stitchkit 0.100.2 → 0.101.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (242) hide show
  1. package/CHANGELOG.md +153 -0
  2. package/README.md +2 -1
  3. package/dist/entrypoints/agent-runtime/browser.js +119 -119
  4. package/dist/entrypoints/agent-runtime/coding-tools.js +15 -20
  5. package/dist/entrypoints/agent-runtime/harness.js +55 -63
  6. package/dist/entrypoints/agent-runtime/openrouter.js +6 -6
  7. package/dist/entrypoints/agent-runtime/sandbox.js +20 -25
  8. package/dist/entrypoints/agent-runtime/sqlite/bun.js +11 -13
  9. package/dist/entrypoints/agent-runtime/sqlite/node.js +11 -13
  10. package/dist/entrypoints/agent-runtime/testing.js +32 -34
  11. package/dist/entrypoints/agent-runtime.js +395 -402
  12. package/dist/entrypoints/application/diagnostic-journal.js +26 -27
  13. package/dist/entrypoints/application/directory-inbox.js +16 -17
  14. package/dist/entrypoints/application/grammy.js +13 -13
  15. package/dist/entrypoints/application/opentelemetry.js +13 -13
  16. package/dist/entrypoints/application/schemas.js +24 -24
  17. package/dist/entrypoints/application.js +209 -210
  18. package/dist/entrypoints/bin/upgrade-cli.js +2 -2
  19. package/dist/entrypoints/cli.js +81 -84
  20. package/dist/entrypoints/contract.js +54 -57
  21. package/dist/entrypoints/declaration.js +22 -22
  22. package/dist/entrypoints/files.js +18 -21
  23. package/dist/entrypoints/geo.js +7 -8
  24. package/dist/entrypoints/google.js +2 -2
  25. package/dist/entrypoints/index.js +150 -154
  26. package/dist/entrypoints/live.js +45 -47
  27. package/dist/entrypoints/node.js +68 -74
  28. package/dist/entrypoints/oauth.js +6 -6
  29. package/dist/entrypoints/observability.d.ts +1 -0
  30. package/dist/entrypoints/observability.d.ts.map +1 -1
  31. package/dist/entrypoints/observability.js +116 -87
  32. package/dist/entrypoints/primitives.js +35 -35
  33. package/dist/entrypoints/react/keyboard.d.ts +4 -0
  34. package/dist/entrypoints/react/keyboard.d.ts.map +1 -0
  35. package/dist/entrypoints/react/keyboard.js +397 -0
  36. package/dist/entrypoints/react.js +10 -10
  37. package/dist/entrypoints/release.js +7 -7
  38. package/dist/entrypoints/remote.js +15 -17
  39. package/dist/entrypoints/server.js +198 -200
  40. package/dist/entrypoints/telegram/html.d.ts +5 -0
  41. package/dist/entrypoints/telegram/html.d.ts.map +1 -0
  42. package/dist/entrypoints/telegram/html.js +26 -0
  43. package/dist/entrypoints/telegram/screens.d.ts +14 -0
  44. package/dist/entrypoints/telegram/screens.d.ts.map +1 -0
  45. package/dist/entrypoints/telegram/screens.js +2028 -0
  46. package/dist/entrypoints/telegram.d.ts +11 -3
  47. package/dist/entrypoints/telegram.d.ts.map +1 -1
  48. package/dist/entrypoints/telegram.js +779 -159
  49. package/dist/entrypoints/testing.js +75 -79
  50. package/dist/entrypoints/tools/connections.js +30 -32
  51. package/dist/entrypoints/tools/contract.js +18 -20
  52. package/dist/entrypoints/tools/invoker.js +12 -17
  53. package/dist/entrypoints/tools.js +224 -229
  54. package/dist/entrypoints/tracking/server.js +6 -6
  55. package/dist/entrypoints/tracking.js +40 -42
  56. package/dist/entrypoints/voice.js +3 -3
  57. package/dist/{index-eaysmdtq.js → index-0ndk4555.js} +56 -56
  58. package/dist/{index-2bxbyab0.js → index-1bx1xv1k.js} +1 -1
  59. package/dist/{index-p5r7qpdd.js → index-1eeqpadm.js} +4 -4
  60. package/dist/{index-hadmp193.js → index-3ct7hhq6.js} +210 -210
  61. package/dist/{index-e01r054k.js → index-45tdvqa3.js} +26 -26
  62. package/dist/{index-dce5wxcq.js → index-4s0fep5q.js} +8 -8
  63. package/dist/index-50ejfz75.js +9 -0
  64. package/dist/{index-m9zn6cpq.js → index-5107q189.js} +12 -12
  65. package/dist/{index-sbdmyz75.js → index-5cc6r990.js} +3 -3
  66. package/dist/{index-c6bxbsnc.js → index-7kxw1awn.js} +2 -2
  67. package/dist/{index-0r0fbk7z.js → index-7z9ym7t8.js} +28 -28
  68. package/dist/{index-p7hgdyhb.js → index-814xpr6d.js} +2 -2
  69. package/dist/{index-gtj3zc53.js → index-8kzct1d6.js} +99 -99
  70. package/dist/{index-1zbbzgfh.js → index-9pw0a51a.js} +4 -4
  71. package/dist/{index-79z7m7dt.js → index-a9pd417t.js} +35 -35
  72. package/dist/{index-ham5sz8m.js → index-aaj97r4y.js} +45 -45
  73. package/dist/{index-s812ycat.js → index-aan6hqb9.js} +3 -3
  74. package/dist/{index-10x2hbx0.js → index-adhgd4pe.js} +44 -44
  75. package/dist/{index-2gxzjvyr.js → index-afjvjyck.js} +23 -23
  76. package/dist/{index-qmy6zq75.js → index-ahvsksw5.js} +16 -16
  77. package/dist/{index-hr4tzbwq.js → index-ap3gqe56.js} +3 -3
  78. package/dist/{index-znfs20ss.js → index-b2bz0kdm.js} +16 -16
  79. package/dist/{index-r066jx76.js → index-c6aagrbd.js} +148 -120
  80. package/dist/{index-k30h66yd.js → index-ck71tbcf.js} +9 -9
  81. package/dist/{index-eqqvgdb3.js → index-ct75c3at.js} +2 -2
  82. package/dist/{index-gw8bmyaj.js → index-djjhhgjk.js} +41 -41
