@www.hyperlinks.space/program-kit 1.2.3

package/scripts/test-api-base.ts

@@ -0,0 +1,12 @@
+/**
+ * Quick check that app/api/base.ts works. Run: npx tsx scripts/test-api-base.ts
+ * In Node (no window), getApiBaseUrl() uses Vercel env or falls back to http://localhost:3000.
+ */
+import { getApiBaseUrl, buildApiUrl } from "../api/base.js";
+
+const base = getApiBaseUrl();
+const full = buildApiUrl("/api/telegram");
+
+console.log("[api/base] getApiBaseUrl():", base);
+console.log("[api/base] buildApiUrl('/api/telegram'):", full);
+console.log("[api/base] OK");

package/telegram/post.ts

@@ -0,0 +1,328 @@
+/**
+ * POST /api/telegram handler (init data verify + DB upsert).
+ * Loaded only for POST so GET stays fast. Lives under app/telegram; api/telegram.ts imports this.
+ */
+import crypto from 'crypto';
+import {
+  normalizeUsername,
+  upsertUserFromTma,
+} from '../database/users.js';
+
+const LOG_TAG = '[api/telegram]';
+
+function log(msg: string, detail?: Record<string, unknown>) {
+  const payload = detail ? ` ${JSON.stringify(detail)}` : '';
+  console.log(`${LOG_TAG} ${msg}${payload}`);
+}
+
+function logErr(msg: string, err: unknown) {
+  console.error(
+    `${LOG_TAG} ${msg}`,
+    err instanceof Error ? err.message : err,
+  );
+  if (err instanceof Error && err.stack) console.error(err.stack);
+}
+
+type TelegramUserPayload = {
+  id?: number;
+  username?: string;
+  first_name?: string;
+  last_name?: string;
+  language_code?: string;
+  [key: string]: unknown;
+};
+
+type VerifiedInitData = {
+  auth_date?: string;
+  query_id?: string;
+  user?: TelegramUserPayload;
+  [key: string]: unknown;
+};
+
+const TELEGRAM_WEBAPP_PUBLIC_KEY_RAW = Buffer.from(
+  'e7bf03a2fa4602af4580703d88dda5bb59f32ed8b02a56c187fe7d34caed242d',
+  'hex',
+);
+const ED25519_SPKI_HEADER = Buffer.from(
+  '302a300506032b6570032100',
+  'hex',
+);
+const TELEGRAM_WEBAPP_PUBLIC_KEY = crypto.createPublicKey({
+  key: Buffer.concat([
+    ED25519_SPKI_HEADER,
+    Buffer.from([0]),
+    TELEGRAM_WEBAPP_PUBLIC_KEY_RAW,
+  ]),
+  format: 'der',
+  type: 'spki',
+});
+
+function verifyTelegramWebAppInitData(
+  initData: string,
+  botToken: string,
+  maxAgeSeconds: number = 24 * 3600,
+): VerifiedInitData | null {
+  if (!initData || !botToken) return null;
+  try {
+    const params = new URLSearchParams(initData);
+    const data: Record<string, string> = {};
+    for (const [key, value] of params.entries()) data[key] = value;
+
+    const authDateStr = data['auth_date'];
+    if (authDateStr) {
+      const authDate = Number(authDateStr);
+      if (!Number.isFinite(authDate)) return null;
+      const now = Math.floor(Date.now() / 1000);
+      if (authDate > now + 60) return null;
+      if (maxAgeSeconds != null && now - authDate > maxAgeSeconds) {
+        return null;
+      }
+    }
+
+    const receivedHash = data['hash'];
+    const receivedSignature = data['signature'];
+
+    if (receivedHash) {
+      const dataForHash = { ...data };
+      delete dataForHash['hash'];
+      const sorted = Object.keys(dataForHash)
+        .sort()
+        .map((k) => `${k}=${dataForHash[k]}`)
+        .join('\n');
+      const dataCheckString = Buffer.from(sorted, 'utf8');
+      const secretKey = crypto
+        .createHmac('sha256', 'WebAppData')
+        .update(botToken)
+        .digest();
+      const computedHash = crypto
+        .createHmac('sha256', secretKey)
+        .update(dataCheckString)
+        .digest('hex');
+      const valid =
+        receivedHash.length === computedHash.length &&
+        crypto.timingSafeEqual(
+          Buffer.from(receivedHash, 'hex'),
+          Buffer.from(computedHash, 'hex'),
+        );
+      if (!valid) return null;
+    } else if (receivedSignature) {
+      const botId = botToken.split(':')[0];
+      if (!botId) return null;
+      const dataForSig = { ...data };
+      delete dataForSig['hash'];
+      delete dataForSig['signature'];
+      const sorted = Object.keys(dataForSig)
+        .sort()
+        .map((k) => `${k}=${dataForSig[k]}`)
+        .join('\n');
+      const dataCheckString = `${botId}:WebAppData\n${sorted}`;
+      const base64 = receivedSignature
+        .replace(/-/g, '+')
+        .replace(/_/g, '/');
+      const pad = (4 - (base64.length % 4)) % 4;
+      const sigBuffer = Buffer.from(
+        base64 + '='.repeat(pad),
+        'base64',
+      );
+      const ok = crypto.verify(
+        null,
+        Buffer.from(dataCheckString, 'utf8'),
+        TELEGRAM_WEBAPP_PUBLIC_KEY,
+        sigBuffer,
+      );
+      if (!ok) return null;
+    } else return null;
+
+    const result: VerifiedInitData = { ...data };
+    delete result['hash'];
+    delete result['signature'];
+    if (data.user) {
+      try {
+        result.user = JSON.parse(data.user) as TelegramUserPayload;
+      } catch {
+        return null;
+      }
+    }
