@went.tf/discord-bot-framework 2.4.0 → 2.5.0

package/build/index.d.ts

@@ -4,5 +4,6 @@ export * from './api-client/index.js';
 export * from './interactions/index.js';
 export * from './commands/index.js';
 export * from './client/index.js';
+export * from './webhook/index.js';
 export * from './utils/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}

package/build/index.js

@@ -8,5 +8,6 @@ export * from './api-client/index.js';
 export * from './interactions/index.js';
 export * from './commands/index.js';
 export * from './client/index.js';
+export * from './webhook/index.js';
 export * from './utils/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6CAA6C;AAC7C,sCAAsC;AACtC,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6CAA6C;AAC7C,sCAAsC;AACtC,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}

package/build/webhook/create-webhook-interaction-responder.d.ts

@@ -0,0 +1,33 @@
+import { REST } from '@discordjs/rest';
+import { RESTPatchAPIWebhookWithTokenMessageJSONBody, RESTPostAPIWebhookWithTokenJSONBody, RESTPostAPIWebhookWithTokenResult } from 'discord-api-types/v10';
+export interface CreateWebhookInteractionResponderOptions {
+    rest: REST;
+    applicationId: string;
+    /** The responding interaction's own token (`APIInteraction.token`), valid for 15 minutes after receipt. */
+    interactionToken: string;
+}
+export interface WebhookInteractionResponder {
+    /** `PATCH /webhooks/{application.id}/{interaction.token}/messages/@original` - edits the initial response (including a deferred one). */
+    editReply(body: RESTPatchAPIWebhookWithTokenMessageJSONBody): Promise<unknown>;
+    /** `POST /webhooks/{application.id}/{interaction.token}` - sends an additional message after the initial response. */
+    followUp(body: RESTPostAPIWebhookWithTokenJSONBody): Promise<RESTPostAPIWebhookWithTokenResult>;
+    /** `DELETE /webhooks/{application.id}/{interaction.token}/messages/@original` - deletes the initial response. */
+    deleteReply(): Promise<void>;
+}
+/**
+ * REST counterpart to editing/following-up on an interaction once it's
+ * already been given its initial response - built on `@discordjs/rest` (an
+ * existing peer dependency, same client `createCommandRegistrar` already
+ * uses) rather than a live discord.js `Client`, since webhook mode has none.
+ *
+ * This is *not* a drop-in replacement for discord.js's
+ * `Interaction#reply()`/`editReply()`/`options.get*()` surface - it only
+ * covers what happens after `handleWebhookInteractionRequest`'s synchronous
+ * response (the initial `reply()`/`deferReply()` equivalent is just the
+ * `APIInteractionResponse` your `onInteraction` callback returns). Mimicking
+ * discord.js's full `Interaction` shape closely enough for existing
+ * gateway-based handler code to run unmodified against it is real,
+ * unvalidated design work - see CLAUDE.md's `./webhook` design-decision entry.
+ */
+export declare function createWebhookInteractionResponder(options: CreateWebhookInteractionResponderOptions): WebhookInteractionResponder;
+//# sourceMappingURL=create-webhook-interaction-responder.d.ts.map

package/build/webhook/create-webhook-interaction-responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-webhook-interaction-responder.d.ts","sourceRoot":"","sources":["../../src/webhook/create-webhook-interaction-responder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,2CAA2C,EAAE,mCAAmC,EAAE,iCAAiC,EAAU,MAAM,uBAAuB,CAAC;AAEpK,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,IAAI,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,yIAAyI;IACzI,SAAS,CAAC,IAAI,EAAE,2CAA2C,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,sHAAsH;IACtH,QAAQ,CAAC,IAAI,EAAE,mCAAmC,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAChG,iHAAiH;IACjH,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,wCAAwC,GAAG,2BAA2B,CAQhI"}

