@pixelzx/genesis 2026.6.27 → 2026.6.28

package/dist/setup.gateway-config-DHQ8eaxx.js

@@ -0,0 +1,250 @@
+import { p as resolveSecretInputRef, u as normalizeSecretInputString } from "./types.secrets-BbgGt42I.js";
+import { a as findTailscaleBinary } from "./tailscale-CRSrnk5m.js";
+import { n as ensureControlUiAllowedOriginsForNonLoopbackBind } from "./gateway-control-ui-origins-CLCLZ1lq.js";
+import { t as randomToken } from "./random-token-CC24wPn8.js";
+import { t as resolveSecretInputModeForEnvSelection } from "./provider-auth-mode-B9Pg5Srd.js";
+import { n as promptSecretRefForSetup } from "./provider-auth-ref-Bin67QHe.js";
+import { t as DEFAULT_DANGEROUS_NODE_COMMANDS } from "./node-command-policy-sPDu4daF.js";
+import { c as normalizeGatewayTokenInput, p as validateGatewayPasswordInput } from "./onboard-helpers-Di14BUn2.js";
+import { t as resolveSetupSecretInputString } from "./setup.secret-input-BAA3d-Wq.js";
+import { a as maybeAddTailnetOriginToControlUiAllowedOrigins, i as TAILSCALE_MISSING_BIN_NOTE_LINES, n as TAILSCALE_DOCS_LINES, r as TAILSCALE_EXPOSURE_OPTIONS, t as validateIPv4AddressInput } from "./ipv4-CKTpL3V3.js";
+//#region src/wizard/setup.gateway-config.ts
+function normalizeWizardTextInput(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+async function configureGatewayForSetup(opts) {
+	const { flow, localPort, quickstartGateway, prompter } = opts;
+	let { nextConfig } = opts;
+	const port = flow === "quickstart" ? quickstartGateway.port : Number.parseInt(normalizeWizardTextInput(await prompter.text({
+		message: "Gateway port",
+		initialValue: String(localPort),
+		validate: (value) => Number.isFinite(Number(value)) ? void 0 : "Invalid port"
+	})), 10);
+	let bind = flow === "quickstart" ? quickstartGateway.bind : await prompter.select({
+		message: "Gateway bind",
+		options: [
+			{
+				value: "loopback",
+				label: "Loopback (127.0.0.1)"
+			},
+			{
+				value: "lan",
+				label: "LAN (0.0.0.0)"
+			},
+			{
+				value: "tailnet",
+				label: "Tailnet (Tailscale IP)"
+			},
+			{
+				value: "auto",
+				label: "Auto (Loopback → LAN)"
+			},
+			{
+				value: "custom",
+				label: "Custom IP"
+			}
+		]
+	});
+	let customBindHost = quickstartGateway.customBindHost;
+	if (bind === "custom") {
+		if (flow !== "quickstart" || !customBindHost) {
+			const input = await prompter.text({
+				message: "Custom IP address",
+				placeholder: "192.168.1.100",
+				initialValue: customBindHost ?? "",
+				validate: validateIPv4AddressInput
+			});
+			customBindHost = typeof input === "string" ? input.trim() : void 0;
+		}
+	}
+	let authMode = flow === "quickstart" ? quickstartGateway.authMode : await prompter.select({
+		message: "Gateway auth",
+		options: [{
+			value: "token",
+			label: "Token",
+			hint: "Recommended default (local + remote)"
+		}, {
+			value: "password",
+			label: "Password"
+		}],
+		initialValue: "token"
+	});
+	const tailscaleMode = flow === "quickstart" ? quickstartGateway.tailscaleMode : await prompter.select({
+		message: "Tailscale exposure",
+		options: [...TAILSCALE_EXPOSURE_OPTIONS]
+	});
+	let tailscaleBin = null;
+	if (tailscaleMode !== "off") {
+		tailscaleBin = await findTailscaleBinary();
+		if (!tailscaleBin) await prompter.note(TAILSCALE_MISSING_BIN_NOTE_LINES.join("\n"), "Tailscale Warning");
+	}
+	let tailscaleResetOnExit = flow === "quickstart" ? quickstartGateway.tailscaleResetOnExit : false;
+	if (tailscaleMode !== "off" && flow !== "quickstart") {
+		await prompter.note(TAILSCALE_DOCS_LINES.join("\n"), "Tailscale");
+		tailscaleResetOnExit = await prompter.confirm({
+			message: "Reset Tailscale serve/funnel on exit?",
+			initialValue: false
+		});
+	}
+	if (tailscaleMode !== "off" && bind !== "loopback") {
+		await prompter.note("Tailscale requires bind=loopback. Adjusting bind to loopback.", "Note");
+		bind = "loopback";
+		customBindHost = void 0;
+	}
+	if (tailscaleMode === "funnel" && authMode !== "password") {
+		await prompter.note("Tailscale funnel requires password auth.", "Note");
+		authMode = "password";
+	}
+	let gatewayToken;
+	let gatewayTokenInput;
+	if (authMode === "token") {
+		const quickstartTokenString = normalizeSecretInputString(quickstartGateway.token);
+		const quickstartTokenRef = resolveSecretInputRef({
+			value: quickstartGateway.token,
+			defaults: nextConfig.secrets?.defaults
+		}).ref;
+		if ((flow === "quickstart" && opts.secretInputMode !== "ref" ? quickstartTokenRef ? "ref" : "plaintext" : await resolveSecretInputModeForEnvSelection({
+			prompter,
+			explicitMode: opts.secretInputMode,
+			copy: {
+				modeMessage: "How do you want to provide the gateway token?",
+				plaintextLabel: "Generate/store plaintext token",
+				plaintextHint: "Default",
+				refLabel: "Use SecretRef",
+				refHint: "Store a reference instead of plaintext"
+			}
+		})) === "ref") if (flow === "quickstart" && quickstartTokenRef) {
+			gatewayTokenInput = quickstartTokenRef;
+			gatewayToken = await resolveSetupSecretInputString({
+				config: nextConfig,
+				value: quickstartTokenRef,
+				path: "gateway.auth.token",
+				env: process.env
+			});
+		} else {
+			const resolved = await promptSecretRefForSetup({
+				provider: "gateway-auth-token",
+				config: nextConfig,
+				prompter,
+				preferredEnvVar: "GENESIS_GATEWAY_TOKEN",
+				copy: {
+					sourceMessage: "Where is this gateway token stored?",
+					envVarPlaceholder: "GENESIS_GATEWAY_TOKEN"
+				}
+			});
+			gatewayTokenInput = resolved.ref;
+			gatewayToken = resolved.resolvedValue;
+		}
+		else if (flow === "quickstart") {
+			gatewayToken = (quickstartTokenString ?? normalizeGatewayTokenInput(process.env.GENESIS_GATEWAY_TOKEN)) || randomToken();
+			gatewayTokenInput = gatewayToken;
+		} else {
+			gatewayToken = normalizeGatewayTokenInput(await prompter.text({
+				message: "Gateway token (blank to generate)",
+				placeholder: "Needed for multi-machine or non-loopback access",
+				initialValue: quickstartTokenString ?? normalizeGatewayTokenInput(process.env.GENESIS_GATEWAY_TOKEN) ?? ""
+			})) || randomToken();
+			gatewayTokenInput = gatewayToken;
+		}
+	}
+	if (authMode === "password") {
+		let password = flow === "quickstart" && quickstartGateway.password ? quickstartGateway.password : void 0;
+		if (!password) if (await resolveSecretInputModeForEnvSelection({
+			prompter,
+			explicitMode: opts.secretInputMode,
+			copy: {
+				modeMessage: "How do you want to provide the gateway password?",
+				plaintextLabel: "Enter password now",
+				plaintextHint: "Stores the password directly in Genesis config"
+			}
+		}) === "ref") password = (await promptSecretRefForSetup({
+			provider: "gateway-auth-password",
+			config: nextConfig,
+			prompter,
+			preferredEnvVar: "GENESIS_GATEWAY_PASSWORD",
+			copy: {
+				sourceMessage: "Where is this gateway password stored?",
+				envVarPlaceholder: "GENESIS_GATEWAY_PASSWORD"
+			}
+		})).ref;
+		else password = normalizeWizardTextInput(await prompter.text({
+			message: "Gateway password",
+			validate: validateGatewayPasswordInput
+		}));
+		nextConfig = {
+			...nextConfig,
+			gateway: {
+				...nextConfig.gateway,
+				auth: {
+					...nextConfig.gateway?.auth,
+					mode: "password",
+					password
+				}
+			}
+		};
+	} else if (authMode === "token") nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			auth: {
+				...nextConfig.gateway?.auth,
+				mode: "token",
+				token: gatewayTokenInput
