@openclaw/matrix 2026.8.1 → 2026.8.33

package/dist/{sdk-TZYyo0XQ.js → .setup/sdk-DoObvds0.mjs}

@@ -1,26 +1,30 @@
-import "./reaction-common-DkrQdBSZ.js";
-import { t as SqliteBackedMatrixSyncStore } from "./file-sync-store-DjskBX2o.js";
-import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-B_71hN6W.js";
-import { t as MATRIX_IDB_PERSIST_INTERVAL_MS } from "./idb-persistence-lock-DAJ49nZX.js";
-import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-DKVS3_DO.js";
-import { a as throwIfMatrixStartupAborted, r as createMatrixStartupAbortError } from "./client-kSi51NKp.js";
-import { n as matrixEventToRaw, r as parseMxc } from "./event-helpers-XRfAbOIh.js";
-import { n as createMatrixGuardedFetch, t as MatrixAuthedHttpClient } from "./http-client-D8o8b9u6.js";
-import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.js";
-import { t as createMatrixJsSdkClientLogger } from "./logging-DRjvUOIh.js";
-import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-DLj4vDeu.js";
-import { n as isRepairableSecretStorageAccessError, t as MatrixRecoveryKeyStore } from "./recovery-key-store-CognuDys.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.mjs";
+import "./reaction-common-DkrQdBSZ.mjs";
+import { A as writeMatrixRecoveryKeyStateForPath, E as readMatrixRecoveryKeyStateForPath, S as readLegacyMatrixRecoveryKeyFile, _ as migrateLegacyMatrixRecoveryKeyFilePathToStore, t as claimCurrentTokenStorageState } from "./storage-B-nf2ReN.mjs";
+import { i as openMatrixSyncCacheStoreOptions, l as writeMatrixSyncCacheStateToSyncStore, n as deleteMatrixSyncCacheStateFromSyncStore, o as readPersistedStoreFromSyncStore } from "./sync-cache-state-6Hjn1K-v.mjs";
+import { t as MATRIX_IDB_PERSIST_INTERVAL_MS } from "./idb-persistence-lock-B3fZXyF_.mjs";
+import { n as LogService, r as noop, t as ConsoleLogger } from "./logger-B3tfcB-m.mjs";
+import { n as isMatrixNotFoundError, t as formatMatrixErrorReason } from "./errors-DKVS3_DO.mjs";
+import { a as throwIfMatrixStartupAborted, r as createMatrixStartupAbortError } from "./client-DvcYcTSy.mjs";
+import { n as matrixEventToRaw, r as parseMxc } from "./event-helpers-XRfAbOIh.mjs";
+import { n as createMatrixGuardedFetch, t as MatrixAuthedHttpClient } from "./http-client-Bv6a2OfI.mjs";
+import { n as resolveMatrixRoomKeyBackupReadinessError } from "./backup-health-Dm_YMVFT.mjs";
+import { t as createMatrixJsSdkClientLogger } from "./logging-CkohOZwO.mjs";
+import { a as isMatrixAccessTokenInvalidatedError, c as resolveMatrixLocalTimeoutMs, f as isMatrixReadySyncState, i as createMatrixExplicitBootstrapOptions, l as unresolvedMatrixDeviceVerificationStatus, n as MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS, o as resolveMatrixDiagnostic, p as isMatrixTerminalSyncState, r as MATRIX_STATUS_DIAGNOSTIC_TIMEOUT_MS, s as resolveMatrixDiagnosticResult, t as MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS, u as unresolvedMatrixRoomKeyBackupStatus } from "./client-support-Bn9Bk0-H.mjs";
 import { createRequire } from "node:module";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { normalizeNullableString, normalizeStringEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
+import path from "node:path";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
-import { ClientEvent, EventType, Filter, MatrixError, MatrixEventEvent, MsgType, Preset, createClient } from "matrix-js-sdk/lib/matrix.js";
 import { EventEmitter } from "node:events";
