@kodelyth/synology-chat 2026.5.39 → 2026.5.42

package/dist/channel-plugin-api.js

@@ -0,0 +1,2 @@
+import { t as synologyChatPlugin } from "./channel-DL2_2tLQ.js";
+export { synologyChatPlugin };

package/dist/contract-api.js

@@ -0,0 +1,2 @@
+import { t as collectSynologyChatSecurityAuditFindings } from "./security-audit-Zu_nkF2x.js";
+export { collectSynologyChatSecurityAuditFindings };

package/dist/index.js

@@ -0,0 +1,18 @@
+import { defineBundledChannelEntry } from "klaw/plugin-sdk/channel-entry-contract";
+//#region extensions/synology-chat/index.ts
+var synology_chat_default = defineBundledChannelEntry({
+	id: "synology-chat",
+	name: "Synology Chat",
+	description: "Native Synology Chat channel plugin for Klaw",
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./channel-plugin-api.js",
+		exportName: "synologyChatPlugin"
+	},
+	runtime: {
+		specifier: "./api.js",
+		exportName: "setSynologyRuntime"
+	}
+});
+//#endregion
+export { synology_chat_default as default };

package/dist/security-audit-Zu_nkF2x.js

@@ -0,0 +1,14 @@
+//#region extensions/synology-chat/src/security-audit.ts
+function collectSynologyChatSecurityAuditFindings(params) {
+	if (!params.account.dangerouslyAllowNameMatching) return [];
+	const accountId = params.accountId?.trim() || params.account.accountId || "default";
+	return [{
+		checkId: "channels.synology-chat.reply.dangerous_name_matching_enabled",
+		severity: "info",
+		title: `Synology Chat dangerous name matching is enabled${params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath ? ` (account: ${accountId})` : ""}`,
+		detail: "dangerouslyAllowNameMatching=true re-enables mutable username/nickname matching for reply delivery. This is a break-glass compatibility mode, not a hardened default.",
+		remediation: "Prefer stable numeric Synology Chat user IDs for reply delivery, then disable dangerouslyAllowNameMatching."
+	}];
+}
+//#endregion
+export { collectSynologyChatSecurityAuditFindings as t };

package/dist/setup-api.js

@@ -0,0 +1,2 @@
+import { n as synologyChatSetupWizard, t as synologyChatSetupAdapter } from "./setup-surface-BHDzBWdx.js";
+export { synologyChatSetupAdapter, synologyChatSetupWizard };

package/dist/setup-entry.js

@@ -0,0 +1,11 @@
+import { defineBundledChannelSetupEntry } from "klaw/plugin-sdk/channel-entry-contract";
+//#region extensions/synology-chat/setup-entry.ts
+var setup_entry_default = defineBundledChannelSetupEntry({
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./api.js",
+		exportName: "synologyChatPlugin"
+	}
+});
+//#endregion
+export { setup_entry_default as default };

