@open-everywhere/provider-discord 0.1.0

package/dist/agent/channels/discord-read.js

@@ -0,0 +1,128 @@
+// The Discord read adapter — EXTRACTED from core channels/channel-read.ts (OPE-114 stage 4). A real
+// `GET /channels/{id}/messages` (bot token) mapped through linesFromDiscordMessages into the neutral
+// RenderedLine[]; registered via registerReadAdapter from registerDiscordProvider(). Discord threads
+// ARE their own channel ids (one endpoint covers a base channel AND a thread — see
+// discord-backscroll.ts), so readThread reads the thread's OWN id, carried in `thread_ts` (the
+// generic verb's per-surface "thread identifier"). The generic per-surface allowlist gate
+// (assertSurfaceAllowed) is SHARED from core (barrel) — it is platform-parameterised.
+//
+// The bot token is a SECRET — header only, never logged. Fail-LOUD (unlike fail-soft backscroll
+// enrichment): a read must surface its error. The requester is injectable for offline tests.
+import { assertSurfaceAllowed, bindFrom, resolvePartition, refutedReadAuthorIds, } from "@open-everywhere/core/agent/adapter-api.js";
+import { linesFromDiscordMessages } from "./discord-backscroll.js";
+import { discordAuthorRoles } from "../approvals/discord-admin.js";
+const DISCORD_CHANNEL_DEFAULT_LIMIT = 50;
+const DISCORD_THREAD_DEFAULT_LIMIT = 100;
+const DISCORD_MAX_PAGE = 100;
+const liveDiscordRead = async (channelId, limit) => {
+    const token = process.env.DISCORD_BOT_TOKEN;
+    if (!token)
+        throw new Error("read: DISCORD_BOT_TOKEN is not set — the Discord read tools need the bot token.");
+    const qs = new URLSearchParams({ limit: String(Math.min(limit, DISCORD_MAX_PAGE)) }).toString();
+    const res = await fetch(`https://discord.com/api/v10/channels/${channelId}/messages?${qs}`, {
+        headers: { authorization: `Bot ${token}` },
+    });
+    if (!res.ok)
+        throw new Error(`read: Discord GET messages failed (HTTP ${res.status}) for channel ${channelId}.`);
+    return res.json();
+};
+/**
+ * Map a raw Discord messages array (newest-first) to oldest-first RenderedLine[] — reusing
+ * linesFromDiscordMessages for the exact system/empty drop + sender classification. Pure; exported
+ * for the render test.
+ *
+ * `author` IS UNCHANGED (the sender id, else `(unknown)`). OPE-474 adds the two GRADING fields
+ * beside it, taken from the sender classification linesFromDiscordMessages already made: a `user`
+ * line carries its `authorId`, and a `bot`/`agent` line is marked a machine and drops out of the
+ * probe. An `unknown` line carries neither, which is the fail-open answer for an author nobody can
+ * name.
+ */
+export function discordLinesFromRaw(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const ordered = [...raw].reverse(); // Discord: newest-first → oldest-first
+    return linesFromDiscordMessages(ordered).map((l) => ({
+        author: l.senderId ?? "(unknown)",
+        ts: l.ts,
+        text: l.text,
+        ...(l.senderType === "bot" || l.senderType === "agent"
+            ? { bot: true }
+            : l.senderType === "user" && l.senderId !== undefined
+                ? { authorId: l.senderId }
+                : {}),
+    }));
+}
+// --- the OPE-474 non-member author leg ---------------------------------------------------------
+//
+// 🔴 DISCORD CANNOT REFUTE AN AUTHOR ITSELF, at all. It has no organisation concept — guild
+// membership IS the boundary, and a community guild admits the world — so the ONLY author-grain
+// evidence here is the operator's author-trust register (identity/author-trust.ts, OPE-516). This is
+// the same conclusion discord-backscroll.ts's `gradeDiscordContextLines` reached for the wake leg,
+// and this adapter deliberately reproduces its shape rather than a second one.
+//
+// `member.pending` — the trigger's own screening signal — is NOT available here either, and the
+// reason is structural rather than an omission: it rides the gateway relay's MESSAGE_CREATE member
+// object, and Discord's documented Message object (what `GET /channels/{id}/messages` returns) has
+// no `member` field at all.
+//
+// THE ROLE PROBE IS COST-GATED THEN FAIL-OPEN, in that order — {@link refutedReadAuthorIds} runs the
+// gate and this supplies the probe:
+//   1. UNARMED guild (the default posture): no register query is worth building, so NO role fetch
+//      runs. Zero new I/O.
+//   2. ARMED guild: each DISTINCT author gets ONE TTL-cached {@link discordAuthorRoles} call.
+//   3. `undefined` from the probe means CANNOT CHECK, and the join skips that author entirely —
+//      never an unverified `[]`. On a guild armed the documented-usual way
+//      (`{ membership: "discord/<g>/role:*" }`) an unverified empty array would make every author
+//      look role-less and therefore `external`, which marked ordinary colleagues' messages. That
+//      exact bug was caught in OPE-475; the contract that prevents it is in read-author-trust.ts.
+export const discordReadAdapter = {
+    platform: "discord",
+    /**
+     * OPE-929 — Discord's own spelling of "which room and which thread is this turn in".
+     *
+     * 🔴 A DISCORD THREAD IS ITS OWN CHANNEL. There is no thread id inside a channel to carry, so the
+     * CONTAINER and the THREAD ROOT are the same snowflake on a thread turn, and `readThread` is the
+     * verb that reads it (it fetches `threadTs` directly — see below). The turn is a thread turn when
+     * the ingress stamped a PARENT channel id, which is exactly what `domainSurface` carries: the
+     * mapper sets it only from `parent_channel_id`, so its presence IS "this is a thread".
+     *
+     * A base-channel turn has no parent stamp, so it reports no thread root and `read_thread` refuses
+     * it honestly.
+     */
+    wakeAddress(ctx) {
+        const b = bindFrom(ctx);
+        const container = typeof b.target?.["channelId"] === "string" ? b.target["channelId"] : undefined;
+        if (!container)
+            return undefined;
+        return { container, ...(b.domainSurface ? { threadRoot: container } : {}) };
+    },
+    async readChannel(ctx, channel, limit, req = liveDiscordRead) {
+        await assertSurfaceAllowed(ctx, "discord", channel);
+        return discordLinesFromRaw(await req(channel, limit ?? DISCORD_CHANNEL_DEFAULT_LIMIT));
+    },
+    async readThread(ctx, channel, threadTs, limit, req = liveDiscordRead) {
+        // A Discord thread is its own channel id — read `thread_ts` (the thread's id), allowlist-checked.
+        await assertSurfaceAllowed(ctx, "discord", threadTs);
+        return discordLinesFromRaw(await req(threadTs, limit ?? DISCORD_THREAD_DEFAULT_LIMIT));
+    },
+    /** OPE-474 / OPE-534 — the register leg only (see the note above). It answers with the refuted
+     *  AUTHOR IDS, because core reads the one answer twice: the turn mark and the `withhold` body
+     *  replacement. `roleProbe` is injected ONLY so a test can drive the grading offline; every live
+     *  call defaults to the TTL-cached live probe. */
+    async refutedAuthorIds(ctx, lines, roleProbe = discordAuthorRoles) {
+        const p = resolvePartition(ctx);
+        // `workspace` is the GUILD id for a guild surface, and the DM partner's user id for a DM
+        // (discord-identity.ts `bindDiscord`). A DM's key can never be an armed tenant — arming is by
+        // guild — so the cost gate answers `false` there without a lookup, which is the right answer:
+        // a DM has no guild membership to refute against.
+        const tenantKey = p.workspaceKey;
+        const guildId = p.workspace;
+        return await refutedReadAuthorIds(lines, tenantKey, {
+            memberships: async (authorId) => {
+                const roles = await roleProbe(guildId, authorId);
+                return roles === undefined ? undefined : roles.map((r) => `${tenantKey}/role:${r}`);
+            },
+        });
+    },
+};
+//# sourceMappingURL=discord-read.js.map

