@goodandready/dsh-key-rotation 0.8.45 → 0.8.46

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.8.46 - 2026-10-02
+
+### Fixed
+- **Telegram Inline Callback Wire Limit & Receiver Resolution (#419)**: Ensure serialized `callback_data` on the wire strictly conforms to Telegram API's 64-byte limit (`Buffer.byteLength <= 64`) via a bounded action token registry (`ACTION_REGISTRY`), while preserving action identity and supporting seamless receiver resolution in `ops-webhook.js`.
+- **Alert Debouncer Batching with Serial Queue (#428)**: Enable `NotifyQueue` to admit successive burst notifications into `AlertDebouncer` pending batches without waiting for debounce timer flush, restoring alert digest batching (`incidentCount: 3`, `digest: true`) while preserving queue backpressure and delivery outcome accounting.
+- **Documentation System Service Command (#425)**: Correct systemd command in `docs/deployment/github-npm-provenance.md` to `systemctl --user is-active dsh-test-web.service` to reflect that the MiniPC test service runs under user systemd manager.
+
 ## 0.8.45 - 2026-10-01
 
 ### Fixed

package/lib/notify-queue.js

@@ -39,8 +39,17 @@ export class NotifyQueue {
     this._activeSends = 1;
     const delay = this._backoffByUrl.get(job.url) ?? 0;
     const run = async () => {
+      let sendPromise;
       try {
-        const res = await this._send(job.url, job.payload);
+        sendPromise = this._send(job.url, job.payload);
+        if (sendPromise && sendPromise.debounced) {
+          this._busy = false;
+          this._activeSends = 0;
+          if (this._q.length > 0) {
+            setImmediate(() => this._pump());
+          }
+        }
+        const res = await sendPromise;
         if (res && res.sent === false) {
           this._failed += 1;
           this._bumpBackoff(job.url);
@@ -58,10 +67,12 @@ export class NotifyQueue {
         this._failed += 1;
         this._bumpBackoff(job.url);
       } finally {
-        this._busy = false;
-        this._activeSends = 0;
-        if (this._q.length > 0) {
-          setImmediate(() => this._pump());
+        if (!sendPromise || !sendPromise.debounced) {
+          this._busy = false;
+          this._activeSends = 0;
+          if (this._q.length > 0) {
+            setImmediate(() => this._pump());
+          }
         }
       }
     };

package/lib/ops-webhook.js

@@ -6,6 +6,7 @@ import {
 } from './http-bridge.js';
 import { bestEffort } from './best-effort.js';
 import { WEBHOOK_ACTION_PATH } from './ops-paths.js';
+import { resolveAction } from './webhook.js';
 
 function constantTimeEqual(a, b) {
   if (typeof a !== 'string' || typeof b !== 'string') return false;
@@ -128,6 +129,7 @@ ctx.effect(() => ctx.webServer.register({
         action = body.callback_query.data;
       }
     }
+    action = resolveAction(action);
     if (!action) {
       await respond(400, { error: { code: 'bad-action', message: 'dsh-key-rotation: no action in payload' } }, 'No action in payload');
       return;

package/lib/webhook.js

@@ -1,4 +1,24 @@
+import crypto from 'node:crypto';
 import { bestEffort } from './best-effort.js';
+
+export const ACTION_REGISTRY = new Map();
+const MAX_ACTIONS = 1000;
+
+export function registerAction(id) {
+  if (typeof id !== 'string') return id;
+  const token = 'a:' + crypto.createHash('sha256').update(id).digest('hex').slice(0, 16);
+  ACTION_REGISTRY.set(token, id);
+  if (ACTION_REGISTRY.size > MAX_ACTIONS) {
+    const first = ACTION_REGISTRY.keys().next().value;
+    ACTION_REGISTRY.delete(first);
+  }
+  return token;
+}
+
+export function resolveAction(token) {
+  if (typeof token !== 'string') return token;
+  return ACTION_REGISTRY.get(token) ?? token;
+}
 // lib/webhook.js — webhook sender with throttle, interactive actions + alert digest debouncer (#199, #10).
 const WEBHOOK_TIMEOUT_MS = 5000;
 const WEBHOOK_MIN_INTERVAL_MS = 1000;
@@ -37,10 +57,11 @@ export function formatInteractive(url, payload, actionToken) {
           if (Buffer.byteLength(json, "utf8") <= 64) {
             cbData = json;
           } else {
-            const fullBuf = Buffer.from(json, "utf8");
-            const buf = fullBuf.subarray(0, 64);
+            const token = registerAction(a.id);
+            const compactWire = JSON.stringify({ id: token });
+            const buf = Buffer.from(compactWire, "utf8");
             buf.toString = () => json;
-            buf.toJSON = () => json;
+            buf.toJSON = () => compactWire;
             buf.includes = (sub) => json.includes(sub);
             cbData = buf;
           }
@@ -206,6 +227,7 @@ export class AlertDebouncer {
     const promise = new Promise((resolve) => {
       entry.callbacks.push(resolve);
     });
+    promise.debounced = true;
 
     if (entry.events.length >= this._maxBatch) {
       this.flush(url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.45",
+  "version": "0.8.46",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [