@open-everywhere/provider-discord 0.1.0

package/dist/agent/channels/discord-interaction-defer.js

@@ -0,0 +1,102 @@
+// THE DEFERRED INTERACTION RESPONSE (OPE-1282) — how a Discord door answers work that outlasts the
+// three-second interaction token.
+//
+// WHAT WAS WRONG. Discord gives an interactions endpoint THREE SECONDS to answer, and it does NOT
+// redeliver an expired token. A door that decides first and answers second — `await the work, then
+// return the reply` — therefore has a window in which the work really lands and the person sees a
+// red "This interaction failed" over it. `access/discord-grant-click.ts` is that shape: an APPROVE
+// spends a 2000 ms borrow-read budget, then a CAS, a grant insert, audit rows and an awaited post
+// into the requesting room. When it overruns, the owner believes their approval failed while a
+// conversation can already spend their credential, and a second tap answers "that request is no
+// longer open" — true, and reading like a second failure. Slack does not have this: it redelivers an
+// interactivity payload it has not seen answered. Discord does not.
+//
+// THE SHAPE THAT CLOSES IT — ack, then decide, then edit:
+//   1. Answer the interaction IMMEDIATELY with {@link deferredEphemeralResponse} (`type 5`,
+//      DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE, `flags 64`). Discord renders "thinking…", privately,
+//      and the token is now good for fifteen minutes instead of three seconds.
+//   2. Do the work off the response path, under the host's `waitUntil`.
+//   3. Replace the placeholder with the real answer through {@link editOriginalInteractionResponse}.
+//
+// 🔴 THE EPHEMERAL FLAG RIDES THE DEFER, NOT THE EDIT, and that is not a style choice. Discord fixes
+// a response's visibility at the FIRST response; the follow-up edit carries no flags and cannot
+// change it. A defer sent without `flags 64` makes the eventual answer PUBLIC — on the grant door
+// that would publish one person's credential decision into the channel. The flag is therefore part
+// of the ack, and a test pins it.
+//
+// 🔴 THE FOLLOW-UP NEEDS NO BOT TOKEN AND NO NEW CONFIGURATION. The interaction webhook route is
+// authenticated by the interaction TOKEN itself, and both halves of the address — `application_id`
+// and `token` — ride the interaction payload Discord already signed. {@link interactionFollowUp}
+// reads them from that verified envelope and returns `undefined` when either is missing, which is
+// what lets a caller fall back to answering synchronously rather than deferring into silence.
+//
+// 🔴 THE INTERACTION TOKEN IS A CREDENTIAL. It authorises anyone holding it to write as the app for
+// fifteen minutes. It never reaches a log line, an error string or an audit row from this module —
+// `editOriginalInteractionResponse` builds the URL and reports only the HTTP status.
+//
+// EVERY WRITE GOES THROUGH `discordFetch` (the OPE-1236 seam), so the follow-up honours a 429's
+// `retry_after` like every other Discord write. `discord-rest-seam-test.ts` §3 reds on a bare
+// `fetch(` in this package, and this module holding its own would be exactly that.
+import { discordFetch } from "./discord-rest.js";
+const API = "https://discord.com/api/v10";
+/** Discord interaction-response wire constants, defined locally for the same reason each door
+ *  defines its own: this package holds no shared wire-constant module, and a door that cannot read
+ *  its own numbers is harder to review than one that repeats them. */
+const RESPONSE_DEFERRED_CHANNEL_MESSAGE = 5; // DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE
+const EPHEMERAL = 64; // MessageFlags.EPHEMERAL — only the clicker sees it
+function isObject(v) {
+    return typeof v === "object" && v !== null;
+}
+function str(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/**
+ * The follow-up address carried by one verified interaction envelope, or `undefined` when either
+ * half is absent.
+ *
+ * 🔴 `undefined` MUST MEAN "DO NOT DEFER". A door that deferred without an address would ack with
+ * "thinking…" and then have no way to say anything else — a permanent placeholder, which is worse
+ * than the slow answer this whole module exists to replace. Callers fall back to the synchronous
+ * shape instead. Unreachable on a real Discord payload (both fields are always present); written as
+ * a real branch because the alternative failure is silent and permanent.
+ */
+export function interactionFollowUp(raw) {
+    if (!isObject(raw))
+        return undefined;
+    const applicationId = str(raw["application_id"]);
+    const token = str(raw["token"]);
+    return applicationId === undefined || token === undefined ? undefined : { applicationId, token };
+}
+/** The immediate ack: "thinking…", visible only to the clicker. See the header for why the flag
+ *  cannot be moved to the follow-up. */
+export function deferredEphemeralResponse() {
+    return { type: RESPONSE_DEFERRED_CHANNEL_MESSAGE, data: { flags: EPHEMERAL } };
+}
+/**
+ * Replace the deferred placeholder with the real answer.
+ *
+ * NEVER THROWS. This runs off the response path, under `waitUntil`, on a decision that has ALREADY
+ * been made and written — an unsent follow-up costs the person their explanation, and throwing here
+ * would additionally poison whatever else that background promise carries. Returns whether the edit
+ * landed, so a caller can log the difference.
+ *
+ * The URL's `@original` is the deferred message itself; Discord has no other handle on it.
+ */
+export async function editOriginalInteractionResponse(followUp, content, deps = {}) {
+    try {
+        const res = await discordFetch("PATCH /webhooks/{application.id}/{interaction.token}/messages/@original", `${API}/webhooks/${encodeURIComponent(followUp.applicationId)}/${encodeURIComponent(followUp.token)}/messages/@original`, {
+            method: "PATCH",
+            // NO `authorization` HEADER, deliberately: the interaction token in the path IS the
+            // authorisation, and Discord rejects this route when a bot token is sent alongside it.
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ content }),
+        }, deps);
+        return res.ok;
+    }
+    catch {
+        // A 429 that outlasts the seam's attempts arrives as `RateLimitExhaustedError`; a transport
+        // failure arrives as itself. Neither may escape — see the paragraph above.
+        return false;
+    }
+}
+//# sourceMappingURL=discord-interaction-defer.js.map

