@openclaw/zalo 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/{actions.runtime-BRP15DNe.js → actions.runtime-DUY9_6Ss.js}

@@ -1,4 +1,4 @@
-import { t as sendMessageZalo } from "./send-BGGtv8x_.js";
+import { t as sendMessageZalo } from "./send-DVMIplpy.js";
 //#region extensions/zalo/src/actions.runtime.ts
 const zaloActionsRuntime = { sendMessageZalo };
 //#endregion

package/dist/api.js

@@ -1,5 +1,5 @@
-import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-T6qc2eAG.js";
-import { t as zaloPlugin } from "./channel-Dcp-XLf8.js";
+import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-CcCJ1E26.js";
+import { t as zaloPlugin } from "./channel-Vdxu1Y3k.js";
 import { n as resolveZaloRuntimeGroupPolicy } from "./group-access-8qHRzDHx.js";
 import { zaloSetupWizard } from "./setup-api.js";
 export { createZaloSetupWizardProxy, resolveZaloRuntimeGroupPolicy, zaloDmPolicy, zaloPlugin, zaloSetupAdapter, zaloSetupWizard };

package/dist/{channel-Dcp-XLf8.js → channel-Vdxu1Y3k.js}

@@ -1,12 +1,12 @@
-import { c as inspectZaloAccount, d as resolveZaloAccount, i as zaloSetupContract, l as listZaloAccountIds, p as buildSecretInputSchema, t as createZaloSetupWizardProxy, u as resolveDefaultZaloAccountId } from "./setup-core-T6qc2eAG.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-Bxvjh0Hq.js";
+import { c as inspectZaloAccount, d as resolveZaloAccount, i as zaloSetupContract, l as listZaloAccountIds, p as buildSecretInputSchema, t as createZaloSetupWizardProxy, u as resolveDefaultZaloAccountId } from "./setup-core-CcCJ1E26.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-Cpsqe5Cv.js";
 import { describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver, mapAllowFromEntries } from "openclaw/plugin-sdk/channel-config-helpers";
 import { buildChannelConfigSchema, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
-import { buildOpenGroupPolicyRestrictSendersWarning, buildOpenGroupPolicyWarning, createOpenProviderGroupPolicyWarningCollector } from "openclaw/plugin-sdk/channel-policy";
+import { buildOpenGroupPolicyRestrictSendersWarning, buildOpenGroupPolicyWarning, createConditionalWarningCollector, createOpenProviderGroupPolicyWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import { createAttachedChannelResultAdapter, createEmptyChannelResult } from "openclaw/plugin-sdk/channel-send-result";
 import { buildTokenChannelStatusSummary } from "openclaw/plugin-sdk/channel-status";
 import { createStaticReplyToModeResolver } from "openclaw/plugin-sdk/conversation-runtime";
@@ -16,15 +16,15 @@ import { sendPayloadWithChunkedTextAndMedia } from "openclaw/plugin-sdk/reply-pa
 import { createComputedAccountStatusAdapter, createDefaultChannelRuntimeState, standardDmPolicyOpenIssue } from "openclaw/plugin-sdk/status-helpers";
 import { chunkTextForOutbound, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix, stripTargetKindPrefix } from "openclaw/plugin-sdk/core";
 import { jsonResult, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 import { extractToolSend } from "openclaw/plugin-sdk/tool-send";
 import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
 import { AllowFromListSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { z } from "zod";
+import { buildChannelOutboundSessionRoute, stripChannelTargetPrefix, stripTargetKindPrefix } from "openclaw/plugin-sdk/core";
 import { coerceStatusIssueAccountId, readStatusIssueFields } from "openclaw/plugin-sdk/extension-shared";
 //#region extensions/zalo/src/actions.ts
-const loadZaloActionsRuntime = createLazyRuntimeNamedExport(() => import("./actions.runtime-BRP15DNe.js"), "zaloActionsRuntime");
+const loadZaloActionsRuntime = createLazyRuntimeNamedExport(() => import("./actions.runtime-DUY9_6Ss.js"), "zaloActionsRuntime");
 const providerId = "zalo";
 const ZALO_ACTIONS = /* @__PURE__ */ new Set(["send"]);
 function listEnabledAccounts(cfg, accountId) {
@@ -180,8 +180,8 @@ function looksLikeZaloChatId(raw, normalized) {
 	const target = normalizeZaloMessagingTarget(normalized ?? raw);
 	return Boolean(target);
 }
-const loadZaloChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-5CivhE5e.js"));
-const zaloSetupWizard = createZaloSetupWizardProxy(async () => (await import("./setup-surface-edfRk3eu.js").then((n) => n.t)).zaloSetupWizard);
+const loadZaloChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-UD-M7eDb.js"));
+const zaloSetupWizard = createZaloSetupWizardProxy(async () => (await import("./setup-surface-CIpp_MDf.js").then((n) => n.t)).zaloSetupWizard);
 const zaloTextChunkLimit = 2e3;
 async function sendZaloDelivery(ctx) {
 	const result = await (await loadZaloChannelRuntime()).sendZaloText({
@@ -260,6 +260,12 @@ const collectZaloSecurityWarnings = createOpenProviderGroupPolicyWarningCollecto
 		})];
 	}
 });
+const collectZaloOpenGroupFindings = createConditionalWarningCollector.findings({
+	collectWarnings: collectZaloSecurityWarnings,
+	checkId: "channels.zalo.groups.open",
+	severity: "critical",
+	title: "Zalo security warning"
+});
 const zaloPlugin = createChatChannelPlugin({
 	base: {
 		id: "zalo",
@@ -349,7 +355,7 @@ const zaloPlugin = createChatChannelPlugin({
 	},
 	security: {
 		resolveDmPolicy: resolveZaloDmPolicy,
-		collectWarnings: collectZaloSecurityWarnings
+		collectWarnings: collectZaloOpenGroupFindings
 	},
 	pairing: { text: {
 		idLabel: "zaloUserId",

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zaloPlugin } from "./channel-Dcp-XLf8.js";
+import { t as zaloPlugin } from "./channel-Vdxu1Y3k.js";
 export { zaloPlugin };

package/dist/{channel.runtime-5CivhE5e.js → channel.runtime-UD-M7eDb.js}

@@ -1,6 +1,6 @@
-import { m as normalizeSecretInputString } from "./setup-core-T6qc2eAG.js";
-import { i as PAIRING_APPROVED_MESSAGE } from "./runtime-api-qxdOyk3M.js";
-import { a as getMe, n as resolveZaloProxyFetch, r as ZaloApiError, t as sendMessageZalo } from "./send-BGGtv8x_.js";
+import { m as normalizeSecretInputString } from "./setup-core-CcCJ1E26.js";
+import { i as PAIRING_APPROVED_MESSAGE } from "./runtime-api-BNim5FCa.js";
+import { a as getMe, n as resolveZaloProxyFetch, r as ZaloApiError, t as sendMessageZalo } from "./send-DVMIplpy.js";
 import { createAccountStatusSink } from "openclaw/plugin-sdk/channel-outbound";
 import { runChannelProbe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/zalo/src/probe.ts
@@ -35,7 +35,7 @@ async function probeZalo(token, timeoutMs = 5e3, fetcher) {
 //#endregion
 //#region extensions/zalo/src/channel.runtime.ts
 async function notifyZaloPairingApproval(params) {
-	const { resolveZaloAccount } = await import("./setup-core-T6qc2eAG.js").then((n) => n.s);
+	const { resolveZaloAccount } = await import("./setup-core-CcCJ1E26.js").then((n) => n.s);
 	const account = resolveZaloAccount({ cfg: params.cfg });
 	if (!account.token) throw new Error("Zalo token not configured");
 	await sendMessageZalo(params.id, PAIRING_APPROVED_MESSAGE, { token: account.token });
@@ -69,7 +69,7 @@ async function startZaloGatewayAccount(ctx) {
 		setStatus: ctx.setStatus
 	});
 	ctx.log?.info(`[${account.accountId}] starting provider${zaloBotLabel} mode=${mode}`);
-	const { monitorZaloProvider } = await import("./monitor-Ckz5Mo22.js");
+	const { monitorZaloProvider } = await import("./monitor-JdVVhnCm.js");
 	return monitorZaloProvider({
 		token,
 		account,

package/dist/{monitor-Ckz5Mo22.js → monitor-JdVVhnCm.js}

@@ -1,6 +1,6 @@
 import { n as resolveZaloRuntimeGroupPolicy, t as normalizeZaloAllowEntry } from "./group-access-8qHRzDHx.js";
-import { t as getZaloRuntime } from "./runtime-api-qxdOyk3M.js";
-import { c as sendChatAction, d as setWebhook, f as ZALO_OUTBOUND_MEDIA_TTL_MS, i as deleteWebhook, l as sendMessage, n as resolveZaloProxyFetch, o as getUpdates, r as ZaloApiError, s as getWebhookInfo, u as sendPhoto } from "./send-BGGtv8x_.js";
+import { t as getZaloRuntime } from "./runtime-api-BNim5FCa.js";
+import { c as sendChatAction, d as setWebhook, f as ZALO_OUTBOUND_MEDIA_TTL_MS, i as deleteWebhook, l as sendMessage, n as resolveZaloProxyFetch, o as getUpdates, r as ZaloApiError, s as getWebhookInfo, u as sendPhoto } from "./send-DVMIplpy.js";
 import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-outbound";
 import { createLazyRuntimeModule, createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
 import { deliverTextOrMediaReply, resolveSendableOutboundReplyParts } from "openclaw/plugin-sdk/reply-payload";
@@ -174,8 +174,8 @@ function resolveZaloTimestampMs(date) {
 	if (!date) return;
 	return date >= UNIX_MILLISECONDS_THRESHOLD ? date : date * 1e3;
 }
-const loadZaloWebhookRuntime = createLazyRuntimeNamedExport(() => import("./monitor.webhook-S7nThy3R.js"), "zaloWebhookRuntime");
-const loadZaloWebhookIngressRuntime = createLazyRuntimeNamedExport(() => import("./webhook-spool-Bf17xwqi.js"), "zaloWebhookIngressRuntime");
+const loadZaloWebhookRuntime = createLazyRuntimeNamedExport(() => import("./monitor.webhook-cl1sV6j0.js"), "zaloWebhookRuntime");
+const loadZaloWebhookIngressRuntime = createLazyRuntimeNamedExport(() => import("./webhook-spool-Bdnu4GjY.js"), "zaloWebhookIngressRuntime");
 const loadZaloWebhookModule = createLazyRuntimeModule(async () => ({
 	...await loadZaloWebhookRuntime(),
 	...await loadZaloWebhookIngressRuntime()

package/dist/{monitor.webhook-S7nThy3R.js → monitor.webhook-cl1sV6j0.js}

@@ -1,5 +1,5 @@
-import { B as registerWebhookTargetWithPluginRoute, G as resolveWebhookTargetWithAuthOrRejectSync, V as resolveClientIp, Z as withResolvedWebhookRequestPipeline, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, l as applyBasicWebhookRequestGuards, o as WEBHOOK_RATE_LIMIT_DEFAULTS, x as createWebhookAnomalyTracker, z as registerWebhookTarget } from "./runtime-api-qxdOyk3M.js";
-import { ZaloWebhookPayloadError } from "./webhook-spool-Bf17xwqi.js";
+import { B as registerWebhookTargetWithPluginRoute, G as resolveWebhookTargetWithAuthOrRejectSync, V as resolveClientIp, Z as withResolvedWebhookRequestPipeline, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, l as applyBasicWebhookRequestGuards, o as WEBHOOK_RATE_LIMIT_DEFAULTS, x as createWebhookAnomalyTracker, z as registerWebhookTarget } from "./runtime-api-BNim5FCa.js";
+import { ZaloWebhookPayloadError } from "./webhook-spool-Bdnu4GjY.js";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import { readWebhookBodyOrReject } from "openclaw/plugin-sdk/webhook-request-guards";
 //#region extensions/zalo/src/monitor.webhook.ts

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { A as mergeAllowFromEntries, B as registerWebhookTargetWithPluginRoute, C as formatAllowFromLowercase, D as isNumericTargetId, E as isNormalizedSenderAllowed, F as promptSingleChannelSecretInput, G as resolveWebhookTargetWithAuthOrRejectSync, H as resolveDefaultGroupPolicy, I as readJsonWebhookBodyOrReject, J as setTopLevelChannelDmPolicyWithAllowFrom, K as runSingleChannelSecretStep, L as readStringParam, M as normalizeAccountId, N as normalizeResolvedSecretInputString, O as jsonResult, P as normalizeSecretInputString, R as registerPluginHttpRoute, S as deliverTextOrMediaReply, T as hasConfiguredSecretInput, U as resolveOpenProviderRuntimeGroupPolicy, V as resolveClientIp, W as resolveWebhookPath, X as warnMissingProviderGroupPolicyFallbackOnce, Y as waitForAbortSignal, Z as withResolvedWebhookRequestPipeline, _ as createChannelMessageReplyPipeline, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, c as applyAccountNameToChannelSection, d as buildBaseAccountStatusSnapshot, f as buildChannelConfigSchema, g as chunkTextForOutbound, h as buildTokenChannelStatusSummary, i as PAIRING_APPROVED_MESSAGE, j as migrateBaseNameToDefaultAccount, k as logTypingFailure, l as applyBasicWebhookRequestGuards, m as buildSingleChannelSecretPromptState, n as setZaloRuntime, o as WEBHOOK_RATE_LIMIT_DEFAULTS, p as buildSecretInputSchema, q as sendPayloadWithChunkedTextAndMedia, r as DEFAULT_ACCOUNT_ID, s as addWildcardAllowFrom, u as applySetupAccountConfigPatch, v as createChannelPairingController, w as formatPairingApproveHint, x as createWebhookAnomalyTracker, y as createDedupeCache, z as registerWebhookTarget } from "./runtime-api-qxdOyk3M.js";
+import { A as mergeAllowFromEntries, B as registerWebhookTargetWithPluginRoute, C as formatAllowFromLowercase, D as isNumericTargetId, E as isNormalizedSenderAllowed, F as promptSingleChannelSecretInput, G as resolveWebhookTargetWithAuthOrRejectSync, H as resolveDefaultGroupPolicy, I as readJsonWebhookBodyOrReject, J as setTopLevelChannelDmPolicyWithAllowFrom, K as runSingleChannelSecretStep, L as readStringParam, M as normalizeAccountId, N as normalizeResolvedSecretInputString, O as jsonResult, P as normalizeSecretInputString, R as registerPluginHttpRoute, S as deliverTextOrMediaReply, T as hasConfiguredSecretInput, U as resolveOpenProviderRuntimeGroupPolicy, V as resolveClientIp, W as resolveWebhookPath, X as warnMissingProviderGroupPolicyFallbackOnce, Y as waitForAbortSignal, Z as withResolvedWebhookRequestPipeline, _ as createChannelMessageReplyPipeline, a as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, b as createFixedWindowRateLimiter, c as applyAccountNameToChannelSection, d as buildBaseAccountStatusSnapshot, f as buildChannelConfigSchema, g as chunkTextForOutbound, h as buildTokenChannelStatusSummary, i as PAIRING_APPROVED_MESSAGE, j as migrateBaseNameToDefaultAccount, k as logTypingFailure, l as applyBasicWebhookRequestGuards, m as buildSingleChannelSecretPromptState, n as setZaloRuntime, o as WEBHOOK_RATE_LIMIT_DEFAULTS, p as buildSecretInputSchema, q as sendPayloadWithChunkedTextAndMedia, r as DEFAULT_ACCOUNT_ID, s as addWildcardAllowFrom, u as applySetupAccountConfigPatch, v as createChannelPairingController, w as formatPairingApproveHint, x as createWebhookAnomalyTracker, y as createDedupeCache, z as registerWebhookTarget } from "./runtime-api-BNim5FCa.js";
 export { DEFAULT_ACCOUNT_ID, PAIRING_APPROVED_MESSAGE, WEBHOOK_ANOMALY_COUNTER_DEFAULTS, WEBHOOK_RATE_LIMIT_DEFAULTS, addWildcardAllowFrom, applyAccountNameToChannelSection, applyBasicWebhookRequestGuards, applySetupAccountConfigPatch, buildBaseAccountStatusSnapshot, buildChannelConfigSchema, buildSecretInputSchema, buildSingleChannelSecretPromptState, buildTokenChannelStatusSummary, chunkTextForOutbound, createChannelMessageReplyPipeline, createChannelPairingController, createDedupeCache, createFixedWindowRateLimiter, createWebhookAnomalyTracker, deliverTextOrMediaReply, formatAllowFromLowercase, formatPairingApproveHint, hasConfiguredSecretInput, isNormalizedSenderAllowed, isNumericTargetId, jsonResult, logTypingFailure, mergeAllowFromEntries, migrateBaseNameToDefaultAccount, normalizeAccountId, normalizeResolvedSecretInputString, normalizeSecretInputString, promptSingleChannelSecretInput, readJsonWebhookBodyOrReject, readStringParam, registerPluginHttpRoute, registerWebhookTarget, registerWebhookTargetWithPluginRoute, resolveClientIp, resolveDefaultGroupPolicy, resolveOpenProviderRuntimeGroupPolicy, resolveWebhookPath, resolveWebhookTargetWithAuthOrRejectSync, runSingleChannelSecretStep, sendPayloadWithChunkedTextAndMedia, setTopLevelChannelDmPolicyWithAllowFrom, setZaloRuntime, waitForAbortSignal, warnMissingProviderGroupPolicyFallbackOnce, withResolvedWebhookRequestPipeline };

