@openclaw/zalo 2026.7.1-beta.1 → 2026.7.1-beta.4

package/dist/{actions.runtime-BvO8xrg_.js → actions.runtime-OmfJFYZn.js}

@@ -1,4 +1,4 @@
-import { t as sendMessageZalo } from "./send-DzchAfon.js";
+import { t as sendMessageZalo } from "./send-9sVVxyap.js";
 //#region extensions/zalo/src/actions.runtime.ts
 const zaloActionsRuntime = { sendMessageZalo };
 //#endregion

package/dist/api.js

@@ -1,5 +1,5 @@
 import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-fwCh0QUi.js";
-import { t as zaloPlugin } from "./channel-Zju2s6y_.js";
+import { t as zaloPlugin } from "./channel-BOWhJVyl.js";
 import { n as resolveZaloRuntimeGroupPolicy } from "./group-access-8qHRzDHx.js";
 import { zaloSetupWizard } from "./setup-api.js";
 export { createZaloSetupWizardProxy, resolveZaloRuntimeGroupPolicy, zaloDmPolicy, zaloPlugin, zaloSetupAdapter, zaloSetupWizard };

package/dist/{channel-Zju2s6y_.js → channel-BOWhJVyl.js}

@@ -12,7 +12,7 @@ import { buildTokenChannelStatusSummary } from "openclaw/plugin-sdk/channel-stat
 import { createStaticReplyToModeResolver } from "openclaw/plugin-sdk/conversation-runtime";
 import { createChannelDirectoryAdapter, listResolvedDirectoryUserEntriesFromAllowFrom } from "openclaw/plugin-sdk/directory-runtime";
 import { createLazyRuntimeModule, createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
-import { isNumericTargetId, sendPayloadWithChunkedTextAndMedia } from "openclaw/plugin-sdk/reply-payload";
+import { sendPayloadWithChunkedTextAndMedia } from "openclaw/plugin-sdk/reply-payload";
 import { createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -24,7 +24,7 @@ import { AllowFromListSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigS
 import { z } from "zod";
 import { coerceStatusIssueAccountId, readStatusIssueFields } from "openclaw/plugin-sdk/extension-shared";
 //#region extensions/zalo/src/actions.ts
-const loadZaloActionsRuntime = createLazyRuntimeNamedExport(() => import("./actions.runtime-BvO8xrg_.js"), "zaloActionsRuntime");
+const loadZaloActionsRuntime = createLazyRuntimeNamedExport(() => import("./actions.runtime-OmfJFYZn.js"), "zaloActionsRuntime");
 const providerId = "zalo";
 function listEnabledAccounts(cfg, accountId) {
 	return (accountId ? [resolveZaloAccount({
@@ -35,7 +35,7 @@ function listEnabledAccounts(cfg, accountId) {
 const zaloMessageActions = {
 	describeMessageTool: ({ cfg, accountId }) => {
 		if (listEnabledAccounts(cfg, accountId).length === 0) return null;
-		const actions = new Set(["send"]);
+		const actions = /* @__PURE__ */ new Set(["send"]);
 		return {
 			actions: Array.from(actions),
 			capabilities: []
@@ -111,7 +111,9 @@ const ZaloConfigSchema = buildCatchallMultiAccountChannelSchema(z.object({
 function resolveZaloOutboundSessionRoute(params) {
 	const trimmed = stripChannelTargetPrefix(params.target, "zalo", "zl");
 	if (!trimmed) return null;
-	const isGroup = normalizeLowercaseStringOrEmpty(trimmed).startsWith("group:");
+	const normalizedTarget = normalizeLowercaseStringOrEmpty(trimmed);
+	const isGroup = normalizedTarget.startsWith("group:");
+	const recipientSessionExact = /^(?:group|user|dm):/.test(normalizedTarget);
 	const peerId = stripTargetKindPrefix(trimmed);
 	if (!peerId) return null;
 	return buildChannelOutboundSessionRoute({
@@ -119,6 +121,7 @@ function resolveZaloOutboundSessionRoute(params) {
 		agentId: params.agentId,
 		channel: "zalo",
 		accountId: params.accountId,
+		recipientSessionExact,
 		peer: {
 			kind: isGroup ? "group" : "direct",
 			id: peerId
@@ -173,7 +176,11 @@ function normalizeZaloMessagingTarget(raw) {
 	if (!trimmed) return;
 	return trimmed.replace(/^(zalo|zl):/i, "").trim();
 }
-const loadZaloChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-T7qX1CZo.js"));
+function looksLikeZaloChatId(raw, normalized) {
+	const target = normalizeZaloMessagingTarget(normalized ?? raw);
+	return Boolean(target);
+}
+const loadZaloChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-CEPgF8Zo.js"));
 const zaloSetupWizard = createZaloSetupWizardProxy(async () => (await import("./setup-surface-8eRimod9.js")).zaloSetupWizard);
 const zaloTextChunkLimit = 2e3;
 const zaloRawSendResultAdapter = createRawChannelSendResultAdapter({
@@ -297,7 +304,7 @@ const zaloPlugin = createChatChannelPlugin({
 			normalizeTarget: normalizeZaloMessagingTarget,
 			resolveOutboundSessionRoute: (params) => resolveZaloOutboundSessionRoute(params),
 			targetResolver: {
-				looksLikeId: isNumericTargetId,
+				looksLikeId: looksLikeZaloChatId,
 				hint: "<chatId>"
 			}
 		},
@@ -358,7 +365,8 @@ const zaloPlugin = createChatChannelPlugin({
 			chunker: chunkTextForOutbound,
 			sendText: (nextCtx) => zaloRawSendResultAdapter.sendText(nextCtx),
 			sendMedia: (nextCtx) => zaloRawSendResultAdapter.sendMedia(nextCtx),
-			emptyResult: createEmptyChannelResult("zalo")
+			emptyResult: createEmptyChannelResult("zalo"),
+			onResult: ctx.onDeliveryResult
 		}),
 		...zaloRawSendResultAdapter
 	}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zaloPlugin } from "./channel-Zju2s6y_.js";
+import { t as zaloPlugin } from "./channel-BOWhJVyl.js";
 export { zaloPlugin };

