@openclaw/crabline 0.1.11 → 0.1.12

package/dist/src/matrix-ids.js

@@ -0,0 +1,83 @@
+import { isIP } from "node:net";
+const MAX_MATRIX_IDENTIFIER_BYTES = 255;
+function isMatrixIpv4Address(value) {
+    const octets = value.split(".");
+    return (octets.length === 4 && octets.every((octet) => /^\d{1,3}$/u.test(octet) && Number(octet) <= 255));
+}
+export function isMatrixServerName(value) {
+    const ipv6 = /^\[([^\]]+)\](?::(\d{1,5}))?$/u.exec(value);
+    if (ipv6) {
+        return isIP(ipv6[1]) === 6;
+    }
+    const hostAndPort = /^([^:]+?)(?::(\d{1,5}))?$/u.exec(value);
+    if (!hostAndPort) {
+        return false;
+    }
+    const hostname = hostAndPort[1];
+    if (isMatrixIpv4Address(hostname)) {
+        return true;
+    }
+    if (/^\d+\.\d+\.\d+\.\d+$/u.test(hostname)) {
+        return false;
+    }
+    return hostname.length <= 255 && /^[A-Za-z0-9.-]+$/u.test(hostname);
+}
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (next < 0xdc00 || next > 0xdfff) {
+                return true;
+            }
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+function isMatrixScopedIdentifier(value, sigil, allowEmptyLocalpart = false) {
+    const separator = value.indexOf(":");
+    const localpart = value.slice(1, separator);
+    return (value.startsWith(sigil) &&
+        Buffer.byteLength(value, "utf8") <= MAX_MATRIX_IDENTIFIER_BYTES &&
+        separator >= (allowEmptyLocalpart ? 1 : 2) &&
+        !localpart.includes("\0") &&
+        !hasLoneSurrogate(localpart) &&
+        isMatrixServerName(value.slice(separator + 1)));
+}
+function isMatrixHashIdentifier(value, sigil, allowLegacyBase64) {
+    if (!value.startsWith(sigil) || Buffer.byteLength(value, "utf8") > MAX_MATRIX_IDENTIFIER_BYTES) {
+        return false;
+    }
+    const opaqueId = value.slice(1);
+    const encoding = allowLegacyBase64 && /^[A-Za-z0-9+/]{43}$/u.test(opaqueId)
+        ? "base64"
+        : /^[A-Za-z0-9_-]{43}$/u.test(opaqueId)
+            ? "base64url"
+            : undefined;
+    if (!encoding) {
+        return false;
+    }
+    const decoded = Buffer.from(opaqueId, encoding);
+    return decoded.length === 32 && decoded.toString(encoding).replace(/=+$/u, "") === opaqueId;
+}
+export function isMatrixRoomId(value) {
+    return isMatrixScopedIdentifier(value, "!") || isMatrixHashIdentifier(value, "!", false);
+}
+export function isMatrixEventId(value) {
+    return isMatrixScopedIdentifier(value, "$") || isMatrixHashIdentifier(value, "$", true);
+}
+export function isMatrixUserId(value) {
+    if (!isMatrixScopedIdentifier(value, "@")) {
+        return false;
+    }
+    const localpart = value.slice(1, value.indexOf(":"));
+    return /^[a-z0-9._=/+-]+$/u.test(localpart);
+}
+export function isHistoricalMatrixUserId(value) {
+    return isMatrixScopedIdentifier(value, "@", true);
+}
+//# sourceMappingURL=matrix-ids.js.map

package/dist/src/matrix-ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matrix-ids.js","sourceRoot":"","sources":["../../src/matrix-ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;IACjC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAa,EACb,KAAsB,EACtB,mBAAmB,GAAG,KAAK;IAE3B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5C,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,2BAA2B;QAC/D,SAAS,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAC5B,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,KAAgB,EAChB,iBAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,2BAA2B,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,QAAQ,GACZ,iBAAiB,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACxD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC","sourcesContent":["import { isIP } from \"node:net\";\n\nconst MAX_MATRIX_IDENTIFIER_BYTES = 255;\n\nfunction isMatrixIpv4Address(value: string): boolean {\n  const octets = value.split(\".\");\n  return (\n    octets.length === 4 && octets.every((octet) => /^\\d{1,3}$/u.test(octet) && Number(octet) <= 255)\n  );\n}\n\nexport function isMatrixServerName(value: string): boolean {\n  const ipv6 = /^\\[([^\\]]+)\\](?::(\\d{1,5}))?$/u.exec(value);\n  if (ipv6) {\n    return isIP(ipv6[1]!) === 6;\n  }\n  const hostAndPort = /^([^:]+?)(?::(\\d{1,5}))?