+import { ClientEvent, EventType, Filter, MatrixError, MatrixEventEvent, MemoryStore, MsgType, Preset, SyncAccumulator, createClient } from "matrix-js-sdk/lib/matrix.js";
 import { RoomEvent } from "matrix-js-sdk/lib/models/room.js";
 import { VerificationMethod } from "matrix-js-sdk/lib/types.js";
 import { SyncApi, SyncState } from "matrix-js-sdk/lib/sync.js";
+import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";
 import { EventStatus } from "matrix-js-sdk/lib/models/event-status.js";
 //#region extensions/matrix/src/matrix/sdk/client-device-info.ts
 async function resolveMatrixCrossSigningPublicationStatus(params) {
@@ -135,6 +139,219 @@ function refreshMatrixDmRoomIds(direct, dmRoomIds) {
 	return true;
 }
 //#endregion
+//#region extensions/matrix/src/matrix/async-lock.ts
+function createAsyncLock() {
+	let lock = Promise.resolve();
+	return async function withLock(fn) {
+		const previous = lock;
+		let release;
+		lock = new Promise((resolve) => {
+			release = resolve;
+		});
+		await previous;
+		try {
+			return await fn();
+		} finally {
+			release?.();
+		}
+	};
+}
+//#endregion
+//#region extensions/matrix/src/matrix/client/file-sync-store.ts
+const PERSIST_DEBOUNCE_MS = 250;
+function cloneJson(value) {
+	return structuredClone(value);
+}
+function syncDataToSyncResponse(syncData) {
+	return {
+		next_batch: syncData.nextBatch,
+		rooms: syncData.roomsData,
+		account_data: { events: syncData.accountData }
+	};
+}
+var SqliteBackedMatrixSyncStore = class extends MemoryStore {
+	constructor(storageRootDir) {
+		super();
+		this.storageRootDir = storageRootDir;
+		this.persistLock = createAsyncLock();
+		this.accumulator = new SyncAccumulator();
+		this.savedSync = null;
+		this.cleanShutdown = false;
+		this.dirty = false;
+		this.frozen = false;
+		this.persistTimer = null;
+		this.persistPromise = null;
+		let restoredSavedSync = null;
+		let restoredClientOptions;
+		let restoredCleanShutdown = false;
+		let syncCacheStore = createNoopMatrixSyncCacheStore();
+		let syncCacheStoreUnavailableError;
+		try {
+			syncCacheStore = openMatrixSyncCacheStore(storageRootDir);
+			const persisted = readPersistedStoreFromSyncStore(syncCacheStore);
+			if (persisted) {
+				restoredSavedSync = persisted.savedSync;
+				restoredClientOptions = persisted.clientOptions;
+				restoredCleanShutdown = persisted.cleanShutdown === true;
+			}
+		} catch (err) {
+			syncCacheStoreUnavailableError = err;
+			LogService.warn("MatrixSyncCacheStore", "Failed to load Matrix sync cache:", err);
+		}
+		this.store = syncCacheStore;
+		this.storeUnavailableError = syncCacheStoreUnavailableError;
+		this.savedSync = restoredSavedSync;
+		this.savedClientOptions = restoredClientOptions;
+		this.hadSavedSyncOnLoad = restoredSavedSync !== null;
+		this.hadCleanShutdownOnLoad = this.hadSavedSyncOnLoad && restoredCleanShutdown;
+		this.cleanShutdown = this.hadCleanShutdownOnLoad;
+		if (this.savedSync) {
+			this.accumulator.accumulate(syncDataToSyncResponse(this.savedSync), true);
+			super.setSyncToken(this.savedSync.nextBatch);
+		}
+		if (this.savedClientOptions) super.storeClientOptions(this.savedClientOptions);
+	}
+	hasSavedSync() {
+		return this.hadSavedSyncOnLoad;
+	}
+	hasSavedSyncFromCleanShutdown() {
+		return this.hadCleanShutdownOnLoad;
+	}
+	getSavedSync() {
+		return Promise.resolve(this.savedSync ? cloneJson(this.savedSync) : null);
+	}
+	getSavedSyncToken() {
+		return Promise.resolve(this.savedSync?.nextBatch ?? null);
+	}
+	setSyncData(syncData) {
+		if (this.frozen) return Promise.resolve();
+		this.accumulator.accumulate(syncData);
