lunibee 0.2.3 → 0.2.4

package/dist/managers/message.d.ts

@@ -7,7 +7,8 @@ export interface MessageCacheOptions {
     /** Sliding TTL in ms. Omit for no expiry. */
     ttl?: number;
 }
-import { REST } from "@lunibee/rest";
+import { REST, type RESTFileAttachment } from "@lunibee/rest";
+import type { AllowedMentions } from "@lunibee/types";
 import { Message, type ResourceContext } from "@lunibee/structures";
 /** A file to upload with a message. */
 export interface MessageFile {
@@ -26,12 +27,15 @@ export type MessageEditOptions = MessageCreateOptions;
  * data as UTF-8. `allowedMentions` is the client's default, applied only when
  * the payload has no `allowed_mentions` of its own.
  */
-export declare function toRequest(options: MessageCreateOptions, allowedMentions?: unknown): unknown;
+export declare function toRequest(options: MessageCreateOptions, allowedMentions?: AllowedMentions): Omit<MessageCreateOptions, "files"> | {
+    body: Omit<MessageCreateOptions, "files">;
+    files: RESTFileAttachment[];
+};
 export declare class MessageManager {
     #private;
     /** Cached messages; always empty unless a message cache is configured. */
     readonly cache: Collection<string, Message>;
-    constructor(rest: REST, context: ResourceContext, channelId: string, cache?: MessageCacheOptions, allowedMentions?: unknown);
+    constructor(rest: REST, context: ResourceContext, channelId: string, cache?: MessageCacheOptions, allowedMentions?: AllowedMentions);
     resolve(messageId: string): Promise<Message>;
     send(options: MessageCreateOptions): Promise<Message>;
     fetch(messageId: string): Promise<Message>;

package/dist/rest/errors.d.ts

@@ -28,13 +28,20 @@ export type RESTErrorKind =
 export declare function redactPath(path: string): string;
 /** Error thrown when Discord rejects a REST request. */
 export declare class RESTError extends Error {
-    /** Failure category. */ readonly kind: RESTErrorKind;
-    /** HTTP status returned by Discord. */ readonly status: number;
-    /** Discord API error code, when provided. */ readonly code?: number;
-    /** Raw Discord validation/error payload. */ readonly errors?: unknown;
-    /** HTTP method used for the failed request. */ readonly method?: string;
-    /** API path used for the failed request. */ readonly path?: string;
-    /** What to check next, for errors with a common cause (missing access or permissions). */ readonly hint?: string;
+    /** Failure category. */
+    readonly kind: RESTErrorKind;
+    /** HTTP status returned by Discord. */
+    readonly status: number;
+    /** Discord API error code, when provided. */
+    readonly code?: number;
+    /** Raw Discord validation/error payload. */
+    readonly errors?: unknown;
+    /** HTTP method used for the failed request. */
+    readonly method?: string;
+    /** API path used for the failed request. */
+    readonly path?: string;
+    /** What to check next, for errors with a common cause (missing access or permissions). */
+    readonly hint?: string;
     /** Creates a REST error with request context. @param message Error message. @param status HTTP status. @param code Discord error code. @param errors Raw error payload. @param options Request context and cause. */
     constructor(message: string, status: number, code?: number, errors?: unknown, options?: {
         method?: string;

