@openclaw/whatsapp 2026.9.8 → 2026.10.1-beta.1

package/dist/.setup/{socket-close-CT__V2fz.mjs → socket-close-DU7eerAa.mjs}

@@ -1,14 +1,16 @@
-import { c as resolveWebCredsPath, s as resolveWebCredsBackupPath, t as assertWebCredsPathRegularFileOrMissing } from "./creds-files-CDATZWWM.mjs";
-import { A as enqueueCredsSave, M as waitForCredsSaveQueueWithTimeout, N as writeCredsJsonAtomically, P as writeWebCredsRawAtomically, b as restoreCredsFromBackupIfNeeded, u as readCredsJsonRaw, y as resolveDefaultWebAuthDir } from "./auth-store-BBonwKks.mjs";
+import { a as readWebCredsJsonRawSync, o as resolveWebCredsBackupPath, s as resolveWebCredsPath, t as assertWebCredsPathRegularFileOrMissing } from "./creds-files-B8WcOAmE.mjs";
+import { M as writeCredsJsonAtomically, N as writeWebCredsRawAtomically, j as waitForCredsSaveQueueWithTimeout, k as enqueueCredsSave, v as resolveDefaultWebAuthDir, y as restoreCredsFromBackupIfNeeded } from "./auth-store-D2rN-hP5.mjs";
 import { n as getStatusCode } from "./session-errors-B8UcAnZN.mjs";
 import { a as makeWASocket, i as makeCacheableSignalKeyStore, n as createBaileysSignalRepository, r as fetchLatestBaileysVersion, s as useMultiFileAuthState } from "./session.runtime-st1konFI.mjs";
 import { VERSION, formatCliCommand } from "openclaw/plugin-sdk/cli-runtime";
 import { toErrorObject } from "openclaw/plugin-sdk/error-runtime";
-import { computeBackoff, danger, getChildLogger, sleepWithAbort, success, toPinoLikeLogger } from "openclaw/plugin-sdk/runtime-env";
+import { computeBackoff, danger, getChildLogger, sleepWithAbort, sleepWithAbort as sleepWithAbort$1, success, toPinoLikeLogger } from "openclaw/plugin-sdk/runtime-env";
 import { renderQrTerminal } from "openclaw/plugin-sdk/media-runtime";
 import { clamp, ensureDir, resolveUserPath } from "openclaw/plugin-sdk/text-utility-runtime";
 import fs from "node:fs/promises";
+import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { parseStrictPositiveInteger, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { raceWithTimeout, withTimeout } from "openclaw/plugin-sdk/time-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { FILE_LOCK_STALE_ERROR_CODE, FILE_LOCK_TIMEOUT_ERROR_CODE, acquireFileLock } from "openclaw/plugin-sdk/file-lock";
 import { createNodeProxyAgent } from "openclaw/plugin-sdk/fetch-runtime";
@@ -30,20 +32,6 @@ function ownershipCancelledError(signal) {
 	const reason = signal?.reason;
 	return reason instanceof Error ? reason : new Error("WhatsApp connection ownership cancelled", reason === void 0 ? {} : { cause: reason });
 }
-async function waitForAbortableDelay(delayMs, signal) {
-	if (signal?.aborted) throw ownershipCancelledError(signal);
-	await new Promise((resolve, reject) => {
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(ownershipCancelledError(signal));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, delayMs);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
 async function reserveProcessOwner(params) {
 	while (true) {
 		if (params.signal?.aborted) throw ownershipCancelledError(params.signal);
@@ -126,9 +114,9 @@ async function acquireOwnerLease(params) {
 			}
 			const delayMs = Math.min(100 * 1.5 ** attempt, 1e3);
 			attempt += 1;
-			await waitForAbortableDelay(delayMs, params.signal).catch((delayError) => {
+			await sleepWithAbort(delayMs, params.signal).catch(() => {
 				abandonProcessOwner(ownerPath, processOwner);
-				throw delayError;
+				throw ownershipCancelledError(params.signal);
 			});
 		}
 	}
@@ -162,7 +150,7 @@ async function acquireWhatsAppStandaloneConnectionOwner(authDir) {
 }
 //#endregion
 //#region extensions/whatsapp/src/socket-timing.ts
-const socketSendMessageQueueTails = /* @__PURE__ */ new WeakMap();
+const socketSendMessageQueues = /* @__PURE__ */ new WeakMap();
 const DEFAULT_WHATSAPP_SOCKET_TIMING = {
 	keepAliveIntervalMs: 25e3,
 	connectTimeoutMs: 6e4,
@@ -190,29 +178,20 @@ function isWhatsAppSocketOperationTimeoutError(error) {
 function resolveWhatsAppSocketOperationTimeoutMs(timeoutMs) {
 	return resolveTimerTimeoutMs(timeoutMs, DEFAULT_WHATSAPP_SOCKET_TIMING.defaultQueryTimeoutMs);
 }
-async function runSerializedSocketSendMessage(sock, run) {
-	const result = (socketSendMessageQueueTails.get(sock) ?? Promise.resolve()).then(run);
-	const tail = result.then(() => void 0, () => void 0);
-	socketSendMessageQueueTails.set(sock, tail);
-	tail.then(() => {
-		if (socketSendMessageQueueTails.get(sock) === tail) socketSendMessageQueueTails.delete(sock);
