@soimy/dingtalk 3.6.2-beta.1 → 3.6.2

package/dist/index.js

@@ -2,9 +2,6 @@
 import { defineChannelPluginEntry } from "openclaw/plugin-sdk/core";
 import { readStringParam as readStringParam2 } from "openclaw/plugin-sdk/param-readers";
 
-// src/channel.ts
-import { buildChannelConfigSchema } from "openclaw/plugin-sdk/core";
-
 // src/secret-input.ts
 import { readFile } from "node:fs/promises";
 import { z } from "zod";
@@ -410,1240 +407,1273 @@ function resolveDingTalkAccount(cfg, accountId) {
   };
 }
 
-// src/config-schema.ts
-import { z as z2 } from "zod";
+// src/http-client.ts
+import axios from "axios";
+var DEFAULT_HTTP_TIMEOUT_MS = 1e4;
+var httpClient = typeof axios?.create === "function" ? axios.create({ timeout: DEFAULT_HTTP_TIMEOUT_MS }) : axios;
+httpClient.isAxiosError = axios.isAxiosError;
+var http_client_default = httpClient;
 
-// src/persistence-store.ts
+// src/utils.ts
+import * as dns from "node:dns";
 import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os2 from "node:os";
 import * as path2 from "node:path";
-var NAMESPACE_ROOT_DIR = "dingtalk-state";
-function toErrorMessage(err) {
-  if (err instanceof Error) {
-    return err.message;
-  }
-  try {
-    return JSON.stringify(err);
-  } catch {
-    return String(err);
-  }
-}
-function sanitizeSegment(value) {
-  return value.replace(/[^a-zA-Z0-9._-]/g, "_");
+var pluginDebugWriters = /* @__PURE__ */ new Map();
+var closedPluginDebugScopes = /* @__PURE__ */ new Set();
+function padNumber(value, width = 2) {
+  return String(value).padStart(width, "0");
 }
-function encodeScopeValue(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
+function formatTimezoneOffset(date) {
+  const offsetMinutes = -date.getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? "+" : "-";
+  const absoluteMinutes = Math.abs(offsetMinutes);
+  const hours = Math.floor(absoluteMinutes / 60);
+  const minutes = absoluteMinutes % 60;
+  return `${sign}${padNumber(hours)}:${padNumber(minutes)}`;
 }
-function buildScopeSuffix(scope) {
-  if (!scope) {
-    return "";
-  }
-  const ordered = [
-    ["accountId", scope.accountId],
-    ["agentId", scope.agentId],
-    ["conversationId", scope.conversationId],
-    ["groupId", scope.groupId],
-    ["targetId", scope.targetId]
-  ];
-  const segments = ordered.filter(([, value]) => Boolean(value && value.trim())).map(([key, value]) => `${key.replace(/Id$/, "")}-${encodeScopeValue((value || "").trim())}`);
-  if (segments.length === 0) {
-    return "";
-  }
-  return `.${segments.join(".")}`;
+function formatPluginDebugTimestamp(date) {
+  return `${date.getFullYear()}-${padNumber(date.getMonth() + 1)}-${padNumber(date.getDate())} ${padNumber(date.getHours())}:${padNumber(date.getMinutes())}:${padNumber(date.getSeconds())}.${padNumber(date.getMilliseconds(), 3)}${formatTimezoneOffset(date)}`;
 }
-function resolveNamespacePath(namespace, options) {
-  const format = options.format || "json";
-  const baseDir = path2.join(path2.dirname(options.storePath), NAMESPACE_ROOT_DIR);
-  const safeNamespace = sanitizeSegment(namespace.trim());
-  const suffix = buildScopeSuffix(options.scope);
-  return path2.join(baseDir, `${safeNamespace}${suffix}.${format}`);
+function formatPluginDebugDate(date) {
+  return `${date.getFullYear()}-${padNumber(date.getMonth() + 1)}-${padNumber(date.getDate())}`;
 }
-function readNamespaceJson(namespace, options) {
-  const filePath = resolveNamespacePath(namespace, options);
-  try {
-    if (!fs.existsSync(filePath)) {
-      return options.fallback;
-    }
-    const raw = fs.readFileSync(filePath, "utf-8");
-    if (!raw.trim()) {
-      return options.fallback;
-    }
-    return JSON.parse(raw);
-  } catch (err) {
-    options.log?.warn?.(
-      `[DingTalk][Persistence] Failed to read namespace=${namespace} path=${filePath}: ${toErrorMessage(err)}`
-    );
-    return options.fallback;
-  }
+function resolvePluginDebugLogFilePath(params) {
+  return path2.join(
+    path2.dirname(params.storePath),
+    "logs",
+    "dingtalk",
+    params.accountId,
+    `debug-${formatPluginDebugDate(params.date)}.log`
+  );
 }
-function writeNamespaceJsonAtomic(namespace, options) {
-  const filePath = resolveNamespacePath(namespace, options);
-  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  try {
-    fs.mkdirSync(path2.dirname(filePath), { recursive: true });
-    fs.writeFileSync(tempPath, JSON.stringify(options.data, null, 2));
-    try {
-      fs.renameSync(tempPath, filePath);
-    } catch (err) {
-      if (fs.existsSync(filePath)) {
-        fs.rmSync(filePath, { force: true });
-        fs.renameSync(tempPath, filePath);
-      } else {
-        throw err;
-      }
-    }
-  } catch (err) {
-    options.log?.warn?.(
-      `[DingTalk][Persistence] Failed to write namespace=${namespace} path=${filePath}: ${toErrorMessage(err)}`
-    );
-    if (fs.existsSync(tempPath)) {
-      fs.rmSync(tempPath, { force: true });
-    }
-  }
+function formatPluginDebugLine(params) {
+  return `[${formatPluginDebugTimestamp(params.date)}] [debug] [dingtalk] [account:${params.accountId}] ${params.message}`;
 }
-
-// src/message-context-store.ts
-var MESSAGE_CONTEXT_NAMESPACE = "messages.context";
-var MESSAGE_CONTEXT_VERSION = 1;
-var DEFAULT_MESSAGE_CONTEXT_TTL_DAYS = 7;
-var DEFAULT_CARD_CONTENT_TTL_MS = 24 * 60 * 60 * 1e3;
-var DEFAULT_MEDIA_CONTEXT_TTL_MS = 24 * 60 * 60 * 1e3;
-var DEFAULT_CREATED_AT_MATCH_WINDOW_MS = 2e3;
-var MAX_RECORDS_PER_SCOPE = 1e3;
-var DEFAULT_OUTBOUND_SENDER = {
-  senderId: "bot",
-  senderName: "OpenClaw"
-};
-function inferConversationChatType(conversationId) {
-  return conversationId.startsWith("cid") ? "group" : "direct";
+function buildPluginDebugWriterKey(params) {
+  return JSON.stringify([params.storePath, params.accountId, formatPluginDebugDate(params.date)]);
 }
-var stateCache = /* @__PURE__ */ new Map();
-function getScopeKey(params) {
-  return JSON.stringify([
-    params.storePath || "__memory__",
-    params.accountId,
-    params.conversationId || null
-  ]);
+function buildPluginDebugScopeKey(params) {
+  return JSON.stringify([params.storePath, params.accountId]);
 }
-function fallbackState() {
-  return {
-    version: MESSAGE_CONTEXT_VERSION,
-    updatedAt: Date.now(),
-    records: {},
-    byAlias: {},
-    recentByCreatedAt: []
+function resolvePluginDebugWriter(params) {
+  const key = buildPluginDebugWriterKey(params);
+  const existing = pluginDebugWriters.get(key);
+  if (existing) {
+    return existing;
+  }
+  const created = {
+    filePath: resolvePluginDebugLogFilePath(params),
+    warned: false,
+    directoryReady: false
   };
+  pluginDebugWriters.set(key, created);
+  return created;
 }
-function asRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
+function resolvePluginDebugLog(params) {
+  const baseLog = params.baseLog;
+  const fsImpl = params.fsImpl ?? fs;
+  const scopeKey = params.storePath ? buildPluginDebugScopeKey({ storePath: params.storePath, accountId: params.accountId }) : void 0;
+  if (scopeKey) {
+    closedPluginDebugScopes.delete(scopeKey);
   }
-  return value;
+  return {
+    debug: (message) => {
+      if (!params.debug) {
+        baseLog?.debug?.(message);
+        return;
+      }
+      const date = params.now ? params.now() : /* @__PURE__ */ new Date();
+      const line = formatPluginDebugLine({
+        accountId: params.accountId,
+        date,
+        message
+      });
+      try {
+        process.stdout.write(`${line}
+`);
+      } catch {
+      }
+      if (params.storePath && scopeKey && !closedPluginDebugScopes.has(scopeKey)) {
+        const writer = resolvePluginDebugWriter({
+          storePath: params.storePath,
+          accountId: params.accountId,
+          date
+        });
+        try {
+          if (!writer.directoryReady) {
+            fsImpl.mkdirSync(path2.dirname(writer.filePath), { recursive: true });
+            writer.directoryReady = true;
+          }
+          fsImpl.appendFileSync(writer.filePath, `${line}
+`, "utf8");
+        } catch (err) {
+          if (!writer.warned) {
+            writer.warned = true;
+            baseLog?.warn?.(
+              `[DingTalk] Plugin debug log file unavailable: accountId=${params.accountId} path=${writer.filePath} error=${getErrorMessage(err)}`
+            );
+          }
+        }
+      }
+      try {
+        baseLog?.debug?.(message);
+      } catch {
+      }
+    },
+    info: (message) => baseLog?.info?.(message),
+    warn: (message) => baseLog?.warn?.(message),
+    error: (message) => baseLog?.error?.(message)
+  };
 }
-function normalizeMedia(value) {
-  const candidate = asRecord(value);
-  if (!candidate) {
-    return void 0;
+function closePluginDebugLog(params) {
+  if (!params.storePath) {
+    return;
   }
-  const downloadCode = typeof candidate.downloadCode === "string" && candidate.downloadCode.trim() ? candidate.downloadCode.trim() : void 0;
-  const downloadCodes = Array.isArray(candidate.downloadCodes) && candidate.downloadCodes.length > 0 ? candidate.downloadCodes.filter((c) => typeof c === "string" && c.trim()) : void 0;
-  const spaceId = typeof candidate.spaceId === "string" && candidate.spaceId.trim() ? candidate.spaceId.trim() : void 0;
-  const fileId = typeof candidate.fileId === "string" && candidate.fileId.trim() ? candidate.fileId.trim() : void 0;
-  if (!downloadCode && (!downloadCodes || downloadCodes.length === 0) && !spaceId && !fileId) {
-    return void 0;
+  const scopeKey = buildPluginDebugScopeKey({
+    storePath: params.storePath,
+    accountId: params.accountId
+  });
+  closedPluginDebugScopes.add(scopeKey);
+  for (const key of pluginDebugWriters.keys()) {
+    const [writerStorePath, writerAccountId] = JSON.parse(key);
+    if (writerStorePath === params.storePath && writerAccountId === params.accountId) {
+      pluginDebugWriters.delete(key);
+    }
   }
-  return { downloadCode, downloadCodes, spaceId, fileId };
 }
-function normalizeQuotedRef(value) {
-  const candidate = asRecord(value);
-  if (!candidate) {
-    return void 0;
-  }
-  const targetDirection = candidate.targetDirection === "outbound" ? "outbound" : candidate.targetDirection === "inbound" ? "inbound" : void 0;
-  const key = candidate.key === "msgId" || candidate.key === "messageId" || candidate.key === "processQueryKey" || candidate.key === "outTrackId" || candidate.key === "cardInstanceId" ? candidate.key : void 0;
-  const valueString = typeof candidate.value === "string" && candidate.value.trim() ? candidate.value.trim() : void 0;
-  const fallbackCreatedAt = typeof candidate.fallbackCreatedAt === "number" && Number.isFinite(candidate.fallbackCreatedAt) ? candidate.fallbackCreatedAt : void 0;
-  if (!targetDirection) {
-    return void 0;
-  }
-  if (!key && !fallbackCreatedAt) {
-    return void 0;
+function maskSensitiveData(data) {
+  if (data === null || data === void 0) {
+    return data;
   }
-  if (key && !valueString) {
-    return void 0;
+  if (typeof data !== "object") {
+    return data;
   }
-  return {
-    targetDirection,
-    key,
-    value: valueString,
-    fallbackCreatedAt
-  };
-}
-function normalizeAttachmentTextSource(value) {
-  return value === "text" || value === "html" || value === "pdf" || value === "docx" ? value : void 0;
-}
-function normalizeDelivery(value) {
-  const candidate = asRecord(value);
-  if (!candidate) {
-    return void 0;
-  }
-  const messageId = typeof candidate.messageId === "string" && candidate.messageId.trim() ? candidate.messageId.trim() : void 0;
-  const processQueryKey = typeof candidate.processQueryKey === "string" && candidate.processQueryKey.trim() ? candidate.processQueryKey.trim() : void 0;
-  const outTrackId = typeof candidate.outTrackId === "string" && candidate.outTrackId.trim() ? candidate.outTrackId.trim() : void 0;
-  const cardInstanceId = typeof candidate.cardInstanceId === "string" && candidate.cardInstanceId.trim() ? candidate.cardInstanceId.trim() : void 0;
-  const kind = typeof candidate.kind === "string" && candidate.kind.trim() ? candidate.kind.trim() : void 0;
-  if (!messageId && !processQueryKey && !outTrackId && !cardInstanceId && !kind) {
-    return void 0;
+  const masked = JSON.parse(JSON.stringify(data));
+  const sensitiveFields = /* @__PURE__ */ new Set(["token", "accessToken"]);
+  function maskObj(obj) {
+    for (const key in obj) {
+      if (sensitiveFields.has(key)) {
+        const val = obj[key];
+        if (typeof val === "string" && val.length > 6) {
+          obj[key] = val.slice(0, 3) + "*".repeat(val.length - 6) + val.slice(-3);
+        } else if (typeof val === "string") {
+          obj[key] = "*".repeat(val.length);
+        }
+      } else if (typeof obj[key] === "object" && obj[key] !== null && !Array.isArray(obj[key])) {
+        maskObj(obj[key]);
+      }
+    }
   }
-  return { messageId, processQueryKey, outTrackId, cardInstanceId, kind };
+  maskObj(masked);
+  return masked;
 }
-function normalizeMentions(value) {
-  if (!Array.isArray(value)) {
-    return void 0;
+function stringifyUnknown(value) {
+  if (typeof value === "string") {
+    return value;
   }
-  const normalized = [...new Set(value.map((item) => String(item || "").trim()).filter(Boolean))];
-  return normalized.length > 0 ? normalized : void 0;
-}
-function normalizeMessageRecord(value) {
-  const candidate = asRecord(value);
-  if (!candidate) {
-    return null;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
   }
-  const msgId = typeof candidate.msgId === "string" && candidate.msgId.trim() ? candidate.msgId.trim() : "";
-  const direction = candidate.direction === "outbound" ? "outbound" : candidate.direction === "inbound" ? "inbound" : null;
-  const accountId = typeof candidate.accountId === "string" && candidate.accountId.trim() ? candidate.accountId.trim() : "";
-  const conversationId = typeof candidate.conversationId === "string" && candidate.conversationId.trim() ? candidate.conversationId.trim() : null;
-  const createdAt = typeof candidate.createdAt === "number" && Number.isFinite(candidate.createdAt) ? candidate.createdAt : NaN;
-  const updatedAt = typeof candidate.updatedAt === "number" && Number.isFinite(candidate.updatedAt) ? candidate.updatedAt : Date.now();
-  if (!msgId || !direction || !accountId || !Number.isFinite(createdAt)) {
-    return null;
+  try {
+    const serialized = JSON.stringify(value);
+    return serialized ?? String(value);
+  } catch {
+    return "[unserializable]";
   }
-  const expiresAt = typeof candidate.expiresAt === "number" && Number.isFinite(candidate.expiresAt) ? candidate.expiresAt : void 0;
-  return {
-    msgId,
-    direction,
-    topic: candidate.topic === null ? null : typeof candidate.topic === "string" ? candidate.topic : null,
-    accountId,
-    conversationId,
-    createdAt,
-    updatedAt,
-    expiresAt,
-    messageType: typeof candidate.messageType === "string" ? candidate.messageType : void 0,
-    text: typeof candidate.text === "string" ? candidate.text : void 0,
-    attachmentText: typeof candidate.attachmentText === "string" ? candidate.attachmentText : void 0,
-    attachmentTextSource: normalizeAttachmentTextSource(candidate.attachmentTextSource),
-    attachmentTextTruncated: candidate.attachmentTextTruncated === true ? true : void 0,
-    attachmentFileName: typeof candidate.attachmentFileName === "string" ? candidate.attachmentFileName : void 0,
-    quotedRef: normalizeQuotedRef(candidate.quotedRef),
-    senderId: typeof candidate.senderId === "string" && candidate.senderId.trim() ? candidate.senderId.trim() : void 0,
-    senderName: typeof candidate.senderName === "string" && candidate.senderName.trim() ? candidate.senderName.trim() : void 0,
-    mentions: normalizeMentions(candidate.mentions),
-    chatType: candidate.chatType === "direct" || candidate.chatType === "group" ? candidate.chatType : void 0,
-    quotedMessageId: typeof candidate.quotedMessageId === "string" && candidate.quotedMessageId.trim() ? candidate.quotedMessageId.trim() : void 0,
-    media: normalizeMedia(candidate.media),
-    delivery: normalizeDelivery(candidate.delivery)
-  };
 }
-function buildAliasKey(kind, value) {
-  return `${kind}:${value.trim()}`;
-}
-function buildAliasEntries(record) {
-  const aliases = [];
-  if (record.direction === "inbound" && record.msgId.trim()) {
-    aliases.push([buildAliasKey("inboundMsgId", record.msgId), record.msgId]);
-  }
-  const delivery = record.delivery;
-  if (!delivery) {
-    return aliases;
+function parseBooleanLike(value) {
+  if (typeof value === "boolean") {
+    return value;
   }
-  if (delivery.messageId) {
-    aliases.push([buildAliasKey("messageId", delivery.messageId), record.msgId]);
+  if (typeof value === "number") {
+    if (value === 1) {
+      return true;
+    }
+    if (value === 0) {
+      return false;
+    }
+    return void 0;
   }
-  if (delivery.processQueryKey) {
-    aliases.push([buildAliasKey("processQueryKey", delivery.processQueryKey), record.msgId]);
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["1", "true", "yes", "y", "on"].includes(normalized)) {
+      return true;
+    }
+    if (["0", "false", "no", "n", "off"].includes(normalized)) {
+      return false;
+    }
   }
-  if (delivery.outTrackId) {
-    aliases.push([buildAliasKey("outTrackId", delivery.outTrackId), record.msgId]);
+  return void 0;
+}
+function getErrorMessage(err) {
+  if (err instanceof Error && err.message) {
+    return err.message;
   }
-  if (delivery.cardInstanceId) {
-    aliases.push([buildAliasKey("cardInstanceId", delivery.cardInstanceId), record.msgId]);
+  if (err && typeof err === "object") {
+    const record = err;
+    if (typeof record.message === "string" && record.message.trim()) {
+      return record.message;
+    }
   }
-  return aliases;
+  return stringifyUnknown(err);
 }
-function isRecordExpired(record, nowMs) {
-  return typeof record.expiresAt === "number" && Number.isFinite(record.expiresAt) && nowMs >= record.expiresAt;
+function getErrorResponseData(err) {
+  if (!err || typeof err !== "object") {
+    return void 0;
+  }
+  return err.response?.data;
 }
-function normalizeState(state, nowMs) {
-  const normalizedRecords = {};
-  const sortedRecords = Object.values(state.records).map((record) => normalizeMessageRecord(record)).filter((record) => record !== null).filter((record) => !isRecordExpired(record, nowMs)).toSorted((left, right) => left.createdAt - right.createdAt);
-  const keptRecords = sortedRecords.slice(-MAX_RECORDS_PER_SCOPE);
-  for (const record of keptRecords) {
-    normalizedRecords[record.msgId] = record;
+function formatDingTalkErrorPayload(payload) {
+  if (payload === null || payload === void 0) {
+    return "payload=unknown";
   }
-  const byAlias = {};
-  for (const record of keptRecords) {
-    for (const [key, value] of buildAliasEntries(record)) {
-      byAlias[key] = value;
+  let code;
+  let message;
+  if (typeof payload === "object" && !Array.isArray(payload)) {
+    const obj = payload;
+    if (typeof obj.code === "string" || typeof obj.code === "number") {
+      code = String(obj.code);
     }
-  }
-  return {
-    removed: Object.keys(state.records).length - Object.keys(normalizedRecords).length,
-    state: {
-      version: MESSAGE_CONTEXT_VERSION,
-      updatedAt: state.updatedAt,
-      records: normalizedRecords,
-      byAlias,
-      recentByCreatedAt: keptRecords.map((record) => record.msgId)
+    if (typeof obj.message === "string") {
+      message = obj.message;
     }
-  };
-}
-function hydrateState(params, nowMs) {
-  if (!params.storePath) {
-    return fallbackState();
   }
-  const persisted = readNamespaceJson(
-    MESSAGE_CONTEXT_NAMESPACE,
-    {
-      storePath: params.storePath,
-      scope: { accountId: params.accountId, conversationId: params.conversationId || void 0 },
-      format: "json",
-      fallback: { version: MESSAGE_CONTEXT_VERSION, updatedAt: Date.now(), records: {} }
-    }
-  );
-  const parsedRecords = asRecord(persisted.records) || {};
-  const hydrated = fallbackState();
-  hydrated.updatedAt = typeof persisted.updatedAt === "number" ? persisted.updatedAt : Date.now();
-  for (const [key, value] of Object.entries(parsedRecords)) {
-    const normalized = normalizeMessageRecord(value);
-    if (normalized) {
-      hydrated.records[key] = normalized;
+  let serialized;
+  try {
+    serialized = JSON.stringify(maskSensitiveData(payload));
+  } catch {
+    if (typeof payload === "string") {
+      serialized = payload;
+    } else if (typeof payload === "number" || typeof payload === "boolean" || typeof payload === "bigint") {
+      serialized = `${payload}`;
+    } else {
+      serialized = "[unserializable-payload]";
     }
   }
-  return normalizeState(hydrated, nowMs).state;
-}
-function loadState(params, nowMs = Date.now()) {
-  const scopeKey = getScopeKey(params);
-  const cached = stateCache.get(scopeKey);
-  if (cached) {
-    return cached;
+  const parts = [];
+  if (code) {
+    parts.push(`code=${code}`);
   }
-  const hydrated = params.storePath ? hydrateState(params, nowMs) : fallbackState();
-  stateCache.set(scopeKey, hydrated);
-  return hydrated;
-}
-function writeState(params, state) {
-  stateCache.set(getScopeKey(params), state);
-  if (!params.storePath) {
-    return;
+  if (message) {
+    parts.push(`message=${message}`);
   }
-  writeNamespaceJsonAtomic(MESSAGE_CONTEXT_NAMESPACE, {
-    storePath: params.storePath,
-    scope: { accountId: params.accountId, conversationId: params.conversationId || void 0 },
-    format: "json",
-    data: {
-      version: MESSAGE_CONTEXT_VERSION,
-      updatedAt: state.updatedAt,
-      records: state.records
-    }
-  });
+  parts.push(`payload=${serialized}`);
+  return parts.join(" ");
 }
-function cloneStateForMutation(state) {
-  return {
-    version: state.version,
-    updatedAt: state.updatedAt,
-    records: { ...state.records },
-    byAlias: state.byAlias,
-    recentByCreatedAt: state.recentByCreatedAt
-  };
+function formatDingTalkErrorPayloadLog(scope, payload, prefix = "[DingTalk]") {
+  return `${prefix}[ErrorPayload][${scope}] ${formatDingTalkErrorPayload(payload)}`;
 }
-function mergeText(existing, next) {
-  if (typeof next !== "string") {
-    return existing;
-  }
-  return next;
+function getProxyBypassOption(config) {
+  return config?.bypassProxyForSend ? { proxy: false } : {};
 }
-function mergeAttachmentText(existing, next) {
-  if (typeof next !== "string") {
-    return existing;
-  }
-  return next;
+function createResolve4FallbackLookup(log, accountId) {
+  return createResolve4FallbackLookupWithDeps(log, accountId, dns, net);
 }
-function mergeQuotedRef(existing, next) {
-  if (!existing) {
-    return next;
-  }
-  if (!next) {
-    return existing;
-  }
-  return {
-    targetDirection: next.targetDirection,
-    key: next.key || existing.key,
-    value: next.value || existing.value,
-    fallbackCreatedAt: next.fallbackCreatedAt ?? existing.fallbackCreatedAt
+function createResolve4FallbackLookupWithDeps(log, accountId, dnsImpl, netImpl) {
+  let fallbackLogged = false;
+  return (hostname, options, callback) => {
+    const ipFamily = netImpl.isIP(hostname);
+    if (ipFamily !== 0) {
+      if (options.all) {
+        callback(null, [{ address: hostname, family: ipFamily }], ipFamily);
+        return;
+      }
+      callback(null, hostname, ipFamily);
+      return;
+    }
+    dnsImpl.lookup(hostname, options, (lookupErr, address, family) => {
+      if (!lookupErr) {
+        callback(null, address, family);
+        return;
+      }
+      if (lookupErr.code !== "ENOTFOUND") {
+        callback(lookupErr, address, family);
+        return;
+      }
+      dnsImpl.resolve4(hostname, (resolveErr, addresses) => {
+        if (resolveErr || !addresses || addresses.length === 0) {
+          callback(lookupErr, address, family);
+          return;
+        }
+        if (!fallbackLogged) {
+          fallbackLogged = true;
+          log?.warn?.(
+            `[${accountId ?? "default"}] System DNS lookup failed for ${hostname} (ENOTFOUND); using resolve4 fallback ${addresses[0]}`
+          );
+        }
+        if (options.all) {
+          callback(
+            null,
+            addresses.map((item) => ({ address: item, family: 4 })),
+            4
+          );
+          return;
+        }
+        callback(null, addresses[0], 4);
+      });
+    });
   };
 }
-function mergeStringField(existing, next) {
-  if (typeof next !== "string" || !next.trim()) {
-    return existing;
+function getHeaderCaseInsensitive(headers, key) {
+  if (!headers || typeof headers !== "object" || Array.isArray(headers)) {
+    return void 0;
   }
-  return next.trim();
-}
-function mergeMentions(existing, next) {
-  if (!next) {
-    return existing;
+  const entries = Object.entries(headers);
+  const matched = entries.find(([name]) => name.toLowerCase() === key.toLowerCase());
+  if (!matched) {
+    return void 0;
   }
-  return normalizeMentions(next) || existing;
-}
-function mergeMedia(existing, next) {
-  if (!existing) {
-    return next;
+  const value = matched[1];
+  if (Array.isArray(value)) {
+    return value.length > 0 ? String(value[0]) : void 0;
   }
-  if (!next) {
-    return existing;
+  if (value === null || value === void 0) {
+    return void 0;
   }
-  return {
-    downloadCode: next.downloadCode || existing.downloadCode,
-    downloadCodes: next.downloadCodes || existing.downloadCodes,
-    spaceId: next.spaceId || existing.spaceId,
-    fileId: next.fileId || existing.fileId
-  };
-}
-function mergeDelivery(existing, next) {
-  if (!existing) {
-    return next;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
   }
-  if (!next) {
-    return existing;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
   }
-  return {
-    messageId: next.messageId || existing.messageId,
-    processQueryKey: next.processQueryKey || existing.processQueryKey,
-    outTrackId: next.outTrackId || existing.outTrackId,
-    cardInstanceId: next.cardInstanceId || existing.cardInstanceId,
-    kind: next.kind || existing.kind
-  };
-}
-function mergeAttachmentTextSource(existing, next) {
-  return next ?? existing;
 }
-function mergeAttachmentTextTruncated(existing, next) {
-  return next === void 0 ? existing : next;
-}
-function mergeAttachmentFileName(existing, next) {
-  if (typeof next !== "string") {
-    return existing;
+function formatDingTalkConnectionErrorLog(scope, err, baseMessage) {
+  if (!err || typeof err !== "object") {
+    return null;
   }
-  return next;
-}
-function resolveExistingMsgId(state, params, nowMs) {
-  if (params.direction === "inbound" && params.msgId) {
-    const direct = state.records[params.msgId];
-    if (direct && !isRecordExpired(direct, nowMs)) {
-      return params.msgId;
-    }
+  const errRecord = err;
+  const stage = typeof errRecord.dingtalkConnectionStage === "string" ? errRecord.dingtalkConnectionStage : scope;
+  const endpoint = typeof errRecord.dingtalkConnectionEndpoint === "string" ? errRecord.dingtalkConnectionEndpoint : void 0;
+  const hasResponse = "response" in errRecord && errRecord.response !== null && errRecord.response !== void 0;
+  if (!hasResponse && !endpoint && stage === scope) {
+    return null;
   }
-  const delivery = params.delivery;
-  if (!delivery) {
-    return void 0;
+  const parts = [`${baseMessage} [DingTalk][ConnectionError][${stage}]`];
+  if (endpoint) {
+    parts.push(`endpoint=${endpoint}`);
   }
-  const candidates = [
-    ["messageId", delivery.messageId],
-    ["processQueryKey", delivery.processQueryKey],
-    ["outTrackId", delivery.outTrackId],
-    ["cardInstanceId", delivery.cardInstanceId]
-  ];
-  for (const [kind, value] of candidates) {
-    if (!value) {
-      continue;
+  const response = err.response;
+  if (response) {
+    if (response.status !== void 0 && response.status !== null) {
+      const statusText = typeof response.status === "string" || typeof response.status === "number" || typeof response.status === "boolean" || typeof response.status === "bigint" ? String(response.status) : JSON.stringify(response.status);
+      parts.push(`status=${statusText}`);
     }
-    const aliasHit = state.byAlias[buildAliasKey(kind, value)];
-    if (!aliasHit) {
-      continue;
+    let requestId = getHeaderCaseInsensitive(response.headers, "x-acs-dingtalk-request-id");
+    if (!requestId && response.data && typeof response.data === "object" && !Array.isArray(response.data)) {
+      const data = response.data;
+      if (typeof data.requestId === "string") {
+        requestId = data.requestId;
+      } else if (typeof data.requestid === "string") {
+        requestId = data.requestid;
+      }
     }
-    const record = state.records[aliasHit];
-    if (record && !isRecordExpired(record, nowMs)) {
-      return aliasHit;
+    if (requestId) {
+      parts.push(`requestId=${requestId}`);
+    }
+    if (response.data !== void 0) {
+      parts.push(formatDingTalkErrorPayload(response.data));
     }
   }
-  return void 0;
-}
-function computeExpiresAt(nowMs, ttlMs, ttlReferenceMs) {
-  if (typeof ttlMs !== "number" || !Number.isFinite(ttlMs) || ttlMs <= 0) {
-    return void 0;
+  if (stage === "connect.websocket") {
+    parts.push("Likely websocket/proxy/WSS issue after connections/open succeeded");
   }
-  return (typeof ttlReferenceMs === "number" && Number.isFinite(ttlReferenceMs) ? ttlReferenceMs : nowMs) + ttlMs;
+  parts.push("See docs/connection-troubleshooting.md or run scripts/dingtalk-connection-check.*");
+  return parts.join(" ");
 }
-function pruneStateByCreatedAt(state, ttlDays, nowMs) {
-  if (!ttlDays || ttlDays <= 0) {
-    return { state, removed: 0 };
-  }
-  const cutoff = nowMs - ttlDays * 24 * 60 * 60 * 1e3;
-  const nextRecords = {};
-  for (const [msgId, record] of Object.entries(state.records)) {
-    if (record.createdAt >= cutoff) {
-      nextRecords[msgId] = record;
+function cleanupOrphanedTempFiles(log) {
+  const tempDir = os2.tmpdir();
+  const dingtalkPattern = /^dingtalk_\d+\..+$/;
+  let cleaned = 0;
+  try {
+    const files = fs.readdirSync(tempDir);
+    const now = Date.now();
+    const maxAge = 24 * 60 * 60 * 1e3;
+    for (const file of files) {
+      if (!dingtalkPattern.test(file)) {
+        continue;
+      }
+      const filePath = path2.join(tempDir, file);
+      try {
+        const stats = fs.statSync(filePath);
+        if (now - stats.mtime.getTime() > maxAge) {
+          fs.unlinkSync(filePath);
+          cleaned++;
+          log?.debug?.(`[DingTalk] Cleaned up orphaned temp file: ${file}`);
+        }
+      } catch (err) {
+        log?.debug?.(`[DingTalk] Failed to cleanup temp file ${file}: ${getErrorMessage(err)}`);
+      }
     }
+    if (cleaned > 0) {
+      log?.info?.(`[DingTalk] Cleaned up ${cleaned} orphaned temp files`);
+    }
+  } catch (err) {
+    log?.debug?.(`[DingTalk] Failed to cleanup temp directory: ${getErrorMessage(err)}`);
   }
-  const removed = Object.keys(state.records).length - Object.keys(nextRecords).length;
-  if (removed === 0) {
-    return { state, removed: 0 };
-  }
-  return {
-    removed,
-    state: {
-      ...state,
-      records: nextRecords
+  return cleaned;
+}
+async function retryWithBackoff(fn, options = {}) {
+  const { maxRetries = 3, baseDelayMs = 100, log } = options;
+  for (let attempt = 1; attempt <= maxRetries; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      const statusCode = err.response?.status;
+      const isRetryable = statusCode === 401 || statusCode === 429 || statusCode && statusCode >= 500;
+      const responseData = getErrorResponseData(err);
+      if (responseData !== void 0) {
+        log?.debug?.(formatDingTalkErrorPayloadLog("retry.beforeDecision", responseData));
+      }
+      if (!isRetryable || attempt === maxRetries) {
+        throw err;
+      }
+      const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
+      log?.debug?.(`[DingTalk] Retry attempt ${attempt}/${maxRetries} after ${delayMs}ms`);
+      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
     }
-  };
+  }
+  throw new Error("Retry exhausted without returning");
 }
-function upsertRecord(params) {
-  const nowMs = params.updatedAt ?? Date.now();
-  let state = cloneStateForMutation(loadState(params, nowMs));
-  if (params.cleanupCreatedAtTtlDays && params.cleanupCreatedAtTtlDays > 0) {
-    state = pruneStateByCreatedAt(state, params.cleanupCreatedAtTtlDays, nowMs).state;
+function getCurrentTimestamp() {
+  return Date.now();
+}
+
+// src/auth.ts
+var accessTokenCache = /* @__PURE__ */ new Map();
+async function getAccessToken(config, log) {
+  const cacheKey = config.clientId;
+  const now = Date.now();
+  const cached = accessTokenCache.get(cacheKey);
+  if (cached && cached.expiry > now + 6e4) {
+    return cached.accessToken;
   }
-  const existingMsgId = resolveExistingMsgId(
-    state,
-    {
-      direction: params.direction,
-      msgId: params.msgId,
-      delivery: params.delivery
+  const runtimeConfig = await resolveRuntimeConfig(config, log);
+  const token = await retryWithBackoff(
+    async () => {
+      const response = await http_client_default.post(
+        "https://api.dingtalk.com/v1.0/oauth2/accessToken",
+        {
+          appKey: runtimeConfig.clientId,
+          appSecret: runtimeConfig.clientSecret
+        }
+      );
+      accessTokenCache.set(cacheKey, {
+        accessToken: response.data.accessToken,
+        expiry: now + response.data.expireIn * 1e3
+      });
+      return response.data.accessToken;
     },
-    nowMs
+    { maxRetries: 3, log }
   );
-  const canonicalMsgId = existingMsgId || params.msgId || params.delivery?.messageId || params.delivery?.processQueryKey || params.delivery?.outTrackId;
-  if (!canonicalMsgId || !canonicalMsgId.trim()) {
-    return void 0;
+  return token;
+}
+
+// src/channel.ts
+import { buildChannelConfigSchema } from "openclaw/plugin-sdk/core";
+
+// src/config-schema.ts
+import { z as z2 } from "zod";
+
+// src/persistence-store.ts
+import * as fs2 from "node:fs";
+import * as path3 from "node:path";
+var NAMESPACE_ROOT_DIR = "dingtalk-state";
+function toErrorMessage(err) {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
   }
-  const existing = state.records[canonicalMsgId];
-  const expiresAt = computeExpiresAt(nowMs, params.ttlMs, params.ttlReferenceMs);
-  const normalizedQuotedRef = normalizeQuotedRef(params.quotedRef);
-  state.records[canonicalMsgId] = {
-    msgId: canonicalMsgId,
-    direction: params.direction,
-    topic: params.topic ?? existing?.topic ?? null,
-    accountId: params.accountId,
-    conversationId: params.conversationId,
-    createdAt: existing?.createdAt ?? params.createdAt,
-    updatedAt: nowMs,
-    expiresAt: expiresAt === void 0 ? existing?.expiresAt : Math.max(expiresAt, existing?.expiresAt ?? 0),
-    messageType: params.messageType || existing?.messageType,
-    text: mergeText(existing?.text, params.text),
-    attachmentText: mergeAttachmentText(existing?.attachmentText, params.attachmentText),
-    attachmentTextSource: mergeAttachmentTextSource(
-      existing?.attachmentTextSource,
-      params.attachmentTextSource
-    ),
-    attachmentTextTruncated: mergeAttachmentTextTruncated(
-      existing?.attachmentTextTruncated,
-      params.attachmentTextTruncated
-    ),
-    attachmentFileName: mergeAttachmentFileName(
-      existing?.attachmentFileName,
-      params.attachmentFileName
-    ),
-    quotedRef: mergeQuotedRef(existing?.quotedRef, normalizedQuotedRef),
-    senderId: mergeStringField(existing?.senderId, params.senderId),
-    senderName: mergeStringField(existing?.senderName, params.senderName),
-    mentions: mergeMentions(existing?.mentions, params.mentions),
-    chatType: params.chatType || existing?.chatType,
-    quotedMessageId: mergeStringField(existing?.quotedMessageId, params.quotedMessageId),
-    media: mergeMedia(existing?.media, params.media),
-    delivery: mergeDelivery(existing?.delivery, params.delivery)
-  };
-  state.updatedAt = nowMs;
-  writeState(params, normalizeState(state, nowMs).state);
-  return canonicalMsgId;
 }
-function upsertInboundMessageContext(params) {
-  return upsertRecord({
-    ...params,
-    direction: "inbound",
-    topic: params.topic ?? null,
-    msgId: params.msgId,
-    cleanupCreatedAtTtlDays: params.cleanupCreatedAtTtlDays
-  }) || params.msgId;
+function sanitizeSegment(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
-function upsertOutboundMessageContext(params) {
-  return upsertRecord({
-    ...params,
-    direction: "outbound",
-    topic: params.topic ?? null
-  });
+function encodeScopeValue(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
 }
-function resolveByMsgId(params) {
-  const nowMs = params.nowMs ?? Date.now();
-  const state = loadState(params, nowMs);
-  const direct = state.records[params.msgId];
-  if (direct && !isRecordExpired(direct, nowMs)) {
-    return direct;
+function buildScopeSuffix(scope) {
+  if (!scope) {
+    return "";
   }
-  const aliasTarget = state.byAlias[buildAliasKey("inboundMsgId", params.msgId)];
-  if (!aliasTarget) {
-    return null;
+  const ordered = [
+    ["accountId", scope.accountId],
+    ["agentId", scope.agentId],
+    ["conversationId", scope.conversationId],
+    ["groupId", scope.groupId],
+    ["targetId", scope.targetId]
+  ];
+  const segments = ordered.filter(([, value]) => Boolean(value && value.trim())).map(([key, value]) => `${key.replace(/Id$/, "")}-${encodeScopeValue((value || "").trim())}`);
+  if (segments.length === 0) {
+    return "";
   }
-  const record = state.records[aliasTarget];
-  return record && !isRecordExpired(record, nowMs) ? record : null;
