@open-mercato/channel-discord 0.6.8-develop.7090.1.4dbca7b350

package/dist/modules/channel_discord/workers/discord-interactions.js

@@ -0,0 +1,113 @@
+import { createTranslator } from "@open-mercato/shared/lib/i18n/translate";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  COMMUNICATION_CHANNELS_QUEUES,
+  getCommunicationChannelsQueue
+} from "@open-mercato/core/modules/communication_channels/lib/queue";
+import { parseDiscordCredentialsOrThrow } from "../lib/credentials.js";
+import { getDiscordRestClient } from "../lib/discord-rest.js";
+import {
+  buildInteractionFollowUpContent,
+  buildInteractionInboundJob,
+  sendInteractionFollowUp
+} from "../lib/interactions-dispatch.js";
+import {
+  CHANNEL_DISCORD_INTERACTIONS_QUEUE
+} from "../lib/interactions-queue.js";
+const logger = createLogger("channel_discord").child({ component: "interactions-worker" });
+const metadata = {
+  queue: CHANNEL_DISCORD_INTERACTIONS_QUEUE,
+  id: "channel_discord:interactions",
+  concurrency: 5
+};
+async function resolveFollowUpContent(interaction) {
+  try {
+    const { resolveTranslations } = await import("@open-mercato/shared/lib/i18n/server");
+    const { t } = await resolveTranslations();
+    return buildInteractionFollowUpContent(interaction, t);
+  } catch (err) {
+    logger.debug("falling back to the untranslated interaction acknowledgement", { err });
+    return buildInteractionFollowUpContent(interaction, createTranslator({}));
+  }
+}
+async function handle(job, ctx) {
+  const payload = job.payload;
+  if (!payload?.interaction) {
+    logger.warn("interaction dispatch job carried no interaction \u2014 dropping");
+    return;
+  }
+  const { interaction } = payload;
+  const inboundJob = buildInteractionInboundJob({
+    dispatch: interaction,
+    channel: {
+      channelId: payload.channelId,
+      channelType: payload.channelType,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId
+    }
+  });
+  if (inboundJob) {
+    await getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound).enqueue(
+      inboundJob
+    );
+    logger.debug("discord interaction enqueued to the hub inbound queue", {
+      channelId: payload.channelId,
+      interactionId: interaction.id,
+      queue: COMMUNICATION_CHANNELS_QUEUES.inbound
+    });
+  } else {
+    logger.debug("discord interaction dropped \u2014 invoked by a bot", {
+      channelId: payload.channelId,
+      interactionId: interaction.id
+    });
+  }
+  let credentialsService = null;
+  try {
+    credentialsService = ctx.resolve("integrationCredentialsService");
+  } catch {
+    credentialsService = null;
+  }
+  if (!credentialsService) {
+    logger.warn("integrationCredentialsService unavailable \u2014 cannot acknowledge the interaction", {
+      channelId: payload.channelId
+    });
+    return;
+  }
+  const credentials = await credentialsService.resolve("channel_discord", {
+    tenantId: payload.credentialScope.tenantId,
+    organizationId: payload.credentialScope.organizationId,
+    userId: payload.credentialScope.userId
+  });
+  if (!credentials) {
+    logger.warn("no Discord credentials for the interaction channel \u2014 cannot acknowledge", {
+      channelId: payload.channelId
+    });
+    return;
+  }
+  const parsed = parseDiscordCredentialsOrThrow(credentials);
+  if (parsed.applicationId !== interaction.applicationId) {
+    logger.warn("interaction application id does not match the stored credentials", {
+      channelId: payload.channelId,
+      interactionId: interaction.id
+    });
+  }
+  const delivery = await sendInteractionFollowUp(getDiscordRestClient(), {
+    // Addressed with the application the interaction itself carries: the whole
+    // body is Ed25519-signed, so this value is as verified as the channel match.
+    applicationId: interaction.applicationId,
+    interactionToken: interaction.token,
+    content: await resolveFollowUpContent(interaction),
+    ephemeral: true
+  });
+  logger.info("discord interaction acknowledged", {
+    channelId: payload.channelId,
+    interactionId: interaction.id,
+    interactionType: interaction.type,
+    delivery
+  });
+}
+export {
+  handle as default,
+  metadata
+};
+//# sourceMappingURL=discord-interactions.js.map

package/dist/modules/channel_discord/workers/discord-interactions.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/channel_discord/workers/discord-interactions.ts"],
+  "sourcesContent": ["import type { QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport { createTranslator } from '@open-mercato/shared/lib/i18n/translate'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '@open-mercato/core/modules/communication_channels/lib/queue'\nimport { parseDiscordCredentialsOrThrow } from '../lib/credentials'\nimport { getDiscordRestClient } from '../lib/discord-rest'\nimport {\n  buildInteractionFollowUpContent,\n  buildInteractionInboundJob,\n  sendInteractionFollowUp,\n  type DispatchableInteraction,\n} from '../lib/interactions-dispatch'\nimport {\n  CHANNEL_DISCORD_INTERACTIONS_QUEUE,\n  type InteractionDispatchJobPayload,\n} from '../lib/interactions-queue'\n\nconst logger = createLogger('channel_discord').child({ component: 'interactions-worker' })\n\n/**\n * Discord interaction dispatch worker.\n *\n * WHY A WORKER: Discord gives the Interactions endpoint three seconds to answer,\n * and closes the interaction if it misses. So the route verifies the signature,\n * returns a deferred acknowledgement, and hands the rest here \u2014 where the two\n * slow halves can take as long as they need: writing the interaction into the\n * hub, and replacing the \"thinking\u2026\" placeholder with a real message.\n *\n * The queue is the ORDINARY module queue, consumed by the app's standard worker\n * runner \u2014 unlike `channel_discord_gateway`, nothing has to be started by hand.\n *\n * IDEMPOTENCE: the hub dedups on `(channel_id, external_message_id)` and the\n * external id is the interaction snowflake, so a retry after a failed follow-up\n * re-enqueues the same inbound job harmlessly rather than duplicating the record.\n */\nexport const metadata: WorkerMeta = {\n  queue: CHANNEL_DISCORD_INTERACTIONS_QUEUE,\n  id: 'channel_discord:interactions',\n  concurrency: 5,\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n}\n\ntype HandlerContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\n/**\n * Translate the acknowledgement, falling back to each key's English default when\n * no dictionary is available \u2014 a worker process that never loaded the app's\n * modules must still send the user a readable answer rather than a translation\n * key. `resolveTranslations` is imported dynamically because it pulls in\n * `server-only`, which has no business in this module's static graph.