@openclaw/zalo 2026.7.2-beta.1 → 2026.7.2-beta.2

package/dist/api.js

@@ -1,5 +1,5 @@
 import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-fwCh0QUi.js";
-import { t as zaloPlugin } from "./channel-C_73K8pR.js";
+import { t as zaloPlugin } from "./channel-CBPOM3Pc.js";
 import { n as resolveZaloRuntimeGroupPolicy } from "./group-access-8qHRzDHx.js";
 import { zaloSetupWizard } from "./setup-api.js";
 export { createZaloSetupWizardProxy, resolveZaloRuntimeGroupPolicy, zaloDmPolicy, zaloPlugin, zaloSetupAdapter, zaloSetupWizard };

package/dist/{channel-C_73K8pR.js → channel-CBPOM3Pc.js}

@@ -13,19 +13,20 @@ import { createStaticReplyToModeResolver } from "openclaw/plugin-sdk/conversatio
 import { createChannelDirectoryAdapter, listResolvedDirectoryUserEntriesFromAllowFrom } from "openclaw/plugin-sdk/directory-runtime";
 import { createLazyRuntimeModule, createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
 import { sendPayloadWithChunkedTextAndMedia } from "openclaw/plugin-sdk/reply-payload";
-import { createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
+import { createComputedAccountStatusAdapter, createDefaultChannelRuntimeState, standardDmPolicyOpenIssue } from "openclaw/plugin-sdk/status-helpers";
 import { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix, stripTargetKindPrefix } from "openclaw/plugin-sdk/core";
 import { jsonResult, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 import { extractToolSend } from "openclaw/plugin-sdk/tool-send";
 import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
-import { AllowFromListSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, buildCatchallMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import { AllowFromListSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { z } from "zod";
 import { coerceStatusIssueAccountId, readStatusIssueFields } from "openclaw/plugin-sdk/extension-shared";
 //#region extensions/zalo/src/actions.ts
 const loadZaloActionsRuntime = createLazyRuntimeNamedExport(() => import("./actions.runtime-OmfJFYZn.js"), "zaloActionsRuntime");
 const providerId = "zalo";
+const ZALO_ACTIONS = /* @__PURE__ */ new Set(["send"]);
 function listEnabledAccounts(cfg, accountId) {
 	return (accountId ? [resolveZaloAccount({
 		cfg,
@@ -35,12 +36,12 @@ function listEnabledAccounts(cfg, accountId) {
 const zaloMessageActions = {
 	describeMessageTool: ({ cfg, accountId }) => {
 		if (listEnabledAccounts(cfg, accountId).length === 0) return null;
-		const actions = /* @__PURE__ */ new Set(["send"]);
 		return {
-			actions: Array.from(actions),
+			actions: Array.from(ZALO_ACTIONS),
 			capabilities: []
 		};
 	},
+	supportsAction: ({ action }) => ZALO_ACTIONS.has(action),
 	extractToolSend: ({ args }) => extractToolSend(args, "sendMessage"),
 	handleAction: async ({ action, params, cfg, accountId }) => {
 		if (action === "send") {
@@ -85,7 +86,7 @@ const zaloApprovalAuth = createChannelApprovalAuth({
 	},
 	normalizeApprover: normalizeZaloApproverId
 }).approvalAuth;
-const ZaloConfigSchema = buildCatchallMultiAccountChannelSchema(z.object({
+const ZaloConfigSchema = buildMultiAccountChannelSchema(z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	markdown: MarkdownConfigSchema,
@@ -101,7 +102,7 @@ const ZaloConfigSchema = buildCatchallMultiAccountChannelSchema(z.object({
 	mediaMaxMb: z.number().optional(),
 	proxy: z.string().optional(),
 	responsePrefix: z.string().optional()
-}));
+}), { accountsMode: "catchall" });
 //#endregion
 //#region extensions/zalo/src/session-route.ts
 function resolveZaloOutboundSessionRoute(params) {
@@ -144,13 +145,12 @@ function collectZaloStatusIssues(accounts) {
 		const enabled = account.enabled !== false;
 		const configured = account.configured === true;
 		if (!enabled || !configured) continue;
-		if (account.dmPolicy === "open") issues.push({
+		if (account.dmPolicy === "open") issues.push(standardDmPolicyOpenIssue({
 			channel: "zalo",
 			accountId,
-			kind: "config",
-			message: "Zalo dmPolicy is \"open\", allowing any user to message the bot without pairing.",
-			fix: "Set channels.zalo.dmPolicy to \"pairing\" or \"allowlist\" to restrict access."
-		});
+			channelLabel: "Zalo",
+			configPath: "channels.zalo"
+		}));
 	}
 	return issues;
 }
@@ -176,7 +176,7 @@ function looksLikeZaloChatId(raw, normalized) {
 	const target = normalizeZaloMessagingTarget(normalized ?? raw);
 	return Boolean(target);
 }
-const loadZaloChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-DiilvQ99.js"));
+const loadZaloChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-BsZBukDW.js"));
 const zaloSetupWizard = createZaloSetupWizardProxy(async () => (await import("./setup-surface-8eRimod9.js")).zaloSetupWizard);
 const zaloTextChunkLimit = 2e3;
 async function sendZaloDelivery(ctx) {

