sealclaw 2026.5.78 → 2026.5.80

package/dist/abort-CKqwH0eA.js

@@ -0,0 +1,202 @@
+import { c as normalizeOptionalString, s as normalizeOptionalLowercaseString } from "./string-coerce-Bje8XVt9.js";
+import { i as formatErrorMessage } from "./errors-D4jx1Axd.js";
+import { o as parseAgentSessionKey } from "./session-key-utils-BiZnc9ns.js";
+import { p as resolveSessionAgentId } from "./agent-scope-DcilFo3V.js";
+import { r as logVerbose } from "./globals-CHNs9cIE.js";
+import { u as resolveStorePath } from "./paths-B9zIGb6o.js";
+import { t as loadSessionStore } from "./store-load-BVkE8_v8.js";
+import { d as resolveSessionStoreEntry, o as updateSessionStore } from "./store-lHGoCkld.js";
+import "./sessions-CWe5Y11f.js";
+import { h as replyRunRegistry } from "./run-state-DEHDqFli.js";
+import { n as abortEmbeddedPiRun } from "./runs-BJngugAg.js";
+import { n as getAcpSessionManager } from "./manager-R8zRfxAq.js";
+import { c as resolveMainSessionAlias, s as resolveInternalSessionKey } from "./sessions-helpers-ChPn2Hn_.js";
+import { s as clearSessionQueues } from "./queue-DvqzGFUW.js";
+import { f as markSubagentRunTerminated, o as getLatestSubagentRunByChildSessionKey, u as listSubagentRunsForController } from "./subagent-registry-DlF3yXjn.js";
+import { o as stripMentions, s as stripStructuralPrefixes } from "./mentions-CoKfBMbu.js";
+import { i as setAbortMemory, n as isAbortRequestText } from "./abort-primitives-DTiyVtvz.js";
+import { t as resolveCommandAuthorization } from "./command-auth-CNmYqgdk.js";
+import { a as shouldPersistAbortCutoff, i as resolveAbortCutoffFromContext, t as applyAbortCutoffToSessionEntry } from "./abort-cutoff-Br7JHgND.js";
+const abortDeps = {
+	getAcpSessionManager,
+	abortEmbeddedPiRun,
+	getLatestSubagentRunByChildSessionKey,
+	listSubagentRunsForController,
+	markSubagentRunTerminated
+};
+function formatAbortReplyText(stoppedSubagents) {
+	if (typeof stoppedSubagents !== "number" || stoppedSubagents <= 0) return "⚙️ Agent was aborted.";
+	return `⚙️ Agent was aborted. Stopped ${stoppedSubagents} ${stoppedSubagents === 1 ? "sub-agent" : "sub-agents"}.`;
+}
+function resolveSessionEntryForKey(store, sessionKey) {
+	if (!store || !sessionKey) return {};
+	const resolved = resolveSessionStoreEntry({
+		store,
+		sessionKey
+	});
+	if (resolved.existing) return resolved.legacyKeys.length > 0 ? {
+		entry: resolved.existing,
+		key: resolved.normalizedKey,
+		legacyKeys: resolved.legacyKeys
+	} : {
+		entry: resolved.existing,
+		key: resolved.normalizedKey
+	};
+	return {};
+}
+function normalizeRequesterSessionKey(cfg, key) {
+	const cleaned = normalizeOptionalString(key);
+	if (!cleaned) return;
+	const { mainKey, alias } = resolveMainSessionAlias(cfg);
+	return resolveInternalSessionKey({
+		key: cleaned,
+		alias,
+		mainKey
+	});
+}
+function stopSubagentsForRequester(params) {
+	const requesterKey = normalizeRequesterSessionKey(params.cfg, params.requesterSessionKey);
+	if (!requesterKey) return { stopped: 0 };
+	const dedupedRunsByChildKey = /* @__PURE__ */ new Map();
+	for (const run of abortDeps.listSubagentRunsForController(requesterKey)) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey) continue;
+		const latest = abortDeps.getLatestSubagentRunByChildSessionKey(childKey);
+		if (!latest) {
+			const existing = dedupedRunsByChildKey.get(childKey);
+			if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+			continue;
+		}
+		const latestControllerSessionKey = normalizeOptionalString(latest?.controllerSessionKey) ?? normalizeOptionalString(latest?.requesterSessionKey);
+		if (latest.runId !== run.runId || latestControllerSessionKey !== requesterKey) continue;
+		const existing = dedupedRunsByChildKey.get(childKey);
+		if (!existing || run.createdAt >= existing.createdAt) dedupedRunsByChildKey.set(childKey, run);
+	}
+	const runs = Array.from(dedupedRunsByChildKey.values());
+	if (runs.length === 0) return { stopped: 0 };
+	const storeCache = /* @__PURE__ */ new Map();
+	const seenChildKeys = /* @__PURE__ */ new Set();
+	let stopped = 0;
+	for (const run of runs) {
+		const childKey = normalizeOptionalString(run.childSessionKey);
+		if (!childKey || seenChildKeys.has(childKey)) continue;
+		seenChildKeys.add(childKey);
+		if (!run.endedAt) {
+			const cleared = clearSessionQueues([childKey]);
+			const parsed = parseAgentSessionKey(childKey);
+			const storePath = resolveStorePath(params.cfg.session?.store, { agentId: parsed?.agentId });
+			let store = storeCache.get(storePath);
+			if (!store) {
+				store = loadSessionStore(storePath);
+				storeCache.set(storePath, store);
+			}
+			const entry = store[childKey];
+			const sessionId = replyRunRegistry.resolveSessionId(childKey) ?? entry?.sessionId;
+			const aborted = (childKey ? replyRunRegistry.abort(childKey) : false) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+			if (abortDeps.markSubagentRunTerminated({
+				runId: run.runId,
+				childSessionKey: childKey,
+				reason: "killed"
+			}) > 0 || aborted || cleared.followupCleared > 0 || cleared.laneCleared > 0) stopped += 1;
+		}
+		const cascadeResult = stopSubagentsForRequester({
+			cfg: params.cfg,
+			requesterSessionKey: childKey
+		});
+		stopped += cascadeResult.stopped;
+	}
+	if (stopped > 0) logVerbose(`abort: stopped ${stopped} subagent run(s) for ${requesterKey}`);
+	return { stopped };
+}
+async function tryFastAbortFromMessage(params) {
+	const { ctx, cfg } = params;
+	const targetKey = normalizeOptionalString(ctx.CommandTargetSessionKey) ?? normalizeOptionalString(ctx.SessionKey);
+	const raw = stripStructuralPrefixes(ctx.CommandBody ?? ctx.RawBody ?? ctx.Body ?? "");
+	if (!isAbortRequestText(normalizeOptionalLowercaseString(ctx.ChatType) === "group" ? stripMentions(raw, ctx, cfg, resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	})) : raw)) return {
+		handled: false,
+		aborted: false
+	};
+	const commandAuthorized = ctx.CommandAuthorized;
+	const auth = resolveCommandAuthorization({
+		ctx,
+		cfg,
+		commandAuthorized
+	});
+	if (!auth.isAuthorizedSender) return {
+		handled: false,
+		aborted: false
+	};
+	const agentId = resolveSessionAgentId({
+		sessionKey: targetKey ?? ctx.SessionKey ?? "",
+		config: cfg
+	});
+	const abortKey = targetKey ?? auth.from ?? auth.to;
+	const requesterSessionKey = targetKey ?? ctx.SessionKey ?? abortKey;
+	if (targetKey) {
+		const storePath = resolveStorePath(cfg.session?.store, { agentId });
+		const store = loadSessionStore(storePath);
+		const { entry, key, legacyKeys } = resolveSessionEntryForKey(store, targetKey);
+		const resolvedTargetKey = key ?? targetKey;
+		const acpManager = abortDeps.getAcpSessionManager();
+		if (acpManager.resolveSession({
+			cfg,
+			sessionKey: resolvedTargetKey
+		}).kind !== "none") try {
+			await acpManager.cancelSession({
+				cfg,
+				sessionKey: resolvedTargetKey,