$/u.exec(value);\n  if (!hostAndPort) {\n    return false;\n  }\n  const hostname = hostAndPort[1]!;\n  if (isMatrixIpv4Address(hostname)) {\n    return true;\n  }\n  if (/^\\d+\\.\\d+\\.\\d+\\.\\d+$/u.test(hostname)) {\n    return false;\n  }\n  return hostname.length <= 255 && /^[A-Za-z0-9.-]+$/u.test(hostname);\n}\n\nfunction hasLoneSurrogate(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (next < 0xdc00 || next > 0xdfff) {\n        return true;\n      }\n      index += 1;\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction isMatrixScopedIdentifier(\n  value: string,\n  sigil: \"!\" | \"$\" | \"@\",\n  allowEmptyLocalpart = false,\n): boolean {\n  const separator = value.indexOf(\":\");\n  const localpart = value.slice(1, separator);\n  return (\n    value.startsWith(sigil) &&\n    Buffer.byteLength(value, \"utf8\") <= MAX_MATRIX_IDENTIFIER_BYTES &&\n    separator >= (allowEmptyLocalpart ? 1 : 2) &&\n    !localpart.includes(\"\\0\") &&\n    !hasLoneSurrogate(localpart) &&\n    isMatrixServerName(value.slice(separator + 1))\n  );\n}\n\nfunction isMatrixHashIdentifier(\n  value: string,\n  sigil: \"!\" | \"$\",\n  allowLegacyBase64: boolean,\n): boolean {\n  if (!value.startsWith(sigil) || Buffer.byteLength(value, \"utf8\") > MAX_MATRIX_IDENTIFIER_BYTES) {\n    return false;\n  }\n  const opaqueId = value.slice(1);\n  const encoding =\n    allowLegacyBase64 && /^[A-Za-z0-9+/]{43}$/u.test(opaqueId)\n      ? \"base64\"\n      : /^[A-Za-z0-9_-]{43}$/u.test(opaqueId)\n        ? \"base64url\"\n        : undefined;\n  if (!encoding) {\n    return false;\n  }\n  const decoded = Buffer.from(opaqueId, encoding);\n  return decoded.length === 32 && decoded.toString(encoding).replace(/=+$/u, \"\") === opaqueId;\n}\n\nexport function isMatrixRoomId(value: string): boolean {\n  return isMatrixScopedIdentifier(value, \"!\") || isMatrixHashIdentifier(value, \"!\", false);\n}\n\nexport function isMatrixEventId(value: string): boolean {\n  return isMatrixScopedIdentifier(value, \"$\") || isMatrixHashIdentifier(value, \"$\", true);\n}\n\nexport function isMatrixUserId(value: string): boolean {\n  if (!isMatrixScopedIdentifier(value, \"@\")) {\n    return false;\n  }\n  const localpart = value.slice(1, value.indexOf(\":\"));\n  return /^[a-z0-9._=/+-]+$/u.test(localpart);\n}\n\nexport function isHistoricalMatrixUserId(value: string): boolean {\n  return isMatrixScopedIdentifier(value, \"@\", true);\n}\n"]}

package/dist/src/openclaw/artifact-generation.d.ts

@@ -2,15 +2,20 @@ import type { CrablineServerManifest } from "../servers/index.js";
 import { publishPrivateFileAtomically, syncParentDirectory } from "./private-file.js";
 import { type OpenClawCrablineChannelDriverSelection } from "./shared.js";
 import type { OpenClawCrablineSmokeRunLock } from "./smoke-lock.js";
-export type OpenClawCrablineArtifactPointer = {
+type OpenClawCrablineArtifactPointerBase = {
     capabilityMatrixPath: string;
     generation: string;
     manifestPath: string;
     previousGeneration?: string;
     providerReadinessArtifactPath: string;
     smokeArtifactPath: string;
-    version: 1;
 };
+export type OpenClawCrablineArtifactPointer = (OpenClawCrablineArtifactPointerBase & {
+    version: 1;
+}) | (OpenClawCrablineArtifactPointerBase & {
+    recorderSnapshotPath: string | null;
+    version: 2;
+});
 export type PublishedOpenClawCrablineArtifactGeneration = OpenClawCrablineArtifactPointer & {
     pointerPath: string;
     providerReadiness: Record<string, unknown>;

package/dist/src/openclaw/artifact-generation.js

@@ -1,11 +1,13 @@
 import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import { captureDirectoryIdentity, publishPrivateFileAtomically, removeSecuredPrivateDirectory, securePrivateDirectory, syncParentDirectory, } from "./private-file.js";
 import { OPENCLAW_CRABLINE_ARTIFACT_POINTER_PATH, OPENCLAW_CRABLINE_ARTIFACT_STORE_DIRECTORY, OPENCLAW_CRABLINE_CHANNEL_CAPABILITY_MATRIX_PATH, OPENCLAW_CRABLINE_CHANNEL_SMOKE_PATH, OPENCLAW_CRABLINE_PROVIDER_READINESS_PATH, OPENCLAW_CRABLINE_MANIFEST_PATH, } from "./shared.js";
 const GENERATION_NAME_PATTERN = /^generation-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 const STAGING_NAME_PATTERN = /^\.staging-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 const REMOVAL_TOMBSTONE_PATTERN = /^\.(.+)\.\d+\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.remove$/iu;
