@openclaw/matrix 2026.9.1 → 2026.9.3

package/dist/{storage-BVf4uucD.js → storage-metadata-DYArLcq1.js}

@@ -1,11 +1,8 @@
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
-import { n as resolveMatrixAccountStorageRoot } from "./storage-paths-gUmSydsW.js";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { createHash, randomUUID } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs";
-import { loadJsonFile } from "openclaw/plugin-sdk/json-store";
 import os from "node:os";
 //#region extensions/matrix/src/matrix/sqlite-state.ts
 function resolveStateDirOverride(options) {
@@ -241,19 +238,22 @@ function archiveLegacyStateFileIfPossible(filePath) {
 function readIdbSnapshotJsonFromStore(store) {
 	const meta = store.lookup(idbMetaKey());
 	if (!isIdbSnapshotMeta(meta)) return null;
-	const chunks = readIdbSnapshotChunks(meta, (key) => store.lookup(key));
+	const chunks = readIdbSnapshotChunks(meta, store);
 	return chunks ? chunks.join("") : null;
 }
 async function readIdbSnapshotJsonFromAsyncStore(store) {
 	const meta = await store.lookup(idbMetaKey());
 	if (!isIdbSnapshotMeta(meta)) return null;
-	const chunks = await readIdbSnapshotChunksAsync(meta, (key) => store.lookup(key));
+	const chunks = await readIdbSnapshotChunksAsync(meta, store);
 	return chunks ? chunks.join("") : null;
 }
-function readIdbSnapshotChunks(meta, lookup) {
+function readIdbSnapshotChunks(meta, store) {
+	const records = store.lookupMany?.(Array.from({ length: meta.chunkCount }, (_, index) => idbChunkKey(meta.generation, index)));
 	const chunks = [];
 	for (let index = 0; index < meta.chunkCount; index += 1) {
-		const chunk = lookup(idbChunkKey(meta.generation, index));
+		const result = records?.[index];
+		if (result && !result.ok) throw result.error;
+		const chunk = records ? result?.value : store.lookup(idbChunkKey(meta.generation, index));
 		if (!isIdbSnapshotChunk(chunk) || chunk.index !== index) return null;
 		chunks.push(chunk.data);
 	}
@@ -261,10 +261,13 @@ function readIdbSnapshotChunks(meta, lookup) {
 	if (meta.digest !== digestText(snapshotJson)) return null;
 	return chunks;
 }
-async function readIdbSnapshotChunksAsync(meta, lookup) {
+async function readIdbSnapshotChunksAsync(meta, store) {
+	const records = await store.lookupMany?.(Array.from({ length: meta.chunkCount }, (_, index) => idbChunkKey(meta.generation, index)));
 	const chunks = [];
 	for (let index = 0; index < meta.chunkCount; index += 1) {
-		const chunk = await lookup(idbChunkKey(meta.generation, index));
+		const result = records?.[index];
+		if (result && !result.ok) throw result.error;
+		const chunk = records ? result?.value : await store.lookup(idbChunkKey(meta.generation, index));
 		if (!isIdbSnapshotChunk(chunk) || chunk.index !== index) return null;
 		chunks.push(chunk.data);
 	}
@@ -345,10 +348,7 @@ function isIdbSnapshotChunk(value) {
 	return isRecord(value) && value.kind === "snapshot-chunk" && typeof value.index === "number" && Number.isSafeInteger(value.index) && value.index >= 0 && typeof value.data === "string";
 }
 //#endregion
-//#region extensions/matrix/src/matrix/client/storage.ts
-const DEFAULT_ACCOUNT_KEY = "default";
-const STORAGE_META_FILENAME = "storage-meta.json";
-const THREAD_BINDINGS_FILENAME = "thread-bindings.json";
+//#region extensions/matrix/src/matrix/client/storage-metadata.ts
 const STORAGE_META_NAMESPACE = "storage-meta";
 const STORAGE_META_STATE_KEY = "current";
 const STORAGE_META_MAX_ENTRIES = 10;
@@ -359,28 +359,6 @@ function openMatrixStorageMetaStoreOptions(storageRootDir) {
 		env: resolveMatrixSqliteStateEnv({ stateDir: storageRootDir })
 	};
 }
-function openStorageMetaStore(rootDir) {
-	return getMatrixRuntime().state.openSyncKeyedStore(openMatrixStorageMetaStoreOptions(rootDir));
-}
-function scoreStorageRoot(rootDir, metadata = readStoredRootMetadata(rootDir)) {
-	let score = 0;
-	if (Object.keys(metadata).length > 0) score += 1;
-	if (metadata.currentTokenStateClaimed === true) score += 8;
-	if (fs.existsSync(path.join(rootDir, "crypto"))) score += 8;
-	if (fs.existsSync(path.join(rootDir, THREAD_BINDINGS_FILENAME))) score += 4;
-	if (fs.existsSync(path.join(rootDir, "legacy-crypto-migration.json"))) score += 3;
-	if (fs.existsSync(path.join(rootDir, "recovery-key.json"))) score += 2;
-	if (fs.existsSync(path.join(rootDir, "crypto-idb-snapshot.json"))) score += 2;
-	score += scoreMatrixCryptoStateInStore(rootDir);
-	return score;
-}
-function resolveStorageRootMtimeMs(rootDir) {
-	try {
-		return fs.statSync(rootDir).mtimeMs;
-	} catch {
-		return 0;
-	}
-}
 function normalizeMatrixStorageMetadata(value) {
 	if (!isRecord(value)) return null;
 	const metadata = {};
@@ -399,288 +377,5 @@ async function hasMatrixStorageMetaStateInStore(params) {
 async function writeMatrixStorageMetaStateToStore(params) {
 	await params.store.register(STORAGE_META_STATE_KEY, params.payload);
 }
-function readStoredRootMetadata(rootDir) {
