@open-mercato/channel-discord 0.6.8-develop.7090.1.4dbca7b350

package/src/modules/channel_discord/lib/interactions-verify.ts

@@ -0,0 +1,174 @@
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto'
+
+/**
+ * Discord interaction request signing (Ed25519).
+ *
+ * Every interaction POST carries `X-Signature-Ed25519` (hex) and
+ * `X-Signature-Timestamp`. The signed payload is `timestamp + rawBody`, verified
+ * against the application's Ed25519 **public key** (hex, from the General
+ * Information tab). We verify with Node's built-in `crypto` (`ed25519`) — no
+ * `tweetnacl` dependency.
+ *
+ * SECURITY CONTRACT: this function is FAIL-CLOSED. It returns `false` on a
+ * missing header, a malformed key/signature, or any verification error — never
+ * throws, never returns `true` on doubt. Callers MUST reject (`401`) on `false`.
+ */
+
+// Standard SPKI DER prefix for an Ed25519 public key (RFC 8410). Prepending it
+// to the 32 raw key bytes yields a DER document `createPublicKey` accepts,
+// avoiding a third-party crypto dependency.
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex')
+
+function isHex(value: string): boolean {
+  return value.length > 0 && value.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(value)
+}
+
+/** An Ed25519 signature is 64 bytes, so 128 hex characters. */
+const ED25519_SIGNATURE_HEX_LENGTH = 128
+
+/**
+ * Whether the request's signature headers are even capable of verifying —
+ * present, hex, and the right length. This depends on the REQUEST ALONE, never
+ * on a candidate channel, which is why it is exported separately: the route runs
+ * it before it loads any channel, so an unsigned or malformed POST is rejected
+ * without a single database round-trip.
+ *
+ * `verifyDiscordSignature` applies the same guard itself, so this is an
+ * optimisation of *when* the answer is known, never a replacement for the
+ * fail-closed check.
+ */
+export function hasVerifiableSignatureHeaders(
+  signatureHex: string | undefined | null,
+  timestamp: string | undefined | null,
+): signatureHex is string {
+  if (!signatureHex || !timestamp) return false
+  return isHex(signatureHex) && signatureHex.length === ED25519_SIGNATURE_HEX_LENGTH
+}
+
+function publicKeyFromHex(publicKeyHex: string) {
+  if (!isHex(publicKeyHex) || publicKeyHex.length !== 64) {
+    throw new Error('invalid ed25519 public key')
+  }
+  const raw = Buffer.from(publicKeyHex, 'hex')
+  const der = Buffer.concat([ED25519_SPKI_PREFIX, raw])
+  return createPublicKey({ key: der, format: 'der', type: 'spki' })
+}
+
+export interface VerifyDiscordSignatureInput {
+  publicKeyHex: string
+  signatureHex: string | undefined | null
+  timestamp: string | undefined | null
+  rawBody: string
+}
+
+/**
+ * Verify a Discord interaction signature. Returns `true` only when the signature
+ * cryptographically matches `timestamp + rawBody` under `publicKeyHex`.
+ */
+export function verifyDiscordSignature(input: VerifyDiscordSignatureInput): boolean {
+  const { publicKeyHex, signatureHex, timestamp, rawBody } = input
+  if (!hasVerifiableSignatureHeaders(signatureHex, timestamp)) return false
+  try {
+    const key = publicKeyFromHex(publicKeyHex)
+    const message = Buffer.from(String(timestamp) + rawBody, 'utf-8')
+    const signature = Buffer.from(signatureHex, 'hex')
+    // Ed25519: the algorithm is implied by the key, so the first arg is null.
+    return cryptoVerify(null, message, key, signature)
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Replay guard. Discord signs `timestamp + body`, but a captured request stays
+ * cryptographically valid forever — freshness has to be enforced separately.
+ * A timestamp outside the ± skew window (or missing / non-numeric) is rejected,
+ * fail-closed, so a recorded interaction cannot be replayed later.
+ */
+export const DISCORD_SIGNATURE_MAX_SKEW_SECONDS = 300
+
+export interface TimestampFreshnessOptions {
+  maxSkewSeconds?: number
+  /** Injectable clock (epoch seconds) for tests; defaults to the real clock. */
+  nowEpochSeconds?: number
+}
+
+export function isSignatureTimestampFresh(
+  timestamp: string | undefined | null,
+  options?: TimestampFreshnessOptions,
+): boolean {
+  if (!timestamp) return false
+  const value = String(timestamp).trim()
+  if (!/^\d{1,12}$/.test(value)) return false
+  const parsedSeconds = Number(value)
+  if (!Number.isSafeInteger(parsedSeconds)) return false
+  const maxSkewSeconds = options?.maxSkewSeconds ?? DISCORD_SIGNATURE_MAX_SKEW_SECONDS
+  const nowSeconds = options?.nowEpochSeconds ?? Math.floor(Date.now() / 1000)
+  return Math.abs(nowSeconds - parsedSeconds) <= maxSkewSeconds
+}
+
+/** Discord interaction types. */
+export const DiscordInteractionType = {
+  PING: 1,
+  APPLICATION_COMMAND: 2,
+  MESSAGE_COMPONENT: 3,
+  APPLICATION_COMMAND_AUTOCOMPLETE: 4,
+  MODAL_SUBMIT: 5,
+} as const
+
+/** Discord interaction response types. */
+export const DiscordInteractionResponseType = {
+  PONG: 1,
+  CHANNEL_MESSAGE_WITH_SOURCE: 4,
+  DEFERRED_CHANNEL_MESSAGE_WITH_SOURCE: 5,
+  DEFERRED_UPDATE_MESSAGE: 6,
+  // Autocomplete is the one interaction type Discord will not accept a deferred
+  // ack for — it must be answered synchronously with this type and a choice list.
+  APPLICATION_COMMAND_AUTOCOMPLETE_RESULT: 8,
+} as const
+
+export interface ParsedInteraction {
+  type: number
+  data?: Record<string, unknown>
+  member?: { user?: { id?: string; username?: string; global_name?: string | null } }
+  user?: { id?: string; username?: string; global_name?: string | null }
+  channel_id?: string
+  guild_id?: string
+  application_id?: string
+  id?: string
+  token?: string
+  [key: string]: unknown
+}
+
+/**
+ * Parse the interaction body. Returns `null` when the body is not a JSON object
+ * with a numeric `type` — the caller treats that as a non-interaction payload.
+ */
+export function parseInteractionBody(rawBody: string): ParsedInteraction | null {
+  try {
+    const parsed = JSON.parse(rawBody) as unknown
+    if (!parsed || typeof parsed !== 'object') return null
+    const candidate = parsed as { type?: unknown }
+    if (typeof candidate.type !== 'number') return null
+    return parsed as ParsedInteraction
+  } catch {
+    return null
+  }
+}
+
+/**
+ * The `application_id` an interaction body claims, or `null` when the body does
+ * not carry a usable one.
+ *
+ * UNTRUSTED — this value is read before any signature has been verified, so it
+ * may only ever be used to NARROW the set of candidate channels the signature is
+ * then checked against. It is never an authorization decision: a body claiming
+ * another tenant's application still has to carry that tenant's Ed25519
+ * signature to be accepted, and a body claiming nothing falls back to the full
+ * candidate set rather than being let through.
+ */
+export function readInteractionApplicationId(rawBody: string): string | null {
+  const interaction = parseInteractionBody(rawBody)
+  const applicationId = interaction?.application_id
+  return typeof applicationId === 'string' && applicationId.length > 0 ? applicationId : null
+}

package/src/modules/channel_discord/lib/normalize-inbound.ts

@@ -0,0 +1,89 @@
+import type {
+  NormalizedInboundMessage,
+  NormalizedAttachment,
+} from '@open-mercato/core/modules/communication_channels/lib/adapter'
+import type { DiscordMessageObject } from './discord-rest'
+
+/**
+ * Prefix used to build the hub's `externalConversationId` from a Discord channel
+ * (or thread) id. A Discord "channel" (text channel / thread) is the unit the
+ * hub threads on, mirroring `gmail-thread:` / Slack channel conventions.
+ */
+export const DISCORD_CONVERSATION_PREFIX = 'discord-channel:'
+
+export const DISCORD_CHANNEL_CONTENT_TYPE = 'discord'
+
+function mapAttachments(message: DiscordMessageObject): NormalizedAttachment[] | undefined {
+  if (!Array.isArray(message.attachments) || message.attachments.length === 0) return undefined
+  return message.attachments.map((attachment) => ({
+    url: attachment.url,
+    mimeType: attachment.content_type ?? 'application/octet-stream',
+    fileName: attachment.filename,
+    fileSize: attachment.size,
+    inline: false,
+  }))
+}
+
+/**
+ * Map a raw Discord message object (from `MESSAGE_CREATE` or REST history) into
+ * the hub's canonical `NormalizedInboundMessage`.
+ *
+ * Discord senders have no email/phone — the CRM contact is resolved from the
+ * user id / handle later (`resolveContact`). The `externalConversationId` is the
+ * channel/thread id (a Discord thread reuses this same shape), so all messages
+ * in one channel thread into one hub conversation.
+ */
+export function normalizeInboundDiscordMessage(message: DiscordMessageObject): NormalizedInboundMessage {
+  const author = message.author ?? ({} as DiscordMessageObject['author'])
+  const senderDisplayName = author?.global_name || author?.username || undefined
+  const timestamp = message.timestamp ? new Date(message.timestamp) : new Date()
+
+  return {
+    externalMessageId: message.id,
+    externalConversationId: `${DISCORD_CONVERSATION_PREFIX}${message.channel_id}`,
+    senderIdentifier: author?.id ?? 'unknown',
+    senderDisplayName,
+    body: message.content ?? '',
+    bodyFormat: 'markdown',
+    attachments: mapAttachments(message),
+    timestamp,
+    replyToExternalId: message.message_reference?.message_id,
+    channelPayload: message as unknown as Record<string, unknown>,
+    channelContentType: DISCORD_CHANNEL_CONTENT_TYPE,
+    channelMetadata: {
+      discordChannelId: message.channel_id,
+      discordGuildId: message.guild_id,
+      discordAuthorId: author?.id,
+      discordAuthorUsername: author?.username,
+      discordAuthorGlobalName: author?.global_name ?? undefined,
+      discordAuthorIsBot: Boolean(author?.bot),
+      // Only present when the record came from a slash command or a component
+      // press rather than someone typing. A consumer that treats every inbound
+      // message the same can ignore these; one that answers commands
+      // specifically needs to tell them apart without re-parsing `channelPayload`.
+      ...(message.discord_interaction
+        ? {
+            discordInteractionId: message.discord_interaction.id,
+            discordInteractionType: message.discord_interaction.type,
+            discordCommandName: message.discord_interaction.commandName,
+            discordComponentCustomId: message.discord_interaction.customId,
+          }
+        : {}),
+    },
+  }
+}
+
+/**
+ * True when a raw message must be dropped as bot-authored. The gateway worker
+ * uses this as the feedback-loop guard.
+ *
+ * We drop ANY message flagged `author.bot` (not just our own bot's user id):
+ * other bots/webhooks in the channel would otherwise be ingested and could
+ * trigger the AI auto-reply, creating cross-bot loops and noise. The explicit
+ * `botUserId` check is retained as a belt-and-suspenders guard for the rare case
+ * where our own bot's `author.bot` flag is absent from a payload.
+ */
+export function isAuthoredByBot(message: DiscordMessageObject, botUserId: string | undefined): boolean {
+  if (message.author?.bot) return true
+  return botUserId ? message.author?.id === botUserId : false
+}

package/src/modules/channel_discord/lib/preset.ts

@@ -0,0 +1,109 @@
+import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'
+import type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import { discordCredentialsSchema, type DiscordCredentials } from './credentials'
+
+export const CHANNEL_DISCORD_INTEGRATION_ID = 'channel_discord'
+
+export type DiscordEnvPreset = {
+  credentials: DiscordCredentials
+  force: boolean
+}
+
+export type ApplyDiscordPresetResult =
+  | { status: 'skipped'; reason: string }
+  | { status: 'configured' }
+
+function readEnvValue(env: NodeJS.ProcessEnv, key: string): string | undefined {
+  const value = env[key]?.trim()
+  return value ? value : undefined
+}
+
+/**
+ * Read the deployment-managed Discord bootstrap credentials from the environment
+ * (SPEC 2026-06-19 § Connect the channel in Open Mercato).
+ *
+ * Returns `null` when no `OM_CHANNEL_DISCORD_*` credential var is set at all —
+ * the normal case, where the bot is connected interactively through
+ * `/backend/integrations`. When any of them IS set the preset must be complete,
+ * so a half-filled deployment fails loudly instead of persisting a bot token
+ * that cannot authenticate. The bot token is never logged or echoed.
+ */
+export function readDiscordEnvPreset(env: NodeJS.ProcessEnv = process.env): DiscordEnvPreset | null {
+  const botToken = readEnvValue(env, 'OM_CHANNEL_DISCORD_BOT_TOKEN')
+  const applicationId = readEnvValue(env, 'OM_CHANNEL_DISCORD_APPLICATION_ID')
+  const publicKey = readEnvValue(env, 'OM_CHANNEL_DISCORD_PUBLIC_KEY')
+  const guildId = readEnvValue(env, 'OM_CHANNEL_DISCORD_GUILD_ID')
+  const defaultChannelId = readEnvValue(env, 'OM_CHANNEL_DISCORD_DEFAULT_CHANNEL_ID')
+
+  if (!botToken && !applicationId && !publicKey) return null
+
+  const parsed = discordCredentialsSchema.safeParse({
+    botToken,
+    applicationId,
+    publicKey,
+    ...(guildId ? { guildId } : {}),
+    ...(defaultChannelId ? { defaultChannelId } : {}),
+  })
+  if (!parsed.success) {
+    const first = parsed.error.issues[0]
+    throw new Error(
+      '[internal] Incomplete Discord env preset. Set OM_CHANNEL_DISCORD_BOT_TOKEN, ' +
+        'OM_CHANNEL_DISCORD_APPLICATION_ID and OM_CHANNEL_DISCORD_PUBLIC_KEY ' +
+        `(${first?.path.join('.') ?? 'credentials'}: ${first?.message ?? 'invalid'}).`,
+    )
+  }
+
+  return {
+    credentials: parsed.data,
+    force: parseBooleanToken(env.OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE) ?? false,
+  }
+}
+
+/**
+ * Apply the env preset to one (tenant, organization) scope through the standard
+ * integration credential service — never by special-casing the provider in core.
+ *
+ * Existing credentials win unless `OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE` (or an
+ * explicit `force`) says otherwise, so re-running tenant setup or the
+ * `configure-from-env` CLI command is safe and idempotent.
+ */
+export async function applyDiscordEnvPreset(params: {
+  credentialsService: CredentialsService
+  integrationLogService?: IntegrationLogService
+  scope: IntegrationScope
+  force?: boolean
+  env?: NodeJS.ProcessEnv
+}): Promise<ApplyDiscordPresetResult> {
+  const preset = readDiscordEnvPreset(params.env)
+  if (!preset) {
+    return { status: 'skipped', reason: 'No Discord preset env variables were provided.' }
+  }
+
+  const force = params.force ?? preset.force
+  if (!force) {
+    const existing = await params.credentialsService.getRaw(CHANNEL_DISCORD_INTEGRATION_ID, params.scope)
+    if (existing) {
+      return {
+        status: 'skipped',
+        reason:
+          'Discord credentials already exist. Use OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE=true to overwrite.',
+      }
+    }
+  }
+
+  await params.credentialsService.save(CHANNEL_DISCORD_INTEGRATION_ID, preset.credentials, params.scope)
+
+  if (params.integrationLogService) {
+    await params.integrationLogService
+      .scoped(CHANNEL_DISCORD_INTEGRATION_ID, params.scope)
+      .info('Discord integration was preconfigured from environment variables.', {
+        applicationId: preset.credentials.applicationId,
+        guildId: preset.credentials.guildId ?? null,
+        defaultChannelId: preset.credentials.defaultChannelId ?? null,
+      })
+  }
+
+  return { status: 'configured' }
+}

package/src/modules/channel_discord/lib/queue-strategy.ts

@@ -0,0 +1,29 @@
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('channel_discord').child({ component: 'cli' })
+
+/**
+ * Refuse to start the gateway when inbound messages cannot possibly be delivered.
+ *
+ * `start-gateway` is a standalone process that runs a worker for the
+ * `channel_discord_gateway` queue only, while the bridge enqueues received
+ * messages into `communication-channels-inbound` / `-reactions`, whose workers
+ * live in the app server process. Under the DEFAULT `QUEUE_STRATEGY=local` the
+ * queue is in-process, so those jobs never cross the process boundary: they are
+ * dropped with no error, no log, no retry and no `failed` entry, while the
+ * channel keeps reporting `Connected`. Failing loudly at startup is the only
+ * honest option — the alternative looks like it works.
+ *
+ * Lives outside `cli.ts` so it stays unit-testable without pulling the DI
+ * container graph into the test.
+ */
+export function assertInboundDeliverable(queueStrategy: string | undefined): void {
+  if (queueStrategy === 'async') return
+  const message =
+    'channel_discord start-gateway requires QUEUE_STRATEGY=async (with Redis configured). ' +
+    'Under the default in-process queue strategy the gateway cannot hand inbound messages to the ' +
+    'communication-channels workers running in the app server process — they would be silently dropped. ' +
+    'Set QUEUE_STRATEGY=async and point the queue at Redis, then start this command again.'
+  logger.error(message, { queueStrategy: queueStrategy ?? 'local (default)' })
+  throw new Error(`[internal] ${message}`)
+}

package/src/modules/channel_discord/lib/slash-commands.ts

@@ -0,0 +1,57 @@
+/**
+ * Application (slash) commands this provider registers against a guild.
+ *
+ * NOT LOCALIZED, deliberately: a Discord application registers ONE canonical
+ * command name per guild — the localized variants Discord supports live in
+ * `name_localizations` / `description_localizations`, which are a per-command
+ * map rather than an app locale, and no operator surface exists yet to choose
+ * which locales a tenant wants. The registration is also an operator action
+ * (`mercato channel_discord register-slash-commands`), not a rendered UI string.
+ *
+ * The set is deliberately minimal. Every command routes to the same place —
+ * the hub inbox — so the provider ships the one command that makes that useful
+ * and leaves richer command trees to whoever knows their own workflow. Register
+ * a different set by passing `--commands <path-to-json>`.
+ */
+export const CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT = 1
+export const CHANNEL_DISCORD_OPTION_TYPE_STRING = 3
+
+export const DISCORD_DEFAULT_SLASH_COMMANDS: Array<Record<string, unknown>> = [
+  {
+    name: 'mercato',
+    type: CHANNEL_DISCORD_SLASH_COMMAND_TYPE_CHAT_INPUT,
+    description: 'Send a message to the team through Open Mercato',
+    options: [
+      {
+        type: CHANNEL_DISCORD_OPTION_TYPE_STRING,
+        name: 'message',
+        description: 'What do you need?',
+        required: true,
+      },
+    ],
+  },
+]
+
+/**
+ * Validate an operator-supplied command list read from JSON. Discord rejects a
+ * malformed registration with a 400 whose body names an array index, so failing
+ * here with the index and the reason is strictly more useful than forwarding it.
+ */
+export function parseSlashCommandDefinitions(value: unknown): Array<Record<string, unknown>> {
+  if (!Array.isArray(value)) {
+    throw new Error('[internal] Discord slash command definitions must be a JSON array.')
+  }
+  return value.map((entry, index) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+      throw new Error(`[internal] Discord slash command at index ${index} is not an object.`)
+    }
+    const command = entry as Record<string, unknown>
+    if (typeof command.name !== 'string' || command.name.length === 0) {
+      throw new Error(`[internal] Discord slash command at index ${index} has no name.`)
+    }
+    if (typeof command.description !== 'string' || command.description.length === 0) {
+      throw new Error(`[internal] Discord slash command "${command.name}" has no description.`)
+    }
+    return command
+  })
+}

package/src/modules/channel_discord/message-types.ts

@@ -0,0 +1,75 @@
+import type { MessageAction, MessageTypeDefinition } from '@open-mercato/shared/modules/messages/types'
+import {
+  CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_COMMAND_ID,
+  CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_COMMAND_ID,
+} from './lib/ai-proposal-contract'
+
+/**
+ * The message type the `complex`-tier AI proposal is filed under (issue #4778).
+ *
+ * Declaring it here is what makes the approval surface work at all: the messages
+ * module builds its allowlist of dispatchable action commands from the
+ * `defaultActions` of every REGISTERED message type
+ * (`messages/lib/actions.ts` → `getMessageSafeCommandIds`). An action whose
+ * `commandId` is not reachable that way is rejected with "Action command is not
+ * allowed" — the confused-deputy guard that stops a composer from making a
+ * recipient dispatch an arbitrary command with their own auth. So the two
+ * commands below are allowlisted precisely because this file declares them, and
+ * for no other message type.
+ */
+export const CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE = 'channel_discord.ai_reply_proposal'
+
+export const CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID = 'approve_send'
+export const CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID = 'dismiss'
+
+const proposalActions: MessageAction[] = [
+  {
+    id: CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_ACTION_ID,
+    label: 'Approve and send',
+    labelKey: 'channel_discord.aiProposal.actions.approve',
+    variant: 'default',
+    icon: 'send',
+    commandId: CHANNEL_DISCORD_AI_PROPOSAL_APPROVE_COMMAND_ID,
+    isTerminal: true,
+    // Sending posts publicly into a Discord server on the tenant's behalf, so the
+    // operator confirms once before it leaves the building. No `confirmMessage`:
+    // the inbox renders that field verbatim (`message-detail/panels/dialogs.tsx`),
+    // so a translation key would leak into the dialog — omitting it falls back to
+    // the module's own localized confirmation copy.
+    confirmRequired: true,
+  },
+  {
+    id: CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_ACTION_ID,
+    label: 'Dismiss',
+    labelKey: 'channel_discord.aiProposal.actions.dismiss',
+    variant: 'outline',
+    icon: 'x',
+    commandId: CHANNEL_DISCORD_AI_PROPOSAL_DISMISS_COMMAND_ID,
+    isTerminal: true,
+  },
+]
+
+export const messageTypes: MessageTypeDefinition[] = [
+  {
+    type: CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE,
+    module: 'channel_discord',
+    labelKey: 'channel_discord.aiProposal.messageType',
+    icon: 'bot',
+    color: 'violet',
+    ui: {
+      listItemComponent: 'messages.default.listItem',
+      contentComponent: 'messages.default.content',
+      actionsComponent: 'messages.default.actions',
+    },
+    // Replying to the proposal itself would go nowhere — the conversation lives
+    // on the Discord thread the proposal points at, not on this internal note.
+    allowReply: false,
+    allowForward: true,
+    defaultActions: proposalActions,
+    // A week-old proposal is stale: the person on Discord has moved on and the
+    // draft was written against a conversation that has since changed.
+    actionsExpireAfterHours: 168,
+  },
+]
+
+export default messageTypes

package/src/modules/channel_discord/setup.ts

@@ -0,0 +1,78 @@
+import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+import {
+  hasChannelAdapter,
+  registerChannelAdapter,
+} from '@open-mercato/core/modules/communication_channels/lib/adapter-registry-singleton'
+import { createCredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import { createIntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getDiscordChannelAdapter } from './lib/adapter'
+import { applyDiscordEnvPreset, CHANNEL_DISCORD_INTEGRATION_ID } from './lib/preset'
+
+const logger = createLogger('channel_discord').child({ component: 'setup' })
+
+/**
+ * Register the Discord `ChannelAdapter` exactly once per process at import time.
+ * The registry is process-wide, so we guard with `hasChannelAdapter` to silence
+ * the duplicate-providerKey error on dev-mode HMR + repeated test imports.
+ *
+ * Env presets (`OM_CHANNEL_DISCORD_*`, see `lib/preset.ts` and `.env.example`)
+ * are optional operator conveniences applied on tenant creation and rerunnable
+ * via `yarn mercato channel_discord configure-from-env`; the bot is normally
+ * connected via the credential connect flow (`/backend/integrations`). The
+ * gateway worker honours `OM_CHANNEL_DISCORD_GATEWAY_DISABLED` to skip the
+ * socket in CI / send-only deployments.
+ */
+function ensureDiscordAdapterRegistered(): void {
+  if (hasChannelAdapter('discord')) return
+  registerChannelAdapter(getDiscordChannelAdapter())
+}
+
+ensureDiscordAdapterRegistered()
+
+export const setup: ModuleSetupConfig = {
+  defaultRoleFeatures: {
+    // `ai_auto_reply.run` is granted here so a tenant that creates a real
+    // channel-bot user and puts it in an admin role gets a principal that can
+    // invoke the auto-reply agent. Deployments without such a user do not need
+    // the grant at all — the provider's service principal carries it in code
+    // (`lib/ai-service-principal.ts`).
+    superadmin: [
+      'channel_discord.view',
+      'channel_discord.configure',
+      'channel_discord.ai_auto_reply.run',
+    ],
+    admin: [
+      'channel_discord.view',
+      'channel_discord.configure',
+      'channel_discord.ai_auto_reply.run',
+    ],
+  },
+  async onTenantCreated({ em, organizationId, tenantId }) {
+    ensureDiscordAdapterRegistered()
+
+    const integrationLogService = createIntegrationLogService(em)
+    try {
+      await applyDiscordEnvPreset({
+        credentialsService: createCredentialsService(em),
+        integrationLogService,
+        scope: { tenantId, organizationId },
+      })
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown Discord preset error'
+      try {
+        await integrationLogService
+          .scoped(CHANNEL_DISCORD_INTEGRATION_ID, { tenantId, organizationId })
+          .error(`Failed to apply Discord env preset during tenant setup: ${message}`)
+      } catch (logError) {
+        const logMessage = logError instanceof Error ? logError.message : 'Unknown integration log error'
+        logger.error('Failed to apply env preset during tenant setup; persisting to integration logs also failed', {
+          presetError: message,
+          logError: logMessage,
+        })
+      }
+    }
+  },
+}
+
+export default setup