  83. package/dist/{index-8qt2m66q.js → index-dvwj1f43.js} +43 -43
  84. package/dist/index-e05cjgtf.js +144 -0
  85. package/dist/{index-yw4fzmdz.js → index-e6c2spsd.js} +79 -30
  86. package/dist/{index-fhwqwxe0.js → index-ej331hah.js} +1 -1
  87. package/dist/{index-9t3dffv2.js → index-ewbaywk5.js} +5 -5
  88. package/dist/{index-7p1f0vp2.js → index-fyphpknh.js} +25 -25
  89. package/dist/{index-83bdg97s.js → index-g149e9pk.js} +1 -1
  90. package/dist/{index-ngfhvfpd.js → index-g6a3na27.js} +4 -4
  91. package/dist/{index-qwhynv6x.js → index-h124epcf.js} +20 -20
  92. package/dist/{index-h6eeys1v.js → index-h97tqqp1.js} +9 -9
  93. package/dist/{index-zcgf3gqf.js → index-hby4qhax.js} +10 -10
  94. package/dist/{index-5jrd0yng.js → index-j8aw2c0e.js} +4 -4
  95. package/dist/{index-d8m8zpd8.js → index-jzczzcsb.js} +14 -14
  96. package/dist/index-kqnd6a85.js +26 -0
  97. package/dist/{index-35mh5bhj.js → index-kw1ws0cs.js} +12 -12
  98. package/dist/{index-4gcnakhx.js → index-m38ej7e5.js} +2 -2
  99. package/dist/{index-ndddxtyx.js → index-m79yr938.js} +19 -19
  100. package/dist/{index-5p2m7we1.js → index-m9fndta6.js} +11 -11
  101. package/dist/index-mnkk1ffz.js +150 -0
  102. package/dist/index-n15jny5b.js +4 -0
  103. package/dist/{index-2vtcmrj9.js → index-n53mswt3.js} +20 -20
  104. package/dist/{index-bt14acb5.js → index-n5yqxd3d.js} +21 -21
  105. package/dist/{index-bm5rx7n6.js → index-n9tyz8z3.js} +12 -12
  106. package/dist/index-nmaqxdx7.js +463 -0
  107. package/dist/{index-mqv3b5rh.js → index-nx6eazt0.js} +30 -30
  108. package/dist/{index-3z73fh2c.js → index-q0th8q0z.js} +9 -9
  109. package/dist/{index-v260df89.js → index-qjeggp8w.js} +20 -20
  110. package/dist/{index-zfrhfn82.js → index-r1z0rd9c.js} +20 -20
  111. package/dist/{index-wqgjfstn.js → index-r5c4fedv.js} +3 -3
  112. package/dist/{index-cyktc4bp.js → index-r5hsgkz5.js} +118 -118
  113. package/dist/{index-0b1ess5e.js → index-r7a7r7ha.js} +1 -1
  114. package/dist/{index-1j8pm5t0.js → index-rfkh44ss.js} +15 -15
  115. package/dist/index-rz3z13e9.js +47 -0
  116. package/dist/{index-k6gpggb9.js → index-s80awwsw.js} +35 -35
  117. package/dist/{index-vqr7f7v8.js → index-ssmd41kh.js} +124 -124
  118. package/dist/index-sznqf8fx.js +20 -0
  119. package/dist/{index-ensd0r74.js → index-v14qqmys.js} +41 -41
  120. package/dist/{index-paz6sgdp.js → index-v4a2fjtk.js} +36 -36
  121. package/dist/{index-d9pk3td4.js → index-w0eqdhyd.js} +14 -14
  122. package/dist/{index-5qn1kx34.js → index-w575evhq.js} +29 -29
  123. package/dist/{index-3gye9wzb.js → index-w5s3xftz.js} +26 -26
  124. package/dist/{index-tm88avnj.js → index-wykebpn9.js} +3 -3
  125. package/dist/{index-sh3s86na.js → index-xkhk5d6g.js} +17 -17
  126. package/dist/{index-6k1937bx.js → index-xqhede6x.js} +4 -4
  127. package/dist/{index-f4fx2tza.js → index-zs4ms3th.js} +181 -181
  128. package/dist/{index-k5hsfc3j.js → index-zsvzhjtk.js} +1 -1
  129. package/dist/internal/secret-shapes.d.ts +21 -0
  130. package/dist/internal/secret-shapes.d.ts.map +1 -0
  131. package/dist/observability/bounded-logger.d.ts +2 -0
  132. package/dist/observability/bounded-logger.d.ts.map +1 -1
  133. package/dist/observability/sanitize.d.ts +6 -0
  134. package/dist/observability/sanitize.d.ts.map +1 -1
  135. package/dist/observability/secret-values.d.ts +25 -0
  136. package/dist/observability/secret-values.d.ts.map +1 -0
  137. package/dist/react/keyboard/hooks.d.ts +71 -0
  138. package/dist/react/keyboard/hooks.d.ts.map +1 -0
  139. package/dist/react/keyboard/layers.d.ts +98 -0
  140. package/dist/react/keyboard/layers.d.ts.map +1 -0
  141. package/dist/react/keyboard/zone.d.ts +139 -0
  142. package/dist/react/keyboard/zone.d.ts.map +1 -0
  143. package/dist/telegram/bot-api.d.ts +7 -4
  144. package/dist/telegram/bot-api.d.ts.map +1 -1
  145. package/dist/telegram/crypto.d.ts +16 -0
  146. package/dist/telegram/crypto.d.ts.map +1 -0
  147. package/dist/telegram/html/check.d.ts +26 -0
  148. package/dist/telegram/html/check.d.ts.map +1 -0
  149. package/dist/telegram/html/nodes.d.ts +70 -0
  150. package/dist/telegram/html/nodes.d.ts.map +1 -0
  151. package/dist/telegram/html/parse.d.ts +35 -0
  152. package/dist/telegram/html/parse.d.ts.map +1 -0
  153. package/dist/telegram/html/render.d.ts +39 -0
  154. package/dist/telegram/html/render.d.ts.map +1 -0
  155. package/dist/telegram/init-data.d.ts +3 -44
  156. package/dist/telegram/init-data.d.ts.map +1 -1
  157. package/dist/telegram/operator-channel.d.ts +19 -3
  158. package/dist/telegram/operator-channel.d.ts.map +1 -1
  159. package/dist/telegram/operator-dedupe.d.ts +44 -0
  160. package/dist/telegram/operator-dedupe.d.ts.map +1 -0
  161. package/dist/telegram/screens/callback-codec.d.ts +34 -0
  162. package/dist/telegram/screens/callback-codec.d.ts.map +1 -0
  163. package/dist/telegram/screens/dispatch.d.ts +22 -0
