silentlake 2026.3.24

package/dist/monitor-CL5OYLih.js

@@ -0,0 +1,878 @@
+import "./src-CmXHIz5f.js";
+import "./redact-BDinS1q9.js";
+import "./errors-BxyFnvP3.js";
+import "./unhandled-rejections-CDJ8dOVP.js";
+import "./logger-CoEtkjhn.js";
+import "./paths-GHJ97ebE.js";
+import "./tmp-openclaw-dir-idKIOMmb.js";
+import "./theme-CdOoMzRk.js";
+import "./globals-41sdSaKv.js";
+import "./runtime-CT2LIJZu.js";
+import "./ansi-BEJF8NKS.js";
+import "./subsystem-CUp-6QQf.js";
+import "./boolean-DKtCJu_W.js";
+import "./env-BP70DGuy.js";
+import "./warning-filter-CgvLQB4Y.js";
+import "./utils-Bxk6BLTg.js";
+import "./links-Bilm-v0z.js";
+import "./paths-nCHyK08H.js";
+import "./auth-profiles-CWEIQV77.js";
+import "./boundary-path-B3FFLYNx.js";
+import "./boundary-file-read-BP6VMpqH.js";
+import "./logger-Cqy7-Maj.js";
+import "./exec-Dmex2w_d.js";
+import "./workspace-BH7CXmrr.js";
+import "./agent-scope-DPP4Z_UU.js";
+import "./model-selection-BTpJnslv.js";
+import "./io-jOnQRia2.js";
+import "./host-env-security-BogNN146.js";
+import "./shell-env-cD92jEyV.js";
+import "./safe-text-B_CQuica.js";
+import "./version-DCY9_obP.js";
+import "./env-substitution-D6t_sLS_.js";
+import "./includes-7XyL3p1c.js";
+import "./zod-schema.providers-core-Dgq7MTqU.js";
+import "./legacy-web-search-BgZjNG2h.js";
+import "./registry-rgYi7KoO.js";
+import "./config-state-CE0CGjey.js";
+import "./manifest-registry-B90TyTWl.js";
+import "./avatar-policy-Ds9e6uHI.js";
+import "./ip-C8vmzVu0.js";
+import "./zod-schema.agent-runtime-T_EC_6fg.js";
+import "./zod-schema.core-BdgRr-F1.js";
+import "./config-pn7LKJdW.js";
+import "./file-lock-WbEmczmY.js";
+import "./audit-fs-oDMUa5N_.js";
+import "./resolve-T2q_0ARF.js";
+import "./profiles-D17eMKQZ.js";
+import "./repair-qXnOAvDy.js";
+import "./tailscale-Cbsx-2HB.js";
+import "./tailnet-ofqBrXzu.js";
+import { u as resolveClientIp } from "./net-DlJFp95v.js";
+import "./auth-O6LQFLHJ.js";
+import "./credentials-BPwBlm1X.js";
+import "./message-channel-Cy-gN4K2.js";
+import "./store-CvL8MPei.js";
+import "./runtime-CuvWMN7E.js";
+import "./registry-C3q59Qj0.js";
+import "./plugins-1Z50ecJ6.js";
+import "./sessions-DaSBVNwD.js";
+import "./paths-CTjJI9l0.js";
+import "./session-write-lock-DNKvpjKf.js";
+import "./method-scopes-DgypDW23.js";
+import "./call-BmLt3xO1.js";
+import "./ports-lsof-DtJqhFOr.js";
+import "./restart-stale-pids-CLGiqU2E.js";
+import "./ports-DFiK_Jc-.js";
+import "./logging-CbTTfADU.js";
+import "./commands-Bb9xUwz9.js";
+import "./identity-cyBYcoXS.js";
+import "./secret-input-4REZ4sHo.js";
+import "./bindings-kjwuC11Q.js";
+import "./resolve-route-vEY3ONZ2.js";
+import "./routing-Y3m0o-kB.js";
+import "./base-session-key-Cf2rkwag.js";
+import "./token-Bgv8XEsC.js";
+import { Ca as resolveDirectDmAuthorizationOutcome, Ta as resolveSenderCommandAuthorizationWithRuntime } from "./pi-embedded-CSQySvOV.js";
+import "./identity-file-EndG1nfc.js";
+import "./identity-DovQV4zD.js";
+import "./provider-env-vars-CsQlY7bF.js";
+import "./model-auth-env-CF9ts7Th.js";
+import "./anthropic-vertex-provider-Dd5agCN9.js";
+import "./model-auth-B__TJTPw.js";
+import "./kilocode-shared-DS7_0IMs.js";
+import "./provider-models-C2EjYMwW.js";
+import "./provider-model-allowlist-4HSOnlX-.js";
+import "./retry-D15TD1S3.js";
+import "./models-config.providers.discovery-BaIk1NKL.js";
+import "./state-paths-DJIGEFq_.js";
+import "./cli-runtime-aAVwbEYy.js";
+import { t as waitForAbortSignal } from "./abort-signal-CsrBEr94.js";
+import "./runtime-env-a_iwdJIv.js";
+import "./diagnostic-DqJXx_4Q.js";
+import "./text-runtime-C_Roi_Je.js";
+import "./config-presence-BmUF_5K9.js";
+import "./thread-bindings-messages-Cdo8jSa9.js";
+import "./conversation-runtime-1O0Aaolb.js";
+import { t as createDedupeCache } from "./dedupe-Cgnk5BbX.js";
+import "./registry-CPsHw6xU.js";
+import "./internal-hooks-0uipqzRY.js";
+import "./http-registry-WFFbLYRd.js";
+import "./runtime-whatsapp-boundary-xZem0NyQ.js";
+import "./provider-catalog-D7QvsUXS.js";
+import "./provider-catalog-C5vmXjmb.js";
+import "./provider-catalog--18-pW5t.js";
+import "./tool-catalog-BV6FcEWS.js";
+import "./docker-XFNiArwM.js";
+import "./sandbox-CUUouiKs.js";
+import "./common-CUBlLRXB.js";
+import "./image-ops-j01UkxEv.js";
+import "./thinking-BBD_0HSp.js";
+import "./path-alias-guards-ZTKqurNH.js";
+import "./sandbox-paths-fqp_TZdO.js";
+import "./typebox-D0SHDJST.js";
+import "./mime-C4vVTBso.js";
+import "./ssrf-Dk9XaoKN.js";
+import "./fetch-guard-DIyN1HW5.js";
+import "./provider-web-search-NzK8ep1E.js";
+import "./manager-ChTGDe87.js";
+import "./heartbeat-7aHh0m3d.js";
+import "./typing-DG_YqWJ7.js";
+import "./target-registry-krAVlXi_.js";
+import "./external-content-BUdUOqkv.js";
+import "./brave-CkimJe4j.js";
+import "./channel-config-helpers-CieQWILI.js";
+import { a as warnMissingProviderGroupPolicyFallbackOnce, r as resolveDefaultGroupPolicy } from "./runtime-group-policy-B7irU4eu.js";
+import "./whatsapp-DXbWlm3A.js";
+import { n as createChannelPairingController } from "./channel-pairing-D54mn51y.js";
+import "./delegate-D4ql5N70.js";
+import "./config-schema-B1UGMwZ8.js";
+import "./secret-file-DYJtH6kf.js";
+import "./core-C7aHA4Aq.js";
+import "./security-runtime-BuEhpJVE.js";
+import { r as evaluateSenderGroupAccess } from "./group-access-DJZrYPx1.js";
+import "./pairing-store-C4lsd4pO.js";
+import "./json-store-O1LwpnBH.js";
+import "./dm-policy-shared-6bCJzHOS.js";
+import "./provider-auth-ref-BS3gwrNr.js";
+import "./provider-auth-input-BftBdgvW.js";
+import "./provider-auth-Bw8x1a3o.js";
+import "./provider-auth-helpers-B0dS-1WK.js";
+import "./provider-api-key-auth-BE0taXiB.js";
+import "./image-generation-CNKc-mFK.js";
+import "./shared-LeP8iUTz.js";
+import "./provider-usage-ClDVmkhl.js";
+import "./media-understanding-DD2uMjK8.js";
+import "./provider-onboard-CjOfyeQG.js";
+import "./perplexity-Beshd9zu.js";
+import "./provider-auth-api-key-BrQYvdxi.js";
+import "./command-secret-targets-COcwhn-D.js";
+import "./whatsapp-heartbeat-CSWnPQ7q.js";
+import "./fs-safe-D3qzH-ab.js";
+import "./web-media-CtU6jM5V.js";
+import "./local-roots-DAzCjWbC.js";
+import "./frontmatter-S5vS-I4a.js";
+import "./env-overrides-JneV60sd.js";
+import "./skills-CCgKs_NJ.js";
+import "./skill-commands-CiSwTFBQ.js";
+import "./workspace-dirs-_O4V3xCR.js";
+import "./pairing-token-gKj4SNFJ.js";
+import "./model-selection-Ci9cPkL2.js";
+import "./system-events-mAu6Ap6K.js";
+import { i as deliverTextOrMediaReply, p as resolveSendableOutboundReplyParts } from "./reply-payload-DBGc074f.js";
+import "./pi-model-discovery-CuX5CDyZ.js";
+import "./message-hook-mappers-BBTV3JRQ.js";
+import "./delivery-queue-DrrqB4Hi.js";
+import "./channel-plugin-common-BhTxCE5t.js";
+import "./shared-BU0QgVMZ.js";
+import "./status-helpers-Cda-rGLX.js";
+import "./config-runtime-CstET7fq.js";
+import "./routes-TpLEcKO8.js";
+import "./media-limits-Cuvmmhop.js";
+import "./axios-xDDnM0KG.js";
+import "./manager-DuwFn87U.js";
+import "./web-media-BfBb8i48.js";
+import "./mentions-Bxys_va0.js";
+import "./commands-registry.data-XyUTELK9.js";
+import "./commands-registry-ChCep1KJ.js";
+import "./channel-inbound-DwzVf2PK.js";
+import "./config-DdDLrP_v.js";
+import "./ssh-tunnel-Cz51VBAt.js";
+import "./server-middleware-CCqKhKUb.js";
+import "./read-only-account-inspect-DPJzadPo.js";
+import "./channel-summary-CdYLGMVt.js";
+import "./channel-policy-C4GKHvhz.js";
+import "./resolve-utils-CbqJY2bs.js";
+import { i as isNormalizedSenderAllowed } from "./allow-from-C4iBpqFI.js";
+import "./channel-actions-DU2CR3xW.js";
+import "./exec-approvals-BJhuySBz.js";
+import "./exec-approvals-allowlist-B_wPddCb.js";
+import "./http-body-CCiSfloA.js";
+import "./ssrf-policy-Dk6oMa20.js";
+import "./history-CHjo8B5W.js";
+import "./reply-history-CVCD5oE9.js";
+import { r as logTypingFailure } from "./logging-Bz1qZDPg.js";
+import { t as createChannelReplyPipeline } from "./channel-reply-pipeline-CPTuaW8n.js";
+import "./exec-safe-bin-runtime-policy-BZkObC8r.js";
