@openclaw/synology-chat 2026.5.2 → 2026.5.3-beta.2

package/dist/channel-plugin-api.js

@@ -0,0 +1,2 @@
+import { t as synologyChatPlugin } from "./channel-BYl2GyR_.js";
+export { synologyChatPlugin };

package/dist/contract-api.js

@@ -0,0 +1,2 @@
+import { t as collectSynologyChatSecurityAuditFindings } from "./security-audit-Zu_nkF2x.js";
+export { collectSynologyChatSecurityAuditFindings };

package/dist/index.js

@@ -0,0 +1,18 @@
+import { defineBundledChannelEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+//#region extensions/synology-chat/index.ts
+var synology_chat_default = defineBundledChannelEntry({
+	id: "synology-chat",
+	name: "Synology Chat",
+	description: "Native Synology Chat channel plugin for OpenClaw",
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./channel-plugin-api.js",
+		exportName: "synologyChatPlugin"
+	},
+	runtime: {
+		specifier: "./api.js",
+		exportName: "setSynologyRuntime"
+	}
+});
+//#endregion
+export { synology_chat_default as default };

package/dist/security-audit-Zu_nkF2x.js

@@ -0,0 +1,14 @@
+//#region extensions/synology-chat/src/security-audit.ts
+function collectSynologyChatSecurityAuditFindings(params) {
+	if (!params.account.dangerouslyAllowNameMatching) return [];
+	const accountId = params.accountId?.trim() || params.account.accountId || "default";
+	return [{
+		checkId: "channels.synology-chat.reply.dangerous_name_matching_enabled",
+		severity: "info",
+		title: `Synology Chat dangerous name matching is enabled${params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath ? ` (account: ${accountId})` : ""}`,
+		detail: "dangerouslyAllowNameMatching=true re-enables mutable username/nickname matching for reply delivery. This is a break-glass compatibility mode, not a hardened default.",
+		remediation: "Prefer stable numeric Synology Chat user IDs for reply delivery, then disable dangerouslyAllowNameMatching."
+	}];
+}
+//#endregion
+export { collectSynologyChatSecurityAuditFindings as t };

package/dist/setup-api.js

@@ -0,0 +1,2 @@
+import { n as synologyChatSetupWizard, t as synologyChatSetupAdapter } from "./setup-surface-BTp4n9pb.js";
+export { synologyChatSetupAdapter, synologyChatSetupWizard };

package/dist/setup-entry.js

@@ -0,0 +1,11 @@
+import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+//#region extensions/synology-chat/setup-entry.ts
+var setup_entry_default = defineBundledChannelSetupEntry({
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./api.js",
+		exportName: "synologyChatPlugin"
+	}
+});
+//#endregion
+export { setup_entry_default as default };

