@openclaw/synology-chat 2026.5.7 → 2026.5.10-beta.1

package/dist/api.js

@@ -1,3 +1,3 @@
-import { n as setSynologyRuntime, t as synologyChatPlugin } from "./channel-BYl2GyR_.js";
+import { n as setSynologyRuntime, t as synologyChatPlugin } from "./channel-IPqYKUxY.js";
 import { t as collectSynologyChatSecurityAuditFindings } from "./security-audit-Zu_nkF2x.js";
 export { collectSynologyChatSecurityAuditFindings, setSynologyRuntime, synologyChatPlugin };

package/dist/{channel-BYl2GyR_.js → channel-IPqYKUxY.js}

@@ -1,25 +1,27 @@
-import { i as resolveAccount, n as synologyChatSetupWizard, r as listAccountIds, t as synologyChatSetupAdapter } from "./setup-surface-BTp4n9pb.js";
+import { i as resolveAccount, n as synologyChatSetupWizard, r as listAccountIds, t as synologyChatSetupAdapter } from "./setup-surface-daP5yN4Y.js";
 import { t as collectSynologyChatSecurityAuditFindings } from "./security-audit-Zu_nkF2x.js";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { createHybridChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
+import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-message";
 import { composeWarningCollectors, createConditionalWarningCollector, projectAccountConfigWarningCollector, projectAccountWarningCollector } from "openclaw/plugin-sdk/channel-policy";
-import { attachChannelToResult } from "openclaw/plugin-sdk/channel-send-result";
 import { createEmptyChannelDirectoryAdapter } from "openclaw/plugin-sdk/directory-runtime";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/account-resolution";
 import { createResolvedApproverActionAuthAdapter, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
 import * as http from "node:http";
 import * as https from "node:https";
 import { safeParseJsonWithSchema, safeParseWithSchema } from "openclaw/plugin-sdk/extension-shared";
+import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { formatErrorMessage, resolvePinnedHostnameWithPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
-import { z } from "zod";
+import { z } from "openclaw/plugin-sdk/zod";
 import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
-import { z as z$1 } from "openclaw/plugin-sdk/zod";
 import { beginWebhookRequestPipelineOrReject, createFixedWindowRateLimiter, createWebhookInFlightLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, registerPluginHttpRoute, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { buildAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import * as querystring from "node:querystring";
+import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/synology-chat/src/approval-auth.ts
 function normalizeSynologyChatApproverId(value) {
@@ -44,9 +46,6 @@ const synologyChatApprovalAuth = createResolvedApproverActionAuthAdapter({
 */
 const MIN_SEND_INTERVAL_MS = 500;
 let lastSendTime = 0;
-function normalizeLowercaseStringOrEmpty$2(value) {
-	return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
 const ChatUserSchema = z.object({
 	user_id: z.number(),
 	username: z.string().optional(),
@@ -179,10 +178,10 @@ async function assertSafeWebhookFileUrl(fileUrl) {
 */
 async function resolveLegacyWebhookNameToChatUserId(params) {
 	const users = await fetchChatUsers(params.incomingUrl, params.allowInsecureSsl, params.log);
-	const lower = normalizeLowercaseStringOrEmpty$2(params.mutableWebhookUsername);
-	const byNickname = users.find((u) => normalizeLowercaseStringOrEmpty$2(u.nickname) === lower);
+	const lower = normalizeLowercaseStringOrEmpty(params.mutableWebhookUsername);
+	const byNickname = users.find((u) => normalizeLowercaseStringOrEmpty(u.nickname) === lower);
 	if (byNickname) return byNickname.user_id;
-	const byUsername = users.find((u) => normalizeLowercaseStringOrEmpty$2(u.username) === lower);
+	const byUsername = users.find((u) => normalizeLowercaseStringOrEmpty(u.username) === lower);
 	if (byUsername) return byUsername.user_id;
 }
 function buildWebhookBody(payload, userId) {
@@ -230,14 +229,11 @@ function doPost(url, body, allowInsecureSsl = false) {
 		req.end();
 	});
 }
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
 //#endregion
 //#region extensions/synology-chat/src/config-schema.ts
-const SynologyChatChannelConfigSchema = buildChannelConfigSchema(z$1.object({
-	dangerouslyAllowNameMatching: z$1.boolean().optional(),
-	dangerouslyAllowInheritedWebhookPath: z$1.boolean().optional()
+const SynologyChatChannelConfigSchema = buildChannelConfigSchema(z.object({
+	dangerouslyAllowNameMatching: z.boolean().optional(),
+	dangerouslyAllowInheritedWebhookPath: z.boolean().optional()
 }).passthrough());
 //#endregion
 //#region extensions/synology-chat/src/runtime.ts
@@ -288,8 +284,8 @@ function resolveSynologyChatInboundRoute(params) {
 }
 async function deliverSynologyChatReply(params) {
 	const text = params.payload.text ?? params.payload.body;
-	if (!text) return;
-	await sendMessage(params.account.incomingUrl, text, params.sendUserId, params.account.allowInsecureSsl);