+		this.savedSync = this.accumulator.getJSON();
+		this.markDirtyAndSchedulePersist();
+		return Promise.resolve();
+	}
+	getClientOptions() {
+		return Promise.resolve(this.savedClientOptions ? cloneJson(this.savedClientOptions) : void 0);
+	}
+	storeClientOptions(options) {
+		if (this.frozen) return Promise.resolve();
+		this.savedClientOptions = cloneJson(options);
+		super.storeClientOptions(options);
+		this.markDirtyAndSchedulePersist();
+		return Promise.resolve();
+	}
+	save(force = false) {
+		if (force) return this.flush();
+		return Promise.resolve();
+	}
+	wantsSave() {
+		return false;
+	}
+	async deleteAllData() {
+		this.assertStoreAvailable();
+		if (this.persistTimer) {
+			clearTimeout(this.persistTimer);
+			this.persistTimer = null;
+		}
+		this.dirty = false;
+		await this.persistPromise?.catch(() => void 0);
+		await super.deleteAllData();
+		this.savedSync = null;
+		this.savedClientOptions = void 0;
+		this.cleanShutdown = false;
+		await deleteMatrixSyncCacheStateFromSyncStore({
+			storageRootDir: this.storageRootDir,
+			store: this.store
+		});
+	}
+	markCleanShutdown() {
+		this.cleanShutdown = true;
+		this.dirty = true;
+	}
+	async freezeSyncCursorPersistence() {
+		this.frozen = true;
+		if (this.persistTimer) {
+			clearTimeout(this.persistTimer);
+			this.persistTimer = null;
+		}
+		await this.persistPromise;
+	}
+	discardPendingSyncCursorPersistence() {
+		this.frozen = true;
+		if (this.persistTimer) {
+			clearTimeout(this.persistTimer);
+			this.persistTimer = null;
+		}
+		this.cleanShutdown = false;
+		this.dirty = false;
+	}
+	async flush() {
+		if (this.persistTimer) {
+			clearTimeout(this.persistTimer);
+			this.persistTimer = null;
+		}
+		while (this.dirty || this.persistPromise) {
+			if (this.dirty && !this.persistPromise) this.persistPromise = this.persist().finally(() => {
+				this.persistPromise = null;
+			});
+			await this.persistPromise;
+		}
+	}
+	markDirtyAndSchedulePersist() {
+		if (this.frozen) return;
+		this.cleanShutdown = false;
+		this.dirty = true;
+		if (this.persistTimer) return;
+		this.persistTimer = setTimeout(() => {
+			this.persistTimer = null;
+			this.flush().catch((err) => {
+				LogService.warn("MatrixSyncCacheStore", "Failed to persist Matrix sync store:", err);
+			});
+		}, PERSIST_DEBOUNCE_MS);
+		this.persistTimer.unref?.();
+	}
+	async persist() {
+		this.assertStoreAvailable();
+		this.dirty = false;
+		const payload = {
+			version: 1,
+			savedSync: this.savedSync ? cloneJson(this.savedSync) : null,
+			cleanShutdown: this.cleanShutdown,
+			...this.savedClientOptions ? { clientOptions: cloneJson(this.savedClientOptions) } : {}
+		};
+		try {
+			await this.persistLock(async () => {
+				writeMatrixSyncCacheStateToSyncStore({
+					payload,
+					store: this.store
+				});
+				claimCurrentTokenStorageState({ rootDir: this.storageRootDir });
+			});
+		} catch (err) {
+			this.dirty = true;
+			throw err;
+		}
+	}
+	assertStoreAvailable() {
+		if (this.storeUnavailableError == null) return;
+		throw new Error("Matrix sync cache SQLite store is unavailable; cannot persist sync state", { cause: this.storeUnavailableError });
+	}
+};
+function createNoopMatrixSyncCacheStore() {
+	return {
+		register: () => {},
+		registerIfAbsent: () => false,
+		lookup: () => void 0,
+		consume: () => void 0,
+		delete: () => false,
+		entries: () => [],
+		clear: () => {}
+	};
+}
+function openMatrixSyncCacheStore(storageRootDir) {
+	return getMatrixRuntime().state.openSyncKeyedStore(openMatrixSyncCacheStoreOptions(storageRootDir));