package/dist/agent/channels/discord-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-read.js","sourceRoot":"","sources":["../../../agent/channels/discord-read.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,qGAAqG;AACrG,qGAAqG;AACrG,mFAAmF;AACnF,+FAA+F;AAC/F,0FAA0F;AAC1F,sFAAsF;AACtF,EAAE;AACF,gGAAgG;AAChG,6FAA6F;AAE7F,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,GAIrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAyB,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,MAAM,6BAA6B,GAAG,EAAE,CAAC;AACzC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAK7B,MAAM,eAAe,GAAyB,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAC/G,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wCAAwC,SAAS,aAAa,EAAE,EAAE,EAAE;QAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,EAAE,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,MAAM,iBAAiB,SAAS,GAAG,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAI,GAAsC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,uCAAuC;IAC/G,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,WAAW;QACjC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO;YACpD,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE;YACf,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACnD,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;gBAC1B,CAAC,CAAC,EAAE,CAAC;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED,kGAAkG;AAClG,EAAE;AACF,4FAA4F;AAC5F,gGAAgG;AAChG,qGAAqG;AACrG,mGAAmG;AACnG,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,4BAA4B;AAC5B,EAAE;AACF,qGAAqG;AACrG,oCAAoC;AACpC,kGAAkG;AAClG,2BAA2B;AAC3B,8FAA8F;AAC9F,gGAAgG;AAChG,2EAA2E;AAC3E,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAElG,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,SAAkB;IAC5B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,GAAoB;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,GAAoB,EAAE,OAAe,EAAE,KAAc,EAAE,GAAG,GAAyB,eAAe;QAClH,MAAM,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,mBAAmB,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAoB,EAAE,OAAe,EAAE,QAAgB,EAAE,KAAc,EAAE,GAAG,GAAyB,eAAe;QACnI,kGAAkG;QAClG,MAAM,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrD,OAAO,mBAAmB,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,4BAA4B,CAAC,CAAC,CAAC;IACzF,CAAC;IACD;;;sDAGkD;IAClD,KAAK,CAAC,gBAAgB,CAAC,GAAoB,EAAE,KAA8B,EAAE,SAAS,GAAqB,kBAAkB;QAC3H,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,yFAAyF;QACzF,8FAA8F;QAC9F,8FAA8F;QAC9F,kDAAkD;QAClD,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;QAC5B,OAAO,MAAM,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE;YAClD,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/agent/channels/discord-rest.d.ts