+	if (!text) return { visibleReplySent: false };
+	return { visibleReplySent: await sendMessage(params.account.incomingUrl, text, params.sendUserId, params.account.allowInsecureSsl) };
 }
 async function dispatchSynologyChatInboundTurn(params) {
 	const currentCfg = getSynologyRuntime().config.current();
@@ -364,13 +360,16 @@ async function dispatchSynologyChatInboundTurn(params) {
 					ctxPayload: msgCtx,
 					recordInboundSession: resolved.rt.channel.session.recordInboundSession,
 					dispatchReplyWithBufferedBlockDispatcher: resolved.rt.channel.reply.dispatchReplyWithBufferedBlockDispatcher,
-					delivery: { deliver: async (payload) => {
-						await deliverSynologyChatReply({
-							account: params.account,
-							sendUserId,
-							payload
-						});
-					} },
+					delivery: {
+						durable: () => ({ to: sendUserId }),
+						deliver: async (payload) => {
+							return await deliverSynologyChatReply({
+								account: params.account,
+								sendUserId,
+								payload
+							});
+						}
+					},
 					dispatcherOptions: { onReplyStart: () => {
 						params.log?.info?.(`Agent reply started for ${params.msg.from}`);
 					} },
@@ -396,37 +395,23 @@ function validateToken(received, expected) {
 	if (!received || !expected) return false;
 	return safeEqualSecret(received, expected);
 }
-/**
-* Check if a user ID is in the allowed list.
-* Allowlist mode must be explicit; empty lists should not match any user.
-*/
-function checkUserAllowed(userId, allowedUserIds) {
-	if (allowedUserIds.length === 0) return false;
-	if (allowedUserIds.includes("*")) return true;
-	return allowedUserIds.includes(userId);
-}
-/**
-* Resolve DM authorization for a sender across all DM policy modes.
-* Keeps policy semantics in one place so webhook/startup behavior stays consistent.
-*/
-function authorizeUserForDm(userId, dmPolicy, allowedUserIds) {
-	if (dmPolicy === "disabled") return {
-		allowed: false,
-		reason: "disabled"
-	};
-	if (dmPolicy === "open") return checkUserAllowed(userId, allowedUserIds) ? { allowed: true } : {
-		allowed: false,
-		reason: "not-allowlisted"
-	};
-	if (allowedUserIds.length === 0) return {
-		allowed: false,
-		reason: "allowlist-empty"
-	};
-	if (!checkUserAllowed(userId, allowedUserIds)) return {
-		allowed: false,
-		reason: "not-allowlisted"
-	};
-	return { allowed: true };
+async function authorizeUserForDmWithIngress(params) {
+	return await resolveStableChannelMessageIngress({
+		channelId: "synology-chat",
+		accountId: params.accountId,
+		identity: {
+			key: "sender-id",
+			entryIdPrefix: "synology-chat-entry"
+		},
+		subject: { stableId: params.userId },
+		conversation: {
+			kind: "direct",
+			id: "direct"
+		},
+		event: { mayPair: false },
+		dmPolicy: params.dmPolicy,
+		allowFrom: params.allowedUserIds
+	});
 }
 /**
 * Sanitize user input to prevent prompt injection attacks.
@@ -476,9 +461,6 @@ var RateLimiter = class {
 };
 //#endregion
 //#region extensions/synology-chat/src/webhook-handler.ts
-function normalizeLowercaseStringOrEmpty$1(value) {
-	return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
 const rateLimiters = /* @__PURE__ */ new Map();
 const invalidTokenRateLimiters = /* @__PURE__ */ new Map();
 const webhookInFlightLimiter = createWebhookInFlightLimiter();
@@ -642,7 +624,7 @@ function extractTokenFromHeaders(req) {
 * - text    <- text | message | content
 */
 function parsePayload(req, body) {
-	const contentType = normalizeLowercaseStringOrEmpty$1(req.headers["content-type"]);
+	const contentType = normalizeLowercaseStringOrEmpty(req.headers["content-type"]);
 	let bodyFields = {};
 	if (contentType.includes("application/json")) bodyFields = parseJsonBody(body);
 	else if (contentType.includes("application/x-www-form-urlencoded")) bodyFields = parseFormBody(body);
@@ -727,7 +709,7 @@ async function parseWebhookPayloadRequest(params) {
 		payload
 	};
 }
-function authorizeSynologyWebhook(params) {
+async function authorizeSynologyWebhook(params) {
 	const invalidTokenRateLimitKey = getSynologyWebhookInvalidTokenRateLimitKey(params.req);
 	if (params.invalidTokenRateLimiter.isLocked(invalidTokenRateLimitKey)) {
 		params.log?.warn(`Rate limit exceeded for remote IP: ${invalidTokenRateLimitKey}`);
@@ -753,14 +735,19 @@ function authorizeSynologyWebhook(params) {
 			error: "Invalid token"
 		};
 	}
-	const auth = authorizeUserForDm(params.payload.user_id, params.account.dmPolicy, params.account.allowedUserIds);
-	if (!auth.allowed) {
-		if (auth.reason === "disabled") return {
+	const auth = await authorizeUserForDmWithIngress({
+		accountId: params.account.accountId,
+		userId: params.payload.user_id,
+		dmPolicy: params.account.dmPolicy,
+		allowedUserIds: params.account.allowedUserIds
+	});
+	if (!auth.senderAccess.allowed) {
+		if (auth.senderAccess.reasonCode === "dm_policy_disabled") return {
 			ok: false,
 			statusCode: 403,
 			error: "DMs are disabled"
