teleton 0.5.2 → 0.6.0

package/dist/chunk-4IPJ25HE.js

@@ -0,0 +1,2839 @@
+import {
+  createDbWrapper,
+  migrateFromMainDb,
+  openModuleDb
+} from "./chunk-ECSCVEQQ.js";
+import {
+  COINGECKO_API_URL,
+  fetchWithTimeout,
+  tonapiFetch
+} from "./chunk-GDCODBNO.js";
+import {
+  RETRY_BLOCKCHAIN_BASE_DELAY_MS,
+  RETRY_BLOCKCHAIN_MAX_DELAY_MS,
+  RETRY_BLOCKCHAIN_TIMEOUT_MS,
+  RETRY_DEFAULT_BASE_DELAY_MS,
+  RETRY_DEFAULT_MAX_ATTEMPTS,
+  RETRY_DEFAULT_MAX_DELAY_MS,
+  RETRY_DEFAULT_TIMEOUT_MS
+} from "./chunk-4DU3C27M.js";
+import {
+  PAYMENT_TOLERANCE_RATIO,
+  TELEGRAM_MAX_MESSAGE_LENGTH
+} from "./chunk-RO62LO6Z.js";
+import {
+  ALLOWED_EXTENSIONS,
+  TELETON_ROOT,
+  WORKSPACE_PATHS,
+  WORKSPACE_ROOT
+} from "./chunk-EYWNOHMJ.js";
+import {
+  getCachedHttpEndpoint
+} from "./chunk-QUAPFI2N.js";
+import {
+  __require
+} from "./chunk-QGM4M3NI.js";
+
+// src/config/providers.ts
+var PROVIDER_REGISTRY = {
+  anthropic: {
+    id: "anthropic",
+    displayName: "Anthropic (Claude)",
+    envVar: "ANTHROPIC_API_KEY",
+    keyPrefix: "sk-ant-",
+    keyHint: "sk-ant-api03-...",
+    consoleUrl: "https://console.anthropic.com/",
+    defaultModel: "claude-opus-4-5-20251101",
+    utilityModel: "claude-3-5-haiku-20241022",
+    toolLimit: null,
+    piAiProvider: "anthropic"
+  },
+  openai: {
+    id: "openai",
+    displayName: "OpenAI (GPT-4o)",
+    envVar: "OPENAI_API_KEY",
+    keyPrefix: "sk-",
+    keyHint: "sk-proj-...",
+    consoleUrl: "https://platform.openai.com/api-keys",
+    defaultModel: "gpt-4o",
+    utilityModel: "gpt-4o-mini",
+    toolLimit: 128,
+    piAiProvider: "openai"
+  },
+  google: {
+    id: "google",
+    displayName: "Google (Gemini)",
+    envVar: "GOOGLE_API_KEY",
+    keyPrefix: null,
+    keyHint: "AIza...",
+    consoleUrl: "https://aistudio.google.com/apikey",
+    defaultModel: "gemini-2.5-flash",
+    utilityModel: "gemini-2.0-flash-lite",
+    toolLimit: 128,
+    piAiProvider: "google"
+  },
+  xai: {
+    id: "xai",
+    displayName: "xAI (Grok)",
+    envVar: "XAI_API_KEY",
+    keyPrefix: "xai-",
+    keyHint: "xai-...",
+    consoleUrl: "https://console.x.ai/",
+    defaultModel: "grok-3",
+    utilityModel: "grok-3-mini-fast",
+    toolLimit: 128,
+    piAiProvider: "xai"
+  },
+  groq: {
+    id: "groq",
+    displayName: "Groq",
+    envVar: "GROQ_API_KEY",
+    keyPrefix: "gsk_",
+    keyHint: "gsk_...",
+    consoleUrl: "https://console.groq.com/keys",
+    defaultModel: "llama-3.3-70b-versatile",
+    utilityModel: "llama-3.1-8b-instant",
+    toolLimit: 128,
+    piAiProvider: "groq"
+  },
+  openrouter: {
+    id: "openrouter",
+    displayName: "OpenRouter",
+    envVar: "OPENROUTER_API_KEY",
+    keyPrefix: "sk-or-",
+    keyHint: "sk-or-v1-...",
+    consoleUrl: "https://openrouter.ai/keys",
+    defaultModel: "anthropic/claude-opus-4.5",
+    utilityModel: "google/gemini-2.5-flash-lite",
+    toolLimit: 128,
+    piAiProvider: "openrouter"
+  }
+};
+function getProviderMetadata(provider) {
+  const meta = PROVIDER_REGISTRY[provider];
+  if (!meta) {
+    throw new Error(`Unknown provider: ${provider}`);
+  }
+  return meta;
+}
+function getSupportedProviders() {
+  return Object.values(PROVIDER_REGISTRY);
+}
+function validateApiKeyFormat(provider, key) {
+  const meta = PROVIDER_REGISTRY[provider];
+  if (!meta) return `Unknown provider: ${provider}`;
+  if (!key || key.trim().length === 0) return "API key is required";
+  if (meta.keyPrefix && !key.startsWith(meta.keyPrefix)) {
+    return `Invalid format (should start with ${meta.keyPrefix})`;
+  }
+  return void 0;
+}
+
+// src/config/loader.ts
+import { readFileSync, existsSync, writeFileSync, mkdirSync, chmodSync } from "fs";
+import { parse, stringify } from "yaml";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
+// src/config/schema.ts
+import { z } from "zod";
+var DMPolicy = z.enum(["pairing", "allowlist", "open", "disabled"]);
+var GroupPolicy = z.enum(["open", "allowlist", "disabled"]);
+var SessionResetPolicySchema = z.object({
+  daily_reset_enabled: z.boolean().default(true).describe("Enable daily session reset"),
+  daily_reset_hour: z.number().min(0).max(23).default(4).describe("Hour of day (0-23) to reset sessions"),
+  idle_expiry_enabled: z.boolean().default(true).describe("Enable session reset after idle period"),
+  idle_expiry_minutes: z.number().default(1440).describe("Minutes of inactivity before session reset (default: 24h)")
+});
+var AgentConfigSchema = z.object({
+  provider: z.enum(["anthropic", "openai", "google", "xai", "groq", "openrouter"]).default("anthropic"),
+  api_key: z.string(),
+  model: z.string().default("claude-opus-4-5-20251101"),
+  utility_model: z.string().optional().describe("Cheap model for summarization (auto-detected if omitted)"),
+  max_tokens: z.number().default(4096),
+  temperature: z.number().default(0.7),
+  system_prompt: z.string().nullable().default(null),
+  max_agentic_iterations: z.number().default(5).describe("Maximum number of agentic loop iterations (tool call \u2192 result \u2192 tool call cycles)"),
+  session_reset_policy: SessionResetPolicySchema.default(SessionResetPolicySchema.parse({}))
+});
+var TelegramConfigSchema = z.object({
+  api_id: z.number(),
+  api_hash: z.string(),
+  phone: z.string(),
+  session_name: z.string().default("teleton_session"),
+  session_path: z.string().default("~/.teleton"),
+  dm_policy: DMPolicy.default("pairing"),
+  allow_from: z.array(z.number()).default([]),
+  group_policy: GroupPolicy.default("open"),
+  group_allow_from: z.array(z.number()).default([]),
+  require_mention: z.boolean().default(true),
+  max_message_length: z.number().default(TELEGRAM_MAX_MESSAGE_LENGTH),
+  typing_simulation: z.boolean().default(true),
+  rate_limit_messages_per_second: z.number().default(1),
+  rate_limit_groups_per_minute: z.number().default(20),
+  admin_ids: z.array(z.number()).default([]),
+  agent_channel: z.string().nullable().default(null),
+  owner_name: z.string().optional().describe("Owner's first name (e.g., 'Alex')"),
+  owner_username: z.string().optional().describe("Owner's Telegram username (without @)"),
+  owner_id: z.number().optional().describe("Owner's Telegram user ID"),
+  debounce_ms: z.number().default(1500).describe("Debounce delay in milliseconds for group messages (0 = disabled)"),
+  bot_token: z.string().optional().describe("Telegram Bot token from @BotFather for inline deal buttons"),
+  bot_username: z.string().optional().describe("Bot username without @ (e.g., 'teleton_deals_bot')")
+});
+var StorageConfigSchema = z.object({
+  sessions_file: z.string().default("~/.teleton/sessions.json"),
+  pairing_file: z.string().default("~/.teleton/pairing.json"),
+  memory_file: z.string().default("~/.teleton/memory.json"),
+  history_limit: z.number().default(100)
+});
+var MetaConfigSchema = z.object({
+  version: z.string().default("1.0.0"),
+  created_at: z.string().optional(),
+  last_modified_at: z.string().optional(),
+  onboard_command: z.string().default("teleton setup")
+});
+var _DealsObject = z.object({
+  enabled: z.boolean().default(true),
+  expiry_seconds: z.number().default(120),
+  buy_max_floor_percent: z.number().default(100),
+  sell_min_floor_percent: z.number().default(105),
+  poll_interval_ms: z.number().default(5e3),
+  max_verification_retries: z.number().default(12),
+  expiry_check_interval_ms: z.number().default(6e4)
+});
+var DealsConfigSchema = _DealsObject.default(_DealsObject.parse({}));
+var _WebUIObject = z.object({
+  enabled: z.boolean().default(false).describe("Enable WebUI server"),
+  port: z.number().default(7777).describe("HTTP server port"),
+  host: z.string().default("127.0.0.1").describe("Bind address (localhost only for security)"),
+  auth_token: z.string().optional().describe("Bearer token for API auth (auto-generated if omitted)"),
+  cors_origins: z.array(z.string()).default(["http://localhost:5173", "http://localhost:7777"]).describe("Allowed CORS origins for development"),
+  log_requests: z.boolean().default(false).describe("Log all HTTP requests")
+});
+var WebUIConfigSchema = _WebUIObject.default(_WebUIObject.parse({}));
+var _EmbeddingObject = z.object({
+  provider: z.enum(["local", "anthropic", "none"]).default("local").describe("Embedding provider: local (ONNX), anthropic (API), or none (FTS5-only)"),
+  model: z.string().optional().describe("Model override (default: Xenova/all-MiniLM-L6-v2 for local)")
+});
+var EmbeddingConfigSchema = _EmbeddingObject.default(_EmbeddingObject.parse({}));
+var _DevObject = z.object({
+  hot_reload: z.boolean().default(false).describe("Enable plugin hot-reload (watches ~/.teleton/plugins/ for changes)")
+});
+var DevConfigSchema = _DevObject.default(_DevObject.parse({}));
+var McpServerSchema = z.object({
+  command: z.string().optional().describe("Stdio command (e.g. 'npx @modelcontextprotocol/server-filesystem /tmp')"),
+  args: z.array(z.string()).optional().describe("Explicit args array (overrides command splitting)"),
+  env: z.record(z.string(), z.string()).optional().describe("Environment variables for stdio server"),
+  url: z.string().url().optional().describe("SSE/HTTP endpoint URL (alternative to command)"),
+  scope: z.enum(["always", "dm-only", "group-only", "admin-only"]).default("always").describe("Tool scope"),
+  enabled: z.boolean().default(true).describe("Enable/disable this server")
+}).refine((s) => s.command || s.url, {
+  message: "Each MCP server needs either 'command' (stdio) or 'url' (SSE/HTTP)"
+});
+var _McpObject = z.object({
+  servers: z.record(z.string(), McpServerSchema).default({})
+});
+var McpConfigSchema = _McpObject.default(_McpObject.parse({}));
+var _ToolRagObject = z.object({
+  enabled: z.boolean().default(false).describe("Enable semantic tool retrieval (Tool RAG)"),
+  top_k: z.number().default(25).describe("Max tools to retrieve per LLM call"),
+  always_include: z.array(z.string()).default([
+    "telegram_send_message",
+    "telegram_reply_message",
+    "telegram_send_photo",
+    "telegram_send_document",
+    "journal_*",
+    "workspace_*",
+    "web_*"
+  ]).describe("Tool name patterns always included (prefix glob with *)"),
+  skip_unlimited_providers: z.boolean().default(false).describe("Skip Tool RAG for providers with no tool limit (e.g. Anthropic)")
+});
+var ToolRagConfigSchema = _ToolRagObject.default(_ToolRagObject.parse({}));
+var ConfigSchema = z.object({
+  meta: MetaConfigSchema.default(MetaConfigSchema.parse({})),
+  agent: AgentConfigSchema,
+  telegram: TelegramConfigSchema,
+  storage: StorageConfigSchema.default(StorageConfigSchema.parse({})),
+  embedding: EmbeddingConfigSchema,
+  deals: DealsConfigSchema,
+  webui: WebUIConfigSchema,
+  dev: DevConfigSchema,
+  tool_rag: ToolRagConfigSchema,
+  mcp: McpConfigSchema,
+  plugins: z.record(z.string(), z.unknown()).default({}).describe("Per-plugin config (key = plugin name with underscores)"),
+  tonapi_key: z.string().optional().describe("TonAPI key for higher rate limits (from @tonapi_bot)"),
+  tavily_api_key: z.string().optional().describe("Tavily API key for web search & extract (free at https://tavily.com)")
+});
+
+// src/config/loader.ts
+var DEFAULT_CONFIG_PATH = join(TELETON_ROOT, "config.yaml");
+function expandPath(path) {
+  if (path.startsWith("~")) {
+    return join(homedir(), path.slice(1));
+  }
+  return path;
+}
+function loadConfig(configPath = DEFAULT_CONFIG_PATH) {
+  const fullPath = expandPath(configPath);
+  if (!existsSync(fullPath)) {
+    throw new Error(`Config file not found: ${fullPath}
+Run 'teleton setup' to create one.`);
+  }
+  let content;
+  try {
+    content = readFileSync(fullPath, "utf-8");
+  } catch (error) {
+    throw new Error(`Cannot read config file ${fullPath}: ${error.message}`);
+  }
+  let raw;
+  try {
+    raw = parse(content);
+  } catch (error) {
+    throw new Error(`Invalid YAML in ${fullPath}: ${error.message}`);
+  }
+  if (raw && typeof raw === "object" && "market" in raw) {
+    console.warn("\u26A0\uFE0F  config.market is deprecated and ignored. Use market-api plugin instead.");
+    delete raw.market;
+  }
+  const result = ConfigSchema.safeParse(raw);
+  if (!result.success) {
+    throw new Error(`Invalid config: ${result.error.message}`);
+  }
+  const config = result.data;
+  const provider = config.agent.provider;
+  if (provider !== "anthropic" && !raw.agent?.model) {
+    const meta = getProviderMetadata(provider);
+    config.agent.model = meta.defaultModel;
+  }
+  config.telegram.session_path = expandPath(config.telegram.session_path);
+  config.storage.sessions_file = expandPath(config.storage.sessions_file);
+  config.storage.pairing_file = expandPath(config.storage.pairing_file);
+  config.storage.memory_file = expandPath(config.storage.memory_file);
+  if (process.env.TELETON_API_KEY) {
+    config.agent.api_key = process.env.TELETON_API_KEY;
+  }
+  if (process.env.TELETON_TG_API_ID) {
+    const apiId = parseInt(process.env.TELETON_TG_API_ID, 10);
+    if (isNaN(apiId)) {
+      throw new Error(
+        `Invalid TELETON_TG_API_ID environment variable: "${process.env.TELETON_TG_API_ID}" is not a valid integer`
+      );
+    }
+    config.telegram.api_id = apiId;
+  }
+  if (process.env.TELETON_TG_API_HASH) {
+    config.telegram.api_hash = process.env.TELETON_TG_API_HASH;
+  }
+  if (process.env.TELETON_TG_PHONE) {
+    config.telegram.phone = process.env.TELETON_TG_PHONE;
+  }
+  if (process.env.TELETON_WEBUI_ENABLED) {
+    config.webui.enabled = process.env.TELETON_WEBUI_ENABLED === "true";
+  }
+  if (process.env.TELETON_WEBUI_PORT) {
+    const port = parseInt(process.env.TELETON_WEBUI_PORT, 10);
+    if (!isNaN(port)) {
+      config.webui.port = port;
+    }
+  }
+  if (process.env.TELETON_WEBUI_HOST) {
+    config.webui.host = process.env.TELETON_WEBUI_HOST;
+  }
+  if (process.env.TELETON_TAVILY_API_KEY) {
+    config.tavily_api_key = process.env.TELETON_TAVILY_API_KEY;
+  }
+  if (process.env.TELETON_TONAPI_KEY) {
+    config.tonapi_key = process.env.TELETON_TONAPI_KEY;
+  }
+  return config;
+}
+function configExists(configPath = DEFAULT_CONFIG_PATH) {
+  return existsSync(expandPath(configPath));
+}
+function getDefaultConfigPath() {
+  return DEFAULT_CONFIG_PATH;
+}
+
+// src/ton/wallet-service.ts
+import { mnemonicNew, mnemonicToPrivateKey, mnemonicValidate } from "@ton/crypto";
+import { WalletContractV5R1, TonClient, fromNano } from "@ton/ton";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+var WALLET_FILE = join2(TELETON_ROOT, "wallet.json");
+var _walletCache;
+var _keyPairCache = null;
+async function generateWallet() {
+  const mnemonic = await mnemonicNew(24);
+  const keyPair = await mnemonicToPrivateKey(mnemonic);
+  const wallet = WalletContractV5R1.create({
+    workchain: 0,
+    publicKey: keyPair.publicKey
+  });
+  const address = wallet.address.toString({ bounceable: true, testOnly: false });
+  return {
+    version: "w5r1",
+    address,
+    publicKey: keyPair.publicKey.toString("hex"),
+    mnemonic,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function saveWallet(wallet) {
+  const dir = dirname2(WALLET_FILE);
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true });
+  }
+  writeFileSync2(WALLET_FILE, JSON.stringify(wallet, null, 2), "utf-8");
+  chmodSync2(WALLET_FILE, 384);
+  _walletCache = void 0;
+  _keyPairCache = null;
+}
+function loadWallet() {
+  if (_walletCache !== void 0) return _walletCache;
+  if (!existsSync2(WALLET_FILE)) {
+    _walletCache = null;
+    return null;
+  }
+  try {
+    const content = readFileSync2(WALLET_FILE, "utf-8");
+    _walletCache = JSON.parse(content);
+    return _walletCache;
+  } catch (error) {
+    console.error("Failed to load wallet:", error);
+    _walletCache = null;
+    return null;
+  }
+}
+function walletExists() {
+  return existsSync2(WALLET_FILE);
+}
+async function importWallet(mnemonic) {
+  const valid = await mnemonicValidate(mnemonic);
+  if (!valid) {
+    throw new Error("Invalid mnemonic: words do not form a valid TON seed phrase");
+  }
+  const keyPair = await mnemonicToPrivateKey(mnemonic);
+  const wallet = WalletContractV5R1.create({
+    workchain: 0,
+    publicKey: keyPair.publicKey
+  });
+  const address = wallet.address.toString({ bounceable: true, testOnly: false });
+  return {
+    version: "w5r1",
+    address,
+    publicKey: keyPair.publicKey.toString("hex"),
+    mnemonic,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function getWalletAddress() {
+  const wallet = loadWallet();
+  return wallet?.address || null;
+}
+async function getKeyPair() {
+  if (_keyPairCache) return _keyPairCache;
+  const wallet = loadWallet();
+  if (!wallet) return null;
+  _keyPairCache = await mnemonicToPrivateKey(wallet.mnemonic);
+  return _keyPairCache;
+}
+async function getWalletBalance(address) {
+  try {
+    const endpoint = await getCachedHttpEndpoint();
+    const client = new TonClient({ endpoint });
+    const { Address: Address2 } = await import("@ton/core");
+    const addressObj = Address2.parse(address);
+    const balance = await client.getBalance(addressObj);
+    const balanceFormatted = fromNano(balance);
+    return {
+      balance: balanceFormatted,
+      balanceNano: balance.toString()
+    };
+  } catch (error) {
+    console.error("Failed to get balance:", error);
+    return null;
+  }
+}
+var TON_PRICE_CACHE_TTL_MS = 3e4;
+var _tonPriceCache = null;
+async function getTonPrice() {
+  if (_tonPriceCache && Date.now() - _tonPriceCache.timestamp < TON_PRICE_CACHE_TTL_MS) {
+    return { ..._tonPriceCache };
+  }
+  try {
+    const response = await tonapiFetch(`/rates?tokens=ton&currencies=usd`);
+    if (response.ok) {
+      const data = await response.json();
+      const price = data?.rates?.TON?.prices?.USD;
+      if (typeof price === "number" && price > 0) {
+        _tonPriceCache = { usd: price, source: "TonAPI", timestamp: Date.now() };
+        return _tonPriceCache;
+      }
+    }
+  } catch {
+  }
+  try {
+    const response = await fetchWithTimeout(
+      `${COINGECKO_API_URL}/simple/price?ids=the-open-network&vs_currencies=usd`
+    );
+    if (!response.ok) {
+      throw new Error(`CoinGecko API error: ${response.status}`);
+    }
+    const data = await response.json();
+    const price = data["the-open-network"]?.usd;
+    if (typeof price === "number" && price > 0) {
+      _tonPriceCache = { usd: price, source: "CoinGecko", timestamp: Date.now() };
+      return _tonPriceCache;
+    }
+  } catch (error) {
+    console.error("Failed to get TON price:", error);
+  }
+  return null;
+}
+
+// src/agent/tools/plugin-loader.ts
+import { readdirSync, readFileSync as readFileSync4, existsSync as existsSync4, statSync } from "fs";
+import { join as join4 } from "path";
+import { pathToFileURL } from "url";
+import { execFile } from "child_process";
+import { promisify } from "util";
+
+// src/agent/tools/plugin-validator.ts
+import { z as z2 } from "zod";
+var ManifestSchema = z2.object({
+  name: z2.string().min(1).max(64).regex(
+    /^[a-z0-9][a-z0-9-]*$/,
+    "Must be lowercase alphanumeric with hyphens, starting with a letter or number"
+  ),
+  version: z2.string().regex(/^\d+\.\d+\.\d+$/, "Must be semver (e.g., 1.0.0)"),
+  author: z2.string().max(128).optional(),
+  description: z2.string().max(256).optional(),
+  dependencies: z2.array(z2.string()).optional(),
+  defaultConfig: z2.record(z2.string(), z2.unknown()).optional(),
+  sdkVersion: z2.string().max(32).optional(),
+  secrets: z2.record(
+    z2.string(),
+    z2.object({
+      required: z2.boolean(),
+      description: z2.string().max(256),
+      env: z2.string().max(128).optional()
+    })
+  ).optional()
+});
+function validateManifest(raw) {
+  return ManifestSchema.parse(raw);
+}
+function validateToolDefs(defs, pluginName) {
+  const valid = [];
+  for (const def of defs) {
+    if (!def || typeof def !== "object") {
+      console.warn(`\u26A0\uFE0F  [${pluginName}] tool is not an object, skipping`);
+      continue;
+    }
+    const t = def;
+    if (!t.name || typeof t.name !== "string") {
+      console.warn(`\u26A0\uFE0F  [${pluginName}] tool missing 'name', skipping`);
+      continue;
+    }
+    if (!t.description || typeof t.description !== "string") {
+      console.warn(`\u26A0\uFE0F  [${pluginName}] tool "${t.name}" missing 'description', skipping`);
+      continue;
+    }
+    if (!t.execute || typeof t.execute !== "function") {
+      console.warn(`\u26A0\uFE0F  [${pluginName}] tool "${t.name}" missing 'execute' function, skipping`);
+      continue;
+    }
+    valid.push(t);
+  }
+  return valid;
+}
+function sanitizeConfigForPlugins(config) {
+  return {
+    agent: {
+      provider: config.agent.provider,
+      model: config.agent.model,
+      max_tokens: config.agent.max_tokens
+    },
+    telegram: {
+      admin_ids: config.telegram.admin_ids
+    },
+    deals: { enabled: config.deals.enabled }
+  };
+}
+
+// packages/sdk/dist/index.js
+var PluginSDKError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  name = "PluginSDKError";
+};
+var SDK_VERSION = "1.0.0";
+
+// src/ton/transfer.ts
+import { WalletContractV5R1 as WalletContractV5R12, TonClient as TonClient2, toNano, internal } from "@ton/ton";
+import { Address, SendMode } from "@ton/core";
+async function sendTon(params) {
+  try {
+    const { toAddress, amount, comment = "", bounce = false } = params;
+    let recipientAddress;
+    try {
+      recipientAddress = Address.parse(toAddress);
+    } catch (e) {
+      console.error(`Invalid recipient address: ${toAddress}`, e);
+      return null;
+    }
+    const keyPair = await getKeyPair();
+    if (!keyPair) {
+      console.error("Wallet not initialized");
+      return null;
+    }
+    const wallet = WalletContractV5R12.create({
+      workchain: 0,
+      publicKey: keyPair.publicKey
+    });
+    const endpoint = await getCachedHttpEndpoint();
+    const client = new TonClient2({ endpoint });
+    const contract = client.open(wallet);
+    const seqno = await contract.getSeqno();
+    await contract.sendTransfer({
+      seqno,
+      secretKey: keyPair.secretKey,
+      sendMode: SendMode.PAY_GAS_SEPARATELY + SendMode.IGNORE_ERRORS,
+      messages: [
+        internal({
+          to: recipientAddress,
+          value: toNano(amount),
+          body: comment,
+          bounce
+        })
+      ]
+    });
+    const pseudoHash = `${seqno}_${Date.now()}_${amount.toFixed(2)}`;
+    console.log(`\u{1F4B8} [TON] Sent ${amount} TON to ${toAddress.slice(0, 8)}... - seqno: ${seqno}`);
+    return pseudoHash;
+  } catch (error) {
+    console.error("Error sending TON:", error);
+    return null;
+  }
+}
+
+// src/utils/retry.ts
+var DEFAULT_OPTIONS = {
+  maxAttempts: RETRY_DEFAULT_MAX_ATTEMPTS,
+  baseDelayMs: RETRY_DEFAULT_BASE_DELAY_MS,
+  maxDelayMs: RETRY_DEFAULT_MAX_DELAY_MS,
+  timeout: RETRY_DEFAULT_TIMEOUT_MS
+};
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function withRetry(fn, options = {}) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  let lastError;
+  for (let attempt = 1; attempt <= opts.maxAttempts; attempt++) {
+    try {
+      const result = await Promise.race([
+        fn(),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error("Operation timeout")), opts.timeout)
+        )
+      ]);
+      return result;
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+      console.warn(`Retry attempt ${attempt}/${opts.maxAttempts} failed:`, lastError.message);
+      if (attempt < opts.maxAttempts) {
+        const delay = Math.min(opts.baseDelayMs * Math.pow(2, attempt - 1), opts.maxDelayMs);
+        await sleep(delay);
+      }
+    }
+  }
+  throw lastError || new Error("All retry attempts failed");
+}
+async function withBlockchainRetry(fn, operation = "blockchain operation") {
+  try {
+    return await withRetry(fn, {
+      maxAttempts: RETRY_DEFAULT_MAX_ATTEMPTS,
+      baseDelayMs: RETRY_BLOCKCHAIN_BASE_DELAY_MS,
+      maxDelayMs: RETRY_BLOCKCHAIN_MAX_DELAY_MS,
+      timeout: RETRY_BLOCKCHAIN_TIMEOUT_MS
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`${operation} failed after retries: ${message}`);
+  }
+}
+
+// src/sdk/ton.ts
+var DEFAULT_MAX_AGE_MINUTES = 10;
+var DEFAULT_TX_RETENTION_DAYS = 30;
+var CLEANUP_PROBABILITY = 0.1;
+function cleanupOldTransactions(db, retentionDays, log) {
+  if (Math.random() > CLEANUP_PROBABILITY) return;
+  try {
+    const cutoff = Math.floor(Date.now() / 1e3) - retentionDays * 24 * 60 * 60;
+    const result = db.prepare("DELETE FROM used_transactions WHERE used_at < ?").run(cutoff);
+    if (result.changes > 0) {
+      log.debug(`Cleaned up ${result.changes} old transaction records (>${retentionDays}d)`);
+    }
+  } catch (err) {
+    log.error("Transaction cleanup failed:", err);
+  }
+}
+function createTonSDK(log, db) {
+  return {
+    getAddress() {
+      try {
+        return getWalletAddress();
+      } catch (err) {
+        log.error("ton.getAddress() failed:", err);
+        return null;
+      }
+    },
+    async getBalance(address) {
+      try {
+        const addr = address ?? getWalletAddress();
+        if (!addr) return null;
+        return await getWalletBalance(addr);
+      } catch (err) {
+        log.error("ton.getBalance() failed:", err);
+        return null;
+      }
+    },
+    async getPrice() {
+      try {
+        return await getTonPrice();
+      } catch (err) {
+        log.error("ton.getPrice() failed:", err);
+        return null;
+      }
+    },
+    async sendTON(to, amount, comment) {
+      const walletAddr = getWalletAddress();
+      if (!walletAddr) {
+        throw new PluginSDKError("Wallet not initialized", "WALLET_NOT_INITIALIZED");
+      }
+      if (!Number.isFinite(amount) || amount <= 0) {
+        throw new PluginSDKError("Amount must be a positive number", "OPERATION_FAILED");
+      }
+      try {
+        const { Address: Address2 } = await import("@ton/core");
+        Address2.parse(to);
+      } catch {
+        throw new PluginSDKError("Invalid TON address format", "INVALID_ADDRESS");
+      }
+      try {
+        const txRef = await sendTon({
+          toAddress: to,
+          amount,
+          comment,
+          bounce: false
+        });
+        if (!txRef) {
+          throw new PluginSDKError(
+            "Transaction failed \u2014 no reference returned",
+            "OPERATION_FAILED"
+          );
+        }
+        return { txRef, amount };
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send TON: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getTransactions(address, limit) {
+      try {
+        const { TonClient: TonClient3 } = await import("@ton/ton");
+        const { Address: Address2 } = await import("@ton/core");
+        const { getCachedHttpEndpoint: getCachedHttpEndpoint2 } = await import("./endpoint-FLYNEZ2F.js");
+        const { formatTransactions } = await import("./format-transactions-FD74HI5N.js");
+        const addressObj = Address2.parse(address);
+        const endpoint = await getCachedHttpEndpoint2();
+        const client = new TonClient3({ endpoint });
+        const transactions = await withBlockchainRetry(
+          () => client.getTransactions(addressObj, {
+            limit: Math.min(limit ?? 10, 50)
+          }),
+          "sdk.ton.getTransactions"
+        );
+        return formatTransactions(transactions);
+      } catch (err) {
+        log.error("ton.getTransactions() failed:", err);
+        return [];
+      }
+    },
+    async verifyPayment(params) {
+      if (!db) {
+        throw new PluginSDKError(
+          "No database available \u2014 verifyPayment requires migrate() with used_transactions table",
+          "OPERATION_FAILED"
+        );
+      }
+      const address = getWalletAddress();
+      if (!address) {
+        throw new PluginSDKError("Wallet not initialized", "WALLET_NOT_INITIALIZED");
+      }
+      const maxAgeMinutes = params.maxAgeMinutes ?? DEFAULT_MAX_AGE_MINUTES;
+      cleanupOldTransactions(db, DEFAULT_TX_RETENTION_DAYS, log);
+      try {
+        const txs = await this.getTransactions(address, 20);
+        for (const tx of txs) {
+          if (tx.type !== "ton_received") continue;
+          if (!tx.amount || !tx.from) continue;
+          const tonAmount = parseFloat(tx.amount.replace(/ TON$/, ""));
+          if (isNaN(tonAmount)) continue;
+          if (tonAmount < params.amount * PAYMENT_TOLERANCE_RATIO) continue;
+          if (tx.secondsAgo > maxAgeMinutes * 60) continue;
+          const memo = (tx.comment ?? "").trim().toLowerCase().replace(/^@/, "");
+          const expected = params.memo.toLowerCase().replace(/^@/, "");
+          if (memo !== expected) continue;
+          const txHash = tx.hash;
+          const result = db.prepare(
+            `INSERT OR IGNORE INTO used_transactions (tx_hash, user_id, amount, game_type, used_at)
+               VALUES (?, ?, ?, ?, unixepoch())`
+          ).run(txHash, params.memo, tonAmount, params.gameType);
+          if (result.changes === 0) continue;
+          return {
+            verified: true,
+            txHash,
+            amount: tonAmount,
+            playerWallet: tx.from,
+            date: tx.date,
+            secondsAgo: tx.secondsAgo
+          };
+        }
+        return {
+          verified: false,
+          error: `Payment not found. Send ${params.amount} TON to ${address} with memo: ${params.memo}`
+        };
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        log.error("ton.verifyPayment() failed:", err);
+        return {
+          verified: false,
+          error: `Verification failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    },
+    // ─── Jettons ─────────────────────────────────────────────────
+    async getJettonBalances(ownerAddress) {
+      try {
+        const addr = ownerAddress ?? getWalletAddress();
+        if (!addr) return [];
+        const response = await tonapiFetch(`/accounts/${addr}/jettons`);
+        if (!response.ok) {
+          log.error(`ton.getJettonBalances() TonAPI error: ${response.status}`);
+          return [];
+        }
+        const data = await response.json();
+        const balances = [];
+        for (const item of data.balances || []) {
+          const { balance, wallet_address, jetton } = item;
+          if (jetton.verification === "blacklist") continue;
+          const decimals = jetton.decimals || 9;
+          const rawBalance = BigInt(balance);
+          const divisor = BigInt(10 ** decimals);
+          const wholePart = rawBalance / divisor;
+          const fractionalPart = rawBalance % divisor;
+          const balanceFormatted = fractionalPart === BigInt(0) ? wholePart.toString() : `${wholePart}.${fractionalPart.toString().padStart(decimals, "0").replace(/0+$/, "")}`;
+          balances.push({
+            jettonAddress: jetton.address,
+            walletAddress: wallet_address.address,
+            balance,
+            balanceFormatted,
+            symbol: jetton.symbol || "UNKNOWN",
+            name: jetton.name || "Unknown Token",
+            decimals,
+            verified: jetton.verification === "whitelist",
+            usdPrice: item.price?.prices?.USD ? Number(item.price.prices.USD) : void 0
+          });
+        }
+        return balances;
+      } catch (err) {
+        log.error("ton.getJettonBalances() failed:", err);
+        return [];
+      }
+    },
+    async getJettonInfo(jettonAddress) {
+      try {
+        const response = await tonapiFetch(`/jettons/${jettonAddress}`);
+        if (response.status === 404) return null;
+        if (!response.ok) {
+          log.error(`ton.getJettonInfo() TonAPI error: ${response.status}`);
+          return null;
+        }
+        const data = await response.json();
+        const metadata = data.metadata || {};
+        const decimals = parseInt(metadata.decimals || "9");
+        return {
+          address: metadata.address || jettonAddress,
+          name: metadata.name || "Unknown",
+          symbol: metadata.symbol || "UNKNOWN",
+          decimals,
+          totalSupply: data.total_supply || "0",
+          holdersCount: data.holders_count || 0,
+          verified: data.verification === "whitelist",
+          description: metadata.description || void 0,
+          image: data.preview || metadata.image || void 0
+        };
+      } catch (err) {
+        log.error("ton.getJettonInfo() failed:", err);
+        return null;
+      }
+    },
+    async sendJetton(jettonAddress, to, amount, opts) {
+      const { Address: Address2, beginCell, SendMode: SendMode2 } = await import("@ton/core");
+      const { WalletContractV5R1: WalletContractV5R13, TonClient: TonClient3, toNano: toNano2, internal: internal2 } = await import("@ton/ton");
+      const { getCachedHttpEndpoint: getCachedHttpEndpoint2 } = await import("./endpoint-FLYNEZ2F.js");
+      const walletData = loadWallet();
+      if (!walletData) {
+        throw new PluginSDKError("Wallet not initialized", "WALLET_NOT_INITIALIZED");
+      }
+      if (!Number.isFinite(amount) || amount <= 0) {
+        throw new PluginSDKError("Amount must be a positive number", "OPERATION_FAILED");
+      }
+      try {
+        Address2.parse(to);
+      } catch {
+        throw new PluginSDKError("Invalid recipient address", "INVALID_ADDRESS");
+      }
+      const jettonsResponse = await tonapiFetch(`/accounts/${walletData.address}/jettons`);
+      if (!jettonsResponse.ok) {
+        throw new PluginSDKError(
+          `Failed to fetch jetton balances: ${jettonsResponse.status}`,
+          "OPERATION_FAILED"
+        );
+      }
+      const jettonsData = await jettonsResponse.json();
+      const jettonBalance = jettonsData.balances?.find(
+        (b) => b.jetton.address.toLowerCase() === jettonAddress.toLowerCase() || Address2.parse(b.jetton.address).toString() === Address2.parse(jettonAddress).toString()
+      );
+      if (!jettonBalance) {
+        throw new PluginSDKError(
+          `You don't own any of this jetton: ${jettonAddress}`,
+          "OPERATION_FAILED"
+        );
+      }
+      const senderJettonWallet = jettonBalance.wallet_address.address;
+      const decimals = jettonBalance.jetton.decimals || 9;
+      const currentBalance = BigInt(jettonBalance.balance);
+      const amountInUnits = BigInt(Math.floor(amount * 10 ** decimals));
+      if (amountInUnits > currentBalance) {
+        throw new PluginSDKError(
+          `Insufficient balance. Have ${Number(currentBalance) / 10 ** decimals}, need ${amount}`,
+          "OPERATION_FAILED"
+        );
+      }
+      const comment = opts?.comment;
+      let forwardPayload = beginCell().endCell();
+      if (comment) {
+        forwardPayload = beginCell().storeUint(0, 32).storeStringTail(comment).endCell();
+      }
+      const JETTON_TRANSFER_OP = 260734629;
+      const messageBody = beginCell().storeUint(JETTON_TRANSFER_OP, 32).storeUint(0, 64).storeCoins(amountInUnits).storeAddress(Address2.parse(to)).storeAddress(Address2.parse(walletData.address)).storeBit(false).storeCoins(comment ? toNano2("0.01") : BigInt(1)).storeBit(comment ? true : false).storeMaybeRef(comment ? forwardPayload : null).endCell();
+      const keyPair = await getKeyPair();
+      if (!keyPair) {
+        throw new PluginSDKError("Wallet key derivation failed", "OPERATION_FAILED");
+      }
+      const wallet = WalletContractV5R13.create({
+        workchain: 0,
+        publicKey: keyPair.publicKey
+      });
+      const endpoint = await getCachedHttpEndpoint2();
+      const client = new TonClient3({ endpoint });
+      const walletContract = client.open(wallet);
+      const seqno = await walletContract.getSeqno();
+      await walletContract.sendTransfer({
+        seqno,
+        secretKey: keyPair.secretKey,
+        sendMode: SendMode2.PAY_GAS_SEPARATELY + SendMode2.IGNORE_ERRORS,
+        messages: [
+          internal2({
+            to: Address2.parse(senderJettonWallet),
+            value: toNano2("0.05"),
+            body: messageBody,
+            bounce: true
+          })
+        ]
+      });
+      return { success: true, seqno };
+    },
+    async getJettonWalletAddress(ownerAddress, jettonAddress) {
+      try {
+        const response = await tonapiFetch(`/accounts/${ownerAddress}/jettons`);
+        if (!response.ok) {
+          log.error(`ton.getJettonWalletAddress() TonAPI error: ${response.status}`);
+          return null;
+        }
+        const { Address: Address2 } = await import("@ton/core");
+        const data = await response.json();
+        const match = (data.balances || []).find(
+          (b) => b.jetton.address.toLowerCase() === jettonAddress.toLowerCase() || Address2.parse(b.jetton.address).toString() === Address2.parse(jettonAddress).toString()
+        );
+        return match ? match.wallet_address.address : null;
+      } catch (err) {
+        log.error("ton.getJettonWalletAddress() failed:", err);
+        return null;
+      }
+    },
+    // ─── NFT ─────────────────────────────────────────────────────
+    async getNftItems(ownerAddress) {
+      try {
+        const addr = ownerAddress ?? getWalletAddress();
+        if (!addr) return [];
+        const response = await tonapiFetch(
+          `/accounts/${encodeURIComponent(addr)}/nfts?limit=100&indirect_ownership=true`
+        );
+        if (!response.ok) {
+          log.error(`ton.getNftItems() TonAPI error: ${response.status}`);
+          return [];
+        }
+        const data = await response.json();
+        if (!Array.isArray(data.nft_items)) return [];
+        return data.nft_items.filter((item) => item.trust !== "blacklist").map((item) => mapNftItem(item));
+      } catch (err) {
+        log.error("ton.getNftItems() failed:", err);
+        return [];
+      }
+    },
+    async getNftInfo(nftAddress) {
+      try {
+        const response = await tonapiFetch(`/nfts/${nftAddress}`);
+        if (response.status === 404) return null;
+        if (!response.ok) {
+          log.error(`ton.getNftInfo() TonAPI error: ${response.status}`);
+          return null;
+        }
+        const item = await response.json();
+        return mapNftItem(item);
+      } catch (err) {
+        log.error("ton.getNftInfo() failed:", err);
+        return null;
+      }
+    },
+    // ─── Utilities ───────────────────────────────────────────────
+    toNano(amount) {
+      try {
+        const { toNano: convert } = __require("@ton/ton");
+        return convert(String(amount));
+      } catch (err) {
+        throw new PluginSDKError(
+          `toNano conversion failed: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    fromNano(nano) {
+      const { fromNano: convert } = __require("@ton/ton");
+      return convert(nano);
+    },
+    validateAddress(address) {
+      try {
+        const { Address: Address2 } = __require("@ton/core");
+        Address2.parse(address);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function mapNftItem(item) {
+  const meta = item.metadata || {};
+  const coll = item.collection || {};
+  const previews = item.previews || [];
+  const preview = previews.length > 1 && previews[1].url || previews.length > 0 && previews[0].url || void 0;
+  return {
+    address: item.address,
+    index: item.index ?? 0,
+    ownerAddress: item.owner?.address || void 0,
+    collectionAddress: coll.address || void 0,
+    collectionName: coll.name || void 0,
+    name: meta.name || void 0,
+    description: meta.description ? meta.description.slice(0, 200) : void 0,
+    image: preview || meta.image || void 0,
+    verified: item.trust === "whitelist"
+  };
+}
+
+// src/sdk/telegram.ts
+import { randomBytes as randomBytes3 } from "crypto";
+
+// src/sdk/telegram-messages.ts
+import { randomBytes } from "crypto";
+function createTelegramMessagesSDK(bridge, log) {
+  function requireBridge() {
+    if (!bridge.isAvailable()) {
+      throw new PluginSDKError(
+        "Telegram bridge not connected. SDK telegram methods can only be called at runtime (inside tool executors or start()), not during plugin loading.",
+        "BRIDGE_NOT_CONNECTED"
+      );
+    }
+  }
+  function getClient() {
+    return bridge.getClient().getClient();
+  }
+  function toSimpleMessage(msg) {
+    return {
+      id: msg.id,
+      text: msg.message ?? "",
+      senderId: Number(msg.fromId?.userId ?? msg.fromId?.channelId ?? 0),
+      timestamp: new Date(msg.date * 1e3)
+    };
+  }
+  return {
+    // ─── Messages ──────────────────────────────────────────────
+    async deleteMessage(chatId, messageId, revoke = true) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const isChannel = chatId.startsWith("-100");
+        if (isChannel) {
+          const channel = await gramJsClient.getEntity(chatId);
+          await gramJsClient.invoke(
+            new Api.channels.DeleteMessages({
+              channel,
+              id: [messageId]
+            })
+          );
+        } else {
+          await gramJsClient.invoke(
+            new Api.messages.DeleteMessages({
+              id: [messageId],
+              revoke
+            })
+          );
+        }
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to delete message: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async forwardMessage(fromChatId, toChatId, messageId) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const result = await gramJsClient.invoke(
+          new Api.messages.ForwardMessages({
+            fromPeer: fromChatId,
+            toPeer: toChatId,
+            id: [messageId],
+            randomId: [randomBytes(8).readBigUInt64BE()]
+          })
+        );
+        const updates = result;
+        if (updates.updates) {
+          for (const update of updates.updates) {
+            if (update.className === "UpdateNewMessage" || update.className === "UpdateNewChannelMessage") {
+              return update.message.id;
+            }
+          }
+        }
+        return 0;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to forward message: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async pinMessage(chatId, messageId, opts) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        await gramJsClient.invoke(
+          new Api.messages.UpdatePinnedMessage({
+            peer: chatId,
+            id: messageId,
+            silent: opts?.silent,
+            unpin: opts?.unpin
+          })
+        );
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to ${opts?.unpin ? "unpin" : "pin"} message: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async searchMessages(chatId, query, limit = 20) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const entity = await gramJsClient.getEntity(chatId);
+        const result = await gramJsClient.invoke(
+          new Api.messages.Search({
+            peer: entity,
+            q: query,
+            filter: new Api.InputMessagesFilterEmpty(),
+            limit
+          })
+        );
+        const resultData = result;
+        return (resultData.messages ?? []).map(toSimpleMessage);
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        log.error("telegram.searchMessages() failed:", err);
+        return [];
+      }
+    },
+    async scheduleMessage(chatId, text, scheduleDate) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const result = await gramJsClient.sendMessage(chatId, {
+          message: text,
+          schedule: scheduleDate
+        });
+        return result.id ?? 0;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to schedule message: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getReplies(chatId, messageId, limit = 50) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const bigInt = (await import("./BigInteger-DQ33LTTE.js")).default;
+        const peer = await gramJsClient.getInputEntity(chatId);
+        const result = await gramJsClient.invoke(
+          new Api.messages.GetReplies({
+            peer,
+            msgId: messageId,
+            offsetId: 0,
+            offsetDate: 0,
+            addOffset: 0,
+            limit,
+            maxId: 0,
+            minId: 0,
+            hash: bigInt(0)
+          })
+        );
+        const messages = [];
+        if ("messages" in result) {
+          for (const msg of result.messages) {
+            if (msg.className === "Message") {
+              messages.push(toSimpleMessage(msg));
+            }
+          }
+        }
+        messages.sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
+        return messages;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to get replies: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    // ─── Media ─────────────────────────────────────────────────
+    async sendPhoto(chatId, photo, opts) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const result = await gramJsClient.sendFile(chatId, {
+          file: photo,
+          caption: opts?.caption,
+          replyTo: opts?.replyToId
+        });
+        return result.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send photo: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendVideo(chatId, video, opts) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const result = await gramJsClient.sendFile(chatId, {
+          file: video,
+          caption: opts?.caption,
+          replyTo: opts?.replyToId,
+          forceDocument: false,
+          attributes: [
+            new Api.DocumentAttributeVideo({
+              roundMessage: false,
+              supportsStreaming: true,
+              duration: 0,
+              w: 0,
+              h: 0
+            })
+          ]
+        });
+        return result.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send video: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendVoice(chatId, voice, opts) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const result = await gramJsClient.sendFile(chatId, {
+          file: voice,
+          caption: opts?.caption,
+          replyTo: opts?.replyToId,
+          attributes: [new Api.DocumentAttributeAudio({ voice: true, duration: 0 })]
+        });
+        return result.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send voice: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendFile(chatId, file, opts) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const attributes = [];
+        if (opts?.fileName) {
+          attributes.push(new Api.DocumentAttributeFilename({ fileName: opts.fileName }));
+        }
+        const result = await gramJsClient.sendFile(chatId, {
+          file,
+          caption: opts?.caption,
+          replyTo: opts?.replyToId,
+          forceDocument: true,
+          attributes: attributes.length > 0 ? attributes : void 0
+        });
+        return result.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send file: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendGif(chatId, gif, opts) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const { Api } = await import("telegram");
+        const result = await gramJsClient.sendFile(chatId, {
+          file: gif,
+          caption: opts?.caption,
+          replyTo: opts?.replyToId,
+          attributes: [new Api.DocumentAttributeAnimated()]
+        });
+        return result.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send GIF: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendSticker(chatId, sticker) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const result = await gramJsClient.sendFile(chatId, {
+          file: sticker
+        });
+        return result.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send sticker: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async downloadMedia(chatId, messageId) {
+      requireBridge();
+      try {
+        const gramJsClient = getClient();
+        const messages = await gramJsClient.getMessages(chatId, {
+          ids: [messageId]
+        });
+        if (!messages || messages.length === 0 || !messages[0].media) {
+          return null;
+        }
+        const buffer = await gramJsClient.downloadMedia(messages[0], {});
+        return buffer ? Buffer.from(buffer) : null;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to download media: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    // ─── Advanced ──────────────────────────────────────────────
+    async setTyping(chatId) {
+      requireBridge();
+      try {
+        await bridge.setTyping(chatId);
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to set typing: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    }
+  };
+}
+
+// src/sdk/telegram-social.ts
+import { randomBytes as randomBytes2 } from "crypto";
+function createTelegramSocialSDK(bridge, log) {
+  function requireBridge() {
+    if (!bridge.isAvailable()) {
+      throw new PluginSDKError(
+        "Telegram bridge not connected. SDK telegram methods can only be called at runtime (inside tool executors or start()), not during plugin loading.",
+        "BRIDGE_NOT_CONNECTED"
+      );
+    }
+  }
+  function getClient() {
+    return bridge.getClient().getClient();
+  }
+  return {
+    // ─── Chat & Users ─────────────────────────────────────────
+    async getChatInfo(chatId) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        let entity;
+        try {
+          entity = await client.getEntity(chatId);
+        } catch {
+          return null;
+        }
+        const isChannel = entity.className === "Channel" || entity.className === "ChannelForbidden";
+        const isChat = entity.className === "Chat" || entity.className === "ChatForbidden";
+        const isUser = entity.className === "User";
+        if (isUser) {
+          const user = entity;
+          return {
+            id: user.id?.toString() || chatId,
+            title: [user.firstName, user.lastName].filter(Boolean).join(" ") || "Unknown",
+            type: "private",
+            username: user.username || void 0
+          };
+        }
+        if (isChannel) {
+          const channel = entity;
+          let description;
+          let membersCount;
+          try {
+            const fullChannel = await client.invoke(
+              new Api.channels.GetFullChannel({ channel: entity })
+            );
+            const fullChat = fullChannel.fullChat;
+            description = fullChat.about || void 0;
+            membersCount = fullChat.participantsCount || void 0;
+          } catch {
+          }
+          const type = channel.megagroup ? "supergroup" : channel.broadcast ? "channel" : "group";
+          return {
+            id: channel.id?.toString() || chatId,
+            title: channel.title || "Unknown",
+            type,
+            username: channel.username || void 0,
+            description,
+            membersCount
+          };
+        }
+        if (isChat) {
+          const chat = entity;
+          let description;
+          try {
+            const fullChatResult = await client.invoke(
+              new Api.messages.GetFullChat({ chatId: chat.id })
+            );
+            const fullChat = fullChatResult.fullChat;
+            description = fullChat.about || void 0;
+          } catch {
+          }
+          return {
+            id: chat.id?.toString() || chatId,
+            title: chat.title || "Unknown",
+            type: "group",
+            description,
+            membersCount: chat.participantsCount || void 0
+          };
+        }
+        return null;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        log.error("telegram.getChatInfo() failed:", err);
+        return null;
+      }
+    },
+    async getUserInfo(userId) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        let entity;
+        try {
+          const id = typeof userId === "string" ? userId.replace("@", "") : userId.toString();
+          entity = await client.getEntity(id);
+        } catch {
+          return null;
+        }
+        if (entity.className !== "User") return null;
+        const user = entity;
+        return {
+          id: Number(user.id),
+          firstName: user.firstName || "",
+          lastName: user.lastName || void 0,
+          username: user.username || void 0,
+          isBot: user.bot || false
+        };
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to get user info: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async resolveUsername(username) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const cleanUsername = username.replace("@", "").toLowerCase();
+        if (!cleanUsername) return null;
+        let result;
+        try {
+          result = await client.invoke(
+            new Api.contacts.ResolveUsername({ username: cleanUsername })
+          );
+        } catch (err) {
+          if (err.message?.includes("USERNAME_NOT_OCCUPIED") || err.errorMessage === "USERNAME_NOT_OCCUPIED") {
+            return null;
+          }
+          throw err;
+        }
+        if (result.users && result.users.length > 0) {
+          const user = result.users[0];
+          return {
+            id: Number(user.id),
+            type: "user",
+            username: user.username || void 0,
+            title: user.firstName || void 0
+          };
+        }
+        if (result.chats && result.chats.length > 0) {
+          const chat = result.chats[0];
+          const type = chat.className === "Channel" ? "channel" : "chat";
+          return {
+            id: Number(chat.id),
+            type,
+            username: chat.username || void 0,
+            title: chat.title || void 0
+          };
+        }
+        return null;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to resolve username: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getParticipants(chatId, limit) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const entity = await client.getEntity(chatId);
+        const result = await client.invoke(
+          new Api.channels.GetParticipants({
+            channel: entity,
+            filter: new Api.ChannelParticipantsRecent(),
+            offset: 0,
+            limit: limit ?? 100,
+            hash: 0
+          })
+        );
+        const resultData = result;
+        return (resultData.users || []).map((user) => ({
+          id: Number(user.id),
+          firstName: user.firstName || "",
+          lastName: user.lastName || void 0,
+          username: user.username || void 0,
+          isBot: user.bot || false
+        }));
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        log.error("telegram.getParticipants() failed:", err);
+        return [];
+      }
+    },
+    // ─── Interactive ──────────────────────────────────────────
+    async createPoll(chatId, question, answers, opts) {
+      requireBridge();
+      if (!answers || answers.length < 2) {
+        throw new PluginSDKError("Poll must have at least 2 answers", "OPERATION_FAILED");
+      }
+      if (answers.length > 10) {
+        throw new PluginSDKError("Poll cannot have more than 10 answers", "OPERATION_FAILED");
+      }
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const anonymous = opts?.isAnonymous ?? true;
+        const multipleChoice = opts?.multipleChoice ?? false;
+        const poll = new Api.Poll({
+          id: randomBytes2(8).readBigUInt64BE(),
+          question: new Api.TextWithEntities({ text: question, entities: [] }),
+          answers: answers.map(
+            (opt, idx) => new Api.PollAnswer({
+              text: new Api.TextWithEntities({ text: opt, entities: [] }),
+              option: Buffer.from([idx])
+            })
+          ),
+          publicVoters: !anonymous,
+          multipleChoice
+        });
+        const result = await client.invoke(
+          new Api.messages.SendMedia({
+            peer: chatId,
+            media: new Api.InputMediaPoll({ poll }),
+            message: "",
+            randomId: randomBytes2(8).readBigUInt64BE()
+          })
+        );
+        if (result.className === "Updates" || result.className === "UpdatesCombined") {
+          for (const update of result.updates) {
+            if (update.className === "UpdateNewMessage" || update.className === "UpdateNewChannelMessage") {
+              return update.message?.id ?? 0;
+            }
+          }
+        }
+        return 0;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to create poll: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async createQuiz(chatId, question, answers, correctIndex, explanation) {
+      requireBridge();
+      if (!answers || answers.length < 2) {
+        throw new PluginSDKError("Quiz must have at least 2 answers", "OPERATION_FAILED");
+      }
+      if (answers.length > 10) {
+        throw new PluginSDKError("Quiz cannot have more than 10 answers", "OPERATION_FAILED");
+      }
+      if (correctIndex < 0 || correctIndex >= answers.length) {
+        throw new PluginSDKError(
+          `correctIndex ${correctIndex} is out of bounds (0-${answers.length - 1})`,
+          "OPERATION_FAILED"
+        );
+      }
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const poll = new Api.Poll({
+          id: randomBytes2(8).readBigUInt64BE(),
+          question: new Api.TextWithEntities({ text: question, entities: [] }),
+          answers: answers.map(
+            (opt, idx) => new Api.PollAnswer({
+              text: new Api.TextWithEntities({ text: opt, entities: [] }),
+              option: Buffer.from([idx])
+            })
+          ),
+          quiz: true,
+          publicVoters: false,
+          multipleChoice: false
+        });
+        const result = await client.invoke(
+          new Api.messages.SendMedia({
+            peer: chatId,
+            media: new Api.InputMediaPoll({
+              poll,
+              correctAnswers: [Buffer.from([correctIndex])],
+              solution: explanation,
+              solutionEntities: []
+            }),
+            message: "",
+            randomId: randomBytes2(8).readBigUInt64BE()
+          })
+        );
+        if (result.className === "Updates" || result.className === "UpdatesCombined") {
+          for (const update of result.updates) {
+            if (update.className === "UpdateNewMessage" || update.className === "UpdateNewChannelMessage") {
+              return update.message?.id ?? 0;
+            }
+          }
+        }
+        return 0;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to create quiz: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    // ─── Moderation ───────────────────────────────────────────
+    async banUser(chatId, userId) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        await client.invoke(
+          new Api.channels.EditBanned({
+            channel: chatId,
+            participant: userId.toString(),
+            bannedRights: new Api.ChatBannedRights({
+              untilDate: 0,
+              viewMessages: true,
+              sendMessages: true,
+              sendMedia: true,
+              sendStickers: true,
+              sendGifs: true,
+              sendGames: true,
+              sendInline: true,
+              embedLinks: true
+            })
+          })
+        );
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to ban user: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async unbanUser(chatId, userId) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        await client.invoke(
+          new Api.channels.EditBanned({
+            channel: chatId,
+            participant: userId.toString(),
+            bannedRights: new Api.ChatBannedRights({
+              untilDate: 0
+            })
+          })
+        );
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to unban user: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async muteUser(chatId, userId, untilDate) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        await client.invoke(
+          new Api.channels.EditBanned({
+            channel: chatId,
+            participant: userId.toString(),
+            bannedRights: new Api.ChatBannedRights({
+              untilDate: untilDate ?? 0,
+              sendMessages: true
+            })
+          })
+        );
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to mute user: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    // ─── Stars & Gifts ────────────────────────────────────────
+    async getStarsBalance() {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const result = await client.invoke(
+          new Api.payments.GetStarsStatus({
+            peer: new Api.InputPeerSelf()
+          })
+        );
+        return Number(result.balance?.amount?.toString() || "0");
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to get stars balance: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendGift(userId, giftId, opts) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const user = await client.getEntity(userId.toString());
+        const invoiceData = {
+          peer: user,
+          giftId: BigInt(giftId),
+          hideName: opts?.anonymous ?? false,
+          message: opts?.message ? new Api.TextWithEntities({ text: opts.message, entities: [] }) : void 0
+        };
+        const form = await client.invoke(
+          new Api.payments.GetPaymentForm({
+            invoice: new Api.InputInvoiceStarGift(invoiceData)
+          })
+        );
+        await client.invoke(
+          new Api.payments.SendStarsForm({
+            formId: form.formId,
+            invoice: new Api.InputInvoiceStarGift(invoiceData)
+          })
+        );
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send gift: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getAvailableGifts() {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const result = await client.invoke(new Api.payments.GetStarGifts({ hash: 0 }));
+        if (result.className === "payments.StarGiftsNotModified") {
+          return [];
+        }
+        return (result.gifts || []).filter((gift) => !gift.soldOut).map((gift) => ({
+          id: gift.id?.toString(),
+          starsAmount: Number(gift.stars?.toString() || "0"),
+          availableAmount: gift.limited ? Number(gift.availabilityRemains?.toString() || "0") : void 0,
+          totalAmount: gift.limited ? Number(gift.availabilityTotal?.toString() || "0") : void 0
+        }));
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to get available gifts: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getMyGifts(limit) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        const result = await client.invoke(
+          new Api.payments.GetSavedStarGifts({
+            peer: new Api.InputPeerSelf(),
+            offset: "",
+            limit: limit ?? 50
+          })
+        );
+        return (result.gifts || []).map((savedGift) => {
+          const gift = savedGift.gift;
+          return {
+            id: gift?.id?.toString() || "",
+            fromId: savedGift.fromId ? Number(savedGift.fromId) : void 0,
+            date: savedGift.date || 0,
+            starsAmount: Number(gift?.stars?.toString() || "0"),
+            saved: savedGift.unsaved !== true,
+            messageId: savedGift.msgId || void 0
+          };
+        });
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to get my gifts: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getResaleGifts(limit) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        if (!Api.payments.GetResaleStarGifts) {
+          throw new PluginSDKError(
+            "Resale gift marketplace is not supported in the current Telegram API layer.",
+            "OPERATION_FAILED"
+          );
+        }
+        const result = await client.invoke(
+          new Api.payments.GetResaleStarGifts({
+            offset: "",
+            limit: limit ?? 50
+          })
+        );
+        return (result.gifts || []).map((listing) => ({
+          id: listing.odayId?.toString() || "",
+          starsAmount: Number(listing.resellStars?.toString() || "0")
+        }));
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to get resale gifts: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async buyResaleGift(giftId) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api } = await import("telegram");
+        if (!Api.InputInvoiceStarGiftResale) {
+          throw new PluginSDKError(
+            "Resale gift purchasing is not supported in the current Telegram API layer.",
+            "OPERATION_FAILED"
+          );
+        }
+        const stargiftInput = new Api.InputSavedStarGiftUser({
+          odayId: BigInt(giftId)
+        });
+        const invoiceData = { stargift: stargiftInput };
+        const form = await client.invoke(
+          new Api.payments.GetPaymentForm({
+            invoice: new Api.InputInvoiceStarGiftResale(invoiceData)
+          })
+        );
+        await client.invoke(
+          new Api.payments.SendStarsForm({
+            formId: form.formId,
+            invoice: new Api.InputInvoiceStarGiftResale(invoiceData)
+          })
+        );
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to buy resale gift: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendStory(mediaPath, opts) {
+      requireBridge();
+      try {
+        const client = getClient();
+        const { Api, helpers } = await import("telegram");
+        const { CustomFile } = await import("telegram/client/uploads.js");
+        const { readFileSync: readFileSync5, statSync: statSync2 } = await import("fs");
+        const { basename: basename2 } = await import("path");
+        const filePath = mediaPath;
+        const fileName = basename2(filePath);
+        const fileSize = statSync2(filePath).size;
+        const fileBuffer = readFileSync5(filePath);
+        const isVideo = filePath.toLowerCase().match(/\.(mp4|mov|avi)$/);
+        const customFile = new CustomFile(fileName, fileSize, filePath, fileBuffer);
+        const uploadedFile = await client.uploadFile({
+          file: customFile,
+          workers: 1
+        });
+        let inputMedia;
+        if (isVideo) {
+          inputMedia = new Api.InputMediaUploadedDocument({
+            file: uploadedFile,
+            mimeType: "video/mp4",
+            attributes: [
+              new Api.DocumentAttributeVideo({
+                duration: 0,
+                w: 720,
+                h: 1280,
+                supportsStreaming: true
+              }),
+              new Api.DocumentAttributeFilename({ fileName })
+            ]
+          });
+        } else {
+          inputMedia = new Api.InputMediaUploadedPhoto({
+            file: uploadedFile
+          });
+        }
+        const privacyRules = [new Api.InputPrivacyValueAllowAll()];
+        const result = await client.invoke(
+          new Api.stories.SendStory({
+            peer: "me",
+            media: inputMedia,
+            caption: opts?.caption || "",
+            privacyRules,
+            randomId: helpers.generateRandomBigInt()
+          })
+        );
+        return result.id || 0;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send story: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    }
+  };
+}
+
+// src/sdk/telegram.ts
+function createTelegramSDK(bridge, log) {
+  function requireBridge() {
+    if (!bridge.isAvailable()) {
+      throw new PluginSDKError(
+        "Telegram bridge not connected. SDK telegram methods can only be called at runtime (inside tool executors or start()), not during plugin loading.",
+        "BRIDGE_NOT_CONNECTED"
+      );
+    }
+  }
+  return {
+    async sendMessage(chatId, text, opts) {
+      requireBridge();
+      try {
+        const msg = await bridge.sendMessage({
+          chatId,
+          text,
+          replyToId: opts?.replyToId,
+          inlineKeyboard: opts?.inlineKeyboard
+        });
+        return msg.id;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send message: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async editMessage(chatId, messageId, text, opts) {
+      requireBridge();
+      try {
+        const msg = await bridge.editMessage({
+          chatId,
+          messageId,
+          text,
+          inlineKeyboard: opts?.inlineKeyboard
+        });
+        return typeof msg?.id === "number" ? msg.id : messageId;
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to edit message: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendDice(chatId, emoticon, replyToId) {
+      requireBridge();
+      try {
+        const gramJsClient = bridge.getClient().getClient();
+        const { Api } = await import("telegram");
+        const result = await gramJsClient.invoke(
+          new Api.messages.SendMedia({
+            peer: chatId,
+            media: new Api.InputMediaDice({ emoticon }),
+            message: "",
+            randomId: randomBytes3(8).readBigUInt64BE(),
+            replyTo: replyToId ? new Api.InputReplyToMessage({ replyToMsgId: replyToId }) : void 0
+          })
+        );
+        let value;
+        let messageId;
+        if (result.className === "Updates" || result.className === "UpdatesCombined") {
+          for (const update of result.updates) {
+            if (update.className === "UpdateNewMessage" || update.className === "UpdateNewChannelMessage") {
+              const msg = update.message;
+              if (msg?.media?.className === "MessageMediaDice") {
+                value = msg.media.value;
+                messageId = msg.id;
+                break;
+              }
+            }
+          }
+        }
+        if (value === void 0 || messageId === void 0) {
+          throw new Error("Could not extract dice value from Telegram response");
+        }
+        return { value, messageId };
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send dice: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async sendReaction(chatId, messageId, emoji) {
+      requireBridge();
+      try {
+        await bridge.sendReaction(chatId, messageId, emoji);
+      } catch (err) {
+        if (err instanceof PluginSDKError) throw err;
+        throw new PluginSDKError(
+          `Failed to send reaction: ${err instanceof Error ? err.message : String(err)}`,
+          "OPERATION_FAILED"
+        );
+      }
+    },
+    async getMessages(chatId, limit) {
+      requireBridge();
+      try {
+        const messages = await bridge.getMessages(chatId, limit ?? 50);
+        return messages.map((m) => ({
+          id: m.id,
+          text: m.text,
+          senderId: m.senderId,
+          senderUsername: m.senderUsername,
+          timestamp: m.timestamp
+        }));
+      } catch (err) {
+        log.error("telegram.getMessages() failed:", err);
+        return [];
+      }
+    },
+    getMe() {
+      try {
+        const me = bridge.getClient()?.getMe?.();
+        if (!me) return null;
+        return {
+          id: Number(me.id),
+          username: me.username,
+          firstName: me.firstName,
+          isBot: me.isBot
+        };
+      } catch {
+        return null;
+      }
+    },
+    isAvailable() {
+      return bridge.isAvailable();
+    },
+    getRawClient() {
+      if (!bridge.isAvailable()) return null;
+      try {
+        return bridge.getClient().getClient();
+      } catch {
+        return null;
+      }
+    },
+    // Spread extended methods from sub-modules
+    ...createTelegramMessagesSDK(bridge, log),
+    ...createTelegramSocialSDK(bridge, log)
+  };
+}
+
+// src/sdk/secrets.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
+var SECRETS_DIR = join3(TELETON_ROOT, "plugins", "data");
+function getSecretsPath(pluginName) {
+  return join3(SECRETS_DIR, `${pluginName}.secrets.json`);
+}
+function readSecretsFile(pluginName) {
+  const filePath = getSecretsPath(pluginName);
+  try {
+    if (!existsSync3(filePath)) return {};
+    const raw = readFileSync3(filePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function writePluginSecret(pluginName, key, value) {
+  mkdirSync3(SECRETS_DIR, { recursive: true });
+  const filePath = getSecretsPath(pluginName);
+  const existing = readSecretsFile(pluginName);
+  existing[key] = value;
+  writeFileSync3(filePath, JSON.stringify(existing, null, 2), { mode: 384 });
+}
+function deletePluginSecret(pluginName, key) {
+  const existing = readSecretsFile(pluginName);
+  if (!(key in existing)) return false;
+  delete existing[key];
+  const filePath = getSecretsPath(pluginName);
+  writeFileSync3(filePath, JSON.stringify(existing, null, 2), { mode: 384 });
+  return true;
+}
+function listPluginSecretKeys(pluginName) {
+  return Object.keys(readSecretsFile(pluginName));
+}
+function createSecretsSDK(pluginName, pluginConfig, log) {
+  const envPrefix = pluginName.replace(/-/g, "_").toUpperCase();
+  function get(key) {
+    const envKey = `${envPrefix}_${key.toUpperCase()}`;
+    const envValue = process.env[envKey];
+    if (envValue) {
+      log.debug(`Secret "${key}" resolved from env var ${envKey}`);
+      return envValue;
+    }
+    const stored = readSecretsFile(pluginName);
+    if (key in stored && stored[key]) {
+      log.debug(`Secret "${key}" resolved from secrets store`);
+      return stored[key];
+    }
+    const configValue = pluginConfig[key];
+    if (configValue !== void 0 && configValue !== null) {
+      log.debug(`Secret "${key}" resolved from pluginConfig`);
+      return String(configValue);
+    }
+    return void 0;
+  }
+  return {
+    get,
+    require(key) {
+      const value = get(key);
+      if (!value) {
+        throw new PluginSDKError(
+          `Missing required secret "${key}". Set it via: /plugin set ${pluginName} ${key} <value>`,
+          "SECRET_NOT_FOUND"
+        );
+      }
+      return value;
+    },
+    has(key) {
+      return get(key) !== void 0;
+    }
+  };
+}
+
+// src/sdk/storage.ts
+var KV_TABLE = "_kv";
+var CLEANUP_PROBABILITY2 = 0.05;
+function ensureTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS ${KV_TABLE} (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      expires_at INTEGER
+    )
+  `);
+}
+function createStorageSDK(db) {
+  ensureTable(db);
+  const stmtGet = db.prepare(`SELECT value, expires_at FROM ${KV_TABLE} WHERE key = ?`);
+  const stmtSet = db.prepare(
+    `INSERT OR REPLACE INTO ${KV_TABLE} (key, value, expires_at) VALUES (?, ?, ?)`
+  );
+  const stmtDel = db.prepare(`DELETE FROM ${KV_TABLE} WHERE key = ?`);
+  const stmtHas = db.prepare(`SELECT 1 FROM ${KV_TABLE} WHERE key = ?`);
+  const stmtClear = db.prepare(`DELETE FROM ${KV_TABLE}`);
+  const stmtCleanup = db.prepare(
+    `DELETE FROM ${KV_TABLE} WHERE expires_at IS NOT NULL AND expires_at < ?`
+  );
+  function maybeCleanup() {
+    if (Math.random() < CLEANUP_PROBABILITY2) {
+      stmtCleanup.run(Date.now());
+    }
+  }
+  return {
+    get(key) {
+      maybeCleanup();
+      const row = stmtGet.get(key);
+      if (!row) return void 0;
+      if (row.expires_at !== null && row.expires_at < Date.now()) {
+        stmtDel.run(key);
+        return void 0;
+      }
+      try {
+        return JSON.parse(row.value);
+      } catch {
+        return row.value;
+      }
+    },
+    set(key, value, opts) {
+      const serialized = JSON.stringify(value);
+      const expiresAt = opts?.ttl ? Date.now() + opts.ttl : null;
+      stmtSet.run(key, serialized, expiresAt);
+    },
+    delete(key) {
+      const result = stmtDel.run(key);
+      return result.changes > 0;
+    },
+    has(key) {
+      const row = stmtGet.get(key);
+      if (!row) return false;
+      if (row.expires_at !== null && row.expires_at < Date.now()) {
+        stmtDel.run(key);
+        return false;
+      }
+      return true;
+    },
+    clear() {
+      stmtClear.run();
+    }
+  };
+}
+
+// src/sdk/index.ts
+function createPluginSDK(deps, opts) {
+  const log = createLogger(opts.pluginName);
+  const ton = Object.freeze(createTonSDK(log, opts.db));
+  const telegram = Object.freeze(createTelegramSDK(deps.bridge, log));
+  const secrets = Object.freeze(createSecretsSDK(opts.pluginName, opts.pluginConfig, log));
+  const storage = opts.db ? Object.freeze(createStorageSDK(opts.db)) : null;
+  const frozenLog = Object.freeze(log);
+  const frozenConfig = Object.freeze(opts.sanitizedConfig);
+  const frozenPluginConfig = Object.freeze(opts.pluginConfig);
+  return Object.freeze({
+    version: SDK_VERSION,
+    ton,
+    telegram,
+    secrets,
+    storage,
+    db: opts.db,
+    config: frozenConfig,
+    pluginConfig: frozenPluginConfig,
+    log: frozenLog
+  });
+}
+function createLogger(pluginName) {
+  const prefix = `[${pluginName}]`;
+  return {
+    info: (...args) => console.log(prefix, ...args),
+    warn: (...args) => console.warn(`\u26A0\uFE0F ${prefix}`, ...args),
+    error: (...args) => console.error(`\u274C ${prefix}`, ...args),
+    debug: (...args) => {
+      if (process.env.DEBUG || process.env.VERBOSE) {
+        console.log(`\u{1F50D} ${prefix}`, ...args);
+      }
+    }
+  };
+}
+function parseSemver(v) {
+  const match = v.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return {
+    major: parseInt(match[1]),
+    minor: parseInt(match[2]),
+    patch: parseInt(match[3])
+  };
+}
+function semverGte(a, b) {
+  if (a.major !== b.major) return a.major > b.major;
+  if (a.minor !== b.minor) return a.minor > b.minor;
+  return a.patch >= b.patch;
+}
+function semverSatisfies(current, range) {
+  const cur = parseSemver(current);
+  if (!cur) {
+    console.warn(`\u26A0\uFE0F  [SDK] Could not parse current version "${current}", skipping check`);
+    return true;
+  }
+  if (range.startsWith(">=")) {
+    const req2 = parseSemver(range.slice(2));
+    if (!req2) {
+      console.warn(`\u26A0\uFE0F  [SDK] Malformed sdkVersion range "${range}", skipping check`);
+      return true;
+    }
+    return semverGte(cur, req2);
+  }
+  if (range.startsWith("^")) {
+    const req2 = parseSemver(range.slice(1));
+    if (!req2) {
+      console.warn(`\u26A0\uFE0F  [SDK] Malformed sdkVersion range "${range}", skipping check`);
+      return true;
+    }
+    if (req2.major === 0) {
+      return cur.major === 0 && cur.minor === req2.minor && semverGte(cur, req2);
+    }
+    return cur.major === req2.major && semverGte(cur, req2);
+  }
+  const req = parseSemver(range);
+  if (!req) {
+    console.warn(`\u26A0\uFE0F  [SDK] Malformed sdkVersion "${range}", skipping check`);
+    return true;
+  }
+  return cur.major === req.major && cur.minor === req.minor && cur.patch === req.patch;
+}
+
+// src/agent/tools/plugin-loader.ts
+var execFileAsync = promisify(execFile);
+var PLUGIN_DATA_DIR = join4(TELETON_ROOT, "plugins", "data");
+function adaptPlugin(raw, entryName, config, loadedModuleNames, sdkDeps) {
+  let manifest = null;
+  if (raw.manifest) {
+    try {
+      manifest = validateManifest(raw.manifest);
+    } catch (err) {
+      console.warn(
+        `\u26A0\uFE0F  [${entryName}] invalid manifest, ignoring:`,
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+  if (!manifest) {
+    const manifestPath = join4(WORKSPACE_PATHS.PLUGINS_DIR, entryName, "manifest.json");
+    try {
+      if (existsSync4(manifestPath)) {
+        const diskManifest = JSON.parse(readFileSync4(manifestPath, "utf-8"));
+        if (diskManifest && typeof diskManifest.version === "string") {
+          manifest = {
+            name: entryName,
+            version: diskManifest.version,
+            description: typeof diskManifest.description === "string" ? diskManifest.description : void 0,
+            author: typeof diskManifest.author === "string" ? diskManifest.author : diskManifest.author?.name ?? void 0
+          };
+        }
+      }
+    } catch {
+    }
+  }
+  const pluginName = manifest?.name ?? entryName.replace(/\.js$/, "");
+  const pluginVersion = manifest?.version ?? "0.0.0";
+  if (manifest?.dependencies) {
+    for (const dep of manifest.dependencies) {
+      if (!loadedModuleNames.includes(dep)) {
+        throw new Error(`Plugin "${pluginName}" requires module "${dep}" which is not loaded`);
+      }
+    }
+  }
+  if (manifest?.sdkVersion) {
+    if (!semverSatisfies(SDK_VERSION, manifest.sdkVersion)) {
+      throw new Error(
+        `Plugin "${pluginName}" requires SDK ${manifest.sdkVersion} but current SDK is ${SDK_VERSION}`
+      );
+    }
+  }
+  const pluginConfigKey = pluginName.replace(/-/g, "_");
+  const rawPluginConfig = config.plugins?.[pluginConfigKey] ?? {};
+  const pluginConfig = { ...manifest?.defaultConfig, ...rawPluginConfig };
+  const log = (...args) => console.log(`[${pluginName}]`, ...args);
+  if (manifest?.secrets) {
+    const dummyLogger = {
+      info: log,
+      warn: (...a) => console.warn(`\u26A0\uFE0F [${pluginName}]`, ...a),
+      error: (...a) => console.error(`\u274C [${pluginName}]`, ...a),
+      debug: () => {
+      }
+    };
+    const secretsCheck = createSecretsSDK(pluginName, pluginConfig, dummyLogger);
+    const missing = [];
+    for (const [key, decl] of Object.entries(
+      manifest.secrets
+    )) {
+      if (decl.required && !secretsCheck.has(key)) {
+        missing.push(`${key} \u2014 ${decl.description}`);
+      }
+    }
+    if (missing.length > 0) {
+      console.warn(
+        `\u26A0\uFE0F  [${pluginName}] Missing required secrets:
+` + missing.map((m) => `   \u2022 ${m}`).join("\n") + `
+   Set via: /plugin set ${pluginName} <key> <value>`
+      );
+    }
+  }
+  const hasMigrate = typeof raw.migrate === "function";
+  let pluginDb = null;
+  const getDb = () => pluginDb;
+  const withPluginDb = createDbWrapper(getDb, pluginName);
+  const sanitizedConfig = sanitizeConfigForPlugins(config);
+  const module = {
+    name: pluginName,
+    version: pluginVersion,
+    // Store event hooks from plugin exports
+    onMessage: typeof raw.onMessage === "function" ? raw.onMessage : void 0,
+    onCallbackQuery: typeof raw.onCallbackQuery === "function" ? raw.onCallbackQuery : void 0,
+    configure() {
+    },
+    migrate() {
+      try {
+        const dbPath = join4(PLUGIN_DATA_DIR, `${pluginName}.db`);
+        pluginDb = openModuleDb(dbPath);
+        if (hasMigrate) {
+          raw.migrate(pluginDb);
+          const pluginTables = pluginDb.prepare(
+            `SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'`
+          ).all().map((t) => t.name).filter((n) => n !== "_kv");
+          if (pluginTables.length > 0) {
+            migrateFromMainDb(pluginDb, pluginTables);
+          }
+        }
+      } catch (err) {
+        console.error(
+          `\u274C [${pluginName}] migrate() failed:`,
+          err instanceof Error ? err.message : err
+        );
+        if (pluginDb) {
+          try {
+            pluginDb.close();
+          } catch {
+          }
+          pluginDb = null;
+        }
+      }
+    },
+    tools() {
+      try {
+        let toolDefs;
+        if (typeof raw.tools === "function") {
+          const sdk = createPluginSDK(sdkDeps, {
+            pluginName,
+            db: pluginDb,
+            sanitizedConfig,
+            pluginConfig
+          });
+          toolDefs = raw.tools(sdk);
+        } else if (Array.isArray(raw.tools)) {
+          toolDefs = raw.tools;
+        } else {
+          return [];
+        }
+        const validDefs = validateToolDefs(toolDefs, pluginName);
+        return validDefs.map((def) => {
+          const rawExecutor = def.execute;
+          const sandboxedExecutor = (params, context) => {
+            const sanitizedContext = {
+              ...context,
+              config: context.config ? sanitizeConfigForPlugins(context.config) : void 0
+            };
+            return rawExecutor(params, sanitizedContext);
+          };
+          return {
+            tool: {
+              name: def.name,
+              description: def.description,
+              parameters: def.parameters || {
+                type: "object",
+                properties: {}
+              },
+              ...def.category ? { category: def.category } : {}
+            },
+            executor: pluginDb ? withPluginDb(sandboxedExecutor) : sandboxedExecutor,
+            scope: def.scope
+          };
+        });
+      } catch (err) {
+        console.error(
+          `\u274C [${pluginName}] tools() failed:`,
+          err instanceof Error ? err.message : err
+        );
+        return [];
+      }
+    },
+    async start(context) {
+      if (!raw.start) return;
+      try {
+        const enhancedContext = {
+          bridge: context.bridge,
+          db: pluginDb ?? null,
+          config: sanitizedConfig,
+          pluginConfig,
+          log
+        };
+        await raw.start(enhancedContext);
+      } catch (err) {
+        console.error(
+          `\u274C [${pluginName}] start() failed:`,
+          err instanceof Error ? err.message : err
+        );
+      }
+    },
+    async stop() {
+      try {
+        await raw.stop?.();
+      } catch (err) {
+        console.error(
+          `\u274C [${pluginName}] stop() failed:`,
+          err instanceof Error ? err.message : err
+        );
+      } finally {
+        if (pluginDb) {
+          try {
+            pluginDb.close();
+          } catch {
+          }
+          pluginDb = null;
+        }
+      }
+    }
+  };
+  return module;
+}
+async function ensurePluginDeps(pluginDir, pluginEntry) {
+  const pkgJson = join4(pluginDir, "package.json");
+  const lockfile = join4(pluginDir, "package-lock.json");
+  const nodeModules = join4(pluginDir, "node_modules");
+  if (!existsSync4(pkgJson)) return;
+  if (!existsSync4(lockfile)) {
+    console.warn(
+      `\u26A0\uFE0F  [${pluginEntry}] package.json without package-lock.json \u2014 skipping (lockfile required)`
+    );
+    return;
+  }
+  if (existsSync4(nodeModules)) {
+    const marker = join4(nodeModules, ".package-lock.json");
+    if (existsSync4(marker) && statSync(marker).mtimeMs >= statSync(lockfile).mtimeMs) return;
+  }
+  console.log(`\u{1F4E6} [${pluginEntry}] Installing dependencies...`);
+  try {
+    await execFileAsync("npm", ["ci", "--ignore-scripts", "--no-audit", "--no-fund"], {
+      cwd: pluginDir,
+      timeout: 6e4,
+      env: { ...process.env, NODE_ENV: "production" }
+    });
+    console.log(`\u{1F4E6} [${pluginEntry}] Dependencies installed`);
+  } catch (err) {
+    console.error(`\u274C [${pluginEntry}] Failed to install deps: ${String(err).slice(0, 300)}`);
+  }
+}
+async function loadEnhancedPlugins(config, loadedModuleNames, sdkDeps) {
+  const pluginsDir = WORKSPACE_PATHS.PLUGINS_DIR;
+  if (!existsSync4(pluginsDir)) {
+    return [];
+  }
+  const entries = readdirSync(pluginsDir);
+  const modules = [];
+  const loadedNames = /* @__PURE__ */ new Set();
+  const pluginPaths = [];
+  for (const entry of entries) {
+    if (entry === "data") continue;
+    const entryPath = join4(pluginsDir, entry);
+    let modulePath = null;
+    try {
+      const stat = statSync(entryPath);
+      if (stat.isFile() && entry.endsWith(".js")) {
+        modulePath = entryPath;
+      } else if (stat.isDirectory()) {
+        const indexPath = join4(entryPath, "index.js");
+        if (existsSync4(indexPath)) {
+          modulePath = indexPath;
+        }
+      }
+    } catch {
+      continue;
+    }
+    if (modulePath) {
+      pluginPaths.push({ entry, path: modulePath });
+    }
+  }
+  await Promise.allSettled(
+    pluginPaths.filter(({ path }) => path.endsWith("index.js")).map(({ entry }) => ensurePluginDeps(join4(pluginsDir, entry), entry))
+  );
+  const loadResults = await Promise.allSettled(
+    pluginPaths.map(async ({ entry, path }) => {
+      const moduleUrl = pathToFileURL(path).href;
+      const mod = await import(moduleUrl);
+      return { entry, mod };
+    })
+  );
+  for (const result of loadResults) {
+    if (result.status === "rejected") {
+      console.error(
+        `\u274C Plugin failed to load:`,
+        result.reason instanceof Error ? result.reason.message : result.reason
+      );
+      continue;
+    }
+    const { entry, mod } = result.value;
+    try {
+      if (!mod.tools || typeof mod.tools !== "function" && !Array.isArray(mod.tools)) {
+        console.warn(`\u26A0\uFE0F  Plugin "${entry}": no 'tools' array or function exported, skipping`);
+        continue;
+      }
+      const adapted = adaptPlugin(mod, entry, config, loadedModuleNames, sdkDeps);
+      if (loadedNames.has(adapted.name)) {
+        console.warn(
+          `\u26A0\uFE0F  Plugin "${adapted.name}" already loaded, skipping duplicate from "${entry}"`
+        );
+        continue;
+      }
+      loadedNames.add(adapted.name);
+      modules.push(adapted);
+    } catch (err) {
+      console.error(
+        `\u274C Plugin "${entry}" failed to adapt:`,
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+  return modules;
+}
+
+// src/workspace/validator.ts
+import { existsSync as existsSync5, lstatSync, readdirSync as readdirSync2 } from "fs";
+import { resolve, normalize, relative, extname, basename } from "path";
+import { homedir as homedir2 } from "os";
+var WorkspaceSecurityError = class extends Error {
+  constructor(message, attemptedPath) {
+    super(message);
+    this.attemptedPath = attemptedPath;
+    this.name = "WorkspaceSecurityError";
+  }
+};
+function decodeRecursive(str) {
+  let decoded = str;
+  let prev = "";
+  let iterations = 0;
+  const maxIterations = 10;
+  while (decoded !== prev && iterations < maxIterations) {
+    prev = decoded;
+    try {
+      decoded = decodeURIComponent(decoded);
+    } catch {
+      break;
+    }
+    iterations++;
+  }
+  return decoded;
+}
+function validatePath(inputPath, allowCreate = false) {
+  if (!inputPath || inputPath.trim() === "") {
+    throw new WorkspaceSecurityError("Path cannot be empty.", inputPath);
+  }
+  const trimmedPath = inputPath.trim().replace(/\\/g, "/");
+  const decodedPath = decodeRecursive(trimmedPath);
+  let absolutePath;
+  if (decodedPath.startsWith("/")) {
+    absolutePath = resolve(normalize(decodedPath));
+  } else if (decodedPath.startsWith("~/")) {
+    const expanded = decodedPath.replace(/^~(?=$|[\\/])/, homedir2());
+    absolutePath = resolve(expanded);
+  } else {
+    absolutePath = resolve(WORKSPACE_ROOT, normalize(decodedPath));
+  }
+  const relativePath = relative(WORKSPACE_ROOT, absolutePath);
+  if (relativePath.startsWith("..") || relativePath.startsWith("/")) {
+    throw new WorkspaceSecurityError(
+      `Access denied: Path '${inputPath}' is outside the workspace. Only files in ~/.teleton/workspace/ are accessible.`,
+      inputPath
+    );
+  }
+  const exists = existsSync5(absolutePath);
+  if (!exists && !allowCreate) {
+    throw new WorkspaceSecurityError(
+      `File not found: '${inputPath}' does not exist in workspace.`,
+      inputPath
+    );
+  }
+  if (exists) {
+    const stats = lstatSync(absolutePath);
+    if (stats.isSymbolicLink()) {
+      throw new WorkspaceSecurityError(
+        `Access denied: Symbolic links are not allowed for security reasons.`,
+        inputPath
+      );
+    }
+  }
+  return {
+    absolutePath,
+    relativePath,
+    exists,
+    isDirectory: exists ? lstatSync(absolutePath).isDirectory() : false,
+    extension: extname(absolutePath).toLowerCase(),
+    filename: basename(absolutePath)
+  };
+}
+function validateReadPath(inputPath) {
+  const validated = validatePath(inputPath, false);
+  if (validated.isDirectory) {
+    throw new WorkspaceSecurityError(`Cannot read directory as file: '${inputPath}'`, inputPath);
+  }
+  return validated;
+}
+var IMMUTABLE_FILES = ["SOUL.md", "STRATEGY.md", "SECURITY.md"];
+function validateWritePath(inputPath, fileType) {
+  const validated = validatePath(inputPath, true);
+  if (IMMUTABLE_FILES.includes(validated.filename)) {
+    throw new WorkspaceSecurityError(
+      `Cannot write to ${validated.filename}. This file is configured by the owner. Use memory_write instead.`,
+      inputPath
+    );
+  }
+  if (fileType && ALLOWED_EXTENSIONS[fileType]) {
+    const allowedExts = ALLOWED_EXTENSIONS[fileType];
+    if (!allowedExts.includes(validated.extension)) {
+      throw new WorkspaceSecurityError(
+        `Invalid file type: '${validated.extension}' is not allowed for ${fileType}. Allowed: ${allowedExts.join(", ")}`,
+        inputPath
+      );
+    }
+  }
+  return validated;
+}
+function validateDirectory(inputPath) {
+  const validated = validatePath(inputPath, true);
+  if (validated.exists && !validated.isDirectory) {
+    throw new WorkspaceSecurityError(
+      `Path exists but is not a directory: '${inputPath}'`,
+      inputPath
+    );
+  }
+  return validated;
+}
+
+export {
+  DealsConfigSchema,
+  ConfigSchema,
+  getProviderMetadata,
+  getSupportedProviders,
+  validateApiKeyFormat,
+  expandPath,
+  loadConfig,
+  configExists,
+  getDefaultConfigPath,
+  WorkspaceSecurityError,
+  validatePath,
+  validateReadPath,
+  validateWritePath,
+  validateDirectory,
+  generateWallet,
+  saveWallet,
+  loadWallet,
+  walletExists,
+  importWallet,
+  getWalletAddress,
+  getKeyPair,
+  getWalletBalance,
+  getTonPrice,
+  writePluginSecret,
+  deletePluginSecret,
+  listPluginSecretKeys,
+  withBlockchainRetry,
+  sendTon,
+  adaptPlugin,
+  ensurePluginDeps,
+  loadEnhancedPlugins
+};