@@ -0,0 +1,33 @@
+import { type RetryPolicy } from "@open-everywhere/core/agent/adapter-api.js";
+/** The provider surface name on the NAMED rate-limit failure. */
+export declare const DISCORD_SURFACE = "discord";
+/** The subset of `fetch` this seam drives — injectable so a test scripts the 429 sequence. */
+export type DiscordFetchLike = (url: string, init: RequestInit) => Promise<Response>;
+/** Transport and retry seams. A test injects both; live code passes neither. */
+export interface DiscordFetchDeps {
+    readonly fetch?: DiscordFetchLike;
+    readonly retry?: RetryPolicy;
+}
+/**
+ * Read the honoured delay from a Discord 429 body, in milliseconds, or `undefined` when the body
+ * carries no usable `retry_after` (then the seam falls back to the header). Discord states
+ * `retry_after` in SECONDS — fractional, e.g. `0.75` — so this multiplies by 1000 rather than
+ * routing through the header parser, which reads integer seconds only.
+ *
+ * 🔴 NEVER THROWS, and reads a CLONE. The primitive cancels the original body right after this
+ * returns; reading the clone leaves the original intact for that cancel. A body that is missing,
+ * not JSON, or carries no numeric `retry_after` answers `undefined` — never a wrong delay.
+ */
+export declare function discordBodyRetryAfterMs(res: Response): Promise<number | undefined>;
+/**
+ * Issue ONE Discord REST call with the shared 429 backoff, honouring the body's `retry_after` over
+ * the header. `operation` is the id-free route shape for the named failure. `deps.retry` lets a test
+ * inject a stub sleep/clock; live callers pass nothing.
+ *
+ * Returns the FIRST non-429 response untouched — the caller reads `res.ok`/`res.status`/`res.json()`
+ * exactly as it did before this seam existed. Throws `RateLimitExhaustedError` when a 429 outlasts
+ * the bounded attempts, and re-throws a transport error unretried (an unanswered write may have
+ * applied).
+ */
+export declare function discordFetch(operation: string, url: string, init: RequestInit, deps?: DiscordFetchDeps): Promise<Response>;
+//# sourceMappingURL=discord-rest.d.ts.map

package/dist/agent/channels/discord-rest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-rest.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord-rest.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAE9F,iEAAiE;AACjE,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC,8FAA8F;AAC9F,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CASxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ9H"}

package/dist/agent/channels/discord-rest.js

@@ -0,0 +1,75 @@
+// discord-rest — THE ONE place a Discord REST WRITE call leaves this host (OPE-1236).
+//
+// WHY THIS SEAM EXISTS. Every Discord write in the reply/message-ops path used to be a bare `fetch`
+// with no 429 handling. Discord answers a rate-limited call with HTTP 429, and it states the delay
+// TWICE: in the `Retry-After` header AND in a JSON `retry_after` body field (fractional seconds).
+// The body field is authoritative — Discord's own docs put the precise delay there — so the shared
+// header-only backoff would miss it. This funnel wraps every write call in the shared
+// `withRetryAfter` primitive and feeds it a body-precedence override, so a Discord write honours the
+// delay the vendor actually named. See `docs/extending/provider-rate-limits.md`.
+//
+// 🔴 WHAT THIS SEAM COVERS, EXACTLY. Every Discord WRITE in this package: the reply feature's write
+// seam (`discord-post.ts`), the ancillary message ops (`discord-message-ops.ts`), and — since
+// OPE-1311 — the GATEWAY's own five writes (`discord-gateway.ts`: the completion post-back, the
+// open-DM, the typing indicator, the reaction and the thread open). Every `fetch` in those three
+// files goes through here.
+//
+// It does NOT cover the four READ channels (`discord-read.ts`, `discord-backscroll.ts`,
+// `discord-directory.ts`, `discord-bot-name.ts`), which still hold their own raw `fetch`.
+// `discord-rest-seam-test.ts` § 3 holds that KNOWN-UNCOVERED inventory and reds when a NEW file grows
+// its own bare `fetch(` (a write that would bypass the seam) or a covered file regrows one, so the
+// gap cannot widen unnoticed.
+//
+// The gateway's writes are fail-silent, so they do not all take the shared policy: the two ephemeral
+// affordances (typing, the reaction) pass a tighter one, because both are awaited on the turn's own
+// latency path. `discord-gateway.ts`'s `AFFORDANCE_RETRY` carries that reasoning.
+//
+// The bot token is a SECRET — it rides only the caller's header, never through here, and no response
+// body ever reaches an error string. `operation` is the id-free vendor route SHAPE (e.g.
+// `POST /channels/{id}/messages`) that rides the NAMED `RateLimitExhaustedError`; keep ids out of it,
+// so every field on that error stays safe to log.
+import { withRetryAfter } from "@open-everywhere/core/agent/adapter-api.js";
+/** The provider surface name on the NAMED rate-limit failure. */
+export const DISCORD_SURFACE = "discord";
+/**
+ * Read the honoured delay from a Discord 429 body, in milliseconds, or `undefined` when the body
+ * carries no usable `retry_after` (then the seam falls back to the header). Discord states
+ * `retry_after` in SECONDS — fractional, e.g. `0.75` — so this multiplies by 1000 rather than
+ * routing through the header parser, which reads integer seconds only.
+ *
+ * 🔴 NEVER THROWS, and reads a CLONE. The primitive cancels the original body right after this
+ * returns; reading the clone leaves the original intact for that cancel. A body that is missing,
+ * not JSON, or carries no numeric `retry_after` answers `undefined` — never a wrong delay.
+ */
+export async function discordBodyRetryAfterMs(res) {
+    try {
+        const body = (await res.clone().json());
+        const seconds = body?.retry_after;
+        if (typeof seconds !== "number" || !Number.isFinite(seconds) || seconds < 0)
+            return undefined;
+        return seconds * 1000;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Issue ONE Discord REST call with the shared 429 backoff, honouring the body's `retry_after` over
+ * the header. `operation` is the id-free route shape for the named failure. `deps.retry` lets a test
+ * inject a stub sleep/clock; live callers pass nothing.
+ *
+ * Returns the FIRST non-429 response untouched — the caller reads `res.ok`/`res.status`/`res.json()`
+ * exactly as it did before this seam existed. Throws `RateLimitExhaustedError` when a 429 outlasts
+ * the bounded attempts, and re-throws a transport error unretried (an unanswered write may have
+ * applied).
+ */
+export function discordFetch(operation, url, init, deps = {}) {
+    const send = () => (deps.fetch ?? globalThis.fetch)(url, init);
+    return withRetryAfter(send, {
+        surface: DISCORD_SURFACE,
+        operation,
+        retryAfterMs: (res) => discordBodyRetryAfterMs(res),
+        ...deps.retry,
+    });
+}
+//# sourceMappingURL=discord-rest.js.map