+			}
+		}
+	};
+	nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			port,
+			bind,
+			...bind === "custom" && customBindHost ? { customBindHost } : {},
+			tailscale: {
+				...nextConfig.gateway?.tailscale,
+				mode: tailscaleMode,
+				resetOnExit: tailscaleResetOnExit
+			}
+		}
+	};
+	if (flow === "quickstart" && bind === "loopback" && nextConfig.gateway?.controlUi?.allowInsecureAuth === void 0) nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			controlUi: {
+				...nextConfig.gateway?.controlUi,
+				allowInsecureAuth: true
+			}
+		}
+	};
+	nextConfig = ensureControlUiAllowedOriginsForNonLoopbackBind(nextConfig, { requireControlUiEnabled: true }).config;
+	nextConfig = await maybeAddTailnetOriginToControlUiAllowedOrigins({
+		config: nextConfig,
+		tailscaleMode,
+		tailscaleBin
+	});
+	if (!quickstartGateway.hasExisting && nextConfig.gateway?.nodes?.denyCommands === void 0 && nextConfig.gateway?.nodes?.allowCommands === void 0 && nextConfig.gateway?.nodes?.browser === void 0) nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			nodes: {
+				...nextConfig.gateway?.nodes,
+				denyCommands: [...DEFAULT_DANGEROUS_NODE_COMMANDS]
+			}
+		}
+	};
+	return {
+		nextConfig,
+		settings: {
+			port,
+			bind,
+			customBindHost: bind === "custom" ? customBindHost : void 0,
+			authMode,
+			gatewayToken,
+			tailscaleMode,
+			tailscaleResetOnExit
+		}
+	};
+}
+//#endregion
+export { configureGatewayForSetup };

package/dist/shared-BY5yIWjE.js

@@ -0,0 +1,198 @@
+import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString, s as normalizeOptionalLowercaseString } from "./string-coerce-DPP_aYVc.js";
+import { o as isSubagentSessionKey, s as parseAgentSessionKey } from "./session-key-utils-DDwuwYKT.js";
+import { t as getActivePluginChannelRegistry } from "./runtime-Bv6YcDYx.js";
+import { c as countPendingDescendantRunsFromRuns, i as subagentRuns, t as getSubagentRunsSnapshotForRead } from "./subagent-registry-state-CpOSWZWQ.js";
+import { p as extractTextFromChatContent } from "./sanitize-user-facing-text-DKqUCgHB.js";
+import { r as callGateway } from "./call-Dwj7PrNe.js";
+import { n as sanitizeTextContent } from "./chat-history-text-AHitS_or.js";
+import { n as resolveStoredSubagentCapabilities } from "./subagent-capabilities-DFXCYxt0.js";
+import { n as looksLikeSessionId } from "./session-id-Ckb23Lzd.js";
+import { o as resolveInternalSessionKey, s as resolveMainSessionAlias } from "./sessions-helpers-DYP9dapI.js";
+import { i as formatRunLabel, s as resolveSubagentTargetFromRuns } from "./subagents-format-CqbR_pUY.js";
+//#region src/auto-reply/reply/channel-context.ts
+function resolveCommandSurfaceChannel(params) {
+	return normalizeOptionalLowercaseString(params.ctx.OriginatingChannel ?? params.command.channel ?? params.ctx.Surface ?? params.ctx.Provider) ?? "";
+}
+function resolveChannelAccountId(params) {
+	const accountId = normalizeOptionalString(params.ctx.AccountId) ?? "";
+	if (accountId) return accountId;
+	const channel = resolveCommandSurfaceChannel(params);
+	const plugin = getActivePluginChannelRegistry()?.channels.find((entry) => entry.plugin.id === channel)?.plugin;
+	return normalizeOptionalString(plugin?.config.defaultAccountId?.(params.cfg)) || "default";
+}
+//#endregion
+//#region src/auto-reply/reply/commands-subagents-text.ts
+function extractMessageText(message) {
+	const role = typeof message.role === "string" ? message.role : "";
+	const shouldSanitize = role === "assistant";
+	const text = extractTextFromChatContent(message.content, { sanitizeText: shouldSanitize ? sanitizeTextContent : void 0 });
+	return text ? {
+		role,
+		text
+	} : null;
+}
+//#endregion
