@open-mercato/channel-discord 0.7.1-develop.7202.1.a52dc6707c → 0.8.0

package/dist/modules/channel_discord/lib/channel-state-store.js

@@ -91,6 +91,7 @@ async function quarantineDiscordChannel(params) {
   if (!channel) return "not_found";
   channel.status = "requires_reauth";
   channel.lastError = params.reason;
+  channel.isActive = false;
   await fork.flush();
   return "quarantined";
 }

package/dist/modules/channel_discord/lib/channel-state-store.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/channel_discord/lib/channel-state-store.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '@open-mercato/core/modules/communication_channels/data/entities'\nimport { discordChannelStateSchema, type DiscordChannelState } from './credentials'\n\n/**\n * Tenant/organization scope every Discord channel-state write MUST carry.\n * The gateway worker persists resume state from a WebSocket callback that fires\n * long after the job handler returned, so the scope is captured up front from\n * the channel row the job loaded and replayed on every write.\n */\nexport type DiscordChannelScope = {\n  tenantId: string\n  organizationId: string | null\n}\n\n/** The gateway-owned subset of `channelState` this store is allowed to write. */\nexport type DiscordChannelStatePatch = {\n  sessionId?: string\n  sequence?: number | null\n  resumeGatewayUrl?: string\n  botUserId?: string\n}\n\nexport type PersistDiscordChannelStateResult = 'written' | 'skipped' | 'not_found'\n\n/**\n * Merge a gateway resume-state patch onto the state currently stored on the\n * channel row, or return `null` when the patch must not be written.\n *\n * Two rules make this safe against the socket callbacks racing each other:\n *\n * - Only the gateway-owned keys are touched; every other key (`aiAutoReplyEnabled`,\n *   `aiAgentId`, operator-set fields) is carried forward from the row that was\n *   just read, so a concurrent UI edit is never clobbered wholesale.\n * - A patch that would rewind the sequence of the session already stored is\n *   dropped. A late `READY` callback from a superseded socket must not overwrite\n *   fresher resume state with a stale cursor.\n */\nexport function mergeDiscordChannelState(\n  currentRaw: unknown,\n  patch: DiscordChannelStatePatch,\n  now: Date,\n): DiscordChannelState | null {\n  const current = discordChannelStateSchema.parse(currentRaw ?? {})\n  const sameSession = Boolean(patch.sessionId) && patch.sessionId === current.sessionId\n  const rewindsSequence =\n    sameSession &&\n    typeof patch.sequence === 'number' &&\n    typeof current.sequence === 'number' &&\n    patch.sequence < current.sequence\n  if (rewindsSequence) return null\n\n  return {\n    ...current,\n    ...patch,\n    lastConnectedAt: now.toISOString(),\n  }\n}\n\n/**\n * Scoped read-modify-write of a Discord channel's gateway resume state.\n *\n * The lookup filters by `tenant_id` / `organization_id` (never by id alone) so a\n * socket callback can only ever touch the row its own channel scope owns, and it\n * runs on its own `EntityManager` fork so the flush never rides on the request\n * context the worker job was started from.\n */\nexport async function persistDiscordChannelState(params: {\n  em: EntityManager\n  channelId: string\n  scope: DiscordChannelScope\n  patch: DiscordChannelStatePatch\n  now?: Date\n}): Promise<PersistDiscordChannelStateResult> {\n  const fork = params.em.fork()\n  const channel = await findOneWithDecryption(\n    fork,\n    CommunicationChannel,\n    {\n      id: params.channelId,\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId ?? params.scope.tenantId,\n    },\n  )\n  if (!channel) return 'not_found'\n\n  const merged = mergeDiscordChannelState(channel.channelState, params.patch, params.now ?? new Date())\n  if (!merged) return 'skipped'\n\n  channel.channelState = merged\n  await fork.flush()\n  return 'written'\n}\n\nexport type RecordAutoReplyOutcomeResult = 'written' | 'unchanged' | 'not_found'\n\n/** Truncated so a provider stack trace cannot grow the JSONB column without bound. */\nconst AUTO_REPLY_ERROR_MAX_LENGTH = 500\n\n/**\n * Record \u2014 or clear \u2014 why the last AI auto-reply attempt on this channel produced\n * nothing.