package/dist/{channel.runtime-T7qX1CZo.js → channel.runtime-CEPgF8Zo.js}

@@ -1,6 +1,6 @@
 import { p as normalizeSecretInputString } from "./setup-core-fwCh0QUi.js";
-import { i as PAIRING_APPROVED_MESSAGE } from "./runtime-api-CDwUY_-_.js";
-import { a as getMe, n as resolveZaloProxyFetch, r as ZaloApiError, t as sendMessageZalo } from "./send-DzchAfon.js";
+import { i as PAIRING_APPROVED_MESSAGE } from "./runtime-api-CAA4ZtqF.js";
+import { a as getMe, n as resolveZaloProxyFetch, r as ZaloApiError, t as sendMessageZalo } from "./send-9sVVxyap.js";
 import { createAccountStatusSink } from "openclaw/plugin-sdk/channel-outbound";
 //#region extensions/zalo/src/probe.ts
 async function probeZalo(token, timeoutMs = 5e3, fetcher) {
@@ -71,7 +71,7 @@ async function startZaloGatewayAccount(ctx) {
 	const fetcher = resolveZaloProxyFetch(account.config.proxy);
 	try {
 		const probe = await probeZalo(token, 2500, fetcher);
-		const name = probe.ok ? probe.bot?.name?.trim() : null;
+		const name = probe.ok ? probe.bot?.account_name?.trim() : null;
 		if (name) zaloBotLabel = ` (${name})`;
 		if (!probe.ok) ctx.log?.warn?.(`[${account.accountId}] Zalo probe failed before provider start (${String(probe.elapsedMs)}ms): ${probe.error}`);
 		ctx.setStatus({
@@ -86,7 +86,7 @@ async function startZaloGatewayAccount(ctx) {
 		setStatus: ctx.setStatus
 	});
 	ctx.log?.info(`[${account.accountId}] starting provider${zaloBotLabel} mode=${mode}`);
-	const { monitorZaloProvider } = await import("./monitor-C1dGXDyQ.js");
+	const { monitorZaloProvider } = await import("./monitor-fgcJhAZL.js");
 	return monitorZaloProvider({
 		token,
 		account,

