From 576ce7c656d687c0f82f49380d3f660685ef4c68 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 18 Apr 2026 00:40:58 +0100
Subject: [PATCH] perf: slim zalo group access facade

---
 .../.generated/plugin-sdk-api-baseline.sha256 |  4 +-
 extensions/zalo/src/group-access.ts           |  4 +-
 src/plugin-sdk/group-access.ts                |  3 ++
 src/plugin-sdk/zalo-setup.ts                  | 43 +++++++++++--------
 4 files changed, 32 insertions(+), 22 deletions(-)

diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256
index b4782eed7d6..753f3ebaff2 100644
--- a/docs/.generated/plugin-sdk-api-baseline.sha256
+++ b/docs/.generated/plugin-sdk-api-baseline.sha256
@@ -1,2 +1,2 @@
-052943a9f1eb82a49452b6715f4c08faeb650d16a36c150a3c726ff392ecad0d  plugin-sdk-api-baseline.json
-a5077395f009f5064331dc1c38bb2d6d2864299d3c1fbd9e40956c1700fa253c  plugin-sdk-api-baseline.jsonl
+e5c3d6eb56304164434a8b29670a6f02490f359eb7a5f3f4034e61a1b8421c54  plugin-sdk-api-baseline.json
+14d07997a35902bbd3c94d528aafa53185bc66a0ddd9b518f87c85a352feb476  plugin-sdk-api-baseline.jsonl
diff --git a/extensions/zalo/src/group-access.ts b/extensions/zalo/src/group-access.ts
index 0cd4755d16e..5b317ad70de 100644
--- a/extensions/zalo/src/group-access.ts
+++ b/extensions/zalo/src/group-access.ts
@@ -1,10 +1,8 @@
 import { isNormalizedSenderAllowed } from "openclaw/plugin-sdk/allow-from";
 import {
+  evaluateSenderGroupAccess,
   resolveOpenProviderRuntimeGroupPolicy,
   type GroupPolicy,
-} from "openclaw/plugin-sdk/config-runtime";
-import {
-  evaluateSenderGroupAccess,
   type SenderGroupAccessDecision,
 } from "openclaw/plugin-sdk/group-access";
 
diff --git a/src/plugin-sdk/group-access.ts b/src/plugin-sdk/group-access.ts
index bec84b4ba7c..494a78c7b6c 100644
--- a/src/plugin-sdk/group-access.ts
+++ b/src/plugin-sdk/group-access.ts
@@ -1,6 +1,9 @@
 import { resolveOpenProviderRuntimeGroupPolicy } from "../config/runtime-group-policy.js";
 import type { GroupPolicy } from "../config/types.base.js";
 
+export { resolveOpenProviderRuntimeGroupPolicy };
+export type { GroupPolicy };
+
 export type SenderGroupAccessReason =
   | "allowed"
   | "disabled"
diff --git a/src/plugin-sdk/zalo-setup.ts b/src/plugin-sdk/zalo-setup.ts
index d9745a051b7..8912c285c2b 100644
--- a/src/plugin-sdk/zalo-setup.ts
+++ b/src/plugin-sdk/zalo-setup.ts
@@ -1,29 +1,38 @@
-// Manual facade. Keep loader boundary explicit.
-type FacadeModule = typeof import("@openclaw/zalo/setup-api.js");
+// Manual facade. Keep loader boundaries explicit and narrow.
+type SetupFacadeModule = typeof import("@openclaw/zalo/setup-api.js");
+type GroupAccessFacadeModule = typeof import("@openclaw/zalo/contract-api.js");
 import {
   createLazyFacadeObjectValue,
   loadBundledPluginPublicSurfaceModuleSync,
 } from "./facade-loader.js";
 
-function loadFacadeModule(): FacadeModule {
-  return loadBundledPluginPublicSurfaceModuleSync<FacadeModule>({
+function loadSetupFacadeModule(): SetupFacadeModule {
+  return loadBundledPluginPublicSurfaceModuleSync<SetupFacadeModule>({
     dirName: "zalo",
     artifactBasename: "setup-api.js",
   });
 }
-export const evaluateZaloGroupAccess: FacadeModule["evaluateZaloGroupAccess"] = ((...args) =>
-  loadFacadeModule()["evaluateZaloGroupAccess"](
-    ...args,
-  )) as FacadeModule["evaluateZaloGroupAccess"];
-export const resolveZaloRuntimeGroupPolicy: FacadeModule["resolveZaloRuntimeGroupPolicy"] = ((
+function loadGroupAccessFacadeModule(): GroupAccessFacadeModule {
+  return loadBundledPluginPublicSurfaceModuleSync<GroupAccessFacadeModule>({
+    dirName: "zalo",
+    artifactBasename: "contract-api.js",
+  });
+}
+
+export const evaluateZaloGroupAccess: GroupAccessFacadeModule["evaluateZaloGroupAccess"] = ((
   ...args
 ) =>
-  loadFacadeModule()["resolveZaloRuntimeGroupPolicy"](
+  loadGroupAccessFacadeModule()["evaluateZaloGroupAccess"](
     ...args,
-  )) as FacadeModule["resolveZaloRuntimeGroupPolicy"];
-export const zaloSetupAdapter: FacadeModule["zaloSetupAdapter"] = createLazyFacadeObjectValue(
-  () => loadFacadeModule()["zaloSetupAdapter"] as object,
-) as FacadeModule["zaloSetupAdapter"];
-export const zaloSetupWizard: FacadeModule["zaloSetupWizard"] = createLazyFacadeObjectValue(
-  () => loadFacadeModule()["zaloSetupWizard"] as object,
-) as FacadeModule["zaloSetupWizard"];
+  )) as GroupAccessFacadeModule["evaluateZaloGroupAccess"];
+export const resolveZaloRuntimeGroupPolicy: GroupAccessFacadeModule["resolveZaloRuntimeGroupPolicy"] =
+  ((...args) =>
+    loadGroupAccessFacadeModule()["resolveZaloRuntimeGroupPolicy"](
+      ...args,
+    )) as GroupAccessFacadeModule["resolveZaloRuntimeGroupPolicy"];
+export const zaloSetupAdapter: SetupFacadeModule["zaloSetupAdapter"] = createLazyFacadeObjectValue(
+  () => loadSetupFacadeModule()["zaloSetupAdapter"] as object,
+) as SetupFacadeModule["zaloSetupAdapter"];
+export const zaloSetupWizard: SetupFacadeModule["zaloSetupWizard"] = createLazyFacadeObjectValue(
+  () => loadSetupFacadeModule()["zaloSetupWizard"] as object,
+) as SetupFacadeModule["zaloSetupWizard"];