\n *\n * The subscriber degrades every failure to a no-op on purpose: a broken model, a\n * denied policy check or a malformed object must never turn into a send. Being\n * *silent* about it is the part that hurts, because the operator's surface still\n * reads \"Auto-reply on\" while the channel answers nothing, and a `logger.warn` in\n * a background subscriber is not somewhere anyone looks. A save-time check cannot\n * close this on its own either \u2014 the settings route validates the agent against\n * the auto-reply principal, but a role edited afterwards makes that verdict stale.\n *\n * `failure: null` clears the marker, and the caller is expected to skip the write\n * when there is nothing to clear \u2014 a successful reply on a healthy channel must\n * not cost a row update per inbound message.\n *\n * The channel row's own `lastError` is deliberately left alone: the hub owns it\n * for delivery and polling failures, clears it on a successful poll, and keys the\n * reauth banner off `status`. Borrowing it here would let an AI failure mask a\n * delivery failure and let a successful poll erase an AI one.\n */\nexport async function recordDiscordAutoReplyOutcome(params: {\n  em: EntityManager\n  channelId: string\n  scope: DiscordChannelScope\n  failure: string | null\n  now?: Date\n}): Promise<RecordAutoReplyOutcomeResult> {\n  const fork = params.em.fork()\n  const channel = await findOneWithDecryption(\n    fork,\n    CommunicationChannel,\n    {\n      id: params.channelId,\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId ?? params.scope.tenantId,\n    },\n  )\n  if (!channel) return 'not_found'\n\n  const current = discordChannelStateSchema.parse(channel.channelState ?? {})\n  const failure = params.failure?.slice(0, AUTO_REPLY_ERROR_MAX_LENGTH) ?? null\n  if (failure === null && current.aiAutoReplyLastError === undefined) return 'unchanged'\n  if (failure !== null && current.aiAutoReplyLastError === failure) return 'unchanged'\n\n  const next: DiscordChannelState = { ...current }\n  if (failure === null) {\n    delete next.aiAutoReplyLastError\n    delete next.aiAutoReplyLastErrorAt\n  } else {\n    next.aiAutoReplyLastError = failure\n    next.aiAutoReplyLastErrorAt = (params.now ?? new Date()).toISOString()\n  }\n\n  channel.channelState = next\n  await fork.flush()\n  return 'written'\n}\n\nexport type QuarantineDiscordChannelResult = 'quarantined' | 'not_found'\n\n/**\n * Park a channel Discord has fatally rejected so the reconciler stops re-opening it.\n *\n * A `4004` (invalid token) or `4014` (disallowed intents) close is not\n * recoverable by retrying: the token or the Developer Portal toggle has to\n * change first. Without a persisted status the refresh job sees \"no live\n * session\" on the next tick and IDENTIFYs again \u2014 at the CLI's default 60s\n * refresh that is ~1440 session starts per day against Discord's ~1000/day\n * per-bot budget, while the row and the admin UI still read `connected`.\n *\n * Writing `requires_reauth` mirrors what the hub already does for a channel\n * whose credentials could not be persisted (`connect-channel.ts`), so the\n * existing reauth banner, the mutation guard that keys on `status`, and the\n * operator's reconnect flow all engage without any hub change.\n */\nexport async function quarantineDiscordChannel(params: {\n  em: EntityManager\n  channelId: string\n  scope: DiscordChannelScope\n  reason: string\n}): Promise<QuarantineDiscordChannelResult> {\n  const fork = params.em.fork()\n  const channel = await findOneWithDecryption(\n    fork,\n    CommunicationChannel,\n    {\n      id: params.channelId,\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId ?? params.scope.tenantId,\n    },\n  )\n  if (!channel) return 'not_found'\n\n  channel.status = 'requires_reauth'\n  channel.lastError = params.reason\n  await fork.flush()\n  return 'quarantined'\n}\n"],
