@open-mercato/channel-discord 0.6.8-develop.7090.1.4dbca7b350

package/dist/modules/channel_discord/lib/interactions-handler.js

@@ -0,0 +1,115 @@
+import { DISCORD_MESSAGE_FLAG_EPHEMERAL } from "./discord-rest.js";
+import {
+  isDispatchableInteractionType,
+  readDispatchableInteraction
+} from "./interactions-dispatch.js";
+import {
+  DiscordInteractionResponseType,
+  DiscordInteractionType,
+  hasVerifiableSignatureHeaders,
+  isSignatureTimestampFresh,
+  parseInteractionBody,
+  readInteractionApplicationId,
+  verifyDiscordSignature
+} from "./interactions-verify.js";
+const DEFAULT_INTERACTION_MESSAGES = {
+  notDispatchable: "This interaction is missing the channel or user context Open Mercato needs, so it was not recorded.",
+  unsupported: "The Open Mercato Discord channel does not handle this interaction type."
+};
+function ephemeralReply(content) {
+  return {
+    type: DiscordInteractionResponseType.CHANNEL_MESSAGE_WITH_SOURCE,
+    data: { content, flags: DISCORD_MESSAGE_FLAG_EPHEMERAL }
+  };
+}
+function screenInteractionRequest(input) {
+  const { signatureHex, timestamp, freshness } = input;
+  if (!isSignatureTimestampFresh(timestamp, freshness)) {
+    return { status: 401, body: { error: "stale_timestamp" }, matchedChannel: null };
+  }
+  if (!hasVerifiableSignatureHeaders(signatureHex, timestamp)) {
+    return { status: 401, body: { error: "invalid_signature" }, matchedChannel: null };
+  }
+  return null;
+}
+async function resolveDiscordInteraction(input) {
+  const { rawBody, signatureHex, timestamp, loadCandidates, freshness, messages } = input;
+  const screened = screenInteractionRequest({ signatureHex, timestamp, freshness });
+  if (screened) return screened;
+  const candidates = await loadCandidates({ applicationId: readInteractionApplicationId(rawBody) });
+  return handleDiscordInteraction({ rawBody, signatureHex, timestamp, candidates, freshness, messages });
+}
+function handleDiscordInteraction(input) {
+  const { rawBody, signatureHex, timestamp, candidates, freshness } = input;
+  const messages = input.messages ?? DEFAULT_INTERACTION_MESSAGES;
+  const screened = screenInteractionRequest({ signatureHex, timestamp, freshness });
+  if (screened) return screened;
+  let matched = null;
+  for (const candidate of candidates) {
+    const ok = verifyDiscordSignature({
+      publicKeyHex: candidate.publicKey,
+      signatureHex,
+      timestamp,
+      rawBody
+    });
+    if (ok) {
+      matched = candidate;
+      break;
+    }
+  }
+  if (!matched) {
+    return { status: 401, body: { error: "invalid_signature" }, matchedChannel: null };
+  }
+  const interaction = parseInteractionBody(rawBody);
+  if (!interaction) {
+    return { status: 400, body: { error: "invalid_interaction" }, matchedChannel: matched };
+  }
+  if (interaction.type === DiscordInteractionType.PING) {
+    return {
+      status: 200,
+      body: { type: DiscordInteractionResponseType.PONG },
+      matchedChannel: matched
+    };
+  }
+  if (isDispatchableInteractionType(interaction.type)) {
+    const dispatch = readDispatchableInteraction(interaction);
+    if (!dispatch) {
+      return {
+        status: 200,
+        body: ephemeralReply(messages.notDispatchable),
+        matchedChannel: matched,
+        dispatch: null
+      };
+    }
+    return {
+      status: 200,
+      body: { type: DiscordInteractionResponseType.DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE },
+      matchedChannel: matched,
+      dispatch
+    };
+  }
+  if (interaction.type === DiscordInteractionType.APPLICATION_COMMAND_AUTOCOMPLETE) {
+    return {
+      status: 200,
+      body: {
+        type: DiscordInteractionResponseType.APPLICATION_COMMAND_AUTOCOMPLETE_RESULT,
+        data: { choices: [] }
+      },
+      matchedChannel: matched,
+      dispatch: null
+    };
+  }
+  return {
+    status: 200,
+    body: ephemeralReply(messages.unsupported),
+    matchedChannel: matched,
+    dispatch: null
+  };
+}
+export {
+  DEFAULT_INTERACTION_MESSAGES,
+  handleDiscordInteraction,
+  resolveDiscordInteraction,
+  screenInteractionRequest
+};
+//# sourceMappingURL=interactions-handler.js.map

package/dist/modules/channel_discord/lib/interactions-handler.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/interactions-handler.ts"],
+  "sourcesContent": ["import { DISCORD_MESSAGE_FLAG_EPHEMERAL } from './discord-rest'\nimport {\n  isDispatchableInteractionType,\n  readDispatchableInteraction,\n  type DispatchableInteraction,\n} from './interactions-dispatch'\nimport {\n  DiscordInteractionResponseType,\n  DiscordInteractionType,\n  hasVerifiableSignatureHeaders,\n  isSignatureTimestampFresh,\n  parseInteractionBody,\n  readInteractionApplicationId,\n  verifyDiscordSignature,\n  type TimestampFreshnessOptions,\n} from './interactions-verify'\n\nexport interface InteractionCandidate {\n  channelId: string\n  /** Hub channel type, carried through so the dispatch job matches the gateway's. */\n  channelType: string\n  tenantId: string\n  organizationId: string | null\n  publicKey: string\n  /** Discord application this channel's bot belongs to; `null` when unknown. */\n  applicationId: string | null\n  /**\n   * Scope `integrationCredentialsService.resolve` must be called with to obtain\n   * this channel's bot token. Carried instead of the token itself so no\n   * credential ever reaches a queue payload.\n   */\n  credentialScope: { tenantId: string; organizationId: string; userId: string | null }\n}\n\n/**\n * The two user-visible strings the synchronous handler can have to emit.\n *\n * They are passed in rather than translated here so the handler stays pure and\n * synchronous \u2014 Discord gives the endpoint three seconds, and the caller already\n * knows the locale.\n */\nexport interface InteractionMessages {\n  /** Verified, but the payload carries no channel / user / token to dispatch. */\n  notDispatchable: string\n  /** Verified and well-formed, but this provider does not handle the type. */\n  unsupported: string\n}\n\nexport const DEFAULT_INTERACTION_MESSAGES: InteractionMessages = {\n  notDispatchable:\n    'This interaction is missing the channel or user context Open Mercato needs, so it was not recorded.',\n  unsupported: 'The Open Mercato Discord channel does not handle this interaction type.',\n}\n\nfunction ephemeralReply(content: string): Record<string, unknown> {\n  return {\n    type: DiscordInteractionResponseType.CHANNEL_MESSAGE_WITH_SOURCE,\n    data: { content, flags: DISCORD_MESSAGE_FLAG_EPHEMERAL },\n  }\n}\n\n/**\n * What the candidate loader is allowed to narrow by. `applicationId` comes from\n * the unverified request body, so it may only ever shrink the candidate set \u2014\n * see `readInteractionApplicationId`.\n */\nexport interface InteractionCandidateFilter {\n  applicationId: string | null\n}\n\nexport interface InteractionResult {\n  status: number\n  /** JSON body to return (Discord expects a response type for verified interactions). */\n  body: Record<string, unknown>\n  /** The channel the signature verified against (tenant-pinned). Null on reject. */\n  matchedChannel: InteractionCandidate | null\n  /**\n   * Work the caller MUST hand off when the body above is a deferred\n   * acknowledgement. Non-null exactly when the response promises a follow-up:\n   * ignoring it is what leaves the user staring at \"thinking\u2026\" forever.\n   */\n  dispatch?: DispatchableInteraction | null\n}\n\n/**\n * Request-only rejection gate, evaluated before anything tenant-scoped is loaded.\n *\n * WHY IT EXISTS: this endpoint is unauthenticated by design, so any caller can\n * POST to it. Everything decidable from the request alone \u2014 a missing, malformed\n * or wrong-length signature header, a missing or stale timestamp \u2014 is decided\n * here, so that traffic never reaches the candidate loader and never costs a\n * database round-trip or a credential decrypt.\n *\n * Returns the rejection to send, or `null` when the request is well-formed\n * enough that candidates must be loaded to answer it. It is deliberately\n * signature-*shape* only: whether the signature actually verifies still requires\n * a public key, and that check stays where it was.\n */\nexport function screenInteractionRequest(input: {\n  signatureHex: string | undefined | null\n  timestamp: string | undefined | null\n  freshness?: TimestampFreshnessOptions\n}): InteractionResult | null {\n  const { signatureHex, timestamp, freshness } = input\n\n  if (!isSignatureTimestampFresh(timestamp, freshness)) {\n    return { status: 401, body: { error: 'stale_timestamp' }, matchedChannel: null }\n  }\n  if (!hasVerifiableSignatureHeaders(signatureHex, timestamp)) {\n    return { status: 401, body: { error: 'invalid_signature' }, matchedChannel: null }\n  }\n  return null\n}\n\n/**\n * Screen the request, then load only the candidates that could plausibly match\n * it, then dispatch.\n *\n * This is the order the HTTP route must follow, expressed once and injectable so\n * it can be tested without a database: `loadCandidates` is not called at all for\n * a request the screening gate rejects, and when it is called it receives the\n * `application_id` narrowing so the Ed25519 fan-out runs over the channels of\n * one Discord application instead of every Discord channel in the installation.\n *\n * The narrowing is a NARROWING, never an authorization decision \u2014 the signature\n * gate below is unchanged, so a body that claims someone else's `application_id`\n * still fails unless it also carries that application's signature.\n */\nexport async function resolveDiscordInteraction(input: {\n  rawBody: string\n  signatureHex: string | undefined | null\n  timestamp: string | undefined | null\n  loadCandidates: (filter: InteractionCandidateFilter) => Promise<InteractionCandidate[]>\n  freshness?: TimestampFreshnessOptions\n  messages?: InteractionMessages\n}): Promise<InteractionResult> {\n  const { rawBody, signatureHex, timestamp, loadCandidates, freshness, messages } = input\n\n  const screened = screenInteractionRequest({ signatureHex, timestamp, freshness })\n  if (screened) return screened\n\n  const candidates = await loadCandidates({ applicationId: readInteractionApplicationId(rawBody) })\n  return handleDiscordInteraction({ rawBody, signatureHex, timestamp, candidates, freshness, messages })\n}\n\n/**\n * Core Discord Interactions dispatch \u2014 pure and testable (no HTTP/DB).\n *\n * SECURITY (fail-closed): the request is rejected (401) unless its Ed25519\n * signature verifies against exactly one candidate channel's public key. The\n * matched channel pins the tenant, so one tenant's interaction never lands in\n * another tenant's scope. A tampered / missing signature verifies against no\n * candidate \u2192 401, and no tenant-scoped work is done.\n *\n * REPLAY GUARD: the signed timestamp must be within\n * `DISCORD_SIGNATURE_MAX_SKEW_SECONDS` of the server clock. The check runs\n * BEFORE the per-candidate Ed25519 fan-out, so a replayed capture (still\n * cryptographically valid forever) is rejected without any verify work.\n *\n * COST: this function only decides what to do with candidates it is handed.\n * Callers that have to *load* those candidates first must run\n * `screenInteractionRequest` before doing so \u2014 that is what keeps an unsigned or\n * stale request genuinely constant-cost rather than merely cheap after the\n * database has already been read (`resolveDiscordInteraction` does it for them).\n *\n * On the mandatory PING (type 1) handshake it returns `{ type: 1 }` (PONG) so\n * Discord accepts the endpoint URL.\n *\n * Application commands, message components and modal submissions return a\n * deferred acknowledgement TOGETHER WITH the `dispatch` the caller must hand to\n * the interactions worker: that worker normalizes the interaction into the hub's\n * existing inbound path and replaces the deferred ack with a real message. The\n * two travel in one result on purpose \u2014 a deferred ack nobody follows up is the\n * permanent \"thinking\u2026\" state this endpoint used to produce.\n *\n * Autocomplete is answered synchronously with an empty choice list, the only\n * response Discord accepts for it, and anything else gets a visible, ephemeral\n * \"not handled\" reply rather than a promise this provider cannot keep.\n */\nexport function handleDiscordInteraction(input: {\n  rawBody: string\n  signatureHex: string | undefined | null\n  timestamp: string | undefined | null\n  candidates: InteractionCandidate[]\n  freshness?: TimestampFreshnessOptions\n  messages?: InteractionMessages\n}): InteractionResult {\n  const { rawBody, signatureHex, timestamp, candidates, freshness } = input\n  const messages = input.messages ?? DEFAULT_INTERACTION_MESSAGES\n\n  const screened = screenInteractionRequest({ signatureHex, timestamp, freshness })\n  if (screened) return screened\n\n  let matched: InteractionCandidate | null = null\n  for (const candidate of candidates) {\n    const ok = verifyDiscordSignature({\n      publicKeyHex: candidate.publicKey,\n      signatureHex,\n      timestamp,\n      rawBody,\n    })\n    if (ok) {\n      matched = candidate\n      break\n    }\n  }\n\n  if (!matched) {\n    // FAIL-CLOSED \u2014 never acknowledge an unverified interaction.\n    return { status: 401, body: { error: 'invalid_signature' }, matchedChannel: null }\n  }\n\n  const interaction = parseInteractionBody(rawBody)\n  if (!interaction) {\n    return { status: 400, body: { error: 'invalid_interaction' }, matchedChannel: matched }\n  }\n\n  if (interaction.type === DiscordInteractionType.PING) {\n    return {\n      status: 200,\n      body: { type: DiscordInteractionResponseType.PONG },\n      matchedChannel: matched,\n    }\n  }\n\n  if (isDispatchableInteractionType(interaction.type)) {\n    const dispatch = readDispatchableInteraction(interaction)\n    if (!dispatch) {\n      // Deferring here would be a promise we cannot keep: without the follow-up\n      // token or the channel there is nothing to edit the placeholder with.\n      return {\n        status: 200,\n        body: ephemeralReply(messages.notDispatchable),\n        matchedChannel: matched,\n        dispatch: null,\n      }\n    }\n    return {\n      status: 200,\n      body: { type: DiscordInteractionResponseType.DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE },\n      matchedChannel: matched,\n      dispatch,\n    }\n  }\n\n  if (interaction.type === DiscordInteractionType.APPLICATION_COMMAND_AUTOCOMPLETE) {\n    // Discord rejects a deferred ack for autocomplete. No command this provider\n    // registers declares an autocompleting option, so an empty list is the\n    // honest answer and it closes the request immediately.\n    return {\n      status: 200,\n      body: {\n        type: DiscordInteractionResponseType.APPLICATION_COMMAND_AUTOCOMPLETE_RESULT,\n        data: { choices: [] },\n      },\n      matchedChannel: matched,\n      dispatch: null,\n    }\n  }\n\n  return {\n    status: 200,\n    body: ephemeralReply(messages.unsupported),\n    matchedChannel: matched,\n    dispatch: null,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAiCA,MAAM,+BAAoD;AAAA,EAC/D,iBACE;AAAA,EACF,aAAa;AACf;AAEA,SAAS,eAAe,SAA0C;AAChE,SAAO;AAAA,IACL,MAAM,+BAA+B;AAAA,IACrC,MAAM,EAAE,SAAS,OAAO,+BAA+B;AAAA,EACzD;AACF;AAuCO,SAAS,yBAAyB,OAIZ;AAC3B,QAAM,EAAE,cAAc,WAAW,UAAU,IAAI;AAE/C,MAAI,CAAC,0BAA0B,WAAW,SAAS,GAAG;AACpD,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,kBAAkB,GAAG,gBAAgB,KAAK;AAAA,EACjF;AACA,MAAI,CAAC,8BAA8B,cAAc,SAAS,GAAG;AAC3D,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,oBAAoB,GAAG,gBAAgB,KAAK;AAAA,EACnF;AACA,SAAO;AACT;AAgBA,eAAsB,0BAA0B,OAOjB;AAC7B,QAAM,EAAE,SAAS,cAAc,WAAW,gBAAgB,WAAW,SAAS,IAAI;AAElF,QAAM,WAAW,yBAAyB,EAAE,cAAc,WAAW,UAAU,CAAC;AAChF,MAAI,SAAU,QAAO;AAErB,QAAM,aAAa,MAAM,eAAe,EAAE,eAAe,6BAA6B,OAAO,EAAE,CAAC;AAChG,SAAO,yBAAyB,EAAE,SAAS,cAAc,WAAW,YAAY,WAAW,SAAS,CAAC;AACvG;AAoCO,SAAS,yBAAyB,OAOnB;AACpB,QAAM,EAAE,SAAS,cAAc,WAAW,YAAY,UAAU,IAAI;AACpE,QAAM,WAAW,MAAM,YAAY;AAEnC,QAAM,WAAW,yBAAyB,EAAE,cAAc,WAAW,UAAU,CAAC;AAChF,MAAI,SAAU,QAAO;AAErB,MAAI,UAAuC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,KAAK,uBAAuB;AAAA,MAChC,cAAc,UAAU;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,IAAI;AACN,gBAAU;AACV;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AAEZ,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,oBAAoB,GAAG,gBAAgB,KAAK;AAAA,EACnF;AAEA,QAAM,cAAc,qBAAqB,OAAO;AAChD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,sBAAsB,GAAG,gBAAgB,QAAQ;AAAA,EACxF;AAEA,MAAI,YAAY,SAAS,uBAAuB,MAAM;AACpD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,EAAE,MAAM,+BAA+B,KAAK;AAAA,MAClD,gBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,8BAA8B,YAAY,IAAI,GAAG;AACnD,UAAM,WAAW,4BAA4B,WAAW;AACxD,QAAI,CAAC,UAAU;AAGb,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM,eAAe,SAAS,eAAe;AAAA,QAC7C,gBAAgB;AAAA,QAChB,UAAU;AAAA,MACZ;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,EAAE,MAAM,+BAA+B,qCAAqC;AAAA,MAClF,gBAAgB;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,uBAAuB,kCAAkC;AAIhF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,+BAA+B;AAAA,QACrC,MAAM,EAAE,SAAS,CAAC,EAAE;AAAA,MACtB;AAAA,MACA,gBAAgB;AAAA,MAChB,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,MAAM,eAAe,SAAS,WAAW;AAAA,IACzC,gBAAgB;AAAA,IAChB,UAAU;AAAA,EACZ;AACF;",
+  "names": []
+}