package/dist/{monitor-C1dGXDyQ.js → monitor-fgcJhAZL.js}

@@ -1,6 +1,7 @@
 import { n as resolveZaloRuntimeGroupPolicy, t as normalizeZaloAllowEntry } from "./group-access-8qHRzDHx.js";
-import { t as getZaloRuntime } from "./runtime-api-CDwUY_-_.js";
-import { c as sendChatAction, d as setWebhook, i as deleteWebhook, l as sendMessage, n as resolveZaloProxyFetch, o as getUpdates, r as ZaloApiError, s as getWebhookInfo, u as sendPhoto } from "./send-DzchAfon.js";
+import { t as getZaloRuntime } from "./runtime-api-CAA4ZtqF.js";
+import { c as sendChatAction, d as setWebhook, i as deleteWebhook, l as sendMessage, n as resolveZaloProxyFetch, o as getUpdates, r as ZaloApiError, s as getWebhookInfo, u as sendPhoto } from "./send-9sVVxyap.js";
+import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { deliverTextOrMediaReply, resolveSendableOutboundReplyParts } from "openclaw/plugin-sdk/reply-payload";
 import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
@@ -9,6 +10,7 @@ import { logTypingFailure } from "openclaw/plugin-sdk/channel-feedback";
 import { resolveInboundRouteEnvelopeBuilderWithRuntime } from "openclaw/plugin-sdk/inbound-envelope";
 import { registerPluginHttpRoute, resolveWebhookPath } from "openclaw/plugin-sdk/webhook-ingress";
 import { asDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
+import { formatInboundMediaUnavailableText } from "openclaw/plugin-sdk/channel-inbound";
 import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { waitForAbortSignal } from "openclaw/plugin-sdk/runtime-env";
 import { createHostedOutboundMediaStore } from "openclaw/plugin-sdk/outbound-media";
@@ -152,12 +154,13 @@ const ZALO_TEXT_LIMIT = 2e3;
 const DEFAULT_MEDIA_MAX_MB = 5;
 const WEBHOOK_CLEANUP_TIMEOUT_MS = 5e3;
 const ZALO_TYPING_TIMEOUT_MS = 5e3;
-let zaloWebhookModulePromise;
+const UNIX_MILLISECONDS_THRESHOLD = 0xe8d4a51000;
 const hostedMediaRouteRefs = /* @__PURE__ */ new Map();
-function loadZaloWebhookModule() {
-	zaloWebhookModulePromise ??= import("./monitor.webhook-B23mUx-y.js");
-	return zaloWebhookModulePromise;
+function resolveZaloTimestampMs(date) {
+	if (!date) return;
+	return date >= UNIX_MILLISECONDS_THRESHOLD ? date : date * 1e3;
 }
+const loadZaloWebhookModule = createLazyRuntimeModule(() => import("./monitor.webhook-AYcIUBBP.js"));
 function releaseSharedHostedMediaRouteRef(routePath) {
 	const current = hostedMediaRouteRefs.get(routePath);
 	if (!current) return;
@@ -334,7 +337,7 @@ async function handleImageMessage(params) {
 	const authorization = await authorizeZaloMessage({
 		...params,
 		text: caption,
-		mediaPath: photo_url ? "__pending_media__" : void 0,
+		mediaPath: "__pending_media__",
 		mediaType: void 0
 	});
 	if (!authorization) return;
@@ -351,9 +354,15 @@ async function handleImageMessage(params) {
 	} catch (err) {
 		runtime.error?.(`[${account.accountId}] Failed to download Zalo image: ${String(err)}`);
 	}
