@rubytech/create-maxy-code 0.1.581 → 0.1.583

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.d.ts

@@ -1,3 +1,4 @@
+import { type TelegramBotEntryWrite } from "../../../../../lib/telegram-managed-bot/dist/index.js";
 /** The single canonical maxy Telegram webhook path. Duplicated (intentionally)
  *  with platform/ui/server/public-host-gate.ts PUBLIC_ALLOWED_PREFIXES — a unit
  *  test asserts they agree. The official plugin's /channels/telegram is NOT this. */
@@ -16,28 +17,22 @@ export declare function admitsWebhookPath(webhookPath: string): boolean;
  *  configDirName and the secret path duplicates; telegram-account-write.test.ts
  *  asserts the two derivations agree. */
 export declare function botIdFromToken(token: string): string | null;
-export type TelegramBotEntryInput = {
-    id: string;
-    token: string;
-    role: "admin";
-    adminUsers?: number[];
+/** Task 2618 — one declaration, in the shared lib, which the UI webhook route
+ *  writes through too. The twin in `platform/ui/app/lib/telegram/bot-registry.ts`
+ *  is the READER's shape; this is the writer's. */
+export type TelegramBotEntryInput = TelegramBotEntryWrite;
+/** The account's own configuration directory inside this brand install. */
+export declare function resolveAccountDir(platformRoot: string, accountId: string): {
+    ok: true;
+    dir: string;
 } | {
-    id: string;
-    token: string;
-    role: "public";
-    agent: string;
-    dmPolicy?: "open" | "allowlist" | "disabled";
-    allowFrom?: number[];
+    ok: false;
+    error: string;
 };
-/** The account's own directory inside this brand install, or a refusal.
- *
- *  The containment assertion is the point and is why this is exported rather
- *  than inlined twice: a traversal in `accountId` (e.g. "../../.claude") must
- *  never let account state land outside ~/.<brand>/. `relative` is
- *  separator-aware; a non-brand path yields a result that escapes ("..") or is
- *  absolute. Task 2588 gave this a second caller (the card store), and
- *  duplicating a security check is how the two drift. */
-export declare function resolveAccountDir(platformRoot: string, accountId: string): {
+/** Task 2625 — the account's Telegram message store. A SIBLING of the accounts
+ *  directory, not a child of it: `ui/app/lib/telegram/message-store.ts` writes to
+ *  <brand>/data/telegram-messages/<accountId>/. */
+export declare function resolveTelegramStoreDir(platformRoot: string, accountId: string): {
     ok: true;
     dir: string;
 } | {

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-write.d.ts","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAGA;;qFAEqF;AACrF,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;;;qEAOqE;AACrE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;yCAGyC;AACzC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK3D;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACnE;IACE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEN;;;;;;;yDAOyD;AACzD,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAO1D;AAED;;;;;;;;;iDASiD;AACjD,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,qBAAqB,GAC3B;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAgC/C"}
+{"version":3,"file":"account-write.d.ts","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,uDAAuD,CAAC;AAE/D;;qFAEqF;AACrF,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;;;qEAOqE;AACrE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;yCAGyC;AACzC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK3D;AAED;;mDAEmD;AACnD,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAuB1D,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAE1D;AAED;;mDAEmD;AACnD,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAE1D;AAED;;;;;;;;;iDASiD;AACjD,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,qBAAqB,GAC3B;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmB/C"}

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.js

@@ -1,5 +1,5 @@
 import { resolve, join, relative, isAbsolute } from "node:path";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { writeTelegramBotEntry, } from "../../../../../lib/telegram-managed-bot/dist/index.js";
 /** The single canonical maxy Telegram webhook path. Duplicated (intentionally)
  *  with platform/ui/server/public-host-gate.ts PUBLIC_ALLOWED_PREFIXES — a unit
  *  test asserts they agree. The official plugin's /channels/telegram is NOT this. */
@@ -26,23 +26,34 @@ export function botIdFromToken(token) {
     const id = token.slice(0, i);
     return /^\d+$/.test(id) ? id : null;
 }
-/** The account's own directory inside this brand install, or a refusal.
+/** A directory under this brand install, or a refusal.
  *
- *  The containment assertion is the point and is why this is exported rather
- *  than inlined twice: a traversal in `accountId` (e.g. "../../.claude") must
- *  never let account state land outside ~/.<brand>/. `relative` is
- *  separator-aware; a non-brand path yields a result that escapes ("..") or is
- *  absolute. Task 2588 gave this a second caller (the card store), and
- *  duplicating a security check is how the two drift. */
-export function resolveAccountDir(platformRoot, accountId) {
-    const dir = join(resolve(platformRoot, "..", "data", "accounts"), accountId);
+ *  The containment assertion is the point and is why it lives in ONE function: a
+ *  traversal in `accountId` (e.g. "../../.claude") must never let account state
+ *  land outside ~/.<brand>/. `relative` is separator-aware; a non-brand path
+ *  yields a result that escapes ("..") or is absolute. Task 2588 gave this a
+ *  second caller (the card store) and Task 2625 a third (the Telegram message
+ *  store), and duplicating a security check is how the copies drift — so the two
+ *  exported resolvers below differ only in which directory they name. */
+function containedDir(platformRoot, ...segments) {
     const brandRoot = resolve(platformRoot, "..");
+    const dir = join(brandRoot, ...segments);
     const rel = relative(brandRoot, resolve(dir));
     const underBrand = rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
     if (!underBrand)
         return { ok: false, error: "non-brand-path" };
     return { ok: true, dir };
 }
+/** The account's own configuration directory inside this brand install. */
+export function resolveAccountDir(platformRoot, accountId) {
+    return containedDir(platformRoot, "data", "accounts", accountId);
+}
+/** Task 2625 — the account's Telegram message store. A SIBLING of the accounts
+ *  directory, not a child of it: `ui/app/lib/telegram/message-store.ts` writes to
+ *  <brand>/data/telegram-messages/<accountId>/. */
+export function resolveTelegramStoreDir(platformRoot, accountId) {
+    return containedDir(platformRoot, "data", "telegram-messages", accountId);
+}
 /** Persist one bot entry into account.json's `telegram.bots` array, replacing
  *  any entry with the same id and leaving every other entry byte-identical.
  *
@@ -66,27 +77,11 @@ export function persistTelegramBot(platformRoot, accountId, entry) {
         };
     }
     const dir = resolved.dir;
-    const configPath = join(dir, "account.json");
-    if (!existsSync(configPath)) {
-        return { ok: false, error: `account.json not found at ${configPath}` };
-    }
-    let config;
-    try {
-        config = JSON.parse(readFileSync(configPath, "utf-8"));
-    }
-    catch (e) {
-        return { ok: false, error: `account.json parse failed: ${e.message}` };
-    }
-    const telegram = config.telegram ?? {};
-    const bots = Array.isArray(telegram.bots) ? telegram.bots : [];
-    const at = bots.findIndex((b) => b && typeof b === "object" && b.id === entry.id);
-    if (at >= 0)
-        bots[at] = entry;
-    else
-        bots.push(entry);
-    telegram.bots = bots;
-    config.telegram = telegram;
-    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-    return { ok: true, dir };
+    // Task 2618 — the array merge itself moved to the shared lib, which the UI
+    // webhook route also calls when it persists a newly provisioned bot. This
+    // function keeps the part that is genuinely its own: the containment assertion
+    // above, which exists because `accountId` reaches it from a tool parameter.
+    const written = writeTelegramBotEntry(dir, entry);
+    return written.ok ? { ok: true, dir } : { ok: false, error: written.error, dir };
 }
 //# sourceMappingURL=account-write.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-write.js","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAElE;;qFAEqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;;;qEAOqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,KAAK,yBAAyB,CAAC;AACnD,CAAC;AAED;;;yCAGyC;AACzC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAaD;;;;;;;yDAOyD;AACzD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;iDASiD;AACjD,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAiB,EACjB,KAA4B;IAE5B,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC;SACtE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,UAAU,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAoC,IAAI,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"account-write.js","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,qBAAqB,GAEtB,MAAM,uDAAuD,CAAC;AAE/D;;qFAEqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;;;qEAOqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,KAAK,yBAAyB,CAAC;AACnD,CAAC;AAED;;;yCAGyC;AACzC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAOD;;;;;;;;yEAQyE;AACzE,SAAS,YAAY,CACnB,YAAoB,EACpB,GAAG,QAAkB;IAErB,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,SAAiB;IAEjB,OAAO,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,uBAAuB,CACrC,YAAoB,EACpB,SAAiB;IAEjB,OAAO,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;iDASiD;AACjD,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAiB,EACjB,KAA4B;IAE5B,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC;SACtE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;AACnF,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.d.ts

@@ -9,4 +9,17 @@ export declare function accountDirFor(platformRoot: string, accountId: string):
  *  rejects a nonexistent slug. telegram-agent-active.test.ts asserts the two
  *  agree. A bot may only be paired to an agent that can actually answer. */
 export declare function isActiveAgentSlug(accountDir: string, slug: string): boolean;
+/** Task 2619 — every specialist card's FILE BASENAME on this account, without
+ *  `.md`, sorted.
+ *
+ *  Duplicated from platform/ui/app/lib/claude-agent/specialist-roster.ts
+ *  `listSpecialistCardNames`, the same plugin/platform boundary `isActiveAgentSlug`
+ *  and `botIdFromToken` are duplicated across; telegram-account-write.test.ts
+ *  asserts the two agree.
+ *
+ *  The basename, not the frontmatter `name`: `--agent <value>` resolves
+ *  `<accountDir>/.claude/agents/<value>.md`, a mirror the session manager builds
+ *  by basename, so a bot may only be bound to a name that can actually be
+ *  spawned. */
+export declare function listSpecialistCardNames(accountDir: string): string[];
 //# sourceMappingURL=agent-active.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-active.d.ts","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;4EAO4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ3E"}
+{"version":3,"file":"agent-active.d.ts","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;4EAO4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ3E;AAED;;;;;;;;;;;eAWe;AACf,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAOpE"}

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.js

@@ -1,5 +1,5 @@
 import { resolve, join } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 /** The account's own directory under the brand install. */
 export function accountDirFor(platformRoot, accountId) {
     return join(resolve(platformRoot, "..", "data", "accounts"), accountId);
@@ -23,4 +23,25 @@ export function isActiveAgentSlug(accountDir, slug) {
         return false;
     }
 }
+/** Task 2619 — every specialist card's FILE BASENAME on this account, without
+ *  `.md`, sorted.
+ *
+ *  Duplicated from platform/ui/app/lib/claude-agent/specialist-roster.ts
+ *  `listSpecialistCardNames`, the same plugin/platform boundary `isActiveAgentSlug`
+ *  and `botIdFromToken` are duplicated across; telegram-account-write.test.ts
+ *  asserts the two agree.
+ *
+ *  The basename, not the frontmatter `name`: `--agent <value>` resolves
+ *  `<accountDir>/.claude/agents/<value>.md`, a mirror the session manager builds
+ *  by basename, so a bot may only be bound to a name that can actually be
+ *  spawned. */
+export function listSpecialistCardNames(accountDir) {
+    const dir = join(accountDir, "specialists", "agents");
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => f.endsWith(".md"))
+        .map((f) => f.slice(0, -3))
+        .sort();
+}
 //# sourceMappingURL=agent-active.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-active.js","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC,MAAM,KAAK,QAAQ,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-active.js","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC,MAAM,KAAK,QAAQ,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;eAWe;AACf,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-census.d.ts","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAClD,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAe1F;AAED;;;;;;;;;;8BAU8B;AAC9B,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzD;AAED;;0EAE0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAO3F;AAED;;;;;;;;;;;oEAWoE;AACpE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYzD,CAAC;AAQH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC,CAWA;AAED;;yBAEyB;AACzB,eAAO,MAAM,kBAAkB,UAAY,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAgCxE"}
+{"version":3,"file":"api-census.d.ts","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAClD,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAe1F;AAED;;;;;;;;;;8BAU8B;AAC9B,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzD;AAED;;0EAE0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAO3F;AAED;;;;;;;;;;;oEAWoE;AACpE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBzD,CAAC;AAQH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC,CAWA;AAED;;yBAEyB;AACzB,eAAO,MAAM,kBAAkB,UAAY,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAgCxE"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.js

@@ -7,6 +7,7 @@ import { THREAD_METHOD } from "../tools/thread.js";
 import { ASK_METHOD } from "../tools/ask.js";
 import { MEDIA_SEND_METHOD } from "../tools/media-send.js";
 import { INVOICE_METHOD } from "../tools/invoice.js";
+import { MANAGED_BOT_METHODS } from "../../../../../lib/telegram-managed-bot/dist/index.js";
 export const CENSUS_TAG = "[telegram-api-census]";
 export const TOOLS_TAG = "[telegram-tools]";
 /** The local half, emitted once at MCP boot. No network, so every session pays
@@ -85,6 +86,11 @@ export const OWNED_METHODS = Object.freeze({
     ...Object.fromEntries(Object.values(ASK_METHOD).map((m) => [m, "telegram-ask"])),
     ...Object.fromEntries(Object.values(MEDIA_SEND_METHOD).map((m) => [m, "telegram-media-send"])),
     ...Object.fromEntries(Object.values(INVOICE_METHOD).map((m) => [m, "telegram-invoice"])),
+    // Task 2618 — all four, including the two `api-guard` also refuses. A refused
+    // method emits no `op=call` line so it can never be tallied, but leaving it out
+    // here would make the map disagree with the tool about what the tool covers,
+    // which is the drift this map exists to prevent.
+    ...Object.fromEntries(Object.values(MANAGED_BOT_METHODS).map((m) => [m, "telegram-bot-provision"])),
 });
 /** Only `telegram-api`'s own op=call line. The typed tools emit
  *  `[telegram-tools] op=call`, which must NOT be counted: this census answers

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-census.js","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAA6B;IAChF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;YACzB,SAAS,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAC/D,CAAC,MAAM,CAAC;QACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,GAAG,UAAU,YAAY,eAAe,CAAC,MAAM,YAAY,aAAa,SAAS,IAAI,cAAc,SAAS,EAAE,CAAC;AACxH,CAAC;AAED;;;;;;;;;;8BAU8B;AAC9B,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC3E,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,eAAe;IACvC,mBAAmB,EAAE,eAAe;IACpC,OAAO,EAAE,sBAAsB;IAC/B,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;IAChF,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CACxE;IACD,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACzF,CAAC,CAAC;AAEH;;;oCAGoC;AACpC,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IAItD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;yBAEyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,kBAAkB;wBAAE,SAAS;oBACvD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;oBAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,SAAS,oBAAoB,UAAU,gBAAgB,SAAS,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"api-census.js","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAA6B;IAChF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;YACzB,SAAS,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAC/D,CAAC,MAAM,CAAC;QACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,GAAG,UAAU,YAAY,eAAe,CAAC,MAAM,YAAY,aAAa,SAAS,IAAI,cAAc,SAAS,EAAE,CAAC;AACxH,CAAC;AAED;;;;;;;;;;8BAU8B;AAC9B,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC3E,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,eAAe;IACvC,mBAAmB,EAAE,eAAe;IACpC,OAAO,EAAE,sBAAsB;IAC/B,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;IAChF,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CACxE;IACD,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxF,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,iDAAiD;IACjD,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAC7E;CACF,CAAC,CAAC;AAEH;;;oCAGoC;AACpC,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IAItD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;yBAEyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,kBAAkB;wBAAE,SAAS;oBACvD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;oBAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,SAAS,oBAAoB,UAAU,gBAAgB,SAAS,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC;AACvG,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.d.ts

@@ -1,4 +1,4 @@
-export type RefusalReason = "owned-by-webhook-register" | "mutually-exclusive-with-webhook" | "moves-bot-off-cloud";
+export type RefusalReason = "owned-by-webhook-register" | "mutually-exclusive-with-webhook" | "moves-bot-off-cloud" | "returns-a-credential";
 export type MethodVerdict = {
     allowed: true;
     listed: boolean;