package/dist/setup-surface-BHDzBWdx.js

@@ -0,0 +1,334 @@
+import { normalizeOptionalString } from "klaw/plugin-sdk/string-coerce-runtime";
+import { DEFAULT_ACCOUNT_ID, listCombinedAccountIds, resolveMergedAccountConfig } from "klaw/plugin-sdk/account-resolution";
+import { resolveDangerousNameMatchingEnabled } from "klaw/plugin-sdk/dangerous-name-runtime";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, createAllowFromSection, createSetupTranslator, createStandardChannelSetupStatus, formatDocsLink, mergeAllowFromEntries, normalizeAccountId, setSetupChannelEnabled, splitSetupEntries } from "klaw/plugin-sdk/setup";
+//#region extensions/synology-chat/src/accounts.ts
+/**
+* Account resolution: reads config from channels.synology-chat,
+* merges per-account overrides, falls back to environment variables.
+*/
+/** Extract the channel config from the full Klaw config object. */
+function getChannelConfig$1(cfg) {
+	return cfg?.channels?.["synology-chat"];
+}
+function resolveImplicitAccountId(channelCfg) {
+	return channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN ? DEFAULT_ACCOUNT_ID : void 0;
+}
+function getRawAccountConfig$1(channelCfg, accountId) {
+	if (accountId === DEFAULT_ACCOUNT_ID) return channelCfg;
+	return channelCfg.accounts?.[accountId] ?? {};
+}
+function hasExplicitWebhookPath(rawAccount) {
+	return typeof rawAccount?.webhookPath === "string" && rawAccount.webhookPath.trim().length > 0;
+}
+function resolveWebhookPathSource(params) {
+	if (hasExplicitWebhookPath(params.rawAccount)) return "explicit";
+	if (params.accountId !== DEFAULT_ACCOUNT_ID && hasExplicitWebhookPath(params.channelCfg)) return "inherited-base";
+	return "default";
+}
+/** Parse allowedUserIds from string or array to string[]. */
+function parseAllowedUserIds(raw) {
+	if (!raw) return [];
+	if (Array.isArray(raw)) return raw.filter(Boolean);
+	return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function parseRateLimitPerMinute(raw) {
+	if (raw == null) return 30;
+	const trimmed = raw.trim();
+	if (!/^-?\d+$/.test(trimmed)) return 30;
+	return Number.parseInt(trimmed, 10);
+}
+/**
+* List all configured account IDs for this channel.
+* Returns ["default"] if there's a base config, plus any named accounts.
+*/
+function listAccountIds(cfg) {
+	const channelCfg = getChannelConfig$1(cfg);
+	if (!channelCfg) return [];
+	return listCombinedAccountIds({
+		configuredAccountIds: Object.keys(channelCfg.accounts ?? {}),
+		implicitAccountId: resolveImplicitAccountId(channelCfg)
+	});
+}
+/**
+* Resolve a specific account by ID with full defaults applied.
+* Falls back to env vars for the "default" account.
+*/
+function resolveAccount(cfg, accountId) {
+	const channelCfg = getChannelConfig$1(cfg) ?? {};
+	const id = accountId || DEFAULT_ACCOUNT_ID;
+	const accountOverrides = id === DEFAULT_ACCOUNT_ID ? void 0 : channelCfg.accounts?.[id] ?? void 0;
+	const rawAccount = getRawAccountConfig$1(channelCfg, id);
+	const merged = resolveMergedAccountConfig({
+		channelConfig: channelCfg,
+		accounts: channelCfg.accounts,
+		accountId: id
+	});
+	const envToken = process.env.SYNOLOGY_CHAT_TOKEN ?? "";
+	const envIncomingUrl = process.env.SYNOLOGY_CHAT_INCOMING_URL ?? "";
+	const envNasHost = process.env.SYNOLOGY_NAS_HOST ?? "localhost";
+	const envAllowedUserIds = process.env.SYNOLOGY_ALLOWED_USER_IDS ?? "";
+	const envRateLimitValue = parseRateLimitPerMinute(process.env.SYNOLOGY_RATE_LIMIT);
+	const envBotName = process.env.KLAW_BOT_NAME ?? "Klaw";
+	const webhookPathSource = resolveWebhookPathSource({
+		accountId: id,
+		channelCfg,
+		rawAccount
+	});
+	const dangerouslyAllowInheritedWebhookPath = rawAccount.dangerouslyAllowInheritedWebhookPath ?? channelCfg.dangerouslyAllowInheritedWebhookPath ?? false;
+	return {
+		accountId: id,
+		enabled: merged.enabled ?? true,
+		token: merged.token ?? envToken,
+		incomingUrl: merged.incomingUrl ?? envIncomingUrl,
+		nasHost: merged.nasHost ?? envNasHost,
+		webhookPath: merged.webhookPath ?? "/webhook/synology",
+		webhookPathSource,
+		dangerouslyAllowNameMatching: resolveDangerousNameMatchingEnabled({
+			providerConfig: channelCfg,
+			accountConfig: accountOverrides
+		}),
+		dangerouslyAllowInheritedWebhookPath,
+		dmPolicy: merged.dmPolicy ?? "allowlist",
+		allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
+		rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
+		botName: merged.botName ?? envBotName,
+		allowInsecureSsl: merged.allowInsecureSsl ?? false
+	};
+}
+//#endregion
+//#region extensions/synology-chat/src/setup-surface.ts
+const t = createSetupTranslator();
+const channel = "synology-chat";
+const DEFAULT_WEBHOOK_PATH = "/webhook/synology";
+const SYNOLOGY_SETUP_HELP_LINES = [
+	t("wizard.synologyChat.helpIncomingWebhook"),
+	t("wizard.synologyChat.helpOutgoingWebhook"),
+	t("wizard.synologyChat.helpPointWebhook", { path: DEFAULT_WEBHOOK_PATH }),
+	t("wizard.synologyChat.helpAllowedUsers"),
+	`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
+];
+const SYNOLOGY_ALLOW_FROM_HELP_LINES = [
+	t("wizard.synologyChat.allowlistIntro"),
+	t("wizard.synologyChat.examples"),
+	"- 123456",
+	"- synology-chat:123456",
+	t("wizard.synologyChat.multipleEntries"),
+	`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
+];
+function getChannelConfig(cfg) {
+	return cfg.channels?.[channel] ?? {};
+}
+function getRawAccountConfig(cfg, accountId) {
+	const channelConfig = getChannelConfig(cfg);
+	if (accountId === DEFAULT_ACCOUNT_ID$1) return channelConfig;
+	return channelConfig.accounts?.[accountId] ?? {};
+}
+function patchSynologyChatAccountConfig(params) {
+	const channelConfig = getChannelConfig(params.cfg);
+	if (params.accountId === DEFAULT_ACCOUNT_ID$1) {
+		const nextChannelConfig = { ...channelConfig };
+		for (const field of params.clearFields ?? []) delete nextChannelConfig[field];
+		return {
+			...params.cfg,
+			channels: {
+				...params.cfg.channels,
+				[channel]: {
+					...nextChannelConfig,
+					...params.enabled ? { enabled: true } : {},
+					...params.patch
+				}
+			}
+		};
+	}
+	const nextAccounts = { ...channelConfig.accounts };
+	const nextAccountConfig = { ...nextAccounts[params.accountId] };
+	for (const field of params.clearFields ?? []) delete nextAccountConfig[field];
+	nextAccounts[params.accountId] = {
+		...nextAccountConfig,
+		...params.enabled ? { enabled: true } : {},
+		...params.patch
+	};
+	return {
+		...params.cfg,
+		channels: {
+			...params.cfg.channels,
+			[channel]: {
+				...channelConfig,
+				...params.enabled ? { enabled: true } : {},
+				accounts: nextAccounts
+			}
+		}
+	};
+}
+function isSynologyChatConfigured(cfg, accountId) {
+	const account = resolveAccount(cfg, accountId);
+	return Boolean(account.token.trim() && account.incomingUrl.trim());
+}
+function validateWebhookUrl(value) {
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "Incoming webhook must use http:// or https://.";
+	} catch {
+		return "Incoming webhook must be a valid URL.";
+	}
+}
+function validateWebhookPath(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return;
+	return trimmed.startsWith("/") ? void 0 : "Webhook path must start with /.";
+}
+function parseSynologyUserId(value) {
+	const cleaned = value.replace(/^synology(?:[-_]?chat)?:/i, "").trim();
+	return /^\d+$/.test(cleaned) ? cleaned : null;
+}
+function normalizeSynologyAllowedUserId(value) {
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return `${value}`.trim();
+	return "";
+}
+function resolveExistingAllowedUserIds(cfg, accountId) {
+	const raw = getRawAccountConfig(cfg, accountId).allowedUserIds;
+	if (Array.isArray(raw)) return raw.map(normalizeSynologyAllowedUserId).filter(Boolean);
+	return normalizeSynologyAllowedUserId(raw).split(",").map((value) => value.trim()).filter(Boolean);
+}
+const synologyChatSetupAdapter = {
+	resolveAccountId: ({ accountId }) => normalizeAccountId(accountId) ?? DEFAULT_ACCOUNT_ID$1,
+	validateInput: ({ accountId, input }) => {
+		if (input.useEnv && accountId !== DEFAULT_ACCOUNT_ID$1) return "Synology Chat env credentials only support the default account.";
+		if (!input.useEnv && !input.token?.trim()) return "Synology Chat requires --token or --use-env.";
+		if (!input.url?.trim()) return "Synology Chat requires --url for the incoming webhook.";
+		const urlError = validateWebhookUrl(input.url.trim());
+		if (urlError) return urlError;
+		if (input.webhookPath?.trim()) return validateWebhookPath(input.webhookPath.trim()) ?? null;
+		return null;
+	},
+	applyAccountConfig: ({ cfg, accountId, input }) => patchSynologyChatAccountConfig({
+		cfg,
+		accountId,
+		enabled: true,
+		clearFields: input.useEnv ? ["token"] : void 0,
+		patch: {
+			...input.useEnv ? {} : { token: input.token?.trim() },
+			incomingUrl: input.url?.trim(),
+			...input.webhookPath?.trim() ? { webhookPath: input.webhookPath.trim() } : {}
+		}
+	})
+};
+const synologyChatSetupWizard = {
+	channel,
+	status: createStandardChannelSetupStatus({
+		channelLabel: "Synology Chat",
+		configuredLabel: t("wizard.channels.statusConfigured"),
+		unconfiguredLabel: t("wizard.channels.statusNeedsTokenIncomingWebhook"),
+		configuredHint: t("wizard.channels.statusConfigured"),
+		unconfiguredHint: t("wizard.channels.statusNeedsTokenIncomingWebhook"),
+		configuredScore: 1,
+		unconfiguredScore: 0,
+		includeStatusLine: true,
+		resolveConfigured: ({ cfg, accountId }) => accountId ? isSynologyChatConfigured(cfg, accountId) : listAccountIds(cfg).some((candidateAccountId) => isSynologyChatConfigured(cfg, candidateAccountId)),
+		resolveExtraStatusLines: ({ cfg }) => [`Accounts: ${listAccountIds(cfg).length || 0}`]
+	}),
+	introNote: {
+		title: t("wizard.synologyChat.setupTitle"),
+		lines: SYNOLOGY_SETUP_HELP_LINES
+	},
+	credentials: [{
+		inputKey: "token",
+		providerHint: channel,
+		credentialLabel: "outgoing webhook token",
+		preferredEnvVar: "SYNOLOGY_CHAT_TOKEN",
+		helpTitle: t("wizard.synologyChat.webhookTokenTitle"),
+		helpLines: SYNOLOGY_SETUP_HELP_LINES,
+		envPrompt: t("wizard.synologyChat.tokenEnvPrompt"),
+		keepPrompt: t("wizard.synologyChat.tokenKeep"),
+		inputPrompt: t("wizard.synologyChat.tokenInput"),
+		allowEnv: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID$1,
+		inspect: ({ cfg, accountId }) => {
+			const account = resolveAccount(cfg, accountId);
+			const raw = getRawAccountConfig(cfg, accountId);
+			return {
+				accountConfigured: isSynologyChatConfigured(cfg, accountId),
+				hasConfiguredValue: Boolean(normalizeOptionalString(raw.token)),
+				resolvedValue: normalizeOptionalString(account.token),
+				envValue: accountId === DEFAULT_ACCOUNT_ID$1 ? normalizeOptionalString(process.env.SYNOLOGY_CHAT_TOKEN) : void 0
+			};
+		},
+		applyUseEnv: async ({ cfg, accountId }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			clearFields: ["token"],
+			patch: {}
+		}),
+		applySet: async ({ cfg, accountId, resolvedValue }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			patch: { token: resolvedValue }
+		})
+	}],
+	textInputs: [{
+		inputKey: "url",
+		message: t("wizard.synologyChat.incomingWebhookUrlPrompt"),
+		placeholder: "https://nas.example.com/webapi/entry.cgi?api=SYNO.Chat.External&method=incoming...",
+		helpTitle: t("wizard.synologyChat.incomingWebhookTitle"),
+		helpLines: [t("wizard.synologyChat.incomingWebhookHelpUseUrl"), t("wizard.synologyChat.incomingWebhookHelpReplies")],
+		currentValue: ({ cfg, accountId }) => getRawAccountConfig(cfg, accountId).incomingUrl?.trim(),
+		keepPrompt: (value) => t("wizard.synologyChat.incomingWebhookKeep", { value }),
+		validate: ({ value }) => validateWebhookUrl(value),
+		applySet: async ({ cfg, accountId, value }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			patch: { incomingUrl: value.trim() }
+		})
+	}, {
+		inputKey: "webhookPath",
+		message: t("wizard.synologyChat.outgoingWebhookPathPrompt"),
+		placeholder: DEFAULT_WEBHOOK_PATH,
+		required: false,
+		applyEmptyValue: true,
+		helpTitle: t("wizard.synologyChat.outgoingWebhookPathTitle"),
+		helpLines: [t("wizard.synologyChat.defaultPath", { path: DEFAULT_WEBHOOK_PATH }), t("wizard.synologyChat.outgoingWebhookPathHelp")],
+		currentValue: ({ cfg, accountId }) => getRawAccountConfig(cfg, accountId).webhookPath?.trim(),
+		keepPrompt: (value) => t("wizard.synologyChat.outgoingWebhookPathKeep", { value }),
+		validate: ({ value }) => validateWebhookPath(value),
+		applySet: async ({ cfg, accountId, value }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			clearFields: value.trim() ? void 0 : ["webhookPath"],
+			patch: value.trim() ? { webhookPath: value.trim() } : {}
+		})
+	}],
+	allowFrom: createAllowFromSection({
+		helpTitle: t("wizard.synologyChat.allowlistTitle"),
+		helpLines: SYNOLOGY_ALLOW_FROM_HELP_LINES,
+		message: t("wizard.synologyChat.allowedUserIdsPrompt"),
+		placeholder: "123456, 987654",
+		invalidWithoutCredentialNote: t("wizard.synologyChat.allowedUserIdsInvalid"),
+		parseInputs: splitSetupEntries,
+		parseId: parseSynologyUserId,
+		apply: async ({ cfg, accountId, allowFrom }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			patch: {
+				dmPolicy: "allowlist",
+				allowedUserIds: mergeAllowFromEntries(resolveExistingAllowedUserIds(cfg, accountId), allowFrom)
+			}
+		})
+	}),
+	completionNote: {
+		title: t("wizard.synologyChat.accessControlTitle"),
+		lines: [
+			`Default outgoing webhook path: ${DEFAULT_WEBHOOK_PATH}`,
+			"Set allowed user IDs, or manually switch `channels.synology-chat.dmPolicy` to `\"open\"` with `allowedUserIds: [\"*\"]` for public DMs.",
+			"With `dmPolicy=\"allowlist\"`, an empty allowedUserIds list blocks the route from starting.",
+			`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
+		]
+	},
+	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
+};
+//#endregion
+export { resolveAccount as i, synologyChatSetupWizard as n, listAccountIds as r, synologyChatSetupAdapter as t };

