release: v1.7.0 — Telegram Mini App embedding enhancements #138

Merged

developer merged 12 commits from development into master 2026-06-24 11:49:44 +00:00

Conversation 1 Commits 12 Files Changed 18

+567 -46

developer commented 2026-06-24 11:47:46 +00:00

Owner

Copy Link

Copy Source

Promote development → master for release v1.7.0: Telegram Mini App embedding enhancements.

Audited against the current Mini Apps API and reviewed live on iOS + Android on the test contour:

• Theme — live light/dark re-apply on Telegram's themeChanged.
• Safe-area — full device insets (bottom/left/right); the home-indicator strip takes the bottom bar's colour.
• SettingsButton — Telegram's native Settings button opens the in-app Settings screen (the in-app gear stays).
• CloudStorage — sync of client display prefs (theme, reduce-motion, board labels) across the user's Telegram devices; the interface language is excluded (it syncs via the durable account).
• Native dialogs — inside Telegram: showConfirm for destructive confirms (resign / block / unfriend), showPopup for the deep-link info notices (deferred until the loading cover clears, on both the native popup and the in-app Modal).
• Security — the validator denies a bot user (is_bot) before provisioning.
• Docs — ARCHITECTURE + FUNCTIONAL (+ _ru).

All Mini App features are version-gated (no-op on older clients). PRs #136 + #137. Tag v1.7.0 on master after merge; the production deploy is a separate, manual workflow_dispatch step.

Promote development → master for release **v1.7.0**: Telegram Mini App embedding enhancements. Audited against the current Mini Apps API and reviewed live on iOS + Android on the test contour: - **Theme** — live light/dark re-apply on Telegram's `themeChanged`. - **Safe-area** — full device insets (bottom/left/right); the home-indicator strip takes the bottom bar's colour. - **SettingsButton** — Telegram's native Settings button opens the in-app Settings screen (the in-app gear stays). - **CloudStorage** — sync of client display prefs (theme, reduce-motion, board labels) across the user's Telegram devices; the interface language is excluded (it syncs via the durable account). - **Native dialogs** — inside Telegram: `showConfirm` for destructive confirms (resign / block / unfriend), `showPopup` for the deep-link info notices (deferred until the loading cover clears, on both the native popup and the in-app Modal). - **Security** — the validator denies a bot user (`is_bot`) before provisioning. - **Docs** — ARCHITECTURE + FUNCTIONAL (+ `_ru`). All Mini App features are version-gated (no-op on older clients). PRs #136 + #137. Tag `v1.7.0` on master after merge; the production deploy is a separate, manual `workflow_dispatch` step.

developer added 12 commits 2026-06-24 11:47:46 +00:00

feat(telegram): re-apply theme live on themeChanged ... 0fb6004a8b

The Mini App read Telegram's themeParams/colorScheme only once at launch, so
switching Telegram's light/dark theme (or its auto day/night) while the app was
open left the SPA on stale colours until a relaunch.

Subscribe to the themeChanged WebApp event and re-apply the theme live. Extract
the launch-time token + colour-scheme + chrome application into syncTelegramTheme
(reading live themeParams when no launch snapshot is passed) and call it from both
applyTelegramChrome (launch) and the new event handler. Add a telegramThemeParams
live getter (+ unit test). Drop the stale 'immersive fullscreen' note from
applyTelegramChrome — the app deliberately does not request fullscreen.

feat(telegram): clear bottom and side safe-area insets ... b84bd1297e

Only the device safe-area TOP inset was mirrored, so on phones with a home
indicator the rack / bottom bar sat under it, and in landscape the notch
clipped the screen edges.

Mirror the full device safe-area inset (bottom / left / right) into new
--tg-safe-bottom / --tg-safe-left / --tg-safe-right CSS vars (0 outside
Telegram) and pad the shared Screen wrapper by them, so every screen clears the
home indicator and the landscape notch; the top inset stays owned by the header.
Replace telegramSafeAreaTop with telegramSafeAreaInset (the full inset object),
with a unit test.

fix(telegram): paint the home-indicator strip with the bottom bar's colour ... d0f60ee41d

The safe-area bottom inset was reserved on the Screen wrapper, so the strip
that holds space for the home indicator showed the content background and read
as detached from the coloured bottom bar / header above it.

