experimental-ash 0.25.2 → 0.27.0

package/dist/src/public/channels/auth.js

@@ -1,414 +1 @@
-/**
- * Route-level HTTP authentication primitives.
- *
- * Strategy helpers return an {@link AuthFn} for route factories. Verifier
- * helpers are lower-level pure functions for custom `fetch` handlers.
- */
-import { decodeJwt } from "#compiled/jose/index.js";
-import { createLogger } from "#internal/logging.js";
-import { authenticateHttpBasicStrategy } from "#runtime/governance/auth/http-basic.js";
-import { authenticateJwtEcdsaStrategy } from "#runtime/governance/auth/jwt-ecdsa.js";
-import { authenticateJwtHmacStrategy } from "#runtime/governance/auth/jwt-hmac.js";
-import { authenticateOidcStrategy } from "#runtime/governance/auth/oidc.js";
-import { createRuntimeSessionAuthContext, } from "#runtime/governance/auth/types.js";
-const vercelOidcLog = createLogger("auth.vercel-oidc");
-import { createRuntimeIpAllowList, isRuntimeIpAllowed, } from "#runtime/governance/network/ip-allow-list.js";
-/**
- * Verifies an HTTP Basic credential against the supplied username +
- * password. Returns `{ ok: true, sessionAuth }` on success or
- * `{ ok: false }` on missing or mismatched credentials.
- *
- * The comparison uses a constant-time check internally so timing attacks
- * cannot leak the configured password.
- */
-export function verifyHttpBasic(authorizationHeader, credentials) {
-    if (authorizationHeader === null) {
-        return { ok: false };
-    }
-    const result = authenticateHttpBasicStrategy({
-        authorization: authorizationHeader,
-        strategy: {
-            kind: "http-basic",
-            password: credentials.password,
-            username: credentials.username,
-        },
-    });
-    if (result.kind !== "authenticated") {
-        return { ok: false };
-    }
-    return {
-        ok: true,
-        sessionAuth: createRuntimeSessionAuthContext(result.principal),
-    };
-}
-/**
- * Verifies a bearer JWT signed with an HMAC secret. Pass the bearer token
- * value (without the `Bearer ` prefix — see {@link extractBearerToken}).
- * Returns `{ ok: true, sessionAuth }` on success or `{ ok: false }` when
- * verification fails or the token's claims don't match the supplied
- * matchers.
- */
-export async function verifyJwtHmac(token, config) {
-    if (token === null || token.length === 0) {
-        return { ok: false };
-    }
-    const strategy = {
-        algorithm: config.algorithm,
-        audiences: [...config.audiences],
-        clockSkewSeconds: config.clockSkewSeconds ?? 30,
-        issuer: config.issuer,
-        kind: "jwt-hmac",
-        secret: config.secret,
-        ...(config.claims === undefined ? {} : { claims: config.claims }),
-        ...(config.subjects === undefined ? {} : { subjects: config.subjects }),
-    };
-    const result = await authenticateJwtHmacStrategy({ strategy, token });
-    if (result.kind !== "authenticated") {
-        return { ok: false };
-    }
-    return {
-        ok: true,
-        sessionAuth: createRuntimeSessionAuthContext(result.principal),
-    };
-}
-/**
- * Verifies a bearer JWT signed with an ECDSA private key against the
- * supplied PEM public key. Same shape as {@link verifyJwtHmac}.
- */
-export async function verifyJwtEcdsa(token, config) {
-    if (token === null || token.length === 0) {
-        return { ok: false };
-    }
-    const strategy = {
-        algorithm: config.algorithm,
-        audiences: [...config.audiences],
-        clockSkewSeconds: config.clockSkewSeconds ?? 30,
-        issuer: config.issuer,
-        kind: "jwt-ecdsa",
-        publicKey: config.publicKey,
-        ...(config.claims === undefined ? {} : { claims: config.claims }),
-        ...(config.subjects === undefined ? {} : { subjects: config.subjects }),
-    };
-    const result = await authenticateJwtEcdsaStrategy({ strategy, token });
-    if (result.kind !== "authenticated") {
-        return { ok: false };
-    }
-    return {
-        ok: true,
-        sessionAuth: createRuntimeSessionAuthContext(result.principal),
-    };
-}
-/**
- * Verifies a bearer OIDC token against an issuer's discovery URL.
