@rubytech/create-maxy-code 0.1.582 → 0.1.584

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.js

@@ -1,5 +1,6 @@
 import { resolve, join, relative, isAbsolute } from "node:path";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { writeTelegramBotEntry, } from "../../../../../lib/telegram-managed-bot/dist/index.js";
+import { telegramStoreRoot } from "../../../../../lib/telegram-reach/dist/index.js";
 /** The single canonical maxy Telegram webhook path. Duplicated (intentionally)
  *  with platform/ui/server/public-host-gate.ts PUBLIC_ALLOWED_PREFIXES — a unit
  *  test asserts they agree. The official plugin's /channels/telegram is NOT this. */
@@ -26,23 +27,46 @@ export function botIdFromToken(token) {
     const id = token.slice(0, i);
     return /^\d+$/.test(id) ? id : null;
 }
-/** The account's own directory inside this brand install, or a refusal.
+/** A directory under `root`, or a refusal.
  *
- *  The containment assertion is the point and is why this is exported rather
- *  than inlined twice: a traversal in `accountId` (e.g. "../../.claude") must
- *  never let account state land outside ~/.<brand>/. `relative` is
- *  separator-aware; a non-brand path yields a result that escapes ("..") or is
- *  absolute. Task 2588 gave this a second caller (the card store), and
- *  duplicating a security check is how the two drift. */
-export function resolveAccountDir(platformRoot, accountId) {
-    const dir = join(resolve(platformRoot, "..", "data", "accounts"), accountId);
-    const brandRoot = resolve(platformRoot, "..");
-    const rel = relative(brandRoot, resolve(dir));
-    const underBrand = rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-    if (!underBrand)
+ *  The containment assertion is the point and is why it lives in ONE function: a
+ *  traversal in `accountId` (e.g. "../../.claude") must never let account state
+ *  land outside the directory it names. `relative` is separator-aware; a path
+ *  outside `root` yields a result that escapes ("..") or is absolute.
+ *
+ *  Task 2644 — the root is a parameter because the two exported resolvers below
+ *  no longer share one. Accounts live under the brand INSTALL dir; the Telegram
+ *  message store lives under the brand CONFIG dir. */
+function containedUnder(root, ...segments) {
+    const dir = join(root, ...segments);
+    const rel = relative(root, resolve(dir));
+    const under = rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+    if (!under)
         return { ok: false, error: "non-brand-path" };
     return { ok: true, dir };
 }
+/** A directory under this brand install, or a refusal. Task 2588 gave this a
+ *  second caller (the card store). */
+function containedDir(platformRoot, ...segments) {
+    return containedUnder(resolve(platformRoot, ".."), ...segments);
+}
+/** The account's own configuration directory inside this brand install. */
+export function resolveAccountDir(platformRoot, accountId) {
+    return containedDir(platformRoot, "data", "accounts", accountId);
+}
+/** Task 2625 — the account's Telegram message store.
+ *
+ *  NOT a sibling of the accounts directory. Accounts live under the brand
+ *  INSTALL dir; this store lives under the brand CONFIG dir,
+ *  `~/.<brand>/data/telegram-messages/<accountId>/`. Task 2644 — reading it as a
+ *  sibling resolved a directory nothing writes, so the walk found no rows and
+ *  `telegram-reach` reported every chat unreachable, including the sender of the
+ *  message it was answering. The derivation is `telegramStoreRoot`, shared with
+ *  `ui/app/lib/telegram/message-store.ts`, so the writer and this reader cannot
+ *  name different directories again. */
+export function resolveTelegramStoreDir(platformRoot, accountId) {
+    return containedUnder(telegramStoreRoot(platformRoot), accountId);
+}
 /** Persist one bot entry into account.json's `telegram.bots` array, replacing
  *  any entry with the same id and leaving every other entry byte-identical.
  *
@@ -66,27 +90,11 @@ export function persistTelegramBot(platformRoot, accountId, entry) {
         };
     }
     const dir = resolved.dir;
-    const configPath = join(dir, "account.json");
-    if (!existsSync(configPath)) {
-        return { ok: false, error: `account.json not found at ${configPath}` };
-    }
-    let config;
-    try {
-        config = JSON.parse(readFileSync(configPath, "utf-8"));
-    }
-    catch (e) {
-        return { ok: false, error: `account.json parse failed: ${e.message}` };
-    }
-    const telegram = config.telegram ?? {};
-    const bots = Array.isArray(telegram.bots) ? telegram.bots : [];
-    const at = bots.findIndex((b) => b && typeof b === "object" && b.id === entry.id);
-    if (at >= 0)
-        bots[at] = entry;
-    else
-        bots.push(entry);
-    telegram.bots = bots;
-    config.telegram = telegram;
-    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-    return { ok: true, dir };
+    // Task 2618 — the array merge itself moved to the shared lib, which the UI
+    // webhook route also calls when it persists a newly provisioned bot. This
+    // function keeps the part that is genuinely its own: the containment assertion
+    // above, which exists because `accountId` reaches it from a tool parameter.
+    const written = writeTelegramBotEntry(dir, entry);
+    return written.ok ? { ok: true, dir } : { ok: false, error: written.error, dir };
 }
 //# sourceMappingURL=account-write.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-write.js","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAElE;;qFAEqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;;;qEAOqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,KAAK,yBAAyB,CAAC;AACnD,CAAC;AAED;;;yCAGyC;AACzC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAaD;;;;;;;yDAOyD;AACzD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;iDASiD;AACjD,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAiB,EACjB,KAA4B;IAE5B,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC;SACtE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,UAAU,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAoC,IAAI,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"account-write.js","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,qBAAqB,GAEtB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAEpF;;qFAEqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;;;qEAOqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,KAAK,yBAAyB,CAAC;AACnD,CAAC;AAED;;;yCAGyC;AACzC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAOD;;;;;;;;;sDASsD;AACtD,SAAS,cAAc,CACrB,IAAY,EACZ,GAAG,QAAkB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;sCACsC;AACtC,SAAS,YAAY,CACnB,YAAoB,EACpB,GAAG,QAAkB;IAErB,OAAO,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,SAAiB;IAEjB,OAAO,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;wCASwC;AACxC,MAAM,UAAU,uBAAuB,CACrC,YAAoB,EACpB,SAAiB;IAEjB,OAAO,cAAc,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;iDASiD;AACjD,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAiB,EACjB,KAA4B;IAE5B,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC;SACtE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;AACnF,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.d.ts

@@ -9,4 +9,17 @@ export declare function accountDirFor(platformRoot: string, accountId: string):
  *  rejects a nonexistent slug. telegram-agent-active.test.ts asserts the two
  *  agree. A bot may only be paired to an agent that can actually answer. */
 export declare function isActiveAgentSlug(accountDir: string, slug: string): boolean;
+/** Task 2619 — every specialist card's FILE BASENAME on this account, without
+ *  `.md`, sorted.
+ *
+ *  Duplicated from platform/ui/app/lib/claude-agent/specialist-roster.ts
+ *  `listSpecialistCardNames`, the same plugin/platform boundary `isActiveAgentSlug`
+ *  and `botIdFromToken` are duplicated across; telegram-account-write.test.ts
+ *  asserts the two agree.
+ *
+ *  The basename, not the frontmatter `name`: `--agent <value>` resolves
+ *  `<accountDir>/.claude/agents/<value>.md`, a mirror the session manager builds
+ *  by basename, so a bot may only be bound to a name that can actually be
+ *  spawned. */
+export declare function listSpecialistCardNames(accountDir: string): string[];
 //# sourceMappingURL=agent-active.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-active.d.ts","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;4EAO4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ3E"}
+{"version":3,"file":"agent-active.d.ts","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;4EAO4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ3E;AAED;;;;;;;;;;;eAWe;AACf,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAOpE"}

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.js

@@ -1,5 +1,5 @@
 import { resolve, join } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 /** The account's own directory under the brand install. */
 export function accountDirFor(platformRoot, accountId) {
     return join(resolve(platformRoot, "..", "data", "accounts"), accountId);
@@ -23,4 +23,25 @@ export function isActiveAgentSlug(accountDir, slug) {
         return false;
     }
 }
+/** Task 2619 — every specialist card's FILE BASENAME on this account, without
+ *  `.md`, sorted.
+ *
+ *  Duplicated from platform/ui/app/lib/claude-agent/specialist-roster.ts
+ *  `listSpecialistCardNames`, the same plugin/platform boundary `isActiveAgentSlug`
+ *  and `botIdFromToken` are duplicated across; telegram-account-write.test.ts
+ *  asserts the two agree.
+ *
+ *  The basename, not the frontmatter `name`: `--agent <value>` resolves
+ *  `<accountDir>/.claude/agents/<value>.md`, a mirror the session manager builds
+ *  by basename, so a bot may only be bound to a name that can actually be
+ *  spawned. */
+export function listSpecialistCardNames(accountDir) {
+    const dir = join(accountDir, "specialists", "agents");
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => f.endsWith(".md"))
+        .map((f) => f.slice(0, -3))
+        .sort();
+}
 //# sourceMappingURL=agent-active.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-active.js","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC,MAAM,KAAK,QAAQ,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-active.js","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC,MAAM,KAAK,QAAQ,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;eAWe;AACf,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.d.ts

@@ -25,7 +25,17 @@ export declare function bootCensusLine(platformRoot: string, accountId: string |
 export declare function extractMethodNames(html: string): string[];
 /** `missing` are methods this plugin ships that the live page no longer
  *  documents; `added` are methods the page documents that this plugin has never
- *  heard of. Both are sorted, so a diff of two census lines is stable. */
+ *  heard of. Both are sorted, so a diff of two census lines is stable.
+ *
+ *  Task 2636 — the eight payment methods are excluded from `added`. The live
+ *  page still documents all eight and always will; without this they would be
+ *  reported as new Telegram additions on every run, for ever.
+ *
+ *  This is an exclusion of eight NAMES, not of Telegram's Payments section: the
+ *  scraper reads a flat list of `<h4>` headings and never parses sections. So if
+ *  Telegram documents a NINTH payments method it will still surface in `added`.
+ *  That is intended — a method we have never seen is a new decision, not drift
+ *  about our own removal. */
 export declare function diffMethods(live: readonly string[]): {
     missing: string[];
     added: string[];

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-census.d.ts","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAClD,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAe1F;AAED;;;;;;;;;;8BAU8B;AAC9B,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzD;AAED;;0EAE0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAO3F;AAED;;;;;;;;;;;oEAWoE;AACpE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYzD,CAAC;AAQH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC,CAWA;AAED;;yBAEyB;AACzB,eAAO,MAAM,kBAAkB,UAAY,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAgCxE"}
+{"version":3,"file":"api-census.d.ts","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAClD,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAe1F;AAED;;;;;;;;;;8BAU8B;AAC9B,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzD;AAED;;;;;;;;;;;;6BAY6B;AAC7B,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAQ3F;AAED;;;;;;;;;;;oEAWoE;AACpE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBzD,CAAC;AAQH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC,CAWA;AAED;;yBAEyB;AACzB,eAAO,MAAM,kBAAkB,UAAY,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAgCxE"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.js