package/index.ts

@@ -0,0 +1,16 @@
+import { defineBundledChannelEntry } from "klaw/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelEntry({
+  id: "synology-chat",
+  name: "Synology Chat",
+  description: "Native Synology Chat channel plugin for Klaw",
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./channel-plugin-api.js",
+    exportName: "synologyChatPlugin",
+  },
+  runtime: {
+    specifier: "./api.js",
+    exportName: "setSynologyRuntime",
+  },
+});

package/klaw.plugin.json

@@ -3,9 +3,7 @@
   "activation": {
     "onStartup": false
   },
-  "channels": [
-    "synology-chat"
-  ],
+  "channels": ["synology-chat"],
   "channelEnvVars": {
     "synology-chat": [
       "SYNOLOGY_CHAT_TOKEN",
@@ -20,24 +18,5 @@
     "type": "object",
     "additionalProperties": false,
     "properties": {}
-  },
-  "channelConfigs": {
-    "synology-chat": {
-      "schema": {
-        "$schema": "http://json-schema.org/draft-07/schema#",
-        "type": "object",
-        "properties": {
-          "dangerouslyAllowNameMatching": {
-            "type": "boolean"
-          },
-          "dangerouslyAllowInheritedWebhookPath": {
-            "type": "boolean"
-          }
-        },
-        "additionalProperties": {}
-      },
-      "label": "Synology Chat",
-      "description": "Connect your Synology NAS Chat to Klaw with full agent capabilities."
-    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kodelyth/synology-chat",
-  "version": "2026.5.39",
+  "version": "2026.5.42",
   "description": "Synology Chat channel plugin for Klaw",
   "repository": {
     "type": "git",
@@ -12,9 +12,9 @@
   },
   "klaw": {
     "extensions": [
-      "./index.js"
+      "./index.ts"
     ],
-    "setupEntry": "./setup-entry.js",
+    "setupEntry": "./setup-entry.ts",
     "channel": {
       "id": "synology-chat",
       "label": "Synology Chat",

package/setup-api.ts

@@ -0,0 +1 @@
+export { synologyChatSetupAdapter, synologyChatSetupWizard } from "./src/setup-surface.js";

package/setup-entry.ts

@@ -0,0 +1,9 @@
+import { defineBundledChannelSetupEntry } from "klaw/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelSetupEntry({
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./api.js",
+    exportName: "synologyChatPlugin",
+  },
+});

package/src/accounts.ts

@@ -0,0 +1,151 @@
+/**
+ * Account resolution: reads config from channels.synology-chat,
+ * merges per-account overrides, falls back to environment variables.
+ */
+
+import {
+  DEFAULT_ACCOUNT_ID,
+  listCombinedAccountIds,
+  resolveMergedAccountConfig,
+  type KlawConfig,
+} from "klaw/plugin-sdk/account-resolution";
+import { resolveDangerousNameMatchingEnabled } from "klaw/plugin-sdk/dangerous-name-runtime";
+import type {
+  SynologyChatChannelConfig,
+  ResolvedSynologyChatAccount,
+  SynologyWebhookPathSource,
+} from "./types.js";
+
+/** Extract the channel config from the full Klaw config object. */
+function getChannelConfig(cfg: KlawConfig): SynologyChatChannelConfig | undefined {
+  return cfg?.channels?.["synology-chat"] as SynologyChatChannelConfig | undefined;
+}
+
+function resolveImplicitAccountId(channelCfg: SynologyChatChannelConfig): string | undefined {
+  return channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN ? DEFAULT_ACCOUNT_ID : undefined;
+}
+
+function getRawAccountConfig(
+  channelCfg: SynologyChatChannelConfig,
+  accountId: string,
+): SynologyChatChannelConfig {
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    return channelCfg;
+  }
+  return channelCfg.accounts?.[accountId] ?? {};
+}
+
+function hasExplicitWebhookPath(rawAccount: SynologyChatChannelConfig | undefined): boolean {
+  return typeof rawAccount?.webhookPath === "string" && rawAccount.webhookPath.trim().length > 0;
+}
+
+function resolveWebhookPathSource(params: {
+  accountId: string;
+  channelCfg: SynologyChatChannelConfig;
+  rawAccount: SynologyChatChannelConfig;
+}): SynologyWebhookPathSource {
+  if (hasExplicitWebhookPath(params.rawAccount)) {
+    return "explicit";
+  }
+  if (params.accountId !== DEFAULT_ACCOUNT_ID && hasExplicitWebhookPath(params.channelCfg)) {
+    return "inherited-base";
+  }
+  return "default";
+}
+
+/** Parse allowedUserIds from string or array to string[]. */
+function parseAllowedUserIds(raw: string | string[] | undefined): string[] {
+  if (!raw) {
+    return [];
+  }
+  if (Array.isArray(raw)) {
+    return raw.filter(Boolean);
+  }
+  return raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+function parseRateLimitPerMinute(raw: string | undefined): number {
+  if (raw == null) {
+    return 30;
+  }
+  const trimmed = raw.trim();
+  if (!/^-?\d+$/.test(trimmed)) {
+    return 30;
+  }
+  return Number.parseInt(trimmed, 10);
+}
+
+/**
+ * List all configured account IDs for this channel.
+ * Returns ["default"] if there's a base config, plus any named accounts.
+ */
+export function listAccountIds(cfg: KlawConfig): string[] {
+  const channelCfg = getChannelConfig(cfg);
+  if (!channelCfg) {
+    return [];
+  }
+
+  return listCombinedAccountIds({
+    configuredAccountIds: Object.keys(channelCfg.accounts ?? {}),
+    implicitAccountId: resolveImplicitAccountId(channelCfg),
+  });
+}
+
+/**
+ * Resolve a specific account by ID with full defaults applied.
+ * Falls back to env vars for the "default" account.
+ */
+export function resolveAccount(
+  cfg: KlawConfig,
+  accountId?: string | null,
+): ResolvedSynologyChatAccount {
+  const channelCfg = getChannelConfig(cfg) ?? {};
+  const id = accountId || DEFAULT_ACCOUNT_ID;
+  const accountOverrides =
+    id === DEFAULT_ACCOUNT_ID ? undefined : (channelCfg.accounts?.[id] ?? undefined);
+  const rawAccount = getRawAccountConfig(channelCfg, id);
+  const merged = resolveMergedAccountConfig<Record<string, unknown> & SynologyChatChannelConfig>({
+    channelConfig: channelCfg as Record<string, unknown> & SynologyChatChannelConfig,
+    accounts: channelCfg.accounts as
+      | Record<string, Partial<Record<string, unknown> & SynologyChatChannelConfig>>
+      | undefined,
+    accountId: id,
+  });
+
+  // Env var fallbacks (primarily for the "default" account)
+  const envToken = process.env.SYNOLOGY_CHAT_TOKEN ?? "";
+  const envIncomingUrl = process.env.SYNOLOGY_CHAT_INCOMING_URL ?? "";
+  const envNasHost = process.env.SYNOLOGY_NAS_HOST ?? "localhost";
+  const envAllowedUserIds = process.env.SYNOLOGY_ALLOWED_USER_IDS ?? "";
+  const envRateLimitValue = parseRateLimitPerMinute(process.env.SYNOLOGY_RATE_LIMIT);
+  const envBotName = process.env.KLAW_BOT_NAME ?? "Klaw";
+  const webhookPathSource = resolveWebhookPathSource({ accountId: id, channelCfg, rawAccount });
+  const dangerouslyAllowInheritedWebhookPath =
+    rawAccount.dangerouslyAllowInheritedWebhookPath ??
+    channelCfg.dangerouslyAllowInheritedWebhookPath ??
+    false;
+
+  // Merge: account override > base channel config > env var
+  return {
+    accountId: id,
+    enabled: merged.enabled ?? true,
+    token: merged.token ?? envToken,
+    incomingUrl: merged.incomingUrl ?? envIncomingUrl,
+    nasHost: merged.nasHost ?? envNasHost,
+    webhookPath: merged.webhookPath ?? "/webhook/synology",
+    webhookPathSource,
+    dangerouslyAllowNameMatching: resolveDangerousNameMatchingEnabled({
+      providerConfig: channelCfg,
+      accountConfig: accountOverrides,
+    }),
+    dangerouslyAllowInheritedWebhookPath,
+    dmPolicy: merged.dmPolicy ?? "allowlist",
+    allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
+    rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
+    botName: merged.botName ?? envBotName,
+    allowInsecureSsl: merged.allowInsecureSsl ?? false,
+  };
+}

