@kodelyth/discord 2026.5.39 → 2026.5.42

package/src/account-inspect.ts

@@ -0,0 +1,128 @@
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "klaw/plugin-sdk/account-id";
+import { hasConfiguredSecretInput, normalizeSecretInputString } from "klaw/plugin-sdk/secret-input";
+import { normalizeOptionalString } from "klaw/plugin-sdk/string-coerce-runtime";
+import {
+  mergeDiscordAccountConfig,
+  resolveDefaultDiscordAccountId,
+  resolveDiscordAccountConfig,
+} from "./accounts.js";
+import type { DiscordAccountConfig, KlawConfig } from "./runtime-api.js";
+import type { DiscordCredentialStatus } from "./token.js";
+
+export type InspectedDiscordAccount = {
+  accountId: string;
+  enabled: boolean;
+  name?: string;
+  token: string;
+  tokenSource: "env" | "config" | "none";
+  tokenStatus: DiscordCredentialStatus;
+  configured: boolean;
+  config: DiscordAccountConfig;
+};
+
+function inspectDiscordTokenValue(value: unknown): {
+  token: string;
+  tokenSource: "config";
+  tokenStatus: Exclude<DiscordCredentialStatus, "missing">;
+} | null {
+  const normalized = normalizeSecretInputString(value);
+  if (normalized) {
+    return {
+      token: normalized.replace(/^Bot\s+/i, ""),
+      tokenSource: "config",
+      tokenStatus: "available",
+    };
+  }
+  if (hasConfiguredSecretInput(value)) {
+    return {
+      token: "",
+      tokenSource: "config",
+      tokenStatus: "configured_unavailable",
+    };
+  }
+  return null;
+}
+
+export function inspectDiscordAccount(params: {
+  cfg: KlawConfig;
+  accountId?: string | null;
+  envToken?: string | null;
+}): InspectedDiscordAccount {
+  const accountId = normalizeAccountId(
+    params.accountId ?? resolveDefaultDiscordAccountId(params.cfg),
+  );
+  const merged = mergeDiscordAccountConfig(params.cfg, accountId);
+  const enabled = params.cfg.channels?.discord?.enabled !== false && merged.enabled !== false;
+  const accountConfig = resolveDiscordAccountConfig(params.cfg, accountId);
+  const hasAccountToken = Boolean(
+    accountConfig &&
+    Object.prototype.hasOwnProperty.call(accountConfig as Record<string, unknown>, "token"),
+  );
+  const accountToken = inspectDiscordTokenValue(accountConfig?.token);
+  if (accountToken) {
+    return {
+      accountId,
+      enabled,
+      name: normalizeOptionalString(merged.name),
+      token: accountToken.token,
+      tokenSource: accountToken.tokenSource,
+      tokenStatus: accountToken.tokenStatus,
+      configured: true,
+      config: merged,
+    };
+  }
+  if (hasAccountToken) {
+    return {
+      accountId,
+      enabled,
+      name: normalizeOptionalString(merged.name),
+      token: "",
+      tokenSource: "none",
+      tokenStatus: "missing",
+      configured: false,
+      config: merged,
+    };
+  }
+
+  const channelToken = inspectDiscordTokenValue(params.cfg.channels?.discord?.token);
+  if (channelToken) {
+    return {
+      accountId,
+      enabled,
+      name: normalizeOptionalString(merged.name),
+      token: channelToken.token,
+      tokenSource: channelToken.tokenSource,
+      tokenStatus: channelToken.tokenStatus,
+      configured: true,
+      config: merged,
+    };
+  }
+
+  const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
+  const envToken = allowEnv
+    ? normalizeSecretInputString(params.envToken ?? process.env.DISCORD_BOT_TOKEN)
+    : undefined;
+  if (envToken) {
+    return {
+      accountId,
+      enabled,
+      name: normalizeOptionalString(merged.name),
+      token: envToken.replace(/^Bot\s+/i, ""),
+      tokenSource: "env",
+      tokenStatus: "available",
+      configured: true,
+      config: merged,
+    };
+  }
+
+  return {