\n */\nasync function resolveFollowUpContent(interaction: DispatchableInteraction): Promise<string> {\n  try {\n    const { resolveTranslations } = await import('@open-mercato/shared/lib/i18n/server')\n    const { t } = await resolveTranslations()\n    return buildInteractionFollowUpContent(interaction, t)\n  } catch (err) {\n    logger.debug('falling back to the untranslated interaction acknowledgement', { err })\n    return buildInteractionFollowUpContent(interaction, createTranslator({}))\n  }\n}\n\nexport default async function handle(\n  job: QueuedJob<InteractionDispatchJobPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  const payload = job.payload\n  if (!payload?.interaction) {\n    logger.warn('interaction dispatch job carried no interaction \u2014 dropping')\n    return\n  }\n\n  const { interaction } = payload\n\n  const inboundJob = buildInteractionInboundJob({\n    dispatch: interaction,\n    channel: {\n      channelId: payload.channelId,\n      channelType: payload.channelType,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    },\n  })\n  if (inboundJob) {\n    await getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound).enqueue(\n      inboundJob as unknown as Record<string, unknown>,\n    )\n    logger.debug('discord interaction enqueued to the hub inbound queue', {\n      channelId: payload.channelId,\n      interactionId: interaction.id,\n      queue: COMMUNICATION_CHANNELS_QUEUES.inbound,\n    })\n  } else {\n    logger.debug('discord interaction dropped \u2014 invoked by a bot', {\n      channelId: payload.channelId,\n      interactionId: interaction.id,\n    })\n  }\n\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  if (!credentialsService) {\n    logger.warn('integrationCredentialsService unavailable \u2014 cannot acknowledge the interaction', {\n      channelId: payload.channelId,\n    })\n    return\n  }\n\n  const credentials = await credentialsService.resolve('channel_discord', {\n    tenantId: payload.credentialScope.tenantId,\n    organizationId: payload.credentialScope.organizationId,\n    userId: payload.credentialScope.userId,\n  })\n  if (!credentials) {\n    logger.warn('no Discord credentials for the interaction channel \u2014 cannot acknowledge', {\n      channelId: payload.channelId,\n    })\n    return\n  }\n  const parsed = parseDiscordCredentialsOrThrow(credentials)\n  if (parsed.applicationId !== interaction.applicationId) {\n    // The interaction verified against this channel's public key, so the two\n    // ought to agree. When they do not the credential bag has drifted from the\n    // application that actually signed, and following up under the stored id\n    // would 401 \u2014 say so once rather than retrying blindly.\n    logger.warn('interaction application id does not match the stored credentials', {\n      channelId: payload.channelId,\n      interactionId: interaction.id,\n    })\n  }\n\n  const delivery = await sendInteractionFollowUp(getDiscordRestClient(), {\n    // Addressed with the application the interaction itself carries: the whole\n    // body is Ed25519-signed, so this value is as verified as the channel match.\n    applicationId: interaction.applicationId,\n    interactionToken: interaction.token,\n    content: await resolveFollowUpContent(interaction),\n    ephemeral: true,\n  })\n\n  logger.info('discord interaction acknowledged', {\n    channelId: payload.channelId,\n    interactionId: interaction.id,\n    interactionType: interaction.type,\n    delivery,\n  })\n}\n"],
