getkova 2026.4.27 → 2026.4.28

package/dist/.buildstamp

@@ -1 +1 @@
-{"builtAt":1776171151463,"head":"1daeccde2f91e6be09a3d9792b925513e9f5ddff"}
+{"builtAt":1776191324621,"head":"b584a1cd7ea55b3e6c271fa95127e7603c3a5d00"}

package/dist/abort-DRk9otya.js

@@ -0,0 +1,201 @@
+import { r as formatErrorMessage } from "./errors-CGMew-1w.js";
+import { o as normalizeOptionalLowercaseString, s as normalizeOptionalString } from "./string-coerce-CIT1-v_a.js";
+import { x as parseAgentSessionKey } from "./session-key-B67CpgUS.js";
+import { v as resolveSessionAgentId } from "./agent-scope-CLTdVQeU.js";
+import { r as logVerbose } from "./globals-DT1z8ZSy.js";
+import { L as getLatestSubagentRunByChildSessionKey, U as markSubagentRunTerminated, V as listSubagentRunsForController } from "./pi-embedded-B-l_oOjj.js";
+import { a as resolveSessionStoreEntry, c as updateSessionStore } from "./store-CZ1B9QbQ.js";
+import "./sessions-DxovCZiS.js";
+import { l as resolveStorePath } from "./paths-0uppdwEr.js";
+import { t as loadSessionStore } from "./store-load-MX54jodH.js";
+import { b as resolveInternalSessionKey, x as resolveMainSessionAlias } from "./subagents-format-CvkmJL5V.js";
+import { h as replyRunRegistry, t as abortEmbeddedPiRun } from "./runs-BDiyste7.js";
+import { i as clearSessionQueues } from "./queue-P6vzx90e.js";
+import { n as getAcpSessionManager } from "./manager-COnFGGCy.js";
+import { i as setAbortMemory, n as isAbortRequestText } from "./abort-primitives-hcpcua71.js";
+import { o as stripMentions, s as stripStructuralPrefixes } from "./mentions-Cfq6fLmr.js";
+import { t as resolveCommandAuthorization } from "./command-auth-CJL4g1RH.js";
+import { a as shouldPersistAbortCutoff, i as resolveAbortCutoffFromContext, t as applyAbortCutoffToSessionEntry } from "./abort-cutoff-s6EfsbL9.js";
+const abortDeps = {
+	getAcpSessionManager,
+	abortEmbeddedPiRun,
+	getLatestSubagentRunByChildSessionKey,
+	listSubagentRunsForController,
+	markSubagentRunTerminated
+};
+function formatAbortReplyText(stoppedSubagents) {
+	if (typeof stoppedSubagents !== "number" || stoppedSubagents <= 0) return "⚙️ Agent was aborted.";
+	return `⚙️ Agent was aborted. Stopped ${stoppedSubagents} ${stoppedSubagents === 1 ? "sub-agent" : "sub-agents"}.`;
+}
+function resolveSessionEntryForKey(store, sessionKey) {
+	if (!store || !sessionKey) return {};
+	const resolved = resolveSessionStoreEntry({
+		store,
+		sessionKey
+	});
+	if (resolved.existing) return resolved.legacyKeys.length > 0 ? {
+		entry: resolved.existing,
+		key: resolved.normalizedKey,
+		legacyKeys: resolved.legacyKeys
+	} : {
+		entry: resolved.existing,
+		key: resolved.normalizedKey
+	};
+	return {};
+}
+function normalizeRequesterSessionKey(cfg, key) {
+	const cleaned = normalizeOptionalString(key);
+	if (!cleaned) return;
+	const { mainKey, alias } = resolveMainSessionAlias(cfg);
+	return resolveInternalSessionKey({
+		key: cleaned,
+		alias,
+		mainKey
+	});
+}
+function stopSubagentsForRequester(params) {
+	const requesterKey = normalizeRequesterSessionKey(params.cfg, params.requesterSessionKey);
+	if (!requesterKey) return { stopped: 0 };
+	const dedupedRunsByChildKey = /* @__PURE__ */ new Map();
+	for (const run of abortDeps.listSubagentRunsForController(requesterKey)) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey) continue;
+		const latest = abortDeps.getLatestSubagentRunByChildSessionKey(childKey);
+		if (!latest) {
+			const existing = dedupedRunsByChildKey.get(childKey);
+			if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+			continue;
+		}
+		const latestControllerSessionKey = normalizeOptionalString(latest?.controllerSessionKey) ?? normalizeOptionalString(latest?.requesterSessionKey);
+		if (latest.runId !== run.runId || latestControllerSessionKey !== requesterKey) continue;
+		const existing = dedupedRunsByChildKey.get(childKey);
+		if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+	}
+	const runs = Array.from(dedupedRunsByChildKey.values());
+	if (runs.length === 0) return { stopped: 0 };
+	const storeCache = /* @__PURE__ */ new Map();
+	const seenChildKeys = /* @__PURE__ */ new Set();
+	let stopped = 0;
+	for (const run of runs) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey || seenChildKeys.has(childKey)) continue;
+		seenChildKeys.add(childKey);
+		if (!run.endedAt) {
+			const cleared = clearSessionQueues([childKey]);
+			const parsed = parseAgentSessionKey(childKey);