package/dist/agent/channels/discord-rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-rest.js","sourceRoot":"","sources":["../../../agent/channels/discord-rest.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,sFAAsF;AACtF,qGAAqG;AACrG,iFAAiF;AACjF,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,gGAAgG;AAChG,iGAAiG;AACjG,2BAA2B;AAC3B,EAAE;AACF,wFAAwF;AACxF,0FAA0F;AAC1F,sGAAsG;AACtG,mGAAmG;AACnG,8BAA8B;AAC9B,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,kFAAkF;AAClF,EAAE;AACF,qGAAqG;AACrG,yFAAyF;AACzF,sGAAsG;AACtG,kDAAkD;AAElD,OAAO,EAAE,cAAc,EAAoB,MAAM,4CAA4C,CAAC;AAE9F,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAWzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAa;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAqC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,CAAC;QAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9F,OAAO,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,GAAW,EAAE,IAAiB,EAAE,IAAI,GAAqB,EAAE;IACzG,MAAM,IAAI,GAAG,GAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAA0B,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxG,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,OAAO,EAAE,eAAe;QACxB,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAe,CAAC;QAC/D,GAAG,IAAI,CAAC,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/channels/discord.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels/discord").DiscordChannel;
+export default _default;
+//# sourceMappingURL=discord.d.ts.map

package/dist/agent/channels/discord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../agent/channels/discord.ts"],"names":[],"mappings":""}