+  "mappings": "AACA,SAAS,wBAAwB;AACjC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,iBAAiB,EAAE,MAAM,EAAE,WAAW,sBAAsB,CAAC;AAkBlF,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AACf;AAoBA,eAAe,uBAAuB,aAAuD;AAC3F,MAAI;AACF,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sCAAsC;AACnF,UAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,WAAO,gCAAgC,aAAa,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,MAAM,gEAAgE,EAAE,IAAI,CAAC;AACpF,WAAO,gCAAgC,aAAa,iBAAiB,CAAC,CAAC,CAAC;AAAA,EAC1E;AACF;AAEA,eAAO,OACL,KACA,KACe;AACf,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,SAAS,aAAa;AACzB,WAAO,KAAK,iEAA4D;AACxE;AAAA,EACF;AAEA,QAAM,EAAE,YAAY,IAAI;AAExB,QAAM,aAAa,2BAA2B;AAAA,IAC5C,UAAU;AAAA,IACV,SAAS;AAAA,MACP,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,MAAI,YAAY;AACd,UAAM,8BAA8B,8BAA8B,OAAO,EAAE;AAAA,MACzE;AAAA,IACF;AACA,WAAO,MAAM,yDAAyD;AAAA,MACpE,WAAW,QAAQ;AAAA,MACnB,eAAe,YAAY;AAAA,MAC3B,OAAO,8BAA8B;AAAA,IACvC,CAAC;AAAA,EACH,OAAO;AACL,WAAO,MAAM,uDAAkD;AAAA,MAC7D,WAAW,QAAQ;AAAA,MACnB,eAAe,YAAY;AAAA,IAC7B,CAAC;AAAA,EACH;AAEA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,MAAI,CAAC,oBAAoB;AACvB,WAAO,KAAK,uFAAkF;AAAA,MAC5F,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,mBAAmB,QAAQ,mBAAmB;AAAA,IACtE,UAAU,QAAQ,gBAAgB;AAAA,IAClC,gBAAgB,QAAQ,gBAAgB;AAAA,IACxC,QAAQ,QAAQ,gBAAgB;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,WAAO,KAAK,gFAA2E;AAAA,MACrF,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD;AAAA,EACF;AACA,QAAM,SAAS,+BAA+B,WAAW;AACzD,MAAI,OAAO,kBAAkB,YAAY,eAAe;AAKtD,WAAO,KAAK,oEAAoE;AAAA,MAC9E,WAAW,QAAQ;AAAA,MACnB,eAAe,YAAY;AAAA,IAC7B,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,MAAM,wBAAwB,qBAAqB,GAAG;AAAA;AAAA;AAAA,IAGrE,eAAe,YAAY;AAAA,IAC3B,kBAAkB,YAAY;AAAA,IAC9B,SAAS,MAAM,uBAAuB,WAAW;AAAA,IACjD,WAAW;AAAA,EACb,CAAC;AAED,SAAO,KAAK,oCAAoC;AAAA,IAC9C,WAAW,QAAQ;AAAA,IACnB,eAAe,YAAY;AAAA,IAC3B,iBAAiB,YAAY;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/jest.config.cjs

@@ -0,0 +1,38 @@
+/** @type {import('jest').Config} */
+const base = require('../../jest.config.base.cjs')
+
+module.exports = {
+  ...base,
+  testEnvironment: 'node',
+  watchman: false,
+  rootDir: '.',
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json'],
+  moduleNameMapper: {
+    '^@open-mercato/channel-discord/(.*)$': '<rootDir>/src/$1',
+    '^@open-mercato/core/(.*)$': '<rootDir>/../core/src/$1',
+    // Test-only: lets the policy/runtime integration spec drive the REAL
+    // `agent-policy` / `agent-runtime` instead of a stub. The runtime dependency
+    // stays soft — production code reaches the peer through a dynamic import.
+    '^@open-mercato/ai-assistant/(.*)$': '<rootDir>/../ai-assistant/src/$1',
+    '^@open-mercato/shared/(.*)$': '<rootDir>/../shared/src/$1',
+    '^@open-mercato/queue/(.*)$': '<rootDir>/../queue/src/$1',
+    '^@open-mercato/ui/(.*)$': '<rootDir>/../ui/src/$1',
+  },
+  transform: {
+    '^.+\\.(t|j)sx?$': [
+      '<rootDir>/../../scripts/jest-mikroorm-transformer.cjs',
+      {
+        tsconfig: {
+          jsx: 'react-jsx',
+          rootDir: '.',
+          ignoreDeprecations: '6.0',
+        },
+      },
+    ],
+  },
+  transformIgnorePatterns: [
+    'node_modules/(?!(@mikro-orm|kysely|ai|@ai-sdk|ai-sdk-ollama|@workflow|@standard-schema)/)',
+  ],
+  testMatch: ['<rootDir>/src/**/__tests__/**/*.test.(ts|tsx)'],
+  passWithNoTests: true,
+}

package/package.json

@@ -0,0 +1,104 @@
+{
+  "name": "@open-mercato/channel-discord",
+  "version": "0.6.8-develop.7090.1.4dbca7b350",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "scripts": {
+    "build": "node build.mjs",
+    "watch": "node watch.mjs",
+    "test": "jest --config jest.config.cjs",
+    "typecheck": "tsc --noEmit"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./*.ts": {
+      "types": "./src/*.ts",
+      "default": "./dist/*.js"
