@open-everywhere/provider-discord 0.1.0

package/dist/agent/channels/discord-bot-name.js

@@ -0,0 +1,98 @@
+// discord-bot-name — the bot's OWN handle on Discord, read from `GET /users/@me` (OPE-610). The
+// discord arm of core's per-surface bot-display-name registry (identity/bot-display-name.ts), so a
+// Discord-pinned session's instructions can name the address this deployment's app is mentioned by.
+//
+// ── A HANDLE, NOT AN IDENTITY (OPE-610) ──────────────────────────────────────────────────────────
+// Tommy settled the naming model on the ticket (2026-08-18): one org agent keeps ONE name
+// (`identity.name`) on every surface it speaks through; a per-surface app's own display name is a
+// HANDLE/address, never a substitute identity. This arm answers "what is this app's own Discord
+// account called" — instructions/access.ts is the ONLY consumer, and it renders the answer as a
+// handle line ("your mention/handle on Discord appears as X"), never as the identity line. That
+// split lives in access.ts, not here; this module's only job is a correct, cached answer to
+// `GET /users/@me`.
+//
+// ── WHY A NEW CALL, NOT THE PER-MESSAGE RELAY VALUE ──────────────────────────────────────────────
+// discord-gateway.ts already carries a `botName` PER MESSAGE (the relay's `bot.name`), which feeds
+// the wake name-drop matcher (`wakeNameDropTokens`, turn-delivery.ts) — that coupling is
+// deliberately untouched by this change; a resolver that disagreed with the per-message value would
+// leave the agent recognising one name in backscroll and being told about a different one in its
+// instructions. The registry arm needs a CACHED, delivery-independent answer (the assembler renders
+// the identity/handle block on every turn, not just on a delivery that happens to carry `bot.name`),
+// so it calls Discord directly and memoises the result — the same shape teams-bot-name.ts uses for
+// Microsoft Graph.
+//
+// ── WHICH FIELD ──────────────────────────────────────────────────────────────────────────────────
+// `GET /users/@me` returns `username` (the account's Discord username) and `global_name` (the
+// newer display name shown in clients; frequently `null` for a bot account, which almost never sets
+// one). `global_name` wins when present and non-blank — it is what a human actually SEES beside the
+// bot's messages — and `username` is the fallback every bot account always has.
+//
+// ── CACHING ──────────────────────────────────────────────────────────────────────────────────────
+// One memoised promise per instance, matching the slack/teams arms exactly: the instruction
+// assembler renders the handle line every turn, so an uncached arm would add a REST round trip per
+// turn. A rename needs a cold start to take effect. A FAILED resolution is cached too, so a
+// deployment missing the token does not re-probe Discord on every turn.
+const DISCORD_API_BASE = "https://discord.com/api/v10";
+const liveDiscordSelfRequest = async () => {
+    const token = process.env.DISCORD_BOT_TOKEN;
+    if (!token)
+        throw new Error("bot-display-name: DISCORD_BOT_TOKEN is not set.");
+    const res = await fetch(`${DISCORD_API_BASE}/users/@me`, {
+        headers: { authorization: `Bot ${token}` },
+    });
+    if (!res.ok)
+        throw new Error(`bot-display-name: Discord GET /users/@me failed (HTTP ${res.status}).`);
+    return res.json();
+};
+function trimmedName(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * The bot's own Discord handle — `global_name` when Discord reports one, else `username` — or
+ * `undefined` when neither resolves. Pure but for the injected `req`, so the resolution rule is
+ * unit-testable with a canned requester: no token mint and no network call. FAIL-SOFT on
+ * everything: a thrown request (no token / non-ok status / transport failure) and a response that
+ * is not an object both read `undefined`.
+ */
+export async function discordBotDisplayNameViaRest(req) {
+    try {
+        const json = (await req());
+        return trimmedName(json?.global_name) ?? trimmedName(json?.username);
+    }
+    catch {
+        return undefined; // no token / 401 / transport failure ⇒ core renders no handle line
+    }
+}
+/** The memoised per-instance promise — see the CACHING note in the header. */
+let handlePromise;
+/** Live arm: {@link discordBotDisplayNameViaRest} through the real REST transport, resolved once
+ *  per instance and registered into core's registry from register.ts. */
+export const discordBotDisplayName = () => {
+    if (!handlePromise) {
+        handlePromise = (async () => {
+            try {
+                // The memoised value is a PROMISE and instruction assembly awaits it on every Discord turn,
+                // so a hung REST call would block every turn on the instance, not one. The race bounds it:
+                // a stall settles the memo to `undefined` (no handle line), same as any other miss —
+                // matching teams-bot-name.ts's bound.
+                const timeout = new Promise((resolve) => {
+                    const t = setTimeout(() => resolve(undefined), 5000);
+                    t.unref?.();
+                });
+                return await Promise.race([discordBotDisplayNameViaRest(liveDiscordSelfRequest), timeout]);
+            }
+            catch {
+                return undefined;
+            }
+        })();
+    }
+    return handlePromise;
+};
+/** Test seam: drop the memoised handle so one test cannot inherit another's. */
+export function _resetDiscordBotDisplayNameForTest() {
+    handlePromise = undefined;
+}
+//# sourceMappingURL=discord-bot-name.js.map

package/dist/agent/channels/discord-bot-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-bot-name.js","sourceRoot":"","sources":["../../../agent/channels/discord-bot-name.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,0FAA0F;AAC1F,kGAAkG;AAClG,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,4FAA4F;AAC5F,oBAAoB;AACpB,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,yFAAyF;AACzF,oGAAoG;AACpG,iGAAiG;AACjG,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,mBAAmB;AACnB,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,oGAAoG;AACpG,oGAAoG;AACpG,gFAAgF;AAChF,EAAE;AACF,oGAAoG;AACpG,4FAA4F;AAC5F,mGAAmG;AACnG,4FAA4F;AAC5F,wEAAwE;AAIxE,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAOvD,MAAM,sBAAsB,GAAyB,KAAK,IAAI,EAAE;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,YAAY,EAAE;QACvD,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,EAAE,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACtG,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC,CAAC;AASF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,GAAyB;IAC1E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAA2B,CAAC;QACrD,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,mEAAmE;IACvF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,IAAI,aAAsD,CAAC;AAE3D;yEACyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAsB,GAAG,EAAE;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,4FAA4F;gBAC5F,2FAA2F;gBAC3F,qFAAqF;gBACrF,sCAAsC;gBACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;oBACjD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;oBACrD,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,kCAAkC;IAChD,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC"}

package/dist/agent/channels/discord-channel-info.d.ts

@@ -0,0 +1,22 @@
+/** The channel facts both consumers read. `parentId` is set ONLY for threads. */
+export interface DiscordChannelInfo {
+    readonly name?: string;
+    /** Present (with a thread type) when the channel is a THREAD — its parent channel id. */
+    readonly parentId?: string;
+    readonly isThread: boolean;
+}
+/** Injectable seams (tests swap both; live callers pass nothing). */
+export interface DiscordInfoDeps {
+    readonly fetchFn?: typeof fetch;
+    readonly token?: string;
+}
+/** Test hook: drop every cached verdict (unit suites re-run lookups with fresh fakes). */
+export declare function clearDiscordInfoCacheForTest(): void;
+export declare function fetchDiscordInfo(kind: "channels" | "guilds", id: string, deps?: DiscordInfoDeps): Promise<DiscordChannelInfo | undefined>;
+/**
+ * The parent channel id of a Discord THREAD, or undefined for a non-thread channel or
+ * ANY lookup failure. The grain consumer's convenience: undefined means "keep today's
+ * thread-grain behaviour" (fail-open — parent resolution must never block a turn).
+ */
+export declare function threadParentChannelId(channelId: string, deps?: DiscordInfoDeps): Promise<string | undefined>;
+//# sourceMappingURL=discord-channel-info.d.ts.map

package/dist/agent/channels/discord-channel-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-channel-info.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-channel-info.ts"],"names":[],"mappings":"AAcA,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AASD,0FAA0F;AAC1F,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,GAAG,QAAQ,EAC3B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CA4BzC;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGtH"}

package/dist/agent/channels/discord-channel-info.js

@@ -0,0 +1,65 @@
+// Shared Discord channel-info lookup — `GET /channels/{id}` (and `GET /guilds/{id}`)
+// via the bot token, cached per id. ONE impl + ONE cache for the two consumers that
+// need the same facts:
+//   - approvals/scope-label.ts — friendly card labels ("#parent · thread \"…\"");
+//   - channels/discord-gateway.ts — thread→parent grain resolution (backlog item 22):
+//     a Discord thread is its OWN channel id, so domain/spend grain must resolve the
+//     PARENT channel or a thread silently falls out of its channel's domain and cap.
+//
+// FAIL-OPEN BY CONTRACT: every failure (no token, non-ok status, network error,
+// malformed body) resolves `undefined` — the caller degrades (raw key on a card,
+// thread-grain accounting on the gateway), never blocks or throws. The bot token is a
+// SECRET — header only, never logged. Verdicts (including some failures — see the
+// cache note) are cached in-process; a serverless instance pays each lookup once.
+// Promise-cached per `kind:id` — concurrent callers share one in-flight request, and a
+// settled result (including `undefined` from a hard failure) is kept for the instance's
+// life: names/parents change on admin edits, not per message, and the pre-extraction
+// scope-label cache behaved exactly this way (a card propose + its decided re-render
+// must not pay twice).
+const infoCache = new Map();
+/** Test hook: drop every cached verdict (unit suites re-run lookups with fresh fakes). */
+export function clearDiscordInfoCacheForTest() {
+    infoCache.clear();
+}
+export function fetchDiscordInfo(kind, id, deps = {}) {
+    const key = `${kind}:${id}`;
+    let p = infoCache.get(key);
+    if (!p) {
+        p = (async () => {
+            const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+            if (!token)
+                return undefined;
+            try {
+                const doFetch = deps.fetchFn ?? fetch;
+                const res = await doFetch(`https://discord.com/api/v10/${kind}/${id}`, {
+                    headers: { authorization: `Bot ${token}` },
+                });
+                if (!res.ok)
+                    return undefined;
+                const body = (await res.json());
+                const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : undefined;
+                const isThread = body.type === 10 || body.type === 11 || body.type === 12;
+                const parentId = isThread && typeof body.parent_id === "string" && body.parent_id ? body.parent_id : undefined;
+                // A nameless channel resolves undefined wholesale — kept from the original
+                // scope-label impl (its callers require the name), and harmless for the grain
+                // consumer: every real guild channel/thread carries a name.
+                return name ? { name, parentId, isThread } : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        infoCache.set(key, p);
+    }
+    return p;
+}
+/**
+ * The parent channel id of a Discord THREAD, or undefined for a non-thread channel or
+ * ANY lookup failure. The grain consumer's convenience: undefined means "keep today's
+ * thread-grain behaviour" (fail-open — parent resolution must never block a turn).
+ */
+export async function threadParentChannelId(channelId, deps = {}) {
+    const info = await fetchDiscordInfo("channels", channelId, deps);
+    return info?.parentId;
+}
+//# sourceMappingURL=discord-channel-info.js.map

package/dist/agent/channels/discord-channel-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-channel-info.js","sourceRoot":"","sources":["../../../agent/channels/discord-channel-info.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,oFAAoF;AACpF,uBAAuB;AACvB,kFAAkF;AAClF,sFAAsF;AACtF,qFAAqF;AACrF,qFAAqF;AACrF,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,sFAAsF;AACtF,kFAAkF;AAClF,kFAAkF;AAgBlF,uFAAuF;AACvF,wFAAwF;AACxF,qFAAqF;AACrF,qFAAqF;AACrF,uBAAuB;AACvB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmD,CAAC;AAE7E,0FAA0F;AAC1F,MAAM,UAAU,4BAA4B;IAC1C,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,EAAU,EACV,IAAI,GAAoB,EAAE;IAE1B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC1D,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;gBACtC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,+BAA+B,IAAI,IAAI,EAAE,EAAE,EAAE;oBACrE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,EAAE,EAAE;iBAC3C,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,OAAO,SAAS,CAAC;gBAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAC;gBAC3F,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC1E,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/G,2EAA2E;gBAC3E,8EAA8E;gBAC9E,4DAA4D;gBAC5D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,IAAI,GAAoB,EAAE;IACvF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,IAAI,EAAE,QAAQ,CAAC;AACxB,CAAC"}

package/dist/agent/channels/discord-directory.d.ts

@@ -0,0 +1,11 @@
+import { type DirectoryCandidate } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Every account in the DECLARED guilds whose username or nickname matches `query`, as
+ * `{nativeId, name, handle}`. Fail-soft to `[]`; never throws.
+ *
+ * `tenant` is deliberately unused: Discord is not a tenant-scoped platform (core
+ * identity/principal-key.ts), so a Discord principal id is vendor-global and core never passes one.
+ * The guild set comes from this deployment's own config instead — see the header.
+ */
+export declare function fetchGuildDirectory(query: string): Promise<readonly DirectoryCandidate[]>;
+//# sourceMappingURL=discord-directory.d.ts.map

package/dist/agent/channels/discord-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-directory.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-directory.ts"],"names":[],"mappings":"AAkDA,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AA+BhH;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAgC/F"}