 		};
-		if (auth.reason === "allowlist-empty") {
+		if (params.account.dmPolicy === "allowlist" && params.account.allowedUserIds.length === 0) {
 			params.log?.warn("Synology Chat allowlist is empty while dmPolicy=allowlist; rejecting message");
 			return {
 				ok: false,
@@ -785,7 +772,7 @@ function authorizeSynologyWebhook(params) {
 	}
 	return {
 		ok: true,
-		commandAuthorized: auth.allowed
+		commandAuthorized: auth.senderAccess.allowed
 	};
 }
 function sanitizeSynologyWebhookText(payload) {
@@ -796,7 +783,7 @@ function sanitizeSynologyWebhookText(payload) {
 async function parseAndAuthorizeSynologyWebhook(params) {
 	const parsed = await parseWebhookPayloadRequest(params);
 	if (!parsed.ok) return { ok: false };
-	const authorized = authorizeSynologyWebhook({
+	const authorized = await authorizeSynologyWebhook({
 		req: params.req,
 		account: params.account,
 		payload: parsed.payload,
@@ -1016,9 +1003,6 @@ function registerSynologyWebhookRoute(params) {
 * Implements the ChannelPlugin interface following the LINE pattern.
 */
 const CHANNEL_ID = "synology-chat";
-function normalizeLowercaseStringOrEmpty(value) {
-	return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
 const resolveSynologyChatDmPolicy = createScopedDmSecurityResolver({
 	channelKey: CHANNEL_ID,
 	resolvePolicy: (account) => account.dmPolicy,
@@ -1061,6 +1045,53 @@ function requireIncomingUrl(account) {
 	if (!account.incomingUrl) throw new Error("Synology Chat incoming URL not configured");
 	return account.incomingUrl;
 }
+function createSynologyChatSendResult(params) {
+	return {
+		channel: CHANNEL_ID,
+		messageId: params.messageId,
+		chatId: params.chatId,
+		receipt: createMessageReceiptFromOutboundResults({
+			results: [{
+				channel: CHANNEL_ID,
+				messageId: params.messageId,
+				chatId: params.chatId,
+				conversationId: params.chatId
+			}],
+			threadId: params.chatId,
+			kind: params.kind
+		})
+	};
+}
+async function sendSynologyChatText(ctx) {
+	const account = resolveOutboundAccount(ctx.cfg ?? {}, ctx.accountId);
+	if (!await sendMessage(requireIncomingUrl(account), ctx.text, ctx.to, account.allowInsecureSsl)) throw new Error("Failed to send message to Synology Chat");
+	return createSynologyChatSendResult({
+		messageId: `sc-${Date.now()}`,
+		chatId: ctx.to,
+		kind: "text"
+	});
+}
+async function sendSynologyChatMedia(ctx) {
+	const account = resolveOutboundAccount(ctx.cfg ?? {}, ctx.accountId);
+	if (!await sendFileUrl(requireIncomingUrl(account), ctx.mediaUrl, ctx.to, account.allowInsecureSsl)) throw new Error("Failed to send media to Synology Chat");
+	return createSynologyChatSendResult({
+		messageId: `sc-${Date.now()}`,
+		chatId: ctx.to,
+		kind: "media"
+	});
+}
+const synologyChatMessageAdapter = defineChannelMessageAdapter({
+	id: CHANNEL_ID,
+	durableFinal: { capabilities: {
+		text: true,
+		media: true,
+		messageSendingHooks: true
+	} },
+	send: {
+		text: async (ctx) => await sendSynologyChatText(ctx),
+		media: async (ctx) => await sendSynologyChatMedia(ctx)
+	}
+});
 function createSynologyChatPlugin() {
 	return createChatChannelPlugin({
 		base: {
@@ -1160,7 +1191,8 @@ function createSynologyChatPlugin() {
 				"- Use line breaks to separate sections",
 				"- Use numbered or bulleted lists for clarity",
 				"- Wrap URLs with `<URL|label>` for user-friendly links"
-			] }
+			] },
+			message: synologyChatMessageAdapter
 		},
 		pairing: { text: {
 			idLabel: "synologyChatUserId",
@@ -1180,22 +1212,12 @@ function createSynologyChatPlugin() {
 		outbound: {
 			deliveryMode: "gateway",
 			textChunkLimit: 2e3,
-			sendText: async ({ to, text, accountId, cfg }) => {
-				const account = resolveOutboundAccount(cfg ?? {}, accountId);
-				if (!await sendMessage(requireIncomingUrl(account), text, to, account.allowInsecureSsl)) throw new Error("Failed to send message to Synology Chat");
-				return attachChannelToResult(CHANNEL_ID, {
-					messageId: `sc-${Date.now()}`,
-					chatId: to
-				});
-			},
-			sendMedia: async ({ to, mediaUrl, accountId, cfg }) => {
-				const account = resolveOutboundAccount(cfg ?? {}, accountId);
-				const incomingUrl = requireIncomingUrl(account);
-				if (!mediaUrl) throw new Error("No media URL provided");
-				if (!await sendFileUrl(incomingUrl, mediaUrl, to, account.allowInsecureSsl)) throw new Error("Failed to send media to Synology Chat");
-				return attachChannelToResult(CHANNEL_ID, {
-					messageId: `sc-${Date.now()}`,
-					chatId: to
+			sendText: sendSynologyChatText,
+			sendMedia: async (ctx) => {
+				if (!ctx.mediaUrl) throw new Error("Synology Chat media send requires mediaUrl");
+				return await sendSynologyChatMedia({
+					...ctx,
+					mediaUrl: ctx.mediaUrl
 				});
 			}
 		}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as synologyChatPlugin } from "./channel-BYl2GyR_.js";
+import { t as synologyChatPlugin } from "./channel-IPqYKUxY.js";
 export { synologyChatPlugin };

