v4.1.0

@altkit/discord v4.1.0

This release improves Discord API v10 compatibility across REST, Gateway, attachments, modal components, invites, and
application payloads. It also introduces consistent TLS configuration and secure transport defaults for REST, Gateway,
voice, and remote-auth connections.

Altkit Discord remains user-account-only and continues to target the Discord.js 14.27.0 API surface where it applies to
this fork.

Highlights

• Added secure TLS 1.2-or-newer defaults across supported network transports.
• Added separate REST, Gateway/voice, destination-proxy, and HTTPS-proxy TLS configuration.
• Updated REST rate-limit handling to use Discord bucket hashes, methods, major resources, and current rate-limit scopes.
• Avoids automatically replaying ambiguous non-idempotent requests.
• Added current voice-channel information, community invite, attachment spoiler, and modal-component support.
• Preserves full flags_new application bitfields as bigint.
• Expanded the migration guide, client configuration, feature guides, API reference, and README.

TLS and transport security

REST, Gateway, voice, and remote-auth connections now use a minimum of TLS 1.2 by default while retaining the library's
browser-like cipher ordering and Node.js certificate verification.

Custom destination TLS settings can be configured independently:

const client = new Client({
  http: {
    tls: { ca: process.env.REST_CA_CERT },
  },
  ws: {
    tls: { ca: process.env.GATEWAY_CA_CERT },
  },
});

For REST proxies:

• http.tls configures the connection to Discord and takes precedence over matching requestTls fields.
• http.agent.requestTls configures the proxy-to-Discord destination connection.
• http.agent.proxyTls configures the connection to an HTTPS proxy itself.
• Existing concrete HTTPS proxy agents remain supported.
• Legacy plain-object WebSocket agent options remain compatible, although ws.tls is preferred.

Do not set rejectUnauthorized: false in production. Disabling certificate verification can expose account credentials and
Discord traffic to interception.

REST and rate limits

• Discovers and caches Discord's X-RateLimit-Bucket hashes.
• Separates handlers by HTTP method, normalized route, and major channel, guild, or webhook resource.
• Isolates webhook IDs and tokens for rate limiting while redacting tokens from public route diagnostics.
• Honors global, user, shared, and route-specific rate-limit signals.
• Accepts retry timing from either Retry-After or the JSON retry_after response field.
• Excludes shared-scope 429 responses from the invalid-request warning counter.
• Preserves the original transport error as HTTPError#cause.
• Successful 204 and 205 responses now resolve to undefined.

Automatic retries are now limited to idempotent methods such as GET, HEAD, OPTIONS, PUT, and DELETE. Ambiguous
POST and PATCH transport failures or server errors are returned without replay because Discord may already have applied
the request. Internal callers can explicitly opt in only when an operation is known to be safe to retry.

Discord API and Gateway v10

Voice channel information

• Added Gateway opcode 43 (REQUEST_CHANNEL_INFO).
• Added Guild#requestChannelInfo() for the status and voice_start_time fields.
• Added CHANNEL_INFO and VOICE_CHANNEL_START_TIME_UPDATE handlers.
• Voice channel status and start-time updates refresh the cached channel and emit channelUpdate.
• Added BaseGuildVoiceChannel#voiceStartTimestamp and voiceStartAt.

Community invites

• Invite creation accepts roleIds for roles assigned when an invite is accepted.
• Invite creation accepts targetUsersFile as a CSV file or an array of user resolvables.
• Added GuildInviteManager#fetchTargetUsers().
• Added GuildInviteManager#updateTargetUsers().
• Added GuildInviteManager#fetchTargetUsersJobStatus().
• Added partial invite roles through Invite#roles.
• Target-user CSV arrays use Discord's standardized user_id header.

Messages and attachments

• New uploads and message edits send explicit is_spoiler attachment metadata.
• AttachmentBuilder#setSpoiler() continues to maintain the legacy SPOILER_ filename prefix for compatibility.
• Existing attachments retain their spoiler state when message payloads are rebuilt.
• Forum-thread starter messages include spoiler metadata for uploaded files.

Applications and components

• Added Application#flagsNew as a bigint so application flag bits above bit 30 retain full precision.
• Added current Label, File Upload, Radio Group, Checkbox Group, and Checkbox component values and serialization shapes.
• Added the corresponding component enums, raw data types, runtime exports, and TypeScript declarations.

Images and CDN validation

• Image buffers now produce matching JPEG, PNG, or GIF data-URI MIME types.
• Unknown image signatures throw instead of being incorrectly labeled as JPEG.
• CDN image sizes now accept only documented powers of two from 16 through 4096.

Compatibility and upgrade notes

• Node.js 20.19.0 or newer remains required.
• Discord.js compatibility remains at 14.27.0.
• Bot tokens and bot-owned command, interaction-response, intent, and sharding workflows remain unsupported.
• GuildManager#create() remains only as a deprecated, undocumented user-account compatibility helper.
• Applications that relied on automatic POST or PATCH replay should add their own operation-specific recovery logic.
• Applications that expected an empty ArrayBuffer from 204 or 205 responses should now handle undefined.
• Custom certificate settings should move to http.tls, ws.tls, requestTls, or proxyTls according to their target.
• Previously accepted non-power-of-two CDN sizes such as 56, 96, 300, and 600 must be changed.

Dependencies updated in this release include:

• undici from ^6.27.0 to ^7.28.0.
• globals from ^16.3.0 to ^17.7.0.

Review the included migration guide for detailed examples and TLS precedence rules before deploying the upgrade.

Documentation and testing

• Reworked the README for the current v4 user-account-only and API v10 scope.
• Expanded the Altkit migration guide with API v10, TLS, proxy, retry, attachment, voice, invite, and application changes.
• Added dedicated client configuration, security, voice-channel information, and community invite documentation.
• Made the documentation navigation version derive from package.json.
• Regenerated the API reference with the new structures, methods, properties, and typings.
• Added API v10 and TLS regression suites.
• Passed linting, formatting, documentation parsing, TypeScript and tsd, example checks, 48 unit tests, package smoke
  testing, and the VitePress production build.

Installation

npm install @altkit/discord@4.1.0

Warning

Automating normal Discord user accounts may violate Discord's Terms of Service and can result in account restrictions or
termination. Altkit Discord is unofficial, is not supported by Discord, and is used at your own risk.

Full changelog: v4.0.4...v4.1.0