package/src/approval-auth.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { synologyChatApprovalAuth } from "./approval-auth.js";
+
+describe("synologyChatApprovalAuth", () => {
+  it("authorizes numeric Synology Chat user ids", () => {
+    const cfg = { channels: { "synology-chat": { allowedUserIds: ["123"] } } };
+
+    expect(
+      synologyChatApprovalAuth.authorizeActorAction({
+        cfg,
+        senderId: "123",
+        action: "approve",
+        approvalKind: "plugin",
+      }),
+    ).toEqual({ authorized: true });
+  });
+});

package/src/approval-auth.ts

@@ -0,0 +1,22 @@
+import {
+  createResolvedApproverActionAuthAdapter,
+  resolveApprovalApprovers,
+} from "klaw/plugin-sdk/approval-auth-runtime";
+import { resolveAccount } from "./accounts.js";
+
+function normalizeSynologyChatApproverId(value: string | number): string | undefined {
+  const trimmed = String(value).trim();
+  return /^\d+$/.test(trimmed) ? trimmed : undefined;
+}
+
+export const synologyChatApprovalAuth = createResolvedApproverActionAuthAdapter({
+  channelLabel: "Synology Chat",
+  resolveApprovers: ({ cfg, accountId }) => {
+    const account = resolveAccount(cfg ?? {}, accountId);
+    return resolveApprovalApprovers({
+      allowFrom: account.allowedUserIds,
+      normalizeApprover: normalizeSynologyChatApproverId,
+    });
+  },
+  normalizeSenderId: (value) => normalizeSynologyChatApproverId(value),
+});