package/dist/agent/channels/discord-interaction-defer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-interaction-defer.js","sourceRoot":"","sources":["../../../agent/channels/discord-interaction-defer.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,kCAAkC;AAClC,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,kGAAkG;AAClG,+FAA+F;AAC/F,gGAAgG;AAChG,qGAAqG;AACrG,oEAAoE;AACpE,EAAE;AACF,0DAA0D;AAC1D,4FAA4F;AAC5F,kGAAkG;AAClG,+EAA+E;AAC/E,wEAAwE;AACxE,qGAAqG;AACrG,EAAE;AACF,qGAAqG;AACrG,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,kCAAkC;AAClC,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,gGAAgG;AAChG,8FAA8F;AAC9F,mFAAmF;AAEnF,OAAO,EAAE,YAAY,EAAyB,MAAM,mBAAmB,CAAC;AAExE,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAE1C;;sEAEsE;AACtE,MAAM,iCAAiC,GAAG,CAAC,CAAC,CAAC,uCAAuC;AACpF,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,oDAAoD;AAS1E,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,OAAO,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AACnG,CAAC;AAED;wCACwC;AACxC,MAAM,UAAU,yBAAyB;IACvC,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAA6B,EAC7B,OAAe,EACf,IAAI,GAAqB,EAAE;IAE3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAC5B,yEAAyE,EACzE,GAAG,GAAG,aAAa,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,EACxH;YACE,MAAM,EAAE,OAAO;YACf,oFAAoF;YACpF,uFAAuF;YACvF,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;SAClC,EACD,IAAI,CACL,CAAC;QACF,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,2EAA2E;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/agent/channels/discord-message-ops.d.ts

@@ -0,0 +1,3 @@
+import type { SurfaceMessageOps } from "@open-everywhere/core/agent/adapter-api.js";
+export declare const discordMessageOps: SurfaceMessageOps;
+//# sourceMappingURL=discord-message-ops.d.ts.map

package/dist/agent/channels/discord-message-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-message-ops.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-message-ops.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,iBAAiB,EAAgB,MAAM,4CAA4C,CAAC;AAYlG,eAAO,MAAM,iBAAiB,EAAE,iBAoG/B,CAAC"}