package/dist/modules/channel_discord/lib/interactions-queue.js

@@ -0,0 +1,17 @@
+import { createModuleQueue } from "@open-mercato/queue";
+const CHANNEL_DISCORD_INTERACTIONS_QUEUE = "channel_discord_interactions";
+const INTERACTIONS_QUEUE_CONCURRENCY = 5;
+let cachedQueue = null;
+function getInteractionDispatchQueue() {
+  if (!cachedQueue) {
+    cachedQueue = createModuleQueue(CHANNEL_DISCORD_INTERACTIONS_QUEUE, {
+      concurrency: INTERACTIONS_QUEUE_CONCURRENCY
+    });
+  }
+  return cachedQueue;
+}
+export {
+  CHANNEL_DISCORD_INTERACTIONS_QUEUE,
+  getInteractionDispatchQueue
+};
+//# sourceMappingURL=interactions-queue.js.map

package/dist/modules/channel_discord/lib/interactions-queue.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/interactions-queue.ts"],
+  "sourcesContent": ["import { createModuleQueue, type Queue } from '@open-mercato/queue'\nimport type { DispatchableInteraction } from './interactions-dispatch'\n\n/**\n * Queue carrying verified Discord interactions from the HTTP route to the\n * dispatch worker.\n *\n * It lives here rather than in the worker so the route never imports a worker\n * module: `workers/` is an auto-discovery path, and a route that pulled one in\n * would drag the worker's dependency graph into the request bundle.\n *\n * Mirrors the hub's `getCommunicationChannelsQueue` \u2014 one memoized instance per\n * name, so the route and the worker share it instead of constructing a queue per\n * request.\n */\nexport const CHANNEL_DISCORD_INTERACTIONS_QUEUE = 'channel_discord_interactions'\n\nconst INTERACTIONS_QUEUE_CONCURRENCY = 5\n\nexport type InteractionDispatchJobPayload = {\n  channelId: string\n  channelType: string\n  tenantId: string\n  organizationId: string | null\n  /**\n   * Scope the **bot token** is re-resolved with on the worker side. The bot token\n   * itself is deliberately absent, because the local queue strategy persists\n   * payloads to disk as plain JSON and that token is long-lived.\n   *\n   * This is not a blanket \"no credential travels on this payload\" guarantee, and\n   * reading it as one would be a mistake: `interaction.token` below IS a\n   * credential. It is Discord's interaction webhook token, and on its own \u2014 with\n   * no bot token at all \u2014 it can post as the application (the `auth === null`\n   * calls in `discord-rest.ts`), so it does land on disk under the local\n   * strategy. Discord expires it 15 minutes after the interaction, which bounds\n   * the exposure rather than removing it. `interactions-dispatch.ts` states the\n   * same constraint from the other side.\n   */\n  credentialScope: { tenantId: string; organizationId: string; userId: string | null }\n  interaction: DispatchableInteraction\n}\n\nlet cachedQueue: Queue<Record<string, unknown>> | null = null\n\nexport function getInteractionDispatchQueue(): Queue<Record<string, unknown>> {\n  if (!cachedQueue) {\n    cachedQueue = createModuleQueue<Record<string, unknown>>(CHANNEL_DISCORD_INTERACTIONS_QUEUE, {\n      concurrency: INTERACTIONS_QUEUE_CONCURRENCY,\n    })\n  }\n  return cachedQueue\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAqC;AAevC,MAAM,qCAAqC;AAElD,MAAM,iCAAiC;AAyBvC,IAAI,cAAqD;AAElD,SAAS,8BAA8D;AAC5E,MAAI,CAAC,aAAa;AAChB,kBAAc,kBAA2C,oCAAoC;AAAA,MAC3F,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/channel_discord/lib/interactions-verify.js

@@ -0,0 +1,84 @@
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function isHex(value) {
+  return value.length > 0 && value.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(value);
+}
+const ED25519_SIGNATURE_HEX_LENGTH = 128;
+function hasVerifiableSignatureHeaders(signatureHex, timestamp) {
+  if (!signatureHex || !timestamp) return false;
+  return isHex(signatureHex) && signatureHex.length === ED25519_SIGNATURE_HEX_LENGTH;
+}
+function publicKeyFromHex(publicKeyHex) {
+  if (!isHex(publicKeyHex) || publicKeyHex.length !== 64) {
+    throw new Error("invalid ed25519 public key");
+  }
+  const raw = Buffer.from(publicKeyHex, "hex");
+  const der = Buffer.concat([ED25519_SPKI_PREFIX, raw]);
+  return createPublicKey({ key: der, format: "der", type: "spki" });
+}
+function verifyDiscordSignature(input) {
+  const { publicKeyHex, signatureHex, timestamp, rawBody } = input;
+  if (!hasVerifiableSignatureHeaders(signatureHex, timestamp)) return false;
+  try {
+    const key = publicKeyFromHex(publicKeyHex);
+    const message = Buffer.from(String(timestamp) + rawBody, "utf-8");
+    const signature = Buffer.from(signatureHex, "hex");
+    return cryptoVerify(null, message, key, signature);
+  } catch {
+    return false;
+  }
+}
+const DISCORD_SIGNATURE_MAX_SKEW_SECONDS = 300;
+function isSignatureTimestampFresh(timestamp, options) {
+  if (!timestamp) return false;
+  const value = String(timestamp).trim();
+  if (!/^\d{1,12}$/.test(value)) return false;
+  const parsedSeconds = Number(value);
+  if (!Number.isSafeInteger(parsedSeconds)) return false;
+  const maxSkewSeconds = options?.maxSkewSeconds ?? DISCORD_SIGNATURE_MAX_SKEW_SECONDS;
+  const nowSeconds = options?.nowEpochSeconds ?? Math.floor(Date.now() / 1e3);
+  return Math.abs(nowSeconds - parsedSeconds) <= maxSkewSeconds;
+}
+const DiscordInteractionType = {
+  PING: 1,
+  APPLICATION_COMMAND: 2,
+  MESSAGE_COMPONENT: 3,
+  APPLICATION_COMMAND_AUTOCOMPLETE: 4,
+  MODAL_SUBMIT: 5
+};
+const DiscordInteractionResponseType = {
+  PONG: 1,
+  CHANNEL_MESSAGE_WITH_SOURCE: 4,
+  DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE: 5,
+  DEFERRED_UPDATE_MESSAGE: 6,
+  // Autocomplete is the one interaction type Discord will not accept a deferred
+  // ack for — it must be answered synchronously with this type and a choice list.
+  APPLICATION_COMMAND_AUTOCOMPLETE_RESULT: 8
+};
+function parseInteractionBody(rawBody) {
+  try {
+    const parsed = JSON.parse(rawBody);
+    if (!parsed || typeof parsed !== "object") return null;
+    const candidate = parsed;
+    if (typeof candidate.type !== "number") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function readInteractionApplicationId(rawBody) {
+  const interaction = parseInteractionBody(rawBody);
+  const applicationId = interaction?.application_id;
+  return typeof applicationId === "string" && applicationId.length > 0 ? applicationId : null;
+}
+export {
+  DISCORD_SIGNATURE_MAX_SKEW_SECONDS,
+  DiscordInteractionResponseType,
+  DiscordInteractionType,
+  hasVerifiableSignatureHeaders,
+  isSignatureTimestampFresh,
+  parseInteractionBody,
+  readInteractionApplicationId,
+  verifyDiscordSignature
+};
+//# sourceMappingURL=interactions-verify.js.map

