@moxxy/plugin-telegram 0.27.0

package/dist/keys.js

@@ -0,0 +1,42 @@
+/**
+ * Vault keys + token validation shared by the channel, its subcommands, and the
+ * interactive setup wizard. Kept in their own module so the wizard / pair-flow
+ * helpers can import them without pulling in the plugin's full index.
+ */
+/** Vault key the plugin uses for the Bot API token. */
+export const TELEGRAM_TOKEN_KEY = 'telegram_bot_token';
+/** Vault key the plugin uses for the paired chat id. */
+export const TELEGRAM_AUTHORIZED_CHAT_KEY = 'telegram_authorized_chat_id';
+/**
+ * Vault key for the voice-replies preference. Single-paired-chat model, so a
+ * simple present-flag (`'1'` = on, absent = off) keyed like the other telegram
+ * keys, toggled from the paired chat via `/voice`.
+ */
+export const TELEGRAM_VOICE_REPLIES_KEY = 'telegram_voice_replies';
+/** Regex validating a Telegram bot token (`<digits>:<22+ url-safe>`). */
+export const TELEGRAM_TOKEN_RE = /^\d+:[A-Za-z0-9_-]{20,}$/;
+/** Read the persisted voice-replies preference (`'1'` → on). */
+export async function loadVoiceReplies(vault) {
+    return (await vault.get(TELEGRAM_VOICE_REPLIES_KEY)) === '1';
+}
+/** Persist the voice-replies preference: store `'1'` when on, remove it when off. */
+export async function saveVoiceReplies(vault, on) {
+    if (on)
+        await vault.set(TELEGRAM_VOICE_REPLIES_KEY, '1');
+    else
+        await vault.delete(TELEGRAM_VOICE_REPLIES_KEY);
+}
+/**
+ * Parse a stored chat-id (the vault keeps it as a string). Returns `null` for a
+ * missing OR corrupt value rather than letting `Number(x)` yield `NaN` — a
+ * silent NaN serializes to `null` in status output (masking the corruption) and
+ * would otherwise be passed to `api.sendMessage(NaN, …)` as a real target,
+ * producing an opaque Telegram 400 instead of a clear "not paired" signal.
+ */
+export function parseChatId(raw) {
+    if (raw == null || raw === '')
+        return null;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : null;
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD,wDAAwD;AACxD,MAAM,CAAC,MAAM,4BAA4B,GAAG,6BAA6B,CAAC;AAC1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAS5D,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAkC;IACvE,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,KAAK,GAAG,CAAC;AAC/D,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA6C,EAC7C,EAAW;IAEX,IAAI,EAAE;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;;QACpD,MAAM,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAA8B;IACxD,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}

package/dist/pair-flow.d.ts

@@ -0,0 +1,18 @@
+import { type ChannelSubcommandContext } from '@moxxy/sdk';
+/**
+ * Drive the host-issued QR pairing flow end-to-end in a terminal — the SAME
+ * mechanism the desktop Channels panel uses, just rendered inline here.
+ *
+ * Steps:
+ *   1. Build a TelegramChannel from the subcommand ctx and wire the session's
+ *      permission resolver.
+ *   2. Subscribe to "paired" BEFORE starting the bot so a fast scan can't race us.
+ *   3. Start the bot in pairing mode — it mints a code and publishes a
+ *      `t.me/<bot>?start=<code>` deep link as `channel.requestUrl`.
+ *   4. Render that deep link as a scannable QR (+ the plain link).
+ *   5. The user scans / opens the link and taps START (or sends the 6 digits);
+ *      the bot authorizes that chat and `onPaired` fires.
+ *   6. Hand off SIGINT to keep the bot running until the user Ctrl-Cs.
+ */
+export declare function runPairFlow(ctx: ChannelSubcommandContext): Promise<number>;
+//# sourceMappingURL=pair-flow.d.ts.map

package/dist/pair-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair-flow.d.ts","sourceRoot":"","sources":["../src/pair-flow.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAQnF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6FhF"}

