# AI prompt — build a Telegram partner app

Copy this prompt into Cursor / ChatGPT / similar. Attach the downloaded files listed at the end.

---

You are building a **partner backend** for a Telegram platform (not the Telegram admin itself).

## Product

Build a simple **recharge / top-up** service (or swap the domain if I say so): packages, demo pay (mark order PAID), history. No real payment, no extra security theater. Secrets in environment variables.

## How the platform works (must follow exactly)

1. I log in to the Telegram **management panel** with credentials, create an **App**, set **Managed** or **Passthrough**, paste my backend URL, and copy the **secret key**.
2. I attach a BotFather bot (panel or Open API).
3. Telegram users talk to the bot. Updates go to the **Telegram service**, not to me.
4. I implement **only the mechanisms I pick below** (one or more):

**I pick (delete the ones I do not want):**
- [ ] **Managed** — Panel stores templates and routes. My app returns `{ vars }` on REMOTE paths. Operators edit chat text in the panel.
- [ ] **Passthrough** — Every chat event POSTs to `/telegram/inbound`. Return `{ content, buttons, mode }`. Optional photo on `image` (or `photo` / `photoUrl`): an http(s) **link** or **base64** (`data:image/png;base64,...`). This sample sends base64.
- [ ] **Open API** — My app calls `POST /telegram/v1/*` (MD5 sign) to manage bots/groups/channels/templates/routes and send outbound. Often combined with Managed or Passthrough.

HMAC (Managed REMOTE + Passthrough): `X-Telegram-Signature` = hex HMAC-SHA256(secret, `timestamp + "." + rawBody`).
Open API sign: `md5(secretKey + tenantId + appId + timestamp)`.

Do not implement mechanisms I did not tick. If I pick all three, use two Apps (one Managed, one Passthrough).

## What I want you to generate

Only what I ticked above. Include a short README: login → create App → secret → that mechanism.

## Files I attached (use them as source of truth)

- `getting-started.md` — operator steps
- `hmac-inbound.md` — inbound contract
- `open-api.md` — Open API contract
- `managed-templates.json` — example templates (import one object at a time, or POST `/telegram/v1/templates` each)
- `managed-routes.json` — example REMOTE routes for recharge

Do not invent different header names or a different sign algorithm. Do not put Telegram webhooks on my app.

My Telegram service base URL: `<paste>`
My tenant id: `<paste>`
My App id(s): `<paste>`
My secret: `<paste later, not in git>`

---

## How to use this with AI (short)

1. Download all files from the Guidelines page.
2. Paste the prompt above.
3. Attach every downloaded file.
4. Fill the placeholders (URLs, tenant, app ids).
5. Tick the mechanism(s) in the prompt: Managed, Passthrough, and/or Open API (one or several).
6. After code exists: create the App in the panel, paste backend URL + secret. For Managed, import JSON or Open API “push demo templates/routes”.