-	});
-	return await result;
+function runSerializedSocketSendMessage(sock, run) {
+	let queue = socketSendMessageQueues.get(sock);
+	if (!queue) {
+		queue = new KeyedAsyncQueue();
+		socketSendMessageQueues.set(sock, queue);
+	}
+	return queue.enqueue("sendMessage", run);
 }
 async function withWhatsAppSocketOperationTimeout(operation, promise, timeoutMs, onTimeout) {
 	const resolvedTimeoutMs = resolveWhatsAppSocketOperationTimeoutMs(timeoutMs);
-	let timeout = null;
-	try {
-		return await Promise.race([promise, new Promise((_, reject) => {
-			timeout = setTimeout(() => {
-				onTimeout?.();
-				reject(new WhatsAppSocketOperationTimeoutError(operation, resolvedTimeoutMs));
-			}, resolvedTimeoutMs);
-			timeout.unref?.();
-		})]);
-	} finally {
-		if (timeout) clearTimeout(timeout);
-	}
+	return await raceWithTimeout(promise, resolvedTimeoutMs, () => {
+		onTimeout?.();
+		throw new WhatsAppSocketOperationTimeoutError(operation, resolvedTimeoutMs);
+	}, { ref: false });
 }
 function createWhatsAppSocketOperationTimeoutAdapter(sock, timeoutMs, hooks) {
 	const operationTimeoutMs = resolveWhatsAppSocketOperationTimeoutMs(timeoutMs);
@@ -241,16 +220,14 @@ const DEFAULT_RECONNECT_POLICY = {
 	jitter: .25,
 	maxAttempts: 12
 };
-function resolveHeartbeatSeconds(cfg, overrideSeconds) {
-	const candidate = overrideSeconds;
-	if (typeof candidate === "number" && candidate > 0) return candidate;
+function resolveHeartbeatSeconds(overrideSeconds) {
+	if (typeof overrideSeconds === "number" && overrideSeconds > 0) return overrideSeconds;
 	return DEFAULT_HEARTBEAT_SECONDS;
 }
-function resolveReconnectPolicy(cfg, overrides) {
-	const overrideConfig = overrides ?? {};
+function resolveReconnectPolicy(overrides) {
 	const merged = {
 		...DEFAULT_RECONNECT_POLICY,
-		...overrideConfig
+		...overrides
 	};
 	merged.initialMs = Math.max(250, merged.initialMs);
 	merged.maxMs = Math.max(merged.initialMs, merged.maxMs);
@@ -276,7 +253,7 @@ async function safeSaveCreds(params) {
 	try {
 		const credsPath = resolveWebCredsPath(params.authDir);
 		const backupPath = resolveWebCredsBackupPath(params.authDir);
-		const raw = readCredsJsonRaw(credsPath);
+		const raw = readWebCredsJsonRawSync(credsPath);
 		if (raw) try {
 			JSON.parse(raw);
 			backup = {
@@ -559,12 +536,7 @@ function createConnectionTimeoutError(timeoutMs) {
 //#region extensions/whatsapp/src/socket-close.ts
 const SOCKET_CLOSE_TIMEOUT_MS = 15e3;
 async function withCloseTimeout(task, operationName) {
-	let timer;
-	await Promise.race([task, new Promise((_resolve, reject) => {
-		timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`WhatsApp ${operationName} timed out`)), SOCKET_CLOSE_TIMEOUT_MS);
-	})]).finally(() => {
-		if (timer) clearTimeout(timer);
-	});
+	await withTimeout(task, SOCKET_CLOSE_TIMEOUT_MS, { message: `WhatsApp ${operationName} timed out` });
 }
 async function waitForTransportClose(ws, operation, operationName) {
 	let onClose;
@@ -604,4 +576,4 @@ async function closeWhatsAppSocketAndWait(sock, reason) {
 	throw new AggregateError(errors, "WhatsApp socket close could not be confirmed");
 }
 //#endregion
-export { renderQrTerminal as _, DEFAULT_RECONNECT_POLICY as a, acquireWhatsAppStandaloneConnectionOwner as b, resolveHeartbeatSeconds as c, DEFAULT_WHATSAPP_SOCKET_TIMING as d, createWhatsAppSocketOperationTimeoutAdapter as f, withWhatsAppSocketOperationTimeout as g, resolveWhatsAppSocketTiming as h, waitForWaConnection as i, resolveReconnectPolicy as l, resolveWhatsAppSocketOperationTimeoutMs as m, createWaDirectorySocket as n, computeBackoff as o, isWhatsAppSocketOperationTimeoutError as p, createWaSocket as r, newConnectionId as s, closeWhatsAppSocketAndWait as t, sleepWithAbort as u, WhatsAppConnectionOwnerBusyError as v, acquireWhatsAppGatewayConnectionOwner as y };
+export { renderQrTerminal as _, DEFAULT_RECONNECT_POLICY as a, acquireWhatsAppStandaloneConnectionOwner as b, resolveHeartbeatSeconds as c, DEFAULT_WHATSAPP_SOCKET_TIMING as d, createWhatsAppSocketOperationTimeoutAdapter as f, withWhatsAppSocketOperationTimeout as g, resolveWhatsAppSocketTiming as h, waitForWaConnection as i, resolveReconnectPolicy as l, resolveWhatsAppSocketOperationTimeoutMs as m, createWaDirectorySocket as n, computeBackoff as o, isWhatsAppSocketOperationTimeoutError as p, createWaSocket as r, newConnectionId as s, closeWhatsAppSocketAndWait as t, sleepWithAbort$1 as u, WhatsAppConnectionOwnerBusyError as v, acquireWhatsAppGatewayConnectionOwner as y };

package/dist/.setup/{targets-runtime-DmiqXIXO.mjs → targets-runtime-Dls-Xh4F.mjs}

@@ -56,17 +56,9 @@ function assertWebChannel(input) {
 	if (input !== "web") throw new Error("Web channel must be 'web'");
 }
 function isSelfChatMode(selfE164, allowFrom) {
-	if (!selfE164) return false;
-	if (!Array.isArray(allowFrom) || allowFrom.length === 0) return false;
+	if (!selfE164 || !Array.isArray(allowFrom) || allowFrom.length === 0) return false;
 	const normalizedSelf = normalizeE164(selfE164);
-	return allowFrom.some((n) => {
-		if (n === "*") return false;
-		try {
-			return normalizeE164(String(n)) === normalizedSelf;
-		} catch {
-			return false;
-		}
-	});
+	return allowFrom.some((entry) => entry !== "*" && normalizeE164(String(entry)) === normalizedSelf);
 }
 function toWhatsappJid(number) {
 	const withoutPrefix = number.replace(/^whatsapp:/i, "").trim();
@@ -147,34 +139,21 @@ function resolveLidMappingDirs(params) {
 	addDir(path.join(CONFIG_DIR, "credentials"));
 	return [...dirs];
 }
-function readLidReverseMapping(params) {
-	const mappingFilename = `lid-mapping-${params.lid}_reverse.json`;
-	const mappingDirs = resolveLidMappingDirs({ opts: params.opts });
-	for (const dir of mappingDirs) {
+function readLidMapping(mappingFilename, opts, normalize) {
+	for (const dir of resolveLidMappingDirs({ opts })) {
 		const mappingPath = path.join(dir, mappingFilename);
 		try {
 			const data = fs.readFileSync(mappingPath, "utf8");
-			const phone = JSON.parse(data);
-			if (phone === null || phone === void 0) continue;
-			return normalizeE164(String(phone));
+			const value = JSON.parse(data);
+			if (value === null || value === void 0) continue;
+			const normalized = normalize(String(value));
+			if (normalized !== null) return normalized;
 		} catch {}
 	}
 	return null;
 }
 function readLidForwardMapping(params) {
-	const mappingFilename = `lid-mapping-${params.phoneDigits}.json`;
-	const mappingDirs = resolveLidMappingDirs({ opts: params.opts });
-	for (const dir of mappingDirs) {
-		const mappingPath = path.join(dir, mappingFilename);
-		try {
-			const data = fs.readFileSync(mappingPath, "utf8");
-			const lid = JSON.parse(data);
-			if (lid === null || lid === void 0) continue;
-			const digits = String(lid).replace(/\D/g, "");
-			if (digits) return digits;
-		} catch {}
-	}
-	return null;
+	return readLidMapping(`lid-mapping-${params.phoneDigits}.json`, params.opts, (value) => value.replace(/\D/g, "") || null);
 }
 function jidToE164(jid, opts) {
 	const phoneDigits = jid.match(/^(\d+)(?::\d+)?@(s\.whatsapp\.net|hosted)$/)?.[1];
@@ -183,10 +162,7 @@ function jidToE164(jid, opts) {
 	if (!lidMatch) return null;
 	const lid = lidMatch[1];
 	if (!lid) return null;
-	const phone = readLidReverseMapping({
-		lid,
-		opts
-	});
+	const phone = readLidMapping(`lid-mapping-${lid}_reverse.json`, opts, normalizeE164);
 	if (phone) return phone;
 	if (opts?.logMissing ?? shouldLogVerbose()) logVerbose(`LID mapping not found for ${lidMatch[1]}; skipping inbound message`);
 	return null;

package/dist/action-runtime-api.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./.setup/action-runtime-DeVk5V7r.mjs";
+import { t as handleWhatsAppAction } from "./.setup/action-runtime-CE3zGstN.mjs";
 export { handleWhatsAppAction };

package/dist/action-runtime.runtime.js

@@ -1,2 +1,2 @@
-import { t as handleWhatsAppAction } from "./.setup/action-runtime-DeVk5V7r.mjs";
+import { t as handleWhatsAppAction } from "./.setup/action-runtime-CE3zGstN.mjs";
 export { handleWhatsAppAction };

