@rubytech/create-maxy-code 0.1.575 → 0.1.577

package/payload/platform/plugins/dispatch/skills/dispatch-page/template/planner.js

@@ -114,20 +114,133 @@
      column order above. */
   var HOUR_KEYS = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun'];
 
-  /* One visit. Clicking moves it to the next declared status and posts that
-     through the portal's existing write door. Which transitions are legal is
-     Task 2511's; this cycles the declared list. */
-  function visitButton(v, meta, zone) {
+  /* Whether the account declared this move (Task 2511).
+
+     Absent from the published list means refused, and the list travels with the
+     week, so a drag is refused with the install offline. `visit-status.ts`
+     refuses it a second time from the same list; that refusal is the binding
+     one, and this one exists so the operator is told now rather than in sixty
+     seconds. An unchanged status is NOT a move, which is the same rule the door
+     applies: `[from, to]` declares a move and no account declares a
+     self-transition, so without this every pure re-timing would be refused. */
+  function declared(meta, from, to) {
+    if (from === to) return true;
+    var list = (meta && meta.transitions) || [];
+    for (var i = 0; i < list.length; i++) {
+      if (list[i][0] === from && list[i][1] === to) return true;
+    }
+    return false;
+  }
+
+  /* The same wall-clock time on a different day, IN THE ACCOUNT'S ZONE.
+
+     Built by asking the account's own formatter what instant renders as the
+     wanted wall time, never from the browser's offset: a page that guesses the
+     zone re-times a visit to a plausible wrong hour, which is the Task 2280
+     defect. Two passes, because the offset either side of a daylight-saving
+     transition differs and the first correction can land on the far side of it.
+
+     Returns the shape the door admits, which is what `toISOString` produces. */
+  function retimed(iso, dayKey, zone) {
+    var wall = new Intl.DateTimeFormat('en-GB', {
+      timeZone: zone,
+      hour: '2-digit',
+      minute: '2-digit',
+      hour12: false,
+    });
+    var held = wall.format(new Date(iso));
+    var guess = new Date(dayKey + 'T' + held + ':00.000Z');
+    for (var i = 0; i < 2; i++) {
+      var seen = wall.format(guess);
+      if (seen === held) break;
+      var drift =
+        (Number(held.slice(0, 2)) - Number(seen.slice(0, 2))) * 60 +
+        (Number(held.slice(3)) - Number(seen.slice(3)));
+      guess = new Date(guess.getTime() + drift * 60000);
+    }
+    return guess.toISOString();
+  }
+
+  /* One visit. Clicking moves it to the next declared status; dragging re-times
+     or re-assigns it. Both post through the portal's existing write door, and
+     both are refused here first against the published transition list. */
+  function visitButton(v, data, meta, zone) {
     var b = document.createElement('button');
     b.type = 'button';
     b.className = 'pl-visit';
+    b.draggable = true;
     b.textContent = [timeOf(v.startDate, zone), v.status, v.purpose].filter(Boolean).join(' · ');
     b.addEventListener('click', function () {
       advance(v, meta);
     });
+    /* The panel is a second gesture on the same card, so the click keeps
+       meaning what it meant before this task. */
+    b.addEventListener('contextmenu', function (e) {
+      e.preventDefault();
+      openVisit(v, data, meta, zone);
+    });
+    b.addEventListener('dragstart', function (e) {
+      dragging = v;
+      if (e.dataTransfer) e.dataTransfer.effectAllowed = 'move';
+    });
+    b.addEventListener('dragend', function () {
+      dragging = null;
+    });
     return b;
   }
 