-  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,iCAA2D;AAoC7D,SAAS,yBACd,YACA,OACA,KAC4B;AAC5B,QAAM,UAAU,0BAA0B,MAAM,cAAc,CAAC,CAAC;AAChE,QAAM,cAAc,QAAQ,MAAM,SAAS,KAAK,MAAM,cAAc,QAAQ;AAC5E,QAAM,kBACJ,eACA,OAAO,MAAM,aAAa,YAC1B,OAAO,QAAQ,aAAa,YAC5B,MAAM,WAAW,QAAQ;AAC3B,MAAI,gBAAiB,QAAO;AAE5B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG;AAAA,IACH,iBAAiB,IAAI,YAAY;AAAA,EACnC;AACF;AAUA,eAAsB,2BAA2B,QAMH;AAC5C,QAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM,kBAAkB,OAAO,MAAM;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,SAAS,yBAAyB,QAAQ,cAAc,OAAO,OAAO,OAAO,OAAO,oBAAI,KAAK,CAAC;AACpG,MAAI,CAAC,OAAQ,QAAO;AAEpB,UAAQ,eAAe;AACvB,QAAM,KAAK,MAAM;AACjB,SAAO;AACT;AAKA,MAAM,8BAA8B;AAuBpC,eAAsB,8BAA8B,QAMV;AACxC,QAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM,kBAAkB,OAAO,MAAM;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,UAAU,0BAA0B,MAAM,QAAQ,gBAAgB,CAAC,CAAC;AAC1E,QAAM,UAAU,OAAO,SAAS,MAAM,GAAG,2BAA2B,KAAK;AACzE,MAAI,YAAY,QAAQ,QAAQ,yBAAyB,OAAW,QAAO;AAC3E,MAAI,YAAY,QAAQ,QAAQ,yBAAyB,QAAS,QAAO;AAEzE,QAAM,OAA4B,EAAE,GAAG,QAAQ;AAC/C,MAAI,YAAY,MAAM;AACpB,WAAO,KAAK;AACZ,WAAO,KAAK;AAAA,EACd,OAAO;AACL,SAAK,uBAAuB;AAC5B,SAAK,0BAA0B,OAAO,OAAO,oBAAI,KAAK,GAAG,YAAY;AAAA,EACvE;AAEA,UAAQ,eAAe;AACvB,QAAM,KAAK,MAAM;AACjB,SAAO;AACT;AAmBA,eAAsB,yBAAyB,QAKH;AAC1C,QAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM,kBAAkB,OAAO,MAAM;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,UAAQ,SAAS;AACjB,UAAQ,YAAY,OAAO;AAC3B,QAAM,KAAK,MAAM;AACjB,SAAO;AACT;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '@open-mercato/core/modules/communication_channels/data/entities'\nimport { discordChannelStateSchema, type DiscordChannelState } from './credentials'\n\n/**\n * Tenant/organization scope every Discord channel-state write MUST carry.\n * The gateway worker persists resume state from a WebSocket callback that fires\n * long after the job handler returned, so the scope is captured up front from\n * the channel row the job loaded and replayed on every write.\n */\nexport type DiscordChannelScope = {\n  tenantId: string\n  organizationId: string | null\n}\n\n/** The gateway-owned subset of `channelState` this store is allowed to write. */\nexport type DiscordChannelStatePatch = {\n  sessionId?: string\n  sequence?: number | null\n  resumeGatewayUrl?: string\n  botUserId?: string\n}\n\nexport type PersistDiscordChannelStateResult = 'written' | 'skipped' | 'not_found'\n\n/**\n * Merge a gateway resume-state patch onto the state currently stored on the\n * channel row, or return `null` when the patch must not be written.\n *\n * Two rules make this safe against the socket callbacks racing each other:\n *\n * - Only the gateway-owned keys are touched; every other key (`aiAutoReplyEnabled`,\n *   `aiAgentId`, operator-set fields) is carried forward from the row that was\n *   just read, so a concurrent UI edit is never clobbered wholesale.\n * - A patch that would rewind the sequence of the session already stored is\n *   dropped. A late `READY` callback from a superseded socket must not overwrite\n *   fresher resume state with a stale cursor.\n */\nexport function mergeDiscordChannelState(\n  currentRaw: unknown,\n  patch: DiscordChannelStatePatch,\n  now: Date,\n): DiscordChannelState | null {\n  const current = discordChannelStateSchema.parse(currentRaw ?? {})\n  const sameSession = Boolean(patch.sessionId) && patch.sessionId === current.sessionId\n  const rewindsSequence =\n    sameSession &&\n    typeof patch.sequence === 'number' &&\n    typeof current.sequence === 'number' &&\n    patch.sequence < current.sequence\n  if (rewindsSequence) return null\n\n  return {\n    ...current,\n    ...patch,\n    lastConnectedAt: now.toISOString(),\n  }\n}\n\n/**\n * Scoped read-modify-write of a Discord channel's gateway resume state.\n *\n * The lookup filters by `tenant_id` / `organization_id` (never by id alone) so a\n * socket callback can only ever touch the row its own channel scope owns, and it\n * runs on its own `EntityManager` fork so the flush never rides on the request\n * context the worker job was started from.