@@ -1,12 +1,13 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { REFUSED_COUNT } from "./api-guard.js";
+import { PAYMENT_METHODS } from "./api-guard.js";
 import { BOT_API_METHODS } from "./api-methods.js";
 import { listRegisteredBots, resolveBotToken } from "./account-token.js";
 import { THREAD_METHOD } from "../tools/thread.js";
 import { ASK_METHOD } from "../tools/ask.js";
 import { MEDIA_SEND_METHOD } from "../tools/media-send.js";
-import { INVOICE_METHOD } from "../tools/invoice.js";
+import { MANAGED_BOT_METHODS } from "../../../../../lib/telegram-managed-bot/dist/index.js";
 export const CENSUS_TAG = "[telegram-api-census]";
 export const TOOLS_TAG = "[telegram-tools]";
 /** The local half, emitted once at MCP boot. No network, so every session pays
@@ -54,13 +55,24 @@ export function extractMethodNames(html) {
 }
 /** `missing` are methods this plugin ships that the live page no longer
  *  documents; `added` are methods the page documents that this plugin has never
- *  heard of. Both are sorted, so a diff of two census lines is stable. */
+ *  heard of. Both are sorted, so a diff of two census lines is stable.
+ *
+ *  Task 2636 — the eight payment methods are excluded from `added`. The live
+ *  page still documents all eight and always will; without this they would be
+ *  reported as new Telegram additions on every run, for ever.
+ *
+ *  This is an exclusion of eight NAMES, not of Telegram's Payments section: the
+ *  scraper reads a flat list of `<h4>` headings and never parses sections. So if
+ *  Telegram documents a NINTH payments method it will still surface in `added`.
+ *  That is intended — a method we have never seen is a new decision, not drift
+ *  about our own removal. */
 export function diffMethods(live) {
     const liveSet = new Set(live);
     const shippedSet = new Set(BOT_API_METHODS);
+    const removed = new Set(PAYMENT_METHODS);
     return {
         missing: BOT_API_METHODS.filter((m) => !liveSet.has(m)).sort(),
-        added: live.filter((m) => !shippedSet.has(m)).sort(),
+        added: live.filter((m) => !shippedSet.has(m) && !removed.has(m)).sort(),
     };
 }
 /** Bot API method to the typed tool that owns it: the three tools Task 2588
@@ -84,7 +96,15 @@ export const OWNED_METHODS = Object.freeze({
     ...Object.fromEntries(Object.values(THREAD_METHOD).map((m) => [m, "telegram-thread"])),
     ...Object.fromEntries(Object.values(ASK_METHOD).map((m) => [m, "telegram-ask"])),
     ...Object.fromEntries(Object.values(MEDIA_SEND_METHOD).map((m) => [m, "telegram-media-send"])),
-    ...Object.fromEntries(Object.values(INVOICE_METHOD).map((m) => [m, "telegram-invoice"])),
+    // Task 2636 — the eight payment methods are deliberately absent. The 2618 rule
+    // below keeps a refused method listed while a TOOL still covers it, so the map
+    // and the tool cannot disagree; no tool covers these now, so listing them would
+    // assert an owner that does not exist.
+    // Task 2618 — all four, including the two `api-guard` also refuses. A refused
+    // method emits no `op=call` line so it can never be tallied, but leaving it out
+    // here would make the map disagree with the tool about what the tool covers,
+    // which is the drift this map exists to prevent.
+    ...Object.fromEntries(Object.values(MANAGED_BOT_METHODS).map((m) => [m, "telegram-bot-provision"])),
 });
 /** Only `telegram-api`'s own op=call line. The typed tools emit
  *  `[telegram-tools] op=call`, which must NOT be counted: this census answers

package/payload/platform/plugins/telegram/mcp/dist/lib/api-census.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-census.js","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAA6B;IAChF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;YACzB,SAAS,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAC/D,CAAC,MAAM,CAAC;QACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,GAAG,UAAU,YAAY,eAAe,CAAC,MAAM,YAAY,aAAa,SAAS,IAAI,cAAc,SAAS,EAAE,CAAC;AACxH,CAAC;AAED;;;;;;;;;;8BAU8B;AAC9B,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC3E,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,eAAe;IACvC,mBAAmB,EAAE,eAAe;IACpC,OAAO,EAAE,sBAAsB;IAC/B,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;IAChF,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CACxE;IACD,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACzF,CAAC,CAAC;AAEH;;;oCAGoC;AACpC,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IAItD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;yBAEyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,kBAAkB;wBAAE,SAAS;oBACvD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;oBAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,SAAS,oBAAoB,UAAU,gBAAgB,SAAS,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"api-census.js","sourceRoot":"","sources":["../../src/lib/api-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;2EAS2E;AAC3E,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAA6B;IAChF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;YACzB,SAAS,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAC/D,CAAC,MAAM,CAAC;QACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,GAAG,UAAU,YAAY,eAAe,CAAC,MAAM,YAAY,aAAa,SAAS,IAAI,cAAc,SAAS,EAAE,CAAC;AACxH,CAAC;AAED;;;;;;;;;;8BAU8B;AAC9B,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;6BAY6B;AAC7B,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO;QACL,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC3E,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,eAAe;IACvC,mBAAmB,EAAE,eAAe;IACpC,OAAO,EAAE,sBAAsB;IAC/B,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;IAChF,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CACxE;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,uCAAuC;IACvC,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,iDAAiD;IACjD,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAC7E;CACF,CAAC,CAAC;AAEH;;;oCAGoC;AACpC,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IAItD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;yBAEyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;gEAcgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,kBAAkB;wBAAE,SAAS;oBACvD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;oBAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,SAAS,oBAAoB,UAAU,gBAAgB,SAAS,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC;AACvG,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.d.ts

@@ -1,4 +1,14 @@
-export type RefusalReason = "owned-by-webhook-register" | "mutually-exclusive-with-webhook" | "moves-bot-off-cloud";
+export type RefusalReason = "owned-by-webhook-register" | "mutually-exclusive-with-webhook" | "moves-bot-off-cloud" | "returns-a-credential" | "payments-surface-removed";
+/** Task 2636 — the eight Bot API Payments methods. Hand-written rather than
+ *  derived, because the census section they could have been read from is being
+ *  deleted by this same task.
+ *
+ *  Refusing them is not defence in depth, it is the load-bearing half of the
+ *  removal. `checkMethod` ALLOWS any name absent from `BOT_API_METHODS` so that
+ *  a method Telegram adds after the 10.2 snapshot still works, which means
+ *  deleting these names would otherwise make `telegram-api method=sendInvoice`
+ *  start working. */
+export declare const PAYMENT_METHODS: readonly string[];
 export type MethodVerdict = {
     allowed: true;
     listed: boolean;

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-guard.d.ts","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GACrB,2BAA2B,GAC3B,iCAAiC,GACjC,qBAAqB,CAAC;AAyB1B,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;4BAI4B;AAC5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAIvD;AAED,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAA+B,CAAC"}
+{"version":3,"file":"api-guard.d.ts","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GACrB,2BAA2B,GAC3B,iCAAiC,GACjC,qBAAqB,GACrB,sBAAsB,GACtB,0BAA0B,CAAC;AAE/B;;;;;;;;qBAQqB;AACrB,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAS3C,CAAC;AA2DH,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;4BAI4B;AAC5B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAIvD;AAED,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAA+B,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.js

@@ -1,5 +1,25 @@
 import { BOT_API_METHODS } from "./api-methods.js";
-/** The five methods `telegram-api` will not relay, each with the reason and the
+import { MANAGED_BOT_METHODS } from "../../../../../lib/telegram-managed-bot/dist/index.js";
+/** Task 2636 — the eight Bot API Payments methods. Hand-written rather than
+ *  derived, because the census section they could have been read from is being
+ *  deleted by this same task.
+ *
+ *  Refusing them is not defence in depth, it is the load-bearing half of the
+ *  removal. `checkMethod` ALLOWS any name absent from `BOT_API_METHODS` so that
+ *  a method Telegram adds after the 10.2 snapshot still works, which means
+ *  deleting these names would otherwise make `telegram-api method=sendInvoice`
+ *  start working. */
+export const PAYMENT_METHODS = Object.freeze([
+    "sendInvoice",
+    "createInvoiceLink",
+    "answerShippingQuery",
+    "answerPreCheckoutQuery",
+    "getMyStarBalance",
+    "getStarTransactions",
+    "refundStarPayment",
+    "editUserStarSubscription",
+]);
+/** The fifteen methods `telegram-api` will not relay, each with the reason and the
  *  surface that owns the capability instead.
  *
  *  Webhook state belongs to `telegram-webhook-register`, which enforces the
@@ -10,13 +30,45 @@ import { BOT_API_METHODS } from "./api-methods.js";
  *  getUpdates is, in Telegram's words, one of "two mutually exclusive ways of
  *  receiving updates", and it "will not work if an outgoing webhook is set up".
  *
- *  logOut and close both move the bot off the cloud Bot API server. */
+ *  logOut and close both move the bot off the cloud Bot API server.
+ *
+ *  Task 2618 — getManagedBotToken and replaceManagedBotToken both RETURN A LIVE
+ *  BOT TOKEN as their result. A passthrough relay hands that straight back as a
+ *  tool result, which puts it in the transcript, and nothing downstream would
+ *  notice. `telegram-bot-provision` fetches the same tokens, persists them to
+ *  account.json and returns only the bot id. Listing them in OWNED_METHODS is
+ *  not a substitute: that governs the census bucket, not whether the call runs.
+ *
+ *  The two access-settings methods are deliberately NOT here. They return no
+ *  credential, so refusing them would remove a capability while protecting
+ *  nothing.
+ *
+ *  Task 2636 — the eight Payments methods are refused because the surface they
+ *  belonged to was removed, not because relaying one would break routing. Stars
+ *  cannot be redeemed by a bot at all, and no fiat provider here settles the
+ *  currencies this install needs. No surface owns the capability now, so `owner`
+ *  says so in words rather than naming a tool. */
 const REFUSALS = Object.freeze({
     setWebhook: { reason: "owned-by-webhook-register", owner: "telegram-webhook-register" },
     deleteWebhook: { reason: "owned-by-webhook-register", owner: "telegram-webhook-register" },
     getUpdates: { reason: "mutually-exclusive-with-webhook", owner: "telegram-webhook-register" },
     logOut: { reason: "moves-bot-off-cloud", owner: "the cloud Bot API server" },
     close: { reason: "moves-bot-off-cloud", owner: "the cloud Bot API server" },
+    [MANAGED_BOT_METHODS.token]: {
+        reason: "returns-a-credential",
+        owner: "telegram-bot-provision",
+    },
+    [MANAGED_BOT_METHODS.rotate]: {
+        reason: "returns-a-credential",
+        owner: "telegram-bot-provision",
+    },
+    ...Object.fromEntries(PAYMENT_METHODS.map((name) => [
+        name,
+        {
+            reason: "payments-surface-removed",
+            owner: "nothing: this install takes no payment inside Telegram",
+        },
+    ])),
 });
 const LISTED = new Set(BOT_API_METHODS);
 /** An unlisted method is ALLOWED, not refused. `BOT_API_METHODS` is a snapshot

package/payload/platform/plugins/telegram/mcp/dist/lib/api-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-guard.js","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAOnD;;;;;;;;;;;uEAWuE;AACvE,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACvF,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC1F,UAAU,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC7F,MAAM,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC5E,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;CAC5E,CAAC,CAAC;AAEL,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAMxC;;;;4BAI4B;AAC5B,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC"}
+{"version":3,"file":"api-guard.js","sourceRoot":"","sources":["../../src/lib/api-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAS5F;;;;;;;;qBAQqB;AACrB,MAAM,CAAC,MAAM,eAAe,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC9D,aAAa;IACb,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,kBAAkB;IAClB,qBAAqB;IACrB,mBAAmB;IACnB,0BAA0B;CAC3B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA4BkD;AAClD,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACvF,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC1F,UAAU,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC7F,MAAM,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC5E,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC3E,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;QAC3B,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,wBAAwB;KAChC;IACD,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE;QAC5B,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,wBAAwB;KAChC;IACD,GAAG,MAAM,CAAC,WAAW,CACnB,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,IAAI;QACJ;YACE,MAAM,EAAE,0BAAmC;YAC3C,KAAK,EAAE,wDAAwD;SAChE;KACF,CAAC,CACH;CACF,CAAC,CAAC;AAEL,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAMxC;;;;4BAI4B;AAC5B,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-methods.d.ts

@@ -22,9 +22,6 @@ export declare const METHOD_SECTIONS: readonly [{
 }, {
     readonly section: "Inline mode";
     readonly methods: readonly ["answerInlineQuery"];
-}, {
-    readonly section: "Payments";
-    readonly methods: readonly ["sendInvoice", "createInvoiceLink", "answerShippingQuery", "answerPreCheckoutQuery", "getMyStarBalance", "getStarTransactions", "refundStarPayment", "editUserStarSubscription"];
 }, {
     readonly section: "Telegram Passport";
     readonly methods: readonly ["setPassportDataErrors"];

package/payload/platform/plugins/telegram/mcp/dist/lib/api-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-methods.d.ts","sourceRoot":"","sources":["../../src/lib/api-methods.ts"],"names":[],"mappings":"AAAA;;gCAEgC;AAChC,eAAO,MAAM,WAAW,SAAS,CAAC;AAElC;6EAC6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUlB,CAAC;AAEX;kEACkE;AAClE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAE5C,CAAC"}
+{"version":3,"file":"api-methods.d.ts","sourceRoot":"","sources":["../../src/lib/api-methods.ts"],"names":[],"mappings":"AAAA;;gCAEgC;AAChC,eAAO,MAAM,WAAW,SAAS,CAAC;AAElC;6EAC6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EASlB,CAAC;AAEX;kEACkE;AAClE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAE5C,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/api-methods.js

@@ -11,7 +11,6 @@ export const METHOD_SECTIONS = [
     { section: "Stickers", methods: ["sendSticker", "getStickerSet", "getCustomEmojiStickers", "uploadStickerFile", "createNewStickerSet", "addStickerToSet", "setStickerPositionInSet", "deleteStickerFromSet", "replaceStickerInSet", "setStickerEmojiList", "setStickerKeywords", "setStickerMaskPosition", "setStickerSetTitle", "setStickerSetThumbnail", "setCustomEmojiStickerSetThumbnail", "deleteStickerSet"] },
     { section: "Rich messages", methods: ["sendRichMessage", "sendRichMessageDraft"] },
     { section: "Inline mode", methods: ["answerInlineQuery"] },
-    { section: "Payments", methods: ["sendInvoice", "createInvoiceLink", "answerShippingQuery", "answerPreCheckoutQuery", "getMyStarBalance", "getStarTransactions", "refundStarPayment", "editUserStarSubscription"] },
     { section: "Telegram Passport", methods: ["setPassportDataErrors"] },
     { section: "Games", methods: ["sendGame", "setGameScore", "getGameHighScores"] },
 ];

package/payload/platform/plugins/telegram/mcp/dist/lib/api-methods.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-methods.js","sourceRoot":"","sources":["../../src/lib/api-methods.ts"],"names":[],"mappings":"AAAA;;gCAEgC;AAChC,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAElC;6EAC6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,CAAC,EAAE;IACxG,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE,SAAS,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,eAAe,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,UAAU,EAAE,yBAAyB,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,4BAA4B,CAAC,EAAE;IAC7xF,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,UAAU,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,EAAE;IAC1f,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,mCAAmC,EAAE,kBAAkB,CAAC,EAAE;IACrZ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,EAAE;IAClF,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE;IAC1D,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,EAAE;IACnN,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE;IACpE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,mBAAmB,CAAC,EAAE;CACxE,CAAC;AAEX;kEACkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAsB,eAAe,CAAC,OAAO,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAA4B,CACtC,CAAC"}
+{"version":3,"file":"api-methods.js","sourceRoot":"","sources":["../../src/lib/api-methods.ts"],"names":[],"mappings":"AAAA;;gCAEgC;AAChC,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAElC;6EAC6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,CAAC,EAAE;IACxG,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE,SAAS,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,eAAe,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,UAAU,EAAE,yBAAyB,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,4BAA4B,CAAC,EAAE;IAC7xF,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,UAAU,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,EAAE;IAC1f,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,mCAAmC,EAAE,kBAAkB,CAAC,EAAE;IACrZ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,EAAE;IAClF,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE;IAC1D,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE;IACpE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,mBAAmB,CAAC,EAAE;CACxE,CAAC;AAEX;kEACkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAsB,eAAe,CAAC,OAAO,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAA4B,CACtC,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/business-window-store.d.ts

@@ -0,0 +1,58 @@
+/** Task 2615 — the read side of Telegram's 24-hour business reply window.
+ *
+ *  `BusinessBotRights.can_reply` grants the right to "send and edit messages in
+ *  the private chats that had incoming messages in the last 24 hours". Outside
+ *  that window Telegram refuses the send, and nothing is emitted when the window
+ *  closes, so a customer simply becomes unanswerable with no event anywhere.
+ *  Deciding before the call is what turns that silence into a refusal the agent
+ *  can act on.
+ *
+ *  The platform writes the conversation (`platform/ui/app/lib/telegram/
+ *  message-store.ts`); this reads it back. The window constant, the row shape and
+ *  the path derivation are duplicated across the boundary on purpose — the plugin
+ *  cannot import from `platform/ui/app`, the same boundary that already
+ *  duplicates the webhook secret path, the card store, the live-location store
+ *  and the business connection — and
+ *  `ui/app/lib/telegram/__tests__/business-window-boundary.test.ts` asserts the
+ *  two derivations agree.
+ *
+ *  TWO ROOTS, and they are not the same one. The connection record sits in the
+ *  ACCOUNT dir, `<installDir>/data/accounts/<accountId>`; the conversation store
+ *  is under the brand CONFIG dir, `~/.<brand>/data/telegram-messages/<accountId>`.
+ *  Task 2644 — they are NOT siblings, which is what this file assumed, and the
+ *  path derivation is no longer duplicated: `telegramStoreRoot` is shared with
+ *  the platform writer. `resolveAccountDir` is still the containment authority:
+ *  its refusal is what stops a traversal in the account id from reaching outside
+ *  the install.
+ */
+/** Telegram's window, in seconds. Restated rather than imported, for the reason
+ *  the header gives; the boundary test is what keeps it equal to the platform's
+ *  `BUSINESS_REPLY_WINDOW_S`. */
+export declare const BUSINESS_REPLY_WINDOW_S = 86400;
+/** The business conversation's key. Mirrors `telegramBusinessChannelKey`. */
+export declare function businessChannelKey(botId: string, chatId: string | number): string;
+/** The newest Telegram-clock second among INBOUND rows in one business chat, or
+ *  null when the chat holds none carrying that field.
+ *
+ *  Inbound only: the window runs from what the CUSTOMER last sent, and counting
+ *  an agent reply would extend it on every send so the refusal could never fire.
+ *
+ *  Null rather than 0 for "nothing to measure from". Zero is a real Unix second
+ *  and would read as 1970, refusing every reply in a conversation whose rows
+ *  predate the field. */
+export declare function newestInboundTelegramDate(platformRoot: string, accountId: string, channelKey: string): number | null;
+export interface BusinessWindowVerdict {
+    allowed: boolean;
+    ageS: number | null;
+    reason: "ok" | "no-inbound" | "lapsed";
+}
+export declare function businessWindowVerdict(input: {
+    newestInboundDate: number | null;
+    nowMs: number;
+}): BusinessWindowVerdict;
+/** The refusal the agent reads. It names the WINDOW and the chat, never a
+ *  parameter: there is no argument the caller could add to make this send work,
+ *  which is the shape Task 2611 gave `ask.ts` for a checklist with no
+ *  connection. */
+export declare function businessWindowRefusal(chatId: number | string, ageS: number | null): string;
+//# sourceMappingURL=business-window-store.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/business-window-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-window-store.d.ts","sourceRoot":"","sources":["../../src/lib/business-window-store.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;iCAEiC;AACjC,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjF;AAyBD;;;;;;;;yBAQyB;AACzB,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CA0Bf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,IAAI,GAAG,YAAY,GAAG,QAAQ,CAAC;CACxC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,qBAAqB,CAQxB;AAED;;;kBAGkB;AAClB,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAc1F"}