+			const storePath = resolveStorePath(params.cfg.session?.store, { agentId: parsed?.agentId });
+			let store = storeCache.get(storePath);
+			if (!store) {
+				store = loadSessionStore(storePath);
+				storeCache.set(storePath, store);
+			}
+			const entry = store[childKey];
+			const sessionId = replyRunRegistry.resolveSessionId(childKey) ?? entry?.sessionId;
+			const aborted = (childKey ? replyRunRegistry.abort(childKey) : false) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+			if (abortDeps.markSubagentRunTerminated({
+				runId: run.runId,
+				childSessionKey: childKey,
+				reason: "killed"
+			}) > 0 || aborted || cleared.followupCleared > 0 || cleared.laneCleared > 0) stopped += 1;
+		}
+		const cascadeResult = stopSubagentsForRequester({
+			cfg: params.cfg,
+			requesterSessionKey: childKey
+		});
+		stopped += cascadeResult.stopped;
+	}
+	if (stopped > 0) logVerbose(`abort: stopped ${stopped} subagent run(s) for ${requesterKey}`);
+	return { stopped };
+}
+async function tryFastAbortFromMessage(params) {
+	const { ctx, cfg } = params;
+	const targetKey = normalizeOptionalString(ctx.CommandTargetSessionKey) ?? normalizeOptionalString(ctx.SessionKey);
+	const raw = stripStructuralPrefixes(ctx.CommandBody ?? ctx.RawBody ?? ctx.Body ?? "");
+	if (!isAbortRequestText(normalizeOptionalLowercaseString(ctx.ChatType) === "group" ? stripMentions(raw, ctx, cfg, resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	})) : raw)) return {
+		handled: false,
+		aborted: false
+	};
+	const commandAuthorized = ctx.CommandAuthorized;
+	const auth = resolveCommandAuthorization({
+		ctx,
+		cfg,
+		commandAuthorized
+	});
+	if (!auth.isAuthorizedSender) return {
+		handled: false,
+		aborted: false
+	};
+	const agentId = resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	});
+	const abortKey = targetKey ?? auth.from ?? auth.to;
+	const requesterSessionKey = targetKey ?? ctx.SessionKey ?? abortKey;
+	if (targetKey) {
+		const storePath = resolveStorePath(cfg.session?.store, { agentId });
+		const store = loadSessionStore(storePath);
+		const { entry, key, legacyKeys } = resolveSessionEntryForKey(store, targetKey);
+		const resolvedTargetKey = key ?? targetKey;
+		const acpManager = abortDeps.getAcpSessionManager();
+		if (acpManager.resolveSession({
+			cfg,
+			sessionKey: resolvedTargetKey
+		}).kind !== "none") try {
+			await acpManager.cancelSession({
+				cfg,
+				sessionKey: resolvedTargetKey,
+				reason: "fast-abort"
+			});
+		} catch (error) {
+			logVerbose(`abort: ACP cancel failed for ${resolvedTargetKey}: ${formatErrorMessage(error)}`);
+		}
+		const sessionId = replyRunRegistry.resolveSessionId(resolvedTargetKey) ?? entry?.sessionId;
+		const aborted = replyRunRegistry.abort(resolvedTargetKey) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+		const cleared = clearSessionQueues([resolvedTargetKey, sessionId]);
+		if (cleared.followupCleared > 0 || cleared.laneCleared > 0) logVerbose(`abort: cleared followups=${cleared.followupCleared} lane=${cleared.laneCleared} keys=${cleared.keys.join(",")}`);
+		const abortCutoff = shouldPersistAbortCutoff({
+			commandSessionKey: ctx.SessionKey,
+			targetSessionKey: resolvedTargetKey
+		}) ? resolveAbortCutoffFromContext(ctx) : void 0;
+		if (entry && key) {
+			entry.abortedLastRun = true;
+			applyAbortCutoffToSessionEntry(entry, abortCutoff);
+			entry.updatedAt = Date.now();
+			store[key] = entry;
+			for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete store[legacyKey];
+			await updateSessionStore(storePath, (nextStore) => {
+				const nextEntry = nextStore[key] ?? entry;
+				if (!nextEntry) return;
+				nextEntry.abortedLastRun = true;
+				applyAbortCutoffToSessionEntry(nextEntry, abortCutoff);
+				nextEntry.updatedAt = Date.now();
+				nextStore[key] = nextEntry;
+				for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete nextStore[legacyKey];
+			});
+		} else if (abortKey) setAbortMemory(abortKey, true);
+		const { stopped } = stopSubagentsForRequester({
+			cfg,
+			requesterSessionKey
+		});
+		return {
+			handled: true,
+			aborted,
+			stoppedSubagents: stopped
+		};
+	}
+	if (abortKey) setAbortMemory(abortKey, true);
+	const { stopped } = stopSubagentsForRequester({
+		cfg,
+		requesterSessionKey
+	});
+	return {
+		handled: true,
+		aborted: false,
+		stoppedSubagents: stopped
+	};
+}
+//#endregion
+export { tryFastAbortFromMessage as i, resolveSessionEntryForKey as n, stopSubagentsForRequester as r, formatAbortReplyText as t };

