@pixelzx/genesis 2026.5.3-5 → 2026.5.5

package/dist/setup-DZJZF2R6.js

@@ -0,0 +1,495 @@
+import { i as formatErrorMessage } from "./errors-Jbvi20TW.js";
+import { m as resolveUserPath } from "./utils-DaGfogP-.js";
+import { n as defaultRuntime } from "./runtime-CQ7eH0le.js";
+import { t as formatCliCommand } from "./command-format-DAeUlu7u.js";
+import { u as resolveGatewayPort } from "./paths-DmR9mjUX.js";
+import { u as normalizeSecretInputString } from "./types.secrets-ews2W8BF.js";
+import { u as readConfigFileSnapshot, y as writeConfigFile } from "./io-h8M_Z0Lj.js";
+import "./config-B3ZoZd5V.js";
+import { t as WizardCancelledError } from "./prompts-ZE6fbgyP.js";
+import { c as formatPluginCompatibilityNotice, n as buildPluginCompatibilityNotices } from "./status-DuZdkulz.js";
+import { t as resolveSetupSecretInputString } from "./setup.secret-input-BwQgiCU3.js";
+import chalk from "chalk";
+//#region src/wizard/setup.security-note.ts
+const SECURITY_NOTE_TITLE = "Security disclaimer";
+const heading = (text) => chalk.bold(text);
+const SECURITY_NOTE_MESSAGE = [
+	"Genesis is a hobby project and still in beta. Expect sharp edges.",
+	"By default, Genesis is a personal agent: one trusted operator boundary.",
+	"This bot can read files and run actions if tools are enabled.",
+	"A bad prompt can trick it into doing unsafe things.",
+	"",
+	"Genesis is not a hostile multi-tenant boundary by default.",
+	"If multiple users can message one tool-enabled agent, they share that delegated tool authority.",
+	"",
+	"If you’re not comfortable with security hardening and access control, don’t run Genesis.",
+	"Ask someone experienced to help before enabling tools or exposing it to the internet.",
+	"",
+	heading("Recommended baseline"),
+	"- Pairing/allowlists + mention gating.",
+	"- Multi-user/shared inbox: split trust boundaries (separate gateway/credentials, ideally separate OS users/hosts).",
+	"- Sandbox + least-privilege tools.",
+	"- Shared inboxes: isolate DM sessions (session.dmScope: per-channel-peer) and keep tool access minimal.",
+	"- Keep secrets out of the agent’s reachable filesystem.",
+	"- Use the strongest available model for any bot with tools or untrusted inboxes.",
+	"",
+	heading("Run regularly"),
+	formatCliCommand("genesis security audit --deep"),
+	formatCliCommand("genesis security audit --fix"),
+	"",
+	heading("Learn more"),
+	"- https://docs.genesis.ai/gateway/security"
+].join("\n");
+//#endregion
+//#region src/wizard/setup.ts
+let authChoiceModulePromise;
+let configLoggingModulePromise;
+let modelPickerModulePromise;
+function loadAuthChoiceModule() {
+	authChoiceModulePromise ??= import("./auth-choice-DRyJ9rJB.js");
+	return authChoiceModulePromise;
+}
+function loadConfigLoggingModule() {
+	configLoggingModulePromise ??= import("./logging-bfkJL7yT.js");
+	return configLoggingModulePromise;
+}
+function loadModelPickerModule() {
+	modelPickerModulePromise ??= import("./model-picker-BldxY6Jo.js");
+	return modelPickerModulePromise;
+}
+async function resolveAuthChoiceModelSelectionPolicy(params) {
+	const preferredProvider = await params.resolvePreferredProviderForAuthChoice({
+		choice: params.authChoice,
+		config: params.config,
+		workspaceDir: params.workspaceDir,
+		env: params.env
+	});
+	const { resolvePluginProviders, resolveProviderPluginChoice } = await import("./provider-auth-choice.runtime-DBaJlbBQ.js");
+	const providers = resolvePluginProviders({
+		config: params.config,
+		workspaceDir: params.workspaceDir,
+		env: params.env,
+		mode: "setup"
+	});
+	const resolvedChoice = resolveProviderPluginChoice({
+		providers,
+		choice: params.authChoice
+	});
+	const matchedProvider = resolvedChoice?.provider ?? (() => {
+		const preferredId = preferredProvider?.trim();
+		if (!preferredId) return;
+		return providers.find((provider) => typeof provider.id === "string" && provider.id.trim() === preferredId);
+	})();
+	const setupPolicy = resolvedChoice?.wizard?.modelSelection ?? matchedProvider?.wizard?.setup?.modelSelection;
+	return {
+		preferredProvider,
+		promptWhenAuthChoiceProvided: setupPolicy?.promptWhenAuthChoiceProvided === true,
+		allowKeepCurrent: setupPolicy?.allowKeepCurrent ?? true
+	};
+}
+async function requireRiskAcknowledgement(params) {
+	if (params.opts.acceptRisk === true) return;
+	await params.prompter.note(SECURITY_NOTE_MESSAGE, SECURITY_NOTE_TITLE);
+	if (!await params.prompter.confirm({
+		message: "I understand this is personal-by-default and shared/multi-user use requires lock-down. Continue?",
+		initialValue: false
+	})) throw new WizardCancelledError("risk not accepted");
+}
+async function runSetupWizard(opts, runtime = defaultRuntime, prompter) {
+	const onboardHelpers = await import("./onboard-helpers-DWxdMyCs.js");
+	onboardHelpers.printWizardHeader(runtime);
+	await prompter.intro("Genesis setup");
+	await requireRiskAcknowledgement({
+		opts,
+		prompter
+	});
+	const snapshot = await readConfigFileSnapshot();
+	let baseConfig = snapshot.valid ? snapshot.exists ? snapshot.sourceConfig ?? snapshot.config : {} : {};
+	if (snapshot.exists && !snapshot.valid) {
+		await prompter.note(onboardHelpers.summarizeExistingConfig(baseConfig), "Invalid config");
+		if (snapshot.issues.length > 0) await prompter.note([
+			...snapshot.issues.map((iss) => `- ${iss.path}: ${iss.message}`),
+			"",
+			"Docs: https://docs.genesis.ai/gateway/configuration"
+		].join("\n"), "Config issues");
+		await prompter.outro(`Config invalid. Run \`${formatCliCommand("genesis doctor")}\` to repair it, then re-run setup.`);
+		runtime.exit(1);
+		return;
+	}
+	const compatibilityNotices = snapshot.valid ? buildPluginCompatibilityNotices({ config: baseConfig }) : [];
+	if (compatibilityNotices.length > 0) await prompter.note([
+		`Detected ${compatibilityNotices.length} plugin compatibility notice${compatibilityNotices.length === 1 ? "" : "s"} in the current config.`,
+		...compatibilityNotices.slice(0, 4).map((notice) => `- ${formatPluginCompatibilityNotice(notice)}`),
+		...compatibilityNotices.length > 4 ? [`- ... +${compatibilityNotices.length - 4} more`] : [],
+		"",
+		`Review: ${formatCliCommand("genesis doctor")}`,
+		`Inspect: ${formatCliCommand("genesis plugins inspect --all")}`
+	].join("\n"), "Plugin compatibility");
+	const quickstartHint = `Configure details later via ${formatCliCommand("genesis configure")}.`;
+	const manualHint = "Configure port, network, Tailscale, and auth options.";
+	const explicitFlowRaw = opts.flow?.trim();
+	const normalizedExplicitFlow = explicitFlowRaw === "manual" ? "advanced" : explicitFlowRaw;
+	if (normalizedExplicitFlow && normalizedExplicitFlow !== "quickstart" && normalizedExplicitFlow !== "advanced") {
+		runtime.error("Invalid --flow (use quickstart, manual, or advanced).");
+		runtime.exit(1);
+		return;
+	}
+	let flow = (normalizedExplicitFlow === "quickstart" || normalizedExplicitFlow === "advanced" ? normalizedExplicitFlow : void 0) ?? await prompter.select({
+		message: "Setup mode",
+		options: [{
+			value: "quickstart",
+			label: "QuickStart",
+			hint: quickstartHint
+		}, {
+			value: "advanced",
+			label: "Manual",
+			hint: manualHint
+		}],
+		initialValue: "quickstart"
+	});
+	if (opts.mode === "remote" && flow === "quickstart") {
