@openclaw/zalouser 2026.5.24-beta.2 → 2026.5.25-beta.1

package/dist/{api-4XaYbfFN.js → api-JQB4ot-D.js}

@@ -1,10 +1,10 @@
-import "./setup-surface-BojZvmoT.js";
+import "./setup-surface-Bxs5sB9I.js";
 import "./shared-DldcYEuJ.js";
-import "./channel-M34KcI2i.js";
+import "./channel-JP8XV98s.js";
 import { r as parseZalouserOutboundTarget } from "./session-route-Bp8b300d.js";
 import "./security-audit-DhK2UscX.js";
 import { i as listZaloFriendsMatching, n as getZaloUserInfo, s as listZaloGroupsMatching, t as checkZaloAuthenticated } from "./zalo-js-DbixqoIc.js";
-import "./channel.setup-BhBGdPX2.js";
+import "./channel.setup-NgaAvG_W.js";
 import { i as sendMessageZalouser, n as sendImageZalouser, r as sendLinkZalouser } from "./send-DWMNFMHL.js";
 import { stringEnum } from "openclaw/plugin-sdk/channel-actions";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";

package/dist/api.js

@@ -1,7 +1,7 @@
-import { n as zalouserSetupWizard } from "./setup-surface-BojZvmoT.js";
+import { n as zalouserSetupWizard } from "./setup-surface-Bxs5sB9I.js";
 import { n as createZalouserSetupWizardProxy, r as zalouserSetupAdapter } from "./shared-DldcYEuJ.js";
-import { t as zalouserPlugin } from "./channel-M34KcI2i.js";
+import { t as zalouserPlugin } from "./channel-JP8XV98s.js";
 import { n as isZalouserMutableGroupEntry, t as collectZalouserSecurityAuditFindings } from "./security-audit-DhK2UscX.js";
-import { t as zalouserSetupPlugin } from "./channel.setup-BhBGdPX2.js";
-import { t as createZalouserTool } from "./api-4XaYbfFN.js";
+import { t as zalouserSetupPlugin } from "./channel.setup-NgaAvG_W.js";
+import { t as createZalouserTool } from "./api-JQB4ot-D.js";
 export { collectZalouserSecurityAuditFindings, createZalouserSetupWizardProxy, createZalouserTool, isZalouserMutableGroupEntry, zalouserPlugin, zalouserSetupAdapter, zalouserSetupPlugin, zalouserSetupWizard };

package/dist/{channel-M34KcI2i.js → channel-JP8XV98s.js}

@@ -449,7 +449,7 @@ function collectZalouserStatusIssues(accounts) {
 //#endregion
 //#region extensions/zalouser/src/channel.ts
 const loadZalouserChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-7I0T1txN.js"));
-const zalouserSetupWizardProxy = createZalouserSetupWizardProxy(async () => (await import("./setup-surface-BojZvmoT.js").then((n) => n.t)).zalouserSetupWizard);
+const zalouserSetupWizardProxy = createZalouserSetupWizardProxy(async () => (await import("./setup-surface-Bxs5sB9I.js").then((n) => n.t)).zalouserSetupWizard);
 function mapUser(params) {
 	return {
 		kind: "user",
@@ -566,7 +566,7 @@ const zalouserPlugin = createChatChannelPlugin({
 					setStatus: ctx.setStatus
 				});
 				ctx.log?.info(`[${account.accountId}] starting zalouser provider${userLabel}`);
-				const { monitorZalouserProvider } = await import("./monitor-DU4TYyfM.js");
+				const { monitorZalouserProvider } = await import("./monitor-BY3hC_SJ.js");
 				return monitorZalouserProvider({
 					account,
 					config: ctx.cfg,

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zalouserPlugin } from "./channel-M34KcI2i.js";
+import { t as zalouserPlugin } from "./channel-JP8XV98s.js";
 export { zalouserPlugin };

package/dist/{channel.setup-BhBGdPX2.js → channel.setup-NgaAvG_W.js}

@@ -1,4 +1,4 @@
-import { n as zalouserSetupWizard } from "./setup-surface-BojZvmoT.js";
+import { n as zalouserSetupWizard } from "./setup-surface-Bxs5sB9I.js";
 import { r as zalouserSetupAdapter, t as createZalouserPluginBase } from "./shared-DldcYEuJ.js";
 //#region extensions/zalouser/src/channel.setup.ts
 const zalouserSetupPlugin = { ...createZalouserPluginBase({