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zaloPlugin } from "./channel-C_73K8pR.js";
+import { t as zaloPlugin } from "./channel-CBPOM3Pc.js";
 export { zaloPlugin };

package/dist/{channel.runtime-DiilvQ99.js → channel.runtime-BsZBukDW.js}

@@ -86,7 +86,7 @@ async function startZaloGatewayAccount(ctx) {
 		setStatus: ctx.setStatus
 	});
 	ctx.log?.info(`[${account.accountId}] starting provider${zaloBotLabel} mode=${mode}`);
-	const { monitorZaloProvider } = await import("./monitor-alx9kzIY.js");
+	const { monitorZaloProvider } = await import("./monitor-DTi243P3.js");
 	return monitorZaloProvider({
 		token,
 		account,

package/dist/{monitor-alx9kzIY.js → monitor-DTi243P3.js}

@@ -14,6 +14,7 @@ import { formatInboundMediaUnavailableText } from "openclaw/plugin-sdk/channel-i
 import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { sleepWithAbort, waitForAbortSignal } from "openclaw/plugin-sdk/runtime-env";
 import { createHostedOutboundMediaStore } from "openclaw/plugin-sdk/outbound-media";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/zalo/src/monitor-durable.ts
 function prepareZaloDurableReplyPayload(params) {
 	if (!params.payload.text) return params.payload;
@@ -129,7 +130,7 @@ async function tryHandleHostedZaloMediaRequest(req, res) {
 		res.end("Expired");
 		return true;
 	}
-	if (url.searchParams.get("token") !== entry.metadata.token) {
+	if (!safeEqualSecret(url.searchParams.get("token"), entry.metadata.token)) {
 		res.statusCode = 401;
 		res.end("Unauthorized");
 		return true;
@@ -164,7 +165,7 @@ function resolveZaloTimestampMs(date) {
 	if (!date) return;
 	return date >= UNIX_MILLISECONDS_THRESHOLD ? date : date * 1e3;
 }
-const loadZaloWebhookModule = createLazyRuntimeModule(() => import("./monitor.webhook-AYcIUBBP.js"));
+const loadZaloWebhookModule = createLazyRuntimeModule(() => import("./monitor.webhook-BFkM-Syx.js"));
 function releaseSharedHostedMediaRouteRef(routePath) {
 	const current = hostedMediaRouteRefs.get(routePath);
 	if (!current) return;