+    accountId,
+    enabled,
+    name: normalizeOptionalString(merged.name),
+    token: "",
+    tokenSource: "none",
+    tokenStatus: "missing",
+    configured: false,
+    config: merged,
+  };
+}

package/src/accounts.test.ts

@@ -0,0 +1,381 @@
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import {
+  clearRuntimeConfigSnapshot,
+  setRuntimeConfigSnapshot,
+} from "klaw/plugin-sdk/runtime-config-snapshot";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  createDiscordActionGate,
+  isDiscordAccountEnabledForRuntime,
+  listDiscordAccountIds,
+  listEnabledDiscordAccounts,
+  resolveDefaultDiscordAccountId,
+  resolveDiscordAccount,
+  resolveDiscordAccountDisabledReason,
+  resolveDiscordMaxLinesPerMessage,
+} from "./accounts.js";
+
+afterEach(() => {
+  clearRuntimeConfigSnapshot();
+  vi.unstubAllEnvs();
+});
+
+const defaultAccountOmissionCases = [
+  {
+    name: "resolveDiscordAccount",
+    assert: () => {
+      const resolved = resolveDiscordAccount({
+        cfg: {
+          channels: {
+            discord: {
+              defaultAccount: "work",
+              accounts: {
+                work: { token: "token-work", name: "Work" },
+              },
+            },
+          },
+        },
+      });
+
+      expect(resolved.accountId).toBe("work");
+      expect(resolved.name).toBe("Work");
+      expect(resolved.token).toBe("token-work");
+    },
+  },
+  {
+    name: "createDiscordActionGate",
+    assert: () => {
+      const gate = createDiscordActionGate({
+        cfg: {
+          channels: {
+            discord: {
+              actions: { reactions: false },
+              defaultAccount: "work",
+              accounts: {
+                work: {
+                  token: "token-work",
+                  actions: { reactions: true },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      expect(gate("reactions")).toBe(true);
+    },
+  },
+];
+
+describe("Discord defaultAccount omission contract", () => {
+  it.each(defaultAccountOmissionCases)(
+    "$name uses configured defaultAccount when accountId is omitted",
+    ({ assert }) => {
+      assert();
+    },
+  );
+
+  it("keeps the implicit default account when named accounts are added to top-level credentials", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          token: "token-default",
+          accounts: {
+            work: {
+              enabled: false,
+              token: "token-work",
+            },
+          },
+        },
+      },
+    } as KlawConfig;
+
+    expect(listDiscordAccountIds(cfg)).toEqual(["default", "work"]);
+    expect(resolveDefaultDiscordAccountId(cfg)).toBe("default");
+    expect(listEnabledDiscordAccounts(cfg).map((account) => account.accountId)).toEqual([
+      "default",
+    ]);
+  });
+});
+
+describe("resolveDiscordAccount allowFrom precedence", () => {
+  it("prefers accounts.default.allowFrom over top-level for default account", () => {
+    const resolved = resolveDiscordAccount({
+      cfg: {
+        channels: {
+          discord: {
+            allowFrom: ["top"],
+            accounts: {
+              default: { allowFrom: ["default"], token: "token-default" },
+            },
+          },
+        },
+      },
+      accountId: "default",
+    });
+
+    expect(resolved.config.allowFrom).toEqual(["default"]);
+  });
+
+  it("falls back to top-level allowFrom for named account without override", () => {
+    const resolved = resolveDiscordAccount({
+      cfg: {
+        channels: {
+          discord: {
+            allowFrom: ["top"],
+            accounts: {
+              work: { token: "token-work" },
+            },
+          },
+        },