package/dist/{secret-contract-Bxvjh0Hq.js → secret-contract-Cpsqe5Cv.js}

@@ -1,4 +1,4 @@
-import { collectConditionalChannelFieldAssignments, createChannelSecretTargetRegistryEntries, getChannelSurface, hasOwnProperty } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+import { collectConditionalChannelFieldAssignments, createChannelSecretTargetRegistryEntries, getChannelSurface, hasOwnProperty, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 //#region extensions/zalo/src/secret-contract.ts
 const secretTargetRegistryEntries = createChannelSecretTargetRegistryEntries({
 	channelKey: "zalo",
@@ -17,7 +17,7 @@ function collectRuntimeConfigAssignments(params) {
 		defaults: params.defaults,
 		context: params.context,
 		topLevelActiveWithoutAccounts: true,
-		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "botToken"),
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "botToken") && !normalizeSecretStringValue(account.tokenFile),
 		accountActive: ({ enabled }) => enabled,
 		topInactiveReason: "no enabled Zalo surface inherits this top-level botToken.",
 		accountInactiveReason: "Zalo account is disabled."

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Bxvjh0Hq.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Cpsqe5Cv.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/{send-BGGtv8x_.js → send-DVMIplpy.js}

@@ -1,10 +1,10 @@
-import { d as resolveZaloAccount, f as resolveZaloToken } from "./setup-core-T6qc2eAG.js";
+import { d as resolveZaloAccount, f as resolveZaloToken } from "./setup-core-CcCJ1E26.js";
 import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-outbound";
 import { stripChannelTargetPrefix, stripTargetKindPrefix } from "openclaw/plugin-sdk/core";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
+import { assertOkOrThrowProviderError, readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { resolvePinnedHostnameWithPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
 import { makeProxyFetch } from "openclaw/plugin-sdk/fetch-runtime";
 //#region extensions/zalo/src/timeouts.ts
@@ -55,12 +55,14 @@ async function callZaloApi(method, token, body, options) {
 	const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
 	const fetcher = options?.fetch ?? fetch;
 	try {
-		const data = await readProviderJsonResponse(await fetcher(url, {
+		const response = await fetcher(url, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: body ? JSON.stringify(body) : void 0,
 			signal: controller.signal
-		}), `zalo.${method}`);
+		});
+		await assertOkOrThrowProviderError(response, `zalo.${method}`);
+		const data = await readProviderJsonResponse(response, `zalo.${method}`);
 		if (!data.ok) throw new ZaloApiError(data.description ?? `Zalo API error: ${method}`, data.error_code, data.description);
 		return data;
 	} finally {

package/dist/setup-api.js

@@ -1,4 +1,4 @@
-import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-T6qc2eAG.js";
+import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-CcCJ1E26.js";
 import { n as resolveZaloRuntimeGroupPolicy } from "./group-access-8qHRzDHx.js";
 import { loadBundledEntryExportSync } from "openclaw/plugin-sdk/channel-entry-contract";
 //#region extensions/zalo/setup-api.ts

package/dist/{setup-core-T6qc2eAG.js → setup-core-CcCJ1E26.js}

@@ -1,8 +1,8 @@
 import { createAccountListHelpers } from "openclaw/plugin-sdk/account-helpers";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/routing";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
 import { buildSecretInputSchema, normalizeSecretInputString, resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
@@ -20,8 +20,18 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region extensions/zalo/src/token.ts
-function readTokenFromFile(tokenFile) {
-	return tryReadSecretFileSync(tokenFile, "Zalo token file", { rejectSymlink: true }) ?? "";
+function readTokenFromFile(tokenFile, configPath) {
+	const result = tryReadSecretFileSync(tokenFile, "Zalo token file", { rejectSymlink: true }, { configPath });
+	return result.status === "available" ? {
+		token: result.value,
+		source: "configFile",
+		status: "available"
+	} : {
+		token: "",
+		source: "configFile",
+		status: "configured_unavailable",
+		credentialDiagnostics: [result.diagnostic]
+	};
 }
 function resolveZaloToken(config, accountId, options) {
 	const resolvedAccountId = normalizeAccountId(accountId ?? config?.defaultAccount);
@@ -45,21 +55,8 @@ function resolveZaloToken(config, accountId, options) {
 			source: "config",
 			status: "configured_unavailable"
 		};
-		const fileToken = readTokenFromFile(accountConfig.tokenFile);
-		if (fileToken) return {
-			token: fileToken,
-			source: "configFile",
-			status: "available"
-		};
-	}
-	if (!accountHasBotToken) {
-		const fileToken = readTokenFromFile(accountConfig?.tokenFile);
-		if (fileToken) return {
-			token: fileToken,
-			source: "configFile",
-			status: "available"
-		};
 	}
+	if (accountConfig?.tokenFile?.trim()) return readTokenFromFile(accountConfig.tokenFile, `channels.zalo.accounts.${resolvedAccountId}.tokenFile`);
 	if (!accountHasBotToken) {
 		const token = resolveSecretInputString({
 			value: baseConfig?.botToken,
@@ -76,12 +73,7 @@ function resolveZaloToken(config, accountId, options) {
 			source: "config",
 			status: "configured_unavailable"
 		};
-		const fileToken = readTokenFromFile(baseConfig?.tokenFile);
-		if (fileToken) return {
-			token: fileToken,
-			source: "configFile",
-			status: "available"
-		};
+		if (baseConfig?.tokenFile?.trim()) return readTokenFromFile(baseConfig.tokenFile, "channels.zalo.tokenFile");
 	}
 	if (isDefaultAccount) {
 		const envToken = process.env.ZALO_BOT_TOKEN?.trim();
@@ -126,6 +118,7 @@ function resolveZaloAccountWithMode(params) {
 		token: tokenResolution.token,
 		tokenSource: tokenResolution.source,
 		tokenStatus: tokenResolution.status,
+		...tokenResolution.credentialDiagnostics ? { credentialDiagnostics: tokenResolution.credentialDiagnostics } : {},
 		config: merged
 	};
 }