+//#region src/auto-reply/reply/commands-subagents/shared.ts
+const COMMAND = "/subagents";
+const COMMAND_KILL = "/kill";
+const COMMAND_STEER = "/steer";
+const COMMAND_TELL = "/tell";
+const COMMAND_FOCUS = "/focus";
+const COMMAND_UNFOCUS = "/unfocus";
+const COMMAND_AGENTS = "/agents";
+const ACTIONS = new Set([
+	"list",
+	"kill",
+	"log",
+	"send",
+	"steer",
+	"info",
+	"spawn",
+	"focus",
+	"unfocus",
+	"agents",
+	"help"
+]);
+function stopWithText(text) {
+	return {
+		shouldContinue: false,
+		reply: { text }
+	};
+}
+function stopWithUnknownTargetError(error) {
+	return stopWithText(`⚠️ ${error ?? "Unknown subagent."}`);
+}
+function resolveSubagentTarget(runs, token) {
+	return resolveSubagentTargetFromRuns({
+		runs,
+		token,
+		recentWindowMinutes: 30,
+		label: (entry) => formatRunLabel(entry),
+		isActive: (entry) => !entry.endedAt || Math.max(0, countPendingDescendantRunsFromRuns(getSubagentRunsSnapshotForRead(subagentRuns), entry.childSessionKey)) > 0,
+		errors: {
+			missingTarget: "Missing subagent id.",
+			invalidIndex: (value) => `Invalid subagent index: ${value}`,
+			unknownSession: (value) => `Unknown subagent session: ${value}`,
+			ambiguousLabel: (value) => `Ambiguous subagent label: ${value}`,
+			ambiguousLabelPrefix: (value) => `Ambiguous subagent label prefix: ${value}`,
+			ambiguousRunIdPrefix: (value) => `Ambiguous run id prefix: ${value}`,
+			unknownTarget: (value) => `Unknown subagent id: ${value}`
+		}
+	});
+}
+function resolveSubagentEntryForToken(runs, token) {
+	const resolved = resolveSubagentTarget(runs, token);
+	if (!resolved.entry) return { reply: stopWithUnknownTargetError(resolved.error) };
+	return { entry: resolved.entry };
+}
+function resolveRequesterSessionKey(params, opts) {
+	const commandTarget = normalizeOptionalString(params.ctx.CommandTargetSessionKey);
+	const commandSession = normalizeOptionalString(params.sessionKey);
+	const raw = opts?.preferCommandTarget ?? params.ctx.CommandSource === "native" ? commandTarget || commandSession : commandSession || commandTarget;
+	if (!raw) return;
+	const { mainKey, alias } = resolveMainSessionAlias(params.cfg);
+	return resolveInternalSessionKey({
+		key: raw,
+		alias,
+		mainKey
+	});
+}
+function resolveCommandSubagentController(params, requesterKey) {
+	if (!isSubagentSessionKey(requesterKey)) return {
+		controllerSessionKey: requesterKey,
+		callerSessionKey: requesterKey,
+		callerIsSubagent: false,
+		controlScope: "children"
+	};
+	return {
+		controllerSessionKey: requesterKey,
+		callerSessionKey: requesterKey,
+		callerIsSubagent: true,
+		controlScope: resolveStoredSubagentCapabilities(requesterKey, { cfg: params.cfg }).controlScope
+	};
+}
+function resolveHandledPrefix(normalized) {
+	return normalized.startsWith("/subagents") ? COMMAND : normalized.startsWith("/kill") ? COMMAND_KILL : normalized.startsWith("/steer") ? COMMAND_STEER : normalized.startsWith("/tell") ? COMMAND_TELL : normalized.startsWith("/focus") ? COMMAND_FOCUS : normalized.startsWith("/unfocus") ? COMMAND_UNFOCUS : normalized.startsWith("/agents") ? COMMAND_AGENTS : null;
+}
+function resolveSubagentsAction(params) {
+	if (params.handledPrefix === "/subagents") {
+		const [actionRaw] = params.restTokens;
+		const action = normalizeLowercaseStringOrEmpty(actionRaw) || "list";
+		if (!ACTIONS.has(action)) return null;
+		params.restTokens.splice(0, 1);
+		return action;
+	}
+	if (params.handledPrefix === "/kill") return "kill";
+	if (params.handledPrefix === "/focus") return "focus";
+	if (params.handledPrefix === "/unfocus") return "unfocus";
+	if (params.handledPrefix === "/agents") return "agents";
+	return "steer";
+}
+async function resolveFocusTargetSession(params) {