+}
+//#endregion
 //#region extensions/matrix/src/matrix/sdk/client-sync-quiesce.ts
 const MATRIX_SYNC_QUIESCE_TIMEOUT_MS = 5e3;
 const MATRIX_JS_SDK_SYNC_VERSION = "42.2.0";
@@ -204,6 +421,275 @@ async function quiesceMatrixClientSync(params) {
 	});
 }
 //#endregion
+//#region extensions/matrix/src/matrix/sdk/recovery-key-store.ts
+function isRepairableSecretStorageAccessError(err) {
+	const message = formatMatrixErrorReason(err);
+	if (!message) return false;
+	if (message.includes("getsecretstoragekey callback returned falsey")) return true;
+	if (message.includes("decrypting secret") && message.includes("bad mac")) return true;
+	return false;
+}
+var MatrixRecoveryKeyStore = class {
+	constructor(recoveryKeyPath) {
+		this.secretStorageKeyCache = /* @__PURE__ */ new Map();
+		this.stagedRecoveryKey = null;
+		this.stagedRecoveryKeyUsed = false;
+		this.stagedCacheKeyIds = /* @__PURE__ */ new Set();
+		this.recoveryKeyPath = recoveryKeyPath;
+		this.storageRootDir = recoveryKeyPath ? path.dirname(recoveryKeyPath) : void 0;
+		if (this.recoveryKeyPath) try {
+			migrateLegacyMatrixRecoveryKeyFilePathToStore(this.recoveryKeyPath);
+		} catch (err) {
+			this.legacyRecoveryKeyPathOnMigrationFailure = this.recoveryKeyPath;
+			LogService.warn("MatrixClientLite", "Failed to migrate Matrix recovery key state:", err);
+		}
+	}
+	buildCryptoCallbacks() {
+		return {
+			getSecretStorageKey: async ({ keys }) => {
+				const requestedKeyIds = Object.keys(keys ?? {});
+				if (requestedKeyIds.length === 0) return null;
+				const staged = this.resolveStagedSecretStorageKey(requestedKeyIds);
+				if (staged) return staged;
+				for (const keyId of requestedKeyIds) {
+					const cached = this.secretStorageKeyCache.get(keyId);
+					if (cached) return [keyId, new Uint8Array(cached.key)];
+				}
+				const stored = this.loadStoredRecoveryKey();
+				if (!stored?.privateKeyBase64) return null;
+				const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
+				if (privateKey.length === 0) return null;
+				if (stored.keyId && requestedKeyIds.includes(stored.keyId)) {
+					this.rememberSecretStorageKey(stored.keyId, privateKey, stored.keyInfo);
+					return [stored.keyId, privateKey];
+				}
+				const firstRequestedKeyId = requestedKeyIds[0];
+				if (!firstRequestedKeyId) return null;
+				this.rememberSecretStorageKey(firstRequestedKeyId, privateKey, stored.keyInfo);
+				return [firstRequestedKeyId, privateKey];
+			},
+			cacheSecretStorageKey: (keyId, keyInfo, key) => {
+				const privateKey = new Uint8Array(key);
+				const normalizedKeyInfo = {
+					passphrase: keyInfo?.passphrase,
+					name: typeof keyInfo?.name === "string" ? keyInfo.name : void 0
+				};
+				this.rememberSecretStorageKey(keyId, privateKey, normalizedKeyInfo);
+				const stored = this.loadStoredRecoveryKey();
+				this.saveRecoveryKeyToDisk({
+					keyId,
+					keyInfo: normalizedKeyInfo,
+					privateKey,
+					encodedPrivateKey: stored?.encodedPrivateKey
+				});
+			}
+		};
+	}
+	getRecoveryKeySummary() {
+		const stored = this.loadStoredRecoveryKey();
+		if (!stored) return null;
+		return {
+			encodedPrivateKey: stored.encodedPrivateKey,
+			keyId: stored.keyId,
+			createdAt: stored.createdAt
+		};
+	}
+	getSecretStorageKeyCandidate(keyId) {
+		const normalizedKeyId = keyId.trim();
+		if (!normalizedKeyId) return null;
+		const staged = this.resolveStagedSecretStorageKey([normalizedKeyId]);
+		if (staged) return staged[1];
+		const stored = this.loadStoredRecoveryKey();
