@kavtuai/guildgate 0.1.0

package/dist/action.d.ts

@@ -0,0 +1,65 @@
+import type { CacheManager } from "./cache.js";
+import type { GuildGateStores } from "./stores.js";
+import type { RealtimeEvent, RequestEnvelope, ResourceRef, SessionRecord, SupportedLocale } from "./types.js";
+export interface AuthorizationDecision {
+    allowed: boolean;
+    code?: string;
+    details?: Record<string, unknown>;
+}
+export interface ActionContext {
+    requestId: string;
+    request: RequestEnvelope;
+    locale: SupportedLocale;
+    session: SessionRecord | null;
+    userId?: string;
+    isOwner: boolean;
+    signal: AbortSignal;
+    stores: GuildGateStores;
+    cache: CacheManager;
+    now: Date;
+}
+export interface ActionRateLimit<I> {
+    limit: number;
+    windowMs: number;
+    cost?: number;
+    key?: (context: Omit<ActionContext, "signal">, input: I) => string;
+}
+export interface ActionIdempotency<I> {
+    required?: boolean;
+    ttlMs: number;
+    scope?: (context: Omit<ActionContext, "signal">, input: I) => string;
+}
+export interface ActionConcurrency<I> {
+    key: (context: Omit<ActionContext, "signal">, input: I) => string;
+    ttlMs?: number;
+    waitMs?: number;
+}
+export interface ActionDefinition<I, O> {
+    name: string;
+    authentication?: "required" | "optional" | "none";
+    csrf?: "required" | "disabled";
+    timeoutMs?: number;
+    parse?: (value: unknown) => I;
+    resource?: (input: I) => ResourceRef | undefined;
+    rateLimit?: ActionRateLimit<I>;
+    idempotency?: ActionIdempotency<I>;
+    concurrency?: ActionConcurrency<I>;
+    authorize?: (context: Omit<ActionContext, "signal">, input: I) => Promise<AuthorizationDecision | void> | AuthorizationDecision | void;
+    execute: (context: ActionContext, input: I) => Promise<O>;
+    audit?: {
+        enabled?: boolean;
+        changes?: (result: O, input: I) => unknown;
+    };
+    cache?: {
+        invalidateTags?: (result: O, input: I) => string[];
+    };
+    realtime?: {
+        delivery?: "immediate" | "outbox";
+        events: (result: O, input: I) => Array<Omit<RealtimeEvent, "version" | "id" | "timestamp">>;
+    };
+}
+export interface DefinedAction<I, O> {
+    readonly definition: ActionDefinition<I, O>;
+}
+export declare function defineAction<I, O>(definition: ActionDefinition<I, O>): DefinedAction<I, O>;
+//# sourceMappingURL=action.d.ts.map

package/dist/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;CACtE;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IAClD,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,WAAW,GAAG,SAAS,CAAC;IACjD,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IACvI,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,EAAE;QACN,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;KAC5C,CAAC;IACF,KAAK,CAAC,EAAE;QACN,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;KACpD,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAClC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC;KAC7F,CAAC;CACH;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC7C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAE1F"}

package/dist/action.js

@@ -0,0 +1,4 @@
+export function defineAction(definition) {
+    return Object.freeze({ definition });
+}
+//# sourceMappingURL=action.js.map

package/dist/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AA6EA,MAAM,UAAU,YAAY,CAAO,UAAkC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/cache.d.ts

@@ -0,0 +1,23 @@
+import type { CacheStore, LockStore } from "./stores.js";
+export declare class CacheManager {
+    private readonly store;
+    private readonly locks;
+    constructor(store: CacheStore, locks: LockStore);
+    get<T>(key: string): Promise<T | null>;
+    set<T>(key: string, value: T, input: {
+        ttlMs: number;
+        staleMs?: number;
+        tags?: string[];
+    }): Promise<void>;
+    remember<T>(input: {
+        key: string;
+        ttlMs: number;
+        staleMs?: number;
+        tags?: string[];
+        lockTtlMs?: number;
+        waitMs?: number;
+        load: () => Promise<T>;
+    }): Promise<T>;
+    invalidateTags(tags: string[]): Promise<number>;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGzD,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,SAAS;IAG7B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAMtC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzG,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;KACxB,GAAG,OAAO,CAAC,CAAC,CAAC;IAwBd,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAGhD"}