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-guard.d.ts","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GACrB,2BAA2B,GAC3B,iCAAiC,GACjC,qBAAqB,CAAC;AAyB1B,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;4BAI4B;AAC5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAIvD;AAED,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAA+B,CAAC"}
+{"version":3,"file":"api-guard.d.ts","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GACrB,2BAA2B,GAC3B,iCAAiC,GACjC,qBAAqB,GACrB,sBAAsB,CAAC;AA4C3B,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;4BAI4B;AAC5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAIvD;AAED,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAA+B,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.js

@@ -1,5 +1,6 @@
 import { BOT_API_METHODS } from "./api-methods.js";
-/** The five methods `telegram-api` will not relay, each with the reason and the
+import { MANAGED_BOT_METHODS } from "../../../../../lib/telegram-managed-bot/dist/index.js";
+/** The seven methods `telegram-api` will not relay, each with the reason and the
  *  surface that owns the capability instead.
  *
  *  Webhook state belongs to `telegram-webhook-register`, which enforces the
@@ -10,13 +11,32 @@ import { BOT_API_METHODS } from "./api-methods.js";
  *  getUpdates is, in Telegram's words, one of "two mutually exclusive ways of
  *  receiving updates", and it "will not work if an outgoing webhook is set up".
  *
- *  logOut and close both move the bot off the cloud Bot API server. */
+ *  logOut and close both move the bot off the cloud Bot API server.
+ *
+ *  Task 2618 — getManagedBotToken and replaceManagedBotToken both RETURN A LIVE
+ *  BOT TOKEN as their result. A passthrough relay hands that straight back as a
+ *  tool result, which puts it in the transcript, and nothing downstream would
+ *  notice. `telegram-bot-provision` fetches the same tokens, persists them to
+ *  account.json and returns only the bot id. Listing them in OWNED_METHODS is
+ *  not a substitute: that governs the census bucket, not whether the call runs.
+ *
+ *  The two access-settings methods are deliberately NOT here. They return no
+ *  credential, so refusing them would remove a capability while protecting
+ *  nothing. */
 const REFUSALS = Object.freeze({
     setWebhook: { reason: "owned-by-webhook-register", owner: "telegram-webhook-register" },
     deleteWebhook: { reason: "owned-by-webhook-register", owner: "telegram-webhook-register" },
     getUpdates: { reason: "mutually-exclusive-with-webhook", owner: "telegram-webhook-register" },
     logOut: { reason: "moves-bot-off-cloud", owner: "the cloud Bot API server" },
     close: { reason: "moves-bot-off-cloud", owner: "the cloud Bot API server" },
+    [MANAGED_BOT_METHODS.token]: {
+        reason: "returns-a-credential",
+        owner: "telegram-bot-provision",
+    },
+    [MANAGED_BOT_METHODS.rotate]: {
+        reason: "returns-a-credential",
+        owner: "telegram-bot-provision",
+    },
 });
 const LISTED = new Set(BOT_API_METHODS);
 /** An unlisted method is ALLOWED, not refused. `BOT_API_METHODS` is a snapshot

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-guard.js","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAOnD;;;;;;;;;;;uEAWuE;AACvE,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACvF,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC1F,UAAU,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC7F,MAAM,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC5E,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;CAC5E,CAAC,CAAC;AAEL,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAMxC;;;;4BAI4B;AAC5B,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC"}
+{"version":3,"file":"api-guard.js","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAQ5F;;;;;;;;;;;;;;;;;;;;;;eAsBe;AACf,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACvF,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC1F,UAAU,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC7F,MAAM,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC5E,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC3E,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;QAC3B,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,wBAAwB;KAChC;IACD,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE;QAC5B,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,wBAAwB;KAChC;CACF,CAAC,CAAC;AAEL,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAMxC;;;;4BAI4B;AAC5B,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/business-connection-store.d.ts

@@ -0,0 +1,38 @@
+/** Task 2611 — the read side of the business connection record.
+ *
+ *  The platform writes it (`platform/ui/app/lib/telegram/business-connection.ts`)
+ *  when Telegram announces the connection on a `business_connection` update; this
+ *  reads it back so `telegram-ask kind=checklist` can send without the caller
+ *  naming an identifier they have no way to obtain. The shape, the file name and
+ *  the disabled rule are duplicated across the boundary on purpose — the plugin
+ *  cannot import from `platform/ui/app`, the same boundary that already duplicates
+ *  the webhook secret path, the card store and the live-location store — and
+ *  `ui/app/lib/telegram/__tests__/business-connection-boundary.test.ts` asserts the
+ *  two derivations agree.
+ *
+ *  Runtime state, so its own file beside `telegram-cards.json` rather than a key in
+ *  `account.json`, which holds configuration. Same brand containment: the path
+ *  resolves through `resolveAccountDir`, so a traversal in the account id reads as
+ *  no connection rather than reaching outside the install.
+ */
+export declare const BUSINESS_CONNECTION_FILE = "telegram-business-connection.json";
+export interface BusinessConnectionRecord {
+    /** The identifier `sendChecklist` cannot go without. */
+    id: string;
+    userId: number | null;
+    userChatId: number | null;
+    /** Telegram's clock: the Unix second the connection was established. */
+    date: number | null;
+    isEnabled: boolean;
+    /** Stored verbatim by the writer. */
+    rights: Record<string, unknown> | null;
+    /** Our clock: the millisecond the record was written. */
+    at: number;
+}
+/** The connection this bot can currently send on behalf of, or null.
+ *
+ *  A record with `isEnabled:false` reads as absent. The writer keeps it on disk so
+ *  the audit can see the revocation; returning it here would let the tool spend a
+ *  handle Telegram has already withdrawn. */
+export declare function readBusinessConnection(platformRoot: string, accountId: string, botId: string): BusinessConnectionRecord | null;
+//# sourceMappingURL=business-connection-store.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/business-connection-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-connection-store.d.ts","sourceRoot":"","sources":["../../src/lib/business-connection-store.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAE5E,MAAM,WAAW,wBAAwB;IACvC,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wEAAwE;IACxE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;CACZ;AAQD;;;;6CAI6C;AAC7C,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,wBAAwB,GAAG,IAAI,CAiBjC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/business-connection-store.js

@@ -0,0 +1,56 @@
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { resolveAccountDir } from "./account-write.js";
+/** Task 2611 — the read side of the business connection record.
+ *
+ *  The platform writes it (`platform/ui/app/lib/telegram/business-connection.ts`)
+ *  when Telegram announces the connection on a `business_connection` update; this
+ *  reads it back so `telegram-ask kind=checklist` can send without the caller
+ *  naming an identifier they have no way to obtain. The shape, the file name and
+ *  the disabled rule are duplicated across the boundary on purpose — the plugin
+ *  cannot import from `platform/ui/app`, the same boundary that already duplicates
+ *  the webhook secret path, the card store and the live-location store — and
+ *  `ui/app/lib/telegram/__tests__/business-connection-boundary.test.ts` asserts the
+ *  two derivations agree.
+ *
+ *  Runtime state, so its own file beside `telegram-cards.json` rather than a key in
+ *  `account.json`, which holds configuration. Same brand containment: the path
+ *  resolves through `resolveAccountDir`, so a traversal in the account id reads as
+ *  no connection rather than reaching outside the install.
+ */
+export const BUSINESS_CONNECTION_FILE = "telegram-business-connection.json";
+function isRecord(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const r = v;
+    return typeof r.id === "string" && r.id.length > 0 && typeof r.isEnabled === "boolean";
+}
+/** The connection this bot can currently send on behalf of, or null.
+ *
+ *  A record with `isEnabled:false` reads as absent. The writer keeps it on disk so
+ *  the audit can see the revocation; returning it here would let the tool spend a
+ *  handle Telegram has already withdrawn. */
+export function readBusinessConnection(platformRoot, accountId, botId) {
+    const resolved = resolveAccountDir(platformRoot, accountId);
+    if (!resolved.ok)
+        return null;
+    const path = join(resolved.dir, BUSINESS_CONNECTION_FILE);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const rec = parsed[botId];
+        if (!isRecord(rec) || !rec.isEnabled)
+            return null;
+        return rec;
+    }
+    catch {
+        // Unparseable state reads as "no connection stored", so the tool refuses by
+        // name. Throwing here would take the tool down over a file the caller never
+        // sees.
+        return null;
+    }
+}
+//# sourceMappingURL=business-connection-store.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/business-connection-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-connection-store.js","sourceRoot":"","sources":["../../src/lib/business-connection-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mCAAmC,CAAC;AAgB5E,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;AACzF,CAAC;AAED;;;;6CAI6C;AAC7C,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,KAAa;IAEb,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,GAAG,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,4EAA4E;QAC5E,QAAQ;QACR,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/business-window-store.d.ts

@@ -0,0 +1,55 @@
+/** Task 2615 — the read side of Telegram's 24-hour business reply window.
+ *
+ *  `BusinessBotRights.can_reply` grants the right to "send and edit messages in
+ *  the private chats that had incoming messages in the last 24 hours". Outside
+ *  that window Telegram refuses the send, and nothing is emitted when the window
+ *  closes, so a customer simply becomes unanswerable with no event anywhere.
+ *  Deciding before the call is what turns that silence into a refusal the agent
+ *  can act on.
+ *
+ *  The platform writes the conversation (`platform/ui/app/lib/telegram/
+ *  message-store.ts`); this reads it back. The window constant, the row shape and
+ *  the path derivation are duplicated across the boundary on purpose — the plugin
+ *  cannot import from `platform/ui/app`, the same boundary that already
+ *  duplicates the webhook secret path, the card store, the live-location store
+ *  and the business connection — and
+ *  `ui/app/lib/telegram/__tests__/business-window-boundary.test.ts` asserts the
+ *  two derivations agree.
+ *
+ *  TWO ROOTS, and they are not the same one. The connection record sits in the
+ *  ACCOUNT dir (`data/accounts/<accountId>`); the conversation store is its
+ *  SIBLING, `data/telegram-messages/<accountId>`. `resolveAccountDir` is still
+ *  the containment authority: its refusal is what stops a traversal in the
+ *  account id from reaching outside the install.
+ */
+/** Telegram's window, in seconds. Restated rather than imported, for the reason
+ *  the header gives; the boundary test is what keeps it equal to the platform's
+ *  `BUSINESS_REPLY_WINDOW_S`. */
+export declare const BUSINESS_REPLY_WINDOW_S = 86400;
+/** The business conversation's key. Mirrors `telegramBusinessChannelKey`. */
+export declare function businessChannelKey(botId: string, chatId: string | number): string;
+/** The newest Telegram-clock second among INBOUND rows in one business chat, or
+ *  null when the chat holds none carrying that field.
+ *
+ *  Inbound only: the window runs from what the CUSTOMER last sent, and counting
+ *  an agent reply would extend it on every send so the refusal could never fire.
+ *
+ *  Null rather than 0 for "nothing to measure from". Zero is a real Unix second
+ *  and would read as 1970, refusing every reply in a conversation whose rows
+ *  predate the field. */
+export declare function newestInboundTelegramDate(platformRoot: string, accountId: string, channelKey: string): number | null;
+export interface BusinessWindowVerdict {
+    allowed: boolean;
+    ageS: number | null;
+    reason: "ok" | "no-inbound" | "lapsed";
+}
+export declare function businessWindowVerdict(input: {
+    newestInboundDate: number | null;
+    nowMs: number;
+}): BusinessWindowVerdict;
+/** The refusal the agent reads. It names the WINDOW and the chat, never a
+ *  parameter: there is no argument the caller could add to make this send work,
+ *  which is the shape Task 2611 gave `ask.ts` for a checklist with no
+ *  connection. */
+export declare function businessWindowRefusal(chatId: number | string, ageS: number | null): string;
+//# sourceMappingURL=business-window-store.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/business-window-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-window-store.d.ts","sourceRoot":"","sources":["../../src/lib/business-window-store.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;iCAEiC;AACjC,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjF;AAmBD;;;;;;;;yBAQyB;AACzB,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CA0Bf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,IAAI,GAAG,YAAY,GAAG,QAAQ,CAAC;CACxC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,qBAAqB,CAQxB;AAED;;;kBAGkB;AAClB,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAc1F"}