+				reason: "fast-abort"
+			});
+		} catch (error) {
+			logVerbose(`abort: ACP cancel failed for ${resolvedTargetKey}: ${formatErrorMessage(error)}`);
+		}
+		const sessionId = replyRunRegistry.resolveSessionId(resolvedTargetKey) ?? entry?.sessionId;
+		const aborted = replyRunRegistry.abort(resolvedTargetKey) || (sessionId ? abortDeps.abortEmbeddedPiRun(sessionId) : false);
+		const cleared = clearSessionQueues([resolvedTargetKey, sessionId]);
+		if (cleared.followupCleared > 0 || cleared.laneCleared > 0) logVerbose(`abort: cleared followups=${cleared.followupCleared} lane=${cleared.laneCleared} keys=${cleared.keys.join(",")}`);
+		const abortCutoff = shouldPersistAbortCutoff({
+			commandSessionKey: ctx.SessionKey,
+			targetSessionKey: resolvedTargetKey
+		}) ? resolveAbortCutoffFromContext(ctx) : void 0;
+		if (entry && key) {
+			entry.abortedLastRun = true;
+			applyAbortCutoffToSessionEntry(entry, abortCutoff);
+			entry.updatedAt = Date.now();
+			store[key] = entry;
+			for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete store[legacyKey];
+			await updateSessionStore(storePath, (nextStore) => {
+				const nextEntry = nextStore[key] ?? entry;
+				if (!nextEntry) return;
+				nextEntry.abortedLastRun = true;
+				applyAbortCutoffToSessionEntry(nextEntry, abortCutoff);
+				nextEntry.updatedAt = Date.now();
+				nextStore[key] = nextEntry;
+				for (const legacyKey of legacyKeys ?? []) if (legacyKey !== key) delete nextStore[legacyKey];
+			});
+		} else if (abortKey) setAbortMemory(abortKey, true);
+		const { stopped } = stopSubagentsForRequester({
+			cfg,
+			requesterSessionKey
+		});
+		return {
+			handled: true,
+			aborted,
+			stoppedSubagents: stopped
+		};
+	}
+	if (abortKey) setAbortMemory(abortKey, true);
+	const { stopped } = stopSubagentsForRequester({
+		cfg,
+		requesterSessionKey
+	});
+	return {
+		handled: true,
+		aborted: false,
+		stoppedSubagents: stopped
+	};
+}
+//#endregion
+export { tryFastAbortFromMessage as i, resolveSessionEntryForKey as n, stopSubagentsForRequester as r, formatAbortReplyText as t };

package/dist/abort-primitives-DTiyVtvz.js

@@ -0,0 +1,93 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-Bje8XVt9.js";
+import { r as normalizeCommandBody } from "./commands-registry-normalize-miRMd_Vl.js";
+//#region src/auto-reply/reply/abort-primitives.ts
+const ABORT_TRIGGERS = new Set([
+	"stop",
+	"esc",
+	"abort",
+	"wait",
+	"exit",
+	"interrupt",
+	"detente",
+	"deten",
+	"detén",
+	"arrete",
+	"arrête",
+	"停止",
+	"やめて",
+	"止めて",
+	"रुको",
+	"توقف",
+	"стоп",
+	"остановись",
+	"останови",
+	"остановить",
+	"прекрати",
+	"halt",
+	"anhalten",
+	"aufhören",
+	"hoer auf",
+	"stopp",
+	"pare",
+	"stop openclaw",
+	"openclaw stop",
+	"stop action",
+	"stop current action",
+	"stop run",
+	"stop current run",
+	"stop agent",
+	"stop the agent",
+	"stop don't do anything",
+	"stop dont do anything",
+	"stop do not do anything",
+	"stop doing anything",
+	"do not do that",
+	"please stop",
+	"stop please"
+]);
+const ABORT_MEMORY = /* @__PURE__ */ new Map();
+const ABORT_MEMORY_MAX = 2e3;
+const TRAILING_ABORT_PUNCTUATION_RE = /[.!?…,，。;；:：'"’”)\]}]+$/u;
+function normalizeAbortTriggerText(text) {
+	return normalizeLowercaseStringOrEmpty(text).replace(/[’`]/g, "'").replace(/\s+/g, " ").replace(TRAILING_ABORT_PUNCTUATION_RE, "").trim();
+}
+function isAbortTrigger(text) {
+	if (!text) return false;
