araharah-executor
7875ed4d94
- POST: WR-01 cap (MAX_GUIDANCE_BODY_CHARS 8192, pre/post-read double check), hand-rolled snapshot validation (slug destinationId, bounded name, finite metrics, integer startedAtSec, polyline6 geometry >= 2 points via decodePolyline6) -> mintGuidanceSession with the CLAIM's chat_id — a body chat_id is structurally ignored (T-06-02 injection probe GW4) - GET/DELETE: resolve then OWN — envelope.chat_id === claim.chat_id else 404, foreign and absent indistinguishable (T-06-02b); DELETE actively removes the record (D-14's server half); non-POST/GET/DELETE -> 405 - category-only logging: [guidance] rejected: unauthorized|malformed — literal strings, no interpolation of body/claim values (D-14) - RP2 re-pin ships WITH the change (gate re-pin law): the total @araharah/routing ban becomes an explicit allowlist — exactly the polyline6 codec may enter the Worker (geometry validation); the routing stack stays web-side; RP1 unchanged - bot/package.json + lock: @araharah/routing workspace dep
24 lines
594 B
JSON
24 lines
594 B
JSON
{
|
|
"name": "@araharah/bot",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"test": "node test/runner.mjs",
|
|
"typecheck": "tsc --noEmit",
|
|
"dev": "wrangler dev --port 8787 --local",
|
|
"deploy": "wrangler deploy && node scripts/set-webhook.mjs",
|
|
"commands": "node scripts/register-commands.mjs"
|
|
},
|
|
"dependencies": {
|
|
"grammy": "^1.46.0",
|
|
"@araharah/search": "*",
|
|
"@araharah/routing": "*"
|
|
},
|
|
"devDependencies": {
|
|
"wrangler": "^4.151.3",
|
|
"typescript": "^5.9.3",
|
|
"@cloudflare/workers-types": "^5.20261022.1",
|
|
"@types/node": "^26.6.5"
|
|
}
|
|
}
|