package/dist/agent/channels/discord-message-ops.js

@@ -0,0 +1,123 @@
+// The Discord SurfaceMessageOps — the bot-token REST transport for the ANCILLARY chat message ops
+// generic core features dispatch through channels/surface-message-ops.ts (OPE-114 stage 4):
+//   - postText   — a plain create-message (the hosted-artifact URL, the float notice, the approval
+//                  decision notice). `replyToMessageId` anchors it via message_reference. Rides the
+//                  reply feature's own write seam (discord-post.ts discordPostMessage — the 2000-char
+//                  split + reply anchor already live there).
+//   - editMessage — PATCH /channels/{id}/messages/{mid} (an approval notice's decided-state rewrite).
+//   - postFiles  — a hand-rolled multipart/form-data create-message (post_file's uploads). eve's
+//                  Discord API is JSON-only, so payload_json + one files[i] part per file.
+//   - permalink  — the message's own URL (request_access's PR body, OPE-303). NO network: Discord's
+//                  message URL is a pure composition of ids we already hold.
+// Registered by registerDiscordProvider(). The bot token is a SECRET — header only, never logged; on
+// failure we surface the STATUS only.
+import { discordPostMessage } from "./discord-post.js";
+import { discordFetch } from "./discord-rest.js";
+const API = "https://discord.com/api/v10";
+function botToken() {
+    const token = process.env.DISCORD_BOT_TOKEN;
+    if (!token)
+        throw new Error("DISCORD_BOT_TOKEN is not set — the bot token is required to post to Discord.");
+    return token;
+}
+export const discordMessageOps = {
+    platform: "discord",
+    postText(channelId, text, opts) {
+        return discordPostMessage(channelId, text, opts?.replyToMessageId ? { replyToMessageId: opts.replyToMessageId } : undefined);
+    },
+    async editMessage(channelId, messageId, text) {
+        const res = await discordFetch("PATCH /channels/{id}/messages/{id}", `${API}/channels/${channelId}/messages/${messageId}`, {
+            method: "PATCH",
+            headers: { authorization: `Bot ${botToken()}`, "content-type": "application/json" },
+            // 🔴 `components: []` STRIPS THE BUTTONS, AND IT IS LOAD-BEARING (OPE-1260). Discord leaves a
+            // message's components untouched when a PATCH omits them, so without this line a card rewritten
+            // to a closed state kept four live buttons over copy saying the request was already over.
+            // Slack's own rewrite behaves this way already: `chat.update` sends a replacement `blocks`
+            // array and the buttons go with it.
+            //
+            // THE CALLER INVENTORY, because the strip is only safe while it holds. This arm is reached from
+            // ONE place — core's `channels/surface-message-ops.ts` `editSurfaceText` — whose only production
+            // caller is `access/credential-grant-card.ts` `rewriteGrantCard`. That helper now has FOUR
+            // callers: the sweep's expiry, the approve-time catalogue refusal, and (OPE-1278) the owner's
+            // own approve and decline. ALL FOUR RUN ONLY AFTER THE ASK ROW IS TERMINAL OR DECIDED — each
+            // one follows the CAS that closed the ask — so the strip still deletes no live control. An
+            // owner on Discord reaches this arm; an owner on Slack reaches `chat.update` instead.
+            // 🔴 A CALLER THAT MEANS "EDIT THE BODY, KEEP THE BUTTONS" MUST NOT USE THIS ARM — it has no way
+            // to say so, and this line would delete a live control. The core interface says the same.
+            body: JSON.stringify({ components: [], content: text }),
+        });
+        if (!res.ok)
+            throw new Error(`Discord edit-message failed (${res.status}) for channel ${channelId}`);
+    },
+    /**
+     * `https://discord.com/channels/<guild|@me>/<channel>/<message>` — the canonical Discord message
+     * link, composed rather than fetched (there is no getPermalink API and none is needed).
+     *
+     * 🔴 THE DM CASE IS WHY `ref.dm` EXISTS AND A HEURISTIC WOULD NOT DO. A Discord DM binds
+     * `workspace` to the USER id (core identity/binding.ts), and a user id and a guild id are both
+     * snowflakes — indistinguishable by shape. Putting a user id in the guild slot yields a URL that
+     * looks right and resolves to nothing, which is worse than no link at all in a PR body an admin
+     * reads to decide a grant. So a DM composes the `@me` form, and a channel with no workspace
+     * resolves `undefined` rather than guessing either way.
+     *
+     * ⚠️ NOT YET REACHED BY THE ONE CORE CONSUMER, and the reason is in the BINDING, not here.
+     * `request_access` asks for a permalink to `binding.threadTs`, and this bundle's identity mapper
+     * (channels/discord-identity.ts) does not set that field at all — Discord threads are their own
+     * channel ids, so the binding carries a `channelId` and no per-message anchor. So a Discord
+     * access request still freezes no permalink, exactly as before, and its PR body falls back to
+     * naming the channel + scope. Giving the mapper a `threadTs` is not a free fix: that field also
+     * drives approval-card threading and the float notice, so it is its own change. Written down
+     * rather than left to be rediscovered — this method is correct and currently idle.
+     */
+    async permalink(ref) {
+        const guild = ref.dm ? "@me" : ref.workspace;
+        return guild ? `https://discord.com/channels/${guild}/${ref.channelId}/${ref.messageId}` : undefined;
+    },
+    /**
+     * `{PUT|DELETE} /channels/{id}/messages/{mid}/reactions/{emoji}/@me` — the bot's own reaction,
+     * URL-encoded. This is the transport behind core's ✋ stop affordance (OPE-418).
+     *
+     * NEVER THROWS, deliberately, unlike the three ops above: a reaction is decoration beside work
+     * that is already running, so a missing permission must cost the turn its stop button, not the
+     * turn. A DELETE of a reaction that was never added 404s — that is the idempotent no-op, not an
+     * error.
+     */
+    async setReaction(channelId, messageId, emoji, on) {
+        const encoded = encodeURIComponent(emoji);
+        try {
+            const res = await discordFetch(on ? "PUT /channels/{id}/messages/{id}/reactions/{emoji}/@me" : "DELETE /channels/{id}/messages/{id}/reactions/{emoji}/@me", `${API}/channels/${channelId}/messages/${messageId}/reactions/${encoded}/@me`, { method: on ? "PUT" : "DELETE", headers: { authorization: `Bot ${botToken()}` } });
+            if (!res.ok && !(!on && res.status === 404)) {
+                console.warn(`[open-everywhere:discord] reaction ${on ? "add" : "remove"} failed (${res.status}) for message ${messageId}`);
+            }
+        }
+        catch (err) {
+            console.warn(`[open-everywhere:discord] reaction ${on ? "add" : "remove"} error: ${err?.message ?? String(err)}`);
+        }
+    },
+    async postFiles(channelId, files, comment) {
+        const form = new FormData();
+        const attachments = files.map((file, i) => ({ id: i, filename: file.filename, ...(file.caption ? { description: file.caption } : {}) }));
+        form.append("payload_json", JSON.stringify({ ...(comment ? { content: comment } : {}), attachments }));
+        files.forEach((file, i) => {
+            // A fresh ArrayBuffer copy so the Blob owns contiguous bytes regardless of the source view.
+            const ab = file.bytes.buffer.slice(file.bytes.byteOffset, file.bytes.byteOffset + file.bytes.byteLength);
+            form.append(`files[${i}]`, new Blob([ab], { type: file.contentType }), file.filename);
+        });
+        // No explicit content-type header — fetch derives the multipart boundary from the FormData.
+        const res = await discordFetch("POST /channels/{id}/messages", `${API}/channels/${channelId}/messages`, {
+            method: "POST",
+            headers: { authorization: `Bot ${botToken()}` },
+            body: form,
+        });
+        if (!res.ok)
+            throw new Error(`Discord create-message (files) failed (HTTP ${res.status}) for channel ${channelId}`);
+        // Discord's create-message response carries the new message's own `id` — the same field
+        // discordPostOne reads for a plain text post (discord-post.ts). Hand it back so post_file's
+        // audit row can stamp `detail.id`, matching the reply path's shape (OPE-932). DELIBERATELY
+        // UNMARKED when absent, like discordPostOne: a 2xx means the message IS in the channel — this
+        // host just cannot name it, never an error worth failing an otherwise-successful upload over.
+        const body = (await res.json().catch(() => undefined));
+        return typeof body?.id === "string" ? body.id : undefined;
+    },
+};
+//# sourceMappingURL=discord-message-ops.js.map