package/dist/agent-tools-api.js

@@ -1,7 +1,7 @@
-import { a as resolveWhatsAppAccount } from "./.setup/accounts-CtRPAQCL.mjs";
+import { a as resolveWhatsAppAccount } from "./.setup/accounts-F0vHuze2.mjs";
 import { r as getWhatsAppConnectionController } from "./.setup/connection-controller-runtime-context-hgLJoRc8.mjs";
-import { s as resolveJidToE164 } from "./.setup/targets-runtime-DmiqXIXO.mjs";
-import { n as registerWhatsAppLoginTool } from "./.setup/agent-tools-login-CL5C1rA2.mjs";
+import { s as resolveJidToE164 } from "./.setup/targets-runtime-Dls-Xh4F.mjs";
+import { n as registerWhatsAppLoginTool } from "./.setup/agent-tools-login-B7VEvJO7.mjs";
 import { createActionGate, stringEnum } from "openclaw/plugin-sdk/channel-actions";
 import path from "node:path";
 import { resolveOAuthDir } from "openclaw/plugin-sdk/state-paths";

package/dist/api.js

@@ -1,17 +1,17 @@
-import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./.setup/accounts-CtRPAQCL.mjs";
+import { a as resolveWhatsAppAccount, i as listWhatsAppAuthDirs, n as hasAnyWhatsAppAuth, o as resolveWhatsAppAuthDir, r as listEnabledWhatsAppAccounts, s as resolveWhatsAppMediaMaxBytes, t as DEFAULT_WHATSAPP_MEDIA_MAX_MB } from "./.setup/accounts-F0vHuze2.mjs";
 import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./.setup/account-ids-CB5SOWjc.mjs";
 import { a as normalizeWhatsAppAllowFromEntries, c as normalizeWhatsAppTarget, i as looksLikeWhatsAppTargetId, r as isWhatsAppUserTarget, s as normalizeWhatsAppMessagingTarget, t as isWhatsAppGroupJid } from "./.setup/normalize-target-BGra1ZnM.mjs";
-import { t as resolveWhatsAppOutboundTarget } from "./.setup/resolve-outbound-target-C2eUvsTc.mjs";
-import { c as toWhatsappJid, i as markdownToWhatsApp, l as toWhatsappJidWithLid, n as isSelfChatMode, r as jidToE164, s as resolveJidToE164, t as assertWebChannel } from "./.setup/targets-runtime-DmiqXIXO.mjs";
-import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS, t as whatsappPlugin } from "./.setup/channel-CJFE0kD_.mjs";
-import { i as resolveWhatsAppGroupToolPolicy, r as resolveWhatsAppGroupRequireMention } from "./.setup/shared-DgOG5Iqr.mjs";
+import { t as resolveWhatsAppOutboundTarget } from "./.setup/resolve-outbound-target-CzyNKmrl.mjs";
+import { c as toWhatsappJid, i as markdownToWhatsApp, l as toWhatsappJidWithLid, n as isSelfChatMode, r as jidToE164, s as resolveJidToE164, t as assertWebChannel } from "./.setup/targets-runtime-Dls-Xh4F.mjs";
+import { n as WHATSAPP_LEGACY_OUTBOUND_SEND_DEP_KEYS, t as whatsappPlugin } from "./.setup/channel-DNgKHMCz.mjs";
+import { i as resolveWhatsAppGroupToolPolicy, r as resolveWhatsAppGroupRequireMention } from "./.setup/shared-CP_zs2U7.mjs";
 import { t as whatsappCommandPolicy } from "./.setup/command-policy-BIOSHySD.mjs";
-import { t as whatsappSetupPlugin } from "./.setup/channel.setup-CfN1UfdY.mjs";
+import { t as whatsappSetupPlugin } from "./.setup/channel.setup-CsS_NAKQ.mjs";
 import { t as DEFAULT_WEB_MEDIA_BYTES } from "./.setup/constants-C7m81BNe.mjs";
-import { d as DEFAULT_WHATSAPP_SOCKET_TIMING, f as createWhatsAppSocketOperationTimeoutAdapter, i as waitForWaConnection, r as createWaSocket } from "./.setup/socket-close-CT__V2fz.mjs";
+import { d as DEFAULT_WHATSAPP_SOCKET_TIMING, f as createWhatsAppSocketOperationTimeoutAdapter, i as waitForWaConnection, r as createWaSocket } from "./.setup/socket-close-DU7eerAa.mjs";
 import { n as getStatusCode, t as formatError } from "./.setup/session-errors-B8UcAnZN.mjs";
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./.setup/directory-config-DUiJ5d8I.mjs";
-import { _ as resolveInboundMediaMimetype, c as extractContextInfo, m as findMessageSection, o as describeReplyContext, p as extractText, t as createWebSendApi, u as extractLocationData } from "./.setup/send-api-H4AkQJjT.mjs";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./.setup/directory-config-RYQomHyB.mjs";
+import { _ as resolveInboundMediaMimetype, c as extractContextInfo, m as findMessageSection, o as describeReplyContext, p as extractText, t as createWebSendApi, u as extractLocationData } from "./.setup/send-api-B03VDwZ1.mjs";
 import { asBoolean, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { formatLocationText } from "openclaw/plugin-sdk/channel-inbound";
 import { normalizeE164, resolveUserPath } from "openclaw/plugin-sdk/text-utility-runtime";
@@ -155,7 +155,7 @@ async function startWhatsAppQaDriverSession(params) {
 		settlePendingNotifications(waiterError);
 		for (const waiter of waiters) {
 			removeWaiter(waiter);
-			if (waiterError) waiter.reject(waiterError);
+			waiter.reject(waiterError);
 		}
 		removeMessageListener();
 		sock.end(void 0);

