create-stitchkit 0.6.8 → 0.6.10

package/CHANGELOG.md

@@ -12,6 +12,28 @@ step is overwritten by the next release.
 
 ## [Unreleased]
 
+## [0.6.10] - 2026-10-05
+
+### Changed
+
+- Generated projects track Stitchkit `^0.105.0`. The template's query-client test
+  builds its `ApiError` values with named options (`{ status: 500 }`), which 0.105
+  requires; a project that upgrades its own Stitchkit past 0.104 migrates the same
+  way (see Stitchkit's upgrading guide).
+- The Telegram-bot template's journal no longer passes a token pattern: with
+  Stitchkit 0.101 every logger masks a bot token by shape and keeps the bot's
+  id (`123456:[redacted]`), and an error's own fields reach the line.
+
+## [0.6.9] — 2026-09-29
+
+### Changed
+
+- Generated projects track Stitchkit `^0.100.3`, which adds Telegram screens,
+  message markup, webhook ownership and durable update intake, and keyboard
+  layers for React.
+- Generated projects pin `packageManager: bun@1.4.2`, the current Bun, in the
+  full-stack, agent and Telegram-bot templates.
+
 ## [0.6.8] — 2026-09-28
 
 ### Changed

package/dist/cli.js

@@ -197,8 +197,8 @@ function createApplicationIdentity(destination, displayName) {
     }
   });
 }
-function withIdentity(declaration2, identity) {
-  const copied = parseProjectDeclaration(declaration2);
+function withIdentity(declaration, identity) {
+  const copied = parseProjectDeclaration(declaration);
   return parseProjectDeclaration({ ...copied, identity });
 }
 
@@ -425,13 +425,13 @@ async function scaffoldProject(templateDirectory, destination, options = {}) {
       await rm(join(resolvedDestination, "bun.lock"), { force: true });
     }
     const declarationPath = join(resolvedDestination, "project.json");
-    const declaration2 = withIdentity(JSON.parse(await readFile(declarationPath, "utf8")), identity);
-    await writeFile(declarationPath, `${JSON.stringify(declaration2, undefined, 2)}
+    const declaration = withIdentity(JSON.parse(await readFile(declarationPath, "utf8")), identity);
+    await writeFile(declarationPath, `${JSON.stringify(declaration, undefined, 2)}
 `);
     if (options.identityModule !== false) {
       const identityPath = join(resolvedDestination, APP_IDENTITY_PATH);
       await mkdir(dirname(identityPath), { recursive: true });
-      await writeFile(identityPath, renderAppIdentityModule(declaration2.identity));
+      await writeFile(identityPath, renderAppIdentityModule(declaration.identity));
     }
     const manifestPath = join(resolvedDestination, "package.json");
     const manifest = RootManifestSchema.parse(JSON.parse(await readFile(manifestPath, "utf8")));
@@ -548,10 +548,10 @@ if (import.meta.main) {
 }
 async function roleAddresses(destination) {
   try {
-    const declaration2 = parseProjectDeclaration(JSON.parse(await readFile2(join2(destination, "project.json"), "utf8")));
+    const declaration = parseProjectDeclaration(JSON.parse(await readFile2(join2(destination, "project.json"), "utf8")));
     const environment = readEnvironmentExample(await readFile2(join2(destination, ".env.example"), "utf8"));
     const host = environment.BIND_HOST ?? "127.0.0.1";
-    return declaration2.roles.flatMap((role) => {
+    return declaration.roles.flatMap((role) => {
       const port = role.listener && environment[role.listener.portVariable];
       if (!role.listener || !port)
         return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-stitchkit",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "Create a production-shaped Stitchkit application",
   "license": "MIT",
   "author": "Max Listov <maxlistov@gmail.com>",
@@ -84,11 +84,11 @@
     "@types/react": "^19.3.0",
     "ai": "^7.0.111",
     "react": "^19.3.0",
-    "stitchkit": "0.100.1",
+    "stitchkit": "0.105.0",
     "typescript": "^7.0.2"
   },
   "engines": {
     "bun": ">=1.2.0"
   },
-  "packageManager": "bun@1.3.14"
+  "packageManager": "bun@1.4.2"
 }

package/template/bun.lock

@@ -145,7 +145,7 @@
     "zod": "4.6.5",
   },
   "catalog": {
-    "stitchkit": "^0.100.1",
+    "stitchkit": "^0.105.0",
   },
   "packages": {
     "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.89", "", { "dependencies": { "@ai-sdk/provider": "4.0.17", "@ai-sdk/provider-utils": "5.0.45", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-n0Q88UUASYQBGK3Ogs9pCe8h3ZXeTHFSuGOLBJAyH73MVGNKUv9w8EJX2f340WUF3eDWWOV305gO7YBpSCPblA=="],
@@ -1128,7 +1128,7 @@
 