+	const agentBody = mediaPath ? authorization.rawBody : formatInboundMediaUnavailableText({
+		body: caption,
+		mediaPlaceholder: "<media:image>",
+		notice: "[zalo image attachment unavailable]"
+	});
 	await processMessageWithPipeline({
 		...params,
 		authorization,
+		agentBody,
 		text: caption,
 		mediaPath,
 		mediaType
@@ -455,7 +464,7 @@ async function authorizeZaloMessage(params) {
 	};
 }
 async function processMessageWithPipeline(params) {
-	const { message, token, account, config, runtime, core, mediaPath, mediaType, statusSink, fetcher, authorization: authorizationOverride } = params;
+	const { message, token, account, config, runtime, core, mediaPath, mediaType, statusSink, fetcher, agentBody: agentBodyOverride, authorization: authorizationOverride } = params;
 	const { message_id, date } = message;
 	const authorization = authorizationOverride ?? await authorizeZaloMessage({
 		...params,
@@ -464,6 +473,7 @@ async function processMessageWithPipeline(params) {
 	});
 	if (!authorization) return;
 	const { isGroup, chatId, senderId, senderName, rawBody, commandAuthorized } = authorization;
+	const agentBody = agentBodyOverride ?? rawBody;
 	const { route, buildEnvelope } = resolveInboundRouteEnvelopeBuilderWithRuntime({
 		cfg: config,
 		channel: "zalo",
@@ -480,17 +490,18 @@ async function processMessageWithPipeline(params) {
 		return;
 	}
 	const fromLabel = isGroup ? `group:${chatId}` : senderName || `user:${senderId}`;
+	const timestamp = resolveZaloTimestampMs(date);
 	const { storePath, body } = buildEnvelope({
 		channel: "Zalo",
 		from: fromLabel,
-		timestamp: date ? date * 1e3 : void 0,
-		body: rawBody
+		timestamp,
+		body: agentBody
 	});
 	const ctxPayload = core.channel.inbound.buildContext({
 		channel: "zalo",
 		accountId: route.accountId,
 		messageId: message_id,
-		timestamp: date ? date * 1e3 : void 0,
+		timestamp,
 		from: isGroup ? `zalo:group:${chatId}` : `zalo:${senderId}`,
 		sender: {
 			id: senderId,
@@ -509,7 +520,7 @@ async function processMessageWithPipeline(params) {
 		reply: { to: `zalo:${chatId}` },
 		message: {
 			body,
-			bodyForAgent: rawBody,
+			bodyForAgent: agentBody,
 			rawBody,
 			commandBody: rawBody
 		},
@@ -618,15 +629,16 @@ async function deliverZaloReply(params) {
 			}
 		},
 		sendMedia: async ({ mediaUrl, caption }) => {
+			const sendableMediaUrl = canHostMedia && webhookUrl && webhookPath ? await prepareHostedZaloMediaUrl({
+				mediaUrl,
+				webhookUrl,
+				webhookPath,
+				maxBytes: mediaMaxBytes,
+				proxyUrl
+			}) : mediaUrl;
 			await sendPhoto(token, {
 				chat_id: chatId,
-				photo: canHostMedia && webhookUrl && webhookPath ? await prepareHostedZaloMediaUrl({
-					mediaUrl,
-					webhookUrl,
-					webhookPath,
-					maxBytes: mediaMaxBytes,
-					proxyUrl
-				}) : mediaUrl,
+				photo: sendableMediaUrl,
 				caption
 			}, fetcher);
 			statusSink?.({ lastOutboundAt: Date.now() });

package/dist/{monitor.webhook-B23mUx-y.js → monitor.webhook-AYcIUBBP.js}

@@ -1,4 +1,4 @@
-import { B as registerWebhookTargetWithPluginRoute, I as readJsonWebhookBodyOrReject, K as resolveWebhookTargetWithAuthOrRejectSync, Q as withResolvedWebhookRequestPipeline, V as resolveClientIp, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, l as applyBasicWebhookRequestGuards, o as WEBHOOK_RATE_LIMIT_DEFAULTS, x as createWebhookAnomalyTracker, z as registerWebhookTarget } from "./runtime-api-CDwUY_-_.js";
+import { B as registerWebhookTargetWithPluginRoute, I as readJsonWebhookBodyOrReject, K as resolveWebhookTargetWithAuthOrRejectSync, Q as withResolvedWebhookRequestPipeline, V as resolveClientIp, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, l as applyBasicWebhookRequestGuards, o as WEBHOOK_RATE_LIMIT_DEFAULTS, x as createWebhookAnomalyTracker, z as registerWebhookTarget } from "./runtime-api-CAA4ZtqF.js";
 import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/zalo/src/monitor.webhook.ts
@@ -29,9 +29,6 @@ function getZaloWebhookRateLimitStateSizeForTest() {
 function getZaloWebhookStatusCounterSizeForTest() {
 	return webhookAnomalyTracker.size();
 }
-function timingSafeEquals(left, right) {
-	return safeEqualSecret(left, right);
-}
 function buildReplayEventCacheKey(target, update) {
 	const messageId = update.message?.message_id;
 	if (!messageId) return null;
@@ -122,7 +119,7 @@ async function handleZaloWebhookRequest(req, res, processUpdate) {
 			const target = resolveWebhookTargetWithAuthOrRejectSync({
 				targets,
 				res,
-				isMatch: (entry) => timingSafeEquals(entry.secret, headerToken)
+				isMatch: (entry) => safeEqualSecret(entry.secret, headerToken)
 			});
 			if (!target) {
 				recordWebhookStatus(targets[0]?.runtime, path, res.statusCode);
@@ -172,4 +169,4 @@ async function handleZaloWebhookRequest(req, res, processUpdate) {
 	});
 }
 //#endregion
-export { ZaloRetryableWebhookError, clearZaloWebhookSecurityStateForTest, getZaloWebhookRateLimitStateSizeForTest, getZaloWebhookStatusCounterSizeForTest, handleZaloWebhookRequest, processZaloReplayGuardedUpdate, registerZaloWebhookTarget };
+export { ZaloRetryableWebhookError, clearZaloWebhookSecurityStateForTest, getZaloWebhookRateLimitStateSizeForTest, getZaloWebhookStatusCounterSizeForTest, handleZaloWebhookRequest, registerZaloWebhookTarget };

