@open-mercato/core 0.8.1-develop.7221.1.ece7ca874e → 0.8.1-develop.7225.1.73190a4a95

package/src/modules/communication_channels/backend/profile/communication-channels/ConnectChannelMenu.tsx

@@ -0,0 +1,120 @@
+'use client'
+
+import * as React from 'react'
+import { ChevronDown } from 'lucide-react'
+import { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { InjectionSpot, useInjectionWidgets } from '@open-mercato/ui/backend/injection/InjectionSpot'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { cn } from '@open-mercato/shared/lib/utils'
+
+const CONNECT_MENU_TRIGGER_ID = 'communication-channels-connect-trigger'
+const CONNECT_MENU_PANEL_ID = 'communication-channels-connect-menu'
+
+type ConnectChannelMenuProps = {
+  onConnected: () => void
+}
+
+/**
+ * Single "Connect channel" entry point for the profile page.
+ *
+ * Every `channel-*` package injects its own connect control into the
+ * `profile:communication-channels:connect` spot. Rendering that spot inline put
+ * each provider button side by side in the page header, unspaced and growing
+ * wider with every installed provider (#5595). The widgets now stack inside a
+ * dropdown, so a new provider lengthens a list instead of widening a row.
+ *
+ * The panel stays mounted and is hidden with CSS rather than being conditionally
+ * rendered: `channel-imap` and `channel-discord` own their connect `Dialog`
+ * inside the injected widget, so unmounting the panel on close would tear down
+ * an open dialog.
+ */
+export function ConnectChannelMenu({ onConnected }: ConnectChannelMenuProps): React.JSX.Element | null {
+  const t = useT()
+  const spotId = extensionPoints.hosts.profileConnect.spotId
+  const [open, setOpen] = React.useState(false)
+  const containerRef = React.useRef<HTMLDivElement>(null)
+  const triggerRef = React.useRef<HTMLButtonElement>(null)
+
+  const context = React.useMemo(() => ({ reload: onConnected }), [onConnected])
+  const { widgets } = useInjectionWidgets(spotId, { context, triggerOnLoad: true })
+
+  React.useEffect(() => {
+    if (!open) return
+    // A provider's credential dialog renders through a portal at `document.body`,
+    // so it sits outside `containerRef` and a click inside it reads as an outside
+    // click. Dismissing on those would collapse the panel behind the open dialog —
+    // the tear-down the panel is kept mounted to avoid in the first place.
+    //
+    // Escape is deliberately not guarded the same way. The provider widgets render
+    // a controlled `Dialog` with no `DialogTrigger`, so Radix has no recorded
+    // element to hand focus back to and drops it on `<body>` when the dialog
+    // closes — measured in Chromium, where focus was still on `<body>` two seconds
+    // later. Closing the menu here and calling `focus()` is then the only thing
+    // that leaves a keyboard user anywhere usable, so Escape dismisses both layers
+    // together on purpose until the provider widgets restore focus themselves.
+    function isInsideDialog(target: EventTarget | null): boolean {
+      const element = target as Element | null
+      return typeof element?.closest === 'function' && element.closest('[role="dialog"]') !== null
+    }
+    function onDocumentMouseDown(event: MouseEvent) {
+      if (isInsideDialog(event.target)) return
+      const target = event.target as Node
+      if (containerRef.current && !containerRef.current.contains(target)) setOpen(false)
+    }
+    function onKeyDown(event: KeyboardEvent) {
+      if (event.key !== 'Escape') return
+      setOpen(false)
+      triggerRef.current?.focus()
+    }
+    document.addEventListener('mousedown', onDocumentMouseDown)
+    document.addEventListener('keydown', onKeyDown)
+    return () => {
+      document.removeEventListener('mousedown', onDocumentMouseDown)
+      document.removeEventListener('keydown', onKeyDown)
+    }
+  }, [open])
+
+  if (widgets.length === 0) return null
+
+  return (
+    <div ref={containerRef} className="relative inline-block text-left">
+      <Button
+        ref={triggerRef}
+        id={CONNECT_MENU_TRIGGER_ID}
+        type="button"
+        variant="outline"
+        aria-expanded={open}
+        aria-controls={CONNECT_MENU_PANEL_ID}
+        onClick={() => setOpen((current) => !current)}
+      >
+        {t('communication_channels.profile.connect.menu', 'Connect channel')}
+        <ChevronDown className={cn('size-4 transition-transform', open && 'rotate-180')} />
+      </Button>
+      {/* A disclosure group, not `role="menu"`: the rows are provider-owned
+          widgets rendering plain buttons, and ARIA only allows `menuitem`-shaped
+          children under a menu — declaring one would hide them from assistive
+          technology instead of describing them. */}
+      <div
+        id={CONNECT_MENU_PANEL_ID}
+        role="group"
+        aria-labelledby={CONNECT_MENU_TRIGGER_ID}
+        data-testid="connect-channel-menu-panel"
+        className={cn(
+          // Anchoring flips with the header: the header wraps on a phone, which
+          // moves the trigger to the left edge, and right-anchoring a panel
+          // wider than the trigger then pushes it off-screen. Left-anchor below
+          // `sm`, right-anchor from `sm` up where the trigger sits right. The
+          // `max-w-` clamp (mirroring RowActions) keeps a long provider label
+          // from widening the panel past the viewport either way.
+          'absolute left-0 top-full z-dropdown mt-2 w-max min-w-56 max-w-[calc(100vw-1rem)] flex-col items-stretch gap-2 rounded-md border bg-background p-2 shadow-md sm:left-auto sm:right-0',
+          open ? 'flex' : 'hidden',
+        )}
+      >
+        <InjectionSpot spotId={spotId} context={context} data={{}} widgetsOverride={widgets} />
+      </div>
+    </div>
+  )
+}
+
+export default ConnectChannelMenu

package/src/modules/communication_channels/backend/profile/communication-channels/page.tsx

@@ -21,11 +21,11 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { Textarea } from '@open-mercato/ui/primitives/textarea'
 import { KbdShortcut } from '@open-mercato/ui/primitives/kbd'
-import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { ConnectChannelMenu } from './ConnectChannelMenu'
 
 type ChannelRow = {
   id: string
@@ -146,6 +146,8 @@ export default function ProfileCommunicationChannelsPage() {
 
   const reauthRows = rows.filter((r) => r.status === 'requires_reauth')
 
+  const reloadChannels = React.useCallback(() => setReloadKey((k) => k + 1), [])
+
   const onSetPrimary = React.useCallback(
     async (channelId: string) => {
       let response
@@ -500,8 +502,8 @@ export default function ProfileCommunicationChannelsPage() {
   return (
     <Page>
       <PageBody>
-        <header className="mb-4 flex items-baseline justify-between">
-          <div>
+        <header className="mb-4 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between sm:gap-4">
+          <div className="min-w-0">
             <h1 className="text-2xl font-semibold">
               {t('communication_channels.profile.title', 'My communication channels')}
             </h1>
@@ -513,12 +515,9 @@ export default function ProfileCommunicationChannelsPage() {
             </p>
           </div>
           {/* Provider connect entry points injected by each channel-* package
-              (channel-gmail, channel-imap) via UMES. */}
-          <InjectionSpot
-            spotId={extensionPoints.hosts.profileConnect.spotId}
-            context={{ reload: () => setReloadKey((k) => k + 1) }}
-            data={{}}
-          />
+              (channel-gmail, channel-imap) via UMES. They stack inside one
+              dropdown so the header does not widen per installed provider. */}
+          <ConnectChannelMenu onConnected={reloadChannels} />
         </header>
 
         {reauthRows.length > 0 ? (
@@ -543,7 +542,7 @@ export default function ProfileCommunicationChannelsPage() {
           error={errorMessage}
           emptyState={t(
             'communication_channels.profile.empty',
-            'You have no connected channels yet. Use one of the Connect buttons above to add a channel.',
+            'You have no connected channels yet. Add one using the menu at the top of this page.',
           )}
         />
         <ImportHistoryDialog

package/src/modules/communication_channels/commands/connect-credential-channel.ts

@@ -104,6 +104,7 @@ const connectCredentialChannelCommand: CommandHandler<
     const effectiveUserId = tenantScoped ? null : input.userId
 
     // Optional credential validation.
+    let adapterIdentifier: string | null = null
     if (typeof adapter.validateCredentials === 'function') {
       const validation = await adapter.validateCredentials({
         providerKey: input.providerKey,
@@ -120,6 +121,9 @@ const connectCredentialChannelCommand: CommandHandler<
           errorCodes: validation.errorCodes,
         }
       }
+      if (typeof validation.externalIdentifier === 'string' && validation.externalIdentifier.length > 0) {
+        adapterIdentifier = validation.externalIdentifier
+      }
     }
 
