diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256
index 1b1467396fd..8e5ba1621dc 100644
--- a/docs/.generated/plugin-sdk-api-baseline.sha256
+++ b/docs/.generated/plugin-sdk-api-baseline.sha256
@@ -1,2 +1,2 @@
-6820a26fa0570caae81669337ec98f4946c096036e5603248c71a7afa4cb12a1  plugin-sdk-api-baseline.json
-a3959468d81184676d92af7f8958c680ce351ac81d4bafade4428b0cb9609e65  plugin-sdk-api-baseline.jsonl
+4eb7cd87196b34b76c8f5d296debe78407ff5a4b8e6867c8e8feb19aabd668cf  plugin-sdk-api-baseline.json
+ec4c861295450c09889ce5154371686cf68fdc6e3be479ce0c4bc4eeaa38b00b  plugin-sdk-api-baseline.jsonl
diff --git a/extensions/msteams/runtime-api.ts b/extensions/msteams/runtime-api.ts
index bb71ffb851e..0bb70455017 100644
--- a/extensions/msteams/runtime-api.ts
+++ b/extensions/msteams/runtime-api.ts
@@ -1,5 +1,75 @@
 // Private runtime barrel for the bundled Microsoft Teams extension.
 // Keep this barrel thin and aligned with the local extension surface.
 
-export * from "openclaw/plugin-sdk/msteams";
+export { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
+export type { AllowlistMatch } from "openclaw/plugin-sdk/allow-from";
+export {
+  mergeAllowlist,
+  resolveAllowlistMatchSimple,
+  summarizeMapping,
+} from "openclaw/plugin-sdk/allow-from";
+export type {
+  BaseProbeResult,
+  ChannelDirectoryEntry,
+  ChannelGroupContext,
+  ChannelMessageActionName,
+  ChannelOutboundAdapter,
+} from "openclaw/plugin-sdk/channel-contract";
+export type { ChannelPlugin } from "openclaw/plugin-sdk/channel-core";
+export { logTypingFailure } from "openclaw/plugin-sdk/channel-logging";
+export { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
+export {
+  evaluateSenderGroupAccessForPolicy,
+  readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithLists,
+  resolveEffectiveAllowFromLists,
+  resolveSenderScopedGroupPolicy,
+  resolveToolsBySender,
+} from "openclaw/plugin-sdk/channel-policy";
+export { createChannelReplyPipeline } from "openclaw/plugin-sdk/channel-reply-pipeline";
+export {
+  PAIRING_APPROVED_MESSAGE,
+  buildProbeChannelStatusSummary,
+  createDefaultChannelRuntimeState,
+} from "openclaw/plugin-sdk/channel-status";
+export {
+  buildChannelKeyCandidates,
+  normalizeChannelSlug,
+  resolveChannelEntryMatchWithFallback,
+  resolveNestedAllowlistDecision,
+} from "openclaw/plugin-sdk/channel-targets";
+export type {
+  GroupPolicy,
+  GroupToolPolicyConfig,
+  MSTeamsChannelConfig,
+  MSTeamsConfig,
+  MSTeamsReplyStyle,
+  MSTeamsTeamConfig,
+  MarkdownTableMode,
+  OpenClawConfig,
+} from "openclaw/plugin-sdk/config-runtime";
+export {
+  isDangerousNameMatchingEnabled,
+  resolveDefaultGroupPolicy,
+} from "openclaw/plugin-sdk/config-runtime";
+export { withFileLock } from "openclaw/plugin-sdk/file-lock";
+export { keepHttpServerTaskAlive } from "openclaw/plugin-sdk/channel-lifecycle";
+export {
+  detectMime,
+  extensionForMime,
+  extractOriginalFilename,
+  getFileExtension,
+  resolveChannelMediaMaxBytes,
+} from "openclaw/plugin-sdk/media-runtime";
+export { dispatchReplyFromConfigWithSettledDispatcher } from "openclaw/plugin-sdk/inbound-reply-dispatch";
+export { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
+export { buildMediaPayload } from "openclaw/plugin-sdk/reply-payload";
+export type { ReplyPayload } from "openclaw/plugin-sdk/reply-payload";
+export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
+export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+export type { SsrFPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
+export { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+export { normalizeStringEntries } from "openclaw/plugin-sdk/string-normalization-runtime";
+export { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
+export { DEFAULT_WEBHOOK_MAX_BODY_BYTES } from "openclaw/plugin-sdk/webhook-ingress";
 export { setMSTeamsRuntime } from "./src/runtime.js";
diff --git a/extensions/msteams/src/messenger.test.ts b/extensions/msteams/src/messenger.test.ts
index 455a5e21091..eae2a4566cc 100644
--- a/extensions/msteams/src/messenger.test.ts
+++ b/extensions/msteams/src/messenger.test.ts
@@ -1,6 +1,7 @@
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { SILENT_REPLY_TOKEN, type PluginRuntime } from "openclaw/plugin-sdk/msteams";
+import { SILENT_REPLY_TOKEN } from "openclaw/plugin-sdk/reply-chunking";
+import type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { resolvePreferredOpenClawTmpDir } from "../../../src/infra/tmp-openclaw-dir.js";
 import type { StoredConversationReference } from "./conversation-store.js";
diff --git a/extensions/msteams/src/send.test.ts b/extensions/msteams/src/send.test.ts
index d3b5baafcab..c0b37dfafd1 100644
--- a/extensions/msteams/src/send.test.ts
+++ b/extensions/msteams/src/send.test.ts
@@ -19,7 +19,7 @@ const mockState = vi.hoisted(() => ({
   buildTeamsFileInfoCard: vi.fn(),
 }));
 
-vi.mock("openclaw/plugin-sdk/msteams", () => ({
+vi.mock("openclaw/plugin-sdk/outbound-media", () => ({
   loadOutboundMediaFromUrl: mockState.loadOutboundMediaFromUrl,
 }));
 
diff --git a/extensions/nextcloud-talk/runtime-api.ts b/extensions/nextcloud-talk/runtime-api.ts
index de22ca71abb..98fbf11fb8e 100644
--- a/extensions/nextcloud-talk/runtime-api.ts
+++ b/extensions/nextcloud-talk/runtime-api.ts
@@ -1,5 +1,33 @@
 // Private runtime barrel for the bundled Nextcloud Talk extension.
 // Keep this barrel thin and aligned with the local extension surface.
 
-export * from "openclaw/plugin-sdk/nextcloud-talk";
+export type { AllowlistMatch } from "openclaw/plugin-sdk/allow-from";
+export type { ChannelGroupContext } from "openclaw/plugin-sdk/channel-contract";
+export { logInboundDrop } from "openclaw/plugin-sdk/channel-logging";
+export { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
+export {
+  readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithCommandGate,
+} from "openclaw/plugin-sdk/channel-policy";
+export type {
+  BlockStreamingCoalesceConfig,
+  DmConfig,
+  DmPolicy,
+  GroupPolicy,
+  GroupToolPolicyConfig,
+  OpenClawConfig,
+} from "openclaw/plugin-sdk/config-runtime";
+export {
+  GROUP_POLICY_BLOCKED_LABEL,
+  resolveAllowlistProviderRuntimeGroupPolicy,
+  resolveDefaultGroupPolicy,
+  warnMissingProviderGroupPolicyFallbackOnce,
+} from "openclaw/plugin-sdk/config-runtime";
+export { dispatchInboundReplyWithBase } from "openclaw/plugin-sdk/inbound-reply-dispatch";
+export type { OutboundReplyPayload } from "openclaw/plugin-sdk/reply-payload";
+export { deliverFormattedTextWithAttachments } from "openclaw/plugin-sdk/reply-payload";
+export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
+export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+export type { SecretInput } from "openclaw/plugin-sdk/secret-input";
+export { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 export { setNextcloudTalkRuntime } from "./src/runtime.js";
diff --git a/extensions/nextcloud-talk/src/api.ts b/extensions/nextcloud-talk/src/api.ts
index 06ea03cf295..6048b406c0a 100644
--- a/extensions/nextcloud-talk/src/api.ts
+++ b/extensions/nextcloud-talk/src/api.ts
@@ -1 +1 @@
-export { createAuthRateLimiter } from "openclaw/plugin-sdk/nextcloud-talk";
+export { createAuthRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
diff --git a/extensions/nostr/runtime-api.ts b/extensions/nostr/runtime-api.ts
index 29825771891..77ac75ff302 100644
--- a/extensions/nostr/runtime-api.ts
+++ b/extensions/nostr/runtime-api.ts
@@ -1,4 +1,6 @@
 // Private runtime barrel for the bundled Nostr extension.
 // Keep this barrel thin and aligned with the local extension surface.
 
-export * from "openclaw/plugin-sdk/nostr";
+export type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
+export { getPluginRuntimeGatewayRequestScope } from "openclaw/plugin-sdk/plugin-runtime";
+export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
diff --git a/extensions/twitch/runtime-api.ts b/extensions/twitch/runtime-api.ts
index 87433b1997f..296b534afe6 100644
--- a/extensions/twitch/runtime-api.ts
+++ b/extensions/twitch/runtime-api.ts
@@ -1,4 +1,22 @@
 // Private runtime barrel for the bundled Twitch extension.
 // Keep this barrel thin and aligned with the local extension surface.
 
-export * from "openclaw/plugin-sdk/twitch";
+export type {
+  ChannelAccountSnapshot,
+  ChannelCapabilities,
+  ChannelGatewayContext,
+  ChannelLogSink,
+  ChannelMessageActionAdapter,
+  ChannelMessageActionContext,
+  ChannelMeta,
+  ChannelOutboundAdapter,
+  ChannelOutboundContext,
+  ChannelResolveKind,
+  ChannelResolveResult,
+  ChannelStatusAdapter,
+} from "openclaw/plugin-sdk/channel-contract";
+export type { ChannelPlugin } from "openclaw/plugin-sdk/channel-core";
+export type { OutboundDeliveryResult } from "openclaw/plugin-sdk/channel-send-result";
+export type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
+export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+export type { WizardPrompter } from "openclaw/plugin-sdk/setup";
diff --git a/extensions/voice-call/runtime-api.ts b/extensions/voice-call/runtime-api.ts
index 9dd4fb0f3bc..fdf6e27aad1 100644
--- a/extensions/voice-call/runtime-api.ts
+++ b/extensions/voice-call/runtime-api.ts
@@ -1,4 +1,20 @@
 // Private runtime barrel for the bundled Voice Call extension.
 // Keep this barrel thin and aligned with the local extension surface.
 
-export * from "openclaw/plugin-sdk/voice-call";
+export { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+export type { OpenClawPluginApi } from "openclaw/plugin-sdk/plugin-entry";
+export type { GatewayRequestHandlerOptions } from "openclaw/plugin-sdk/gateway-runtime";
+export {
+  isRequestBodyLimitError,
+  readRequestBodyWithLimit,
+  requestBodyErrorToText,
+} from "openclaw/plugin-sdk/webhook-request-guards";
+export { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
+export type { SessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+export {
+  TtsAutoSchema,
+  TtsConfigSchema,
+  TtsModeSchema,
+  TtsProviderSchema,
+} from "openclaw/plugin-sdk/tts-runtime";
+export { sleep } from "openclaw/plugin-sdk/runtime-env";
diff --git a/src/plugin-sdk/channel-contract.ts b/src/plugin-sdk/channel-contract.ts
index df83d66dd30..3c962d855eb 100644
--- a/src/plugin-sdk/channel-contract.ts
+++ b/src/plugin-sdk/channel-contract.ts
@@ -7,16 +7,19 @@ export type {
   ChannelApprovalAdapter,
   ChannelApprovalCapability,
   ChannelCommandConversationContext,
+  ChannelCapabilities,
   ChannelDirectoryEntry,
   ChannelResolveKind,
   ChannelResolveResult,
   ChannelGroupContext,
+  ChannelLogSink,
   ChannelMessageActionAdapter,
   ChannelMessageActionContext,
   ChannelMessageActionDiscoveryContext,
   ChannelMessageActionName,
   ChannelMessageToolDiscovery,
   ChannelMessageToolSchemaContribution,
+  ChannelMeta,
   ChannelStructuredComponents,
   ChannelStatusIssue,
   ChannelThreadingContext,
@@ -34,5 +37,7 @@ export type {
   ChannelDoctorSequenceResult,
   ChannelGatewayContext,
   ChannelOutboundAdapter,
+  ChannelOutboundContext,
+  ChannelStatusAdapter,
 } from "../channels/plugins/types.adapters.js";
 export type { ChannelRuntimeSurface } from "../channels/plugins/channel-runtime-surface.types.js";
diff --git a/src/plugin-sdk/channel-policy.ts b/src/plugin-sdk/channel-policy.ts
index 360e3b85784..87ad49a8ffe 100644
--- a/src/plugin-sdk/channel-policy.ts
+++ b/src/plugin-sdk/channel-policy.ts
@@ -43,11 +43,13 @@ export {
 export {
   DM_GROUP_ACCESS_REASON,
   readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithCommandGate,
   resolveDmGroupAccessWithLists,
   resolveEffectiveAllowFromLists,
 } from "../security/dm-policy-shared.js";
 export {
   evaluateGroupRouteAccessForPolicy,
+  evaluateSenderGroupAccessForPolicy,
   resolveSenderScopedGroupPolicy,
 } from "./group-access.js";
 export { createAllowlistProviderRestrictSendersWarningCollector };
diff --git a/src/plugin-sdk/channel-send-result.ts b/src/plugin-sdk/channel-send-result.ts
index 0ee291212a0..2046ad85b5f 100644
--- a/src/plugin-sdk/channel-send-result.ts
+++ b/src/plugin-sdk/channel-send-result.ts
@@ -3,6 +3,7 @@ import type { ChannelPollResult } from "../channels/plugins/types.public.js";
 import type { OutboundDeliveryResult } from "../infra/outbound/deliver.js";
 
 export type { ChannelOutboundAdapter } from "../channels/plugins/outbound.types.js";
+export type { OutboundDeliveryResult } from "../infra/outbound/deliver.js";
 export type ChannelSendRawResult = {
   ok: boolean;
   messageId?: string | null;
diff --git a/src/plugin-sdk/config-runtime.ts b/src/plugin-sdk/config-runtime.ts
index 5ea45d225b1..cb192333fbd 100644
--- a/src/plugin-sdk/config-runtime.ts
+++ b/src/plugin-sdk/config-runtime.ts
@@ -70,6 +70,7 @@ export { resolveMarkdownTableMode } from "../config/markdown-tables.js";
 export {
   resolveChannelGroupPolicy,
   resolveChannelGroupRequireMention,
+  resolveToolsBySender,
   type ChannelGroupPolicy,
 } from "../config/group-policy.js";
 export {
@@ -118,6 +119,10 @@ export type {
   GroupToolPolicyConfig,
   MarkdownConfig,
   MarkdownTableMode,
+  MSTeamsChannelConfig,
+  MSTeamsConfig,
+  MSTeamsReplyStyle,
+  MSTeamsTeamConfig,
   OpenClawConfig,
   ReplyToMode,
   SignalReactionNotificationMode,
diff --git a/src/plugin-sdk/plugin-runtime.ts b/src/plugin-sdk/plugin-runtime.ts
index 20bea8fee3a..84c43b6f28b 100644
--- a/src/plugin-sdk/plugin-runtime.ts
+++ b/src/plugin-sdk/plugin-runtime.ts
@@ -8,4 +8,5 @@ export * from "../plugins/interactive-binding-helpers.js";
 export * from "../plugins/interactive.js";
 export * from "../plugins/lazy-service-module.js";
 export * from "../plugins/types.js";
+export { getPluginRuntimeGatewayRequestScope } from "../plugins/runtime/gateway-request-scope.js";
 export type { PluginRuntime, RuntimeLogger } from "../plugins/runtime/types.js";
diff --git a/src/plugin-sdk/session-store-runtime.ts b/src/plugin-sdk/session-store-runtime.ts
index 6f1ab218563..0e5ed35eb80 100644
--- a/src/plugin-sdk/session-store-runtime.ts
+++ b/src/plugin-sdk/session-store-runtime.ts
@@ -4,3 +4,4 @@ export { loadSessionStore } from "../config/sessions/store-load.js";
 export { resolveSessionStoreEntry } from "../config/sessions/store-entry.js";
 export { resolveStorePath } from "../config/sessions/paths.js";
 export { readSessionUpdatedAt } from "../config/sessions/store.js";
+export type { SessionEntry } from "../config/sessions/types.js";
diff --git a/src/plugin-sdk/tts-runtime.ts b/src/plugin-sdk/tts-runtime.ts
index c8ce751718b..57c10f98dae 100644
--- a/src/plugin-sdk/tts-runtime.ts
+++ b/src/plugin-sdk/tts-runtime.ts
@@ -13,6 +13,12 @@ import type {
   TtsSynthesisResult,
   TtsTelephonyResult,
 } from "./tts-runtime.types.js";
+export {
+  TtsAutoSchema,
+  TtsConfigSchema,
+  TtsModeSchema,
+  TtsProviderSchema,
+} from "../config/zod-schema.core.js";
 
 // Manual facade. Keep loader boundary explicit and avoid typing this public SDK
 // seam through the bundled speech-core runtime surface.
diff --git a/src/plugin-sdk/webhook-ingress.ts b/src/plugin-sdk/webhook-ingress.ts
index 12b46afbcaf..1e5c26ab361 100644
--- a/src/plugin-sdk/webhook-ingress.ts
+++ b/src/plugin-sdk/webhook-ingress.ts
@@ -44,3 +44,4 @@ export { resolveRequestClientIp } from "../gateway/net.js";
 export { createAuthRateLimiter } from "../gateway/auth-rate-limit.js";
 export type { AuthRateLimiter, RateLimitConfig } from "../gateway/auth-rate-limit.js";
 export { normalizePluginHttpPath } from "../plugins/http-path.js";
+export { DEFAULT_WEBHOOK_MAX_BODY_BYTES } from "../infra/http-body.js";
diff --git a/src/plugins/contracts/plugin-sdk-runtime-api-guardrails.test.ts b/src/plugins/contracts/plugin-sdk-runtime-api-guardrails.test.ts
index 63b1a73f679..55a57379222 100644
--- a/src/plugins/contracts/plugin-sdk-runtime-api-guardrails.test.ts
+++ b/src/plugins/contracts/plugin-sdk-runtime-api-guardrails.test.ts
@@ -81,6 +81,36 @@ const RUNTIME_API_EXPORT_GUARDS: Record<string, readonly string[]> = {
     'export { createWebhookInFlightLimiter, readJsonWebhookBodyOrReject, type WebhookInFlightLimiter } from "openclaw/plugin-sdk/webhook-request-guards";',
     'export { setGoogleChatRuntime } from "./src/runtime.js";',
   ],
+  [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "msteams", relativePath: "runtime-api.ts" })]: [
+    'export { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";',
+    'export type { AllowlistMatch } from "openclaw/plugin-sdk/allow-from";',
+    'export { mergeAllowlist, resolveAllowlistMatchSimple, summarizeMapping } from "openclaw/plugin-sdk/allow-from";',
+    'export type { BaseProbeResult, ChannelDirectoryEntry, ChannelGroupContext, ChannelMessageActionName, ChannelOutboundAdapter } from "openclaw/plugin-sdk/channel-contract";',
+    'export type { ChannelPlugin } from "openclaw/plugin-sdk/channel-core";',
+    'export { logTypingFailure } from "openclaw/plugin-sdk/channel-logging";',
+    'export { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";',
+    'export { evaluateSenderGroupAccessForPolicy, readStoreAllowFromForDmPolicy, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveSenderScopedGroupPolicy, resolveToolsBySender } from "openclaw/plugin-sdk/channel-policy";',
+    'export { createChannelReplyPipeline } from "openclaw/plugin-sdk/channel-reply-pipeline";',
+    'export { PAIRING_APPROVED_MESSAGE, buildProbeChannelStatusSummary, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/channel-status";',
+    'export { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback, resolveNestedAllowlistDecision } from "openclaw/plugin-sdk/channel-targets";',
+    'export type { GroupPolicy, GroupToolPolicyConfig, MSTeamsChannelConfig, MSTeamsConfig, MSTeamsReplyStyle, MSTeamsTeamConfig, MarkdownTableMode, OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";',
+    'export { isDangerousNameMatchingEnabled, resolveDefaultGroupPolicy } from "openclaw/plugin-sdk/config-runtime";',
+    'export { withFileLock } from "openclaw/plugin-sdk/file-lock";',
+    'export { keepHttpServerTaskAlive } from "openclaw/plugin-sdk/channel-lifecycle";',
+    'export { detectMime, extensionForMime, extractOriginalFilename, getFileExtension, resolveChannelMediaMaxBytes } from "openclaw/plugin-sdk/media-runtime";',
+    'export { dispatchReplyFromConfigWithSettledDispatcher } from "openclaw/plugin-sdk/inbound-reply-dispatch";',
+    'export { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";',
+    'export { buildMediaPayload } from "openclaw/plugin-sdk/reply-payload";',
+    'export type { ReplyPayload } from "openclaw/plugin-sdk/reply-payload";',
+    'export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";',
+    'export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";',
+    'export type { SsrFPolicy } from "openclaw/plugin-sdk/ssrf-runtime";',
+    'export { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";',
+    'export { normalizeStringEntries } from "openclaw/plugin-sdk/string-normalization-runtime";',
+    'export { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";',
+    'export { DEFAULT_WEBHOOK_MAX_BODY_BYTES } from "openclaw/plugin-sdk/webhook-ingress";',
+    'export { setMSTeamsRuntime } from "./src/runtime.js";',
+  ],
   [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "irc", relativePath: "runtime-api.ts" })]: [
     'export { setIrcRuntime } from "./src/runtime.js";',
   ],
@@ -104,9 +134,27 @@ const RUNTIME_API_EXPORT_GUARDS: Record<string, readonly string[]> = {
     pluginId: "nextcloud-talk",
     relativePath: "runtime-api.ts",
   })]: [
-    'export * from "openclaw/plugin-sdk/nextcloud-talk";',
+    'export type { AllowlistMatch } from "openclaw/plugin-sdk/allow-from";',
+    'export type { ChannelGroupContext } from "openclaw/plugin-sdk/channel-contract";',
+    'export { logInboundDrop } from "openclaw/plugin-sdk/channel-logging";',
+    'export { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";',
+    'export { readStoreAllowFromForDmPolicy, resolveDmGroupAccessWithCommandGate } from "openclaw/plugin-sdk/channel-policy";',
+    'export type { BlockStreamingCoalesceConfig, DmConfig, DmPolicy, GroupPolicy, GroupToolPolicyConfig, OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";',
+    'export { GROUP_POLICY_BLOCKED_LABEL, resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/config-runtime";',
+    'export { dispatchInboundReplyWithBase } from "openclaw/plugin-sdk/inbound-reply-dispatch";',
+    'export type { OutboundReplyPayload } from "openclaw/plugin-sdk/reply-payload";',
+    'export { deliverFormattedTextWithAttachments } from "openclaw/plugin-sdk/reply-payload";',
+    'export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";',
+    'export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";',
+    'export type { SecretInput } from "openclaw/plugin-sdk/secret-input";',
+    'export { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";',
     'export { setNextcloudTalkRuntime } from "./src/runtime.js";',
   ],
+  [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "nostr", relativePath: "runtime-api.ts" })]: [
+    'export type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";',
+    'export { getPluginRuntimeGatewayRequestScope } from "openclaw/plugin-sdk/plugin-runtime";',
+    'export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";',
+  ],
   [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "signal", relativePath: "runtime-api.ts" })]: [
     'export * from "./src/runtime-api.js";',
     'export { setSignalRuntime } from "./src/runtime.js";',
@@ -156,6 +204,28 @@ const RUNTIME_API_EXPORT_GUARDS: Record<string, readonly string[]> = {
       'export { parseTelegramTopicConversation } from "./src/topic-conversation.js";',
       'export { resolveTelegramPollVisibility } from "./src/poll-visibility.js";',
     ],
+  [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "twitch", relativePath: "runtime-api.ts" })]: [
+    'export type { ChannelAccountSnapshot, ChannelCapabilities, ChannelGatewayContext, ChannelLogSink, ChannelMessageActionAdapter, ChannelMessageActionContext, ChannelMeta, ChannelOutboundAdapter, ChannelOutboundContext, ChannelResolveKind, ChannelResolveResult, ChannelStatusAdapter } from "openclaw/plugin-sdk/channel-contract";',
+    'export type { ChannelPlugin } from "openclaw/plugin-sdk/channel-core";',
+    'export type { OutboundDeliveryResult } from "openclaw/plugin-sdk/channel-send-result";',
+    'export type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";',
+    'export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";',
+    'export type { WizardPrompter } from "openclaw/plugin-sdk/setup";',
+  ],
+  [bundledPluginFile({
+    rootDir: ROOT_DIR,
+    pluginId: "voice-call",
+    relativePath: "runtime-api.ts",
+  })]: [
+    'export { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";',
+    'export type { OpenClawPluginApi } from "openclaw/plugin-sdk/plugin-entry";',
+    'export type { GatewayRequestHandlerOptions } from "openclaw/plugin-sdk/gateway-runtime";',
+    'export { isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-request-guards";',
+    'export { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";',
+    'export type { SessionEntry } from "openclaw/plugin-sdk/session-store-runtime";',
+    'export { TtsAutoSchema, TtsConfigSchema, TtsModeSchema, TtsProviderSchema } from "openclaw/plugin-sdk/tts-runtime";',
+    'export { sleep } from "openclaw/plugin-sdk/runtime-env";',
+  ],
   [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "whatsapp", relativePath: "runtime-api.ts" })]:
     [
       'export * from "./src/active-listener.js";',
@@ -239,6 +309,24 @@ describe("runtime api guardrails", () => {
     }
   });
 
+  it("keeps bundled runtime api barrels off their own branded sdk facades", () => {
+    for (const [pluginId, rootDir] of getBundledPluginRoots().entries()) {
+      const path = resolve(rootDir, "runtime-api.ts");
+      if (!existsSync(path)) {
+        continue;
+      }
+      const source = readFileSync(path, "utf8");
+      expect(
+        source,
+        `${pluginId} runtime api should use generic sdk subpaths or local exports`,
+      ).not.toContain(`"openclaw/plugin-sdk/${pluginId}"`);
+      expect(
+        source,
+        `${pluginId} runtime api should use generic sdk subpaths or local exports`,
+      ).not.toContain(`'openclaw/plugin-sdk/${pluginId}'`);
+    }
+  });
+
   it("keeps Slack's narrow runtime-setter entrypoint pinned to a single export", () => {
     // Regression for #69317. The bundled channel entry's runtime.specifier
     // now points at runtime-setter-api.ts. The whole point of that file is