  164. package/dist/telegram/screens/dispatch.d.ts.map +1 -0
  165. package/dist/telegram/screens/display.d.ts +70 -0
  166. package/dist/telegram/screens/display.d.ts.map +1 -0
  167. package/dist/telegram/screens/execute.d.ts +57 -0
  168. package/dist/telegram/screens/execute.d.ts.map +1 -0
  169. package/dist/telegram/screens/html.d.ts +36 -0
  170. package/dist/telegram/screens/html.d.ts.map +1 -0
  171. package/dist/telegram/screens/outcome.d.ts +74 -0
  172. package/dist/telegram/screens/outcome.d.ts.map +1 -0
  173. package/dist/telegram/screens/path.d.ts +29 -0
  174. package/dist/telegram/screens/path.d.ts.map +1 -0
  175. package/dist/telegram/screens/reconcile.d.ts +67 -0
  176. package/dist/telegram/screens/reconcile.d.ts.map +1 -0
  177. package/dist/telegram/screens/registry.d.ts +23 -0
  178. package/dist/telegram/screens/registry.d.ts.map +1 -0
  179. package/dist/telegram/screens/render.d.ts +70 -0
  180. package/dist/telegram/screens/render.d.ts.map +1 -0
  181. package/dist/telegram/screens/runtime.d.ts +133 -0
  182. package/dist/telegram/screens/runtime.d.ts.map +1 -0
  183. package/dist/telegram/screens/screen-types.d.ts +130 -0
  184. package/dist/telegram/screens/screen-types.d.ts.map +1 -0
  185. package/dist/telegram/screens/screen.d.ts +138 -0
  186. package/dist/telegram/screens/screen.d.ts.map +1 -0
  187. package/dist/telegram/screens/state.d.ts +115 -0
  188. package/dist/telegram/screens/state.d.ts.map +1 -0
  189. package/dist/telegram/screens/telegram-screens.d.ts +18 -0
  190. package/dist/telegram/screens/telegram-screens.d.ts.map +1 -0
  191. package/dist/telegram/screens/test-chat-telegram.d.ts +47 -0
  192. package/dist/telegram/screens/test-chat-telegram.d.ts.map +1 -0
  193. package/dist/telegram/screens/test-chat.d.ts +66 -0
  194. package/dist/telegram/screens/test-chat.d.ts.map +1 -0
  195. package/dist/telegram/screens/view.d.ts +89 -0
  196. package/dist/telegram/screens/view.d.ts.map +1 -0
  197. package/dist/telegram/send-failure.d.ts +25 -0
  198. package/dist/telegram/send-failure.d.ts.map +1 -1
  199. package/dist/telegram/update-intake.d.ts +82 -0
  200. package/dist/telegram/update-intake.d.ts.map +1 -0
  201. package/dist/telegram/update-store-check.d.ts +22 -0
  202. package/dist/telegram/update-store-check.d.ts.map +1 -0
  203. package/dist/telegram/update-store-postgres.d.ts +33 -0
  204. package/dist/telegram/update-store-postgres.d.ts.map +1 -0
  205. package/dist/telegram/update-store-sqlite.d.ts +26 -0
  206. package/dist/telegram/update-store-sqlite.d.ts.map +1 -0
  207. package/dist/telegram/update-store.d.ts +67 -0
  208. package/dist/telegram/update-store.d.ts.map +1 -0
  209. package/dist/telegram/user.d.ts +51 -0
  210. package/dist/telegram/user.d.ts.map +1 -0
  211. package/dist/telegram/webhook.d.ts +105 -0
  212. package/dist/telegram/webhook.d.ts.map +1 -0
  213. package/dist/tools/cli/args-fields.d.ts +8 -0
  214. package/dist/tools/cli/args-fields.d.ts.map +1 -1
  215. package/dist/tools/cli/args-route.d.ts.map +1 -1
  216. package/dist/tools/cli/args.d.ts.map +1 -1
  217. package/dist/tools/cli/help.d.ts.map +1 -1
  218. package/llms/cli.txt +8 -2
  219. package/llms/observability.txt +15 -2
  220. package/llms/react-keyboard.txt +193 -0
  221. package/llms/server.4.txt +16 -0
  222. package/llms/stitchkit.txt +10 -4
  223. package/llms/telegram-html.txt +35 -0
  224. package/llms/telegram-screens.txt +365 -0
  225. package/llms/telegram.txt +245 -11
  226. package/llms/{upgrading-0.74.0-0.100.0.txt → upgrading-0.74.0-0.101.0.txt} +39 -3
  227. package/llms/upgrading.txt +1 -1
  228. package/llms-full.txt +889 -19
  229. package/llms.txt +12 -7
  230. package/package.json +17 -2
  231. package/dist/index-2k4yrqkc.js +0 -9
  232. package/dist/index-crykmqkr.js +0 -26
  233. package/dist/index-y64k3s0h.js +0 -150
  234. package/dist/index-y91ry9h2.js +0 -4
  235. /package/dist/{index-hffjpmq9.js → index-9jfdm5tg.js} +0 -0
  236. /package/dist/{index-zjjyynm3.js → index-d4pa2bgs.js} +0 -0
  237. /package/dist/{index-rxfy4cq7.js → index-dwfv9a85.js} +0 -0
  238. /package/dist/{index-5jm36zv1.js → index-gfk7nrht.js} +0 -0
  239. /package/dist/{index-b9aefrqd.js → index-n1dqr7gf.js} +0 -0
  240. /package/dist/{index-q3pyb9n0.js → index-sykb5ag7.js} +0 -0
  241. /package/dist/{index-48ffdxgk.js → index-xhzq2qvj.js} +0 -0
  242. /package/dist/{index-kzfs85xp.js → index-zsarb5xp.js} +0 -0
package/CHANGELOG.md CHANGED
@@ -15,6 +15,159 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
15
15
 
16
16
  ## [Unreleased]
17
17
 
18
+ ## [0.101.0] — 2026-09-29
19
+
20
+ ### ⚠️ Breaking changes
21
+
22
+ - **`stitchkit/telegram`** — `TelegramInitDataUser` is `TelegramUser`. The same
23
+ camelCase record now also comes out of `parseTelegramUser(ctx.from)`, so its
24
+ name says any Telegram user. `import type { TelegramInitDataUser }` →
25
+ `import type { TelegramUser }`.
