@mastra/discord 1.1.0-alpha.0 → 1.2.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # @mastra/discord
 
+## 1.2.0-alpha.0
+
+### Minor Changes
+
+- A bot token is now enough to configure `DiscordProvider` — `applicationId` and `publicKey` are resolved automatically from Discord's `GET /applications/@me` when omitted, then persisted alongside the token. ([#25125](https://github.com/mastra-ai/mastra/pull/25125))
+
+  ```typescript
+  // Before: all three credentials were required
+  new DiscordProvider({ app: { botToken, publicKey, applicationId } });
+
+  // After: the bot token alone works
+  new DiscordProvider({ app: { botToken } });
+  ```
+
+  Explicitly supplied values (config, `DISCORD_PUBLIC_KEY` / `DISCORD_APPLICATION_ID` env vars, or `configure()`) still take precedence over the resolved ones.
+
+### Patch Changes
+
+- Switching the Discord bot token via `configure()` now replaces the app config instead of merging into it. Previously the prior application's `publicKey` and `applicationId` survived the switch — including in persisted config — so the old application's Ed25519 key kept verifying inbound webhooks while the new bot token was active. The provider now drops everything derived from the old token and re-resolves the new application's identity from `GET /applications/@me`. ([#25149](https://github.com/mastra-ai/mastra/pull/25149))
+
+  For the same reason, `publicKey` and `applicationId` no longer fall back to `DISCORD_PUBLIC_KEY` / `DISCORD_APPLICATION_ID` when the bot token is supplied via config or `configure()` — stale environment values from a different application would otherwise attach to the new token. Environment fallback for those fields applies only when the bot token itself comes from `DISCORD_BOT_TOKEN`.
+
+- Updated dependencies [[`68cc668`](https://github.com/mastra-ai/mastra/commit/68cc66800e5ce6f5d62189fc7b5ef9d71cf80971), [`781762b`](https://github.com/mastra-ai/mastra/commit/781762b2dcd0c8cc7f9b8ab73824ec45a5225db7), [`cc0da13`](https://github.com/mastra-ai/mastra/commit/cc0da13b826d5f74213c4d8c470acf8698542249), [`f2c3f8c`](https://github.com/mastra-ai/mastra/commit/f2c3f8c74e1d7bc7baca5303b36320b0b361775c), [`1fe1c2b`](https://github.com/mastra-ai/mastra/commit/1fe1c2b6f0b29481dca62a9199af751d594e3ea6), [`279a736`](https://github.com/mastra-ai/mastra/commit/279a736c62495cac0f247ab1402a8c80bccc892a), [`4edc93d`](https://github.com/mastra-ai/mastra/commit/4edc93dedadb89686aad75a4853cb0aa807d256e)]:
+  - @mastra/core@1.72.0-alpha.2
+
+## 1.1.0
+
+### Minor Changes
+
+- Added `@mastra/discord` for connecting Mastra agents to Discord. One Discord app serves many servers, and agents respond to slash commands, DMs, and @mentions. Set `encryptionKey` or `MASTRA_ENCRYPTION_KEY` to encrypt the stored bot token at rest. ([#25002](https://github.com/mastra-ai/mastra/pull/25002))
+
+  ```ts
+  import { Mastra } from '@mastra/core';
+  import { DiscordProvider } from '@mastra/discord';
+
+  // App credentials from the Discord Developer Portal (or the DISCORD_BOT_TOKEN /
+  // DISCORD_PUBLIC_KEY / DISCORD_APPLICATION_ID env vars):
+  const discord = new DiscordProvider({
+    app: {
+      botToken: process.env.DISCORD_BOT_TOKEN!,
+      publicKey: process.env.DISCORD_PUBLIC_KEY!,
+      applicationId: process.env.DISCORD_APPLICATION_ID!,
+    },
+  });
+
+  export const mastra = new Mastra({
+    agents: { support },
+    channels: { discord },
+  });
+
+  // Bind an agent. If the bot is already in DISCORD_GUILD_ID, this binds the
+  // agent to that guild and registers its slash commands immediately. Otherwise
+  // it returns an OAuth2 bot-invite URL and the install stays pending until the
+  // bot joins a guild — the first interaction from that guild activates it.
+  const result = await discord.connect('support', { guildId: process.env.DISCORD_GUILD_ID });
+  // → { type: 'immediate' }  OR  { type: 'oauth', authorizationUrl, installationId }
+  ```
+
+### Patch Changes
+
+- Updated dependencies [[`fc7d2c1`](https://github.com/mastra-ai/mastra/commit/fc7d2c102e911f43f70f425e67c970231ea19363), [`4607046`](https://github.com/mastra-ai/mastra/commit/460704663e2869183e7dfff7efec49a4f2f47503), [`1e435dc`](https://github.com/mastra-ai/mastra/commit/1e435dc84a9c1b35aa58d0ab9b14ff39fe13aab0), [`9ba23a2`](https://github.com/mastra-ai/mastra/commit/9ba23a23893622b72c76189199d02432590606c1), [`b757896`](https://github.com/mastra-ai/mastra/commit/b757896872edd74f71ec104be92273c5406265da), [`7f64865`](https://github.com/mastra-ai/mastra/commit/7f648656d2b24b214a899e8835b8286333c80a19), [`f751e65`](https://github.com/mastra-ai/mastra/commit/f751e659f496e5e53ed38632c59c296fec2ccbe5)]:
+  - @mastra/core@1.71.0
+
 ## 1.1.0-alpha.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -115427,7 +115427,7 @@ var DiscordProvider = class {
 	#storeGeneration = 0;
 	constructor(config = {}) {
 		this.#config = config;
-		this.#configured = this.#suppliedAppConfig() != null;
+		this.#configured = this.#hasSuppliedCredentials();
 	}
 	/**
 	* Called by Mastra when this channel is registered.
@@ -115444,7 +115444,7 @@ var DiscordProvider = class {
 		}
 		if (isNewInstance) {
 			this.#adapters.clear();
-			this.#configured = this.#suppliedAppConfig() != null;
+			this.#configured = this.#hasSuppliedCredentials();
 		}
 		this.#mastra = mastra;
 	}
@@ -115516,7 +115516,7 @@ var DiscordProvider = class {
 	async #doInitialize() {
 		const store = await this.#getStore();
 		const active = (await store.list()).filter((i) => i.status === "active");
-		const hasApp = await store.getAppConfig() != null || this.#suppliedAppConfig() != null;
+		const hasApp = await store.getAppConfig() != null || this.#hasSuppliedCredentials();
 		this.#configured = hasApp || active.length > 0;
 		for (const installation of active) try {
 			await this.#activateInstallation(installation);
@@ -115527,7 +115527,10 @@ var DiscordProvider = class {
 	/**
 	* Provide or clear the app credentials at runtime. An object merges/overrides
 	* `botToken` / `publicKey` / `applicationId` (persisted on the next `connect`);
-	* `null` clears the stored app config.
+	* `null` clears the stored app config. Supplying a **different bot token**
+	* replaces the app config instead of merging: the token identifies the
+	* Discord application, so any `publicKey`/`applicationId` from the previous
+	* application must not survive the switch.
 	*/
 	async configure(credentials) {
 		if (credentials === null) {
@@ -115549,7 +115552,7 @@ var DiscordProvider = class {
 				...credentials
 			}
 		};
-		this.#configured = this.#suppliedAppConfig() != null || this.#configured;
+		this.#configured = this.#hasSuppliedCredentials() || this.#configured;
 		if (![
 			"botToken",
 			"publicKey",
@@ -115557,7 +115560,14 @@ var DiscordProvider = class {
 		].some((k) => credentials[k] !== void 0 && credentials[k] !== previous?.[k])) return;
 		const store = await this.#getStore();
 		const stored = await store.getAppConfig();
-		if (stored) {
+		const tokenSupersedes = (base) => credentials.botToken !== void 0 && base?.botToken !== void 0 && base.botToken !== credentials.botToken;
+		if (tokenSupersedes(previous) || tokenSupersedes(stored)) {
+			this.#config = {
+				...this.#config,
+				app: { ...credentials }
+			};
+			await store.deleteAppConfig();
+		} else if (stored) {
 			const merged = {
 				...stored,
 				...credentials
@@ -115586,8 +115596,8 @@ var DiscordProvider = class {
 		const store = await this.#getStore();
 		const existing = await store.getByAgent(agentId);
 		if (existing?.status === "active") throw new Error(`Agent "${agentId}" is already connected to Discord. Disconnect first to reconnect. To add another server, invite the bot with the existing URL — new guilds activate on first use.`);
-		const { app, persisted } = await this.#resolveAppConfig(store);
-		const identity = await validateApp(app.botToken, this.#apiBaseUrl());
+		const { app, persisted, identity: resolvedIdentity } = await this.#resolveAppConfig(store);
+		const identity = resolvedIdentity ?? await validateApp(app.botToken, this.#apiBaseUrl());
 		if (!persisted) await store.saveAppConfig(app);
 		const installationId = existing?.id ?? (0, crypto$1.randomUUID)();
 		const webhookId = existing?.webhookId ?? (0, crypto$1.randomUUID)();
@@ -115854,12 +115864,33 @@ var DiscordProvider = class {
 			return;
 		}
 	}
+	/**
+	* App credentials from provider config or `DISCORD_*` env.
+	*
+	* A config-supplied bot token defines the application identity, so
+	* `publicKey` / `applicationId` never fall back to the environment in that
+	* case — stale `DISCORD_PUBLIC_KEY` / `DISCORD_APPLICATION_ID` from a
+	* *different* application would otherwise complete the config and keep that
+	* application's Ed25519 key trusted for webhook verification (bypassing the
+	* `GET /applications/@me` backfill). Env fallback for those fields applies
+	* only when the bot token itself comes from the environment.
+	*/
+	#suppliedPartialAppConfig() {
+		const a = this.#config.app ?? {};
+		if (a.botToken != null) return {
+			botToken: a.botToken,
+			publicKey: a.publicKey,
+			applicationId: a.applicationId
+		};
+		return {
+			botToken: process.env.DISCORD_BOT_TOKEN,
+			publicKey: a.publicKey ?? process.env.DISCORD_PUBLIC_KEY,
+			applicationId: a.applicationId ?? process.env.DISCORD_APPLICATION_ID
+		};
+	}
 	/** App credentials from provider config or `DISCORD_*` env, or `null` if incomplete. */
 	#suppliedAppConfig() {
-		const a = this.#config.app ?? {};
-		const botToken = a.botToken ?? process.env.DISCORD_BOT_TOKEN;
-		const publicKey = a.publicKey ?? process.env.DISCORD_PUBLIC_KEY;
-		const applicationId = a.applicationId ?? process.env.DISCORD_APPLICATION_ID;
+		const { botToken, publicKey, applicationId } = this.#suppliedPartialAppConfig();
 		if (botToken && publicKey && applicationId) return {
 			botToken,
 			publicKey,
@@ -115868,10 +115899,22 @@ var DiscordProvider = class {
 		return null;
 	}
 	/**
+	* Whether credentials are resolvable without storage. A bot token alone is
+	* enough: `applicationId` and `publicKey` are backfilled from
+	* `GET /applications/@me` by {@link #resolveAppConfig}.
+	*/
+	#hasSuppliedCredentials() {
+		return this.#suppliedPartialAppConfig().botToken != null;
+	}
+	/**
 	* Resolve the app config: prefer the stored one, else the supplied credentials
-	* (config / `DISCORD_*` env). `persisted` says whether it's already in storage,
-	* so the caller can persist supplied credentials **once**, after validation.
-	* Throws if neither is available.
+	* (config / `DISCORD_*` env). A supplied `botToken` without `publicKey` /
+	* `applicationId` is completed from `GET /applications/@me` — the application
+	* object carries both the id and the Ed25519 `verify_key`. `persisted` says
+	* whether it's already in storage, so the caller can persist supplied
+	* credentials **once**, after validation. `identity` is set when the token was
+	* already validated against `/applications/@me` here, so callers can skip a
+	* second validation call. Throws if no credentials are available.
 	*/
 	async #resolveAppConfig(store) {
 		const stored = await store.getAppConfig();
@@ -115884,7 +115927,22 @@ var DiscordProvider = class {
 			app: supplied,
 			persisted: false
 		};
-		throw new Error("Discord app is not configured. Provide botToken, publicKey, and applicationId via the provider `app` option, the DISCORD_BOT_TOKEN / DISCORD_PUBLIC_KEY / DISCORD_APPLICATION_ID env vars, or configure() — Discord applications are created in the Developer Portal, not programmatically.");
+		const partial = this.#suppliedPartialAppConfig();
+		if (partial.botToken) {
+			const identity = await validateApp(partial.botToken, this.#apiBaseUrl());
+			const publicKey = partial.publicKey ?? identity.verify_key;
+			if (!publicKey) throw new Error("Discord /applications/@me returned no verify_key; provide publicKey explicitly.");
+			return {
+				app: {
+					botToken: partial.botToken,
+					publicKey,
+					applicationId: partial.applicationId ?? identity.id
+				},
+				persisted: false,
+				identity
+			};
+		}
+		throw new Error("Discord app is not configured. Provide at least a botToken via the provider `app` option, the DISCORD_BOT_TOKEN env var, or configure() — publicKey and applicationId are resolved from Discord automatically when omitted. Discord applications are created in the Developer Portal, not programmatically.");
 	}
 	/**
 	* The single entry point to the store. Every caller either gets the cached