-	if (fs.existsSync(path.join(rootDir, "state", "openclaw.sqlite"))) try {
-		const stored = normalizeMatrixStorageMetadata(openStorageMetaStore(rootDir).lookup(STORAGE_META_STATE_KEY));
-		if (stored) return stored;
-	} catch {}
-	return normalizeMatrixStorageMetadata(loadJsonFile(path.join(rootDir, STORAGE_META_FILENAME))) ?? {};
-}
-function isCompatibleStorageRoot(params) {
-	const metadata = readStoredRootMetadata(params.candidateRootDir);
-	if (metadata.homeserver && metadata.homeserver !== params.homeserver) return false;
-	if (metadata.userId && metadata.userId !== params.userId) return false;
-	if (metadata.accountId && normalizeAccountId(metadata.accountId) !== normalizeAccountId(params.accountKey)) return false;
-	if (params.deviceId && metadata.deviceId && metadata.deviceId.trim() && metadata.deviceId.trim() !== params.deviceId.trim()) return false;
-	if (params.requireExplicitDeviceMatch && params.deviceId && (!metadata.deviceId || metadata.deviceId.trim() !== params.deviceId.trim())) return false;
-	return true;
-}
-function resolvePreferredMatrixStorageRoot(params) {
-	const canonical = {
-		rootDir: params.canonicalRootDir,
-		tokenHash: params.canonicalTokenHash
-	};
-	const deviceId = params.deviceId?.trim();
-	if (!deviceId) return canonical;
-	const canonicalMetadata = readStoredRootMetadata(params.canonicalRootDir);
-	if (canonicalMetadata.accessTokenHash === params.canonicalTokenHash && canonicalMetadata.deviceId?.trim() === deviceId && canonicalMetadata.currentTokenStateClaimed === true) return canonical;
-	const parentDir = path.dirname(params.canonicalRootDir);
-	const bestCurrentScore = scoreStorageRoot(params.canonicalRootDir, canonicalMetadata);
-	const bestCurrentMtimeMs = resolveStorageRootMtimeMs(params.canonicalRootDir);
-	let best = {
-		rootDir: params.canonicalRootDir,
-		tokenHash: params.canonicalTokenHash,
-		score: bestCurrentScore,
-		mtimeMs: bestCurrentMtimeMs
-	};
-	let siblingEntries;
-	try {
-		siblingEntries = fs.readdirSync(parentDir, { withFileTypes: true });
-	} catch {
-		return {
-			rootDir: best.rootDir,
-			tokenHash: best.tokenHash
-		};
-	}
-	const compatiblePopulatedSiblings = [];
-	const populatedTokenHashes = bestCurrentScore > 0 ? [params.canonicalTokenHash] : [];
-	for (const entry of siblingEntries.toSorted((a, b) => a.name.localeCompare(b.name))) {
-		if (!entry.isDirectory()) continue;
-		if (entry.name === params.canonicalTokenHash) continue;
-		const candidateRootDir = path.join(parentDir, entry.name);
-		if (!isCompatibleStorageRoot({
-			candidateRootDir,
-			homeserver: params.homeserver,
-			userId: params.userId,
-			accountKey: params.accountKey,
-			deviceId,
-			requireExplicitDeviceMatch: true
-		})) continue;
-		const candidateScore = scoreStorageRoot(candidateRootDir);
-		if (candidateScore <= 0) continue;
-		populatedTokenHashes.push(entry.name);
-		compatiblePopulatedSiblings.push({
-			rootDir: candidateRootDir,
-			tokenHash: entry.name,
-			score: candidateScore,
-			mtimeMs: resolveStorageRootMtimeMs(candidateRootDir)
-		});
-	}
-	for (const candidate of compatiblePopulatedSiblings) if (candidate.score > best.score || best.rootDir !== params.canonicalRootDir && candidate.score === best.score && candidate.mtimeMs > best.mtimeMs) best = {
-		rootDir: candidate.rootDir,
-		tokenHash: candidate.tokenHash,
-		score: candidate.score,
-		mtimeMs: candidate.mtimeMs
-	};
-	if (populatedTokenHashes.length > 1) getMatrixRuntime().logging.getChildLogger({ module: "matrix-storage" }).warn("matrix: multiple populated token-hash storage roots detected", {
-		parentDir,
-		canonicalTokenHash: params.canonicalTokenHash,
-		selectedTokenHash: best.tokenHash,
-		populatedTokenHashes,
-		populatedSiblingTokenHashes: compatiblePopulatedSiblings.map((root) => root.tokenHash),
-		populatedRootCount: populatedTokenHashes.length
-	});
-	return {
-		rootDir: best.rootDir,
-		tokenHash: best.tokenHash
-	};
-}
-function resolveMatrixStoragePaths(params) {
-	const env = params.env ?? process.env;
-	const stateDir = params.stateDir ?? getMatrixRuntime().state.resolveStateDir(env, os.homedir);
-	const canonical = resolveMatrixAccountStorageRoot({
-		stateDir,
-		homeserver: params.homeserver,
-		userId: params.userId,
-		accessToken: params.accessToken,
-		accountId: params.accountId
-	});
-	const { rootDir, tokenHash } = resolvePreferredMatrixStorageRoot({
-		canonicalRootDir: canonical.rootDir,
-		canonicalTokenHash: canonical.tokenHash,
-		homeserver: params.homeserver,
-		userId: params.userId,
-		accountKey: canonical.accountKey,
-		deviceId: params.deviceId
-	});
-	return {
-		rootDir,
-		storagePath: path.join(rootDir, "bot-storage.json"),
-		cryptoPath: path.join(rootDir, "crypto"),
-		recoveryKeyPath: path.join(rootDir, MATRIX_RECOVERY_KEY_FILENAME),
-		idbSnapshotPath: path.join(rootDir, MATRIX_IDB_SNAPSHOT_FILENAME),
-		accountKey: canonical.accountKey,
-		tokenHash
-	};
-}
-function resolveMatrixStateFilePath(params) {
-	const storagePaths = resolveMatrixStoragePaths({