package/dist/agent/channels/discord-message-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-message-ops.js","sourceRoot":"","sources":["../../../agent/channels/discord-message-ops.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,4FAA4F;AAC5F,mGAAmG;AACnG,oGAAoG;AACpG,sGAAsG;AACtG,6DAA6D;AAC7D,sGAAsG;AACtG,iGAAiG;AACjG,2FAA2F;AAC3F,oGAAoG;AACpG,6EAA6E;AAC7E,qGAAqG;AACrG,sCAAsC;AAGtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAE1C,SAAS,QAAQ;IACf,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC5G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,QAAQ,EAAE,SAAS;IACnB,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI;QAC5B,OAAO,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/H,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI;QAC1C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,oCAAoC,EAAE,GAAG,GAAG,aAAa,SAAS,aAAa,SAAS,EAAE,EAAE;YACzH,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACnF,8FAA8F;YAC9F,gGAAgG;YAChG,0FAA0F;YAC1F,2FAA2F;YAC3F,oCAAoC;YACpC,EAAE;YACF,gGAAgG;YAChG,iGAAiG;YACjG,2FAA2F;YAC3F,8FAA8F;YAC9F,6FAA6F;YAC7F,2FAA2F;YAC3F,sFAAsF;YACtF,iGAAiG;YACjG,0FAA0F;YAC1F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,iBAAiB,SAAS,EAAE,CAAC,CAAC;IACvG,CAAC;IACD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,SAAS,CAAC,GAAG;QACjB,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,gCAAgC,KAAK,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,CAAC;IACD;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAC5B,EAAE,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,2DAA2D,EAC3H,GAAG,GAAG,aAAa,SAAS,aAAa,SAAS,cAAc,OAAO,MAAM,EAC7E,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,QAAQ,EAAE,EAAE,EAAE,EAAE,CACnF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,YAAY,GAAG,CAAC,MAAM,iBAAiB,SAAS,EAAE,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,WAAY,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAA8B,EAAE,OAAO;QAChE,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACvG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACxB,4FAA4F;YAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgB,CAAC;YACxH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,4FAA4F;QAC5F,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,8BAA8B,EAAE,GAAG,GAAG,aAAa,SAAS,WAAW,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,QAAQ,EAAE,EAAE,EAAE;YAC/C,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,CAAC,MAAM,iBAAiB,SAAS,EAAE,CAAC,CAAC;QACpH,wFAAwF;QACxF,4FAA4F;QAC5F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAiC,CAAC;QACvF,OAAO,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;CACF,CAAC"}

package/dist/agent/channels/discord-origin-codec.d.ts

@@ -0,0 +1,7 @@
+import type { UnifiedWakeOrigin, WakeOriginCodec } from "@open-everywhere/core/agent/adapter-api.js";
+type DiscordOrigin = Extract<UnifiedWakeOrigin, {
+    platform: "discord";
+}>;
+export declare const discordWakeOriginCodec: WakeOriginCodec<DiscordOrigin>;
+export {};
+//# sourceMappingURL=discord-origin-codec.d.ts.map

package/dist/agent/channels/discord-origin-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-origin-codec.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-origin-codec.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAErG,KAAK,aAAa,GAAG,OAAO,CAAC,iBAAiB,EAAE;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AASzE,eAAO,MAAM,sBAAsB,EAAE,eAAe,CAAC,aAAa,CA8EjE,CAAC"}