+		await prompter.note("QuickStart only supports local gateways. Switching to Manual mode.", "QuickStart");
+		flow = "advanced";
+	}
+	if (snapshot.exists) {
+		await prompter.note(onboardHelpers.summarizeExistingConfig(baseConfig), "Existing config detected");
+		if (await prompter.select({
+			message: "Config handling",
+			options: [
+				{
+					value: "keep",
+					label: "Use existing values"
+				},
+				{
+					value: "modify",
+					label: "Update values"
+				},
+				{
+					value: "reset",
+					label: "Reset"
+				}
+			]
+		}) === "reset") {
+			const workspaceDefault = baseConfig.agents?.defaults?.workspace ?? onboardHelpers.DEFAULT_WORKSPACE;
+			const resetScope = await prompter.select({
+				message: "Reset scope",
+				options: [
+					{
+						value: "config",
+						label: "Config only"
+					},
+					{
+						value: "config+creds+sessions",
+						label: "Config + creds + sessions"
+					},
+					{
+						value: "full",
+						label: "Full reset (config + creds + sessions + workspace)"
+					}
+				]
+			});
+			await onboardHelpers.handleReset(resetScope, resolveUserPath(workspaceDefault), runtime);
+			baseConfig = {};
+		}
+	}
+	const quickstartGateway = (() => {
+		const hasExisting = typeof baseConfig.gateway?.port === "number" || baseConfig.gateway?.bind !== void 0 || baseConfig.gateway?.auth?.mode !== void 0 || baseConfig.gateway?.auth?.token !== void 0 || baseConfig.gateway?.auth?.password !== void 0 || baseConfig.gateway?.customBindHost !== void 0 || baseConfig.gateway?.tailscale?.mode !== void 0;
+		const bindRaw = baseConfig.gateway?.bind;
+		const bind = bindRaw === "loopback" || bindRaw === "lan" || bindRaw === "auto" || bindRaw === "custom" || bindRaw === "tailnet" ? bindRaw : "loopback";
+		let authMode = "token";
+		if (baseConfig.gateway?.auth?.mode === "token" || baseConfig.gateway?.auth?.mode === "password") authMode = baseConfig.gateway.auth.mode;
+		else if (baseConfig.gateway?.auth?.token) authMode = "token";
+		else if (baseConfig.gateway?.auth?.password) authMode = "password";
+		const tailscaleRaw = baseConfig.gateway?.tailscale?.mode;
+		const tailscaleMode = tailscaleRaw === "off" || tailscaleRaw === "serve" || tailscaleRaw === "funnel" ? tailscaleRaw : "off";
+		return {
+			hasExisting,
+			port: resolveGatewayPort(baseConfig),
+			bind,
+			authMode,
+			tailscaleMode,
+			token: baseConfig.gateway?.auth?.token,
+			password: baseConfig.gateway?.auth?.password,
+			customBindHost: baseConfig.gateway?.customBindHost,
+			tailscaleResetOnExit: baseConfig.gateway?.tailscale?.resetOnExit ?? false
+		};
+	})();
+	if (flow === "quickstart") {
+		const formatBind = (value) => {
+			if (value === "loopback") return "Loopback (127.0.0.1)";
+			if (value === "lan") return "LAN";
+			if (value === "custom") return "Custom IP";
+			if (value === "tailnet") return "Tailnet (Tailscale IP)";
+			return "Auto";
+		};
+		const formatAuth = (value) => {
+			if (value === "token") return "Token (default)";
+			return "Password";
+		};
+		const formatTailscale = (value) => {
+			if (value === "off") return "Off";
+			if (value === "serve") return "Serve";
+			return "Funnel";
+		};
+		const quickstartLines = quickstartGateway.hasExisting ? [
+			"Keeping your current gateway settings:",
+			`Gateway port: ${quickstartGateway.port}`,
+			`Gateway bind: ${formatBind(quickstartGateway.bind)}`,
+			...quickstartGateway.bind === "custom" && quickstartGateway.customBindHost ? [`Gateway custom IP: ${quickstartGateway.customBindHost}`] : [],
+			`Gateway auth: ${formatAuth(quickstartGateway.authMode)}`,
+			`Tailscale exposure: ${formatTailscale(quickstartGateway.tailscaleMode)}`,
+			"Direct to chat channels."
+		] : [
+			`Gateway port: ${quickstartGateway.port}`,
+			"Gateway bind: Loopback (127.0.0.1)",
+			"Gateway auth: Token (default)",
+			"Tailscale exposure: Off",
+			"Direct to chat channels."
+		];
+		await prompter.note(quickstartLines.join("\n"), "QuickStart");
+	}
+	const localPort = resolveGatewayPort(baseConfig);
+	const localUrl = `ws://127.0.0.1:${localPort}`;
+	let localGatewayToken = process.env.GENESIS_GATEWAY_TOKEN;
+	try {
+		const resolvedGatewayToken = await resolveSetupSecretInputString({
+			config: baseConfig,
+			value: baseConfig.gateway?.auth?.token,
+			path: "gateway.auth.token",
+			env: process.env
+		});
+		if (resolvedGatewayToken) localGatewayToken = resolvedGatewayToken;
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.auth.token SecretRef for setup probe.", formatErrorMessage(error)].join("\n"), "Gateway auth");
+	}
+	let localGatewayPassword = process.env.GENESIS_GATEWAY_PASSWORD;
+	try {
+		const resolvedGatewayPassword = await resolveSetupSecretInputString({
+			config: baseConfig,
+			value: baseConfig.gateway?.auth?.password,
+			path: "gateway.auth.password",
+			env: process.env
+		});
+		if (resolvedGatewayPassword) localGatewayPassword = resolvedGatewayPassword;
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.auth.password SecretRef for setup probe.", formatErrorMessage(error)].join("\n"), "Gateway auth");
+	}
+	const localProbe = await onboardHelpers.probeGatewayReachable({
+		url: localUrl,
+		token: localGatewayToken,
+		password: localGatewayPassword
+	});
+	const remoteUrl = baseConfig.gateway?.remote?.url?.trim() ?? "";
+	let remoteGatewayToken = normalizeSecretInputString(baseConfig.gateway?.remote?.token);
+	try {
+		const resolvedRemoteGatewayToken = await resolveSetupSecretInputString({
+			config: baseConfig,
+			value: baseConfig.gateway?.remote?.token,
+			path: "gateway.remote.token",
+			env: process.env
+		});
+		if (resolvedRemoteGatewayToken) remoteGatewayToken = resolvedRemoteGatewayToken;
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.remote.token SecretRef for setup probe.", formatErrorMessage(error)].join("\n"), "Gateway auth");
+	}
+	const remoteProbe = remoteUrl ? await onboardHelpers.probeGatewayReachable({
+		url: remoteUrl,
+		token: remoteGatewayToken
+	}) : null;
+	const mode = opts.mode ?? (flow === "quickstart" ? "local" : await prompter.select({
+		message: "What do you want to set up?",
+		options: [{
+			value: "local",
+			label: "Local gateway (this machine)",
+			hint: localProbe.ok ? `Gateway reachable (${localUrl})` : `No gateway detected (${localUrl})`
+		}, {
+			value: "remote",
+			label: "Remote gateway (info-only)",
+			hint: !remoteUrl ? "No remote URL configured yet" : remoteProbe?.ok ? `Gateway reachable (${remoteUrl})` : `Configured but unreachable (${remoteUrl})`
+		}]
+	}));
+	if (mode === "remote") {
+		const { promptRemoteGatewayConfig } = await import("./onboard-remote-D8THwo3P.js");
+		const { applySkipBootstrapConfig } = await import("./onboard-config-CpmYSD-w.js");
+		const { logConfigUpdated } = await loadConfigLoggingModule();
+		let nextConfig = await promptRemoteGatewayConfig(baseConfig, prompter, { secretInputMode: opts.secretInputMode });
+		if (opts.skipBootstrap) nextConfig = applySkipBootstrapConfig(nextConfig);
+		nextConfig = onboardHelpers.applyWizardMetadata(nextConfig, {
+			command: "onboard",
+			mode
+		});
+		await writeConfigFile(nextConfig);
+		logConfigUpdated(runtime);
+		await prompter.outro("Remote gateway configured.");
+		return;
+	}