- */
-export async function verifyOidc(token, config) {
-    const result = await runOidcVerification(token, {
-        ...config,
-        acceptCurrentVercelProject: false,
-    });
-    return result.kind === "authenticated"
-        ? { ok: true, sessionAuth: createRuntimeSessionAuthContext(result.principal) }
-        : { ok: false };
-}
-/**
- * Runs OIDC token verification against a resolved strategy and returns
- * the strategy authenticator's tagged result. Internal helper shared
- * between {@link verifyOidc} (public, never grants the Vercel
- * current-project upgrade) and {@link verifyVercelOidc} (always opts
- * into it). Returning the raw outcome rather than a boolean lets call
- * sites log a structured rejection reason.
- */
-async function runOidcVerification(token, config) {
-    if (token === null || token.length === 0) {
-        return { kind: "not-authenticated" };
-    }
-    const strategy = {
-        acceptCurrentVercelProject: config.acceptCurrentVercelProject,
-        audiences: [...config.audiences],
-        clockSkewSeconds: config.clockSkewSeconds ?? 30,
-        discoveryUrl: config.discoveryUrl ?? `${config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
-        issuer: config.issuer,
-        kind: "oidc",
-        ...(config.claims === undefined ? {} : { claims: config.claims }),
-        ...(config.subjects === undefined ? {} : { subjects: config.subjects }),
-    };
-    return await authenticateOidcStrategy({ strategy, token });
-}
-// ---------------------------------------------------------------------------
-// Bearer token extraction
-// ---------------------------------------------------------------------------
-/**
- * Extracts the bearer token from an `Authorization: Bearer <token>` header.
- * Returns `null` if the header is missing, the scheme isn't `Bearer`, or
- * the value after `Bearer ` is empty.
- */
-export function extractBearerToken(authorizationHeader) {
-    if (authorizationHeader === null) {
-        return null;
-    }
-    const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader);
-    const value = match?.[1]?.trim();
-    return value === undefined || value.length === 0 ? null : value;
-}
-/**
- * Parses an array of exact IP addresses or CIDR blocks into a reusable
- * {@link IpAllowList}. Throws if any entry is malformed.
- */
-export function createIpAllowList(entries) {
-    return createRuntimeIpAllowList(entries);
-}
-/**
- * Returns whether the supplied IP is permitted by `allowList`. `null`
- * inputs always return `false` — adapters that need to allow unknown IPs
- * should not call this helper at all.
- */
-export function isIpAllowed(ip, allowList) {
-    if (ip === null) {
-        return false;
-    }
-    return isRuntimeIpAllowed(ip, allowList);
-}
-/**
- * Builds a JSON failure response shaped like the framework's other auth
- * failures: `cache-control: no-store`, an array of `www-authenticate`
- * headers (one per challenge), and a `{ ok: false, code, error }` body.
- */
-export function createUnauthorizedResponse(opts = {}) {
-    const status = opts.status ?? 401;
-    const code = opts.code ?? (status === 403 ? "forbidden" : "unauthorized");
-    const message = opts.message ?? (status === 403 ? "Forbidden." : "Authorization is required for this route.");
-    const challenges = opts.challenges ?? [];
-    const headers = new Headers({ "cache-control": "no-store" });
-    for (const challenge of challenges) {
-        headers.append("www-authenticate", formatChallenge(challenge));
-    }
-    return Response.json({
-        code,
-        error: message,
-        ok: false,
-    }, {
-        headers,
-        status,
-    });
-}
-function formatChallenge(challenge) {
-    if (challenge.parameters === undefined || Object.keys(challenge.parameters).length === 0) {
-        return challenge.scheme;
-    }
-    const renderedParameters = Object.entries(challenge.parameters)
-        .map(([key, value]) => `${key}="${escapeChallengeValue(value)}"`)
-        .join(", ");
-    return `${challenge.scheme} ${renderedParameters}`;
-}
-function escapeChallengeValue(value) {
-    return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
-}
-/**
- * Allows a route to accept anonymous requests explicitly.
- */
-export function none() {
-    return () => undefined;
-}
-const VERCEL_OIDC_ISSUER_PREFIX = "https://oidc.vercel.com/";
-/**
- * Verifies a bearer JWT minted by Vercel OIDC.