package/dist/pair-flow.js

@@ -0,0 +1,119 @@
+import { log, outro, spinner } from '@clack/prompts';
+import QRCode from 'qrcode';
+import { exitAfterPairRequested } from '@moxxy/sdk';
+import { TelegramChannel } from './channel.js';
+// Tiny zero-dep ANSI dim helper, so this flow stays inside the plugin.
+const ANSI = process.stdout.isTTY && !process.env.NO_COLOR;
+const dim = (s) => (ANSI ? `\x1b[2m${s}\x1b[22m` : s);
+/**
+ * Drive the host-issued QR pairing flow end-to-end in a terminal — the SAME
+ * mechanism the desktop Channels panel uses, just rendered inline here.
+ *
+ * Steps:
+ *   1. Build a TelegramChannel from the subcommand ctx and wire the session's
+ *      permission resolver.
+ *   2. Subscribe to "paired" BEFORE starting the bot so a fast scan can't race us.
+ *   3. Start the bot in pairing mode — it mints a code and publishes a
+ *      `t.me/<bot>?start=<code>` deep link as `channel.requestUrl`.
+ *   4. Render that deep link as a scannable QR (+ the plain link).
+ *   5. The user scans / opens the link and taps START (or sends the 6 digits);
+ *      the bot authorizes that chat and `onPaired` fires.
+ *   6. Hand off SIGINT to keep the bot running until the user Ctrl-Cs.
+ */
+export async function runPairFlow(ctx) {
+    const session = ctx.session;
+    const channel = new TelegramChannel({
+        vault: ctx.deps.vault,
+        token: ctx.deps.options?.['token'] ?? undefined,
+        logger: ctx.deps.logger,
+    });
+    session.setPermissionResolver(channel.permissionResolver);
+    // Subscribe BEFORE start so the first scan can't fire before us.
+    let pairedResolve = null;
+    const paired = new Promise((resolve) => {
+        pairedResolve = resolve;
+    });
+    const unsubscribe = channel.onPaired((chatId) => {
+        pairedResolve?.(chatId);
+        pairedResolve = null;
+    });
+    outro(dim('opening pairing window...'));
+    // `pair: true` opens the host-issued QR window and resolves the bot's deep link.
+    const handle = await channel.start({ session, pair: true });
+    // From here on we own the bot lifecycle. Any failure path needs to
+    // call stopBot() before returning.
+    const stopBot = async () => {
+        unsubscribe();
+        try {
+            await handle.stop('wizard');
+        }
+        catch {
+            /* ignore */
+        }
+    };
+    // Already paired (no window was opened): there's nothing to scan. Tell the
+    // user how to re-pair rather than hanging on a pairing that can't happen.
+    if (channel.connected) {
+        log.info('This bot is already paired. Run `moxxy channels telegram unpair` first to pair a different chat.');
+        await stopBot();
+        return 0;
+    }
+    const url = channel.requestUrl;
+    if (!url) {
+        log.error('Could not resolve the bot link — check the token is valid and the network is reachable.');
+        await stopBot();
+        return 1;
+    }
+    await printPairQr(url);
+    log.info('Scan the QR with your phone (or open the link and tap START) — your chat pairs automatically.');
+    // Graceful Ctrl-C while waiting (or once running): stop the bot and exit.
+    let stopping = false;
+    const shutdown = async () => {
+        if (stopping)
+            return;
+        stopping = true;
+        await stopBot();
+        await session.close('SIGINT').catch(() => undefined);
+        process.exit(0);
+    };
+    const onSignal = () => void shutdown();
+    process.once('SIGINT', onSignal);
+    process.once('SIGTERM', onSignal);
+    const spin = spinner();
+    spin.start('Waiting for you to pair in Telegram...');
+    const chatId = await paired;
+    spin.stop(`Paired ✓ — chat ${chatId} is authorized.`);
+    if (exitAfterPairRequested(ctx)) {
+        // Orchestrated pairing (`moxxy onboard`): hand control back — the caller
+        // starts the bot under its own service afterwards. Our SIGINT handlers
+        // would `process.exit` the orchestrator, so drop them first.
+        process.removeListener('SIGINT', onSignal);
+        process.removeListener('SIGTERM', onSignal);
+        await stopBot();
+        return 0;
+    }
+    log.info('Bot is running. Press Ctrl+C to stop.');
+    try {
+        // Only reached if the bot stops on its own (a signal path exits via
+        // shutdown()); remove our handlers so they don't outlive this flow.
+        await handle.running;
+        return 0;
+    }
+    finally {
+        process.removeListener('SIGINT', onSignal);
+        process.removeListener('SIGTERM', onSignal);
+    }
+}
+/** Render the pairing deep link as a scannable terminal QR + the plain link. */
+async function printPairQr(url) {
+    let qr = '';
+    try {
+        qr = await QRCode.toString(url, { type: 'terminal', small: true });
+    }
+    catch {
+        qr = '';
+    }
+    // CLI surface — intentional stdout.
+    console.log(['', qr, `  link: ${url}`, ''].join('\n'));
+}
+//# sourceMappingURL=pair-flow.js.map

package/dist/pair-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair-flow.js","sourceRoot":"","sources":["../src/pair-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAiC,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,uEAAuE;AACvE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC3D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAA6B;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC;QAClC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAmB;QACnC,KAAK,EAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAwB,IAAI,SAAS;QACvE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAe;KACjC,CAAC,CAAC;IACH,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE1D,iEAAiE;IACjE,IAAI,aAAa,GAAsC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC7C,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;QAC9C,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC;QACxB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAExC,iFAAiF;IACjF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,WAAW,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CACN,kGAAkG,CACnG,CAAC;QACF,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,yFAAyF,CAAC,CAAC;QACrG,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;IAE1G,0EAA0E;IAC1E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAS,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,mBAAmB,MAAM,iBAAiB,CAAC,CAAC;IAEtD,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,yEAAyE;QACzE,uEAAuE;QACvE,6DAA6D;QAC7D,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,MAAM,CAAC,OAAO,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,EAAE,CAAC;IACV,CAAC;IACD,oCAAoC;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/pairing.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Pairing state machine — one mechanism, host-issued QR code.
+ *
+ * A control surface (the desktop "Channels" panel, or `moxxy channels telegram
+ * pair` in a terminal) opens a window with `beginHostIssuedPairing`: the 6-digit
+ * code is generated UP FRONT so the surface can embed it in a
+ * `t.me/<bot>?start=<code>` deep link and render that as a QR. The user scans /
+ * opens the link and taps START — the bot receives `/start <code>` — or simply
+ * sends the 6 digits as a message. `submitChatCode` matches the presented code
+ * and authorizes that chat.
+ *
+ * Why this single direction (it replaced an older bot-issues-a-code /
+ * paste-in-the-terminal flow): it works identically whether the surface is a GUI
+ * with no terminal (the desktop) or a terminal (the `pair` command renders the
+ * QR inline) — one affordance everywhere, zero manual code entry — while keeping
+ * the "prove you can see the host's screen" security property (the code only
+ * ever lived on the surface).
+ *
+ * The transitions live in `@moxxy/channel-kit` (host-code pairing, generic over
+ * the peer id — shared with future channels); this module keeps the
+ * Telegram-shaped state/decision surface and maps the kit's semantic action
+ * kinds to Telegram's user-facing messages.
+ */
+export type PairingPhase = 'idle' | 'awaiting-host-code' | 'paired' | 'expired';
+export interface PairingState {
+    phase: PairingPhase;
+    code: string | null;
+    pendingChatId: number | null;
+    expiresAt: number | null;
+    authorizedChatId: number | null;
+}
+export interface PairingDecision {
+    readonly state: PairingState;
+    readonly action: {
+        kind: 'reject';
+        message: string;
+    } | {
+        kind: 'paired';
+        chatId: number;
+    } | {
+        kind: 'still-paired';
+        chatId: number;
+    } | {
+        kind: 'mismatch';
+        message: string;
+    } | {
+        kind: 'expired';
+        message: string;
+    } | {
+        kind: 'not-pending';
+        message: string;
+    };
+}
+export declare function createPairingState(opts?: {
+    authorizedChatId?: number | null;
+}): PairingState;
+/**
+ * Open a host-issued pairing window. The code is generated immediately so the
+ * surface can embed it in the deep link / QR it shows the user.
+ *
+ * No TTL by default: the window's lifetime is the channel process's lifetime
+ * while unpaired (the surface tears it down by stopping the channel), and the
+ * security boundary is "could see the host's screen", not a clock. A caller may
+ * still pass a `ttlMs` to bound it.
+ */
+export declare function beginHostIssuedPairing(state: PairingState, code?: string, now?: number, ttlMs?: number | null): {
+    state: PairingState;
+    code: string;
+};
+/**
+ * Called when the bot receives a BARE `/start` (no code payload) — i.e. the user
+ * opened the chat manually rather than via the pairing deep link. The code path
+ * for a `/start <code>` payload (and plain-message codes) is `submitChatCode`.
+ *
+ * Behavior depends on phase:
+ *   - paired (same chat)   → still-paired (already authorized; greet)
+ *   - paired (other chat)  → reject (the bot is owned by someone else)
+ *   - awaiting-host-code   → reject with a nudge to use the QR / send the code
+ *   - idle / expired       → reject with a nudge to start pairing
+ */
+export declare function handleStart(state: PairingState, chatId: number): PairingDecision;
+/**
+ * Called when a chat PRESENTS a host-issued code — either as the payload of a
+ * `/start <code>` deep link or as a plain 6-digit message. On match the chat is
+ * authorized.
+ */
+export declare function submitChatCode(state: PairingState, chatId: number, rawCode: string, now?: number): PairingDecision;
+export declare function isAuthorized(state: PairingState, chatId: number): boolean;
+export declare function clearPairing(state: PairingState): PairingState;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,YAAY,GACpB,MAAM,GAGN,oBAAoB,GACpB,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EACX;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACnC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACxC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACrC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACpC;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AA8BD,wBAAgB,kBAAkB,CAAC,IAAI,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,YAAY,CAOhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAsB,EAC5B,GAAG,GAAE,MAAmB,EACxB,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAGvC;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAGhF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAmB,GACvB,eAAe,CAGjB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAE9D"}

package/dist/pairing.js

@@ -0,0 +1,97 @@
+import { randomCode } from '@moxxy/plugin-vault';
+import { clearHostCodePairing, createHostCodeState, greetPeer, isPeerAuthorized, openHostCodeWindow, submitPeerCode, } from '@moxxy/channel-kit';
+const MSG_FOREIGN_CHAT = 'This bot is paired with a different chat. Access denied.';
+const MSG_WINDOW_OPEN_HINT = 'Scan the QR (or open the link) shown in moxxy, or send the 6-digit code it shows, to finish pairing.';
+const MSG_NO_WINDOW = 'No pairing window is open. Start pairing from the moxxy desktop Channels panel, or run `moxxy channels telegram pair`.';
+const MSG_NOT_PENDING = 'No pairing window is open.';
+const MSG_EXPIRED = 'Pairing window expired. Start the channel again to retry.';
+const MSG_MISMATCH = "Code didn't match. Check the digits shown in moxxy and try again.";
+function toKit(state) {
+    return {
+        phase: state.phase,
+        code: state.code,
+        expiresAt: state.expiresAt,
+        authorizedPeer: state.authorizedChatId,
+    };
+}
+function fromKit(state) {
+    return {
+        phase: state.phase,
+        code: state.code,
+        pendingChatId: null,
+        expiresAt: state.expiresAt,
+        authorizedChatId: state.authorizedPeer,
+    };
+}
+export function createPairingState(opts = {}) {
+    return fromKit(createHostCodeState({
+        // Preserve the historical truthy check (a 0 chat id is not a real chat).
+        authorizedPeer: opts.authorizedChatId ? opts.authorizedChatId : null,
+    }));
+}
+/**
+ * Open a host-issued pairing window. The code is generated immediately so the
+ * surface can embed it in the deep link / QR it shows the user.
+ *
+ * No TTL by default: the window's lifetime is the channel process's lifetime
+ * while unpaired (the surface tears it down by stopping the channel), and the
+ * security boundary is "could see the host's screen", not a clock. A caller may
+ * still pass a `ttlMs` to bound it.
+ */
+export function beginHostIssuedPairing(state, code = randomCode(6), now = Date.now(), ttlMs = null) {
+    const opened = openHostCodeWindow(toKit(state), { code, now, ttlMs });
+    return { state: fromKit(opened.state), code: opened.code };
+}
+/** Map a kit action to the Telegram-worded decision, reusing `state` when the
+ *  machine didn't transition. */
+function mapAction(state, kitState, action) {
+    switch (action.kind) {
+        case 'paired':
+            return { state: fromKit(kitState), action: { kind: 'paired', chatId: action.peer } };
+        case 'still-paired':
+            return { state, action: { kind: 'still-paired', chatId: action.peer } };
+        case 'rejected-foreign-peer':
+            return { state, action: { kind: 'reject', message: MSG_FOREIGN_CHAT } };
+        case 'window-open-hint':
+            return { state, action: { kind: 'reject', message: MSG_WINDOW_OPEN_HINT } };
+        case 'no-window':
+            return { state, action: { kind: 'reject', message: MSG_NO_WINDOW } };
+        case 'not-pending':
+            return { state, action: { kind: 'not-pending', message: MSG_NOT_PENDING } };
+        case 'expired':
+            return { state: fromKit(kitState), action: { kind: 'expired', message: MSG_EXPIRED } };
+        case 'mismatch':
+            return { state, action: { kind: 'mismatch', message: MSG_MISMATCH } };
+    }
+}
+/**
+ * Called when the bot receives a BARE `/start` (no code payload) — i.e. the user
+ * opened the chat manually rather than via the pairing deep link. The code path
+ * for a `/start <code>` payload (and plain-message codes) is `submitChatCode`.
+ *
+ * Behavior depends on phase:
+ *   - paired (same chat)   → still-paired (already authorized; greet)
+ *   - paired (other chat)  → reject (the bot is owned by someone else)
+ *   - awaiting-host-code   → reject with a nudge to use the QR / send the code
+ *   - idle / expired       → reject with a nudge to start pairing
+ */
+export function handleStart(state, chatId) {
+    const decision = greetPeer(toKit(state), chatId);
+    return mapAction(state, decision.state, decision.action);
+}
+/**
+ * Called when a chat PRESENTS a host-issued code — either as the payload of a
+ * `/start <code>` deep link or as a plain 6-digit message. On match the chat is
+ * authorized.
+ */
+export function submitChatCode(state, chatId, rawCode, now = Date.now()) {
+    const decision = submitPeerCode(toKit(state), chatId, rawCode, now);
+    return mapAction(state, decision.state, decision.action);
+}
+export function isAuthorized(state, chatId) {
+    return isPeerAuthorized(toKit(state), chatId);
+}
+export function clearPairing(state) {
+    return fromKit(clearHostCodePairing(toKit(state)));
+}
+//# sourceMappingURL=pairing.js.map

package/dist/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,GAGf,MAAM,oBAAoB,CAAC;AAqD5B,MAAM,gBAAgB,GAAG,0DAA0D,CAAC;AACpF,MAAM,oBAAoB,GACxB,sGAAsG,CAAC;AACzG,MAAM,aAAa,GACjB,wHAAwH,CAAC;AAC3H,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,WAAW,GAAG,2DAA2D,CAAC;AAChF,MAAM,YAAY,GAAG,mEAAmE,CAAC;AAEzF,SAAS,KAAK,CAAC,KAAmB;IAChC,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,cAAc;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6C,EAAE;IAChF,OAAO,OAAO,CACZ,mBAAmB,CAAS;QAC1B,yEAAyE;QACzE,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;KACrE,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,OAAe,UAAU,CAAC,CAAC,CAAC,EAC5B,MAAc,IAAI,CAAC,GAAG,EAAE,EACxB,QAAuB,IAAI;IAE3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED;iCACiC;AACjC,SAAS,SAAS,CAChB,KAAmB,EACnB,QAA+B,EAC/B,MAA8B;IAE9B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvF,KAAK,cAAc;YACjB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC1E,KAAK,kBAAkB;YACrB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC9E,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;QACvE,KAAK,aAAa;YAChB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;QAC9E,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;QACzF,KAAK,UAAU;YACb,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAAmB,EAAE,MAAc;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAmB,EACnB,MAAc,EACd,OAAe,EACf,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,MAAc;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/permission.d.ts

@@ -0,0 +1,25 @@
+import type { PendingToolCall, PermissionContext, PermissionDecision, PermissionResolver } from '@moxxy/sdk';
+export interface PendingPermission {
+    readonly callId: string;
+    readonly call: PendingToolCall;
+    readonly ctx: PermissionContext;
+    readonly resolve: (decision: PermissionDecision) => void;
+}
+/**
+ * Permission resolver that defers each tool call to an external decider (the
+ * Telegram bot, which renders an inline keyboard and waits for a callback).
+ * The Telegram channel registers a callback handler that invokes
+ * `resolvePending(callId, decision)` when the user clicks a button.
+ */
+export declare class TelegramPermissionResolver implements PermissionResolver {
+    readonly name = "telegram";
+    private readonly pending;
+    private readonly sessionAllows;
+    private deciderFn;
+    setDecider(fn: (call: PendingToolCall, ctx: PermissionContext) => Promise<void>): void;
+    check(call: PendingToolCall, ctx: PermissionContext): Promise<PermissionDecision>;
+    /** Called by the bot when a permission callback button is clicked. */
+    resolvePending(callId: string, decision: PermissionDecision): boolean;
+    abortAll(reason?: string): void;
+}
+//# sourceMappingURL=permission.d.ts.map

package/dist/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE7G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC1D;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,QAAQ,CAAC,IAAI,cAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,SAAS,CAED;IAEhB,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIhF,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkBvF,sEAAsE;IACtE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO;IAQrE,QAAQ,CAAC,MAAM,SAAmB,GAAG,IAAI;CAM1C"}

package/dist/permission.js

@@ -0,0 +1,49 @@
+/**
+ * Permission resolver that defers each tool call to an external decider (the
+ * Telegram bot, which renders an inline keyboard and waits for a callback).
+ * The Telegram channel registers a callback handler that invokes
+ * `resolvePending(callId, decision)` when the user clicks a button.
+ */
+export class TelegramPermissionResolver {
+    name = 'telegram';
+    pending = new Map();
+    sessionAllows = new Set();
+    deciderFn = null;
+    setDecider(fn) {
+        this.deciderFn = fn;
+    }
+    async check(call, ctx) {
+        if (this.sessionAllows.has(call.name)) {
+            return { mode: 'allow_session', reason: 'allow_session previously granted' };
+        }
+        if (!this.deciderFn) {
+            return { mode: 'deny', reason: 'no decider attached (bot not running)' };
+        }
+        const decision = await new Promise((resolve) => {
+            this.pending.set(call.callId, { callId: call.callId, call, ctx, resolve });
+            this.deciderFn(call, ctx).catch((err) => {
+                this.pending.delete(call.callId);
+                resolve({ mode: 'deny', reason: err instanceof Error ? err.message : String(err) });
+            });
+        });
+        if (decision.mode === 'allow_session')
+            this.sessionAllows.add(call.name);
+        return decision;
+    }
+    /** Called by the bot when a permission callback button is clicked. */
+    resolvePending(callId, decision) {
+        const pending = this.pending.get(callId);
+        if (!pending)
+            return false;
+        this.pending.delete(callId);
+        pending.resolve(decision);
+        return true;
+    }
+    abortAll(reason = 'channel closed') {
+        for (const pending of this.pending.values()) {
+            pending.resolve({ mode: 'deny', reason });
+        }
+        this.pending.clear();
+    }
+}
+//# sourceMappingURL=permission.js.map

package/dist/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IAC5B,IAAI,GAAG,UAAU,CAAC;IACV,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC/C,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,SAAS,GAEN,IAAI,CAAC;IAEhB,UAAU,CAAC,EAAoE;QAC7E,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAqB,EAAE,GAAsB;QACvD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;YACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,SAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,cAAc,CAAC,MAAc,EAAE,QAA4B;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,MAAM,GAAG,gBAAgB;QAChC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/render.d.ts

@@ -0,0 +1,68 @@
+import type { MoxxyEvent } from '@moxxy/sdk';
+export interface RenderedFrame {
+    /** Pre-formatted HTML activity block (blockquote of tool calls). */
+    readonly activityHtml: string;
+    /** Assistant body in original markdown — caller converts to Telegram HTML. */
+    readonly body: string;
+    /** Pre-formatted HTML error line. */
+    readonly errorHtml: string;
+    /**
+     * Pre-formatted HTML diff block(s) for any file-diff tool results in
+     * this turn. Each is a summary line plus a `<pre><code
+     * class="language-diff">…</code></pre>` fence; Telegram highlights the
+     * `+`/`-` lines for the `diff` language. Empty string when no file was
+     * edited. Composed after the body — see `composeFrame`.
+     */
+    readonly diffHtml: string;
+    /** True if any of the above changed since the previous frame. */
+    readonly hasUpdate: boolean;
+}
+export declare class TurnRenderer {
+    private chunks;
+    /** In-flight + completed tool calls keyed by callId, in arrival order. */
+    private tools;
+    private skillBanner;
+    private notices;
+    private finalAssistant;
+    private errorLine;
+    /** Pre-formatted HTML diff blocks, one per file-diff tool result, in arrival order. */
+    private diffBlocks;
+    private lastFrame;
+    accept(event: MoxxyEvent): RenderedFrame;
+    /**
+     * Compose the current frame. `collapse` (set on the final flush) folds a
+     * long tool-activity trace into an expandable box so the finished message
+     * leads with the answer; during streaming it's left false so the activity
+     * stays fully visible while work is in flight.
+     */
+    snapshot(opts?: {
+        collapse?: boolean;
+    }): RenderedFrame;
+    /**
+     * Format the tool/skill activity block. Returns null when there's
+     * nothing to show — keeps frames lean for chat-only turns.
+     *
+     * The block is rendered with HTML tags (`<b>`, `<code>`, `<i>`) so
+     * it survives `markdownToTelegramHtml` intact (the function escapes
+     * `<` `>` `&` in text segments but leaves existing tags alone via
+     * the fence/inline placeholder dance). Use `__inert__` markers so
+     * already-formed HTML doesn't get re-escaped.
+     *
+     * When `collapse` is set (final frame) and the trace ran long, fold it
+     * into a `<blockquote expandable>` topped by a one-line summary — the
+     * tool noise becomes a tap-to-open box and the assistant's answer leads.
+     */
+    private renderActivity;
+    reset(): void;
+}
+/**
+ * Split composed Telegram HTML into <=`limit`-char parts that are each
+ * independently valid `parse_mode=HTML`. Cuts are chosen so they never land
+ * inside a `<...>` tag or an `&...;` entity; if a block-level tag (e.g. a
+ * `<pre><code class="language-diff">` fence or a `<blockquote>`) is open at the
+ * boundary it is closed in the head part and reopened in the tail. For plain
+ * text with no open tags this reduces to the old newline-preferring behaviour
+ * and `parts.join('')` reconstructs the input exactly.
+ */
+export declare function splitForTelegram(text: string, limit?: number): string[];
+//# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAiB7C,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAyCD,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,0EAA0E;IAC1E,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,SAAS,CAAuB;IACxC,uFAAuF;IACvF,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,SAAS,CAAM;IAEvB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,aAAa;IA6ExC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,aAAa;IAQ1D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,cAAc;IA0BtB,KAAK,IAAI,IAAI;CAUd;AAkOD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAA+B,GAAG,MAAM,EAAE,CA0D/F"}