+	const workspaceDir = resolveUserPath((opts.workspace ?? (flow === "quickstart" ? baseConfig.agents?.defaults?.workspace ?? onboardHelpers.DEFAULT_WORKSPACE : await prompter.text({
+		message: "Workspace directory",
+		initialValue: baseConfig.agents?.defaults?.workspace ?? onboardHelpers.DEFAULT_WORKSPACE
+	}))).trim() || onboardHelpers.DEFAULT_WORKSPACE);
+	const { applyLocalSetupWorkspaceConfig, applySkipBootstrapConfig } = await import("./onboard-config-CpmYSD-w.js");
+	let nextConfig = applyLocalSetupWorkspaceConfig(baseConfig, workspaceDir);
+	if (opts.skipBootstrap) nextConfig = applySkipBootstrapConfig(nextConfig);
+	const authChoiceFromPrompt = opts.authChoice === void 0;
+	let authChoice = opts.authChoice;
+	let authStore;
+	let promptAuthChoiceGrouped;
+	if (authChoiceFromPrompt) {
+		const { ensureAuthProfileStore } = await import("./agents/auth-profiles.runtime.js");
+		({promptAuthChoiceGrouped} = await import("./auth-choice-prompt-1EriFNA8.js"));
+		authStore = ensureAuthProfileStore(void 0, { allowKeychainPrompt: false });
+	}
+	while (true) {
+		if (authChoiceFromPrompt) authChoice = await promptAuthChoiceGrouped({
+			prompter,
+			store: authStore,
+			includeSkip: true,
+			config: nextConfig,
+			workspaceDir
+		});
+		if (authChoice === void 0) throw new WizardCancelledError("auth choice is required");
+		if (authChoice === "custom-api-key") {
+			const { promptCustomApiConfig } = await import("./onboard-custom-Skp24tPF.js");
+			nextConfig = (await promptCustomApiConfig({
+				prompter,
+				runtime,
+				config: nextConfig,
+				secretInputMode: opts.secretInputMode
+			})).config;
+			break;
+		}
+		if (authChoice === "skip") {
+			if (authChoiceFromPrompt) {
+				const { applyPrimaryModel, promptDefaultModel } = await loadModelPickerModule();
+				const modelSelection = await promptDefaultModel({
+					config: nextConfig,
+					prompter,
+					allowKeep: true,
+					ignoreAllowlist: true,
+					includeProviderPluginSetups: true,
+					workspaceDir,
+					runtime
+				});
+				if (modelSelection.config) nextConfig = modelSelection.config;
+				if (modelSelection.model) nextConfig = applyPrimaryModel(nextConfig, modelSelection.model);
+				const { warnIfModelConfigLooksOff } = await loadAuthChoiceModule();
+				await warnIfModelConfigLooksOff(nextConfig, prompter);
+			}
+			break;
+		}
+		const [{ applyAuthChoice, resolvePreferredProviderForAuthChoice, warnIfModelConfigLooksOff }, { applyPrimaryModel, promptDefaultModel }] = await Promise.all([loadAuthChoiceModule(), loadModelPickerModule()]);
+		const authResult = await applyAuthChoice({
+			authChoice,
+			config: nextConfig,
+			prompter,
+			runtime,
+			setDefaultModel: true,
+			opts: {
+				tokenProvider: opts.tokenProvider,
+				token: opts.authChoice === "apiKey" && opts.token ? opts.token : void 0
+			}
+		});
+		nextConfig = authResult.config;
+		if (authResult.retrySelection) {
+			if (authChoiceFromPrompt) continue;
+			break;
+		}
+		if (authResult.agentModelOverride) nextConfig = applyPrimaryModel(nextConfig, authResult.agentModelOverride);
+		const authChoiceModelSelectionPolicy = await resolveAuthChoiceModelSelectionPolicy({
+			authChoice,
+			config: nextConfig,
+			workspaceDir,
+			resolvePreferredProviderForAuthChoice
+		});
+		if (authChoiceFromPrompt || authChoiceModelSelectionPolicy?.promptWhenAuthChoiceProvided) {
+			const modelSelection = await promptDefaultModel({
+				config: nextConfig,
+				prompter,
+				allowKeep: authChoiceModelSelectionPolicy?.allowKeepCurrent ?? true,