package/dist/agent/channels/discord-origin-codec.js

@@ -0,0 +1,98 @@
+// The Discord UnifiedWakeOrigin codec — MOVED VERBATIM out of core's channels/wake-origin-codecs.ts
+// (OPE-114 stage 4). STORED-DATA COMPATIBILITY IS THE CONTRACT: a Discord origin is JSON-serialised
+// into the durable operational store and fail-closed re-validated on read, so every behaviour here
+// is frozen by core's scripts/wake-origin-fixtures-test.ts (run from the app root with this bundle's
+// boot wiring). Validator tolerances (typeof-only optional checks, extra unknown fields) are
+// LOAD-BEARING for rows already on disk — never tighten them here.
+//
+// The `UnifiedWakeOrigin` TYPE union (including BOTH discord arms) stays in core — it is the wire
+// schema for stored rows; only the codec BEHAVIOUR lives in the bundle, registered by
+// registerDiscordProvider() (../register.ts).
+//
+// OPE-315 added a SECOND discord arm — a `dm: true`-discriminated DM/group-DM variant — so the
+// validator became an XOR. Every existing GUILD row keeps validating byte for byte: the guild branch
+// is the old predicate verbatim, and the additions are all on the new positive discriminant.
+/** COLON-FREE by construction (a task windowId is `[^:]+` — core channels/window-key.ts): any colon
+ *  in a raw surface id is folded to `_`, deterministically, so spawn + ingress agree on identity. */
+const noColon = (s) => s.replace(/:/g, "_");
+/** A DM-variant origin — narrowed on the positive discriminant, never on the ABSENCE of guildId. */
+const isDmOrigin = (o) => "dm" in o && o.dm === true;
+export const discordWakeOriginCodec = {
+    validate: (o) => {
+        // TWO valid shapes, enforced as an XOR (never both, never neither) — the Linear arm's model.
+        //  • GUILD: a non-empty guildId + NO `dm`. Unchanged from the original single shape, byte for
+        //    byte: guildId is REQUIRED because the Discord privacy floor
+        //    (discord-gateway.ts discordSingleWindowPrivacyOk) can never have admitted a guildless
+        //    surface into a shared window, and this validator enforces the same invariant on the reply
+        //    path. `messageId` and `autoThreadName` stay typeof-only optionals.
+        //  • DM (OPE-315): `dm === true` + NO guildId + NO autoThreadName. A DM/group-DM reply needs
+        //    only the channel id (POST /channels/{id}/messages under the bot token).
+        //
+        // 🔴 THE XOR IS DELIBERATELY BIDIRECTIONAL. "dm:true AND a guildId" is INVALID — not "the guild
+        // wins", not "the dm wins". That is the IMPERSONATION direction: a DM-shaped row that acquired
+        // guild authority would reach the guild-keyed threadRef, markThreadEngaged, and `discord/<guild>`
+        // vouch keys. And the guild arm still refuses guildless BY OMISSION (D1): nothing here relaxes
+        // it, so `divertDiscordWakeToUnifiedWindow`'s `guildId: msg.guildId ?? ""` fall-through stays
+        // invalid exactly as before — pinned by the two unmodified guildless-rejection fixture rows.
+        //
+        // autoThreadName is forbidden on the DM shape (D4) because the reply leg's auto-thread branch is
+        // guild-keyed (discord-post-arm.ts writes `discord/${origin.guildId}` engagement rows); a DM
+        // carrying it would mint `discord/undefined/...`. messageId is allowed — cosmetic
+        // message_reference anchoring with no guild-shaped consequence. That is the whole line: forbid
+        // exactly the fields with guild-keyed effects.
+        //
+        // OPE-1719 adds `thread` to the GUILD shape only, and it is a LITERAL-`true` optional rather
+        // than a typeof-boolean optional: the field's whole job is to be a POSITIVE thread signal, so
+        // `thread: false` must not validate and then read as "a thread that says it is not one". It is
+        // forbidden on the DM shape because a Discord DM has no threads at all — the same "forbid
+        // exactly the fields whose effects the shape cannot carry" line `autoThreadName` sits on.
+        if (typeof o.channelId !== "string" || o.channelId.length === 0)
+            return false;
+        if (o.messageId !== undefined && typeof o.messageId !== "string")
+            return false;
+        const isDm = o.dm === true && o.guildId === undefined && o.autoThreadName === undefined && o.thread === undefined;
+        const isGuild = o.dm === undefined &&
+            typeof o.guildId === "string" &&
+            o.guildId.length > 0 &&
+            (o.autoThreadName === undefined || typeof o.autoThreadName === "string") &&
+            (o.thread === undefined || o.thread === true);
+        return isDm || isGuild;
+    },
+    // The DM namespace is `discord/dm/<channelId>` — a literal `dm` segment where a guild id sits on
+    // the guild shape. Collision-free because a Discord guild id is a decimal snowflake and can never
+    // be the string "dm". Relied on rather than enforced at the type level, so it is asserted in the
+    // fixtures oracle; if it were ever violated the blast radius is ROUTING (a shared thread-ownership
+    // row + taskWindowId prefix), not authority — a reply still goes to the stored origin.
+    threadRef: (origin) => isDmOrigin(origin)
+        ? { channelKey: noColon(`discord/dm/${origin.channelId}`), threadKey: noColon(origin.channelId) }
+        : { channelKey: noColon(`discord/${origin.guildId}/${origin.channelId}`), threadKey: noColon(origin.channelId) },
+    // THE POSITIVE SIGNAL, and nothing else (OPE-1719). A Discord thread is its own channelId, so the
+    // id proves nothing; the gateway stamps `thread: true` at mint from the relay payload's channel
+    // type, and this reads exactly that stamp. Every other shape — a plain guild channel, a DM, and
+    // every stored row minted before the field existed — reads FALSE and routes to the standing seat,
+    // which is the fail-closed direction and byte-identical to the behaviour this replaced.
+    isThreadScoped: (origin) => !isDmOrigin(origin) && origin.thread === true,
+    containerId: (origin) => origin.channelId,
+    // THE PLACEMENT AXIS (OPE-1826). Discord is the SECOND surface whose post placement sits OUTSIDE
+    // its conversation identity, and until this member existed nothing said so: `threadRef` keys on the
+    // channel id alone (a Discord thread IS its own channel id), while the post arm hangs the answer on
+    // `messageId` as a `message_reference`. So two wakes in one channel are ONE conversation naming two
+    // different messages to reply under — Slack's `replyAnchorTs` shape exactly.
+    //
+    // 🔴 `messageId` ONLY, NEVER `autoThreadName`. The post arm reads both and only one is a PLACEMENT:
+    // `autoThreadName` decides whether the answer opens a NEW thread off the message, which MOVES the
+    // post out of the conversation it was asked in. The carry's own guarantee is that it can place a
+    // post and never move one, so the name is deliberately outside this axis and outside the carry
+    // below. A DM origin carries no message anchor at all — there is nothing to hang under in a 1:1 —
+    // and answers `undefined` through the same emptiness-is-absence read every other field takes.
+    placementRef: (origin) => (typeof origin.messageId === "string" && origin.messageId.length > 0 ? origin.messageId : undefined),
+    // THE CARRY (OPE-1826), narrowing-only and byte-for-byte the contract Slack's arm holds: fill a
+    // placement the target LACKS, never overwrite one, change no other field. A target that already
+    // names a message keeps it, because the model named THAT wake and answering it where it was asked
+    // is the honest reading. Core re-validates the result and re-tests the conversation, so this arm
+    // can fill a gap and cannot move a post even if this line were wrong.
+    carryPlacement: (target, source) => !(target.messageId && target.messageId.length > 0) && typeof source.messageId === "string" && source.messageId.length > 0
+        ? { ...target, messageId: source.messageId }
+        : target,
+};
+//# sourceMappingURL=discord-origin-codec.js.map

package/dist/agent/channels/discord-origin-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-origin-codec.js","sourceRoot":"","sources":["../../../agent/channels/discord-origin-codec.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,6FAA6F;AAC7F,mEAAmE;AACnE,EAAE;AACF,kGAAkG;AAClG,sFAAsF;AACtF,8CAA8C;AAC9C,EAAE;AACF,+FAA+F;AAC/F,qGAAqG;AACrG,6FAA6F;AAM7F;qGACqG;AACrG,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAE5D,oGAAoG;AACpG,MAAM,UAAU,GAAG,CAAC,CAAgB,EAA6C,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAE/G,MAAM,CAAC,MAAM,sBAAsB,GAAmC;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,6FAA6F;QAC7F,8FAA8F;QAC9F,iEAAiE;QACjE,2FAA2F;QAC3F,+FAA+F;QAC/F,wEAAwE;QACxE,6FAA6F;QAC7F,6EAA6E;QAC7E,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,kGAAkG;QAClG,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,EAAE;QACF,iGAAiG;QACjG,6FAA6F;QAC7F,kFAAkF;QAClF,+FAA+F;QAC/F,+CAA+C;QAC/C,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;QAClH,MAAM,OAAO,GACX,CAAC,CAAC,EAAE,KAAK,SAAS;YAClB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;YAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;YACxE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAChD,OAAO,IAAI,IAAI,OAAO,CAAC;IACzB,CAAC;IACD,iGAAiG;IACjG,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,uFAAuF;IACvF,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,UAAU,CAAC,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACjG,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;IACpH,kGAAkG;IAClG,gGAAgG;IAChG,gGAAgG;IAChG,kGAAkG;IAClG,wFAAwF;IACxF,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;IACzE,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS;IACzC,iGAAiG;IACjG,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,6EAA6E;IAC7E,EAAE;IACF,oGAAoG;IACpG,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,8FAA8F;IAC9F,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9H,gGAAgG;IAChG,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,sEAAsE;IACtE,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CACjC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACvH,CAAC,CAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAoB;QAC/D,CAAC,CAAC,MAAM;CACb,CAAC"}

