@kodelyth/discord 2026.5.39 → 2026.6.1

package/dist/runtime-api.actions.js

@@ -0,0 +1,3 @@
+import { a as readDiscordChannelCreateParams, c as readDiscordParentIdParam, i as requiredGuildPermissionForModerationAction, n as isDiscordModerationAction, o as readDiscordChannelEditParams, r as readDiscordModerationCommand, s as readDiscordChannelMoveParams, t as handleDiscordAction } from "./runtime-DUaw66V_.js";
+import { t as discordMessageActions } from "./channel-actions-BxEBnEuv.js";
+export { discordMessageActions, handleDiscordAction, isDiscordModerationAction, readDiscordChannelCreateParams, readDiscordChannelEditParams, readDiscordChannelMoveParams, readDiscordModerationCommand, readDiscordParentIdParam, requiredGuildPermissionForModerationAction };

package/dist/runtime-api.js

@@ -0,0 +1,30 @@
+import { x as resolveDiscordOutboundSessionRoute } from "./components-luonoe13.js";
+import { n as registerBuiltDiscordComponentMessage, r as sendDiscordComponentMessage, t as editDiscordComponentMessage } from "./send.components-Bcgxvm52.js";
+import { a as clearPresences, c as setPresence, i as unregisterGateway, n as getGateway, o as getPresence, r as registerGateway, s as presenceCacheSize, t as clearGateways } from "./gateway-registry-BKSpa4GB.js";
+import { D as fetchMemberGuildPermissionsDiscord, E as fetchChannelPermissionsDiscord, O as hasAllGuildPermissionsDiscord, k as hasAnyGuildPermissionDiscord, w as DiscordSendError } from "./send.shared-D4iBnAmn.js";
+import { n as listDiscordDirectoryGroupsLive, r as listDiscordDirectoryPeersLive } from "./directory-live-DX4dLRpJ.js";
+import { _ as resolveGroupDmAllow, a as normalizeDiscordSlug, c as resolveDiscordChannelConfigWithFallback, d as resolveDiscordGuildEntry, g as resolveDiscordShouldRequireMention, n as isDiscordGroupAllowedByPolicy, r as normalizeDiscordAllowList, s as resolveDiscordChannelConfig, t as allowListMatches, u as resolveDiscordCommandAuthorized, v as shouldEmitDiscordReactionNotification } from "./allow-list-B0s7evD7.js";
+import { A as removeRoleDiscord, B as removeChannelPermissionDiscord, C as fetchChannelInfoDiscord, D as kickMemberDiscord, E as fetchVoiceStatusDiscord, F as uploadStickerDiscord, I as createChannelDiscord, L as deleteChannelDiscord, M as timeoutMemberDiscord, N as listGuildEmojisDiscord, O as listGuildChannelsDiscord, P as uploadEmojiDiscord, R as editChannelDiscord, S as createScheduledEventDiscord, T as fetchRoleInfoDiscord, V as setChannelPermissionDiscord, _ as readMessagesDiscord, a as removeReactionDiscord, b as addRoleDiscord, c as sendWebhookMessageDiscord, d as deleteMessageDiscord, f as editMessageDiscord, g as pinMessageDiscord, h as listThreadsDiscord, i as removeOwnReactionsDiscord, j as resolveEventCoverImage, k as listScheduledEventsDiscord, m as listPinsDiscord, n as fetchReactionsDiscord, o as sendTypingDiscord, p as fetchMessageDiscord, r as reactMessageDiscord, s as sendVoiceMessageDiscord, u as createThreadDiscord, v as searchMessagesDiscord, w as fetchMemberInfoDiscord, x as banMemberDiscord, y as unpinMessageDiscord, z as moveChannelDiscord } from "./send-DCtPCHGk.js";
+import { n as sendPollDiscord, r as sendStickerDiscord, t as sendMessageDiscord } from "./send.outbound-S9t0UuHc.js";
+import { a as readDiscordChannelCreateParams, c as readDiscordParentIdParam, i as requiredGuildPermissionForModerationAction, n as isDiscordModerationAction, o as readDiscordChannelEditParams, r as readDiscordModerationCommand, s as readDiscordChannelMoveParams, t as handleDiscordAction } from "./runtime-DUaw66V_.js";
+import { r as setDiscordRuntime } from "./runtime-fC6f4UF2.js";
+import { t as discordMessageActions } from "./channel-actions-BxEBnEuv.js";
+import { C as resolveThreadBindingMaxAgeMs, S as resolveThreadBindingMaxAgeExpiresAt, b as resolveThreadBindingIdleTimeoutMs, l as isRecentlyUnboundThreadWebhookMessage, x as resolveThreadBindingInactivityExpiresAt } from "./thread-bindings.state-eTFl-PqJ.js";
+import { n as setThreadBindingMaxAgeBySessionKey, t as setThreadBindingIdleTimeoutBySessionKey } from "./thread-bindings.session-updates-DJZGIwaU.js";
+import { t as resolveDiscordChannelAllowlist } from "./resolve-channels-0LX4pUbB.js";
+import { t as resolveDiscordUserAllowlist } from "./resolve-users-CztOv0Qs.js";
+import { _ as formatThreadBindingDurationLabel, b as resolveThreadBindingThreadName, g as resolveThreadBindingPersonaFromRecord, h as resolveThreadBindingPersona, y as resolveThreadBindingIntroText } from "./thread-bindings.discord-api-ssGH5wc2.js";
+import { a as reconcileAcpThreadBindingsOnStartup, c as resolveDiscordThreadBindingMaxAgeMs, i as listThreadBindingsForAccount, l as resolveThreadBindingsEnabled, n as autoBindSpawnedDiscordSubagent, o as unbindThreadBindingsBySessionKey, r as listThreadBindingsBySessionKey, s as resolveDiscordThreadBindingIdleTimeoutMs } from "./thread-bindings-9aKRmZv0.js";