+  return `.${segments.join(".")}`;
 }
-function resolveByAlias(params) {
-  const nowMs = params.nowMs ?? Date.now();
-  const state = loadState(params, nowMs);
-  const msgId = state.byAlias[buildAliasKey(params.kind, params.value)];
-  if (!msgId) {
-    return null;
-  }
-  const record = state.records[msgId];
-  return record && !isRecordExpired(record, nowMs) ? record : null;
+function resolveNamespacePath(namespace, options) {
+  const format = options.format || "json";
+  const baseDir = path3.join(path3.dirname(options.storePath), NAMESPACE_ROOT_DIR);
+  const safeNamespace = sanitizeSegment(namespace.trim());
+  const suffix = buildScopeSuffix(options.scope);
+  return path3.join(baseDir, `${safeNamespace}${suffix}.${format}`);
 }
-function resolveByQuotedRef(params) {
-  const nowMs = params.nowMs ?? Date.now();
-  const quotedRef = normalizeQuotedRef(params.quotedRef);
-  const log = params.log;
-  if (!quotedRef) {
-    log?.debug?.(
-      `[DingTalk][QuotedRef] Resolve skipped: invalid quotedRef accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
-    );
-    return null;
-  }
-  if (quotedRef.targetDirection === "inbound") {
-    if (quotedRef.key !== "msgId" || !quotedRef.value) {
-      log?.debug?.(
-        `[DingTalk][QuotedRef] Resolve skipped: inbound quotedRef missing msgId accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
-      );
-      return null;
+function readNamespaceJson(namespace, options) {
+  const filePath = resolveNamespacePath(namespace, options);
+  try {
+    if (!fs2.existsSync(filePath)) {
+      return options.fallback;
     }
-    const record = resolveByMsgId({
-      ...params,
-      msgId: quotedRef.value,
-      nowMs
-    });
-    log?.debug?.(
-      `[DingTalk][QuotedRef] Resolve inbound by msgId=${quotedRef.value} hit=${record ? "yes" : "no"} accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
-    );
-    return record;
-  }
-  if (quotedRef.key && quotedRef.value && quotedRef.key !== "msgId") {
-    const aliasRecord = resolveByAlias({
-      ...params,
-      kind: quotedRef.key,
-      value: quotedRef.value,
-      nowMs
-    });
-    if (aliasRecord) {
-      log?.debug?.(
-        `[DingTalk][QuotedRef] Resolve outbound by ${quotedRef.key}=${quotedRef.value} hit=yes accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
-      );
-      return aliasRecord;
+    const raw = fs2.readFileSync(filePath, "utf-8");
+    if (!raw.trim()) {
+      return options.fallback;
     }
-    log?.debug?.(
-      `[DingTalk][QuotedRef] Resolve outbound by ${quotedRef.key}=${quotedRef.value} hit=no accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
-    );
-  }
-  if (typeof quotedRef.fallbackCreatedAt === "number" && Number.isFinite(quotedRef.fallbackCreatedAt)) {
-    const record = resolveByCreatedAtWindow({
-      ...params,
-      createdAt: quotedRef.fallbackCreatedAt,
-      direction: "outbound",
-      nowMs
-    });
-    log?.debug?.(
-      `[DingTalk][QuotedRef] Resolve outbound by createdAt=${quotedRef.fallbackCreatedAt} hit=${record ? "yes" : "no"} accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+    return JSON.parse(raw);
+  } catch (err) {
+    options.log?.warn?.(
+      `[DingTalk][Persistence] Failed to read namespace=${namespace} path=${filePath}: ${toErrorMessage(err)}`
     );
-    return record;
+    return options.fallback;
   }
-  log?.debug?.(
-    `[DingTalk][QuotedRef] Resolve outbound missed without createdAt fallback accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
-  );
-  return null;
 }
-function resolveByCreatedAtWindow(params) {
-  const nowMs = params.nowMs ?? Date.now();
-  const windowMs = params.windowMs ?? DEFAULT_CREATED_AT_MATCH_WINDOW_MS;
-  const state = loadState(params, nowMs);
-  let bestRecord = null;
-  let bestDelta = Infinity;
-  for (const msgId of state.recentByCreatedAt) {
-    const record = state.records[msgId];
-    if (!record || isRecordExpired(record, nowMs)) {
-      continue;
-    }
-    if (params.direction && record.direction !== params.direction) {
-      continue;
+function writeNamespaceJsonAtomic(namespace, options) {
+  const filePath = resolveNamespacePath(namespace, options);
+  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    fs2.mkdirSync(path3.dirname(filePath), { recursive: true });
+    fs2.writeFileSync(tempPath, JSON.stringify(options.data, null, 2));
+    try {
+      fs2.renameSync(tempPath, filePath);
+    } catch (err) {
+      if (fs2.existsSync(filePath)) {
+        fs2.rmSync(filePath, { force: true });
+        fs2.renameSync(tempPath, filePath);
+      } else {
+        throw err;
+      }
     }
-    const delta = Math.abs(record.createdAt - params.createdAt);
-    if (delta <= windowMs && delta < bestDelta) {
-      bestDelta = delta;
-      bestRecord = record;
+  } catch (err) {
+    options.log?.warn?.(
+      `[DingTalk][Persistence] Failed to write namespace=${namespace} path=${filePath}: ${toErrorMessage(err)}`
+    );
+    if (fs2.existsSync(tempPath)) {
+      fs2.rmSync(tempPath, { force: true });
     }
   }
-  return bestRecord;
 }
 
-// src/config-schema.ts
-var AckReactionSchema = z2.union([
-  z2.literal(""),
-  z2.enum(["off", "emoji", "kaomoji"]),
-  z2.string().min(1)
-]);
-var CardStreamingModeSchema = z2.enum(["off", "answer", "all"]);
-var ContextVisibilitySchema = z2.enum(["all", "allowlist", "allowlist_quote"]);
-var DingTalkAccountConfigShape = {
-  /** Account name (optional display name) */
-  name: z2.string().optional(),
-  /** Enable or disable this DingTalk channel/account without deleting saved credentials. */
-  enabled: z2.boolean().optional().default(true),
-  /** DingTalk App Key (Client ID) used to authenticate API and Stream connections. */
-  clientId: z2.string().optional(),
-  /** DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. */
-  clientSecret: buildSecretInputSchema().optional(),
-  /** Direct-message access policy: open, pairing, or allowlist. */
-  dmPolicy: z2.enum(["open", "pairing", "allowlist"]).optional().default("open"),
-  /** Group-message access policy: open, allowlist, or disabled. */
-  groupPolicy: z2.enum(["open", "allowlist", "disabled"]).optional().default("open"),
-  /** User IDs allowed when `dmPolicy` is `allowlist`. */
-  allowFrom: z2.array(z2.string()).optional(),
-  /** Sender IDs allowed when `groupPolicy` is `allowlist`. */
-  groupAllowFrom: z2.array(z2.string()).optional(),
-  /** Default disabled. Enabling `all` allows learned displayName lookup but may misroute on stale or duplicate names and is available to all callers until upstream exposes requester authz context. */
-  displayNameResolution: z2.enum(["disabled", "all"]).optional().default("disabled"),
-  /** Controls how much supplemental host context remains visible to the reply runtime. `allowlist_quote` is the safest advanced mode when only explicit quotes or replies should remain visible. */
-  contextVisibility: ContextVisibilitySchema.optional(),
-  /** Allowed remote media download hosts, IPs, or CIDRs for media fetches. */
-  mediaUrlAllowlist: z2.array(z2.string()).optional(),
-  /** Native acknowledgement reaction mode: off, emoji, kaomoji, or a custom compatibility string. */
-  ackReaction: AckReactionSchema.optional(),
-  /** Retention window in days for short-lived message context used by quoting and media recovery. */
-  journalTTLDays: z2.number().int().min(1).optional().default(DEFAULT_MESSAGE_CONTEXT_TTL_DAYS),
-  /** Enable verbose DingTalk channel debug logging. */
-  debug: z2.boolean().optional().default(false),
-  /** Default reply delivery mode: markdown or card. */
-  messageType: z2.enum(["markdown", "card"]).optional().default("markdown"),
-  /** Deprecated and ignored. AI card replies now always use the built-in DingTalk template contract. Keep only for backward-compatible config parsing. */
-  cardTemplateId: z2.string().optional(),
-  /** Deprecated and ignored. The built-in AI card contract owns the streaming field mapping. Keep only for backward-compatible config parsing. */
-  cardTemplateKey: z2.string().optional().default("content"),
-  /** Per-group overrides keyed by conversationId. Supports `*` as a wildcard fallback. */
-  groups: z2.record(
-    z2.string(),
-    z2.object({
-      /** Additional system prompt appended for this group. */
-      systemPrompt: z2.string().optional(),
-      /** Require an explicit @mention before the bot answers in this group. */
-      requireMention: z2.boolean().optional(),
-      /** Optional per-group sender allowlist for tighter access control than the channel default. */
-      groupAllowFrom: z2.array(z2.string()).optional()
-    })
-  ).optional(),
-  /** Connection robustness configuration */
-  /** Maximum connection attempts in a single reconnect cycle before backing off or giving up. */
-  maxConnectionAttempts: z2.number().int().min(1).optional().default(10),
-  /** Initial reconnect backoff delay in milliseconds. */
-  initialReconnectDelay: z2.number().int().min(100).optional().default(1e3),
-  /** Upper bound for reconnect backoff delay in milliseconds. */
-  maxReconnectDelay: z2.number().int().min(1e3).optional().default(6e4),
-  /** Randomization factor added to reconnect backoff to avoid synchronized reconnect storms. */
-  reconnectJitter: z2.number().min(0).max(1).optional().default(0.3),
-  /** Maximum reconnect cycles before the channel stops retrying and waits for the next lifecycle restart. */
-  maxReconnectCycles: z2.number().int().min(1).optional().default(10),
-  /** Time limit in milliseconds for one reconnect cycle before starting a fresh cycle. */
-  reconnectDeadlineMs: z2.number().int().min(5e3).optional().default(5e4),
-  /** Enable the plugin connection manager. Disable only when you intentionally rely on DWClient native keepAlive plus autoReconnect behavior. */
-  useConnectionManager: z2.boolean().optional().default(true),
-  /** Maximum inbound media size in MB accepted by the plugin. When omitted, the runtime default is used. */
-  mediaMaxMb: z2.number().int().min(1).optional(),
-  /** Enable the underlying Stream client heartbeat. When omitted, runtime derives a default from `useConnectionManager`. */
-  keepAlive: z2.boolean().optional(),
-  /** Bypass global or system HTTP(S) proxy settings for DingTalk send, upload, and card APIs. */
-  bypassProxyForSend: z2.boolean().optional().default(false),
-  /** Controls the proactive-send permission reminder shown when a conversation has not granted send rights yet. */
-  proactivePermissionHint: z2.object({
-    /** Show the proactive-send permission hint when the runtime detects missing DingTalk proactive permission. */
-    enabled: z2.boolean().optional().default(true),
-    /** Minimum cooldown in hours before the same proactive permission hint can be shown again. */
-    cooldownHours: z2.number().int().min(1).max(24 * 30).optional().default(24)
-  }).optional().default({ enabled: true, cooldownHours: 24 }),
-  /** Deprecated compatibility flag. When true and `cardStreamingMode` is unset, runtime resolves to `cardStreamingMode: "all"`. Do not use in new configs. */
-  cardRealTimeStream: z2.boolean().optional(),
-  /** Card streaming mode:
-   *  - off: disable incremental streaming
-   *  - answer: stream answer text
-   *  - all: stream answer + reasoning or thinking text */
-  cardStreamingMode: CardStreamingModeSchema.optional(),
-  /** Throttle interval in milliseconds between AI card streaming updates. */
-  cardStreamInterval: z2.number().int().min(200).optional().default(1e3),
-  /** Cooldown window in milliseconds after AI card trigger errors. Replies fall back to non-card delivery during this period. */
-  aicardDegradeMs: z2.number().int().min(6e4).optional().default(30 * 60 * 1e3),
-  /** Enable the local feedback-learning loop for notes, reflections, and command-assisted learning. */
-  learningEnabled: z2.boolean().optional(),
-  /** Automatically apply generated learning output into session notes or global rules when available. */
-  learningAutoApply: z2.boolean().optional(),
-  /** Retention window in milliseconds for temporary learning notes. */
-  learningNoteTtlMs: z2.number().int().min(6e4).optional(),
-  /** Convert markdown tables to plain text before sending when you want more consistent DingTalk rendering. */
-  convertMarkdownTables: z2.boolean().optional().default(true),
-  /** @mention the sender after card finalization in group chats.
-   *  Set to a non-empty string (e.g. "✅ 回复完成") to enable — the value is used as the message text.
-   *  Leave empty or omit to disable. */
-  cardAtSender: z2.string().optional(),
-  /** Status line visibility toggles for the AI card footer. */
-  cardStatusLine: z2.object({
-    /** Show model name. */
-    model: z2.boolean().optional().default(true),
-    /** Show thinking effort level. */
-    effort: z2.boolean().optional().default(true),
-    /** Show agent display name. */
-    agent: z2.boolean().optional().default(true),
-    /** Show task elapsed time. */
-    taskTime: z2.boolean().optional().default(false),
-    /** Show token usage summary (input/output/cache). */
-    tokens: z2.boolean().optional().default(false),
-    /** Show DingTalk API call count. */
-    dapiUsage: z2.boolean().optional().default(false)
-  }).optional().default({ model: true, effort: true, agent: true, taskTime: false, tokens: false, dapiUsage: false })
+// src/message-context-store.ts
+var MESSAGE_CONTEXT_NAMESPACE = "messages.context";
+var MESSAGE_CONTEXT_VERSION = 1;
+var DEFAULT_MESSAGE_CONTEXT_TTL_DAYS = 7;
+var DEFAULT_CARD_CONTENT_TTL_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_MEDIA_CONTEXT_TTL_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_CREATED_AT_MATCH_WINDOW_MS = 2e3;
+var MAX_RECORDS_PER_SCOPE = 1e3;
+var DEFAULT_OUTBOUND_SENDER = {
+  senderId: "bot",
+  senderName: "OpenClaw"
 };
-var DingTalkAccountConfigSchema = z2.object(DingTalkAccountConfigShape);
-var DingTalkConfigSchema = DingTalkAccountConfigSchema.extend({
-  /** Multi-account configuration */
-  accounts: z2.record(z2.string(), DingTalkAccountConfigSchema.optional()).optional()
-});
-
-// src/gateway/channel-gateway.ts
-import { DWClient, TOPIC_CARD, TOPIC_ROBOT } from "dingtalk-stream";
-
-// src/http-client.ts
-import axios from "axios";
-var DEFAULT_HTTP_TIMEOUT_MS = 1e4;
-var httpClient = typeof axios?.create === "function" ? axios.create({ timeout: DEFAULT_HTTP_TIMEOUT_MS }) : axios;
-httpClient.isAxiosError = axios.isAxiosError;
-var http_client_default = httpClient;
-
-// src/utils.ts
-import * as dns from "node:dns";
-import * as fs2 from "node:fs";
-import * as net from "node:net";
-import * as os2 from "node:os";
-import * as path3 from "node:path";
-var pluginDebugWriters = /* @__PURE__ */ new Map();
-var closedPluginDebugScopes = /* @__PURE__ */ new Set();
-function padNumber(value, width = 2) {
-  return String(value).padStart(width, "0");
+function inferConversationChatType(conversationId) {
+  return conversationId.startsWith("cid") ? "group" : "direct";
 }
-function formatTimezoneOffset(date) {
-  const offsetMinutes = -date.getTimezoneOffset();
-  const sign = offsetMinutes >= 0 ? "+" : "-";
-  const absoluteMinutes = Math.abs(offsetMinutes);
-  const hours = Math.floor(absoluteMinutes / 60);
-  const minutes = absoluteMinutes % 60;
-  return `${sign}${padNumber(hours)}:${padNumber(minutes)}`;
+var stateCache = /* @__PURE__ */ new Map();
+function getScopeKey(params) {
+  return JSON.stringify([
+    params.storePath || "__memory__",
+    params.accountId,
+    params.conversationId || null
+  ]);
 }
-function formatPluginDebugTimestamp(date) {
-  return `${date.getFullYear()}-${padNumber(date.getMonth() + 1)}-${padNumber(date.getDate())} ${padNumber(date.getHours())}:${padNumber(date.getMinutes())}:${padNumber(date.getSeconds())}.${padNumber(date.getMilliseconds(), 3)}${formatTimezoneOffset(date)}`;
+function fallbackState() {
+  return {
+    version: MESSAGE_CONTEXT_VERSION,
+    updatedAt: Date.now(),
+    records: {},
+    byAlias: {},
+    recentByCreatedAt: []
+  };
 }
-function formatPluginDebugDate(date) {
-  return `${date.getFullYear()}-${padNumber(date.getMonth() + 1)}-${padNumber(date.getDate())}`;
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value;
 }
-function resolvePluginDebugLogFilePath(params) {
-  return path3.join(
-    path3.dirname(params.storePath),
-    "logs",
-    "dingtalk",
-    params.accountId,
-    `debug-${formatPluginDebugDate(params.date)}.log`
-  );
+function normalizeMedia(value) {
+  const candidate = asRecord(value);
+  if (!candidate) {
+    return void 0;
+  }
+  const downloadCode = typeof candidate.downloadCode === "string" && candidate.downloadCode.trim() ? candidate.downloadCode.trim() : void 0;
+  const downloadCodes = Array.isArray(candidate.downloadCodes) && candidate.downloadCodes.length > 0 ? candidate.downloadCodes.filter((c) => typeof c === "string" && c.trim()) : void 0;
+  const spaceId = typeof candidate.spaceId === "string" && candidate.spaceId.trim() ? candidate.spaceId.trim() : void 0;
+  const fileId = typeof candidate.fileId === "string" && candidate.fileId.trim() ? candidate.fileId.trim() : void 0;
+  if (!downloadCode && (!downloadCodes || downloadCodes.length === 0) && !spaceId && !fileId) {
+    return void 0;
+  }
+  return { downloadCode, downloadCodes, spaceId, fileId };
 }
-function formatPluginDebugLine(params) {
-  return `[${formatPluginDebugTimestamp(params.date)}] [debug] [dingtalk] [account:${params.accountId}] ${params.message}`;
+function normalizeQuotedRef(value) {
+  const candidate = asRecord(value);
+  if (!candidate) {
+    return void 0;
+  }
+  const targetDirection = candidate.targetDirection === "outbound" ? "outbound" : candidate.targetDirection === "inbound" ? "inbound" : void 0;
+  const key = candidate.key === "msgId" || candidate.key === "messageId" || candidate.key === "processQueryKey" || candidate.key === "outTrackId" || candidate.key === "cardInstanceId" ? candidate.key : void 0;
+  const valueString = typeof candidate.value === "string" && candidate.value.trim() ? candidate.value.trim() : void 0;
+  const fallbackCreatedAt = typeof candidate.fallbackCreatedAt === "number" && Number.isFinite(candidate.fallbackCreatedAt) ? candidate.fallbackCreatedAt : void 0;
+  if (!targetDirection) {
+    return void 0;
+  }
+  if (!key && !fallbackCreatedAt) {
+    return void 0;
+  }
+  if (key && !valueString) {
+    return void 0;
+  }
+  return {
+    targetDirection,
+    key,
+    value: valueString,
+    fallbackCreatedAt
+  };
 }
-function buildPluginDebugWriterKey(params) {
-  return JSON.stringify([params.storePath, params.accountId, formatPluginDebugDate(params.date)]);
+function normalizeAttachmentTextSource(value) {
+  return value === "text" || value === "html" || value === "pdf" || value === "docx" ? value : void 0;
 }
-function buildPluginDebugScopeKey(params) {
-  return JSON.stringify([params.storePath, params.accountId]);
+function normalizeDelivery(value) {
+  const candidate = asRecord(value);
+  if (!candidate) {
+    return void 0;
+  }
+  const messageId = typeof candidate.messageId === "string" && candidate.messageId.trim() ? candidate.messageId.trim() : void 0;
+  const processQueryKey = typeof candidate.processQueryKey === "string" && candidate.processQueryKey.trim() ? candidate.processQueryKey.trim() : void 0;
+  const outTrackId = typeof candidate.outTrackId === "string" && candidate.outTrackId.trim() ? candidate.outTrackId.trim() : void 0;
+  const cardInstanceId = typeof candidate.cardInstanceId === "string" && candidate.cardInstanceId.trim() ? candidate.cardInstanceId.trim() : void 0;
+  const kind = typeof candidate.kind === "string" && candidate.kind.trim() ? candidate.kind.trim() : void 0;
+  if (!messageId && !processQueryKey && !outTrackId && !cardInstanceId && !kind) {
+    return void 0;
+  }
+  return { messageId, processQueryKey, outTrackId, cardInstanceId, kind };
 }
-function resolvePluginDebugWriter(params) {
-  const key = buildPluginDebugWriterKey(params);
-  const existing = pluginDebugWriters.get(key);
-  if (existing) {
-    return existing;
+function normalizeMentions(value) {
+  if (!Array.isArray(value)) {
+    return void 0;
   }
-  const created = {
-    filePath: resolvePluginDebugLogFilePath(params),
-    warned: false,
-    directoryReady: false
+  const normalized = [...new Set(value.map((item) => String(item || "").trim()).filter(Boolean))];
+  return normalized.length > 0 ? normalized : void 0;
+}
+function normalizeMessageRecord(value) {
+  const candidate = asRecord(value);
+  if (!candidate) {
+    return null;
+  }
+  const msgId = typeof candidate.msgId === "string" && candidate.msgId.trim() ? candidate.msgId.trim() : "";
+  const direction = candidate.direction === "outbound" ? "outbound" : candidate.direction === "inbound" ? "inbound" : null;
+  const accountId = typeof candidate.accountId === "string" && candidate.accountId.trim() ? candidate.accountId.trim() : "";
+  const conversationId = typeof candidate.conversationId === "string" && candidate.conversationId.trim() ? candidate.conversationId.trim() : null;
+  const createdAt = typeof candidate.createdAt === "number" && Number.isFinite(candidate.createdAt) ? candidate.createdAt : NaN;
+  const updatedAt = typeof candidate.updatedAt === "number" && Number.isFinite(candidate.updatedAt) ? candidate.updatedAt : Date.now();
+  if (!msgId || !direction || !accountId || !Number.isFinite(createdAt)) {
+    return null;
+  }
+  const expiresAt = typeof candidate.expiresAt === "number" && Number.isFinite(candidate.expiresAt) ? candidate.expiresAt : void 0;
+  return {
+    msgId,
+    direction,
+    topic: candidate.topic === null ? null : typeof candidate.topic === "string" ? candidate.topic : null,
+    accountId,
+    conversationId,
+    createdAt,
+    updatedAt,
+    expiresAt,
+    messageType: typeof candidate.messageType === "string" ? candidate.messageType : void 0,
+    text: typeof candidate.text === "string" ? candidate.text : void 0,
+    attachmentText: typeof candidate.attachmentText === "string" ? candidate.attachmentText : void 0,
+    attachmentTextSource: normalizeAttachmentTextSource(candidate.attachmentTextSource),
+    attachmentTextTruncated: candidate.attachmentTextTruncated === true ? true : void 0,
+    attachmentFileName: typeof candidate.attachmentFileName === "string" ? candidate.attachmentFileName : void 0,
+    quotedRef: normalizeQuotedRef(candidate.quotedRef),
+    senderId: typeof candidate.senderId === "string" && candidate.senderId.trim() ? candidate.senderId.trim() : void 0,
+    senderName: typeof candidate.senderName === "string" && candidate.senderName.trim() ? candidate.senderName.trim() : void 0,
+    mentions: normalizeMentions(candidate.mentions),
+    chatType: candidate.chatType === "direct" || candidate.chatType === "group" ? candidate.chatType : void 0,
+    quotedMessageId: typeof candidate.quotedMessageId === "string" && candidate.quotedMessageId.trim() ? candidate.quotedMessageId.trim() : void 0,
+    media: normalizeMedia(candidate.media),
+    delivery: normalizeDelivery(candidate.delivery)
   };
-  pluginDebugWriters.set(key, created);
-  return created;
 }
-function resolvePluginDebugLog(params) {
-  const baseLog = params.baseLog;
-  const fsImpl = params.fsImpl ?? fs2;
-  const scopeKey = params.storePath ? buildPluginDebugScopeKey({ storePath: params.storePath, accountId: params.accountId }) : void 0;
-  if (scopeKey) {
-    closedPluginDebugScopes.delete(scopeKey);
+function buildAliasKey(kind, value) {
+  return `${kind}:${value.trim()}`;
+}
+function buildAliasEntries(record) {
+  const aliases = [];
+  if (record.direction === "inbound" && record.msgId.trim()) {
+    aliases.push([buildAliasKey("inboundMsgId", record.msgId), record.msgId]);
+  }
+  const delivery = record.delivery;
+  if (!delivery) {
+    return aliases;
+  }
+  if (delivery.messageId) {
+    aliases.push([buildAliasKey("messageId", delivery.messageId), record.msgId]);
+  }
+  if (delivery.processQueryKey) {
+    aliases.push([buildAliasKey("processQueryKey", delivery.processQueryKey), record.msgId]);
+  }
+  if (delivery.outTrackId) {
+    aliases.push([buildAliasKey("outTrackId", delivery.outTrackId), record.msgId]);
+  }
+  if (delivery.cardInstanceId) {
+    aliases.push([buildAliasKey("cardInstanceId", delivery.cardInstanceId), record.msgId]);
+  }
+  return aliases;
+}
+function isRecordExpired(record, nowMs) {
+  return typeof record.expiresAt === "number" && Number.isFinite(record.expiresAt) && nowMs >= record.expiresAt;
+}
+function normalizeState(state, nowMs) {
+  const normalizedRecords = {};
+  const sortedRecords = Object.values(state.records).map((record) => normalizeMessageRecord(record)).filter((record) => record !== null).filter((record) => !isRecordExpired(record, nowMs)).toSorted((left, right) => left.createdAt - right.createdAt);
+  const keptRecords = sortedRecords.slice(-MAX_RECORDS_PER_SCOPE);
+  for (const record of keptRecords) {
+    normalizedRecords[record.msgId] = record;
+  }
+  const byAlias = {};
+  for (const record of keptRecords) {
+    for (const [key, value] of buildAliasEntries(record)) {
+      byAlias[key] = value;
+    }
   }
   return {
-    debug: (message) => {
-      if (!params.debug) {
-        baseLog?.debug?.(message);
-        return;
-      }
-      const date = params.now ? params.now() : /* @__PURE__ */ new Date();
-      const line = formatPluginDebugLine({
-        accountId: params.accountId,
-        date,
-        message
-      });
-      try {
-        process.stdout.write(`${line}
-`);
-      } catch {
-      }
-      if (params.storePath && scopeKey && !closedPluginDebugScopes.has(scopeKey)) {
-        const writer = resolvePluginDebugWriter({
-          storePath: params.storePath,
-          accountId: params.accountId,
-          date
-        });
-        try {
-          if (!writer.directoryReady) {
-            fsImpl.mkdirSync(path3.dirname(writer.filePath), { recursive: true });
-            writer.directoryReady = true;
-          }
-          fsImpl.appendFileSync(writer.filePath, `${line}
-`, "utf8");
-        } catch (err) {
-          if (!writer.warned) {
-            writer.warned = true;
-            baseLog?.warn?.(
-              `[DingTalk] Plugin debug log file unavailable: accountId=${params.accountId} path=${writer.filePath} error=${getErrorMessage(err)}`
-            );
-          }
-        }
-      }
-      try {
-        baseLog?.debug?.(message);
-      } catch {
-      }
-    },
-    info: (message) => baseLog?.info?.(message),
-    warn: (message) => baseLog?.warn?.(message),
-    error: (message) => baseLog?.error?.(message)
+    removed: Object.keys(state.records).length - Object.keys(normalizedRecords).length,
+    state: {
+      version: MESSAGE_CONTEXT_VERSION,
+      updatedAt: state.updatedAt,
+      records: normalizedRecords,
+      byAlias,
+      recentByCreatedAt: keptRecords.map((record) => record.msgId)
+    }
   };
 }
-function closePluginDebugLog(params) {
+function hydrateState(params, nowMs) {
+  if (!params.storePath) {
+    return fallbackState();
+  }
+  const persisted = readNamespaceJson(
+    MESSAGE_CONTEXT_NAMESPACE,
+    {
+      storePath: params.storePath,
+      scope: { accountId: params.accountId, conversationId: params.conversationId || void 0 },
+      format: "json",
+      fallback: { version: MESSAGE_CONTEXT_VERSION, updatedAt: Date.now(), records: {} }
+    }
+  );
+  const parsedRecords = asRecord(persisted.records) || {};
+  const hydrated = fallbackState();
+  hydrated.updatedAt = typeof persisted.updatedAt === "number" ? persisted.updatedAt : Date.now();
+  for (const [key, value] of Object.entries(parsedRecords)) {
+    const normalized = normalizeMessageRecord(value);
+    if (normalized) {
+      hydrated.records[key] = normalized;
+    }
+  }
+  return normalizeState(hydrated, nowMs).state;
+}
+function loadState(params, nowMs = Date.now()) {
+  const scopeKey = getScopeKey(params);
+  const cached = stateCache.get(scopeKey);
+  if (cached) {
+    return cached;
+  }
+  const hydrated = params.storePath ? hydrateState(params, nowMs) : fallbackState();
+  stateCache.set(scopeKey, hydrated);
+  return hydrated;
+}
+function writeState(params, state) {
+  stateCache.set(getScopeKey(params), state);
   if (!params.storePath) {
     return;
   }
-  const scopeKey = buildPluginDebugScopeKey({
+  writeNamespaceJsonAtomic(MESSAGE_CONTEXT_NAMESPACE, {
     storePath: params.storePath,
-    accountId: params.accountId
-  });
-  closedPluginDebugScopes.add(scopeKey);
-  for (const key of pluginDebugWriters.keys()) {
-    const [writerStorePath, writerAccountId] = JSON.parse(key);
-    if (writerStorePath === params.storePath && writerAccountId === params.accountId) {
-      pluginDebugWriters.delete(key);
+    scope: { accountId: params.accountId, conversationId: params.conversationId || void 0 },
+    format: "json",
+    data: {
+      version: MESSAGE_CONTEXT_VERSION,
+      updatedAt: state.updatedAt,
+      records: state.records
     }
-  }
+  });
 }
-function maskSensitiveData(data) {
-  if (data === null || data === void 0) {
-    return data;
-  }
-  if (typeof data !== "object") {
-    return data;
-  }
-  const masked = JSON.parse(JSON.stringify(data));
-  const sensitiveFields = /* @__PURE__ */ new Set(["token", "accessToken"]);
-  function maskObj(obj) {
-    for (const key in obj) {
-      if (sensitiveFields.has(key)) {
-        const val = obj[key];
-        if (typeof val === "string" && val.length > 6) {
-          obj[key] = val.slice(0, 3) + "*".repeat(val.length - 6) + val.slice(-3);
-        } else if (typeof val === "string") {
-          obj[key] = "*".repeat(val.length);
-        }
-      } else if (typeof obj[key] === "object" && obj[key] !== null && !Array.isArray(obj[key])) {
-        maskObj(obj[key]);
-      }
-    }
-  }
-  maskObj(masked);
-  return masked;
+function cloneStateForMutation(state) {
+  return {
+    version: state.version,
+    updatedAt: state.updatedAt,
+    records: { ...state.records },
+    byAlias: state.byAlias,
+    recentByCreatedAt: state.recentByCreatedAt
+  };
 }
-function stringifyUnknown(value) {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  try {
-    const serialized = JSON.stringify(value);
-    return serialized ?? String(value);
-  } catch {
-    return "[unserializable]";
+function mergeText(existing, next) {
+  if (typeof next !== "string") {
+    return existing;
   }
+  return next;
 }
-function parseBooleanLike(value) {
-  if (typeof value === "boolean") {
-    return value;
-  }
-  if (typeof value === "number") {
-    if (value === 1) {
-      return true;
-    }
-    if (value === 0) {
-      return false;
-    }
-    return void 0;
-  }
-  if (typeof value === "string") {
-    const normalized = value.trim().toLowerCase();
-    if (["1", "true", "yes", "y", "on"].includes(normalized)) {
-      return true;
-    }
-    if (["0", "false", "no", "n", "off"].includes(normalized)) {
-      return false;
-    }
+function mergeAttachmentText(existing, next) {
+  if (typeof next !== "string") {
+    return existing;
   }
-  return void 0;
+  return next;
 }
-function getErrorMessage(err) {
-  if (err instanceof Error && err.message) {
-    return err.message;
+function mergeQuotedRef(existing, next) {
+  if (!existing) {
+    return next;
   }
-  if (err && typeof err === "object") {
-    const record = err;
-    if (typeof record.message === "string" && record.message.trim()) {
-      return record.message;
-    }
+  if (!next) {
+    return existing;
   }
-  return stringifyUnknown(err);
+  return {
+    targetDirection: next.targetDirection,
+    key: next.key || existing.key,
+    value: next.value || existing.value,
+    fallbackCreatedAt: next.fallbackCreatedAt ?? existing.fallbackCreatedAt
+  };
 }
-function getErrorResponseData(err) {
-  if (!err || typeof err !== "object") {
-    return void 0;
+function mergeStringField(existing, next) {
+  if (typeof next !== "string" || !next.trim()) {
+    return existing;
   }
-  return err.response?.data;
+  return next.trim();
 }
-function formatDingTalkErrorPayload(payload) {
-  if (payload === null || payload === void 0) {
-    return "payload=unknown";
+function mergeMentions(existing, next) {
+  if (!next) {
+    return existing;
   }
-  let code;
-  let message;
-  if (typeof payload === "object" && !Array.isArray(payload)) {
-    const obj = payload;
-    if (typeof obj.code === "string" || typeof obj.code === "number") {
-      code = String(obj.code);
-    }
-    if (typeof obj.message === "string") {
-      message = obj.message;
-    }
+  return normalizeMentions(next) || existing;
+}
+function mergeMedia(existing, next) {
+  if (!existing) {
+    return next;
   }
-  let serialized;
-  try {
-    serialized = JSON.stringify(maskSensitiveData(payload));
-  } catch {
-    if (typeof payload === "string") {
-      serialized = payload;
-    } else if (typeof payload === "number" || typeof payload === "boolean" || typeof payload === "bigint") {
-      serialized = `${payload}`;
-    } else {
-      serialized = "[unserializable-payload]";
-    }
+  if (!next) {
+    return existing;
   }
-  const parts = [];
-  if (code) {
-    parts.push(`code=${code}`);
+  return {
+    downloadCode: next.downloadCode || existing.downloadCode,
+    downloadCodes: next.downloadCodes || existing.downloadCodes,
+    spaceId: next.spaceId || existing.spaceId,
+    fileId: next.fileId || existing.fileId
+  };
+}
+function mergeDelivery(existing, next) {
+  if (!existing) {
+    return next;
   }
-  if (message) {
-    parts.push(`message=${message}`);
+  if (!next) {
+    return existing;
   }
-  parts.push(`payload=${serialized}`);
-  return parts.join(" ");
+  return {
+    messageId: next.messageId || existing.messageId,
+    processQueryKey: next.processQueryKey || existing.processQueryKey,
+    outTrackId: next.outTrackId || existing.outTrackId,
+    cardInstanceId: next.cardInstanceId || existing.cardInstanceId,
+    kind: next.kind || existing.kind
+  };
 }
-function formatDingTalkErrorPayloadLog(scope, payload, prefix = "[DingTalk]") {
-  return `${prefix}[ErrorPayload][${scope}] ${formatDingTalkErrorPayload(payload)}`;
+function mergeAttachmentTextSource(existing, next) {
+  return next ?? existing;
 }
-function getProxyBypassOption(config) {
-  return config?.bypassProxyForSend ? { proxy: false } : {};
+function mergeAttachmentTextTruncated(existing, next) {
+  return next === void 0 ? existing : next;
 }
-function createResolve4FallbackLookup(log, accountId) {
-  return createResolve4FallbackLookupWithDeps(log, accountId, dns, net);
+function mergeAttachmentFileName(existing, next) {
+  if (typeof next !== "string") {
+    return existing;
+  }
+  return next;
 }
-function createResolve4FallbackLookupWithDeps(log, accountId, dnsImpl, netImpl) {
-  let fallbackLogged = false;
-  return (hostname, options, callback) => {
-    const ipFamily = netImpl.isIP(hostname);
-    if (ipFamily !== 0) {
-      if (options.all) {
-        callback(null, [{ address: hostname, family: ipFamily }], ipFamily);
-        return;
-      }
-      callback(null, hostname, ipFamily);
-      return;
+function resolveExistingMsgId(state, params, nowMs) {
+  if (params.direction === "inbound" && params.msgId) {
+    const direct = state.records[params.msgId];
+    if (direct && !isRecordExpired(direct, nowMs)) {
+      return params.msgId;
     }
-    dnsImpl.lookup(hostname, options, (lookupErr, address, family) => {
-      if (!lookupErr) {
-        callback(null, address, family);
-        return;
-      }
-      if (lookupErr.code !== "ENOTFOUND") {
-        callback(lookupErr, address, family);
-        return;
-      }
-      dnsImpl.resolve4(hostname, (resolveErr, addresses) => {
-        if (resolveErr || !addresses || addresses.length === 0) {
-          callback(lookupErr, address, family);
-          return;
-        }
-        if (!fallbackLogged) {
-          fallbackLogged = true;
-          log?.warn?.(
-            `[${accountId ?? "default"}] System DNS lookup failed for ${hostname} (ENOTFOUND); using resolve4 fallback ${addresses[0]}`
-          );
-        }
-        if (options.all) {
-          callback(
-            null,
-            addresses.map((item) => ({ address: item, family: 4 })),
-            4
-          );
-          return;
-        }
-        callback(null, addresses[0], 4);
-      });
-    });
-  };
+  }
+  const delivery = params.delivery;
+  if (!delivery) {
+    return void 0;
+  }
+  const candidates = [
+    ["messageId", delivery.messageId],
+    ["processQueryKey", delivery.processQueryKey],
+    ["outTrackId", delivery.outTrackId],
+    ["cardInstanceId", delivery.cardInstanceId]
+  ];
+  for (const [kind, value] of candidates) {
+    if (!value) {
+      continue;
+    }
+    const aliasHit = state.byAlias[buildAliasKey(kind, value)];
+    if (!aliasHit) {
+      continue;
+    }
+    const record = state.records[aliasHit];
+    if (record && !isRecordExpired(record, nowMs)) {
+      return aliasHit;
+    }
+  }
+  return void 0;
 }
-function getHeaderCaseInsensitive(headers, key) {
-  if (!headers || typeof headers !== "object" || Array.isArray(headers)) {
+function computeExpiresAt(nowMs, ttlMs, ttlReferenceMs) {
+  if (typeof ttlMs !== "number" || !Number.isFinite(ttlMs) || ttlMs <= 0) {
     return void 0;
   }
-  const entries = Object.entries(headers);
-  const matched = entries.find(([name]) => name.toLowerCase() === key.toLowerCase());
-  if (!matched) {
-    return void 0;
+  return (typeof ttlReferenceMs === "number" && Number.isFinite(ttlReferenceMs) ? ttlReferenceMs : nowMs) + ttlMs;
+}
+function pruneStateByCreatedAt(state, ttlDays, nowMs) {
+  if (!ttlDays || ttlDays <= 0) {
+    return { state, removed: 0 };
   }
-  const value = matched[1];
-  if (Array.isArray(value)) {
-    return value.length > 0 ? String(value[0]) : void 0;
+  const cutoff = nowMs - ttlDays * 24 * 60 * 60 * 1e3;
+  const nextRecords = {};
+  for (const [msgId, record] of Object.entries(state.records)) {
+    if (record.createdAt >= cutoff) {
+      nextRecords[msgId] = record;
+    }
   }
-  if (value === null || value === void 0) {
-    return void 0;
+  const removed = Object.keys(state.records).length - Object.keys(nextRecords).length;
+  if (removed === 0) {
+    return { state, removed: 0 };
   }
-  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
+  return {
+    removed,
+    state: {
+      ...state,
+      records: nextRecords
+    }
+  };
+}
+function upsertRecord(params) {
+  const nowMs = params.updatedAt ?? Date.now();
+  let state = cloneStateForMutation(loadState(params, nowMs));
+  if (params.cleanupCreatedAtTtlDays && params.cleanupCreatedAtTtlDays > 0) {
+    state = pruneStateByCreatedAt(state, params.cleanupCreatedAtTtlDays, nowMs).state;
   }
-  try {
-    return JSON.stringify(value);
-  } catch {
+  const existingMsgId = resolveExistingMsgId(
+    state,
+    {
+      direction: params.direction,
+      msgId: params.msgId,
+      delivery: params.delivery
+    },
+    nowMs
+  );
+  const canonicalMsgId = existingMsgId || params.msgId || params.delivery?.messageId || params.delivery?.processQueryKey || params.delivery?.outTrackId;
+  if (!canonicalMsgId || !canonicalMsgId.trim()) {
     return void 0;
   }
+  const existing = state.records[canonicalMsgId];
+  const expiresAt = computeExpiresAt(nowMs, params.ttlMs, params.ttlReferenceMs);
+  const normalizedQuotedRef = normalizeQuotedRef(params.quotedRef);
+  state.records[canonicalMsgId] = {
+    msgId: canonicalMsgId,
+    direction: params.direction,
+    topic: params.topic ?? existing?.topic ?? null,
+    accountId: params.accountId,
+    conversationId: params.conversationId,
+    createdAt: existing?.createdAt ?? params.createdAt,
+    updatedAt: nowMs,
+    expiresAt: expiresAt === void 0 ? existing?.expiresAt : Math.max(expiresAt, existing?.expiresAt ?? 0),
+    messageType: params.messageType || existing?.messageType,
+    text: mergeText(existing?.text, params.text),
+    attachmentText: mergeAttachmentText(existing?.attachmentText, params.attachmentText),
+    attachmentTextSource: mergeAttachmentTextSource(
+      existing?.attachmentTextSource,
+      params.attachmentTextSource
+    ),
+    attachmentTextTruncated: mergeAttachmentTextTruncated(
+      existing?.attachmentTextTruncated,
+      params.attachmentTextTruncated
+    ),
+    attachmentFileName: mergeAttachmentFileName(
+      existing?.attachmentFileName,
+      params.attachmentFileName
+    ),
+    quotedRef: mergeQuotedRef(existing?.quotedRef, normalizedQuotedRef),
+    senderId: mergeStringField(existing?.senderId, params.senderId),
+    senderName: mergeStringField(existing?.senderName, params.senderName),
+    mentions: mergeMentions(existing?.mentions, params.mentions),
+    chatType: params.chatType || existing?.chatType,
+    quotedMessageId: mergeStringField(existing?.quotedMessageId, params.quotedMessageId),
+    media: mergeMedia(existing?.media, params.media),
+    delivery: mergeDelivery(existing?.delivery, params.delivery)
+  };
+  state.updatedAt = nowMs;
+  writeState(params, normalizeState(state, nowMs).state);
+  return canonicalMsgId;
 }
-function formatDingTalkConnectionErrorLog(scope, err, baseMessage) {
-  if (!err || typeof err !== "object") {
+function upsertInboundMessageContext(params) {
+  return upsertRecord({
+    ...params,
+    direction: "inbound",
+    topic: params.topic ?? null,
+    msgId: params.msgId,
+    cleanupCreatedAtTtlDays: params.cleanupCreatedAtTtlDays
+  }) || params.msgId;
+}
+function upsertOutboundMessageContext(params) {
+  return upsertRecord({
+    ...params,
+    direction: "outbound",
+    topic: params.topic ?? null
+  });
+}
+function resolveByMsgId(params) {
+  const nowMs = params.nowMs ?? Date.now();
+  const state = loadState(params, nowMs);
+  const direct = state.records[params.msgId];
+  if (direct && !isRecordExpired(direct, nowMs)) {
+    return direct;
+  }
+  const aliasTarget = state.byAlias[buildAliasKey("inboundMsgId", params.msgId)];
+  if (!aliasTarget) {
     return null;
   }
-  const errRecord = err;
-  const stage = typeof errRecord.dingtalkConnectionStage === "string" ? errRecord.dingtalkConnectionStage : scope;
-  const endpoint = typeof errRecord.dingtalkConnectionEndpoint === "string" ? errRecord.dingtalkConnectionEndpoint : void 0;
-  const hasResponse = "response" in errRecord && errRecord.response !== null && errRecord.response !== void 0;
-  if (!hasResponse && !endpoint && stage === scope) {
+  const record = state.records[aliasTarget];
+  return record && !isRecordExpired(record, nowMs) ? record : null;
+}
+function resolveByAlias(params) {
+  const nowMs = params.nowMs ?? Date.now();
+  const state = loadState(params, nowMs);
+  const msgId = state.byAlias[buildAliasKey(params.kind, params.value)];
+  if (!msgId) {
     return null;
   }
-  const parts = [`${baseMessage} [DingTalk][ConnectionError][${stage}]`];
-  if (endpoint) {
-    parts.push(`endpoint=${endpoint}`);
+  const record = state.records[msgId];
+  return record && !isRecordExpired(record, nowMs) ? record : null;
+}
+function resolveByQuotedRef(params) {
+  const nowMs = params.nowMs ?? Date.now();
+  const quotedRef = normalizeQuotedRef(params.quotedRef);
+  const log = params.log;
+  if (!quotedRef) {
+    log?.debug?.(
+      `[DingTalk][QuotedRef] Resolve skipped: invalid quotedRef accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+    );
+    return null;
   }
-  const response = err.response;
-  if (response) {
-    if (response.status !== void 0 && response.status !== null) {
-      const statusText = typeof response.status === "string" || typeof response.status === "number" || typeof response.status === "boolean" || typeof response.status === "bigint" ? String(response.status) : JSON.stringify(response.status);
-      parts.push(`status=${statusText}`);
-    }
-    let requestId = getHeaderCaseInsensitive(response.headers, "x-acs-dingtalk-request-id");
-    if (!requestId && response.data && typeof response.data === "object" && !Array.isArray(response.data)) {
-      const data = response.data;
-      if (typeof data.requestId === "string") {
-        requestId = data.requestId;
-      } else if (typeof data.requestid === "string") {
-        requestId = data.requestid;
-      }
-    }
-    if (requestId) {
-      parts.push(`requestId=${requestId}`);
+  if (quotedRef.targetDirection === "inbound") {
+    if (quotedRef.key !== "msgId" || !quotedRef.value) {
+      log?.debug?.(
+        `[DingTalk][QuotedRef] Resolve skipped: inbound quotedRef missing msgId accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+      );
+      return null;
     }
-    if (response.data !== void 0) {
-      parts.push(formatDingTalkErrorPayload(response.data));
+    const record = resolveByMsgId({
+      ...params,
+      msgId: quotedRef.value,
+      nowMs
+    });
+    log?.debug?.(
+      `[DingTalk][QuotedRef] Resolve inbound by msgId=${quotedRef.value} hit=${record ? "yes" : "no"} accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+    );
+    return record;
+  }
+  if (quotedRef.key && quotedRef.value && quotedRef.key !== "msgId") {
+    const aliasRecord = resolveByAlias({
+      ...params,
+      kind: quotedRef.key,
+      value: quotedRef.value,
+      nowMs
+    });
+    if (aliasRecord) {
+      log?.debug?.(
+        `[DingTalk][QuotedRef] Resolve outbound by ${quotedRef.key}=${quotedRef.value} hit=yes accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+      );
+      return aliasRecord;
     }
+    log?.debug?.(
+      `[DingTalk][QuotedRef] Resolve outbound by ${quotedRef.key}=${quotedRef.value} hit=no accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+    );
   }
-  if (stage === "connect.websocket") {
-    parts.push("Likely websocket/proxy/WSS issue after connections/open succeeded");
+  if (typeof quotedRef.fallbackCreatedAt === "number" && Number.isFinite(quotedRef.fallbackCreatedAt)) {
+    const record = resolveByCreatedAtWindow({
+      ...params,
+      createdAt: quotedRef.fallbackCreatedAt,
+      direction: "outbound",
+      nowMs
+    });
+    log?.debug?.(
+      `[DingTalk][QuotedRef] Resolve outbound by createdAt=${quotedRef.fallbackCreatedAt} hit=${record ? "yes" : "no"} accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+    );
+    return record;
   }
-  parts.push("See docs/connection-troubleshooting.md or run scripts/dingtalk-connection-check.*");
-  return parts.join(" ");
+  log?.debug?.(
+    `[DingTalk][QuotedRef] Resolve outbound missed without createdAt fallback accountId=${params.accountId} conversationId=${params.conversationId || "(none)"}`
+  );
+  return null;
 }
-function cleanupOrphanedTempFiles(log) {
-  const tempDir = os2.tmpdir();
-  const dingtalkPattern = /^dingtalk_\d+\..+$/;
-  let cleaned = 0;
-  try {
-    const files = fs2.readdirSync(tempDir);
-    const now = Date.now();
-    const maxAge = 24 * 60 * 60 * 1e3;
-    for (const file of files) {
-      if (!dingtalkPattern.test(file)) {
-        continue;
-      }
-      const filePath = path3.join(tempDir, file);
-      try {
-        const stats = fs2.statSync(filePath);
-        if (now - stats.mtime.getTime() > maxAge) {
-          fs2.unlinkSync(filePath);
-          cleaned++;
-          log?.debug?.(`[DingTalk] Cleaned up orphaned temp file: ${file}`);
-        }
-      } catch (err) {
-        log?.debug?.(`[DingTalk] Failed to cleanup temp file ${file}: ${getErrorMessage(err)}`);
-      }
+function resolveByCreatedAtWindow(params) {
+  const nowMs = params.nowMs ?? Date.now();
+  const windowMs = params.windowMs ?? DEFAULT_CREATED_AT_MATCH_WINDOW_MS;
+  const state = loadState(params, nowMs);
+  let bestRecord = null;
+  let bestDelta = Infinity;
+  for (const msgId of state.recentByCreatedAt) {
+    const record = state.records[msgId];
+    if (!record || isRecordExpired(record, nowMs)) {
+      continue;
     }
-    if (cleaned > 0) {
-      log?.info?.(`[DingTalk] Cleaned up ${cleaned} orphaned temp files`);
+    if (params.direction && record.direction !== params.direction) {
+      continue;
     }
-  } catch (err) {
-    log?.debug?.(`[DingTalk] Failed to cleanup temp directory: ${getErrorMessage(err)}`);
-  }
-  return cleaned;
-}
-async function retryWithBackoff(fn, options = {}) {
-  const { maxRetries = 3, baseDelayMs = 100, log } = options;
-  for (let attempt = 1; attempt <= maxRetries; attempt++) {
-    try {
-      return await fn();
-    } catch (err) {
-      const statusCode = err.response?.status;
-      const isRetryable = statusCode === 401 || statusCode === 429 || statusCode && statusCode >= 500;
-      const responseData = getErrorResponseData(err);
-      if (responseData !== void 0) {
-        log?.debug?.(formatDingTalkErrorPayloadLog("retry.beforeDecision", responseData));
-      }
-      if (!isRetryable || attempt === maxRetries) {
-        throw err;
-      }
-      const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
-      log?.debug?.(`[DingTalk] Retry attempt ${attempt}/${maxRetries} after ${delayMs}ms`);
-      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+    const delta = Math.abs(record.createdAt - params.createdAt);
+    if (delta <= windowMs && delta < bestDelta) {
+      bestDelta = delta;
+      bestRecord = record;
     }
   }
-  throw new Error("Retry exhausted without returning");
-}
-function getCurrentTimestamp() {
-  return Date.now();
+  return bestRecord;
 }
 
+// src/config-schema.ts
+var AckReactionSchema = z2.union([
+  z2.literal(""),
+  z2.enum(["off", "emoji", "kaomoji"]),
+  z2.string().min(1)
+]);
+var CardStreamingModeSchema = z2.enum(["off", "answer", "all"]);
+var ContextVisibilitySchema = z2.enum(["all", "allowlist", "allowlist_quote"]);
+var DingTalkAccountConfigShape = {
+  /** Account name (optional display name) */
+  name: z2.string().optional(),
+  /** Enable or disable this DingTalk channel/account without deleting saved credentials. */
+  enabled: z2.boolean().optional().default(true),
+  /** DingTalk App Key (Client ID) used to authenticate API and Stream connections. */
+  clientId: z2.string().optional(),
+  /** DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. */
+  clientSecret: buildSecretInputSchema().optional(),
+  /** Direct-message access policy: open, pairing, or allowlist. */
+  dmPolicy: z2.enum(["open", "pairing", "allowlist"]).optional().default("open"),
+  /** Group-message access policy: open, allowlist, or disabled. */
+  groupPolicy: z2.enum(["open", "allowlist", "disabled"]).optional().default("open"),
+  /** User IDs allowed when `dmPolicy` is `allowlist`. */
+  allowFrom: z2.array(z2.string()).optional(),
+  /** Sender IDs allowed when `groupPolicy` is `allowlist`. */
+  groupAllowFrom: z2.array(z2.string()).optional(),
+  /** Default disabled. Enabling `all` allows learned displayName lookup but may misroute on stale or duplicate names and is available to all callers until upstream exposes requester authz context. */
+  displayNameResolution: z2.enum(["disabled", "all"]).optional().default("disabled"),
+  /** Controls how much supplemental host context remains visible to the reply runtime. `allowlist_quote` is the safest advanced mode when only explicit quotes or replies should remain visible. */
+  contextVisibility: ContextVisibilitySchema.optional(),
+  /** Allowed remote media download hosts, IPs, or CIDRs for media fetches. */
+  mediaUrlAllowlist: z2.array(z2.string()).optional(),
+  /** Native acknowledgement reaction mode: off, emoji, kaomoji, or a custom compatibility string. */
+  ackReaction: AckReactionSchema.optional(),
+  /** Retention window in days for short-lived message context used by quoting and media recovery. */
+  journalTTLDays: z2.number().int().min(1).optional().default(DEFAULT_MESSAGE_CONTEXT_TTL_DAYS),
+  /** Enable verbose DingTalk channel debug logging. */
+  debug: z2.boolean().optional().default(false),
+  /** Default reply delivery mode: markdown or card. */
+  messageType: z2.enum(["markdown", "card"]).optional().default("markdown"),
+  /** Deprecated and ignored. AI card replies now always use the built-in DingTalk template contract. Keep only for backward-compatible config parsing. */
+  cardTemplateId: z2.string().optional(),
+  /** Deprecated and ignored. The built-in AI card contract owns the streaming field mapping. Keep only for backward-compatible config parsing. */
+  cardTemplateKey: z2.string().optional().default("content"),
+  /** Per-group overrides keyed by conversationId. Supports `*` as a wildcard fallback. */
+  groups: z2.record(
+    z2.string(),
+    z2.object({
+      /** Additional system prompt appended for this group. */
+      systemPrompt: z2.string().optional(),
+      /** Require an explicit @mention before the bot answers in this group. */
+      requireMention: z2.boolean().optional(),
+      /** Optional per-group sender allowlist for tighter access control than the channel default. */
+      groupAllowFrom: z2.array(z2.string()).optional()
+    })
+  ).optional(),
+  /** Connection robustness configuration */
+  /** Maximum connection attempts in a single reconnect cycle before backing off or giving up. */
+  maxConnectionAttempts: z2.number().int().min(1).optional().default(10),
+  /** Initial reconnect backoff delay in milliseconds. */
+  initialReconnectDelay: z2.number().int().min(100).optional().default(1e3),
+  /** Upper bound for reconnect backoff delay in milliseconds. */
+  maxReconnectDelay: z2.number().int().min(1e3).optional().default(6e4),
+  /** Randomization factor added to reconnect backoff to avoid synchronized reconnect storms. */
+  reconnectJitter: z2.number().min(0).max(1).optional().default(0.3),
+  /** Maximum reconnect cycles before the channel stops retrying and waits for the next lifecycle restart. */
+  maxReconnectCycles: z2.number().int().min(1).optional().default(10),
+  /** Time limit in milliseconds for one reconnect cycle before starting a fresh cycle. */
+  reconnectDeadlineMs: z2.number().int().min(5e3).optional().default(5e4),
+  /** Enable the plugin connection manager. Disable only when you intentionally rely on DWClient native keepAlive plus autoReconnect behavior. */
+  useConnectionManager: z2.boolean().optional().default(true),
+  /** Maximum inbound media size in MB accepted by the plugin. When omitted, the runtime default is used. */
+  mediaMaxMb: z2.number().int().min(1).optional(),
+  /** Enable the underlying Stream client heartbeat. When omitted, runtime derives a default from `useConnectionManager`. */
+  keepAlive: z2.boolean().optional(),
+  /** Bypass global or system HTTP(S) proxy settings for DingTalk send, upload, and card APIs. */
+  bypassProxyForSend: z2.boolean().optional().default(false),
+  /** Controls the proactive-send permission reminder shown when a conversation has not granted send rights yet. */
+  proactivePermissionHint: z2.object({
+    /** Show the proactive-send permission hint when the runtime detects missing DingTalk proactive permission. */
+    enabled: z2.boolean().optional().default(true),
+    /** Minimum cooldown in hours before the same proactive permission hint can be shown again. */
+    cooldownHours: z2.number().int().min(1).max(24 * 30).optional().default(24)
+  }).optional().default({ enabled: true, cooldownHours: 24 }),
+  /** Deprecated compatibility flag. When true and `cardStreamingMode` is unset, runtime resolves to `cardStreamingMode: "all"`. Do not use in new configs. */
+  cardRealTimeStream: z2.boolean().optional(),
+  /** Card streaming mode:
+   *  - off: disable incremental streaming
+   *  - answer: stream answer text
+   *  - all: stream answer + reasoning or thinking text */
+  cardStreamingMode: CardStreamingModeSchema.optional(),
+  /** Throttle interval in milliseconds between AI card streaming updates. */
+  cardStreamInterval: z2.number().int().min(200).optional().default(1e3),
+  /** Cooldown window in milliseconds after AI card trigger errors. Replies fall back to non-card delivery during this period. */
+  aicardDegradeMs: z2.number().int().min(6e4).optional().default(30 * 60 * 1e3),
+  /** Enable the local feedback-learning loop for notes, reflections, and command-assisted learning. */
+  learningEnabled: z2.boolean().optional(),
+  /** Automatically apply generated learning output into session notes or global rules when available. */
+  learningAutoApply: z2.boolean().optional(),
+  /** Retention window in milliseconds for temporary learning notes. */
+  learningNoteTtlMs: z2.number().int().min(6e4).optional(),
+  /** Convert markdown tables to plain text before sending when you want more consistent DingTalk rendering. */
+  convertMarkdownTables: z2.boolean().optional().default(true),
+  /** @mention the sender after card finalization in group chats.
+   *  Set to a non-empty string (e.g. "✅ 回复完成") to enable — the value is used as the message text.
+   *  Leave empty or omit to disable. */
+  cardAtSender: z2.string().optional(),
+  /** Status line visibility toggles for the AI card footer. */
+  cardStatusLine: z2.object({
+    /** Show model name. */
+    model: z2.boolean().optional().default(true),
+    /** Show thinking effort level. */
+    effort: z2.boolean().optional().default(true),
+    /** Show agent display name. */
+    agent: z2.boolean().optional().default(true),
+    /** Show task elapsed time. */
+    taskTime: z2.boolean().optional().default(false),
+    /** Show token usage summary (input/output/cache). */
+    tokens: z2.boolean().optional().default(false),
+    /** Show DingTalk API call count. */
+    dapiUsage: z2.boolean().optional().default(false)
+  }).optional().default({ model: true, effort: true, agent: true, taskTime: false, tokens: false, dapiUsage: false })
+};
+var DingTalkAccountConfigSchema = z2.object(DingTalkAccountConfigShape);
+var DingTalkConfigSchema = DingTalkAccountConfigSchema.extend({
+  /** Multi-account configuration */
+  accounts: z2.record(z2.string(), DingTalkAccountConfigSchema.optional()).optional()
+});
+
+// src/gateway/channel-gateway.ts
+import { DWClient, TOPIC_CARD, TOPIC_ROBOT } from "dingtalk-stream";
+
 // src/card-callback-service.ts
 var DINGTALK_API = "https://api.dingtalk.com";
 function stringifyCandidate(value) {
@@ -1904,36 +1934,6 @@ import { randomUUID } from "node:crypto";
 import * as fs3 from "node:fs";
 import * as path4 from "node:path";
 
-// src/auth.ts
-var accessTokenCache = /* @__PURE__ */ new Map();
-async function getAccessToken(config, log) {
-  const cacheKey = config.clientId;
-  const now = Date.now();
-  const cached = accessTokenCache.get(cacheKey);
-  if (cached && cached.expiry > now + 6e4) {
-    return cached.accessToken;
-  }
-  const runtimeConfig = await resolveRuntimeConfig(config, log);
-  const token = await retryWithBackoff(
-    async () => {
-      const response = await http_client_default.post(
-        "https://api.dingtalk.com/v1.0/oauth2/accessToken",
-        {
-          appKey: runtimeConfig.clientId,
-          appSecret: runtimeConfig.clientSecret
-        }
-      );
-      accessTokenCache.set(cacheKey, {
-        accessToken: response.data.accessToken,
-        expiry: now + response.data.expireIn * 1e3
-      });
-      return response.data.accessToken;
-    },
-    { maxRetries: 3, log }
-  );
-  return token;
-}
-
 // src/card/card-template.ts
 var STOP_ACTION_VISIBLE = true;
 var BUILTIN_DINGTALK_CARD_TEMPLATE_ID = process.env.DINGTALK_CARD_TEMPLATE_ID || "675cde2f-f526-40cb-b828-f5b2b57b8b77.schema";
@@ -14365,7 +14365,7 @@ async function listDocs(config, spaceId, parentId, log = getLogger()) {
 
 // index.ts
 function registerDingTalkDocsGatewayMethods(api) {
-  api.registerGatewayMethod("dingtalk.docs.create", async ({ respond, params }) => {
+  const createHandler = async ({ respond, params }) => {
     const accountId = readStringParam2(params, "accountId");
     const spaceId = readStringParam2(params, "spaceId", { required: true });
     const title = readStringParam2(params, "title", { required: true });
@@ -14394,31 +14394,187 @@ function registerDingTalkDocsGatewayMethods(api) {
       }
       throw error;
     }
-  });
-  api.registerGatewayMethod("dingtalk.docs.append", async ({ respond, params }) => {
+  };
+  const appendHandler = async ({ respond, params }) => {
     const accountId = readStringParam2(params, "accountId");
     const docId = readStringParam2(params, "docId", { required: true });
     const content = readStringParam2(params, "content", { required: true, allowEmpty: false });
     const config = getConfig(api.config, accountId ?? void 0);
     const result = await appendToDoc(config, docId, content, api.logger);
     return respond(true, result);
-  });
-  api.registerGatewayMethod("dingtalk.docs.search", async ({ respond, params }) => {
+  };
+  const searchHandler = async ({ respond, params }) => {
     const accountId = readStringParam2(params, "accountId");
     const keyword = readStringParam2(params, "keyword", { required: true });
     const spaceId = readStringParam2(params, "spaceId");
     const config = getConfig(api.config, accountId ?? void 0);
     const docs = await searchDocs(config, keyword, spaceId, api.logger);
     return respond(true, { docs });
-  });
-  api.registerGatewayMethod("dingtalk.docs.list", async ({ respond, params }) => {
+  };
+  const listHandler = async ({ respond, params }) => {
     const accountId = readStringParam2(params, "accountId");
     const spaceId = readStringParam2(params, "spaceId", { required: true });
     const parentId = readStringParam2(params, "parentId");
     const config = getConfig(api.config, accountId ?? void 0);
     const docs = await listDocs(config, spaceId, parentId, api.logger);
     return respond(true, { docs });
-  });
+  };
+  api.registerGatewayMethod("dingtalk.docs.create", createHandler);
+  api.registerGatewayMethod("dingtalk.docs.append", appendHandler);
+  api.registerGatewayMethod("dingtalk.docs.search", searchHandler);
+  api.registerGatewayMethod("dingtalk.docs.list", listHandler);
+  api.registerGatewayMethod("dingtalk-connector.docs.create", createHandler);
+  api.registerGatewayMethod("dingtalk-connector.docs.append", appendHandler);
+  api.registerGatewayMethod("dingtalk-connector.docs.search", searchHandler);
+  api.registerGatewayMethod("dingtalk-connector.docs.list", listHandler);
+}
+function getContentParam(params) {
+  return readStringParam2(params, "content") ?? readStringParam2(params, "message");
+}
+function getErrorMessage2(error, fallback) {
+  return error instanceof Error ? error.message : fallback;
+}
+function maskClientId(clientId) {
+  if (!clientId) {
+    return null;
+  }
+  return clientId.length <= 4 ? "****" : `****${clientId.slice(-4)}`;
+}
+function isConnectorSendTarget(target) {
+  return /^(user|group):\S+$/.test(target);
+}
+async function sendGatewayMessage(params) {
+  const config = getConfig(params.api.config, params.accountId);
+  const accountId = params.accountId ?? "default";
+  if (!config.clientId || !config.clientSecret) {
+    return params.respond(false, { error: "DingTalk not configured" });
+  }
+  let result;
+  try {
+    result = await sendMessage(config, params.target, params.content, {
+      log: params.api.logger,
+      accountId,
+      conversationId: params.target,
+      storePath: params.storePath,
+      forceMarkdown: params.useAICard === false
+    });
+  } catch (error) {
+    const message = getErrorMessage2(error, "send failed");
+    params.api.logger?.warn?.(`[DingTalk][GatewayRPC] send failed: ${message}`);
+    return params.respond(false, { error: message });
+  }
+  return params.respond(
+    result.ok,
+    result.ok ? {
+      ok: true,
+      target: params.target,
+      messageId: result.messageId ?? null,
+      tracking: result.tracking ?? null
+    } : { error: result.error || "send failed" }
+  );
+}
+function registerDingTalkConnectorCompatibilityGatewayMethods(api) {
+  api.registerGatewayMethod(
+    "dingtalk-connector.sendToUser",
+    async ({ context, respond, params }) => {
+      const accountId = readStringParam2(params, "accountId");
+      const userId = readStringParam2(params, "userId", { required: true });
+      const content = getContentParam(params);
+      if (!content) {
+        return respond(false, { error: "content or message is required" });
+      }
+      return sendGatewayMessage({
+        api,
+        respond,
+        accountId: accountId ?? void 0,
+        target: `user:${userId}`,
+        content,
+        storePath: context?.cronStorePath,
+        useAICard: params.useAICard
+      });
+    }
+  );
+  api.registerGatewayMethod(
+    "dingtalk-connector.sendToGroup",
+    async ({ context, respond, params }) => {
+      const accountId = readStringParam2(params, "accountId");
+      const openConversationId = readStringParam2(params, "openConversationId", { required: true });
+      const content = getContentParam(params);
+      if (!content) {
+        return respond(false, { error: "content or message is required" });
+      }
+      return sendGatewayMessage({
+        api,
+        respond,
+        accountId: accountId ?? void 0,
+        target: `group:${openConversationId}`,
+        content,
+        storePath: context?.cronStorePath,
+        useAICard: params.useAICard
+      });
+    }
+  );
+  api.registerGatewayMethod(
+    "dingtalk-connector.send",
+    async ({ context, respond, params }) => {
+      const accountId = readStringParam2(params, "accountId");
+      const target = readStringParam2(params, "target", { required: true });
+      const content = getContentParam(params);
+      if (!content) {
+        return respond(false, { error: "content or message is required" });
+      }
+      if (!isConnectorSendTarget(target)) {
+        return respond(false, { error: "target must start with user: or group:" });
+      }
+      return sendGatewayMessage({
+        api,
+        respond,
+        accountId: accountId ?? void 0,
+        target,
+        content,
+        storePath: context?.cronStorePath,
+        useAICard: params.useAICard
+      });
+    }
+  );
+  api.registerGatewayMethod(
+    "dingtalk-connector.status",
+    async ({ respond }) => {
+      const accountIds = listDingTalkAccountIds(api.config);
+      const accounts = accountIds.length > 0 ? accountIds : ["default"];
+      return respond(true, {
+        channel: "dingtalk",
+        accounts: accounts.map((accountId) => {
+          const account = resolveDingTalkAccount(api.config, accountId);
+          return {
+            accountId,
+            configured: account.configured,
+            enabled: account.enabled !== false,
+            name: account.name ?? null,
+            clientId: maskClientId(account.clientId)
+          };
+        })
+      });
+    }
+  );
+  api.registerGatewayMethod(
+    "dingtalk-connector.probe",
+    async ({ respond, params }) => {
+      const accountId = readStringParam2(params, "accountId");
+      const config = getConfig(api.config, accountId ?? void 0);
+      if (!config.clientId || !config.clientSecret) {
+        return respond(false, { error: "DingTalk not configured" });
+      }
+      try {
+        await getAccessToken(config, api.logger);
+        return respond(true, { ok: true, clientId: maskClientId(config.clientId) });
+      } catch (error) {
+        const message = getErrorMessage2(error, "probe failed");
+        api.logger?.warn?.(`[DingTalk][GatewayRPC] probe failed: ${message}`);
+        return respond(false, { error: message });
+      }
+    }
+  );
 }
 var index_default = defineChannelPluginEntry({
   id: "dingtalk",
@@ -14428,11 +14584,15 @@ var index_default = defineChannelPluginEntry({
   setRuntime: setDingTalkRuntime,
   registerFull(api) {
     registerDingTalkDocsGatewayMethods(api);
-    api.on("llm_output", (event) => {
-      if (event.usage) {
-        accumulateUsage(event.runId, event.usage);
+    registerDingTalkConnectorCompatibilityGatewayMethods(api);
+    api.on(
+      "llm_output",
+      (event) => {
+        if (event.usage) {
+          accumulateUsage(event.runId, event.usage);
+        }
       }
-    });
+    );
   }
 });
 export {