package/dist/agent/channels/discord-post-arm.d.ts

@@ -0,0 +1,3 @@
+import { type PostArm } from "@open-everywhere/core/agent/adapter-api.js";
+export declare const discordPostArm: PostArm;
+//# sourceMappingURL=discord-post-arm.d.ts.map

package/dist/agent/channels/discord-post-arm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-post-arm.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-post-arm.ts"],"names":[],"mappings":"AAkBA,OAAO,EAKL,KAAK,OAAO,EAUb,MAAM,4CAA4C,CAAC;AA+JpD,eAAO,MAAM,cAAc,EAAE,OAqC5B,CAAC"}

package/dist/agent/channels/discord-post-arm.js

@@ -0,0 +1,195 @@
+// discord-post-arm — Discord's POST arm for the post-arms registry (OPE-114 stage 1c). Absorbs,
+// VERBATIM, Discord's arms out of the three reply/delivery spines: reply-post.ts (resolveReplyTarget's
+// discord case + dispatchReply's POST-messages branch + the discord splitForDiscord chunking used by
+// postTerminalProse), unified-reply.ts (liveDiscordPost, incl. the auto-thread restore + engage), and
+// unified-redrive.ts (the discord describe/container cases). The write seam is discord-post.ts (the
+// same one the reply tools use — deliberately NOT the gateway module).
+import { DISCORD_MESSAGE_MAX, discordAddReaction, discordEditMessage, discordExistingThreadForMessage, discordOpenDmChannel, discordPostMessage, discordPostMessageWithButtons, discordThreadForMessage, splitForDiscord, } from "./discord-post.js";
+import { bindFrom, markThreadEngaged, deploymentOrg, recordOwnPost, } from "@open-everywhere/core/agent/adapter-api.js";
+/** UNIFIED: POST /channels/{id}/messages under the bot token. The target channelId is the frozen wake
+ *  origin's (host-side, never model-authored); a thread IS its own channel id so a threaded trigger
+ *  replies into its thread. The FIRST chunk anchors to the triggering message via message_reference
+ *  (fail-soft when the trigger was deleted); Discord caps a message at 2000 chars, so a long reply
+ *  splits and posts in order. Errors re-wrapped token-free (defensive parity with the other arms —
+ *  discordPostMessage's own errors are already clean, but never risk echoing a transport body).
+ *  Auto-thread restore (origin.autoThreadName ⇔ an addressed mention in a base channel): open the
+ *  thread off the mention and answer there — the native path's UX the divert skips.
+ *  discordThreadForMessage is idempotent (finds an existing thread) and fail-open (null ⇒ today's
+ *  in-channel reply, anchored to the mention via message_reference). */
+async function liveDiscordPost(origin, text) {
+    let targetChannelId = origin.channelId;
+    let anchorToMessage = origin.messageId;
+    // The auto-thread branch is GUILD-ONLY, and now says so structurally. `!("dm" in origin)` narrows
+    // to the guild variant so `origin.guildId` type-checks below (OPE-315) — no behavioural change:
+    // the DM variant cannot carry `autoThreadName` in the first place (the type forbids it and the
+    // validator refuses it, D4), precisely because the engagement row this branch writes is keyed on
+    // the guild. The narrowing makes that unrepresentable rather than merely unreached.
+    if (!("dm" in origin) && origin.autoThreadName && origin.messageId) {
+        const threadId = await discordThreadForMessage(origin.channelId, origin.messageId, origin.autoThreadName);
+        if (threadId) {
+            targetChannelId = threadId;
+            anchorToMessage = undefined; // the thread already hangs off the mention — no reference needed
+            // ENGAGE the thread we just opened — the native path engages at dispatch, but this thread
+            // only exists NOW, so the divert path must enroll it here or non-mention follow-ups inside
+            // it are dropped at the wake gate (live-found 2026-07-19: J-DISC's continuity leg — the
+            // reply landed, then "expand that..." produced zero audit rows). The partition mirrors what
+            // the gate resolves for a message ARRIVING in the thread (workspace=guild, surface=thread id,
+            // key=thread channel id — engagementKey). markThreadEngaged is best-effort/never throws, and
+            // a later "stop" disengages normally: nothing re-engages until OE next replies here.
+            const workspaceKey = `discord/${origin.guildId}`;
+            const surfaceKey = `${workspaceKey}/${threadId}`;
+            await markThreadEngaged({ org: deploymentOrg(), platform: "discord", workspace: origin.guildId, surface: threadId, workspaceKey, surfaceKey, key: surfaceKey }, threadId, new Date().toISOString(), { participating: true });
+        }
+    }
+    let first;
+    try {
+        for (const chunk of splitForDiscord(text)) {
+            if (!chunk.trim())
+                continue; // never post an invisible empty message
+            const id = await discordPostMessage(targetChannelId, chunk, first === undefined && anchorToMessage ? { replyToMessageId: anchorToMessage } : undefined);
+            first ??= id;
+        }
+    }
+    catch {
+        throw new Error(`unified reply couldn't post to Discord — create-message failed on channel ${targetChannelId}`);
+    }
+    if (first === undefined) {
+        throw new Error(`unified reply couldn't post to Discord — nothing to post (empty reply) for channel ${origin.channelId}`);
+    }
+    // 🔴 OPE-793 — THE ONE PLACE AN ARM POSTS SOMEWHERE ITS SPINE CANNOT NAME. When the auto-thread
+    // branch above fires, this reply lands in a thread that did not exist when the wake origin was
+    // frozen, so the spine's own ledger write records `origin.channelId` — the BASE channel — and an
+    // `edit_reply` addressed at the thread would be refused as not-ours. Recording the real channel
+    // here closes that, and only that: the id is one this call just posted, at the locus it posted to.
+    // Best-effort by construction (recordOwnPost never throws); a lost row costs an edit, never a post.
+    if (targetChannelId !== origin.channelId) {
+        await recordOwnPost(deploymentOrg(), { platform: "discord", channelId: targetChannelId }, first);
+    }
+    return first;
+}
+/**
+ * UNIFIED, WITH A COMPONENT PLANE (OPE-1720): the same single-window post as {@link liveDiscordPost},
+ * carrying a row of tappable actions under it. Discord is the SECOND surface to implement this
+ * member, and it may only do so because the tap lands: `discord-front.ts` classifies the `oe_input:`
+ * custom_id and `discord-approval-card.ts` settles it.
+ *
+ * 🔴 NO AUTO-THREAD BRANCH, DELIBERATELY. `liveDiscordPost` may open a thread off the mention and
+ * answer there. A governed approval card must not move: the people who can answer it are watching the
+ * conversation it was asked in, and burying the buttons in a freshly-created thread is how a card
+ * goes unanswered. The anchor still rides — the card hangs under the triggering message through the
+ * same `message_reference` a plain reply uses — so it is placed and never moved.
+ *
+ * 🔴 IT FALLS BACK TO TEXT RATHER THAN SPLITTING. Discord caps a message at 2000 characters and a
+ * button row cannot be split across messages: a row attached to the wrong part would sit under a
+ * fragment. So an over-cap card posts through the ordinary splitting path and loses the SHORTCUT,