package/dist/setup-surface-BTp4n9pb.js

@@ -0,0 +1,336 @@
+import { DEFAULT_ACCOUNT_ID, listCombinedAccountIds, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
+import { resolveDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, createAllowFromSection, createStandardChannelSetupStatus, formatDocsLink, mergeAllowFromEntries, normalizeAccountId, setSetupChannelEnabled, splitSetupEntries } from "openclaw/plugin-sdk/setup";
+//#region extensions/synology-chat/src/accounts.ts
+/**
+* Account resolution: reads config from channels.synology-chat,
+* merges per-account overrides, falls back to environment variables.
+*/
+/** Extract the channel config from the full OpenClaw config object. */
+function getChannelConfig$1(cfg) {
+	return cfg?.channels?.["synology-chat"];
+}
+function resolveImplicitAccountId(channelCfg) {
+	return channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN ? DEFAULT_ACCOUNT_ID : void 0;
+}
+function getRawAccountConfig$1(channelCfg, accountId) {
+	if (accountId === DEFAULT_ACCOUNT_ID) return channelCfg;
+	return channelCfg.accounts?.[accountId] ?? {};
+}
+function hasExplicitWebhookPath(rawAccount) {
+	return typeof rawAccount?.webhookPath === "string" && rawAccount.webhookPath.trim().length > 0;
+}
+function resolveWebhookPathSource(params) {
+	if (hasExplicitWebhookPath(params.rawAccount)) return "explicit";
+	if (params.accountId !== DEFAULT_ACCOUNT_ID && hasExplicitWebhookPath(params.channelCfg)) return "inherited-base";
+	return "default";
+}
+/** Parse allowedUserIds from string or array to string[]. */
+function parseAllowedUserIds(raw) {
+	if (!raw) return [];
+	if (Array.isArray(raw)) return raw.filter(Boolean);
+	return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function parseRateLimitPerMinute(raw) {
+	if (raw == null) return 30;
+	const trimmed = raw.trim();
+	if (!/^-?\d+$/.test(trimmed)) return 30;
+	return Number.parseInt(trimmed, 10);
+}
+/**
+* List all configured account IDs for this channel.
+* Returns ["default"] if there's a base config, plus any named accounts.
+*/
+function listAccountIds(cfg) {
+	const channelCfg = getChannelConfig$1(cfg);
+	if (!channelCfg) return [];
+	return listCombinedAccountIds({
+		configuredAccountIds: Object.keys(channelCfg.accounts ?? {}),
+		implicitAccountId: resolveImplicitAccountId(channelCfg)
+	});
+}
+/**
+* Resolve a specific account by ID with full defaults applied.
+* Falls back to env vars for the "default" account.
+*/
+function resolveAccount(cfg, accountId) {
+	const channelCfg = getChannelConfig$1(cfg) ?? {};
+	const id = accountId || DEFAULT_ACCOUNT_ID;
+	const accountOverrides = id === DEFAULT_ACCOUNT_ID ? void 0 : channelCfg.accounts?.[id] ?? void 0;
+	const rawAccount = getRawAccountConfig$1(channelCfg, id);
+	const merged = resolveMergedAccountConfig({
+		channelConfig: channelCfg,
+		accounts: channelCfg.accounts,
+		accountId: id
+	});
+	const envToken = process.env.SYNOLOGY_CHAT_TOKEN ?? "";
+	const envIncomingUrl = process.env.SYNOLOGY_CHAT_INCOMING_URL ?? "";
+	const envNasHost = process.env.SYNOLOGY_NAS_HOST ?? "localhost";
+	const envAllowedUserIds = process.env.SYNOLOGY_ALLOWED_USER_IDS ?? "";
+	const envRateLimitValue = parseRateLimitPerMinute(process.env.SYNOLOGY_RATE_LIMIT);
+	const envBotName = process.env.OPENCLAW_BOT_NAME ?? "OpenClaw";
+	const webhookPathSource = resolveWebhookPathSource({
+		accountId: id,
+		channelCfg,
+		rawAccount
+	});
+	const dangerouslyAllowInheritedWebhookPath = rawAccount.dangerouslyAllowInheritedWebhookPath ?? channelCfg.dangerouslyAllowInheritedWebhookPath ?? false;
+	return {
+		accountId: id,
+		enabled: merged.enabled ?? true,
+		token: merged.token ?? envToken,
+		incomingUrl: merged.incomingUrl ?? envIncomingUrl,
+		nasHost: merged.nasHost ?? envNasHost,
+		webhookPath: merged.webhookPath ?? "/webhook/synology",
+		webhookPathSource,
+		dangerouslyAllowNameMatching: resolveDangerousNameMatchingEnabled({
+			providerConfig: channelCfg,
+			accountConfig: accountOverrides
+		}),
+		dangerouslyAllowInheritedWebhookPath,
+		dmPolicy: merged.dmPolicy ?? "allowlist",
+		allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
+		rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
+		botName: merged.botName ?? envBotName,
+		allowInsecureSsl: merged.allowInsecureSsl ?? false
+	};
+}
+//#endregion
+//#region extensions/synology-chat/src/setup-surface.ts
+const channel = "synology-chat";
+const DEFAULT_WEBHOOK_PATH = "/webhook/synology";
+const SYNOLOGY_SETUP_HELP_LINES = [
+	"1) Create an incoming webhook in Synology Chat and copy its URL",
+	"2) Create an outgoing webhook and copy its secret token",
+	`3) Point the outgoing webhook to https://<gateway-host>${DEFAULT_WEBHOOK_PATH}`,
+	"4) Keep allowed user IDs handy for DM allowlisting",
+	`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
+];
+const SYNOLOGY_ALLOW_FROM_HELP_LINES = [
+	"Allowlist Synology Chat DMs by numeric user id.",
+	"Examples:",
+	"- 123456",
+	"- synology-chat:123456",
+	"Multiple entries: comma-separated.",
+	`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
+];
+function normalizeOptionalString(value) {
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
+}
+function getChannelConfig(cfg) {
+	return cfg.channels?.[channel] ?? {};
+}
+function getRawAccountConfig(cfg, accountId) {
+	const channelConfig = getChannelConfig(cfg);
+	if (accountId === DEFAULT_ACCOUNT_ID$1) return channelConfig;
+	return channelConfig.accounts?.[accountId] ?? {};
+}
+function patchSynologyChatAccountConfig(params) {
+	const channelConfig = getChannelConfig(params.cfg);
+	if (params.accountId === DEFAULT_ACCOUNT_ID$1) {
+		const nextChannelConfig = { ...channelConfig };
+		for (const field of params.clearFields ?? []) delete nextChannelConfig[field];
+		return {
+			...params.cfg,
+			channels: {
+				...params.cfg.channels,
+				[channel]: {
+					...nextChannelConfig,
+					...params.enabled ? { enabled: true } : {},
+					...params.patch
+				}
+			}
+		};
+	}
+	const nextAccounts = { ...channelConfig.accounts };
+	const nextAccountConfig = { ...nextAccounts[params.accountId] };
+	for (const field of params.clearFields ?? []) delete nextAccountConfig[field];
+	nextAccounts[params.accountId] = {
+		...nextAccountConfig,
+		...params.enabled ? { enabled: true } : {},
+		...params.patch
+	};
+	return {
+		...params.cfg,
+		channels: {
+			...params.cfg.channels,
+			[channel]: {
+				...channelConfig,
+				...params.enabled ? { enabled: true } : {},
+				accounts: nextAccounts
+			}
+		}
+	};
+}
+function isSynologyChatConfigured(cfg, accountId) {
+	const account = resolveAccount(cfg, accountId);
+	return Boolean(account.token.trim() && account.incomingUrl.trim());
+}
+function validateWebhookUrl(value) {
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "Incoming webhook must use http:// or https://.";
+	} catch {
+		return "Incoming webhook must be a valid URL.";
+	}
+}
+function validateWebhookPath(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return;
+	return trimmed.startsWith("/") ? void 0 : "Webhook path must start with /.";
+}
+function parseSynologyUserId(value) {
+	const cleaned = value.replace(/^synology(?:[-_]?chat)?:/i, "").trim();
+	return /^\d+$/.test(cleaned) ? cleaned : null;
+}