package/dist/auth-presence.js

@@ -1,9 +1,9 @@
-import { r as hasWebCredsSync } from "./.setup/creds-files-CDATZWWM.mjs";
+import { n as hasWebCredsSync } from "./.setup/creds-files-B8WcOAmE.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveOAuthDir } from "openclaw/plugin-sdk/state-paths";
 import { resolveUserPath } from "openclaw/plugin-sdk/account-resolution";
-import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 //#region extensions/whatsapp/auth-presence.ts
 function addAccountAuthDirs(authDirs, accountId, authDir, accountsRoot, env) {
 	authDirs.add(path.join(accountsRoot, normalizeAccountId(accountId)));
@@ -14,8 +14,7 @@ function listWhatsAppAuthDirs(cfg, env = process.env) {
 	const oauthDir = resolveOAuthDir(env);
 	const accountsRoot = path.join(oauthDir, "whatsapp");
 	const channel = cfg.channels?.whatsapp;
-	const authDirs = /* @__PURE__ */ new Set([oauthDir, path.join(accountsRoot, DEFAULT_ACCOUNT_ID)]);
-	addAccountAuthDirs(authDirs, DEFAULT_ACCOUNT_ID, void 0, accountsRoot, env);
+	const authDirs = /* @__PURE__ */ new Set([path.join(accountsRoot, DEFAULT_ACCOUNT_ID$1)]);
 	if (channel?.defaultAccount?.trim()) addAccountAuthDirs(authDirs, channel.defaultAccount, channel.accounts?.[channel.defaultAccount]?.authDir, accountsRoot, env);
 	const accounts = channel?.accounts;
 	if (accounts) for (const [accountId, account] of Object.entries(accounts)) addAccountAuthDirs(authDirs, accountId, account?.authDir, accountsRoot, env);

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as whatsappPlugin } from "./.setup/channel-CJFE0kD_.mjs";
+import { t as whatsappPlugin } from "./.setup/channel-DNgKHMCz.mjs";
 export { whatsappPlugin };

package/dist/directory-contract-api.js

@@ -1,4 +1,4 @@
-import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./.setup/directory-config-DUiJ5d8I.mjs";
+import { n as listWhatsAppDirectoryGroupsFromConfig, r as listWhatsAppDirectoryPeersFromConfig } from "./.setup/directory-config-RYQomHyB.mjs";
 //#region extensions/whatsapp/directory-contract-api.ts
 const whatsappDirectoryContractPlugin = {
 	id: "whatsapp",