package/build/webhook/create-webhook-interaction-responder.js

@@ -0,0 +1,25 @@
+import { Routes } from 'discord-api-types/v10';
+/**
+ * REST counterpart to editing/following-up on an interaction once it's
+ * already been given its initial response - built on `@discordjs/rest` (an
+ * existing peer dependency, same client `createCommandRegistrar` already
+ * uses) rather than a live discord.js `Client`, since webhook mode has none.
+ *
+ * This is *not* a drop-in replacement for discord.js's
+ * `Interaction#reply()`/`editReply()`/`options.get*()` surface - it only
+ * covers what happens after `handleWebhookInteractionRequest`'s synchronous
+ * response (the initial `reply()`/`deferReply()` equivalent is just the
+ * `APIInteractionResponse` your `onInteraction` callback returns). Mimicking
+ * discord.js's full `Interaction` shape closely enough for existing
+ * gateway-based handler code to run unmodified against it is real,
+ * unvalidated design work - see CLAUDE.md's `./webhook` design-decision entry.
+ */
+export function createWebhookInteractionResponder(options) {
+    const { rest, applicationId, interactionToken } = options;
+    return {
+        editReply: (body) => rest.patch(Routes.webhookMessage(applicationId, interactionToken, '@original'), { body }),
+        followUp: (body) => rest.post(Routes.webhook(applicationId, interactionToken), { body }),
+        deleteReply: () => rest.delete(Routes.webhookMessage(applicationId, interactionToken, '@original')),
+    };
+}
+//# sourceMappingURL=create-webhook-interaction-responder.js.map

package/build/webhook/create-webhook-interaction-responder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-webhook-interaction-responder.js","sourceRoot":"","sources":["../../src/webhook/create-webhook-interaction-responder.ts"],"names":[],"mappings":"AACA,OAAO,EAAuH,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAkBpK;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAiD;IACjG,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAE1D,OAAO;QACL,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9G,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,CAA+C;QACtI,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAkB;KACrH,CAAC;AACJ,CAAC"}

package/build/webhook/handle-webhook-interaction-request.d.ts

@@ -0,0 +1,41 @@
+import { APIInteraction, APIInteractionResponse } from 'discord-api-types/v10';
+import { NestableLogger } from '../logger/types.js';
+export interface WebhookInteractionRequest {
+    /** The request's `X-Signature-Ed25519` header. */
+    signature: string | undefined;
+    /** The request's `X-Signature-Timestamp` header. */
+    timestamp: string | undefined;
+    /** The raw (unparsed) request body, exactly as received - required for signature verification. */
+    rawBody: string | Buffer;
+}
+export interface WebhookInteractionResponse {
+    status: number;
+    body: APIInteractionResponse | {
+        error: string;
+    };
+}
+export interface HandleWebhookInteractionRequestOptions {
+    /** The bot's Ed25519 application public key, from the Discord developer portal, as a hex string. */
+    publicKey: string;
+    logger: NestableLogger;
+    /**
+     * Called for every interaction that isn't Discord's own PING handshake
+     * check. Its return value becomes the HTTP response body sent back to
+     * Discord as the interaction's initial response (e.g. a `CHANNEL_MESSAGE_WITH_SOURCE`
+     * or a `DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE` to be followed up on later via
+     * `createWebhookInteractionResponder`).
+     */
+    onInteraction: (interaction: APIInteraction) => APIInteractionResponse | Promise<APIInteractionResponse>;
+}
+/**
+ * Framework-agnostic core of an HTTP Interactions endpoint: verifies the
+ * request's Ed25519 signature, answers Discord's PING (type 1) validation
+ * handshake with PONG directly, and otherwise hands the parsed interaction to
+ * `onInteraction`. Deliberately takes/returns plain data (raw body + headers
+ * in, `{ status, body }` out) instead of an `http.IncomingMessage`/Express
+ * `Request`/etc., so it can be wired into any HTTP layer a bot already uses -
+ * this package doesn't otherwise depend on one, and picking one here would be
+ * a bigger commitment than this function needs to make.
+ */
+export declare function handleWebhookInteractionRequest(request: WebhookInteractionRequest, options: HandleWebhookInteractionRequestOptions): Promise<WebhookInteractionResponse>;
+//# sourceMappingURL=handle-webhook-interaction-request.d.ts.map

package/build/webhook/handle-webhook-interaction-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle-webhook-interaction-request.d.ts","sourceRoot":"","sources":["../../src/webhook/handle-webhook-interaction-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAA4C,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,MAAM,WAAW,yBAAyB;IACxC,kDAAkD;IAClD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,oDAAoD;IACpD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kGAAkG;IAClG,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,sBAAsB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,sCAAsC;IACrD,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,WAAW,EAAE,cAAc,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC1G;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,0BAA0B,CAAC,CAiCrC"}

package/build/webhook/handle-webhook-interaction-request.js

@@ -0,0 +1,45 @@
+import { InteractionResponseType, InteractionType } from 'discord-api-types/v10';
+import { verifyInteractionRequest } from './verify-interaction-request.js';
+/**
+ * Framework-agnostic core of an HTTP Interactions endpoint: verifies the
+ * request's Ed25519 signature, answers Discord's PING (type 1) validation
+ * handshake with PONG directly, and otherwise hands the parsed interaction to
+ * `onInteraction`. Deliberately takes/returns plain data (raw body + headers
+ * in, `{ status, body }` out) instead of an `http.IncomingMessage`/Express
+ * `Request`/etc., so it can be wired into any HTTP layer a bot already uses -
+ * this package doesn't otherwise depend on one, and picking one here would be
+ * a bigger commitment than this function needs to make.
+ */
+export async function handleWebhookInteractionRequest(request, options) {
+    const { publicKey, logger, onInteraction } = options;
+    const isValid = verifyInteractionRequest({
+        publicKey,
+        signature: request.signature,
+        timestamp: request.timestamp,
+        rawBody: request.rawBody,
+    });
+    if (!isValid) {
+        logger.warn('Rejected webhook interaction request with invalid signature');
+        return { status: 401, body: { error: 'Invalid request signature' } };
+    }
+    let interaction;
+    try {
+        interaction = JSON.parse(request.rawBody.toString());
+    }
+    catch (e) {
+        logger.error('Failed to parse webhook interaction request body as JSON', e);
+        return { status: 400, body: { error: 'Invalid JSON body' } };
+    }
+    if (interaction.type === InteractionType.Ping) {
+        return { status: 200, body: { type: InteractionResponseType.Pong } };
+    }
+    try {
+        const body = await onInteraction(interaction);
+        return { status: 200, body };
+    }
+    catch (e) {
+        logger.error('Error while handling webhook interaction', e);
+        return { status: 500, body: { error: 'Internal error' } };
+    }
+}
+//# sourceMappingURL=handle-webhook-interaction-request.js.map

package/build/webhook/handle-webhook-interaction-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle-webhook-interaction-request.js","sourceRoot":"","sources":["../../src/webhook/handle-webhook-interaction-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,uBAAuB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AA8B3E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAkC,EAClC,OAA+C;IAE/C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAErD,MAAM,OAAO,GAAG,wBAAwB,CAAC;QACvC,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,WAA2B,CAAC;IAChC,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAmB,CAAC;IACzE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,IAAI,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/build/webhook/index.d.ts

@@ -0,0 +1,4 @@
+export * from './verify-interaction-request.js';
+export * from './handle-webhook-interaction-request.js';
+export * from './create-webhook-interaction-responder.js';
+//# sourceMappingURL=index.d.ts.map

package/build/webhook/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhook/index.ts"],"names":[],"mappings":"AAIA,cAAc,iCAAiC,CAAC;AAChD,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC"}

package/build/webhook/index.js

@@ -0,0 +1,8 @@
+// Experimental: unvalidated against a real bot migration yet. See this
+// module's design-decision entry in CLAUDE.md before relying on it, in
+// particular that `createWebhookInteractionResponder` is not a drop-in
+// discord.js `Interaction` shim.
+export * from './verify-interaction-request.js';
+export * from './handle-webhook-interaction-request.js';
+export * from './create-webhook-interaction-responder.js';
+//# sourceMappingURL=index.js.map

package/build/webhook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhook/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,iCAAiC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC"}

package/build/webhook/verify-interaction-request.d.ts

@@ -0,0 +1,22 @@
+export interface VerifyInteractionRequestOptions {
+    /** The bot's Ed25519 application public key, from the Discord developer portal, as a hex string. */
+    publicKey: string;
+    /** The request's `X-Signature-Ed25519` header. */
+    signature: string | undefined;
+    /** The request's `X-Signature-Timestamp` header. */
+    timestamp: string | undefined;
+    /** The raw (unparsed) request body, exactly as received - verification fails against a re-serialized body. */
+    rawBody: string | Buffer;
+}
+/**
+ * Verifies a Discord Interactions-webhook request's Ed25519 signature, per
+ * https://discord.com/developers/docs/interactions/overview#setting-up-an-endpoint.
+ *
+ * Built on Node's native `crypto` module (`verify`/`createPublicKey`, both
+ * Ed25519-capable since Node 12) instead of `tweetnacl` or
+ * `discord-interactions` - matching this package's standing preference for a
+ * native API over a new dependency when one suffices (see the discord-webhook
+ * pino transport, and `createHandlerWatcher`'s use of native `fs.watch`).
+ */
+export declare function verifyInteractionRequest(options: VerifyInteractionRequestOptions): boolean;
+//# sourceMappingURL=verify-interaction-request.d.ts.map

package/build/webhook/verify-interaction-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-interaction-request.d.ts","sourceRoot":"","sources":["../../src/webhook/verify-interaction-request.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,+BAA+B;IAC9C,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,oDAAoD;IACpD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,8GAA8G;IAC9G,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAkB1F"}

package/build/webhook/verify-interaction-request.js

@@ -0,0 +1,37 @@
+import { createPublicKey, verify } from 'node:crypto';
+// DER SPKI wrapper for a raw 32-byte Ed25519 public key
+// (302a300506032b6570032100 = SEQUENCE { SEQUENCE { OID 1.3.101.112 }, BIT STRING (32 bytes) }).
+// Node's `crypto.createPublicKey` has no raw-Ed25519-key input format, only DER/PEM/JWK, and
+// Discord's developer portal only ever gives bots the raw 32-byte hex key - this prefix is the
+// standard, fixed way to wrap one into the DER SPKI shape `createPublicKey` accepts.
+const ed25519SpkiDerPrefix = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Verifies a Discord Interactions-webhook request's Ed25519 signature, per
+ * https://discord.com/developers/docs/interactions/overview#setting-up-an-endpoint.
+ *
+ * Built on Node's native `crypto` module (`verify`/`createPublicKey`, both
+ * Ed25519-capable since Node 12) instead of `tweetnacl` or
+ * `discord-interactions` - matching this package's standing preference for a
+ * native API over a new dependency when one suffices (see the discord-webhook
+ * pino transport, and `createHandlerWatcher`'s use of native `fs.watch`).
+ */
+export function verifyInteractionRequest(options) {
+    const { publicKey, signature, timestamp, rawBody } = options;
+    if (!signature || !timestamp) {
+        return false;
+    }
+    try {
+        const key = createPublicKey({
+            key: Buffer.concat([ed25519SpkiDerPrefix, Buffer.from(publicKey, 'hex')]),
+            format: 'der',
+            type: 'spki',
+        });
+        const message = Buffer.concat([Buffer.from(timestamp, 'utf8'), Buffer.from(rawBody)]);
+        return verify(null, message, key, Buffer.from(signature, 'hex'));
+    }
+    catch {
+        // Malformed hex in publicKey/signature, wrong-length key, etc. - all just "not valid".
+        return false;
+    }
+}
+//# sourceMappingURL=verify-interaction-request.js.map

package/build/webhook/verify-interaction-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-interaction-request.js","sourceRoot":"","sources":["../../src/webhook/verify-interaction-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEtD,wDAAwD;AACxD,iGAAiG;AACjG,6FAA6F;AAC7F,+FAA+F;AAC/F,qFAAqF;AACrF,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAa5E;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAC/E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@went.tf/discord-bot-framework",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Shared framework for building Discord bots with discord.js: logging, env validation, interaction dispatch, API client, and optional Postgres/i18next helpers",
   "author": "WentTheFox <mail@went.tf> (https://github.com/WentTheFox)",
   "license": "MIT",
@@ -48,6 +48,10 @@
       "types": "./build/client/index.d.ts",
       "default": "./build/client/index.js"
     },
+    "./webhook": {
+      "types": "./build/webhook/index.d.ts",
+      "default": "./build/webhook/index.js"
+    },
     "./dev": {
       "types": "./build/dev/index.d.ts",
       "default": "./build/dev/index.js"