package/dist/{monitor-DU4TYyfM.js → monitor-BY3hC_SJ.js}

@@ -1,4 +1,4 @@
-import { a as resolveZalouserMessageSid, c as isZalouserGroupEntryAllowed, i as formatZalouserMessageSidFull, n as getZalouserRuntime, o as buildZalouserGroupCandidates, s as findZalouserGroupEntry } from "./channel-M34KcI2i.js";
+import { a as resolveZalouserMessageSid, c as isZalouserGroupEntryAllowed, i as formatZalouserMessageSidFull, n as getZalouserRuntime, o as buildZalouserGroupCandidates, s as findZalouserGroupEntry } from "./channel-JP8XV98s.js";
 import { o as listZaloGroups, r as listZaloFriends, u as resolveZaloGroupContext, v as startZaloListener } from "./zalo-js-DbixqoIc.js";
 import { i as sendMessageZalouser, o as sendSeenZalouser, s as sendTypingZalouser, t as sendDeliveredZalouser } from "./send-DWMNFMHL.js";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/runtime-api.js

@@ -1,9 +1,9 @@
-import { n as zalouserSetupWizard } from "./setup-surface-BojZvmoT.js";
+import { n as zalouserSetupWizard } from "./setup-surface-Bxs5sB9I.js";
 import { n as createZalouserSetupWizardProxy, r as zalouserSetupAdapter } from "./shared-DldcYEuJ.js";
-import { r as setZalouserRuntime, t as zalouserPlugin } from "./channel-M34KcI2i.js";
+import { r as setZalouserRuntime, t as zalouserPlugin } from "./channel-JP8XV98s.js";
 import { n as isZalouserMutableGroupEntry, t as collectZalouserSecurityAuditFindings } from "./security-audit-DhK2UscX.js";
-import { t as zalouserSetupPlugin } from "./channel.setup-BhBGdPX2.js";
-import { t as createZalouserTool } from "./api-4XaYbfFN.js";
+import { t as zalouserSetupPlugin } from "./channel.setup-NgaAvG_W.js";
+import { t as createZalouserTool } from "./api-JQB4ot-D.js";
 import { buildBaseAccountStatusSnapshot } from "openclaw/plugin-sdk/status-helpers";
 import { formatAllowFromLowercase, mergeAllowlist, summarizeMapping } from "openclaw/plugin-sdk/allow-from";
 import { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, normalizeAccountId } from "openclaw/plugin-sdk/core";

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zalouserSetupPlugin } from "./channel.setup-BhBGdPX2.js";
+import { t as zalouserSetupPlugin } from "./channel.setup-NgaAvG_W.js";
 export { zalouserSetupPlugin };

package/dist/{setup-surface-BojZvmoT.js → setup-surface-Bxs5sB9I.js}

@@ -1,6 +1,7 @@
 import { a as resolveZalouserAccountSync, i as resolveDefaultZalouserAccountId, r as listZalouserAccountIds, t as checkZcaAuthenticated } from "./accounts-CHcNfL1Y.js";
 import { i as writeQrDataUrlToTempFile } from "./shared-DldcYEuJ.js";
 import { b as waitForZaloQrLogin, c as logoutZaloProfile, d as resolveZaloGroupsByEntries, l as resolveZaloAllowFromEntries, y as startZaloQrLogin } from "./zalo-js-DbixqoIc.js";
+import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, addWildcardAllowFrom, createSetupTranslator, formatCliCommand, formatDocsLink, formatResolvedUnresolvedNote, mergeAllowFromEntries, normalizeAccountId, patchScopedAccountConfig } from "openclaw/plugin-sdk/setup";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -24,7 +25,7 @@ const ZALOUSER_DM_ACCESS_TITLE = t("wizard.zalouser.dmAccessTitle");
 const ZALOUSER_ALLOWLIST_TITLE = t("wizard.zalouser.allowlistTitle");
 const ZALOUSER_GROUPS_TITLE = t("wizard.zalouser.groupsTitle");
 function parseZalouserEntries(raw) {
-	return raw.split(/[\n,;]+/g).map((entry) => entry.trim()).filter(Boolean);
+	return normalizeStringEntries(raw.split(/[\n,;]+/g));
 }
 function setZalouserAccountScopedConfig(cfg, accountId, defaultPatch, accountPatch = defaultPatch) {
 	return patchScopedAccountConfig({
@@ -331,7 +332,7 @@ const zalouserSetupWizard = {
 				});
 				const resolvedIds = resolved.filter((entry) => entry.resolved && entry.id).map((entry) => entry.id);
 				const unresolved = resolved.filter((entry) => !entry.resolved).map((entry) => entry.input);
-				const keys = [...resolvedIds, ...unresolved.map((entry) => entry.trim()).filter(Boolean)];
+				const keys = [...resolvedIds, ...normalizeStringEntries(unresolved)];
 				const resolution = formatResolvedUnresolvedNote({
 					resolved: resolvedIds,
 					unresolved
@@ -340,7 +341,7 @@ const zalouserSetupWizard = {
 				return keys;
 			} catch (err) {
 				await prompter.note(t("wizard.zalouser.groupLookupFailed", { error: String(err) }), ZALOUSER_GROUPS_TITLE);
-				return entries.map((entry) => entry.trim()).filter(Boolean);
+				return normalizeStringEntries(entries);
 			}
 		},
 		applyAllowlist: ({ cfg, accountId, resolved }) => setZalouserGroupAllowlist(cfg, accountId, resolved)

package/node_modules/ws/lib/receiver.js

@@ -40,6 +40,10 @@ class Receiver extends Writable {
    *     extensions
    * @param {Boolean} [options.isServer=false] Specifies whether to operate in
    *     client or server mode
+   * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+   *     buffered data chunks
+   * @param {Number} [options.maxFragments=0] The maximum number of message
+   *     fragments
    * @param {Number} [options.maxPayload=0] The maximum allowed message length
    * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
    *     not to skip UTF-8 validation for text and close messages
@@ -54,6 +58,8 @@ class Receiver extends Writable {
     this._binaryType = options.binaryType || BINARY_TYPES[0];
     this._extensions = options.extensions || {};
     this._isServer = !!options.isServer;
+    this._maxBufferedChunks = options.maxBufferedChunks | 0;
+    this._maxFragments = options.maxFragments | 0;
     this._maxPayload = options.maxPayload | 0;
     this._skipUTF8Validation = !!options.skipUTF8Validation;
     this[kWebSocket] = undefined;
@@ -89,6 +95,22 @@ class Receiver extends Writable {
   _write(chunk, encoding, cb) {
     if (this._opcode === 0x08 && this._state == GET_INFO) return cb();
 
+    if (
+      this._maxBufferedChunks > 0 &&
+      this._buffers.length >= this._maxBufferedChunks
+    ) {
+      cb(
+        this.createError(
+          RangeError,
+          'Too many buffered chunks',
+          false,
+          1008,
+          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+        )
+      );
+      return;
+    }
+
     this._bufferedBytes += chunk.length;
     this._buffers.push(chunk);
     this.startLoop(cb);
@@ -485,6 +507,22 @@ class Receiver extends Writable {
     }
 
     if (data.length) {
+      if (
+        this._maxFragments > 0 &&
+        this._fragments.length >= this._maxFragments
+      ) {
+        const error = this.createError(
+          RangeError,
+          'Too many message fragments',
+          false,
+          1008,
+          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+        );
+
+        cb(error);
+        return;
+      }
+
       //
       // This message is not compressed so its length is the sum of the payload
       // length of all fragments.
@@ -524,6 +562,22 @@ class Receiver extends Writable {
           return;
         }
 
+        if (
+          this._maxFragments > 0 &&
+          this._fragments.length >= this._maxFragments
+        ) {
+          const error = this.createError(
+            RangeError,
+            'Too many message fragments',
+            false,
+            1008,
+            'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+          );
+
+          cb(error);
+          return;
+        }
+
         this._fragments.push(buf);
       }
 

package/node_modules/ws/lib/websocket-server.js

@@ -43,6 +43,10 @@ class WebSocketServer extends EventEmitter {
    *     called
    * @param {Function} [options.handleProtocols] A hook to handle protocols
    * @param {String} [options.host] The hostname where to bind the server
+   * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+   *     buffered data chunks
+   * @param {Number} [options.maxFragments=131072] The maximum number of message
+   *     fragments
    * @param {Number} [options.maxPayload=104857600] The maximum allowed message
    *     size
    * @param {Boolean} [options.noServer=false] Enable no server mode
@@ -65,6 +69,8 @@ class WebSocketServer extends EventEmitter {
     options = {
       allowSynchronousEvents: true,
       autoPong: true,
+      maxBufferedChunks: 1024 * 1024,
+      maxFragments: 128 * 1024,
       maxPayload: 100 * 1024 * 1024,
       skipUTF8Validation: false,
       perMessageDeflate: false,
@@ -424,6 +430,8 @@ class WebSocketServer extends EventEmitter {
 