package/dist/modules/channel_discord/lib/interactions-verify.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/interactions-verify.ts"],
+  "sourcesContent": ["import { createPublicKey, verify as cryptoVerify } from 'node:crypto'\n\n/**\n * Discord interaction request signing (Ed25519).\n *\n * Every interaction POST carries `X-Signature-Ed25519` (hex) and\n * `X-Signature-Timestamp`. The signed payload is `timestamp + rawBody`, verified\n * against the application's Ed25519 **public key** (hex, from the General\n * Information tab). We verify with Node's built-in `crypto` (`ed25519`) \u2014 no\n * `tweetnacl` dependency.\n *\n * SECURITY CONTRACT: this function is FAIL-CLOSED. It returns `false` on a\n * missing header, a malformed key/signature, or any verification error \u2014 never\n * throws, never returns `true` on doubt. Callers MUST reject (`401`) on `false`.\n */\n\n// Standard SPKI DER prefix for an Ed25519 public key (RFC 8410). Prepending it\n// to the 32 raw key bytes yields a DER document `createPublicKey` accepts,\n// avoiding a third-party crypto dependency.\nconst ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex')\n\nfunction isHex(value: string): boolean {\n  return value.length > 0 && value.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(value)\n}\n\n/** An Ed25519 signature is 64 bytes, so 128 hex characters. */\nconst ED25519_SIGNATURE_HEX_LENGTH = 128\n\n/**\n * Whether the request's signature headers are even capable of verifying \u2014\n * present, hex, and the right length. This depends on the REQUEST ALONE, never\n * on a candidate channel, which is why it is exported separately: the route runs\n * it before it loads any channel, so an unsigned or malformed POST is rejected\n * without a single database round-trip.\n *\n * `verifyDiscordSignature` applies the same guard itself, so this is an\n * optimisation of *when* the answer is known, never a replacement for the\n * fail-closed check.\n */\nexport function hasVerifiableSignatureHeaders(\n  signatureHex: string | undefined | null,\n  timestamp: string | undefined | null,\n): signatureHex is string {\n  if (!signatureHex || !timestamp) return false\n  return isHex(signatureHex) && signatureHex.length === ED25519_SIGNATURE_HEX_LENGTH\n}\n\nfunction publicKeyFromHex(publicKeyHex: string) {\n  if (!isHex(publicKeyHex) || publicKeyHex.length !== 64) {\n    throw new Error('invalid ed25519 public key')\n  }\n  const raw = Buffer.from(publicKeyHex, 'hex')\n  const der = Buffer.concat([ED25519_SPKI_PREFIX, raw])\n  return createPublicKey({ key: der, format: 'der', type: 'spki' })\n}\n\nexport interface VerifyDiscordSignatureInput {\n  publicKeyHex: string\n  signatureHex: string | undefined | null\n  timestamp: string | undefined | null\n  rawBody: string\n}\n\n/**\n * Verify a Discord interaction signature. Returns `true` only when the signature\n * cryptographically matches `timestamp + rawBody` under `publicKeyHex`.\n */\nexport function verifyDiscordSignature(input: VerifyDiscordSignatureInput): boolean {\n  const { publicKeyHex, signatureHex, timestamp, rawBody } = input\n  if (!hasVerifiableSignatureHeaders(signatureHex, timestamp)) return false\n  try {\n    const key = publicKeyFromHex(publicKeyHex)\n    const message = Buffer.from(String(timestamp) + rawBody, 'utf-8')\n    const signature = Buffer.from(signatureHex, 'hex')\n    // Ed25519: the algorithm is implied by the key, so the first arg is null.\n    return cryptoVerify(null, message, key, signature)\n  } catch {\n    return false\n  }\n}\n\n/**\n * Replay guard. Discord signs `timestamp + body`, but a captured request stays\n * cryptographically valid forever \u2014 freshness has to be enforced separately.\n * A timestamp outside the \u00B1 skew window (or missing / non-numeric) is rejected,\n * fail-closed, so a recorded interaction cannot be replayed later.\n */\nexport const DISCORD_SIGNATURE_MAX_SKEW_SECONDS = 300\n\nexport interface TimestampFreshnessOptions {\n  maxSkewSeconds?: number\n  /** Injectable clock (epoch seconds) for tests; defaults to the real clock. */\n  nowEpochSeconds?: number\n}\n\nexport function isSignatureTimestampFresh(\n  timestamp: string | undefined | null,\n  options?: TimestampFreshnessOptions,\n): boolean {\n  if (!timestamp) return false\n  const value = String(timestamp).trim()\n  if (!/^\\d{1,12}$/.test(value)) return false\n  const parsedSeconds = Number(value)\n  if (!Number.isSafeInteger(parsedSeconds)) return false\n  const maxSkewSeconds = options?.maxSkewSeconds ?? DISCORD_SIGNATURE_MAX_SKEW_SECONDS\n  const nowSeconds = options?.nowEpochSeconds ?? Math.floor(Date.now() / 1000)\n  return Math.abs(nowSeconds - parsedSeconds) <= maxSkewSeconds\n}\n\n/** Discord interaction types. */\nexport const DiscordInteractionType = {\n  PING: 1,\n  APPLICATION_COMMAND: 2,\n  MESSAGE_COMPONENT: 3,\n  APPLICATION_COMMAND_AUTOCOMPLETE: 4,\n  MODAL_SUBMIT: 5,\n} as const\n\n/** Discord interaction response types. */\nexport const DiscordInteractionResponseType = {\n  PONG: 1,\n  CHANNEL_MESSAGE_WITH_SOURCE: 4,\n  DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE: 5,\n  DEFERRED_UPDATE_MESSAGE: 6,\n  // Autocomplete is the one interaction type Discord will not accept a deferred\n  // ack for \u2014 it must be answered synchronously with this type and a choice list.\n  APPLICATION_COMMAND_AUTOCOMPLETE_RESULT: 8,\n} as const\n\nexport interface ParsedInteraction {\n  type: number\n  data?: Record<string, unknown>\n  member?: { user?: { id?: string; username?: string; global_name?: string | null } }\n  user?: { id?: string; username?: string; global_name?: string | null }\n  channel_id?: string\n  guild_id?: string\n  application_id?: string\n  id?: string\n  token?: string\n  [key: string]: unknown\n}\n\n/**\n * Parse the interaction body. Returns `null` when the body is not a JSON object\n * with a numeric `type` \u2014 the caller treats that as a non-interaction payload.\n */\nexport function parseInteractionBody(rawBody: string): ParsedInteraction | null {\n  try {\n    const parsed = JSON.parse(rawBody) as unknown\n    if (!parsed || typeof parsed !== 'object') return null\n    const candidate = parsed as { type?: unknown }\n    if (typeof candidate.type !== 'number') return null\n    return parsed as ParsedInteraction\n  } catch {\n    return null\n  }\n}\n\n/**\n * The `application_id` an interaction body claims, or `null` when the body does\n * not carry a usable one.\n *\n * UNTRUSTED \u2014 this value is read before any signature has been verified, so it\n * may only ever be used to NARROW the set of candidate channels the signature is\n * then checked against. It is never an authorization decision: a body claiming\n * another tenant's application still has to carry that tenant's Ed25519\n * signature to be accepted, and a body claiming nothing falls back to the full\n * candidate set rather than being let through.\n */\nexport function readInteractionApplicationId(rawBody: string): string | null {\n  const interaction = parseInteractionBody(rawBody)\n  const applicationId = interaction?.application_id\n  return typeof applicationId === 'string' && applicationId.length > 0 ? applicationId : null\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB,UAAU,oBAAoB;AAmBxD,MAAM,sBAAsB,OAAO,KAAK,4BAA4B,KAAK;AAEzE,SAAS,MAAM,OAAwB;AACrC,SAAO,MAAM,SAAS,KAAK,MAAM,SAAS,MAAM,KAAK,iBAAiB,KAAK,KAAK;AAClF;AAGA,MAAM,+BAA+B;AAa9B,SAAS,8BACd,cACA,WACwB;AACxB,MAAI,CAAC,gBAAgB,CAAC,UAAW,QAAO;AACxC,SAAO,MAAM,YAAY,KAAK,aAAa,WAAW;AACxD;AAEA,SAAS,iBAAiB,cAAsB;AAC9C,MAAI,CAAC,MAAM,YAAY,KAAK,aAAa,WAAW,IAAI;AACtD,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,QAAM,MAAM,OAAO,KAAK,cAAc,KAAK;AAC3C,QAAM,MAAM,OAAO,OAAO,CAAC,qBAAqB,GAAG,CAAC;AACpD,SAAO,gBAAgB,EAAE,KAAK,KAAK,QAAQ,OAAO,MAAM,OAAO,CAAC;AAClE;AAaO,SAAS,uBAAuB,OAA6C;AAClF,QAAM,EAAE,cAAc,cAAc,WAAW,QAAQ,IAAI;AAC3D,MAAI,CAAC,8BAA8B,cAAc,SAAS,EAAG,QAAO;AACpE,MAAI;AACF,UAAM,MAAM,iBAAiB,YAAY;AACzC,UAAM,UAAU,OAAO,KAAK,OAAO,SAAS,IAAI,SAAS,OAAO;AAChE,UAAM,YAAY,OAAO,KAAK,cAAc,KAAK;AAEjD,WAAO,aAAa,MAAM,SAAS,KAAK,SAAS;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQO,MAAM,qCAAqC;AAQ3C,SAAS,0BACd,WACA,SACS;AACT,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,QAAQ,OAAO,SAAS,EAAE,KAAK;AACrC,MAAI,CAAC,aAAa,KAAK,KAAK,EAAG,QAAO;AACtC,QAAM,gBAAgB,OAAO,KAAK;AAClC,MAAI,CAAC,OAAO,cAAc,aAAa,EAAG,QAAO;AACjD,QAAM,iBAAiB,SAAS,kBAAkB;AAClD,QAAM,aAAa,SAAS,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC3E,SAAO,KAAK,IAAI,aAAa,aAAa,KAAK;AACjD;AAGO,MAAM,yBAAyB;AAAA,EACpC,MAAM;AAAA,EACN,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,kCAAkC;AAAA,EAClC,cAAc;AAChB;AAGO,MAAM,iCAAiC;AAAA,EAC5C,MAAM;AAAA,EACN,6BAA6B;AAAA,EAC7B,sCAAsC;AAAA,EACtC,yBAAyB;AAAA;AAAA;AAAA,EAGzB,yCAAyC;AAC3C;AAmBO,SAAS,qBAAqB,SAA2C;AAC9E,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,UAAM,YAAY;AAClB,QAAI,OAAO,UAAU,SAAS,SAAU,QAAO;AAC/C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAaO,SAAS,6BAA6B,SAAgC;AAC3E,QAAM,cAAc,qBAAqB,OAAO;AAChD,QAAM,gBAAgB,aAAa;AACnC,SAAO,OAAO,kBAAkB,YAAY,cAAc,SAAS,IAAI,gBAAgB;AACzF;",
+  "names": []
+}

package/dist/modules/channel_discord/lib/normalize-inbound.js

@@ -0,0 +1,59 @@
+const DISCORD_CONVERSATION_PREFIX = "discord-channel:";
+const DISCORD_CHANNEL_CONTENT_TYPE = "discord";
+function mapAttachments(message) {
+  if (!Array.isArray(message.attachments) || message.attachments.length === 0) return void 0;
+  return message.attachments.map((attachment) => ({
+    url: attachment.url,
+    mimeType: attachment.content_type ?? "application/octet-stream",
+    fileName: attachment.filename,
+    fileSize: attachment.size,
+    inline: false
+  }));
+}
+function normalizeInboundDiscordMessage(message) {
+  const author = message.author ?? {};
+  const senderDisplayName = author?.global_name || author?.username || void 0;
+  const timestamp = message.timestamp ? new Date(message.timestamp) : /* @__PURE__ */ new Date();
+  return {
+    externalMessageId: message.id,
+    externalConversationId: `${DISCORD_CONVERSATION_PREFIX}${message.channel_id}`,
+    senderIdentifier: author?.id ?? "unknown",
+    senderDisplayName,
+    body: message.content ?? "",
+    bodyFormat: "markdown",
+    attachments: mapAttachments(message),
+    timestamp,
+    replyToExternalId: message.message_reference?.message_id,
+    channelPayload: message,
+    channelContentType: DISCORD_CHANNEL_CONTENT_TYPE,
+    channelMetadata: {
+      discordChannelId: message.channel_id,
+      discordGuildId: message.guild_id,
+      discordAuthorId: author?.id,
+      discordAuthorUsername: author?.username,
+      discordAuthorGlobalName: author?.global_name ?? void 0,
+      discordAuthorIsBot: Boolean(author?.bot),
+      // Only present when the record came from a slash command or a component
+      // press rather than someone typing. A consumer that treats every inbound
+      // message the same can ignore these; one that answers commands
+      // specifically needs to tell them apart without re-parsing `channelPayload`.
+      ...message.discord_interaction ? {
+        discordInteractionId: message.discord_interaction.id,
+        discordInteractionType: message.discord_interaction.type,
+        discordCommandName: message.discord_interaction.commandName,
+        discordComponentCustomId: message.discord_interaction.customId
+      } : {}
+    }
+  };
+}
+function isAuthoredByBot(message, botUserId) {
+  if (message.author?.bot) return true;
+  return botUserId ? message.author?.id === botUserId : false;
+}
+export {
+  DISCORD_CHANNEL_CONTENT_TYPE,
+  DISCORD_CONVERSATION_PREFIX,
+  isAuthoredByBot,
+  normalizeInboundDiscordMessage
+};
+//# sourceMappingURL=normalize-inbound.js.map

package/dist/modules/channel_discord/lib/normalize-inbound.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/normalize-inbound.ts"],
+  "sourcesContent": ["import type {\n  NormalizedInboundMessage,\n  NormalizedAttachment,\n} from '@open-mercato/core/modules/communication_channels/lib/adapter'\nimport type { DiscordMessageObject } from './discord-rest'\n\n/**\n * Prefix used to build the hub's `externalConversationId` from a Discord channel\n * (or thread) id. A Discord \"channel\" (text channel / thread) is the unit the\n * hub threads on, mirroring `gmail-thread:` / Slack channel conventions.\n */\nexport const DISCORD_CONVERSATION_PREFIX = 'discord-channel:'\n\nexport const DISCORD_CHANNEL_CONTENT_TYPE = 'discord'\n\nfunction mapAttachments(message: DiscordMessageObject): NormalizedAttachment[] | undefined {\n  if (!Array.isArray(message.attachments) || message.attachments.length === 0) return undefined\n  return message.attachments.map((attachment) => ({\n    url: attachment.url,\n    mimeType: attachment.content_type ?? 'application/octet-stream',\n    fileName: attachment.filename,\n    fileSize: attachment.size,\n    inline: false,\n  }))\n}\n\n/**\n * Map a raw Discord message object (from `MESSAGE_CREATE` or REST history) into\n * the hub's canonical `NormalizedInboundMessage`.\n *\n * Discord senders have no email/phone \u2014 the CRM contact is resolved from the\n * user id / handle later (`resolveContact`). The `externalConversationId` is the\n * channel/thread id (a Discord thread reuses this same shape), so all messages\n * in one channel thread into one hub conversation.\n */\nexport function normalizeInboundDiscordMessage(message: DiscordMessageObject): NormalizedInboundMessage {\n  const author = message.author ?? ({} as DiscordMessageObject['author'])\n  const senderDisplayName = author?.global_name || author?.username || undefined\n  const timestamp = message.timestamp ? new Date(message.timestamp) : new Date()\n\n  return {\n    externalMessageId: message.id,\n    externalConversationId: `${DISCORD_CONVERSATION_PREFIX}${message.channel_id}`,\n    senderIdentifier: author?.id ?? 'unknown',\n    senderDisplayName,\n    body: message.content ?? '',\n    bodyFormat: 'markdown',\n    attachments: mapAttachments(message),\n    timestamp,\n    replyToExternalId: message.message_reference?.message_id,\n    channelPayload: message as unknown as Record<string, unknown>,\n    channelContentType: DISCORD_CHANNEL_CONTENT_TYPE,\n    channelMetadata: {\n      discordChannelId: message.channel_id,\n      discordGuildId: message.guild_id,\n      discordAuthorId: author?.id,\n      discordAuthorUsername: author?.username,\n      discordAuthorGlobalName: author?.global_name ?? undefined,\n      discordAuthorIsBot: Boolean(author?.bot),\n      // Only present when the record came from a slash command or a component\n      // press rather than someone typing. A consumer that treats every inbound\n      // message the same can ignore these; one that answers commands\n      // specifically needs to tell them apart without re-parsing `channelPayload`.\n      ...(message.discord_interaction\n        ? {\n            discordInteractionId: message.discord_interaction.id,\n            discordInteractionType: message.discord_interaction.type,\n            discordCommandName: message.discord_interaction.commandName,\n            discordComponentCustomId: message.discord_interaction.customId,\n          }\n        : {}),\n    },\n  }\n}\n\n/**\n * True when a raw message must be dropped as bot-authored. The gateway worker\n * uses this as the feedback-loop guard.\n *\n * We drop ANY message flagged `author.bot` (not just our own bot's user id):\n * other bots/webhooks in the channel would otherwise be ingested and could\n * trigger the AI auto-reply, creating cross-bot loops and noise. The explicit\n * `botUserId` check is retained as a belt-and-suspenders guard for the rare case\n * where our own bot's `author.bot` flag is absent from a payload.\n */\nexport function isAuthoredByBot(message: DiscordMessageObject, botUserId: string | undefined): boolean {\n  if (message.author?.bot) return true\n  return botUserId ? message.author?.id === botUserId : false\n}\n"],
+  "mappings": "AAWO,MAAM,8BAA8B;AAEpC,MAAM,+BAA+B;AAE5C,SAAS,eAAe,SAAmE;AACzF,MAAI,CAAC,MAAM,QAAQ,QAAQ,WAAW,KAAK,QAAQ,YAAY,WAAW,EAAG,QAAO;AACpF,SAAO,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,IAC9C,KAAK,WAAW;AAAA,IAChB,UAAU,WAAW,gBAAgB;AAAA,IACrC,UAAU,WAAW;AAAA,IACrB,UAAU,WAAW;AAAA,IACrB,QAAQ;AAAA,EACV,EAAE;AACJ;AAWO,SAAS,+BAA+B,SAAyD;AACtG,QAAM,SAAS,QAAQ,UAAW,CAAC;AACnC,QAAM,oBAAoB,QAAQ,eAAe,QAAQ,YAAY;AACrE,QAAM,YAAY,QAAQ,YAAY,IAAI,KAAK,QAAQ,SAAS,IAAI,oBAAI,KAAK;AAE7E,SAAO;AAAA,IACL,mBAAmB,QAAQ;AAAA,IAC3B,wBAAwB,GAAG,2BAA2B,GAAG,QAAQ,UAAU;AAAA,IAC3E,kBAAkB,QAAQ,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,QAAQ,WAAW;AAAA,IACzB,YAAY;AAAA,IACZ,aAAa,eAAe,OAAO;AAAA,IACnC;AAAA,IACA,mBAAmB,QAAQ,mBAAmB;AAAA,IAC9C,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,MACf,kBAAkB,QAAQ;AAAA,MAC1B,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,uBAAuB,QAAQ;AAAA,MAC/B,yBAAyB,QAAQ,eAAe;AAAA,MAChD,oBAAoB,QAAQ,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKvC,GAAI,QAAQ,sBACR;AAAA,QACE,sBAAsB,QAAQ,oBAAoB;AAAA,QAClD,wBAAwB,QAAQ,oBAAoB;AAAA,QACpD,oBAAoB,QAAQ,oBAAoB;AAAA,QAChD,0BAA0B,QAAQ,oBAAoB;AAAA,MACxD,IACA,CAAC;AAAA,IACP;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB,SAA+B,WAAwC;AACrG,MAAI,QAAQ,QAAQ,IAAK,QAAO;AAChC,SAAO,YAAY,QAAQ,QAAQ,OAAO,YAAY;AACxD;",
+  "names": []
+}