\n */\nexport async function persistDiscordChannelState(params: {\n  em: EntityManager\n  channelId: string\n  scope: DiscordChannelScope\n  patch: DiscordChannelStatePatch\n  now?: Date\n}): Promise<PersistDiscordChannelStateResult> {\n  const fork = params.em.fork()\n  const channel = await findOneWithDecryption(\n    fork,\n    CommunicationChannel,\n    {\n      id: params.channelId,\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId ?? params.scope.tenantId,\n    },\n  )\n  if (!channel) return 'not_found'\n\n  const merged = mergeDiscordChannelState(channel.channelState, params.patch, params.now ?? new Date())\n  if (!merged) return 'skipped'\n\n  channel.channelState = merged\n  await fork.flush()\n  return 'written'\n}\n\nexport type RecordAutoReplyOutcomeResult = 'written' | 'unchanged' | 'not_found'\n\n/** Truncated so a provider stack trace cannot grow the JSONB column without bound. */\nconst AUTO_REPLY_ERROR_MAX_LENGTH = 500\n\n/**\n * Record \u2014 or clear \u2014 why the last AI auto-reply attempt on this channel produced\n * nothing.\n *\n * The subscriber degrades every failure to a no-op on purpose: a broken model, a\n * denied policy check or a malformed object must never turn into a send. Being\n * *silent* about it is the part that hurts, because the operator's surface still\n * reads \"Auto-reply on\" while the channel answers nothing, and a `logger.warn` in\n * a background subscriber is not somewhere anyone looks. A save-time check cannot\n * close this on its own either \u2014 the settings route validates the agent against\n * the auto-reply principal, but a role edited afterwards makes that verdict stale.\n *\n * `failure: null` clears the marker, and the caller is expected to skip the write\n * when there is nothing to clear \u2014 a successful reply on a healthy channel must\n * not cost a row update per inbound message.\n *\n * The channel row's own `lastError` is deliberately left alone: the hub owns it\n * for delivery and polling failures, clears it on a successful poll, and keys the\n * reauth banner off `status`. Borrowing it here would let an AI failure mask a\n * delivery failure and let a successful poll erase an AI one.\n */\nexport async function recordDiscordAutoReplyOutcome(params: {\n  em: EntityManager\n  channelId: string\n  scope: DiscordChannelScope\n  failure: string | null\n  now?: Date\n}): Promise<RecordAutoReplyOutcomeResult> {\n  const fork = params.em.fork()\n  const channel = await findOneWithDecryption(\n    fork,\n    CommunicationChannel,\n    {\n      id: params.channelId,\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId ?? params.scope.tenantId,\n    },\n  )\n  if (!channel) return 'not_found'\n\n  const current = discordChannelStateSchema.parse(channel.channelState ?? {})\n  const failure = params.failure?.slice(0, AUTO_REPLY_ERROR_MAX_LENGTH) ?? null\n  if (failure === null && current.aiAutoReplyLastError === undefined) return 'unchanged'\n  if (failure !== null && current.aiAutoReplyLastError === failure) return 'unchanged'\n\n  const next: DiscordChannelState = { ...current }\n  if (failure === null) {\n    delete next.aiAutoReplyLastError\n    delete next.aiAutoReplyLastErrorAt\n  } else {\n    next.aiAutoReplyLastError = failure\n    next.aiAutoReplyLastErrorAt = (params.now ?? new Date()).toISOString()\n  }\n\n  channel.channelState = next\n  await fork.flush()\n  return 'written'\n}\n\nexport type QuarantineDiscordChannelResult = 'quarantined' | 'not_found'\n\n/**\n * Park a channel Discord has fatally rejected so the reconciler stops re-opening it.\n *\n * A `4004` (invalid token) or `4014` (disallowed intents) close is not\n * recoverable by retrying: the token or the Developer Portal toggle has to\n * change first. Without a persisted status the refresh job sees \"no live\n * session\" on the next tick and IDENTIFYs again \u2014 at the CLI's default 60s\n * refresh that is ~1440 session starts per day against Discord's ~1000/day\n * per-bot budget, while the row and the admin UI still read `connected`.