+import { i as testing, n as createThreadBindingManager, r as getThreadBindingManager, t as createNoopThreadBindingManager } from "./thread-bindings.manager-0YBHGemk.js";
+import { a as resolveDiscordPrivilegedIntentsFromFlags, i as probeDiscord, n as fetchDiscordApplicationSummary, r as parseApplicationIdFromToken, t as fetchDiscordApplicationId } from "./probe-D--Ca4JF.js";
+import { a as mergeAbortSignals, i as DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, n as DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, r as DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, t as DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS } from "./timeouts-CEwuGaWT.js";
+import "./runtime-api.actions.js";
+import { r as collectDiscordAuditChannelIds, t as auditDiscordChannelPermissions } from "./audit-DoiK49WO.js";
+import "./runtime-api.lookup.js";
+import { S as sanitizeDiscordThreadName, _ as registerDiscordListener, b as resolveDiscordReplyTarget, c as resolveDiscordGatewayIntents, d as createDiscordNativeCommand, l as waitForDiscordGatewayPluginRegistration, s as createDiscordGatewayPlugin, t as monitorDiscordProvider } from "./provider-B2-31CIT.js";
+import { i as buildDiscordMediaPayload } from "./message-utils-dUbem16p.js";
+import { t as createDiscordMessageHandler } from "./message-handler-mXzc3tA_.js";
+import "./runtime-api.monitor-CvVKvEXW.js";
+import "./runtime-api.send.js";
+import "./runtime-api.threads.js";
+export { DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS, DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, DiscordSendError, testing as __testing, testing, addRoleDiscord, allowListMatches, auditDiscordChannelPermissions, autoBindSpawnedDiscordSubagent, banMemberDiscord, buildDiscordMediaPayload, clearGateways, clearPresences, collectDiscordAuditChannelIds, createChannelDiscord, createDiscordGatewayPlugin, createDiscordMessageHandler, createDiscordNativeCommand, createNoopThreadBindingManager, createScheduledEventDiscord, createThreadBindingManager, createThreadDiscord, deleteChannelDiscord, deleteMessageDiscord, discordMessageActions, editChannelDiscord, editDiscordComponentMessage, editMessageDiscord, fetchChannelInfoDiscord, fetchChannelPermissionsDiscord, fetchDiscordApplicationId, fetchDiscordApplicationSummary, fetchMemberGuildPermissionsDiscord, fetchMemberInfoDiscord, fetchMessageDiscord, fetchReactionsDiscord, fetchRoleInfoDiscord, fetchVoiceStatusDiscord, formatThreadBindingDurationLabel, getGateway, getPresence, getThreadBindingManager, handleDiscordAction, hasAllGuildPermissionsDiscord, hasAnyGuildPermissionDiscord, isDiscordGroupAllowedByPolicy, isDiscordModerationAction, isRecentlyUnboundThreadWebhookMessage, kickMemberDiscord, listDiscordDirectoryGroupsLive, listDiscordDirectoryPeersLive, listGuildChannelsDiscord, listGuildEmojisDiscord, listPinsDiscord, listScheduledEventsDiscord, listThreadBindingsBySessionKey, listThreadBindingsForAccount, listThreadsDiscord, mergeAbortSignals, monitorDiscordProvider, moveChannelDiscord, normalizeDiscordAllowList, normalizeDiscordSlug, parseApplicationIdFromToken, pinMessageDiscord, presenceCacheSize, probeDiscord, reactMessageDiscord, readDiscordChannelCreateParams, readDiscordChannelEditParams, readDiscordChannelMoveParams, readDiscordModerationCommand, readDiscordParentIdParam, readMessagesDiscord, reconcileAcpThreadBindingsOnStartup, registerBuiltDiscordComponentMessage, registerDiscordListener, registerGateway, removeChannelPermissionDiscord, removeOwnReactionsDiscord, removeReactionDiscord, removeRoleDiscord, requiredGuildPermissionForModerationAction, resolveDiscordChannelAllowlist, resolveDiscordChannelConfig, resolveDiscordChannelConfigWithFallback, resolveDiscordCommandAuthorized, resolveDiscordGatewayIntents, resolveDiscordGuildEntry, resolveDiscordOutboundSessionRoute, resolveDiscordPrivilegedIntentsFromFlags, resolveDiscordReplyTarget, resolveDiscordShouldRequireMention, resolveDiscordThreadBindingIdleTimeoutMs, resolveDiscordThreadBindingMaxAgeMs, resolveDiscordUserAllowlist, resolveEventCoverImage, resolveGroupDmAllow, resolveThreadBindingIdleTimeoutMs, resolveThreadBindingInactivityExpiresAt, resolveThreadBindingIntroText, resolveThreadBindingMaxAgeExpiresAt, resolveThreadBindingMaxAgeMs, resolveThreadBindingPersona, resolveThreadBindingPersonaFromRecord, resolveThreadBindingThreadName, resolveThreadBindingsEnabled, sanitizeDiscordThreadName, searchMessagesDiscord, sendDiscordComponentMessage, sendMessageDiscord, sendPollDiscord, sendStickerDiscord, sendTypingDiscord, sendVoiceMessageDiscord, sendWebhookMessageDiscord, setChannelPermissionDiscord, setDiscordRuntime, setPresence, setThreadBindingIdleTimeoutBySessionKey, setThreadBindingMaxAgeBySessionKey, shouldEmitDiscordReactionNotification, timeoutMemberDiscord, unbindThreadBindingsBySessionKey, unpinMessageDiscord, unregisterGateway, uploadEmojiDiscord, uploadStickerDiscord, waitForDiscordGatewayPluginRegistration };

