Replace pnpm-lock.yaml with package-lock.json. Both overrides move to
package.json#overrides, including the request -> @cypress/request alias.
allowBuilds for es5-ext becomes package.json#allowScripts.
The deploy script chained "pnpm register", which would have failed once pnpm
was gone; it now calls npm run register.
- alias legacy request transitive to maintained @cypress/request fork
- pin undici to 7.28.0 for GHSA batch affecting < 7.28.0
- drop form-data/qs/tough-cookie overrides now satisfied upstream
- bump @vercel/functions to 3.7.5 and google-play-scraper to 10.1.3
- bump actions/checkout and actions/setup-node to v7
The existing top-level "overrides" field was npm syntax and ignored by pnpm.
Move overrides to pnpm-workspace.yaml where pnpm 11 reads them. Also bump
form-data to ^2.5.5 (was ^2.5.4) and tough-cookie to ^4.1.4 (was ^4.1.3).
This forces the patched versions throughout the tree, replacing form-data@2.3.3
and tough-cookie@2.5.0 that came in via app-store-scraper -> request.
New admin-only command persists APP_CACHE_SECONDS override in admin doc
(admin.appCacheSeconds), bounds [60, 86400], 0/default clears. Fallback
to env when unset.
app-cache-repository now takes a lazy memoized TTL getter — admin doc
read at most once per request, only on cache write paths. app-builder
wires (admin.getAppCacheSeconds() ?? config.appCacheSeconds).
/settings now displays effective TTL with override status alongside the
existing per-group settings.
Also fix /setdayswarning + /setappttl arg parsing: gate reset on string
'0' instead of parseInt === 0, so '/cmd 0.5', '/cmd 0xff', '/cmd 0abc'
no longer silently trigger a reset.
setMyCommands now runs at default scope (user commands only) plus once
per ADMIN_ID with scope:{type:'chat'} carrying the full set, so admin
commands (/addgroup, /delgroup, /listgroup) are hidden from non-admins'
menu. requireAdminUser remains the actual auth gate; this is UI cleanup.
parseAdminIds extracted to src/util/parse-admin-ids.js — shared between
config loading and the register script. ADMIN_IDS now required by
register-webhook.js (.env.deploy.example updated). Per-admin call uses
allowFail to gracefully skip admins who haven't DMed the bot yet.
src/bot/commands/index.js owns the canonical catalog (name, description,
adminOnly, build factory). bot.js builds dispatch from it; future menu
registration reads it. Drops the 14 explicit factory imports + the inline
/info handler from bot.js. Prevents the dispatch-vs-menu drift that bit
us with /setdayswarning (commit 0131206 → 49726f1 backfill).
- remove MONGODB_URI from .env.example (Atlas migration done; deleted from
Vercel cloud env too)
- trim .env.deploy.example to vars actually consumed by deploy scripts
(Upstash creds were only needed by the now-deleted migration script)
- README config table: drop ENV / SOURCE_COMMIT / SCHEDULE_CHECK_APP_TIME
(never read by code; Java-era leftovers)
- check-secret-leaks: drop MONGODB_URI; add UPSTASH/KV/CRON tokens; widen
scan roots to include api/
- add scripts/list-upstash-keys.js read-only ops helper
- pin form-data/qs/tough-cookie via package.json overrides; clears 3 of 4
Dependabot alerts (request SSRF risk-accepted, no upstream fix)
- add GitHub Actions CI (lint + syntax check) on push/PR
- add /settings and /setdayswarning to setMyCommands
- new npm run describe sets bot profile description via Bot API
- README: drop stale preview warning, add Operations section
Adds optional group.settings.numDaysWarningNotUpdated, resolved per-group
in scheduler and /checkapp with fallback to env default. New commands
/settings (read) and /setdayswarning <n|0|default> (write).
Migration to Vercel + Upstash is live and the Java bot is being
shut down. Git history retains all phase docs and audit reports
if needed for reference.
/delgroup previously only removed the chatId from the admin allowlist;
the matching group:{chatId} key (with its tracked-app state) was left
in Redis with no TTL. Re-adding the same group later resurrected the
old subscription list. Now the command calls store.group.deleteGroup
after the admin removal succeeds.
The scheduler's Google branch and /checkapp's Google rows path both
called daysBetween(updatedMs, now) without guarding non-finite
updatedMs values, unlike the parallel Apple branches. A garbage
upstream value would have produced NaN days. Skip those entries.
The dispatcher already wraps every handler in try/catch and sends the
'Internal server error' fallback on failure. Each command's inner
try/catch around its Redis ops was masking that path — the dispatcher
never saw the error, so logger.error('command failed') never fired.
Removing the inner catches restores observability and shortens each
file. The semantically-different try/catch blocks (mapping upstream
API failures to a different user message) are kept.
The dispatcher now extracts both the command name and its arguments
once and passes the args array to handlers via a 3rd parameter. Each
command file drops its splitArgs(getCommandArguments(msg.text)) call
and the corresponding imports. command-utils.js loses the now-unused
arg helpers (only auth helpers remain). info.js — a 12-line file with
one sendMessage — folds into bot.js's commands map.
Two near-identical per-store repository files collapse into a single
createAppCacheRepository(handle, prefix, ttl) factory used twice from
app-builder. Scrapers now receive the cache directly (one less layer),
and the cache entry shape drops the obsolete _id field — the Redis key
already encodes the appId.
Delete repository/store.js (one-line aggregator) — wiring now inline in
app-builder.js. Drop unused exports: scan + UpstashUnavailable from
upstash.js, getMe + TelegramApiError class from telegram-api.js,
init/getAdmin/save from admin-repository.js, exists/saveGroup from
group-repository.js. Generic Error replaces the named error classes.
Inline trivial factory bodies into the repos and scrapers that used them.
The class:/_id: fields were Java-Mongo parity artifacts that nothing
in this codebase reads — Redis docs with the old fields still parse
fine; the next write drops them.
Vercel `nodejs` runtime passes IncomingMessage/ServerResponse with
shouldAddHelpers=true (auto-parsed JSON body, .status/.send helpers),
not the Web Standards Request/Response. Calling `req.headers.get(...)`
on the classic IncomingMessage threw `TypeError: req.headers.get is
not a function` and crashed every webhook + cron invocation with 500.
Switch both handlers to (req, res) signature, read headers as plain
object (lowercased keys), use req.body for parsed JSON, and respond
via res.status().send().
Caught during Phase 6 smoke test of the first prod deploy.
Vercel Marketplace Upstash integration injects KV_REST_API_URL and
KV_REST_API_TOKEN — different names from vanilla Upstash signup
(UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN). Adapter and
migration script now accept either form, so the operator doesn't have
to duplicate values when sharing an Upstash DB provisioned via the
Vercel integration. UPSTASH_* takes precedence when both are set.
- Add Upstash REST creds, KEY_PREFIX, MONGODB_URI (one-shot migration)
- Update WORKER_URL example to Vercel format (var name retained for
register-webhook.js compatibility; rename deferred to Phase 7)
- Track docs/journals/ entry from cook session
Java repo renamed legacy-store-scraper-bot → java-store-scraper-bot for symmetry with go-store-scraper-bot. Status (deprecated/maintained) belongs in README banners, not URLs.
GitHub repo rename: js-store-scraper-bot becomes the canonical store-scraper-bot. The Java reference impl is renamed to legacy-store-scraper-bot in parallel.
Updates: package.json name + description, README header + reference link, wrangler.toml worker name (file slated for removal in cleanup phase but kept consistent in the interim).
Adds the phase doc that drove the migration script and updates plan.md
with the new phase, dependency edges (02 → 06 → 04), and removes the
prior "Out of scope: Data migration" line.
Operator runs `npm run migrate` (reads admin + group docs from Atlas)
followed by `npm run migrate:bulk` (uploads via wrangler kv bulk put).
Cache collections are skipped by default since they auto-rebuild from
upstream APIs; --include-cache flag migrates them with TTL preserved.
- mongodb is added as a devDependency only — never enters the Worker
bundle, the Worker still talks to KV exclusively.
- scripts/.atlas-export.json is gitignored (contains exported state).
- README documents the one-time runbook.
Adds the 260505-1425 plan that drove the KV swap (Phase 01 already
applied in the preceding commit; Phases 02-05 are operator-driven).
Marks 260426-2327-cloudflare-deploy-and-smoke as superseded since
the KV pivot was taken pre-emptively rather than after a hard-gate trip.
Drops the mongodb dependency entirely; all four logical collections
(admin singleton, group, apple_app, google_app) now live in a single KV
namespace bound as STORE_KV with prefixed keys. Cache TTL is delegated
to KV via expirationTtl (clamped to the 60s minimum). Document shape,
field names, and Java parity at the doc level are preserved.
- Adds src/repository/kv.js helper (getJson/putJson/del with TTL clamp)
- Rewrites all four *-repository.js modules on top of KV
- Removes src/repository/mongodb.js and the MONGODB_URI env requirement
- Adds an early STORE_KV-binding guard in src/index.js
- Bumps to 0.3.0
tiennm99