-		homeserver: params.auth.homeserver,
-		userId: params.auth.userId,
-		accessToken: params.auth.accessToken,
-		accountId: params.accountId ?? params.auth.accountId,
-		deviceId: params.auth.deviceId,
-		env: params.env,
-		stateDir: params.stateDir
-	});
-	return path.join(storagePaths.rootDir, params.filename);
-}
-async function maybeMigrateLegacyStorage(params) {
-	const hasAccountScopedLegacyStorageFile = fs.existsSync(params.storagePaths.storagePath);
-	const syncCache = hasAccountScopedLegacyStorageFile ? await import("./sync-cache-state-d-A_OhbU.js").then((n) => n.s) : null;
-	const hasAccountScopedLegacyStorage = hasAccountScopedLegacyStorageFile && await syncCache?.readLegacyMatrixSyncCacheState(params.storagePaths.rootDir) !== null;
-	const hasAccountScopedRecoveryKey = fs.existsSync(params.storagePaths.recoveryKeyPath);
-	const hasAccountScopedLegacyCryptoMigration = fs.existsSync(path.join(params.storagePaths.rootDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME));
-	if (!hasAccountScopedLegacyStorage && !hasAccountScopedRecoveryKey && !hasAccountScopedLegacyCryptoMigration) return;
-	const logger = getMatrixRuntime().logging.getChildLogger({ module: "matrix-storage" });
-	fs.mkdirSync(params.storagePaths.rootDir, { recursive: true });
-	const moved = [];
-	const pendingArchives = [];
-	const skippedExistingTargets = [];
-	try {
-		if (hasAccountScopedLegacyStorage) await migrateLegacySyncCacheToSqlite({
-			sourceRootDir: params.storagePaths.rootDir,
-			sourcePath: params.storagePaths.storagePath,
-			targetRootDir: params.storagePaths.rootDir,
-			label: "account sync cache",
-			moved,
-			pendingArchives
-		});
-		if (hasAccountScopedRecoveryKey) {
-			migrateLegacyMatrixRecoveryKeyFileToStore(params.storagePaths.rootDir);
-			moved.push({
-				sourcePath: params.storagePaths.recoveryKeyPath,
-				targetPath: `${params.storagePaths.rootDir} SQLite recovery key state`,
-				label: "recovery key"
-			});
-		}
-		if (hasAccountScopedLegacyCryptoMigration) {
-			migrateLegacyMatrixLegacyCryptoMigrationFileToStore(params.storagePaths.rootDir);
-			moved.push({
-				sourcePath: path.join(params.storagePaths.rootDir, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME),
-				targetPath: `${params.storagePaths.rootDir} SQLite legacy crypto migration state`,
-				label: "legacy crypto migration"
-			});
-		}
-	} catch (err) {
-		const rollbackError = rollbackLegacyMoves(moved);
-		throw new Error(rollbackError ? `Failed migrating legacy Matrix client storage: ${String(err)}. Rollback also failed: ${rollbackError}` : `Failed migrating legacy Matrix client storage: ${String(err)}`, { cause: err });
-	}
-	for (const archive of pendingArchives) archiveLegacyStoragePath({
-		...archive,
-		skippedExistingTargets
-	});
-	if (moved.length > 0) logger.info(`matrix: migrated legacy client storage into ${params.storagePaths.rootDir}\n${moved.map((entry) => `- ${entry.label}: ${entry.sourcePath} -> ${entry.targetPath}`).join("\n")}`);
-	if (skippedExistingTargets.length > 0) logger.warn?.(`matrix: legacy client storage files were left in place because their migrated targets already existed.\n${skippedExistingTargets.join("\n")}`);
-}
-async function migrateLegacySyncCacheToSqlite(params) {
-	const syncCache = await import("./sync-cache-state-d-A_OhbU.js").then((n) => n.s);
-	const persisted = await syncCache.readLegacyMatrixSyncCacheState(params.sourceRootDir);
-	if (!persisted) return;
-	const store = getMatrixRuntime().state.openKeyedStore(syncCache.openMatrixSyncCacheStoreOptions(params.targetRootDir));
-	if (!await syncCache.hasMatrixSyncCacheStateInStore({
-		storageRootDir: params.targetRootDir,
-		store
-	})) {
-		await syncCache.writeMatrixSyncCacheStateToStore({
-			storageRootDir: params.targetRootDir,
-			payload: persisted,
-			store
-		});
-		claimCurrentTokenStorageState({ rootDir: params.targetRootDir });
-		params.moved.push({
-			sourcePath: params.sourcePath,
-			targetPath: `${params.targetRootDir} SQLite sync cache`,
-			label: params.label
-		});
-	}
-	params.pendingArchives.push({
-		sourcePath: params.sourcePath,
-		label: params.label
-	});
-}
-function archiveLegacyStoragePath(params) {
-	const archivedLegacyStoragePath = `${params.sourcePath}.migrated`;
-	if (fs.existsSync(archivedLegacyStoragePath)) {
-		params.skippedExistingTargets.push(`- ${params.label} remains at ${params.sourcePath} because ${archivedLegacyStoragePath} already exists`);
-		return;
-	}
-	fs.renameSync(params.sourcePath, archivedLegacyStoragePath);
-}
-function rollbackLegacyMoves(moved) {
-	for (const entry of moved.toReversed()) try {
-		if (!fs.existsSync(entry.targetPath) || fs.existsSync(entry.sourcePath)) continue;
-		fs.renameSync(entry.targetPath, entry.sourcePath);
-	} catch (err) {
-		return `${entry.label} (${entry.targetPath} -> ${entry.sourcePath}): ${String(err)}`;
-	}
-	return null;
-}
-function writeStoredRootMetadata(rootDir, payload) {
-	try {
-		const normalized = normalizeMatrixStorageMetadata(payload);
-		if (!normalized) return false;
-		openStorageMetaStore(rootDir).register(STORAGE_META_STATE_KEY, normalized);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function writeStorageMeta(params) {
-	const existing = readStoredRootMetadata(params.storagePaths.rootDir);
-	return writeStoredRootMetadata(params.storagePaths.rootDir, {
-		homeserver: params.homeserver,
-		userId: params.userId,
-		accountId: params.accountId ?? DEFAULT_ACCOUNT_KEY,
-		accessTokenHash: params.storagePaths.tokenHash,
-		deviceId: params.deviceId ?? null,
-		currentTokenStateClaimed: params.currentTokenStateClaimed ?? existing.currentTokenStateClaimed === true,
-		createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-	});
-}
-function claimCurrentTokenStorageState(params) {
-	const metadata = readStoredRootMetadata(params.rootDir);
-	if (!metadata.accessTokenHash?.trim()) return false;
-	return writeStoredRootMetadata(params.rootDir, {
-		homeserver: metadata.homeserver,
-		userId: metadata.userId,
-		accountId: metadata.accountId ?? DEFAULT_ACCOUNT_KEY,
-		accessTokenHash: metadata.accessTokenHash,
-		deviceId: metadata.deviceId ?? null,
-		currentTokenStateClaimed: true,
-		createdAt: metadata.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-	});
-}
-function recordCurrentStorageMetaDeviceId(params) {
-	const deviceId = params.deviceId.trim();
-	if (!deviceId) return false;
-	const metadata = readStoredRootMetadata(params.rootDir);
-	if (!metadata.accessTokenHash?.trim()) return false;
-	return writeStoredRootMetadata(params.rootDir, {
-		homeserver: metadata.homeserver,
-		userId: metadata.userId,
-		accountId: metadata.accountId ?? DEFAULT_ACCOUNT_KEY,
-		accessTokenHash: metadata.accessTokenHash,
-		deviceId,
-		currentTokenStateClaimed: metadata.currentTokenStateClaimed === true,
-		createdAt: metadata.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-	});
-}
-function repairCurrentTokenStorageMetaDeviceId(params) {
-	return writeStorageMeta({
-		storagePaths: resolveMatrixStoragePaths({
-			homeserver: params.homeserver,
-			userId: params.userId,
-			accessToken: params.accessToken,
-			accountId: params.accountId,
-			env: params.env,
-			stateDir: params.stateDir
-		}),
-		homeserver: params.homeserver,
-		userId: params.userId,
-		accountId: params.accountId,
-		deviceId: params.deviceId
-	});
-}
 //#endregion
-export { writeMatrixRecoveryKeyStateForPath as A, readLegacyMatrixRecoveryKeyState as C, writeMatrixIdbSnapshotJson as D, readMatrixRecoveryKeyStateForPath as E, resolveMatrixSqliteStateEnv as M, resolveMatrixSqliteStateKey as N, writeMatrixIdbSnapshotJsonToStore as O, readLegacyMatrixRecoveryKeyFile as S, readMatrixIdbSnapshotJsonFromStore as T, migrateLegacyMatrixRecoveryKeyFilePathToStore as _, openMatrixStorageMetaStoreOptions as a, openMatrixRecoveryKeyStoreOptions as b, resolveMatrixStateFilePath as c, writeStorageMeta as d, MATRIX_IDB_SNAPSHOT_FILENAME as f, hasMatrixRecoveryKeyStateInStore as g, hasMatrixLegacyCryptoMigrationStateInStore as h, normalizeMatrixStorageMetadata as i, writeMatrixRecoveryKeyStateToStore as j, writeMatrixLegacyCryptoMigrationStateToStore as k, resolveMatrixStoragePaths as l, MATRIX_RECOVERY_KEY_FILENAME as m, hasMatrixStorageMetaStateInStore as n, recordCurrentStorageMetaDeviceId as o, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME as p, maybeMigrateLegacyStorage as r, repairCurrentTokenStorageMetaDeviceId as s, claimCurrentTokenStorageState as t, writeMatrixStorageMetaStateToStore as u, openMatrixIdbSnapshotStoreOptions as v, readMatrixIdbSnapshotJson as w, readLegacyMatrixLegacyCryptoMigrationState as x, openMatrixLegacyCryptoMigrationStoreOptions as y };
+export { resolveMatrixSqliteStateKey as A, scoreMatrixCryptoStateInStore as C, writeMatrixRecoveryKeyStateForPath as D, writeMatrixLegacyCryptoMigrationStateToStore as E, writeMatrixRecoveryKeyStateToStore as O, readMatrixRecoveryKeyStateForPath as S, writeMatrixIdbSnapshotJsonToStore as T, readLegacyMatrixLegacyCryptoMigrationState as _, writeMatrixStorageMetaStateToStore as a, readMatrixIdbSnapshotJson as b, MATRIX_RECOVERY_KEY_FILENAME as c, migrateLegacyMatrixLegacyCryptoMigrationFileToStore as d, migrateLegacyMatrixRecoveryKeyFilePathToStore as f, openMatrixRecoveryKeyStoreOptions as g, openMatrixLegacyCryptoMigrationStoreOptions as h, openMatrixStorageMetaStoreOptions as i, resolveMatrixSqliteStateEnv as k, hasMatrixLegacyCryptoMigrationStateInStore as l, openMatrixIdbSnapshotStoreOptions as m, hasMatrixStorageMetaStateInStore as n, MATRIX_IDB_SNAPSHOT_FILENAME as o, migrateLegacyMatrixRecoveryKeyFileToStore as p, normalizeMatrixStorageMetadata as r, MATRIX_LEGACY_CRYPTO_MIGRATION_FILENAME as s, STORAGE_META_STATE_KEY as t, hasMatrixRecoveryKeyStateInStore as u, readLegacyMatrixRecoveryKeyFile as v, writeMatrixIdbSnapshotJson as w, readMatrixIdbSnapshotJsonFromStore as x, readLegacyMatrixRecoveryKeyState as y };

package/dist/{storage-paths-gUmSydsW.js → storage-paths-DVCANXTc.js}

@@ -3,6 +3,18 @@ import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/acco
 import crypto from "node:crypto";
 import path from "node:path";
 //#region extensions/matrix/src/storage-paths.ts
+const MATRIX_TOKEN_HASH_DIRECTORY_PATTERN = /^[a-f0-9]{16}$/u;
+const MATRIX_SERVER_USER_DIRECTORY_PATTERN = /^.+__.+$/u;
+function isMatrixActiveTokenRootDirectory(name) {
+	return MATRIX_TOKEN_HASH_DIRECTORY_PATTERN.test(name);
+}
+function resolveMatrixStateLayoutChildDepth(depth, name) {
+	if (depth === 0) return name === "accounts" ? 1 : null;
+	if (depth === 1) return 2;
+	if (depth === 2) return MATRIX_SERVER_USER_DIRECTORY_PATTERN.test(name) ? 3 : null;
+	if (depth === 3) return isMatrixActiveTokenRootDirectory(name) ? 4 : null;
+	return null;
+}
 function sanitizeMatrixPathSegment(value) {
 	return normalizeLowercaseStringOrEmpty(value).replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "unknown";
 }
@@ -38,4 +50,4 @@ function resolveMatrixAccountStorageRoot(params) {
 	};
 }
 //#endregion
-export { resolveMatrixCredentialsPath as a, resolveMatrixCredentialsFilename as i, resolveMatrixAccountStorageRoot as n, resolveMatrixHomeserverKey as o, resolveMatrixCredentialsDir as r, sanitizeMatrixPathSegment as s, hashMatrixAccessToken as t };
+export { resolveMatrixCredentialsFilename as a, resolveMatrixStateLayoutChildDepth as c, resolveMatrixCredentialsDir as i, sanitizeMatrixPathSegment as l, isMatrixActiveTokenRootDirectory as n, resolveMatrixCredentialsPath as o, resolveMatrixAccountStorageRoot as r, resolveMatrixHomeserverKey as s, hashMatrixAccessToken as t };

package/dist/{sync-cache-state-d-A_OhbU.js → sync-cache-state-C-mhj3xb.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { M as resolveMatrixSqliteStateEnv } from "./storage-BVf4uucD.js";
+import { k as resolveMatrixSqliteStateEnv } from "./storage-metadata-DYArLcq1.js";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import path from "node:path";
@@ -74,9 +74,12 @@ function readPersistedStoreFromSyncStore(store) {
 	const stateKey = SYNC_CACHE_STATE_KEY;
 	const meta = store.lookup(metaKey(stateKey));
 	if (!isSyncCacheMeta(meta)) return null;
+	const records = store.lookupMany?.(Array.from({ length: meta.chunkCount }, (_, index) => chunkKey(stateKey, meta.generation, index)));
 	const chunks = [];
 	for (let index = 0; index < meta.chunkCount; index += 1) {
-		const chunk = store.lookup(chunkKey(stateKey, meta.generation, index));
+		const result = records?.[index];
+		if (result && !result.ok) throw result.error;
+		const chunk = records ? result?.value : store.lookup(chunkKey(stateKey, meta.generation, index));
 		if (!isSyncCacheChunk(chunk) || chunk.index !== index) return normalizePersistedStore({
 			version: 1,
 			savedSync: null,
@@ -191,9 +194,12 @@ async function hasMatrixSyncCacheStateInStore(params) {
 	const stateKey = SYNC_CACHE_STATE_KEY;
 	const meta = await params.store.lookup(metaKey(stateKey));
 	if (!isSyncCacheMeta(meta) || meta.chunkCount <= 0) return false;
+	const records = await params.store.lookupMany?.(Array.from({ length: meta.chunkCount }, (_, index) => chunkKey(stateKey, meta.generation, index)));
 	const chunks = [];
 	for (let index = 0; index < meta.chunkCount; index += 1) {
-		const chunk = await params.store.lookup(chunkKey(stateKey, meta.generation, index));
+		const result = records?.[index];
+		if (result && !result.ok) throw result.error;
+		const chunk = records ? result?.value : await params.store.lookup(chunkKey(stateKey, meta.generation, index));
 		if (!isSyncCacheChunk(chunk) || chunk.index !== index) return false;
 		chunks.push(chunk.data);
 	}

package/dist/{thread-bindings-DgxQEB99.js → thread-bindings-CRyf5on_.js}

@@ -1,7 +1,8 @@
 import { t as getMatrixRuntime } from "./runtime-6S3DNFNv.js";
 import { a as listBindingsForAccount, c as resolveEffectiveBindingExpiry, d as setMatrixThreadBindingManagerEntry, l as setBindingRecord, m as toSessionBindingRecord, o as removeBindingRecord, p as toMatrixBindingTargetKind, r as getMatrixThreadBindingManagerEntry, s as resolveBindingKey, t as deleteMatrixThreadBindingManagerEntry } from "./thread-bindings-shared-oNPiyMWY.js";
-import { M as resolveMatrixSqliteStateEnv, N as resolveMatrixSqliteStateKey, c as resolveMatrixStateFilePath, t as claimCurrentTokenStorageState } from "./storage-BVf4uucD.js";
-import { r as sendMessageMatrix } from "./send-DG7Bnj7_.js";
+import { A as resolveMatrixSqliteStateKey, k as resolveMatrixSqliteStateEnv } from "./storage-metadata-DYArLcq1.js";
+import { a as resolveMatrixStateFilePath, t as claimCurrentTokenStorageState } from "./storage-CV-pfV_2.js";
+import { r as sendMessageMatrix } from "./send-B9l1lKau.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import path from "node:path";

package/dist/{tool-actions.runtime-vbkQgU7D.js → tool-actions.runtime-D5-hTkDu.js}

@@ -1,16 +1,16 @@
 import { a as resolveMatrixAccountConfig, o as resolveMatrixBaseConfig } from "./account-config-CRsKoMqJ.js";
-import { i as resolveMatrixAccount } from "./accounts-DR1c4xF_.js";
-import { l as resolveMatrixRoomConfig } from "./channel-b-jES-oi.js";
+import { i as resolveMatrixAccount } from "./accounts-GwSAk9vY.js";
+import { a as resolveMatrixRoomConfig } from "./channel-BpYiqmx-.js";
 import { i as normalizeMatrixResolvableTarget } from "./target-ids-Nwx7cMVE.js";
-import { i as buildMatrixReactionRelationsPath, o as selectOwnMatrixReactionEventIds, s as summarizeMatrixReactionEvents } from "./reaction-common-DkrQdBSZ.js";
-import { b as resolveMatrixRoomId, h as parsePollStart, l as buildPollResponseContent, m as isPollStartType, n as reactMatrixMessage } from "./send-DG7Bnj7_.js";
+import { C as parsePollStart, O as resolveMatrixRoomId, S as isPollStartType, _ as buildPollResponseContent, n as reactMatrixMessage } from "./send-B9l1lKau.js";
 import { i as isStrictDirectMembership, n as hasDirectMatrixMemberFlag, o as readJoinedMatrixMembers } from "./direct-room-RinHjtqX.js";
-import { a as fetchEventSummary, i as sendMatrixMessage, n as editMatrixMessage, o as readPinnedEvents, p as resolveMatrixActionLimit, r as readMatrixMessages, s as EventType, t as deleteMatrixMessage } from "./messages-C1U3b1oN.js";
-import { n as withResolvedActionClient, r as withResolvedRoomAction } from "./client-D2utPQ1E.js";
-import { r as parseMxc } from "./event-helpers-XRfAbOIh.js";
-import { t as applyMatrixProfileUpdate } from "./profile-update-Cd1p8ABr.js";
-import { _ as scanMatrixVerificationQr, a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, h as restoreMatrixRoomKeyBackup, i as confirmMatrixVerificationReciprocateQr, l as getMatrixVerificationSas, n as bootstrapMatrixVerification, o as generateMatrixVerificationQr, p as requestMatrixVerification, r as cancelMatrixVerification, s as getMatrixEncryptionStatus, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-D-iOebn4.js";
-import { n as getMatrixMemberInfo, r as getMatrixRoomInfo, t as createMatrixRoomInfoResolver } from "./room-info-DVkKDscD.js";
+import { i as buildMatrixReactionRelationsPath, o as selectOwnMatrixReactionEventIds, s as summarizeMatrixReactionEvents } from "./reaction-common-DkrQdBSZ.js";
+import { i as parseMxc } from "./event-helpers-CspuhE9k.js";
+import { a as fetchEventSummary, c as resolveMatrixActionLimit, i as sendMatrixMessage, n as editMatrixMessage, o as readPinnedEvents, r as readMatrixMessages, s as EventType, t as deleteMatrixMessage } from "./messages-H4mi9Cap.js";
+import { n as withResolvedActionClient, r as withResolvedRoomAction } from "./client-BXQCQDfY.js";
+import { t as applyMatrixProfileUpdate } from "./profile-update-DWEg8Ylt.js";
+import { _ as scanMatrixVerificationQr, a as confirmMatrixVerificationSas, b as verifyMatrixRecoveryKey, c as getMatrixRoomKeyBackupStatus, d as listMatrixVerifications, f as mismatchMatrixVerificationSas, h as restoreMatrixRoomKeyBackup, i as confirmMatrixVerificationReciprocateQr, l as getMatrixVerificationSas, n as bootstrapMatrixVerification, o as generateMatrixVerificationQr, p as requestMatrixVerification, r as cancelMatrixVerification, s as getMatrixEncryptionStatus, t as acceptMatrixVerification, u as getMatrixVerificationStatus, v as startMatrixVerification } from "./verification-B_aqtbx-.js";
+import { n as getMatrixMemberInfo, r as getMatrixRoomInfo, t as createMatrixRoomInfoResolver } from "./room-info-CjnbX52D.js";
 import { isRecord, normalizeOptionalLowercaseString, uniqueStrings, uniqueValues } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { ToolAuthorizationError, createActionGate, jsonResult, readPositiveIntegerParam, readReactionParams, readStringArrayParam, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";

package/dist/types-DzSc7Sqm.js

@@ -0,0 +1,32 @@
+import { n as MATRIX_REACTION_EVENT_TYPE, t as MATRIX_ANNOTATION_RELATION_TYPE } from "./reaction-common-DkrQdBSZ.js";
+//#region extensions/matrix/src/matrix/send/types.ts
+const MsgType = {
+	Text: "m.text",
+	Image: "m.image",
+	Audio: "m.audio",
+	Video: "m.video",
+	File: "m.file",
+	Notice: "m.notice"
+};
+const RelationType = {
+	Annotation: MATRIX_ANNOTATION_RELATION_TYPE,
+	Replace: "m.replace",
+	Thread: "m.thread"
+};
+const EventType = {
+	Direct: "m.direct",
+	Reaction: MATRIX_REACTION_EVENT_TYPE,
+	RoomMessage: "m.room.message"
+};
+const MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY = "com.openclaw.finalized_preview";
+/**
+* MSC4357 live marker key.
+* When present on event content, signals that the message is still being
+* streamed (e.g. an LLM generating a response). Supporting clients render
+* the message with a streaming animation until an edit without this marker
+* arrives, indicating the stream is complete.
+* @see https://github.com/matrix-org/matrix-spec-proposals/pull/4357
+*/
+const MSC4357_LIVE_KEY = "org.matrix.msc4357.live";
+//#endregion
+export { RelationType as a, MsgType as i, MATRIX_OPENCLAW_FINALIZED_PREVIEW_KEY as n, MSC4357_LIVE_KEY as r, EventType as t };

package/dist/{verification-D-iOebn4.js → verification-B_aqtbx-.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { i as withStartedActionClient, n as withResolvedActionClient } from "./client-D2utPQ1E.js";
-import { n as formatMatrixEncryptionUnavailableError } from "./encryption-guidance-BNcZNQZI.js";
+import { i as withStartedActionClient, n as withResolvedActionClient } from "./client-BXQCQDfY.js";
+import { n as formatMatrixEncryptionUnavailableError } from "./encryption-guidance-mDyxJV9U.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { setTimeout } from "node:timers/promises";

package/node_modules/@matrix-org/matrix-sdk-crypto-wasm/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@matrix-org/matrix-sdk-crypto-wasm",
-    "version": "18.5.0",
+    "version": "18.7.0",
     "homepage": "https://github.com/matrix-org/matrix-sdk-crypto-wasm",
     "description": "WebAssembly bindings of the matrix-sdk-crypto encryption library",
     "license": "Apache-2.0",

package/node_modules/@matrix-org/matrix-sdk-crypto-wasm/pkg/matrix_sdk_crypto_wasm.d.ts

@@ -2445,9 +2445,19 @@ export class OlmMachine {
      *   certificates. These will be used to check X.509 signatures on user
      *   identities. Any user identity that has a valid signature according to
      *   the supplied CAs will be considered verified, without any manual
-     *   verification taking place. A PEM-formatted string.
+     *
+     * * `raw_x509_signer` - Optional async function for signing some data with
+     *   an X.509 certificate. Used to sign the user's identity so compatible
+     *   clients will recognise this user as verified without manual
+     *   verification taking place. If you supply this you must also supply
+     *   raw_x509_validity.
+     *
+     * * `raw_x509_validity` - Optional function returning the validity period
+     *   of the X.509 certificate used for signing, as the number of
+     *   milliseconds since the Unix epoch. If you supply this you must also
+     *   supply raw_x509_signer.
      */
-    static initFromStore(user_id: UserId, device_id: DeviceId, store_handle: StoreHandle, logger?: JsLogger, ca_certs_pem?: String): Promise<OlmMachine>;
+    static initFromStore(user_id: UserId, device_id: DeviceId, store_handle: StoreHandle, logger?: JsLogger, ca_certs_pem?: String, raw_x509_signer?: (item: Uint8Array) => Promise<{ signature_bytes: Uint8Array, certificate_chain: string }>, raw_x509_validity?: () => number): Promise<OlmMachine>;
     /**
      * Create a new `OlmMachine`.
      *
@@ -2479,8 +2489,19 @@ export class OlmMachine {
      *   identities. Any user identity that has a valid signature according to
      *   the supplied CAs will be considered verified, without any manual
      *   verification taking place. A PEM-formatted string.
+     *
+     * * `raw_x509_signer` - Optional async function for signing some data with
+     *   an X.509 certificate. Used to sign the user's identity so compatible
+     *   clients will recognise this user as verified without manual
+     *   verification taking place. If you supply this you must also supply
+     *   raw_x509_validity.
+     *
+     * * `raw_x509_validity` - Optional function returning the validity period
+     *   of the X.509 certificate used for signing, as the number of
+     *   milliseconds since the Unix epoch. If you supply this you must also
+     *   supply raw_x509_signer.
      */
-    static initialize(user_id: UserId, device_id: DeviceId, store_name?: string, store_passphrase?: string, logger?: JsLogger, ca_certs_pem?: String): Promise<OlmMachine>;
+    static initialize(user_id: UserId, device_id: DeviceId, store_name?: string, store_passphrase?: string, logger?: JsLogger, ca_certs_pem?: String, raw_x509_signer?: (item: Uint8Array) => Promise<{ signature_bytes: Uint8Array, certificate_chain: string }>, raw_x509_validity?: () => number): Promise<OlmMachine>;
     /**
      * Invalidate the currently active outbound group session for the
      * given room.
@@ -2597,7 +2618,11 @@ export class OlmMachine {
      *   `/sync` response
      * * `one_time_keys_counts`: The number of one-time keys on the server,
      *   from the `/sync` response. A `Map` from string (encryption algorithm)
-     *   to number (number of keys).
+     *   to number (number of keys). Following the sync v2 semantics, a missing
+     *   entry for an algorithm means that there are *zero* keys of that type
+     *   on the server. If the caller has no information about the key counts
+     *   (for example, because it is processing only part of a sync response),
+     *   it should use {@link receiveSyncChangesMsc4186} instead.
      * * `unused_fallback_keys`: Optionally, a `Set` of unused fallback keys on
      *   the server, from the `/sync` response. If this is set, it is used to
      *   determine if new fallback keys should be uploaded.
@@ -2614,6 +2639,46 @@ export class OlmMachine {
      *   * {@link InvalidToDeviceEvent}
      */
     receiveSyncChanges(to_device_events: string, changed_devices: DeviceLists, one_time_keys_counts: Map<string, number>, unused_fallback_keys?: Set<string>, decryption_settings?: DecryptionSettings): Promise<ProcessedToDeviceEvent[]>;
+    /**
+     * Handle the changes to the end-to-end encryption state we received from
+     * a [MSC4186](https://github.com/matrix-org/matrix-spec-proposals/pull/4186)
+     * (simplified sliding sync) response.
+     *
+     * This behaves exactly like {@link receiveSyncChanges}, except for the
+     * handling of `one_time_keys_counts`: under MSC4186 semantics, a missing
+     * entry for an algorithm means that the number of keys on the server is
+     * *unchanged*, rather than zero.
+     *
+     * This is therefore also the method to use when the caller has no
+     * information about the one-time key counts, for example because it is
+     * processing only the to-device events or the device list changes from a
+     * sync response.
+     *
+     * # Arguments
+     *
+     * * `to_device_events`: the JSON-encoded to-device events from the sync
+     *   response
+     * * `changed_devices`: the mapping of changed and left devices, from the
+     *   sync response
+     * * `one_time_keys_counts`: The number of one-time keys on the server,
+     *   from the sync response. A `Map` from string (encryption algorithm) to
+     *   number (number of keys). A missing entry means "unchanged".
+     * * `unused_fallback_keys`: Optionally, a `Set` of unused fallback keys on
+     *   the server, from the sync response. If this is set, it is used to
+     *   determine if new fallback keys should be uploaded.
+     * * `decryption_settings`: Optionally, the settings to use when decrypting
+     *   to-device events. If not set, to-device events will be decrypted with
+     *   a {@link TrustRequirement} of `Untrusted`.
+     *
+     * # Returns
+     *
+     * A list of values, each of which can be any of:
+     *   * {@link DecryptedToDeviceEvent}
+     *   * {@link PlainTextToDeviceEvent}
+     *   * {@link UTDToDeviceEvent}
+     *   * {@link InvalidToDeviceEvent}
+     */
+    receiveSyncChangesMsc4186(to_device_events: string, changed_devices: DeviceLists, one_time_keys_counts: Map<string, number>, unused_fallback_keys?: Set<string>, decryption_settings?: DecryptionSettings): Promise<ProcessedToDeviceEvent[]>;
     /**
      * Receive a verification event.
      *