package/dist/{setup-surface-edfRk3eu.js → setup-surface-CIpp_MDf.js}

@@ -1,4 +1,4 @@
-import { a as noteZaloTokenHelp, c as inspectZaloAccount, h as __exportAll, n as zaloDmPolicy, o as promptZaloAllowFrom } from "./setup-core-T6qc2eAG.js";
+import { a as noteZaloTokenHelp, c as inspectZaloAccount, h as __exportAll, n as zaloDmPolicy, o as promptZaloAllowFrom } from "./setup-core-CcCJ1E26.js";
 import { DEFAULT_ACCOUNT_ID, buildSingleChannelSecretPromptState, createSetupTranslator, createStandardChannelSetupStatus, hasConfiguredSecretInput, promptSingleChannelSecretInput, runSingleChannelSecretStep } from "openclaw/plugin-sdk/setup";
 //#region extensions/zalo/src/setup-surface.ts
 var setup_surface_exports = /* @__PURE__ */ __exportAll({ zaloSetupWizard: () => zaloSetupWizard });

package/dist/setup-surface.js

@@ -1,3 +1,3 @@
-import { r as zaloSetupAdapter } from "./setup-core-T6qc2eAG.js";
-import { n as zaloSetupWizard } from "./setup-surface-edfRk3eu.js";
+import { r as zaloSetupAdapter } from "./setup-core-CcCJ1E26.js";
+import { n as zaloSetupWizard } from "./setup-surface-CIpp_MDf.js";
 export { zaloSetupAdapter, zaloSetupWizard };

