@mastra/discord 1.1.0 → 1.2.0-alpha.0

package/dist/index.d.cts

@@ -83,7 +83,9 @@ interface DiscordProviderConfig {
    * App credentials (bot token / public key / application id). May be omitted
    * here and provided via the `DISCORD_BOT_TOKEN` / `DISCORD_PUBLIC_KEY` /
    * `DISCORD_APPLICATION_ID` env vars, or later via {@link DiscordProvider.configure}.
-   * Whichever source resolves first is persisted **once** to channels storage.
+   * A bot token alone is enough: `publicKey` and `applicationId` are resolved
+   * from `GET /applications/@me` when omitted. Whichever source resolves first
+   * is persisted **once** to channels storage.
    */
   app?: Partial<DiscordAppConfig>;
   /**
@@ -333,7 +335,10 @@ declare class DiscordProvider implements ChannelProvider {
   /**
    * Provide or clear the app credentials at runtime. An object merges/overrides
    * `botToken` / `publicKey` / `applicationId` (persisted on the next `connect`);
-   * `null` clears the stored app config.
+   * `null` clears the stored app config. Supplying a **different bot token**
+   * replaces the app config instead of merging: the token identifies the
+   * Discord application, so any `publicKey`/`applicationId` from the previous
+   * application must not survive the switch.
    */
   configure(credentials: Partial<DiscordAppConfig> | null): Promise<void>;
   /**
@@ -444,6 +449,12 @@ interface DiscordApplication {
   id: string;
   /** The application's name. */
   name: string;
+  /**
+   * The Ed25519 public key used to verify interaction signatures. Discord
+   * includes it on every application object, so a bot token alone is enough to
+   * resolve the interaction-verification key.
+   */
+  verify_key: string;
 }
 /**
  * Call the Discord REST API with Bot-token auth. `method` is required; supplying

package/dist/index.d.ts

@@ -83,7 +83,9 @@ interface DiscordProviderConfig {
    * App credentials (bot token / public key / application id). May be omitted
    * here and provided via the `DISCORD_BOT_TOKEN` / `DISCORD_PUBLIC_KEY` /
    * `DISCORD_APPLICATION_ID` env vars, or later via {@link DiscordProvider.configure}.
-   * Whichever source resolves first is persisted **once** to channels storage.
+   * A bot token alone is enough: `publicKey` and `applicationId` are resolved
+   * from `GET /applications/@me` when omitted. Whichever source resolves first
+   * is persisted **once** to channels storage.
    */
   app?: Partial<DiscordAppConfig>;
   /**
@@ -333,7 +335,10 @@ declare class DiscordProvider implements ChannelProvider {
   /**
    * Provide or clear the app credentials at runtime. An object merges/overrides
    * `botToken` / `publicKey` / `applicationId` (persisted on the next `connect`);
-   * `null` clears the stored app config.
+   * `null` clears the stored app config. Supplying a **different bot token**
+   * replaces the app config instead of merging: the token identifies the
+   * Discord application, so any `publicKey`/`applicationId` from the previous
+   * application must not survive the switch.
    */
   configure(credentials: Partial<DiscordAppConfig> | null): Promise<void>;
   /**
@@ -444,6 +449,12 @@ interface DiscordApplication {
   id: string;
   /** The application's name. */
   name: string;
+  /**
+   * The Ed25519 public key used to verify interaction signatures. Discord
+   * includes it on every application object, so a bot token alone is enough to
+   * resolve the interaction-verification key.
+   */
+  verify_key: string;
 }
 /**
  * Call the Discord REST API with Bot-token auth. `method` is required; supplying

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/discord-provider.ts","../src/install-store.ts","../src/discord-client.ts","../src/commands.ts","../src/crypto.ts"],"mappings":";;;;;;;;;;;;cAgBa;;cAGA;;;;;;;;cASA;WACX;WACA;WACA;WACA;WACA;WACA;WACA;WACA;;;;;;;;;cAUW;;cAWA;;;;;;UAOI;;EAEf;;EAEA;;;KAIU;EAAiC;EAAc;;;;;;;;UAQ1C;;EAEf;;EAEA;;EAEA;;;;;;;;;;UAWe;;;;;;;EAOf,MAAM,QAAQ;;;;;EAKd;;;;;;EAMA,UAAU;;;;;EAKV;;;;;;;EAOA;;;;;EAKA;;;;;;EAMA,WAAW;;;;;;;;;;EAUX;;;;;EAKA,YAAY;;;;;;;;EAQZ;;;;;EAKA;;;;;;EAMA,mBAAmB;;EAEnB,SAAS;;;;;;;;EAQT,YAAY;;;;;;EAMZ;;EASA,WAAW;;EAEX,cAAc;;EAEd,cAAc;;EAEd,QAAQ;;EAER,gBAAgB;;EAEhB,cAAc;;EAEd,oBAAoB;;EAEpB,mBAAmB;;EAEnB,OAAO;;EAEP,cAAc;;;;;;;;EAQd,cAAc;;;;;;;EAOd,QAAQ;;EAER,aAAa,cAAc,+BAA+B;;;UAI3C;;;;;;;EAOf;;EAEA;;;;;EAKA,WAAW;;EAEX;;;;;;;;;UAUe;;EAEf;;EAEA;;;;;EAKA;;;;;EAKA;;EAEA;;EAEA;;EAEA,WAAW;;;;;;EAMX,kBAAkB;;EAElB,aAAa;;;;;;;;;;;iBC9PC,4BACd,QAAQ,KAAK;EAEb,WAAW;EACX;EACA,aAAa;EACb;;;;;;;;;;;;;;;;;;;;;;;;;;;cAmCW,2BAA2B;;WAC7B;EAoCT,YAAY,SAAQ;;;;;EAWpB,SAAS,QAAQ;;;;;;;;;EAwCjB,aAAa;;EAoBb,WAAW;;;;;;EAgCL,cAAc;;;;;;EA8Bd,UAAU,aAAa,QAAQ,2BAA2B;;;;;;;;;;;;;;EAuD1D,QAAQ,iBAAiB,UAAS,wBAA6B,QAAQ;;;;;;;EA4EvE,cAAc,mBAAmB,kBAAkB,QAAQ;;;;;;;;;;EAmD3D,WAAW,kBAAkB;;EAY7B,qBAAqB,QAAQ;;EAO7B,gBAAgB,kBAAkB,QAAQ;;EAMhD;;EAKA,WAAW,yBAAyB;;;;;cCrczB;;;;;;;;;;;;;cAgCA;;mBAEQ;mBACA;EAFnB,YACmB,SAAS,iBACT;;EAMb,gBAAgB,QAAQ;;EAaxB,cAAc,KAAK,mBAAmB;;EAUtC,mBAAmB;;EAOnB,WAAW,kBAAkB,QAAQ;;EAMrC,eAAe,oBAAoB,QAAQ;;;;;;;;;;;;;;;;EAoB3C,aAAa,kBAAkB,QAAQ;;EAqBvC,KAAK,cAAc,sBAAsB;;EAKzC,QAAQ,QAAQ;;EAMhB,cAAc,kBAAkB;;;iBA6DxB,mBAAmB,SAAS,sBAAsB;;;;;;;;UC/JjD;;EAEf;;EAEA;;;;;;;;;;;;iBAmBoB,eACpB,kBACA,gBACA,cACA,qBACA,iBACC,QAAQ;;;;;;;iBA+BW,YACpB,kBACA,sBACC,QAAQ;;;;;;;;;;;;;;iBAyBW,iBACpB,kBACA,iBACA,sBACC;;;;;;;;iBA8EmB,sBACpB,kBACA,uBACA,iBACA,mBAAmB,kBACnB,sBACC;;;;;;;;iBAcmB,uBACpB,kBACA,uBACA,mBAAmB,kBACnB,sBACC;;UAOc;;EAEf;;EAEA;;EAEA;;;;;EAKA;;;;;;;;;iBAUc,eAAe,SAAS;;;;;;;;;cC3P3B,2BAA2B;;;;;;;;;;iBAaxB,kBAAkB,cAAc,oCAAoC;;;;;;;iBAyBpE,aAAa,mBAAmB;;;;iBC3BhC,YAAY;;iBAKZ,QAAQ,mBAAmB;;iBAU3B,QAAQ,eAAe"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/discord-provider.ts","../src/install-store.ts","../src/discord-client.ts","../src/commands.ts","../src/crypto.ts"],"mappings":";;;;;;;;;;;;cAgBa;;cAGA;;;;;;;;cASA;WACX;WACA;WACA;WACA;WACA;WACA;WACA;WACA;;;;;;;;;cAUW;;cAWA;;;;;;UAOI;;EAEf;;EAEA;;;KAIU;EAAiC;EAAc;;;;;;;;UAQ1C;;EAEf;;EAEA;;EAEA;;;;;;;;;;UAWe;;;;;;;;;EASf,MAAM,QAAQ;;;;;EAKd;;;;;;EAMA,UAAU;;;;;EAKV;;;;;;;EAOA;;;;;EAKA;;;;;;EAMA,WAAW;;;;;;;;;;EAUX;;;;;EAKA,YAAY;;;;;;;;EAQZ;;;;;EAKA;;;;;;EAMA,mBAAmB;;EAEnB,SAAS;;;;;;;;EAQT,YAAY;;;;;;EAMZ;;EASA,WAAW;;EAEX,cAAc;;EAEd,cAAc;;EAEd,QAAQ;;EAER,gBAAgB;;EAEhB,cAAc;;EAEd,oBAAoB;;EAEpB,mBAAmB;;EAEnB,OAAO;;EAEP,cAAc;;;;;;;;EAQd,cAAc;;;;;;;EAOd,QAAQ;;EAER,aAAa,cAAc,+BAA+B;;;UAI3C;;;;;;;EAOf;;EAEA;;;;;EAKA,WAAW;;EAEX;;;;;;;;;UAUe;;EAEf;;EAEA;;;;;EAKA;;;;;EAKA;;EAEA;;EAEA;;EAEA,WAAW;;;;;;EAMX,kBAAkB;;EAElB,aAAa;;;;;;;;;;;iBC/PC,4BACd,QAAQ,KAAK;EAEb,WAAW;EACX;EACA,aAAa;EACb;;;;;;;;;;;;;;;;;;;;;;;;;;;cAmCW,2BAA2B;;WAC7B;EAoCT,YAAY,SAAQ;;;;;EAYpB,SAAS,QAAQ;;;;;;;;;EAwCjB,aAAa;;EAoBb,WAAW;;;;;;EAgCL,cAAc;;;;;;;;;EAiCd,UAAU,aAAa,QAAQ,2BAA2B;;;;;;;;;;;;;;EAmE1D,QAAQ,iBAAiB,UAAS,wBAA6B,QAAQ;;;;;;;EA6EvE,cAAc,mBAAmB,kBAAkB,QAAQ;;;;;;;;;;EAmD3D,WAAW,kBAAkB;;EAY7B,qBAAqB,QAAQ;;EAO7B,gBAAgB,kBAAkB,QAAQ;;EAMhD;;EAKA,WAAW,yBAAyB;;;;;cCvdzB;;;;;;;;;;;;;cAgCA;;mBAEQ;mBACA;EAFnB,YACmB,SAAS,iBACT;;EAMb,gBAAgB,QAAQ;;EAaxB,cAAc,KAAK,mBAAmB;;EAUtC,mBAAmB;;EAOnB,WAAW,kBAAkB,QAAQ;;EAMrC,eAAe,oBAAoB,QAAQ;;;;;;;;;;;;;;;;EAoB3C,aAAa,kBAAkB,QAAQ;;EAqBvC,KAAK,cAAc,sBAAsB;;EAKzC,QAAQ,QAAQ;;EAMhB,cAAc,kBAAkB;;;iBA6DxB,mBAAmB,SAAS,sBAAsB;;;;;;;;UC/JjD;;EAEf;;EAEA;;;;;;EAMA;;;;;;;;;;;;iBAmBoB,eACpB,kBACA,gBACA,cACA,qBACA,iBACC,QAAQ;;;;;;;iBA+BW,YACpB,kBACA,sBACC,QAAQ;;;;;;;;;;;;;;iBAyBW,iBACpB,kBACA,iBACA,sBACC;;;;;;;;iBA8EmB,sBACpB,kBACA,uBACA,iBACA,mBAAmB,kBACnB,sBACC;;;;;;;;iBAcmB,uBACpB,kBACA,uBACA,mBAAmB,kBACnB,sBACC;;UAOc;;EAEf;;EAEA;;EAEA;;;;;EAKA;;;;;;;;;iBAUc,eAAe,SAAS;;;;;;;;;cCjQ3B,2BAA2B;;;;;;;;;;iBAaxB,kBAAkB,cAAc,oCAAoC;;;;;;;iBAyBpE,aAAa,mBAAmB;;;;iBC3BhC,YAAY;;iBAKZ,QAAQ,mBAAmB;;iBAU3B,QAAQ,eAAe"}

package/dist/index.js

@@ -548,7 +548,7 @@ var DiscordProvider = class {
 	#storeGeneration = 0;
 	constructor(config = {}) {
 		this.#config = config;
-		this.#configured = this.#suppliedAppConfig() != null;
+		this.#configured = this.#hasSuppliedCredentials();
 	}
 	/**
 	* Called by Mastra when this channel is registered.
@@ -565,7 +565,7 @@ var DiscordProvider = class {
 		}
 		if (isNewInstance) {
 			this.#adapters.clear();
-			this.#configured = this.#suppliedAppConfig() != null;
+			this.#configured = this.#hasSuppliedCredentials();
 		}
 		this.#mastra = mastra;
 	}
@@ -637,7 +637,7 @@ var DiscordProvider = class {
 	async #doInitialize() {
 		const store = await this.#getStore();
 		const active = (await store.list()).filter((i) => i.status === "active");
-		const hasApp = await store.getAppConfig() != null || this.#suppliedAppConfig() != null;
+		const hasApp = await store.getAppConfig() != null || this.#hasSuppliedCredentials();
 		this.#configured = hasApp || active.length > 0;
 		for (const installation of active) try {
 			await this.#activateInstallation(installation);
@@ -648,7 +648,10 @@ var DiscordProvider = class {
 	/**
 	* Provide or clear the app credentials at runtime. An object merges/overrides
 	* `botToken` / `publicKey` / `applicationId` (persisted on the next `connect`);
-	* `null` clears the stored app config.
+	* `null` clears the stored app config. Supplying a **different bot token**
+	* replaces the app config instead of merging: the token identifies the
+	* Discord application, so any `publicKey`/`applicationId` from the previous
+	* application must not survive the switch.
 	*/
 	async configure(credentials) {
 		if (credentials === null) {
@@ -670,7 +673,7 @@ var DiscordProvider = class {
 				...credentials
 			}
 		};
-		this.#configured = this.#suppliedAppConfig() != null || this.#configured;
+		this.#configured = this.#hasSuppliedCredentials() || this.#configured;
 		if (![
 			"botToken",
 			"publicKey",
@@ -678,7 +681,14 @@ var DiscordProvider = class {
 		].some((k) => credentials[k] !== void 0 && credentials[k] !== previous?.[k])) return;
 		const store = await this.#getStore();
 		const stored = await store.getAppConfig();
-		if (stored) {
+		const tokenSupersedes = (base) => credentials.botToken !== void 0 && base?.botToken !== void 0 && base.botToken !== credentials.botToken;
+		if (tokenSupersedes(previous) || tokenSupersedes(stored)) {
+			this.#config = {
+				...this.#config,
+				app: { ...credentials }
+			};
+			await store.deleteAppConfig();
+		} else if (stored) {
 			const merged = {
 				...stored,
 				...credentials
@@ -707,8 +717,8 @@ var DiscordProvider = class {
 		const store = await this.#getStore();
 		const existing = await store.getByAgent(agentId);
 		if (existing?.status === "active") throw new Error(`Agent "${agentId}" is already connected to Discord. Disconnect first to reconnect. To add another server, invite the bot with the existing URL — new guilds activate on first use.`);
-		const { app, persisted } = await this.#resolveAppConfig(store);
-		const identity = await validateApp(app.botToken, this.#apiBaseUrl());
+		const { app, persisted, identity: resolvedIdentity } = await this.#resolveAppConfig(store);
+		const identity = resolvedIdentity ?? await validateApp(app.botToken, this.#apiBaseUrl());
 		if (!persisted) await store.saveAppConfig(app);
 		const installationId = existing?.id ?? randomUUID();
 		const webhookId = existing?.webhookId ?? randomUUID();
@@ -975,12 +985,33 @@ var DiscordProvider = class {
 			return;
 		}
 	}
+	/**
+	* App credentials from provider config or `DISCORD_*` env.
+	*
+	* A config-supplied bot token defines the application identity, so
+	* `publicKey` / `applicationId` never fall back to the environment in that
+	* case — stale `DISCORD_PUBLIC_KEY` / `DISCORD_APPLICATION_ID` from a
+	* *different* application would otherwise complete the config and keep that
+	* application's Ed25519 key trusted for webhook verification (bypassing the
+	* `GET /applications/@me` backfill). Env fallback for those fields applies
+	* only when the bot token itself comes from the environment.
+	*/
+	#suppliedPartialAppConfig() {
+		const a = this.#config.app ?? {};
+		if (a.botToken != null) return {
+			botToken: a.botToken,
+			publicKey: a.publicKey,
+			applicationId: a.applicationId
+		};
+		return {
+			botToken: process.env.DISCORD_BOT_TOKEN,
+			publicKey: a.publicKey ?? process.env.DISCORD_PUBLIC_KEY,
+			applicationId: a.applicationId ?? process.env.DISCORD_APPLICATION_ID
+		};
+	}
 	/** App credentials from provider config or `DISCORD_*` env, or `null` if incomplete. */
 	#suppliedAppConfig() {
-		const a = this.#config.app ?? {};
-		const botToken = a.botToken ?? process.env.DISCORD_BOT_TOKEN;
-		const publicKey = a.publicKey ?? process.env.DISCORD_PUBLIC_KEY;
-		const applicationId = a.applicationId ?? process.env.DISCORD_APPLICATION_ID;
+		const { botToken, publicKey, applicationId } = this.#suppliedPartialAppConfig();
 		if (botToken && publicKey && applicationId) return {
 			botToken,
 			publicKey,
@@ -989,10 +1020,22 @@ var DiscordProvider = class {
 		return null;
 	}
 	/**
+	* Whether credentials are resolvable without storage. A bot token alone is
+	* enough: `applicationId` and `publicKey` are backfilled from
+	* `GET /applications/@me` by {@link #resolveAppConfig}.
+	*/
+	#hasSuppliedCredentials() {
+		return this.#suppliedPartialAppConfig().botToken != null;
+	}
+	/**
 	* Resolve the app config: prefer the stored one, else the supplied credentials
-	* (config / `DISCORD_*` env). `persisted` says whether it's already in storage,
-	* so the caller can persist supplied credentials **once**, after validation.
-	* Throws if neither is available.
+	* (config / `DISCORD_*` env). A supplied `botToken` without `publicKey` /
+	* `applicationId` is completed from `GET /applications/@me` — the application
+	* object carries both the id and the Ed25519 `verify_key`. `persisted` says
+	* whether it's already in storage, so the caller can persist supplied
+	* credentials **once**, after validation. `identity` is set when the token was
+	* already validated against `/applications/@me` here, so callers can skip a
+	* second validation call. Throws if no credentials are available.
 	*/
 	async #resolveAppConfig(store) {
 		const stored = await store.getAppConfig();
@@ -1005,7 +1048,22 @@ var DiscordProvider = class {
 			app: supplied,
 			persisted: false
 		};
-		throw new Error("Discord app is not configured. Provide botToken, publicKey, and applicationId via the provider `app` option, the DISCORD_BOT_TOKEN / DISCORD_PUBLIC_KEY / DISCORD_APPLICATION_ID env vars, or configure() — Discord applications are created in the Developer Portal, not programmatically.");
+		const partial = this.#suppliedPartialAppConfig();
+		if (partial.botToken) {
+			const identity = await validateApp(partial.botToken, this.#apiBaseUrl());
+			const publicKey = partial.publicKey ?? identity.verify_key;
+			if (!publicKey) throw new Error("Discord /applications/@me returned no verify_key; provide publicKey explicitly.");
+			return {
+				app: {
+					botToken: partial.botToken,
+					publicKey,
+					applicationId: partial.applicationId ?? identity.id
+				},
+				persisted: false,
+				identity
+			};
+		}
+		throw new Error("Discord app is not configured. Provide at least a botToken via the provider `app` option, the DISCORD_BOT_TOKEN env var, or configure() — publicKey and applicationId are resolved from Discord automatically when omitted. Discord applications are created in the Developer Portal, not programmatically.");
 	}
 	/**
 	* The single entry point to the store. Every caller either gets the cached