package/dist/agent/channels/discord.js

@@ -0,0 +1,230 @@
+// The Discord surface. Wires Discord's HTTP Interactions (slash commands) → an
+// OpenEverywhere session, and — the point of the "Discord-binding" slice — populates the
+// session auth context with the REAL Discord identity (guild/channel/user ids + the
+// channel type) so the identity seam (agent/identity/binding.ts) resolves the actual
+// workspace (the guild/server — the org boundary), surface (the channel), mode
+// (channel/dm/mpim), and visibility (fail-closed private) instead of OE_* env
+// stand-ins. Everything downstream — memory partition, access resolver, routine
+// dispatch — then keys off real Discord identity with no further change.
+//
+// Eve's Discord channel is interaction-based, not message-based: there is no
+// app_mention / message event, only `onCommand(ctx, interaction)` for an explicitly
+// invoked slash command. A slash command is already a bot-directed act — you can't
+// invoke the app without targeting it — so it is the natural analogue of Slack's
+// mention-gating: every onCommand is, by construction, "mentioned". We accept both
+// DMs and guild commands and still drop bot-authored invocations, then override
+// onCommand only to attach OUR richer auth via buildDiscordAuth (the eve default
+// derives a thinner, guild-scoped auth). Kept MINIMAL for launch — identity binding +
+// dispatch only; no status-UX / onboarding extras (cf. slack.ts).
+//
+// Credentials: omitted here, so eve falls back to DISCORD_PUBLIC_KEY /
+// DISCORD_APPLICATION_ID / DISCORD_BOT_TOKEN (see .env.example). Swap the credential
+// broker later without touching identity. Capturing the channel type / guild presence is a
+// RAW-fact job; the security-critical interpretation (fail-closed to private) lives in
+// the binding (discordVisibility).
+//
+// FRONTED (see discord-front.ts): the wrapped eve channel sits on an internal route; the
+// public Interactions Endpoint URL is our front, which answers `oe-approval:` approval-card
+// button clicks (admin approvals — approvals/discord-flow.ts) and forwards everything else
+// (PING, slash commands, eve's own HITL clicks) here unchanged. Same option-(c) pattern as
+// the Slack channel (slack-front.ts) and for the same reason: eve exposes no onComponent hook.
+//
+// A THIRD, separate URL (see discord-events.ts) carries Discord's app-level WEBHOOK EVENTS —
+// APPLICATION_AUTHORIZED / APPLICATION_DEAUTHORIZED, i.e. install/uninstall — into the audit
+// trail. Configured on the developer portal's Webhooks page, not the Interactions one.
+import { discordChannel, } from "eve/channels/discord";
+import { buildDiscordAuth, threadParentFromRawChannel, discordMemberPendingFromRaw } from "./discord-identity.js";
+import { finalMessageActionForTurn, NO_REPLY_SENTINEL_REASON, auditNoReplySentinelObserved, isBareStop, consumeRepliedThisTurn, dropClosingProse, resolvePartition, authPrincipalId, } from "@open-everywhere/core/agent/adapter-api.js";
+import { frontDiscordChannel, INTERNAL_DISCORD_ROUTE } from "./discord-front.js";
+import { withDiscordEventsRoute } from "./discord-events.js";
+// The audit partition for a terminal event, rebuilt from the LIVE session state the same
+// way slack.ts rebuilds its own (the completion handler has no auth context): guild →
+// workspace, channel → surface, via the REAL identity seam so rows land exactly where the
+// dispatch partition did. Null on an unidentifiable state (no channel id) — the caller
+// then skips the row (fail-soft; auditing must never fail or post into the turn).
+function auditPartitionForState(state) {
+    if (!state.channelId)
+        return null;
+    try {
+        return resolvePartition({
+            channel: { kind: "discord" },
+            session: { auth: { current: buildDiscordAuth({ userId: "", guildId: state.guildId ?? undefined, channelId: state.channelId }) } },
+        });
+    }
+    catch {
+        return null;
+    }
+}
+// Read the Discord numeric channel `type` from the raw interaction payload. The parsed
+// interaction exposes ids (channel/guild/user) but not the channel kind, which lives in
+// the payload's `channel` object. Used only to tell a DM (1) / group DM (3) from a guild
+// text channel or thread; absent → the binding falls back to guild-presence for mode and
+// fails closed on visibility. Defensive: the payload is Discord's raw JSON.
+function channelTypeFromRaw(raw) {
+    const ch = raw["channel"];
+    if (ch && typeof ch === "object") {
+        const t = ch["type"];
+        if (typeof t === "number")
+            return String(t);
+    }
+    return undefined;
+}
+// Attach OUR richer Discord auth: raw guild/channel/user ids + the channel type (and,
+// for a THREAD, its parent channel id — the raw payload's channel partial carries
+// `parent_id`, so the thread→parent domain/spend grain of item 22 is FREE here, no REST
+// lookup like the gateway's message path needs), which the binding then interprets into
+// workspace/surface/mode/visibility. Drops invocations by another bot — we never act on
+// a bot's command.
+function authFromInteraction(interaction) {
+    if (interaction.user.isBot)
+        return null; // bot actor — drop
+    return buildDiscordAuth({
+        userId: interaction.user.id,
+        guildId: interaction.guildId,
+        channelId: interaction.channelId,
+        channelType: channelTypeFromRaw(interaction.raw),
+        parentChannelId: threadParentFromRawChannel(interaction.raw),
+        // Guest/unverified detection (OPE-60): the interaction payload carries the guild `member`
+        // object (incl. `member.pending`) for FREE — no privileged intent, no REST call. A pending
+        // member hasn't cleared membership screening → the binding demotes trust to external.
+        memberPending: discordMemberPendingFromRaw(interaction.raw),
+    });
+}
+const discordInteractionChannel = discordChannel({
+    // Internal mount — the public URL is the approval-click front (frontDiscordChannel below).
+    route: INTERNAL_DISCORD_ROUTE,
+    // 🔴 QUEUE, NEVER STEER (OPE-412) — eve's default `steer` cancels the turn in flight when a
+    // message arrives. Same reasoning as the Slack channel; see slack.ts for the full note.
+    turnPolicy: "queue",
+    onCommand: async (ctx, interaction) => {
+        const auth = authFromInteraction(interaction);
+        if (auth === null)
+            return null; // bot author / unactionable → ack without dispatch
+        try {
+            await ctx.discord.startTyping();
+        }
+        catch {
+            /* typing indicator is best-effort */
+        }
+        return { auth };
+    },
+    events: {
+        // Authoring this handler REPLACES eve's Discord default for "turn.started" (verified in
+        // node_modules/eve/dist/.../discord/defaults.js: `async "turn.started"(e,t,n){await
+        // t.discord.startTyping()}`), so we replicate that default body verbatim first, matching the
+        // discipline channels/slack.ts's own turn.started comment documents.
+        //
+        // OPE-645: REPLY PRINCIPAL snapshot — the same T1.4 pattern channels/slack.ts,
+        // channels/teams.ts and discord-gateway.ts each use for their own: message.completed
+        // has no live auth ctx (eve rewrites session.auth.current on every delivery, and this channel
+        // runs `turnPolicy: "queue"`, so a later queued delivery can overwrite it before this turn's
+        // own message.completed fires), but turn.started does. authPrincipalId(ctx) is the exact read
+        // bindFrom(ctx).principalId falls back to for an ordinary human turn (identity/binding.ts) —
+        // snapshotting it here means the DROP row this handler writes since OPE-2006 names the same
+        // person the turn's egress.policy rows already do. It is no longer a `reply.post` row: nothing
+        // posts here.
+        "turn.started": async (_data, channel, ctx) => {
+            // Snapshot FIRST — the attribution must not depend on the typing call succeeding (the
+            // same discipline the Slack sibling states for its supervisor target snapshot).
+            channel.state.oeReplyPrincipalId = authPrincipalId(ctx);
+            await channel.discord.startTyping();
+        },
+        // Override the reply-posting handler for ONE addition: a fired `watch` routine
+        // ends its turn with the silence sentinel when the watched state is unchanged
+        // (routines/watch.ts) — swallow it, never post it. Mirrors the Slack override
+        // (channels/slack.ts) and the Teams one, via the shared, unit-tested
+        // finalMessageAction() decision. Everything else matches eve's Discord default
+        // (tool-calls and empty final messages post nothing). Only routine fires teach
+        // the sentinel on this surface; slash-command replies are unaffected.
+        "message.completed": async (data, channel, ctx) => {
+            const sessionId = ctx?.session?.id; // stamped into the terminal audit rows → joins to the transcript
+            // OPE-1647: the TURN ID, so the stand-down silence mark (channels/stand-down-silence.ts) can
+            // prove it belongs to THIS turn. Same extraction idiom this file already uses for the §POSTED
+            // consume below.
+            // 🔴 SINCE OPE-2006 IT SERVES THE SILENCE DECISION ALONE. It is read once here and handed to
+            // `finalMessageActionForTurn`, whose `consumeStandDownSilenceThisTurn(turnId)` is its only
+            // reader on this path. There is no reply audit below to stamp it onto: this surface DROPS its
+            // closing prose, so the durable latch that guarded the old post has no door left to shut here.
+            const turnId = ctx?.session?.turn?.id;
+            const action = finalMessageActionForTurn(data.finishReason, data.message, turnId);
+            // An interim tool-call step, not the turn's end — don't consume the reply signal here:
+            // the tool this step is about to run may be the `reply` call itself (mirrors slack.ts).
+            if (action.kind === "buffer-tool-status")
+                return;
+            // Terminal decision — read-and-reset the reply-tool signal once, on every terminal
+            // branch (post OR silent), so it never bleeds into the next turn (same contract as
+            // slack.ts's reactedThisTurn/repliedThisTurn consume). TURN-ID KEYED (OPE-805): only THIS
+            // turn's own mark answers true — see reply-signal.ts's header.
+            const repliedThisTurn = consumeRepliedThisTurn(ctx?.session?.turn?.id);
+            if (action.kind !== "post") {
+                // Only log a genuinely JUDGED silence (the NO_REPLY sentinel, or the no_reply
+                // tool) — an ordinary empty completion (nothing to say, no judgment made) isn't
+                // worth a log line.
+                if (action.kind === "silent" && action.reason !== "empty final message") {
+                    console.log(`[open-everywhere:discord] judged silence (${action.reason}) — nothing posted (channel ${channel.state.channelId ?? "?"})`);
+                }
+                // ACTIONS-ONLY posture (audit-wedge build plan §1c, 2026-07-14): a judged silence is not
+                // an audited action — the transcript answers "why did it stay quiet?", not the audit log.
+                // The console line above stays; the bare-stop WARN below stays (an anomaly, not a silence).
+                //
+                // ONE exception (OPE-890): the model ended the turn on the bare NO_REPLY sentinel — the
+                // TOOL route already carries an always-on `reply.no_reply_observed` row (tools/no_reply.ts,
+                // OPE-649); this is the sentinel route's twin, same action name, best-effort. Reached only
+                // for a genuine bare-sentinel turn — finalMessageActionForTurn already resolves the tool
+                // route to its own `no_reply tool: …` reason, so a tool-called turn never lands here.
+                if (action.kind === "silent" && action.reason === NO_REPLY_SENTINEL_REASON) {
+                    const p = auditPartitionForState(channel.state);
+                    if (p)
+                        await auditNoReplySentinelObserved(p, sessionId).catch(() => undefined);
+                }
+                // Bare-stop enforcement (see slack-events.ts's isBareStop header for the full
+                // rationale — DETECT-AND-LOG, not a hard gate). `react` is Slack-only (no
+                // Discord equivalent wired), but the reply-tool family (reply-signal.ts) IS armed
+                // here, so a `reply`-then-silent turn must not be mis-flagged. The bare stop is
+                // ALSO covered by the discord.no_reply row above (reason "empty final message").
+                if (action.kind === "silent" && isBareStop(action, repliedThisTurn)) {
+                    console.warn(`[open-everywhere:discord] BARE STOP — turn ended with no reply and no no_reply (channel ${channel.state.channelId ?? "?"}) — this usually means a judgment call went missing, not that one was made.`);
+                }
+                return;
+            }
+            // 🔴 THE CLOSING PROSE IS DROPPED, NOT POSTED (OPE-2006). This branch used to route the
+            // terminal reply through `postTerminalProse`, with a raw `channel.discord.post` fallback for an
+            // unidentifiable state. Both are gone: the `reply` tool is the only channel a seat's words
+            // leave by, so a turn that ended in prose and never called `reply` has said nothing here. The
+            // row is the record — no re-send, no queue, no host-side re-post.
+            // WHAT TELLS THE MODEL is the seat prompt: Discord declares `closingProseDropped`, so a
+            // conversational seat here reads the `reply-only` delivery arm, whose copy states that the
+            // turn-final text is discarded — inside its persona when the token is supervisor-shaped, and
+            // through the `delivery` slot when it is not (instructions/access.ts `renderDeliverySlot`).
+            {
+                const p = auditPartitionForState(channel.state);
+                if (p) {
+                    await dropClosingProse({
+                        row: {
+                            org: p.org,
+                            platform: p.platform,
+                            workspace: p.workspace,
+                            surface: p.surface,
+                            principalId: channel.state.oeReplyPrincipalId,
+                        },
+                        chars: action.text.length,
+                        ...(sessionId ? { sessionId } : {}),
+                        anchor: { channelId: channel.state.channelId ?? null },
+                        log: (m) => console.warn(`[open-everywhere:discord] ${m} (channel ${channel.state.channelId ?? "?"})`),
+                    });
+                }
+                else {
+                    // No resolvable partition, so there is no row to file it under — the drop still happens and
+                    // the log line is the whole record, the same honest degradation the silence branches above
+                    // take on an unidentifiable state.
+                    console.warn(`[open-everywhere:discord] closing prose DROPPED (${action.text.length}c) — nothing posted, and no partition to audit it under (channel ${channel.state.channelId ?? "?"})`);
+                }
+            }
+        },
+    },
+});
+// FRONTED (interactions) + the app-level WEBHOOK EVENTS route (discord-events.ts): a separate,
+// additive URL that audits APPLICATION_AUTHORIZED / APPLICATION_DEAUTHORIZED so install/uninstall
+// is observable. Observability only — it gates nothing and never reaches a session.
+export default withDiscordEventsRoute(frontDiscordChannel(discordInteractionChannel));
+//# sourceMappingURL=discord.js.map