package/dist/webhook-spool-Bdnu4GjY.js

@@ -0,0 +1,180 @@
+import { t as getZaloRuntime } from "./runtime-api-BNim5FCa.js";
+import { r as ZaloApiError } from "./send-DVMIplpy.js";
+import { DEFAULT_INGRESS_ADOPTION_STALL_MS, DEFAULT_INGRESS_RETRY_MAX_ATTEMPTS, bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor } from "openclaw/plugin-sdk/channel-outbound";
+import { normalizeNullableString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { z } from "zod";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { runDetachedWebhookWork } from "openclaw/plugin-sdk/webhook-request-guards";
+//#region extensions/zalo/src/webhook-spool.ts
+const ZALO_WEBHOOK_SPOOL_VERSION = 1;
+const ZALO_WEBHOOK_DRAIN_INTERVAL_MS = 500;
+const ZALO_WEBHOOK_MAX_CONCURRENT_DELIVERIES = 8;
+const ZaloWebhookPayloadError = createChannelIngressError("ZaloWebhookPayloadError");
+const nonEmptyWebhookStringSchema = z.string().transform((value) => normalizeNullableString(value)).pipe(z.string());
+const optionalWebhookStringSchema = z.string().optional().catch(void 0);
+const webhookEnvelopeSchema = z.looseObject({
+	ok: z.unknown().optional(),
+	result: z.looseObject({}).optional().catch(void 0)
+}).transform((envelope) => envelope.ok === true && envelope.result ? envelope.result : envelope);
+const webhookAdmissionSchema = z.looseObject({ message: z.looseObject({
+	message_id: nonEmptyWebhookStringSchema,
+	chat: z.looseObject({ id: nonEmptyWebhookStringSchema })
+}) });
+const webhookSenderSchema = z.object({
+	id: nonEmptyWebhookStringSchema,
+	name: optionalWebhookStringSchema,
+	display_name: optionalWebhookStringSchema,
+	avatar: optionalWebhookStringSchema,
+	is_bot: z.boolean().optional().catch(void 0)
+});
+const webhookChatSchema = z.object({
+	id: nonEmptyWebhookStringSchema,
+	chat_type: z.enum(["PRIVATE", "GROUP"])
+});
+const webhookMessageSchema = z.object({
+	message_id: nonEmptyWebhookStringSchema,
+	from: webhookSenderSchema,
+	chat: webhookChatSchema,
+	date: z.number().finite(),
+	text: optionalWebhookStringSchema,
+	photo_url: optionalWebhookStringSchema,
+	caption: optionalWebhookStringSchema,
+	sticker: optionalWebhookStringSchema,
+	message_type: optionalWebhookStringSchema
+});
+const webhookUpdateSchema = z.object({
+	event_name: z.enum([
+		"message.text.received",
+		"message.image.received",
+		"message.sticker.received",
+		"message.unsupported.received"
+	]),
+	message: webhookMessageSchema
+}).superRefine((update, context) => {
+	if (update.event_name === "message.text.received" && update.message.text === void 0) context.addIssue({
+		code: "custom",
+		path: ["message", "text"],
+		message: "text event requires message.text"
+	});
+});
+function parseRawRecord(rawEvent) {
+	let parsed;
+	try {
+		parsed = JSON.parse(rawEvent);
+	} catch (error) {
+		throw new ZaloWebhookPayloadError("Zalo webhook body contains invalid JSON.", { cause: error });
+	}
+	const envelope = webhookEnvelopeSchema.safeParse(parsed);
+	if (!envelope.success) throw new ZaloWebhookPayloadError("Zalo webhook body must be a JSON object.");
+	return envelope.data;
+}
+function inspectZaloWebhookEvent(rawEvent) {
+	const update = parseRawRecord(rawEvent);
+	const admission = webhookAdmissionSchema.safeParse(update);
+	if (!admission.success) {
+		if (admission.error.issues.some((issue) => issue.path[0] === "message" && (issue.path.length === 1 || issue.path[1] === "message_id"))) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.message_id.");
+		if (admission.error.issues.some((issue) => issue.path[0] === "message" && issue.path[1] === "chat")) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.chat.id.");
+		throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.message_id.");
+	}
+	return {
+		eventId: admission.data.message.message_id,
+		laneKey: `chat:${admission.data.message.chat.id}`,
+		update
+	};
+}
+function parseClaimedUpdate(payload, claimedId) {
+	if (payload.version !== ZALO_WEBHOOK_SPOOL_VERSION || typeof payload.rawEvent !== "string") throw new ZaloWebhookPayloadError("Zalo webhook spool payload is invalid.");
+	const facts = inspectZaloWebhookEvent(payload.rawEvent);
+	if (facts.eventId !== claimedId) throw new ZaloWebhookPayloadError("Zalo webhook message id changed after durable admission.");
+	const parsed = webhookUpdateSchema.safeParse(facts.update);
+	if (!parsed.success) {
+		const paths = parsed.error.issues.map((issue) => issue.path.join("."));
+		if (paths.some((path) => path === "event_name")) throw new ZaloWebhookPayloadError("Zalo webhook event_name is unsupported.");
+		if (paths.some((path) => path === "message.from" || path.startsWith("message.from.id"))) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.from.id.");
+		if (paths.some((path) => path === "message.chat" || path.startsWith("message.chat.id"))) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.chat.id.");
+		if (paths.some((path) => path.startsWith("message.chat.chat_type"))) throw new ZaloWebhookPayloadError("Zalo webhook message has an invalid chat type.");
+		if (paths.some((path) => path.startsWith("message.date"))) throw new ZaloWebhookPayloadError("Zalo webhook message has an invalid date.");
+		if (paths.some((path) => path.startsWith("message.text"))) throw new ZaloWebhookPayloadError("Zalo text event is missing message.text.");
+		throw new ZaloWebhookPayloadError("Zalo webhook event_name is unsupported.");
+	}
+	const { event_name: eventName, message } = parsed.data;
+	return {
+		event_name: eventName,
+		message: {
+			message_id: claimedId,
+			from: message.from,
+			chat: message.chat,
+			date: message.date,
+			...message.text !== void 0 ? { text: message.text } : {},
+			...message.photo_url !== void 0 ? { photo_url: message.photo_url } : {},
+			...message.caption !== void 0 ? { caption: message.caption } : {},
+			...message.sticker !== void 0 ? { sticker: message.sticker } : {},
+			...message.message_type !== void 0 ? { message_type: message.message_type } : {}
+		}
+	};
+}
+function isZaloAuthenticationFailure(error) {
+	let current = error;
+	const seen = /* @__PURE__ */ new Set();
+	while (current && typeof current === "object" && !seen.has(current)) {
+		seen.add(current);
+		const candidate = current;
+		if (current instanceof ZaloApiError && (current.errorCode === 401 || current.errorCode === 403) || candidate.status === 401 || candidate.status === 403 || candidate.statusCode === 401 || candidate.statusCode === 403) return true;
+		current = candidate.cause;
+	}
+	return false;
+}
+function createZaloWebhookIngress(options) {
+	const monitor = createChannelIngressMonitor({
+		queue: options.queue ?? getZaloRuntime().state.openChannelIngressQueue({ accountId: options.accountId }),
+		inspect: (rawEvent) => inspectZaloWebhookEvent(rawEvent),
+		payload: {
+			storage: "raw-event",
+			version: ZALO_WEBHOOK_SPOOL_VERSION,
+			serialize: (rawEvent) => rawEvent,
+			deserialize: (rawEvent) => rawEvent,
+			createClaimError: (kind) => new ZaloWebhookPayloadError(kind === "invalid-version" ? "Zalo webhook spool payload is invalid." : "Zalo webhook identity changed after durable admission.")
+		},
+		deliver: async (_rawEvent, lifecycle, claim) => {
+			const update = parseClaimedUpdate(claim.payload, claim.id);
+			await options.deliver(update, bindIngressLifecycleToReplyOptions(lifecycle).turnAdoptionLifecycle);
+		},
+		pollIntervalMs: ZALO_WEBHOOK_DRAIN_INTERVAL_MS,
+		retention: { failedMaxEntries: 5e3 },
+		waitForDeliveryIdleBeforeRepump: false,
+		runPumpTask: runDetachedWebhookWork,
+		deferredClaims: "wait-on-stop",
+		drain: {
+			adoptionStallTimeoutMs: DEFAULT_INGRESS_ADOPTION_STALL_MS,
+			startLimit: ZALO_WEBHOOK_MAX_CONCURRENT_DELIVERIES,
+			retryPolicy: {
+				maxAttempts: DEFAULT_INGRESS_RETRY_MAX_ATTEMPTS,
+				deadLetterMinAgeMs: 0
+			},
+			resolveNonRetryableFailure: (error) => {
+				if (error instanceof ZaloWebhookPayloadError) return {
+					reason: "invalid-event",
+					message: error.message
+				};
+				if (isZaloAuthenticationFailure(error)) return {
+					reason: "authentication-failed",
+					message: formatErrorMessage(error)
+				};
+				return null;
+			},
+			onLog: (message) => options.runtime.error?.(`zalo ingress: ${message}`)
+		},
+		createStoppedError: () => /* @__PURE__ */ new Error("Zalo ingress stopped."),
+		onError: (error) => options.runtime.error?.(`zalo ingress drain failed: ${formatErrorMessage(error)}`)
+	});
+	return {
+		accept: async (rawEvent) => {
+			await monitor.admit(rawEvent);
+		},
+		start: monitor.start,
+		stop: monitor.stop
+	};
+}
+const zaloWebhookIngressRuntime = { createZaloWebhookIngress };
+//#endregion
+export { ZaloWebhookPayloadError, zaloWebhookIngressRuntime };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/zalo",
-  "version": "2026.8.1-beta.2",
+  "version": "2026.8.1-beta.3",
   "description": "OpenClaw Zalo channel plugin for bot and webhook chats.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.8.1-beta.2"
+    "openclaw": ">=2026.8.1-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -83,10 +83,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.8.1-beta.2"
+      "pluginApi": ">=2026.8.1-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.8.1-beta.2"
+      "openclawVersion": "2026.8.1-beta.3"
     },
     "release": {
       "publishToClawHub": true,