+    return result;
+  } catch {
+    return null;
+  }
+}
+
+/** Get JSON body from Web Request or Node req (Vercel may pass either). */
+async function getBody(
+  request:
+    | Request
+    | {
+        json?: () => Promise<unknown>;
+        body?: unknown;
+        on?: (e: string, fn: (c: Buffer) => void) => void;
+      },
+): Promise<unknown> {
+  if (
+    typeof (request as { json?: () => Promise<unknown> }).json ===
+    'function'
+  ) {
+    return (request as Request).json();
+  }
+  const req = request as {
+    body?: unknown;
+    on?: (e: string, fn: (c: Buffer) => void) => void;
+  };
+  if (req.body != null && typeof req.body === 'object') {
+    return req.body;
+  }
+  if (typeof req.on === 'function') {
+    const chunks: Buffer[] = [];
+    return new Promise<unknown>((resolve, reject) => {
+      (req as NodeJS.ReadableStream).on(
+        'data',
+        (c: Buffer) => chunks.push(c),
+      );
+      (req as NodeJS.ReadableStream).on('end', () => {
+        try {
+          const raw = Buffer.concat(chunks).toString('utf8');
+          resolve(raw ? JSON.parse(raw) : null);
+        } catch (e) {
+          reject(e);
+        }
+      });
+      (req as NodeJS.ReadableStream).on('error', reject);
+    });
+  }
+  return null;
+}
+
+export async function handlePost(
+  request: Request | { json?: () => Promise<unknown>; body?: unknown },
+): Promise<Response> {
+  const startMs = Date.now();
+  log('post_start', { elapsedMs: 0 });
+
+  let body: any;
+  try {
+    body = await getBody(request);
+    if (body == null) throw new Error('no_body');
+    log('body_parsed', { elapsedMs: Date.now() - startMs });
+  } catch (e) {
+    logErr('body_parse_failed', e);
+    return new Response(
+      JSON.stringify({ ok: false, error: 'bad_json' }),
+      {
+        status: 400,
+        headers: { 'content-type': 'application/json' },
+      },
+    );
+  }
+
+  const initData =
+    typeof body?.initData === 'string' ? body.initData : '';
+  if (!initData) {
+    log('reject', {
+      reason: 'missing_initData',
+      elapsedMs: Date.now() - startMs,
+    });
+    return new Response(
+      JSON.stringify({ ok: false, error: 'missing_initData' }),
+      {
+        status: 400,
+        headers: { 'content-type': 'application/json' },
+      },
+    );
+  }
+  log('initData_received', {
+    initDataLength: initData.length,
+    elapsedMs: Date.now() - startMs,
+  });
+
+  const botToken = (process.env.BOT_TOKEN || '').trim();
+  if (!botToken) {
+    log('reject', {
+      reason: 'bot_token_not_configured',
+      elapsedMs: Date.now() - startMs,
+    });
+    return new Response(
+      JSON.stringify({ ok: false, error: 'bot_token_not_configured' }),
+      {
+        status: 500,
+        headers: { 'content-type': 'application/json' },
+      },
+    );
+  }
+
+  const verifyStart = Date.now();
+  const verified = verifyTelegramWebAppInitData(initData, botToken);
+  log('verify_done', {
+    ok: !!verified,
+    verifyMs: Date.now() - verifyStart,
+    elapsedMs: Date.now() - startMs,
+  });
+
+  if (!verified) {
+    log('reject', {
+      reason: 'invalid_initdata',
+      elapsedMs: Date.now() - startMs,
+    });
+    return new Response(
+      JSON.stringify({ ok: false, error: 'invalid_initdata' }),
+      {
+        status: 401,
+        headers: { 'content-type': 'application/json' },
+      },
+    );
+  }
+
+  const user: TelegramUserPayload =
+    verified.user && typeof verified.user === 'object'
+      ? (verified.user as TelegramUserPayload)
+      : {};
+  const telegramUsername = normalizeUsername(user.username);
+  if (!telegramUsername) {
+    log('reject', {
+      reason: 'username_required',
+      elapsedMs: Date.now() - startMs,
+    });
+    return new Response(
+      JSON.stringify({ ok: false, error: 'username_required' }),
+      {
+        status: 400,
+        headers: { 'content-type': 'application/json' },
+      },
+    );
+  }
+  log('username_ok', {
+    telegramUsername,
+    elapsedMs: Date.now() - startMs,
+  });
+
+  const locale =
+    typeof user.language_code === 'string'
+      ? user.language_code
+      : null;
+  const dbStart = Date.now();
+  try {
+    await upsertUserFromTma({ telegramUsername, locale });
+    log('db_upsert_done', {
+      dbMs: Date.now() - dbStart,
+      elapsedMs: Date.now() - startMs,
+    });
+  } catch (e) {
+    logErr('db_upsert_failed', e);
+    return new Response(
+      JSON.stringify({ ok: false, error: 'db_error' }),
+      {
+        status: 500,
+        headers: { 'content-type': 'application/json' },
+      },
+    );
+  }
+
+  log('success', {
+    telegramUsername,
+    totalMs: Date.now() - startMs,
+  });
+  return new Response(
+    JSON.stringify({ ok: true, telegram_username: telegramUsername }),
+    { status: 200, headers: { 'content-type': 'application/json' } },
+  );
+}

package/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "extends": "expo/tsconfig.base",
+  "compilerOptions": {
+    "strict": true,
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".expo/types/**/*.ts",
+    "expo-env.d.ts"
+  ]
+}

package/vercel.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "buildCommand": "npm run db:migrate && npx expo export -p web && npx tsx scripts/set-webhook.ts",
+  "outputDirectory": "dist",
+  "framework": null,
+  "installCommand": "npm install"
+}

package/windows/after-sign-windows-icon.cjs

@@ -0,0 +1,13 @@
+/**
+ * electron-builder afterSign (Windows): embed icon via app-builder rcedit (see embed-windows-exe-icon.cjs).
+ */
+const { embedWindowsExeIcon } = require("./embed-windows-exe-icon.cjs");
+
+module.exports = async (context) => {
+  if (context.electronPlatformName !== "win32") return;
+  await embedWindowsExeIcon({
+    appOutDir: context.appOutDir,
+    projectDir: context.packager.projectDir,
+    productFilename: context.packager.appInfo.productFilename,
+  });
+};

package/windows/build-layout.cjs

@@ -0,0 +1,72 @@
+/**
+ * Windows electron-builder layout:
+ * - Staging: releases/builder/build_MMDDYYYY_HHMM/eb-output/ (deleted after cleanup)
+ * - Final:   releases/builder/build_MMDDYYYY_HHMM/<productSlug from package.json>Installer_<stamp>.exe
+ *            releases/builder/build_MMDDYYYY_HHMM/<RELEASE_BUILD_DEV_DIRNAME>/  (zip, yml, unpacked, etc.)
+ * - BUILD_STAMP matches the folder id (required by package.json nsis.artifactName).
+ */
+const fs = require("fs");
+const path = require("path");
+
+/** Non-installer artifacts live here (same name for builder + Forge; CI expects this path). */
+const RELEASE_BUILD_DEV_DIRNAME = "dev";
+
+const pad = (n) => String(n).padStart(2, "0");
+
+function makeDefaultBuildName(d = new Date()) {
+  return (
+    "build_" +
+    pad(d.getMonth() + 1) +
+    pad(d.getDate()) +
+    d.getFullYear() +
+    "_" +
+    pad(d.getHours()) +
+    pad(d.getMinutes())
+  );
+}
+
+/** build_03292026_1938 -> 03292026_1938 */
+function stampFromBuildName(buildName) {
+  if (!/^build_\d{8}_\d{4}$/.test(buildName)) return null;
+  return buildName.slice("build_".length);
+}
+
+/**
+ * @param {string} appDir - path to app/ (directory with package.json)
+ * @returns {{ buildName: string, buildStamp: string, buildDir: string, ebOutputDir: string }}
+ */
+function resolveBuildLayout(appDir) {
+  const envBuildId = process.env.RELEASE_BUILD_ID?.trim();
+  const buildName =
+    envBuildId && /^build_\d{8}_\d{4}$/.test(envBuildId) ? envBuildId : makeDefaultBuildName();
+  const buildStamp = process.env.BUILD_STAMP?.trim() || stampFromBuildName(buildName);
+  if (!buildStamp) {
+    throw new Error(`[build-layout] could not derive BUILD_STAMP for buildName=${buildName}`);
+  }
+
+  const releasesDir = path.join(appDir, "releases");
+  const buildDir = path.join(releasesDir, "builder", buildName);
+  const ebOutputDir = path.join(buildDir, "eb-output");
+
+  return { buildName, buildStamp, releasesDir, buildDir, ebOutputDir };
+}
+
+function ensureCleanEbOutput(ebOutputDir) {
+  try {
+    if (fs.existsSync(ebOutputDir)) {
+      fs.rmSync(ebOutputDir, { recursive: true, force: true });
+    }
+    fs.mkdirSync(ebOutputDir, { recursive: true });
+  } catch (e) {
+    console.warn("[build-layout] ensureCleanEbOutput:", e?.message || e);
+    throw e;
+  }
+}
+
+module.exports = {
+  RELEASE_BUILD_DEV_DIRNAME,
+  resolveBuildLayout,
+  ensureCleanEbOutput,
+  makeDefaultBuildName,
+  stampFromBuildName,
+};

package/windows/build-with-progress.cjs

@@ -0,0 +1,88 @@
+/**
+ * Runs electron-builder --win with stable pass-through logging.
+ * Usage: node windows/build-with-progress.cjs [--pack] [--verbose]
+ *   --pack     Skip "npm run build", run only electron-builder (pack:win style).
+ *   --verbose  Add DEBUG=electron-builder.
+ */
+const { spawn } = require("child_process");
+const path = require("path");
+const { resolveBuildLayout, ensureCleanEbOutput } = require("./build-layout.cjs");
+
+const appDir = path.join(__dirname, "..");
+const isPack = process.argv.includes("--pack");
+const isVerbose = process.argv.includes("--verbose");
+
+const ebCli = require.resolve("electron-builder/cli.js");
+
+function relForConfig(p) {
+  return path.relative(appDir, p).split(path.sep).join("/");
+}
+
+function run(command, args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const { pipeOutput: usePipe, env: optsEnv, shell = true } = opts;
+    const env = { ...process.env, ...(optsEnv || {}) };
+    if (isVerbose) env.DEBUG = "electron-builder";
+    const child = spawn(command, args, {
+      cwd: appDir,
+      env,
+      stdio: usePipe ? ["inherit", "pipe", "pipe"] : "inherit",
+      shell,
+    });
+    if (!usePipe) {
+      child.on("close", (code) => {
+        if (code !== 0) reject(new Error(`Exit ${code}`));
+        else resolve();
+      });
+      child.on("error", reject);
+      return;
+    }
+    child.stdout.on("data", (chunk) => {
+      const s = chunk.toString();
+      process.stdout.write(s);
+    });
+    child.stderr.on("data", (chunk) => {
+      const s = chunk.toString();
+      process.stderr.write(s);
+    });
+    child.on("close", (code, signal) => {
+      if (code !== 0) reject(new Error(`Exit ${code}`));
+      else resolve();
+    });
+    child.on("error", (err) => {
+      reject(err);
+    });
+  });
+}
+
+(async () => {
+  try {
+    if (!isPack) {
+      console.log("Running: npm run build\n");
+      await run("npm", ["run", "build"], { stdio: "inherit" });
+    }
+    const layout = resolveBuildLayout(appDir);
+    ensureCleanEbOutput(layout.ebOutputDir);
+    const outArg = `--config.directories.output=${relForConfig(layout.ebOutputDir)}`;
+    const ebEnv = {
+      ...process.env,
+      BUILD_STAMP: layout.buildStamp,
+      RELEASE_BUILD_ID: layout.buildName,
+      HSP_EB_OUTPUT: relForConfig(layout.ebOutputDir),
+    };
+    if (isVerbose) ebEnv.DEBUG = "electron-builder";
+    // Never publish from this script: CI has no GH_TOKEN unless set, and releases are created via gh workflow + cleanup (latest.yml).
+    console.log(`\nBuild: ${layout.buildName}  stamp: ${layout.buildStamp}`);
+    console.log(`Output: ${relForConfig(layout.ebOutputDir)}`);
+    console.log("Running: electron-builder --win --publish never\n");
+    await run(process.execPath, [ebCli, "--win", "--publish", "never", outArg], {
+      pipeOutput: true,
+      env: ebEnv,
+      shell: false,
+    });
+    console.log("\nRunning: windows/cleanup.cjs\n");
+    await run("node", [path.join(__dirname, "cleanup.cjs")], { env: ebEnv });
+  } catch (e) {
+    process.exit(1);
+  }
+})();