+	const subagentMatch = resolveSubagentTarget(params.runs, params.token);
+	if (subagentMatch.entry) {
+		const key = subagentMatch.entry.childSessionKey;
+		return {
+			targetKind: "subagent",
+			targetSessionKey: key,
+			agentId: parseAgentSessionKey(key)?.agentId ?? "main",
+			label: formatRunLabel(subagentMatch.entry)
+		};
+	}
+	const token = params.token.trim();
+	if (!token) return null;
+	const attempts = [];
+	attempts.push({ key: token });
+	if (looksLikeSessionId(token)) attempts.push({ sessionId: token });
+	attempts.push({ label: token });
+	for (const attempt of attempts) try {
+		const key = normalizeOptionalString((await callGateway({
+			method: "sessions.resolve",
+			params: attempt
+		}))?.key) ?? "";
+		if (!key) continue;
+		const parsed = parseAgentSessionKey(key);
+		return {
+			targetKind: key.includes(":subagent:") ? "subagent" : "acp",
+			targetSessionKey: key,
+			agentId: parsed?.agentId ?? "main",
+			label: token
+		};
+	} catch {}
+	return null;
+}
+function buildSubagentsHelp() {
+	return [
+		"Subagents",
+		"Usage:",
+		"- /subagents list",
+		"- /subagents kill <id|#|all>",
+		"- /subagents log <id|#> [limit] [tools]",
+		"- /subagents info <id|#>",
+		"- /subagents send <id|#> <message>",
+		"- /subagents steer <id|#> <message>",
+		"- /subagents spawn <agentId> <task> [--model <model>] [--thinking <level>]",
+		"- /focus <subagent-label|session-key|session-id|session-label>",
+		"- /unfocus",
+		"- /agents",
+		"- /session idle <duration|off>",
+		"- /session max-age <duration|off>",
+		"- /kill <id|#|all>",
+		"- /steer <id|#> <message>",
+		"- /tell <id|#> <message>",
+		"",
+		"Ids: use the list index (#), runId/session prefix, label, or full session key."
+	].join("\n");
+}
+function formatLogLines(messages) {
+	const lines = [];
+	for (const msg of messages) {
+		const extracted = extractMessageText(msg);
+		if (!extracted) continue;
+		const label = extracted.role === "assistant" ? "Assistant" : "User";
+		lines.push(`${label}: ${extracted.text}`);
+	}
+	return lines;
+}
+//#endregion
+export { resolveFocusTargetSession as a, resolveSubagentEntryForToken as c, resolveChannelAccountId as d, resolveCommandSurfaceChannel as f, resolveCommandSubagentController as i, resolveSubagentsAction as l, buildSubagentsHelp as n, resolveHandledPrefix as o, formatLogLines as r, resolveRequesterSessionKey as s, COMMAND as t, stopWithText as u };

package/dist/shared-BtY5n-4U.js

@@ -0,0 +1,76 @@
+import { n as defaultRuntime } from "./runtime-DDkDH9fa.js";
+import { i as getBundledChannelSetupPlugin } from "./bundled-CApOpgxZ.js";
+import { t as DEFAULT_ACCOUNT_ID } from "./account-id-CTXHUezn.js";
+import { n as getLoadedChannelPlugin, t as getChannelPlugin } from "./registry-BPyvV-id.js";
+import "./plugins-DhprD-7C.js";
+import { n as getChannelsCommandSecretTargetIds } from "./command-secret-targets-DRpr1JEj.js";
+import { t as hasConfiguredUnavailableCredentialStatus } from "./account-snapshot-fields-7tcmFFXl.js";
+import { t as resolveCommandConfigWithSecrets } from "./command-config-resolution-BNQbV_C6.js";
+import { n as requireValidConfigSnapshot } from "./config-validation-JqbUug0f.js";
+//#region src/commands/channels/shared.ts
+async function requireValidConfig(runtime = defaultRuntime, secretResolution) {
+	const cfg = await requireValidConfigSnapshot(runtime);
+	if (!cfg) return null;
+	const { effectiveConfig } = await resolveCommandConfigWithSecrets({
+		config: cfg,
+		commandName: secretResolution?.commandName ?? "channels",
+		targetIds: getChannelsCommandSecretTargetIds(),
+		mode: secretResolution?.mode,
+		runtime
+	});
+	return effectiveConfig;
+}
+function formatAccountLabel(params) {
+	const base = params.accountId || "default";