+		if (!stored?.privateKeyBase64) return null;
+		const privateKey = new Uint8Array(Buffer.from(stored.privateKeyBase64, "base64"));
+		if (privateKey.length === 0) return null;
+		this.rememberSecretStorageKey(normalizedKeyId, privateKey, stored.keyInfo);
+		return privateKey;
+	}
+	resolveEncodedRecoveryKeyInput(params) {
+		const encodedPrivateKey = params.encodedPrivateKey.trim();
+		if (!encodedPrivateKey) throw new Error("Matrix recovery key is required");
+		let privateKey;
+		try {
+			privateKey = decodeRecoveryKey(encodedPrivateKey);
+		} catch (err) {
+			throw new Error(`Invalid Matrix recovery key: ${formatErrorMessage(err)}`, { cause: err });
+		}
+		const keyId = typeof params.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : null;
+		return {
+			encodedPrivateKey,
+			privateKey,
+			keyId,
+			keyInfo: params.keyInfo ?? this.loadStoredRecoveryKey()?.keyInfo
+		};
+	}
+	storeEncodedRecoveryKey(params) {
+		const prepared = this.resolveEncodedRecoveryKeyInput(params);
+		this.saveRecoveryKeyToDisk({
+			keyId: prepared.keyId,
+			keyInfo: prepared.keyInfo,
+			privateKey: prepared.privateKey,
+			encodedPrivateKey: prepared.encodedPrivateKey
+		});
+		if (prepared.keyId) this.rememberSecretStorageKey(prepared.keyId, prepared.privateKey, prepared.keyInfo);
+		return this.getRecoveryKeySummary() ?? {};
+	}
+	stageEncodedRecoveryKey(params) {
+		const prepared = this.resolveEncodedRecoveryKeyInput(params);
+		this.discardStagedRecoveryKey();
+		this.stagedRecoveryKey = {
+			version: 1,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			keyId: prepared.keyId,
+			encodedPrivateKey: prepared.encodedPrivateKey,
+			privateKeyBase64: Buffer.from(prepared.privateKey).toString("base64"),
+			keyInfo: prepared.keyInfo
+		};
+	}
+	hasStagedRecoveryKeyBeenUsed() {
+		return this.stagedRecoveryKeyUsed;
+	}
+	commitStagedRecoveryKey(params) {
+		if (!this.stagedRecoveryKey) return this.getRecoveryKeySummary();
+		const staged = this.stagedRecoveryKey;
+		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+		const keyId = typeof params?.keyId === "string" && params.keyId.trim() ? params.keyId.trim() : staged.keyId;
+		this.saveRecoveryKeyToDisk({
+			keyId,
+			keyInfo: params?.keyInfo ?? staged.keyInfo,
+			privateKey,
+			encodedPrivateKey: staged.encodedPrivateKey
+		});
+		this.clearStagedRecoveryKeyTracking();
+		return this.getRecoveryKeySummary();
+	}
+	discardStagedRecoveryKey() {
+		for (const keyId of this.stagedCacheKeyIds) this.secretStorageKeyCache.delete(keyId);
+		this.clearStagedRecoveryKeyTracking();
+	}
+	async bootstrapSecretStorageWithRecoveryKey(crypto, options = {}) {
+		let status = null;
+		const getSecretStorageStatus = crypto.getSecretStorageStatus;
+		if (typeof getSecretStorageStatus === "function") try {
+			status = await getSecretStorageStatus.call(crypto);
+		} catch (err) {
+			LogService.warn("MatrixClientLite", "Failed to read secret storage status:", err);
+		}
+		const hasDefaultSecretStorageKey = Boolean(status?.defaultKeyId);
+		const hasKnownInvalidSecrets = Object.values(status?.secretStorageKeyValidityMap ?? {}).some((valid) => !valid);
+		let generatedRecoveryKey = false;
+		const storedRecovery = this.loadStoredRecoveryKey();
+		const stagedRecovery = this.stagedRecoveryKey;
+		const sourceRecovery = options.forceNewRecoveryKey === true ? null : stagedRecovery ?? storedRecovery;
+		let recoveryKey = sourceRecovery ? {
+			keyInfo: sourceRecovery.keyInfo,
+			privateKey: new Uint8Array(Buffer.from(sourceRecovery.privateKeyBase64, "base64")),