package/dist/doctor-contract-api.js

@@ -1,31 +1,205 @@
-import { i as isWhatsAppBaileysAuthFileName } from "./.setup/creds-files-CDATZWWM.mjs";
-import { r as runtime_doctor_migrations_exports, t as normalizeCompatibilityConfig$1 } from "./.setup/doctor-iMwg0Vhr.mjs";
-import fs from "node:fs";
+import { r as resolveDefaultWhatsAppAccountId, t as listAccountIds } from "./.setup/account-ids-CB5SOWjc.mjs";
+import { r as isWhatsAppBaileysAuthFileName } from "./.setup/creds-files-B8WcOAmE.mjs";
+import { r as runtime_doctor_migrations_exports, t as normalizeCompatibilityConfig$1 } from "./.setup/doctor-DKzeBEmH.mjs";
+import fs, { realpathSync } from "node:fs";
 import path from "node:path";
-import { fileExists } from "openclaw/plugin-sdk/file-access-runtime";
-import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
+import { normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-core";
+import { resolveOAuthDir } from "openclaw/plugin-sdk/state-paths";
+import { assertNoSymlinkParentsSync, readRegularFileSync, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { resolveUserPath as resolveUserPath$1 } from "openclaw/plugin-sdk/account-resolution";
+import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
+import fs$1 from "node:fs/promises";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/account-id";
+import { createHash } from "node:crypto";
 //#region extensions/whatsapp/src/state-migrations.ts
-function detectWhatsAppLegacyStateMigrations(params) {
-	const targetDir = path.join(params.oauthDir, "whatsapp", DEFAULT_ACCOUNT_ID);
-	return (() => {
-		try {
-			return fs.readdirSync(params.oauthDir, { withFileTypes: true });
-		} catch {
-			return [];
-		}
-	})().flatMap((entry) => {
-		if (!entry.isFile() || !isWhatsAppBaileysAuthFileName(entry.name)) return [];
-		const sourcePath = path.join(params.oauthDir, entry.name);
-		const targetPath = path.join(targetDir, entry.name);
-		if (fileExists(targetPath)) return [];
-		return [{
-			kind: "move",
-			label: `WhatsApp auth ${entry.name}`,
-			sourcePath,
-			targetPath
-		}];
+function credentialSetDigest(files) {
+	return createHash("sha256").update(JSON.stringify([...files].toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0))).digest("hex");
+}
+function comparablePath(value) {
+	try {
+		return realpathSync.native(value);
+	} catch {
+		return path.resolve(value);
+	}
+}
+function explicitlyOwnsRoot(params) {
+	const channel = params.config.channels?.whatsapp;
+	const oauthRoot = comparablePath(params.oauthDir);
+	return Object.values(channel?.accounts ?? {}).some((owner) => {
+		const configured = owner?.authDir?.trim();
+		return configured && comparablePath(resolveUserPath$1(configured, params.env)) === oauthRoot;
 	});
 }
+async function listSources(params) {
+	try {
+		if (!(await fs$1.lstat(params.oauthDir)).isDirectory()) throw new Error("WhatsApp legacy credential root must be a regular directory.");
+	} catch (error) {
+		if (extractErrorCode(error) === "ENOENT") return [];
+		throw error;
+	}
+	const sources = /* @__PURE__ */ new Map();
+	for (const entry of await fs$1.readdir(params.oauthDir, { withFileTypes: true })) {
+		const name = runtime_doctor_migrations_exports.resolveLegacyMigrationSourcePath?.(entry.name) ?? entry.name;
+		if (!entry.isFile() || !isWhatsAppBaileysAuthFileName(name)) continue;
+		const source = sources.get(name) ?? {
+			name,
+			filePath: path.join(params.oauthDir, name),
+			claimPaths: []
+		};
+		if (name !== entry.name) source.claimPaths.push(path.join(params.oauthDir, entry.name));
+		sources.set(name, source);
+	}
+	return [...sources.values()].filter((source) => !explicitlyOwnsRoot(params) || source.claimPaths.length > 0).toSorted((left, right) => Number(left.name === "creds.json") - Number(right.name === "creds.json") || left.name.localeCompare(right.name));
+}
+const whatsappLegacyStateMigration = {
+	id: "whatsapp-legacy-state",
+	label: "WhatsApp legacy state",
+	collectBackupResources: ({ env, stateDir }) => [{
+		path: resolveOAuthDir(env, stateDir),
+		kind: "directory"
+	}, {
+		path: path.join(stateDir, "state", "openclaw.sqlite"),
+		kind: "sqlite"
+	}],
+	async detectLegacyState(params) {
+		const sources = await listSources(params);
+		return sources.length > 0 ? { preview: [explicitlyOwnsRoot(params) ? `- Restore ${sources.length} interrupted WhatsApp credential claims in the configured root` : `- Move ${sources.length} WhatsApp credential files into the default account`] } : null;
+	},
+	async migrateLegacyState(params) {
+		const sources = await listSources(params);
+		const changes = [];
+		const warnings = [];
+		if (sources.length === 0) return {
+			changes,
+			warnings
+		};
+		const assertCurrent = params.context.channelIngressQueues?.find((entry) => entry.channelId === "whatsapp")?.assertCurrent;
+		const { backupLegacyStateSource } = runtime_doctor_migrations_exports;
+		if (!assertCurrent || !backupLegacyStateSource) return {
+			changes,
+			warnings: ["WhatsApp credential import requires offline Doctor repair. Update OpenClaw core and run openclaw doctor --fix; original files remain unchanged."]
+		};
+		const backups = [];
+		for (const source of sources) backups.push({
+			source,
+			backup: await backupLegacyStateSource({
+				filePath: source.filePath,
+				claimPaths: source.claimPaths,
+				assertCurrent
+			})
+		});
+		if (explicitlyOwnsRoot(params)) return {