+const CURRENT_GENERATION_READ_ATTEMPTS = 8;
 function resolveProviderReadinessArtifactPath(selection) {
     const readinessPath = selection.providerReadinessArtifactPath ?? selection.smokeArtifactPath;
     if (selection.capabilityMatrixPath !== OPENCLAW_CRABLINE_CHANNEL_CAPABILITY_MATRIX_PATH ||
@@ -17,6 +19,179 @@ function resolveProviderReadinessArtifactPath(selection) {
 function isMissingPathError(error) {
     return error.code === "ENOENT";
 }
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasNonEmptyStringFields(value, fields) {
+    return fields.every((field) => typeof value[field] === "string" && value[field].length > 0);
+}
+function isGeneratedManifest(value) {
+    if (value.version !== 1 ||
+        !hasNonEmptyStringFields(value, ["adminToken", "baseUrl", "provider"]) ||
+        !isRecord(value.endpoints) ||
+        !isRecord(value.env)) {
+        return false;
+    }
+    const endpoints = value.endpoints;
+    const env = value.env;
+    const baseUrl = value.baseUrl;
+    switch (value.provider) {
+        case "mattermost":
+            return (hasNonEmptyStringFields(value, ["botToken", "botUserId"]) &&
+                hasNonEmptyStringFields(endpoints, ["adminInboundUrl", "apiRoot", "websocketUrl"]) &&
+                hasNonEmptyStringFields(env, ["MATTERMOST_BOT_TOKEN", "MATTERMOST_URL"]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/crabline/mattermost/inbound` &&
+                endpoints.apiRoot === `${baseUrl}/api/v4` &&
+                endpoints.websocketUrl === `${baseUrl.replace(/^http/u, "ws")}/api/v4/websocket` &&
+                env.MATTERMOST_BOT_TOKEN === value.botToken &&
+                env.MATTERMOST_URL === baseUrl);
+        case "matrix":
+            return (hasNonEmptyStringFields(value, ["accessToken", "botUserId", "deviceId"]) &&
+                hasNonEmptyStringFields(endpoints, ["adminInboundUrl", "clientApiRoot", "syncUrl"]) &&
+                hasNonEmptyStringFields(env, [
+                    "MATRIX_ACCESS_TOKEN",
+                    "MATRIX_BASE_URL",
+                    "MATRIX_USER_ID",
+                ]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/crabline/matrix/inbound` &&
+                endpoints.clientApiRoot === `${baseUrl}/_matrix/client/v3` &&
+                endpoints.syncUrl === `${endpoints.clientApiRoot}/sync` &&
+                env.MATRIX_ACCESS_TOKEN === value.accessToken &&
+                env.MATRIX_BASE_URL === baseUrl &&
+                env.MATRIX_USER_ID === value.botUserId);
+        case "signal":
+            return (hasNonEmptyStringFields(value, ["account"]) &&
+                hasNonEmptyStringFields(endpoints, ["adminInboundUrl", "apiRoot", "eventsUrl", "rpcUrl"]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/crabline/signal/inbound` &&
+                endpoints.apiRoot === baseUrl &&
+                endpoints.eventsUrl === `${baseUrl}/api/v1/events` &&
+                endpoints.rpcUrl === `${baseUrl}/api/v1/rpc` &&
+                Object.keys(env).length === 0);
+        case "slack":
+            return (hasNonEmptyStringFields(value, ["botToken", "signingSecret"]) &&
+                hasNonEmptyStringFields(endpoints, ["adminInboundUrl", "apiRoot", "eventsUrl"]) &&
+                hasNonEmptyStringFields(env, [
+                    "SLACK_API_URL",
+                    "SLACK_BOT_TOKEN",
+                    "SLACK_SIGNING_SECRET",
+                ]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/crabline/slack/inbound` &&
+                endpoints.apiRoot === `${baseUrl}/api/` &&
+                endpoints.eventsUrl === `${baseUrl}/slack/events` &&
+                env.SLACK_API_URL === endpoints.apiRoot &&
+                env.SLACK_BOT_TOKEN === value.botToken &&
+                env.SLACK_SIGNING_SECRET === value.signingSecret);
+        case "telegram":
+            return (hasNonEmptyStringFields(value, ["botToken"]) &&
+                hasNonEmptyStringFields(endpoints, ["adminInboundUrl", "apiRoot"]) &&
+                hasNonEmptyStringFields(env, ["TELEGRAM_BOT_TOKEN"]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/crabline/telegram/inbound` &&
+                endpoints.apiRoot === baseUrl &&
