@xbibzlibrary/telebibz 0.4.4 → 3.0.1

package/test/all.test.js

@@ -0,0 +1,334 @@
+// test/all.test.js — 14 kasus, 100% tanpa jaringan (transport disuntik).
+'use strict';
+
+const assert = require('assert');
+const { TeleBibz, btn, url, kb, webApp, copy, humanize, File, InlineKeyboard,
+  Menu, MenuContainer, iq, autoRetry, throttler, limiter, InputMediaBuilder } = require('..');
+
+let N = 0, OK = 0;
+const TOTAL = 24;
+const t = (nama, fn) => {
+  const done = () => { N++; if (N === TOTAL) { console.log(`\n${OK}/${N} lulus`); process.exit(OK === N ? 0 : 1); } };
+  Promise.resolve()
+    .then(fn)
+    .then(() => { OK++; console.log(`  ✓ ${nama}`); done(); })
+    .catch((e) => { console.error(`  ✗ ${nama}\n    ${e.stack || e}`); done(); });
+};
+
+/* ===== harness: bot dengan transport palsu (merekam panggilan API) ===== */
+function buatBot(overrides = {}) {
+  const calls = [];
+  const transport = async (method, payload = {}) => {
+    calls.push({ method, payload });
+    if (method === 'getMe') return { id: 99, is_bot: true, first_name: 'Tes', username: 'tesbot' };
+    if (method === 'sendMessage') return { message_id: calls.length, ...payload };
+    if (overrides[method]) return overrides[method](payload);
+    return true;
+  };
+  const bot = new TeleBibz('123456:TESTTOKEN-TESTTOKEN-TESTTOKEN-TESTOKEN', { silent: true, transport });
+  return { bot, calls, me: null };
+}
+async function boot(b) { await b.init(); }
+const ME = { id: 99, is_bot: true, first_name: 'Tes', username: 'tesbot' };
+const USER = { id: 555, is_bot: false, first_name: 'Budi' };
+const CHAT = { id: 555, type: 'private', first_name: 'Budi' };
+let uid = 0, mid = 0;
+function uMsg(text, chat = CHAT) {
+  return {
+    update_id: ++uid,
+    message: {
+      message_id: ++mid, from: USER, chat, date: Math.floor(Date.now() / 1000),
+      text,
+      ...(text.startsWith('/') ? { entities: [{ type: 'bot_command', offset: 0, length: text.split(' ')[0].length }] } : {}),
+    },
+  };
+}
+const texts = (calls) => calls.filter((c) => c.method === 'sendMessage').map((c) => c.payload.text || '');
+
+/* ===== 1. keyboard builder ===== */
+t('btn()/url()/kb(): bentuk objek + warna + ikon', () => {
+  assert.deepStrictEqual(btn('A', 'a'), { text: 'A', callback_data: 'a' });
+  assert.deepStrictEqual(btn('B', 'b', 'danger', '123'), { text: 'B', callback_data: 'b', style: 'danger', icon_custom_emoji_id: '123' });
+  assert.strictEqual(url('W', 'https://x', 'success').style, 'success');
+  assert.strictEqual(webApp('App', 'https://w').web_app.url, 'https://w');
+  assert.strictEqual(copy('Salin', 'kode').copy_text.text, 'kode');
+  assert.ok(kb([[btn('X', 'x')]]).reply_markup.inline_keyboard[0][0].text === 'X');
+  assert.ok(kb.confirm('y', 'n').reply_markup.inline_keyboard[0][0].style === 'success');
+  const ik = new InlineKeyboard().text('A', 'a').url('B', 'https://b').row().text('C', 'c', 'danger').build();
+  assert.strictEqual(ik.reply_markup.inline_keyboard.length, 2);
+});
+
+/* ===== 2. token guard ===== */
+t('constructor menolak token ngaco cepat', () => {
+  assert.throws(() => new TeleBibz('bukan-token'), /token tidak valid/i);
+  assert.throws(() => new TeleBibz(), /token tidak valid/i);
+});
+
+/* ===== 3. cmd + hears ===== */
+t('cmd & hears merespons via sendMessage', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  let startHit = 0;
+  bot.cmd('start', (ctx) => { startHit++; return ctx.reply(`Halo ${ctx.from.first_name}`); });
+  bot.hears(/halo/i, (ctx) => ctx.reply('halo juga'));
+  await bot.handleUpdate(uMsg('/start'));
+  await bot.handleUpdate(uMsg('Halo kawan'));
+  assert.strictEqual(startHit, 1);
+  const tx = texts(calls);
+  assert.ok(tx.some((x) => /Halo Budi/.test(x)) && tx.some((x) => /halo juga/.test(x)));
+});
+
+/* ===== 4. action ===== */
+t('action() menangkap callback_data', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.action('menu:premium', (ctx) => ctx.editMessageText('premium dibuka'));
+  await bot.handleUpdate({
+    update_id: ++uid,
+    callback_query: {
+      id: 'q1', from: USER, chat_instance: 'ci', data: 'menu:premium',
+      message: { message_id: 7, from: { id: 99, is_bot: true, first_name: 'T' }, chat: CHAT, date: 1 },
+    },
+  });
+  assert.ok(calls.some((c) => c.method === 'editMessageText' && /premium dibuka/.test(c.payload.text)));
+});
+
+/* ===== 5. hears string persis ===== */
+t('hears(string) hanya cocok teks persis (ci)', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.hears('ping', (ctx) => ctx.reply('pong'));
+  await bot.handleUpdate(uMsg('PING'));
+  await bot.handleUpdate(uMsg('ping pong'));
+  const po = texts(calls).filter((x) => x === 'pong');
+  assert.strictEqual(po.length, 1, 'hears string harus cocok persis sekali saja');
+});
+
+/* ===== 6–8. wizard ===== */
+t('wizard mengalir penuh: tanya → validasi → done', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  const jawab = [];
+  bot.wizard('daftar', {
+    steps: [
+      { key: 'nama', ask: 'Nama?' },
+      { key: 'umur', ask: 'Umur?', parse: (t) => parseInt(t, 10), validate: (n) => (n > 0 ? null : 'Ulangi angka:') },
+    ],
+    done: async (ans, ctx) => { jawab.push(ans); await ctx.reply('selesai'); },
+  });
+  const send = (t) => bot.handleUpdate(uMsg(t));
+  await send('/daftar'); await send('Budi'); await send('abc'); await send('25');
+  const tx = texts(calls);
+  assert.deepStrictEqual(jawab, [{ nama: 'Budi', umur: 25 }]);
+  assert.ok(tx.some((x) => /Nama\?/.test(x)) && tx.some((x) => /Ulangi angka/.test(x)) && tx.some((x) => /selesai/.test(x)));
+});
+
+t('wizard batal via kata batal', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.wizard('isi', { steps: [{ key: 'a', ask: 'A?' }], done: () => {} });
+  await bot.handleUpdate(uMsg('/isi'));
+  await bot.handleUpdate(uMsg('batal'));
+  assert.ok(texts(calls).some((x) => /dibatalkan/i.test(x)));
+});
+
+t('pesan non-teks di tengah wizard tidak error & wizard lanjut', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  let doneHit = 0;
+  bot.wizard('form', { steps: [{ key: 'a', ask: 'A?' }], done: () => doneHit++ });
+  await bot.handleUpdate(uMsg('/form'));
+  await bot.handleUpdate({ update_id: ++uid, message: { message_id: ++mid, from: USER, chat: CHAT, date: 1, photo: [{ file_id: 'f', width: 1, height: 1 }] } });
+  await bot.handleUpdate(uMsg('oke'));
+  assert.strictEqual(doneHit, 1);
+  assert.ok(!texts(calls).some((x) => /error/i.test(x)));
+});
+
+/* ===== 9. broadcast ===== */
+t('broadcast mengirim ke semua + merangkum kegagalan', async () => {
