@openclaw/discord 2026.6.11 → 2026.7.1-beta.2

package/dist/{runtime-ywXByivr.js → runtime-DaaaVvJm.js}

@@ -1,17 +1,57 @@
-import { Ut as resolveDiscordChannelId } from "./send.receipt-B21MspvT.js";
+import { Ut as resolveDiscordChannelId } from "./send.receipt-CK162xD0.js";
 import { a as mergeDiscordAccountConfig, o as resolveDefaultDiscordAccountId, t as createDiscordActionGate } from "./accounts-P19jm1lf.js";
-import { d as readDiscordComponentSpec } from "./components-Dm4c_ce6.js";
-import { _ as withNormalizedTimestamp, c as jsonResult, d as readNonNegativeIntegerParam, f as readPositiveIntegerParam, g as resolvePollMaxSelections, h as readStringParam, l as parseAvailableTags, m as readStringArrayParam, p as readReactionParams, r as sendDiscordComponentMessage, s as assertMediaNotDataUrl, u as readBooleanParam } from "./send.components-D4bl20xr.js";
+import { d as readDiscordComponentSpec } from "./components-CBPNJhVP.js";
+import { _ as withNormalizedTimestamp, c as jsonResult, d as readNonNegativeIntegerParam, f as readPositiveIntegerParam, g as resolvePollMaxSelections, h as readStringParam, l as parseAvailableTags, m as readStringArrayParam, p as readReactionParams, r as sendDiscordComponentMessage, s as assertMediaNotDataUrl, u as readBooleanParam } from "./send.components-C2psXc7A.js";
 import { n as getGateway, o as getPresence } from "./gateway-registry-DPxmW0Db.js";
-import { E as canManageGuildRoleDiscord, L as createDiscordRuntimeAccountContext, M as hasAnyGuildPermissionDiscord, N as isThreadChannelType$1, O as fetchChannelPermissionsDiscord, T as canManageGuildMemberRoleDiscord, d as resolveDiscordTargetChannelId, j as hasAnyChannelPermissionDiscord } from "./send.shared-9082A2sO.js";
+import { E as canManageGuildRoleDiscord, L as createDiscordRuntimeAccountContext, M as hasAnyGuildPermissionDiscord, N as isThreadChannelType$1, O as fetchChannelPermissionsDiscord, T as canManageGuildMemberRoleDiscord, d as resolveDiscordTargetChannelId, j as hasAnyChannelPermissionDiscord } from "./send.shared-CUTfqvXx.js";
 import { a as normalizeDiscordSlug, c as resolveDiscordChannelConfigWithFallback, n as isDiscordGroupAllowedByPolicy } from "./allow-list-C-MqM-B_.js";
-import { A as listScheduledEventsDiscord, B as moveChannelDiscord, C as fetchChannelInfoDiscord, D as fetchVoiceStatusDiscord, E as fetchRoleInfoDiscord, F as uploadEmojiDiscord, H as setChannelPermissionDiscord, I as uploadStickerDiscord, L as createChannelDiscord, M as resolveEventCoverImage, N as timeoutMemberDiscord, O as kickMemberDiscord, P as listGuildEmojisDiscord, R as deleteChannelDiscord, S as createScheduledEventDiscord, T as fetchMemberInfoDiscord, V as removeChannelPermissionDiscord, _ as readMessagesDiscord, a as removeReactionDiscord, b as addRoleDiscord, d as deleteMessageDiscord, f as editMessageDiscord, g as pinMessageDiscord, h as listThreadsDiscord, i as removeOwnReactionsDiscord, j as removeRoleDiscord, k as listGuildChannelsDiscord, l as DiscordThreadInitialMessageError, m as listPinsDiscord, n as fetchReactionsDiscord, p as fetchMessageDiscord, r as reactMessageDiscord, s as sendVoiceMessageDiscord, u as createThreadDiscord, v as searchMessagesDiscord, w as fetchGuildInfoDiscord, x as banMemberDiscord, y as unpinMessageDiscord, z as editChannelDiscord } from "./send-Dc5uQX5H.js";
-import { n as sendPollDiscord, r as sendStickerDiscord, t as sendMessageDiscord } from "./send.outbound-5axvwLkl.js";
-import "./targets-ClUPljCU.js";
+import { A as listScheduledEventsDiscord, B as moveChannelDiscord, C as fetchChannelInfoDiscord, D as fetchVoiceStatusDiscord, E as fetchRoleInfoDiscord, F as uploadEmojiDiscord, H as setChannelPermissionDiscord, I as uploadStickerDiscord, L as createChannelDiscord, M as resolveEventCoverImage, N as timeoutMemberDiscord, O as kickMemberDiscord, P as listGuildEmojisDiscord, R as deleteChannelDiscord, S as createScheduledEventDiscord, T as fetchMemberInfoDiscord, V as removeChannelPermissionDiscord, _ as readMessagesDiscord, a as removeReactionDiscord, b as addRoleDiscord, d as deleteMessageDiscord, f as editMessageDiscord, g as pinMessageDiscord, h as listThreadsDiscord, i as removeOwnReactionsDiscord, j as removeRoleDiscord, k as listGuildChannelsDiscord, l as DiscordThreadInitialMessageError, m as listPinsDiscord, n as fetchReactionsDiscord, p as fetchMessageDiscord, r as reactMessageDiscord, s as sendVoiceMessageDiscord, u as createThreadDiscord, v as searchMessagesDiscord, w as fetchGuildInfoDiscord, x as banMemberDiscord, y as unpinMessageDiscord, z as editChannelDiscord } from "./send-B_yfprXu.js";
+import { n as sendPollDiscord, r as sendStickerDiscord, t as sendMessageDiscord } from "./send.outbound-BPcCF1v2.js";
+import "./targets-BA7gf0K0.js";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { ChannelType, PermissionFlagsBits } from "discord-api-types/v10";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { resolveOpenProviderRuntimeGroupPolicy } from "openclaw/plugin-sdk/runtime-group-policy";
+//#region extensions/discord/src/actions/runtime.messaging.runtime.ts
+const discordMessagingActionRuntime = {
+	createThreadDiscord,
+	deleteMessageDiscord,
+	editChannelDiscord,
+	editMessageDiscord,
+	fetchChannelInfoDiscord,
+	fetchGuildInfoDiscord,
+	fetchChannelPermissionsDiscord,
+	fetchMessageDiscord,
+	fetchReactionsDiscord,
+	listPinsDiscord,
+	listThreadsDiscord,
+	pinMessageDiscord,
+	reactMessageDiscord,
+	readDiscordComponentSpec,
+	readMessagesDiscord,
+	removeOwnReactionsDiscord,
+	removeReactionDiscord,
+	resolveDiscordReactionTargetChannelId,
+	resolveDiscordChannelId,
+	searchMessagesDiscord,
+	sendDiscordComponentMessage,
+	sendMessageDiscord,
+	sendPollDiscord,
+	sendStickerDiscord,
+	sendVoiceMessageDiscord,
+	unpinMessageDiscord
+};
+async function resolveDiscordReactionTargetChannelId(params) {
+	try {
+		return resolveDiscordChannelId(params.target);
+	} catch {
+		return (await resolveDiscordTargetChannelId(params.target, {
+			cfg: params.cfg,
+			accountId: params.accountId
+		})).channelId;
+	}
+}
+//#endregion
 //#region extensions/discord/src/actions/runtime.shared.ts
 function readDiscordParentIdParam(params) {
 	if (params.clearParent === true) return null;
@@ -66,6 +106,239 @@ function readDiscordChannelMoveParams(params) {
 	};
 }
 //#endregion
+//#region extensions/discord/src/actions/runtime.messaging.shared.ts
+function hasDiscordGuildEntries(guilds) {
+	return Boolean(guilds && Object.keys(guilds).length > 0);
+}
+function allowsAllDiscordGuildChannels(channels) {
+	const wildcard = channels?.["*"];
+	if (!wildcard || wildcard.enabled === false) return false;
+	return Object.values(channels ?? {}).every((entry) => entry?.enabled !== false);
+}
+function resolveDiscordActionGuildEntry(params) {
+	const guildId = params.guildId?.trim();
+	if (!params.guilds) return null;
+	if (guildId && params.guilds[guildId]) return {
+		...params.guilds[guildId],
+		id: guildId
+	};
+	if (guildId) {
+		const byConfiguredId = Object.values(params.guilds).find((guild) => guild?.id === guildId);
+		if (byConfiguredId) return {
+			...byConfiguredId,
+			id: guildId
+		};
+	}
+	const guildSlug = params.guildName ? normalizeDiscordSlug(params.guildName) : "";
+	if (guildSlug) {
+		const bySlug = params.guilds[guildSlug] ?? Object.values(params.guilds).find((guild) => guild?.slug === guildSlug);
+		if (bySlug) return {
+			...bySlug,
+			id: guildId,
+			slug: guildSlug || bySlug.slug
+		};
+	}
+	if (params.includeWildcard === false) return null;
+	const wildcard = params.guilds["*"];
+	return wildcard ? {
+		...wildcard,
+		id: guildId
+	} : null;
+}
+function readDiscordChannelStringField(value, ...keys) {
+	if (!value || typeof value !== "object") return;
+	const record = value;
+	for (const key of keys) {
+		const candidate = record[key];
+		if (typeof candidate === "string" && candidate.trim()) return candidate.trim();
+	}
+}
+function readDiscordChannelType(value) {
+	if (!value || typeof value !== "object") return;
+	const type = value.type;