26
+ - **`stitchkit/telegram`** — `TELEGRAM_BOT_TOKEN_PATTERN` matches the secret
27
+ half of a token only, after `<bot id>:`, so masking with it keeps the bot's id
28
+ (`123456:[redacted]`) — the only thing in a masked line that says which bot
29
+ failed. Masking no longer needs it at all: `redact` masks bot tokens by shape.
30
+ `sensitiveUrlPatterns: [TELEGRAM_BOT_TOKEN_PATTERN]` → nothing;
31
+ `text.replace(new RegExp(TELEGRAM_BOT_TOKEN_PATTERN.source, 'g'), …)` →
32
+ `redactTelegramBotToken(text)`. See ADR 0214 and the 0.101.0 migration in
33
+ `docs/guide/upgrading.md`.
34
+
35
+ **Who must act:** code that names the type `TelegramInitDataUser` (rename the
36
+ import), and code that uses `TELEGRAM_BOT_TOKEN_PATTERN` to find or cut a whole
37
+ token. Code that only passes the pattern to a logger keeps working — and can
38
+ drop it, since tokens are masked by shape.
39
+
40
+ ### Added
41
+
42
+ - `stitchkit/telegram` — `postgresTelegramUpdateStore`: the webhook update store
43
+ in Postgres over one `query(text, parameters)` the application already has —
44
+ Bun `sql.unsafe`, Prisma `$queryRawUnsafe`, `pg` `pool.query` — each rule one
45
+ conditional statement with explicit casts, so a claim is atomic across
46
+ processes and a driver returning `bigint` as a string or a `bigint` reads the
47
+ same. `postgresTelegramUpdateStoreSchema(table)` is the table for a migration;
48
+ `createTable: false` leaves the schema to it.
49
+ - `stitchkit/telegram` — `checkTelegramUpdateStore(make)`: every rule of
50
+ `TelegramUpdateStore` on a fresh store, eight claims raced against each other,
51
+ resolving with the violations. A store of one's own over an ORM is checked by
52
+ the rules the shipped memory, SQLite and Postgres stores pass.
53
+ - `stitchkit/telegram` — `createTelegramOperatorDedupe`: the operator channel's
54
+ dedupe window alone, for a bot that sends alerts itself — `(text, topic?)` is
55
+ `{ send: true, text }` with the held-back counts, or `{ send: false, reason }`.
56
+ - `stitchkit/telegram` — `parseTelegramUser`: grammY's `ctx.from`, a Bot API
57
+ `User` or a Mini App `user` as the one `TelegramUser` initData returns.
58
+ - `stitchkit/telegram` — `TELEGRAM_SEND_FAILURE_REASONS`, every reason as a
59
+ list; the reasons' traits are one table, so a new reason without its traits
60
+ does not compile.
61
+ - `stitchkit/telegram` — `redactTelegramBotToken(text)`.
62
+
63
+ ### Changed
64
+
65
+ - `stitchkit/observability` — `redact`, and so every logger and audit sink,
66
+ masks secrets by shape in every string: the secret half of a bot token, the
67
+ password in `scheme://user:password@host`, and the value of a query parameter
68
+ named as a secret (`token`, `access_token`, `api-key`, `key`, `sig`, …). A URL
69
+ in an error message is the usual way a token reaches a journal, and no key
70
+ name marks it.
71
+ - `stitchkit/observability` — an error keeps its own fields: a
72
+ `TelegramBotApiError`'s `error_code` and `parameters`, a provider's `status`,
73
+ written beside `name`, `message`, `stack` and `cause` and masked by the same
74
+ rules. A field holding a class instance other than an error — grammY's
75
+ `BotError.ctx` — is written as its class name, so one error cannot push its
76
+ line past the bound and lose the stack.
77
+
78
+ ### Fixed
79
+
80
+ - `stitchkit/telegram` — the update intake unwraps grammY's `BotError`: a
81
+ `retry`, an `onFailure` and the error stored with the update saw the wrapper
82
+ ("Error in middleware: …") instead of what the middleware threw, so a retry
83
+ policy could not recognise the bot's own terminal error and retried it.
84
+
85
+ ## [0.100.3] — 2026-09-29
86
+
87
+ ### Added
88
+
89
+ - `stitchkit/react/keyboard` (new, evolving) — which part of a React screen
90
+ gets a key. `useKeyLayer` puts a layer on one window-wide stack asked
91
+ `overlay` → `local` → `route` → `zone` → `global`, innermost first within a
92
+ kind (by element containment, so a panel outranks the page it mounted with);
93
+ a live overlay is a barrier, keys typed in fields pass layers by except
94
+ Escape, and the listener sits in the bubbling phase so widgets and fields keep
95
+ what they handle. `useEscapeLayer` closes one level per press, and a held
96
+ Escape closes one. `useNavZone` makes a list the arrows move through with real
97
+ focus — roving `tabIndex`, `listbox`/`tablist` roles or `aria-current`,
98
+ `select` and `highlight` modes, `onEnter`/`onExit` on the cross axis,
99
+ `onBoundary` or `loop` at the ends, and `onReveal` for a virtualized list
100
+ whose next row is not rendered yet — focus lands on it when it mounts. Hooks
101
+ only; `react` is the only peer.
102
+ → ADR 0212, [keyboard guide](docs/guide/keyboard.md)
103
+ - `stitchkit/telegram/html` (new, evolving; browser and server, no peer) —
104
+ Telegram's HTML parse mode as a tree. `parseTelegramHtml` turns any markup
105
+ into nodes Telegram accepts — synonyms renamed, block tags into line breaks, a
106
+ link only with an `href` Telegram opens, an entity where Telegram forbids it
107
+ (formatting inside `code`, a quote in a quote) kept as its words — and
108
+ `renderTelegramHtml` / `sanitizeTelegramHtml` write it back.
109
+ `splitTelegramHtml` cuts by what the reader sees, not the markup's length, at
110
+ a paragraph, a line, a space, never inside a character or a custom emoji, and
111
+ reopens every element across a cut with its attributes; `truncateTelegramHtml`,
112
+ `telegramHtmlText`, `checkTelegramHtml` (what Telegram would refuse, without
113
+ repairing), `escapeTelegramHtml`, `TELEGRAM_TEXT_LIMIT` /
114
+ `TELEGRAM_CAPTION_LIMIT`. → ADR 0213, [guide](docs/guide/telegram.md#message-markup)
115
+ - `stitchkit/telegram` — a bot on a webhook. `claimTelegramWebhook` sets the
116
+ webhook only where it already points to this address with this secret, or
117
+ where `takeoverFrom` names the current owner's host (`'none'` for no webhook);
118
+ the address carries an `owner` tag of the secret, so a copy of the production
119
+ address with another secret is refused (`TelegramWebhookClaimError`:
120
+ `owned-elsewhere`, `other-secret`, `not-confirmed`, hosts only).
121
+ `checkTelegramWebhook` notices a webhook that moved; `receiveTelegramWebhook`
122
+ answers a request — 403 without the secret, 200 once the update is recorded.
123
+ `createTelegramUpdateIntake` records an update before Telegram is answered and
124
+ handles it after: chat order kept, other chats alongside, a renewed lease per
125
+ attempt, a sweep that takes over what a restart or a dead process left,
126
+ retries, `maxAttempts`, repeats refused for `retainMs`; at least once. The
127
+ store is an interface of atomic steps, with `memoryTelegramUpdateStore` and
128
+ `sqliteTelegramUpdateStore` over a `bun:sqlite` or `node:sqlite` handle.
129
+ → ADR 0213, [guide](docs/guide/telegram.md#a-bot-on-a-webhook)
130
+ - `stitchkit/telegram` — `dedupe` on `createTelegramOperatorChannel`: one
131
+ message per fingerprint per window, the next one sent carries how many were
132
+ held back, and a budget per window turns a storm into one count; held-back
133
+ messages reach `onDropped` as `repeated` / `over-budget`. `sensitiveValues`
134
+ masks exact secrets.
135
+ - `stitchkit/observability` — `sensitiveValues` on `createJsonLogger`,
136
+ `createBoundedLogger` and `SanitizeOptions` masks exact secret values in every
137
+ string; `secretValuesFromEnv(env)` collects them from variables named as a
138
+ token, secret, key, password or credential and from inside URL variables,
139
+ URL-encoded too.
140
+ - `stitchkit/telegram/screens` (new, evolving) — a bot's menus as declared
141
+ screens over grammY. `telegramScreens<Ctx>()` declares screens and groups by
142
+ path (`tg.screen('/project/:id').load(…).action(…).on(…).view(…)`), with params
143
+ typed from the path literal, typed action buttons (`act.name(label, input)`)
144
+ and a group `load` that checks access for every screen under it. A view is
145
+ reconciled against what the chat shows by message key — only the part that
146
+ changed is edited, order holds, "not modified" and a deleted message are
147
+ absorbed — and the chat's record lives in any grammY `StorageAdapter`, so
148
+ navigation and waiting for input survive a restart. Outcomes `stay`, `go`,
149
+ `back`, `toast` and `notice` (a receipt, or a remark with `expiresInMs`);
150
+ input deleted before any load or handler unless `keepMessage`; a params
151
+ schema must accept its own output (a compile error otherwise); a refusal
152
+ halfway leaves the record on the screen the chat was on; `screens.open`,
153
+ `screens.button(link(…))` for notifications, `onStale`, `onError`, `onEvent`;
154
+ a forged `callback_data` never reaches a handler. `createScreenTestChat(bot)`
155
+ drives the application's own `Bot` against an in-memory Bot API. grammY is
156
+ named in the declarations only. → ADR 0211, [guide](docs/guide/telegram-screens.md)
157
+
158
+ ### Fixed
159
+
160
+ - `stitchkit/cli` — `--flag true` and `--flag false` after a boolean flag are
161
+ its value. The word used to be read as a positional argument: it filled the
162
+ first non-boolean field, so the refusal named a field nobody had touched, and
163
+ `--flag false` turned the flag on. The same for a short alias, a framework
164
+ flag (`--json false`) and an application option; any other word stays a
165
+ positional, and command help says so.