+	const normalized = normalizeAbortTriggerText(text);
+	return ABORT_TRIGGERS.has(normalized);
+}
+function isAbortRequestText(text, options) {
+	if (!text) return false;
+	const normalized = normalizeCommandBody(text, options).trim();
+	if (!normalized) return false;
+	const normalizedLower = normalizeLowercaseStringOrEmpty(normalized);
+	return normalizedLower === "/stop" || normalizeAbortTriggerText(normalizedLower) === "/stop" || isAbortTrigger(normalizedLower);
+}
+function getAbortMemory(key) {
+	const normalized = key.trim();
+	if (!normalized) return;
+	return ABORT_MEMORY.get(normalized);
+}
+function pruneAbortMemory() {
+	if (ABORT_MEMORY.size <= ABORT_MEMORY_MAX) return;
+	const excess = ABORT_MEMORY.size - ABORT_MEMORY_MAX;
+	let removed = 0;
+	for (const entryKey of ABORT_MEMORY.keys()) {
+		ABORT_MEMORY.delete(entryKey);
+		removed += 1;
+		if (removed >= excess) break;
+	}
+}
+function setAbortMemory(key, value) {
+	const normalized = key.trim();
+	if (!normalized) return;
+	if (!value) {
+		ABORT_MEMORY.delete(normalized);
+		return;
+	}
+	if (ABORT_MEMORY.has(normalized)) ABORT_MEMORY.delete(normalized);
+	ABORT_MEMORY.set(normalized, true);
+	pruneAbortMemory();
+}
+//#endregion
+export { setAbortMemory as i, isAbortRequestText as n, isAbortTrigger as r, getAbortMemory as t };

package/dist/abort.runtime-DXJMDdWJ.js

@@ -0,0 +1,2 @@
+import { i as tryFastAbortFromMessage, t as formatAbortReplyText } from "./abort-CKqwH0eA.js";
+export { formatAbortReplyText, tryFastAbortFromMessage };

package/dist/abort.runtime.js

@@ -1 +1 @@
-export * from "./abort.runtime-BxllILBs.js";
+export * from "./abort.runtime-DXJMDdWJ.js";

package/dist/access-CzVg9UoW.js

@@ -0,0 +1,90 @@
+import { t as resolveCommandAuthorizedFromAuthorizers } from "./command-gating-Ca4i_Dzb.js";
+import { i as resolveOpenProviderRuntimeGroupPolicy } from "./runtime-group-policy-Kz5pTCPx.js";
+import "./command-auth-native-DHCDJKzF.js";
+import { c as resolveDiscordChannelConfigWithFallback, d as resolveDiscordGuildEntry, f as resolveDiscordMemberAccessState, m as resolveDiscordOwnerAccess, n as isDiscordGroupAllowedByPolicy } from "./allow-list-DWHGjcrt.js";
+//#region extensions/discord/src/voice/config.ts
+function resolveDiscordVoiceEnabled(voice) {
+	if (voice?.enabled !== void 0) return voice.enabled;
+	return voice !== void 0;
+}
+//#endregion
+//#region extensions/discord/src/voice/access.ts
+async function authorizeDiscordVoiceIngress(params) {
+	const groupPolicy = params.groupPolicy ?? resolveOpenProviderRuntimeGroupPolicy({
+		providerConfigPresent: params.cfg.channels?.discord !== void 0,
+		groupPolicy: params.discordConfig.groupPolicy,
+		defaultGroupPolicy: params.cfg.channels?.defaults?.groupPolicy
+	}).groupPolicy;
+	const guildInfo = resolveDiscordGuildEntry({
+		guild: params.guild ?? {
+			id: params.guildId,
+			...params.guildName ? { name: params.guildName } : {}
+		},
+		guildId: params.guildId,
+		guildEntries: params.discordConfig.guilds
+	});
+	const channelConfig = params.channelId ? resolveDiscordChannelConfigWithFallback({
+		guildInfo,
+		channelId: params.channelId,
+		channelName: params.channelName,
+		channelSlug: params.channelSlug,
+		parentId: params.parentId,
+		parentName: params.parentName,
+		parentSlug: params.parentSlug,
+		scope: params.scope
+	}) : null;
+	if (channelConfig?.enabled === false) return {
+		ok: false,
+		message: "This channel is disabled."
+	};
+	const channelAllowlistConfigured = Boolean(guildInfo?.channels) && Object.keys(guildInfo?.channels ?? {}).length > 0;
+	if (!params.channelId && groupPolicy === "allowlist" && channelAllowlistConfigured) return {
+		ok: false,
+		message: `${params.channelLabel ?? "This channel"} is not allowlisted for voice commands.`
+	};
+	const channelAllowed = channelConfig ? channelConfig.allowed : !channelAllowlistConfigured;
+	if (!isDiscordGroupAllowedByPolicy({
+		groupPolicy,
+		guildAllowlisted: Boolean(guildInfo),
+		channelAllowlistConfigured,
+		channelAllowed
+	}) || channelConfig?.allowed === false) return {
+		ok: false,
+		message: `${params.channelLabel ?? "This channel"} is not allowlisted for voice commands.`
+	};
+	const { hasAccessRestrictions, memberAllowed } = resolveDiscordMemberAccessState({
+		channelConfig,
+		guildInfo,
+		memberRoleIds: params.memberRoleIds,
+		sender: params.sender,
+		allowNameMatching: false
+	});
+	const { ownerAllowList, ownerAllowed } = resolveDiscordOwnerAccess({
+		allowFrom: params.ownerAllowFrom ?? params.discordConfig.allowFrom ?? params.discordConfig.dm?.allowFrom,
+		sender: params.sender,
+		allowNameMatching: false
+	});
+	const useAccessGroups = params.useAccessGroups ?? params.cfg.commands?.useAccessGroups !== false;
+	return resolveCommandAuthorizedFromAuthorizers({
+		useAccessGroups,
+		authorizers: useAccessGroups ? [{
+			configured: ownerAllowList != null,
+			allowed: ownerAllowed
+		}, {
+			configured: hasAccessRestrictions,
+			allowed: memberAllowed
+		}] : [{
+			configured: hasAccessRestrictions,
+			allowed: memberAllowed
+		}],
+		modeWhenAccessGroupsOff: "configured"
+	}) ? {
+		ok: true,
+		channelConfig
+	} : {
+		ok: false,
+		message: "You are not authorized to use this command."
+	};
+}
+//#endregion
+export { resolveDiscordVoiceEnabled as n, authorizeDiscordVoiceIngress as t };

package/dist/access-control-Doy6nF67.js

@@ -0,0 +1,295 @@
+import "./security-runtime-B5OM3Qlq.js";
+import { l as normalizeE164 } from "./utils-Ba75iQOz.js";
+import { n as defaultRuntime } from "./runtime-CxAzaBMy.js";
+import { b as resolveGroupSessionKey } from "./store-lHGoCkld.js";
+import { n as resolveChannelGroupRequireMention, t as resolveChannelGroupPolicy } from "./group-policy-ZtoZIQLu.js";
+import { d as upsertChannelPairingRequest } from "./pairing-store-C1MHZVQH.js";
+import { a as warnMissingProviderGroupPolicyFallbackOnce, r as resolveDefaultGroupPolicy } from "./runtime-group-policy-Kz5pTCPx.js";
+import "./channel-policy-CdTfGR0V.js";
+import { a as resolveDmGroupAccessWithCommandGate, n as readStoreAllowFromForDmPolicy, o as resolveDmGroupAccessWithLists, s as resolveEffectiveAllowFromLists } from "./dm-policy-shared-DuCFOJo7.js";
+import { t as createChannelPairingChallengeIssuer } from "./channel-pairing-HXkrKiiD.js";
+import "./runtime-env-42oNjzv_.js";
+import "./conversation-runtime-BdaQ3xrL.js";
+import { n as expandAllowFromWithAccessGroups } from "./access-groups-iQy8mgSJ.js";
+import "./session-store-runtime-BMmc-kl0.js";
+import { a as resolveWhatsAppAccount } from "./accounts-VtGDf8Xd.js";
+import { n as isSelfChatMode } from "./text-runtime-D3a1ww12.js";
+import { a as getSelfIdentity, o as getSenderIdentity } from "./identity-DMK_K-2S.js";
+import { t as resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy-D_NDKAii.js";
+//#region extensions/whatsapp/src/inbound-policy.ts
+function resolveGroupConversationId(conversationId) {
+	return resolveGroupSessionKey({
+		From: conversationId,
+		ChatType: "group",
+		Provider: "whatsapp"
+	})?.id ?? conversationId;
+}