+  const { bot } = buatBot(); await boot(bot);
+  bot.api.config.use(async (prev, method, payload) => {
+    if (method === 'sendMessage' && payload.chat_id === 99) {
+      const e = new Error('Forbidden: bot was blocked by the user');
+      e.description = 'bot was blocked by the user'; throw e;
+    }
+    return prev(method, payload);
+  });
+  const hasil = await bot.broadcast([1, 99, 2], 'tes', { delay: 0 });
+  assert.strictEqual(hasil.terkirim + hasil.gagal, 3);
+  assert.strictEqual(hasil.gagal, 1);
+  assert.strictEqual(hasil.errors[0].chatId, 99);
+});
+
+/* ===== 10. humanize ===== */
+t('humanize menerjemahkan error API populer', () => {
+  assert.ok(/diblokir/i.test(humanize(new Error('bot was blocked by the user')).saran));
+  const asing = humanize(new Error('sesuatu yang tidak dikenal'));
+  assert.strictEqual(asing.saran, null);
+});
+
+/* ===== 11. session default ===== */
+t('ctx.session selalu {} tanpa setup apa pun', async () => {
+  const { bot } = buatBot(); await boot(bot);
+  let seen = null;
+  bot.on('message:text', (ctx) => { seen = ctx.session; });
+  await bot.handleUpdate(uMsg('cek sesi'));
+  assert.ok(seen && typeof seen === 'object');
+});
+
+/* ===== 12. onError kustom ===== */
+t('onError kustom menerima err+ctx, handler error TIDAK crash', async () => {
+  const { bot } = buatBot(); await boot(bot);
+  const got = [];
+  bot.opts.onError = (err, ctx) => got.push([String(err), ctx && ctx.chat.id]);
+  bot.cmd('boom', () => { throw new Error('meledak'); });
+  await bot.handleUpdate(uMsg('/boom'));
+  assert.strictEqual(got.length, 1);
+  assert.ok(/meledak/.test(got[0][0]) && got[0][1] === 555);
+});
+
+/* ===== 13. polling 409 → auto-retry; stop bersih ===== */
+t('launch: getUpdates 409 → retry halus; stop() resolve runPromise', async () => {
+  let polls = 0;
+  const transport = async (method) => {
+    if (method === 'getMe') return { id: 1, is_bot: true, first_name: 'X', username: 'x' };
+    if (method === 'getUpdates') {
+      polls++;
+      if (polls === 1) { const e = new Error('terminated by other getUpdates request'); e.error_code = 409; e.description = e.message; throw e; }
+      await new Promise((r) => setTimeout(r, 40));
+      return [];
+    }
+    return true;
+  };
+  const bot = new TeleBibz('123456:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', { silent: true, transport });
+  await bot.launch({ noSignalHandlers: true, conflictDelay: 25 });
+  await new Promise((r) => setTimeout(r, 200));
+  bot.stop();
+  await bot.runPromise;
+  assert.ok(polls >= 2, `harus retry minimal sekali, polls=${polls}`);
+});
+
+/* ===== 15. Proxy API generik: metode apapun ===== */
+t('Proxy: api.metodeBebas(payload) → callApi mentah', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  await bot.api.sendDiceCustom({ chat_id: 1, emoji: '🎲' });
+  const c = calls.find((x) => x.method === 'sendDiceCustom');
+  assert.ok(c && c.payload.emoji === '🎲');
+});
+
+/* ===== 16. transformer pipeline ===== */
+t('api.config.use: transformer melihat semua panggilan', async () => {
+  const { bot } = buatBot(); await boot(bot);
+  const seen = [];
+  bot.api.config.use(async (prev, m, p) => { seen.push(m); return prev(m, p); });
+  await bot.api.sendMessage(1, 'a'); await bot.api.getMyCommands();
+  assert.deepStrictEqual(seen, ['sendMessage', 'getMyCommands']);
+});
+
+/* ===== 17. autoRetry menahan 429 sekali ===== */
+t('autoRetry: 429 + retry_after dihormati lalu sukses', async () => {
+  let hits = 0;
+  const tr = async (m) => { hits++; if (hits === 1) { const e = new Error('Too Many Requests'); e.error_code = 429; e.parameters = { retry_after: 0 }; throw e; } return true; };
+  const out = await autoRetry({ maxRetry: 2, baseDelayMs: 1 })(tr, 'sendMessage', {});
+  assert.ok(out === true && hits === 2);
+});
+
+/* ===== 18. throttler memanggil berurutan ===== */
+t('throttler: semua panggilan lolos berurutan', async () => {
+  const order = []; const tr = async (m) => { order.push(m); return m; };
+  const th = throttler({ perSecond: 1000 });
+  await Promise.all([th(tr, 'a', {}), th(tr, 'b', {}), th(tr, 'c', {})]);
+  assert.deepStrictEqual(order, ['a', 'b', 'c']);
+});
+
+/* ===== 19. limiter menahan spam ===== */
+t('limiter: update ke-4 dalam window ditahan', async () => {
+  const { bot } = buatBot(); await boot(bot);
+  let hits = 0;
+  bot.use(limiter({ windowMs: 60000, limit: 3 }));
+  bot.on(':text', () => { hits++; });
+  for (let i = 0; i < 5; i++) await bot.handleUpdate(uMsg('x' + i));
+  assert.strictEqual(hits, 3);
+});
+
+/* ===== 20. Menu render + tekan ===== */
+t('Menu: render keyboard & handler tombol jalan', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  const mc = new MenuContainer();
+  const m = mc.create('cfg');
+  let pressed = 0;
+  m.text('Tombol', async (ctx) => { pressed++; await ctx.answerCallbackQuery('sip'); });
+  bot.use(mc);
+  const rm = await m.render({});
+  const cbData = rm.inline_keyboard[0][0].callback_data;
+  assert.strictEqual(cbData, 'cfg|0');
+  await bot.handleUpdate({ update_id: ++uid, callback_query: { id: 'c1', from: USER, chat_instance: 'x', data: cbData, message: { message_id: 9, from: { id: 99, is_bot: true, first_name: 'B' }, chat: CHAT, date: 1 } } });
+  assert.strictEqual(pressed, 1);
+  assert.ok(calls.some((c) => c.method === 'answerCallbackQuery' && c.payload.text === 'sip'));
+});
+
+/* ===== 21. inlineQuery ===== */
+t('inlineQuery: regex cocok, answerInlineQuery terkirim', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.inlineQuery(/kucing/i, async (ctx) => {
+    await ctx.answerInlineQuery([iq.article('1', 'Kucing garong', { message_text: 'meong!' })], { cache_time: 0 });
+  });
+  await bot.handleUpdate({ update_id: ++uid, inline_query: { id: 'i1', from: USER, query: 'kucing lucu', offset: '' } });
+  const c = calls.find((x) => x.method === 'answerInlineQuery');
+  assert.ok(c && c.payload.results[0].type === 'article');
+});
+
+/* ===== 22. replyWithMediaGroup ===== */
+t('replyWithMediaGroup membentuk payload media', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.cmd('album', (ctx) => ctx.replyWithMediaGroup([
+    InputMediaBuilder.photo('https://a/1.jpg'), InputMediaBuilder.photo('https://a/2.jpg', { caption: 'dua' }),
+  ]));
+  await bot.handleUpdate(uMsg('/album'));
+  const c = calls.find((x) => x.method === 'sendMediaGroup');
+  assert.ok(c && c.payload.media.length === 2 && c.payload.media[1].caption === 'dua');
+});
+
+/* ===== 23. composer lanjutan: branch/drop/filter ===== */
+t('branch/drop/filter berperilaku benar (semantik grammY)', async () => {
+  // bot A: branch memilih sub-pohon
+  const A = buatBot(); await boot(A.bot);
+  const tagA = [];
+  A.bot.branch((ctx) => ctx.msg.text === 'yes', async () => { tagA.push('A'); }, async () => { tagA.push('B'); });
+  await A.bot.handleUpdate(uMsg('yes'));
+  await A.bot.handleUpdate(uMsg('no'));
+  assert.deepStrictEqual(tagA, ['A', 'B']);
+
+  // bot B: filter menjalankan hanya saat cocok; drop menahan saat cocok
+  const B = buatBot(); await boot(B.bot);
+  const tagB = [];
+  B.bot.filter((ctx) => ctx.msg.text.startsWith('fi'), async () => { tagB.push('F'); });
+  B.bot.drop((ctx) => ctx.msg.text === 'toxic', async () => { tagB.push('TERTAHAN'); });
+  await B.bot.handleUpdate(uMsg('file update'));
+  await B.bot.handleUpdate(uMsg('toxic'));        // drop(pred=true) → mw ditahan ✓
+  await B.bot.handleUpdate(uMsg('bukan cocok'));  // drop(pred=false) → mw jalan ✓
+  assert.deepStrictEqual(tagB, ['F', 'TERTAHAN']);
+});
+
+/* ===== 24. ctx.getFile pilih photo terbesar ===== */
+t('ctx.getFile() memilih ukuran photo terbesar', async () => {
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.on('message:photo', async (ctx) => { const f = await ctx.getFile(); await ctx.reply('got:' + f.file_path || 'x'); });
+  await bot.handleUpdate({
+    update_id: ++uid,
+    message: { message_id: ++mid, from: USER, chat: CHAT, date: 1, photo: [
+      { file_id: 'kecil', width: 90, height: 90 }, { file_id: 'besar', width: 800, height: 600 },
+    ] },
+  });
+  const g = calls.find((c) => c.method === 'getFile');
+  assert.ok(g && g.payload.file_id === 'besar');
+});
+
+/* ===== 14. webhook handler Node murni ===== */
+t('webhook(): body JSON diproses handleUpdate', async () => {
+  const { Readable } = require('stream');
+  const { bot, calls } = buatBot(); await boot(bot);
+  bot.cmd('start', (ctx) => ctx.reply('hai webhook'));
+  const handler = bot.webhook();
+  const upd = uMsg('/start');
+  const req = Readable.from([JSON.stringify(upd)]);
+  let status = 0, bodyOut = '';
+  const res = { set statusCode(v) { status = v; }, get statusCode() { return status; }, setHeader() {}, end(b) { bodyOut = b; } };
+  await handler(req, res);
+  assert.strictEqual(status, 200);
+  assert.ok(texts(calls).some((x) => /hai webhook/.test(x)));
+});

package/CODE_OF_CONDUCT.md

@@ -1,37 +0,0 @@
-# Code of Conduct
-
-## Our pledge
-
-We are committed to making participation in the telebibz community welcoming, respectful, technically rigorous, and safe for everyone. Contributors, maintainers, reviewers, users, and other participants are expected to act in good faith and to prioritize constructive collaboration.
-
-## Expected behavior
-
-Participants should communicate clearly and respectfully, assume good intent while discussing technical disagreements, provide actionable feedback, document relevant context, respect privacy and confidentiality, and accept that maintainers may make decisions based on project scope, security, compatibility, and release risk.
-
-When reporting a defect or security issue, include reproducible technical information without publishing secrets, personal data, or exploit details that could put users at risk. When reviewing code, focus on the implementation and its consequences rather than the person who wrote it.
-
-## Unacceptable behavior
-
-Harassment, discrimination, threats, intimidation, personal attacks, doxxing, deliberate disruption, sexualized conduct in project spaces, impersonation, publishing private information without consent, spam, and knowingly submitting malicious or deceptive changes are not acceptable. Attempts to bypass project security controls, expose credentials, poison dependencies, or manipulate release automation are treated as serious violations.
-
-## Scope
-
-This Code of Conduct applies to repository issues, pull requests, discussions, reviews, commits, releases, documentation, official project channels, and any interaction where a participant is representing telebibz or its maintainers.
-
-## Enforcement
-
-Maintainers may remove or edit content, close discussions, restrict participation, reject contributions, revoke project permissions, or take other proportionate action. Serious or repeated violations may result in a permanent ban from project spaces. Enforcement decisions consider the severity, intent, impact, recurrence, and available evidence.
-
-## Reporting
-
-Report conduct concerns privately to the maintainers through the repository's private security/contact channel. Do not open a public issue for sensitive reports. Include links, dates, relevant usernames, and a concise description of what occurred. Do not include credentials or unnecessary personal information.
-
-Security vulnerabilities must be reported according to [SECURITY.md](SECURITY.md), not through a public issue.
-
-## Appeals
-
-A participant may request a review of an enforcement decision by providing relevant context privately. Appeals are reviewed by a maintainer who was not the sole decision-maker for the original action where practical. Retaliation against a good-faith report or appeal is prohibited.
-
-## Attribution
-
-This policy is informed by the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/), adapted for the technical and security needs of this project.

package/CONTRIBUTING.md

@@ -1,59 +0,0 @@
-# Contributing to telebibz
-
-Thank you for helping improve telebibz. Contributions are welcome when they are focused, reproducible, tested, documented, and compatible with the project's security and release policies.
-
-## Before you start
-
-Read [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), [CONTRIBUTION_RULES.md](CONTRIBUTION_RULES.md), [SECURITY.md](SECURITY.md), and [RELEASE_POLICY.md](RELEASE_POLICY.md). Do not open a public issue for a security vulnerability or include tokens, private chat identifiers, production payloads, or other sensitive data in an issue, pull request, test, log, screenshot, or commit.
-
-Check existing issues and pull requests before opening a new one. For a defect, use the bug template and include a minimal reproduction. For a new capability, use the feature template and explain the public API, behavior, compatibility, and testing implications.
-
-## Local setup
-
-The project requires Node.js `>=22` and uses npm for release-compatible commands. Install dependencies and run the baseline checks:
-
-```bash
-npm ci
-npm run typecheck
-npm run test:types
-npm run test:examples
-npm run lint
-npm test
-npm run build
-npm run security
-npm run release:check
-```
-
-The credential-gated Telegram E2E suite is skipped unless the required test environment variables are provided. Never use production credentials in tests. Use `MockTransport`, `createTestBot()`, `createMockUpdate()`, and the integration fixtures for deterministic tests.
-
-## Branches and commits
-
-Create a focused branch from `main`. Keep unrelated refactors out of a feature or bug-fix pull request. Use an imperative Conventional Commit-style message, for example `fix: isolate polling handler failures` or `docs: expand storage adapter reference`. Include `[skip release]` only when a change must not trigger the GitHub-to-npm release workflow; maintainers may remove that marker when a release is appropriate.
-
-## Implementation expectations
-
-Public behavior must be implemented in TypeScript with strict typing. Do not add fake responses, silent stubs, undocumented breaking behavior, or untested branches. Preserve ESM and CommonJS builds, zero runtime vendor dependencies in the core package, Node.js `>=22` compatibility, and the existing package export map.
-
-Changes to routing, context, lifecycle, transport, storage, queue, scheduler, approval, generated API declarations, or release automation require regression tests. Changes to a public function, class, method, option, error, event, or generated method require a corresponding API documentation update. Changes to examples require `npm run test:examples` and must use placeholders instead of credentials. Changes that affect package contents must pass `release:check` and `npm pack --dry-run`.
-
-## Pull request process
-
-Open a pull request against `main` and complete the pull request template. Explain the problem, solution, compatibility impact, test evidence, documentation changes, and security implications. Keep the diff reviewable. Maintainers may request changes, split a pull request, or ask for a follow-up issue when scope is too broad.
-
-Every pull request must pass the CI workflow. A maintainer reviews API compatibility, error handling, tests, documentation, package contents, and release impact before approval. Do not merge while required checks are failing or unresolved security concerns remain.
-
-## Documentation and translations
-
-English is the default README language. Keep `README.id.md`, `README.zh-CN.md`, `docs/API.id.md`, and `docs/API.zh-CN.md` synchronized when public behavior changes. Code signatures, method names, package names, environment variables, and command names must remain exact in every translation.
-
-## Release process
-
-Normal pushes to `main` can trigger the protected auto-publish workflow. The workflow runs quality gates, computes an unused patch version, publishes the package, commits the version, creates a tag, and creates a GitHub Release. See [RELEASE_AUTOMATION.md](RELEASE_AUTOMATION.md) for the required `NPM_TOKEN` secret and private-source provenance constraint. Contributors must not publish directly to npm unless explicitly authorized by the maintainers.
-
-## Showcase submissions
-
-Public projects using Telebibz may be submitted through a pull request to [SHOWCASE.md](SHOWCASE.md). Include only public links and a short description. Never include bot tokens, private endpoints, personal data, or confidential source code.
-
-## Questions
-
-Use the question/support template for usage questions and consult the [English API reference](docs/API.md) first. Keep support requests free of credentials and private user data.

package/CONTRIBUTION_RULES.md

@@ -1,41 +0,0 @@
-# Contribution Rules
-
-These rules are the operational requirements for contributions to telebibz. They complement [CONTRIBUTING.md](CONTRIBUTING.md) and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
-
-## Scope and ownership
-
-A contribution must have a clear owner, a stated problem, and a bounded outcome. Large changes should be split into reviewable pull requests. Maintainers may reject work that is technically correct but outside the package scope, duplicates an existing design, introduces unnecessary dependencies, or creates disproportionate maintenance cost.
-
-## API and compatibility rules
-
-Public exports, constructor options, method signatures, event names, error classes, generated method names, package entrypoints, and persisted data formats are compatibility-sensitive. A breaking change requires an explicit migration note, a versioning decision, updated type-level tests, and maintainer approval.
-
-New public APIs must have strict TypeScript types, runtime validation where input can be unsafe, deterministic error behavior, examples, and API reference documentation. Avoid `any` in public signatures. When a Telegram type is not specialized in the core method map, use the vendored `TelegramTypes` declarations or an honest generic boundary rather than inventing an inaccurate shape.
-
-## Runtime and error-handling rules
-
-Network operations must honor timeout and cancellation behavior. Retry logic must be bounded and must not retry authentication or validation failures blindly. Update handlers must not terminate polling because one update failed. Background tasks must surface errors through documented hooks or events and must not create unhandled promise rejections.
-
-Callback-query handling must work for both message-backed and inline callbacks. Router behavior must state whether first-match or all-match is used. Nested middleware must not execute terminal handlers twice. Persistent state must use the `Storage` abstraction and must document consistency, TTL, and driver assumptions.
-
-## Testing rules
-
-A pull request must add or update tests for every changed behavior. Use unit tests for pure logic, integration tests for module boundaries, type-level tests for public signatures, and credential-gated E2E tests only for real Telegram behavior that cannot be represented safely by mocks. Tests must be deterministic and must clean up timers, temporary files, listeners, and network resources.
-
-A bug fix is incomplete without a regression test that fails against the old behavior. A feature is incomplete without tests for success, invalid input, cancellation, retry/failure, and boundary behavior where applicable.
-
-## Documentation rules
-
-Documentation must describe the implementation that exists in source, not a planned feature. Every documented limitation must remain accurate. English is canonical; Indonesian and Simplified Chinese translations must preserve signatures, code blocks, URLs, environment variables, and command names exactly.
-
-## Dependency and security rules
-
-Do not add a runtime dependency without a written justification, license review, bundle/package impact analysis, and maintainer approval. Never commit credentials, private keys, Telegram tokens, npm tokens, test secrets, or real user data. Security-sensitive changes require review of [SECURITY.md](SECURITY.md) and must not be disclosed publicly before a fix or coordinated disclosure decision.
-
-## Release and repository rules
-
-Do not edit or overwrite an already published npm version. Do not manually create a release tag that conflicts with the protected workflow. Do not bypass required checks, disable security audit, weaken release checks, or modify workflow permissions without maintainer approval. Use `[skip release]` only for changes that must not publish a package.
-
-## Review standards
-
-Reviewers should verify correctness, compatibility, tests, documentation, security, package contents, and operational behavior. Approval is not a guarantee that no defect exists; it confirms that the change meets the current project acceptance criteria and is safe to merge based on the available evidence.

package/GOVERNANCE.md

@@ -1,47 +0,0 @@
-# Governance
-
-## Project purpose
-
-telebibz is a TypeScript Telegram Bot Framework. Governance exists to preserve a stable public API, honest feature scope, secure release automation, and a respectful contributor community.
-
-## Roles
-
-| Role | Responsibility |
-|---|---|
-| Users | Report reproducible defects, explain use cases, and provide feedback without publishing secrets. |
-| Contributors | Submit focused code, tests, documentation, and issue reports that follow the project rules. |
-| Reviewers | Examine correctness, compatibility, security, tests, documentation, and operational risk. |
-| Maintainers | Set project direction, review and merge changes, manage releases, triage issues, and protect the repository. |
-| Release maintainers | Control npm credentials, GitHub Actions environments, version tags, npm publication, and release verification. |
-
-One person may hold multiple roles, but security-sensitive actions should use separation of duties whenever practical.
-
-## Decision-making
-
-Routine decisions are made by maintainers through pull request review and documented issue discussion. Decisions should be based on user benefit, implementation quality, compatibility, security, maintenance cost, and evidence from tests or production reports.
-
-For controversial or breaking changes, maintainers should document alternatives, migration impact, and the reason for the selected approach. A maintainer may request a design note before implementation. Silence is not approval for a breaking change.
-
-## Triage
-
-New issues are initially classified as bug, feature, documentation, security, support, or duplicate. Maintainers may request a reproduction, reduce sensitive details, split scope, mark a report as blocked, or close it when the requested behavior conflicts with the documented project contract.
-
-Security reports are handled privately according to [SECURITY.md](SECURITY.md). Public issues must not contain exploit instructions, credentials, or personal data.
-
-## Pull requests
-
-A pull request requires a passing CI workflow and at least one maintainer review. Changes affecting authentication, transport, update dispatch, persistence, release automation, package exports, or security policy may require additional review. Maintainers can require a regression test, API documentation, migration note, or threat-model explanation before merge.
-
-## Releases
-
-The protected GitHub Actions workflow is the canonical release path. It runs quality gates, computes a new immutable npm version, publishes the package, creates a version commit and tag, and creates a GitHub Release. Direct npm publication is restricted to authorized release maintainers. Release credentials must remain in GitHub or npm secret storage and must be rotated after exposure.
-
-Because the source repository is private, the workflow uses npm publish without provenance. If the repository becomes public and provenance is enabled, the policy and workflow must be reviewed together before the next release.
-
-## Repository protection
-
-Required CI checks, branch protection, environment approvals, workflow permissions, package scope, and immutable release rules must not be weakened casually. Any change to these controls requires a pull request, a written rationale, and maintainer approval.
-
-## Amendments
-
-Governance changes are proposed through a pull request that explains the current problem, proposed rule, affected roles, and migration plan. The updated governance document becomes effective when the pull request merges.