+                env.TELEGRAM_BOT_TOKEN === value.botToken);
+        case "whatsapp":
+            return (hasNonEmptyStringFields(value, [
+                "accessToken",
+                "graphVersion",
+                "phoneNumberId",
+                "selfJid",
+            ]) &&
+                hasNonEmptyStringFields(endpoints, [
+                    "adminInboundUrl",
+                    "apiRoot",
+                    "baileysWebSocketUrl",
+                    "messagesUrl",
+                    "phoneNumberUrl",
+                    "statusUrl",
+                ]) &&
+                hasNonEmptyStringFields(env, [
+                    "CLOUD_API_ACCESS_TOKEN",
+                    "CLOUD_API_VERSION",
+                    "WA_BASE_URL",
+                    "WA_PHONE_NUMBER_ID",
+                ]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/_crabline/admin/whatsapp/inbound` &&
+                endpoints.apiRoot === `${baseUrl}/${value.graphVersion}` &&
+                endpoints.phoneNumberUrl ===
+                    `${endpoints.apiRoot}/${value.phoneNumberId}` &&
+                endpoints.messagesUrl === `${endpoints.phoneNumberUrl}/messages` &&
+                endpoints.statusUrl === endpoints.messagesUrl &&
+                endpoints.baileysWebSocketUrl ===
+                    `${baseUrl.replace(/^http/u, "ws")}/ws/chat?access_token=${encodeURIComponent(value.accessToken)}` &&
+                env.CLOUD_API_ACCESS_TOKEN === value.accessToken &&
+                env.CLOUD_API_VERSION === value.graphVersion &&
+                env.WA_BASE_URL === baseUrl &&
+                env.WA_PHONE_NUMBER_ID === value.phoneNumberId);
+        case "zalo":
+            return (hasNonEmptyStringFields(value, ["botId", "botToken"]) &&
+                hasNonEmptyStringFields(endpoints, ["adminInboundUrl", "apiRoot"]) &&
+                hasNonEmptyStringFields(env, ["ZALO_API_URL", "ZALO_BOT_TOKEN"]) &&
+                endpoints.adminInboundUrl === `${baseUrl}/crabline/zalo/inbound` &&
+                endpoints.apiRoot === baseUrl &&
+                env.ZALO_API_URL === baseUrl &&
+                env.ZALO_BOT_TOKEN === value.botToken);
+        default:
+            return false;
+    }
+}
+function isSuccessfulProbe(value, manifest) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    switch (manifest.provider) {
+        case "mattermost":
+            return (value.id === manifest.botUserId &&
+                typeof value.username === "string" &&
+                value.username.trim().length > 0 &&
+                typeof value.update_at === "number" &&
+                Number.isSafeInteger(value.update_at) &&
+                value.update_at >= 0);
+        case "matrix":
+            return value.user_id === manifest.botUserId;
+        case "signal":
+            return (value.ok === true &&
+                typeof value.status === "number" &&
+                Number.isInteger(value.status) &&
+                value.status >= 200 &&
+                value.status < 300);
+        case "slack":
+            return value.ok === true;
+        case "telegram": {
+            const result = value.result;
+            const tokenBotId = typeof manifest.botToken === "string"
+                ? /^([1-9]\d*):/u.exec(manifest.botToken)?.[1]
+                : undefined;
+            const expectedBotId = tokenBotId === undefined ? undefined : Number(tokenBotId);
+            return (value.ok === true &&
+                isRecord(result) &&
+                typeof result.id === "number" &&
+                Number.isSafeInteger(result.id) &&
+                result.id > 0 &&
+                Number.isSafeInteger(expectedBotId) &&
+                result.id === expectedBotId &&
+                result.is_bot === true &&
+                typeof result.first_name === "string" &&
+                result.first_name.length > 0);
+        }
+        case "whatsapp":
+            return value.id === manifest.phoneNumberId;
+        case "zalo":
+            return value.ok === true && isRecord(value.result) && value.result.id === manifest.botId;
+        default:
+            return false;
+    }
+}
+function isReadinessSection(value, manifest, manifestPath, requireCurrentFields) {
