@openclaw/zalouser 2026.5.27 → 2026.5.28-beta.1

package/dist/{accounts.runtime-B8IJHMI7.js → accounts.runtime-BtI8gfc2.js}

@@ -1,2 +1,2 @@
-import { n as getZaloUserInfo, t as checkZaloAuthenticated } from "./zalo-js-C3Wijq_z.js";
+import { n as getZaloUserInfo, t as checkZaloAuthenticated } from "./zalo-js-CoAYxl2h.js";
 export { checkZaloAuthenticated, getZaloUserInfo };

package/dist/{api-CC2is5Vz.js → api-BBqnUi9A.js}

@@ -1,11 +1,10 @@
-import "./setup-surface-CjXKvjhE.js";
-import "./shared-BcyjjZep.js";
-import "./channel-BICvWuAo.js";
-import { r as parseZalouserOutboundTarget } from "./session-route-Bp8b300d.js";
+import "./setup-surface-DQBRWLnI.js";
+import "./shared-BweDHhLM.js";
+import { n as parseZalouserOutboundTarget } from "./channel-DlMjHD00.js";
 import "./security-audit-DhK2UscX.js";
-import { i as listZaloFriendsMatching, n as getZaloUserInfo, s as listZaloGroupsMatching, t as checkZaloAuthenticated } from "./zalo-js-C3Wijq_z.js";
-import "./channel.setup-Db981qWE.js";
-import { i as sendMessageZalouser, n as sendImageZalouser, r as sendLinkZalouser } from "./send-CbTBtzZQ.js";
+import { i as listZaloFriendsMatching, n as getZaloUserInfo, s as listZaloGroupsMatching, t as checkZaloAuthenticated } from "./zalo-js-CoAYxl2h.js";
+import "./channel.setup-CdA5CvO0.js";
+import { i as sendMessageZalouser, n as sendImageZalouser, r as sendLinkZalouser } from "./send-C65xy6Wd.js";
 import { stringEnum } from "openclaw/plugin-sdk/channel-actions";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { Type } from "typebox";

package/dist/api.js

@@ -1,7 +1,7 @@
-import { n as zalouserSetupWizard } from "./setup-surface-CjXKvjhE.js";
-import { n as createZalouserSetupWizardProxy, r as zalouserSetupAdapter } from "./shared-BcyjjZep.js";
-import { t as zalouserPlugin } from "./channel-BICvWuAo.js";
+import { n as zalouserSetupWizard } from "./setup-surface-DQBRWLnI.js";
+import { n as createZalouserSetupWizardProxy, r as zalouserSetupAdapter } from "./shared-BweDHhLM.js";
+import { t as zalouserPlugin } from "./channel-DlMjHD00.js";
 import { n as isZalouserMutableGroupEntry, t as collectZalouserSecurityAuditFindings } from "./security-audit-DhK2UscX.js";
-import { t as zalouserSetupPlugin } from "./channel.setup-Db981qWE.js";
-import { t as createZalouserTool } from "./api-CC2is5Vz.js";
+import { t as zalouserSetupPlugin } from "./channel.setup-CdA5CvO0.js";
+import { t as createZalouserTool } from "./api-BBqnUi9A.js";
 export { collectZalouserSecurityAuditFindings, createZalouserSetupWizardProxy, createZalouserTool, isZalouserMutableGroupEntry, zalouserPlugin, zalouserSetupAdapter, zalouserSetupPlugin, zalouserSetupWizard };

