Deploying a bot

*.cloak-keystore.json

import { Client, type CloakClientError } from '@cloak-software/bot-sdk';

const client = new Client({
  token: process.env.CLOAK_TOKEN!,
  // A mounted volume, not the container filesystem.
  keystorePath: process.env.KEYSTORE_PATH ?? '/data/bot.cloak-keystore.json',
  requiredPermissions: ['message_send'],
  debug: process.env.CLOAK_DEBUG === '1',
});

// The single funnel for failures the SDK catches and keeps going from.
// With no listener these stay silent by design.
client.on('error', (e: CloakClientError) => {
  console.error('[cloak] error', e.source, e.context ?? '', e.message);
});

// send() is fire-and-forget: a server-side denial arrives here, not as a
// rejected promise.
client.on('sendRejected', (r) => {
  console.error('[cloak] send rejected', r.code, r.message, r.permission ?? '');
});

client.on('disconnect', (e) => console.warn('[cloak] disconnected', e));
client.on('reconnecting', ({ attempt, delayMs }) =>
  console.warn(`[cloak] reconnecting (attempt ${attempt}) in ${delayMs}ms`),
);
client.on('reconnected', () => console.log('[cloak] reconnected'));
client.on('ready', () => console.log(`[cloak] ready as ${client.user?.id}`));

client.on('messageCreate', (msg) => {
  if (msg.authorId === client.user?.id) return;
  // serverId is null in a DM, so guard before anything server-scoped.
  if (msg.isDM || !msg.serverId) return;
  if (msg.content.trim() !== '!ping') return;
  if (!client.can('message_send', msg.serverId)) return;
  // channel.send() is a plain message. msg.reply() would fire a
  // mute-piercing "replied to you" notification.
  msg.channel.send('pong').catch((e) => console.error('[cloak] send failed', e));
});

// destroy() closes the transport and flushes queued keystore writes.
for (const signal of ['SIGINT', 'SIGTERM'] as const) {
  process.once(signal, () => {
    client.destroy().finally(() => process.exit(0));
  });
}

client.login().catch((e: unknown) => {
  console.error('[cloak] login failed', e);
  process.exit(1);
});

[Unit]
Description=Cloak bot
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=cloakbot
WorkingDirectory=/srv/cloak-bot
Environment=KEYSTORE_PATH=/var/lib/cloak-bot/bot.cloak-keystore.json
EnvironmentFile=/etc/cloak-bot.env
ExecStart=/usr/bin/node bot.js
Restart=always
RestartSec=5
KillSignal=SIGTERM
TimeoutStopSec=15
StateDirectory=cloak-bot

[Install]
WantedBy=multi-user.target