+				ignoreAllowlist: true,
+				includeProviderPluginSetups: true,
+				preferredProvider: authChoiceModelSelectionPolicy?.preferredProvider,
+				workspaceDir,
+				runtime
+			});
+			if (modelSelection.config) nextConfig = modelSelection.config;
+			if (modelSelection.model) nextConfig = applyPrimaryModel(nextConfig, modelSelection.model);
+		}
+		await warnIfModelConfigLooksOff(nextConfig, prompter);
+		break;
+	}
+	const { configureGatewayForSetup } = await import("./setup.gateway-config-BH4xbjcX.js");
+	const gateway = await configureGatewayForSetup({
+		flow,
+		baseConfig,
+		nextConfig,
+		localPort,
+		quickstartGateway,
+		secretInputMode: opts.secretInputMode,
+		prompter,
+		runtime
+	});
+	nextConfig = gateway.nextConfig;
+	const settings = gateway.settings;
+	if (opts.skipChannels ?? opts.skipProviders) await prompter.note("Skipping channel setup.", "Channels");
+	else {
+		const { listChannelPlugins } = await import("./plugins-wj1AjcUK.js");
+		const { setupChannels } = await import("./onboard-channels-CRitWl53.js");
+		const quickstartAllowFromChannels = flow === "quickstart" ? listChannelPlugins().filter((plugin) => plugin.meta.quickstartAllowFrom).map((plugin) => plugin.id) : [];
+		nextConfig = await setupChannels(nextConfig, runtime, prompter, {
+			allowSignalInstall: true,
+			deferStatusUntilSelection: flow === "quickstart",
+			forceAllowFromChannels: quickstartAllowFromChannels,
+			skipDmPolicyPrompt: flow === "quickstart",
+			skipConfirm: flow === "quickstart",
+			quickstartDefaults: flow === "quickstart",
+			secretInputMode: opts.secretInputMode
+		});
+	}
+	await writeConfigFile(nextConfig);
+	const { logConfigUpdated } = await loadConfigLoggingModule();
+	logConfigUpdated(runtime);
+	await onboardHelpers.ensureWorkspaceAndSessions(workspaceDir, runtime, { skipBootstrap: Boolean(nextConfig.agents?.defaults?.skipBootstrap) });
+	if (opts.skipSearch) await prompter.note("Skipping search setup.", "Search");
+	else {
+		const { setupSearch } = await import("./onboard-search-XCG-N-tW.js");
+		nextConfig = await setupSearch(nextConfig, runtime, prompter, {
+			quickstartDefaults: flow === "quickstart",
+			secretInputMode: opts.secretInputMode
+		});
+	}
+	if (opts.skipSkills) await prompter.note("Skipping skills setup.", "Skills");
+	else {
+		const { setupSkills } = await import("./onboard-skills-DtOgSJZo.js");
+		nextConfig = await setupSkills(nextConfig, workspaceDir, runtime, prompter);
+	}
+	if (flow !== "quickstart") {
+		const { setupPluginConfig } = await import("./setup.plugin-config-D1Nt_Y2g.js");
+		nextConfig = await setupPluginConfig({
+			config: nextConfig,
+			prompter,
+			workspaceDir
+		});
+	}
+	const { setupInternalHooks } = await import("./onboard-hooks-Dqjuk9KT.js");
+	nextConfig = await setupInternalHooks(nextConfig, runtime, prompter);
+	nextConfig = onboardHelpers.applyWizardMetadata(nextConfig, {
+		command: "onboard",
+		mode
+	});
+	await writeConfigFile(nextConfig);
+	const { finalizeSetupWizard } = await import("./setup.finalize-DXUCLT5O.js");
+	const { launchedTui } = await finalizeSetupWizard({
+		flow,
+		opts,
+		baseConfig,
+		nextConfig,
+		workspaceDir,
+		settings,
+		prompter,
+		runtime
+	});
+	if (launchedTui) return;
+}
+//#endregion
+export { runSetupWizard as t };

package/dist/setup-api-BkYWhB-B.js

@@ -0,0 +1,29 @@
+import { r as loadBundledEntryExportSync } from "./channel-entry-contract-CnjoEU1u.js";
+import "./setup-core-BXBabSEx.js";
+//#region extensions/zalo/setup-api.ts
+function createLazyObjectValue(load) {