+	return typeof type === "number" ? type : void 0;
+}
+function isDiscordThreadChannel(value) {
+	const type = readDiscordChannelType(value);
+	return type === 10 || type === 11 || type === 12;
+}
+function isDiscordReadTargetAllowedInGuild(params) {
+	if (resolveDiscordChannelConfigWithFallback({
+		guildInfo: params.guildInfo,
+		channelId: params.target.channelId,
+		channelName: params.target.channelName,
+		channelSlug: params.target.channelSlug,
+		parentId: params.target.parentId,
+		parentName: params.target.parentName,
+		parentSlug: params.target.parentSlug,
+		scope: params.target.scope
+	})?.allowed === false) return false;
+	return isDiscordGroupAllowedByPolicy({
+		groupPolicy: params.groupPolicy,
+		guildAllowlisted: Boolean(params.guildInfo),
+		channelAllowlistConfigured: hasDiscordGuildEntries(params.guildInfo?.channels),
+		channelAllowed: true
+	});
+}
+function isDiscordReadTargetExplicitlyAllowedById(params) {
+	const channelEntry = params.guildInfo?.channels?.[params.target.channelId];
+	if (!channelEntry || channelEntry.enabled === false) return false;
+	return isDiscordGroupAllowedByPolicy({
+		groupPolicy: params.groupPolicy,
+		guildAllowlisted: Boolean(params.guildInfo),
+		channelAllowlistConfigured: true,
+		channelAllowed: true
+	});
+}
+function createDiscordMessagingActionContext(params) {
+	const accountId = readStringParam(params.input, "accountId");
+	const cfgOptions = { cfg: params.cfg };
+	const accountConfig = mergeDiscordAccountConfig(params.cfg, accountId ?? resolveDefaultDiscordAccountId(params.cfg));
+	const guilds = accountConfig.guilds;
+	const hasGuildEntries = Object.keys(guilds ?? {}).length > 0;
+	const { groupPolicy } = resolveOpenProviderRuntimeGroupPolicy({
+		providerConfigPresent: params.cfg.channels?.discord !== void 0,
+		groupPolicy: accountConfig.groupPolicy,
+		defaultGroupPolicy: params.cfg.channels?.defaults?.groupPolicy
+	});
+	const withOpts = (extra) => createDiscordActionOptions({
+		cfg: params.cfg,
+		accountId,
+		extra
+	});
+	const resolvedReactionAccountId = accountId ?? resolveDefaultDiscordAccountId(params.cfg);
+	const reactionRuntimeOptions = resolvedReactionAccountId ? createDiscordRuntimeAccountContext({
+		cfg: params.cfg,
+		accountId: resolvedReactionAccountId
+	}) : cfgOptions;
+	const guildNameById = /* @__PURE__ */ new Map();
+	const resolveGuildName = async (guildId) => {
+		if (guildNameById.has(guildId)) return guildNameById.get(guildId) ?? null;
+		try {
+			const guildName = readDiscordChannelStringField(await discordMessagingActionRuntime.fetchGuildInfoDiscord(guildId, withOpts()), "name") ?? null;
+			guildNameById.set(guildId, guildName);
+			return guildName;
+		} catch {
+			guildNameById.set(guildId, null);
+			return null;
+		}
+	};
+	const resolveReadGuildEntry = async (guildId) => {
+		const direct = resolveDiscordActionGuildEntry({
+			guilds,
+			guildId,
+			includeWildcard: false
+		});
+		if (direct || !guildId) return direct;
+		const named = resolveDiscordActionGuildEntry({
+			guilds,
+			guildId,
+			guildName: await resolveGuildName(guildId) ?? void 0,
+			includeWildcard: false
+		});
+		if (named) return named;
+		return resolveDiscordActionGuildEntry({
+			guilds,
+			guildId
+		});
+	};
+	const resolveReadTargetContext = async (channelId) => {
+		const fallback = {
+			channelId,
+			channelSlug: normalizeDiscordSlug(channelId) || channelId
+		};
+		let channelInfo;
+		try {
+			channelInfo = await discordMessagingActionRuntime.fetchChannelInfoDiscord(channelId, withOpts());
+		} catch {
+			return fallback;
+		}
+		const channelName = readDiscordChannelStringField(channelInfo, "name");
+		const target = {
+			channelId,
+			channelSlug: channelName ? normalizeDiscordSlug(channelName) : fallback.channelSlug
+		};
+		const targetGuildId = readDiscordChannelStringField(channelInfo, "guild_id", "guildId");
+		if (targetGuildId) target.guildId = targetGuildId;
+		if (channelName) target.channelName = channelName;