package/dist/modules/channel_discord/lib/preset.js

@@ -0,0 +1,63 @@
+import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
+import { discordCredentialsSchema } from "./credentials.js";
+const CHANNEL_DISCORD_INTEGRATION_ID = "channel_discord";
+function readEnvValue(env, key) {
+  const value = env[key]?.trim();
+  return value ? value : void 0;
+}
+function readDiscordEnvPreset(env = process.env) {
+  const botToken = readEnvValue(env, "OM_CHANNEL_DISCORD_BOT_TOKEN");
+  const applicationId = readEnvValue(env, "OM_CHANNEL_DISCORD_APPLICATION_ID");
+  const publicKey = readEnvValue(env, "OM_CHANNEL_DISCORD_PUBLIC_KEY");
+  const guildId = readEnvValue(env, "OM_CHANNEL_DISCORD_GUILD_ID");
+  const defaultChannelId = readEnvValue(env, "OM_CHANNEL_DISCORD_DEFAULT_CHANNEL_ID");
+  if (!botToken && !applicationId && !publicKey) return null;
+  const parsed = discordCredentialsSchema.safeParse({
+    botToken,
+    applicationId,
+    publicKey,
+    ...guildId ? { guildId } : {},
+    ...defaultChannelId ? { defaultChannelId } : {}
+  });
+  if (!parsed.success) {
+    const first = parsed.error.issues[0];
+    throw new Error(
+      `[internal] Incomplete Discord env preset. Set OM_CHANNEL_DISCORD_BOT_TOKEN, OM_CHANNEL_DISCORD_APPLICATION_ID and OM_CHANNEL_DISCORD_PUBLIC_KEY (${first?.path.join(".") ?? "credentials"}: ${first?.message ?? "invalid"}).`
+    );
+  }
+  return {
+    credentials: parsed.data,
+    force: parseBooleanToken(env.OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE) ?? false
+  };
+}
+async function applyDiscordEnvPreset(params) {
+  const preset = readDiscordEnvPreset(params.env);
+  if (!preset) {
+    return { status: "skipped", reason: "No Discord preset env variables were provided." };
+  }
+  const force = params.force ?? preset.force;
+  if (!force) {
+    const existing = await params.credentialsService.getRaw(CHANNEL_DISCORD_INTEGRATION_ID, params.scope);
+    if (existing) {
+      return {
+        status: "skipped",
+        reason: "Discord credentials already exist. Use OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE=true to overwrite."
+      };
+    }
+  }
+  await params.credentialsService.save(CHANNEL_DISCORD_INTEGRATION_ID, preset.credentials, params.scope);
+  if (params.integrationLogService) {
+    await params.integrationLogService.scoped(CHANNEL_DISCORD_INTEGRATION_ID, params.scope).info("Discord integration was preconfigured from environment variables.", {
+      applicationId: preset.credentials.applicationId,
+      guildId: preset.credentials.guildId ?? null,
+      defaultChannelId: preset.credentials.defaultChannelId ?? null
+    });
+  }
+  return { status: "configured" };
+}
+export {
+  CHANNEL_DISCORD_INTEGRATION_ID,
+  applyDiscordEnvPreset,
+  readDiscordEnvPreset
+};
+//# sourceMappingURL=preset.js.map