+			encodedPrivateKey: sourceRecovery.encodedPrivateKey
+		} : null;
+		if (recoveryKey && status?.defaultKeyId) {
+			const defaultKeyId = status.defaultKeyId;
+			if (!stagedRecovery) {
+				this.rememberSecretStorageKey(defaultKeyId, recoveryKey.privateKey, recoveryKey.keyInfo);
+				if (storedRecovery && storedRecovery.keyId !== defaultKeyId) this.saveRecoveryKeyToDisk({
+					keyId: defaultKeyId,
+					keyInfo: recoveryKey.keyInfo,
+					privateKey: recoveryKey.privateKey,
+					encodedPrivateKey: recoveryKey.encodedPrivateKey
+				});
+			}
+		}
+		const ensureRecoveryKey = async () => {
+			if (recoveryKey) {
+				if (stagedRecovery) this.stagedRecoveryKeyUsed = true;
+				return recoveryKey;
+			}
+			if (typeof crypto.createRecoveryKeyFromPassphrase !== "function") throw new Error("Matrix crypto backend does not support recovery key generation (createRecoveryKeyFromPassphrase missing)");
+			recoveryKey = await crypto.createRecoveryKeyFromPassphrase();
+			this.saveRecoveryKeyToDisk(recoveryKey);
+			generatedRecoveryKey = true;
+			return recoveryKey;
+		};
+		const shouldRecreateSecretStorage = options.forceNewSecretStorage === true || !hasDefaultSecretStorageKey || !recoveryKey && status?.ready === false || hasKnownInvalidSecrets;
+		if (hasKnownInvalidSecrets) recoveryKey = null;
+		const secretStorageOptions = { setupNewKeyBackup: options.setupNewKeyBackup === true };
+		if (shouldRecreateSecretStorage) {
+			secretStorageOptions.setupNewSecretStorage = true;
+			secretStorageOptions.createSecretStorageKey = ensureRecoveryKey;
+		}
+		try {
+			await crypto.bootstrapSecretStorage(secretStorageOptions);
+		} catch (err) {
+			if (!(options.allowSecretStorageRecreateWithoutRecoveryKey === true && hasDefaultSecretStorageKey && isRepairableSecretStorageAccessError(err))) throw err;
+			recoveryKey = null;
+			LogService.warn("MatrixClientLite", "Secret storage exists on the server but local recovery material cannot unlock it; recreating secret storage during explicit bootstrap.");
+			await crypto.bootstrapSecretStorage({
+				setupNewSecretStorage: true,
+				setupNewKeyBackup: options.setupNewKeyBackup === true,
+				createSecretStorageKey: ensureRecoveryKey
+			});
+		}
+		if (generatedRecoveryKey && this.storageRootDir) LogService.warn("MatrixClientLite", "Generated Matrix recovery key and saved it to Matrix SQLite state. Keep the displayed recovery key secure.");
+	}
+	clearStagedRecoveryKeyTracking() {
+		this.stagedRecoveryKey = null;
+		this.stagedRecoveryKeyUsed = false;
+		this.stagedCacheKeyIds.clear();
+	}
+	resolveStagedSecretStorageKey(requestedKeyIds) {
+		const staged = this.stagedRecoveryKey;
+		if (!staged?.privateKeyBase64) return null;
+		const privateKey = new Uint8Array(Buffer.from(staged.privateKeyBase64, "base64"));
+		if (privateKey.length === 0) return null;
+		const keyId = staged.keyId && requestedKeyIds.includes(staged.keyId) ? staged.keyId : requestedKeyIds[0];
+		if (!keyId) return null;
+		this.rememberStagedSecretStorageKey(keyId, privateKey, staged.keyInfo);
+		this.stagedCacheKeyIds.add(keyId);
+		return [keyId, privateKey];
+	}
+	rememberStagedSecretStorageKey(keyId, key, keyInfo) {
+		this.stagedRecoveryKeyUsed = true;
+		this.rememberSecretStorageKey(keyId, key, keyInfo);
+	}
+	rememberSecretStorageKey(keyId, key, keyInfo) {
+		if (!keyId.trim()) return;
+		this.secretStorageKeyCache.set(keyId, {
+			key: new Uint8Array(key),
+			keyInfo
+		});
+	}
+	loadStoredRecoveryKey() {
+		if (!this.recoveryKeyPath) return null;
+		try {
+			const stored = readMatrixRecoveryKeyStateForPath(this.recoveryKeyPath);
+			if (stored) return stored;
+		} catch {}
+		if (this.legacyRecoveryKeyPathOnMigrationFailure) return readLegacyMatrixRecoveryKeyFile(this.legacyRecoveryKeyPathOnMigrationFailure);
+		return null;
+	}
+	saveRecoveryKeyToDisk(params) {
+		if (!this.recoveryKeyPath) return;
+		try {
+			const payload = {
+				version: 1,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				keyId: typeof params.keyId === "string" ? params.keyId : null,
+				encodedPrivateKey: params.encodedPrivateKey,
+				privateKeyBase64: Buffer.from(params.privateKey).toString("base64"),
+				keyInfo: params.keyInfo ? {
+					passphrase: params.keyInfo.passphrase,
+					name: params.keyInfo.name
+				} : void 0
+			};
+			writeMatrixRecoveryKeyStateForPath({
+				recoveryKeyPath: this.recoveryKeyPath,
+				payload
+			});
+		} catch (err) {
+			LogService.warn("MatrixClientLite", "Failed to persist recovery key:", err);
+		}
+	}
+};
+//#endregion
 //#region extensions/matrix/src/matrix/sdk/client-base.ts
 function resolveMessageWireDispatch(resource, init) {
 	if ((init?.method ?? (resource instanceof Request ? resource.method : "GET")).toUpperCase() !== "PUT") return null;
@@ -221,7 +707,7 @@ function resolveMessageWireDispatch(resource, init) {
 	};
 }
 let loadedMatrixCryptoRuntime = null;
-const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-C4WDYxlP.js").then((runtime) => {
+const loadMatrixCryptoRuntime = createLazyRuntimeModule(() => import("./crypto-runtime-Ch4WOG1y.mjs").then((runtime) => {
 	loadedMatrixCryptoRuntime = runtime;
 	return runtime;
 }));
@@ -552,13 +1038,15 @@ var MatrixClientBase = class {
 		if (!cryptoBootstrapper) return;
 		const initial = await cryptoBootstrapper.bootstrap(crypto, MATRIX_INITIAL_CRYPTO_BOOTSTRAP_OPTIONS);
 		throwIfMatrixStartupAborted(abortSignal);
-		if (!initial.crossSigningPublished || initial.ownDeviceVerified === false) if ((await this.getOwnDeviceVerificationStatus()).signedByOwner) LogService.warn("MatrixClientLite", "Cross-signing/bootstrap is incomplete for an already owner-signed device; skipping automatic reset and preserving the current identity. Restore the recovery key or run an explicit verification bootstrap if repair is needed.");
-		else try {
-			const repaired = await cryptoBootstrapper.bootstrap(crypto, MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS);
-			throwIfMatrixStartupAborted(abortSignal);
-			if (repaired.crossSigningPublished && repaired.ownDeviceVerified !== false) LogService.info("MatrixClientLite", "Cross-signing/bootstrap recovered after forced reset");
-		} catch (err) {
-			LogService.warn("MatrixClientLite", "Failed to recover cross-signing/bootstrap with forced reset:", err);
+		if (!initial.crossSigningPublished || initial.ownDeviceVerified === false) {
+			if ((await this.getOwnDeviceVerificationStatus()).signedByOwner) LogService.warn("MatrixClientLite", "Cross-signing/bootstrap is incomplete for an already owner-signed device; skipping automatic reset and preserving the current identity. Restore the recovery key or run an explicit verification bootstrap if repair is needed.");
+			else try {
+				const repaired = await cryptoBootstrapper.bootstrap(crypto, MATRIX_AUTOMATIC_REPAIR_BOOTSTRAP_OPTIONS);
+				throwIfMatrixStartupAborted(abortSignal);
+				if (repaired.crossSigningPublished && repaired.ownDeviceVerified !== false) LogService.info("MatrixClientLite", "Cross-signing/bootstrap recovered after forced reset");