package/dist/setup-api.js

@@ -1,2 +1,2 @@
-import { n as synologyChatSetupWizard, t as synologyChatSetupAdapter } from "./setup-surface-BTp4n9pb.js";
+import { n as synologyChatSetupWizard, t as synologyChatSetupAdapter } from "./setup-surface-daP5yN4Y.js";
 export { synologyChatSetupAdapter, synologyChatSetupWizard };

package/dist/{setup-surface-BTp4n9pb.js → setup-surface-daP5yN4Y.js}

@@ -1,3 +1,4 @@
+import { normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
 import { DEFAULT_ACCOUNT_ID, listCombinedAccountIds, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
 import { resolveDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, createAllowFromSection, createStandardChannelSetupStatus, formatDocsLink, mergeAllowFromEntries, normalizeAccountId, setSetupChannelEnabled, splitSetupEntries } from "openclaw/plugin-sdk/setup";
@@ -114,10 +115,6 @@ const SYNOLOGY_ALLOW_FROM_HELP_LINES = [
 	"Multiple entries: comma-separated.",
 	`Docs: ${formatDocsLink("/channels/synology-chat", "channels/synology-chat")}`
 ];
-function normalizeOptionalString(value) {
-	if (typeof value !== "string") return;
-	return value.trim() || void 0;
-}
 function getChannelConfig(cfg) {
 	return cfg.channels?.[channel] ?? {};
 }

package/package.json

@@ -1,15 +1,12 @@
 {
   "name": "@openclaw/synology-chat",
-  "version": "2026.5.7",
+  "version": "2026.5.10-beta.1",
   "description": "Synology Chat channel plugin for OpenClaw",
   "repository": {
     "type": "git",
     "url": "https://github.com/openclaw/openclaw"
   },
   "type": "module",
-  "dependencies": {
-    "zod": "^4.4.3"
-  },
   "devDependencies": {
     "@openclaw/plugin-sdk": "workspace:*"
   },
@@ -33,10 +30,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.7"
+      "pluginApi": ">=2026.5.10-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.7"
+      "openclawVersion": "2026.5.10-beta.1"
     },
     "release": {
       "publishToClawHub": true,
@@ -52,7 +49,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.7"
+    "openclaw": ">=2026.5.10-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {