[Marius Storhaug (MariusStorhaug)]

Discord provides a reusable PowerShell client for bot access and interactive OAuth2 user sign-in. Connections use encrypted Context storage and are restored by name or default selection. At the user's request, the repository also moves to the current Process-PSModule v8 framework with explicit CI secrets, Pester 6, and real integration tests instead of mocks. The PR remains draft: the required test-bot secret is not configured, so authenticated integration and the coverage gate are not yet verified.

New: Authentication and saved contexts

Connect-DiscordAccount (Connect-Discord) accepts a bot token or a configured confidential OAuth2 application. User sign-in validates the callback state and issuer, uses S256 PKCE, requests identify by default, and implements token refresh. Normal account session tokens and self-bot automation are not supported.

Get-DiscordContext, Switch-DiscordContext, and Disconnect-DiscordAccount (Disconnect-Discord) manage named local connections and their default selection. Credentials stay SecureStrings and are encrypted by Context. Get-DiscordViewer retrieves /users/@me.

New: Reusable REST client

Invoke-DiscordAPI uses Bot or Bearer authorization and accepts only Discord's HTTPS v10 API destinations. It returns Request, Response, Headers, StatusCode, and StatusDescription; request metadata contains no authorization headers or body. GET/HEAD dictionaries become encoded query parameters, including lowercase Boolean values. HTTP 429 retries honor Discord's delay; other failures throw. No MCP server, Gateway connection, or resource-management command expansion is included.

Changed: Pipeline and documentation

The caller uses the owned v8 framework pointer, explicit TestData, Pester 6.1+ within the 6.x line, and the existing release-label semantics. Tests rely on the framework's built-module import, use public interfaces, and contain no mocks or fallback target imports. Optional live server/channel reads use existing resources; no Discord resource is created, edited, or deleted.

Zensical replaces the obsolete MkDocs configuration. Logo bytes, social links, consent, navigation expansion, and palette controls are preserved; fonts and features follow the template baseline. The README includes bot setup, user OAuth2 configuration, scopes, credentials, Context behavior, REST usage, and pipeline requirements.

Breaking Changes

The template Get-PSModuleTest greeting is replaced by client commands. PowerShell 7.4+ and Context 8.1.3+ are required. The framework's old APIKey input becomes PSGALLERY_API_KEY, with GitHub API operations using the existing organization App credentials.

Adopting this release

1. Select the resulting module release and use PowerShell 7.4 or later. Context is installed as a dependency.
2. Follow the README to supply a bot token securely, or configure an application you control with its client ID, OAuth2 client secret, and exact registered redirect http://localhost:53682/. User self-identity needs identify; the guild-list example additionally requests guilds.
3. Add repository secret DISCORD_BOT_TOKEN for live CI. Optional variables DISCORD_TEST_GUILD_ID and DISCORD_TEST_CHANNEL_ID identify existing test resources. Install the bot in that server and allow it to view the channel; no Administrator, privileged intents, or message-sending permission is needed by these tests.
4. Supply the framework secrets PSGALLERY_API_KEY, SHELLY_CLIENT_ID, and SHELLY_PRIVATE_KEY. They are already available here through organization secrets. The existing workflow was re-enabled with user approval.

Release impact

Decision source: release:minor, explicitly mapped in .github/PSModule.yml alongside the existing prefixed labels and retained legacy labels. This is a stable minor change from the pre-1.0 v0.0.5 baseline, with breaking integration changes described above. Final version and release coordinates are resolved by the release process.

---

Technical details

Consumer change record

Surface	Before	After	Consumer action	Verification
Authentication/identity	Greeting scaffold	Bot and PKCE user connection plus self identity	Adoption step 2	Public validation and real local callback checks pass; authenticated checks await the bot secret
Context	None	Encrypted named credentials and default selection	Install dependency; protect local vault	Artifact classes/import verified; live save/restore tests await the bot secret
REST	None	Safe destinations, response envelope, queries, error/rate-limit handling	Use selected or explicit context	Public guards and real unauthenticated Discord HTTP 401 failure verified; authenticated REST pending
Runtime	Template defaults	PowerShell 7.4+, Context 8.1.3+	Adoption step 1	Native artifact import succeeds
CI/test data	v5.4.6 with inherited fixed secrets	v8 with explicit Discord data and native Pester 6	Adoption steps 3–4	Build/framework/public checks pass on all OS runners; missing credential fails live setup explicitly
Site	Legacy MkDocs config	Template-aligned Zensical and generated command help	No additional consumer action	Native docs/site pass; all eight help URLs and unchanged icon verified locally

Template baseline

Process-PSModule v8.0.7 inspected at immutable source 105e4dcefe1946782066aa50a5c7d3658319895a. The caller follows the owned v8 major contract. Template-PSModule inspected at ff935a5745db222c5f28e59df45931b617c2c50b. Discord retains its existing 50% coverage target and linter overrides. The consumer had no authored docs tree or custom assets; .github/zensical.toml uses the template's generated-site layout, verified through the native framework site build and a local build with the same structuring/postprocessing steps.

Maintainer evidence

Implementation, tests, workflow, query correction, and documentation are split into small commits. GitHub/Context reference checkouts were inspected read-only. Context's vault key is held in ID/Name; the Discord snowflake remains separate in UserID. Official OAuth prose documents confidential exchange/refresh, and official metadata advertises S256 PKCE.

• Native framework builds the module and passes source/module tests and lint across Windows, Linux, and macOS.
• All 28 public-interface tests pass on those runners. Local acceptance against the actual native artifact passes with Pester 6.1.0; native CI resolves Pester 6.2.0 within the declared supported range.
• Real local loopback experiments pass valid callback, wrong-state rejection, timeout, and listener release. The RFC 7636 S256 vector and actual unauthenticated Discord HTTP 401 path pass without mocks or credentials.
• Native repository lint, generated documentation, and Zensical site checks pass. Local Markdown lint checks README plus all eight postprocessed references; the site includes all canonical help routes, a landing page, and the unchanged icon.
• The live Auth suite has 9 tests blocked at setup because DISCORD_BOT_TOKEN is missing; its 2 optional resource tests are skipped because their variables are absent. This is not reported as a passing integration run. The 50% coverage gate remains open.
• No real application or account credential was created, and no real OAuth2 consent/code exchange has been performed. User sign-in remains a manual end-to-end check after application configuration.

The initial PR planner's output was suppressed by GitHub's credential redaction. The latest native PR run executes the actual checks after rendering scheme names as code in the PR body; it is no longer a skipped-only success. The local Windows builder separately encounters mixed framework-generated line endings at formatting; the official Ubuntu-built artifact imports and works on Windows without a test bootstrap. The owned @v8 reference is the documented framework contract; zizmor's blanket SHA-only finding is that owned-major exception, not an undisclosed pin change.

Changed surface	Standards and domain/framework checks	Result
Client source	MSX PowerShell, PSModule layout, actual Context API, official Discord OAuth/REST	Build/lint/public validation aligned; authenticated verification blocked by fixture
Tests	Native Pester 6 discovery and framework-prepared public interface	No mocks/private calls/bootstrap; public cases pass; live setup fails explicitly
Caller/settings	YAML, explicit secrets and least privilege, current v8 contract	Native checks pass; release-label mappings and artifact ignores preserved
README/example/Zensical	Markdown, user setup, template design and generated routes/assets	Validated; obsolete MkDocs config removed

Scoped issue discovery returned no open Discord issues. The draft stays open until the bot fixture, real integration, and coverage gate pass.

Relevant issues (or links)

• https://github.com/PSModule/GitHub
• https://github.com/PSModule/Context
• https://github.com/PSModule/Process-PSModule/releases/tag/v8.0.7
• https://docs.discord.com/developers/topics/oauth2
• https://discord.com/.well-known/oauth-authorization-server
• https://docs.discord.com/developers/resources/user
• https://docs.discord.com/developers/topics/rate-limits