+    if (!isRecord(value) || value.manifestPath !== manifestPath || !isRecord(value.result)) {
+        return false;
+    }
+    const result = value.result;
+    return (result.ok === true &&
+        result.provider === manifest.provider &&
+        isRecord(result.endpoints) &&
+        isDeepStrictEqual(result.endpoints, manifest.endpoints) &&
+        isSuccessfulProbe(result.probe, manifest) &&
+        (!requireCurrentFields || (result.proof === "provider-api-probe" && result.ready === true)));
+}
 function assertGenerationName(value, field) {
     if (typeof value !== "string" || !GENERATION_NAME_PATTERN.test(value)) {
         throw new Error(`OpenClaw Crabline artifact pointer ${field} is malformed.`);
@@ -32,28 +207,38 @@ function artifactRemovalTombstoneBaseName(name) {
         ? originalName
         : null;
 }
-function withRecorderSnapshotPath(providerReadiness, recorderPath) {
+function withPublishedRecorderPath(providerReadiness, recorderPath) {
     const result = providerReadiness.result;
     if (!result || typeof result !== "object" || Array.isArray(result)) {
         throw new Error("OpenClaw Crabline provider readiness result is malformed.");
     }
+    const publishedResult = {
+        ...result,
+    };
+    if (recorderPath === undefined) {
+        delete publishedResult.recorderPath;
+    }
+    else {
+        publishedResult.recorderPath = recorderPath;
+    }
     return {
         ...providerReadiness,
-        result: {
-            ...result,
-            recorderPath,
-        },
+        result: publishedResult,
     };
 }
 function parseArtifactPointer(contents) {
-    let value;
+    let parsed;
     try {
-        value = JSON.parse(contents);
+        parsed = JSON.parse(contents);
     }
     catch (error) {
         throw new Error("OpenClaw Crabline artifact pointer is malformed.", { cause: error });
     }
-    if (value.version !== 1) {
+    if (!isRecord(parsed)) {
+        throw new Error("OpenClaw Crabline artifact pointer is malformed.");
+    }
+    const value = parsed;
+    if (value.version !== 1 && value.version !== 2) {
         throw new Error("OpenClaw Crabline artifact pointer is malformed.");
     }
     assertGenerationName(value.generation, "generation");
@@ -72,6 +257,8 @@ function parseArtifactPointer(contents) {
     if (typeof value.capabilityMatrixPath !== "string" ||
         value.capabilityMatrixPath !== expected.capabilityMatrixPath ||
         value.manifestPath !== expected.manifestPath ||
+        (value.version === 2 &&
+            value.providerReadinessArtifactPath !== expected.providerReadinessArtifactPath) ||
         (value.providerReadinessArtifactPath !== undefined &&
             value.providerReadinessArtifactPath !== expected.providerReadinessArtifactPath) ||
         (value.smokeArtifactPath !== undefined &&
@@ -79,15 +266,36 @@ function parseArtifactPointer(contents) {
         (value.providerReadinessArtifactPath === undefined && value.smokeArtifactPath === undefined)) {
         throw new Error("OpenClaw Crabline artifact pointer is malformed.");
     }
-    return {
+    if (value.version === 1 && value.recorderSnapshotPath !== undefined) {
+        throw new Error("OpenClaw Crabline artifact pointer is malformed.");
+    }
+    if (value.version === 2) {
+        if (value.recorderSnapshotPath !== null && typeof value.recorderSnapshotPath !== "string") {
+            throw new Error("OpenClaw Crabline artifact pointer is malformed.");
+        }
+        if (typeof value.recorderSnapshotPath === "string") {
+            const recorderFileName = path.basename(value.recorderSnapshotPath);
+            if (!recorderFileName.endsWith(".jsonl") ||
+                value.recorderSnapshotPath !== generationArtifactPath(value.generation, recorderFileName)) {
+                throw new Error("OpenClaw Crabline artifact pointer is malformed.");
+            }
+        }
+    }
+    const pointer = {
         capabilityMatrixPath: value.capabilityMatrixPath,
         generation: value.generation,
         ...(value.previousGeneration ? { previousGeneration: value.previousGeneration } : {}),
         manifestPath: value.manifestPath,
         providerReadinessArtifactPath: value.providerReadinessArtifactPath ?? value.smokeArtifactPath,
         smokeArtifactPath: value.smokeArtifactPath ?? value.providerReadinessArtifactPath,
-        version: 1,
     };
+    return value.version === 1
+        ? { ...pointer, version: 1 }
+        : {
+            ...pointer,
+            recorderSnapshotPath: value.recorderSnapshotPath,
+            version: 2,
+        };
 }
 export async function readOpenClawCrablineArtifactPointer(outputDir) {
     try {
@@ -100,17 +308,178 @@ export async function readOpenClawCrablineArtifactPointer(outputDir) {
         throw error;
     }
 }
-async function assertCurrentGenerationExists(outputDir, pointer) {
+async function assertArtifactGenerationExists(outputDir, pointer) {
+    const generationDirectory = path.resolve(outputDir, OPENCLAW_CRABLINE_ARTIFACT_STORE_DIRECTORY, pointer.generation);
+    let currentGeneration;
+    try {
+        currentGeneration = await captureDirectoryIdentity(generationDirectory);
+    }
+    catch (error) {
+        throw new Error("OpenClaw Crabline current artifact generation is incomplete.", {
+            cause: error,
+        });
+    }
+    const assertGenerationIdentity = async () => {
+        try {
+            await currentGeneration.assertIdentityAt();
+        }
+        catch (error) {
+            throw new Error("OpenClaw Crabline current artifact generation is incomplete.", {
+                cause: error,
+            });
+        }
+    };
     for (const artifactPath of [
         pointer.manifestPath,
         pointer.capabilityMatrixPath,
         pointer.providerReadinessArtifactPath,
     ]) {
-        const stats = await fs.lstat(path.join(outputDir, artifactPath));
+        await assertGenerationIdentity();
+        let stats;
+        try {
+            stats = await fs.lstat(path.join(outputDir, artifactPath));
+        }
+        catch (error) {
+            throw new Error("OpenClaw Crabline current artifact generation is incomplete.", {
+                cause: error,
+            });
+        }
         if (!stats.isFile()) {
             throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
         }
+        await assertGenerationIdentity();
     }
+    const readArtifactObject = async (artifactPath) => {
+        try {
+            await assertGenerationIdentity();
+            const value = JSON.parse(await fs.readFile(path.join(outputDir, artifactPath), "utf8"));
+            await assertGenerationIdentity();
+            if (!isRecord(value)) {
+                throw new Error("artifact is not an object");
+            }
+            return value;
+        }
+        catch (error) {
+            throw new Error("OpenClaw Crabline current artifact generation is incomplete.", {
+                cause: error,
+            });
+        }
+    };
+    const readNestedRecorderPath = (value) => {
+        const result = value.result;
+        const recorderPath = result.recorderPath;
+        if (recorderPath !== undefined && typeof recorderPath !== "string") {
+            throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+        }
+        return recorderPath;
+    };
+    const manifest = await readArtifactObject(pointer.manifestPath);
+    const capabilityMatrix = await readArtifactObject(pointer.capabilityMatrixPath);
+    const readiness = await readArtifactObject(pointer.providerReadinessArtifactPath);
+    const providerReadiness = readiness.providerReadiness;
+    const smoke = readiness.smoke;
+    if (!isGeneratedManifest(manifest) ||
+        capabilityMatrix.version !== 1 ||
+        capabilityMatrix.source !== "openclaw/crabline" ||
+        capabilityMatrix.manifestPath !== pointer.manifestPath ||
+        capabilityMatrix.channelDriver !== "crabline" ||
+        typeof capabilityMatrix.selectedChannel !== "string" ||
+        capabilityMatrix.selectedChannel.length === 0 ||
+        capabilityMatrix.report === null ||
+        typeof capabilityMatrix.report !== "object" ||
+        Array.isArray(capabilityMatrix.report) ||
+        readiness.version !== 1 ||
+        readiness.source !== "openclaw/crabline" ||
+        readiness.manifestPath !== pointer.manifestPath ||
+        readiness.channelDriver !== "crabline" ||
+        readiness.selectedChannel !== capabilityMatrix.selectedChannel ||
+        manifest.provider !== readiness.selectedChannel ||
+        !isReadinessSection(smoke, manifest, pointer.manifestPath, pointer.version === 2 || providerReadiness !== undefined) ||
+        (pointer.version === 2 &&
+            (!isReadinessSection(providerReadiness, manifest, pointer.manifestPath, true) ||
+                !isDeepStrictEqual(providerReadiness, smoke))) ||
+        (pointer.version === 1 &&
+            providerReadiness !== undefined &&
+            (!isReadinessSection(providerReadiness, manifest, pointer.manifestPath, true) ||
+                !isDeepStrictEqual(providerReadiness, smoke)))) {
+        throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+    }
+    const manifestRecorderPath = typeof manifest.recorderPath === "string" ? manifest.recorderPath : undefined;
+    const providerReadinessRecorderPath = isRecord(providerReadiness)
+        ? readNestedRecorderPath(providerReadiness)
+        : undefined;
+    const smokeRecorderPath = readNestedRecorderPath(smoke);
+    const readinessRecorderPaths = [
+        ...(isRecord(providerReadiness) ? [providerReadinessRecorderPath] : []),
+        smokeRecorderPath,
+    ];
+    const recorderPaths = [manifestRecorderPath, ...readinessRecorderPaths];
+    if (manifest.recorderPath !== undefined && typeof manifest.recorderPath !== "string") {
+        throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+    }
+    // The artifact store is owner-only; v1 compatibility covers historical layouts, not hostile same-owner rewrites.
+    if (pointer.version === 1 &&
+        readinessRecorderPaths.every((recorderPath) => recorderPath === undefined) &&
+        (manifestRecorderPath === undefined ||
+            path.dirname(path.resolve(outputDir, manifestRecorderPath)) !== generationDirectory)) {
+        return;
+    }
+    if (pointer.version === 2 && pointer.recorderSnapshotPath === null) {
+        if (recorderPaths.some((recorderPath) => recorderPath !== undefined)) {
+            throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+        }
+        return;
+    }
+    const resolvedRecorderPaths = recorderPaths.map((recorderPath) => recorderPath === undefined ? undefined : path.resolve(outputDir, recorderPath));
+    if (resolvedRecorderPaths.some((recorderPath) => recorderPath === undefined || path.dirname(recorderPath) !== generationDirectory) ||
+        new Set(resolvedRecorderPaths).size !== 1) {
+        throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+    }
+    const recorderPath = resolvedRecorderPaths[0];
+    if (pointer.version === 2 &&
+        pointer.recorderSnapshotPath !== null &&
+        recorderPath !== path.resolve(outputDir, pointer.recorderSnapshotPath)) {
+        throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+    }
+    try {
+        await assertGenerationIdentity();
+        const recorderStats = await fs.lstat(recorderPath, { bigint: true });
+        if (recorderStats.isFile() && recorderStats.nlink === 1n) {
+            await assertGenerationIdentity();
+            return;
+        }
+    }
+    catch (error) {
+        throw new Error("OpenClaw Crabline current artifact generation is incomplete.", {
+            cause: error,
+        });
+    }
+    throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+}
+async function readValidCurrentArtifactGeneration(outputDir, initialPointer) {
+    let pointer = initialPointer;
+    let lastValidationError;
+    for (let attempt = 0; attempt < CURRENT_GENERATION_READ_ATTEMPTS; attempt += 1) {
+        try {
+            await assertArtifactGenerationExists(outputDir, pointer);
+            lastValidationError = undefined;
+        }
+        catch (error) {
+            lastValidationError = error;
+        }
+        const currentPointer = await readOpenClawCrablineArtifactPointer(outputDir);
+        if (currentPointer === null || isDeepStrictEqual(currentPointer, pointer)) {
+            if (lastValidationError !== undefined) {
+                throw lastValidationError;
+            }
+            if (currentPointer === null) {
+                throw new Error("OpenClaw Crabline current artifact generation is incomplete.");
+            }
+            return pointer;
+        }
+        pointer = currentPointer;
+    }