- *
- * Acceptance rule:
- *
- * - Tokens whose `project_id` matches `VERCEL_PROJECT_ID` are **always**
- *   accepted regardless of `subjects`. This guarantees the deployment's
- *   own runtime callers (subagent, internal fetches, etc.) authenticate
- *   without authors having to enumerate them.
- * - Tokens from other Vercel projects are accepted **only** when their
- *   `sub` matches one of the supplied {@link VerifyVercelOidcOptions.subjects}
- *   patterns.
- *
- * The token's `environment` claim is not constrained — production,
- * preview, and development tokens for the current project all
- * authenticate. The principal is tagged `principalType: "runtime"` when
- * the token's `environment` matches the current deployment, otherwise
- * `"service"`.
- */
-export async function verifyVercelOidc(token, opts = {}) {
-    if (token === null || token.length === 0) {
-        vercelOidcLog.debug("Rejected request without a bearer token.");
-        return { ok: false };
-    }
-    const claims = decodeUnverifiedJwtClaims(token);
-    if (claims === null) {
-        vercelOidcLog.debug("Rejected token that failed to decode as a JWT.");
-        return { ok: false };
-    }
-    if (!claims.issuer.startsWith(VERCEL_OIDC_ISSUER_PREFIX)) {
-        vercelOidcLog.debug("Rejected token whose issuer is not a Vercel OIDC issuer.", {
-            issuer: claims.issuer,
-        });
-        return { ok: false };
-    }
-    if (claims.audiences.length === 0) {
-        vercelOidcLog.debug("Rejected token with no audience claim.", { issuer: claims.issuer });
-        return { ok: false };
-    }
-    // `acceptCurrentVercelProject: true` activates the same-project bypass
-    // inside the OIDC verifier so any token minted for `VERCEL_PROJECT_ID`
-    // is accepted regardless of `subjects`. The supplied `subjects`
-    // matcher (defaulting to an empty list that matches nothing)
-    // determines which **other** callers are allowed in.
-    const result = await runOidcVerification(token, {
-        acceptCurrentVercelProject: true,
-        audiences: claims.audiences,
-        issuer: claims.issuer,
-        subjects: opts.subjects ?? [],
-    });
-    if (result.kind === "authenticated") {
-        vercelOidcLog.debug("Accepted Vercel OIDC token.", {
-            issuer: claims.issuer,
-            principalType: result.principal.principalType,
-            subject: result.principal.subject,
-        });
-        return { ok: true, sessionAuth: createRuntimeSessionAuthContext(result.principal) };
-    }
-    vercelOidcLog.debug("Rejected Vercel OIDC token after verification.", {
-        audiences: claims.audiences,
-        issuer: claims.issuer,
-        reason: result.kind,
-        subjectsConfigured: (opts.subjects ?? []).length > 0,
-        ...(result.kind === "misconfigured" ? { detail: result.message } : {}),
-    });
-    return { ok: false };
-}
-/**
- * Builds a Vercel OIDC `sub` matcher pattern from a typed input.
- *
- * Vercel-issued OIDC tokens carry a `sub` of the form
- * `owner:[TEAM_SLUG]:project:[PROJECT_NAME]:environment:[ENVIRONMENT]`.
- * Hand-writing this shape — and the wildcards used to extend it —
- * invites two foot-guns: misspelling a slug (silently rejecting all
- * callers) and over-broad wildcards (silently accepting unrelated
- * callers). This helper rejects malformed inputs at construction time
- * and forces an explicit `environment` choice.
- *
- * Use it inside {@link VerifyVercelOidcOptions.subjects} to layer
- * additional Vercel-project callers on top of the always-on
- * current-project bypass:
- *
- * ```ts
- * vercelOidc({
- *   subjects: [vercelSubject({ teamSlug: "partner", projectName: "data" })],
- * });
- * ```
- *
- * If your team or project name changes, the `sub` claim flips with it
- * and any policy built on this helper has to be updated too — the
- * stable team/project IDs are not exposed in `sub`. See Vercel's OIDC
- * reference for the full token anatomy.
- */
-export function vercelSubject(input) {
-    assertVercelSubjectSegment("teamSlug", input.teamSlug);
-    assertVercelSubjectSegment("projectName", input.projectName);
-    const environment = input.environment ?? "production";
-    if (environment !== "production" &&
-        environment !== "preview" &&
-        environment !== "development" &&
-        environment !== "*") {
-        throw new Error(`vercelSubject: invalid environment ${JSON.stringify(environment)}; expected "production", "preview", "development", or "*".`);
-    }
-    return `owner:${input.teamSlug}:project:${input.projectName}:environment:${environment}`;
-}
-function assertVercelSubjectSegment(field, value) {
-    if (value.length === 0) {
-        throw new Error(`vercelSubject: ${field} must be a non-empty string.`);
-    }
-    if (value.includes("*") || value.includes(":")) {
-        throw new Error(`vercelSubject: ${field} ${JSON.stringify(value)} may not contain ${value.includes(":") ? "':'" : "'*'"}. Hand-write the subject string when wildcards are intentional.`);
-    }
-}
-/**
- * Returns an HTTP route auth callback backed by Vercel OIDC.
- *
- * See {@link verifyVercelOidc} for the always-on current-project bypass
- * and how `subjects` extends acceptance to other Vercel projects.
- */
-export function vercelOidc(opts = {}) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyVercelOidc(token, opts);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies HTTP Basic credentials on the
- * inbound request via {@link verifyHttpBasic}.
- */
-export function httpBasic(credentials) {
-    return (request) => {
-        const result = verifyHttpBasic(request.headers.get("authorization"), credentials);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies an HMAC-signed bearer JWT on
- * the inbound request via {@link verifyJwtHmac}.
- */
-export function jwtHmac(config) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyJwtHmac(token, config);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies an ECDSA-signed bearer JWT on
- * the inbound request via {@link verifyJwtEcdsa}.
- */
-export function jwtEcdsa(config) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyJwtEcdsa(token, config);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies an OIDC bearer token on the
- * inbound request via {@link verifyOidc}.
- *
- * Use {@link vercelOidc} instead when targeting Vercel-issued tokens —
- * it preconfigures the issuer, audience, and runtime principal flag.
- */
-export function oidc(config) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyOidc(token, config);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-// ---------------------------------------------------------------------------
-// Internals
-// ---------------------------------------------------------------------------
-/**
- * Decodes a bearer JWT into its issuer and audience(s) without verifying
- * the signature. Returns `null` for malformed tokens or tokens missing
- * the `iss` claim.
- *
- * Used by {@link verifyVercelOidc} to discover the team-scoped issuer and
- * audience baked into Vercel-issued tokens before running full
- * verification.
- */
-function decodeUnverifiedJwtClaims(token) {
-    let payload;
-    try {
-        payload = decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-    if (typeof payload.iss !== "string" || payload.iss.length === 0) {
-        return null;
-    }
-    const audiences = typeof payload.aud === "string"
-        ? [payload.aud]
-        : Array.isArray(payload.aud)
-            ? payload.aud.filter((value) => typeof value === "string")
-            : [];
-    return { audiences, issuer: payload.iss };
-}
+import{createLogger}from"#internal/logging.js";import{decodeJwt}from"#compiled/jose/index.js";import{authenticateHttpBasicStrategy}from"#runtime/governance/auth/http-basic.js";import{authenticateJwtEcdsaStrategy}from"#runtime/governance/auth/jwt-ecdsa.js";import{authenticateJwtHmacStrategy}from"#runtime/governance/auth/jwt-hmac.js";import{authenticateOidcStrategy}from"#runtime/governance/auth/oidc.js";import{createRuntimeSessionAuthContext}from"#runtime/governance/auth/types.js";import{createRuntimeIpAllowList,isRuntimeIpAllowed}from"#runtime/governance/network/ip-allow-list.js";var vercelOidcLog=createLogger(`auth.vercel-oidc`);function verifyHttpBasic(e,t){if(e===null)return{ok:!1};let r=authenticateHttpBasicStrategy({authorization:e,strategy:{kind:`http-basic`,password:t.password,username:t.username}});return r.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(r.principal)}:{ok:!1}}async function verifyJwtHmac(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtHmacStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-hmac`,secret:t.secret,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyJwtEcdsa(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtEcdsaStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-ecdsa`,publicKey:t.publicKey,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyOidc(e,t){let n=await runOidcVerification(e,{...t,acceptCurrentVercelProject:!1});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function runOidcVerification(e,t){return e===null||e.length===0?{kind:`not-authenticated`}:await authenticateOidcStrategy({strategy:{acceptCurrentVercelProject:t.acceptCurrentVercelProject,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,discoveryUrl:t.discoveryUrl??`${t.issuer.replace(/\/$/,``)}/.well-known/openid-configuration`,issuer:t.issuer,kind:`oidc`,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e})}function extractBearerToken(e){if(e===null)return null;let t=/^Bearer\s+(.+)$/i.exec(e)?.[1]?.trim();return t===void 0||t.length===0?null:t}function createIpAllowList(e){return createRuntimeIpAllowList(e)}function isIpAllowed(e,t){return e===null?!1:isRuntimeIpAllowed(e,t)}function createUnauthorizedResponse(e={}){let t=e.status??401,n=e.code??(t===403?`forbidden`:`unauthorized`),r=e.message??(t===403?`Forbidden.`:`Authorization is required for this route.`),i=e.challenges??[],a=new Headers({"cache-control":`no-store`});for(let e of i)a.append(`www-authenticate`,formatChallenge(e));return Response.json({code:n,error:r,ok:!1},{headers:a,status:t})}function formatChallenge(e){if(e.parameters===void 0||Object.keys(e.parameters).length===0)return e.scheme;let t=Object.entries(e.parameters).map(([e,t])=>`${e}="${escapeChallengeValue(t)}"`).join(`, `);return`${e.scheme} ${t}`}function escapeChallengeValue(e){return e.replaceAll(`\\`,`\\\\`).replaceAll(`"`,`\\"`)}function none(){return()=>void 0}var VERCEL_OIDC_ISSUER_PREFIX=`https://oidc.vercel.com/`;async function verifyVercelOidc(e,t={}){if(e===null||e.length===0)return vercelOidcLog.debug(`Rejected request without a bearer token.`),{ok:!1};let n=decodeUnverifiedJwtClaims(e);if(n===null)return vercelOidcLog.debug(`Rejected token that failed to decode as a JWT.`),{ok:!1};if(!n.issuer.startsWith(VERCEL_OIDC_ISSUER_PREFIX))return vercelOidcLog.debug(`Rejected token whose issuer is not a Vercel OIDC issuer.`,{issuer:n.issuer}),{ok:!1};if(n.audiences.length===0)return vercelOidcLog.debug(`Rejected token with no audience claim.`,{issuer:n.issuer}),{ok:!1};let r=await runOidcVerification(e,{acceptCurrentVercelProject:!0,audiences:n.audiences,issuer:n.issuer,subjects:t.subjects??[]});return r.kind===`authenticated`?(vercelOidcLog.debug(`Accepted Vercel OIDC token.`,{issuer:n.issuer,principalType:r.principal.principalType,subject:r.principal.subject}),{ok:!0,sessionAuth:createRuntimeSessionAuthContext(r.principal)}):(vercelOidcLog.debug(`Rejected Vercel OIDC token after verification.`,{audiences:n.audiences,issuer:n.issuer,reason:r.kind,subjectsConfigured:(t.subjects??[]).length>0,...r.kind===`misconfigured`?{detail:r.message}:{}}),{ok:!1})}function vercelSubject(e){assertVercelSubjectSegment(`teamSlug`,e.teamSlug),assertVercelSubjectSegment(`projectName`,e.projectName);let t=e.environment??`production`;if(t!==`production`&&t!==`preview`&&t!==`development`&&t!==`*`)throw Error(`vercelSubject: invalid environment ${JSON.stringify(t)}; expected "production", "preview", "development", or "*".`);return`owner:${e.teamSlug}:project:${e.projectName}:environment:${t}`}function assertVercelSubjectSegment(e,t){if(t.length===0)throw Error(`vercelSubject: ${e} must be a non-empty string.`);if(t.includes(`*`)||t.includes(`:`))throw Error(`vercelSubject: ${e} ${JSON.stringify(t)} may not contain ${t.includes(`:`)?`':'`:`'*'`}. Hand-write the subject string when wildcards are intentional.`)}function vercelOidc(e={}){return async t=>{let n=await verifyVercelOidc(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function httpBasic(e){return t=>{let n=verifyHttpBasic(t.headers.get(`authorization`),e);return n.ok?n.sessionAuth:null}}function jwtHmac(e){return async t=>{let n=await verifyJwtHmac(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function jwtEcdsa(e){return async t=>{let n=await verifyJwtEcdsa(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function oidc(e){return async t=>{let n=await verifyOidc(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function decodeUnverifiedJwtClaims(e){let n;try{n=decodeJwt(e)}catch{return null}return typeof n.iss!=`string`||n.iss.length===0?null:{audiences:typeof n.aud==`string`?[n.aud]:Array.isArray(n.aud)?n.aud.filter(e=>typeof e==`string`):[],issuer:n.iss}}export{createIpAllowList,createUnauthorizedResponse,extractBearerToken,httpBasic,isIpAllowed,jwtEcdsa,jwtHmac,none,oidc,vercelOidc,vercelSubject,verifyHttpBasic,verifyJwtEcdsa,verifyJwtHmac,verifyOidc,verifyVercelOidc};

package/dist/src/public/channels/discord/api.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Minimal Discord REST API wrapper used by the Discord channel.
+ *
+ * The channel talks directly to Discord's JSON HTTP API instead of
+ * exposing a third-party SDK through Ash public surfaces.
+ */
+import { type JsonObject } from "#shared/json.js";
+import { resolveDiscordPublicKey, type DiscordPublicKey } from "#public/channels/discord/verify.js";
+/** Discord application id, materialized directly or from an async secret provider. */
+export type DiscordApplicationId = string | (() => string | Promise<string>);
+/** Discord bot token, materialized directly or from an async secret provider. */
+export type DiscordBotToken = string | (() => string | Promise<string>);
+/** Fetch implementation override used by tests or non-standard runtimes. */
+export type DiscordFetch = typeof fetch;
+/** Credentials used by the native Discord channel. */
+export interface DiscordCredentials {
+    readonly applicationId?: DiscordApplicationId;
+    readonly botToken?: DiscordBotToken;
+    readonly publicKey?: DiscordPublicKey;
+}
+/** Shared Discord API options. */
+export interface DiscordApiOptions {
+    readonly apiBaseUrl?: string;
+    readonly credentials?: DiscordCredentials;
+    readonly fetch?: DiscordFetch;
+}
+/** Raw Discord API response body. */
+export interface DiscordApiResponse {
+    readonly status: number;
+    readonly ok: boolean;
+    readonly body: unknown;
+}
+/** Minimal Discord message object returned by channel write operations. */
+export interface DiscordPostedMessage {
+    /** Discord message id, when Discord returned one. */
+    readonly id: string;
+    /** Channel id associated with the message, when Discord returned one. */
+    readonly channelId?: string;
+    /** Discord's raw JSON response. */
+    readonly raw: unknown;
+}
+/** Allowed mentions payload that suppresses all generated pings. */
+export declare const DISCORD_NO_MENTIONS: JsonObject;
+/** Discord's documented message-content cap. */
+export declare const DISCORD_MESSAGE_CONTENT_MAX_LENGTH = 2000;
+/** Builds the channel-local continuation token (`<channelId>:<conversationId>`). */
+export declare function discordContinuationToken(channelId: string, conversationId: string | undefined): string;
+/** Resolves a Discord application id, falling back to `DISCORD_APPLICATION_ID`. */
+export declare function resolveDiscordApplicationId(applicationId?: DiscordApplicationId): Promise<string>;
+/** Resolves a Discord bot token, falling back to `DISCORD_BOT_TOKEN`. */
+export declare function resolveDiscordBotToken(botToken?: DiscordBotToken): Promise<string>;
+/** Resolves a Discord public key, falling back to `DISCORD_PUBLIC_KEY`. */
+export { resolveDiscordPublicKey };
+/**
+ * Low-level Discord JSON API call. Bot-token auth is included only when
+ * a token is supplied; interaction webhook endpoints intentionally run
+ * without bot auth.
+ */
+export declare function callDiscordApi(input: {
+    readonly apiBaseUrl?: string;
+    readonly body?: JsonObject;
+    readonly botToken?: DiscordBotToken;
+    readonly fetch?: DiscordFetch;
+    readonly method?: "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
+    readonly path: string;
+}): Promise<DiscordApiResponse>;
+/** Sends a bot-authenticated message to one Discord channel. */
+export declare function sendDiscordChannelMessage(input: DiscordApiOptions & {
+    readonly body: DiscordMessageBody;
+    readonly channelId: string;
+}): Promise<DiscordPostedMessage>;
+/** Triggers Discord's short-lived channel typing indicator with bot auth. */
+export declare function triggerDiscordTypingIndicator(input: DiscordApiOptions & {
+    readonly channelId: string;
+}): Promise<void>;
+/** Edits the original response for a deferred Discord interaction. */
+export declare function editDiscordOriginalResponse(input: DiscordApiOptions & {
+    readonly body: DiscordMessageBody;
+    readonly interactionToken: string;
+}): Promise<DiscordPostedMessage>;
+/** Creates a Discord interaction followup message. */
+export declare function createDiscordFollowupMessage(input: DiscordApiOptions & {
+    readonly body: DiscordMessageBody;
+    readonly interactionToken: string;
+}): Promise<DiscordPostedMessage>;
+/** JSON body supported by Discord message endpoints used by Ash. */
+export interface DiscordMessageBody {
+    readonly allowed_mentions?: Readonly<Record<string, unknown>>;
+    readonly components?: readonly Readonly<Record<string, unknown>>[];
+    readonly content?: string;
+    readonly flags?: number;
+    readonly tts?: boolean;
+}
+/**
+ * Splits text into chunks Discord will accept as individual message
+ * contents. Empty strings produce one empty chunk so callers can still
+ * decide how to handle a no-content message.
+ */
+export declare function splitDiscordMessageContent(content: string): readonly string[];

package/dist/src/public/channels/discord/api.js

@@ -0,0 +1,2 @@
+import{isObject}from"#shared/guards.js";import{parseJsonObject}from"#shared/json.js";import{resolveDiscordPublicKey}from"#public/channels/discord/verify.js";var DISCORD_NO_MENTIONS={parse:[]},DISCORD_MESSAGE_CONTENT_MAX_LENGTH=2e3;function discordContinuationToken(e,t){return`${e}:${t??``}`}async function resolveDiscordApplicationId(e){let t=e??process.env.DISCORD_APPLICATION_ID;if(!t)throw Error(`DISCORD_APPLICATION_ID is required.`);return typeof t==`function`?await t():t}async function resolveDiscordBotToken(e){let t=e??process.env.DISCORD_BOT_TOKEN;if(!t)throw Error(`DISCORD_BOT_TOKEN is required.`);return typeof t==`function`?await t():t}async function callDiscordApi(e){let n=e.fetch??fetch,r=new Headers;if(r.set(`content-type`,`application/json; charset=utf-8`),e.botToken!==void 0){let t=await resolveDiscordBotToken(e.botToken);r.set(`authorization`,`Bot ${t}`)}let i={headers:r,method:e.method??`POST`};e.body!==void 0&&(i.body=JSON.stringify(parseJsonObject(e.body)));let a=await n(`${e.apiBaseUrl??`https://discord.com/api/v10`}${e.path}`,i);return{body:await parseResponseBody(a),ok:a.ok,status:a.status}}async function sendDiscordChannelMessage(e){let t=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,body:normalizeMessageBody(e.body),botToken:e.credentials?.botToken,fetch:e.fetch,path:`/channels/${encodeURIComponent(e.channelId)}/messages`});if(!t.ok)throw Error(`Discord create message failed with HTTP ${t.status}.`);return toPostedMessage(t.body)}async function triggerDiscordTypingIndicator(e){let t=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,botToken:e.credentials?.botToken,fetch:e.fetch,path:`/channels/${encodeURIComponent(e.channelId)}/typing`});if(!t.ok)throw Error(`Discord typing indicator failed with HTTP ${t.status}.`)}async function editDiscordOriginalResponse(e){let t=await resolveDiscordApplicationId(e.credentials?.applicationId),n=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,body:normalizeMessageBody(e.body),fetch:e.fetch,method:`PATCH`,path:`/webhooks/${encodeURIComponent(t)}/${encodeURIComponent(e.interactionToken)}/messages/@original`});if(!n.ok)throw Error(`Discord edit original response failed with HTTP ${n.status}.`);return toPostedMessage(n.body)}async function createDiscordFollowupMessage(e){let t=await resolveDiscordApplicationId(e.credentials?.applicationId),n=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,body:normalizeMessageBody(e.body),fetch:e.fetch,path:`/webhooks/${encodeURIComponent(t)}/${encodeURIComponent(e.interactionToken)}`});if(!n.ok)throw Error(`Discord followup message failed with HTTP ${n.status}.`);return toPostedMessage(n.body)}function splitDiscordMessageContent(e){if(e.length<=2e3)return[e];let t=[],n=e;for(;n.length>DISCORD_MESSAGE_CONTENT_MAX_LENGTH;){let e=n.lastIndexOf(`
+`,DISCORD_MESSAGE_CONTENT_MAX_LENGTH);e<=0&&(e=n.lastIndexOf(` `,DISCORD_MESSAGE_CONTENT_MAX_LENGTH)),e<=0&&(e=DISCORD_MESSAGE_CONTENT_MAX_LENGTH),t.push(n.slice(0,e).trimEnd()),n=n.slice(e).trimStart()}return t.push(n),t}function normalizeMessageBody(e){let n={...e};return n.allowed_mentions===void 0&&(n.allowed_mentions=DISCORD_NO_MENTIONS),parseJsonObject(n)}function toPostedMessage(e){let t=parseMaybeObject(e);return{channelId:typeof t.channel_id==`string`?t.channel_id:void 0,id:typeof t.id==`string`?t.id:``,raw:e}}function parseMaybeObject(t){return isObject(t)?t:{}}async function parseResponseBody(e){let t=await e.text();if(!t)return null;try{return JSON.parse(t)}catch{return t}}export{DISCORD_MESSAGE_CONTENT_MAX_LENGTH,DISCORD_NO_MENTIONS,callDiscordApi,createDiscordFollowupMessage,discordContinuationToken,editDiscordOriginalResponse,resolveDiscordApplicationId,resolveDiscordBotToken,resolveDiscordPublicKey,sendDiscordChannelMessage,splitDiscordMessageContent,triggerDiscordTypingIndicator};

package/dist/src/public/channels/discord/defaults.d.ts

@@ -0,0 +1,9 @@
+import type { SessionAuthContext } from "#channel/types.js";
+import type { DiscordCommandInteraction } from "#public/channels/discord/inbound.js";
+import type { DiscordChannelEvents, DiscordCommandResult, DiscordContext } from "#public/channels/discord/discordChannel.js";
+/** Default auth projection for Discord interaction actors. */
+export declare function defaultDiscordAuth(interaction: DiscordCommandInteraction): SessionAuthContext;
+/** Default command hook: dispatch with Discord user auth. */
+export declare function defaultOnCommand(_ctx: DiscordContext, interaction: DiscordCommandInteraction): DiscordCommandResult;
+/** Built-in Discord event handlers for typing, replies, HITL, and terminal errors. */
+export declare const defaultEvents: DiscordChannelEvents;

package/dist/src/public/channels/discord/defaults.js

@@ -0,0 +1,3 @@
+import{extractErrorId,formatErrorHint}from"#internal/logging.js";import{splitDiscordMessageContent}from"#public/channels/discord/api.js";import{renderInputRequestComponents}from"#public/channels/discord/hitl.js";function defaultDiscordAuth(e){let t={channel_id:e.channelId,interaction_id:e.id,user_id:e.user.id,username:e.user.username};return e.guildId!==void 0&&(t.guild_id=e.guildId),e.member?.nick!==void 0&&(t.member_nick=e.member.nick),{attributes:t,authenticator:`discord-interaction`,issuer:e.guildId?`discord:${e.guildId}`:`discord`,principalId:e.guildId?`discord:${e.guildId}:${e.user.id}`:`discord:${e.user.id}`,principalType:e.user.isBot?`service`:`user`}}function defaultOnCommand(e,t){return{auth:defaultDiscordAuth(t)}}var defaultEvents={async"turn.started"(e,t){await t.discord.startTyping()},async"actions.requested"(e,t){await t.discord.startTyping()},async"input.requested"(e,t){for(let i of e.requests){let e=splitDiscordMessageContent(i.prompt)[0]??i.prompt;await t.discord.post({components:renderInputRequestComponents(i),content:e})}},async"message.completed"(e,t){e.finishReason===`tool-calls`||!e.message||await t.discord.post(e.message)},async"session.failed"(n,r){let i=formatErrorHint(n),a=extractErrorId(n.details);await r.discord.post([`This session could not recover from an error${i}.`,``,`Start a new command to continue.`,...a?[``,`Error id: ${a}`]:[]].join(`
+`))},async"turn.failed"(n,r){let i=formatErrorHint(n),a=extractErrorId(n.details);await r.discord.post([`I hit an error while handling your request${i}.`,``,`Please try again, rephrase, or reach out if it keeps failing.`,...a?[``,`Error id: ${a}`]:[]].join(`
+`))}};export{defaultDiscordAuth,defaultEvents,defaultOnCommand};