package/dist/agent/channels/discord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord.js","sourceRoot":"","sources":["../../../agent/channels/discord.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,yFAAyF;AACzF,oFAAoF;AACpF,qFAAqF;AACrF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,oFAAoF;AACpF,mFAAmF;AACnF,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,iFAAiF;AACjF,sFAAsF;AACtF,kEAAkE;AAClE,EAAE;AACF,uEAAuE;AACvE,qFAAqF;AACrF,2FAA2F;AAC3F,uFAAuF;AACvF,mCAAmC;AACnC,EAAE;AACF,yFAAyF;AACzF,4FAA4F;AAC5F,2FAA2F;AAC3F,2FAA2F;AAC3F,+FAA+F;AAC/F,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,uFAAuF;AAEvF,OAAO,EACL,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,2BAA2B,EAAkC,MAAM,uBAAuB,CAAC;AAClJ,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAEhB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,yFAAyF;AACzF,sFAAsF;AACtF,0FAA0F;AAC1F,uFAAuF;AACvF,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,KAA2D;IACzF,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE;SAClI,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,GAA4B;IACtD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1B,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAI,EAA8B,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sFAAsF;AACtF,kFAAkF;AAClF,wFAAwF;AACxF,wFAAwF;AACxF,wFAAwF;AACxF,mBAAmB;AACnB,SAAS,mBAAmB,CAAC,WAAsC;IACjE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;IAC5D,OAAO,gBAAgB,CAAC;QACtB,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE;QAC3B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,WAAW,EAAE,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC;QAChD,eAAe,EAAE,0BAA0B,CAAC,WAAW,CAAC,GAAG,CAAC;QAC5D,0FAA0F;QAC1F,2FAA2F;QAC3F,sFAAsF;QACtF,aAAa,EAAE,2BAA2B,CAAC,WAAW,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,yBAAyB,GAAG,cAAc,CAAC;IAC/C,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,4FAA4F;IAC5F,wFAAwF;IACxF,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,KAAK,EAAE,GAAmB,EAAE,WAAsC,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;QACnF,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,EAAE;QACN,wFAAwF;QACxF,oFAAoF;QACpF,6FAA6F;QAC7F,qEAAqE;QACrE,EAAE;QACF,+EAA+E;QAC/E,qFAAqF;QACrF,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,cAAc;QACd,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC5C,sFAAsF;YACtF,gFAAgF;YAC/E,OAAO,CAAC,KAA4C,CAAC,kBAAkB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAChG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC;QACD,+EAA+E;QAC/E,8EAA8E;QAC9E,8EAA8E;QAC9E,qEAAqE;QACrE,+EAA+E;QAC/E,+EAA+E;QAC/E,sEAAsE;QACtE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,iEAAiE;YACrG,6FAA6F;YAC7F,8FAA8F;YAC9F,iBAAiB;YACjB,6FAA6F;YAC7F,2FAA2F;YAC3F,8FAA8F;YAC9F,+FAA+F;YAC/F,MAAM,MAAM,GAAI,GAA2D,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/F,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClF,uFAAuF;YACvF,wFAAwF;YACxF,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB;gBAAE,OAAO;YACjD,mFAAmF;YACnF,mFAAmF;YACnF,0FAA0F;YAC1F,+DAA+D;YAC/D,MAAM,eAAe,GAAG,sBAAsB,CAAE,GAA2D,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAChI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,8EAA8E;gBAC9E,gFAAgF;gBAChF,oBAAoB;gBACpB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,MAAM,+BAA+B,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC,CAAC;gBAC1I,CAAC;gBACD,yFAAyF;gBACzF,0FAA0F;gBAC1F,4FAA4F;gBAC5F,EAAE;gBACF,wFAAwF;gBACxF,4FAA4F;gBAC5F,2FAA2F;gBAC3F,yFAAyF;gBACzF,sFAAsF;gBACtF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;oBAC3E,MAAM,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAChD,IAAI,CAAC;wBAAE,MAAM,4BAA4B,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACjF,CAAC;gBACD,8EAA8E;gBAC9E,0EAA0E;gBAC1E,kFAAkF;gBAClF,gFAAgF;gBAChF,iFAAiF;gBACjF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;oBACpE,OAAO,CAAC,IAAI,CACV,2FAA2F,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,6EAA6E,CACvM,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YACD,wFAAwF;YACxF,gGAAgG;YAChG,2FAA2F;YAC3F,8FAA8F;YAC9F,kEAAkE;YAClE,wFAAwF;YACxF,2FAA2F;YAC3F,6FAA6F;YAC7F,4FAA4F;YAC5F,CAAC;gBACC,MAAM,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAChD,IAAI,CAAC,EAAE,CAAC;oBACN,MAAM,gBAAgB,CAAC;wBACrB,GAAG,EAAE;4BACH,GAAG,EAAE,CAAC,CAAC,GAAG;4BACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;4BACpB,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,OAAO,EAAE,CAAC,CAAC,OAAO;4BAClB,WAAW,EAAG,OAAO,CAAC,KAA4C,CAAC,kBAAwC;yBAC5G;wBACD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;wBACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE;wBACtD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,aAAa,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC;qBACvG,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,4FAA4F;oBAC5F,2FAA2F;oBAC3F,mCAAmC;oBACnC,OAAO,CAAC,IAAI,CACV,oDAAoD,MAAM,CAAC,IAAI,CAAC,MAAM,oEAAoE,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,CAC5K,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,+FAA+F;AAC/F,kGAAkG;AAClG,oFAAoF;AACpF,eAAe,sBAAsB,CAAC,mBAAmB,CAAC,yBAAyB,CAAC,CAAC,CAAC"}