+    throw new Error("OpenClaw Crabline current artifact generation changed too frequently to validate.", lastValidationError === undefined ? undefined : { cause: lastValidationError });
 }
 async function pruneArtifactStore(params) {
     const retainedGenerations = new Set(params.pointer
@@ -153,11 +522,11 @@ export async function publishOpenClawCrablineArtifactGeneration(params, dependen
     await output.assertIdentityAt();
     await store.assertIdentityAt();
     await params.lock.assertOwned();
-    const currentPointer = await readOpenClawCrablineArtifactPointer(outputDir);
+    let currentPointer = await readOpenClawCrablineArtifactPointer(outputDir);
     await output.assertIdentityAt();
     await store.assertIdentityAt();
     if (currentPointer) {
-        await assertCurrentGenerationExists(outputDir, currentPointer);
+        currentPointer = await readValidCurrentArtifactGeneration(outputDir, currentPointer);
         await output.assertIdentityAt();
         await store.assertIdentityAt();
     }
@@ -193,15 +562,6 @@ export async function publishOpenClawCrablineArtifactGeneration(params, dependen
     let primaryError;
     let published;
     try {
-        const pointer = {
-            capabilityMatrixPath: generationArtifactPath(generation, params.selection.capabilityMatrixPath),
-            generation,
-            manifestPath: generationArtifactPath(generation, OPENCLAW_CRABLINE_MANIFEST_PATH),
-            ...(currentPointer ? { previousGeneration: currentPointer.generation } : {}),
-            providerReadinessArtifactPath: generationArtifactPath(generation, providerReadinessArtifactPath),
-            smokeArtifactPath: generationArtifactPath(generation, providerReadinessArtifactPath),
-            version: 1,
-        };
         if (params.recorderSnapshot &&
             (path.basename(params.recorderSnapshot.fileName) !== params.recorderSnapshot.fileName ||
                 !params.recorderSnapshot.fileName.endsWith(".jsonl"))) {
@@ -210,12 +570,20 @@ export async function publishOpenClawCrablineArtifactGeneration(params, dependen
         const recorderSnapshotPath = params.recorderSnapshot
             ? generationArtifactPath(generation, params.recorderSnapshot.fileName)
             : undefined;
+        const pointer = {
+            capabilityMatrixPath: generationArtifactPath(generation, params.selection.capabilityMatrixPath),
+            generation,
+            manifestPath: generationArtifactPath(generation, OPENCLAW_CRABLINE_MANIFEST_PATH),
+            ...(currentPointer ? { previousGeneration: currentPointer.generation } : {}),
+            providerReadinessArtifactPath: generationArtifactPath(generation, providerReadinessArtifactPath),
+            recorderSnapshotPath: recorderSnapshotPath ?? null,
+            smokeArtifactPath: generationArtifactPath(generation, providerReadinessArtifactPath),
+            version: 2,
+        };
         const publishedManifest = recorderSnapshotPath
             ? { ...params.manifest, recorderPath: recorderSnapshotPath }
-            : params.manifest;
-        const providerReadinessBase = recorderSnapshotPath
-            ? withRecorderSnapshotPath(params.providerReadiness, recorderSnapshotPath)
-            : params.providerReadiness;
+            : Object.fromEntries(Object.entries(params.manifest).filter(([key]) => key !== "recorderPath"));
+        const providerReadinessBase = withPublishedRecorderPath(params.providerReadiness, recorderSnapshotPath);
         const providerReadiness = {
             ...providerReadinessBase,
             manifestPath: pointer.manifestPath,
@@ -280,6 +648,10 @@ export async function publishOpenClawCrablineArtifactGeneration(params, dependen
         await output.assertIdentityAt();
         await store.assertIdentityAt();
         await staging.assertIdentityAt(generationPath);
+        await assertArtifactGenerationExists(outputDir, pointer);
+        await output.assertIdentityAt();
+        await store.assertIdentityAt();
+        await staging.assertIdentityAt(generationPath);
         await params.lock.commitFileAtomically({
             contents: `${JSON.stringify(pointer, null, 2)}\n`,
             destinationPath: path.join(outputDir, OPENCLAW_CRABLINE_ARTIFACT_POINTER_PATH),