package/dist/{runtime-api-CDwUY_-_.js → runtime-api-CAA4ZtqF.js}

@@ -1,7 +1,7 @@
 import { formatAllowFromLowercase as formatAllowFromLowercase$1, isNormalizedSenderAllowed } from "openclaw/plugin-sdk/allow-from";
 import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-outbound";
 import { PAIRING_APPROVED_MESSAGE, buildTokenChannelStatusSummary as buildTokenChannelStatusSummary$1 } from "openclaw/plugin-sdk/channel-status";
-import { deliverTextOrMediaReply as deliverTextOrMediaReply$1, isNumericTargetId as isNumericTargetId$1, sendPayloadWithChunkedTextAndMedia as sendPayloadWithChunkedTextAndMedia$1 } from "openclaw/plugin-sdk/reply-payload";
+import { deliverTextOrMediaReply as deliverTextOrMediaReply$1, isNumericTargetId, sendPayloadWithChunkedTextAndMedia as sendPayloadWithChunkedTextAndMedia$1 } from "openclaw/plugin-sdk/reply-payload";
 import { buildBaseAccountStatusSnapshot } from "openclaw/plugin-sdk/status-helpers";
 import { chunkTextForOutbound as chunkTextForOutbound$1 } from "openclaw/plugin-sdk/text-chunking";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildChannelConfigSchema, createDedupeCache, formatPairingApproveHint, jsonResult, normalizeAccountId as normalizeAccountId$1, readStringParam, resolveClientIp } from "openclaw/plugin-sdk/core";
@@ -20,4 +20,4 @@ const { setRuntime: setZaloRuntime, getRuntime: getZaloRuntime } = createPluginR
 	errorMessage: "Zalo runtime not initialized"
 });
 //#endregion
-export { mergeAllowFromEntries$1 as A, registerWebhookTargetWithPluginRoute as B, formatAllowFromLowercase$1 as C, isNumericTargetId$1 as D, isNormalizedSenderAllowed as E, promptSingleChannelSecretInput$1 as F, resolveWebhookPath$1 as G, resolveDefaultGroupPolicy$1 as H, readJsonWebhookBodyOrReject as I, sendPayloadWithChunkedTextAndMedia$1 as J, resolveWebhookTargetWithAuthOrRejectSync as K, readStringParam as L, normalizeAccountId$1 as M, normalizeResolvedSecretInputString as N, jsonResult as O, normalizeSecretInputString as P, withResolvedWebhookRequestPipeline as Q, registerPluginHttpRoute$1 as R, deliverTextOrMediaReply$1 as S, hasConfiguredSecretInput$1 as T, resolveInboundRouteEnvelopeBuilderWithRuntime$1 as U, resolveClientIp as V, resolveOpenProviderRuntimeGroupPolicy$1 as W, waitForAbortSignal as X, setTopLevelChannelDmPolicyWithAllowFrom as Y, warnMissingProviderGroupPolicyFallbackOnce$1 as Z, createChannelMessageReplyPipeline as _, WEBHOOK_ANOMALY_COUNTER_DEFAULTS as a, createFixedWindowRateLimiter as b, applyAccountNameToChannelSection as c, buildBaseAccountStatusSnapshot as d, buildChannelConfigSchema as f, chunkTextForOutbound$1 as g, buildTokenChannelStatusSummary$1 as h, PAIRING_APPROVED_MESSAGE as i, migrateBaseNameToDefaultAccount as j, logTypingFailure$1 as k, applyBasicWebhookRequestGuards as l, buildSingleChannelSecretPromptState$1 as m, setZaloRuntime as n, WEBHOOK_RATE_LIMIT_DEFAULTS as o, buildSecretInputSchema as p, runSingleChannelSecretStep$1 as q, DEFAULT_ACCOUNT_ID$1 as r, addWildcardAllowFrom$1 as s, getZaloRuntime as t, applySetupAccountConfigPatch as u, createChannelPairingController$1 as v, formatPairingApproveHint as w, createWebhookAnomalyTracker as x, createDedupeCache as y, registerWebhookTarget as z };
+export { mergeAllowFromEntries$1 as A, registerWebhookTargetWithPluginRoute as B, formatAllowFromLowercase$1 as C, isNumericTargetId as D, isNormalizedSenderAllowed as E, promptSingleChannelSecretInput$1 as F, resolveWebhookPath$1 as G, resolveDefaultGroupPolicy$1 as H, readJsonWebhookBodyOrReject as I, sendPayloadWithChunkedTextAndMedia$1 as J, resolveWebhookTargetWithAuthOrRejectSync as K, readStringParam as L, normalizeAccountId$1 as M, normalizeResolvedSecretInputString as N, jsonResult as O, normalizeSecretInputString as P, withResolvedWebhookRequestPipeline as Q, registerPluginHttpRoute$1 as R, deliverTextOrMediaReply$1 as S, hasConfiguredSecretInput$1 as T, resolveInboundRouteEnvelopeBuilderWithRuntime$1 as U, resolveClientIp as V, resolveOpenProviderRuntimeGroupPolicy$1 as W, waitForAbortSignal as X, setTopLevelChannelDmPolicyWithAllowFrom as Y, warnMissingProviderGroupPolicyFallbackOnce$1 as Z, createChannelMessageReplyPipeline as _, WEBHOOK_ANOMALY_COUNTER_DEFAULTS as a, createFixedWindowRateLimiter as b, applyAccountNameToChannelSection as c, buildBaseAccountStatusSnapshot as d, buildChannelConfigSchema as f, chunkTextForOutbound$1 as g, buildTokenChannelStatusSummary$1 as h, PAIRING_APPROVED_MESSAGE as i, migrateBaseNameToDefaultAccount as j, logTypingFailure$1 as k, applyBasicWebhookRequestGuards as l, buildSingleChannelSecretPromptState$1 as m, setZaloRuntime as n, WEBHOOK_RATE_LIMIT_DEFAULTS as o, buildSecretInputSchema as p, runSingleChannelSecretStep$1 as q, DEFAULT_ACCOUNT_ID$1 as r, addWildcardAllowFrom$1 as s, getZaloRuntime as t, applySetupAccountConfigPatch as u, createChannelPairingController$1 as v, formatPairingApproveHint as w, createWebhookAnomalyTracker as x, createDedupeCache as y, registerWebhookTarget as z };