+  /* The visit under the pointer during a drag. Held here rather than in
+     dataTransfer, which only carries strings and would mean looking the visit
+     back up by id on every drop. */
+  var dragging = null;
+
+  function move(v, meta, zone, toOwnerId, toDayKey) {
+    var body = { visitId: v.visitId, status: v.status };
+    if (toOwnerId !== v.ownerId) body.assignedOwnerId = toOwnerId;
+    if (toDayKey !== dayOf(v.startDate, zone)) {
+      body.startDate = retimed(v.startDate, toDayKey, zone);
+    }
+    /* A drop that changes neither is not a write. */
+    if (body.assignedOwnerId === undefined && body.startDate === undefined) return;
+    say('Saving…');
+    api('/api/visit-status', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+      .then(function (r) {
+        return r.json().then(function (d) {
+          return { s: r.status, d: d };
+        });
+      })
+      .then(function (res) {
+        if (!res.d.ok) {
+          console.error('[planner] move refused', { status: res.s, error: res.d.error });
+          say(
+            res.s === 404
+              ? 'That is not yours to change.'
+              : res.d.error === 'illegal-transition'
+                ? 'That move is not one this account allows.'
+                : 'That change was refused.',
+          );
+          /* The card returns to origin by redrawing what the device last
+             published. Leaving it where it fell would be the page telling the
+             operator something happened that did not. */
+          if (latest) render(latest);
+          return;
+        }
+        if (body.assignedOwnerId !== undefined) v.ownerId = body.assignedOwnerId;
+        if (body.startDate !== undefined) v.startDate = body.startDate;
+        say('Saved. It reaches the office within a minute.');
+        if (latest) render(latest);
+      })
+      .catch(function (err) {
+        console.error('[planner] move failed', { status: 'network', error: err });
+        say('Could not reach the server.');
+        if (latest) render(latest);
+      });
+  }
+
   function advance(v, meta) {
     var names = ((meta && meta.statuses) || []).map(function (s) {
       return s.name;
@@ -137,6 +250,10 @@
       return;
     }
     var next = names[(names.indexOf(v.status) + 1) % names.length];
+    if (!declared(meta, v.status, next)) {
+      say('That move is not one this account allows.');
+      return;
+    }
     say('Saving…');
     api('/api/visit-status', {
       method: 'POST',
@@ -169,6 +286,60 @@
       });
   }
 
+  /* Who may be sent to this record, why the others may not, and what has been
+     recorded against it.
+
+     Rendered from what /api/visits returned and nothing else. The install
+     computed the offers and the exclusions with the one implementation of
+     qualification and clash; re-deciding any of it here would be a second rule
+     to get wrong, which is what `functions/api/visits.ts` rules out. A
+     candidate carries no travel estimate today and is rendered without one
+     rather than dropped. */
+  function openVisit(v, data, meta, zone) {
+    var mine = (data.candidates || []).filter(function (c) {
+      return c.visitId === v.visitId;
+    });
+    document.getElementById('pl-allocate-head').textContent =
+      [timeOf(v.startDate, zone), v.status, v.purpose].filter(Boolean).join(' · ');
+
+    var list = document.getElementById('pl-allocate-list');
+    list.replaceChildren();
+    if (!mine.length) {
+      /* Never an empty box. Nobody offered and nobody excluded is a different
+         fact from an unstaffable record, and the operator cannot tell them
+         apart from a blank panel. */
+      var none = cell('pl-candidate', 'Nobody has been offered for this, and nobody was excluded.');
+      none.setAttribute('data-kind', 'excluded');
+      list.appendChild(none);
+    }
+    mine.forEach(function (c) {
+      var who = c.name || c.workerId;
+      var note =
+        c.kind === 'excluded'
+          ? c.reason
+          : (c.conflicts || []).length
+            ? (c.conflicts || []).length + ' already booked in this window'
+            : 'free';
+      var li = document.createElement('li');
+      li.className = 'pl-candidate';
+      li.setAttribute('data-kind', c.kind);
+      li.textContent = who + ' · ' + note;
+      list.appendChild(li);
+    });
+
+    /* What the worker recorded, as counts. The contents themselves are files,
+       and the portal's own file exchange already carries them. */
+    document.getElementById('pl-record').textContent = [
+      'notes ' + (v.notes || 0),
+      'media ' + (v.media || 0),
+      'parts ' + (v.parts || 0),
+      'checklist ' + (v.checklistDone || 0) + '/' + (v.checklistTotal || 0),
+      'signatures ' + (v.signatures || 0),
+    ].join(' · ');
+
+    document.getElementById('pl-allocate').hidden = false;
+  }
+
   function render(data) {
     var meta = data.meta;
     /* UTC when the account published no config. Never the browser's: a page
@@ -225,12 +396,35 @@
           'data-off',
           w.workingHours && w.workingHours[HOUR_KEYS[i]] ? 'false' : 'true',
         );
+        /* Every cell is a drop target, including a day the worker does not
+           work: the office books into one deliberately, and a cell that
+           refused the drop would make that decision for them. A row with no
+           configured worker is not a target, because there is no ownerId to
+           re-assign to. */
+        if (w.workerId) {
+          c.addEventListener('dragover', function (e) {
+            if (!dragging) return;
+            e.preventDefault();
+            c.setAttribute('data-over', 'true');
+          });
+          c.addEventListener('dragleave', function () {
+            c.removeAttribute('data-over');
+          });
+          c.addEventListener('drop', function (e) {
+            e.preventDefault();
+            c.removeAttribute('data-over');
+            if (!dragging) return;
+            var v = dragging;
+            dragging = null;
+            move(v, meta, zone, w.ownerId, k);
+          });
+        }
         (byOwner[w.ownerId] || [])
           .filter(function (v) {
             return dayOf(v.startDate, zone) === k;
           })
           .forEach(function (v) {
-            c.appendChild(visitButton(v, meta, zone));
+            c.appendChild(visitButton(v, data, meta, zone));
           });
         gridEl.appendChild(c);
       });
@@ -316,6 +510,10 @@
       });
   });
 
