experimental-ash 0.26.0 → 0.27.0

package/dist/src/public/channels/auth.js

@@ -1,414 +1 @@
-/**
- * Route-level HTTP authentication primitives.
- *
- * Strategy helpers return an {@link AuthFn} for route factories. Verifier
- * helpers are lower-level pure functions for custom `fetch` handlers.
- */
-import { decodeJwt } from "#compiled/jose/index.js";
-import { createLogger } from "#internal/logging.js";
-import { authenticateHttpBasicStrategy } from "#runtime/governance/auth/http-basic.js";
-import { authenticateJwtEcdsaStrategy } from "#runtime/governance/auth/jwt-ecdsa.js";
-import { authenticateJwtHmacStrategy } from "#runtime/governance/auth/jwt-hmac.js";
-import { authenticateOidcStrategy } from "#runtime/governance/auth/oidc.js";
-import { createRuntimeSessionAuthContext, } from "#runtime/governance/auth/types.js";
-const vercelOidcLog = createLogger("auth.vercel-oidc");
-import { createRuntimeIpAllowList, isRuntimeIpAllowed, } from "#runtime/governance/network/ip-allow-list.js";
-/**
- * Verifies an HTTP Basic credential against the supplied username +
- * password. Returns `{ ok: true, sessionAuth }` on success or
- * `{ ok: false }` on missing or mismatched credentials.
- *
- * The comparison uses a constant-time check internally so timing attacks
- * cannot leak the configured password.
- */
-export function verifyHttpBasic(authorizationHeader, credentials) {
-    if (authorizationHeader === null) {
-        return { ok: false };
-    }
-    const result = authenticateHttpBasicStrategy({
-        authorization: authorizationHeader,
-        strategy: {
-            kind: "http-basic",
-            password: credentials.password,
-            username: credentials.username,
-        },
-    });
-    if (result.kind !== "authenticated") {
-        return { ok: false };
-    }
-    return {
-        ok: true,
-        sessionAuth: createRuntimeSessionAuthContext(result.principal),
-    };
-}
-/**
- * Verifies a bearer JWT signed with an HMAC secret. Pass the bearer token
- * value (without the `Bearer ` prefix — see {@link extractBearerToken}).
- * Returns `{ ok: true, sessionAuth }` on success or `{ ok: false }` when
- * verification fails or the token's claims don't match the supplied
- * matchers.
- */
-export async function verifyJwtHmac(token, config) {
-    if (token === null || token.length === 0) {
-        return { ok: false };
-    }
-    const strategy = {
-        algorithm: config.algorithm,
-        audiences: [...config.audiences],
-        clockSkewSeconds: config.clockSkewSeconds ?? 30,
-        issuer: config.issuer,
-        kind: "jwt-hmac",
-        secret: config.secret,
-        ...(config.claims === undefined ? {} : { claims: config.claims }),
-        ...(config.subjects === undefined ? {} : { subjects: config.subjects }),
-    };
-    const result = await authenticateJwtHmacStrategy({ strategy, token });
-    if (result.kind !== "authenticated") {
-        return { ok: false };
-    }
-    return {
-        ok: true,
-        sessionAuth: createRuntimeSessionAuthContext(result.principal),
-    };
-}
-/**
- * Verifies a bearer JWT signed with an ECDSA private key against the
- * supplied PEM public key. Same shape as {@link verifyJwtHmac}.
- */
-export async function verifyJwtEcdsa(token, config) {
-    if (token === null || token.length === 0) {
-        return { ok: false };
-    }
-    const strategy = {
-        algorithm: config.algorithm,
-        audiences: [...config.audiences],
-        clockSkewSeconds: config.clockSkewSeconds ?? 30,
-        issuer: config.issuer,
-        kind: "jwt-ecdsa",
-        publicKey: config.publicKey,
-        ...(config.claims === undefined ? {} : { claims: config.claims }),
-        ...(config.subjects === undefined ? {} : { subjects: config.subjects }),
-    };
-    const result = await authenticateJwtEcdsaStrategy({ strategy, token });
-    if (result.kind !== "authenticated") {
-        return { ok: false };
-    }
-    return {
-        ok: true,
-        sessionAuth: createRuntimeSessionAuthContext(result.principal),
-    };
-}
-/**
- * Verifies a bearer OIDC token against an issuer's discovery URL.
- */
-export async function verifyOidc(token, config) {
-    const result = await runOidcVerification(token, {
-        ...config,
-        acceptCurrentVercelProject: false,
-    });
-    return result.kind === "authenticated"
-        ? { ok: true, sessionAuth: createRuntimeSessionAuthContext(result.principal) }
-        : { ok: false };
-}
-/**
- * Runs OIDC token verification against a resolved strategy and returns
- * the strategy authenticator's tagged result. Internal helper shared
- * between {@link verifyOidc} (public, never grants the Vercel
- * current-project upgrade) and {@link verifyVercelOidc} (always opts
- * into it). Returning the raw outcome rather than a boolean lets call
- * sites log a structured rejection reason.