package/dist/cache.js

@@ -0,0 +1,53 @@
+import { randomToken } from "./crypto.js";
+export class CacheManager {
+    store;
+    locks;
+    constructor(store, locks) {
+        this.store = store;
+        this.locks = locks;
+    }
+    async get(key) {
+        const entry = await this.store.get(key);
+        if (!entry || entry.expiresAtMs <= Date.now())
+            return null;
+        return entry.value;
+    }
+    async set(key, value, input) {
+        const now = Date.now();
+        await this.store.set(key, {
+            value,
+            expiresAtMs: now + input.ttlMs,
+            staleUntilMs: input.staleMs ? now + input.ttlMs + input.staleMs : undefined,
+            tags: input.tags ?? [],
+        });
+    }
+    async remember(input) {
+        const entry = await this.store.get(input.key);
+        const now = Date.now();
+        if (entry && entry.expiresAtMs > now)
+            return entry.value;
+        const token = randomToken(16);
+        const lockKey = `cache-load:${input.key}`;
+        const acquired = await this.locks.acquire(lockKey, token, input.lockTtlMs ?? 5_000, input.waitMs ?? 1_000);
+        if (!acquired) {
+            if (entry && (entry.staleUntilMs ?? 0) > now)
+                return entry.value;
+            return input.load();
+        }
+        try {
+            const secondRead = await this.store.get(input.key);
+            if (secondRead && secondRead.expiresAtMs > Date.now())
+                return secondRead.value;
+            const value = await input.load();
+            await this.set(input.key, value, input);
+            return value;
+        }
+        finally {
+            await this.locks.release(lockKey, token);
+        }
+    }
+    invalidateTags(tags) {
+        return this.store.deleteByTags(tags);
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,KAAiB,EACjB,KAAgB;QADhB,UAAK,GAAL,KAAK,CAAY;QACjB,UAAK,GAAL,KAAK,CAAW;IAChC,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAI,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,KAA2D;QAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACxB,KAAK;YACL,WAAW,EAAE,GAAG,GAAG,KAAK,CAAC,KAAK;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC3E,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,KAQjB;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,cAAc,KAAK,CAAC,GAAG,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;YACjE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAI,KAAK,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,UAAU,IAAI,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,cAAc,CAAC,IAAc;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/crypto.d.ts

@@ -0,0 +1,15 @@
+export declare function randomToken(bytes?: number): string;
+export declare function sha256(value: string): string;
+export declare function hmacSha256(secret: string | Uint8Array, value: string): string;
+export declare function safeEqualText(left: string, right: string): boolean;
+export declare function stableStringify(value: unknown): string;
+export interface TokenCipher {
+    encrypt(plaintext: string): string;
+    decrypt(payload: string): string;
+}
+export declare function createTokenCipher(input: {
+    keys: Record<string, string | Uint8Array>;
+    activeKeyId: string;
+}): TokenCipher;
+export declare function redactValue(value: unknown, sensitiveKeys: Set<string>): unknown;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AASA,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAE9C;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI5C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAatD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAmCxH;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAQ/E"}