package/dist/{channel-BICvWuAo.js → channel-DlMjHD00.js}

@@ -1,12 +1,11 @@
-import { a as resolveZalouserAccountSync, i as resolveDefaultZalouserAccountId, r as listZalouserAccountIds, t as checkZcaAuthenticated } from "./accounts-C1OmvrPK.js";
-import { a as DEFAULT_ACCOUNT_ID, c as isNumericTargetId, i as writeQrDataUrlToTempFile, l as normalizeAccountId, n as createZalouserSetupWizardProxy, o as chunkTextForOutbound, r as zalouserSetupAdapter, s as isDangerousNameMatchingEnabled, t as createZalouserPluginBase, u as sendPayloadWithChunkedTextAndMedia } from "./shared-BcyjjZep.js";
-import { i as resolveZalouserOutboundSessionRoute, n as parseZalouserDirectoryGroupId, r as parseZalouserOutboundTarget, t as normalizeZalouserTarget } from "./session-route-Bp8b300d.js";
+import { a as DEFAULT_ACCOUNT_ID, c as isNumericTargetId, d as checkZcaAuthenticated, f as listZalouserAccountIds, i as writeQrDataUrlToTempFile, l as normalizeAccountId, m as resolveZalouserAccountSync, n as createZalouserSetupWizardProxy, o as chunkTextForOutbound, p as resolveDefaultZalouserAccountId, r as zalouserSetupAdapter, s as isDangerousNameMatchingEnabled, t as createZalouserPluginBase, u as sendPayloadWithChunkedTextAndMedia } from "./shared-BweDHhLM.js";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createAccountStatusSink, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
 import { buildPassiveProbedChannelStatusSummary, coerceStatusIssueAccountId, readStatusIssueFields } from "openclaw/plugin-sdk/extension-shared";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { createAsyncComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { buildChannelOutboundSessionRoute } from "openclaw/plugin-sdk/core";
 import { createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
 import { createEmptyChannelResult, createRawChannelSendResultAdapter } from "openclaw/plugin-sdk/channel-send-result";
@@ -115,8 +114,97 @@ const { setRuntime: setZalouserRuntime, getRuntime: getZalouserRuntime } = creat
 	errorMessage: "Zalouser runtime not initialized"
 });
 //#endregion
+//#region extensions/zalouser/src/session-route.ts
+function stripZalouserTargetPrefix(raw) {
+	return raw.trim().replace(/^(zalouser|zlu):/i, "").trim();
+}
+function normalizeZalouserTarget(raw) {
+	const trimmed = stripZalouserTargetPrefix(raw);
+	if (!trimmed) return;
+	const lower = normalizeLowercaseStringOrEmpty(trimmed);
+	if (lower.startsWith("group:")) {
+		const id = trimmed.slice(6).trim();
+		return id ? `group:${id}` : void 0;
+	}
+	if (lower.startsWith("g:")) {
+		const id = trimmed.slice(2).trim();
+		return id ? `group:${id}` : void 0;
+	}
+	if (lower.startsWith("user:")) {
+		const id = trimmed.slice(5).trim();
+		return id ? `user:${id}` : void 0;
+	}
+	if (lower.startsWith("dm:")) {
+		const id = trimmed.slice(3).trim();
+		return id ? `user:${id}` : void 0;
+	}
+	if (lower.startsWith("u:")) {
+		const id = trimmed.slice(2).trim();
+		return id ? `user:${id}` : void 0;
+	}
+	if (/^g-\S+$/i.test(trimmed)) return `group:${trimmed}`;
+	if (/^u-\S+$/i.test(trimmed)) return `user:${trimmed}`;
+	return trimmed;
+}
+function parseZalouserOutboundTarget(raw) {
+	const normalized = normalizeZalouserTarget(raw);
+	if (!normalized) throw new Error("Zalouser target is required");
+	const lowered = normalizeLowercaseStringOrEmpty(normalized);
+	if (lowered.startsWith("group:")) {
+		const threadId = normalized.slice(6).trim();
+		if (!threadId) throw new Error("Zalouser group target is missing group id");
+		return {
+			threadId,
+			isGroup: true
+		};
+	}
+	if (lowered.startsWith("user:")) {
+		const threadId = normalized.slice(5).trim();
+		if (!threadId) throw new Error("Zalouser user target is missing user id");
+		return {
+			threadId,
+			isGroup: false
+		};
+	}
+	return {
+		threadId: normalized,
+		isGroup: false
+	};
+}
+function parseZalouserDirectoryGroupId(raw) {
+	const normalized = normalizeZalouserTarget(raw);
+	if (!normalized) throw new Error("Zalouser group target is required");
+	const lowered = normalizeLowercaseStringOrEmpty(normalized);
+	if (lowered.startsWith("group:")) {
+		const groupId = normalized.slice(6).trim();
+		if (!groupId) throw new Error("Zalouser group target is missing group id");
+		return groupId;
+	}
+	if (lowered.startsWith("user:")) throw new Error("Zalouser group members lookup requires a group target (group:<id>)");
+	return normalized;
+}
+function resolveZalouserOutboundSessionRoute(params) {
+	const normalized = normalizeZalouserTarget(params.target);
+	if (!normalized) return null;
+	const isGroup = (normalizeOptionalLowercaseString(normalized) ?? "").startsWith("group:");
+	const peerId = normalized.replace(/^(group|user):/i, "").trim();
+	return buildChannelOutboundSessionRoute({
+		cfg: params.cfg,
+		agentId: params.agentId,
+		channel: "zalouser",
+		accountId: params.accountId,
+		peer: {
+			kind: isGroup ? "group" : "direct",
+			id: peerId
+		},
+		chatType: isGroup ? "group" : "direct",
+		from: isGroup ? `zalouser:group:${peerId}` : `zalouser:${peerId}`,
+		to: `zalouser:${peerId}`
+	});
+}
+//#endregion
 //#region extensions/zalouser/src/channel.adapters.ts
-const loadZalouserChannelRuntime$1 = createLazyRuntimeModule(() => import("./channel.runtime-1aZZUPQ2.js"));
+const loadZalouserChannelRuntime$1 = createLazyRuntimeModule(() => import("./channel.runtime-C6g86q6_.js"));
 const ZALOUSER_TEXT_CHUNK_LIMIT = 2e3;
 function resolveZalouserQrProfile(accountId) {
 	const normalized = normalizeAccountId(accountId);
@@ -447,8 +535,8 @@ function collectZalouserStatusIssues(accounts) {
 }
 //#endregion
 //#region extensions/zalouser/src/channel.ts
-const loadZalouserChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-1aZZUPQ2.js"));
-const zalouserSetupWizardProxy = createZalouserSetupWizardProxy(async () => (await import("./setup-surface-CjXKvjhE.js").then((n) => n.t)).zalouserSetupWizard);
+const loadZalouserChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-C6g86q6_.js"));
+const zalouserSetupWizardProxy = createZalouserSetupWizardProxy(async () => (await import("./setup-surface-DQBRWLnI.js").then((n) => n.t)).zalouserSetupWizard);
 function mapUser(params) {
 	return {
 		kind: "user",
@@ -565,7 +653,7 @@ const zalouserPlugin = createChatChannelPlugin({
 					setStatus: ctx.setStatus
 				});
 				ctx.log?.info(`[${account.accountId}] starting zalouser provider${userLabel}`);
-				const { monitorZalouserProvider } = await import("./monitor-HUsRtlNS.js");
+				const { monitorZalouserProvider } = await import("./monitor-fmAC676K.js");
 				return monitorZalouserProvider({
 					account,
 					config: ctx.cfg,
@@ -598,4 +686,4 @@ const zalouserPlugin = createChatChannelPlugin({
 	outbound: zalouserOutboundAdapter
 });
 //#endregion
-export { resolveZalouserMessageSid as a, isZalouserGroupEntryAllowed as c, formatZalouserMessageSidFull as i, getZalouserRuntime as n, buildZalouserGroupCandidates as o, setZalouserRuntime as r, findZalouserGroupEntry as s, zalouserPlugin as t };
+export { formatZalouserMessageSidFull as a, findZalouserGroupEntry as c, setZalouserRuntime as i, isZalouserGroupEntryAllowed as l, parseZalouserOutboundTarget as n, resolveZalouserMessageSid as o, getZalouserRuntime as r, buildZalouserGroupCandidates as s, zalouserPlugin as t };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zalouserPlugin } from "./channel-BICvWuAo.js";
+import { t as zalouserPlugin } from "./channel-DlMjHD00.js";
 export { zalouserPlugin };

