araharah-executor
df3b7d65c1
feat(02-03): Worker entry — webhook route + /api/session security gate + deploy plumbing (D-11, D-14, D-16, D-17)
...
- src/webhook.ts: routes exactly /telegram/webhook (grammY cloudflare-mod
adapter, constant-time secret-token auth against env.WEBHOOK_SECRET) and
POST /api/session (validateInitData → 401 category-only rejections →
mintSession one-time token; single mint path, no extra branch — T-02-01/02/06)
- D-14: the only log statement is '[initdata] rejected: <category>' — no
payload, ids, or timestamps
- scripts/set-webhook.mjs: setWebhook with secret_token + allowed_updates
[message], secrets read from gitignored .dev.vars, token never echoed
- bot deploy script chains wrangler deploy + set-webhook; wrangler.jsonc
gains workers_dev (webhook URL target); KV id stays placeholder for the
deploy checkpoint
- verified: 27/27 tests, typecheck clean, wrangler deploy --dry-run exit 0
2026-10-22 11:49:43 +08:00
araharah-executor
b4393fbcf3
feat(02-03): strings module + text-only command surface with Malay aliases (D-01..D-05)
...
- src/i18n/strings.ts: single copy source of truth, en + ms identical
key-sets, clinical/honest start + privacy copy, pickLocale fallback rule
- /start /mula, /help, /privacy /privasi handlers: plain text replies with
link previews disabled, zero menu/button surface (D-02, grep-gated)
- createBot(env) factory registers exactly the phase command stack
- scripts/register-commands.mjs: one-time setMyCommands, two scopes
(default + language_code ms), descriptions derived from helpMenu —
no inline copy, no future-command stubs (D-03/D-05)
- test/commands.test.mjs: CS1-CS6 gates — locale parity, pickLocale
matrix, PRIV-01 copy gate vs never-facts + TTL wording, D-02 structural
grep, D-03 menu gap-freedom, D-04 alias completeness (27 passing)
2026-10-22 11:48:50 +08:00
araharah-executor