     ws.setSocket(socket, head, {
       allowSynchronousEvents: this.options.allowSynchronousEvents,
+      maxBufferedChunks: this.options.maxBufferedChunks,
+      maxFragments: this.options.maxFragments,
       maxPayload: this.options.maxPayload,
       skipUTF8Validation: this.options.skipUTF8Validation
     });

package/node_modules/ws/lib/websocket.js

@@ -201,6 +201,10 @@ class WebSocket extends EventEmitter {
    *     multiple times in the same tick
    * @param {Function} [options.generateMask] The function used to generate the
    *     masking key
+   * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+   *     buffered data chunks
+   * @param {Number} [options.maxFragments=0] The maximum number of message
+   *     fragments
    * @param {Number} [options.maxPayload=0] The maximum allowed message size
    * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
    *     not to skip UTF-8 validation for text and close messages
@@ -212,6 +216,8 @@ class WebSocket extends EventEmitter {
       binaryType: this.binaryType,
       extensions: this._extensions,
       isServer: this._isServer,
+      maxBufferedChunks: options.maxBufferedChunks,
+      maxFragments: options.maxFragments,
       maxPayload: options.maxPayload,
       skipUTF8Validation: options.skipUTF8Validation
     });
@@ -640,6 +646,10 @@ module.exports = WebSocket;
  *     masking key
  * @param {Number} [options.handshakeTimeout] Timeout in milliseconds for the
  *     handshake request
+ * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+ *     buffered data chunks
+ * @param {Number} [options.maxFragments=131072] The maximum number of message
+ *     fragments
  * @param {Number} [options.maxPayload=104857600] The maximum allowed message
  *     size
  * @param {Number} [options.maxRedirects=10] The maximum number of redirects
@@ -660,6 +670,8 @@ function initAsClient(websocket, address, protocols, options) {
     autoPong: true,
     closeTimeout: CLOSE_TIMEOUT,
     protocolVersion: protocolVersions[1],
+    maxBufferedChunks: 1024 * 1024,
+    maxFragments: 128 * 1024,
     maxPayload: 100 * 1024 * 1024,
     skipUTF8Validation: false,
     perMessageDeflate: true,
@@ -1017,6 +1029,8 @@ function initAsClient(websocket, address, protocols, options) {
     websocket.setSocket(socket, head, {
       allowSynchronousEvents: opts.allowSynchronousEvents,
       generateMask: opts.generateMask,
+      maxBufferedChunks: opts.maxBufferedChunks,
+      maxFragments: opts.maxFragments,
       maxPayload: opts.maxPayload,
       skipUTF8Validation: opts.skipUTF8Validation
     });

package/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.20.1",
+  "version": "8.21.0",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",

package/npm-shrinkwrap.json

@@ -1,19 +1,19 @@
 {
   "name": "@openclaw/zalouser",
-  "version": "2026.5.24-beta.2",
+  "version": "2026.5.25-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/zalouser",
-      "version": "2026.5.24-beta.2",
+      "version": "2026.5.25-beta.1",
       "dependencies": {
         "typebox": "1.1.38",
         "zca-js": "2.1.2",
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.5.24-beta.2"
+        "openclaw": ">=2026.5.25-beta.1"
       },
       "peerDependenciesMeta": {
         "openclaw": {
@@ -414,9 +414,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/zalouser",
-  "version": "2026.5.24-beta.2",
+  "version": "2026.5.25-beta.1",
   "description": "OpenClaw Zalo Personal Account plugin via native zca-js integration",
   "repository": {
     "type": "git",
@@ -13,7 +13,7 @@
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.24-beta.2"
+    "openclaw": ">=2026.5.25-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -50,10 +50,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.24-beta.2"
+      "pluginApi": ">=2026.5.25-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.24-beta.2"
+      "openclawVersion": "2026.5.25-beta.1"
     },
     "release": {
       "publishToClawHub": true,