package/dist/rest/index.d.ts

@@ -16,11 +16,16 @@ export interface RESTFileAttachment {
  * `reason`, `auth`) additively without changing that positional default.
  */
 export interface RESTRequestOptions {
-    /** Abort signal used to cancel the request and any queued wait. */ signal?: AbortSignal;
-    /** Query-string appended to the path (`URLSearchParams`, a record, or a raw string). */ query?: RESTQuery;
-    /** Extra request headers merged in (library headers such as `Authorization` win). */ headers?: Record<string, string>;
-    /** Audit-log reason, sent as the `X-Audit-Log-Reason` header. */ reason?: string;
-    /** Set `false` to omit the `Authorization` header for this request. Defaults to `true`. */ auth?: boolean;
+    /** Abort signal used to cancel the request and any queued wait. */
+    signal?: AbortSignal;
+    /** Query-string appended to the path (`URLSearchParams`, a record, or a raw string). */
+    query?: RESTQuery;
+    /** Extra request headers merged in (library headers such as `Authorization` win). */
+    headers?: Record<string, string>;
+    /** Audit-log reason, sent as the `X-Audit-Log-Reason` header. */
+    reason?: string;
+    /** Set `false` to omit the `Authorization` header for this request. Defaults to `true`. */
+    auth?: boolean;
 }
 /**
  * Discord.js-familiar request payload. Superset of {@link RESTRequestOptions} that also
@@ -28,8 +33,10 @@ export interface RESTRequestOptions {
  * additive `method(path, { body })` overloads without breaking the positional signature.
  */
 export interface RequestData extends RESTRequestOptions {
-    /** Request body. Encoded as JSON unless `files` are present (then multipart). */ body?: unknown;
-    /** File attachments; presence upgrades the request to `multipart/form-data`. */ files?: RESTFileAttachment[];
+    /** Request body. Encoded as JSON unless `files` are present (then multipart). */
+    body?: unknown;
+    /** File attachments; presence upgrades the request to `multipart/form-data`. */
+    files?: RESTFileAttachment[];
 }
 /** Context passed to `RESTHooks.onRequest`. */
 export interface RESTRequestContext {
@@ -81,9 +88,12 @@ export interface RESTHooks {
 }
 /** Configures which REST failures may be retried. */
 export interface RetryPolicy {
-    /** Maximum retry attempts. */ maxRetries: number;
-    /** Determines whether a request may be retried. @param method HTTP method. @param status HTTP status, or zero for transport errors. @returns True when retrying is safe under the policy. */ shouldRetry(method: string, status: number): boolean;
-    /** Calculates delay before the next attempt. @param attempt Zero-based retry number. @param retryAfter Server-provided delay, when available. @returns Delay in milliseconds. */ getDelay(attempt: number, retryAfter?: number): number;
+    /** Maximum retry attempts. */
+    maxRetries: number;
+    /** Determines whether a request may be retried. @param method HTTP method. @param status HTTP status, or zero for transport errors. @returns True when retrying is safe under the policy. */
+    shouldRetry(method: string, status: number): boolean;
+    /** Calculates delay before the next attempt. @param attempt Zero-based retry number. @param retryAfter Server-provided delay, when available. @returns Delay in milliseconds. */
+    getDelay(attempt: number, retryAfter?: number): number;
 }
 /** Creates the default conservative REST retry policy. @param maxRetries Maximum retries. @returns Retry policy that retries rate limits and idempotent transient failures. @throws {TypeError} If maxRetries is negative or not finite. */
 export declare function createRetryPolicy(maxRetries?: number): RetryPolicy;
@@ -126,7 +136,8 @@ export declare class REST {
      * @throws {RESTError} If Discord or transport rejects the request.
      */
     request<T>(method: string, path: string, body?: unknown, options?: RequestData): Promise<T>;
-    /** Sends a GET request. @param path API path. @param options Request options (`query`, `headers`, `signal`, …). @returns Decoded response. @throws {RESTError} When the request fails. */ get<T>(path: string, options?: RequestData): Promise<T>;
+    /** Sends a GET request. @param path API path. @param options Request options (`query`, `headers`, `signal`, …). @returns Decoded response. @throws {RESTError} When the request fails. */
+    get<T>(path: string, options?: RequestData): Promise<T>;
     /** Sends a POST request. Accepts a raw body (`post(path, body)`) or a Discord.js-familiar `post(path, { body })`. @param path API path. @param body Optional JSON body, or a `RequestData` wrapper. @param options Request options. @returns Decoded response. @throws {RESTError} When the request fails. */
     post<T>(path: string, options: RequestData): Promise<T>;
     post<T>(path: string, body?: unknown, options?: RequestData): Promise<T>;
@@ -136,7 +147,8 @@ export declare class REST {
     /** Sends a PUT request. Accepts a raw body (`put(path, body)`) or a Discord.js-familiar `put(path, { body })`. @param path API path. @param body Optional JSON body, or a `RequestData` wrapper. @param options Request options. @returns Decoded response. @throws {RESTError} When the request fails. */
     put<T>(path: string, options: RequestData): Promise<T>;
     put<T>(path: string, body?: unknown, options?: RequestData): Promise<T>;
-    /** Sends a DELETE request. @param path API path. @param options Request options (`reason`, `headers`, `signal`, …). @returns Decoded response. @throws {RESTError} When the request fails. */ delete<T>(path: string, options?: RequestData): Promise<T>;
+    /** Sends a DELETE request. @param path API path. @param options Request options (`reason`, `headers`, `signal`, …). @returns Decoded response. @throws {RESTError} When the request fails. */
+    delete<T>(path: string, options?: RequestData): Promise<T>;
     /**
      * Sends a multipart/form-data POST request for file uploads.
      * Attaches a JSON payload as `payload_json` and files as additional fields.

package/dist/rest/index.js

@@ -2,7 +2,7 @@
 // packages/rest/package.json
 var package_default = {
   name: "@lunibee/rest",
-  version: "0.2.3",
+  version: "0.2.4",
   type: "module",
   module: "./src/index.ts",
   types: "./src/index.ts",
@@ -83,7 +83,7 @@ function kindFromStatus(status) {
   return "client";
 }
 function redactPath(path) {
-  return path.replace(/^(\/webhooks\/[^/?]+\/)[^/?]+/, "$1:token").replace(/^(\/interactions\/[^/?]+\/)[^/?]+/, "$1:token");
+  return path.replace(/^(\/webhooks\/[^/?]+\/)[^/?]+/i, "$1:token").replace(/^(\/interactions\/[^/?]+\/)[^/?]+/i, "$1:token");
 }
 var HINTS = {
   50001: "The bot cannot see this resource: check that it is in the guild and has View Channel there.",
@@ -142,19 +142,23 @@ async function abortable(promise, signal, path) {
 }
 
 // packages/rest/src/route.ts
+import { createHash } from "crypto";
 function normalizeRoutePath(path) {
   const queryIndex = path.indexOf("?");
   const routePath = queryIndex === -1 ? path : path.slice(0, queryIndex);
-  return routePath.replace(/\/\d+(?=\/|$)/g, "/:id");
+  return redactPath(routePath).replace(/\/\d+(?=\/|$)/g, "/:id");
 }
 function majorParameter(path) {
-  const match = /^\/(channels|guilds|webhooks)\/(\d+)(?:\/([^/?]+))?/.exec(path);
+  const match = /^\/(channels|guilds|webhooks)\/(\d+)(?:\/([^/?]+))?/i.exec(path);
   if (!match)
     return "@none";
-  if (match[1] === "webhooks" && match[3] !== undefined)
-    return `${match[2]}:${match[3]}`;
+  if (match[1].toLowerCase() === "webhooks" && match[3] !== undefined)
+    return `${match[2]}:${tokenDigest(match[3])}`;
   return match[2];
 }
+function tokenDigest(token) {
+  return createHash("sha256").update(token).digest("hex").slice(0, 16);
+}
 function scopeBucket(hashOrRoute, major) {
   return `${hashOrRoute}|${major}`;
 }
@@ -396,6 +400,9 @@ var Routes = {
   user: () => "/users/@me",
   userById: (userId) => `/users/${snowflake(userId, "User ID")}`,
   guild: (guildId) => `/guilds/${snowflake(guildId, "Guild ID")}`,
+  currentUserGuild: (guildId) => `/users/@me/guilds/${snowflake(guildId, "Guild ID")}`,
+  sticker: (stickerId) => `/stickers/${snowflake(stickerId, "Sticker ID")}`,
+  messageReactionUser: (channelId, messageId, emoji, userId) => `${Routes.messageReactions(channelId, messageId, emoji)}/${snowflake(userId, "User ID")}`,
   guildPreview: (guildId) => `/guilds/${snowflake(guildId, "Guild ID")}/preview`,
   guildActiveThreads: (guildId) => `/guilds/${snowflake(guildId, "Guild ID")}/threads/active`,
   guildWebhooks: (guildId) => `/guilds/${snowflake(guildId, "Guild ID")}/webhooks`,
@@ -657,7 +664,7 @@ class WebhookClient {
   #rest;
   constructor(options, restOptions) {
     if (options.url) {
-      const match = options.url.match(/discord(?:app)?.com\/api\/webhooks\/(\d+)\/([A-Za-z0-9_-]+)/);
+      const match = options.url.match(/^https:\/\/(?:(?:ptb|canary)\.)?discord(?:app)?\.com\/api(?:\/v\d+)?\/webhooks\/(\d{1,20})\/([A-Za-z0-9_-]+)\/?(?:[?#].*)?$/);
       if (!match)
         throw new Error("Invalid Discord webhook URL format.");
       this.id = match[1];
@@ -672,13 +679,20 @@ class WebhookClient {
   }
   async send(options) {
     const payload = typeof options === "string" ? { content: options } : options;
-    const { thread_id, ...body } = payload;
-    const query = thread_id ? `?thread_id=${thread_id}&wait=true` : `?wait=true`;
+    const { thread_id, files, ...body } = payload;
+    const params = new URLSearchParams({ wait: "true" });
+    if (thread_id)
+      params.set("thread_id", String(thread_id));
+    const query = `?${params}`;
     const formattedEmbeds = body.embeds?.map((e) => ("toJSON" in e) ? e.toJSON() : e);
-    return this.#rest.post(`${Routes.webhook(this.id, this.token)}${query}`, {
+    const formattedComponents = body.components?.map((c) => ("toJSON" in c) ? c.toJSON() : c);
+    const path = `${Routes.webhook(this.id, this.token)}${query}`;
+    const json = {
       ...body,
-      embeds: formattedEmbeds
-    });
+      embeds: formattedEmbeds,
+      components: formattedComponents
+    };
+    return files?.length ? this.#rest.postWithFiles(path, json, files) : this.#rest.post(path, json);
   }
   async editMessage(messageId, options) {
     const payload = typeof options === "string" ? { content: options } : options;
@@ -693,6 +707,22 @@ class WebhookClient {
 var LIBRARY_VERSION = package_default.version;
 var LIBRARY_URL = "https://github.com/Ekretos/lunibee";
 var USER_AGENT = `DiscordBot (${LIBRARY_URL}, ${LIBRARY_VERSION})`;
+function assertSafePath(path) {
+  const end = path.search(/[?#]/);
+  const pathname = end === -1 ? path : path.slice(0, end);
+  if (pathname.includes("\\"))
+    throw new TypeError("REST paths must not contain backslashes.");
+  for (const segment of pathname.split("/")) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      throw new TypeError("REST path has malformed percent-encoding.");
+    }
+    if (decoded === "." || decoded === "..")
+      throw new TypeError("REST paths must not contain '.' or '..' segments.");
+  }
+}
 var REQUEST_DATA_KEYS = new Set([
   "body",
   "files",
@@ -777,6 +807,7 @@ class REST {
       throw new TypeError("REST method is required.");
     if (!path.startsWith("/"))
       throw new TypeError("REST paths must start with '/'.");
+    assertSafePath(path);
     const route = createRouteKey(method, path);
     const files = options.files;
     if (files && files.length > 0 && !(body instanceof FormData))
@@ -864,13 +895,19 @@ class REST {
   #headers(body, options) {
     const isFormData = typeof FormData !== "undefined" && body instanceof FormData;
     const headers = { ...options.headers };
+    const set = (name, value) => {
+      for (const key of Object.keys(headers))
+        if (key.toLowerCase() === name.toLowerCase())
+          delete headers[key];
+      headers[name] = value;
+    };
     if (options.auth !== false && this.#token)
-      headers["Authorization"] = `Bot ${this.#token}`;
-    headers["User-Agent"] = USER_AGENT;
+      set("Authorization", `Bot ${this.#token}`);
+    set("User-Agent", USER_AGENT);
     if (options.reason !== undefined)
-      headers["X-Audit-Log-Reason"] = encodeURIComponent(options.reason);
+      set("X-Audit-Log-Reason", encodeURIComponent(options.reason));
     if (!isFormData)
-      headers["Content-Type"] = "application/json";
+      set("Content-Type", "application/json");
     return headers;
   }
   #encodeBody(body) {
@@ -949,4 +986,4 @@ export {
   serializeQuery
 };
 
-//# debugId=0345D6D5C65D143C64756E2164756E21
+//# debugId=51D994350F46554C64756E2164756E21