     "std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
 
-    "stitchkit": ["stitchkit@0.100.1", "", { "dependencies": { "ky": "^2.1.0" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2 || ^2.0.0", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.1.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.2", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.4.2", "ai": "^7.0.107", "google-auth-library": "^11.1.0", "grammy": "^1.46.0", "maxmind": "^5.0.7", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5 || ^1.0.5", "zod": "^4.6.5" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "google-auth-library", "grammy", "maxmind", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"], "bin": { "stitchkit": "dist/entrypoints/bin/upgrade-cli.js" } }, "sha512-zpJEfRl2xe/2JzxyIuxuZrFBe/i2mtEZTa3p+wZNbN6L3wFlP7GfK2ak6MLwikuLYtbmB2N4qGKEcA7qTEMA/Q=="],
+    "stitchkit": ["stitchkit@0.105.0", "", { "dependencies": { "ky": "^2.1.0" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2 || ^2.0.0", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.1.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.2", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.4.2", "ai": "^7.0.107", "google-auth-library": "^11.1.0", "grammy": "^1.46.0", "maxmind": "^5.0.7", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5 || ^1.0.5", "zod": "^4.6.5" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "google-auth-library", "grammy", "maxmind", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"], "bin": { "stitchkit": "dist/entrypoints/bin/upgrade-cli.js" } }, "sha512-iYq2EuG3VS3fbtw92C/5MzSCSzwRss6UZI8QVJZhAojMxGFV2f/kpQpnCygHmeEPSHQNw+eWdzP6TVApMj5QPw=="],
 
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 

package/template/package.json

@@ -7,7 +7,7 @@
     "packages/*"
   ],
   "catalog": {
-    "stitchkit": "^0.100.1"
+    "stitchkit": "^0.105.0"
   },
   "overrides": {
     "@playwright/test": "1.63.0",
@@ -64,5 +64,5 @@
     "bun": ">=1.2.0",
     "node": ">=22"
   },
-  "packageManager": "bun@1.3.14"
+  "packageManager": "bun@1.4.2"
 }

package/template/packages/frontend/src/lib/query-client.test.ts

@@ -28,7 +28,7 @@ describe('query dehydration policy', () => {
     const defaults = getQueryClient().getDefaultOptions();
     const retry = defaults.queries?.retry;
     if (typeof retry !== 'function') throw new Error('query retry policy is required');
-    const serverFailure = new ApiError('INTERNAL_SERVER_ERROR', 500);
+    const serverFailure = new ApiError('INTERNAL_SERVER_ERROR', { status: 500 });
     expect(retry(0, serverFailure)).toBe(true);
     expect(retry(1, serverFailure)).toBe(false);
     expect(defaults.mutations?.retry).toBe(false);
@@ -39,7 +39,7 @@ describe('query dehydration policy', () => {
     const retry = defaults.queries?.retry;
     if (typeof retry !== 'function') throw new Error('query retry policy is required');
     for (const code of ['UNAUTHORIZED', 'FORBIDDEN', 'VALIDATION_ERROR']) {
-      expect(retry(0, new ApiError(code, 401))).toBe(false);
+      expect(retry(0, new ApiError(code, { status: 401 }))).toBe(false);
     }
   });
 });

package/templates/agent/package.json

@@ -32,5 +32,5 @@
   "engines": {
     "bun": ">=1.3.0"
   },
-  "packageManager": "bun@1.3.14"
+  "packageManager": "bun@1.4.2"
 }

package/templates/telegram-bot/package.json

@@ -26,5 +26,5 @@
   "engines": {
     "bun": ">=1.3.0"
   },
-  "packageManager": "bun@1.3.14"
+  "packageManager": "bun@1.4.2"
 }

package/templates/telegram-bot/src/log.ts

@@ -1,18 +1,15 @@
 import { createJsonLogger } from 'stitchkit/observability';
-import { TELEGRAM_BOT_TOKEN_PATTERN } from 'stitchkit/telegram';
 import type { Env } from './env';
 
 /**
  * The process journal: one JSON line per event on standard output. An `Error`
- * under any key keeps its name, message, stack and cause, and a bot token
- * inside a URL or an error message is masked. A line with `"level":50` is an
- * error — the one contract a supervisor reading the journal relies on.
+ * under any key keeps its name, message, stack, cause and own fields, and a bot
+ * token inside a URL or an error message is masked to `<bot id>:[redacted]`. A
+ * line with `"level":50` is an error — the one contract a supervisor reading
+ * the journal relies on.
  */
 export function createLog(env: Pick<Env, 'LOG_LEVEL'>) {
-  return createJsonLogger({
-    level: env.LOG_LEVEL,
-    sensitiveUrlPatterns: [TELEGRAM_BOT_TOKEN_PATTERN],
-  });
+  return createJsonLogger({ level: env.LOG_LEVEL });
 }
 
 export type Log = ReturnType<typeof createLog>;