- */
-async function runOidcVerification(token, config) {
-    if (token === null || token.length === 0) {
-        return { kind: "not-authenticated" };
-    }
-    const strategy = {
-        acceptCurrentVercelProject: config.acceptCurrentVercelProject,
-        audiences: [...config.audiences],
-        clockSkewSeconds: config.clockSkewSeconds ?? 30,
-        discoveryUrl: config.discoveryUrl ?? `${config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
-        issuer: config.issuer,
-        kind: "oidc",
-        ...(config.claims === undefined ? {} : { claims: config.claims }),
-        ...(config.subjects === undefined ? {} : { subjects: config.subjects }),
-    };
-    return await authenticateOidcStrategy({ strategy, token });
-}
-// ---------------------------------------------------------------------------
-// Bearer token extraction
-// ---------------------------------------------------------------------------
-/**
- * Extracts the bearer token from an `Authorization: Bearer <token>` header.
- * Returns `null` if the header is missing, the scheme isn't `Bearer`, or
- * the value after `Bearer ` is empty.
- */
-export function extractBearerToken(authorizationHeader) {
-    if (authorizationHeader === null) {
-        return null;
-    }
-    const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader);
-    const value = match?.[1]?.trim();
-    return value === undefined || value.length === 0 ? null : value;
-}
-/**
- * Parses an array of exact IP addresses or CIDR blocks into a reusable
- * {@link IpAllowList}. Throws if any entry is malformed.
- */
-export function createIpAllowList(entries) {
-    return createRuntimeIpAllowList(entries);
-}
-/**
- * Returns whether the supplied IP is permitted by `allowList`. `null`
- * inputs always return `false` — adapters that need to allow unknown IPs
- * should not call this helper at all.
- */
-export function isIpAllowed(ip, allowList) {
-    if (ip === null) {
-        return false;
-    }
-    return isRuntimeIpAllowed(ip, allowList);
-}
-/**
- * Builds a JSON failure response shaped like the framework's other auth
- * failures: `cache-control: no-store`, an array of `www-authenticate`
- * headers (one per challenge), and a `{ ok: false, code, error }` body.
- */
-export function createUnauthorizedResponse(opts = {}) {
-    const status = opts.status ?? 401;
-    const code = opts.code ?? (status === 403 ? "forbidden" : "unauthorized");
-    const message = opts.message ?? (status === 403 ? "Forbidden." : "Authorization is required for this route.");
-    const challenges = opts.challenges ?? [];
-    const headers = new Headers({ "cache-control": "no-store" });
-    for (const challenge of challenges) {
-        headers.append("www-authenticate", formatChallenge(challenge));
-    }
-    return Response.json({
-        code,
-        error: message,
-        ok: false,
-    }, {
-        headers,
-        status,
-    });
-}
-function formatChallenge(challenge) {
-    if (challenge.parameters === undefined || Object.keys(challenge.parameters).length === 0) {
-        return challenge.scheme;
-    }
-    const renderedParameters = Object.entries(challenge.parameters)
-        .map(([key, value]) => `${key}="${escapeChallengeValue(value)}"`)
-        .join(", ");
-    return `${challenge.scheme} ${renderedParameters}`;
-}
-function escapeChallengeValue(value) {
-    return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
-}
-/**
- * Allows a route to accept anonymous requests explicitly.
- */
-export function none() {
-    return () => undefined;
-}
-const VERCEL_OIDC_ISSUER_PREFIX = "https://oidc.vercel.com/";
-/**
- * Verifies a bearer JWT minted by Vercel OIDC.
- *
- * Acceptance rule:
- *
- * - Tokens whose `project_id` matches `VERCEL_PROJECT_ID` are **always**
- *   accepted regardless of `subjects`. This guarantees the deployment's
- *   own runtime callers (subagent, internal fetches, etc.) authenticate
- *   without authors having to enumerate them.
- * - Tokens from other Vercel projects are accepted **only** when their
- *   `sub` matches one of the supplied {@link VerifyVercelOidcOptions.subjects}
- *   patterns.
- *
- * The token's `environment` claim is not constrained — production,
- * preview, and development tokens for the current project all
- * authenticate. The principal is tagged `principalType: "runtime"` when
- * the token's `environment` matches the current deployment, otherwise
- * `"service"`.
- */
-export async function verifyVercelOidc(token, opts = {}) {
-    if (token === null || token.length === 0) {
-        vercelOidcLog.debug("Rejected request without a bearer token.");
-        return { ok: false };
-    }
-    const claims = decodeUnverifiedJwtClaims(token);
-    if (claims === null) {
-        vercelOidcLog.debug("Rejected token that failed to decode as a JWT.");
-        return { ok: false };
-    }
-    if (!claims.issuer.startsWith(VERCEL_OIDC_ISSUER_PREFIX)) {
-        vercelOidcLog.debug("Rejected token whose issuer is not a Vercel OIDC issuer.", {
-            issuer: claims.issuer,
-        });
-        return { ok: false };
-    }
-    if (claims.audiences.length === 0) {
-        vercelOidcLog.debug("Rejected token with no audience claim.", { issuer: claims.issuer });
-        return { ok: false };
-    }
-    // `acceptCurrentVercelProject: true` activates the same-project bypass
-    // inside the OIDC verifier so any token minted for `VERCEL_PROJECT_ID`
-    // is accepted regardless of `subjects`. The supplied `subjects`
-    // matcher (defaulting to an empty list that matches nothing)
-    // determines which **other** callers are allowed in.
-    const result = await runOidcVerification(token, {
-        acceptCurrentVercelProject: true,
-        audiences: claims.audiences,
-        issuer: claims.issuer,
-        subjects: opts.subjects ?? [],
-    });
-    if (result.kind === "authenticated") {
-        vercelOidcLog.debug("Accepted Vercel OIDC token.", {
-            issuer: claims.issuer,
-            principalType: result.principal.principalType,
-            subject: result.principal.subject,
-        });
-        return { ok: true, sessionAuth: createRuntimeSessionAuthContext(result.principal) };
-    }
-    vercelOidcLog.debug("Rejected Vercel OIDC token after verification.", {
-        audiences: claims.audiences,
-        issuer: claims.issuer,
-        reason: result.kind,
-        subjectsConfigured: (opts.subjects ?? []).length > 0,
-        ...(result.kind === "misconfigured" ? { detail: result.message } : {}),
-    });
-    return { ok: false };
-}
-/**
- * Builds a Vercel OIDC `sub` matcher pattern from a typed input.
- *
- * Vercel-issued OIDC tokens carry a `sub` of the form
- * `owner:[TEAM_SLUG]:project:[PROJECT_NAME]:environment:[ENVIRONMENT]`.
- * Hand-writing this shape — and the wildcards used to extend it —
- * invites two foot-guns: misspelling a slug (silently rejecting all
- * callers) and over-broad wildcards (silently accepting unrelated
- * callers). This helper rejects malformed inputs at construction time
- * and forces an explicit `environment` choice.
- *
- * Use it inside {@link VerifyVercelOidcOptions.subjects} to layer
- * additional Vercel-project callers on top of the always-on
- * current-project bypass:
- *
- * ```ts
- * vercelOidc({
- *   subjects: [vercelSubject({ teamSlug: "partner", projectName: "data" })],
- * });
- * ```
- *
- * If your team or project name changes, the `sub` claim flips with it
- * and any policy built on this helper has to be updated too — the
- * stable team/project IDs are not exposed in `sub`. See Vercel's OIDC
- * reference for the full token anatomy.
- */
-export function vercelSubject(input) {
-    assertVercelSubjectSegment("teamSlug", input.teamSlug);
-    assertVercelSubjectSegment("projectName", input.projectName);
-    const environment = input.environment ?? "production";
-    if (environment !== "production" &&
-        environment !== "preview" &&
-        environment !== "development" &&
-        environment !== "*") {
-        throw new Error(`vercelSubject: invalid environment ${JSON.stringify(environment)}; expected "production", "preview", "development", or "*".`);
-    }
-    return `owner:${input.teamSlug}:project:${input.projectName}:environment:${environment}`;
-}
-function assertVercelSubjectSegment(field, value) {
-    if (value.length === 0) {
-        throw new Error(`vercelSubject: ${field} must be a non-empty string.`);
-    }
-    if (value.includes("*") || value.includes(":")) {
-        throw new Error(`vercelSubject: ${field} ${JSON.stringify(value)} may not contain ${value.includes(":") ? "':'" : "'*'"}. Hand-write the subject string when wildcards are intentional.`);
-    }
-}
-/**
- * Returns an HTTP route auth callback backed by Vercel OIDC.
- *
- * See {@link verifyVercelOidc} for the always-on current-project bypass
- * and how `subjects` extends acceptance to other Vercel projects.
- */
-export function vercelOidc(opts = {}) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyVercelOidc(token, opts);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies HTTP Basic credentials on the
- * inbound request via {@link verifyHttpBasic}.
- */
-export function httpBasic(credentials) {
-    return (request) => {
-        const result = verifyHttpBasic(request.headers.get("authorization"), credentials);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies an HMAC-signed bearer JWT on
- * the inbound request via {@link verifyJwtHmac}.
- */
-export function jwtHmac(config) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyJwtHmac(token, config);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies an ECDSA-signed bearer JWT on
- * the inbound request via {@link verifyJwtEcdsa}.
- */
-export function jwtEcdsa(config) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyJwtEcdsa(token, config);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-/**
- * Returns an {@link AuthFn} that verifies an OIDC bearer token on the
- * inbound request via {@link verifyOidc}.
- *
- * Use {@link vercelOidc} instead when targeting Vercel-issued tokens —
- * it preconfigures the issuer, audience, and runtime principal flag.
- */
-export function oidc(config) {
-    return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
-        const result = await verifyOidc(token, config);
-        return result.ok ? result.sessionAuth : null;
-    };
-}
-// ---------------------------------------------------------------------------
-// Internals
-// ---------------------------------------------------------------------------
-/**
- * Decodes a bearer JWT into its issuer and audience(s) without verifying
- * the signature. Returns `null` for malformed tokens or tokens missing
- * the `iss` claim.
- *
- * Used by {@link verifyVercelOidc} to discover the team-scoped issuer and
- * audience baked into Vercel-issued tokens before running full
- * verification.
- */
-function decodeUnverifiedJwtClaims(token) {
-    let payload;
-    try {
-        payload = decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-    if (typeof payload.iss !== "string" || payload.iss.length === 0) {
-        return null;
-    }
-    const audiences = typeof payload.aud === "string"
-        ? [payload.aud]
-        : Array.isArray(payload.aud)
-            ? payload.aud.filter((value) => typeof value === "string")
-            : [];
-    return { audiences, issuer: payload.iss };
-}
+import{createLogger}from"#internal/logging.js";import{decodeJwt}from"#compiled/jose/index.js";import{authenticateHttpBasicStrategy}from"#runtime/governance/auth/http-basic.js";import{authenticateJwtEcdsaStrategy}from"#runtime/governance/auth/jwt-ecdsa.js";import{authenticateJwtHmacStrategy}from"#runtime/governance/auth/jwt-hmac.js";import{authenticateOidcStrategy}from"#runtime/governance/auth/oidc.js";import{createRuntimeSessionAuthContext}from"#runtime/governance/auth/types.js";import{createRuntimeIpAllowList,isRuntimeIpAllowed}from"#runtime/governance/network/ip-allow-list.js";var vercelOidcLog=createLogger(`auth.vercel-oidc`);function verifyHttpBasic(e,t){if(e===null)return{ok:!1};let r=authenticateHttpBasicStrategy({authorization:e,strategy:{kind:`http-basic`,password:t.password,username:t.username}});return r.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(r.principal)}:{ok:!1}}async function verifyJwtHmac(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtHmacStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-hmac`,secret:t.secret,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyJwtEcdsa(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtEcdsaStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-ecdsa`,publicKey:t.publicKey,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyOidc(e,t){let n=await runOidcVerification(e,{...t,acceptCurrentVercelProject:!1});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function runOidcVerification(e,t){return e===null||e.length===0?{kind:`not-authenticated`}:await authenticateOidcStrategy({strategy:{acceptCurrentVercelProject:t.acceptCurrentVercelProject,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,discoveryUrl:t.discoveryUrl??`${t.issuer.replace(/\/$/,``)}/.well-known/openid-configuration`,issuer:t.issuer,kind:`oidc`,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e})}function extractBearerToken(e){if(e===null)return null;let t=/^Bearer\s+(.+)$/i.exec(e)?.[1]?.trim();return t===void 0||t.length===0?null:t}function createIpAllowList(e){return createRuntimeIpAllowList(e)}function isIpAllowed(e,t){return e===null?!1:isRuntimeIpAllowed(e,t)}function createUnauthorizedResponse(e={}){let t=e.status??401,n=e.code??(t===403?`forbidden`:`unauthorized`),r=e.message??(t===403?`Forbidden.`:`Authorization is required for this route.`),i=e.challenges??[],a=new Headers({"cache-control":`no-store`});for(let e of i)a.append(`www-authenticate`,formatChallenge(e));return Response.json({code:n,error:r,ok:!1},{headers:a,status:t})}function formatChallenge(e){if(e.parameters===void 0||Object.keys(e.parameters).length===0)return e.scheme;let t=Object.entries(e.parameters).map(([e,t])=>`${e}="${escapeChallengeValue(t)}"`).join(`, `);return`${e.scheme} ${t}`}function escapeChallengeValue(e){return e.replaceAll(`\\`,`\\\\`).replaceAll(`"`,`\\"`)}function none(){return()=>void 0}var VERCEL_OIDC_ISSUER_PREFIX=`https://oidc.vercel.com/`;async function verifyVercelOidc(e,t={}){if(e===null||e.length===0)return vercelOidcLog.debug(`Rejected request without a bearer token.`),{ok:!1};let n=decodeUnverifiedJwtClaims(e);if(n===null)return vercelOidcLog.debug(`Rejected token that failed to decode as a JWT.`),{ok:!1};if(!n.issuer.startsWith(VERCEL_OIDC_ISSUER_PREFIX))return vercelOidcLog.debug(`Rejected token whose issuer is not a Vercel OIDC issuer.`,{issuer:n.issuer}),{ok:!1};if(n.audiences.length===0)return vercelOidcLog.debug(`Rejected token with no audience claim.`,{issuer:n.issuer}),{ok:!1};let r=await runOidcVerification(e,{acceptCurrentVercelProject:!0,audiences:n.audiences,issuer:n.issuer,subjects:t.subjects??[]});return r.kind===`authenticated`?(vercelOidcLog.debug(`Accepted Vercel OIDC token.`,{issuer:n.issuer,principalType:r.principal.principalType,subject:r.principal.subject}),{ok:!0,sessionAuth:createRuntimeSessionAuthContext(r.principal)}):(vercelOidcLog.debug(`Rejected Vercel OIDC token after verification.`,{audiences:n.audiences,issuer:n.issuer,reason:r.kind,subjectsConfigured:(t.subjects??[]).length>0,...r.kind===`misconfigured`?{detail:r.message}:{}}),{ok:!1})}function vercelSubject(e){assertVercelSubjectSegment(`teamSlug`,e.teamSlug),assertVercelSubjectSegment(`projectName`,e.projectName);let t=e.environment??`production`;if(t!==`production`&&t!==`preview`&&t!==`development`&&t!==`*`)throw Error(`vercelSubject: invalid environment ${JSON.stringify(t)}; expected "production", "preview", "development", or "*".`);return`owner:${e.teamSlug}:project:${e.projectName}:environment:${t}`}function assertVercelSubjectSegment(e,t){if(t.length===0)throw Error(`vercelSubject: ${e} must be a non-empty string.`);if(t.includes(`*`)||t.includes(`:`))throw Error(`vercelSubject: ${e} ${JSON.stringify(t)} may not contain ${t.includes(`:`)?`':'`:`'*'`}. Hand-write the subject string when wildcards are intentional.`)}function vercelOidc(e={}){return async t=>{let n=await verifyVercelOidc(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function httpBasic(e){return t=>{let n=verifyHttpBasic(t.headers.get(`authorization`),e);return n.ok?n.sessionAuth:null}}function jwtHmac(e){return async t=>{let n=await verifyJwtHmac(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function jwtEcdsa(e){return async t=>{let n=await verifyJwtEcdsa(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function oidc(e){return async t=>{let n=await verifyOidc(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null}}function decodeUnverifiedJwtClaims(e){let n;try{n=decodeJwt(e)}catch{return null}return typeof n.iss!=`string`||n.iss.length===0?null:{audiences:typeof n.aud==`string`?[n.aud]:Array.isArray(n.aud)?n.aud.filter(e=>typeof e==`string`):[],issuer:n.iss}}export{createIpAllowList,createUnauthorizedResponse,extractBearerToken,httpBasic,isIpAllowed,jwtEcdsa,jwtHmac,none,oidc,vercelOidc,vercelSubject,verifyHttpBasic,verifyJwtEcdsa,verifyJwtHmac,verifyOidc,verifyVercelOidc};

package/dist/src/public/channels/discord/api.js

@@ -1,167 +1,2 @@
-/**
- * Minimal Discord REST API wrapper used by the Discord channel.
- *
- * The channel talks directly to Discord's JSON HTTP API instead of
- * exposing a third-party SDK through Ash public surfaces.
- */
-import { parseJsonObject } from "#shared/json.js";
-import { isObject } from "#shared/guards.js";
-import { resolveDiscordPublicKey } from "#public/channels/discord/verify.js";
-/** Allowed mentions payload that suppresses all generated pings. */
-export const DISCORD_NO_MENTIONS = { parse: [] };
-/** Discord's documented message-content cap. */
-export const DISCORD_MESSAGE_CONTENT_MAX_LENGTH = 2000;
-/** Builds the channel-local continuation token (`<channelId>:<conversationId>`). */
-export function discordContinuationToken(channelId, conversationId) {
-    return `${channelId}:${conversationId ?? ""}`;
-}
-/** Resolves a Discord application id, falling back to `DISCORD_APPLICATION_ID`. */
-export async function resolveDiscordApplicationId(applicationId) {
-    const source = applicationId ?? process.env.DISCORD_APPLICATION_ID;
-    if (!source)
-        throw new Error("DISCORD_APPLICATION_ID is required.");
-    return typeof source === "function" ? await source() : source;
-}
-/** Resolves a Discord bot token, falling back to `DISCORD_BOT_TOKEN`. */
-export async function resolveDiscordBotToken(botToken) {
-    const source = botToken ?? process.env.DISCORD_BOT_TOKEN;
-    if (!source)
-        throw new Error("DISCORD_BOT_TOKEN is required.");
-    return typeof source === "function" ? await source() : source;
-}
-/** Resolves a Discord public key, falling back to `DISCORD_PUBLIC_KEY`. */
-export { resolveDiscordPublicKey };
-/**
- * Low-level Discord JSON API call. Bot-token auth is included only when
- * a token is supplied; interaction webhook endpoints intentionally run
- * without bot auth.
- */
-export async function callDiscordApi(input) {
-    const apiFetch = input.fetch ?? fetch;
-    const headers = new Headers();
-    headers.set("content-type", "application/json; charset=utf-8");
-    if (input.botToken !== undefined) {
-        const token = await resolveDiscordBotToken(input.botToken);
-        headers.set("authorization", `Bot ${token}`);
-    }
-    const init = {
-        headers,
-        method: input.method ?? "POST",
-    };
-    if (input.body !== undefined) {
-        init.body = JSON.stringify(parseJsonObject(input.body));
-    }
-    const response = await apiFetch(`${input.apiBaseUrl ?? "https://discord.com/api/v10"}${input.path}`, init);
-    return {
-        body: await parseResponseBody(response),
-        ok: response.ok,
-        status: response.status,
-    };
-}
-/** Sends a bot-authenticated message to one Discord channel. */
-export async function sendDiscordChannelMessage(input) {
-    const response = await callDiscordApi({
-        apiBaseUrl: input.apiBaseUrl,
-        body: normalizeMessageBody(input.body),
-        botToken: input.credentials?.botToken,
-        fetch: input.fetch,
-        path: `/channels/${encodeURIComponent(input.channelId)}/messages`,
-    });
-    if (!response.ok) {
-        throw new Error(`Discord create message failed with HTTP ${response.status}.`);
-    }
-    return toPostedMessage(response.body);
-}
-/** Triggers Discord's short-lived channel typing indicator with bot auth. */
-export async function triggerDiscordTypingIndicator(input) {
-    const response = await callDiscordApi({
-        apiBaseUrl: input.apiBaseUrl,
-        botToken: input.credentials?.botToken,
-        fetch: input.fetch,
-        path: `/channels/${encodeURIComponent(input.channelId)}/typing`,
-    });
-    if (!response.ok) {
-        throw new Error(`Discord typing indicator failed with HTTP ${response.status}.`);
-    }
-}
-/** Edits the original response for a deferred Discord interaction. */
-export async function editDiscordOriginalResponse(input) {
-    const applicationId = await resolveDiscordApplicationId(input.credentials?.applicationId);
-    const response = await callDiscordApi({
-        apiBaseUrl: input.apiBaseUrl,
-        body: normalizeMessageBody(input.body),
-        fetch: input.fetch,
-        method: "PATCH",
-        path: `/webhooks/${encodeURIComponent(applicationId)}/${encodeURIComponent(input.interactionToken)}/messages/@original`,
-    });
-    if (!response.ok) {
-        throw new Error(`Discord edit original response failed with HTTP ${response.status}.`);
-    }
-    return toPostedMessage(response.body);
-}
-/** Creates a Discord interaction followup message. */
-export async function createDiscordFollowupMessage(input) {
-    const applicationId = await resolveDiscordApplicationId(input.credentials?.applicationId);
-    const response = await callDiscordApi({
-        apiBaseUrl: input.apiBaseUrl,
-        body: normalizeMessageBody(input.body),
-        fetch: input.fetch,
-        path: `/webhooks/${encodeURIComponent(applicationId)}/${encodeURIComponent(input.interactionToken)}`,
-    });
-    if (!response.ok) {
-        throw new Error(`Discord followup message failed with HTTP ${response.status}.`);
-    }
-    return toPostedMessage(response.body);
-}
-/**
- * Splits text into chunks Discord will accept as individual message
- * contents. Empty strings produce one empty chunk so callers can still
- * decide how to handle a no-content message.
- */
-export function splitDiscordMessageContent(content) {
-    if (content.length <= DISCORD_MESSAGE_CONTENT_MAX_LENGTH)
-        return [content];
-    const chunks = [];
-    let rest = content;
-    while (rest.length > DISCORD_MESSAGE_CONTENT_MAX_LENGTH) {
-        let cut = rest.lastIndexOf("\n", DISCORD_MESSAGE_CONTENT_MAX_LENGTH);
-        if (cut <= 0) {
-            cut = rest.lastIndexOf(" ", DISCORD_MESSAGE_CONTENT_MAX_LENGTH);
-        }
-        if (cut <= 0)
-            cut = DISCORD_MESSAGE_CONTENT_MAX_LENGTH;
-        chunks.push(rest.slice(0, cut).trimEnd());
-        rest = rest.slice(cut).trimStart();
-    }
-    chunks.push(rest);
-    return chunks;
-}
-function normalizeMessageBody(body) {
-    const normalized = { ...body };
-    if (normalized.allowed_mentions === undefined) {
-        normalized.allowed_mentions = DISCORD_NO_MENTIONS;
-    }
-    return parseJsonObject(normalized);
-}
-function toPostedMessage(body) {
-    const raw = parseMaybeObject(body);
-    return {
-        channelId: typeof raw.channel_id === "string" ? raw.channel_id : undefined,
-        id: typeof raw.id === "string" ? raw.id : "",
-        raw: body,
-    };
-}
-function parseMaybeObject(value) {
-    return isObject(value) ? value : {};
-}
-async function parseResponseBody(response) {
-    const text = await response.text();
-    if (!text)
-        return null;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return text;
-    }
-}
+import{isObject}from"#shared/guards.js";import{parseJsonObject}from"#shared/json.js";import{resolveDiscordPublicKey}from"#public/channels/discord/verify.js";var DISCORD_NO_MENTIONS={parse:[]},DISCORD_MESSAGE_CONTENT_MAX_LENGTH=2e3;function discordContinuationToken(e,t){return`${e}:${t??``}`}async function resolveDiscordApplicationId(e){let t=e??process.env.DISCORD_APPLICATION_ID;if(!t)throw Error(`DISCORD_APPLICATION_ID is required.`);return typeof t==`function`?await t():t}async function resolveDiscordBotToken(e){let t=e??process.env.DISCORD_BOT_TOKEN;if(!t)throw Error(`DISCORD_BOT_TOKEN is required.`);return typeof t==`function`?await t():t}async function callDiscordApi(e){let n=e.fetch??fetch,r=new Headers;if(r.set(`content-type`,`application/json; charset=utf-8`),e.botToken!==void 0){let t=await resolveDiscordBotToken(e.botToken);r.set(`authorization`,`Bot ${t}`)}let i={headers:r,method:e.method??`POST`};e.body!==void 0&&(i.body=JSON.stringify(parseJsonObject(e.body)));let a=await n(`${e.apiBaseUrl??`https://discord.com/api/v10`}${e.path}`,i);return{body:await parseResponseBody(a),ok:a.ok,status:a.status}}async function sendDiscordChannelMessage(e){let t=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,body:normalizeMessageBody(e.body),botToken:e.credentials?.botToken,fetch:e.fetch,path:`/channels/${encodeURIComponent(e.channelId)}/messages`});if(!t.ok)throw Error(`Discord create message failed with HTTP ${t.status}.`);return toPostedMessage(t.body)}async function triggerDiscordTypingIndicator(e){let t=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,botToken:e.credentials?.botToken,fetch:e.fetch,path:`/channels/${encodeURIComponent(e.channelId)}/typing`});if(!t.ok)throw Error(`Discord typing indicator failed with HTTP ${t.status}.`)}async function editDiscordOriginalResponse(e){let t=await resolveDiscordApplicationId(e.credentials?.applicationId),n=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,body:normalizeMessageBody(e.body),fetch:e.fetch,method:`PATCH`,path:`/webhooks/${encodeURIComponent(t)}/${encodeURIComponent(e.interactionToken)}/messages/@original`});if(!n.ok)throw Error(`Discord edit original response failed with HTTP ${n.status}.`);return toPostedMessage(n.body)}async function createDiscordFollowupMessage(e){let t=await resolveDiscordApplicationId(e.credentials?.applicationId),n=await callDiscordApi({apiBaseUrl:e.apiBaseUrl,body:normalizeMessageBody(e.body),fetch:e.fetch,path:`/webhooks/${encodeURIComponent(t)}/${encodeURIComponent(e.interactionToken)}`});if(!n.ok)throw Error(`Discord followup message failed with HTTP ${n.status}.`);return toPostedMessage(n.body)}function splitDiscordMessageContent(e){if(e.length<=2e3)return[e];let t=[],n=e;for(;n.length>DISCORD_MESSAGE_CONTENT_MAX_LENGTH;){let e=n.lastIndexOf(`
+`,DISCORD_MESSAGE_CONTENT_MAX_LENGTH);e<=0&&(e=n.lastIndexOf(` `,DISCORD_MESSAGE_CONTENT_MAX_LENGTH)),e<=0&&(e=DISCORD_MESSAGE_CONTENT_MAX_LENGTH),t.push(n.slice(0,e).trimEnd()),n=n.slice(e).trimStart()}return t.push(n),t}function normalizeMessageBody(e){let n={...e};return n.allowed_mentions===void 0&&(n.allowed_mentions=DISCORD_NO_MENTIONS),parseJsonObject(n)}function toPostedMessage(e){let t=parseMaybeObject(e);return{channelId:typeof t.channel_id==`string`?t.channel_id:void 0,id:typeof t.id==`string`?t.id:``,raw:e}}function parseMaybeObject(t){return isObject(t)?t:{}}async function parseResponseBody(e){let t=await e.text();if(!t)return null;try{return JSON.parse(t)}catch{return t}}export{DISCORD_MESSAGE_CONTENT_MAX_LENGTH,DISCORD_NO_MENTIONS,callDiscordApi,createDiscordFollowupMessage,discordContinuationToken,editDiscordOriginalResponse,resolveDiscordApplicationId,resolveDiscordBotToken,resolveDiscordPublicKey,sendDiscordChannelMessage,splitDiscordMessageContent,triggerDiscordTypingIndicator};

package/dist/src/public/channels/discord/defaults.js

@@ -1,74 +1,3 @@
-import { extractErrorId, formatErrorHint } from "#internal/logging.js";
-import { splitDiscordMessageContent } from "#public/channels/discord/api.js";
-import { renderInputRequestComponents } from "#public/channels/discord/hitl.js";
-/** Default auth projection for Discord interaction actors. */
-export function defaultDiscordAuth(interaction) {
-    const attributes = {
-        channel_id: interaction.channelId,
-        interaction_id: interaction.id,
-        user_id: interaction.user.id,
-        username: interaction.user.username,
-    };
-    if (interaction.guildId !== undefined)
-        attributes.guild_id = interaction.guildId;
-    if (interaction.member?.nick !== undefined)
-        attributes.member_nick = interaction.member.nick;
-    const issuer = interaction.guildId ? `discord:${interaction.guildId}` : "discord";
-    const principalId = interaction.guildId
-        ? `discord:${interaction.guildId}:${interaction.user.id}`
-        : `discord:${interaction.user.id}`;
-    return {
-        attributes,
-        authenticator: "discord-interaction",
-        issuer,
-        principalId,
-        principalType: interaction.user.isBot ? "service" : "user",
-    };
-}
-/** Default command hook: dispatch with Discord user auth. */
-export function defaultOnCommand(_ctx, interaction) {
-    return { auth: defaultDiscordAuth(interaction) };
-}
-/** Built-in Discord event handlers for typing, replies, HITL, and terminal errors. */
-export const defaultEvents = {
-    async "turn.started"(_event, ctx) {
-        await ctx.discord.startTyping();
-    },
-    async "actions.requested"(_event, ctx) {
-        await ctx.discord.startTyping();
-    },
-    async "input.requested"(event, ctx) {
-        for (const request of event.requests) {
-            const content = splitDiscordMessageContent(request.prompt)[0] ?? request.prompt;
-            await ctx.discord.post({
-                components: renderInputRequestComponents(request),
-                content,
-            });
-        }
-    },
-    async "message.completed"(event, ctx) {
-        if (event.finishReason === "tool-calls" || !event.message)
-            return;
-        await ctx.discord.post(event.message);
-    },
-    async "session.failed"(event, ctx) {
-        const hint = formatErrorHint(event);
-        const errorId = extractErrorId(event.details);
-        await ctx.discord.post([
-            `This session could not recover from an error${hint}.`,
-            "",
-            "Start a new command to continue.",
-            ...(errorId ? ["", `Error id: ${errorId}`] : []),
-        ].join("\n"));
-    },
-    async "turn.failed"(event, ctx) {
-        const hint = formatErrorHint(event);
-        const errorId = extractErrorId(event.details);
-        await ctx.discord.post([
-            `I hit an error while handling your request${hint}.`,
-            "",
-            "Please try again, rephrase, or reach out if it keeps failing.",
-            ...(errorId ? ["", `Error id: ${errorId}`] : []),
-        ].join("\n"));
-    },
-};
+import{extractErrorId,formatErrorHint}from"#internal/logging.js";import{splitDiscordMessageContent}from"#public/channels/discord/api.js";import{renderInputRequestComponents}from"#public/channels/discord/hitl.js";function defaultDiscordAuth(e){let t={channel_id:e.channelId,interaction_id:e.id,user_id:e.user.id,username:e.user.username};return e.guildId!==void 0&&(t.guild_id=e.guildId),e.member?.nick!==void 0&&(t.member_nick=e.member.nick),{attributes:t,authenticator:`discord-interaction`,issuer:e.guildId?`discord:${e.guildId}`:`discord`,principalId:e.guildId?`discord:${e.guildId}:${e.user.id}`:`discord:${e.user.id}`,principalType:e.user.isBot?`service`:`user`}}function defaultOnCommand(e,t){return{auth:defaultDiscordAuth(t)}}var defaultEvents={async"turn.started"(e,t){await t.discord.startTyping()},async"actions.requested"(e,t){await t.discord.startTyping()},async"input.requested"(e,t){for(let i of e.requests){let e=splitDiscordMessageContent(i.prompt)[0]??i.prompt;await t.discord.post({components:renderInputRequestComponents(i),content:e})}},async"message.completed"(e,t){e.finishReason===`tool-calls`||!e.message||await t.discord.post(e.message)},async"session.failed"(n,r){let i=formatErrorHint(n),a=extractErrorId(n.details);await r.discord.post([`This session could not recover from an error${i}.`,``,`Start a new command to continue.`,...a?[``,`Error id: ${a}`]:[]].join(`
+`))},async"turn.failed"(n,r){let i=formatErrorHint(n),a=extractErrorId(n.details);await r.discord.post([`I hit an error while handling your request${i}.`,``,`Please try again, rephrase, or reach out if it keeps failing.`,...a?[``,`Error id: ${a}`]:[]].join(`
+`))}};export{defaultDiscordAuth,defaultEvents,defaultOnCommand};