+			changes: backups.map(({ source, backup }) => `Restored WhatsApp auth ${source.name} in the configured root; backup: ${backup.backupPath}`),
+			warnings
+		};
+		const credentials = await root(params.oauthDir, {
+			assertBeforeMutation: assertCurrent,
+			symlinks: "reject",
+			hardlinks: "reject",
+			maxBytes: Number.MAX_SAFE_INTEGER
+		});
+		const targetDir = path.join("whatsapp", DEFAULT_ACCOUNT_ID$2);
+		const targetCreds = path.join(targetDir, "creds.json");
+		const canonical = await credentials.exists(targetCreds) ? await credentials.read(targetCreds) : void 0;
+		const legacy = backups.find(({ source }) => source.name === "creds.json");
+		if (!legacy) return {
+			changes,
+			warnings: ["WhatsApp shared-root key files have no creds.json identity. Kept all original files and private .migrated backups; restore the original creds.json before retrying Doctor."],
+			...canonical ? { warningDisposition: "recoverable" } : {}
+		};
+		if (canonical && !canonical.buffer.equals(legacy.backup.bytes)) return {
+			changes,
+			warnings: ["WhatsApp canonical credentials differ from the legacy shared root. Kept both complete sets and private .migrated backups; choose the intended authDir before removing either set."],
+			warningDisposition: "recoverable"
+		};
+		const targetNames = await fs$1.readdir(path.join(params.oauthDir, targetDir)).catch((error) => {
+			if (extractErrorCode(error) === "ENOENT") return [];
+			throw error;
+		});
+		const targetFiles = /* @__PURE__ */ new Map();
+		for (const name of targetNames.filter(isWhatsAppBaileysAuthFileName)) {
+			const target = await credentials.read(path.join(targetDir, name));
+			targetFiles.set(name, createHash("sha256").update(target.buffer).digest("hex"));
+		}
+		const receiptStore = params.context.openPluginStateKeyedStore({
+			namespace: "auth-directory-migrations",
+			maxEntries: 4096,
+			overflowPolicy: "reject-new"
+		});
+		if (!receiptStore.withCurrent) return {
+			changes,
+			warnings: ["WhatsApp credential import requires current offline storage authority. Update OpenClaw core and rerun Doctor; original credentials remain unchanged."]
+		};
+		const receipts = receiptStore.withCurrent({ assertCurrent });
+		const sourceIdentity = legacy.backup.snapshot.sha256;
+		const previous = await receipts.lookup(sourceIdentity);
+		if (previous && (!canonical || previous.targetDigest !== credentialSetDigest(targetFiles))) return {
+			changes,
+			warnings: ["WhatsApp credential migration previously started, but its complete canonical credential set is absent or changed. Kept source files and backups; restore the complete intended account or select its authDir explicitly. Doctor will not recreate credentials after logout."],
+			...canonical ? { warningDisposition: "recoverable" } : {}
+		};
+		if (!canonical) {
+			const sourceNames = new Set(sources.map((source) => source.name));
+			if (targetNames.some((name) => isWhatsAppBaileysAuthFileName(name) && !sourceNames.has(name))) return {
+				changes,
+				warnings: ["WhatsApp default account contains unmatched auth files without creds.json. Kept the incomplete account and legacy credentials separate; choose the intended credential set before retrying Doctor."]
+			};
+		}
+		for (const { source, backup } of backups) {
+			const relativePath = path.join(targetDir, source.name);
+			if (await credentials.exists(relativePath) && !(await credentials.read(relativePath)).buffer.equals(backup.bytes)) return {
+				changes,
+				warnings: [`WhatsApp auth ${source.name} differs between the default account and legacy shared root. Kept both copies and a private .migrated backup; choose the intended credential set before retrying Doctor.`],
+				...canonical ? { warningDisposition: "recoverable" } : {}
+			};
+		}
+		if (!previous) {
+			const expected = new Map(targetFiles);
+			for (const { source, backup } of backups) {
+				backup.assertUnchanged();
+				expected.set(source.name, backup.snapshot.sha256);
+			}
+			if (!await receipts.registerIfAbsent(sourceIdentity, { targetDigest: credentialSetDigest(expected) })) throw new Error("WhatsApp credential migration receipt changed; rerun Doctor.");
+		}
+		await credentials.mkdir(targetDir, { private: true });
+		const targets = [];
+		for (const { source, backup } of backups) {
+			backup.assertUnchanged();
+			const relativePath = path.join(targetDir, source.name);
+			if (!await credentials.exists(relativePath)) await credentials.create(relativePath, backup.bytes, {
+				atomic: true,
+				durable: true,
+				mode: 384,
+				private: true
+			});
+			const target = await credentials.read(relativePath);
+			if (!target.buffer.equals(backup.bytes)) throw new Error("WhatsApp canonical credentials changed during import; original files retained.");
+			targets.push({
+				source,
+				backup,
+				target,
+				targetPath: path.join(params.oauthDir, relativePath)
+			});
+		}
+		for (const { source, backup, target, targetPath } of targets) {
+			backup.removeSource(() => {
+				assertCurrent();
+				assertNoSymlinkParentsSync({
+					rootDir: params.oauthDir,
+					targetPath: path.dirname(targetPath),
+					requireDirectories: true
+				});
+				const current = readRegularFileSync({ filePath: targetPath });
+				if (current.stat.dev !== target.stat.dev || current.stat.ino !== target.stat.ino || !current.buffer.equals(target.buffer)) throw new Error("WhatsApp canonical credentials changed during import; original backup retained.");
+			});