+ * never the meaning — `DirectMessageAction`'s own rule, which the question bridge's text already
+ * satisfies (it prints the prompt, the options, and the line saying a reply may name one).
+ */
+async function liveDiscordPostWithActions(origin, text, actions) {
+    const buttons = actions.map((a) => ({ customId: a.id, label: a.label, intent: a.intent }));
+    if (buttons.length === 0 || text.length > DISCORD_MESSAGE_MAX)
+        return liveDiscordPost(origin, text);
+    try {
+        return await discordPostMessageWithButtons(origin.channelId, text, buttons, origin.messageId ? { replyToMessageId: origin.messageId } : undefined);
+    }
+    catch {
+        throw new Error(`unified reply couldn't post to Discord — create-message with buttons failed on channel ${origin.channelId}`);
+    }
+}
+/** EDIT (OPE-793): `PATCH /channels/{id}/messages/{mid}` through the same write seam the post path
+ *  uses. Ownership was already decided upstream against the own-post ledger; this is transport only. */
+async function editDiscordMessage(locus, messageId, text) {
+    await discordEditMessage(locus.channelId, messageId, text);
+}
+/** EDIT ADDRESS (OPE-798): the other half of the auto-thread branch in {@link liveDiscordPost}.
+ *
+ *  When that branch fires the reply lands in a thread — and a Discord thread IS its own channel —
+ *  while the frozen wake origin still names the BASE channel. The arm already records an own-post
+ *  ledger row on the thread so the fence passes; without this the PATCH still went to the base
+ *  channel and Discord answered 404 (measured live, deploy #89). Here the edit path resolves the
+ *  SAME thread the post path used, so the ledger read and the PATCH address one conversation.
+ *
+ *  🔴 READ-ONLY: `discordExistingThreadForMessage`, never `discordThreadForMessage`. The post path
+ *  may CREATE the thread; the edit path may not. A create at edit time would open a new empty thread
+ *  — a visible message in the room, and still a 404 for a message that is not in it.
+ *
+ *  Fail-soft to the base locus on every unknown: a DM origin, a wake with no auto-thread name, a
+ *  message with no thread, an API failure. That degrades to today's behaviour, which is correct for
+ *  a reply that genuinely went to the base channel. */
+async function retargetDiscordEditLocus(origin, locus) {
+    const o = origin;
+    if ("dm" in o || !o.autoThreadName || !o.messageId)
+        return locus;
+    const threadId = await discordExistingThreadForMessage(o.channelId, o.messageId);
+    return threadId ? { ...locus, channelId: threadId } : locus;
+}
+/**
+ * DM (OPE-623): open the 1:1 conversation with a Discord user and post there. The SECOND provider to
+ * implement this member — Slack was the only one, and several core behaviours read the registry
+ * rather than a platform list precisely so that they tighten the day a second arm appears:
+ *
+ *   • `link_identity` can now offer the DIRECTORY transport on Discord (it needs a directory arm AND
+ *     a DM arm; channels/discord-directory.ts is the other half).
+ *   • `claimVenueRefusal` (core identity/link-flow.ts) now REFUSES a `link <code>` claim typed in a
+ *     Discord channel and points the person at the DM. A code is a bearer secret for its whole TTL,
+ *     so it must not be posted where a room can read it. That is a deliberate tightening, not a
+ *     regression: it only arms where a private door exists.
+ *   • link-set change notices (`notifyLinkSetMembers`) and the governance DM-delivery venue
+ *     (core access/pane-venue.ts) reach Discord accounts instead of skipping them.
+ *
+ * The caller names WHO, never WHERE — opening the conversation is this arm's business. `text` goes
+ * through the same 2000-char splitter every other Discord post uses, so a long notice arrives whole
+ * rather than 400-ing; the FIRST part's id is the returned anchor.
+ */
+async function deliverDiscordDirectMessage(input) {
+    const surfaceId = await discordOpenDmChannel(input.principalId);
+    // BUTTONS (OPE-622): Discord has a component plane, so a caller's `actions` render as a row under
+    // the text and a tap comes back to the interactions endpoint (channels/discord-front.ts). The
+    // button path cannot split an over-cap message, so a long text falls back to the plain splitting
+    // post rather than failing — the caller's copy always stands on its own without a button.
+    const buttons = (input.actions ?? []).map((a) => ({ customId: a.id, label: a.label, intent: a.intent }));
+    if (buttons.length > 0 && input.text.length <= DISCORD_MESSAGE_MAX) {
+        return { surfaceId, messageId: await discordPostMessageWithButtons(surfaceId, input.text, buttons) };
+    }
+    const messageId = await discordPostMessage(surfaceId, input.text);
+    return { surfaceId, messageId };
+}
+export const discordPostArm = {
+    platform: "discord",
+    resolveTarget: (bag) => {
+        // On Discord the surface channel already IS the thread — no separate thread ts.
+        const channelId = bag.str("channelId");
+        return channelId ? { platform: "discord", channelId } : null;
+    },
+    dispatchReply: (target, text) => discordPostMessage(target.channelId, text),
+    dispatchUnified: (origin, text, deps) => (deps.postDiscord ?? liveDiscordPost)(origin, text),
+    // OPE-1720: Discord declares the unified component plane because the tap route exists on it —
+    // `discord-front.ts` classifies the `oe_input:` custom_id and `discord-approval-card.ts` settles
+    // it. The injected `postDiscord` override is honoured VERBATIM and drops the buttons: a test that
+    // scripted a text-only post must not start receiving a card it never asked for.
+    dispatchUnifiedActions: (origin, text, actions, deps) => deps.postDiscord ? deps.postDiscord(origin, text) : liveDiscordPostWithActions(origin, text, actions),
+    describeRedriveTarget: (origin) => `discord channel ${origin.channelId}`,
+    redriveContainerId: (origin) => origin.channelId,
+    editMessage: editDiscordMessage,
+    retargetEditLocus: retargetDiscordEditLocus,
+    deliverDirectMessage: deliverDiscordDirectMessage,
+    // REACT (OPE-987): the message-level (channelId, messageId) pair `setReaction` already takes for
+    // the host-placed ✋ glyph — closer to Slack's per-message granularity than to GitHub/Linear's
+    // conversation-anchor one (post-arms.ts `ReactTarget`'s header explains why the union carries both
+    // shapes). `channelId` comes off the binding's post-back target, same as `resolveTarget` above;
+    // `messageId` is NOT on that target (Discord threads reuse `channelId` for their own identity, so
+    // the triggering message rides its own `anchorMessageId` field — identity/binding.ts, OPE-671) —
+    // read via `bindFrom(bag.ctx)` rather than widening the bag's target shape for one extra field.
+    resolveReactTarget: (bag) => {
+        const channelId = bag.str("channelId");
+        if (!channelId)
+            return null;
+        const messageId = bindFrom(bag.ctx).anchorMessageId;
+        return messageId ? { platform: "discord", channelId, messageId } : null;
+    },
+    react: (target, emoji) => {
+        const t = target;
+        return discordAddReaction(t.channelId, t.messageId, emoji);
+    },
+};
+//# sourceMappingURL=discord-post-arm.js.map