166
+ - `stitchkit/telegram` — `telegramOperatorSender({ parseMode: 'HTML' })` sends
167
+ markup Telegram accepts. The channel cuts a long text by characters, and the
168
+ cut could end inside a tag, so Telegram refused the message and it was dropped
169
+ as `refused`; the sender now cleans the markup and cuts it by what it shows.
170
+
18
171
  ## [0.100.2] — 2026-09-28
19
172
 
20
173
  ### Added
package/README.md CHANGED
@@ -445,9 +445,10 @@ peer — an install pulls in only what the project actually uses.
445
445
  | `stitchkit-tui` | separate optional package | Renderer-neutral `./core` state plus a Bun/OpenTUI terminal controller, commands, model/session pickers and authenticated local attachment over a caller-composed harness. |
446
446
  | `@openrouter/ai-sdk-provider` | peer, optional | Only `stitchkit/agent-runtime/openrouter`; neutral runtime imports do not resolve it. |
447
447
  | SQLite | runtime built-in, optional | `bun:sqlite` through `stitchkit/agent-runtime/sqlite/bun`, or `node:sqlite` on Node ≥ 22.5 through the Node leaf. |
448
- | `grammy` | peer, optional | Only `stitchkit/application/grammy`; the neutral application kernel does not resolve it. |
448
+ | `grammy` | peer, optional | Only `stitchkit/application/grammy` at run time, and the declarations of `stitchkit/telegram/screens`; the neutral application kernel does not resolve it. |
449
449
  | `@opentelemetry/api` | peer, optional | Type-only boundary for `stitchkit/application/opentelemetry`; the adapter has no runtime import and owns no SDK/exporter. |
450
450
  | `@tanstack/react-query` + `react-query-kit` | peer, optional | Only `stitchkit/react` — `createCursorQuery`, `createCacheBridge`. |
451
+ | `react` | peer, optional | Only the React subpaths: `stitchkit/react` with the two above, and `stitchkit/react/keyboard` — keyboard layers and list zones, hooks only. |
451
452
  | `socket.io` / `@socket.io/bun-engine` / `socket.io-client` | peer, optional | Only the Socket.IO wrappers. `@socket.io/bun-engine` is Bun-only; shipping one self-contained artifact? Hand the loaders to `createSocketIOServer({ peers })`. |
452
453
  | `@socket.io/component-emitter` | peer, optional, **types only** | Referenced by the browser Socket.IO declarations. Arrives with `socket.io-client`; nothing imports it at runtime. |
453
454
  | `srvx` | peer, optional | Only `serveNode` — the Node ≥ 22 HTTP adapter. Bun uses `Bun.serve` and needs nothing. |
@@ -1,124 +1,124 @@
1
1
  import {
2
- AgentControlDeliverySchema,
3
- AgentControlRequestSchema,
4
- AgentControlResponseSchema,
5
- AgentMultiSessionCursorSchema,
6
- advanceAgentMultiSessionCursor,
7
- createAgentControlView,
8
- reduceAgentControlEvent,
9
- reduceAgentControlSnapshot
10
- } from "../../index-bt14acb5.js";
2
+ AgentRecordIdSchema2,
3
+ AgentRecordVersionSchema2,
4
+ AgentTimestampSchema2,
5
+ AgentJsonObjectSchema2,
6
+ AgentProviderEnvelopeSchema2,
7
+ AgentProviderResponseSchema2,
8
+ AgentTextPartSchema2,
9
+ AgentReasoningPartSchema2,
10
+ AgentFilePartSchema2,
11
+ AgentSourcePartSchema2,
12
+ AgentToolCallPartSchema2,
13
+ AgentToolResultPartSchema2,
14
+ AgentToolApprovalRequestPartSchema2,
15
+ AgentToolApprovalResponsePartSchema2,
16
+ AgentOpaquePartSchema2,
17
+ AgentControlPartSchema2,
18
+ AgentMessagePartSchema2,
19
+ AgentMessageRoleSchema2,
20
+ AgentMessageStatusSchema2,
21
+ AgentMessageSchema2,
22
+ AgentAssistantPlaceholderSchema2,
23
+ AgentRunStateSchema2,
24
+ AgentRunQueuePrioritySchema2,
25
+ AgentRunOperationKindSchema2,
26
+ AgentRunOperationPhaseSchema2,
27
+ AgentRunOperationSchema2,
28
+ AgentTerminalReasonSchema2,
29
+ runStateForTerminalReason2,
30
+ AgentProvenanceSchema2,
31
+ AgentUsageValueSchema2,
32
+ AgentCostValueSchema2,
33
+ AgentUsageSchema2,
34
+ AgentRunSchema2,
35
+ AgentSnapshotSchema2,
36
+ AgentRunMetricsSchema2
37
+ } from "../../index-8kzct1d6.js";
11
38
  import {
12
- AgentAdmissionEventSchema,
13
- AgentAttemptResetEventSchema,
14
- AgentCheckpointEventSchema,
15
- AgentReasoningDeltaEventSchema,
16
- AgentReasoningEndEventSchema,
17
- AgentReasoningStartEventSchema,
18
- AgentRunOperationEventSchema,
19
- AgentRunStateEventSchema,
20
- AgentRuntimeEventCursorSchema,
21
- AgentRuntimeEventSchema,
22
- AgentTerminalEventSchema,
23
- AgentToolStatusEventSchema,
24
- AgentTransientDeltaEventSchema,
25
- advanceAgentRuntimeEventCursor,
26
- agentDurableEventId
27
- } from "../../index-y64k3s0h.js";