+		if (!isDiscordThreadChannel(channelInfo)) return target;
+		target.scope = "thread";
+		target.parentId = readDiscordChannelStringField(channelInfo, "parent_id", "parentId");
+		if (!target.parentId) return target;
+		try {
+			const parentName = readDiscordChannelStringField(await discordMessagingActionRuntime.fetchChannelInfoDiscord(target.parentId, withOpts()), "name");
+			if (parentName) {
+				target.parentName = parentName;
+				target.parentSlug = normalizeDiscordSlug(parentName);
+			}
+		} catch {}
+		return target;
+	};
+	return {
+		action: params.action,
+		params: params.input,
+		isActionEnabled: params.isActionEnabled,
+		cfg: params.cfg,
+		options: params.options,
+		accountId,
+		resolveChannelId: () => discordMessagingActionRuntime.resolveDiscordChannelId(readStringParam(params.input, "channelId", { required: true })),
+		assertReadTargetAllowed: async ({ guildId, channelId }) => {
+			const targetChannelId = discordMessagingActionRuntime.resolveDiscordChannelId(channelId);
+			if (!hasGuildEntries && groupPolicy !== "disabled" && groupPolicy !== "allowlist") return;
+			const target = await resolveReadTargetContext(targetChannelId);
+			if (guildId) {
+				if (target.guildId && target.guildId !== guildId) throw new Error("Discord read target channel is not allowed.");
+				if (!isDiscordReadTargetAllowedInGuild({
+					groupPolicy,
+					guildInfo: await resolveReadGuildEntry(guildId),
+					target
+				})) throw new Error("Discord read target channel is not allowed.");
+				return;
+			}
+			if (target.guildId) {
+				if (!isDiscordReadTargetAllowedInGuild({
+					groupPolicy,
+					guildInfo: await resolveReadGuildEntry(target.guildId),
+					target
+				})) throw new Error("Discord read target channel is not allowed.");
+				return;
+			}
+			if (!Object.values(guilds ?? {}).some((guildInfo) => isDiscordReadTargetExplicitlyAllowedById({
+				groupPolicy,
+				guildInfo: guildInfo ?? null,
+				target
+			}))) throw new Error("Discord read target channel is not allowed.");
+		},
+		assertGuildReadTargetAllowed: async ({ guildId, channelTargetRequiredMessage }) => {
+			const guildInfo = await resolveReadGuildEntry(guildId);
+			if (!isDiscordGroupAllowedByPolicy({
+				groupPolicy,
+				guildAllowlisted: Boolean(guildInfo),
+				channelAllowlistConfigured: false,
+				channelAllowed: true
+			})) throw new Error("Discord read target channel is not allowed.");
+			if (hasDiscordGuildEntries(guildInfo?.channels) && !allowsAllDiscordGuildChannels(guildInfo.channels)) throw new Error(channelTargetRequiredMessage ?? "Discord message search requires channelId or channelIds so each read target can be authorized.");
+		},
+		resolveReactionChannelId: async () => {
+			const target = readStringParam(params.input, "channelId") ?? readStringParam(params.input, "to", { required: true });
+			return await discordMessagingActionRuntime.resolveDiscordReactionTargetChannelId({
+				target,
+				cfg: params.cfg,
+				accountId: resolvedReactionAccountId
+			});
+		},
+		withOpts,
+		withReactionRuntimeOptions: (extra) => ({
+			...reactionRuntimeOptions ?? cfgOptions,
+			...extra
+		}),
+		normalizeMessage: (message) => {
+			if (!message || typeof message !== "object") return message;
+			return withNormalizedTimestamp(message, message.timestamp);
+		}
+	};
+}
+//#endregion
 //#region extensions/discord/src/actions/runtime.guild.ts
 const discordGuildActionRuntime = {
 	addRoleDiscord,
@@ -245,15 +518,29 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		accountId,
 		cfg
 	});
+	const readTargetGate = createDiscordMessagingActionContext({
+		action,
+		input: params,
+		isActionEnabled,
+		cfg,
+		options
+	});
 	const withOpts = (extra) => createDiscordActionOptions({
 		cfg,
 		accountId,
 		extra
 	});
+	const assertGuildMetadataReadAllowed = async (guildId) => {
+		await readTargetGate.assertGuildReadTargetAllowed({
+			guildId,
+			channelTargetRequiredMessage: "Discord guild metadata reads require a wildcard channel allowlist for this guild."