+import "./nodes-screen-CQ7IvP62.js";
+import "./system-run-command-Cxq2F1MB.js";
+import "./stagger-DU7FjHYo.js";
+import "./tool-policy-match-CHqTCSdK.js";
+import "./setup-binary-BOJA7zdN.js";
+import "./archive-Tr0wIUO-.js";
+import "./signal-cli-install-DxoL8CgF.js";
+import "./directory-runtime-DhC8QkMq.js";
+import "./timeouts-BwR1sGom.js";
+import "./outbound-runtime-ic_7ulJJ.js";
+import "./acp-runtime-BdLdT-QY.js";
+import "./gateway-runtime-ih2e7a2K.js";
+import "./connection-auth-BSQJeDOU.js";
+import "./discord-core-5tkl-BzP.js";
+import "./with-timeout-2AKTISee.js";
+import "./multimodal-DC43jYNv.js";
+import "./memory-search-Das1tiuB.js";
+import "./query-expansion-Do45hILP.js";
+import "./search-manager-r8Cw4ZRv.js";
+import "./memory-DBjQ0TPd.js";
+import "./mcp-config-Coky4zS4.js";
+import "./setup-wizard-helpers-COZ1UAdX.js";
+import "./setup-wizard-proxy-Slwi-1gX.js";
+import "./setup-CN-teRpz.js";
+import { a as createFixedWindowRateLimiter, o as createWebhookAnomalyTracker, r as WEBHOOK_RATE_LIMIT_DEFAULTS, t as WEBHOOK_ANOMALY_COUNTER_DEFAULTS } from "./webhook-memory-guards-BHrFZ4yq.js";
+import { c as withResolvedWebhookRequestPipeline, d as applyBasicWebhookRequestGuards, h as readJsonWebhookBodyOrReject, n as registerWebhookTargetWithPluginRoute, o as resolveWebhookTargetWithAuthOrRejectSync, t as registerWebhookTarget } from "./webhook-ingress-CupqYpKM.js";
+import { n as resolveWebhookPath } from "./webhook-path-BGFZ55ML.js";
+import { t as resolveInboundRouteEnvelopeBuilderWithRuntime } from "./inbound-envelope-4P3IIJc3.js";
+import "./zalo-CHQzsLhE.js";
+import "./accounts-ChlyF7cx.js";
+import "./runtime-api-D79M0lQN.js";
+import { t as getZaloRuntime } from "./runtime-DP-4DZja.js";
+import { a as getUpdates, c as sendMessage, l as sendPhoto, n as ZaloApiError, o as getWebhookInfo, r as deleteWebhook, s as sendChatAction, t as resolveZaloProxyFetch, u as setWebhook } from "./proxy-H5O2p6AP.js";
+import { timingSafeEqual } from "node:crypto";
+//#region extensions/zalo/src/group-access.ts
+const ZALO_ALLOW_FROM_PREFIX_RE = /^(zalo|zl):/i;
+function isZaloSenderAllowed(senderId, allowFrom) {
+	return isNormalizedSenderAllowed({
+		senderId,
+		allowFrom,
+		stripPrefixRe: ZALO_ALLOW_FROM_PREFIX_RE
+	});
+}
+function evaluateZaloGroupAccess(params) {
+	return evaluateSenderGroupAccess({
+		providerConfigPresent: params.providerConfigPresent,
+		configuredGroupPolicy: params.configuredGroupPolicy,
+		defaultGroupPolicy: params.defaultGroupPolicy,
+		groupAllowFrom: params.groupAllowFrom,
+		senderId: params.senderId,
+		isSenderAllowed: isZaloSenderAllowed
+	});
+}
+//#endregion
+//#region extensions/zalo/src/monitor.webhook.ts
+const ZALO_WEBHOOK_REPLAY_WINDOW_MS = 5 * 6e4;
+const webhookTargets = /* @__PURE__ */ new Map();
+const webhookRateLimiter = createFixedWindowRateLimiter({
+	windowMs: WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs,
+	maxRequests: WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests,
+	maxTrackedKeys: WEBHOOK_RATE_LIMIT_DEFAULTS.maxTrackedKeys
+});
+const recentWebhookEvents = createDedupeCache({
+	ttlMs: ZALO_WEBHOOK_REPLAY_WINDOW_MS,
+	maxSize: 5e3
+});
+const webhookAnomalyTracker = createWebhookAnomalyTracker({
+	maxTrackedKeys: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.maxTrackedKeys,
+	ttlMs: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.ttlMs,
+	logEvery: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.logEvery
+});
+function timingSafeEquals(left, right) {
+	const leftBuffer = Buffer.from(left);
+	const rightBuffer = Buffer.from(right);
+	if (leftBuffer.length !== rightBuffer.length) {
+		const length = Math.max(1, leftBuffer.length, rightBuffer.length);
+		const paddedLeft = Buffer.alloc(length);
+		const paddedRight = Buffer.alloc(length);
+		leftBuffer.copy(paddedLeft);
+		rightBuffer.copy(paddedRight);
+		timingSafeEqual(paddedLeft, paddedRight);
+		return false;
+	}
+	return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function isReplayEvent(update, nowMs) {