+	if (params.name?.trim()) return `${base} (${params.name.trim()})`;
+	return base;
+}
+const channelLabel = (channel) => {
+	return (getLoadedChannelPlugin(channel) ?? getBundledChannelSetupPlugin(channel) ?? getChannelPlugin(channel))?.meta.label ?? channel;
+};
+function formatChannelAccountLabel(params) {
+	const channelText = channelLabel(params.channel);
+	const accountText = formatAccountLabel({
+		accountId: params.accountId,
+		name: params.name
+	});
+	return `${params.channelStyle ? params.channelStyle(channelText) : channelText} ${params.accountStyle ? params.accountStyle(accountText) : accountText}`;
+}
+function appendEnabledConfiguredLinkedBits(bits, account) {
+	if (typeof account.enabled === "boolean") bits.push(account.enabled ? "enabled" : "disabled");
+	if (typeof account.configured === "boolean") if (account.configured) {
+		bits.push("configured");
+		if (hasConfiguredUnavailableCredentialStatus(account)) bits.push("secret unavailable in this command path");
+	} else bits.push("not configured");
+	if (typeof account.linked === "boolean") bits.push(account.linked ? "linked" : "not linked");
+}
+function appendModeBit(bits, account) {
+	if (typeof account.mode === "string" && account.mode.length > 0) bits.push(`mode:${account.mode}`);
+}
+function appendTokenSourceBits(bits, account) {
+	const appendSourceBit = (label, sourceKey, statusKey) => {
+		const source = account[sourceKey];
+		if (typeof source !== "string" || !source || source === "none") return;
+		const unavailable = account[statusKey] === "configured_unavailable" ? " (unavailable)" : "";
+		bits.push(`${label}:${source}${unavailable}`);
+	};
+	appendSourceBit("token", "tokenSource", "tokenStatus");
+	appendSourceBit("bot", "botTokenSource", "botTokenStatus");
+	appendSourceBit("app", "appTokenSource", "appTokenStatus");
+	appendSourceBit("signing", "signingSecretSource", "signingSecretStatus");
+}
+function appendBaseUrlBit(bits, account) {
+	if (typeof account.baseUrl === "string" && account.baseUrl) bits.push(`url:${account.baseUrl}`);
+}
+function buildChannelAccountLine(provider, account, bits) {
+	return `- ${formatChannelAccountLabel({
+		channel: provider,
+		accountId: typeof account.accountId === "string" ? account.accountId : DEFAULT_ACCOUNT_ID,
+		name: typeof account.name === "string" ? account.name : void 0
+	})}: ${bits.join(", ")}`;
+}
+function shouldUseWizard(params) {
+	return params?.hasFlags === false;
+}
+//#endregion
+export { buildChannelAccountLine as a, requireValidConfig as c, appendTokenSourceBits as i, shouldUseWizard as l, appendEnabledConfiguredLinkedBits as n, channelLabel as o, appendModeBit as r, formatChannelAccountLabel as s, appendBaseUrlBit as t };

package/dist/shared-DPf8cDHL.js

@@ -0,0 +1,121 @@
+import { h as MarkdownConfigSchema, l as GroupPolicySchema, o as DmPolicySchema } from "./zod-schema.core-CoFhKG_K.js";
+import { n as buildCatchallMultiAccountChannelSchema, r as buildChannelConfigSchema, t as AllowFromListSchema } from "./config-schema-jug-eHfF.js";
+import { s as ToolPolicySchema } from "./zod-schema.agent-runtime-BxiP7-C2.js";
+import { s as createScopedChannelConfigAdapter, t as adaptScopedAccountAccessor } from "./channel-config-helpers-u7T-fXUn.js";
+import { n as describeAccountSnapshot } from "./account-helpers-BO4UPATV.js";
+import "./core-CYaV0wrq.js";
+import { t as formatAllowFromLowercase } from "./allow-from-BgzfuU4f.js";
+import "./channel-config-schema-Ry4DuFfZ.js";
+import { n as createDangerousNameMatchingMutableAllowlistWarningCollector } from "./channel-policy-CKro2sO6.js";
+import "./config-runtime-AtYct3A3.js";
+import { t as zod_exports } from "./zod-Bqvft_ty.js";