+		});
+	};
 	switch (action) {
 		case "memberInfo": {
 			if (!isActionEnabled("memberInfo")) throw new Error("Discord member info is disabled.");
 			const guildId = readStringParam(params, "guildId", { required: true });
+			await assertGuildMetadataReadAllowed(guildId);
 			const userId = readStringParam(params, "userId", { required: true });
 			const effectiveAccountId = accountId ?? resolveDefaultDiscordAccountId(cfg);
 			const member = await discordGuildActionRuntime.fetchMemberInfoDiscord(guildId, userId, createDiscordActionOptions({
@@ -275,6 +562,7 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		case "roleInfo": {
 			if (!isActionEnabled("roleInfo")) throw new Error("Discord role info is disabled.");
 			const guildId = readStringParam(params, "guildId", { required: true });
+			await assertGuildMetadataReadAllowed(guildId);
 			return jsonResult({
 				ok: true,
 				roles: await discordGuildActionRuntime.fetchRoleInfoDiscord(guildId, withOpts())
@@ -283,6 +571,7 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		case "emojiList": {
 			if (!isActionEnabled("reactions")) throw new Error("Discord reactions are disabled.");
 			const guildId = readStringParam(params, "guildId", { required: true });
+			await assertGuildMetadataReadAllowed(guildId);
 			return jsonResult({
 				ok: true,
 				emojis: await discordGuildActionRuntime.listGuildEmojisDiscord(guildId, withOpts())
@@ -343,6 +632,7 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		case "channelInfo": {
 			if (!isActionEnabled("channelInfo")) throw new Error("Discord channel info is disabled.");
 			const channelId = readStringParam(params, "channelId", { required: true });
+			await readTargetGate.assertReadTargetAllowed({ channelId });
 			return jsonResult({
 				ok: true,
 				channel: await discordGuildActionRuntime.fetchChannelInfoDiscord(channelId, withOpts())
@@ -351,6 +641,7 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		case "channelList": {
 			if (!isActionEnabled("channelInfo")) throw new Error("Discord channel info is disabled.");
 			const guildId = readStringParam(params, "guildId", { required: true });
+			await assertGuildMetadataReadAllowed(guildId);
 			return jsonResult({
 				ok: true,
 				channels: await discordGuildActionRuntime.listGuildChannelsDiscord(guildId, withOpts())
@@ -359,6 +650,7 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		case "voiceStatus": {
 			if (!isActionEnabled("voiceStatus")) throw new Error("Discord voice status is disabled.");
 			const guildId = readStringParam(params, "guildId", { required: true });
+			await assertGuildMetadataReadAllowed(guildId);
 			const userId = readStringParam(params, "userId", { required: true });
 			return jsonResult({
 				ok: true,
@@ -368,6 +660,7 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		case "eventList": {
 			if (!isActionEnabled("events")) throw new Error("Discord events are disabled.");
 			const guildId = readStringParam(params, "guildId", { required: true });
+			await assertGuildMetadataReadAllowed(guildId);
 			return jsonResult({
 				ok: true,
 				events: await discordGuildActionRuntime.listScheduledEventsDiscord(guildId, withOpts())
@@ -459,66 +752,26 @@ async function handleDiscordGuildAction(action, params, isActionEnabled, cfg, op
 		}
 		case "channelPermissionSet": {
 			if (!isActionEnabled("channels")) throw new Error("Discord channel management is disabled.");
-			const { channelId, targetId } = readChannelPermissionTarget(params);
-			const targetType = readStringParam(params, "targetType", { required: true }) === "member" ? 1 : 0;
-			const allow = readStringParam(params, "allow");
-			const deny = readStringParam(params, "deny");
-			await discordGuildActionRuntime.setChannelPermissionDiscord({
-				channelId,
-				targetId,
-				targetType,
-				allow: allow ?? void 0,
-				deny: deny ?? void 0
-			}, withOpts());
-			return jsonResult({ ok: true });
-		}
-		case "channelPermissionRemove": {
-			if (!isActionEnabled("channels")) throw new Error("Discord channel management is disabled.");
-			const { channelId, targetId } = readChannelPermissionTarget(params);
-			await discordGuildActionRuntime.removeChannelPermissionDiscord(channelId, targetId, withOpts());
-			return jsonResult({ ok: true });
-		}
-		default: throw new Error(`Unknown action: ${action}`);
-	}
-}
-//#endregion
-//#region extensions/discord/src/actions/runtime.messaging.runtime.ts
-const discordMessagingActionRuntime = {
-	createThreadDiscord,
-	deleteMessageDiscord,
-	editChannelDiscord,
-	editMessageDiscord,
-	fetchChannelInfoDiscord,
-	fetchGuildInfoDiscord,
-	fetchChannelPermissionsDiscord,
-	fetchMessageDiscord,
-	fetchReactionsDiscord,
-	listPinsDiscord,
-	listThreadsDiscord,
-	pinMessageDiscord,
-	reactMessageDiscord,
-	readDiscordComponentSpec,
-	readMessagesDiscord,
-	removeOwnReactionsDiscord,
-	removeReactionDiscord,
-	resolveDiscordReactionTargetChannelId,
-	resolveDiscordChannelId,
-	searchMessagesDiscord,
-	sendDiscordComponentMessage,
-	sendMessageDiscord,
-	sendPollDiscord,
-	sendStickerDiscord,
-	sendVoiceMessageDiscord,
-	unpinMessageDiscord
-};
-async function resolveDiscordReactionTargetChannelId(params) {
-	try {
-		return resolveDiscordChannelId(params.target);
-	} catch {
-		return (await resolveDiscordTargetChannelId(params.target, {
-			cfg: params.cfg,
-			accountId: params.accountId
-		})).channelId;
+			const { channelId, targetId } = readChannelPermissionTarget(params);
+			const targetType = readStringParam(params, "targetType", { required: true }) === "member" ? 1 : 0;
+			const allow = readStringParam(params, "allow");
+			const deny = readStringParam(params, "deny");
+			await discordGuildActionRuntime.setChannelPermissionDiscord({
+				channelId,
+				targetId,
+				targetType,
+				allow: allow ?? void 0,
+				deny: deny ?? void 0
+			}, withOpts());
+			return jsonResult({ ok: true });
+		}
+		case "channelPermissionRemove": {
+			if (!isActionEnabled("channels")) throw new Error("Discord channel management is disabled.");
+			const { channelId, targetId } = readChannelPermissionTarget(params);
+			await discordGuildActionRuntime.removeChannelPermissionDiscord(channelId, targetId, withOpts());
+			return jsonResult({ ok: true });
+		}
+		default: throw new Error(`Unknown action: ${action}`);
 	}
 }
 //#endregion
@@ -678,13 +931,12 @@ async function handleDiscordMessageManagementAction(ctx) {
 				ok: true,
 				results
 			});
-			const resultsRecord = results;
-			const messages = resultsRecord.messages;
+			const messages = results.messages;
 			const normalizedMessages = Array.isArray(messages) ? messages.map((group) => Array.isArray(group) ? group.map((msg) => ctx.normalizeMessage(msg)) : group) : messages;
 			return jsonResult({
 				ok: true,
 				results: {
-					...resultsRecord,
+					...results,
 					messages: normalizedMessages
 				}
 			});
@@ -966,6 +1218,14 @@ async function handleDiscordMessageSendAction(ctx) {
 			const includeArchived = readBooleanParam(ctx.params, "includeArchived");
 			const before = readStringParam(ctx.params, "before");
 			const limit = readPositiveIntegerParam(ctx.params, "limit");
+			if (channelId && includeArchived === true) await ctx.assertReadTargetAllowed({
+				guildId,
+				channelId
+			});
+			else await ctx.assertGuildReadTargetAllowed({
+				guildId,
+				channelTargetRequiredMessage: "Discord active thread lists require a wildcard channel allowlist so each read target can be authorized."
+			});
 			return jsonResult(normalizeDiscordThreadListActionResult({
 				value: await discordMessagingActionRuntime.listThreadsDiscord({
 					guildId,
@@ -1002,239 +1262,6 @@ async function handleDiscordMessageSendAction(ctx) {
 	}
 }
 //#endregion
-//#region extensions/discord/src/actions/runtime.messaging.shared.ts
-function hasDiscordGuildEntries(guilds) {
-	return Boolean(guilds && Object.keys(guilds).length > 0);
-}
-function allowsAllDiscordGuildChannels(channels) {
-	const wildcard = channels?.["*"];
-	if (!wildcard || wildcard.enabled === false) return false;
-	return Object.values(channels ?? {}).every((entry) => entry?.enabled !== false);
-}
-function resolveDiscordActionGuildEntry(params) {
-	const guildId = params.guildId?.trim();
-	if (!params.guilds) return null;
-	if (guildId && params.guilds[guildId]) return {
-		...params.guilds[guildId],
-		id: guildId
-	};
-	if (guildId) {
-		const byConfiguredId = Object.values(params.guilds).find((guild) => guild?.id === guildId);
-		if (byConfiguredId) return {
-			...byConfiguredId,
-			id: guildId
-		};
-	}
-	const guildSlug = params.guildName ? normalizeDiscordSlug(params.guildName) : "";
-	if (guildSlug) {
-		const bySlug = params.guilds[guildSlug] ?? Object.values(params.guilds).find((guild) => guild?.slug === guildSlug);
-		if (bySlug) return {
-			...bySlug,
-			id: guildId,
-			slug: guildSlug || bySlug.slug
-		};
-	}
-	if (params.includeWildcard === false) return null;
-	const wildcard = params.guilds["*"];
-	return wildcard ? {
-		...wildcard,
-		id: guildId
-	} : null;
-}
-function readDiscordChannelStringField(value, ...keys) {
-	if (!value || typeof value !== "object") return;
-	const record = value;
-	for (const key of keys) {
-		const candidate = record[key];
-		if (typeof candidate === "string" && candidate.trim()) return candidate.trim();
-	}
-}
-function readDiscordChannelType(value) {
-	if (!value || typeof value !== "object") return;
-	const type = value.type;
-	return typeof type === "number" ? type : void 0;
-}
-function isDiscordThreadChannel(value) {
-	const type = readDiscordChannelType(value);
-	return type === 10 || type === 11 || type === 12;
-}
-function isDiscordReadTargetAllowedInGuild(params) {
-	if (resolveDiscordChannelConfigWithFallback({
-		guildInfo: params.guildInfo,
-		channelId: params.target.channelId,
-		channelName: params.target.channelName,
-		channelSlug: params.target.channelSlug,
-		parentId: params.target.parentId,
-		parentName: params.target.parentName,
-		parentSlug: params.target.parentSlug,
-		scope: params.target.scope
-	})?.allowed === false) return false;
-	return isDiscordGroupAllowedByPolicy({
-		groupPolicy: params.groupPolicy,
-		guildAllowlisted: Boolean(params.guildInfo),
-		channelAllowlistConfigured: hasDiscordGuildEntries(params.guildInfo?.channels),
-		channelAllowed: true
-	});
-}
-function isDiscordReadTargetExplicitlyAllowedById(params) {
-	const channelEntry = params.guildInfo?.channels?.[params.target.channelId];
-	if (!channelEntry || channelEntry.enabled === false) return false;
-	return isDiscordGroupAllowedByPolicy({
-		groupPolicy: params.groupPolicy,
-		guildAllowlisted: Boolean(params.guildInfo),
-		channelAllowlistConfigured: true,
-		channelAllowed: true
-	});
-}
-function createDiscordMessagingActionContext(params) {
-	const accountId = readStringParam(params.input, "accountId");
-	const cfgOptions = { cfg: params.cfg };
-	const accountConfig = mergeDiscordAccountConfig(params.cfg, accountId ?? resolveDefaultDiscordAccountId(params.cfg));
-	const guilds = accountConfig.guilds;
-	const hasGuildEntries = Object.keys(guilds ?? {}).length > 0;
-	const { groupPolicy } = resolveOpenProviderRuntimeGroupPolicy({
-		providerConfigPresent: params.cfg.channels?.discord !== void 0,
-		groupPolicy: accountConfig.groupPolicy,
-		defaultGroupPolicy: params.cfg.channels?.defaults?.groupPolicy
-	});
-	const withOpts = (extra) => createDiscordActionOptions({
-		cfg: params.cfg,
-		accountId,
-		extra
-	});
-	const resolvedReactionAccountId = accountId ?? resolveDefaultDiscordAccountId(params.cfg);
-	const reactionRuntimeOptions = resolvedReactionAccountId ? createDiscordRuntimeAccountContext({
-		cfg: params.cfg,
-		accountId: resolvedReactionAccountId
-	}) : cfgOptions;
-	const guildNameById = /* @__PURE__ */ new Map();
-	const resolveGuildName = async (guildId) => {
-		if (guildNameById.has(guildId)) return guildNameById.get(guildId) ?? null;
-		try {
-			const guildName = readDiscordChannelStringField(await discordMessagingActionRuntime.fetchGuildInfoDiscord(guildId, withOpts()), "name") ?? null;
-			guildNameById.set(guildId, guildName);
-			return guildName;
-		} catch {
-			guildNameById.set(guildId, null);
-			return null;
-		}
-	};
-	const resolveReadGuildEntry = async (guildId) => {
-		const direct = resolveDiscordActionGuildEntry({
-			guilds,
-			guildId,
-			includeWildcard: false
-		});
-		if (direct || !guildId) return direct;
-		const named = resolveDiscordActionGuildEntry({
-			guilds,
-			guildId,
-			guildName: await resolveGuildName(guildId) ?? void 0,
-			includeWildcard: false
-		});
-		if (named) return named;
-		return resolveDiscordActionGuildEntry({
-			guilds,
-			guildId
-		});
-	};
-	const resolveReadTargetContext = async (channelId) => {
-		const fallback = {
-			channelId,
-			channelSlug: normalizeDiscordSlug(channelId) || channelId
-		};
-		let channelInfo;
-		try {
-			channelInfo = await discordMessagingActionRuntime.fetchChannelInfoDiscord(channelId, withOpts());
-		} catch {
-			return fallback;
-		}
-		const channelName = readDiscordChannelStringField(channelInfo, "name");
-		const target = {
-			channelId,
-			channelSlug: channelName ? normalizeDiscordSlug(channelName) : fallback.channelSlug
-		};
-		const targetGuildId = readDiscordChannelStringField(channelInfo, "guild_id", "guildId");
-		if (targetGuildId) target.guildId = targetGuildId;
-		if (channelName) target.channelName = channelName;
-		if (!isDiscordThreadChannel(channelInfo)) return target;
-		target.scope = "thread";
-		target.parentId = readDiscordChannelStringField(channelInfo, "parent_id", "parentId");
-		if (!target.parentId) return target;
-		try {
-			const parentName = readDiscordChannelStringField(await discordMessagingActionRuntime.fetchChannelInfoDiscord(target.parentId, withOpts()), "name");
-			if (parentName) {
-				target.parentName = parentName;
-				target.parentSlug = normalizeDiscordSlug(parentName);
-			}
-		} catch {}
-		return target;
-	};
-	return {
-		action: params.action,
-		params: params.input,
-		isActionEnabled: params.isActionEnabled,
-		cfg: params.cfg,
-		options: params.options,
-		accountId,
-		resolveChannelId: () => discordMessagingActionRuntime.resolveDiscordChannelId(readStringParam(params.input, "channelId", { required: true })),
-		assertReadTargetAllowed: async ({ guildId, channelId }) => {
-			const targetChannelId = discordMessagingActionRuntime.resolveDiscordChannelId(channelId);
-			if (!hasGuildEntries && groupPolicy !== "disabled" && groupPolicy !== "allowlist") return;
-			const target = await resolveReadTargetContext(targetChannelId);
-			if (guildId) {
-				if (target.guildId && target.guildId !== guildId) throw new Error("Discord read target channel is not allowed.");
-				if (!isDiscordReadTargetAllowedInGuild({
-					groupPolicy,
-					guildInfo: await resolveReadGuildEntry(guildId),
-					target
-				})) throw new Error("Discord read target channel is not allowed.");
-				return;
-			}
-			if (target.guildId) {
-				if (!isDiscordReadTargetAllowedInGuild({
-					groupPolicy,
-					guildInfo: await resolveReadGuildEntry(target.guildId),
-					target
-				})) throw new Error("Discord read target channel is not allowed.");
-				return;
-			}
-			if (!Object.values(guilds ?? {}).some((guildInfo) => isDiscordReadTargetExplicitlyAllowedById({
-				groupPolicy,
-				guildInfo: guildInfo ?? null,
-				target
-			}))) throw new Error("Discord read target channel is not allowed.");
-		},
-		assertGuildReadTargetAllowed: async ({ guildId }) => {
-			const guildInfo = await resolveReadGuildEntry(guildId);
-			if (!isDiscordGroupAllowedByPolicy({
-				groupPolicy,
-				guildAllowlisted: Boolean(guildInfo),
-				channelAllowlistConfigured: false,
-				channelAllowed: true
-			})) throw new Error("Discord read target channel is not allowed.");
-			if (hasDiscordGuildEntries(guildInfo?.channels) && !allowsAllDiscordGuildChannels(guildInfo.channels)) throw new Error("Discord message search requires channelId or channelIds so each read target can be authorized.");
-		},
-		resolveReactionChannelId: async () => {
-			const target = readStringParam(params.input, "channelId") ?? readStringParam(params.input, "to", { required: true });
-			return await discordMessagingActionRuntime.resolveDiscordReactionTargetChannelId({
-				target,
-				cfg: params.cfg,
-				accountId: resolvedReactionAccountId
-			});
-		},
-		withOpts,
-		withReactionRuntimeOptions: (extra) => ({
-			...reactionRuntimeOptions ?? cfgOptions,
-			...extra
-		}),
-		normalizeMessage: (message) => {
-			if (!message || typeof message !== "object") return message;
-			return withNormalizedTimestamp(message, message.timestamp);
-		}
-	};
-}
-//#endregion
 //#region extensions/discord/src/actions/runtime.messaging.ts
 async function handleDiscordMessagingAction(action, params, isActionEnabled, cfg, options) {
 	if (!cfg) throw new Error("Discord messaging actions require a resolved runtime config.");