+function isNormalizedSenderAllowed(allowEntries, sender) {
+	if (allowEntries.includes("*")) return true;
+	const normalizedSender = normalizeE164(sender ?? "");
+	if (!normalizedSender) return false;
+	return new Set(allowEntries.map((entry) => normalizeE164(entry)).filter((entry) => Boolean(entry))).has(normalizedSender);
+}
+function buildResolvedWhatsAppGroupConfig(params) {
+	return { channels: { whatsapp: {
+		groupPolicy: params.groupPolicy,
+		groups: params.groups
+	} } };
+}
+function resolveWhatsAppInboundPolicy(params) {
+	const account = resolveWhatsAppAccount({
+		cfg: params.cfg,
+		accountId: params.accountId
+	});
+	const configuredAllowFrom = account.allowFrom ?? [];
+	const dmPolicy = account.dmPolicy ?? "pairing";
+	const dmAllowFrom = configuredAllowFrom.length > 0 ? configuredAllowFrom : params.selfE164 ? [params.selfE164] : [];
+	const groupAllowFrom = account.groupAllowFrom ?? (configuredAllowFrom.length > 0 ? configuredAllowFrom : void 0) ?? [];
+	const { effectiveGroupAllowFrom } = resolveEffectiveAllowFromLists({
+		allowFrom: configuredAllowFrom,
+		groupAllowFrom
+	});
+	const defaultGroupPolicy = resolveDefaultGroupPolicy(params.cfg);
+	const { groupPolicy, providerMissingFallbackApplied } = resolveWhatsAppRuntimeGroupPolicy({
+		providerConfigPresent: params.cfg.channels?.whatsapp !== void 0,
+		groupPolicy: account.groupPolicy,
+		defaultGroupPolicy
+	});
+	const resolvedGroupCfg = buildResolvedWhatsAppGroupConfig({
+		groupPolicy,
+		groups: account.groups
+	});
+	const isSamePhone = (value) => typeof value === "string" && typeof params.selfE164 === "string" && value === params.selfE164;
+	return {
+		account,
+		dmPolicy,
+		groupPolicy,
+		configuredAllowFrom,
+		dmAllowFrom,
+		groupAllowFrom,
+		isSelfChat: account.selfChatMode ?? isSelfChatMode(params.selfE164, configuredAllowFrom),
+		providerMissingFallbackApplied,
+		shouldReadStorePairingApprovals: dmPolicy !== "allowlist",
+		isSamePhone,
+		isDmSenderAllowed: (allowEntries, sender) => isSamePhone(sender) || isNormalizedSenderAllowed(allowEntries, sender),
+		isGroupSenderAllowed: (allowEntries, sender) => isNormalizedSenderAllowed(allowEntries, sender),
+		resolveConversationGroupPolicy: (conversationId) => resolveChannelGroupPolicy({
+			cfg: resolvedGroupCfg,
+			channel: "whatsapp",
+			groupId: resolveGroupConversationId(conversationId),
+			hasGroupAllowFrom: effectiveGroupAllowFrom.length > 0
+		}),
+		resolveConversationRequireMention: (conversationId) => resolveChannelGroupRequireMention({
+			cfg: resolvedGroupCfg,
+			channel: "whatsapp",
+			groupId: resolveGroupConversationId(conversationId)
+		})
+	};
+}
+async function resolveWhatsAppCommandAuthorized(params) {
+	const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+	if (!useAccessGroups) return true;
+	const self = getSelfIdentity(params.msg);
+	const policy = params.policy ?? resolveWhatsAppInboundPolicy({
+		cfg: params.cfg,
+		accountId: params.msg.accountId,
+		selfE164: self.e164 ?? null
+	});
+	const isGroup = params.msg.chatType === "group";
+	const sender = getSenderIdentity(params.msg);
+	const dmSender = sender.e164 ?? params.msg.from ?? "";
+	const groupSender = sender.e164 ?? "";
+	const normalizedSender = normalizeE164(isGroup ? groupSender : dmSender);
+	if (!normalizedSender) return false;
+	const storeAllowFrom = isGroup || !policy.shouldReadStorePairingApprovals ? [] : await readStoreAllowFromForDmPolicy({
+		provider: "whatsapp",
+		accountId: policy.account.accountId,
+		dmPolicy: policy.dmPolicy,
+		shouldRead: policy.shouldReadStorePairingApprovals
+	});