+      },
+      accountId: "work",
+    });
+
+    expect(resolved.config.allowFrom).toEqual(["top"]);
+  });
+
+  it("does not inherit default account allowFrom for named account when top-level is absent", () => {
+    const resolved = resolveDiscordAccount({
+      cfg: {
+        channels: {
+          discord: {
+            accounts: {
+              default: { allowFrom: ["default"], token: "token-default" },
+              work: { token: "token-work" },
+            },
+          },
+        },
+      },
+      accountId: "work",
+    });
+
+    expect(resolved.config.allowFrom).toBeUndefined();
+  });
+});
+
+describe("resolveDiscordAccount botLoopProtection precedence", () => {
+  it("merges account overrides over Discord channel defaults field-by-field", () => {
+    const resolved = resolveDiscordAccount({
+      cfg: {
+        channels: {
+          discord: {
+            botLoopProtection: {
+              maxEventsPerWindow: 4,
+              windowSeconds: 60,
+              cooldownSeconds: 30,
+            },
+            accounts: {
+              work: {
+                token: "token-work",
+                botLoopProtection: {
+                  windowSeconds: 10,
+                },
+              },
+            },
+          },
+        },
+      },
+      accountId: "work",
+    });
+
+    expect(resolved.config.botLoopProtection).toEqual({
+      maxEventsPerWindow: 4,
+      windowSeconds: 10,
+      cooldownSeconds: 30,
+    });
+  });
+});
+
+describe("resolveDiscordMaxLinesPerMessage", () => {
+  it("falls back to merged root discord maxLinesPerMessage when runtime config omits it", () => {
+    const resolved = resolveDiscordMaxLinesPerMessage({
+      cfg: {
+        channels: {
+          discord: {
+            maxLinesPerMessage: 120,
+            accounts: {
+              default: { token: "token-default" },
+            },
+          },
+        },
+      },
+      discordConfig: {},
+      accountId: "default",
+    });
+
+    expect(resolved).toBe(120);
+  });
+
+  it("prefers explicit runtime discord maxLinesPerMessage over merged config", () => {
+    const resolved = resolveDiscordMaxLinesPerMessage({
+      cfg: {
+        channels: {
+          discord: {
+            maxLinesPerMessage: 120,
+            accounts: {
+              default: { token: "token-default", maxLinesPerMessage: 80 },
+            },
+          },
+        },
+      },
+      discordConfig: { maxLinesPerMessage: 55 },
+      accountId: "default",
+    });
+
+    expect(resolved).toBe(55);
+  });
+
+  it("uses per-account discord maxLinesPerMessage over the root value when runtime config omits it", () => {
+    const resolved = resolveDiscordMaxLinesPerMessage({
+      cfg: {
+        channels: {
+          discord: {
+            maxLinesPerMessage: 120,
+            accounts: {
+              work: { token: "token-work", maxLinesPerMessage: 80 },
+            },
+          },
+        },
+      },
+      discordConfig: {},
+      accountId: "work",
+    });
+
+    expect(resolved).toBe(80);
+  });
+});
+
+describe("Discord duplicate-token account filtering", () => {
+  it("keeps the config-token account over default env fallback when tokens collide", () => {
+    vi.stubEnv("DISCORD_BOT_TOKEN", "same-token");
+    const cfg = {
+      channels: {
+        discord: {
+          accounts: {
+            work: {
+              token: "same-token",
+            },
+          },
+        },
+      },
+    };
+
+    const defaultAccount = resolveDiscordAccount({ cfg, accountId: "default" });
+    const workAccount = resolveDiscordAccount({ cfg, accountId: "work" });
+
+    expect(isDiscordAccountEnabledForRuntime(defaultAccount, cfg)).toBe(false);
+    expect(resolveDiscordAccountDisabledReason(defaultAccount, cfg)).toBe(
+      'duplicate bot token; using account "work"',
+    );
+    expect(isDiscordAccountEnabledForRuntime(workAccount, cfg)).toBe(true);
+    expect(listEnabledDiscordAccounts(cfg).map((account) => account.accountId)).toEqual(["work"]);
+  });
+
+  it("keeps the first enabled account when duplicate tokens have the same source", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          accounts: {
+            first: {
+              token: "same-token",
+            },
+            second: {
+              token: "same-token",
+            },
+          },
+        },
+      },
+    };
+
+    const firstAccount = resolveDiscordAccount({ cfg, accountId: "first" });
+    const secondAccount = resolveDiscordAccount({ cfg, accountId: "second" });
+
+    expect(isDiscordAccountEnabledForRuntime(firstAccount, cfg)).toBe(true);
+    expect(isDiscordAccountEnabledForRuntime(secondAccount, cfg)).toBe(false);
+    expect(resolveDiscordAccountDisabledReason(secondAccount, cfg)).toBe(
+      'duplicate bot token; using account "first"',
+    );
+    expect(listEnabledDiscordAccounts(cfg).map((account) => account.accountId)).toEqual(["first"]);
+  });
+
+  it("does not let disabled duplicate-token accounts suppress enabled accounts", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          accounts: {
+            disabled: {
+              enabled: false,
+              token: "same-token",
+            },
+            active: {
+              token: "same-token",
+            },
+          },
+        },
+      },
+    };
+
+    const activeAccount = resolveDiscordAccount({ cfg, accountId: "active" });
+
+    expect(isDiscordAccountEnabledForRuntime(activeAccount, cfg)).toBe(true);
+    expect(listEnabledDiscordAccounts(cfg).map((account) => account.accountId)).toEqual(["active"]);
+  });
+});
+
+describe("resolveDiscordAccount runtime config selection", () => {
+  it("resolves named account SecretRefs from the active runtime snapshot", () => {
+    const sourceCfg = {
+      channels: {
+        discord: {
+          defaultAccount: "work",
+          accounts: {
+            work: {
+              name: "Work",
+              token: { source: "env", provider: "default", id: "DISCORD_WORK_TOKEN" },
+            },
+          },
+        },
+      },
+    } as unknown as KlawConfig;
+    const runtimeCfg = {
+      channels: {
+        discord: {
+          defaultAccount: "work",
+          accounts: {
+            work: {
+              name: "Work",
+              token: "Bot runtime-work-token",
+            },
+          },
+        },
+      },
+    } as KlawConfig;
+    setRuntimeConfigSnapshot(runtimeCfg, sourceCfg);
+
+    const resolved = resolveDiscordAccount({ cfg: sourceCfg });
+
+    expect(resolved.accountId).toBe("work");
+    expect(resolved.token).toBe("runtime-work-token");
+    expect(resolved.tokenSource).toBe("config");
+    expect(resolved.tokenStatus).toBe("available");
+  });
+
+  it("preserves configured unavailable tokens without falling through to env", () => {
+    vi.stubEnv("DISCORD_BOT_TOKEN", "env-token");
+    const resolved = resolveDiscordAccount({
+      cfg: {
+        channels: {
+          discord: {
+            token: { source: "env", provider: "default", id: "DISCORD_BOT_TOKEN" },
+          },
+        },
+      } as unknown as KlawConfig,
+      accountId: "default",
+    });
+
+    expect(resolved.token).toBe("");
+    expect(resolved.tokenSource).toBe("config");
+    expect(resolved.tokenStatus).toBe("configured_unavailable");
+  });