+  document.getElementById('pl-allocate-close').addEventListener('click', function () {
+    document.getElementById('pl-allocate').hidden = true;
+  });
+
   document.getElementById('pl-prev').addEventListener('click', function () {
     anchor.setUTCDate(anchor.getUTCDate() - 7);
     if (latest) render(latest);

package/payload/platform/plugins/docs/references/internals.md

@@ -406,7 +406,7 @@ Standing rules the operator gives over a channel are `Preference` nodes. Two mec
 
 **Reconcile by meaning on write (`profile-update`).** The existence check is two-tier. First an exact `(category, key)` match — the classic fast path, unchanged. When that misses, a semantic-neighbour lookup runs over the `preference_embedding` vector index, scoped to the same `accountId` and `scope:'admin'`, non-trashed. If the nearest neighbour is at or above `SAME_SUBJECT_COSINE` (0.85), the write lands on that node through the existing reinforce/update/contradict curve instead of minting a duplicate; the matched neighbours are returned in the tool result so the agent can classify future writes against real prior state. The confidence constants are unchanged — only the join key widens, so a rephrasing under a new `key` no longer forks the rule and a correction demotes the prior node rather than adding a contradictory one.
 
-**Inject the active rule-set every turn (channel gateways).** The one definition of "this account's active rules" is `@maxy/active-rules`: the account owner's admin-scope preferences (resolve the seeded `AdminUser {role:'owner'}`, then select through that owner's `UserProfile` via `HAS_PREFERENCE`), a floor-filtered (`confidence >= 0.4`), confidence-ordered query that returns every such preference verbatim — no cap, no de-confliction, no candidate limit. Concision is enforced at write time by the `conversational-memory` skill (each stored value is a single minimal imperative) and by the write-time semantic reconcile (a same-subject write at or above `SAME_SUBJECT_COSINE` folds into the existing node rather than minting a duplicate), so the injected block stays small because each stored preference is short and non-redundant, not because injection truncates. A preference owned by a non-owner profile (an operator's, stranded on the operator's own profile while managing the account) is never injected; an account with no seeded owner injects nothing. `profile-read` exposes this same owner-scoped set as `activeRules`, and the three inbound gateways (`wa-gateway`, `telegram-gateway`, `webchat-gateway`) fetch it for the effective session account and attach it as `standingRules` on the inbound frame; the channel builders prepend it as a `## Standing rules` block above `## Context`. Both channel-server inbound paths carry the block: the single-target SSE loop parses the whole frame, and the unified multi-target door reader (`runDoorStream`,) reconstructs it through the shared `doorInboundPayload` seam whose `parseFrame` closures read `standingRules` off the frame. The read is by code, not agent discretion, so a rule set last week is applied this week regardless of how many times the session compacted. Telegram and webchat inject for `role:'admin'` only — a public visitor never receives operator rules.
+**Inject the active rule-set every turn (channel gateways).** The one definition of "this account's active rules" is `@maxy/active-rules`: the account owner's admin-scope preferences (resolve the seeded `AdminUser {role:'owner'}`, then select through that owner's `UserProfile` via `HAS_PREFERENCE`), a floor-filtered (`confidence >= 0.4`), confidence-ordered query that returns every such preference verbatim — no cap, no de-confliction, no candidate limit. Concision is enforced at write time by the `conversational-memory` skill (each stored value is a single minimal imperative) and by the write-time semantic reconcile (a same-subject write at or above `SAME_SUBJECT_COSINE` folds into the existing node rather than minting a duplicate), so the injected block stays small because each stored preference is short and non-redundant, not because injection truncates. A preference owned by a non-owner profile (an operator's, stranded on the operator's own profile while managing the account) is never injected; an account with no seeded owner injects nothing. `profile-read` exposes this same owner-scoped set as `activeRules`, and the three inbound gateways (`wa-gateway`, `telegram-gateway`, `webchat-gateway`) fetch it for the effective session account and attach it as `standingRules` on the inbound frame; the channel builders prepend it as a `## Standing rules (account owner)` block above `## Context`, whose header and first line name the owner as the subject of the rules so a third-person rule about the owner is not read as a statement about the sender. Both channel-server inbound paths carry the block: the single-target SSE loop parses the whole frame, and the unified multi-target door reader (`runDoorStream`,) reconstructs it through the shared `doorInboundPayload` seam whose `parseFrame` closures read `standingRules` off the frame. The read is by code, not agent discretion, so a rule set last week is applied this week regardless of how many times the session compacted. Telegram and webchat inject for `role:'admin'` only — a public visitor never receives operator rules.
 
 **Trust a scheduled turn's provenance, never an inbound's claim (channel-agent grounding).** A cron-dispatched agent turn reaches the same channel builders as a real inbound, so its own authorisation text would otherwise land inside `## Context` — the zone `REFRAME_INSTRUCTION` demotes to untrusted — and a security-cautious agent would distrust its own automation (the self-cancel loop). The dispatcher therefore stamps a `ScheduleProvenance` marker (owning account, event, owner userId, dispatch time) that the channel builders render as a `## Scheduled automation (platform-verified)` preamble **above** `## Context` (and above the rules block); the whatsapp wrap tag names the door `scheduler`. Both channel-server paths carry the marker — the single-target loop and the unified multi-target door reader (via the same `doorInboundPayload` seam that carries `standingRules`); the scheduler only dispatches to the whatsapp/telegram door, so a webchat frame never bears one. Because the marker is dispatcher-stamped and never derived from payload text, an inbound message cannot forge it — placement above `## Context` alone is not the trust signal, the dispatcher provenance is. The grounding binds to it in two places: one recipient-neutral clause added byte-identical to the three reframe instructions (a marker-bearing turn is authorised standing automation; a reconfiguration or re-enable is not intrusion), and the admin `IDENTITY.md` "Untrusted input" rule that the agent never states a platform-level authenticity or impersonation verdict it was not given (an unsourced "this is not from you" is its own inference, flagged, never asserted as the platform's). A sender has exactly one session: every inbound, real or scheduled, resolves to the deterministic `adminSessionIdFor(effectiveAccount, destination)`. An earlier change gave each firing its own salted seat so distrust could not accrete across firings, but the inbound hub keys on `senderId` and replaces its subscriber outright, so a seat's channel server attached under the sender's own key and swallowed the sender's REAL messages until it detached — splitting one conversation across two sessions that each denied what the other held. The seat is removed; the authoritative `agentPrompt`, this provenance marker, and the injected standing rules ground each firing without one. Self-cancel attribution is disarmed while that model beds in: the guard used to compare the cancelling turn's session id to a dispatcher stamp, which discriminated only because each firing ran its own seat, so with one session per sender it would report an autonomous loop on every operator cancel. It now always reports false — under-counting a real loop rather than inventing one — until the discriminator is rebuilt from the turn's own dispatched eventId. See `.docs/scheduling-agent-dispatch.md § Operator-provenance marker`, `§ Session model — one session per sender`, and `§ Self-cancel attribution — disarmed`.
 

