@chat-adapter/x

Patch Changes

• fcdc1c9: Honor an adapter's definitive isMention: false instead of re-detecting mentions from the message text.

  An adapter that reads structured platform content reports true or false, and the SDK falls back to matching @username in the text only when the adapter reports nothing. A definitive false now wins, so an adapter can suppress a mention that exists only in text its platform renders literally, such as a code sample. Adapters that previously returned false to mean "not detected" should return undefined instead. Direct messages are unchanged: with no onDirectMessage handler registered they still route to onNewMention.

  Adapter changes that follow from the new contract:

  • Linear: ordinary comments are left undetermined, so SDK text detection still applies to them.

  • Notion: keyword mode leaves comments without a keyword match undetermined instead of reporting false, so @userName in the text still counts.

  • X: posts rebuilt from raw or fetched by id are left undetermined instead of reporting false. Only post.mention.create events report true.

  • Discord: a real ping, role mention, @everyone, or allowlisted channel reports true; anything else is left undetermined instead of false, so a literal @botname typed in the text still counts as before.

Patch Changes

• 7609d8f: Validate external request targets before sending credentials, message content, or attachment requests.

Minor Changes

• 18d4a23: Add a shared thread API for marking messages as read across WhatsApp, Messenger, and XChat.

  Note for anyone calling XchatAdapter.markAsRead() directly: it now rejects when a receipt fails instead of logging a warning and resolving. Automatic read receipts are unaffected, since the adapter still catches and logs those internally. If you call the method yourself without awaiting it, add a .catch() so a failed receipt does not surface as an unhandled rejection.

Patch Changes

• 745fdf5: respect Telegram streaming rate limits and target XChat read receipts exactly

Patch Changes

• b674923: Restrict the X CRC challenge to the opaque token shape X sends before signing it. The endpoint previously returned an HMAC over any crc_token, which let a caller have an arbitrary webhook body signed and replay that as x-twitter-webhooks-signature on a forged POST. A webhook body is JSON and can no longer pass the token check, so a CRC response can't double as a POST event signature.

Minor Changes

• caa6325: Add XChat support to @chat-adapter/x, shipped from the new @chat-adapter/x/chat subpath so it sits alongside the existing X adapter. The XChat crypto stack (@xdevplatform/chat-xdk, @xdevplatform/xdk, juicebox-sdk) is an optional peer dependency, so existing @chat-adapter/x users are unaffected. All cryptography is handled inside the adapter via @xdevplatform/chat-xdk (wasm) and all REST goes through the typed @xdevplatform/xdk client. Only a bot token and a Juicebox PIN are required: the bot's identity (user id and @handle) is resolved from GET /2/users/me at startup.

  • Encrypted send/receive in DMs and groups (webhook push + polling), signature verification on by default; undecryptable or unverified events are dropped

  • Webhook POSTs must carry a valid x-twitter-webhooks-signature, which X sends on every delivery. Set consumerSecret (or X_CONSUMER_SECRET) to receive webhooks, or disableWebhookVerification when an upstream layer already verifies them. Polling deployments are unaffected

  • Mention detection from structured mention entities, swipe-replies to the bot, and a plain-text @handle fallback; group replies sent as quoted replies

  • openDM(userId) starts (or reuses) an encrypted 1:1, running a full key exchange when needed so the bot can message first

  • Media both ways: inbound attachments with lazy download+decrypt, outbound encrypted uploads

  • Edit and delete of the bot's own messages; the first edit of a fresh message is age-gated by editSafetyDelayMs (default 5000ms) so receiving clients have stored the original

  • Reactions in and out, read receipts (sendReadReceipts, default on), typing keep-alive, configurable group welcome message

  • Cards degrade to text with tappable URL/mention entities plus a URL preview attachment

  • Requests carry a chat-sdk-xchat/<version> User-Agent product token so Chat SDK traffic is identifiable in X API request logs (a User-Agent set via apiHeaders takes precedence)

  • Registered in the chat/adapters catalog and the create-chat-sdk CLI scaffold, with a new optional importPath catalog field for adapters that ship on a subpath