package/dist/modules/channel_discord/lib/preset.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/preset.ts"],
+  "sourcesContent": ["import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport { discordCredentialsSchema, type DiscordCredentials } from './credentials'\n\nexport const CHANNEL_DISCORD_INTEGRATION_ID = 'channel_discord'\n\nexport type DiscordEnvPreset = {\n  credentials: DiscordCredentials\n  force: boolean\n}\n\nexport type ApplyDiscordPresetResult =\n  | { status: 'skipped'; reason: string }\n  | { status: 'configured' }\n\nfunction readEnvValue(env: NodeJS.ProcessEnv, key: string): string | undefined {\n  const value = env[key]?.trim()\n  return value ? value : undefined\n}\n\n/**\n * Read the deployment-managed Discord bootstrap credentials from the environment\n * (SPEC 2026-06-19 \u00A7 Connect the channel in Open Mercato).\n *\n * Returns `null` when no `OM_CHANNEL_DISCORD_*` credential var is set at all \u2014\n * the normal case, where the bot is connected interactively through\n * `/backend/integrations`. When any of them IS set the preset must be complete,\n * so a half-filled deployment fails loudly instead of persisting a bot token\n * that cannot authenticate. The bot token is never logged or echoed.\n */\nexport function readDiscordEnvPreset(env: NodeJS.ProcessEnv = process.env): DiscordEnvPreset | null {\n  const botToken = readEnvValue(env, 'OM_CHANNEL_DISCORD_BOT_TOKEN')\n  const applicationId = readEnvValue(env, 'OM_CHANNEL_DISCORD_APPLICATION_ID')\n  const publicKey = readEnvValue(env, 'OM_CHANNEL_DISCORD_PUBLIC_KEY')\n  const guildId = readEnvValue(env, 'OM_CHANNEL_DISCORD_GUILD_ID')\n  const defaultChannelId = readEnvValue(env, 'OM_CHANNEL_DISCORD_DEFAULT_CHANNEL_ID')\n\n  if (!botToken && !applicationId && !publicKey) return null\n\n  const parsed = discordCredentialsSchema.safeParse({\n    botToken,\n    applicationId,\n    publicKey,\n    ...(guildId ? { guildId } : {}),\n    ...(defaultChannelId ? { defaultChannelId } : {}),\n  })\n  if (!parsed.success) {\n    const first = parsed.error.issues[0]\n    throw new Error(\n      '[internal] Incomplete Discord env preset. Set OM_CHANNEL_DISCORD_BOT_TOKEN, ' +\n        'OM_CHANNEL_DISCORD_APPLICATION_ID and OM_CHANNEL_DISCORD_PUBLIC_KEY ' +\n        `(${first?.path.join('.') ?? 'credentials'}: ${first?.message ?? 'invalid'}).`,\n    )\n  }\n\n  return {\n    credentials: parsed.data,\n    force: parseBooleanToken(env.OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE) ?? false,\n  }\n}\n\n/**\n * Apply the env preset to one (tenant, organization) scope through the standard\n * integration credential service \u2014 never by special-casing the provider in core.\n *\n * Existing credentials win unless `OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE` (or an\n * explicit `force`) says otherwise, so re-running tenant setup or the\n * `configure-from-env` CLI command is safe and idempotent.\n */\nexport async function applyDiscordEnvPreset(params: {\n  credentialsService: CredentialsService\n  integrationLogService?: IntegrationLogService\n  scope: IntegrationScope\n  force?: boolean\n  env?: NodeJS.ProcessEnv\n}): Promise<ApplyDiscordPresetResult> {\n  const preset = readDiscordEnvPreset(params.env)\n  if (!preset) {\n    return { status: 'skipped', reason: 'No Discord preset env variables were provided.' }\n  }\n\n  const force = params.force ?? preset.force\n  if (!force) {\n    const existing = await params.credentialsService.getRaw(CHANNEL_DISCORD_INTEGRATION_ID, params.scope)\n    if (existing) {\n      return {\n        status: 'skipped',\n        reason:\n          'Discord credentials already exist. Use OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE=true to overwrite.',\n      }\n    }\n  }\n\n  await params.credentialsService.save(CHANNEL_DISCORD_INTEGRATION_ID, preset.credentials, params.scope)\n\n  if (params.integrationLogService) {\n    await params.integrationLogService\n      .scoped(CHANNEL_DISCORD_INTEGRATION_ID, params.scope)\n      .info('Discord integration was preconfigured from environment variables.', {\n        applicationId: preset.credentials.applicationId,\n        guildId: preset.credentials.guildId ?? null,\n        defaultChannelId: preset.credentials.defaultChannelId ?? null,\n      })\n  }\n\n  return { status: 'configured' }\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAIlC,SAAS,gCAAyD;AAE3D,MAAM,iCAAiC;AAW9C,SAAS,aAAa,KAAwB,KAAiC;AAC7E,QAAM,QAAQ,IAAI,GAAG,GAAG,KAAK;AAC7B,SAAO,QAAQ,QAAQ;AACzB;AAYO,SAAS,qBAAqB,MAAyB,QAAQ,KAA8B;AAClG,QAAM,WAAW,aAAa,KAAK,8BAA8B;AACjE,QAAM,gBAAgB,aAAa,KAAK,mCAAmC;AAC3E,QAAM,YAAY,aAAa,KAAK,+BAA+B;AACnE,QAAM,UAAU,aAAa,KAAK,6BAA6B;AAC/D,QAAM,mBAAmB,aAAa,KAAK,uCAAuC;AAElF,MAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,UAAW,QAAO;AAEtD,QAAM,SAAS,yBAAyB,UAAU;AAAA,IAChD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,UAAM,IAAI;AAAA,MACR,oJAEM,OAAO,KAAK,KAAK,GAAG,KAAK,aAAa,KAAK,OAAO,WAAW,SAAS;AAAA,IAC9E;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,OAAO;AAAA,IACpB,OAAO,kBAAkB,IAAI,qCAAqC,KAAK;AAAA,EACzE;AACF;AAUA,eAAsB,sBAAsB,QAMN;AACpC,QAAM,SAAS,qBAAqB,OAAO,GAAG;AAC9C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,QAAQ,WAAW,QAAQ,iDAAiD;AAAA,EACvF;AAEA,QAAM,QAAQ,OAAO,SAAS,OAAO;AACrC,MAAI,CAAC,OAAO;AACV,UAAM,WAAW,MAAM,OAAO,mBAAmB,OAAO,gCAAgC,OAAO,KAAK;AACpG,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QACE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,mBAAmB,KAAK,gCAAgC,OAAO,aAAa,OAAO,KAAK;AAErG,MAAI,OAAO,uBAAuB;AAChC,UAAM,OAAO,sBACV,OAAO,gCAAgC,OAAO,KAAK,EACnD,KAAK,qEAAqE;AAAA,MACzE,eAAe,OAAO,YAAY;AAAA,MAClC,SAAS,OAAO,YAAY,WAAW;AAAA,MACvC,kBAAkB,OAAO,YAAY,oBAAoB;AAAA,IAC3D,CAAC;AAAA,EACL;AAEA,SAAO,EAAE,QAAQ,aAAa;AAChC;",
+  "names": []
+}

package/dist/modules/channel_discord/lib/queue-strategy.js

@@ -0,0 +1,12 @@
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("channel_discord").child({ component: "cli" });
+function assertInboundDeliverable(queueStrategy) {
+  if (queueStrategy === "async") return;
+  const message = "channel_discord start-gateway requires QUEUE_STRATEGY=async (with Redis configured). Under the default in-process queue strategy the gateway cannot hand inbound messages to the communication-channels workers running in the app server process \u2014 they would be silently dropped. Set QUEUE_STRATEGY=async and point the queue at Redis, then start this command again.";
+  logger.error(message, { queueStrategy: queueStrategy ?? "local (default)" });
+  throw new Error(`[internal] ${message}`);
+}
+export {
+  assertInboundDeliverable
+};
+//# sourceMappingURL=queue-strategy.js.map

package/dist/modules/channel_discord/lib/queue-strategy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/queue-strategy.ts"],
+  "sourcesContent": ["import { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('channel_discord').child({ component: 'cli' })\n\n/**\n * Refuse to start the gateway when inbound messages cannot possibly be delivered.\n *\n * `start-gateway` is a standalone process that runs a worker for the\n * `channel_discord_gateway` queue only, while the bridge enqueues received\n * messages into `communication-channels-inbound` / `-reactions`, whose workers\n * live in the app server process. Under the DEFAULT `QUEUE_STRATEGY=local` the\n * queue is in-process, so those jobs never cross the process boundary: they are\n * dropped with no error, no log, no retry and no `failed` entry, while the\n * channel keeps reporting `Connected`. Failing loudly at startup is the only\n * honest option \u2014 the alternative looks like it works.\n *\n * Lives outside `cli.ts` so it stays unit-testable without pulling the DI\n * container graph into the test.\n */\nexport function assertInboundDeliverable(queueStrategy: string | undefined): void {\n  if (queueStrategy === 'async') return\n  const message =\n    'channel_discord start-gateway requires QUEUE_STRATEGY=async (with Redis configured). ' +\n    'Under the default in-process queue strategy the gateway cannot hand inbound messages to the ' +\n    'communication-channels workers running in the app server process \u2014 they would be silently dropped. ' +\n    'Set QUEUE_STRATEGY=async and point the queue at Redis, then start this command again.'\n  logger.error(message, { queueStrategy: queueStrategy ?? 'local (default)' })\n  throw new Error(`[internal] ${message}`)\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAiBlE,SAAS,yBAAyB,eAAyC;AAChF,MAAI,kBAAkB,QAAS;AAC/B,QAAM,UACJ;AAIF,SAAO,MAAM,SAAS,EAAE,eAAe,iBAAiB,kBAAkB,CAAC;AAC3E,QAAM,IAAI,MAAM,cAAc,OAAO,EAAE;AACzC;",
+  "names": []
+}

package/dist/modules/channel_discord/lib/slash-commands.js

@@ -0,0 +1,42 @@
+const CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT = 1;
+const CHANNEL_DISCORD_OPTION_TYPE_STRING = 3;
+const DISCORD_DEFAULT_SLASH_COMMANDS = [
+  {
+    name: "mercato",
+    type: CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT,
+    description: "Send a message to the team through Open Mercato",
+    options: [
+      {
+        type: CHANNEL_DISCORD_OPTION_TYPE_STRING,
+        name: "message",
+        description: "What do you need?",
+        required: true
+      }
+    ]
+  }
+];
+function parseSlashCommandDefinitions(value) {
+  if (!Array.isArray(value)) {
+    throw new Error("[internal] Discord slash command definitions must be a JSON array.");
+  }
+  return value.map((entry, index) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error(`[internal] Discord slash command at index ${index} is not an object.`);
+    }
+    const command = entry;
+    if (typeof command.name !== "string" || command.name.length === 0) {
+      throw new Error(`[internal] Discord slash command at index ${index} has no name.`);
+    }
+    if (typeof command.description !== "string" || command.description.length === 0) {
+      throw new Error(`[internal] Discord slash command "${command.name}" has no description.`);
+    }
+    return command;
+  });
+}
+export {
+  CHANNEL_DISCORD_OPTION_TYPE_STRING,
+  CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT,
+  DISCORD_DEFAULT_SLASH_COMMANDS,
+  parseSlashCommandDefinitions
+};
+//# sourceMappingURL=slash-commands.js.map

package/dist/modules/channel_discord/lib/slash-commands.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/lib/slash-commands.ts"],
+  "sourcesContent": ["/**\n * Application (slash) commands this provider registers against a guild.\n *\n * NOT LOCALIZED, deliberately: a Discord application registers ONE canonical\n * command name per guild \u2014 the localized variants Discord supports live in\n * `name_localizations` / `description_localizations`, which are a per-command\n * map rather than an app locale, and no operator surface exists yet to choose\n * which locales a tenant wants. The registration is also an operator action\n * (`mercato channel_discord register-slash-commands`), not a rendered UI string.\n *\n * The set is deliberately minimal. Every command routes to the same place \u2014\n * the hub inbox \u2014 so the provider ships the one command that makes that useful\n * and leaves richer command trees to whoever knows their own workflow. Register\n * a different set by passing `--commands <path-to-json>`.\n */\nexport const CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT = 1\nexport const CHANNEL_DISCORD_OPTION_TYPE_STRING = 3\n\nexport const DISCORD_DEFAULT_SLASH_COMMANDS: Array<Record<string, unknown>> = [\n  {\n    name: 'mercato',\n    type: CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT,\n    description: 'Send a message to the team through Open Mercato',\n    options: [\n      {\n        type: CHANNEL_DISCORD_OPTION_TYPE_STRING,\n        name: 'message',\n        description: 'What do you need?',\n        required: true,\n      },\n    ],\n  },\n]\n\n/**\n * Validate an operator-supplied command list read from JSON. Discord rejects a\n * malformed registration with a 400 whose body names an array index, so failing\n * here with the index and the reason is strictly more useful than forwarding it.\n */\nexport function parseSlashCommandDefinitions(value: unknown): Array<Record<string, unknown>> {\n  if (!Array.isArray(value)) {\n    throw new Error('[internal] Discord slash command definitions must be a JSON array.')\n  }\n  return value.map((entry, index) => {\n    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {\n      throw new Error(`[internal] Discord slash command at index ${index} is not an object.`)\n    }\n    const command = entry as Record<string, unknown>\n    if (typeof command.name !== 'string' || command.name.length === 0) {\n      throw new Error(`[internal] Discord slash command at index ${index} has no name.`)\n    }\n    if (typeof command.description !== 'string' || command.description.length === 0) {\n      throw new Error(`[internal] Discord slash command \"${command.name}\" has no description.`)\n    }\n    return command\n  })\n}\n"],
+  "mappings": "AAeO,MAAM,gDAAgD;AACtD,MAAM,qCAAqC;AAE3C,MAAM,iCAAiE;AAAA,EAC5E;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,aAAa;AAAA,QACb,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,6BAA6B,OAAgD;AAC3F,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,SAAO,MAAM,IAAI,CAAC,OAAO,UAAU;AACjC,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,IAAI,MAAM,6CAA6C,KAAK,oBAAoB;AAAA,IACxF;AACA,UAAM,UAAU;AAChB,QAAI,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,WAAW,GAAG;AACjE,YAAM,IAAI,MAAM,6CAA6C,KAAK,eAAe;AAAA,IACnF;AACA,QAAI,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,WAAW,GAAG;AAC/E,YAAM,IAAI,MAAM,qCAAqC,QAAQ,IAAI,uBAAuB;AAAA,IAC1F;AACA,WAAO;AAAA,EACT,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/channel_discord/message-types.js

@@ -0,0 +1,64 @@
+import {
+  CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_COMMAND_ID,
+  CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_COMMAND_ID
+} from "./lib/ai-proposal-contract.js";
+const CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE = "channel_discord.ai_reply_proposal";
+const CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID = "approve_send";
+const CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID = "dismiss";
+const proposalActions = [
+  {
+    id: CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID,
+    label: "Approve and send",
+    labelKey: "channel_discord.aiProposal.actions.approve",
+    variant: "default",
+    icon: "send",
+    commandId: CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_COMMAND_ID,
+    isTerminal: true,
+    // Sending posts publicly into a Discord server on the tenant's behalf, so the
+    // operator confirms once before it leaves the building. No `confirmMessage`:
+    // the inbox renders that field verbatim (`message-detail/panels/dialogs.tsx`),
+    // so a translation key would leak into the dialog — omitting it falls back to
+    // the module's own localized confirmation copy.
+    confirmRequired: true
+  },
+  {
+    id: CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID,
+    label: "Dismiss",
+    labelKey: "channel_discord.aiProposal.actions.dismiss",
+    variant: "outline",
+    icon: "x",
+    commandId: CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_COMMAND_ID,
+    isTerminal: true
+  }
+];
+const messageTypes = [
+  {
+    type: CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE,
+    module: "channel_discord",
+    labelKey: "channel_discord.aiProposal.messageType",
+    icon: "bot",
+    color: "violet",
+    ui: {
+      listItemComponent: "messages.default.listItem",
+      contentComponent: "messages.default.content",
+      actionsComponent: "messages.default.actions"
+    },
+    // Replying to the proposal itself would go nowhere — the conversation lives
+    // on the Discord thread the proposal points at, not on this internal note.
+    allowReply: false,
+    allowForward: true,
+    defaultActions: proposalActions,
+    // A week-old proposal is stale: the person on Discord has moved on and the
+    // draft was written against a conversation that has since changed.
+    actionsExpireAfterHours: 168
+  }
+];
+var message_types_default = messageTypes;
+export {
+  CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID,
+  CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID,
+  CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE,
+  message_types_default as default,
+  messageTypes
+};
+//# sourceMappingURL=message-types.js.map

package/dist/modules/channel_discord/message-types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/channel_discord/message-types.ts"],
+  "sourcesContent": ["import type { MessageAction, MessageTypeDefinition } from '@open-mercato/shared/modules/messages/types'\nimport {\n  CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_COMMAND_ID,\n  CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_COMMAND_ID,\n} from './lib/ai-proposal-contract'\n\n/**\n * The message type the `complex`-tier AI proposal is filed under (issue #4778).\n *\n * Declaring it here is what makes the approval surface work at all: the messages\n * module builds its allowlist of dispatchable action commands from the\n * `defaultActions` of every REGISTERED message type\n * (`messages/lib/actions.ts` \u2192 `getMessageSafeCommandIds`). An action whose\n * `commandId` is not reachable that way is rejected with \"Action command is not\n * allowed\" \u2014 the confused-deputy guard that stops a composer from making a\n * recipient dispatch an arbitrary command with their own auth. So the two\n * commands below are allowlisted precisely because this file declares them, and\n * for no other message type.\n */\nexport const CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE = 'channel_discord.ai_reply_proposal'\n\nexport const CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID = 'approve_send'\nexport const CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID = 'dismiss'\n\nconst proposalActions: MessageAction[] = [\n  {\n    id: CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID,\n    label: 'Approve and send',\n    labelKey: 'channel_discord.aiProposal.actions.approve',\n    variant: 'default',\n    icon: 'send',\n    commandId: CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_COMMAND_ID,\n    isTerminal: true,\n    // Sending posts publicly into a Discord server on the tenant's behalf, so the\n    // operator confirms once before it leaves the building. No `confirmMessage`:\n    // the inbox renders that field verbatim (`message-detail/panels/dialogs.tsx`),\n    // so a translation key would leak into the dialog \u2014 omitting it falls back to\n    // the module's own localized confirmation copy.\n    confirmRequired: true,\n  },\n  {\n    id: CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID,\n    label: 'Dismiss',\n    labelKey: 'channel_discord.aiProposal.actions.dismiss',\n    variant: 'outline',\n    icon: 'x',\n    commandId: CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_COMMAND_ID,\n    isTerminal: true,\n  },\n]\n\nexport const messageTypes: MessageTypeDefinition[] = [\n  {\n    type: CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE,\n    module: 'channel_discord',\n    labelKey: 'channel_discord.aiProposal.messageType',\n    icon: 'bot',\n    color: 'violet',\n    ui: {\n      listItemComponent: 'messages.default.listItem',\n      contentComponent: 'messages.default.content',\n      actionsComponent: 'messages.default.actions',\n    },\n    // Replying to the proposal itself would go nowhere \u2014 the conversation lives\n    // on the Discord thread the proposal points at, not on this internal note.\n    allowReply: false,\n    allowForward: true,\n    defaultActions: proposalActions,\n    // A week-old proposal is stale: the person on Discord has moved on and the\n    // draft was written against a conversation that has since changed.\n    actionsExpireAfterHours: 168,\n  },\n]\n\nexport default messageTypes\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAeA,MAAM,2CAA2C;AAEjD,MAAM,gDAAgD;AACtD,MAAM,gDAAgD;AAE7D,MAAM,kBAAmC;AAAA,EACvC;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMZ,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,YAAY;AAAA,EACd;AACF;AAEO,MAAM,eAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,IAAI;AAAA,MACF,mBAAmB;AAAA,MACnB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,IACpB;AAAA;AAAA;AAAA,IAGA,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,gBAAgB;AAAA;AAAA;AAAA,IAGhB,yBAAyB;AAAA,EAC3B;AACF;AAEA,IAAO,wBAAQ;",
+  "names": []
+}