package/dist/crypto.js

@@ -0,0 +1,87 @@
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
+export function randomToken(bytes = 32) {
+    return randomBytes(bytes).toString("base64url");
+}
+export function sha256(value) {
+    const hash = createHash("sha256");
+    hash.update(value);
+    return hash.digest("hex");
+}
+export function hmacSha256(secret, value) {
+    const hmac = createHmac("sha256", secret);
+    hmac.update(value);
+    return hmac.digest("base64url");
+}
+export function safeEqualText(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export function stableStringify(value) {
+    if (value === undefined)
+        return '{"$undefined":true}';
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        return Number.isFinite(value) ? JSON.stringify(value) : `{"$number":${JSON.stringify(String(value))}}`;
+    }
+    if (typeof value === "bigint")
+        return `{"$bigint":${JSON.stringify(value.toString())}}`;
+    if (value instanceof Date)
+        return `{"$date":${JSON.stringify(value.toISOString())}}`;
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(",")}]`;
+    if (typeof value !== "object")
+        throw new TypeError(`Unsupported stable value type: ${typeof value}`);
+    const source = value;
+    const keys = Object.keys(source).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(source[key])}`).join(",")}}`;
+}
+export function createTokenCipher(input) {
+    const active = input.keys[input.activeKeyId];
+    if (!active)
+        throw new Error(`Unknown active key id: ${input.activeKeyId}`);
+    const normalizeKey = (value) => {
+        const raw = typeof value === "string" ? Buffer.from(value, "base64") : Buffer.from(value);
+        if (raw.length !== 32)
+            throw new Error("Encryption keys must decode to 32 bytes");
+        return raw;
+    };
+    const keyring = new Map(Object.entries(input.keys).map(([id, key]) => [id, normalizeKey(key)]));
+    return {
+        encrypt(plaintext) {
+            const iv = randomBytes(12);
+            const cipher = createCipheriv("aes-256-gcm", normalizeKey(active), iv);
+            const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+            const tag = cipher.getAuthTag();
+            return ["v1", input.activeKeyId, iv.toString("base64url"), tag.toString("base64url"), ciphertext.toString("base64url")].join(".");
+        },
+        decrypt(payload) {
+            const [version, keyId, ivText, tagText, ciphertextText] = payload.split(".");
+            if (version !== "v1" || !keyId || !ivText || !tagText || !ciphertextText) {
+                throw new Error("Invalid encrypted token payload");
+            }
+            const key = keyring.get(keyId);
+            if (!key)
+                throw new Error(`Unknown encryption key id: ${keyId}`);
+            const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivText, "base64url"));
+            decipher.setAuthTag(Buffer.from(tagText, "base64url"));
+            return Buffer.concat([
+                decipher.update(Buffer.from(ciphertextText, "base64url")),
+                decipher.final(),
+            ]).toString("utf8");
+        },
+    };
+}
+export function redactValue(value, sensitiveKeys) {
+    if (Array.isArray(value))
+        return value.map((item) => redactValue(item, sensitiveKeys));
+    if (!value || typeof value !== "object")
+        return value;
+    const output = {};
+    for (const [key, item] of Object.entries(value)) {
+        output[key] = sensitiveKeys.has(key.toLowerCase()) ? "[REDACTED]" : redactValue(item, sensitiveKeys);
+    }
+    return output;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAE,KAAa;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC;IACxF,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,OAAO,KAAK,EAAE,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACtG,CAAC;AAOD,MAAM,UAAU,iBAAiB,CAAC,KAAyE;IACzG,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5E,MAAM,YAAY,GAAG,CAAC,KAA0B,EAAU,EAAE;QAC1D,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAClF,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhG,OAAO;QACL,OAAO,CAAC,SAAiB;YACvB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpI,CAAC;QACD,OAAO,CAAC,OAAe;YACrB,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7E,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YACxF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACzD,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,aAA0B;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/discord/authorizer.d.ts

@@ -0,0 +1,41 @@
+import type { CacheManager } from "../cache.js";
+import type { AuthorizationDecision, ActionContext } from "../action.js";
+import type { DiscordOAuthClient } from "./oauth.js";
+import { type DiscordPermissionName, type DiscordRoleLike } from "./permissions.js";
+export interface DiscordGuildAccess {
+    guildId: string;
+    user: {
+        owner: boolean;
+        permissions: string;
+    };
+    bot: {
+        present: boolean;
+        permissions: string;
+        roleIds: string[];
+        roles: DiscordRoleLike[];
+    };
+}
+export interface DiscordGuildAuthorizer {
+    inspect(input: {
+        userId: string;
+        guildId: string;
+        consistency?: "cached" | "live";
+        signal?: AbortSignal;
+    }): Promise<DiscordGuildAccess>;
+    require<I>(input: {
+        guildId: (value: I) => string;
+        userPermissions?: DiscordPermissionName[];
+        botPermissions?: DiscordPermissionName[];
+        consistency?: "cached" | "live";
+    }): (context: Omit<ActionContext, "signal">, value: I) => Promise<AuthorizationDecision>;
+}
+export declare function createDiscordGuildAuthorizer(input: {
+    oauth: DiscordOAuthClient;
+    botToken: string;
+    botUserId: string;
+    cache: CacheManager;
+    apiBaseUrl?: string;
+    fetch?: typeof globalThis.fetch;
+    cachedTtlMs?: number;
+}): DiscordGuildAuthorizer;
+//# sourceMappingURL=authorizer.d.ts.map

package/dist/discord/authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/discord/authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAY1B,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,GAAG,EAAE;QACH,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,EAAE,eAAe,EAAE,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxI,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE;QAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;QAC9B,eAAe,CAAC,EAAE,qBAAqB,EAAE,CAAC;QAC1C,cAAc,CAAC,EAAE,qBAAqB,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KACjC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC1F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,sBAAsB,CAwFzB"}

