contract.ts

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-M3hRmGO-.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-CufozuyJ.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };