refactor: narrow extension runtime api barrels

extensions/browser/runtime-api.ts

@@ -1,5 +1,84 @@
 export { createBrowserTool } from "./src/browser-tool.js";
-export * from "./src/browser-runtime.js";
+export {
+  applyBrowserProxyPaths,
+  browserAct,
+  browserArmDialog,
+  browserArmFileChooser,
+  type BrowserBridge,
+  browserCloseTab,
+  browserConsoleMessages,
+  browserCreateProfile,
+  type BrowserCreateProfileResult,
+  browserDeleteProfile,
+  type BrowserDeleteProfileResult,
+  browserDoctor,
+  type BrowserDoctorCheck,
+  type BrowserDoctorReport,
+  type BrowserExecutable,
+  browserFocusTab,
+  type BrowserFormField,
+  browserNavigate,
+  browserOpenTab,
+  browserPdfSave,
+  browserProfiles,
+  browserResetProfile,
+  type BrowserResetProfileResult,
+  type BrowserRouteRegistrar,
+  browserScreenshotAction,
+  type BrowserServerState,
+  browserSnapshot,
+  browserStart,
+  browserStatus,
+  type BrowserStatus,
+  browserStop,
+  type BrowserTab,
+  browserTabAction,
+  browserTabs,
+  type BrowserTransport,
+  closeTrackedBrowserTabsForSessions,
+  createBrowserControlContext,
+  createBrowserRouteContext,
+  createBrowserRouteDispatcher,
+  createBrowserRuntimeState,
+  DEFAULT_AI_SNAPSHOT_MAX_CHARS,
+  DEFAULT_BROWSER_EVALUATE_ENABLED,
+  DEFAULT_OPENCLAW_BROWSER_COLOR,
+  DEFAULT_OPENCLAW_BROWSER_PROFILE_NAME,
+  DEFAULT_UPLOAD_DIR,
+  ensureBrowserControlAuth,
+  getBrowserControlState,
+  getBrowserProfileCapabilities,
+  installBrowserAuthMiddleware,
+  installBrowserCommonMiddleware,
+  isPersistentBrowserProfileMutation,
+  movePathToTrash,
+  normalizeBrowserFormField,
+  normalizeBrowserFormFieldValue,
+  normalizeBrowserRequestPath,
+  parseBrowserMajorVersion,
+  persistBrowserProxyFiles,
+  type ProfileStatus,
+  readBrowserVersion,
+  redactCdpUrl,
+  registerBrowserRoutes,
+  resolveBrowserConfig,
+  resolveBrowserControlAuth,
+  type ResolvedBrowserConfig,
+  type ResolvedBrowserProfile,
+  resolveExistingPathsWithinRoot,
+  resolveGoogleChromeExecutableForPlatform,
+  resolveProfile,
+  resolveRequestedBrowserProfile,
+  runBrowserProxyCommand,
+  type SnapshotResult,
+  startBrowserBridgeServer,
+  startBrowserControlServiceFromConfig,
+  stopBrowserBridgeServer,
+  stopBrowserControlService,
+  stopBrowserRuntime,
+  trackSessionBrowserTab,
+  untrackSessionBrowserTab,
+} from "./src/browser-runtime.js";
 export { registerBrowserCli } from "./src/cli/browser-cli.js";
 export { createBrowserPluginService } from "./src/plugin-service.js";
 export { handleBrowserGatewayRequest } from "./src/gateway/browser-request.js";

extensions/line/runtime-api.ts

@@ -48,28 +48,87 @@ export {
 } from "./src/send.js";
 export { monitorLineProvider } from "./src/monitor.js";
 export { hasLineDirectives, parseLineDirectives } from "./src/reply-payload-transform.js";
-
-export * from "./src/accounts.js";
-export * from "./src/bot-access.js";
-export * from "./src/channel-access-token.js";
-export * from "./src/config-schema.js";
-export * from "./src/download.js";
-export * from "./src/group-keys.js";
-export * from "./src/markdown-to-line.js";
-export * from "./src/probe.js";
-export * from "./src/reply-payload-transform.js";
-export * from "./src/send.js";
-export * from "./src/signature.js";
-export * from "./src/template-messages.js";
+export {
+  listLineAccountIds,
+  normalizeAccountId,
+  resolveDefaultLineAccountId,
+  resolveLineAccount,
+} from "./src/accounts.js";
+export { type NormalizedAllowFrom } from "./src/bot-access.js";
+export { resolveLineChannelAccessToken } from "./src/channel-access-token.js";
+export {
+  LineChannelConfigSchema,
+  LineConfigSchema,
+  type LineConfigSchemaType,
+} from "./src/config-schema.js";
+export {
+  resolveExactLineGroupConfigKey,
+  resolveLineGroupConfigEntry,
+  resolveLineGroupLookupIds,
+  resolveLineGroupsConfig,
+} from "./src/group-keys.js";
+export {
+  type CodeBlock,
+  convertCodeBlockToFlexBubble,
+  convertLinksToFlexBubble,
+  convertTableToFlexBubble,
+  extractCodeBlocks,
+  extractLinks,
+  extractMarkdownTables,
+  hasMarkdownToConvert,
+  type MarkdownLink,
+  type MarkdownTable,
+  type ProcessedLineMessage,
+  processLineMessage,
+  stripMarkdown,
+} from "./src/markdown-to-line.js";
+export {
+  createAudioMessage,
+  createFlexMessage,
+  createImageMessage,
+  createLocationMessage,
+  createTextMessageWithQuickReplies,
+  createVideoMessage,
+  getUserDisplayName,
+  getUserProfile,
+  pushImageMessage,
+  replyMessageLine,
+  showLoadingAnimation,
+} from "./src/send.js";
+export { validateLineSignature } from "./src/signature.js";
+export {
+  type ButtonsTemplate,
+  type CarouselColumn,
+  type CarouselTemplate,
+  type ConfirmTemplate,
+  createButtonMenu,
+  createButtonTemplate,
+  createCarouselColumn,
+  createConfirmTemplate,
+  createImageCarousel,
+  createImageCarouselColumn,
+  createLinkMenu,
+  createProductCarousel,
+  createTemplateCarousel,
+  createYesNoConfirm,
+  type ImageCarouselColumn,
+  type ImageCarouselTemplate,
+  type TemplateMessage,
+} from "./src/template-messages.js";
 export type {
   LineChannelData,
   LineConfig,
   LineProbeResult,
   ResolvedLineAccount,
 } from "./src/types.js";
-export * from "./src/webhook-node.js";
-export * from "./src/webhook.js";
-export * from "./src/webhook-utils.js";
+export { createLineNodeWebhookHandler, readLineWebhookRequestBody } from "./src/webhook-node.js";
+export {
+  createLineWebhookMiddleware,
+  type LineWebhookOptions,
+  startLineWebhook,
+  type StartLineWebhookOptions,
+} from "./src/webhook.js";
+export { parseLineWebhookBody } from "./src/webhook-utils.js";
 export { datetimePickerAction, messageAction, postbackAction, uriAction } from "./src/actions.js";
 export type { Action } from "./src/actions.js";
 export {

extensions/matrix/runtime-api.ts

@@ -1,14 +1,33 @@
-// Keep the external runtime API light so Jiti callers can resolve Matrix config
-// helpers without traversing the full plugin-sdk/runtime graph or bootstrapping
-// matrix-js-sdk during plain runtime-api import.
-export * from "./src/auth-precedence.js";
+export {
+  type MatrixResolvedStringField,
+  type MatrixResolvedStringValues,
+  resolveMatrixAccountStringValues,
+} from "./src/auth-precedence.js";
 export {
   requiresExplicitMatrixDefaultAccount,
   resolveMatrixDefaultOrOnlyAccountId,
 } from "./src/account-selection.js";
-export * from "./src/account-selection.js";
-export * from "./src/env-vars.js";
-export * from "./src/storage-paths.js";
+export {
+  findMatrixAccountEntry,
+  resolveConfiguredMatrixAccountIds,
+  resolveMatrixChannelConfig,
+} from "./src/account-selection.js";
+export {
+  getMatrixScopedEnvVarNames,
+  listMatrixEnvAccountIds,
+  resolveMatrixEnvAccountToken,
+} from "./src/env-vars.js";
+export {
+  hashMatrixAccessToken,
+  resolveMatrixAccountStorageRoot,
+  resolveMatrixCredentialsDir,
+  resolveMatrixCredentialsFilename,
+  resolveMatrixCredentialsPath,
+  resolveMatrixHomeserverKey,
+  resolveMatrixLegacyFlatStoragePaths,
+  resolveMatrixLegacyFlatStoreRoot,
+  sanitizeMatrixPathSegment,
+} from "./src/storage-paths.js";
 export { ensureMatrixSdkInstalled, isMatrixSdkAvailable } from "./src/matrix/deps.js";
 export {
   assertHttpUrlTargetsPrivateNetwork,

extensions/matrix/src/approval-handler.runtime.test.ts

@@ -70,10 +70,16 @@ describe("matrixApprovalNativeRuntime", () => {
       },
       request: {} as never,
       approvalKind: "exec",
+      plannedTarget: {
+        surface: "approver-dm",
+        target: { to: "room:!room:example.org" },
+        reason: "preferred",
+      } as never,
       preparedTarget: {
         to: "room:!room:example.org",
         roomId: "!room:example.org",
       },
+      view: {} as never,
       pendingPayload,
     });
 
@@ -216,10 +222,16 @@ describe("matrixApprovalNativeRuntime", () => {
       },
       request: {} as never,
       approvalKind: "exec",
+      plannedTarget: {
+        surface: "approver-dm",
+        target: { to: "room:!room:example.org" },
+        reason: "preferred",
+      } as never,
       preparedTarget: {
         to: "room:!room:example.org",
         roomId: "!room:example.org",
       },
+      view: {} as never,
       pendingPayload,
     });
 

extensions/mattermost/src/runtime-api.ts

@@ -1 +1,69 @@
-export * from "../runtime-api.js";
+export {
+  applyAccountNameToChannelSection,
+  applySetupAccountConfigPatch,
+  type BaseProbeResult,
+  type BlockStreamingCoalesceConfig,
+  buildAgentMediaPayload,
+  buildChannelConfigSchema,
+  buildComputedAccountStatusSnapshot,
+  buildModelsProviderData,
+  buildPendingHistoryContextFromMap,
+  type ChannelAccountSnapshot,
+  type ChannelDirectoryEntry,
+  type ChannelGroupContext,
+  type ChannelMessageActionName,
+  type ChannelPlugin,
+  type ChatType,
+  chunkTextForOutbound,
+  clearHistoryEntriesIfEnabled,
+  createAccountStatusSink,
+  createChannelPairingController,
+  createChannelReplyPipeline,
+  createDedupeCache,
+  DEFAULT_ACCOUNT_ID,
+  DEFAULT_GROUP_HISTORY_LIMIT,
+  DM_GROUP_ACCESS_REASON,
+  type DmPolicy,
+  evaluateSenderGroupAccessForPolicy,
+  formatInboundFromLabel,
+  getAgentScopedMediaLocalRoots,
+  GROUP_POLICY_BLOCKED_LABEL,
+  type GroupPolicy,
+  type HistoryEntry,
+  isDangerousNameMatchingEnabled,
+  isRequestBodyLimitError,
+  isTrustedProxyAddress,
+  listSkillCommandsForAgents,
+  loadOutboundMediaFromUrl,
+  loadSessionStore,
+  logInboundDrop,
+  logTypingFailure,
+  migrateBaseNameToDefaultAccount,
+  type ModelsProviderData,
+  normalizeAccountId,
+  normalizeProviderId,
+  type OpenClawConfig,
+  type OpenClawPluginApi,
+  parseStrictPositiveInteger,
+  type PluginRuntime,
+  rawDataToString,
+  readRequestBodyWithLimit,
+  readStoreAllowFromForDmPolicy,
+  recordPendingHistoryEntryIfEnabled,
+  registerPluginHttpRoute,
+  type ReplyPayload,
+  resolveAllowlistMatchSimple,
+  resolveAllowlistProviderRuntimeGroupPolicy,
+  resolveChannelMediaMaxBytes,
+  resolveClientIp,
+  resolveControlCommandGate,
+  resolveDefaultGroupPolicy,
+  resolveDmGroupAccessWithLists,
+  resolveEffectiveAllowFromLists,
+  resolveStoredModelOverride,
+  resolveStorePath,
+  resolveThreadSessionKeys,
+  type RuntimeEnv,
+  setMattermostRuntime,
+  warnMissingProviderGroupPolicyFallbackOnce,
+} from "../runtime-api.js";

extensions/qa-channel/runtime-api.ts

@@ -1,3 +1,21 @@
-export * from "./src/runtime-api.js";
+export {
+  buildChannelConfigSchema,
+  buildChannelOutboundSessionRoute,
+  type ChannelGatewayContext,
+  type ChannelMessageActionAdapter,
+  type ChannelMessageActionName,
+  type ChannelPlugin,
+  createChatChannelPlugin,
+  createComputedAccountStatusAdapter,
+  createDefaultChannelRuntimeState,
+  createPluginRuntimeStore,
+  defineChannelPluginEntry,
+  dispatchInboundReplyWithBase,
+  getChatChannelMeta,
+  jsonResult,
+  type OpenClawConfig,
+  type PluginRuntime,
+  readStringParam,
+  type RuntimeEnv,
+} from "./src/runtime-api.js";
 export { getQaChannelRuntime, setQaChannelRuntime } from "./src/runtime.js";
-export * from "./src/runtime.js";

extensions/qa-lab/runtime-api.ts

@@ -1,2 +1,41 @@
-export * from "./src/runtime-api.js";
+export {
+  buildQaTarget,
+  callGatewayFromCli,
+  Command,
+  createQaBusThread,
+  defaultQaRuntimeModelForMode,
+  definePluginEntry,
+  deleteQaBusMessage,
+  editQaBusMessage,
+  getQaBusState,
+  injectQaBusInboundMessage,
+  normalizeQaTarget,
+  type OpenClawConfig,
+  parseQaTarget,
+  type PluginRuntime,
+  pollQaBus,
+  type QaBusAttachment,
+  type QaBusConversation,
+  type QaBusCreateThreadInput,
+  type QaBusDeleteMessageInput,
+  type QaBusEditMessageInput,
+  type QaBusEvent,
+  type QaBusInboundMessageInput,
+  type QaBusMessage,
+  type QaBusOutboundMessageInput,
+  type QaBusPollInput,
+  type QaBusPollResult,
+  type QaBusReactToMessageInput,
+  type QaBusReadMessageInput,
+  type QaBusSearchMessagesInput,
+  type QaBusStateSnapshot,
+  type QaBusThread,
+  type QaBusWaitForInput,
+  qaChannelPlugin,
+  reactToQaBusMessage,
+  readQaBusMessage,
+  searchQaBusMessages,
+  sendQaBusMessage,
+  setQaChannelRuntime,
+} from "./src/runtime-api.js";
 export { startQaLiveLaneGateway } from "./src/live-transports/shared/live-gateway.runtime.js";

extensions/signal/runtime-api.ts

@@ -1,2 +1,48 @@
-export * from "./src/runtime-api.js";
+export {
+  applyAccountNameToChannelSection,
+  buildBaseAccountStatusSnapshot,
+  buildBaseChannelStatusSummary,
+  buildChannelConfigSchema,
+  type ChannelMessageActionAdapter,
+  type ChannelPlugin,
+  chunkText,
+  collectStatusIssuesFromLastError,
+  createDefaultChannelRuntimeState,
+  DEFAULT_ACCOUNT_ID,
+  deleteAccountFromConfigSection,
+  detectBinary,
+  emptyPluginConfigSchema,
+  formatCliCommand,
+  formatDocsLink,
+  formatPairingApproveHint,
+  getChatChannelMeta,
+  installSignalCli,
+  listEnabledSignalAccounts,
+  listSignalAccountIds,
+  looksLikeSignalTargetId,
+  migrateBaseNameToDefaultAccount,
+  monitorSignalProvider,
+  normalizeAccountId,
+  normalizeE164,
+  normalizeSignalMessagingTarget,
+  type OpenClawConfig,
+  type OpenClawPluginApi,
+  PAIRING_APPROVED_MESSAGE,
+  type PluginRuntime,
+  probeSignal,
+  removeReactionSignal,
+  resolveAllowlistProviderRuntimeGroupPolicy,
+  resolveChannelMediaMaxBytes,
+  resolveDefaultGroupPolicy,
+  resolveDefaultSignalAccountId,
+  type ResolvedSignalAccount,
+  resolveSignalAccount,
+  resolveSignalReactionLevel,
+  sendMessageSignal,
+  sendReactionSignal,
+  setAccountEnabledInConfigSection,
+  type SignalAccountConfig,
+  SignalConfigSchema,
+  signalMessageActions,
+} from "./src/runtime-api.js";
 export { setSignalRuntime } from "./src/runtime.js";

extensions/zalo/runtime-api.ts

@@ -1,4 +1,75 @@
-// Private runtime barrel for the bundled Zalo extension.
-// Keep this barrel thin and free of channel plugin exports so direct runtime
-// imports do not re-enter the full channel/setup surface.
-export * from "./src/runtime-api.js";
+export {
+  addWildcardAllowFrom,
+  applyAccountNameToChannelSection,
+  applyBasicWebhookRequestGuards,
+  applySetupAccountConfigPatch,
+  type BaseProbeResult,
+  type BaseTokenResolution,
+  buildBaseAccountStatusSnapshot,
+  buildChannelConfigSchema,
+  buildSecretInputSchema,
+  buildSingleChannelSecretPromptState,
+  buildTokenChannelStatusSummary,
+  type ChannelAccountSnapshot,
+  type ChannelMessageActionAdapter,
+  type ChannelMessageActionName,
+  type ChannelPlugin,
+  type ChannelStatusIssue,
+  chunkTextForOutbound,
+  createChannelPairingController,
+  createChannelReplyPipeline,
+  createDedupeCache,
+  createFixedWindowRateLimiter,
+  createWebhookAnomalyTracker,
+  DEFAULT_ACCOUNT_ID,
+  deliverTextOrMediaReply,
+  evaluateSenderGroupAccess,
+  formatAllowFromLowercase,
+  formatPairingApproveHint,
+  type GroupPolicy,
+  hasConfiguredSecretInput,
+  isNormalizedSenderAllowed,
+  isNumericTargetId,
+  jsonResult,
+  logTypingFailure,
+  type MarkdownTableMode,
+  mergeAllowFromEntries,
+  migrateBaseNameToDefaultAccount,
+  normalizeAccountId,
+  normalizeResolvedSecretInputString,
+  normalizeSecretInputString,
+  type OpenClawConfig,
+  type OutboundReplyPayload,
+  PAIRING_APPROVED_MESSAGE,
+  type PluginRuntime,
+  promptSingleChannelSecretInput,
+  readJsonWebhookBodyOrReject,
+  readStringParam,
+  registerPluginHttpRoute,
+  type RegisterWebhookPluginRouteOptions,
+  registerWebhookTarget,
+  type RegisterWebhookTargetOptions,
+  registerWebhookTargetWithPluginRoute,
+  type ReplyPayload,
+  resolveClientIp,
+  resolveDefaultGroupPolicy,
+  resolveDirectDmAuthorizationOutcome,
+  resolveInboundRouteEnvelopeBuilderWithRuntime,
+  resolveOpenProviderRuntimeGroupPolicy,
+  resolveSenderCommandAuthorizationWithRuntime,
+  resolveWebhookPath,
+  resolveWebhookTargetWithAuthOrRejectSync,
+  runSingleChannelSecretStep,
+  type RuntimeEnv,
+  type SecretInput,
+  type SenderGroupAccessDecision,
+  sendPayloadWithChunkedTextAndMedia,
+  setTopLevelChannelDmPolicyWithAllowFrom,
+  setZaloRuntime,
+  waitForAbortSignal,
+  warnMissingProviderGroupPolicyFallbackOnce,
+  WEBHOOK_ANOMALY_COUNTER_DEFAULTS,
+  WEBHOOK_RATE_LIMIT_DEFAULTS,
+  withResolvedWebhookRequestPipeline,
+  type WizardPrompter,
+} from "./src/runtime-api.js";

extensions/zalo/src/runtime-api.ts

@@ -1,5 +1,75 @@
-// Internal runtime barrel. Keep this independent from the public top-level
-// runtime barrel so local imports do not loop back through the plugin export
-// surface during entry loading.
-export * from "./runtime-support.js";
+export {
+  addWildcardAllowFrom,
+  applyAccountNameToChannelSection,
+  applyBasicWebhookRequestGuards,
+  applySetupAccountConfigPatch,
+  type BaseProbeResult,
+  type BaseTokenResolution,
+  buildBaseAccountStatusSnapshot,
+  buildChannelConfigSchema,
+  buildSecretInputSchema,
+  buildSingleChannelSecretPromptState,
+  buildTokenChannelStatusSummary,
+  type ChannelAccountSnapshot,
+  type ChannelMessageActionAdapter,
+  type ChannelMessageActionName,
+  type ChannelPlugin,
+  type ChannelStatusIssue,
+  chunkTextForOutbound,
+  createChannelPairingController,
+  createChannelReplyPipeline,
+  createDedupeCache,
+  createFixedWindowRateLimiter,
+  createWebhookAnomalyTracker,
+  DEFAULT_ACCOUNT_ID,
+  deliverTextOrMediaReply,
+  evaluateSenderGroupAccess,
+  formatAllowFromLowercase,
+  formatPairingApproveHint,
+  type GroupPolicy,
+  hasConfiguredSecretInput,
+  isNormalizedSenderAllowed,
+  isNumericTargetId,
+  jsonResult,
+  logTypingFailure,
+  type MarkdownTableMode,
+  mergeAllowFromEntries,
+  migrateBaseNameToDefaultAccount,
+  normalizeAccountId,
+  normalizeResolvedSecretInputString,
+  normalizeSecretInputString,
+  type OpenClawConfig,
+  type OutboundReplyPayload,
+  PAIRING_APPROVED_MESSAGE,
+  type PluginRuntime,
+  promptSingleChannelSecretInput,
+  readJsonWebhookBodyOrReject,
+  readStringParam,
+  registerPluginHttpRoute,
+  type RegisterWebhookPluginRouteOptions,
+  registerWebhookTarget,
+  type RegisterWebhookTargetOptions,
+  registerWebhookTargetWithPluginRoute,
+  type ReplyPayload,
+  resolveClientIp,
+  resolveDefaultGroupPolicy,
+  resolveDirectDmAuthorizationOutcome,
+  resolveInboundRouteEnvelopeBuilderWithRuntime,
+  resolveOpenProviderRuntimeGroupPolicy,
+  resolveSenderCommandAuthorizationWithRuntime,
+  resolveWebhookPath,
+  resolveWebhookTargetWithAuthOrRejectSync,
+  runSingleChannelSecretStep,
+  type RuntimeEnv,
+  type SecretInput,
+  type SenderGroupAccessDecision,
+  sendPayloadWithChunkedTextAndMedia,
+  setTopLevelChannelDmPolicyWithAllowFrom,
+  waitForAbortSignal,
+  warnMissingProviderGroupPolicyFallbackOnce,
+  WEBHOOK_ANOMALY_COUNTER_DEFAULTS,
+  WEBHOOK_RATE_LIMIT_DEFAULTS,
+  withResolvedWebhookRequestPipeline,
+  type WizardPrompter,
+} from "./runtime-support.js";
 export { setZaloRuntime } from "./runtime.js";

extensions/zalouser/runtime-api.ts

@@ -1,7 +1,13 @@
-// Private runtime barrel for the bundled Zalo Personal extension.
-// Keep this barrel thin and aligned with the local extension surface.
-
-export * from "./api.js";
+export {
+  collectZalouserSecurityAuditFindings,
+  createZalouserSetupWizardProxy,
+  createZalouserTool,
+  isZalouserMutableGroupEntry,
+  zalouserPlugin,
+  zalouserSetupAdapter,
+  zalouserSetupPlugin,
+  zalouserSetupWizard,
+} from "./api.js";
 export { setZalouserRuntime } from "./src/runtime.js";
 export type { ReplyPayload } from "openclaw/plugin-sdk/reply-runtime";
 export type {

src/plugins/contracts/plugin-sdk-runtime-api-guardrails.test.ts

@@ -117,11 +117,11 @@ const RUNTIME_API_EXPORT_GUARDS: Record<string, readonly string[]> = {
     'export { setIrcRuntime } from "./src/runtime.js";',
   ],
   [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "matrix", relativePath: "runtime-api.ts" })]: [
-    'export * from "./src/auth-precedence.js";',
+    'export { type MatrixResolvedStringField, type MatrixResolvedStringValues, resolveMatrixAccountStringValues } from "./src/auth-precedence.js";',
     'export { requiresExplicitMatrixDefaultAccount, resolveMatrixDefaultOrOnlyAccountId } from "./src/account-selection.js";',
-    'export * from "./src/account-selection.js";',
-    'export * from "./src/env-vars.js";',
-    'export * from "./src/storage-paths.js";',
+    'export { findMatrixAccountEntry, resolveConfiguredMatrixAccountIds, resolveMatrixChannelConfig } from "./src/account-selection.js";',
+    'export { getMatrixScopedEnvVarNames, listMatrixEnvAccountIds, resolveMatrixEnvAccountToken } from "./src/env-vars.js";',
+    'export { hashMatrixAccessToken, resolveMatrixAccountStorageRoot, resolveMatrixCredentialsDir, resolveMatrixCredentialsFilename, resolveMatrixCredentialsPath, resolveMatrixHomeserverKey, resolveMatrixLegacyFlatStoragePaths, resolveMatrixLegacyFlatStoreRoot, sanitizeMatrixPathSegment } from "./src/storage-paths.js";',
     'export { ensureMatrixSdkInstalled, isMatrixSdkAvailable } from "./src/matrix/deps.js";',
     'export { assertHttpUrlTargetsPrivateNetwork, closeDispatcher, createPinnedDispatcher, resolvePinnedHostnameWithPolicy, ssrfPolicyFromDangerouslyAllowPrivateNetwork, ssrfPolicyFromAllowPrivateNetwork, type LookupFn, type SsrFPolicy } from "openclaw/plugin-sdk/ssrf-runtime";',
     'export { setMatrixThreadBindingIdleTimeoutBySessionKey, setMatrixThreadBindingMaxAgeBySessionKey } from "./src/matrix/thread-bindings-shared.js";',
@@ -162,7 +162,7 @@ const RUNTIME_API_EXPORT_GUARDS: Record<string, readonly string[]> = {
     'export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";',
   ],
   [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "signal", relativePath: "runtime-api.ts" })]: [
-    'export * from "./src/runtime-api.js";',
+    'export { applyAccountNameToChannelSection, buildBaseAccountStatusSnapshot, buildBaseChannelStatusSummary, buildChannelConfigSchema, type ChannelMessageActionAdapter, type ChannelPlugin, chunkText, collectStatusIssuesFromLastError, createDefaultChannelRuntimeState, DEFAULT_ACCOUNT_ID, deleteAccountFromConfigSection, detectBinary, emptyPluginConfigSchema, formatCliCommand, formatDocsLink, formatPairingApproveHint, getChatChannelMeta, installSignalCli, listEnabledSignalAccounts, listSignalAccountIds, looksLikeSignalTargetId, migrateBaseNameToDefaultAccount, monitorSignalProvider, normalizeAccountId, normalizeE164, normalizeSignalMessagingTarget, type OpenClawConfig, type OpenClawPluginApi, PAIRING_APPROVED_MESSAGE, type PluginRuntime, probeSignal, removeReactionSignal, resolveAllowlistProviderRuntimeGroupPolicy, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveDefaultSignalAccountId, type ResolvedSignalAccount, resolveSignalAccount, resolveSignalReactionLevel, sendMessageSignal, sendReactionSignal, setAccountEnabledInConfigSection, type SignalAccountConfig, SignalConfigSchema, signalMessageActions } from "./src/runtime-api.js";',
     'export { setSignalRuntime } from "./src/runtime.js";',
   ],
   [bundledPluginFile({ rootDir: ROOT_DIR, pluginId: "slack", relativePath: "runtime-api.ts" })]: [