+    },
+    "./*.tsx": {
+      "types": "./src/*.tsx",
+      "default": "./dist/*.js"
+    },
+    "./*.json": "./src/*.json",
+    "./*": {
+      "types": [
+        "./src/*.ts",
+        "./src/*.tsx"
+      ],
+      "default": "./dist/*.js"
+    },
+    "./*/*.json": "./src/*/*.json",
+    "./*/*": {
+      "types": [
+        "./src/*/*.ts",
+        "./src/*/*.tsx"
+      ],
+      "default": "./dist/*/*.js"
+    },
+    "./*/*/*.json": "./src/*/*/*.json",
+    "./*/*/*": {
+      "types": [
+        "./src/*/*/*.ts",
+        "./src/*/*/*.tsx"
+      ],
+      "default": "./dist/*/*/*.js"
+    },
+    "./*/*/*/*.json": "./src/*/*/*/*.json",
+    "./*/*/*/*": {
+      "types": [
+        "./src/*/*/*/*.ts",
+        "./src/*/*/*/*.tsx"
+      ],
+      "default": "./dist/*/*/*/*.js"
+    },
+    "./*/*/*/*/*.json": "./src/*/*/*/*/*.json",
+    "./*/*/*/*/*": {
+      "types": [
+        "./src/*/*/*/*/*.ts",
+        "./src/*/*/*/*/*.tsx"
+      ],
+      "default": "./dist/*/*/*/*/*.js"
+    }
+  },
+  "dependencies": {
+    "@open-mercato/core": "0.6.8-develop.7090.1.4dbca7b350",
+    "@open-mercato/queue": "0.6.8-develop.7090.1.4dbca7b350",
+    "@open-mercato/ui": "0.6.8-develop.7090.1.4dbca7b350"
+  },
+  "peerDependencies": {
+    "@mikro-orm/postgresql": "^7.0.14",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7090.1.4dbca7b350",
+    "@open-mercato/shared": "0.6.8-develop.7090.1.4dbca7b350",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@open-mercato/ai-assistant": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@open-mercato/ai-assistant": "0.6.8-develop.7090.1.4dbca7b350",
+    "@open-mercato/shared": "0.6.8-develop.7090.1.4dbca7b350",
+    "@types/jest": "^30.0.0",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "esbuild": "^0.28.1",
+    "glob": "^13.0.6",
+    "jest": "^30.4.2",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "ts-jest": "^29.4.12",
+    "typescript": "7.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/open-mercato/open-mercato",
+    "directory": "packages/channel-discord"
+  },
+  "stableVersion": "0.6.7"
+}

package/src/index.ts

@@ -0,0 +1 @@
+export { metadata } from './modules/channel_discord/index'

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-001.spec.ts

@@ -0,0 +1,109 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+
+/**
+ * TC-CHANNEL-DISCORD-001 — connect a Discord channel via credentials.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * Asserts the two halves of the connect contract through the hub's real route:
+ *
+ *  1. The `discord` adapter IS registered with the hub — an unknown provider key
+ *     resolves to no adapter and returns 404, `discord` does not.
+ *  2. `validateCredentials` is fail-closed and offline — a malformed credential
+ *     blob is rejected with per-field errors (422) by the zod schema BEFORE any
+ *     Discord REST call, so this test needs no bot token and no network.
+ *
+ * The happy path (a real token accepted by `GET /users/@me`) needs live Discord
+ * and stays unit-tested with a stubbed REST client in
+ * `lib/__tests__/adapter.test.ts`.
+ */
+test.describe('TC-CHANNEL-DISCORD-001: connect channel via credentials', () => {
+  test('requires authentication', async ({ request }) => {
+    const response = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/connect/credentials',
+      // Intentionally empty token — this assertion is the 401 unauth path.
+      { token: '', data: { providerKey: 'discord', displayName: 'unauth', credentials: {} } },
+    )
+    expect(response.status(), 'connect must reject an unauthenticated caller').toBe(401)
+  })
+
+  test('the discord adapter is registered and rejects malformed credentials with field errors', async ({
+    request,
+  }) => {
+    const token = await getAuthToken(request, 'admin')
+    const stamp = Date.now()
+
+    const unknownProvider = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/connect/credentials',
+      {
+        token,
+        data: {
+          providerKey: `not-a-provider-${stamp}`,
+          displayName: `TC-CHANNEL-DISCORD-001 unknown ${stamp}`,
+          credentials: {},
+        },
+      },
+    )
+    expect(
+      unknownProvider.status(),
+      'an unregistered provider key must resolve to no adapter (404)',
+    ).toBe(404)
+
+    const discord = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/connect/credentials',
+      {
+        token,
+        data: {
+          providerKey: 'discord',
+          displayName: `TC-CHANNEL-DISCORD-001 ${stamp}`,
+          // Missing botToken/applicationId, and a publicKey that is neither hex
+          // nor 32 bytes — all three must come back as field errors.
+          credentials: { publicKey: 'not-a-hex-key' },
+        },
+      },
+    )
+    expect(
+      discord.status(),
+      'discord IS registered, so the failure must be credential validation (422), not 404',
+    ).toBe(422)
+
+    const body = await readJsonSafe<{ error?: string; fieldErrors?: Record<string, string> }>(discord)
+    expect(body?.error, 'the 422 must report credential validation').toBe('Credential validation failed')
+    const fieldErrors = body?.fieldErrors ?? {}
+    expect(
+      Object.keys(fieldErrors),
+      'every missing/invalid credential field must be reported back to the operator',
+    ).toEqual(expect.arrayContaining(['botToken', 'applicationId', 'publicKey']))
+  })
+
+  test('a rejected connect attempt creates no channel', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    const stamp = Date.now()
+    const displayName = `TC-CHANNEL-DISCORD-001 orphan ${stamp}`
+
+    const rejected = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/connect/credentials',
+      { token, data: { providerKey: 'discord', displayName, credentials: {} } },
+    )
+    expect(rejected.status(), 'malformed credentials must be rejected').toBe(422)
+
+    const listed = await apiRequest(request, 'GET', '/api/communication_channels/me/channels', {
+      token,
+    })
+    expect(listed.status(), 'GET /me/channels should return 200').toBe(200)
+    const body = await readJsonSafe<{ items?: Array<{ displayName?: string }> }>(listed)
+    const names = (body?.items ?? []).map((item) => item.displayName)
+    expect(names, 'a failed validation must not leave a half-connected channel behind').not.toContain(
+      displayName,
+    )
+  })
+})

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-002.spec.ts

@@ -0,0 +1,58 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+
+/**
+ * TC-CHANNEL-DISCORD-002 — outbound test-send routing for a Discord channel.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * The hub owns the outbound entry point (`POST /channels/[id]/test-send`); the
+ * provider only supplies `convertOutbound` + `sendMessage`. This spec pins the
+ * route's tenant-safety contract, which is what a provider PR can break: an
+ * unauthenticated caller, a malformed id, and an id the caller does not own are
+ * all refused BEFORE any adapter is resolved — so no Discord REST call can be
+ * driven by an unauthorized request.
+ *
+ * The actual Discord payload conversion and REST post are unit-tested against a
+ * stubbed client in `lib/__tests__/convert-outbound.test.ts` and
+ * `lib/__tests__/adapter.test.ts`; they need a live bot token and are therefore
+ * out of scope for CI.
+ */
+const UNKNOWN_CHANNEL_ID = '00000000-0000-4000-8000-0000000d1c02'
+
+test.describe('TC-CHANNEL-DISCORD-002: outbound test-send guards', () => {
+  test('requires authentication', async ({ request }) => {
+    const response = await apiRequest(
+      request,
+      'POST',
+      `/api/communication_channels/channels/${UNKNOWN_CHANNEL_ID}/test-send`,
+      // Intentionally empty token — this assertion is the 401 unauth path.