39
+ AgentAdmissionEventSchema2,
40
+ AgentTransientDeltaEventSchema2,
41
+ AgentReasoningStartEventSchema2,
42
+ AgentReasoningDeltaEventSchema2,
43
+ AgentReasoningEndEventSchema2,
44
+ AgentAttemptResetEventSchema2,
45
+ AgentCheckpointEventSchema2,
46
+ AgentRunStateEventSchema2,
47
+ AgentRunOperationEventSchema2,
48
+ AgentToolStatusEventSchema2,
49
+ AgentTerminalEventSchema2,
50
+ AgentRuntimeEventSchema2,
51
+ AgentRuntimeEventCursorSchema2,
52
+ advanceAgentRuntimeEventCursor2,
53
+ agentDurableEventId2
54
+ } from "../../index-mnkk1ffz.js";
28
55
  import {
29
- AgentAssistantPlaceholderSchema,
30
- AgentControlPartSchema,
31
- AgentCostValueSchema,
32
- AgentFilePartSchema,
33
- AgentJsonObjectSchema,
34
- AgentMessagePartSchema,
35
- AgentMessageRoleSchema,
36
- AgentMessageSchema,
37
- AgentMessageStatusSchema,
38
- AgentOpaquePartSchema,
39
- AgentProvenanceSchema,
40
- AgentProviderEnvelopeSchema,
41
- AgentProviderResponseSchema,
42
- AgentReasoningPartSchema,
43
- AgentRecordIdSchema,
44
- AgentRecordVersionSchema,
45
- AgentRunMetricsSchema,
46
- AgentRunOperationKindSchema,
47
- AgentRunOperationPhaseSchema,
48
- AgentRunOperationSchema,
49
- AgentRunQueuePrioritySchema,
50
- AgentRunSchema,
51
- AgentRunStateSchema,
52
- AgentSnapshotSchema,
53
- AgentSourcePartSchema,
54
- AgentTerminalReasonSchema,
55
- AgentTextPartSchema,
56
- AgentTimestampSchema,
57
- AgentToolApprovalRequestPartSchema,
58
- AgentToolApprovalResponsePartSchema,
59
- AgentToolCallPartSchema,
60
- AgentToolResultPartSchema,
61
- AgentUsageSchema,
62
- AgentUsageValueSchema,
63
- runStateForTerminalReason
64
- } from "../../index-gtj3zc53.js";
56
+ AgentControlRequestSchema2,
57
+ AgentControlResponseSchema2,
58
+ AgentControlDeliverySchema2,
59
+ AgentMultiSessionCursorSchema2,
60
+ advanceAgentMultiSessionCursor2,
61
+ createAgentControlView2,
62
+ reduceAgentControlSnapshot2,
63
+ reduceAgentControlEvent2
64
+ } from "../../index-n5yqxd3d.js";
65
65
  export {
66
- runStateForTerminalReason,
67
- reduceAgentControlSnapshot,
68
- reduceAgentControlEvent,
69
- createAgentControlView,
70
- agentDurableEventId,
71
- advanceAgentRuntimeEventCursor,
72
- advanceAgentMultiSessionCursor,
73
- AgentUsageValueSchema,
74
- AgentUsageSchema,
75
- AgentTransientDeltaEventSchema,
76
- AgentToolStatusEventSchema,
77
- AgentToolResultPartSchema,
78
- AgentToolCallPartSchema,
79
- AgentToolApprovalResponsePartSchema,
80
- AgentToolApprovalRequestPartSchema,
81
- AgentTimestampSchema,
82
- AgentTextPartSchema,
83
- AgentTerminalReasonSchema,
84
- AgentTerminalEventSchema,
85
- AgentSourcePartSchema,
86
- AgentSnapshotSchema,
87
- AgentRuntimeEventSchema,
88
- AgentRuntimeEventCursorSchema,
89
- AgentRunStateSchema,
90
- AgentRunStateEventSchema,
91
- AgentRunSchema,
92
- AgentRunQueuePrioritySchema,
93
- AgentRunOperationSchema,
94
- AgentRunOperationPhaseSchema,
95
- AgentRunOperationKindSchema,
96
- AgentRunOperationEventSchema,
97
- AgentRunMetricsSchema,
98
- AgentRecordVersionSchema,
99
- AgentRecordIdSchema,
100
- AgentReasoningStartEventSchema,
101
- AgentReasoningPartSchema,
102
- AgentReasoningEndEventSchema,
103
- AgentReasoningDeltaEventSchema,
104
- AgentProviderResponseSchema,
105
- AgentProviderEnvelopeSchema,
106
- AgentProvenanceSchema,
107
- AgentOpaquePartSchema,
108
- AgentMultiSessionCursorSchema,
109
- AgentMessageStatusSchema,
110
- AgentMessageSchema,
111
- AgentMessageRoleSchema,
112
- AgentMessagePartSchema,
113
- AgentJsonObjectSchema,
114
- AgentFilePartSchema,
115
- AgentCostValueSchema,
116
- AgentControlResponseSchema,
117
- AgentControlRequestSchema,
118
- AgentControlPartSchema,
119
- AgentControlDeliverySchema,
120
- AgentCheckpointEventSchema,
121
- AgentAttemptResetEventSchema,
122
- AgentAssistantPlaceholderSchema,
123
- AgentAdmissionEventSchema
66
+ AgentAdmissionEventSchema2 as AgentAdmissionEventSchema,
67
+ AgentAssistantPlaceholderSchema2 as AgentAssistantPlaceholderSchema,
68
+ AgentAttemptResetEventSchema2 as AgentAttemptResetEventSchema,
69
+ AgentCheckpointEventSchema2 as AgentCheckpointEventSchema,
70
+ AgentControlDeliverySchema2 as AgentControlDeliverySchema,
71
+ AgentControlPartSchema2 as AgentControlPartSchema,
72
+ AgentControlRequestSchema2 as AgentControlRequestSchema,
73
+ AgentControlResponseSchema2 as AgentControlResponseSchema,
74
+ AgentCostValueSchema2 as AgentCostValueSchema,
75
+ AgentFilePartSchema2 as AgentFilePartSchema,
76
+ AgentJsonObjectSchema2 as AgentJsonObjectSchema,
77
+ AgentMessagePartSchema2 as AgentMessagePartSchema,
78
+ AgentMessageRoleSchema2 as AgentMessageRoleSchema,
79
+ AgentMessageSchema2 as AgentMessageSchema,
80
+ AgentMessageStatusSchema2 as AgentMessageStatusSchema,
81
+ AgentMultiSessionCursorSchema2 as AgentMultiSessionCursorSchema,
82
+ AgentOpaquePartSchema2 as AgentOpaquePartSchema,
83
+ AgentProvenanceSchema2 as AgentProvenanceSchema,
84
+ AgentProviderEnvelopeSchema2 as AgentProviderEnvelopeSchema,
85
+ AgentProviderResponseSchema2 as AgentProviderResponseSchema,
86
+ AgentReasoningDeltaEventSchema2 as AgentReasoningDeltaEventSchema,
87
+ AgentReasoningEndEventSchema2 as AgentReasoningEndEventSchema,
88
+ AgentReasoningPartSchema2 as AgentReasoningPartSchema,
89
+ AgentReasoningStartEventSchema2 as AgentReasoningStartEventSchema,
90
+ AgentRecordIdSchema2 as AgentRecordIdSchema,
91
+ AgentRecordVersionSchema2 as AgentRecordVersionSchema,
92
+ AgentRunMetricsSchema2 as AgentRunMetricsSchema,
93
+ AgentRunOperationEventSchema2 as AgentRunOperationEventSchema,
94
+ AgentRunOperationKindSchema2 as AgentRunOperationKindSchema,
95
+ AgentRunOperationPhaseSchema2 as AgentRunOperationPhaseSchema,
96
+ AgentRunOperationSchema2 as AgentRunOperationSchema,
97
+ AgentRunQueuePrioritySchema2 as AgentRunQueuePrioritySchema,
98
+ AgentRunSchema2 as AgentRunSchema,
99
+ AgentRunStateEventSchema2 as AgentRunStateEventSchema,
100
+ AgentRunStateSchema2 as AgentRunStateSchema,
101
+ AgentRuntimeEventCursorSchema2 as AgentRuntimeEventCursorSchema,
102
+ AgentRuntimeEventSchema2 as AgentRuntimeEventSchema,
103
+ AgentSnapshotSchema2 as AgentSnapshotSchema,
104
+ AgentSourcePartSchema2 as AgentSourcePartSchema,
105
+ AgentTerminalEventSchema2 as AgentTerminalEventSchema,
106
+ AgentTerminalReasonSchema2 as AgentTerminalReasonSchema,
107
+ AgentTextPartSchema2 as AgentTextPartSchema,
108
+ AgentTimestampSchema2 as AgentTimestampSchema,
109
+ AgentToolApprovalRequestPartSchema2 as AgentToolApprovalRequestPartSchema,
110
+ AgentToolApprovalResponsePartSchema2 as AgentToolApprovalResponsePartSchema,
111
+ AgentToolCallPartSchema2 as AgentToolCallPartSchema,
112
+ AgentToolResultPartSchema2 as AgentToolResultPartSchema,
113
+ AgentToolStatusEventSchema2 as AgentToolStatusEventSchema,
114
+ AgentTransientDeltaEventSchema2 as AgentTransientDeltaEventSchema,
115
+ AgentUsageSchema2 as AgentUsageSchema,
116
+ AgentUsageValueSchema2 as AgentUsageValueSchema,
117
+ advanceAgentMultiSessionCursor2 as advanceAgentMultiSessionCursor,
118
+ advanceAgentRuntimeEventCursor2 as advanceAgentRuntimeEventCursor,
119
+ agentDurableEventId2 as agentDurableEventId,
120
+ createAgentControlView2 as createAgentControlView,
121
+ reduceAgentControlEvent2 as reduceAgentControlEvent,
122
+ reduceAgentControlSnapshot2 as reduceAgentControlSnapshot,
123
+ runStateForTerminalReason2 as runStateForTerminalReason
124
124
  };
@@ -1,23 +1,18 @@
1
+ import"../../index-ct75c3at.js";
2
+ import"../../index-7z9ym7t8.js";
3
+ import"../../index-n53mswt3.js";
4
+ import"../../index-b2bz0kdm.js";
1
5
  import {
2
- AgentCodingToolAuthorizationSchema,
3
- AgentCodingToolLimitsSchema,
4
- AgentCodingToolPathAuthorizationSchema,
5
- createAgentCodingTools
6
- } from "../../index-gw8bmyaj.js";
7
- import"../../index-fhwqwxe0.js";
8
- import"../../index-zjjyynm3.js";
9
- import"../../index-qmy6zq75.js";
10
- import"../../index-d8m8zpd8.js";
11
- import"../../index-0r0fbk7z.js";
12
- import"../../index-eqqvgdb3.js";
13
- import"../../index-znfs20ss.js";
14
- import"../../index-p5r7qpdd.js";
15
- import"../../index-2vtcmrj9.js";
16
- import"../../index-k5hsfc3j.js";
17
- import"../../index-hffjpmq9.js";
6
+ AgentCodingToolLimitsSchema2,
7
+ AgentCodingToolAuthorizationSchema2,
8
+ AgentCodingToolPathAuthorizationSchema2,
9
+ createAgentCodingTools2
10
+ } from "../../index-djjhhgjk.js";
11
+ import"../../index-ahvsksw5.js";
12
+ import"../../index-jzczzcsb.js";
18
13
  export {
19
- createAgentCodingTools,
20
- AgentCodingToolPathAuthorizationSchema,
21
- AgentCodingToolLimitsSchema,
22
- AgentCodingToolAuthorizationSchema
14
+ AgentCodingToolAuthorizationSchema2 as AgentCodingToolAuthorizationSchema,
15
+ AgentCodingToolLimitsSchema2 as AgentCodingToolLimitsSchema,
16
+ AgentCodingToolPathAuthorizationSchema2 as AgentCodingToolPathAuthorizationSchema,
17
+ createAgentCodingTools2 as createAgentCodingTools
23
18
  };