+	const messageId = update.message?.message_id;
+	if (!messageId) return false;
+	const key = `${update.event_name}:${messageId}`;
+	return recentWebhookEvents.check(key, nowMs);
+}
+function recordWebhookStatus(runtime, path, statusCode) {
+	webhookAnomalyTracker.record({
+		key: `${path}:${statusCode}`,
+		statusCode,
+		log: runtime?.log,
+		message: (count) => `[zalo] webhook anomaly path=${path} status=${statusCode} count=${String(count)}`
+	});
+}
+function headerValue(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+function registerZaloWebhookTarget$1(target, opts) {
+	if (opts?.route) return registerWebhookTargetWithPluginRoute({
+		targetsByPath: webhookTargets,
+		target,
+		route: opts.route,
+		onLastPathTargetRemoved: opts.onLastPathTargetRemoved
+	}).unregister;
+	return registerWebhookTarget(webhookTargets, target, opts).unregister;
+}
+async function handleZaloWebhookRequest$1(req, res, processUpdate) {
+	return await withResolvedWebhookRequestPipeline({
+		req,
+		res,
+		targetsByPath: webhookTargets,
+		allowMethods: ["POST"],
+		handle: async ({ targets, path }) => {
+			const trustedProxies = targets[0]?.config.gateway?.trustedProxies;
+			const allowRealIpFallback = targets[0]?.config.gateway?.allowRealIpFallback === true;
+			const rateLimitKey = `${path}:${resolveClientIp({
+				remoteAddr: req.socket.remoteAddress,
+				forwardedFor: headerValue(req.headers["x-forwarded-for"]),
+				realIp: headerValue(req.headers["x-real-ip"]),
+				trustedProxies,
+				allowRealIpFallback
+			}) ?? req.socket.remoteAddress ?? "unknown"}`;
+			const nowMs = Date.now();
+			if (!applyBasicWebhookRequestGuards({
+				req,
+				res,
+				rateLimiter: webhookRateLimiter,
+				rateLimitKey,
+				nowMs
+			})) {
+				recordWebhookStatus(targets[0]?.runtime, path, res.statusCode);
+				return true;
+			}
+			const headerToken = String(req.headers["x-bot-api-secret-token"] ?? "");
+			const target = resolveWebhookTargetWithAuthOrRejectSync({
+				targets,
+				res,
+				isMatch: (entry) => timingSafeEquals(entry.secret, headerToken)
+			});
+			if (!target) {
+				recordWebhookStatus(targets[0]?.runtime, path, res.statusCode);
+				return true;
+			}
+			if (!applyBasicWebhookRequestGuards({
+				req,
+				res,
+				requireJsonContentType: true
+			})) {
+				recordWebhookStatus(target.runtime, path, res.statusCode);
+				return true;
+			}
+			const body = await readJsonWebhookBodyOrReject({
+				req,
+				res,
+				maxBytes: 1024 * 1024,
+				timeoutMs: 3e4,
+				emptyObjectOnEmpty: false,
+				invalidJsonMessage: "Bad Request"
+			});
+			if (!body.ok) {
+				recordWebhookStatus(target.runtime, path, res.statusCode);
+				return true;
+			}
+			const raw = body.value;
+			const record = raw && typeof raw === "object" ? raw : null;
+			const update = record && record.ok === true && record.result ? record.result : record ?? void 0;
+			if (!update?.event_name) {
+				res.statusCode = 400;
+				res.end("Bad Request");
+				recordWebhookStatus(target.runtime, path, res.statusCode);
+				return true;
+			}
+			if (isReplayEvent(update, nowMs)) {
+				res.statusCode = 200;
+				res.end("ok");
+				return true;
+			}
+			target.statusSink?.({ lastInboundAt: Date.now() });
+			processUpdate({
+				update,
+				target
+			}).catch((err) => {
+				target.runtime.error?.(`[${target.account.accountId}] Zalo webhook failed: ${String(err)}`);
+			});
+			res.statusCode = 200;
+			res.end("ok");
+			return true;
+		}
+	});
+}
+//#endregion
+//#region extensions/zalo/src/monitor.ts
+const ZALO_TEXT_LIMIT = 2e3;
+const DEFAULT_MEDIA_MAX_MB = 5;
+const WEBHOOK_CLEANUP_TIMEOUT_MS = 5e3;
+const ZALO_TYPING_TIMEOUT_MS = 5e3;
+function formatZaloError(error) {
+	if (error instanceof Error) return error.stack ?? `${error.name}: ${error.message}`;
+	return String(error);
+}
+function describeWebhookTarget(rawUrl) {
+	try {
+		const parsed = new URL(rawUrl);
+		return `${parsed.origin}${parsed.pathname}`;
