@open-everywhere/provider-discord 0.1.0

package/agent/provider-events.ts

@@ -0,0 +1,86 @@
+// DISCORD's event inventory (OPE-1612). See the core module's header
+// (packages/core/agent/routines/provider-events.ts) for what the three routing states mean.
+//
+// 🔴 DISCORD REGISTERS NO EVENT NORMALIZER, so every row is `routing: "none"` and the declaration
+// names no `source`. The rows exist so the gap is legible: the normalizer registry can only
+// enumerate what this deployment already routes, so the events nobody wired are exactly the ones it
+// cannot mention.
+//
+// DISCORD'S TRANSPORT IS THE REASON, AND IT IS A REAL ONE. These are GATEWAY events — a websocket
+// dispatch, not a signed HTTP delivery. The routing plane's ingress is a `TriggerDelivery` with
+// headers and a body that a `WebhookVerifier` made trustworthy, and a gateway frame has neither: the
+// trust comes from the session, not from a signature over the payload. Wiring Discord therefore
+// means deciding what "the declared door with a declared verifier" means for a socket, which is a
+// plane decision rather than a normalizer. The bundle's own gateway transport already carries the
+// message legs it needs.
+
+// 🔴 THIS LIST IS REVIEWED, NOT EXHAUSTIVE. Discord's gateway dispatch table carries far more event
+// names than the rows below — guild, voice, presence, scheduled-event and auto-moderation families
+// among them. A row reaches this file when somebody read the event and decided what a routine could
+// do with it, so an ABSENT event means "nobody has reviewed it here", never "the vendor does not
+// send it".
+
+import type { ProviderEventDeclaration } from "@open-everywhere/core/agent/adapter-api.js";
+
+export const DISCORD_PROVIDER_EVENTS: ProviderEventDeclaration = {
+  // `source` is ABSENT, not empty — the bundle registers no normalizer, so there is no key to name.
+  doc: "https://discord.com/developers/docs/events/gateway-events",
+  events: [
+    {
+      event: "MESSAGE_CREATE",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "a message was sent in a channel; the bundle's own gateway transport reads it for the mention and ambient legs, never the routine plane",
+    },
+    {
+      event: "MESSAGE_UPDATE",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "a message was edited; unwired",
+    },
+    {
+      event: "MESSAGE_DELETE",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "a message was deleted; unwired",
+    },
+    {
+      event: "MESSAGE_REACTION_ADD",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "somebody reacted to a message; the reaction-feedback plane reads it, and a routine could not tell its own ack glyphs from a person's",
+    },
+    {
+      event: "MESSAGE_REACTION_REMOVE",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "a reaction was taken off a message; unwired for the same reason as `MESSAGE_REACTION_ADD`",
+    },
+    {
+      event: "THREAD_CREATE",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "a thread was started; unwired — a candidate trigger, since a new thread is work appearing rather than chatter",
+    },
+    {
+      event: "GUILD_MEMBER_ADD",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "somebody joined the guild; unwired — an onboarding routine would want this one",
+    },
+    {
+      event: "INTERACTION_CREATE",
+      routing: "none",
+      match: [],
+      scope: [],
+      note: "a slash command or component interaction; unwired, and a poor routine trigger — an interaction owes Discord a reply within three seconds, which a fired seat cannot promise",
+    },
+  ],
+};

package/agent/register.ts

@@ -0,0 +1,147 @@
+// registerDiscordProvider — the ONE boot entry of @open-everywhere/provider-discord (OPE-114 stage 4,
+// the second extracted provider bundle, and the deepest-integrated one — a custom gateway webhook
+// transport, admin approval CARDS, a guild-admin spend bypass, and routine dispatch). The app's
+// adapter-wiring module (agent/lib/register-adapters.ts) imports this STATICALLY and calls it once
+// at boot; every seam the discord bundle implements registers here and nowhere else. Static imports
+// only: eve bundles the agent definition and its whole import graph into one rolldown chunk — a
+// literal dynamic import() code-splits and trips eve's "expected one authored module" invariant.
+//
+// What discord registers:
+//   • identity mapper          — bindDiscord (guild=workspace, channel=surface; discord-identity.ts)
+//   • capability manifest      — midTurnPost true (discord-post.ts create-message); reactions true
+//                                 (discord-post.ts discordAddReaction, OPE-987)
+//   • post arm                 — discordPostArm (mid-turn reply + unified reply + auto-thread + redrive
+//                                 + the 1:1 DM delivery arm, OPE-623)
+//   • account directory        — the declared guilds' member search, for the identity-linking
+//                                 directory transport (OPE-623; channels/discord-directory.ts)
+//   • wake-origin codec        — the stored-data discord arm (discord-origin-codec.ts)
+//   • read adapter             — discordReadAdapter (GET /channels/{id}/messages)
+//   • reaction surface         — membership only (discord relay reactions ride the gateway)
+//   • surface message ops      — postText / editMessage / postFiles (post_file, notices)
+//   • approval-card poster     — postDiscordApprovalCard (the REST create-message card, Discord components)
+//   • judge-lift notice poster — postDiscordJudgeLiftNotice (the room's trace of a judge lift, and
+//                                 the "This should not have run" contradict button, OPE-1103)
+//   • routine dispatch channel — the eve discord channel a cron fire receive()s into
+//   • native admin check       — guild-ADMINISTRATOR REST verdict (the spend-cap bypass's native leg)
+//   • scope-label resolver     — friendly `#channel` / `the <guild> server` approval-card labels
+//   • bot display-name arm     — discordBotDisplayName (GET /users/@me, OPE-610; a HANDLE, not identity)
+//   • command reconciler       — reconcileDiscordCommands (OPE-1687; the deployment registers its own
+//                                 "/oe" command at boot, into the guilds the app's config declares)
+
+import {
+  registerIdentityMapper,
+  registerCapabilityManifest,
+  registerSurfaceParity,
+  registerProviderEvents,
+  registerPostArm,
+  registerWakeOriginCodec,
+  registerReadAdapter,
+  registerSeatCatchUp,
+  registerReactionSurface,
+  registerSurfaceMessageOps,
+  registerCardPoster,
+  registerJudgeLiftNoticePoster,
+  registerRoutineDispatch,
+  registerNativeAdminCheck,
+  registerNativeMemberCheck,
+  registerScopeLabelResolver,
+  registerBotDisplayName,
+  registerAccountDirectory,
+  registerProviderDocs,
+  registerSurfaceCommandReconciler,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { PROVIDER_DOCS } from "./docs-generated.js";
+import { DISCORD_SURFACE_PARITY } from "./surface-parity.js";
+import { DISCORD_PROVIDER_EVENTS } from "./provider-events.js";
+import { registerDiscordOps } from "./ops.js";
+import { resolveDiscordTarget, discordReportTargetFor } from "./channels/discord-dispatch-target.js";
+import { bindDiscord } from "./channels/discord-identity.js";
+import { discordPostArm } from "./channels/discord-post-arm.js";
+import { discordWakeOriginCodec } from "./channels/discord-origin-codec.js";
+import { discordReadAdapter } from "./channels/discord-read.js";
+import { discordSeatCatchUpFetch, DISCORD_TIMESTAMP_PRECISION_MS } from "./channels/discord-backscroll.js";
+import { discordMessageOps } from "./channels/discord-message-ops.js";
+import { discordBotDisplayName } from "./channels/discord-bot-name.js";
+import { fetchGuildDirectory } from "./channels/discord-directory.js";
+import { postDiscordApprovalCard, postDiscordJudgeLiftNotice } from "./approvals/discord-flow.js";
+import { discordScopeLabelResolver } from "./approvals/discord-scope-label.js";
+import { guildIdFromScopeKey, isGuildAdminViaRest, isGuildMemberViaRest } from "./approvals/discord-admin.js";
+import { reconcileDiscordCommands } from "./commands/discord-command-sync.js";
+
+/** Perform ALL of the discord bundle's registrations. Idempotent (each register call replaces);
+ *  cheap and side-effect-free beyond the registry writes (every REST call is lazy — the bot token
+ *  resolves only when a real post/read/admin-check fires). */
+export function registerDiscordProvider(): void {
+  registerIdentityMapper("discord", bindDiscord);
+  // POST messages wired (discord-post.ts); the model-callable react verb is wired too (OPE-987,
+  // discord-post-arm.ts resolveReactTarget/react, over discord-post.ts's discordAddReaction).
+  // closingProseDropped (OPE-2006): both Discord completion handlers — the Interactions channel and
+  // the gateway's guild path — DROP a turn's closing text and audit it. `reply` is the only route out.
+  registerCapabilityManifest("discord", { midTurnPost: true, reactions: true, closingProseDropped: true });
+  // The OPE-1499 parity ledger: every capability the chat-surface contract names, answered
+  // `supported` or `{ unsupported: "<reason>" }`. Gates nothing at runtime — `lint:surface-parity`
+  // reds on an unanswered row, and the contract's §7.1/§7.1.1/§7.2 tables are generated from it.
+  registerSurfaceParity("discord", DISCORD_SURFACE_PARITY);
+  // The OPE-1612 event inventory: every vendor event that could wake a routine, and how far the
+  // normalizer plane carries each one. Gates nothing at runtime — `lint:provider-events` reds a
+  // bundle that declares none or that promises a match key the normalizer does not declare, and
+  // the manual's inventory table is generated from it.
+  registerProviderEvents("discord", DISCORD_PROVIDER_EVENTS);
+  registerPostArm(discordPostArm);
+  registerWakeOriginCodec("discord", discordWakeOriginCodec);
+  registerReadAdapter(discordReadAdapter);
+  // THE SEAT CATCH-UP FETCH (OPE-1726): the seat's own channel (or thread) history since its
+  // last wake. Core's shared path applies the bounds, the domain's admission policy and the cap.
+  // The surface DECLARES the unit its own message stamps carry, and core widens both catch-up
+  // bounds by it (OPE-1847). A wrong or missing unit bounds the seat out of its own window.
+  registerSeatCatchUp("discord", discordSeatCatchUpFetch, { timestampPrecisionMs: DISCORD_TIMESTAMP_PRECISION_MS });
+  registerReactionSurface("discord");
+  registerSurfaceMessageOps(discordMessageOps);
+  registerCardPoster("discord", postDiscordApprovalCard);
+  // Judge-lift NOTICE poster (OPE-1103) — a SECOND, separate hook, never the card poster above. The
+  // card poster announces a PENDING action and its failure is fatal; this one reports an action that
+  // has already run and its failure is swallowed. Without this registration a judge lift on a
+  // Discord-bound domain leaves audit rows and nothing a person in the room can act on.
+  registerJudgeLiftNoticePoster("discord", postDiscordJudgeLiftNotice);
+  registerRoutineDispatch("discord", { resolveTarget: resolveDiscordTarget, reportTargetFor: discordReportTargetFor });
+  // Native admin leg for the spend-cap bypass (spend/bypass.ts): a guild ADMINISTRATOR, REST-verified.
+  registerNativeAdminCheck("discord", async (scopeKey, principalId) => {
+    const guildId = guildIdFromScopeKey(scopeKey);
+    return guildId ? isGuildAdminViaRest(guildId, principalId) : false;
+  });
+  // Native MEMBER leg for the approval clicker-floor gate (access/native-admin.ts, OPE-303): guild
+  // membership, REST-verified, bots excluded. Without it core's gate ends in a fail-closed `false`
+  // and a Discord float advertises an undo that can never fire.
+  registerNativeMemberCheck("discord", async (scopeKey, principalId) => {
+    const guildId = guildIdFromScopeKey(scopeKey);
+    return guildId ? isGuildMemberViaRest(guildId, principalId) : false;
+  });
+  registerScopeLabelResolver("discord", discordScopeLabelResolver);
+  // The bot's own Discord handle (OPE-610) — the arm the instruction assembler renders as a HANDLE
+  // line on a Discord-pinned session ("your mention/handle here appears as X"), never as identity —
+  // see channels/discord-bot-name.ts's header for the naming-model split. `discordBotDisplayName`
+  // memoises one `GET /users/@me` per instance, so the assembler pays no round trip per turn.
+  registerBotDisplayName("discord", discordBotDisplayName);
+  // The GUILD ACCOUNT DIRECTORY (OPE-623) — the lookup the reverse-initiated link uses to NAME the
+  // other account instead of posting a bearer code. Discord searches server-side
+  // (`GET /guilds/{id}/members/search`), so the arm makes one call per DECLARED guild and core does
+  // the ranking. It needs the privileged SERVER MEMBERS INTENT; without it the arm answers with
+  // nothing and linking falls back to the code flow. The other half of the transport is the post
+  // arm's `deliverDirectMessage` — core requires BOTH before it offers the directory transport.
+  registerAccountDirectory("discord", (query) => fetchGuildDirectory(query));
+  // Shipped-manual plane (OPE-138): this bundle's own setup runbook (docs/deploy/surfaces/discord.md,
+  // compiled into ./docs-generated.ts because docs/ is not on disk at runtime). De-select the bundle
+  // and the module leaves the import graph; registerProviderDocs re-checks the selection gate anyway.
+  registerProviderDocs("discord", PROVIDER_DOCS);
+  // Slash-command reconcile (OPE-1687): the vendor half of core's command plane. Registering it
+  // makes NO call — the plane runs it once, from the app's boot, and only for the guilds the app
+  // declared in `agent/commands/discord-commands.ts`. Without this row a declared "/oe" subcommand
+  // reaches Discord only when an operator runs `npm run register:discord-commands` by hand, which is
+  // a step nobody could take: the bot token lives with the deployment, not the operator.
+  registerSurfaceCommandReconciler("discord", (scope) => reconcileDiscordCommands(scope));
+  // Ops plane (OPE-495): the telemetry credential-presence probe. Split into ./ops.js so the
+  // STANDALONE ops MCP entry (repo-root scripts/ops-mcp.ts, which serves preflight/quickstart with
+  // no agent boot) registers it without pulling the whole channel graph — the same split slack and
+  // teams use.
+  registerDiscordOps();
+}

package/agent/surface-parity.ts

@@ -0,0 +1,95 @@
+// DISCORD's surface-parity declaration (OPE-1499). See the core module's header
+// (packages/core/agent/identity/surface-parity.ts) for what the three cell shapes mean.
+//
+// Discord is complete on the chat plane. Its one structural difference from Slack is the
+// engagement seam's second step: it enrols conversations and honours the durable `stopped` flag,
+// but gates delivery with its own gateway rule instead of core's `shouldDeliverReply`.
+
+import type { SurfaceParityDeclaration } from "@open-everywhere/core/agent/adapter-api.js";
+
+export const DISCORD_SURFACE_PARITY: SurfaceParityDeclaration = {
+  // registration seams (§7.1)
+  "identity-mapper": "supported",
+  "capability-manifest": "supported",
+  "post-arm": "supported",
+  "wake-origin-codec": "supported",
+  // The arm renders a Discord action row (`discord-post-arm.ts`), the front routes the tap back
+  // (`discord-front.ts` classifies the `oe_input:` custom_id, `discord-approval-card.ts` settles it),
+  // and the settle DELIVERS through core's `approvalCardRespondVia` — all three halves, as the row
+  // requires. The third is not a formality: this front bound its own `args.from(bareToken)` until
+  // OPE-1863, and that address is channel-local, so every tap threw and the approval stayed parked.