package/dist/abort.runtime-C8gvQlDg.js

@@ -0,0 +1,2 @@
+import { i as tryFastAbortFromMessage, t as formatAbortReplyText } from "./abort-DRk9otya.js";
+export { formatAbortReplyText, tryFastAbortFromMessage };

package/dist/abort.runtime.js

@@ -1 +1 @@
-export * from "./abort.runtime-IiQVyFfL.js";
+export * from "./abort.runtime-C8gvQlDg.js";

package/dist/access-control-KiSWnbHu.js

@@ -0,0 +1,146 @@
+import { u as normalizeE164 } from "./utils-DbiYsdmF.js";
+import { ct as loadConfig } from "./provider-runtime-k_BIACzK.js";
+import { r as logVerbose } from "./globals-DT1z8ZSy.js";
+import { p as upsertChannelPairingRequest } from "./pairing-store-DfR6pnnY.js";
+import { a as warnMissingProviderGroupPolicyFallbackOnce, r as resolveDefaultGroupPolicy } from "./runtime-group-policy-B29cWVWm.js";
+import { n as readStoreAllowFromForDmPolicy, o as resolveDmGroupAccessWithLists } from "./dm-policy-shared-B6zNVihF.js";
+import { t as createChannelPairingChallengeIssuer } from "./channel-pairing-0-2UqSTM.js";
+import "./runtime-env-DQLSuJ-f.js";
+import "./config-runtime-BmWJA7aW.js";
+import "./conversation-runtime-C_KrBfmE.js";
+import "./security-runtime-PnTuTGiZ.js";
+import { s as resolveWhatsAppAccount } from "./accounts-Ch5ia88U.js";
+import { n as isSelfChatMode } from "./text-runtime-Bh8yelu1.js";
+import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-Dj8XOZ3i.js";
+//#region extensions/whatsapp/src/inbound/access-control.ts
+const PAIRING_REPLY_HISTORY_GRACE_MS = 3e4;
+async function checkInboundAccessControl(params) {
+	const cfg = loadConfig();
+	const account = resolveWhatsAppAccount({
+		cfg,
+		accountId: params.accountId
+	});
+	const dmPolicy = account.dmPolicy ?? "pairing";
+	const configuredAllowFrom = account.allowFrom ?? [];
+	const storeAllowFrom = await readStoreAllowFromForDmPolicy({
+		provider: "whatsapp",
+		accountId: account.accountId,
+		dmPolicy
+	});
+	const defaultAllowFrom = configuredAllowFrom.length === 0 && params.selfE164 ? [params.selfE164] : [];
+	const dmAllowFrom = configuredAllowFrom.length > 0 ? configuredAllowFrom : defaultAllowFrom;
+	const groupAllowFrom = account.groupAllowFrom ?? (configuredAllowFrom.length > 0 ? configuredAllowFrom : void 0);
+	const isSamePhone = params.from === params.selfE164;
+	const isSelfChat = account.selfChatMode ?? isSelfChatMode(params.selfE164, configuredAllowFrom);
+	const pairingGraceMs = typeof params.pairingGraceMs === "number" && params.pairingGraceMs > 0 ? params.pairingGraceMs : PAIRING_REPLY_HISTORY_GRACE_MS;
+	const suppressPairingReply = typeof params.connectedAtMs === "number" && typeof params.messageTimestampMs === "number" && params.messageTimestampMs < params.connectedAtMs - pairingGraceMs;
+	const defaultGroupPolicy = resolveDefaultGroupPolicy(cfg);
+	const { groupPolicy, providerMissingFallbackApplied } = resolveWhatsAppRuntimeGroupPolicy({
+		providerConfigPresent: cfg.channels?.whatsapp !== void 0,
+		groupPolicy: account.groupPolicy,
+		defaultGroupPolicy
+	});
+	warnMissingProviderGroupPolicyFallbackOnce({
+		providerMissingFallbackApplied,
+		providerKey: "whatsapp",
+		accountId: account.accountId,
+		log: (message) => logVerbose(message)
+	});
+	const normalizedDmSender = normalizeE164(params.from);
+	const normalizedGroupSender = typeof params.senderE164 === "string" ? normalizeE164(params.senderE164) : null;