package/dist/{channel.runtime-1aZZUPQ2.js → channel.runtime-C6g86q6_.js}

@@ -1,6 +1,6 @@
 import { t as collectZalouserSecurityAuditFindings } from "./security-audit-DhK2UscX.js";
-import { a as listZaloGroupMembers, b as waitForZaloQrLogin, c as logoutZaloProfile, i as listZaloFriendsMatching, n as getZaloUserInfo, s as listZaloGroupsMatching, y as startZaloQrLogin } from "./zalo-js-C3Wijq_z.js";
-import { a as sendReactionZalouser, i as sendMessageZalouser } from "./send-CbTBtzZQ.js";
+import { a as listZaloGroupMembers, b as waitForZaloQrLogin, c as logoutZaloProfile, i as listZaloFriendsMatching, n as getZaloUserInfo, s as listZaloGroupsMatching, y as startZaloQrLogin } from "./zalo-js-CoAYxl2h.js";
+import { a as sendReactionZalouser, i as sendMessageZalouser } from "./send-C65xy6Wd.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/zalouser/src/probe.ts
 async function probeZalouser(profile, timeoutMs) {

package/dist/{channel.setup-Db981qWE.js → channel.setup-CdA5CvO0.js}

@@ -1,5 +1,5 @@
-import { n as zalouserSetupWizard } from "./setup-surface-CjXKvjhE.js";
-import { r as zalouserSetupAdapter, t as createZalouserPluginBase } from "./shared-BcyjjZep.js";
+import { n as zalouserSetupWizard } from "./setup-surface-DQBRWLnI.js";
+import { r as zalouserSetupAdapter, t as createZalouserPluginBase } from "./shared-BweDHhLM.js";
 //#region extensions/zalouser/src/channel.setup.ts
 const zalouserSetupPlugin = { ...createZalouserPluginBase({
 	setupWizard: zalouserSetupWizard,

package/dist/{monitor-HUsRtlNS.js → monitor-fmAC676K.js}

@@ -1,6 +1,6 @@
-import { a as resolveZalouserMessageSid, c as isZalouserGroupEntryAllowed, i as formatZalouserMessageSidFull, n as getZalouserRuntime, o as buildZalouserGroupCandidates, s as findZalouserGroupEntry } from "./channel-BICvWuAo.js";
-import { o as listZaloGroups, r as listZaloFriends, u as resolveZaloGroupContext, v as startZaloListener } from "./zalo-js-C3Wijq_z.js";
-import { i as sendMessageZalouser, o as sendSeenZalouser, s as sendTypingZalouser, t as sendDeliveredZalouser } from "./send-CbTBtzZQ.js";
+import { a as formatZalouserMessageSidFull, c as findZalouserGroupEntry, l as isZalouserGroupEntryAllowed, o as resolveZalouserMessageSid, r as getZalouserRuntime, s as buildZalouserGroupCandidates } from "./channel-DlMjHD00.js";
+import { o as listZaloGroups, r as listZaloFriends, u as resolveZaloGroupContext, v as startZaloListener } from "./zalo-js-CoAYxl2h.js";
+import { i as sendMessageZalouser, o as sendSeenZalouser, s as sendTypingZalouser, t as sendDeliveredZalouser } from "./send-C65xy6Wd.js";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { mergeAllowlist, summarizeMapping } from "openclaw/plugin-sdk/allow-from";

package/dist/runtime-api.js

@@ -1,9 +1,9 @@
-import { n as zalouserSetupWizard } from "./setup-surface-CjXKvjhE.js";
-import { n as createZalouserSetupWizardProxy, r as zalouserSetupAdapter } from "./shared-BcyjjZep.js";
-import { r as setZalouserRuntime, t as zalouserPlugin } from "./channel-BICvWuAo.js";
+import { n as zalouserSetupWizard } from "./setup-surface-DQBRWLnI.js";
+import { n as createZalouserSetupWizardProxy, r as zalouserSetupAdapter } from "./shared-BweDHhLM.js";
+import { i as setZalouserRuntime, t as zalouserPlugin } from "./channel-DlMjHD00.js";
 import { n as isZalouserMutableGroupEntry, t as collectZalouserSecurityAuditFindings } from "./security-audit-DhK2UscX.js";
-import { t as zalouserSetupPlugin } from "./channel.setup-Db981qWE.js";
-import { t as createZalouserTool } from "./api-CC2is5Vz.js";
+import { t as zalouserSetupPlugin } from "./channel.setup-CdA5CvO0.js";
+import { t as createZalouserTool } from "./api-BBqnUi9A.js";
 import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-outbound";
 import { buildBaseAccountStatusSnapshot } from "openclaw/plugin-sdk/status-helpers";
 import { formatAllowFromLowercase, mergeAllowlist, summarizeMapping } from "openclaw/plugin-sdk/allow-from";

package/dist/{send-CbTBtzZQ.js → send-C65xy6Wd.js}

@@ -1,4 +1,4 @@
-import { S as TextStyle, _ as sendZaloTypingEvent, f as sendZaloDeliveredEvent, g as sendZaloTextMessage, h as sendZaloSeenEvent, m as sendZaloReaction, p as sendZaloLink, x as createZalouserSendReceipt } from "./zalo-js-C3Wijq_z.js";
+import { S as TextStyle, _ as sendZaloTypingEvent, f as sendZaloDeliveredEvent, g as sendZaloTextMessage, h as sendZaloSeenEvent, m as sendZaloReaction, p as sendZaloLink, x as createZalouserSendReceipt } from "./zalo-js-CoAYxl2h.js";
 //#region extensions/zalouser/src/text-styles.ts
 const ESCAPE_SENTINEL_START = "
";
 const ESCAPE_SENTINEL_END = "";

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as zalouserSetupPlugin } from "./channel.setup-Db981qWE.js";
+import { t as zalouserSetupPlugin } from "./channel.setup-CdA5CvO0.js";
 export { zalouserSetupPlugin };

package/dist/{setup-surface-CjXKvjhE.js → setup-surface-DQBRWLnI.js}

@@ -1,6 +1,5 @@
-import { a as resolveZalouserAccountSync, i as resolveDefaultZalouserAccountId, r as listZalouserAccountIds, t as checkZcaAuthenticated } from "./accounts-C1OmvrPK.js";
-import { i as writeQrDataUrlToTempFile } from "./shared-BcyjjZep.js";
-import { b as waitForZaloQrLogin, c as logoutZaloProfile, d as resolveZaloGroupsByEntries, l as resolveZaloAllowFromEntries, y as startZaloQrLogin } from "./zalo-js-C3Wijq_z.js";
+import { d as checkZcaAuthenticated, f as listZalouserAccountIds, i as writeQrDataUrlToTempFile, m as resolveZalouserAccountSync, p as resolveDefaultZalouserAccountId } from "./shared-BweDHhLM.js";
+import { b as waitForZaloQrLogin, c as logoutZaloProfile, d as resolveZaloGroupsByEntries, l as resolveZaloAllowFromEntries, y as startZaloQrLogin } from "./zalo-js-CoAYxl2h.js";
 import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, addWildcardAllowFrom, createSetupTranslator, formatCliCommand, formatDocsLink, formatResolvedUnresolvedNote, mergeAllowFromEntries, normalizeAccountId, patchScopedAccountConfig } from "openclaw/plugin-sdk/setup";
 //#region \0rolldown/runtime.js

package/dist/{shared-BcyjjZep.js → shared-BweDHhLM.js}

@@ -1,9 +1,10 @@
-import { a as resolveZalouserAccountSync, i as resolveDefaultZalouserAccountId, r as listZalouserAccountIds, t as checkZcaAuthenticated } from "./accounts-C1OmvrPK.js";
 import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-mDJdHVKH.js";
 import { n as isZalouserMutableGroupEntry } from "./security-audit-DhK2UscX.js";
+import { DEFAULT_ACCOUNT_ID, createAccountListHelpers, normalizeAccountId, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { AllowFromListSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ToolPolicySchema, buildCatchallMultiAccountChannelSchema, buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
-import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/core";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/core";
 import { isDangerousNameMatchingEnabled as isDangerousNameMatchingEnabled$1 } from "openclaw/plugin-sdk/dangerous-name-runtime";
 import { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
 import { isNumericTargetId, sendPayloadWithChunkedTextAndMedia } from "openclaw/plugin-sdk/reply-payload";
@@ -15,6 +16,61 @@ import { createDelegatedSetupWizardProxy, createPatchedAccountSetupAdapter, crea
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { z } from "zod";
 import { createDangerousNameMatchingMutableAllowlistWarningCollector } from "openclaw/plugin-sdk/channel-policy";
+//#region extensions/zalouser/src/accounts.ts
+let zalouserAccountsRuntimePromise;
+async function loadZalouserAccountsRuntime() {
+	zalouserAccountsRuntimePromise ??= import("./accounts.runtime-BtI8gfc2.js");
+	return await zalouserAccountsRuntimePromise;
+}
+const { listAccountIds: listZalouserAccountIds, resolveDefaultAccountId: resolveDefaultZalouserAccountId } = createAccountListHelpers("zalouser", { implicitDefaultAccount: {
+	channelKeys: ["profile"],
+	envVars: ["ZALOUSER_PROFILE", "ZCA_PROFILE"]
+} });
+function mergeZalouserAccountConfig(cfg, accountId) {
+	const merged = resolveMergedAccountConfig({
+		channelConfig: cfg.channels?.zalouser,
+		accounts: (cfg.channels?.zalouser)?.accounts,
+		accountId,
+		omitKeys: ["defaultAccount"]
+	});
+	return {
+		...merged,
+		groupPolicy: merged.groupPolicy ?? "allowlist"
+	};
+}
+function resolveProfile(config, accountId) {
+	if (config.profile?.trim()) return config.profile.trim();
+	if (process.env.ZALOUSER_PROFILE?.trim()) return process.env.ZALOUSER_PROFILE.trim();
+	if (process.env.ZCA_PROFILE?.trim()) return process.env.ZCA_PROFILE.trim();
+	if (accountId !== DEFAULT_ACCOUNT_ID) return accountId;
+	return "default";
+}
+function resolveZalouserAccountBase(params) {
+	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultZalouserAccountId(params.cfg));
+	const baseEnabled = (params.cfg.channels?.zalouser)?.enabled !== false;
+	const merged = mergeZalouserAccountConfig(params.cfg, accountId);
+	return {
+		accountId,
+		enabled: baseEnabled && merged.enabled !== false,
+		merged,
+		profile: resolveProfile(merged, accountId)
+	};
+}
+function resolveZalouserAccountSync(params) {
+	const { accountId, enabled, merged, profile } = resolveZalouserAccountBase(params);
+	return {
+		accountId,
+		name: normalizeOptionalString(merged.name),
+		enabled,
+		profile,
+		authenticated: false,
+		config: merged
+	};
+}
+async function checkZcaAuthenticated(profile) {
+	return await (await loadZalouserAccountsRuntime()).checkZaloAuthenticated(profile);
+}
+//#endregion
 //#region extensions/zalouser/src/qr-temp-file.ts
 async function writeQrDataUrlToTempFile(qrDataUrl, profile) {
 	const base64 = (qrDataUrl.trim().match(/^data:image\/png;base64,(.+)$/i)?.[1] ?? "").trim();
@@ -157,4 +213,4 @@ function createZalouserPluginBase(params) {
 	};
 }
 //#endregion
-export { DEFAULT_ACCOUNT_ID as a, isNumericTargetId as c, writeQrDataUrlToTempFile as i, normalizeAccountId as l, createZalouserSetupWizardProxy as n, chunkTextForOutbound as o, zalouserSetupAdapter as r, isDangerousNameMatchingEnabled$1 as s, createZalouserPluginBase as t, sendPayloadWithChunkedTextAndMedia as u };
+export { DEFAULT_ACCOUNT_ID$1 as a, isNumericTargetId as c, checkZcaAuthenticated as d, listZalouserAccountIds as f, writeQrDataUrlToTempFile as i, normalizeAccountId$1 as l, resolveZalouserAccountSync as m, createZalouserSetupWizardProxy as n, chunkTextForOutbound as o, resolveDefaultZalouserAccountId as p, zalouserSetupAdapter as r, isDangerousNameMatchingEnabled$1 as s, createZalouserPluginBase as t, sendPayloadWithChunkedTextAndMedia as u };

package/dist/{zalo-js-C3Wijq_z.js → zalo-js-CoAYxl2h.js}

@@ -5,6 +5,7 @@ import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import { extensionForMime } from "openclaw/plugin-sdk/media-mime";
+import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
 import { privateFileStoreSync, readRegularFileSync, statRegularFileSync, withTimeout } from "openclaw/plugin-sdk/security-runtime";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
@@ -238,8 +239,8 @@ function toNonNegativeInteger(value) {
 		return normalized >= 0 ? normalized : null;
 	}
 	if (typeof value === "string" && value.trim().length > 0) {
-		const parsed = Number.parseInt(value.trim(), 10);
-		if (Number.isFinite(parsed)) return parsed >= 0 ? parsed : null;
+		const parsed = parseStrictNonNegativeInteger(value);
+		if (parsed !== void 0) return parsed >= 0 ? parsed : null;
 	}
 	return null;
 }

package/node_modules/semver/classes/range.js

@@ -98,6 +98,9 @@ class Range {
   }
 
   parseRange (range) {
+    // strip build metadata so it can't bleed into the version
+    range = range.replace(BUILDSTRIPRE, '')
+
     // memoize range parsing for performance.
     // this is a very hot path, and fully deterministic.
     const memoOpts =
@@ -223,6 +226,7 @@ const debug = require('../internal/debug')
 const SemVer = require('./semver')
 const {
   safeRe: re,
+  src,
   t,
   comparatorTrimReplace,
   tildeTrimReplace,
@@ -230,6 +234,9 @@ const {
 } = require('../internal/re')
 const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require('../internal/constants')
 
+// unbounded global build-metadata stripper used by parseRange
+const BUILDSTRIPRE = new RegExp(src[t.BUILD], 'g')
+
 const isNullSet = c => c.value === '<0.0.0-0'
 const isAny = c => c.value === ''
 

package/node_modules/semver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.8.0",
+  "version": "7.8.1",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {

package/node_modules/semver/ranges/subset.js

@@ -174,7 +174,7 @@ const simpleSubset = (sub, dom, options) => {
         if (higher === c && higher !== gt) {
           return false
         }
-      } else if (gt.operator === '>=' && !satisfies(gt.semver, String(c), options)) {
+      } else if (gt.operator === '>=' && !c.test(gt.semver)) {
         return false
       }
     }
@@ -192,7 +192,7 @@ const simpleSubset = (sub, dom, options) => {
         if (lower === c && lower !== lt) {
           return false
         }
-      } else if (lt.operator === '<=' && !satisfies(lt.semver, String(c), options)) {
+      } else if (lt.operator === '<=' && !c.test(lt.semver)) {
         return false
       }
     }

package/npm-shrinkwrap.json

@@ -1,19 +1,19 @@
 {
   "name": "@openclaw/zalouser",
-  "version": "2026.5.27",
+  "version": "2026.5.28-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/zalouser",
-      "version": "2026.5.27",
+      "version": "2026.5.28-beta.1",
       "dependencies": {
         "typebox": "1.1.38",
         "zca-js": "2.1.2",
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.5.27"
+        "openclaw": ">=2026.5.28-beta.1"
       },
       "peerDependenciesMeta": {
         "openclaw": {
@@ -356,9 +356,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz",
+      "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/zalouser",
-  "version": "2026.5.27",
+  "version": "2026.5.28-beta.1",
   "description": "OpenClaw Zalo Personal Account plugin via native zca-js integration.",
   "repository": {
     "type": "git",
@@ -13,7 +13,7 @@
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.27"
+    "openclaw": ">=2026.5.28-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -50,10 +50,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.27"
+      "pluginApi": ">=2026.5.28-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.27"
+      "openclawVersion": "2026.5.28-beta.1"
     },
     "release": {
       "publishToClawHub": true,

package/dist/accounts-C1OmvrPK.js

@@ -1,66 +0,0 @@
-import { DEFAULT_ACCOUNT_ID, createAccountListHelpers, normalizeAccountId, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
-import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-//#region extensions/zalouser/src/accounts.ts
-let zalouserAccountsRuntimePromise;
-async function loadZalouserAccountsRuntime() {
-	zalouserAccountsRuntimePromise ??= import("./accounts.runtime-B8IJHMI7.js");
-	return await zalouserAccountsRuntimePromise;
-}
-const { listAccountIds: listZalouserAccountIds, resolveDefaultAccountId: resolveDefaultZalouserAccountId } = createAccountListHelpers("zalouser", { implicitDefaultAccount: {
-	channelKeys: ["profile"],
-	envVars: ["ZALOUSER_PROFILE", "ZCA_PROFILE"]
-} });
-function mergeZalouserAccountConfig(cfg, accountId) {
-	const merged = resolveMergedAccountConfig({
-		channelConfig: cfg.channels?.zalouser,
-		accounts: (cfg.channels?.zalouser)?.accounts,
-		accountId,
-		omitKeys: ["defaultAccount"]
-	});
-	return {
-		...merged,
-		groupPolicy: merged.groupPolicy ?? "allowlist"
-	};
-}
-function resolveProfile(config, accountId) {
-	if (config.profile?.trim()) return config.profile.trim();
-	if (process.env.ZALOUSER_PROFILE?.trim()) return process.env.ZALOUSER_PROFILE.trim();
-	if (process.env.ZCA_PROFILE?.trim()) return process.env.ZCA_PROFILE.trim();
-	if (accountId !== DEFAULT_ACCOUNT_ID) return accountId;
-	return "default";
-}
-function resolveZalouserAccountBase(params) {
-	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultZalouserAccountId(params.cfg));
-	const baseEnabled = (params.cfg.channels?.zalouser)?.enabled !== false;
-	const merged = mergeZalouserAccountConfig(params.cfg, accountId);
-	return {
-		accountId,
-		enabled: baseEnabled && merged.enabled !== false,
-		merged,
-		profile: resolveProfile(merged, accountId)
-	};
-}
-function resolveZalouserAccountSync(params) {
-	const { accountId, enabled, merged, profile } = resolveZalouserAccountBase(params);
-	return {
-		accountId,
-		name: normalizeOptionalString(merged.name),
-		enabled,
-		profile,
-		authenticated: false,
-		config: merged
-	};
-}
-async function getZcaUserInfo(profile) {
-	const info = await (await loadZalouserAccountsRuntime()).getZaloUserInfo(profile);
-	if (!info) return null;
-	return {
-		userId: info.userId,
-		displayName: info.displayName
-	};
-}
-async function checkZcaAuthenticated(profile) {
-	return await (await loadZalouserAccountsRuntime()).checkZaloAuthenticated(profile);
-}
-//#endregion
-export { resolveZalouserAccountSync as a, resolveDefaultZalouserAccountId as i, getZcaUserInfo as n, listZalouserAccountIds as r, checkZcaAuthenticated as t };

package/dist/session-route-Bp8b300d.js

@@ -1,92 +0,0 @@
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { buildChannelOutboundSessionRoute } from "openclaw/plugin-sdk/core";
-//#region extensions/zalouser/src/session-route.ts
-function stripZalouserTargetPrefix(raw) {
-	return raw.trim().replace(/^(zalouser|zlu):/i, "").trim();
-}
-function normalizeZalouserTarget(raw) {
-	const trimmed = stripZalouserTargetPrefix(raw);
-	if (!trimmed) return;
-	const lower = normalizeLowercaseStringOrEmpty(trimmed);
-	if (lower.startsWith("group:")) {
-		const id = trimmed.slice(6).trim();
-		return id ? `group:${id}` : void 0;
-	}
-	if (lower.startsWith("g:")) {
-		const id = trimmed.slice(2).trim();
-		return id ? `group:${id}` : void 0;
-	}
-	if (lower.startsWith("user:")) {
-		const id = trimmed.slice(5).trim();
-		return id ? `user:${id}` : void 0;
-	}
-	if (lower.startsWith("dm:")) {
-		const id = trimmed.slice(3).trim();
-		return id ? `user:${id}` : void 0;
-	}
-	if (lower.startsWith("u:")) {
-		const id = trimmed.slice(2).trim();
-		return id ? `user:${id}` : void 0;
-	}
-	if (/^g-\S+$/i.test(trimmed)) return `group:${trimmed}`;
-	if (/^u-\S+$/i.test(trimmed)) return `user:${trimmed}`;
-	return trimmed;
-}
-function parseZalouserOutboundTarget(raw) {
-	const normalized = normalizeZalouserTarget(raw);
-	if (!normalized) throw new Error("Zalouser target is required");
-	const lowered = normalizeLowercaseStringOrEmpty(normalized);
-	if (lowered.startsWith("group:")) {
-		const threadId = normalized.slice(6).trim();
-		if (!threadId) throw new Error("Zalouser group target is missing group id");
-		return {
-			threadId,
-			isGroup: true
-		};
-	}
-	if (lowered.startsWith("user:")) {
-		const threadId = normalized.slice(5).trim();
-		if (!threadId) throw new Error("Zalouser user target is missing user id");
-		return {
-			threadId,
-			isGroup: false
-		};
-	}
-	return {
-		threadId: normalized,
-		isGroup: false
-	};
-}
-function parseZalouserDirectoryGroupId(raw) {
-	const normalized = normalizeZalouserTarget(raw);
-	if (!normalized) throw new Error("Zalouser group target is required");
-	const lowered = normalizeLowercaseStringOrEmpty(normalized);
-	if (lowered.startsWith("group:")) {
-		const groupId = normalized.slice(6).trim();
-		if (!groupId) throw new Error("Zalouser group target is missing group id");
-		return groupId;
-	}
-	if (lowered.startsWith("user:")) throw new Error("Zalouser group members lookup requires a group target (group:<id>)");
-	return normalized;
-}
-function resolveZalouserOutboundSessionRoute(params) {
-	const normalized = normalizeZalouserTarget(params.target);
-	if (!normalized) return null;
-	const isGroup = (normalizeOptionalLowercaseString(normalized) ?? "").startsWith("group:");
-	const peerId = normalized.replace(/^(group|user):/i, "").trim();
-	return buildChannelOutboundSessionRoute({
-		cfg: params.cfg,
-		agentId: params.agentId,
-		channel: "zalouser",
-		accountId: params.accountId,
-		peer: {
-			kind: isGroup ? "group" : "direct",
-			id: peerId
-		},
-		chatType: isGroup ? "group" : "direct",
-		from: isGroup ? `zalouser:group:${peerId}` : `zalouser:${peerId}`,
-		to: `zalouser:${peerId}`
-	});
-}
-//#endregion
-export { resolveZalouserOutboundSessionRoute as i, parseZalouserDirectoryGroupId as n, parseZalouserOutboundTarget as r, normalizeZalouserTarget as t };

package/dist/test-api.js

@@ -1,5 +0,0 @@
-import { a as resolveZalouserAccountSync, i as resolveDefaultZalouserAccountId, n as getZcaUserInfo, r as listZalouserAccountIds, t as checkZcaAuthenticated } from "./accounts-C1OmvrPK.js";
-import { r as parseZalouserOutboundTarget } from "./session-route-Bp8b300d.js";
-import { a as listZaloGroupMembers, b as waitForZaloQrLogin, c as logoutZaloProfile, d as resolveZaloGroupsByEntries, i as listZaloFriendsMatching, l as resolveZaloAllowFromEntries, n as getZaloUserInfo, s as listZaloGroupsMatching, t as checkZaloAuthenticated, y as startZaloQrLogin } from "./zalo-js-C3Wijq_z.js";
-import { i as sendMessageZalouser } from "./send-CbTBtzZQ.js";
-export { checkZaloAuthenticated, checkZcaAuthenticated, getZaloUserInfo, getZcaUserInfo, listZaloFriendsMatching, listZaloGroupMembers, listZaloGroupsMatching, listZalouserAccountIds, logoutZaloProfile, parseZalouserOutboundTarget, resolveDefaultZalouserAccountId, resolveZaloAllowFromEntries, resolveZaloGroupsByEntries, resolveZalouserAccountSync, sendMessageZalouser, startZaloQrLogin, waitForZaloQrLogin };