+function normalizeSynologyAllowedUserId(value) {
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return `${value}`.trim();
+	return "";
+}
+function resolveExistingAllowedUserIds(cfg, accountId) {
+	const raw = getRawAccountConfig(cfg, accountId).allowedUserIds;
+	if (Array.isArray(raw)) return raw.map(normalizeSynologyAllowedUserId).filter(Boolean);
+	return normalizeSynologyAllowedUserId(raw).split(",").map((value) => value.trim()).filter(Boolean);
+}
+const synologyChatSetupAdapter = {
+	resolveAccountId: ({ accountId }) => normalizeAccountId(accountId) ?? DEFAULT_ACCOUNT_ID$1,
+	validateInput: ({ accountId, input }) => {
+		if (input.useEnv && accountId !== DEFAULT_ACCOUNT_ID$1) return "Synology Chat env credentials only support the default account.";
+		if (!input.useEnv && !input.token?.trim()) return "Synology Chat requires --token or --use-env.";
+		if (!input.url?.trim()) return "Synology Chat requires --url for the incoming webhook.";
+		const urlError = validateWebhookUrl(input.url.trim());
+		if (urlError) return urlError;
+		if (input.webhookPath?.trim()) return validateWebhookPath(input.webhookPath.trim()) ?? null;
+		return null;
+	},
+	applyAccountConfig: ({ cfg, accountId, input }) => patchSynologyChatAccountConfig({
+		cfg,
+		accountId,
+		enabled: true,
+		clearFields: input.useEnv ? ["token"] : void 0,
+		patch: {
+			...input.useEnv ? {} : { token: input.token?.trim() },
+			incomingUrl: input.url?.trim(),
+			...input.webhookPath?.trim() ? { webhookPath: input.webhookPath.trim() } : {}
+		}
+	})
+};
+const synologyChatSetupWizard = {
+	channel,
+	status: createStandardChannelSetupStatus({
+		channelLabel: "Synology Chat",
+		configuredLabel: "configured",
+		unconfiguredLabel: "needs token + incoming webhook",
+		configuredHint: "configured",
+		unconfiguredHint: "needs token + incoming webhook",
+		configuredScore: 1,
+		unconfiguredScore: 0,
+		includeStatusLine: true,
+		resolveConfigured: ({ cfg, accountId }) => accountId ? isSynologyChatConfigured(cfg, accountId) : listAccountIds(cfg).some((candidateAccountId) => isSynologyChatConfigured(cfg, candidateAccountId)),
+		resolveExtraStatusLines: ({ cfg }) => [`Accounts: ${listAccountIds(cfg).length || 0}`]
+	}),
+	introNote: {
+		title: "Synology Chat webhook setup",
+		lines: SYNOLOGY_SETUP_HELP_LINES
+	},
+	credentials: [{
+		inputKey: "token",
+		providerHint: channel,
+		credentialLabel: "outgoing webhook token",
+		preferredEnvVar: "SYNOLOGY_CHAT_TOKEN",
+		helpTitle: "Synology Chat webhook token",
+		helpLines: SYNOLOGY_SETUP_HELP_LINES,
+		envPrompt: "SYNOLOGY_CHAT_TOKEN detected. Use env var?",
+		keepPrompt: "Synology Chat webhook token already configured. Keep it?",
+		inputPrompt: "Enter Synology Chat outgoing webhook token",
+		allowEnv: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID$1,
+		inspect: ({ cfg, accountId }) => {
+			const account = resolveAccount(cfg, accountId);
+			const raw = getRawAccountConfig(cfg, accountId);
+			return {
+				accountConfigured: isSynologyChatConfigured(cfg, accountId),
+				hasConfiguredValue: Boolean(normalizeOptionalString(raw.token)),
+				resolvedValue: normalizeOptionalString(account.token),
+				envValue: accountId === DEFAULT_ACCOUNT_ID$1 ? normalizeOptionalString(process.env.SYNOLOGY_CHAT_TOKEN) : void 0
+			};
+		},
+		applyUseEnv: async ({ cfg, accountId }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			clearFields: ["token"],
+			patch: {}
+		}),
+		applySet: async ({ cfg, accountId, resolvedValue }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			patch: { token: resolvedValue }
+		})
+	}],
+	textInputs: [{
+		inputKey: "url",
+		message: "Incoming webhook URL",
+		placeholder: "https://nas.example.com/webapi/entry.cgi?api=SYNO.Chat.External&method=incoming...",
+		helpTitle: "Synology Chat incoming webhook",
+		helpLines: ["Use the incoming webhook URL from Synology Chat integrations.", "This is the URL OpenClaw uses to send replies back to Chat."],
+		currentValue: ({ cfg, accountId }) => getRawAccountConfig(cfg, accountId).incomingUrl?.trim(),
+		keepPrompt: (value) => `Incoming webhook URL set (${value}). Keep it?`,
+		validate: ({ value }) => validateWebhookUrl(value),
+		applySet: async ({ cfg, accountId, value }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			patch: { incomingUrl: value.trim() }
+		})
+	}, {
+		inputKey: "webhookPath",
+		message: "Outgoing webhook path (optional)",
+		placeholder: DEFAULT_WEBHOOK_PATH,
+		required: false,
+		applyEmptyValue: true,
+		helpTitle: "Synology Chat outgoing webhook path",
+		helpLines: [`Default path: ${DEFAULT_WEBHOOK_PATH}`, "Change this only if you need multiple Synology Chat webhook routes."],
+		currentValue: ({ cfg, accountId }) => getRawAccountConfig(cfg, accountId).webhookPath?.trim(),
+		keepPrompt: (value) => `Outgoing webhook path set (${value}). Keep it?`,
+		validate: ({ value }) => validateWebhookPath(value),
+		applySet: async ({ cfg, accountId, value }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			clearFields: value.trim() ? void 0 : ["webhookPath"],
+			patch: value.trim() ? { webhookPath: value.trim() } : {}
+		})
+	}],
+	allowFrom: createAllowFromSection({
+		helpTitle: "Synology Chat allowlist",
+		helpLines: SYNOLOGY_ALLOW_FROM_HELP_LINES,
+		message: "Allowed Synology Chat user ids",
+		placeholder: "123456, 987654",
+		invalidWithoutCredentialNote: "Synology Chat user ids must be numeric.",
+		parseInputs: splitSetupEntries,
+		parseId: parseSynologyUserId,
+		apply: async ({ cfg, accountId, allowFrom }) => patchSynologyChatAccountConfig({
+			cfg,
+			accountId,
+			enabled: true,
+			patch: {
+				dmPolicy: "allowlist",
+				allowedUserIds: mergeAllowFromEntries(resolveExistingAllowedUserIds(cfg, accountId), allowFrom)
+			}
+		})
+	}),
+	completionNote: {
+		title: "Synology Chat access control",
+		lines: [
+			`Default outgoing webhook path: ${DEFAULT_WEBHOOK_PATH}`,
+			"Set allowed user IDs, or manually switch `channels.synology-chat.dmPolicy` to `\"open\"` with `allowedUserIds: [\"*\"]` for public DMs.",
+			"With `dmPolicy=\"allowlist\"`, an empty allowedUserIds list blocks the route from starting.",
+			`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
+		]
+	},
+	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
+};
+//#endregion
+export { resolveAccount as i, synologyChatSetupWizard as n, listAccountIds as r, synologyChatSetupAdapter as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/synology-chat",
-  "version": "2026.5.2",
+  "version": "2026.5.3-beta.2",
   "description": "Synology Chat channel plugin for OpenClaw",
   "repository": {
     "type": "git",
@@ -33,14 +33,30 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.2"
+      "pluginApi": ">=2026.5.3-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.2"
+      "openclawVersion": "2026.5.3-beta.2"
     },
     "release": {
       "publishToClawHub": true,
       "publishToNpm": true
+    },
+    "runtimeExtensions": [
+      "./dist/index.js"
+    ],
+    "runtimeSetupEntry": "./dist/setup-entry.js"
+  },
+  "files": [
+    "dist/**",
+    "openclaw.plugin.json"
+  ],
+  "peerDependencies": {
+    "openclaw": ">=2026.5.3-beta.2"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true
     }
   }
 }

package/api.ts

@@ -1,3 +0,0 @@
-export { synologyChatPlugin } from "./src/channel.js";
-export { setSynologyRuntime } from "./src/runtime.js";
-export { collectSynologyChatSecurityAuditFindings } from "./src/security-audit.js";

package/channel-plugin-api.ts

@@ -1 +0,0 @@
-export { synologyChatPlugin } from "./src/channel.js";

package/contract-api.ts

@@ -1 +0,0 @@
-export { collectSynologyChatSecurityAuditFindings } from "./src/security-audit.js";

package/index.ts

@@ -1,16 +0,0 @@
-import { defineBundledChannelEntry } from "openclaw/plugin-sdk/channel-entry-contract";
-
-export default defineBundledChannelEntry({
-  id: "synology-chat",
-  name: "Synology Chat",
-  description: "Native Synology Chat channel plugin for OpenClaw",
-  importMetaUrl: import.meta.url,
-  plugin: {
-    specifier: "./channel-plugin-api.js",
-    exportName: "synologyChatPlugin",
-  },
-  runtime: {
-    specifier: "./api.js",
-    exportName: "setSynologyRuntime",
-  },
-});

package/setup-api.ts

@@ -1 +0,0 @@
-export { synologyChatSetupAdapter, synologyChatSetupWizard } from "./src/setup-surface.js";

package/setup-entry.ts

@@ -1,9 +0,0 @@
-import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
-
-export default defineBundledChannelSetupEntry({
-  importMetaUrl: import.meta.url,
-  plugin: {
-    specifier: "./api.js",
-    exportName: "synologyChatPlugin",
-  },
-});

package/src/accounts.ts

@@ -1,151 +0,0 @@
-/**
- * Account resolution: reads config from channels.synology-chat,
- * merges per-account overrides, falls back to environment variables.
- */
-
-import {
-  DEFAULT_ACCOUNT_ID,
-  listCombinedAccountIds,
-  resolveMergedAccountConfig,
-  type OpenClawConfig,
-} from "openclaw/plugin-sdk/account-resolution";
-import { resolveDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
-import type {
-  SynologyChatChannelConfig,
-  ResolvedSynologyChatAccount,
-  SynologyWebhookPathSource,
-} from "./types.js";
-
-/** Extract the channel config from the full OpenClaw config object. */
-function getChannelConfig(cfg: OpenClawConfig): SynologyChatChannelConfig | undefined {
-  return cfg?.channels?.["synology-chat"] as SynologyChatChannelConfig | undefined;
-}
-
-function resolveImplicitAccountId(channelCfg: SynologyChatChannelConfig): string | undefined {
-  return channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN ? DEFAULT_ACCOUNT_ID : undefined;
-}
-
-function getRawAccountConfig(
-  channelCfg: SynologyChatChannelConfig,
-  accountId: string,
-): SynologyChatChannelConfig {
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return channelCfg;
-  }
-  return channelCfg.accounts?.[accountId] ?? {};
-}
-
-function hasExplicitWebhookPath(rawAccount: SynologyChatChannelConfig | undefined): boolean {
-  return typeof rawAccount?.webhookPath === "string" && rawAccount.webhookPath.trim().length > 0;
-}
-
-function resolveWebhookPathSource(params: {
-  accountId: string;
-  channelCfg: SynologyChatChannelConfig;
-  rawAccount: SynologyChatChannelConfig;
-}): SynologyWebhookPathSource {
-  if (hasExplicitWebhookPath(params.rawAccount)) {
-    return "explicit";
-  }
-  if (params.accountId !== DEFAULT_ACCOUNT_ID && hasExplicitWebhookPath(params.channelCfg)) {
-    return "inherited-base";
-  }
-  return "default";
-}
-
-/** Parse allowedUserIds from string or array to string[]. */
-function parseAllowedUserIds(raw: string | string[] | undefined): string[] {
-  if (!raw) {
-    return [];
-  }
-  if (Array.isArray(raw)) {
-    return raw.filter(Boolean);
-  }
-  return raw
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean);
-}
-
-function parseRateLimitPerMinute(raw: string | undefined): number {
-  if (raw == null) {
-    return 30;
-  }
-  const trimmed = raw.trim();
-  if (!/^-?\d+$/.test(trimmed)) {
-    return 30;
-  }
-  return Number.parseInt(trimmed, 10);
-}
-
-/**
- * List all configured account IDs for this channel.
- * Returns ["default"] if there's a base config, plus any named accounts.
- */
-export function listAccountIds(cfg: OpenClawConfig): string[] {
-  const channelCfg = getChannelConfig(cfg);
-  if (!channelCfg) {
-    return [];
-  }
-
-  return listCombinedAccountIds({
-    configuredAccountIds: Object.keys(channelCfg.accounts ?? {}),
-    implicitAccountId: resolveImplicitAccountId(channelCfg),
-  });
-}
-
-/**
- * Resolve a specific account by ID with full defaults applied.
- * Falls back to env vars for the "default" account.
- */
-export function resolveAccount(
-  cfg: OpenClawConfig,
-  accountId?: string | null,
-): ResolvedSynologyChatAccount {
-  const channelCfg = getChannelConfig(cfg) ?? {};
-  const id = accountId || DEFAULT_ACCOUNT_ID;
-  const accountOverrides =
-    id === DEFAULT_ACCOUNT_ID ? undefined : (channelCfg.accounts?.[id] ?? undefined);
-  const rawAccount = getRawAccountConfig(channelCfg, id);
-  const merged = resolveMergedAccountConfig<Record<string, unknown> & SynologyChatChannelConfig>({
-    channelConfig: channelCfg as Record<string, unknown> & SynologyChatChannelConfig,
-    accounts: channelCfg.accounts as
-      | Record<string, Partial<Record<string, unknown> & SynologyChatChannelConfig>>
-      | undefined,
-    accountId: id,
-  });
-
-  // Env var fallbacks (primarily for the "default" account)
-  const envToken = process.env.SYNOLOGY_CHAT_TOKEN ?? "";
-  const envIncomingUrl = process.env.SYNOLOGY_CHAT_INCOMING_URL ?? "";
-  const envNasHost = process.env.SYNOLOGY_NAS_HOST ?? "localhost";
-  const envAllowedUserIds = process.env.SYNOLOGY_ALLOWED_USER_IDS ?? "";
-  const envRateLimitValue = parseRateLimitPerMinute(process.env.SYNOLOGY_RATE_LIMIT);
-  const envBotName = process.env.OPENCLAW_BOT_NAME ?? "OpenClaw";
-  const webhookPathSource = resolveWebhookPathSource({ accountId: id, channelCfg, rawAccount });
-  const dangerouslyAllowInheritedWebhookPath =
-    rawAccount.dangerouslyAllowInheritedWebhookPath ??
-    channelCfg.dangerouslyAllowInheritedWebhookPath ??
-    false;
-
-  // Merge: account override > base channel config > env var
-  return {
-    accountId: id,
-    enabled: merged.enabled ?? true,
-    token: merged.token ?? envToken,
-    incomingUrl: merged.incomingUrl ?? envIncomingUrl,
-    nasHost: merged.nasHost ?? envNasHost,
-    webhookPath: merged.webhookPath ?? "/webhook/synology",
-    webhookPathSource,
-    dangerouslyAllowNameMatching: resolveDangerousNameMatchingEnabled({
-      providerConfig: channelCfg,
-      accountConfig: accountOverrides,
-    }),
-    dangerouslyAllowInheritedWebhookPath,
-    dmPolicy: merged.dmPolicy ?? "allowlist",
-    allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
-    rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
-    botName: merged.botName ?? envBotName,
-    allowInsecureSsl: merged.allowInsecureSsl ?? false,
-  };
-}