+      { token: '', data: { to: 'integration@example.com' } },
+    )
+    expect(response.status(), 'test-send must reject an unauthenticated caller').toBe(401)
+  })
+
+  test('rejects a malformed channel id before touching any adapter', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    const response = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/not-a-uuid/test-send',
+      { token, data: { to: 'integration@example.com' } },
+    )
+    expect(response.status(), 'a non-uuid channel id must be a 400, not a 500').toBe(400)
+  })
+
+  test('rejects a channel the caller does not own', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    const response = await apiRequest(
+      request,
+      'POST',
+      `/api/communication_channels/channels/${UNKNOWN_CHANNEL_ID}/test-send`,
+      { token, data: { to: 'integration@example.com' } },
+    )
+    expect(
+      response.status(),
+      'an unknown/foreign channel id must be 404 — never a send attempt',
+    ).toBe(404)
+  })
+})

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-003.spec.ts

@@ -0,0 +1,175 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  deleteChannelIfExists,
+  ingestInboundChatMessage,
+  isChannelSeedingAvailable,
+  seedConnectedChannel,
+} from '@open-mercato/core/helpers/integration/communicationChannelsFixtures'
+import { normalizeInboundDiscordMessage } from '../lib/normalize-inbound'
+
+/**
+ * TC-CHANNEL-DISCORD-003 — a message shaped the way the Discord gateway
+ * actually produces it is ingested end to end.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * ⚠️ HISTORY, because this spec earned the scepticism (QA of #4391, @Kapsik89
+ * 2026-08-04 → #4975).
+ *
+ * The first version of this spec claimed to prove that "an inbound Discord
+ * message lands in the hub" and stayed green through three live defects. It fed
+ * the hub an invented `…@test-seed.local` address for both the channel
+ * identifier and the recipient, because the hub's `composeMessageSchema`
+ * demanded `externalEmail` for every public message. A real Discord channel
+ * carries `external_identifier = NULL` and a real Discord sender has no address
+ * at all, so `normalizeInboundDiscordMessage` never ran on that path — the spec
+ * asserted a landing zone the real provider could never reach.
+ *
+ * Both halves of that are fixed now:
+ *   - #4975 (merged as #5252) made the `externalEmail` requirement conditional
+ *     on the originating channel being email-typed, fail-closed.
+ *   - the test-seed `ingest-inbound` action drives the real
+ *     `ingest_inbound_message` command, which composes through
+ *     `messages.messages.compose` — no SQL shortcut, no seeded rows.
+ *
+ * So this spec now does what its name always claimed:
+ *   1. it starts from a verbatim Discord `MESSAGE_CREATE` frame,
+ *   2. runs it through the **real** `normalizeInboundDiscordMessage` — the same
+ *      function the gateway worker calls, not a re-implementation,
+ *   3. hands the normalized result to the hub with **no address anywhere**, and
+ *   4. asserts a platform message exists at the other end.
+ *
+ * Ceiling, stated rather than implied: the transport is the chat-flavoured
+ * test-seed adapter, because connecting a real Discord channel requires a live
+ * bot token and a live credential probe, neither of which exists in CI. What is
+ * NOT stubbed is the part that was broken — the Discord frame, the Discord
+ * normalizer, and the hub's compose validation. The socket state machine
+ * (identify/resume/backoff, bot-self filtering, replay dedup) is a pure state
+ * machine covered by `lib/__tests__/discord-gateway-client.test.ts` and
+ * `lib/__tests__/gateway-bridge.test.ts`.
+ *
+ * Driven via the env-gated test-seed fixture (`OM_ENABLE_TEST_CHANNEL_SEEDING`);
+ * skips when the gate is off.
+ */
+type HealthSnapshot = {
+  channelId?: string
+  counts?: Record<string, number>
+  totalsLast24h?: number
+}
+
+async function readHealth(
+  request: Parameters<typeof apiRequest>[0],
+  token: string,
+  channelId: string,
+): Promise<HealthSnapshot> {
+  const response = await apiRequest(
+    request,
+    'GET',
+    `/api/communication_channels/channels/${channelId}/health`,
+    { token },
+  )
+  expect(response.status(), 'GET /channels/[id]/health should return 200').toBe(200)
+  return (await readJsonSafe<HealthSnapshot>(response)) ?? {}
+}
+
+/**
+ * A `MESSAGE_CREATE` frame in the exact shape Discord delivers it. The values
+ * are the ones QA captured from a real guild while filing #4975 — in particular
+ * the author id is a genuine snowflake, which is the whole point: there is no
+ * address on it, and none is invented anywhere below.
+ */
+function discordMessageCreateFrame(stamp: number) {
+  return {
+    id: `1534333813851816${String(stamp).slice(-3)}`,
+    channel_id: '1534331920463433771',
+    guild_id: '1534331919796273152',
+    content: 'Kolejna wiadomość testowa!@',
+    timestamp: new Date().toISOString(),
+    author: {
+      id: '1499156851487539260',
+      username: 'lorakaspak',
+      global_name: 'Karol Kapsa',
+      bot: false,
+    },
+    attachments: [],
+  }
+}
+
+test.describe('TC-CHANNEL-DISCORD-003: inbound discord message ingest', () => {
+  test('a message shaped the way the Discord gateway actually produces it is ingested', async ({
+    request,
+  }) => {
+    test.slow()
+    let token: string | null = null
+    let channelId: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const seedingAvailable = await isChannelSeedingAvailable(request, token)
+      test.skip(
+        !seedingAvailable,
+        'OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled in this environment; cannot ingest.',
+      )
+
+      const stamp = Date.now()
+      // `providerFlavor: 'chat'` connects the non-email stub, so the channel row
+      // carries a non-email `channelType` and a NULL `externalIdentifier` — the
+      // shape a real Discord channel has. No `externalIdentifier` is passed.
+      channelId = await seedConnectedChannel(request, token, {
+        displayName: `TC-CHANNEL-DISCORD-003 ${stamp}`,
+        providerFlavor: 'chat',
+      })
+
+      const before = await readHealth(request, token, channelId)
+      const totalBefore = before.totalsLast24h ?? 0
+
+      // The real normalizer, on a real frame. If Discord's payload shape and the
+      // hub's expectations ever drift apart, this line is where it shows.
+      const frame = discordMessageCreateFrame(stamp)
+      const normalized = normalizeInboundDiscordMessage(frame as never)
+
+      expect(
+        normalized.senderIdentifier,
+        'the sender must stay the Discord snowflake — synthesising an address here is what #4975 rejects',
+      ).toBe('1499156851487539260')
+      expect(normalized.externalConversationId).toBe('discord-channel:1534331920463433771')
+      expect(
+        (normalized as { externalEmail?: unknown }).externalEmail,
+        'the normalizer must not invent an address',
+      ).toBeUndefined()
+
+      const ingested = await ingestInboundChatMessage(request, token, {
+        channelId,
+        senderIdentifier: normalized.senderIdentifier,
+        senderDisplayName: normalized.senderDisplayName,
+        body: normalized.body,
+        externalMessageId: normalized.externalMessageId,
+        externalConversationId: normalized.externalConversationId,
+      })
+
+      // The assertion the old version could not make: the hub composed a real
+      // platform message from a sender with no address. Before #4975 this step
+      // failed `externalEmail is required when visibility is public`, retried
+      // three times and died in the queue while the channel still read
+      // `Connected`.
+      expect(
+        ingested.status,
+        'the hub must accept an inbound message whose sender has no email address',
+      ).toBe('created')
+      expect(ingested.messageId, 'a platform message must exist').toBeTruthy()
+      expect(ingested.channelLinkId, 'the hub must persist a MessageChannelLink').toBeTruthy()
+      expect(
+        ingested.channelType,
+        'the compose must have been told the originating channel type',
+      ).not.toBe('email')
+
+      const after = await readHealth(request, token, channelId)
+      expect(
+        after.totalsLast24h ?? 0,
+        'the channel health snapshot must count the ingested message',
+      ).toBeGreaterThan(totalBefore)
+    } finally {
+      if (token && channelId) await deleteChannelIfExists(request, token, channelId)
+    }
+  })
+})