package/dist/webhook-spool-Bf17xwqi.js

@@ -1,119 +0,0 @@
-import { t as getZaloRuntime } from "./runtime-api-qxdOyk3M.js";
-import { r as ZaloApiError } from "./send-BGGtv8x_.js";
-import { DEFAULT_INGRESS_ADOPTION_STALL_MS, DEFAULT_INGRESS_RETRY_MAX_ATTEMPTS, bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor } from "openclaw/plugin-sdk/channel-outbound";
-import { normalizeNullableString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { isRecord } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { runDetachedWebhookWork } from "openclaw/plugin-sdk/webhook-request-guards";
-//#region extensions/zalo/src/webhook-spool.ts
-const ZALO_WEBHOOK_SPOOL_VERSION = 1;
-const ZALO_WEBHOOK_DRAIN_INTERVAL_MS = 500;
-const ZALO_WEBHOOK_MAX_CONCURRENT_DELIVERIES = 8;
-const ZaloWebhookPayloadError = createChannelIngressError("ZaloWebhookPayloadError");
-function parseRawRecord(rawEvent) {
-	let parsed;
-	try {
-		parsed = JSON.parse(rawEvent);
-	} catch (error) {
-		throw new ZaloWebhookPayloadError("Zalo webhook body contains invalid JSON.", { cause: error });
-	}
-	if (!isRecord(parsed)) throw new ZaloWebhookPayloadError("Zalo webhook body must be a JSON object.");
-	return parsed;
-}
-function resolveUpdateRecord(envelope) {
-	if (envelope.ok === true && isRecord(envelope.result)) return envelope.result;
-	return envelope;
-}
-function inspectZaloWebhookEvent(rawEvent) {
-	const update = resolveUpdateRecord(parseRawRecord(rawEvent));
-	const message = isRecord(update.message) ? update.message : null;
-	const eventId = normalizeNullableString(message?.message_id);
-	if (!eventId) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.message_id.");
-	const chatId = normalizeNullableString((isRecord(message?.chat) ? message.chat : null)?.id);
-	if (!chatId) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.chat.id.");
-	return {
-		eventId,
-		laneKey: `chat:${chatId}`,
-		update
-	};
-}
-function parseClaimedUpdate(payload, claimedId) {
-	if (payload.version !== ZALO_WEBHOOK_SPOOL_VERSION || typeof payload.rawEvent !== "string") throw new ZaloWebhookPayloadError("Zalo webhook spool payload is invalid.");
-	const facts = inspectZaloWebhookEvent(payload.rawEvent);
-	if (facts.eventId !== claimedId) throw new ZaloWebhookPayloadError("Zalo webhook message id changed after durable admission.");
-	const eventName = normalizeNullableString(facts.update.event_name);
-	if (eventName !== "message.text.received" && eventName !== "message.image.received" && eventName !== "message.sticker.received" && eventName !== "message.unsupported.received") throw new ZaloWebhookPayloadError("Zalo webhook event_name is unsupported.");
-	const message = facts.update.message;
-	const from = isRecord(message.from) ? message.from : null;
-	const chat = isRecord(message.chat) ? message.chat : null;
-	if (!normalizeNullableString(from?.id)) throw new ZaloWebhookPayloadError("Zalo webhook message is missing message.from.id.");
-	if (chat?.chat_type !== "PRIVATE" && chat?.chat_type !== "GROUP") throw new ZaloWebhookPayloadError("Zalo webhook message has an invalid chat type.");
-	if (typeof message.date !== "number" || !Number.isFinite(message.date)) throw new ZaloWebhookPayloadError("Zalo webhook message has an invalid date.");
-	if (eventName === "message.text.received" && typeof message.text !== "string") throw new ZaloWebhookPayloadError("Zalo text event is missing message.text.");
-	return facts.update;
-}
-function isZaloAuthenticationFailure(error) {
-	let current = error;
-	const seen = /* @__PURE__ */ new Set();
-	while (current && typeof current === "object" && !seen.has(current)) {
-		seen.add(current);
-		const candidate = current;
-		if (current instanceof ZaloApiError && (current.errorCode === 401 || current.errorCode === 403) || candidate.status === 401 || candidate.status === 403 || candidate.statusCode === 401 || candidate.statusCode === 403) return true;
-		current = candidate.cause;
-	}
-	return false;
-}
-function createZaloWebhookIngress(options) {
-	const monitor = createChannelIngressMonitor({
-		queue: options.queue ?? getZaloRuntime().state.openChannelIngressQueue({ accountId: options.accountId }),
-		inspect: (rawEvent) => inspectZaloWebhookEvent(rawEvent),
-		payload: {
-			storage: "raw-event",
-			version: ZALO_WEBHOOK_SPOOL_VERSION,
-			serialize: (rawEvent) => rawEvent,
-			deserialize: (rawEvent) => rawEvent,
-			createClaimError: (kind) => new ZaloWebhookPayloadError(kind === "invalid-version" ? "Zalo webhook spool payload is invalid." : "Zalo webhook identity changed after durable admission.")
-		},
-		deliver: async (_rawEvent, lifecycle, claim) => {
-			const update = parseClaimedUpdate(claim.payload, claim.id);
-			await options.deliver(update, bindIngressLifecycleToReplyOptions(lifecycle).turnAdoptionLifecycle);
-		},
-		pollIntervalMs: ZALO_WEBHOOK_DRAIN_INTERVAL_MS,
-		retention: { failedMaxEntries: 5e3 },
-		waitForDeliveryIdleBeforeRepump: false,
-		runPumpTask: runDetachedWebhookWork,
-		deferredClaims: "wait-on-stop",
-		drain: {
-			adoptionStallTimeoutMs: DEFAULT_INGRESS_ADOPTION_STALL_MS,
-			startLimit: ZALO_WEBHOOK_MAX_CONCURRENT_DELIVERIES,
-			retryPolicy: {
-				maxAttempts: DEFAULT_INGRESS_RETRY_MAX_ATTEMPTS,
-				deadLetterMinAgeMs: 0
-			},
-			resolveNonRetryableFailure: (error) => {
-				if (error instanceof ZaloWebhookPayloadError) return {
-					reason: "invalid-event",
-					message: error.message
-				};
-				if (isZaloAuthenticationFailure(error)) return {
-					reason: "authentication-failed",
-					message: formatErrorMessage(error)
-				};
-				return null;
-			},
-			onLog: (message) => options.runtime.error?.(`zalo ingress: ${message}`)
-		},
-		createStoppedError: () => /* @__PURE__ */ new Error("Zalo ingress stopped."),
-		onError: (error) => options.runtime.error?.(`zalo ingress drain failed: ${formatErrorMessage(error)}`)
-	});
-	return {
-		accept: async (rawEvent) => {
-			await monitor.admit(rawEvent);
-		},
-		start: monitor.start,
-		stop: monitor.stop
-	};
-}
-const zaloWebhookIngressRuntime = { createZaloWebhookIngress };
-//#endregion
-export { ZaloWebhookPayloadError, zaloWebhookIngressRuntime };