\n *\n * Writing `requires_reauth` + `isActive = false` mirrors what the hub already\n * does for a channel whose credentials could not be persisted\n * (`connect-channel.ts`'s `applyConnectionState`), so the existing reauth\n * banner, the mutation guard that keys on `status`, the admin channel list\n * (keyed on `isActive`), and the operator's reconnect flow all engage without\n * any hub change.\n */\nexport async function quarantineDiscordChannel(params: {\n  em: EntityManager\n  channelId: string\n  scope: DiscordChannelScope\n  reason: string\n}): Promise<QuarantineDiscordChannelResult> {\n  const fork = params.em.fork()\n  const channel = await findOneWithDecryption(\n    fork,\n    CommunicationChannel,\n    {\n      id: params.channelId,\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: params.scope.tenantId,\n      organizationId: params.scope.organizationId ?? params.scope.tenantId,\n    },\n  )\n  if (!channel) return 'not_found'\n\n  channel.status = 'requires_reauth'\n  channel.lastError = params.reason\n  // Mirrors `connect-channel.ts`'s `applyConnectionState`: the admin list and\n  // the reconciler's `isActive: true` query filter both key on this flag, not\n  // `status` \u2014 without it the channel keeps reporting Active and the next\n  // refresh tick's query would still pick it up.\n  channel.isActive = false\n  await fork.flush()\n  return 'quarantined'\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,iCAA2D;AAoC7D,SAAS,yBACd,YACA,OACA,KAC4B;AAC5B,QAAM,UAAU,0BAA0B,MAAM,cAAc,CAAC,CAAC;AAChE,QAAM,cAAc,QAAQ,MAAM,SAAS,KAAK,MAAM,cAAc,QAAQ;AAC5E,QAAM,kBACJ,eACA,OAAO,MAAM,aAAa,YAC1B,OAAO,QAAQ,aAAa,YAC5B,MAAM,WAAW,QAAQ;AAC3B,MAAI,gBAAiB,QAAO;AAE5B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG;AAAA,IACH,iBAAiB,IAAI,YAAY;AAAA,EACnC;AACF;AAUA,eAAsB,2BAA2B,QAMH;AAC5C,QAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM,kBAAkB,OAAO,MAAM;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,SAAS,yBAAyB,QAAQ,cAAc,OAAO,OAAO,OAAO,OAAO,oBAAI,KAAK,CAAC;AACpG,MAAI,CAAC,OAAQ,QAAO;AAEpB,UAAQ,eAAe;AACvB,QAAM,KAAK,MAAM;AACjB,SAAO;AACT;AAKA,MAAM,8BAA8B;AAuBpC,eAAsB,8BAA8B,QAMV;AACxC,QAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM,kBAAkB,OAAO,MAAM;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,UAAU,0BAA0B,MAAM,QAAQ,gBAAgB,CAAC,CAAC;AAC1E,QAAM,UAAU,OAAO,SAAS,MAAM,GAAG,2BAA2B,KAAK;AACzE,MAAI,YAAY,QAAQ,QAAQ,yBAAyB,OAAW,QAAO;AAC3E,MAAI,YAAY,QAAQ,QAAQ,yBAAyB,QAAS,QAAO;AAEzE,QAAM,OAA4B,EAAE,GAAG,QAAQ;AAC/C,MAAI,YAAY,MAAM;AACpB,WAAO,KAAK;AACZ,WAAO,KAAK;AAAA,EACd,OAAO;AACL,SAAK,uBAAuB;AAC5B,SAAK,0BAA0B,OAAO,OAAO,oBAAI,KAAK,GAAG,YAAY;AAAA,EACvE;AAEA,UAAQ,eAAe;AACvB,QAAM,KAAK,MAAM;AACjB,SAAO;AACT;AAqBA,eAAsB,yBAAyB,QAKH;AAC1C,QAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM;AAAA,MAC7B,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,OAAO,MAAM;AAAA,MACvB,gBAAgB,OAAO,MAAM,kBAAkB,OAAO,MAAM;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,UAAQ,SAAS;AACjB,UAAQ,YAAY,OAAO;AAK3B,UAAQ,WAAW;AACnB,QAAM,KAAK,MAAM;AACjB,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/channel-discord",
-  "version": "0.7.1-develop.7202.1.a52dc6707c",
+  "version": "0.8.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,14 +62,14 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.7.1-develop.7202.1.a52dc6707c",
-    "@open-mercato/queue": "0.7.1-develop.7202.1.a52dc6707c",
-    "@open-mercato/ui": "0.7.1-develop.7202.1.a52dc6707c"
+    "@open-mercato/core": "0.8.0",
+    "@open-mercato/queue": "0.8.0",
+    "@open-mercato/ui": "0.8.0"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/ai-assistant": "0.7.1-develop.7202.1.a52dc6707c",
-    "@open-mercato/shared": "0.7.1-develop.7202.1.a52dc6707c",
+    "@open-mercato/ai-assistant": "0.8.0",
+    "@open-mercato/shared": "0.8.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
@@ -79,8 +79,8 @@
     }
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7202.1.a52dc6707c",
-    "@open-mercato/shared": "0.7.1-develop.7202.1.a52dc6707c",
+    "@open-mercato/ai-assistant": "0.8.0",
+    "@open-mercato/shared": "0.8.0",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.5",
@@ -99,6 +99,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/channel-discord"
-  },
-  "stableVersion": "0.7.0"
+  }
 }

package/src/modules/channel_discord/lib/__tests__/channel-quarantine.test.ts

@@ -1,4 +1,5 @@
 import { quarantineDiscordChannel } from '../channel-state-store'
+import { buildGatewayChannelFilter } from '../../workers/discord-gateway'
 
 jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
   findOneWithDecryption: jest.fn(),
@@ -21,7 +22,7 @@ const { findOneWithDecryption } = require('@open-mercato/shared/lib/encryption/f
  * `is_active=t, status=connected, last_error=NULL`; at the default `--refresh 60`
  * that is ~1440 session starts per day against Discord's ~1000/day per-bot budget.
  */
-type FakeChannel = { status: string; lastError: string | null }
+type FakeChannel = { status: string; lastError: string | null; isActive: boolean }
 
 function fakeEm(channel: FakeChannel | null): { em: unknown; flush: jest.Mock } {
   const flush = jest.fn().mockResolvedValue(undefined)
@@ -38,7 +39,7 @@ describe('quarantineDiscordChannel', () => {
   })
 
   it('parks the channel as requires_reauth with the close code as the reason', async () => {
-    const channel: FakeChannel = { status: 'connected', lastError: null }
+    const channel: FakeChannel = { status: 'connected', lastError: null, isActive: true }
     const { em, flush } = fakeEm(channel)
 
     const result = await quarantineDiscordChannel({
@@ -54,11 +55,55 @@ describe('quarantineDiscordChannel', () => {
     expect(flush).toHaveBeenCalledTimes(1)
   })
 
+  it('flips isActive to false so the admin list stops reporting the channel as Active', async () => {
+    // Regression: the reconciler already skipped `status === 'requires_reauth'`,
+    // but the admin channels list (`backend/communication_channels/channels/page.tsx`)
+    // renders its Active/Inactive badge from `isActive`, not `status` — so a
+    // quarantined channel kept showing Active until this flipped too.
+    const channel: FakeChannel = { status: 'connected', lastError: null, isActive: true }
+    const { em } = fakeEm(channel)
+
+    await quarantineDiscordChannel({
+      em: em as never,
+      channelId: 'chan-1',
+      scope: SCOPE,
+      reason: 'gateway_close_4004',
+    })
+
+    expect(channel.isActive).toBe(false)
+  })
+
+  it('makes the quarantined row drop out of the reconciler’s next-tick query filter', async () => {
+    // `buildGatewayChannelFilter` is what the reconciler runs on every refresh
+    // tick to decide which channels to (re)connect. It filters on `isActive:
+    // true`, so once quarantine flips that flag, the same channel row that
+    // caused 16 fatal closes over 10 ticks (see #4979) no longer matches on
+    // the next tick — no persisted `status` lookup is even needed to skip it.
+    const channel: FakeChannel & { providerKey: string; deletedAt: null } = {
+      status: 'connected',
+      lastError: null,
+      isActive: true,
+      providerKey: 'discord',
+      deletedAt: null,
+    }
+    const { em } = fakeEm(channel)
+
+    await quarantineDiscordChannel({
+      em: em as never,
+      channelId: 'chan-1',
+      scope: SCOPE,
+      reason: 'gateway_close_4014',
+    })
+
+    const nextTickFilter = buildGatewayChannelFilter({})
+    expect(channel.isActive).not.toBe(nextTickFilter.isActive)
+  })
+
   it('looks the channel up inside its own tenant scope, never by id alone', async () => {
-    fakeEm({ status: 'connected', lastError: null })
+    fakeEm({ status: 'connected', lastError: null, isActive: true })
 
     await quarantineDiscordChannel({
-      em: (fakeEm({ status: 'connected', lastError: null }).em) as never,
+      em: (fakeEm({ status: 'connected', lastError: null, isActive: true }).em) as never,
       channelId: 'chan-1',
       scope: SCOPE,
       reason: 'gateway_close_4004',

package/src/modules/channel_discord/lib/channel-state-store.ts

@@ -181,10 +181,12 @@ export type QuarantineDiscordChannelResult = 'quarantined' | 'not_found'
  * refresh that is ~1440 session starts per day against Discord's ~1000/day
  * per-bot budget, while the row and the admin UI still read `connected`.
  *
- * Writing `requires_reauth` mirrors what the hub already does for a channel
- * whose credentials could not be persisted (`connect-channel.ts`), so the
- * existing reauth banner, the mutation guard that keys on `status`, and the
- * operator's reconnect flow all engage without any hub change.
+ * Writing `requires_reauth` + `isActive = false` mirrors what the hub already
+ * does for a channel whose credentials could not be persisted
+ * (`connect-channel.ts`'s `applyConnectionState`), so the existing reauth
+ * banner, the mutation guard that keys on `status`, the admin channel list
+ * (keyed on `isActive`), and the operator's reconnect flow all engage without
+ * any hub change.
  */
 export async function quarantineDiscordChannel(params: {
   em: EntityManager
@@ -212,6 +214,11 @@ export async function quarantineDiscordChannel(params: {
 
   channel.status = 'requires_reauth'
   channel.lastError = params.reason
+  // Mirrors `connect-channel.ts`'s `applyConnectionState`: the admin list and
+  // the reconciler's `isActive: true` query filter both key on this flag, not
+  // `status` — without it the channel keeps reporting Active and the next
+  // refresh tick's query would still pick it up.
+  channel.isActive = false
   await fork.flush()
   return 'quarantined'
 }