Process Telegram webhooks in-process on HF (no Celery worker).

Make Telegram Connected/Not connected only; finish webhook via author browser.

Point Telegram webhooks at the HF API host, not the Vercel marketing site.

Show Telegram webhook setup on the Channels card when HF blocks api.telegram.org.

Save Telegram token when HF cannot reach api.telegram.org.

Import normalize_bot_token for Telegram connect.

Fix Channels escHtml crash and clearer Telegram token validation.

Simplify Channels Meta form: show only fields required for selected channel.

Harden omnichannel: WA 24h window, templates, token budget, security tests.

Add per-author omnichannel channels with auth-hardened inbox.

Allow authors to renew and refill tokens when the current plan budget runs out.

Restore author self-serve billing: view plans, renew, upgrade, and invoices.

Stop cross-panel session wipes that force repeated logouts.

Remove embed debug instrumentation and fix widget intake/overflow.

fix: orphan embed grant (user missing) — clear error + revoke dead grant

debug: instrument embed subscription 403 path (reason + widget ingest)

Fix embed Save: consume unlock credit on first re-lock so field locks immediately

Fix embed unlock: redirect to HF /author, confirm on return, idempotent grant

Fix SuperAdmin logout loop (this-binding) + add Fix Grant button to restore revoked embed grants

Restore soft-revoked grant with commit() during visitor request, guarded by hard-revoke check

Fix visitor 403: clean soft-remap, no in-request DB mutation, grant restore via Embed Code.

Restore revoked in-term embed grants and clear stale Redis blacklist.

Fix stale embed 403 for 2nd visitors; onboarding spotlights; remove TOTP debug.

Fix SuperAdmin embed Remove 403 by sending TOTP on DELETE.

Add debug instrumentation for SuperAdmin TOTP and session logout.

Cache-bust widget.js after embed Origin/CORS fix.

Fix embed 403 on author sites: CORS reflect + Origin fallback.

Polish embed unlock UX: pay unlocks edit, hide add-at-cap, gate embed code.

Enforce plan embed slots with lock-on-save and paid Stripe unlock.

Lock embed tokens to website domain and refine intake UI.

Inject preview token into HTML data-attrs and cache-bust widget.js.

Fix widget token wipe from empty script attrs on preview.

Add debug instrumentation for widget preview sync.

Sync Widget Config appearance to live bot and Embed.

Fix widget theme validation and switch info tips to hover.

Fix auth logout loop from broken refresh retries and premature session wipe.

Isolate author and superadmin sessions to stop surprise logouts.

Polish support messenger media UI with thumbnails and lightbox.

Upgrade support to threaded messenger with media and premium UI.

Add two-way support messaging and author usage dashboard.

fix: repair security_headers IndentationError that crashed HF Space

debug: instrument SuperAdmin pricing plans fetch (session fb34ac)

fix: CSP connect-src for SuperAdmin pricing + full plan editor

fix: Celery Redis auth, white-label service, and support queue resilience

fix: count monthly chats via ChatSession join in usage_snapshot

fix: pass author_id as granted_by for Stripe grants (NOT NULL on legacy DB)

Fix billing dashboard 500 after subscription repair.

Complete Stripe subscription grants with plan limits enforcement.

Reclaim orphaned Stripe subscription access for paying author.

Fix token-usage 500 after Stripe access repair.