+	const access = resolveDmGroupAccessWithLists({
+		isGroup: params.group,
+		dmPolicy,
+		groupPolicy,
+		allowFrom: params.group ? configuredAllowFrom : dmAllowFrom,
+		groupAllowFrom,
+		storeAllowFrom,
+		isSenderAllowed: (allowEntries) => {
+			if (allowEntries.includes("*")) return true;
+			const normalizedEntrySet = new Set(allowEntries.map((entry) => normalizeE164(String(entry))).filter((entry) => Boolean(entry)));
+			if (!params.group && isSamePhone) return true;
+			return params.group ? Boolean(normalizedGroupSender && normalizedEntrySet.has(normalizedGroupSender)) : normalizedEntrySet.has(normalizedDmSender);
+		}
+	});
+	if (params.group && access.decision !== "allow") {
+		if (access.reason === "groupPolicy=disabled") logVerbose("Blocked group message (groupPolicy: disabled)");
+		else if (access.reason === "groupPolicy=allowlist (empty allowlist)") logVerbose("Blocked group message (groupPolicy: allowlist, no groupAllowFrom)");
+		else logVerbose(`Blocked group message from ${params.senderE164 ?? "unknown sender"} (groupPolicy: allowlist)`);
+		return {
+			allowed: false,
+			shouldMarkRead: false,
+			isSelfChat,
+			resolvedAccountId: account.accountId
+		};
+	}
+	if (!params.group) {
+		if (params.isFromMe && !isSamePhone) {
+			logVerbose("Skipping outbound DM (fromMe); no pairing reply needed.");
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat,
+				resolvedAccountId: account.accountId
+			};
+		}
+		if (access.decision === "block" && access.reason === "dmPolicy=disabled") {
+			logVerbose("Blocked dm (dmPolicy: disabled)");
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat,
+				resolvedAccountId: account.accountId
+			};
+		}
+		if (access.decision === "pairing" && !isSamePhone) {
+			const candidate = params.from;
+			if (suppressPairingReply) logVerbose(`Skipping pairing reply for historical DM from ${candidate}.`);
+			else await createChannelPairingChallengeIssuer({
+				channel: "whatsapp",
+				upsertPairingRequest: async ({ id, meta }) => await upsertChannelPairingRequest({
+					channel: "whatsapp",
+					id,
+					accountId: account.accountId,
+					meta
+				})
+			})({
+				senderId: candidate,
+				senderIdLine: `Your WhatsApp phone number: ${candidate}`,
+				meta: { name: (params.pushName ?? "").trim() || void 0 },
+				onCreated: () => {
+					logVerbose(`whatsapp pairing request sender=${candidate} name=${params.pushName ?? "unknown"}`);
+				},
+				sendPairingReply: async (text) => {
+					await params.sock.sendMessage(params.remoteJid, { text });
+				},
+				onReplyError: (err) => {
+					logVerbose(`whatsapp pairing reply failed for ${candidate}: ${String(err)}`);
+				}
+			});
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat,
+				resolvedAccountId: account.accountId
+			};
+		}
+		if (access.decision !== "allow") {
+			logVerbose(`Blocked unauthorized sender ${params.from} (dmPolicy=${dmPolicy})`);
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat,
+				resolvedAccountId: account.accountId
+			};
+		}
+	}
+	return {
+		allowed: true,
+		shouldMarkRead: true,
+		isSelfChat,
+		resolvedAccountId: account.accountId
+	};
+}
+const __testing = { resolveWhatsAppRuntimeGroupPolicy };
+//#endregion
+export { checkInboundAccessControl as n, __testing as t };