package/src/approval-auth.test.ts

@@ -1,17 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { synologyChatApprovalAuth } from "./approval-auth.js";
-
-describe("synologyChatApprovalAuth", () => {
-  it("authorizes numeric Synology Chat user ids", () => {
-    const cfg = { channels: { "synology-chat": { allowedUserIds: ["123"] } } };
-
-    expect(
-      synologyChatApprovalAuth.authorizeActorAction({
-        cfg,
-        senderId: "123",
-        action: "approve",
-        approvalKind: "plugin",
-      }),
-    ).toEqual({ authorized: true });
-  });
-});

package/src/approval-auth.ts

@@ -1,22 +0,0 @@
-import {
-  createResolvedApproverActionAuthAdapter,
-  resolveApprovalApprovers,
-} from "openclaw/plugin-sdk/approval-auth-runtime";
-import { resolveAccount } from "./accounts.js";
-
-function normalizeSynologyChatApproverId(value: string | number): string | undefined {
-  const trimmed = String(value).trim();
-  return /^\d+$/.test(trimmed) ? trimmed : undefined;
-}
-
-export const synologyChatApprovalAuth = createResolvedApproverActionAuthAdapter({
-  channelLabel: "Synology Chat",
-  resolveApprovers: ({ cfg, accountId }) => {
-    const account = resolveAccount(cfg ?? {}, accountId);
-    return resolveApprovalApprovers({
-      allowFrom: account.allowedUserIds,
-      normalizeApprover: normalizeSynologyChatApproverId,
-    });
-  },
-  normalizeSenderId: (value) => normalizeSynologyChatApproverId(value),
-});