+	return new Proxy({}, {
+		get(_target, property, receiver) {
+			return Reflect.get(load(), property, receiver);
+		},
+		has(_target, property) {
+			return property in load();
+		},
+		ownKeys() {
+			return Reflect.ownKeys(load());
+		},
+		getOwnPropertyDescriptor(_target, property) {
+			const descriptor = Object.getOwnPropertyDescriptor(load(), property);
+			return descriptor ? {
+				...descriptor,
+				configurable: true
+			} : void 0;
+		}
+	});
+}
+function loadSetupSurfaceModule() {
+	return loadBundledEntryExportSync(import.meta.url, { specifier: "./src/setup-surface.js" });
+}
+const zaloSetupWizard = createLazyObjectValue(() => loadSetupSurfaceModule().zaloSetupWizard);
+//#endregion
+export { zaloSetupWizard as t };

package/dist/setup-core-BXBabSEx.js

@@ -0,0 +1,171 @@
+import { t as formatDocsLink } from "./links-DmsJCU7L.js";
+import { n as normalizeAccountId } from "./account-id-C3j_3_su.js";
+import { a as createSetupInputPresenceValidator, i as createPatchedAccountSetupAdapter } from "./setup-helpers-DdXv0uuQ.js";
+import { t as addWildcardAllowFrom, v as mergeAllowFromEntries } from "./setup-wizard-helpers-bq7q4u8-.js";
+import { a as createDelegatedSetupWizardProxy } from "./setup-wizard-proxy-Sks7Ynz7.js";
+import "./setup-BX02_N1z.js";
+import { i as resolveZaloAccount, r as resolveDefaultZaloAccountId } from "./accounts-B7yDKwxi.js";
+//#region extensions/zalo/src/setup-allow-from.ts
+async function noteZaloTokenHelp(prompter) {
+	await prompter.note([
+		"1) Open Zalo Bot Platform: https://bot.zaloplatforms.com",
+		"2) Create a bot and get the token",
+		"3) Token looks like 12345689:abc-xyz",
+		"Tip: you can also set ZALO_BOT_TOKEN in your env.",
+		`Docs: ${formatDocsLink("/channels/zalo", "zalo")}`
+	].join("\n"), "Zalo bot token");
+}
+async function promptZaloAllowFrom(params) {
+	const { cfg, prompter } = params;
+	const accountId = params.accountId ?? resolveDefaultZaloAccountId(cfg);
+	const existingAllowFrom = resolveZaloAccount({
+		cfg,
+		accountId
+	}).config.allowFrom ?? [];
+	const unique = mergeAllowFromEntries(existingAllowFrom, [(await prompter.text({
+		message: "Zalo allowFrom (user id)",
+		placeholder: "123456789",
+		initialValue: existingAllowFrom[0] ? String(existingAllowFrom[0]) : void 0,
+		validate: (value) => {
+			const raw = (value ?? "").trim();
+			if (!raw) return "Required";
+			if (!/^\d+$/.test(raw)) return "Use a numeric Zalo user id";
+		}
+	})).trim()]);
+	if (accountId === "default") return {
+		...cfg,
+		channels: {
+			...cfg.channels,
+			zalo: {
+				...cfg.channels?.zalo,
+				enabled: true,
+				dmPolicy: "allowlist",
+				allowFrom: unique
+			}
+		}
+	};
+	const currentAccount = cfg.channels?.zalo?.accounts?.[accountId];
+	return {
+		...cfg,
+		channels: {
+			...cfg.channels,
+			zalo: {
+				...cfg.channels?.zalo,
+				enabled: true,
+				accounts: {
+					...cfg.channels?.zalo?.accounts,
+					[accountId]: {
+						...currentAccount,
+						enabled: currentAccount?.enabled ?? true,
+						dmPolicy: "allowlist",
+						allowFrom: unique
+					}
+				}
+			}
+		}
+	};
+}
+//#endregion
+//#region extensions/zalo/src/setup-core.ts
+const channel = "zalo";
+const zaloSetupAdapter = createPatchedAccountSetupAdapter({
+	channelKey: channel,
+	validateInput: createSetupInputPresenceValidator({
+		defaultAccountOnlyEnvError: "ZALO_BOT_TOKEN can only be used for the default account.",
+		whenNotUseEnv: [{
+			someOf: ["token", "tokenFile"],
+			message: "Zalo requires token or --token-file (or --use-env)."