package/dist/accounts-B9PF1JX7.js

@@ -0,0 +1,133 @@
+import { s as normalizeOptionalString } from "./string-coerce-CIT1-v_a.js";
+import { n as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./account-id-CtHdKPEZ.js";
+import { a as hasConfiguredSecretInput } from "./types.secrets-B9wF6b7d.js";
+import "./text-runtime-DYnhXZIB.js";
+import "./secret-input-D6rNdT8W.js";
+import { a as resolveMatrixDefaultOrOnlyAccountId, o as resolveMatrixAccountStringValues, r as resolveConfiguredMatrixAccountIds } from "./account-selection-Dfhq_bjs.js";
+import { c as resolveMatrixBaseConfig, i as findMatrixAccountConfig, s as resolveMatrixAccountConfig } from "./config-paths-Bj7M0FWH.js";
+import { c as resolveScopedMatrixEnvConfig, r as resolveGlobalMatrixEnvConfig } from "./config-BBpRxcXc.js";
+import "./env-auth-uwjbkQYr.js";
+import { n as loadMatrixCredentials, t as credentialsMatchConfig } from "./credentials-read-DbiyrGlE.js";
+//#region extensions/matrix/src/matrix/accounts.ts
+function clean(value) {
+	return normalizeOptionalString(value) ?? "";
+}
+function resolveMatrixAccountAuthView(params) {
+	const normalizedAccountId = normalizeAccountId(params.accountId);
+	const matrix = resolveMatrixBaseConfig(params.cfg);
+	const account = findMatrixAccountConfig(params.cfg, normalizedAccountId) ?? {};
+	const resolvedStrings = resolveMatrixAccountStringValues({
+		accountId: normalizedAccountId,
+		account: {
+			homeserver: clean(account.homeserver),
+			userId: clean(account.userId),
+			accessToken: typeof account.accessToken === "string" ? clean(account.accessToken) : "",
+			password: typeof account.password === "string" ? clean(account.password) : "",
+			deviceId: clean(account.deviceId),
+			deviceName: clean(account.deviceName)
+		},
+		scopedEnv: resolveScopedMatrixEnvConfig(normalizedAccountId, params.env),
+		channel: {
+			homeserver: clean(matrix.homeserver),
+			userId: clean(matrix.userId),
+			accessToken: typeof matrix.accessToken === "string" ? clean(matrix.accessToken) : "",
+			password: typeof matrix.password === "string" ? clean(matrix.password) : "",
+			deviceId: clean(matrix.deviceId),
+			deviceName: clean(matrix.deviceName)
+		},
+		globalEnv: resolveGlobalMatrixEnvConfig(params.env)
+	});
+	return {
+		homeserver: resolvedStrings.homeserver,
+		userId: resolvedStrings.userId,
+		accessToken: resolvedStrings.accessToken || void 0,
+		password: resolvedStrings.password || void 0
+	};
+}
+function resolveMatrixAccountUserId(params) {
+	const env = params.env ?? process.env;
+	const authView = resolveMatrixAccountAuthView({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		env
+	});
+	const configuredUserId = authView.userId.trim();
+	if (configuredUserId) return configuredUserId;
+	const stored = loadMatrixCredentials(env, params.accountId);
+	if (!stored) return null;
+	if (authView.homeserver && stored.homeserver !== authView.homeserver) return null;
+	if (authView.accessToken && stored.accessToken !== authView.accessToken) return null;
+	return stored.userId.trim() || null;
+}
+function listMatrixAccountIds(cfg) {
+	const ids = resolveConfiguredMatrixAccountIds(cfg, process.env);
+	return ids.length > 0 ? ids : [DEFAULT_ACCOUNT_ID];
+}
+function resolveDefaultMatrixAccountId(cfg) {
+	return normalizeAccountId(resolveMatrixDefaultOrOnlyAccountId(cfg));
+}
+function resolveConfiguredMatrixBotUserIds(params) {
+	const env = params.env ?? process.env;
+	const currentAccountId = normalizeAccountId(params.accountId);
+	const accountIds = new Set(resolveConfiguredMatrixAccountIds(params.cfg, env));
+	if (resolveMatrixAccount({
+		cfg: params.cfg,
+		accountId: "default",
+		env
+	}).configured) accountIds.add(DEFAULT_ACCOUNT_ID);
+	const ids = /* @__PURE__ */ new Set();
+	for (const accountId of accountIds) {
+		if (normalizeAccountId(accountId) === currentAccountId) continue;
+		if (!resolveMatrixAccount({
+			cfg: params.cfg,
+			accountId,
+			env
+		}).configured) continue;
+		const userId = resolveMatrixAccountUserId({
+			cfg: params.cfg,
+			accountId,
+			env
+		});
+		if (userId) ids.add(userId);
+	}
+	return ids;
+}
+function resolveMatrixAccount(params) {
+	const env = params.env ?? process.env;
+	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultMatrixAccountId(params.cfg));
+	const matrixBase = resolveMatrixBaseConfig(params.cfg);
+	const base = resolveMatrixAccountConfig({
+		cfg: params.cfg,
+		accountId,
+		env
+	});
+	const explicitAuthConfig = accountId === "default" ? base : findMatrixAccountConfig(params.cfg, accountId) ?? {};
+	const enabled = base.enabled !== false && matrixBase.enabled !== false;
+	const authView = resolveMatrixAccountAuthView({
+		cfg: params.cfg,
+		accountId,
+		env
+	});
+	const hasHomeserver = Boolean(authView.homeserver);
+	const hasUserId = Boolean(authView.userId);
+	const hasAccessToken = Boolean(authView.accessToken) || hasConfiguredSecretInput(explicitAuthConfig.accessToken);
+	const hasPassword = Boolean(authView.password);
+	const hasPasswordAuth = hasUserId && (hasPassword || hasConfiguredSecretInput(explicitAuthConfig.password));
+	const stored = loadMatrixCredentials(env, accountId);
+	const hasStored = stored && authView.homeserver ? credentialsMatchConfig(stored, {
+		homeserver: authView.homeserver,
+		userId: authView.userId || ""
+	}) : false;
+	const configured = hasHomeserver && (hasAccessToken || hasPasswordAuth || Boolean(hasStored));
+	return {
+		accountId,
+		enabled,
+		name: normalizeOptionalString(base.name),
+		configured,
+		homeserver: authView.homeserver || void 0,
+		userId: authView.userId || void 0,
+		config: base
+	};
+}
+//#endregion
+export { resolveMatrixAccount as i, resolveConfiguredMatrixBotUserIds as n, resolveDefaultMatrixAccountId as r, listMatrixAccountIds as t };