+  "unified-action-plane": "supported",
+  // `messageId` is the `message_reference` anchor and sits outside `threadRef`, which keys on the
+  // channel id alone — Slack's shape exactly. Both members are implemented; `autoThreadName` stays
+  // OUT of the axis because opening a thread MOVES a post rather than placing one.
+  "origin-placement-carry": "supported",
+  "read-adapter": "supported",
+  "reaction-feedback-ingest": "supported",
+  "ancillary-ops": "supported",
+  // Enrols (`markThreadEngaged`) and reads the `stopped` flag, but runs its own delivery gate in
+  // discord-gateway.ts rather than calling core's `shouldDeliverReply` — the seam is wired, and
+  // the trio is not called whole (§7.1's prose).
+  "ambient-engagement-seam": { supported: "enrols and honours `stopped`; gates delivery in its own gateway rule" },
+  // 🔴 A SECOND HONEST SPELLING, NOT A MISSING MAPPING. Under standing seats a Discord auto-thread
+  // is a seated channel in its own right, so a plain follow-up in it diverts as THAT channel's own
+  // wake and `discord-gateway.ts` reports the classifier's word. `J-ENGAGED-discord` reads the pair
+  // `channel-watch` + `singleWindow: true` IN the follow-up's own room instead
+  // (`reportedSeatedChannelWatch`, packages/core/scripts/e2e/engaged-rows.ts). Promoting the value
+  // here would need the seated path to resolve the engagement registry it does not read.
+  "engaged-row-promotion": {
+    unsupported:
+      "the seated path reports the classifier's word — an auto-thread's follow-up diverts as that channel's own wake, and the journey reads `channel-watch` on a `singleWindow: true` row in that room instead",
+  },
+  // A Discord thread is its OWN channel id, so the stored origin could not tell a thread from a
+  // plain channel and the router had to read every Discord wake as top-level. The gateway now
+  // stamps `thread: true` at mint from the relay payload's channel type (OPE-1719), which is the
+  // positive signal the guard needs. The DM leg keeps the raw divert: a DM has no threads.
+  "owned-thread-ingress": { supported: "the guild leg only — a Discord DM carries no threads, so its divert never consults ownership" },
+
+  // wake legs and conversation shapes
+  "addressed-leg": "supported",
+  "ambient-leg": "supported",
+  // `discord-backscroll.ts discordSeatCatchUpFetch` pages `GET /channels/:id/messages` back to the
+  // seat's own `lastWakeAt` and hands the normalized window to core's shared catch-up path. A thread
+  // IS its own channel id on Discord, so one endpoint serves both the container and the conversation.
+  "seat-catch-up": "supported",
+  // BOTH hydration roads pour through one wrapper (`admitDiscordSeatLines`, discord-gateway.ts),
+  // which calls the core seam — never a per-bundle copy of the policy.
+  "seat-context-admission": "supported",
+  // The one registered `CardPoster` (approvals/discord-flow.ts, wired in register.ts): this bundle
+  // owns its own render AND the component route that brings the tap back.
+  "approval-card": "supported",
+  // The one registered `JudgeLiftNoticePoster` too (approvals/discord-flow.ts): the notice renders
+  // as this surface's own card with the overrule button, and the tap comes back the same route the
+  // Approve/Reject taps take.
+  "judge-lift-notice": "supported",
+  "name-drop-mention": "supported",
+  // 🔴 THE EVENT NEVER LEAVES THE RELAY. `deploy/discord-relay/index.js` subscribes to
+  // `Events.MessageCreate` (plus the two reaction events) and nothing else, so an edit — Discord's
+  // `MessageUpdate` — is never forwarded and the ingestion channel has no edit to gate. The gap is
+  // in the relay's subscription set, not in `discord-gateway.ts`.
+  "message-edit-wake": { unsupported: "the gateway relay subscribes to MessageCreate only — an edit raises MessageUpdate, which nothing forwards" },
+  // A Discord thread IS a channel, so `read_thread` reads that thread channel (§4.6.1).
+  threads: { supported: "a thread is itself a channel" },
+  rooms: "supported",
+  dm: "supported",
+  mpim: "supported",
+
+  // core verbs (§7.2)
+  reply: "supported",
+  edit_reply: "supported",
+  // Message-level granularity since OPE-987 (discord-post-arm.ts `resolveReactTarget`/`react`).
