The Zephyr host API

Top-level helpers available directly on the global `zephyr` table.

Metadata and file loaders for the current module. Also exposes the value fields `id`, `name`, `version`, and `settings` (manifest settings merged with `.runtime-config.json` overrides; all values are strings).

Query the set of modules installed alongside this one in the current runtime.

Register slash command and autocomplete handlers at module load time.

Look up translations from the module and framework catalogs, honoring the configured preferred and fallback languages.

Send JSON-like messages between installed modules. Bus operations are not permission-gated.

Time and duration helpers.

Schedule deferred messages back to the current module. Timers are in-memory and do not survive process restarts. Requires the `timers` permission.

Encoding and JSON helpers. No permissions required.

Per-module structured storage. Tables are declared in the module's schema file, and every function operates only on the calling module's own data. All functions require the `storage` permission.

Discord actions. Ids are passed as strings, and Discord API failures surface as Lua runtime errors. Message, embed, button, modal, channel, and permission specs reject unknown fields.

Sandboxed file storage. Paths are virtual, rooted at the module's persistent data directory (`ZEPHYR_DATA_DIR/modules/<module_id>`); absolute-looking paths are still scoped there and parent traversal is rejected. Reads and writes use raw Lua-string bytes. All functions require the `io` permission.

Outbound network access. `tcp_connect` requires `net:tcp`; `http` requires `net:http`; `download` requires both `net:http` and `io`.

In-process voice playback. Plays files from the module's `zephyr.io` sandbox. Requires the `songbird` permission; declare `services = ["songbird"]` for production. Only one backend (Songbird or Lavalink) may own a guild voice session at a time.

Playback through a shared Lavalink v4 node. Requires the `lavalink` permission; declare `services = ["lavalink"]` for production. Track and player return values are the Lavalink v4 JSON shapes (camelCase fields like `loadType`, `encoded`, `info`, `state`).

Resolve YouTube metadata (no media download). Requires the `external:youtube` permission.

Restricted process execution for trusted system modules. Functions require `process:exec` and are additionally gated by a hardcoded system-module allowlist in the host runtime.

Render image assets inside the host for Discord attachments.