+			changes.push(`Moved WhatsApp auth ${source.name} into the default account; backup: ${backup.backupPath}`);
+		}
+		return {
+			changes,
+			warnings
+		};
+	}
+};
 //#endregion
 //#region extensions/whatsapp/src/doctor-contract.ts
 const streamingAliasMigration = (0, runtime_doctor_migrations_exports.defineChannelAliasMigration)({
@@ -36,8 +210,35 @@ const streamingAliasMigration = (0, runtime_doctor_migrations_exports.defineChan
 	},
 	accountStreamingInheritsDefaultAccount: true
 });
-const hasExposeErrorText = (value) => Object.hasOwn((0, runtime_doctor_migrations_exports.asObjectRecord)(value) ?? {}, "exposeErrorText");
 const hasAckReaction = (value) => Boolean((0, runtime_doctor_migrations_exports.asObjectRecord)((0, runtime_doctor_migrations_exports.asObjectRecord)(value)?.ackReaction));
+const legacyDefaultPolicyKeys = /* @__PURE__ */ new Set([
+	"dmPolicy",
+	"allowFrom",
+	"groupPolicy",
+	"groupAllowFrom"
+]);
+function hasPossibleLeftoverDefault(cfg) {
+	const channel = (0, runtime_doctor_migrations_exports.asObjectRecord)(cfg.channels?.whatsapp);
+	const accounts = (0, runtime_doctor_migrations_exports.asObjectRecord)(channel?.accounts);
+	const fallback = (0, runtime_doctor_migrations_exports.asObjectRecord)(accounts?.default);
+	if (!channel || !accounts || !fallback || channel.authDir !== void 0 || typeof channel.defaultAccount === "string" && channel.defaultAccount.trim().toLowerCase() === "default" || Object.keys(accounts).length < 2) return false;
+	const keys = Object.keys(fallback);
+	if (keys.length === 0 || keys.some((key) => !legacyDefaultPolicyKeys.has(key)) || Object.values(accounts).some((account) => !(0, runtime_doctor_migrations_exports.asObjectRecord)(account)) || cfg.bindings?.some((binding) => binding.match.channel.trim().toLowerCase() === "whatsapp" && binding.match.accountId?.trim().toLowerCase() === "default")) return false;
+	const oauthDir = resolveOAuthDir();
+	for (const dir of [oauthDir, path.join(oauthDir, "whatsapp", "default")]) try {
+		if (fs.readdirSync(dir).some(isWhatsAppBaileysAuthFileName)) return false;
+	} catch (error) {
+		if ((0, runtime_doctor_migrations_exports.asObjectRecord)(error)?.code !== "ENOENT") return false;
+	}
+	return true;
+}
+function collectDefaultAccountWarnings(cfg) {
+	if (!hasPossibleLeftoverDefault(cfg)) return [];
+	const namedAccountId = listAccountIds(cfg).find((id) => id !== "default" && normalizeOptionalAccountId(id) === id);
+	if (!namedAccountId) return [];
+	const currentAccountId = resolveDefaultWhatsAppAccountId(cfg);
+	return [`channels.whatsapp.accounts.default contains only shared policy and has no detected credentials. It may be a leftover of an earlier Doctor migration or an intentional account awaiting login. Unqualified WhatsApp operations currently select "${currentAccountId}". Doctor left all accounts and routing unchanged. To select a named account while keeping all accounts and shared policy, run \`openclaw config set channels.whatsapp.defaultAccount '${JSON.stringify(currentAccountId === "default" ? namedAccountId : currentAccountId)}' --strict-json\`. Only if "default" is unwanted, preserve any shared policy you still need, then run \`openclaw channels remove --channel whatsapp --account default --delete\`.`];
+}
 const legacyConfigRules = [
 	...streamingAliasMigration.legacyConfigRules,
 	{
@@ -56,48 +257,22 @@ const legacyConfigRules = [
 		],
 		message: "channels.whatsapp.accounts.<id>.ackReaction moved to global message acknowledgement settings. Run \"openclaw doctor --fix\".",
 		match: (value) => (0, runtime_doctor_migrations_exports.hasLegacyAccountStreamingAliases)(value, hasAckReaction)
-	},
-	{
-		path: [
-			"channels",
-			"whatsapp",
-			"exposeErrorText"
-		],
-		message: "channels.whatsapp.exposeErrorText is retired and ignored. Run \"openclaw doctor --fix\"."
-	},
-	{
-		path: [
-			"channels",
-			"whatsapp",
-			"accounts"
-		],
-		message: "channels.whatsapp.accounts.<id>.exposeErrorText is retired and ignored. Run \"openclaw doctor --fix\".",
-		match: (value) => (0, runtime_doctor_migrations_exports.hasLegacyAccountStreamingAliases)(value, hasExposeErrorText)
 	}
 ];
-function removeExposeErrorText(cfg, changes) {
-	return (0, runtime_doctor_migrations_exports.stripRetiredChannelKeys)({
-		cfg,
-		channelId: "whatsapp",
-		keys: /* @__PURE__ */ new Set(["exposeErrorText"]),
-		scope: "root-and-accounts",
-		onRemove: ({ key, pathPrefix }) => changes.push(`Removed retired ${pathPrefix}.${key}.`)
-	}).config;
-}
 function normalizeCompatibilityConfig({ cfg }) {
 	const ackReaction = normalizeCompatibilityConfig$1({ cfg });
-	const retiredConfig = removeExposeErrorText(ackReaction.config, ackReaction.changes);
-	return streamingAliasMigration.normalizeChannelConfig({
-		cfg: retiredConfig,
+	const normalized = streamingAliasMigration.normalizeChannelConfig({
+		cfg: ackReaction.config,
 		changes: ackReaction.changes
 	});
+	const warnings = collectDefaultAccountWarnings(normalized.config);
+	return {
+		...normalized,
+		...warnings.length ? { warnings } : {}
+	};
 }
 //#endregion
 //#region extensions/whatsapp/doctor-contract-api.ts
-const stateMigrations = [(0, runtime_doctor_migrations_exports.definePluginDoctorMigrationFromPlans)({
-	id: "whatsapp-legacy-state",
-	label: "WhatsApp legacy state",
-	resolvePlans: detectWhatsAppLegacyStateMigrations
-})];
+const stateMigrations = [whatsappLegacyStateMigration];
 //#endregion
 export { legacyConfigRules, normalizeCompatibilityConfig, stateMigrations };