+import { a as resolveZalouserAccountSync, i as resolveDefaultZalouserAccountId, r as listZalouserAccountIds, t as checkZcaAuthenticated } from "./accounts-DAdjC0Za.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-DkrWnf5X.js";
+import { n as isZalouserMutableGroupEntry } from "./security-audit-DUc_ubLQ.js";
+//#region extensions/zalouser/src/config-schema.ts
+const groupConfigSchema = zod_exports.z.object({
+	enabled: zod_exports.z.boolean().optional(),
+	requireMention: zod_exports.z.boolean().optional(),
+	tools: ToolPolicySchema
+});
+const ZalouserConfigSchema = buildCatchallMultiAccountChannelSchema(zod_exports.z.object({
+	name: zod_exports.z.string().optional(),
+	enabled: zod_exports.z.boolean().optional(),
+	markdown: MarkdownConfigSchema,
+	profile: zod_exports.z.string().optional(),
+	dangerouslyAllowNameMatching: zod_exports.z.boolean().optional(),
+	dmPolicy: DmPolicySchema.optional(),
+	allowFrom: AllowFromListSchema,
+	historyLimit: zod_exports.z.number().int().min(0).optional(),
+	groupAllowFrom: AllowFromListSchema,
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	groups: zod_exports.z.object({}).catchall(groupConfigSchema).optional(),
+	messagePrefix: zod_exports.z.string().optional(),
+	responsePrefix: zod_exports.z.string().optional()
+}));
+//#endregion
+//#region extensions/zalouser/src/doctor.ts
+function asObjectRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+const zalouserDoctor = {
+	dmAllowFromMode: "topOnly",
+	groupModel: "hybrid",
+	groupAllowFromFallbackToAllowFrom: false,
+	warnOnEmptyGroupSenderAllowlist: false,
+	legacyConfigRules,
+	normalizeCompatibilityConfig,
+	collectMutableAllowlistWarnings: createDangerousNameMatchingMutableAllowlistWarningCollector({
+		channel: "zalouser",
+		detector: isZalouserMutableGroupEntry,
+		collectLists: (scope) => {
+			const groups = asObjectRecord(scope.account.groups);
+			return groups ? [{
+				pathLabel: `${scope.prefix}.groups`,
+				list: Object.keys(groups)
+			}] : [];
+		}
+	})
+};
+//#endregion
+//#region extensions/zalouser/src/shared.ts
+const zalouserMeta = {
+	id: "zalouser",
+	label: "Zalo Personal",
+	selectionLabel: "Zalo (Personal Account)",
+	docsPath: "/channels/zalouser",
+	docsLabel: "zalouser",
+	blurb: "Zalo personal account via QR code login.",
+	aliases: ["zlu"],
+	order: 85,
+	quickstartAllowFrom: false
+};
+const zalouserConfigAdapter = createScopedChannelConfigAdapter({
+	sectionKey: "zalouser",
+	listAccountIds: listZalouserAccountIds,
+	resolveAccount: adaptScopedAccountAccessor(resolveZalouserAccountSync),
+	defaultAccountId: resolveDefaultZalouserAccountId,
+	clearBaseFields: [
+		"profile",
+		"name",
+		"dmPolicy",
+		"allowFrom",
+		"historyLimit",
+		"groupAllowFrom",
+		"groupPolicy",
+		"groups",
+		"messagePrefix"
+	],
+	resolveAllowFrom: (account) => account.config.allowFrom,
+	formatAllowFrom: (allowFrom) => formatAllowFromLowercase({
+		allowFrom,
+		stripPrefixRe: /^(zalouser|zlu):/i
+	})
+});
+function createZalouserPluginBase(params) {
+	return {
+		id: "zalouser",
+		meta: zalouserMeta,
+		setupWizard: params.setupWizard,
+		capabilities: {
+			chatTypes: ["direct", "group"],
+			media: true,
+			reactions: true,
+			threads: false,
+			polls: false,
+			nativeCommands: false,
+			blockStreaming: true
+		},
+		doctor: zalouserDoctor,
+		reload: { configPrefixes: ["channels.zalouser"] },
+		configSchema: buildChannelConfigSchema(ZalouserConfigSchema),
+		config: {
+			...zalouserConfigAdapter,
+			isConfigured: async (account) => await checkZcaAuthenticated(account.profile),
+			describeAccount: (account) => describeAccountSnapshot({ account })
+		},
+		setup: params.setup
+	};
+}
+//#endregion
+export { createZalouserPluginBase as t };