package/dist/runtime-api.lookup.js

@@ -0,0 +1,7 @@
+import { n as listDiscordDirectoryGroupsLive, r as listDiscordDirectoryPeersLive } from "./directory-live-DX4dLRpJ.js";
+import { r as setDiscordRuntime } from "./runtime-fC6f4UF2.js";
+import { t as resolveDiscordChannelAllowlist } from "./resolve-channels-0LX4pUbB.js";
+import { t as resolveDiscordUserAllowlist } from "./resolve-users-CztOv0Qs.js";
+import { a as resolveDiscordPrivilegedIntentsFromFlags, i as probeDiscord, n as fetchDiscordApplicationSummary, r as parseApplicationIdFromToken, t as fetchDiscordApplicationId } from "./probe-D--Ca4JF.js";
+import { r as collectDiscordAuditChannelIds, t as auditDiscordChannelPermissions } from "./audit-DoiK49WO.js";
+export { auditDiscordChannelPermissions, collectDiscordAuditChannelIds, fetchDiscordApplicationId, fetchDiscordApplicationSummary, listDiscordDirectoryGroupsLive, listDiscordDirectoryPeersLive, parseApplicationIdFromToken, probeDiscord, resolveDiscordChannelAllowlist, resolveDiscordPrivilegedIntentsFromFlags, resolveDiscordUserAllowlist, setDiscordRuntime };

package/dist/runtime-api.monitor-CvVKvEXW.js

@@ -0,0 +1,5 @@
+import "./allow-list-B0s7evD7.js";
+import "./provider-B2-31CIT.js";
+import "./message-utils-dUbem16p.js";
+import "./message-handler-mXzc3tA_.js";
+export {};

package/dist/runtime-api.monitor.js

@@ -0,0 +1,8 @@
+import { a as clearPresences, c as setPresence, i as unregisterGateway, n as getGateway, o as getPresence, r as registerGateway, s as presenceCacheSize, t as clearGateways } from "./gateway-registry-BKSpa4GB.js";
+import { _ as resolveGroupDmAllow, a as normalizeDiscordSlug, c as resolveDiscordChannelConfigWithFallback, d as resolveDiscordGuildEntry, g as resolveDiscordShouldRequireMention, n as isDiscordGroupAllowedByPolicy, r as normalizeDiscordAllowList, s as resolveDiscordChannelConfig, t as allowListMatches, u as resolveDiscordCommandAuthorized, v as shouldEmitDiscordReactionNotification } from "./allow-list-B0s7evD7.js";
+import { a as mergeAbortSignals, i as DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, n as DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, r as DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, t as DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS } from "./timeouts-CEwuGaWT.js";
+import { S as sanitizeDiscordThreadName, _ as registerDiscordListener, b as resolveDiscordReplyTarget, c as resolveDiscordGatewayIntents, d as createDiscordNativeCommand, l as waitForDiscordGatewayPluginRegistration, s as createDiscordGatewayPlugin, t as monitorDiscordProvider } from "./provider-B2-31CIT.js";
+import { i as buildDiscordMediaPayload } from "./message-utils-dUbem16p.js";
+import { t as createDiscordMessageHandler } from "./message-handler-mXzc3tA_.js";
+import "./runtime-api.monitor-CvVKvEXW.js";
+export { DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS, DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, allowListMatches, buildDiscordMediaPayload, clearGateways, clearPresences, createDiscordGatewayPlugin, createDiscordMessageHandler, createDiscordNativeCommand, getGateway, getPresence, isDiscordGroupAllowedByPolicy, mergeAbortSignals, monitorDiscordProvider, normalizeDiscordAllowList, normalizeDiscordSlug, presenceCacheSize, registerDiscordListener, registerGateway, resolveDiscordChannelConfig, resolveDiscordChannelConfigWithFallback, resolveDiscordCommandAuthorized, resolveDiscordGatewayIntents, resolveDiscordGuildEntry, resolveDiscordReplyTarget, resolveDiscordShouldRequireMention, resolveGroupDmAllow, sanitizeDiscordThreadName, setPresence, shouldEmitDiscordReactionNotification, unregisterGateway, waitForDiscordGatewayPluginRegistration };

package/dist/runtime-api.send.js

@@ -0,0 +1,6 @@
+import { x as resolveDiscordOutboundSessionRoute } from "./components-luonoe13.js";
+import { n as registerBuiltDiscordComponentMessage, r as sendDiscordComponentMessage, t as editDiscordComponentMessage } from "./send.components-Bcgxvm52.js";
+import { D as fetchMemberGuildPermissionsDiscord, E as fetchChannelPermissionsDiscord, O as hasAllGuildPermissionsDiscord, k as hasAnyGuildPermissionDiscord, w as DiscordSendError } from "./send.shared-D4iBnAmn.js";
+import { A as removeRoleDiscord, B as removeChannelPermissionDiscord, C as fetchChannelInfoDiscord, D as kickMemberDiscord, E as fetchVoiceStatusDiscord, F as uploadStickerDiscord, I as createChannelDiscord, L as deleteChannelDiscord, M as timeoutMemberDiscord, N as listGuildEmojisDiscord, O as listGuildChannelsDiscord, P as uploadEmojiDiscord, R as editChannelDiscord, S as createScheduledEventDiscord, T as fetchRoleInfoDiscord, V as setChannelPermissionDiscord, _ as readMessagesDiscord, a as removeReactionDiscord, b as addRoleDiscord, c as sendWebhookMessageDiscord, d as deleteMessageDiscord, f as editMessageDiscord, g as pinMessageDiscord, h as listThreadsDiscord, i as removeOwnReactionsDiscord, j as resolveEventCoverImage, k as listScheduledEventsDiscord, m as listPinsDiscord, n as fetchReactionsDiscord, o as sendTypingDiscord, p as fetchMessageDiscord, r as reactMessageDiscord, s as sendVoiceMessageDiscord, u as createThreadDiscord, v as searchMessagesDiscord, w as fetchMemberInfoDiscord, x as banMemberDiscord, y as unpinMessageDiscord, z as moveChannelDiscord } from "./send-DCtPCHGk.js";
+import { n as sendPollDiscord, r as sendStickerDiscord, t as sendMessageDiscord } from "./send.outbound-S9t0UuHc.js";
+export { DiscordSendError, addRoleDiscord, banMemberDiscord, createChannelDiscord, createScheduledEventDiscord, createThreadDiscord, deleteChannelDiscord, deleteMessageDiscord, editChannelDiscord, editDiscordComponentMessage, editMessageDiscord, fetchChannelInfoDiscord, fetchChannelPermissionsDiscord, fetchMemberGuildPermissionsDiscord, fetchMemberInfoDiscord, fetchMessageDiscord, fetchReactionsDiscord, fetchRoleInfoDiscord, fetchVoiceStatusDiscord, hasAllGuildPermissionsDiscord, hasAnyGuildPermissionDiscord, kickMemberDiscord, listGuildChannelsDiscord, listGuildEmojisDiscord, listPinsDiscord, listScheduledEventsDiscord, listThreadsDiscord, moveChannelDiscord, pinMessageDiscord, reactMessageDiscord, readMessagesDiscord, registerBuiltDiscordComponentMessage, removeChannelPermissionDiscord, removeOwnReactionsDiscord, removeReactionDiscord, removeRoleDiscord, resolveDiscordOutboundSessionRoute, resolveEventCoverImage, searchMessagesDiscord, sendDiscordComponentMessage, sendMessageDiscord, sendPollDiscord, sendStickerDiscord, sendTypingDiscord, sendVoiceMessageDiscord, sendWebhookMessageDiscord, setChannelPermissionDiscord, timeoutMemberDiscord, unpinMessageDiscord, uploadEmojiDiscord, uploadStickerDiscord };

package/dist/runtime-api.threads.js

@@ -0,0 +1,6 @@
+import { C as resolveThreadBindingMaxAgeMs, S as resolveThreadBindingMaxAgeExpiresAt, b as resolveThreadBindingIdleTimeoutMs, l as isRecentlyUnboundThreadWebhookMessage, x as resolveThreadBindingInactivityExpiresAt } from "./thread-bindings.state-eTFl-PqJ.js";
+import { n as setThreadBindingMaxAgeBySessionKey, t as setThreadBindingIdleTimeoutBySessionKey } from "./thread-bindings.session-updates-DJZGIwaU.js";
+import { _ as formatThreadBindingDurationLabel, b as resolveThreadBindingThreadName, g as resolveThreadBindingPersonaFromRecord, h as resolveThreadBindingPersona, y as resolveThreadBindingIntroText } from "./thread-bindings.discord-api-ssGH5wc2.js";
+import { a as reconcileAcpThreadBindingsOnStartup, c as resolveDiscordThreadBindingMaxAgeMs, i as listThreadBindingsForAccount, l as resolveThreadBindingsEnabled, n as autoBindSpawnedDiscordSubagent, o as unbindThreadBindingsBySessionKey, r as listThreadBindingsBySessionKey, s as resolveDiscordThreadBindingIdleTimeoutMs } from "./thread-bindings-9aKRmZv0.js";
+import { i as testing, n as createThreadBindingManager, r as getThreadBindingManager, t as createNoopThreadBindingManager } from "./thread-bindings.manager-0YBHGemk.js";
+export { testing as __testing, testing, autoBindSpawnedDiscordSubagent, createNoopThreadBindingManager, createThreadBindingManager, formatThreadBindingDurationLabel, getThreadBindingManager, isRecentlyUnboundThreadWebhookMessage, listThreadBindingsBySessionKey, listThreadBindingsForAccount, reconcileAcpThreadBindingsOnStartup, resolveDiscordThreadBindingIdleTimeoutMs, resolveDiscordThreadBindingMaxAgeMs, resolveThreadBindingIdleTimeoutMs, resolveThreadBindingInactivityExpiresAt, resolveThreadBindingIntroText, resolveThreadBindingMaxAgeExpiresAt, resolveThreadBindingMaxAgeMs, resolveThreadBindingPersona, resolveThreadBindingPersonaFromRecord, resolveThreadBindingThreadName, resolveThreadBindingsEnabled, setThreadBindingIdleTimeoutBySessionKey, setThreadBindingMaxAgeBySessionKey, unbindThreadBindingsBySessionKey };

package/dist/runtime-fC6f4UF2.js

@@ -0,0 +1,8 @@
+import { createPluginRuntimeStore } from "klaw/plugin-sdk/runtime-store";
+//#region extensions/discord/src/runtime.ts
+const { setRuntime: setDiscordRuntime, tryGetRuntime: getOptionalDiscordRuntime, getRuntime: getDiscordRuntime } = createPluginRuntimeStore({
+	pluginId: "discord",
+	errorMessage: "Discord runtime not initialized"
+});
+//#endregion
+export { getOptionalDiscordRuntime as n, setDiscordRuntime as r, getDiscordRuntime as t };

package/dist/runtime-setter-api.js

@@ -0,0 +1,2 @@
+import { r as setDiscordRuntime } from "./runtime-fC6f4UF2.js";
+export { setDiscordRuntime };

package/dist/secret-config-contract-B6WW5V88.js

@@ -0,0 +1,115 @@
+import { collectNestedChannelFieldAssignments, collectSimpleChannelFieldAssignments, getChannelSurface, isBaseFieldActiveForChannelSurface, isEnabledFlag, isRecord } from "klaw/plugin-sdk/channel-secret-basic-runtime";
+import { collectNestedChannelTtsAssignments } from "klaw/plugin-sdk/channel-secret-tts-runtime";
+//#region extensions/discord/src/secret-config-contract.ts
+const secretTargetRegistryEntries = [
+	{
+		id: "channels.discord.accounts.*.pluralkit.token",
+		targetType: "channels.discord.accounts.*.pluralkit.token",
+		configFile: "klaw.json",
+		pathPattern: "channels.discord.accounts.*.pluralkit.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.accounts.*.token",
+		targetType: "channels.discord.accounts.*.token",
+		configFile: "klaw.json",
+		pathPattern: "channels.discord.accounts.*.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
+		targetType: "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
+		configFile: "klaw.json",
+		pathPattern: "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true,
+		providerIdPathSegmentIndex: 6
+	},
+	{
+		id: "channels.discord.pluralkit.token",
+		targetType: "channels.discord.pluralkit.token",
+		configFile: "klaw.json",
+		pathPattern: "channels.discord.pluralkit.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.token",
+		targetType: "channels.discord.token",
+		configFile: "klaw.json",
+		pathPattern: "channels.discord.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.voice.tts.providers.*.apiKey",
+		targetType: "channels.discord.voice.tts.providers.*.apiKey",
+		configFile: "klaw.json",
+		pathPattern: "channels.discord.voice.tts.providers.*.apiKey",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true,
+		providerIdPathSegmentIndex: 4
+	}
+];
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "discord");
+	if (!resolved) return;
+	const { channel: discord, surface } = resolved;
+	collectSimpleChannelFieldAssignments({
+		channelKey: "discord",
+		field: "token",
+		channel: discord,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topInactiveReason: "no enabled account inherits this top-level Discord token.",
+		accountInactiveReason: "Discord account is disabled."
+	});
+	collectNestedChannelFieldAssignments({
+		channelKey: "discord",
+		nestedKey: "pluralkit",
+		field: "token",
+		channel: discord,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "pluralkit") && isRecord(discord.pluralkit) && isEnabledFlag(discord.pluralkit),
+		topInactiveReason: "no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.",
+		accountActive: ({ account, enabled }) => enabled && isRecord(account.pluralkit) && isEnabledFlag(account.pluralkit),
+		accountInactiveReason: "Discord account is disabled or PluralKit is disabled for this account."
+	});
+	collectNestedChannelTtsAssignments({
+		channelKey: "discord",
+		nestedKey: "voice",
+		channel: discord,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "voice") && isRecord(discord.voice) && isEnabledFlag(discord.voice),
+		topInactiveReason: "no enabled Discord surface inherits this top-level voice config or voice is disabled.",
+		accountActive: ({ account, enabled }) => enabled && isRecord(account.voice) && isEnabledFlag(account.voice),
+		accountInactiveReason: "Discord account is disabled or voice is disabled for this account."
+	});
+}
+//#endregion
+export { secretTargetRegistryEntries as n, collectRuntimeConfigAssignments as t };

package/dist/secret-contract-api.js

@@ -0,0 +1,2 @@
+import { n as secretTargetRegistryEntries, t as collectRuntimeConfigAssignments } from "./secret-config-contract-B6WW5V88.js";
+export { collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/security-audit-CnyIQKz6.js

@@ -0,0 +1,120 @@
+import { t as isDiscordMutableAllowEntry } from "./security-doctor-DepqtNCI.js";
+import { coerceNativeSetting, normalizeAllowFromList } from "klaw/plugin-sdk/channel-policy";
+import { readChannelAllowFromStore } from "klaw/plugin-sdk/conversation-runtime";
+import { isDangerousNameMatchingEnabled } from "klaw/plugin-sdk/dangerous-name-runtime";
+import { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "klaw/plugin-sdk/native-command-config-runtime";
+//#region extensions/discord/src/security-audit.ts
+function normalizeOptionalString(value) {
+	const normalized = value?.trim();
+	return normalized ? normalized : void 0;
+}
+function addDiscordNameBasedEntries(params) {
+	if (!Array.isArray(params.values)) return;
+	for (const value of params.values) {
+		if (!isDiscordMutableAllowEntry(String(value))) continue;
+		const text = normalizeOptionalString(String(value)) ?? "";
+		if (!text) continue;
+		params.target.add(`${params.source}:${text}`);
+	}
+}
+async function collectDiscordSecurityAuditFindings(params) {
+	const findings = [];
+	const discordCfg = params.account.config ?? {};
+	const accountId = normalizeOptionalString(params.accountId) ?? params.account.accountId ?? "default";
+	const dangerousNameMatchingEnabled = isDangerousNameMatchingEnabled(discordCfg);
+	const storeAllowFrom = await readChannelAllowFromStore("discord", process.env, accountId).catch(() => []);
+	const discordNameBasedAllowEntries = /* @__PURE__ */ new Set();
+	const discordPathPrefix = params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath ? `channels.discord.accounts.${accountId}` : "channels.discord";
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: discordCfg.allowFrom,
+		source: `${discordPathPrefix}.allowFrom`
+	});
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: discordCfg.dm?.allowFrom,
+		source: `${discordPathPrefix}.dm.allowFrom`
+	});
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: storeAllowFrom,
+		source: "~/.klaw/credentials/discord-allowFrom.json"
+	});
+	const guildEntries = discordCfg.guilds ?? {};
+	for (const [guildKey, guildValue] of Object.entries(guildEntries)) {
+		if (!guildValue || typeof guildValue !== "object") continue;
+		const guild = guildValue;
+		addDiscordNameBasedEntries({
+			target: discordNameBasedAllowEntries,
+			values: guild.users,
+			source: `${discordPathPrefix}.guilds.${guildKey}.users`
+		});
+		const channels = guild.channels;
+		if (!channels || typeof channels !== "object") continue;
+		for (const [channelKey, channelValue] of Object.entries(channels)) {
+			if (!channelValue || typeof channelValue !== "object") continue;
+			addDiscordNameBasedEntries({
+				target: discordNameBasedAllowEntries,
+				values: channelValue.users,
+				source: `${discordPathPrefix}.guilds.${guildKey}.channels.${channelKey}.users`
+			});
+		}
+	}
+	if (discordNameBasedAllowEntries.size > 0) {
+		const examples = Array.from(discordNameBasedAllowEntries).slice(0, 5);
+		const more = discordNameBasedAllowEntries.size > examples.length ? ` (+${discordNameBasedAllowEntries.size - examples.length} more)` : "";
+		findings.push({
+			checkId: "channels.discord.allowFrom.name_based_entries",
+			severity: dangerousNameMatchingEnabled ? "info" : "warn",
+			title: dangerousNameMatchingEnabled ? "Discord allowlist uses break-glass name/tag matching" : "Discord allowlist contains name or tag entries",
+			detail: dangerousNameMatchingEnabled ? `Discord name/tag allowlist matching is explicitly enabled via dangerouslyAllowNameMatching. This mutable-identity mode is operator-selected break-glass behavior and out-of-scope for vulnerability reports by itself. Found: ${examples.join(", ")}${more}.` : `Discord name/tag allowlist matching uses normalized slugs and can collide across users. Found: ${examples.join(", ")}${more}.`,
+			remediation: dangerousNameMatchingEnabled ? "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>), then disable dangerouslyAllowNameMatching." : "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>) in channels.discord.allowFrom and channels.discord.guilds.*.users, or explicitly opt in with dangerouslyAllowNameMatching=true if you accept the risk."
+		});
+	}
+	const nativeEnabled = resolveNativeCommandsEnabled({
+		providerId: "discord",
+		providerSetting: coerceNativeSetting(discordCfg.commands?.native),
+		globalSetting: params.cfg.commands?.native
+	});
+	const nativeSkillsEnabled = resolveNativeSkillsEnabled({
+		providerId: "discord",
+		providerSetting: coerceNativeSetting(discordCfg.commands?.nativeSkills),
+		globalSetting: params.cfg.commands?.nativeSkills
+	});
+	if (!nativeEnabled && !nativeSkillsEnabled) return findings;
+	const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
+	const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+	const guildsConfigured = Object.keys(guildEntries).length > 0;
+	const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
+		if (!guild || typeof guild !== "object") return false;
+		const record = guild;
+		if (Array.isArray(record.users) && record.users.length > 0) return true;
+		const channels = record.channels;
+		if (!channels || typeof channels !== "object") return false;
+		return Object.values(channels).some((channel) => {
+			if (!channel || typeof channel !== "object") return false;
+			const channelRecord = channel;
+			return Array.isArray(channelRecord.users) && channelRecord.users.length > 0;
+		});
+	});
+	const dmAllowFromRaw = discordCfg.dm?.allowFrom;
+	const ownerAllowFromConfigured = normalizeAllowFromList([...Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [], ...storeAllowFrom]).length > 0;
+	const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+	if (!useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !hasAnyUserAllowlist) findings.push({
+		checkId: "channels.discord.commands.native.unrestricted",
+		severity: "critical",
+		title: "Discord slash commands are unrestricted",
+		detail: "commands.useAccessGroups=false disables sender allowlists for Discord slash commands unless a per-guild/channel users allowlist is configured; with no users allowlist, any user in allowed guild channels can invoke /… commands.",
+		remediation: "Set commands.useAccessGroups=true (recommended), or configure channels.discord.guilds.<id>.users (or channels.discord.guilds.<id>.channels.<channel>.users)."
+	});
+	else if (useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !ownerAllowFromConfigured && !hasAnyUserAllowlist) findings.push({
+		checkId: "channels.discord.commands.native.no_allowlists",
+		severity: "warn",
+		title: "Discord slash commands have no allowlists",
+		detail: "Discord slash commands are enabled, but neither an owner allowFrom list nor any per-guild/channel users allowlist is configured; /… commands will be rejected for everyone.",
+		remediation: "Add your user id to channels.discord.allowFrom (or approve yourself via pairing), or configure channels.discord.guilds.<id>.users."
+	});
+	return findings;
+}
+//#endregion
+export { collectDiscordSecurityAuditFindings as t };

package/dist/security-audit-contract-api.js

@@ -0,0 +1,2 @@
+import { t as collectDiscordSecurityAuditFindings } from "./security-audit-CnyIQKz6.js";
+export { collectDiscordSecurityAuditFindings };

package/dist/security-audit.runtime-CQSkjNLu.js

@@ -0,0 +1,2 @@
+import { t as collectDiscordSecurityAuditFindings } from "./security-audit-CnyIQKz6.js";
+export { collectDiscordSecurityAuditFindings };

package/dist/security-contract-DLvYOgLM.js

@@ -0,0 +1,26 @@
+import { isRecord } from "klaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/discord/src/security-contract.ts
+const unsupportedSecretRefSurfacePatterns = ["channels.discord.threadBindings.webhookToken", "channels.discord.accounts.*.threadBindings.webhookToken"];
+function collectUnsupportedSecretRefConfigCandidates(raw) {
+	if (!isRecord(raw)) return [];
+	if (!isRecord(raw.channels) || !isRecord(raw.channels.discord)) return [];
+	const candidates = [];
+	const discord = raw.channels.discord;
+	const threadBindings = isRecord(discord.threadBindings) ? discord.threadBindings : null;
+	if (threadBindings) candidates.push({
+		path: "channels.discord.threadBindings.webhookToken",
+		value: threadBindings.webhookToken
+	});
+	const accounts = isRecord(discord.accounts) ? discord.accounts : null;
+	if (!accounts) return candidates;
+	for (const [accountId, account] of Object.entries(accounts)) {
+		if (!isRecord(account) || !isRecord(account.threadBindings)) continue;
+		candidates.push({
+			path: `channels.discord.accounts.${accountId}.threadBindings.webhookToken`,
+			value: account.threadBindings.webhookToken
+		});
+	}
+	return candidates;
+}
+//#endregion
+export { unsupportedSecretRefSurfacePatterns as n, collectUnsupportedSecretRefConfigCandidates as t };

package/dist/security-contract-api.js

@@ -0,0 +1,2 @@
+import { n as unsupportedSecretRefSurfacePatterns, t as collectUnsupportedSecretRefConfigCandidates } from "./security-contract-DLvYOgLM.js";
+export { collectUnsupportedSecretRefConfigCandidates, unsupportedSecretRefSurfacePatterns };

package/dist/security-doctor-DepqtNCI.js

@@ -0,0 +1,18 @@
+//#region extensions/discord/src/security-doctor.ts
+function isDiscordMutableAllowEntry(raw) {
+	const text = raw.trim();
+	if (!text || text === "*") return false;
+	const maybeMentionId = text.replace(/^<@!?/, "").replace(/>$/, "");
+	if (/^\d+$/.test(maybeMentionId)) return false;
+	for (const prefix of [
+		"discord:",
+		"user:",
+		"pk:"
+	]) {
+		if (!text.startsWith(prefix)) continue;
+		return text.slice(prefix.length).trim().length === 0;
+	}
+	return true;
+}
+//#endregion
+export { isDiscordMutableAllowEntry as t };