package/dist/discord/authorizer.js

@@ -0,0 +1,101 @@
+import { errors } from "../errors.js";
+import { computeBaseGuildPermissions, missingPermissions, } from "./permissions.js";
+export function createDiscordGuildAuthorizer(input) {
+    const fetcher = input.fetch ?? globalThis.fetch;
+    const apiBase = input.apiBaseUrl ?? "https://discord.com/api/v10";
+    const inspect = async (request) => {
+        const load = () => loadAccess(request.userId, request.guildId, request.signal);
+        if (request.consistency === "live")
+            return load();
+        return input.cache.remember({
+            key: `discord-access:${request.userId}:${request.guildId}`,
+            ttlMs: input.cachedTtlMs ?? 20_000,
+            tags: [`discord-access:${request.userId}`, `guild:${request.guildId}`],
+            load,
+        });
+    };
+    return {
+        inspect,
+        require(requirement) {
+            return async (context, value) => {
+                if (!context.userId)
+                    return { allowed: false, code: "AUTHENTICATION_REQUIRED" };
+                const guildId = requirement.guildId(value);
+                const access = await inspect({
+                    userId: context.userId,
+                    guildId,
+                    consistency: requirement.consistency ?? "live",
+                });
+                const missingUser = missingPermissions(access.user.permissions, requirement.userPermissions ?? ["MANAGE_GUILD"], {
+                    owner: access.user.owner,
+                });
+                if (missingUser.length)
+                    return { allowed: false, code: "USER_PERMISSION_MISSING", details: { permissions: missingUser } };
+                if (!access.bot.present)
+                    return { allowed: false, code: "BOT_NOT_IN_GUILD" };
+                const missingBot = missingPermissions(access.bot.permissions, requirement.botPermissions ?? []);
+                if (missingBot.length)
+                    return { allowed: false, code: "BOT_PERMISSION_MISSING", details: { permissions: missingBot } };
+                return { allowed: true };
+            };
+        },
+    };
+    async function loadAccess(userId, guildId, signal) {
+        const accessToken = await input.oauth.getAccessToken(userId);
+        const userGuilds = await discordGet("/users/@me/guilds", `Bearer ${accessToken}`, signal);
+        const userGuild = userGuilds.find((guild) => guild.id === guildId);
+        if (!userGuild)
+            throw errors.guildAccessDenied();
+        const [guild, member, roles] = await Promise.all([
+            discordGet(`/guilds/${guildId}`, `Bot ${input.botToken}`, signal),
+            discordGet(`/guilds/${guildId}/members/${input.botUserId}`, `Bot ${input.botToken}`, signal)
+                .catch((error) => {
+                if (error instanceof ResponseError && error.status === 404)
+                    return null;
+                throw error;
+            }),
+            discordGet(`/guilds/${guildId}/roles`, `Bot ${input.botToken}`, signal),
+        ]);
+        if (!member) {
+            return {
+                guildId,
+                user: { owner: userGuild.owner, permissions: userGuild.permissions },
+                bot: { present: false, permissions: "0", roleIds: [], roles },
+            };
+        }
+        const permissions = computeBaseGuildPermissions({
+            guildId,
+            ownerId: guild.owner_id,
+            memberId: input.botUserId,
+            roleIds: member.roles,
+            roles,
+        });
+        return {
+            guildId,
+            user: { owner: userGuild.owner, permissions: userGuild.permissions },
+            bot: { present: true, permissions: permissions.toString(), roleIds: member.roles, roles },
+        };
+    }
+    async function discordGet(path, authorization, signal) {
+        const response = await fetcher(`${apiBase}${path}`, { headers: { authorization }, signal });
+        if (response.status === 429) {
+            const body = await response.clone().json().catch(() => ({}));
+            const headerSeconds = Number(response.headers.get("retry-after"));
+            const retryAfterMs = Number.isFinite(headerSeconds)
+                ? Math.ceil(headerSeconds * 1000)
+                : Math.ceil((body.retry_after ?? 1) * 1000);
+            throw errors.rateLimited(retryAfterMs);
+        }
+        if (!response.ok)
+            throw new ResponseError(response.status, await response.text().catch(() => ""));
+        return response.json();
+    }
+}
+class ResponseError extends Error {
+    status;
+    constructor(status, body) {
+        super(`Discord request failed with ${status}: ${body}`);
+        this.status = status;
+    }
+}
+//# sourceMappingURL=authorizer.js.map

package/dist/discord/authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/discord/authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GAGnB,MAAM,kBAAkB,CAAC;AAoC1B,MAAM,UAAU,4BAA4B,CAAC,KAQ5C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,IAAI,6BAA6B,CAAC;IAElE,MAAM,OAAO,GAAsC,KAAK,EAAE,OAAO,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC1B,GAAG,EAAE,kBAAkB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE;YAC1D,KAAK,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM;YAClC,IAAI,EAAE,CAAC,kBAAkB,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QAEP,OAAO,CAAC,WAAW;YACjB,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;gBAC9B,IAAI,CAAC,OAAO,CAAC,MAAM;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;gBAChF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;oBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO;oBACP,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,MAAM;iBAC/C,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,eAAe,IAAI,CAAC,cAAc,CAAC,EAAE;oBAC/G,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;iBACzB,CAAC,CAAC;gBACH,IAAI,WAAW,CAAC,MAAM;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC1H,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;gBAC7E,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;gBAChG,IAAI,UAAU,CAAC,MAAM;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC;gBACvH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,MAAoB;QAC7E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,UAAU,CAAwB,mBAAmB,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QACjH,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS;YAAE,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,UAAU,CAAuB,WAAW,OAAO,EAAE,EAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;YACvF,UAAU,CAAwB,WAAW,OAAO,YAAY,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;iBAChH,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACxE,MAAM,KAAK,CAAC;YACd,CAAC,CAAC;YACJ,UAAU,CAAoB,WAAW,OAAO,QAAQ,EAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;SAC3F,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO;gBACP,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;gBACpE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE;aAC9D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,2BAA2B,CAAC;YAC9C,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,KAAK;SACN,CAAC,CAAC;QACH,OAAO;YACL,OAAO;YACP,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;YACpE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE;SAC1F,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,aAAqB,EAAE,MAAoB;QACpF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA6B,CAAC;YACzF,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,aAAc,SAAQ,KAAK;IACV;IAArB,YAAqB,MAAc,EAAE,IAAY;QAC/C,KAAK,CAAC,+BAA+B,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QADrC,WAAM,GAAN,MAAM,CAAQ;IAEnC,CAAC;CACF"}

package/dist/discord/oauth.d.ts

@@ -0,0 +1,64 @@
+import { type TokenCipher } from "../crypto.js";
+import type { GuildGateKernel } from "../kernel.js";
+import type { OAuthCredentialStore, OAuthStateStore } from "../stores.js";
+import type { SupportedLocale } from "../types.js";
+export interface DiscordOAuthUser {
+    id: string;
+    username: string;
+    global_name?: string | null;
+    avatar?: string | null;
+    locale?: string;
+}
+export interface DiscordPartialGuild {
+    id: string;
+    name: string;
+    icon?: string | null;
+    owner: boolean;
+    permissions: string;
+    features?: string[];
+}
+export interface DiscordOAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scopes?: string[];
+    apiBaseUrl?: string;
+    authorizationBaseUrl?: string;
+    stateTtlMs?: number;
+    requestTimeoutMs?: number;
+    fetch?: typeof globalThis.fetch;
+    stateCookieName?: string;
+}
+export interface DiscordOAuthClient {
+    beginLogin(input?: {
+        returnTo?: string;
+        locale?: SupportedLocale;
+        prompt?: "consent" | "none";
+    }): Promise<{
+        authorizationUrl: string;
+        stateCookie: string;
+    }>;
+    completeLogin(input: {
+        code: string;
+        state: string;
+        stateCookie: string | undefined;
+    }): Promise<{
+        user: DiscordOAuthUser;
+        guilds: DiscordPartialGuild[];
+        returnTo: string;
+        sessionToken: string;
+        csrfToken: string;
+        setCookie: string;
+        clearStateCookie: string;
+    }>;
+    getAccessToken(userId: string): Promise<string>;
+    revoke(userId: string): Promise<void>;
+}
+export declare function createDiscordOAuth(input: {
+    config: DiscordOAuthConfig;
+    kernel: GuildGateKernel;
+    stateStore?: OAuthStateStore;
+    credentialStore?: OAuthCredentialStore;
+    cipher: TokenCipher;
+}): DiscordOAuthClient;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/discord/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/discord/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAUD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,eAAe,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACxG,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,aAAa,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC;QAC9F,IAAI,EAAE,gBAAgB,CAAC;QACvB,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC,CAAC;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,kBAAkB,CAoLrB"}