+  react: "supported",
+  no_reply: "supported",
+  read_channel: "supported",
+  read_thread: "supported",
+  search: { unsupported: "no work-search adapter — Discord is a chat surface, not a work corpus (§4.7)" },
+  post_message: "supported",
+  dm_person: "supported",
+  set_dm_delivery: "supported",
+  stop: { supported: "✋ reaction, plus the `/oe stop` command" },
+  ack_stop_glyph: "supported",
+  ack_cancel_note: "supported",
+  stand_down: { supported: "marks the engagement row; refuses out loud when the registry holds none" },
+  post_file: "supported",
+};

package/dist/agent/access/discord-grant-click.d.ts

@@ -0,0 +1,25 @@
+import { type InteractionFollowUp } from "../channels/discord-interaction-defer.js";
+/** The interaction response body this handler returns. Loosely typed, exactly as its two sibling
+ *  handlers type theirs, so the front route can hold one seam type across all three. */
+export type DiscordGrantClickResponse = Record<string, unknown>;
+/** The host edges this door needs to defer. Both are injected so a test can drive the whole
+ *  ack-then-edit sequence with no Discord and no host. */
+export interface DiscordGrantClickDeps {
+    /** The route's own `waitUntil` — keeps the resolution alive past the interaction response on a
+     *  serverless host. ABSENT ⇒ no defer (see the header): the handler awaits and answers as before. */
+    readonly waitUntil?: (p: Promise<unknown>) => void;
+    /** The follow-up edit. Live default is {@link editOriginalInteractionResponse}. */
+    readonly edit?: (followUp: InteractionFollowUp, content: string) => Promise<boolean>;
+}
+/**
+ * Handle one verified `oe_grant:` component click.
+ *
+ * Returns the interaction response body to send, or `null` for anything that is NOT one of ours —
+ * the front route then forwards it, so a click is never silently swallowed. NEVER throws.
+ *
+ * 🔴 ON THE RESOLUTION PATH IT RETURNS BEFORE THE DECISION IS MADE (OPE-1282). The body is a
+ * DEFERRED ephemeral ack; the decision runs under `deps.waitUntil` and edits that placeholder when
+ * it lands. See the header for why, and for the two cases that still answer synchronously.
+ */
+export declare function handleDiscordGrantCardInteraction(raw: unknown, deps?: DiscordGrantClickDeps): Promise<DiscordGrantClickResponse | null>;
+//# sourceMappingURL=discord-grant-click.d.ts.map

package/dist/agent/access/discord-grant-click.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-grant-click.d.ts","sourceRoot":"","sources":["../../../agent/access/discord-grant-click.ts"],"names":[],"mappings":"AAiFA,OAAO,EAAmF,KAAK,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAWrK;wFACwF;AACxF,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE;0DAC0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC;yGACqG;IACrG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACtF;AA8BD;;;;;;;;;GASG;AACH,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAyF3C"}

package/dist/agent/access/discord-grant-click.js

@@ -0,0 +1,210 @@
+// THE DISCORD HALF OF THE CREDENTIAL-GRANT CARD BUTTON (OPE-1260) — the sibling of
+// identity/discord-link-consent.ts, funnelling through core's own `resolveGrantCardClick` exactly as
+// that file funnels through `resolveLinkConsentClick`. Core decides; this file only reads Discord's
+// envelope and writes Discord's answer.
+//
+// WHAT WAS WRONG BEFORE THIS FILE. The owner's grant card is delivered as a DM with an actions row,
+// and the Discord DM arm renders those actions as real components (channels/discord-post-arm.ts). The
+// front route classified only `oe-approval:` and `oe-link:`, so an `oe_grant:` tap FORWARDED to eve's
+// HITL decoder, which no-ops it. The owner saw four buttons, tapped one, and nothing happened —
+// no approval, no decline, no answer, and the ask then lapsed on its own.
+//
+// 🔴 THE CLICKER IS READ FROM THE ENVELOPE, NEVER FROM A PAYLOAD FIELD. A grant answer is scoped to
+// BEING the owner the card was sent to, so whose hand it was is the whole security content of this
+// file. The front route has already verified Discord's Ed25519 signature over the RAW body, so every
+// field read below is Discord's own statement. Core then compares that clicker to the ask row's
+// `ownerPrincipalId`; an ask id names an ask, it never answers one.
+//
+// 🔴 DM-ONLY, REFUSED RATHER THAN TOLERATED — the same rule, for the same reason, as the consent
+// button. A grant card is only ever delivered through `deliverDirectMessage`, so it only ever lands
+// in a 1:1. A guild click therefore cannot be a tap on a real card: the message was forwarded, or the
+// id was guessed. `interaction.guild_id` present ⇒ refuse, and say so.
+//
+// WHERE THIS DIFFERS FROM THE SLACK DOOR, and why. Slack's `handleGrantCardClick` posts its private
+// answer with a second API call (`chat.postEphemeral`), because a Slack interactivity POST answers
+// with an empty 200. Discord's interaction response IS the private answer — `type 4` + `flags 64` —
+// so the answer rides the click's own reply and no second call is made. The DECISION, the copy and
+// the audit row are core's, identical on both surfaces.