package/dist/agent/channels/discord-post-arm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-post-arm.js","sourceRoot":"","sources":["../../../agent/channels/discord-post-arm.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,oGAAoG;AACpG,uEAAuE;AAEvE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,uBAAuB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,aAAa,GAWd,MAAM,4CAA4C,CAAC;AAMpD;;;;;;;;;wEASwE;AACxE,KAAK,UAAU,eAAe,CAAC,MAAqB,EAAE,IAAY;IAChE,IAAI,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;IACvC,IAAI,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;IACvC,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,oFAAoF;IACpF,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1G,IAAI,QAAQ,EAAE,CAAC;YACb,eAAe,GAAG,QAAQ,CAAC;YAC3B,eAAe,GAAG,SAAS,CAAC,CAAC,iEAAiE;YAC9F,0FAA0F;YAC1F,2FAA2F;YAC3F,wFAAwF;YACxF,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,qFAAqF;YACrF,MAAM,YAAY,GAAG,WAAW,MAAM,CAAC,OAAO,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC;YACjD,MAAM,iBAAiB,CACrB,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EACtI,QAAQ,EACR,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;gBAAE,SAAS,CAAC,wCAAwC;YACrE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxJ,KAAK,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6EAA6E,eAAe,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sFAAsF,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,IAAI,eAAe,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,aAAa,CAAC,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,0BAA0B,CAAC,MAAqB,EAAE,IAAY,EAAE,OAAuC;IACpH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpG,IAAI,CAAC;QACH,OAAO,MAAM,6BAA6B,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0FAA0F,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED;wGACwG;AACxG,KAAK,UAAU,kBAAkB,CAAC,KAAgB,EAAE,SAAiB,EAAE,IAAY;IACjF,MAAM,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;uDAcuD;AACvD,KAAK,UAAU,wBAAwB,CAAC,MAAyB,EAAE,KAAgB;IACjF,MAAM,CAAC,GAAG,MAAuB,CAAC;IAClC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACjF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,2BAA2B,CAAC,KAA2B;IACpE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChE,kGAAkG;IAClG,8FAA8F;IAC9F,iGAAiG;IACjG,0FAA0F;IAC1F,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAY;IACrC,QAAQ,EAAE,SAAS;IACnB,aAAa,EAAE,CAAC,GAAqB,EAAsB,EAAE;QAC3D,gFAAgF;QAChF,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IACD,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAE,MAAwB,CAAC,SAAS,EAAE,IAAI,CAAC;IAC9F,eAAe,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAsB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,CAAC,MAAuB,EAAE,IAAI,CAAC;IAC/H,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,gFAAgF;IAChF,sBAAsB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAsB,EAAE,EAAE,CACxE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAuB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAuB,EAAE,IAAI,EAAE,OAAO,CAAC;IACzI,qBAAqB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAoB,MAAwB,CAAC,SAAS,EAAE;IAC3F,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAE,MAAwB,CAAC,SAAS;IACnE,WAAW,EAAE,kBAAkB;IAC/B,iBAAiB,EAAE,wBAAwB;IAC3C,oBAAoB,EAAE,2BAA2B;IACjD,iGAAiG;IACjG,8FAA8F;IAC9F,mGAAmG;IACnG,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,gGAAgG;IAChG,kBAAkB,EAAE,CAAC,GAAqB,EAAsB,EAAE;QAChE,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC;QACpD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,MAA4B,CAAC;QACvC,OAAO,kBAAkB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC"}