@wrongstack/telegram 0.319.1 → 1.0.0

package/dist/inbox.d.ts

@@ -26,12 +26,36 @@ export declare class TelegramInbox {
     private readonly deps;
     readonly buffer: TelegramIncomingMessage[];
     constructor(deps: TelegramInboxDeps);
+    /**
+     * Replace the inbound identity policy sets. Called by the plugin's
+     * hot-reload path (api.onConfigChange) so changes to `inboundMode`,
+     * `allowedUsers`, and `allowedChats` — all classified `hot` — take effect
+     * on the live gate without a plugin restart. The new sets carry the same
+     * semantics as construction (empty set = that dimension unrestricted,
+     * non-empty = mandatory constraint, fail closed on missing identity).
+     */
+    updateAllowlist(allowedUsers: Set<string>, allowedChats: Set<string>): void;
     /** Return buffered messages, newest first. Optionally filter by chat. */
     getMessages(opts?: {
         chatId?: string | number | undefined;
         limit?: number | undefined;
     }): TelegramIncomingMessage[];
-    /** Drop messages older than or equal to the given message ID from the buffer (optionally scoped to a specific chat). */
+    /**
+     * Drop messages older than or equal to the given message ID from the buffer
+     * (optionally scoped to a specific chat).
+     *
+     * Telegram `message_id` is a PER-CHAT counter: ids are ordered only inside
+     * one chat and are never comparable across chats. With an explicit
+     * `chatId`, the drop is scoped to that chat. Without one, the drop is
+     * scoped to the chat(s) that actually contain a buffered message with this
+     * exact id — the anchor names a message in a specific chat, and only that
+     * chat's `<= anchor` range is meaningful. Other chats keep their mail, so
+     * the documented read→ack_last pattern (read newest-first across all
+     * chats, ack the highest id seen) can never destroy mail from a chat the
+     * agent never read — including messages truncated away by `limit`. A
+     * single-chat deployment is unaffected: the one chat owns the anchor,
+     * exactly as before.
+     */
     acknowledge(lastMessageId: number, chatId?: string | number | undefined): number;
     get bufferCount(): number;
     /**

package/dist/index.js

@@ -419,6 +419,18 @@ var TelegramInbox = class {
   constructor(deps) {
     this.deps = deps;
   }
+  /**
+   * Replace the inbound identity policy sets. Called by the plugin's
+   * hot-reload path (api.onConfigChange) so changes to `inboundMode`,
+   * `allowedUsers`, and `allowedChats` — all classified `hot` — take effect
+   * on the live gate without a plugin restart. The new sets carry the same
+   * semantics as construction (empty set = that dimension unrestricted,
+   * non-empty = mandatory constraint, fail closed on missing identity).
+   */
+  updateAllowlist(allowedUsers, allowedChats) {
+    this.deps.allowedUsers = allowedUsers;
+    this.deps.allowedChats = allowedChats;
+  }
   /** Return buffered messages, newest first. Optionally filter by chat. */
   getMessages(opts) {
     let msgs = [...this.buffer].reverse();
@@ -429,17 +441,35 @@ var TelegramInbox = class {
     const limit = opts?.limit ?? 20;
     return msgs.slice(0, limit);
   }
-  /** Drop messages older than or equal to the given message ID from the buffer (optionally scoped to a specific chat). */
+  /**
+   * Drop messages older than or equal to the given message ID from the buffer
+   * (optionally scoped to a specific chat).
+   *
+   * Telegram `message_id` is a PER-CHAT counter: ids are ordered only inside
+   * one chat and are never comparable across chats. With an explicit
+   * `chatId`, the drop is scoped to that chat. Without one, the drop is
+   * scoped to the chat(s) that actually contain a buffered message with this
+   * exact id — the anchor names a message in a specific chat, and only that
+   * chat's `<= anchor` range is meaningful. Other chats keep their mail, so
+   * the documented read→ack_last pattern (read newest-first across all
+   * chats, ack the highest id seen) can never destroy mail from a chat the
+   * agent never read — including messages truncated away by `limit`. A
+   * single-chat deployment is unaffected: the one chat owns the anchor,
+   * exactly as before.
+   */
   acknowledge(lastMessageId, chatId) {
     const before = this.buffer.length;
     const cid = chatId !== void 0 && chatId !== null && String(chatId).trim() !== "" ? String(chatId).trim() : void 0;
+    const anchorChats = cid === void 0 ? new Set(
+      this.buffer.filter((buffered) => buffered.messageId === lastMessageId).map((buffered) => String(buffered.chatId))
+    ) : void 0;
     const remaining = [];
     for (const buffered of this.buffer) {
       if (cid !== void 0) {
         if (String(buffered.chatId) === cid && buffered.messageId <= lastMessageId) {
           continue;
         }
-      } else if (buffered.messageId <= lastMessageId) {
+      } else if (anchorChats?.has(String(buffered.chatId)) && buffered.messageId <= lastMessageId) {
         continue;
       }
       remaining.push(buffered);
@@ -505,6 +535,8 @@ var Poller = class _Poller {
   api;
   pollIntervalMs;
   log;
+  // Not readonly: start() swaps in a fresh controller when a previous stop()
+  // aborted this one (see start()).
   controller;
   offsetStore;
   lock;
@@ -549,6 +581,7 @@ var Poller = class _Poller {
     if (this.pollActive) return;
     this.pollActive = true;
     this._startedAt = Date.now();
+    if (this.controller.signal.aborted) this.controller = new AbortController();
     this.acquireAndPoll();
   }
   stop() {
@@ -626,13 +659,12 @@ var Poller = class _Poller {
         }
         try {
           this.onMessageUpdate(raw);
-          this.offset = upd.update_id + 1;
         } catch (err) {
           this.log.debug(
             `Telegram processMessage failed: ${err instanceof Error ? err.message : String(err)}`
           );
-          break;
         }
+        this.offset = upd.update_id + 1;
       }
       if (this.offsetStore && updates.length > 0) void this.saveOffset();
     } catch (err) {
@@ -2549,6 +2581,10 @@ var plugin = {
         for (const [key, apply] of HOT_APPLIERS) {
           if (hotSet.has(key)) apply(runtimeCfg, fresh);
         }
+        if (hotSet.has("inboundMode") || hotSet.has("allowedUsers") || hotSet.has("allowedChats")) {
+          const sets = inboundAllowlist(nextTg);
+          bot.inbox.updateAllowlist(sets.allowedUsers, sets.allowedChats);
+        }
         if (restartKeys.length > 0) {
           log.warn(
             "Telegram config changed restart-required keys \u2014 restart the plugin for these to take effect",

package/dist/poller.d.ts

@@ -6,7 +6,7 @@ export declare class Poller {
     private readonly api;
     private readonly pollIntervalMs;
     private readonly log;
-    private readonly controller;
+    private controller;
     private readonly offsetStore?;
     private readonly lock?;
     private readonly standbyRetryMs;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/telegram",
-  "version": "0.319.1",
+  "version": "1.0.0",
   "license": "MIT",
   "description": "WrongStack plugin — Telegram bridge: send messages, receive prompts, get notified.",
   "repository": {
@@ -26,11 +26,11 @@
     "!dist/**/*.map"
   ],
   "peerDependencies": {
-    "@wrongstack/core": "0.319.1"
+    "@wrongstack/core": "1.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "@wrongstack/core": "0.319.1",
+    "@wrongstack/core": "1.0.0",
     "typescript": "^7.0.2"
   },
   "publishConfig": {