+//
+// ⚠️ THIS FILE NEVER TOUCHES THE CARD — CORE REWRITES IT AFTER THE DECISION (OPE-1278). The answer
+// here is ephemeral, so the handler leaves the owner's message alone. Core's `rewriteGrantCard`
+// (access/credential-grant-card.ts) rewrites that card to a terminal APPROVED or DECLINED body once
+// the CAS has closed the ask, and the Discord edit arm's `components: []` takes the four buttons
+// with it (channels/discord-message-ops.ts). THAT REWRITE IS BEST-EFFORT: an ask row with no pinned
+// card locus, or an edit the surface refuses, still leaves live buttons over a closed request. The
+// CAS is what makes that safe — core's approve is conjunct on `status = 'pending'`, so a second tap
+// mints nothing and is answered "that request is no longer open", which is the truth.
+//
+// NEVER THROWS. Discord's interactions endpoint must answer within three seconds, and a throw there
+// becomes a red "This interaction failed" the person cannot act on.
+//
+// 🔴 THE RESOLUTION IS DEFERRED, BECAUSE IT IS NOT FAST AND DISCORD DOES NOT REDELIVER (OPE-1282).
+// `resolveGrantCardClick` used to be awaited to completion before this returned. An APPROVE inside it
+// reads the owner's own MCP connection before it CASes — a consent probe, a token mint, an MCP
+// handshake and a `tools/list`, all four sharing one `BORROW_APPROVE_READ_BUDGET_MS` deadline (core
+// connections/grant-mcp-borrow.ts, five seconds) — and then does the CAS, the grant insert, the audit rows
+// and an AWAITED post into the requesting room. That can exceed Discord's three seconds.
+//
+// WHAT THAT COST, AND WHY IT WAS WORSE HERE THAN ON SLACK. Slack redelivers an interactivity payload
+// it has not seen answered, so a slow approve there is retried (slack-front.ts's own note). Discord
+// does NOT redeliver an expired interaction token: the owner saw a red "This interaction failed" and
+// this handler's ephemeral answer was never rendered — while the grant really was minted and the
+// requesting room really was told. A second tap then read "that request is no longer open", which is
+// true and reads like a failure. It was never a correctness problem — the approve CAS still yields
+// exactly one grant — but the owner believed their approval had failed while a conversation could
+// already spend their credential.
+//
+// SO THIS DOOR IS NOW "ACK, THEN DECIDE, THEN EDIT": it answers with a DEFERRED ephemeral response
+// (`type 5`, channels/discord-interaction-defer.ts), hands the resolution to the host's `waitUntil`,
+// and edits the placeholder with core's own decision copy when it lands. The ephemeral flag rides
+// the ACK — Discord fixes visibility at the first response — so the answer is still private.
+//
+// 🔴 THE FAST REFUSALS DO NOT DEFER, and that is deliberate. A guild click, an unattributable
+// clicker and an unreadable action id are all decided from the envelope alone, in no time at all.
+// Deferring them would trade an instant answer for a placeholder plus a second round trip, and each
+// one is a `type 4` today because that is the correct shape for an answer that is already known.
+//
+// 🔴 NO `waitUntil` ⇒ NO DEFER. Without somewhere to run the work, a deferred ack would leave the
+// owner on a permanent "thinking…" — strictly worse than the slow answer. The handler falls back to
+// the original await-then-answer shape instead, and says so in the log.
+//
+// ⚠️ approvals/discord-flow.ts IS ONLY HALF THIS SHAPE, and cannot take the other half as written
+// (OPE-1407). Its `deliverDecisionFeedback` — the notice post and the decision wake — now runs under
+// the route's `waitUntil` WHEN THE ROUTE SUPPLIES ONE, which takes that leg out of the three-second
+// budget; a host that supplies none still awaits it inside the budget. Its `resolveApprovalClick`
+// stays on the response path because that door answers with THREE response KINDS chosen by the
+// resolution (`type 7` replaces the card, `type 6` acks silently, `type 4` sends an ephemeral), and
+// Discord fixes a response's kind at the first response. This door answers with one `type 4` on
+// every path, which is what lets it defer as `type 5` and say the same thing later. Closing the
+// other half needs a follow-up MESSAGE rather than the `@original` edit this module provides.
+import { OE_GRANT_ACTION_PREFIX, parseGrantCardActionId, resolveGrantCardClick, deploymentOrg } from "@open-everywhere/core/agent/adapter-api.js";
+import { deferredEphemeralResponse, editOriginalInteractionResponse, interactionFollowUp } from "../channels/discord-interaction-defer.js";
+function log(msg) {
+    console.log(`[open-everywhere:discord-grant] ${msg}`);
+}
+// Discord interaction-response wire constants, defined locally for the same reason
+// identity/discord-link-consent.ts and approvals/discord-flow.ts define their own.
+const RESPONSE_CHANNEL_MESSAGE = 4; // CHANNEL_MESSAGE_WITH_SOURCE
+const EPHEMERAL = 64; // MessageFlags.EPHEMERAL — only the clicker sees it
+function ephemeral(content) {
+    return { type: RESPONSE_CHANNEL_MESSAGE, data: { content, flags: EPHEMERAL } };
+}
+function isObject(v) {
+    return typeof v === "object" && v !== null;
+}
+/** The clicking user's Discord id, from the envelope's own fields. Discord puts the clicker at
+ *  `interaction.user` in a DM and at `interaction.member.user` in a guild; both are read so the
+ *  guild refusal below is a DELIBERATE refusal rather than an accident of which field was absent. */
+function clickerIdOf(interaction) {
+    const direct = isObject(interaction["user"]) ? interaction["user"]["id"] : undefined;
+    if (typeof direct === "string" && direct.length > 0)
+        return direct;
+    const member = isObject(interaction["member"]) ? interaction["member"]["user"] : undefined;
+    const viaMember = isObject(member) ? member["id"] : undefined;
+    return typeof viaMember === "string" && viaMember.length > 0 ? viaMember : undefined;
+}
+/** The channel the click happened in — the audit row's `surface`. Absent on a body that carries
+ *  none, which is a stamp we leave off rather than invent. */
+function channelIdOf(interaction) {
+    const id = interaction["channel_id"];
+    if (typeof id === "string" && id.length > 0)
+        return id;
+    const channel = isObject(interaction["channel"]) ? interaction["channel"]["id"] : undefined;
+    return typeof channel === "string" && channel.length > 0 ? channel : undefined;
+}
+/**
+ * Handle one verified `oe_grant:` component click.
+ *
+ * Returns the interaction response body to send, or `null` for anything that is NOT one of ours —
+ * the front route then forwards it, so a click is never silently swallowed. NEVER throws.
+ *
+ * 🔴 ON THE RESOLUTION PATH IT RETURNS BEFORE THE DECISION IS MADE (OPE-1282). The body is a
+ * DEFERRED ephemeral ack; the decision runs under `deps.waitUntil` and edits that placeholder when
+ * it lands. See the header for why, and for the two cases that still answer synchronously.
+ */
+export async function handleDiscordGrantCardInteraction(raw, deps = {}) {
+    try {
+        if (!isObject(raw))
+            return null;
+        const data = isObject(raw["data"]) ? raw["data"] : undefined;
+        const customId = typeof data?.["custom_id"] === "string" ? data["custom_id"] : undefined;
+        if (!customId?.startsWith(OE_GRANT_ACTION_PREFIX))
+            return null;
+        const parsed = parseGrantCardActionId(customId);
+        if (parsed === undefined) {
+            // Ours by prefix, unreadable by grammar. Returning null lets the front route forward it rather
+            // than swallow it — the same defensive shape both sibling handlers take.
+            log("grant card custom_id did not parse — forwarding");
+            return null;
+        }
+        if (typeof raw["guild_id"] === "string" && raw["guild_id"].length > 0) {
+            // See the header: a grant card only ever lands in a DM, so a guild click is not the owner
+            // answering their own card.
+            return ephemeral("I only take an answer to a credential request in our direct messages — this one came from a server. Open our DM and answer it there. Nothing was granted.");
+        }
+        const clicker = clickerIdOf(raw);
+        if (clicker === undefined) {
+            log("grant card click carried no attributable user — refusing");
+            return ephemeral("I could not tell who pressed that, so I did nothing and nothing was granted.");
+        }
+        const channelId = channelIdOf(raw);
+        const resolve = () => resolveGrantCardClick({
+            askId: parsed.askId,
+            answer: parsed.answer,
+            // 🔴 NO TENANT RUNG, AND THAT IS THE CORRECT SPELLING RATHER THAN A GAP. Discord is not a
+            // tenant-scoped platform (identity/principal-key.ts), so the owner's key is `discord/<user-id>`
+            // — the exact string the ask row's `ownerPrincipalId` was minted as. Passing a guild here would
+            // compose a three-segment key that matches nobody and refuse every genuine owner.
+            clicker: { platform: "discord", nativeId: clicker },
+            // READ WHEN THE RESOLUTION RUNS, not when the ack is sent — it is the clock the ask's expiry
+            // is judged against, and the defer puts real time between the two.
+            nowMs: Date.now(),
+            // ONE deployment serves ONE org, and the ask row was written under that partition. Reading it
+            // from the deployment rather than the payload is what stops a forged body naming another
+            // tenant's asks — the same reason both sibling handlers read it this way.
+            org: deploymentOrg(),
+            platform: "discord",
+            // A DM has no guild, and the Discord identity mapper's own convention for that partition is the
+            // user's id in the `workspace` rung (channels/discord-identity.ts `guildId ?? userId`). Spelled
+            // the same way here so this audit row files where every other Discord DM row files.
+            workspace: clicker,
+            ...(channelId === undefined ? {} : { surface: channelId }),
+        });
+        const followUp = interactionFollowUp(raw);
+        if (deps.waitUntil === undefined || followUp === undefined) {
+            // NO PLACE TO RUN THE WORK, OR NO ADDRESS TO ANSWER AT ⇒ the pre-OPE-1282 shape. Slow, and
+            // still correct: a deferred ack we could not follow up would leave a permanent "thinking…".
+            log(`grant card click answering synchronously (${deps.waitUntil === undefined ? "no waitUntil" : "no follow-up address"}) — a slow approve may outlive the interaction token`);
+            return ephemeral((await resolve()).text);
+        }
+        const edit = deps.edit ?? editOriginalInteractionResponse;
+        deps.waitUntil((async () => {
+            // TOTAL. This runs after the response has gone; a throw here reaches the host's unhandled
+            // rejection handler and tells the owner nothing. Core's resolver is already total, so the
+            // catch is for the edit's own transport and for an impossible throw above it.
+            let text;
+            try {
+                text = (await resolve()).text;
+            }
+            catch (err) {
+                log(`deferred grant card resolution failed: ${err?.message ?? String(err)}`);
+                text = "That could not be answered right now. Nothing changed, and nothing was granted. Try the button again.";
+            }
+            // 🔴 A FAILED EDIT IS LOUD BUT NOT FATAL: the DECISION has already landed and been audited by
+            // core. What is lost is the owner's explanation, which is exactly what the pre-fix expired
+            // token lost — so this is never a regression, and it must be findable in the log.
+            const shown = await edit(followUp, text);
+            if (!shown)
+                log(`grant card answer could NOT be shown to the owner — the decision landed and is audited, the owner was not told`);
+        })());
+        return deferredEphemeralResponse();
+    }
+    catch (err) {
+        // A three-second endpoint: an unhandled throw is a red "interaction failed" the person cannot act
+        // on. Core's resolver is already total and guards every write, so an honest answer here costs the
+        // owner an explanation and never an outcome.
+        log(`grant card click failed: ${err?.message ?? String(err)}`);
+        return ephemeral("That could not be answered right now. Nothing changed, and nothing was granted. Try the button again.");
+    }
+}
+//# sourceMappingURL=discord-grant-click.js.map

package/dist/agent/access/discord-grant-click.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-grant-click.js","sourceRoot":"","sources":["../../../agent/access/discord-grant-click.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,qGAAqG;AACrG,oGAAoG;AACpG,wCAAwC;AACxC,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,gGAAgG;AAChG,oEAAoE;AACpE,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,sGAAsG;AACtG,uEAAuE;AACvE,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,wDAAwD;AACxD,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,oGAAoG;AACpG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,sFAAsF;AACtF,EAAE;AACF,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,mGAAmG;AACnG,sGAAsG;AACtG,+FAA+F;AAC/F,oGAAoG;AACpG,2GAA2G;AAC3G,yFAAyF;AACzF,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,iGAAiG;AACjG,qGAAqG;AACrG,mGAAmG;AACnG,kGAAkG;AAClG,kCAAkC;AAClC,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,6FAA6F;AAC7F,EAAE;AACF,8FAA8F;AAC9F,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,wEAAwE;AACxE,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,kGAAkG;AAClG,+FAA+F;AAC/F,oGAAoG;AACpG,gGAAgG;AAChG,gGAAgG;AAChG,8FAA8F;AAE9F,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAClJ,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,mBAAmB,EAA4B,MAAM,0CAA0C,CAAC;AAErK,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,CAAC,CAAC,CAAC,8BAA8B;AAClE,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,oDAAoD;AAgB1E,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED;;qGAEqG;AACrG,SAAS,WAAW,CAAC,WAAoC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;8DAC8D;AAC9D,SAAS,WAAW,CAAC,WAAoC;IACvD,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,GAAY,EACZ,IAAI,GAA0B,EAAE;IAEhC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,sBAAsB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,+FAA+F;YAC/F,yEAAyE;YACzE,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,0FAA0F;YAC1F,4BAA4B;YAC5B,OAAO,SAAS,CACd,2JAA2J,CAC5J,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,0DAA0D,CAAC,CAAC;YAChE,OAAO,SAAS,CAAC,8EAA8E,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,GAA8B,EAAE,CAC9C,qBAAqB,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,0FAA0F;YAC1F,gGAAgG;YAChG,gGAAgG;YAChG,kFAAkF;YAClF,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;YACnD,6FAA6F;YAC7F,mEAAmE;YACnE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YACjB,8FAA8F;YAC9F,yFAAyF;YACzF,0EAA0E;YAC1E,GAAG,EAAE,aAAa,EAAE;YACpB,QAAQ,EAAE,SAAS;YACnB,gGAAgG;YAChG,gGAAgG;YAChG,oFAAoF;YACpF,SAAS,EAAE,OAAO;YAClB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEL,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3D,2FAA2F;YAC3F,4FAA4F;YAC5F,GAAG,CAAC,6CAA6C,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,sDAAsD,CAAC,CAAC;YAC/K,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,+BAA+B,CAAC;QAC1D,IAAI,CAAC,SAAS,CACZ,CAAC,KAAK,IAAI,EAAE;YACV,0FAA0F;YAC1F,0FAA0F;YAC1F,8EAA8E;YAC9E,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,0CAA2C,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxF,IAAI,GAAG,uGAAuG,CAAC;YACjH,CAAC;YACD,8FAA8F;YAC9F,2FAA2F;YAC3F,kFAAkF;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,GAAG,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC,CAAC,EAAE,CACL,CAAC;QACF,OAAO,yBAAyB,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kGAAkG;QAClG,kGAAkG;QAClG,6CAA6C;QAC7C,GAAG,CAAC,4BAA6B,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC,uGAAuG,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC"}