+			} catch (err) {
+				LogService.warn("MatrixClientLite", "Failed to recover cross-signing/bootstrap with forced reset:", err);
+			}
 		}
 		this.cryptoBootstrapped = true;
 	}
@@ -853,6 +1341,9 @@ var MatrixClientCore = class extends MatrixClientBase {
 //#region extensions/matrix/src/matrix/sdk/client-verification.ts
 const normalizeNullableVerificationString = normalizeNullableString;
 var MatrixClientVerification = class extends MatrixClientCore {
+	async refreshOwnDeviceKeys() {
+		await this.client.getCrypto()?.userHasCrossSigningKeys(await this.getUserId(), true);
+	}
 	async getRoomKeyBackupStatus() {
 		if (!this.encryptionEnabled) return {
 			serverVersion: null,
@@ -881,14 +1372,16 @@ var MatrixClientVerification = class extends MatrixClientCore {
 		let keyLoadAttempted = false;
 		let keyLoadError = null;
 		if (serverVersion && (shouldLoadBackupKey || shouldActivateBackup)) {
-			if (shouldLoadBackupKey) if (typeof crypto.loadSessionBackupPrivateKeyFromSecretStorage === "function") {
-				keyLoadAttempted = true;
-				try {
-					await crypto.loadSessionBackupPrivateKeyFromSecretStorage();
-				} catch (err) {
-					keyLoadError = formatErrorMessage(err);
-				}
-			} else keyLoadError = "Matrix crypto backend does not support loading backup keys from secret storage";
+			if (shouldLoadBackupKey) {
+				if (typeof crypto.loadSessionBackupPrivateKeyFromSecretStorage === "function") {
+					keyLoadAttempted = true;
+					try {
+						await crypto.loadSessionBackupPrivateKeyFromSecretStorage();
+					} catch (err) {
+						keyLoadError = formatErrorMessage(err);
+					}
+				} else keyLoadError = "Matrix crypto backend does not support loading backup keys from secret storage";
+			}
 			if (!keyLoadError) await this.enableTrustedRoomKeyBackupIfPossible(crypto);
 			({activeVersion, decryptionKeyCached} = await this.resolveRoomKeyBackupLocalState(crypto));
 			({serverVersion, trusted, matchesDecryptionKey} = await this.resolveRoomKeyBackupTrustState(crypto, serverVersion));
@@ -1056,6 +1549,11 @@ var MatrixClientVerification = class extends MatrixClientCore {
 };
 //#endregion
 //#region extensions/matrix/src/matrix/sdk.ts
+var sdk_exports = /* @__PURE__ */ __exportAll({
+	ConsoleLogger: () => ConsoleLogger,
+	LogService: () => LogService,
+	MatrixClient: () => MatrixClient
+});
 var MatrixClient = class extends MatrixClientVerification {
 	async verifyWithRecoveryKey(rawRecoveryKey) {
 		const fail = async (error, fields = {}) => {
@@ -1424,4 +1922,4 @@ var MatrixClient = class extends MatrixClientVerification {
 	}
 };
 //#endregion
-export { ConsoleLogger, LogService, MatrixClient };
+export { ConsoleLogger, LogService, MatrixClient, isRepairableSecretStorageAccessError as n, sdk_exports as t };

package/dist/{secret-contract-CufozuyJ.js → .setup/secret-contract-JlB6VmI3.mjs}

@@ -1,4 +1,4 @@
-import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.js";
+import { t as getMatrixScopedEnvVarNames } from "./env-vars-dGqak9dN.mjs";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { collectSecretInputAssignment, createChannelSecretTargetRegistryEntries, getChannelSurface, hasConfiguredSecretInputValue, hasOwnProperty, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 //#region extensions/matrix/src/secret-contract.ts

package/dist/.setup/secret-contract-api-B-iJoQEv.mjs

@@ -0,0 +1,3 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-JlB6VmI3.mjs";
+import "../secret-contract-api.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };