create-stitchkit 0.6.6 → 0.6.8

package/CHANGELOG.md

@@ -12,6 +12,43 @@ step is overwritten by the next release.
 
 ## [Unreleased]
 
+## [0.6.8] — 2026-09-28
+
+### Changed
+
+- Generated projects track Stitchkit `^0.100.1`. The catalog stayed on
+  `^0.96.1` while 0.97.0–0.100.1 shipped, and on 0.x a caret never crosses a
+  minor, so a new project started four minors behind. The generated code needs
+  no change; what a project that grows past the new defaults must know — the
+  finite watch capacities of 0.100.0 among them — is in Stitchkit's
+  `docs/guide/upgrading.md`.
+
+### Fixed
+
+- The board keeps a note typed before the page hydrated. The text reached the
+  input but not React's state, so Post stayed disabled over a filled field — a
+  slow browser's end-to-end run timed out on it, and a person typing early saw
+  the same.
+
+## [0.6.7] — 2026-09-24
+
+### Fixed
+
+- **A bot from `--template telegram-bot` starts with an operators' chat.** With
+  `OPERATOR_CHAT_ID` set, the optional `operator-channel` was one of the bot's
+  dependencies, and the kernel refuses a required resource that depends on an
+  optional one: the bot started without the chat and not with it. The channel
+  now stands beside the bot and still drains on the way down; the template's
+  test starts the graph with the chat and with local Bot API files. A bot
+  generated from 0.6.5 or 0.6.6 moves the `operator-channel` resource out of the
+  `dependsOn` it passes to `grammyBotResources` and into the application's
+  `resources`.
+
+### Changed
+
+- Generated projects track Stitchkit `^0.96.1`, whose operator channel masks
+  a bot token before a message leaves.
+
 ## [0.6.6] — 2026-09-24
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-stitchkit",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Create a production-shaped Stitchkit application",
   "license": "MIT",
   "author": "Max Listov <maxlistov@gmail.com>",
@@ -84,7 +84,7 @@
     "@types/react": "^19.3.0",
     "ai": "^7.0.111",
     "react": "^19.3.0",
-    "stitchkit": "0.96.0",
+    "stitchkit": "0.100.1",
     "typescript": "^7.0.2"
   },
   "engines": {

package/template/bun.lock

@@ -145,7 +145,7 @@
     "zod": "4.6.5",
   },
   "catalog": {
-    "stitchkit": "^0.96.0",
+    "stitchkit": "^0.100.1",
   },
   "packages": {
     "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.89", "", { "dependencies": { "@ai-sdk/provider": "4.0.17", "@ai-sdk/provider-utils": "5.0.45", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-n0Q88UUASYQBGK3Ogs9pCe8h3ZXeTHFSuGOLBJAyH73MVGNKUv9w8EJX2f340WUF3eDWWOV305gO7YBpSCPblA=="],
@@ -1128,7 +1128,7 @@
 
     "std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
 
-    "stitchkit": ["stitchkit@0.96.0", "", { "dependencies": { "ky": "^2.1.0" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2 || ^2.0.0", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.1.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.2", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.4.2", "ai": "^7.0.107", "google-auth-library": "^11.1.0", "grammy": "^1.46.0", "maxmind": "^5.0.7", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5 || ^1.0.5", "zod": "^4.6.5" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "google-auth-library", "grammy", "maxmind", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"], "bin": { "stitchkit": "dist/entrypoints/bin/upgrade-cli.js" } }, "sha512-5cgzNatZtqE0HCXozqGXdcAeudG+QLxKXKZSHFasYu7O6JvU0rViDVO76hWFSwOiczaSoqsqwk/GM01ArMMUmw=="],
+    "stitchkit": ["stitchkit@0.100.1", "", { "dependencies": { "ky": "^2.1.0" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2 || ^2.0.0", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.1.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.2", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.4.2", "ai": "^7.0.107", "google-auth-library": "^11.1.0", "grammy": "^1.46.0", "maxmind": "^5.0.7", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5 || ^1.0.5", "zod": "^4.6.5" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "google-auth-library", "grammy", "maxmind", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"], "bin": { "stitchkit": "dist/entrypoints/bin/upgrade-cli.js" } }, "sha512-zpJEfRl2xe/2JzxyIuxuZrFBe/i2mtEZTa3p+wZNbN6L3wFlP7GfK2ak6MLwikuLYtbmB2N4qGKEcA7qTEMA/Q=="],
 
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 

package/template/e2e/starter.spec.ts

@@ -45,7 +45,8 @@ test('a note posted in one tab reaches another through the web origin and the so
   const writer = await browser.newPage();
   const reader = await browser.newPage();
   await Promise.all([writer.goto('/en'), reader.goto('/en')]);
-  const note = `note ${Date.now()}`;
+  // Browser projects share the backend and can post in the same millisecond.
+  const note = `note ${crypto.randomUUID()}`;
   await writer.getByRole('textbox', { name: 'Note' }).fill(note);
   await writer.getByRole('button', { name: 'Post' }).click();
   await expect(writer.getByText(note)).toBeVisible();

package/template/package.json

@@ -7,7 +7,7 @@
     "packages/*"
   ],
   "catalog": {
-    "stitchkit": "^0.96.0"
+    "stitchkit": "^0.100.1"
   },
   "overrides": {
     "@playwright/test": "1.63.0",

package/template/packages/frontend/src/features/board/board-panel.tsx

@@ -1,7 +1,7 @@
 'use client';
 
 import type { Board } from '@app/shared';
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import type { WatchStateFrame } from 'stitchkit/live';
 import {
   Button,
@@ -27,6 +27,14 @@ export function BoardPanel({ realtimeOrigin }: { realtimeOrigin?: string }) {
   const [state, setState] = useState<WatchStateFrame>();
   const [draft, setDraft] = useState('');
   const [posting, setPosting] = useState(false);
+  const draftInput = useRef<HTMLInputElement>(null);
+
+  // Text typed before hydration is in the input but not in state, which would
+  // leave Post disabled over a filled field. Take it once, on mount.
+  useEffect(() => {
+    const typed = draftInput.current?.value;
+    if (typed) setDraft(typed);
+  }, []);
 
   useEffect(() => {
     const watch = watchBoard(setBoard, setState, realtimeOrigin);
@@ -60,6 +68,7 @@ export function BoardPanel({ realtimeOrigin }: { realtimeOrigin?: string }) {
             maxLength={140}
             onChange={(event) => setDraft(event.target.value)}
             placeholder='Say something, then open a second tab'
+            ref={draftInput}
             value={draft}
           />
           <Button disabled={posting || draft.trim().length === 0} type='submit'>

package/templates/telegram-bot/README.md

@@ -16,9 +16,10 @@ bun run dev
 
 - `src/handlers.ts` — the product: commands, messages, what goes to the operators' chat.
 - `src/application.ts` — the resource graph: `database` → (`telegram-files`) →
-  (`operator-channel`) → `telegram-configuration` → `telegram-polling`. Queues, an
-  HTTP server for payment webhooks, schedules and metrics go between the database
-  and the bot.
+  `telegram-configuration` → `telegram-polling`, with the optional
+  `operator-channel` beside the bot rather than under it. Required resources the
+  handlers need — queues, an HTTP server for payment webhooks — join the bot's
+  dependencies; optional ones — the operators' chat, metrics — stand beside it.
 - `src/index.ts` — the entry point: environment, journal, signals, and the one
   policy for a poller that ended on its own (shut down, exit 1, let the supervisor
   restart).

package/templates/telegram-bot/src/application.ts

@@ -27,11 +27,14 @@ export interface BotApplicationConfig {
 /**
  * The graph, in start order:
  *
- *   database → [telegram-files] → [operator-channel] → telegram-configuration → telegram-polling
+ *   database → [telegram-files] → telegram-configuration → telegram-polling
+ *   [operator-channel]              beside the bot, not under it
  *
- * Product resources — queues, an HTTP server for payment webhooks, schedules,
- * metrics — go between the database and the bot, and join the bot's
- * `dependsOn` when handlers need them before the first update.
+ * The bot depends only on what it cannot answer without — required resources.
+ * An optional one (the operators' chat, metrics) stands beside the bot: a
+ * required resource may not depend on an optional one, and the bot must keep
+ * answering when the chat is unreachable. Queues and an HTTP server for
+ * payment webhooks are required and join the bot's `dependsOn`.
  */
 export function createBotApplication(config: BotApplicationConfig): ApplicationHandle {
   const database = createDatabase(config.databasePath);
@@ -59,17 +62,17 @@ export function createBotApplication(config: BotApplicationConfig): ApplicationH
     );
   }
   const operators = config.operators;
-  if (operators) {
-    botDependencies.push(
-      defineManagedResource({
-        id: 'operator-channel',
-        required: false,
-        start() {},
-        drain: (context) => operators.drain(context.signal),
-        close: () => operators.close(),
-      }),
-    );
-  }
+  const beside: ManagedResource[] = operators
+    ? [
+        defineManagedResource({
+          id: 'operator-channel',
+          required: false,
+          start() {},
+          drain: (context) => operators.drain(context.signal),
+          close: () => operators.close(),
+        }),
+      ]
+    : [];
 
   const telegram = grammyBotResources({
     bot: config.bot,
@@ -84,7 +87,7 @@ export function createBotApplication(config: BotApplicationConfig): ApplicationH
 
   return createApplication({
     id: 'telegram-bot',
-    resources: [...botDependencies, ...telegram.resources],
+    resources: [...botDependencies, ...beside, ...telegram.resources],
     shutdown: config.shutdown ?? { gracePeriodMs: 30_000, forceTimeoutMs: 5_000 },
     onResourceFailure: ({ resourceId, phase, error }) =>
       config.log.error('Resource failed', { resourceId, phase, error }),

package/templates/telegram-bot/tests/application.test.ts

@@ -1,5 +1,9 @@
 import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { Bot } from 'grammy';
+import { createTelegramLocalFiles, createTelegramOperatorChannel } from 'stitchkit/telegram';
 import { z } from 'zod';
 import { createBotApplication } from '../src/application';
 import { createLog } from '../src/log';
@@ -73,8 +77,12 @@ function fakeTelegram() {
 }
 
 const servers: { stop(): void }[] = [];
-afterEach(() => {
+const directories: string[] = [];
+afterEach(async () => {
   for (const server of servers.splice(0)) server.stop();
+  await Promise.all(
+    directories.splice(0).map((path) => rm(path, { recursive: true, force: true })),
+  );
 });
 
 async function until(check: () => boolean): Promise<void> {
@@ -117,4 +125,47 @@ describe('the bot application', () => {
     expect(Math.max(...telegram.offsets)).toBe(6);
     expect(ended).toEqual([]);
   });
+
+  test('starts with an operators chat and local Bot API files, and the channel drains on the way down', async () => {
+    const telegram = fakeTelegram();
+    servers.push(telegram);
+    const root = await mkdtemp(join(tmpdir(), 'template-bot-files-'));
+    directories.push(root);
+    await mkdir(join(root, '1:template'));
+    const bot = new Bot('1:template', { client: { apiRoot: telegram.origin } });
+    const posted: string[] = [];
+    const operators = createTelegramOperatorChannel<'users' | 'errors'>({
+      chatId: -100,
+      minIntervalMs: 1,
+      send: async (message) => void posted.push(message.text),
+    });
+    const app = createBotApplication({
+      bot,
+      databasePath: ':memory:',
+      log: createLog({ LOG_LEVEL: 'info' }),
+      operators,
+      files: createTelegramLocalFiles({ root, token: '1:template' }),
+      onPollingEnded: () => undefined,
+      shutdown: { gracePeriodMs: 2_000, forceTimeoutMs: 200 },
+    });
+
+    const snapshot = await app.start();
+    expect(snapshot.ready).toBe(true);
+    expect(snapshot.resources.map((resource) => resource.id)).toEqual([
+      'database',
+      'operator-channel',
+      'telegram-files',
+      'telegram-configuration',
+      'telegram-polling',
+    ]);
+    // The bot waits for what it cannot answer without, never for the chat.
+    expect(
+      snapshot.resources.find((resource) => resource.id === 'telegram-configuration')
+        ?.dependsOn,
+    ).toEqual(['database', 'telegram-files']);
+    telegram.push(8);
+    await until(() => posted.length > 0);
+    expect(posted).toEqual(['New user 7']);
+    expect((await app.shutdown()).outcome).toBe('clean');
+  });
 });