+});

package/src/accounts.ts

@@ -0,0 +1,205 @@
+import {
+  createAccountActionGate,
+  createAccountListHelpers,
+  resolveMergedAccountConfig,
+} from "klaw/plugin-sdk/account-helpers";
+import { normalizeAccountId } from "klaw/plugin-sdk/account-id";
+import {
+  mapAllowFromEntries,
+  normalizeChannelDmPolicy,
+  resolveChannelDmAllowFrom,
+  resolveChannelDmPolicy,
+  type ChannelDmPolicy,
+} from "klaw/plugin-sdk/channel-config-helpers";
+import { resolveAccountEntry } from "klaw/plugin-sdk/routing";
+import { normalizeOptionalString } from "klaw/plugin-sdk/string-coerce-runtime";
+import type { DiscordAccountConfig, DiscordActionConfig, KlawConfig } from "./runtime-api.js";
+import { selectDiscordRuntimeConfig } from "./runtime-config.js";
+import { resolveDiscordToken, type DiscordCredentialStatus } from "./token.js";
+
+export type ResolvedDiscordAccount = {
+  accountId: string;
+  enabled: boolean;
+  name?: string;
+  token: string;
+  tokenSource: "env" | "config" | "none";
+  tokenStatus: DiscordCredentialStatus;
+  config: DiscordAccountConfig;
+};
+
+const { listAccountIds, resolveDefaultAccountId } = createAccountListHelpers("discord", {
+  implicitDefaultAccount: {
+    channelKeys: ["token"],
+    envVars: ["DISCORD_BOT_TOKEN"],
+  },
+});
+export const listDiscordAccountIds = listAccountIds;
+export const resolveDefaultDiscordAccountId = resolveDefaultAccountId;
+
+export function resolveDiscordAccountConfig(
+  cfg: KlawConfig,
+  accountId: string,
+): DiscordAccountConfig | undefined {
+  return resolveAccountEntry(cfg.channels?.discord?.accounts, accountId);
+}
+
+export function mergeDiscordAccountConfig(
+  cfg: KlawConfig,
+  accountId: string,
+): DiscordAccountConfig {
+  const merged = resolveMergedAccountConfig<DiscordAccountConfig>({
+    channelConfig: cfg.channels?.discord as DiscordAccountConfig | undefined,
+    accounts: cfg.channels?.discord?.accounts as
+      | Record<string, Partial<DiscordAccountConfig>>
+      | undefined,
+    accountId,
+    nestedObjectKeys: ["botLoopProtection"],
+  });
+  return merged;
+}
+
+export function resolveDiscordAccountAllowFrom(params: {
+  cfg: KlawConfig;
+  accountId?: string | null;
+}): string[] | undefined {
+  const accountId = normalizeAccountId(
+    params.accountId ?? resolveDefaultDiscordAccountId(params.cfg),
+  );
+  const accountConfig = resolveDiscordAccountConfig(params.cfg, accountId);
+  const rootConfig = params.cfg.channels?.discord as DiscordAccountConfig | undefined;
+
+  const allowFrom = resolveChannelDmAllowFrom({
+    account: accountConfig as Record<string, unknown> | undefined,
+    parent: rootConfig as Record<string, unknown> | undefined,
+  });
+  return allowFrom ? mapAllowFromEntries(allowFrom) : undefined;
+}
+
+export function resolveDiscordAccountDmPolicy(params: {
+  cfg: KlawConfig;
+  accountId?: string | null;
+}): ChannelDmPolicy | undefined {
+  const accountId = normalizeAccountId(
+    params.accountId ?? resolveDefaultDiscordAccountId(params.cfg),
+  );
+  const accountConfig = resolveDiscordAccountConfig(params.cfg, accountId);
+  const rootConfig = params.cfg.channels?.discord as DiscordAccountConfig | undefined;
+  const policy = resolveChannelDmPolicy({
+    account: accountConfig as Record<string, unknown> | undefined,
+    parent: rootConfig as Record<string, unknown> | undefined,
+    defaultPolicy: "pairing",
+  });
+  return normalizeChannelDmPolicy(policy);
+}
+
+export function createDiscordActionGate(params: {
+  cfg: KlawConfig;
+  accountId?: string | null;
+}): (key: keyof DiscordActionConfig, defaultValue?: boolean) => boolean {
+  const accountId = normalizeAccountId(
+    params.accountId ?? resolveDefaultDiscordAccountId(params.cfg),
+  );
+  return createAccountActionGate({
+    baseActions: params.cfg.channels?.discord?.actions,
+    accountActions: resolveDiscordAccountConfig(params.cfg, accountId)?.actions,
+  });
+}
+
+export function resolveDiscordAccount(params: {
+  cfg: KlawConfig;
+  accountId?: string | null;
+}): ResolvedDiscordAccount {
+  const cfg = selectDiscordRuntimeConfig(params.cfg);
+  const accountId = normalizeAccountId(params.accountId ?? resolveDefaultDiscordAccountId(cfg));
+  const baseEnabled = cfg.channels?.discord?.enabled !== false;
+  const merged = mergeDiscordAccountConfig(cfg, accountId);
+  const accountEnabled = merged.enabled !== false;
+  const enabled = baseEnabled && accountEnabled;
+  const tokenResolution = resolveDiscordToken(cfg, { accountId });
+  return {
+    accountId,
+    enabled,
+    name: normalizeOptionalString(merged.name),
+    token: tokenResolution.token,
+    tokenSource: tokenResolution.source,
+    tokenStatus: tokenResolution.tokenStatus,
+    config: merged,
+  };
+}
+
+export function resolveDiscordMaxLinesPerMessage(params: {
+  cfg: KlawConfig;
+  discordConfig?: DiscordAccountConfig | null;
+  accountId?: string | null;
+}): number | undefined {
+  if (typeof params.discordConfig?.maxLinesPerMessage === "number") {
+    return params.discordConfig.maxLinesPerMessage;
+  }
+  return resolveDiscordAccount({
+    cfg: params.cfg,
+    accountId: params.accountId,
+  }).config.maxLinesPerMessage;
+}
+
+function resolveDiscordAccountTokenOwner(params: {
+  cfg: KlawConfig;
+  token: string;
+}): string | undefined {
+  const token = params.token.trim();
+  if (!token) {
+    return undefined;
+  }
+  let owner: { accountId: string; priority: number; index: number } | undefined;
+  const accountIds = listDiscordAccountIds(params.cfg);
+  for (const [index, accountId] of accountIds.entries()) {
+    const account = resolveDiscordAccount({ cfg: params.cfg, accountId });
+    const accountToken = account.token.trim();
+    if (!account.enabled || accountToken !== token) {
+      continue;
+    }
+    const priority = account.tokenSource === "config" ? 2 : account.tokenSource === "env" ? 1 : 0;
+    if (!owner || priority > owner.priority) {
+      owner = { accountId: account.accountId, priority, index };
+      continue;
+    }
+    if (priority === owner.priority && index < owner.index) {
+      owner = { accountId: account.accountId, priority, index };
+    }
+  }
+  return owner?.accountId;
+}
+
+function resolveDiscordDuplicateTokenOwner(params: {
+  cfg: KlawConfig;
+  account: ResolvedDiscordAccount;
+}): string | undefined {
+  const owner = resolveDiscordAccountTokenOwner({
+    cfg: params.cfg,
+    token: params.account.token,
+  });
+  return owner && owner !== params.account.accountId ? owner : undefined;
+}
+
+export function isDiscordAccountEnabledForRuntime(
+  account: ResolvedDiscordAccount,
+  cfg: KlawConfig,
+): boolean {
+  return account.enabled && !resolveDiscordDuplicateTokenOwner({ cfg, account });
+}
+
+export function resolveDiscordAccountDisabledReason(
+  account: ResolvedDiscordAccount,
+  cfg: KlawConfig,
+): string {
+  if (!account.enabled) {
+    return "disabled";
+  }
+  const owner = resolveDiscordDuplicateTokenOwner({ cfg, account });
+  return owner ? `duplicate bot token; using account "${owner}"` : "disabled";
+}
+
+export function listEnabledDiscordAccounts(cfg: KlawConfig): ResolvedDiscordAccount[] {
+  return listDiscordAccountIds(cfg)
+    .map((accountId) => resolveDiscordAccount({ cfg, accountId }))
+    .filter((account) => isDiscordAccountEnabledForRuntime(account, cfg));
+}