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-path.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhook-path.test.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-path.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-path.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-path.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-path.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { admitsWebhookPath, CANONICAL_TELEGRAM_PREFIX } from "../lib/account-write.js";
+describe("admitsWebhookPath", () => {
+    it("admits the one path the router serves and the gate exempts", () => {
+        expect(admitsWebhookPath("/api/telegram/")).toBe(true);
+        expect(CANONICAL_TELEGRAM_PREFIX).toBe("/api/telegram/");
+    });
+    it("refuses a subpath — telegram-mount.ts leaves every one of them on 404", () => {
+        expect(admitsWebhookPath("/api/telegram/webhook")).toBe(false);
+        expect(admitsWebhookPath("/api/telegram/8861756902")).toBe(false);
+    });
+    it("refuses the no-slash shape — the router serves it but isRemoteAuthBypassPath 401s it", () => {
+        expect(admitsWebhookPath("/api/telegram")).toBe(false);
+    });
+    it("refuses the official plugin's path", () => {
+        expect(admitsWebhookPath("/channels/telegram")).toBe(false);
+    });
+});
+//# sourceMappingURL=webhook-path.test.js.map

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-path.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-path.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-path.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEvF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-register.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhook-register.test.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-register.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-register.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-register.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-register.test.js

@@ -0,0 +1,110 @@
+import { describe, expect, it } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { webhookRegister } from "../tools/webhook-register.js";
+const STAMP = 1_754_600_000;
+const TOKEN = "8861756902:AAAsecret";
+const URL_OK = "https://sitedesk.example/api/telegram/";
+/** account.json lives at <platformRoot>/../data/accounts/<id>/account.json. */
+function stubAccount() {
+    const root = mkdtempSync(join(tmpdir(), "tg-reg-"));
+    const platformRoot = join(root, "platform");
+    mkdirSync(platformRoot, { recursive: true });
+    const dir = resolve(root, "data", "accounts", "acct-1");
+    mkdirSync(dir, { recursive: true });
+    const configPath = join(dir, "account.json");
+    writeFileSync(configPath, JSON.stringify({ telegram: { bots: [] } }));
+    return { platformRoot, configPath };
+}
+function botsIn(configPath) {
+    return JSON.parse(readFileSync(configPath, "utf-8")).telegram.bots;
+}
+/** getMe ok, setWebhook ok, getWebhookInfo returns whatever `info` says. */
+function stubFetch(info) {
+    return (async (url) => ({
+        json: async () => {
+            if (String(url).endsWith("/getMe"))
+                return { ok: true, result: { username: "sitedeskbot" } };
+            if (String(url).endsWith("/setWebhook"))
+                return { ok: true };
+            return { result: { url: URL_OK, pending_update_count: 0, ...info } };
+        },
+    }));
+}
+function deps(platformRoot, lines, fetchImpl) {
+    const secretDir = mkdtempSync(join(tmpdir(), "tg-sec-"));
+    return {
+        platformRoot,
+        accountId: "acct-1",
+        log: (l) => lines.push(l),
+        fetchImpl,
+        nowSec: () => STAMP,
+        secretPathFor: (botId) => join(secretDir, botId),
+    };
+}
+describe("webhookRegister", () => {
+    it("refuses a subpath, names the one path that works, and writes nothing", async () => {
+        const { platformRoot, configPath } = stubAccount();
+        const lines = [];
+        const out = await webhookRegister({ botToken: TOKEN, webhookUrl: "https://sitedesk.example/api/telegram/webhook", role: "admin" }, deps(platformRoot, lines, stubFetch({})));
+        expect(out.isError).toBe(true);
+        expect(out.text).toContain("/api/telegram/");
+        expect(botsIn(configPath)).toEqual([]);
+        expect(lines.join("\n")).toContain("op=webhook-register path=/api/telegram/webhook");
+        expect(lines.join("\n")).toContain("admitted=false");
+    });
+    it("fails the registration on a fresh delivery error and persists no bot entry", async () => {
+        const { platformRoot, configPath } = stubAccount();
+        const lines = [];
+        const out = await webhookRegister({ botToken: TOKEN, webhookUrl: URL_OK, role: "admin" }, deps(platformRoot, lines, stubFetch({
+            last_error_date: STAMP + 3,
+            last_error_message: "Wrong response from the webhook: 404 Not Found",
+        })));
+        expect(out.isError).toBe(true);
+        expect(out.text).toContain("Wrong response from the webhook: 404 Not Found");
+        expect(botsIn(configPath)).toEqual([]);
+        expect(lines.join("\n")).toContain("op=webhook-verify");
+        expect(lines.join("\n")).toContain("reachable=false");
+    });
+    it("passes an error Telegram kept from the previous URL", async () => {
+        const { platformRoot, configPath } = stubAccount();
+        const lines = [];
+        const out = await webhookRegister({ botToken: TOKEN, webhookUrl: URL_OK, role: "admin" }, deps(platformRoot, lines, stubFetch({
+            last_error_date: STAMP - 60,
+            last_error_message: "Wrong response from the webhook: 404 Not Found",
+            pending_update_count: 83,
+        })));
+        expect(out.isError).toBe(false);
+        expect(botsIn(configPath)).toHaveLength(1);
+        expect(lines.join("\n")).toContain("pending=83");
+    });
+    it("persists the bot and logs the verify line on a clean probe", async () => {
+        const { platformRoot, configPath } = stubAccount();
+        const lines = [];
+        const out = await webhookRegister({ botToken: TOKEN, webhookUrl: URL_OK, role: "admin", adminUsers: [42] }, deps(platformRoot, lines, stubFetch({})));
+        expect(out.isError).toBe(false);
+        expect(botsIn(configPath)).toEqual([
+            { id: "8861756902", token: TOKEN, role: "admin", adminUsers: [42] },
+        ]);
+        expect(lines.join("\n")).toContain("op=webhook-verify path=/api/telegram/ botId=8861756902");
+        expect(lines.join("\n")).toContain("pending=0");
+    });
+    it("keeps the registration when the probe itself throws", async () => {
+        const { platformRoot, configPath } = stubAccount();
+        const lines = [];
+        const throwingProbe = (async (url) => {
+            if (String(url).endsWith("/getWebhookInfo"))
+                throw new Error("socket hang up");
+            return {
+                json: async () => String(url).endsWith("/getMe") ? { ok: true, result: { username: "b" } } : { ok: true },
+            };
+        });
+        const out = await webhookRegister({ botToken: TOKEN, webhookUrl: URL_OK, role: "admin" }, deps(platformRoot, lines, throwingProbe));
+        expect(out.isError).toBe(false);
+        expect(botsIn(configPath)).toHaveLength(1);
+        expect(lines.join("\n")).toContain("op=webhook-verify path=/api/telegram/ botId=8861756902 probe=failed");
+        expect(lines.join("\n")).toContain("reason=socket hang up");
+    });
+});
+//# sourceMappingURL=webhook-register.test.js.map

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-register.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-register.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-register.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,KAAK,GAAG,aAAa,CAAC;AAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC;AACrC,MAAM,MAAM,GAAG,wCAAwC,CAAC;AAExD,+EAA+E;AAC/E,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5C,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,MAAM,CAAC,UAAkB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,IAA6B;IAC9C,OAAO,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;YAC7F,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QACvE,CAAC;KACF,CAAC,CAA4B,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,YAAoB,EAAE,KAAe,EAAE,SAAuB;IAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,QAAQ;QACnB,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS;QACT,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,aAAa,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;QACnD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,+CAA+C,EAAE,IAAI,EAAE,OAAO,EAAE,EAC/F,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CACzC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;QACnD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EACtD,IAAI,CACF,YAAY,EACZ,KAAK,EACL,SAAS,CAAC;YACR,eAAe,EAAE,KAAK,GAAG,CAAC;YAC1B,kBAAkB,EAAE,gDAAgD;SACrE,CAAC,CACH,CACF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gDAAgD,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;QACnD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EACtD,IAAI,CACF,YAAY,EACZ,KAAK,EACL,SAAS,CAAC;YACR,eAAe,EAAE,KAAK,GAAG,EAAE;YAC3B,kBAAkB,EAAE,gDAAgD;YACpE,oBAAoB,EAAE,EAAE;SACzB,CAAC,CACH,CACF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;QACnD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,EACxE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CACzC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,wDAAwD,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;QACnD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC3C,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC/E,OAAO;gBACL,IAAI,EAAE,KAAK,IAAI,EAAE,CACf,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;aAC1F,CAAC;QACJ,CAAC,CAA4B,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EACtD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,aAAa,CAAC,CACzC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;QAC1G,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-verdict.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhook-verdict.test.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-verdict.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verdict.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-verdict.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-verdict.test.js

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { webhookVerdict } from "../lib/telegram.js";
+const STAMP = 1_754_600_000;
+const clean = { url: "https://x/api/telegram/?bot=1", pendingUpdateCount: 0, lastErrorDate: 0 };
+describe("webhookVerdict", () => {
+    it("fails on an error Telegram saw at or after the registration stamp", () => {
+        expect(webhookVerdict({ ...clean, lastErrorDate: STAMP, lastErrorMessage: "Wrong response from the webhook: 404 Not Found" }, STAMP)).toEqual({ reachable: false, reason: "Wrong response from the webhook: 404 Not Found" });
+    });
+    it("passes an error dated before the stamp — it belongs to the previous URL", () => {
+        expect(webhookVerdict({ ...clean, lastErrorDate: STAMP - 1, lastErrorMessage: "Wrong response from the webhook: 404 Not Found" }, STAMP)).toEqual({ reachable: true, reason: "" });
+    });
+    it("passes a backlog with no error — pendingUpdateCount never gates", () => {
+        expect(webhookVerdict({ ...clean, pendingUpdateCount: 83 }, STAMP)).toEqual({
+            reachable: true,
+            reason: "",
+        });
+    });
+    it("passes a clean probe", () => {
+        expect(webhookVerdict(clean, STAMP)).toEqual({ reachable: true, reason: "" });
+    });
+});
+//# sourceMappingURL=webhook-verdict.test.js.map

package/payload/platform/plugins/telegram/mcp/dist/__tests__/webhook-verdict.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verdict.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-verdict.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,KAAK,GAAG,aAAa,CAAC;AAE5B,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AAEhG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CACJ,cAAc,CACZ,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,gDAAgD,EAAE,EACtG,KAAK,CACN,CACF,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CACJ,cAAc,CACZ,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,GAAG,CAAC,EAAE,gBAAgB,EAAE,gDAAgD,EAAE,EAC1G,KAAK,CACN,CACF,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1E,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}