package/dist/agent/channels/discord-directory.js

@@ -0,0 +1,170 @@
+// THE DISCORD ACCOUNT DIRECTORY — "who, in the guilds this deployment serves, is called that?"
+// (OPE-623). The Discord arm of core's identity/account-directory.ts registry, and the second one
+// ever written; the Slack arm (`fetchWorkspaceRoster`, provider-slack channels/slack-events.ts) is
+// the shape this follows.
+//
+// WHAT IT IS FOR. The reverse-initiated identity link (core identity/link-flow.ts) lets a person NAME
+// the other account instead of carrying a bearer code between two surfaces. Naming needs a lookup,
+// and this is Discord's. Core owns the matching, the ranking and the cap (`rankDirectoryCandidates`,
+// pure), so this arm may over-return.
+//
+// 🔴 A DIRECTORY HIT IS NOT EVIDENCE OF ANYTHING. It says an account with that name is in one of
+// these guilds — nothing about whose it is. Anybody can set their Discord display name to "Tommy
+// Long", and a guild nickname is set per guild by the member themselves. The proof in this flow is
+// the CONSENT the named account gives in its own DM, which is why this arm is useless without
+// {@link deliverDiscordDirectMessage} and why core requires both before it will offer the transport.
+//
+// TWO DIVERGENCES FROM THE SLACK ARM, both forced by the platform:
+//
+//   1. THE SEARCH IS SERVER-SIDE. Slack has no user-search method, so its arm walks the whole
+//      roster (up to ten pages) and caches it for a minute. Discord has
+//      `GET /guilds/{guild}/members/search?query=` — Discord itself does the prefix match against
+//      username and nickname and answers with the matches. So this arm makes ONE call per guild per
+//      search and holds NO cache: there is no ten-page walk to collapse, and a second search in the
+//      same turn is a DIFFERENT query, which a roster cache could not have served anyway.
+//   2. THERE IS NO SINGLE "WORKSPACE". Slack's arm has one workspace because a bot token has one.
+//      A Discord bot is in every guild it was invited to, so the population this deployment may
+//      search is the set of guilds its own config DECLARES — `admittedTenantsFromConfig("discord")`,
+//      the same admitted set the wake door fences on. A guild nobody configured is never searched,
+//      so this arm can never surface a member of some unrelated server the bot happens to be in.
+//
+// 🔴 IT NEEDS THE PRIVILEGED `GUILD_MEMBERS` INTENT, and a deployment without it degrades cleanly.
+// Discord gates both member endpoints behind the SERVER MEMBERS INTENT toggle in the application's
+// own developer-portal settings. Without it the search answers 403, this arm resolves to nothing,
+// and `link_identity` falls back to the code transport by itself and says which capability was
+// missing. Tommy ruled directory rights are fine to REQUIRE for the better path; they are never a
+// precondition for linking at all. The refusal is LOGGED once per guild so an operator can act on
+// it — a silent empty answer reads as "nobody matched", which is a different and misleading fact.
+//
+// A RAW ID IS LOOKED UP DIRECTLY. `rankDirectoryCandidates` matches `nativeId` exactly, so pasting a
+// snowflake should find precisely that account — but Discord's search matches names, never ids, so
+// the search alone would answer nothing. A query that is SHAPED like a snowflake therefore also gets
+// a `GET /guilds/{guild}/members/{user}`, whose 404 is the platform's own "not in this guild".
+//
+// FAIL-SOFT PER GUILD. A refused, failed, hung or unreadable guild contributes nothing and the other
+// guilds still answer. Nothing here throws: core's resolver catches, but an arm that leans on that
+// would lose every OTHER guild's rows to one guild's 403.
+//
+// BOTS ARE DROPPED. A link is a statement about a HUMAN, and the consent step would DM a bot that
+// can never answer.
+import { admittedTenantsFromConfig } from "@open-everywhere/core/agent/adapter-api.js";
+const API = "https://discord.com/api/v10";
+/** How many matches one guild's search may return. Core caps the ANSWER at
+ *  `DIRECTORY_MAX_CANDIDATES` (8) after ranking across every guild, so this is deliberately larger:
+ *  a first name that matches twelve people in one guild must not lose the right person to an
+ *  arbitrary Discord-side truncation before core ever ranks them. Discord's own ceiling is 1000. */
+const DISCORD_MEMBER_SEARCH_LIMIT = 25;
+/** How many guilds one search may touch. A deployment declaring more servers than this is not a
+ *  shape we have; the bound exists so a config change can never turn a human-paced lookup into an
+ *  unbounded fan-out of live calls inside one turn. A stop is logged rather than silent. */
+const DISCORD_DIRECTORY_MAX_GUILDS = 8;
+/** A Discord snowflake as a person would paste one: digits only, and long enough to be an id rather
+ *  than someone whose display name is "1234". Discord ids are 17–19 digits today and the epoch makes
+ *  them grow, so the upper bound is generous. */
+const SNOWFLAKE = /^\d{17,20}$/u;
+function log(msg) {
+    console.log(`[open-everywhere:discord-directory] ${msg}`);
+}
+/**
+ * Every account in the DECLARED guilds whose username or nickname matches `query`, as
+ * `{nativeId, name, handle}`. Fail-soft to `[]`; never throws.
+ *
+ * `tenant` is deliberately unused: Discord is not a tenant-scoped platform (core
+ * identity/principal-key.ts), so a Discord principal id is vendor-global and core never passes one.
+ * The guild set comes from this deployment's own config instead — see the header.
+ */
+export async function fetchGuildDirectory(query) {
+    const token = process.env.DISCORD_BOT_TOKEN;
+    if (!token)
+        return [];
+    // The same normalization core's matcher applies (`@tommy` and `tommy` are one query to a person),
+    // done here too because Discord's search would take the `@` literally and match nothing.
+    const q = query.trim().replace(/^@/u, "");
+    if (q.length === 0)
+        return [];
+    const guilds = [...admittedTenantsFromConfig("discord")];
+    if (guilds.length === 0)
+        return [];
+    if (guilds.length > DISCORD_DIRECTORY_MAX_GUILDS) {
+        log(`this deployment declares ${guilds.length} guilds — searching the first ${DISCORD_DIRECTORY_MAX_GUILDS}; a wider search may not see every member.`);
+    }
+    // 🔴 THE GUILDS ARE SEARCHED CONCURRENTLY, and that is about the ARM TIMEOUT rather than speed.
+    // Core gives an arm 8 seconds and answers `[]` when it overruns (identity/account-directory.ts) —
+    // so eight guilds searched one after another could turn a working directory into an empty one on a
+    // slow day, and the person would see the code fallback with no way to tell why. The fan-out is
+    // bounded by DISCORD_DIRECTORY_MAX_GUILDS above, so "concurrent" here means at most eight calls.
+    const perGuild = await Promise.all(guilds.slice(0, DISCORD_DIRECTORY_MAX_GUILDS).map((guild) => guildMembersMatching(token, guild, q)));
+    // Deduped across guilds: one person in three declared servers is ONE account, and three identical
+    // rows would crowd the other candidates out of core's cap. `perGuild` keeps the declared order, so
+    // which guild's nickname wins is deterministic rather than a race.
+    const byId = new Map();
+    for (const members of perGuild) {
+        for (const member of members) {
+            const candidate = candidateFromMember(member);
+            if (candidate && !byId.has(candidate.nativeId))
+                byId.set(candidate.nativeId, candidate);
+        }
+    }
+    return [...byId.values()];
+}
+/** One guild's matches for `q` — the name search, plus the direct id read when `q` is a snowflake.
+ *  Never throws: a guild that refuses contributes nothing and the caller moves on. */
+async function guildMembersMatching(token, guildId, q) {
+    const out = [];
+    const search = await guildRequest(token, `${API}/guilds/${encodeURIComponent(guildId)}/members/search?query=${encodeURIComponent(q)}&limit=${DISCORD_MEMBER_SEARCH_LIMIT}`, guildId, "member search");
+    if (Array.isArray(search))
+        out.push(...search);
+    if (SNOWFLAKE.test(q)) {
+        // A 404 here is Discord's own "not in this guild" and is the ordinary answer, so `guildRequest`
+        // does not log it. Anything readable is one member object rather than an array.
+        const one = await guildRequest(token, `${API}/guilds/${encodeURIComponent(guildId)}/members/${encodeURIComponent(q)}`, guildId, "member read");
+        if (one && typeof one === "object" && !Array.isArray(one))
+            out.push(one);
+    }
+    return out;
+}
+/** One GET under the bot token, or undefined. The token is a SECRET — header only, never a log line,
+ *  an error string or a return value (the same rule channels/discord-post.ts states). */
+async function guildRequest(token, url, guildId, what) {
+    try {
+        const res = await fetch(url, { headers: { authorization: `Bot ${token}` } });
+        if (!res.ok) {
+            // 403 is nearly always the missing SERVER MEMBERS INTENT — the one failure an operator can
+            // fix, and the one a silent empty answer would hide. 404 on the direct read is the ordinary
+            // "not in this guild" and is not news.
+            if (res.status !== 404) {
+                log(`${what} did not answer (${res.status}) for guild ${guildId} — the account directory is unavailable there; linking falls back to the code flow. A 403 usually means the SERVER MEMBERS INTENT is off for this app.`);
+            }
+            return undefined;
+        }
+        return (await res.json());
+    }
+    catch (err) {
+        log(`${what} failed for guild ${guildId}: ${err?.message ?? String(err)}`);
+        return undefined;
+    }
+}
+/**
+ * One member row as a candidate, or undefined when it names no human account.
+ *
+ * `handle` is the account's GLOBAL username (unique across Discord since the username migration) and
+ * `name` prefers the guild NICKNAME, because that is the name the people in that server actually see
+ * and therefore the name the initiator will type. Both are self-set strings; core sanitizes them and
+ * the tool fences them before a model reads either.
+ */
+function candidateFromMember(member) {
+    const user = member?.user;
+    if (!user || typeof user !== "object")
+        return undefined;
+    if (user.bot === true)
+        return undefined; // a bot is a guild member and is not a person
+    const nativeId = typeof user.id === "string" ? user.id.trim() : "";
+    if (nativeId.length === 0)
+        return undefined;
+    const username = typeof user.username === "string" ? user.username.trim() : "";
+    const globalName = typeof user.global_name === "string" ? user.global_name.trim() : "";
+    const nick = typeof member.nick === "string" ? member.nick.trim() : "";
+    const name = nick || globalName || username;
+    return { nativeId, ...(name ? { name } : {}), ...(username ? { handle: username } : {}) };
+}
+//# sourceMappingURL=discord-directory.js.map

package/dist/agent/channels/discord-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-directory.js","sourceRoot":"","sources":["../../../agent/channels/discord-directory.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,0BAA0B;AAC1B,EAAE;AACF,sGAAsG;AACtG,mGAAmG;AACnG,qGAAqG;AACrG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,8FAA8F;AAC9F,qGAAqG;AACrG,EAAE;AACF,mEAAmE;AACnE,EAAE;AACF,8FAA8F;AAC9F,wEAAwE;AACxE,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,0FAA0F;AAC1F,kGAAkG;AAClG,gGAAgG;AAChG,qGAAqG;AACrG,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,qGAAqG;AACrG,+FAA+F;AAC/F,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,0DAA0D;AAC1D,EAAE;AACF,kGAAkG;AAClG,oBAAoB;AAEpB,OAAO,EAAE,yBAAyB,EAA2B,MAAM,4CAA4C,CAAC;AAEhH,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAE1C;;;oGAGoG;AACpG,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC;;4FAE4F;AAC5F,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC;;iDAEiD;AACjD,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,kGAAkG;IAClG,yFAAyF;IACzF,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,CAAC,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QACjD,GAAG,CAAC,4BAA4B,MAAM,CAAC,MAAM,iCAAiC,4BAA4B,4CAA4C,CAAC,CAAC;IAC1J,CAAC;IAED,gGAAgG;IAChG,kGAAkG;IAClG,mGAAmG;IACnG,+FAA+F;IAC/F,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExI,kGAAkG;IAClG,mGAAmG;IACnG,mEAAmE;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;sFACsF;AACtF,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,OAAe,EAAE,CAAS;IAC3E,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,GAAG,WAAW,kBAAkB,CAAC,OAAO,CAAC,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,UAAU,2BAA2B,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IACtM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAI,MAA+B,CAAC,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,gGAAgG;QAChG,gFAAgF;QAChF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,GAAG,WAAW,kBAAkB,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/I,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;yFACyF;AACzF,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,GAAW,EAAE,OAAe,EAAE,IAAY;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2FAA2F;YAC3F,4FAA4F;YAC5F,uCAAuC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,GAAG,CAAC,GAAG,IAAI,oBAAoB,GAAG,CAAC,MAAM,eAAe,OAAO,wJAAwJ,CAAC,CAAC;YAC3N,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,IAAI,qBAAqB,OAAO,KAAM,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,MAA0B;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC,CAAC,8CAA8C;IACvF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,IAAI,UAAU,IAAI,QAAQ,CAAC;IAC5C,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC"}

package/dist/agent/channels/discord-dispatch-target.d.ts

@@ -0,0 +1,15 @@
+import type { Routine, DispatchTarget } from "@open-everywhere/core/agent/adapter-api.js";
+export declare function resolveDiscordTarget(r: Routine): DispatchTarget | null;
+/**
+ * Derive a post-back target for a CONFIGURED Discord report channel ({@link Domain.reportChannel},
+ * OPE-148) from its surfaceKey alone — no stored row, no live binding.
+ *
+ * A Discord surfaceKey is `discord/<guildId>/<channelId>` (approvals/flow.ts postedToSurfaceKey and
+ * discordDecisionWakeTarget both build it that way), so the third segment IS the channel id and
+ * `{ channelId }` is exactly what {@link resolveDiscordTarget} would have read off a stored target.
+ * Mode is deliberately NOT derived: a configured report channel is a guild channel by construction
+ * (a DM cannot be a domain member), and the absent `channelType` lands on the conservative
+ * "channel" arm above — capped rather than spend-exempt, which is the safe direction.
+ */
+export declare function discordReportTargetFor(surfaceKey: string): Readonly<Record<string, unknown>> | null;
+//# sourceMappingURL=discord-dispatch-target.d.ts.map

package/dist/agent/channels/discord-dispatch-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-dispatch-target.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-dispatch-target.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAkC,MAAM,4CAA4C,CAAC;AAW1H,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CA+DtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAInG"}

package/dist/agent/channels/discord-dispatch-target.js

@@ -0,0 +1,99 @@
+// discord-dispatch-target — Discord's routine-dispatch target resolver (OPE-114 stage 4).
+// Moved out of core's schedules/dispatch.ts (resolveDiscordTarget) and registered on the unified
+// routine-dispatch seam (schedules/routine-dispatch.ts registerRoutineDispatch, shared with teams)
+// by registerDiscordProvider(). The bundle imports its own eve channel object directly,
+// which is what retired the interim per-platform dispatch-channel registry the first cut of this
+// extraction used — one seam, not two.
+//
+// Post-back = a channel message via Discord's REST create-message endpoint (bot token) — eve's
+// discordChannel().receive owns the send; NO Gateway websocket is involved (that transport is
+// inbound-ambient only). Target = `{ channelId }`.
+import discord from "./discord.js";
+/** One stored-target field as a non-empty string, or undefined (never a coerced non-string — the
+ *  store row is data, validated on the way out, not trusted). Local copy of core dispatch.ts's
+ *  module-private `storedString`. */
+function storedString(t, key) {
+    const v = t?.[key];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+export function resolveDiscordTarget(r) {
+    const channelId = storedString(r.target, "channelId");
+    if (!channelId)
+        return null;
+    const channelType = storedString(r.target, "channelType");
+    // Mode from the stored channel type ONLY ("1" DM / "3" group DM — see discord-identity.ts).
+    // discordMode's no-guild→dm rule is deliberately NOT reused here: it is sound for a live
+    // interaction (no guild id on the payload ⇒ a DM) but unsound for a stored target that may
+    // simply predate guildId capture — and a guild channel wrongly classed "dm" would slip the
+    // spend cap. Ambiguous ⇒ "channel" (capped — the conservative arm).
+    const mode = channelType === "1" ? "dm" : channelType === "3" ? "mpim" : "channel";
+    const storedGuildId = storedString(r.target, "guildId");
+    // guild_id (for ATTRIBUTES only, below) falls back to the surfaceKey's workspace segment for
+    // targets that predate guildId capture — the same fallback the attributes use, so the origin and
+    // bindDiscord's re-derived workspace always agree.
+    const guildId = storedGuildId ?? r.surfaceKey.split("/")[1] ?? "";
+    // OPE-486 — the fire's WAKE ORIGIN, parity with resolveSlackTarget (routine-dispatch.ts). Absent
+    // before this fix, so a Discord fire could never divert into the unified window (fire-window.ts's
+    // planFireWindow fails closed on a missing origin). Two shapes, matching the codec's XOR
+    // (discord-origin-codec.ts): a DM/group-DM fire (mode "dm"/"mpim") gets the `dm: true` variant —
+    // NEVER a guild-shaped origin with a possibly-empty guildId, which the codec refuses by
+    // construction (D1/D3). Every other fire gets the guild variant; an empty guildId (only possible
+    // when the surfaceKey itself carries none) fails isUnifiedWakeOrigin downstream and the fire
+    // stays native — fail-closed, not a guess. No messageId/autoThreadName: a proactive fire has no
+    // triggering message to anchor to.
+    //
+    // OPE-503 — GUILD EVIDENCE, NOT JUST "NOT A KNOWN DM MODE". A row with neither a stored
+    // channelType nor a stored guildId (a LEGACY row, pre-dating both captures) carries NO positive
+    // signal it is a guild surface. bindDiscord derives workspace as `guildId ?? userId`, so on an
+    // equally-legacy DM row the surfaceKey's workspace segment is the partner's user id, not a guild
+    // id — and the attributes-level `guildId` fallback above cannot tell the two apart either (that
+    // is fine for attributes, see the comment below, but NOT for an origin: the codec's guild arm
+    // only checks non-empty, so a user id validates, and the fire then diverts under
+    // `discord/<userId>/<channelId>` — a guild-shaped routing key minted from a DM). Mint the guild
+    // origin only when there is real evidence of a guild: an explicitly stored guildId, or a
+    // channelType that positively names a non-DM channel. Otherwise leave `origin` absent — the
+    // documented fail-closed default (DispatchTarget.origin) — so the fire still posts natively; it
+    // just does not divert into the unified window on a guess.
+    const guildEvidence = storedGuildId !== undefined || channelType !== undefined;
+    const origin = mode === "dm" || mode === "mpim"
+        ? { platform: "discord", channelId, dm: true }
+        : guildEvidence
+            ? { platform: "discord", channelId, guildId }
+            : undefined;
+    return {
+        channel: discord,
+        // Strict DiscordReceiveTarget shape — guildId/channelType feed attributes only.
+        target: { channelId },
+        mode,
+        // The facts bindDiscord reads. guild_id falls back to the surfaceKey's workspace segment for
+        // targets that predate guildId capture: bindDiscord derives workspace as `guildId ?? userId`,
+        // so that segment IS the original guild id for a guild routine and the creator's user id for
+        // a DM routine — stamping it back yields the identical workspace either way (attribution lands
+        // right; only the legacy DM's mode stays the conservative "channel"). Unlike `origin` above,
+        // this fallback is harmless on a legacy DM row: bindDiscord treats it as an opaque workspace
+        // identity, never as a guild-keyed authority.
+        attributes: {
+            channel_id: channelId,
+            guild_id: guildId,
+            ...(channelType ? { channel_type: channelType } : {}),
+        },
+        ...(origin !== undefined ? { origin } : {}),
+    };
+}
+/**
+ * Derive a post-back target for a CONFIGURED Discord report channel ({@link Domain.reportChannel},
+ * OPE-148) from its surfaceKey alone — no stored row, no live binding.
+ *
+ * A Discord surfaceKey is `discord/<guildId>/<channelId>` (approvals/flow.ts postedToSurfaceKey and
+ * discordDecisionWakeTarget both build it that way), so the third segment IS the channel id and
+ * `{ channelId }` is exactly what {@link resolveDiscordTarget} would have read off a stored target.
+ * Mode is deliberately NOT derived: a configured report channel is a guild channel by construction
+ * (a DM cannot be a domain member), and the absent `channelType` lands on the conservative
+ * "channel" arm above — capped rather than spend-exempt, which is the safe direction.
+ */
+export function discordReportTargetFor(surfaceKey) {
+    const segs = surfaceKey.split("/");
+    const channelId = segs.length === 3 && segs[0] === "discord" ? segs[2] : undefined;
+    return channelId && channelId.length > 0 ? { channelId } : null;
+}
+//# sourceMappingURL=discord-dispatch-target.js.map

package/dist/agent/channels/discord-dispatch-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-dispatch-target.js","sourceRoot":"","sources":["../../../agent/channels/discord-dispatch-target.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,iGAAiG;AACjG,mGAAmG;AACnG,wFAAwF;AACxF,iGAAiG;AACjG,uCAAuC;AACvC,EAAE;AACF,+FAA+F;AAC/F,8FAA8F;AAC9F,mDAAmD;AAGnD,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC;;qCAEqC;AACrC,SAAS,YAAY,CAAC,CAAoB,EAAE,GAAW;IACrD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAU;IAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1D,4FAA4F;IAC5F,yFAAyF;IACzF,2FAA2F;IAC3F,2FAA2F;IAC3F,oEAAoE;IACpE,MAAM,IAAI,GAAgB,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,6FAA6F;IAC7F,iGAAiG;IACjG,mDAAmD;IACnD,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,iGAAiG;IACjG,kGAAkG;IAClG,yFAAyF;IACzF,iGAAiG;IACjG,wFAAwF;IACxF,iGAAiG;IACjG,6FAA6F;IAC7F,gGAAgG;IAChG,mCAAmC;IACnC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,gGAAgG;IAChG,8FAA8F;IAC9F,iFAAiF;IACjF,gGAAgG;IAChG,yFAAyF;IACzF,4FAA4F;IAC5F,gGAAgG;IAChG,2DAA2D;IAC3D,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC;IAC/E,MAAM,MAAM,GACV,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM;QAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE;QAC9C,CAAC,CAAC,aAAa;YACb,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,gFAAgF;QAChF,MAAM,EAAE,EAAE,SAAS,EAAE;QACrB,IAAI;QACJ,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,8CAA8C;QAC9C,UAAU,EAAE;YACV,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,OAAO,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC"}

package/dist/agent/channels/discord-events.d.ts

@@ -0,0 +1,58 @@
+import { type Channel, type RouteHandlerArgs } from "eve/channels";
+/** The public URL to paste into the app's developer-portal **Webhooks** page (NOT the
+ *  Interactions Endpoint URL, which stays {@link PUBLIC_DISCORD_ROUTE}). */
+export declare const PUBLIC_DISCORD_EVENTS_ROUTE = "/eve/v1/discord/events";
+/** The decision one verified Webhook Events body resolves to. `ack` covers everything we
+ *  deliberately don't act on (a PING, an entitlement/social-SDK event, an unparseable body) —
+ *  all of which still get Discord's required 204. */
+export type DiscordEventDecision = {
+    readonly kind: "ack";
+    readonly reason: string;
+} | {
+    readonly kind: "audit";
+    readonly action: string;
+    readonly workspace: string;
+    readonly principalId?: string;
+    readonly detail: Record<string, unknown>;
+};
+/**
+ * Classify one raw Webhook Events body. PURE — no I/O, so every branch is unit-tested.
+ *
+ * The audit partition mirrors what the rest of the Discord surface uses: the GUILD is the
+ * workspace (the org boundary — `bindDiscord` maps guild→workspace), and the authorizing user is
+ * the principal. A USER install (integration_type 1) has no guild at all, so it partitions under
+ * the sentinel workspace `user-install` rather than being forced into a guild it doesn't have —
+ * a fabricated workspace id would be worse than an honest one.
+ */
+export declare function classifyDiscordEvent(rawBody: string): DiscordEventDecision;
+/** Injectable seams so the route is testable without live crypto env or the real store. */
+export interface DiscordEventsOptions {
+    /** The app public key; defaults to DISCORD_PUBLIC_KEY (the same env the interactions path reads). */
+    readonly publicKey?: string;
+    readonly now?: () => number;
+    /** Audit writer (defaults to the real appendAudit under the deployment org). */
+    readonly audit?: (row: {
+        action: string;
+        workspace: string;
+        principalId?: string;
+        detail: Record<string, unknown>;
+    }) => Promise<void>;
+}
+/**
+ * Build the Webhook Events route handler: verify (fail-closed 401), classify, audit, ack.
+ *
+ * The audit write is deliberately AWAITED rather than backgrounded — a `surface.app_*` row is one
+ * cheap insert and Discord's budget is 3 seconds, so we'd rather the row land than shave a
+ * millisecond. It is also wrapped: an audit failure must never turn into a non-2xx, because
+ * Discord retries a failure and then suspends the endpoint — losing the very observability this
+ * route exists to provide.
+ */
+export declare function buildDiscordEventsHandler(opts?: DiscordEventsOptions): (req: Request, args: RouteHandlerArgs) => Promise<Response>;
+/**
+ * Mount the Webhook Events route onto the Discord channel. Additive: it only PREPENDS a route to
+ * the same channel object (one channel name → one session namespace, the frontDiscordChannel
+ * shape), touching neither the interactions front nor eve's own adapter/receive. With no URL
+ * configured in the developer portal this route is simply never hit.
+ */
+export declare function withDiscordEventsRoute<C extends Channel<any, any, any>>(channel: C, opts?: DiscordEventsOptions): C;
+//# sourceMappingURL=discord-events.d.ts.map

package/dist/agent/channels/discord-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-events.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-events.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAQ,KAAK,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE;4EAC4E;AAC5E,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAUpE;;qDAEqD;AACrD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAU7J;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CA2C1E;AAED,2FAA2F;AAC3F,MAAM,WAAW,oBAAoB;IACnC,qGAAqG;IACrG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvI;AAKD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,oBAAyB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6BtI;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,GAAE,oBAAyB,GAAG,CAAC,CAEvH"}