package/dist/accounts-BBUn2cx7.js

@@ -0,0 +1,104 @@
+import { s as normalizeOptionalString } from "./string-coerce-CIT1-v_a.js";
+import { n as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./account-id-CtHdKPEZ.js";
+import { c as normalizeResolvedSecretInputString, l as normalizeSecretInputString } from "./types.secrets-B9wF6b7d.js";
+import { t as resolveAccountEntry } from "./account-lookup-Bm7Mt78_.js";
+import "./text-runtime-DYnhXZIB.js";
+import { s as resolveMergedAccountConfig, t as createAccountListHelpers } from "./account-helpers-rMKmE2wR.js";
+import { i as tryReadSecretFileSync } from "./secret-file-UfStLpnE.js";
+import "./core-CdcMAo6o.js";
+import "./routing-DLQFZ-sa.js";
+import "./secret-input-D6rNdT8W.js";
+//#region extensions/zalo/src/token.ts
+function readTokenFromFile(tokenFile) {
+	return tryReadSecretFileSync(tokenFile, "Zalo token file", { rejectSymlink: true }) ?? "";
+}
+function resolveZaloToken(config, accountId, options) {
+	const resolvedAccountId = normalizeAccountId(accountId ?? config?.defaultAccount);
+	const isDefaultAccount = resolvedAccountId === DEFAULT_ACCOUNT_ID;
+	const baseConfig = config;
+	const accountConfig = resolveAccountEntry(baseConfig?.accounts, normalizeAccountId(resolvedAccountId));
+	const accountHasBotToken = Boolean(accountConfig && Object.prototype.hasOwnProperty.call(accountConfig, "botToken"));
+	if (accountConfig && accountHasBotToken) {
+		const token = options?.allowUnresolvedSecretRef ? normalizeSecretInputString(accountConfig.botToken) : normalizeResolvedSecretInputString({
+			value: accountConfig.botToken,
+			path: `channels.zalo.accounts.${resolvedAccountId}.botToken`
+		});
+		if (token) return {
+			token,
+			source: "config"
+		};
+		const fileToken = readTokenFromFile(accountConfig.tokenFile);
+		if (fileToken) return {
+			token: fileToken,
+			source: "configFile"
+		};
+	}
+	if (!accountHasBotToken) {
+		const fileToken = readTokenFromFile(accountConfig?.tokenFile);
+		if (fileToken) return {
+			token: fileToken,
+			source: "configFile"
+		};
+	}
+	if (!accountHasBotToken) {
+		const token = options?.allowUnresolvedSecretRef ? normalizeSecretInputString(baseConfig?.botToken) : normalizeResolvedSecretInputString({
+			value: baseConfig?.botToken,
+			path: "channels.zalo.botToken"
+		});
+		if (token) return {
+			token,
+			source: "config"
+		};
+		const fileToken = readTokenFromFile(baseConfig?.tokenFile);
+		if (fileToken) return {
+			token: fileToken,
+			source: "configFile"
+		};
+	}
+	if (isDefaultAccount) {
+		const envToken = process.env.ZALO_BOT_TOKEN?.trim();
+		if (envToken) return {
+			token: envToken,
+			source: "env"
+		};
+	}
+	return {
+		token: "",
+		source: "none"
+	};
+}
+//#endregion
+//#region extensions/zalo/src/accounts.ts
+const { listAccountIds: listZaloAccountIds, resolveDefaultAccountId: resolveDefaultZaloAccountId } = createAccountListHelpers("zalo");
+function mergeZaloAccountConfig(cfg, accountId) {
+	return resolveMergedAccountConfig({
+		channelConfig: cfg.channels?.zalo,
+		accounts: (cfg.channels?.zalo)?.accounts,
+		accountId,
+		omitKeys: ["defaultAccount"]
+	});
+}
+function resolveZaloAccount(params) {
+	const accountId = normalizeAccountId(params.accountId ?? (params.cfg.channels?.zalo)?.defaultAccount);
+	const baseEnabled = (params.cfg.channels?.zalo)?.enabled !== false;
+	const merged = mergeZaloAccountConfig(params.cfg, accountId);
+	const accountEnabled = merged.enabled !== false;
+	const enabled = baseEnabled && accountEnabled;
+	const tokenResolution = resolveZaloToken(params.cfg.channels?.zalo, accountId, { allowUnresolvedSecretRef: params.allowUnresolvedSecretRef });
+	return {
+		accountId,
+		name: normalizeOptionalString(merged.name),
+		enabled,
+		token: tokenResolution.token,
+		tokenSource: tokenResolution.source,
+		config: merged
+	};
+}
+function listEnabledZaloAccounts(cfg) {
+	return listZaloAccountIds(cfg).map((accountId) => resolveZaloAccount({
+		cfg,
+		accountId
+	})).filter((account) => account.enabled);
+}
+//#endregion
+export { resolveZaloToken as a, resolveZaloAccount as i, listZaloAccountIds as n, resolveDefaultZaloAccountId as r, listEnabledZaloAccounts as t };