package/dist/agent/commands/discord-command-sync.d.ts

@@ -0,0 +1,66 @@
+import type { SurfaceCommandOutcome, SurfaceCommandScope } from "@open-everywhere/core/agent/adapter-api.js";
+import { type DiscordFetchLike } from "../channels/discord-rest.js";
+/** The projected shape both sides are compared in — exactly the fields this deployment declares. */
+export interface ProjectedOption {
+    readonly name: string;
+    readonly description: string;
+    readonly type: number;
+    readonly required: boolean;
+    readonly min_value?: number;
+    readonly max_value?: number;
+    readonly options: readonly ProjectedOption[];
+}
+export interface ProjectedCommand {
+    readonly name: string;
+    readonly type: number;
+    readonly description: string;
+    readonly options: readonly ProjectedOption[];
+}
+/**
+ * Project one ApplicationCommand — declared or vendor-held — onto the fields this deployment sets.
+ * Returns undefined for anything that is not an object with a name, which is what a malformed or
+ * unexpected list entry looks like.
+ *
+ * OPTION ORDER IS PART OF THE PROJECTION. Discord renders a command's options in the order they were
+ * registered, so a reordered list is a real user-visible difference and must be written. Discord
+ * returns them in the registered order, so a steady state never reorders on its own.
+ */
+export declare function projectCommand(raw: unknown): ProjectedCommand | undefined;
+export interface DiscordCommandDrift {
+    /** Does Discord need a write for this command? */
+    readonly changed: boolean;
+    /** Why — one id-free line for the boot log. */
+    readonly reason: string;
+}
+/**
+ * Compare the command this deployment DECLARES against the list Discord HOLDS at one scope.
+ *
+ * `held` is the raw array Discord's GET returned. Only the entry whose name matches the declared
+ * command is considered: every other command at that scope belongs to someone else and this plane
+ * neither reads nor writes it.
+ */
+export declare function discordCommandDrift(declared: unknown, held: unknown): DiscordCommandDrift;
+export interface DiscordCommandSyncDeps {
+    readonly fetch?: DiscordFetchLike;
+    /** Overrides the env reads. Live boot passes neither; a test passes both. */
+    readonly applicationId?: string;
+    readonly botToken?: string;
+    /** The ceiling on ONE call. Defaults to {@link CALL_TIMEOUT_MS}. */
+    readonly timeoutMs?: number;
+    /** The ceiling on the WHOLE reconcile. Defaults to {@link RECONCILE_BUDGET_MS}. */
+    readonly budgetMs?: number;
+}
+/**
+ * THE RECONCILER the discord bundle registers with core's command plane.
+ *
+ * Runs at boot, so it is gated on BOTH deployment credentials being present: `DISCORD_APPLICATION_ID`
+ * says which app this is and `DISCORD_BOT_TOKEN` authenticates the call. Either missing ⇒ `skipped`,
+ * which is the correct reading of a deployment that carries the bundle but no Discord app — and it is
+ * also what keeps every offline test tier network-free, since no test publishes an application id.
+ *
+ * 🔴 THESE TWO STAY ENV. They are the credential pair this deployment speaks as, which is exactly the
+ * `secret`/`identity` half of the config-as-code line. The GUILD ids do not: they are tracked literals
+ * in `agent/commands/discord-commands.ts` and arrive here as the declared scope.
+ */
+export declare function reconcileDiscordCommands(scope: SurfaceCommandScope, deps?: DiscordCommandSyncDeps): Promise<SurfaceCommandOutcome>;
+//# sourceMappingURL=discord-command-sync.d.ts.map

package/dist/agent/commands/discord-command-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord-command-sync.d.ts","sourceRoot":"","sources":["../../../agent/commands/discord-command-sync.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAe,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAC1H,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAiClF,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAWzE;AAQD,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,mBAAmB,CAgBzF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,mBAAmB,EAAE,IAAI,GAAE,sBAA2B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsB5I"}