package/dist/{runtime-api-qxdOyk3M.js → runtime-api-BNim5FCa.js}

@@ -4,8 +4,8 @@ import { PAIRING_APPROVED_MESSAGE, buildTokenChannelStatusSummary as buildTokenC
 import { deliverTextOrMediaReply as deliverTextOrMediaReply$1, isNumericTargetId, sendPayloadWithChunkedTextAndMedia as sendPayloadWithChunkedTextAndMedia$1 } from "openclaw/plugin-sdk/reply-payload";
 import { buildBaseAccountStatusSnapshot } from "openclaw/plugin-sdk/status-helpers";
 import { chunkTextForOutbound as chunkTextForOutbound$1 } from "openclaw/plugin-sdk/text-chunking";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildChannelConfigSchema, createDedupeCache, formatPairingApproveHint, jsonResult, normalizeAccountId as normalizeAccountId$1, readStringParam, resolveClientIp } from "openclaw/plugin-sdk/core";
 import { buildSecretInputSchema, hasConfiguredSecretInput as hasConfiguredSecretInput$1, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildChannelConfigSchema, createDedupeCache, formatPairingApproveHint, jsonResult, normalizeAccountId as normalizeAccountId$1, readStringParam, resolveClientIp } from "openclaw/plugin-sdk/core";
 import { addWildcardAllowFrom, applyAccountNameToChannelSection, applySetupAccountConfigPatch, buildSingleChannelSecretPromptState as buildSingleChannelSecretPromptState$1, mergeAllowFromEntries as mergeAllowFromEntries$1, migrateBaseNameToDefaultAccount, promptSingleChannelSecretInput as promptSingleChannelSecretInput$1, runSingleChannelSecretStep as runSingleChannelSecretStep$1, setTopLevelChannelDmPolicyWithAllowFrom } from "openclaw/plugin-sdk/setup";
 import { resolveDefaultGroupPolicy as resolveDefaultGroupPolicy$1, resolveOpenProviderRuntimeGroupPolicy as resolveOpenProviderRuntimeGroupPolicy$1, warnMissingProviderGroupPolicyFallbackOnce as warnMissingProviderGroupPolicyFallbackOnce$1 } from "openclaw/plugin-sdk/runtime-group-policy";
 import { createChannelPairingController as createChannelPairingController$1 } from "openclaw/plugin-sdk/channel-pairing";