+	} catch {
+		return rawUrl;
+	}
+}
+function normalizeWebhookUrl(url) {
+	const trimmed = url?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function logVerbose(core, runtime, message) {
+	if (core.logging.shouldLogVerbose()) runtime.log?.(`[zalo] ${message}`);
+}
+function registerZaloWebhookTarget(target) {
+	return registerZaloWebhookTarget$1(target, { route: {
+		auth: "plugin",
+		match: "exact",
+		pluginId: "zalo",
+		source: "zalo-webhook",
+		accountId: target.account.accountId,
+		log: target.runtime.log,
+		handler: async (req, res) => {
+			if (!await handleZaloWebhookRequest(req, res) && !res.headersSent) {
+				res.statusCode = 404;
+				res.setHeader("Content-Type", "text/plain; charset=utf-8");
+				res.end("Not Found");
+			}
+		}
+	} });
+}
+async function handleZaloWebhookRequest(req, res) {
+	return handleZaloWebhookRequest$1(req, res, async ({ update, target }) => {
+		await processUpdate({
+			update,
+			token: target.token,
+			account: target.account,
+			config: target.config,
+			runtime: target.runtime,
+			core: target.core,
+			mediaMaxMb: target.mediaMaxMb,
+			statusSink: target.statusSink,
+			fetcher: target.fetcher
+		});
+	});
+}
+function startPollingLoop(params) {
+	const { token, account, config, runtime, core, abortSignal, isStopped, mediaMaxMb, statusSink, fetcher } = params;
+	const pollTimeout = 30;
+	const processingContext = {
+		token,
+		account,
+		config,
+		runtime,
+		core,
+		mediaMaxMb,
+		statusSink,
+		fetcher
+	};
+	runtime.log?.(`[${account.accountId}] Zalo polling loop started timeout=${String(pollTimeout)}s`);
+	const poll = async () => {
+		if (isStopped() || abortSignal.aborted) return;
+		try {
+			const response = await getUpdates(token, { timeout: pollTimeout }, fetcher);
+			if (response.ok && response.result) {
+				statusSink?.({ lastInboundAt: Date.now() });
+				await processUpdate({
+					update: response.result,
+					...processingContext
+				});
+			}
+		} catch (err) {
+			if (err instanceof ZaloApiError && err.isPollingTimeout) {} else if (!isStopped() && !abortSignal.aborted) {
+				runtime.error?.(`[${account.accountId}] Zalo polling error: ${formatZaloError(err)}`);
+				await new Promise((resolve) => setTimeout(resolve, 5e3));
+			}
+		}
+		if (!isStopped() && !abortSignal.aborted) setImmediate(poll);
+	};
+	poll();
+}
+async function processUpdate(params) {
+	const { update, token, account, config, runtime, core, mediaMaxMb, statusSink, fetcher } = params;
+	const { event_name, message } = update;
+	const sharedContext = {
+		token,
+		account,
+		config,
+		runtime,
+		core,
+		statusSink,
+		fetcher
+	};
+	if (!message) return;
+	switch (event_name) {
+		case "message.text.received":
+			await handleTextMessage({
+				message,
+				...sharedContext
+			});
+			break;
+		case "message.image.received":
+			await handleImageMessage({
+				message,
+				...sharedContext,
+				mediaMaxMb
+			});
+			break;
+		case "message.sticker.received":
+			logVerbose(core, runtime, `[${account.accountId}] Received sticker from ${message.from.id}`);
+			break;
+		case "message.unsupported.received":
+			logVerbose(core, runtime, `[${account.accountId}] Received unsupported message type from ${message.from.id}`);
+			break;
+	}
+}
+async function handleTextMessage(params) {
+	const { message } = params;
+	const { text } = message;
+	if (!text?.trim()) return;
+	await processMessageWithPipeline({
+		...params,
+		text,
+		mediaPath: void 0,
+		mediaType: void 0
+	});
+}
+async function handleImageMessage(params) {
+	const { message, mediaMaxMb, account, core, runtime } = params;
+	const { photo_url, caption } = message;
+	let mediaPath;
+	let mediaType;
+	if (photo_url) try {
+		const maxBytes = mediaMaxMb * 1024 * 1024;
+		const fetched = await core.channel.media.fetchRemoteMedia({
+			url: photo_url,
+			maxBytes
+		});
+		const saved = await core.channel.media.saveMediaBuffer(fetched.buffer, fetched.contentType, "inbound", maxBytes);
+		mediaPath = saved.path;