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { A as mergeAllowFromEntries, B as registerWebhookTargetWithPluginRoute, C as formatAllowFromLowercase, D as isNumericTargetId, E as isNormalizedSenderAllowed, F as promptSingleChannelSecretInput, G as resolveWebhookPath, H as resolveDefaultGroupPolicy, I as readJsonWebhookBodyOrReject, J as sendPayloadWithChunkedTextAndMedia, K as resolveWebhookTargetWithAuthOrRejectSync, L as readStringParam, M as normalizeAccountId, N as normalizeResolvedSecretInputString, O as jsonResult, P as normalizeSecretInputString, Q as withResolvedWebhookRequestPipeline, R as registerPluginHttpRoute, S as deliverTextOrMediaReply, T as hasConfiguredSecretInput, U as resolveInboundRouteEnvelopeBuilderWithRuntime, V as resolveClientIp, W as resolveOpenProviderRuntimeGroupPolicy, X as waitForAbortSignal, Y as setTopLevelChannelDmPolicyWithAllowFrom, Z as warnMissingProviderGroupPolicyFallbackOnce, _ as createChannelMessageReplyPipeline, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, c as applyAccountNameToChannelSection, d as buildBaseAccountStatusSnapshot, f as buildChannelConfigSchema, g as chunkTextForOutbound, h as buildTokenChannelStatusSummary, i as PAIRING_APPROVED_MESSAGE, j as migrateBaseNameToDefaultAccount, k as logTypingFailure, l as applyBasicWebhookRequestGuards, m as buildSingleChannelSecretPromptState, n as setZaloRuntime, o as WEBHOOK_RATE_LIMIT_DEFAULTS, p as buildSecretInputSchema, q as runSingleChannelSecretStep, r as DEFAULT_ACCOUNT_ID, s as addWildcardAllowFrom, u as applySetupAccountConfigPatch, v as createChannelPairingController, w as formatPairingApproveHint, x as createWebhookAnomalyTracker, y as createDedupeCache, z as registerWebhookTarget } from "./runtime-api-CDwUY_-_.js";
+import { A as mergeAllowFromEntries, B as registerWebhookTargetWithPluginRoute, C as formatAllowFromLowercase, D as isNumericTargetId, E as isNormalizedSenderAllowed, F as promptSingleChannelSecretInput, G as resolveWebhookPath, H as resolveDefaultGroupPolicy, I as readJsonWebhookBodyOrReject, J as sendPayloadWithChunkedTextAndMedia, K as resolveWebhookTargetWithAuthOrRejectSync, L as readStringParam, M as normalizeAccountId, N as normalizeResolvedSecretInputString, O as jsonResult, P as normalizeSecretInputString, Q as withResolvedWebhookRequestPipeline, R as registerPluginHttpRoute, S as deliverTextOrMediaReply, T as hasConfiguredSecretInput, U as resolveInboundRouteEnvelopeBuilderWithRuntime, V as resolveClientIp, W as resolveOpenProviderRuntimeGroupPolicy, X as waitForAbortSignal, Y as setTopLevelChannelDmPolicyWithAllowFrom, Z as warnMissingProviderGroupPolicyFallbackOnce, _ as createChannelMessageReplyPipeline, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, c as applyAccountNameToChannelSection, d as buildBaseAccountStatusSnapshot, f as buildChannelConfigSchema, g as chunkTextForOutbound, h as buildTokenChannelStatusSummary, i as PAIRING_APPROVED_MESSAGE, j as migrateBaseNameToDefaultAccount, k as logTypingFailure, l as applyBasicWebhookRequestGuards, m as buildSingleChannelSecretPromptState, n as setZaloRuntime, o as WEBHOOK_RATE_LIMIT_DEFAULTS, p as buildSecretInputSchema, q as runSingleChannelSecretStep, r as DEFAULT_ACCOUNT_ID, s as addWildcardAllowFrom, u as applySetupAccountConfigPatch, v as createChannelPairingController, w as formatPairingApproveHint, x as createWebhookAnomalyTracker, y as createDedupeCache, z as registerWebhookTarget } from "./runtime-api-CAA4ZtqF.js";
 export { DEFAULT_ACCOUNT_ID, PAIRING_APPROVED_MESSAGE, WEBHOOK_ANOMALY_COUNTER_DEFAULTS, WEBHOOK_RATE_LIMIT_DEFAULTS, addWildcardAllowFrom, applyAccountNameToChannelSection, applyBasicWebhookRequestGuards, applySetupAccountConfigPatch, buildBaseAccountStatusSnapshot, buildChannelConfigSchema, buildSecretInputSchema, buildSingleChannelSecretPromptState, buildTokenChannelStatusSummary, chunkTextForOutbound, createChannelMessageReplyPipeline, createChannelPairingController, createDedupeCache, createFixedWindowRateLimiter, createWebhookAnomalyTracker, deliverTextOrMediaReply, formatAllowFromLowercase, formatPairingApproveHint, hasConfiguredSecretInput, isNormalizedSenderAllowed, isNumericTargetId, jsonResult, logTypingFailure, mergeAllowFromEntries, migrateBaseNameToDefaultAccount, normalizeAccountId, normalizeResolvedSecretInputString, normalizeSecretInputString, promptSingleChannelSecretInput, readJsonWebhookBodyOrReject, readStringParam, registerPluginHttpRoute, registerWebhookTarget, registerWebhookTargetWithPluginRoute, resolveClientIp, resolveDefaultGroupPolicy, resolveInboundRouteEnvelopeBuilderWithRuntime, resolveOpenProviderRuntimeGroupPolicy, resolveWebhookPath, resolveWebhookTargetWithAuthOrRejectSync, runSingleChannelSecretStep, sendPayloadWithChunkedTextAndMedia, setTopLevelChannelDmPolicyWithAllowFrom, setZaloRuntime, waitForAbortSignal, warnMissingProviderGroupPolicyFallbackOnce, withResolvedWebhookRequestPipeline };