Move the bottom inset onto the bottom bar: the Screen .tabbar wrapper now paints
--bg-elev and pads itself by --tg-safe-bottom, so the strip continues the
TabBar's chrome; a screen with no tab bar pads its bottom-most content
(.content:last-child) instead, so the strip takes that content's own colour.

feat(telegram): native SettingsButton opens our Settings screen ... ea931c6680

Inside the Mini App, reveal Telegram's native Settings button (Bot API 7.0)
and route its taps to the Settings screen — the standard Mini App affordance.
The in-app gear entry stays the primary path (two entry points by design).
No-op outside Telegram or on a client predating the button.

feat(telegram): sync client display prefs via CloudStorage ... 8a5a5d6c4d

Theme, reduce-motion and board labels lived only in local IndexedDB/localStorage,
so they did not follow the user across devices and could be lost when the Telegram
WebView cleared storage.

Mirror these three device-independent prefs to Telegram CloudStorage (Bot API 6.9)
from the single local-persist point (persistPrefs), and reconcile them from
CloudStorage in the background on launch (reconcileCloudPrefs) so a change made on
another device follows the user here. The local store stays the instant-render
cache; the interface language is intentionally excluded (it syncs via the durable
account). Pure encode/decode extracted to cloudprefs.ts with unit tests; the
CloudStorage transport wrappers are added to telegram.ts. No-op outside Telegram or
on a client predating CloudStorage.

feat(telegram): deny bot users at initData validation ... 8de9fb1ecd

The validator parsed only id/username/first_name/language_code from the signed
Telegram user, so a WebAppUser flagged is_bot would have been provisioned a normal
account. The HMAC already proves Telegram signed the payload, so is_bot==true is
Telegram itself attesting the launching principal is a bot.

Parse is_bot and reject it (ErrInvalidInitData -> gateway 4xx -> launch error). A
real user opening the Mini App never carries it, so this is a defensive deny. Tests
cover both the denied (is_bot true) and allowed (is_bot false) paths.

docs(telegram): document the Mini App embedding enhancements ... 29b6c7e4d8

Record the current state in ARCHITECTURE and FUNCTIONAL (+ _ru mirror): inside the
Mini App the client tracks Telegram's live theme switch, fits the full device
safe-area, exposes a native Settings button into the in-app settings, and syncs the
device-independent display prefs (theme, reduce-motion, board labels — not the
interface language) across the user's Telegram devices via CloudStorage; the
validator denies a bot user (is_bot) before provisioning an account.

feat(telegram): native dialogs for confirms and deep-link notices ... 2ba7cc3086

Inside the Mini App, route the destructive confirmations (resign, block, unfriend)
through Telegram's native showConfirm, and present the deep-link info modals (stale
invite, welcome-on-redeem) as a native showPopup whose button opens the bot chat.
Outside Telegram, or on a client predating the dialogs, the existing in-app Modal is
used unchanged; offline also keeps the modal so the action retains its disabled state.

Adds showConfirm/showPopup wrappers to telegram.ts and a pure popup-params builder
(nativedialogs.ts) with unit tests; the deep-link modal components choose native vs
in-app via an effect gated on insideTelegram + dialog availability.

fix(telegram): evaluate native-dialog availability at fire time ... 4f0cc81dfb

The deep-link info modals (stale invite, welcome-on-redeem) captured
insideTelegram() && telegramDialogsAvailable() in a const at component init, but they
mount in App before bootstrap loads the SDK, so the value was always false and they
fell back to the in-app Modal even inside Telegram. Evaluate it at fire time (in the
effect and the {#if} guard), as the destructive confirms already do at click time.

fix(telegram): defer deep-link notices until the loading cover clears ... 35705f7d1e

The stale-invite / welcome-on-redeem notices are raised during boot, so the native
popup fired over the loading splash. Gate both the native popup and the in-app Modal
on the current route's loading cover being gone — the tile splash on the lobby
(splashDone), the plain loading screen elsewhere (app.ready) — so the notice appears
with the settled screen on every build (Telegram and native/web alike).

Merge pull request 'feat(telegram): Mini App embedding enhancements' (#136) from feature/telegram-embedding into development 2495446a47

Merge pull request 'feat(telegram): native dialogs (experimental, stacked on #136)' (#137) from feature/telegram-native-dialogs into development b03e012011

owner approved these changes 2026-06-24 11:48:17 +00:00

developer merged commit 93d086a8a3 into master 2026-06-24 11:49:44 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#138