+		mediaType = saved.contentType;
+	} catch (err) {
+		runtime.error?.(`[${account.accountId}] Failed to download Zalo image: ${String(err)}`);
+	}
+	await processMessageWithPipeline({
+		...params,
+		text: caption,
+		mediaPath,
+		mediaType
+	});
+}
+async function processMessageWithPipeline(params) {
+	const { message, token, account, config, runtime, core, text, mediaPath, mediaType, statusSink, fetcher } = params;
+	const pairing = createChannelPairingController({
+		core,
+		channel: "zalo",
+		accountId: account.accountId
+	});
+	const { from, chat, message_id, date } = message;
+	const isGroup = chat.chat_type === "GROUP";
+	const chatId = chat.id;
+	const senderId = from.id;
+	const senderName = from.display_name ?? from.name;
+	const dmPolicy = account.config.dmPolicy ?? "pairing";
+	const configAllowFrom = (account.config.allowFrom ?? []).map((v) => String(v));
+	const configuredGroupAllowFrom = (account.config.groupAllowFrom ?? []).map((v) => String(v));
+	const groupAllowFrom = configuredGroupAllowFrom.length > 0 ? configuredGroupAllowFrom : configAllowFrom;
+	const defaultGroupPolicy = resolveDefaultGroupPolicy(config);
+	const groupAccess = isGroup ? evaluateZaloGroupAccess({
+		providerConfigPresent: config.channels?.zalo !== void 0,
+		configuredGroupPolicy: account.config.groupPolicy,
+		defaultGroupPolicy,
+		groupAllowFrom,
+		senderId
+	}) : void 0;
+	if (groupAccess) {
+		warnMissingProviderGroupPolicyFallbackOnce({
+			providerMissingFallbackApplied: groupAccess.providerMissingFallbackApplied,
+			providerKey: "zalo",
+			accountId: account.accountId,
+			log: (message) => logVerbose(core, runtime, message)
+		});
+		if (!groupAccess.allowed) {
+			if (groupAccess.reason === "disabled") logVerbose(core, runtime, `zalo: drop group ${chatId} (groupPolicy=disabled)`);
+			else if (groupAccess.reason === "empty_allowlist") logVerbose(core, runtime, `zalo: drop group ${chatId} (groupPolicy=allowlist, no groupAllowFrom)`);
+			else if (groupAccess.reason === "sender_not_allowlisted") logVerbose(core, runtime, `zalo: drop group sender ${senderId} (groupPolicy=allowlist)`);
+			return;
+		}
+	}
+	const rawBody = text?.trim() || (mediaPath ? "<media:image>" : "");
+	const { senderAllowedForCommands, commandAuthorized } = await resolveSenderCommandAuthorizationWithRuntime({
+		cfg: config,
+		rawBody,
+		isGroup,
+		dmPolicy,
+		configuredAllowFrom: configAllowFrom,
+		configuredGroupAllowFrom: groupAllowFrom,
+		senderId,
+		isSenderAllowed: isZaloSenderAllowed,
+		readAllowFromStore: pairing.readAllowFromStore,
+		runtime: core.channel.commands
+	});
+	const directDmOutcome = resolveDirectDmAuthorizationOutcome({
+		isGroup,
+		dmPolicy,
+		senderAllowedForCommands
+	});
+	if (directDmOutcome === "disabled") {
+		logVerbose(core, runtime, `Blocked zalo DM from ${senderId} (dmPolicy=disabled)`);
+		return;
+	}
+	if (directDmOutcome === "unauthorized") {
+		if (dmPolicy === "pairing") await pairing.issueChallenge({
+			senderId,
+			senderIdLine: `Your Zalo user id: ${senderId}`,
+			meta: { name: senderName ?? void 0 },
+			onCreated: () => {
+				logVerbose(core, runtime, `zalo pairing request sender=${senderId}`);
+			},
+			sendPairingReply: async (text) => {
+				await sendMessage(token, {
+					chat_id: chatId,
+					text
+				}, fetcher);
+				statusSink?.({ lastOutboundAt: Date.now() });
+			},
+			onReplyError: (err) => {
+				logVerbose(core, runtime, `zalo pairing reply failed for ${senderId}: ${String(err)}`);
+			}
+		});
+		else logVerbose(core, runtime, `Blocked unauthorized zalo sender ${senderId} (dmPolicy=${dmPolicy})`);
+		return;
+	}
+	const { route, buildEnvelope } = resolveInboundRouteEnvelopeBuilderWithRuntime({
+		cfg: config,
+		channel: "zalo",
+		accountId: account.accountId,
+		peer: {
+			kind: isGroup ? "group" : "direct",
+			id: chatId
+		},
+		runtime: core.channel,
+		sessionStore: config.session?.store
+	});
+	if (isGroup && core.channel.commands.isControlCommandMessage(rawBody, config) && commandAuthorized !== true) {
+		logVerbose(core, runtime, `zalo: drop control command from unauthorized sender ${senderId}`);
+		return;
+	}
+	const fromLabel = isGroup ? `group:${chatId}` : senderName || `user:${senderId}`;
+	const { storePath, body } = buildEnvelope({
+		channel: "Zalo",
+		from: fromLabel,
+		timestamp: date ? date * 1e3 : void 0,
+		body: rawBody
+	});
+	const ctxPayload = core.channel.reply.finalizeInboundContext({
+		Body: body,
+		BodyForAgent: rawBody,
+		RawBody: rawBody,
+		CommandBody: rawBody,
+		From: isGroup ? `zalo:group:${chatId}` : `zalo:${senderId}`,
+		To: `zalo:${chatId}`,
+		SessionKey: route.sessionKey,
+		AccountId: route.accountId,
+		ChatType: isGroup ? "group" : "direct",
+		ConversationLabel: fromLabel,
+		SenderName: senderName || void 0,
+		SenderId: senderId,
+		CommandAuthorized: commandAuthorized,
+		Provider: "zalo",
+		Surface: "zalo",
+		MessageSid: message_id,
+		MediaPath: mediaPath,
+		MediaType: mediaType,
+		MediaUrl: mediaPath,
+		OriginatingChannel: "zalo",
+		OriginatingTo: `zalo:${chatId}`
+	});
+	await core.channel.session.recordInboundSession({
+		storePath,
+		sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
+		ctx: ctxPayload,
+		onRecordError: (err) => {
+			runtime.error?.(`zalo: failed updating session meta: ${String(err)}`);
+		}
+	});
+	const tableMode = core.channel.text.resolveMarkdownTableMode({
+		cfg: config,
+		channel: "zalo",
+		accountId: account.accountId
+	});
+	const { onModelSelected, ...replyPipeline } = createChannelReplyPipeline({
+		cfg: config,
+		agentId: route.agentId,
+		channel: "zalo",
+		accountId: account.accountId,
+		typing: {
+			start: async () => {
+				await sendChatAction(token, {
+					chat_id: chatId,
+					action: "typing"
+				}, fetcher, ZALO_TYPING_TIMEOUT_MS);
+			},
+			onStartError: (err) => {
+				logTypingFailure({
+					log: (message) => logVerbose(core, runtime, message),
+					channel: "zalo",
+					action: "start",
+					target: chatId,
+					error: err
+				});
+			}
+		}
+	});
+	await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({
+		ctx: ctxPayload,
+		cfg: config,
+		dispatcherOptions: {
+			...replyPipeline,
+			deliver: async (payload) => {
+				await deliverZaloReply({
+					payload,
+					token,
+					chatId,
+					runtime,
+					core,
+					config,
+					accountId: account.accountId,
+					statusSink,
+					fetcher,
+					tableMode
+				});
+			},
+			onError: (err, info) => {
+				runtime.error?.(`[${account.accountId}] Zalo ${info.kind} reply failed: ${String(err)}`);
+			}
+		},
+		replyOptions: { onModelSelected }
+	});
+}
+async function deliverZaloReply(params) {
+	const { payload, token, chatId, runtime, core, config, accountId, statusSink, fetcher } = params;
+	const tableMode = params.tableMode ?? "code";
+	const reply = resolveSendableOutboundReplyParts(payload, { text: core.channel.text.convertMarkdownTables(payload.text ?? "", tableMode) });
+	const chunkMode = core.channel.text.resolveChunkMode(config, "zalo", accountId);
+	await deliverTextOrMediaReply({
+		payload,
+		text: reply.text,
+		chunkText: (value) => core.channel.text.chunkMarkdownTextWithMode(value, ZALO_TEXT_LIMIT, chunkMode),
+		sendText: async (chunk) => {
+			try {
+				await sendMessage(token, {
+					chat_id: chatId,
+					text: chunk
+				}, fetcher);
+				statusSink?.({ lastOutboundAt: Date.now() });
+			} catch (err) {
+				runtime.error?.(`Zalo message send failed: ${String(err)}`);
+			}
+		},
+		sendMedia: async ({ mediaUrl, caption }) => {
+			await sendPhoto(token, {
+				chat_id: chatId,
+				photo: mediaUrl,
+				caption
+			}, fetcher);
+			statusSink?.({ lastOutboundAt: Date.now() });
+		},
+		onMediaError: (error) => {
+			runtime.error?.(`Zalo photo send failed: ${String(error)}`);
+		}
+	});
+}
+async function monitorZaloProvider(options) {
+	const { token, account, config, runtime, abortSignal, useWebhook, webhookUrl, webhookSecret, webhookPath, statusSink, fetcher: fetcherOverride } = options;
+	const core = getZaloRuntime();
+	const effectiveMediaMaxMb = account.config.mediaMaxMb ?? DEFAULT_MEDIA_MAX_MB;
+	const fetcher = fetcherOverride ?? resolveZaloProxyFetch(account.config.proxy);
+	const mode = useWebhook ? "webhook" : "polling";
+	let stopped = false;
+	const stopHandlers = [];
+	let cleanupWebhook;
+	const stop = () => {
+		if (stopped) return;
+		stopped = true;
+		for (const handler of stopHandlers) handler();
+	};
+	runtime.log?.(`[${account.accountId}] Zalo provider init mode=${mode} mediaMaxMb=${String(effectiveMediaMaxMb)}`);
+	try {
+		if (useWebhook) {
+			if (!webhookUrl || !webhookSecret) throw new Error("Zalo webhookUrl and webhookSecret are required for webhook mode");
+			if (!webhookUrl.startsWith("https://")) throw new Error("Zalo webhook URL must use HTTPS");
+			if (webhookSecret.length < 8 || webhookSecret.length > 256) throw new Error("Zalo webhook secret must be 8-256 characters");
+			const path = resolveWebhookPath({
+				webhookPath,
+				webhookUrl,
+				defaultPath: null
+			});
+			if (!path) throw new Error("Zalo webhookPath could not be derived");
+			runtime.log?.(`[${account.accountId}] Zalo configuring webhook path=${path} target=${describeWebhookTarget(webhookUrl)}`);
+			await setWebhook(token, {
+				url: webhookUrl,
+				secret_token: webhookSecret
+			}, fetcher);
+			let webhookCleanupPromise;
+			cleanupWebhook = async () => {
+				if (!webhookCleanupPromise) webhookCleanupPromise = (async () => {
+					runtime.log?.(`[${account.accountId}] Zalo stopping; deleting webhook`);
+					try {
+						await deleteWebhook(token, fetcher, WEBHOOK_CLEANUP_TIMEOUT_MS);
+						runtime.log?.(`[${account.accountId}] Zalo webhook deleted`);
+					} catch (err) {
+						const detail = err instanceof Error && err.name === "AbortError" ? `timed out after ${String(WEBHOOK_CLEANUP_TIMEOUT_MS)}ms` : formatZaloError(err);
+						runtime.error?.(`[${account.accountId}] Zalo webhook delete failed: ${detail}`);
+					}
+				})();
+				await webhookCleanupPromise;
+			};
+			runtime.log?.(`[${account.accountId}] Zalo webhook registered path=${path}`);
+			const unregister = registerZaloWebhookTarget({
+				token,
+				account,
+				config,
+				runtime,
+				core,
+				path,
+				secret: webhookSecret,
+				statusSink: (patch) => statusSink?.(patch),
+				mediaMaxMb: effectiveMediaMaxMb,
+				fetcher
+			});
+			stopHandlers.push(unregister);
+			await waitForAbortSignal(abortSignal);
+			return;
+		}
+		runtime.log?.(`[${account.accountId}] Zalo polling mode: clearing webhook before startup`);
+		try {
+			try {
+				const currentWebhookUrl = normalizeWebhookUrl((await getWebhookInfo(token, fetcher)).result?.url);
+				if (!currentWebhookUrl) runtime.log?.(`[${account.accountId}] Zalo polling mode ready (no webhook configured)`);
+				else {
+					runtime.log?.(`[${account.accountId}] Zalo polling mode disabling existing webhook ${describeWebhookTarget(currentWebhookUrl)}`);
+					await deleteWebhook(token, fetcher);
+					runtime.log?.(`[${account.accountId}] Zalo polling mode ready (webhook disabled)`);
+				}
+			} catch (err) {
+				if (err instanceof ZaloApiError && err.errorCode === 404) runtime.log?.(`[${account.accountId}] Zalo polling mode webhook inspection unavailable; continuing without webhook cleanup`);
+				else throw err;
+			}
+		} catch (err) {
+			runtime.error?.(`[${account.accountId}] Zalo polling startup could not clear webhook: ${formatZaloError(err)}`);
+		}
+		startPollingLoop({
+			token,
+			account,
+			config,
+			runtime,
+			core,
+			abortSignal,
+			isStopped: () => stopped,
+			mediaMaxMb: effectiveMediaMaxMb,
+			statusSink,
+			fetcher
+		});
+		await waitForAbortSignal(abortSignal);
+	} catch (err) {
+		runtime.error?.(`[${account.accountId}] Zalo provider startup failed mode=${mode}: ${formatZaloError(err)}`);
+		throw err;
+	} finally {
+		await cleanupWebhook?.();
+		stop();
+		runtime.log?.(`[${account.accountId}] Zalo provider stopped mode=${mode}`);
+	}
+}
+//#endregion
+export { monitorZaloProvider };