+		}]
+	}),
+	buildPatch: (input) => input.useEnv ? {} : input.tokenFile ? { tokenFile: input.tokenFile } : input.token ? { botToken: input.token } : {}
+});
+const zaloDmPolicy = {
+	label: "Zalo",
+	channel,
+	policyKey: "channels.zalo.dmPolicy",
+	allowFromKey: "channels.zalo.allowFrom",
+	resolveConfigKeys: (cfg, accountId) => (accountId ?? resolveDefaultZaloAccountId(cfg)) !== "default" ? {
+		policyKey: `channels.zalo.accounts.${accountId ?? resolveDefaultZaloAccountId(cfg)}.dmPolicy`,
+		allowFromKey: `channels.zalo.accounts.${accountId ?? resolveDefaultZaloAccountId(cfg)}.allowFrom`
+	} : {
+		policyKey: "channels.zalo.dmPolicy",
+		allowFromKey: "channels.zalo.allowFrom"
+	},
+	getCurrent: (cfg, accountId) => resolveZaloAccount({
+		cfg,
+		accountId: accountId ?? resolveDefaultZaloAccountId(cfg)
+	}).config.dmPolicy ?? "pairing",
+	setPolicy: (cfg, policy, accountId) => {
+		const resolvedAccountId = accountId && normalizeAccountId(accountId) ? normalizeAccountId(accountId) ?? "default" : resolveDefaultZaloAccountId(cfg);
+		const resolved = resolveZaloAccount({
+			cfg,
+			accountId: resolvedAccountId
+		});
+		if (resolvedAccountId === "default") return {
+			...cfg,
+			channels: {
+				...cfg.channels,
+				zalo: {
+					...cfg.channels?.zalo,
+					enabled: true,
+					dmPolicy: policy,
+					...policy === "open" ? { allowFrom: addWildcardAllowFrom(resolved.config.allowFrom) } : {}
+				}
+			}
+		};
+		const currentAccount = cfg.channels?.zalo?.accounts?.[resolvedAccountId];
+		return {
+			...cfg,
+			channels: {
+				...cfg.channels,
+				zalo: {
+					...cfg.channels?.zalo,
+					enabled: true,
+					accounts: {
+						...cfg.channels?.zalo?.accounts,
+						[resolvedAccountId]: {
+							...currentAccount,
+							enabled: currentAccount?.enabled ?? true,
+							dmPolicy: policy,
+							...policy === "open" ? { allowFrom: addWildcardAllowFrom(resolved.config.allowFrom) } : {}
+						}
+					}
+				}
+			}
+		};
+	},
+	promptAllowFrom: async ({ cfg, prompter, accountId }) => promptZaloAllowFrom({
+		cfg,
+		prompter,
+		accountId: accountId ?? resolveDefaultZaloAccountId(cfg)
+	})
+};
+function createZaloSetupWizardProxy(loadWizard) {
+	return createDelegatedSetupWizardProxy({
+		channel,
+		loadWizard,
+		status: {
+			configuredLabel: "configured",
+			unconfiguredLabel: "needs token",
+			configuredHint: "recommended · configured",
+			unconfiguredHint: "recommended · newcomer-friendly",
+			configuredScore: 1,
+			unconfiguredScore: 10
+		},
+		credentials: [],
+		delegateFinalize: true,
+		dmPolicy: zaloDmPolicy,
+		disable: (cfg) => ({
+			...cfg,
+			channels: {
+				...cfg.channels,
+				zalo: {
+					...cfg.channels?.zalo,
+					enabled: false
+				}
+			}
+		})
+	});
+}
+//#endregion
+export { promptZaloAllowFrom as a, noteZaloTokenHelp as i, zaloDmPolicy as n, zaloSetupAdapter as r, createZaloSetupWizardProxy as t };