package/dist/{monitor.webhook-AYcIUBBP.js → monitor.webhook-BFkM-Syx.js}

@@ -1,6 +1,7 @@
 import { B as registerWebhookTargetWithPluginRoute, I as readJsonWebhookBodyOrReject, K as resolveWebhookTargetWithAuthOrRejectSync, Q as withResolvedWebhookRequestPipeline, V as resolveClientIp, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, l as applyBasicWebhookRequestGuards, o as WEBHOOK_RATE_LIMIT_DEFAULTS, x as createWebhookAnomalyTracker, z as registerWebhookTarget } from "./runtime-api-CAA4ZtqF.js";
-import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { createChannelReplayGuard } from "openclaw/plugin-sdk/persistent-dedupe";
+import { runDetachedWebhookWork } from "openclaw/plugin-sdk/webhook-request-guards";
 //#region extensions/zalo/src/monitor.webhook.ts
 const ZALO_WEBHOOK_REPLAY_WINDOW_MS = 5 * 6e4;
 const webhookTargets = /* @__PURE__ */ new Map();
@@ -9,10 +10,6 @@ const webhookRateLimiter = createFixedWindowRateLimiter({
 	maxRequests: WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests,
 	maxTrackedKeys: WEBHOOK_RATE_LIMIT_DEFAULTS.maxTrackedKeys
 });
-const recentWebhookEvents = createClaimableDedupe({
-	ttlMs: ZALO_WEBHOOK_REPLAY_WINDOW_MS,
-	memoryMaxSize: 5e3
-});
 const webhookAnomalyTracker = createWebhookAnomalyTracker({
 	maxTrackedKeys: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.maxTrackedKeys,
 	ttlMs: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.ttlMs,
@@ -43,6 +40,13 @@ function buildReplayEventCacheKey(target, update) {
 		messageId
 	]);
 }
+const recentWebhookEvents = createChannelReplayGuard({
+	dedupe: {
+		ttlMs: ZALO_WEBHOOK_REPLAY_WINDOW_MS,
+		memoryMaxSize: 5e3
+	},
+	buildReplayKey: ({ target, update }) => buildReplayEventCacheKey(target, update)
+});
 var ZaloRetryableWebhookError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -50,23 +54,17 @@ var ZaloRetryableWebhookError = class extends Error {
 	}
 };
 async function processZaloReplayGuardedUpdate(params) {
-	const replayEventKey = buildReplayEventCacheKey(params.target, params.update);
-	if (replayEventKey) {
-		if ((await recentWebhookEvents.claim(replayEventKey, { now: params.nowMs })).kind !== "claimed") return "duplicate";
-	}
-	params.target.statusSink?.({ lastInboundAt: Date.now() });
-	try {
-		await params.processUpdate({
-			update: params.update,
-			target: params.target
-		});
-		if (replayEventKey) await recentWebhookEvents.commit(replayEventKey);
-		return "processed";
-	} catch (error) {
-		if (replayEventKey) if (error instanceof ZaloRetryableWebhookError) recentWebhookEvents.release(replayEventKey, { error });
-		else await recentWebhookEvents.commit(replayEventKey);
-		throw error;
-	}
+	const event = {
+		target: params.target,
+		update: params.update
+	};
+	return (await recentWebhookEvents.processGuarded(event, async () => {
+		params.target.statusSink?.({ lastInboundAt: Date.now() });
+		await params.processUpdate(event);
+	}, {
+		dedupe: { now: params.nowMs },
+		onError: (error) => error instanceof ZaloRetryableWebhookError ? "release" : "commit"
+	})).kind === "processed" ? "processed" : "duplicate";
 }
 function recordWebhookStatus(runtime, path, statusCode) {
 	webhookAnomalyTracker.record({
@@ -154,12 +152,12 @@ async function handleZaloWebhookRequest(req, res, processUpdate) {
 				recordWebhookStatus(target.runtime, path, res.statusCode);
 				return true;
 			}
-			processZaloReplayGuardedUpdate({
+			runDetachedWebhookWork(() => processZaloReplayGuardedUpdate({
 				target,
 				update,
 				processUpdate,
 				nowMs
-			}).catch((err) => {
+			})).catch((err) => {
 				target.runtime.error?.(`[${target.account.accountId}] Zalo webhook failed: ${String(err)}`);
 			});
 			res.statusCode = 200;

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
   "name": "@openclaw/zalo",
-  "version": "2026.7.2-beta.1",
+  "version": "2026.7.2-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/zalo",
-      "version": "2026.7.2-beta.1",
+      "version": "2026.7.2-beta.2",
       "dependencies": {
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.7.2-beta.1"
+        "openclaw": ">=2026.7.2-beta.2"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/zalo",
-  "version": "2026.7.2-beta.1",
+  "version": "2026.7.2-beta.2",
   "description": "OpenClaw Zalo channel plugin for bot and webhook chats.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.1"
+    "openclaw": ">=2026.7.2-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -39,10 +39,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.1"
+      "pluginApi": ">=2026.7.2-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.1"
+      "openclawVersion": "2026.7.2-beta.2"
     },
     "release": {
       "publishToClawHub": true,