+	const isSenderAllowed = (senderId, allowEntries) => isGroup ? policy.isGroupSenderAllowed(allowEntries, senderId) : policy.isDmSenderAllowed(allowEntries, senderId);
+	const [allowFrom, groupAllowFrom] = await Promise.all([expandAllowFromWithAccessGroups({
+		cfg: params.cfg,
+		allowFrom: policy.dmAllowFrom,
+		channel: "whatsapp",
+		accountId: policy.account.accountId,
+		senderId: normalizedSender,
+		isSenderAllowed
+	}), expandAllowFromWithAccessGroups({
+		cfg: params.cfg,
+		allowFrom: policy.groupAllowFrom,
+		channel: "whatsapp",
+		accountId: policy.account.accountId,
+		senderId: normalizedSender,
+		isSenderAllowed
+	})]);
+	const dmStoreAllowFrom = isGroup ? [] : await expandAllowFromWithAccessGroups({
+		cfg: params.cfg,
+		allowFrom: storeAllowFrom,
+		channel: "whatsapp",
+		accountId: policy.account.accountId,
+		senderId: normalizedSender,
+		isSenderAllowed
+	});
+	return resolveDmGroupAccessWithCommandGate({
+		isGroup,
+		dmPolicy: policy.dmPolicy,
+		groupPolicy: policy.groupPolicy,
+		allowFrom,
+		groupAllowFrom,
+		storeAllowFrom: dmStoreAllowFrom,
+		isSenderAllowed: (allowEntries) => isGroup ? policy.isGroupSenderAllowed(allowEntries, groupSender) : policy.isDmSenderAllowed(allowEntries, dmSender),
+		command: {
+			useAccessGroups,
+			allowTextCommands: true,
+			hasControlCommand: true
+		}
+	}).commandAuthorized;
+}
+//#endregion
+//#region extensions/whatsapp/src/inbound/access-control.ts
+const PAIRING_REPLY_HISTORY_GRACE_MS = 3e4;
+function logWhatsAppVerbose(enabled, message) {
+	if (!enabled) return;
+	defaultRuntime.log(message);
+}
+async function checkInboundAccessControl(params) {
+	const policy = resolveWhatsAppInboundPolicy({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		selfE164: params.selfE164
+	});
+	const storeAllowFrom = params.group ? [] : await readStoreAllowFromForDmPolicy({
+		provider: "whatsapp",
+		accountId: policy.account.accountId,
+		dmPolicy: policy.dmPolicy,
+		shouldRead: policy.shouldReadStorePairingApprovals
+	});
+	const pairingGraceMs = typeof params.pairingGraceMs === "number" && params.pairingGraceMs > 0 ? params.pairingGraceMs : PAIRING_REPLY_HISTORY_GRACE_MS;
+	const suppressPairingReply = typeof params.connectedAtMs === "number" && typeof params.messageTimestampMs === "number" && params.messageTimestampMs < params.connectedAtMs - pairingGraceMs;
+	warnMissingProviderGroupPolicyFallbackOnce({
+		providerMissingFallbackApplied: policy.providerMissingFallbackApplied,
+		providerKey: "whatsapp",
+		accountId: policy.account.accountId,
+		log: (message) => logWhatsAppVerbose(params.verbose, message)
+	});
+	const accessGroupSenderId = params.group ? params.senderE164 ?? params.from : params.from;
+	const isAccessGroupSenderAllowed = (senderId, allowEntries) => {
+		return params.group ? policy.isGroupSenderAllowed(allowEntries, senderId) : policy.isDmSenderAllowed(allowEntries, senderId);
+	};
+	const [allowFrom, groupAllowFrom] = await Promise.all([expandAllowFromWithAccessGroups({
+		cfg: params.cfg,
+		allowFrom: params.group ? policy.configuredAllowFrom : policy.dmAllowFrom,
+		channel: "whatsapp",
+		accountId: policy.account.accountId,
+		senderId: accessGroupSenderId,
+		isSenderAllowed: isAccessGroupSenderAllowed
+	}), expandAllowFromWithAccessGroups({
+		cfg: params.cfg,
+		allowFrom: policy.groupAllowFrom,
+		channel: "whatsapp",
+		accountId: policy.account.accountId,
+		senderId: accessGroupSenderId,
+		isSenderAllowed: isAccessGroupSenderAllowed
+	})]);
+	const dmStoreAllowFrom = params.group ? [] : await expandAllowFromWithAccessGroups({
+		cfg: params.cfg,
+		allowFrom: storeAllowFrom,
+		channel: "whatsapp",
+		accountId: policy.account.accountId,
+		senderId: accessGroupSenderId,
+		isSenderAllowed: isAccessGroupSenderAllowed
+	});
+	const access = resolveDmGroupAccessWithLists({
+		isGroup: params.group,
+		dmPolicy: policy.dmPolicy,
+		groupPolicy: policy.groupPolicy,
+		allowFrom,
+		groupAllowFrom,
+		storeAllowFrom: dmStoreAllowFrom,
+		isSenderAllowed: (allowEntries) => {
+			return params.group ? policy.isGroupSenderAllowed(allowEntries, params.senderE164) : policy.isDmSenderAllowed(allowEntries, params.from);
+		}
+	});
+	if (params.group && access.decision !== "allow") {
+		if (access.reason === "groupPolicy=disabled") logWhatsAppVerbose(params.verbose, "Blocked group message (groupPolicy: disabled)");
+		else if (access.reason === "groupPolicy=allowlist (empty allowlist)") logWhatsAppVerbose(params.verbose, "Blocked group message (groupPolicy: allowlist, no groupAllowFrom)");
+		else logWhatsAppVerbose(params.verbose, `Blocked group message from ${params.senderE164 ?? "unknown sender"} (groupPolicy: allowlist)`);
+		return {
+			allowed: false,
+			shouldMarkRead: false,
+			isSelfChat: policy.isSelfChat,
+			resolvedAccountId: policy.account.accountId
+		};
+	}
+	if (!params.group) {
+		if (params.isFromMe && !policy.isSamePhone(params.from)) {
+			logWhatsAppVerbose(params.verbose, "Skipping outbound DM (fromMe); no pairing reply needed.");
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat: policy.isSelfChat,
+				resolvedAccountId: policy.account.accountId
+			};
+		}
+		if (access.decision === "block" && access.reason === "dmPolicy=disabled") {
+			logWhatsAppVerbose(params.verbose, "Blocked dm (dmPolicy: disabled)");
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat: policy.isSelfChat,
+				resolvedAccountId: policy.account.accountId
+			};
+		}
+		if (access.decision === "pairing" && !policy.isSamePhone(params.from)) {
+			const candidate = params.from;
+			if (suppressPairingReply) logWhatsAppVerbose(params.verbose, `Skipping pairing reply for historical DM from ${candidate}.`);
+			else await createChannelPairingChallengeIssuer({
+				channel: "whatsapp",
+				upsertPairingRequest: async ({ id, meta }) => await upsertChannelPairingRequest({
+					channel: "whatsapp",
+					id,
+					accountId: policy.account.accountId,
+					meta
+				})
+			})({
+				senderId: candidate,
+				senderIdLine: `Your WhatsApp phone number: ${candidate}`,
+				meta: { name: (params.pushName ?? "").trim() || void 0 },
+				onCreated: () => {
+					logWhatsAppVerbose(params.verbose, `whatsapp pairing request sender=${candidate} name=${params.pushName ?? "unknown"}`);
+				},
+				sendPairingReply: async (text) => {
+					await params.sock.sendMessage(params.remoteJid, { text });
+				},
+				onReplyError: (err) => {
+					logWhatsAppVerbose(params.verbose, `whatsapp pairing reply failed for ${candidate}: ${String(err)}`);
+				}
+			});
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat: policy.isSelfChat,
+				resolvedAccountId: policy.account.accountId
+			};
+		}
+		if (access.decision !== "allow") {
+			logWhatsAppVerbose(params.verbose, `Blocked unauthorized sender ${params.from} (dmPolicy=${policy.dmPolicy})`);
+			return {
+				allowed: false,
+				shouldMarkRead: false,
+				isSelfChat: policy.isSelfChat,
+				resolvedAccountId: policy.account.accountId
+			};
+		}
+	}
+	return {
+		allowed: true,
+		shouldMarkRead: true,
+		isSelfChat: policy.isSelfChat,
+		resolvedAccountId: policy.account.accountId
+	};
+}
+const __testing = { resolveWhatsAppInboundPolicy };
+//#endregion
+export { resolveWhatsAppInboundPolicy as i, checkInboundAccessControl as n, resolveWhatsAppCommandAuthorized as r, __testing as t };