v4.1.0

@altkit/discord v4.1.0

This release improves Discord API v10 compatibility across REST, Gateway, attachments, modal components, invites, and
application payloads. It also introduces consistent TLS configuration and secure transport defaults for REST, Gateway,
voice, and remote-auth connections.

Altkit Discord remains user-account-only and continues to target the Discord.js 14.27.0 API surface where it applies to
this fork.

Highlights

• Added secure TLS 1.2-or-newer defaults across supported network transports.
• Added separate REST, Gateway/voice, destination-proxy, and HTTPS-proxy TLS configuration.
• Updated REST rate-limit handling to use Discord bucket hashes, methods, major resources, and current rate-limit scopes.
• Avoids automatically replaying ambiguous non-idempotent requests.
• Added current voice-channel information, community invite, attachment spoiler, and modal-component support.
• Preserves full flags_new application bitfields as bigint.
• Expanded the migration guide, client configuration, feature guides, API reference, and README.

TLS and transport security

REST, Gateway, voice, and remote-auth connections now use a minimum of TLS 1.2 by default while retaining the library's
browser-like cipher ordering and Node.js certificate verification.

Custom destination TLS settings can be configured independently:

const client = new Client({
  http: {
    tls: { ca: process.env.REST_CA_CERT },
  },
  ws: {
    tls: { ca: process.env.GATEWAY_CA_CERT },
  },
});

For REST proxies:

• http.tls configures the connection to Discord and takes precedence over matching requestTls fields.
• http.agent.requestTls configures the proxy-to-Discord destination connection.
• http.agent.proxyTls configures the connection to an HTTPS proxy itself.
• Existing concrete HTTPS proxy agents remain supported.
• Legacy plain-object WebSocket agent options remain compatible, although ws.tls is preferred.

Do not set rejectUnauthorized: false in production. Disabling certificate verification can expose account credentials and
Discord traffic to interception.

REST and rate limits

• Discovers and caches Discord's X-RateLimit-Bucket hashes.
• Separates handlers by HTTP method, normalized route, and major channel, guild, or webhook resource.
• Isolates webhook IDs and tokens for rate limiting while redacting tokens from public route diagnostics.
• Honors global, user, shared, and route-specific rate-limit signals.
• Accepts retry timing from either Retry-After or the JSON retry_after response field.
• Excludes shared-scope 429 responses from the invalid-request warning counter.
• Preserves the original transport error as HTTPError#cause.
• Successful 204 and 205 responses now resolve to undefined.

Automatic retries are now limited to idempotent methods such as GET, HEAD, OPTIONS, PUT, and DELETE. Ambiguous
POST and PATCH transport failures or server errors are returned without replay because Discord may already have applied
the request. Internal callers can explicitly opt in only when an operation is known to be safe to retry.

Discord API and Gateway v10

Voice channel information

• Added Gateway opcode 43 (REQUEST_CHANNEL_INFO).
• Added Guild#requestChannelInfo() for the status and voice_start_time fields.
• Added CHANNEL_INFO and VOICE_CHANNEL_START_TIME_UPDATE handlers.
• Voice channel status and start-time updates refresh the cached channel and emit channelUpdate.
• Added BaseGuildVoiceChannel#voiceStartTimestamp and voiceStartAt.

Community invites

• Invite creation accepts roleIds for roles assigned when an invite is accepted.
• Invite creation accepts targetUsersFile as a CSV file or an array of user resolvables.
• Added GuildInviteManager#fetchTargetUsers().
• Added GuildInviteManager#updateTargetUsers().
• Added GuildInviteManager#fetchTargetUsersJobStatus().
• Added partial invite roles through Invite#roles.
• Target-user CSV arrays use Discord's standardized user_id header.

Messages and attachments

• New uploads and message edits send explicit is_spoiler attachment metadata.
• AttachmentBuilder#setSpoiler() continues to maintain the legacy SPOILER_ filename prefix for compatibility.
• Existing attachments retain their spoiler state when message payloads are rebuilt.
• Forum-thread starter messages include spoiler metadata for uploaded files.

Applications and components

• Added Application#flagsNew as a bigint so application flag bits above bit 30 retain full precision.
• Added current Label, File Upload, Radio Group, Checkbox Group, and Checkbox component values and serialization shapes.
• Added the corresponding component enums, raw data types, runtime exports, and TypeScript declarations.

Images and CDN validation

• Image buffers now produce matching JPEG, PNG, or GIF data-URI MIME types.
• Unknown image signatures throw instead of being incorrectly labeled as JPEG.
• CDN image sizes now accept only documented powers of two from 16 through 4096.

Compatibility and upgrade notes

• Node.js 20.19.0 or newer remains required.
• Discord.js compatibility remains at 14.27.0.
• Bot tokens and bot-owned command, interaction-response, intent, and sharding workflows remain unsupported.
• GuildManager#create() remains only as a deprecated, undocumented user-account compatibility helper.
• Applications that relied on automatic POST or PATCH replay should add their own operation-specific recovery logic.
• Applications that expected an empty ArrayBuffer from 204 or 205 responses should now handle undefined.
• Custom certificate settings should move to http.tls, ws.tls, requestTls, or proxyTls according to their target.
• Previously accepted non-power-of-two CDN sizes such as 56, 96, 300, and 600 must be changed.

Dependencies updated in this release include:

• undici from ^6.27.0 to ^7.28.0.
• globals from ^16.3.0 to ^17.7.0.

Review the included migration guide for detailed examples and TLS precedence rules before deploying the upgrade.

Documentation and testing

• Reworked the README for the current v4 user-account-only and API v10 scope.
• Expanded the Altkit migration guide with API v10, TLS, proxy, retry, attachment, voice, invite, and application changes.
• Added dedicated client configuration, security, voice-channel information, and community invite documentation.
• Made the documentation navigation version derive from package.json.
• Regenerated the API reference with the new structures, methods, properties, and typings.
• Added API v10 and TLS regression suites.
• Passed linting, formatting, documentation parsing, TypeScript and tsd, example checks, 48 unit tests, package smoke
  testing, and the VitePress production build.

Installation

npm install @altkit/discord@4.1.0

Warning

Automating normal Discord user accounts may violate Discord's Terms of Service and can result in account restrictions or
termination. Altkit Discord is unofficial, is not supported by Discord, and is used at your own risk.

Full changelog: v4.0.4...v4.1.0

v4.0.4

@altkit/discord v4.0.4

This release establishes @altkit/discord as a user-account-first Discord.js v14.27-compatible package targeting Discord REST API v10 and Gateway v10.

Highlights

• Updated compatibility target to Discord.js 14.27.0.
• Uses Discord REST API v10 and Gateway v10 by default.
• Added modern Discord.js exports, structures, events, flags, and typings.
• Improved attachment, voice-message, collectible, role-color, poll, and stage-instance support.
• Strengthened REST, Gateway, CAPTCHA, MFA/TOTP, voice, and credential handling.
• Added explicit user-account-only runtime capabilities.

User-account-first behavior

The package now explicitly reports its supported account type:

const { accountType, supportsBotAccounts, discordJsVersion } = require('@altkit/discord');

console.log(accountType); // 'user'
console.log(supportsBotAccounts); // false
console.log(discordJsVersion); // '14.27.0'

The following bot-owned functionality is now inactive:

• Bot and OAuth bearer authentication.
• Raw bot-token Gateway authentication.
• Bot Gateway intents.
• Application command registration and editing.
• Application command permission management.
• Application-owned interaction and autocomplete responses.
• Interaction webhook responses.
• Multi-process and direct shard creation.
• Bot-only Gateway dispatch handlers.
• Bot-capable upstream REST and WebSocket re-exports.

Blocked functionality fails locally with BOT_ACCOUNT_UNSUPPORTED or BOT_ONLY_API_DISABLED before a Discord request is made.

User workflows retained

• Sending and editing messages.
• Invoking slash commands.
• Clicking buttons and using select menus.
• Submitting modals.
• Ordinary webhook workflows.
• Account settings and presence.
• Voice and video functionality.
• CAPTCHA and MFA/TOTP handling.

Discord API v10 improvements

• Corrected Gateway heartbeat jitter behavior.
• Added invalid API-version close-code handling.
• Improved v10 attachment upload and message-edit behavior.
• Existing attachments are retained when adding new files.
• Added voice-message attachment metadata.
• Improved REST request validation and timeout handling.
• Separated HTTP dispatchers between REST managers.
• Improved credential redaction in REST, Gateway, and voice diagnostics.

Discord.js v14.27 compatibility

• Added attachment builder voice metadata.
• Added user and guild-member collectible support.
• Added role member-count collections.
• Added nullable role gradient-color support.
• Added scheduled-event resolution for stage instances.
• Updated public exports and TypeScript declarations.
• Removed incompatible bot transport exports.

Documentation and testing

• Updated the README and migration documentation.
• Regenerated the API reference.
• Added user-only capability and bot-feature rejection regressions.
• Added Discord API v10 and Discord.js v14.27 regression coverage.
• Verified TypeScript declarations with tsc and tsd.
• Passed all 36 unit tests, linting, formatting, documentation verification, example checks, package smoke testing, and package dry-run verification.

Installation

npm install @altkit/discord@4.0.4

Upgrade notes

Bot-account applications should not upgrade to this release. Version 4.0.4 intentionally supports user-account workflows only.

Review the included migration guide before upgrading from v3.

Warning

Automating normal Discord user accounts may violate Discord's Terms of Service and can result in account restrictions or termination. Use this package at your own risk.

Full changelog: v4.0.3...v4.0.4

v4.0.3

Full Changelog: v4.0.1...v4.0.3

v4.0.2

Full Changelog: v4.0.1...v4.0.2

v4.0.1

Full Changelog: https://github.com/AltKit/discord/commits/v4.0.1