package/dist/{send-DzchAfon.js → send-9sVVxyap.js}

@@ -1,6 +1,7 @@
 import { d as resolveZaloToken, u as resolveZaloAccount } from "./setup-core-fwCh0QUi.js";
 import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-outbound";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { resolvePinnedHostnameWithPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
@@ -11,6 +12,7 @@ import { makeProxyFetch } from "openclaw/plugin-sdk/fetch-runtime";
 * @see https://bot.zaloplatforms.com/docs
 */
 const ZALO_API_BASE = "https://bot-api.zaloplatforms.com";
+const ZALO_API_URL_ENV = "ZALO_API_URL";
 const ZALO_MEDIA_SSRF_POLICY = {};
 var ZaloApiError = class extends Error {
 	constructor(message, errorCode, description) {
@@ -24,11 +26,24 @@ var ZaloApiError = class extends Error {
 		return this.errorCode === 408;
 	}
 };
+function resolveZaloApiUrl(apiUrl) {
+	const value = apiUrl === void 0 ? process.env[ZALO_API_URL_ENV]?.trim() ?? ZALO_API_BASE : apiUrl.trim();
+	if (!value) throw new Error(`${ZALO_API_URL_ENV} must not be empty.`);
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error(`${ZALO_API_URL_ENV} must be a valid URL.`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`${ZALO_API_URL_ENV} must use http:// or https://.`);
+	if (parsed.search || parsed.hash) throw new Error(`${ZALO_API_URL_ENV} must not include a query string or fragment.`);
+	return parsed.href.replace(/\/+$/u, "");
+}
 /**
 * Call the Zalo Bot API
 */
 async function callZaloApi(method, token, body, options) {
-	const url = `${ZALO_API_BASE}/bot${token}/${method}`;
+	const url = `${resolveZaloApiUrl(options?.apiUrl)}/bot${token}/${method}`;
 	const controller = new AbortController();
 	const requestTimeoutMs = options?.timeoutMs === void 0 ? void 0 : resolveTimerTimeoutMs(options.timeoutMs, 1);
 	const timeoutId = requestTimeoutMs === void 0 ? void 0 : setTimeout(() => controller.abort(), requestTimeoutMs);
@@ -245,7 +260,7 @@ async function sendMessageZalo(chatId, text, options = {}) {
 		kind: "text"
 	}, () => sendMessage(context.token, {
 		chat_id: context.chatId,
-		text: text.slice(0, 2e3)
+		text: truncateUtf16Safe(text, 2e3)
 	}, context.fetcher));
 }
 async function sendPhotoZalo(chatId, photoUrl, options = {}) {
@@ -266,7 +281,7 @@ async function sendPhotoZalo(chatId, photoUrl, options = {}) {
 	}, () => (async () => sendPhoto(context.token, {
 		chat_id: context.chatId,
 		photo: photoUrl.trim(),
-		caption: options.caption?.slice(0, 2e3)
+		caption: options.caption !== void 0 ? truncateUtf16Safe(options.caption, 2e3) : void 0
 	}, context.fetcher))());
 }
 //#endregion

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
   "name": "@openclaw/zalo",
-  "version": "2026.7.1-beta.1",
+  "version": "2026.7.1-beta.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/zalo",
-      "version": "2026.7.1-beta.1",
+      "version": "2026.7.1-beta.4",
       "dependencies": {
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.7.1-beta.1"
+        "openclaw": ">=2026.7.1-beta.4"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/zalo",
-  "version": "2026.7.1-beta.1",
+  "version": "2026.7.1-beta.4",
   "description": "OpenClaw Zalo channel plugin for bot and webhook chats.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.7.1-beta.1"
+    "openclaw": ">=2026.7.1-beta.4"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -39,10 +39,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.7.1-beta.1"
+      "pluginApi": ">=2026.7.1-beta.4"
     },
     "build": {
-      "openclawVersion": "2026.7.1-beta.1"
+      "openclawVersion": "2026.7.1-beta.4"
     },
     "release": {
       "publishToClawHub": true,