     // Persist credentials best-effort.
@@ -200,8 +204,12 @@ const connectCredentialChannelCommand: CommandHandler<
     // carry it as `fromAddress`; other credential providers may use `username` or
     // `email`. Normalize emails to lowercase so the cross-provider duplicate guard
     // and the per-(tenant,user,provider,mailbox) heal index match canonically.
+    // An identity the adapter reported during validation wins: providers such as
+    // Discord have no email-shaped key, and without it every reconnect inserted a
+    // duplicate row instead of healing the existing one (#4977).
     const credBag = input.credentials as Record<string, unknown>
     const rawIdentifier =
+      adapterIdentifier ??
       (typeof credBag.username === 'string' && credBag.username.length > 0 ? credBag.username : null) ??
       (typeof credBag.email === 'string' && credBag.email.length > 0 ? credBag.email : null) ??
       (typeof credBag.fromAddress === 'string' && credBag.fromAddress.length > 0
@@ -233,6 +241,7 @@ const connectCredentialChannelCommand: CommandHandler<
           organizationId: tenantScoped ? null : input.scope.organizationId ?? null,
         },
         pollIntervalSeconds: input.pollIntervalSeconds,
+        adoptUnidentifiedChannel: adapterIdentifier !== null,
       })
     } catch (err) {
       // Same mailbox already connected via another provider — reject so we don't

package/src/modules/communication_channels/commands/ingest-inbound-message.ts

@@ -213,6 +213,7 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
         tenantId: input.scope.tenantId,
         organizationId: input.scope.organizationId ?? null,
         lastMessageAt: m.timestamp ?? new Date(),
+        assignedUserId: channel.userId ?? null,
       })
       em.persist(conversation)
       conversationCreated = true
@@ -378,6 +379,13 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
         : rawBody
     const safeSubject = (m.subject ?? '').trim() || '(no subject)'
 
+    // #6106: a per-user channel is its owner's inbox, so the owner is the
+    // default assignee. Without this fallback the first message of a thread
+    // (no mapping yet) and every message on an unassigned mapping had no
+    // recipient, and the participant-scoped inbox showed it to nobody. A
+    // manual assignment stays authoritative; tenant-wide channels have no owner.
+    const routedAssigneeId = mapping?.assignedUserId ?? channel.userId ?? null
+
     const composeInput = {
       type: `channel.${input.providerKey}`,
       visibility: 'public' as const,
@@ -390,8 +398,14 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
       // senders have no address (Discord, Slack, SMS…) are validated without it.
       // The messages validator fails closed on any type it does not recognize.
       sourceChannelType: input.channelType,
-      recipients: mapping?.assignedUserId
-        ? [{ userId: mapping.assignedUserId, type: 'to' as const }]
+      // #6093: this message came in from the channel, so the recipient below
+      // is internal routing (the conversation's assignee), not an external
+      // addressee. Without the flag the hub's "no recipients on a public
+      // message" rule rejected every message in an assigned conversation and
+      // the worker dropped it as a permanent failure.
+      inboundFromChannel: true,
+      recipients: routedAssigneeId
+        ? [{ userId: routedAssigneeId, type: 'to' as const }]
         : [],
       subject: safeSubject,
       body: truncatedBody,
@@ -440,6 +454,7 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
         channelId: input.channelId,
         providerKey: input.providerKey,
         externalThreadRef: m.externalConversationId,
+        assignedUserId: channel.userId ?? null,
         tenantId: input.scope.tenantId,
         organizationId: input.scope.organizationId ?? null,
       })

package/src/modules/communication_channels/extension-points.ts

@@ -8,7 +8,7 @@ export const extensionPoints = defineModuleExtensionPoints({
       family: 'generic',
       spotId: 'profile:communication-channels:connect',
       supported: ['render-widget'],
-      source: 'backend/profile/communication-channels/page.tsx',
+      source: 'backend/profile/communication-channels/ConnectChannelMenu.tsx',
     }),
     profileChannelsTable: dataTableExtensionHost({ tableId: 'communication_channels.profile.channels', source: 'backend/profile/communication-channels/page.tsx' }),
   },

package/src/modules/communication_channels/i18n/de.json

@@ -89,6 +89,7 @@
   "communication_channels.profile.connect.imap": "IMAP verbinden",
   "communication_channels.profile.connect.imapTitle": "IMAP-Postfach verbinden",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Dieses Postfach ist bereits über einen anderen Anbieter verbunden. Trennen Sie es zuerst, um es mit einem anderen Anbieter erneut zu verbinden.",
+  "communication_channels.profile.connect.menu": "Kanal verbinden",
   "communication_channels.profile.connect.notConfigured": "Dieser Anbieter ist noch nicht konfiguriert. Bitten Sie einen Administrator, die OAuth-Client-ID und das Secret unter Integrationen zu hinterlegen, bevor ein Postfach verbunden wird.",
   "communication_channels.profile.connect.oauthFailed": "OAuth-Verbindung konnte nicht gestartet werden.",
   "communication_channels.profile.connect.save": "Verbinden",
@@ -100,7 +101,7 @@
   "communication_channels.profile.disconnect.description": "Dies entfernt die Verbindung und stoppt die Synchronisierung. Bereits importierte E-Mails bleiben in Ihren Timelines. Sie können den Kanal jederzeit erneut verbinden.",
   "communication_channels.profile.disconnect.submitting": "Wird getrennt…",
   "communication_channels.profile.disconnect.title": "Kanal trennen",
-  "communication_channels.profile.empty": "Sie haben noch keine verbundenen Kanäle. Verwenden Sie oben eine der Schaltflächen zum Verbinden, um einen Kanal hinzuzufügen.",
+  "communication_channels.profile.empty": "Sie haben noch keine verbundenen Kanäle. Fügen Sie einen über das Menü oben auf dieser Seite hinzu.",
   "communication_channels.profile.flash.connected": "Kanal verbunden.",
   "communication_channels.profile.flash.connectedWithProvider": "Kanal verbunden ({provider}).",
   "communication_channels.profile.flash.error": "Kanal konnte nicht verbunden werden.",

package/src/modules/communication_channels/i18n/en.json

@@ -89,6 +89,7 @@
   "communication_channels.profile.connect.imap": "Connect IMAP",
   "communication_channels.profile.connect.imapTitle": "Connect IMAP mailbox",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "This mailbox is already connected through another provider. Disconnect it first to reconnect it with a different one.",
+  "communication_channels.profile.connect.menu": "Connect channel",
   "communication_channels.profile.connect.notConfigured": "This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox.",
   "communication_channels.profile.connect.oauthFailed": "Could not start OAuth connection.",
   "communication_channels.profile.connect.save": "Connect",
@@ -100,7 +101,7 @@
   "communication_channels.profile.disconnect.description": "This removes the connection and stops syncing. Emails already imported stay on your timelines. You can reconnect anytime.",
   "communication_channels.profile.disconnect.submitting": "Disconnecting…",
   "communication_channels.profile.disconnect.title": "Disconnect channel",
-  "communication_channels.profile.empty": "You have no connected channels yet. Use one of the Connect buttons above to add a channel.",
+  "communication_channels.profile.empty": "You have no connected channels yet. Add one using the menu at the top of this page.",
   "communication_channels.profile.flash.connected": "Channel connected.",
   "communication_channels.profile.flash.connectedWithProvider": "Channel connected ({provider}).",
   "communication_channels.profile.flash.error": "Failed to connect channel.",

package/src/modules/communication_channels/i18n/es.json

@@ -89,6 +89,7 @@
   "communication_channels.profile.connect.imap": "Conectar IMAP",
   "communication_channels.profile.connect.imapTitle": "Conectar buzón IMAP",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Este buzón ya está conectado a través de otro proveedor. Desconéctalo primero para volver a conectarlo con uno diferente.",
+  "communication_channels.profile.connect.menu": "Conectar canal",
   "communication_channels.profile.connect.notConfigured": "Este proveedor aún no está configurado. Pide a un administrador que añada el ID de cliente y el secreto de OAuth en Integraciones antes de conectar un buzón.",
   "communication_channels.profile.connect.oauthFailed": "No se pudo iniciar la conexión OAuth.",
   "communication_channels.profile.connect.save": "Conectar",
@@ -100,7 +101,7 @@
   "communication_channels.profile.disconnect.description": "Esto elimina la conexión y detiene la sincronización. Los correos ya importados permanecen en tus cronologías. Puedes volver a conectarlo cuando quieras.",
   "communication_channels.profile.disconnect.submitting": "Desconectando…",
   "communication_channels.profile.disconnect.title": "Desconectar canal",
-  "communication_channels.profile.empty": "Aún no tienes canales conectados. Usa uno de los botones de conexión de arriba para añadir un canal.",
+  "communication_channels.profile.empty": "Aún no tienes canales conectados. Añade uno con el menú de la parte superior de esta página.",
   "communication_channels.profile.flash.connected": "Canal conectado.",
   "communication_channels.profile.flash.connectedWithProvider": "Canal conectado ({provider}).",
   "communication_channels.profile.flash.error": "No se pudo conectar el canal.",

package/src/modules/communication_channels/i18n/ko.json

@@ -89,6 +89,7 @@
   "communication_channels.profile.connect.imap": "IMAP 연결",
   "communication_channels.profile.connect.imapTitle": "IMAP 메일함 연결",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "이 메일함은 이미 다른 제공업체를 통해 연결되어 있습니다. 다른 제공업체로 다시 연결하려면 먼저 연결을 해제하세요.",
+  "communication_channels.profile.connect.menu": "채널 연결",
   "communication_channels.profile.connect.notConfigured": "이 제공업체는 아직 구성되지 않았습니다. 메일함을 연결하기 전에 관리자에게 통합에서 OAuth 클라이언트 ID와 시크릿을 추가하도록 요청하세요.",
   "communication_channels.profile.connect.oauthFailed": "OAuth 연결을 시작할 수 없습니다.",
   "communication_channels.profile.connect.save": "연결",
@@ -100,7 +101,7 @@
   "communication_channels.profile.disconnect.description": "연결을 제거하고 동기화를 중지합니다. 이미 가져온 이메일은 타임라인에 그대로 유지됩니다. 언제든지 다시 연결할 수 있습니다.",
   "communication_channels.profile.disconnect.submitting": "연결 해제 중…",
   "communication_channels.profile.disconnect.title": "채널 연결 해제",
-  "communication_channels.profile.empty": "아직 연결된 채널이 없습니다. 위의 연결 버튼 중 하나를 사용하여 채널을 추가하세요.",
+  "communication_channels.profile.empty": "아직 연결된 채널이 없습니다. 이 페이지 상단의 메뉴에서 채널을 추가하세요.",
   "communication_channels.profile.flash.connected": "채널이 연결되었습니다.",
   "communication_channels.profile.flash.connectedWithProvider": "채널이 연결되었습니다 ({provider}).",
   "communication_channels.profile.flash.error": "채널 연결에 실패했습니다.",

package/src/modules/communication_channels/i18n/pl.json

@@ -89,6 +89,7 @@
   "communication_channels.profile.connect.imap": "Połącz IMAP",
   "communication_channels.profile.connect.imapTitle": "Połącz skrzynkę IMAP",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Ta skrzynka jest już połączona przez innego dostawcę. Najpierw ją rozłącz, aby połączyć ją z innym dostawcą.",
+  "communication_channels.profile.connect.menu": "Połącz kanał",
   "communication_channels.profile.connect.notConfigured": "Ten dostawca nie został jeszcze skonfigurowany. Poproś administratora o dodanie identyfikatora klienta i sekretu OAuth w sekcji Integracje przed połączeniem skrzynki.",
   "communication_channels.profile.connect.oauthFailed": "Nie udało się rozpocząć połączenia OAuth.",
   "communication_channels.profile.connect.save": "Połącz",
@@ -100,7 +101,7 @@
   "communication_channels.profile.disconnect.description": "Spowoduje to usunięcie połączenia i zatrzymanie synchronizacji. Już zaimportowane wiadomości pozostaną na osiach czasu. Możesz połączyć ponownie w dowolnej chwili.",
   "communication_channels.profile.disconnect.submitting": "Rozłączanie…",
   "communication_channels.profile.disconnect.title": "Rozłącz kanał",
-  "communication_channels.profile.empty": "Nie masz jeszcze połączonych kanałów. Użyj jednego z przycisków połączenia powyżej, aby dodać kanał.",
+  "communication_channels.profile.empty": "Nie masz jeszcze połączonych kanałów. Dodaj go za pomocą menu u góry tej strony.",
   "communication_channels.profile.flash.connected": "Kanał połączony.",
   "communication_channels.profile.flash.connectedWithProvider": "Kanał połączony ({provider}).",
   "communication_channels.profile.flash.error": "Nie udało się połączyć kanału.",

package/src/modules/communication_channels/lib/adapter.ts

@@ -519,6 +519,14 @@ export interface ValidateCredentialsResult {
    * that don't emit codes keep working and callers fall back to `errors`.
    */
   errorCodes?: Record<string, string>
+  /**
+   * Stable identity of the connected account, for providers whose credentials
+   * carry no email-shaped `username` / `email` / `fromAddress` (e.g. a Discord
+   * bot). When present on a successful validation the connect flow uses it as
+   * `CommunicationChannel.externalIdentifier`, so reconnecting the same account
+   * heals the existing channel instead of inserting a duplicate row.
+   */
+  externalIdentifier?: string
 }
 
 // ── The adapter contract ─────────────────────────────────────

package/src/modules/communication_channels/lib/connect-channel.ts

@@ -1,4 +1,5 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { CommunicationChannel } from '../data/entities'
 import type { ChannelAdapter } from './adapter'
@@ -44,6 +45,14 @@ export interface CreateConnectedChannelRowArgs {
    * the adapter's push capability (push-capable → null, polling-only → 300).
    */
   pollIntervalSeconds?: number | null
+  /**
+   * The identifier was reported by the adapter itself (not sniffed from the
+   * credential bag). Rows this user created for the same provider before the
+   * adapter reported one carry `external_identifier = NULL` and would never match
+   * the heal key, so the newest such row is adopted instead of inserting another
+   * one next to it.
+   */
+  adoptUnidentifiedChannel?: boolean
 }
 
 /**
@@ -163,6 +172,46 @@ export async function createConnectedChannelRow(
     }
   }
 
+  if (args.adoptUnidentifiedChannel && effectiveExternalIdentifier && !isTenantWidePush) {
+    const unidentified = (await findWithDecryption(
+      em,
+      CommunicationChannel,
+      { tenantId: scope.tenantId, userId, providerKey, externalIdentifier: null, deletedAt: null },
+      { orderBy: { createdAt: 'desc' } },
+      dscope,
+    )) as CommunicationChannel[]
+    const [adopted, ...superseded] = unidentified
+    if (adopted) {
+      // Per-user credentials are stored once per provider, so every older
+      // identifier-less row is a duplicate of the adopted one. Left active, a
+      // stuck `requires_reauth` duplicate would keep its reauth banner forever.
+      const inheritsPrimary = superseded.some((duplicate) => duplicate.isPrimary)
+      // Postgres checks the partial `communication_channels_one_primary_per_user_uq`
+      // index per statement and one flush does not order the SET-false before
+      // the SET-true, so the old primary is cleared in its own phase (each phase
+      // flushes) before the adopted row takes the flag, inside one transaction.
+      await withAtomicFlush(
+        em,
+        [
+          () => {
+            for (const duplicate of superseded) {
+              duplicate.isActive = false
+              duplicate.isPrimary = false
+              duplicate.status = 'disconnected'
+              duplicate.lastError = 'superseded_by_reconnect'
+            }
+          },
+          () => {
+            applyConnectionState(adopted)
+            if (inheritsPrimary) adopted.isPrimary = true
+          },
+        ],
+        { transaction: true },
+      )
+      return adopted
+    }
+  }
+
   const channel = em.create(CommunicationChannel, {
     providerKey,
     channelType: adapter.channelType,

package/src/modules/messages/api/route.ts

@@ -470,8 +470,14 @@ export async function POST(req: Request) {
         sourceHint.data,
       )
     : undefined
-  const { sourceChannelType: _clientSuppliedChannelType, ...clientBody } =
-    (body ?? {}) as Record<string, unknown>
+  // `inboundFromChannel` is likewise server-only (#6093): channel ingest sets
+  // it so an inbound message can be addressed to the conversation's assignee,
+  // and a request body must not be able to waive the recipients rule with it.
+  const {
+    sourceChannelType: _clientSuppliedChannelType,
+    inboundFromChannel: _clientSuppliedInboundFlag,
+    ...clientBody
+  } = (body ?? {}) as Record<string, unknown>
   const input = composeMessageSchema.parse({
     ...clientBody,
     ...(sourceChannelType ? { sourceChannelType } : {}),

package/src/modules/messages/commands/messages.ts

@@ -30,6 +30,13 @@ type MessageSentEventPayload = {
   senderUserId: string
   recipientUserIds: string[]
   sendViaEmail: boolean
+  /**
+   * The message arrived from an external channel (#6093). Its `senderUserId`
+   * is the channel's system user and its real correspondent lives in
+   * `externalName` / `externalEmail`; subscribers that show a sender read it
+   * from there.
+   */
+  inboundFromChannel?: boolean
   externalEmail?: string | null
   forwardedFrom?: string
   replyTo?: string
@@ -303,7 +310,13 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         : undefined
 
       const isPublicVisibility = input.visibility === 'public'
-      const sendViaEmail = isPublicVisibility ? true : input.sendViaEmail
+      // #6093: a channel-ingested message was RECEIVED, not sent. Ingest passes
+      // `sendViaEmail: false` on purpose; forcing it for public visibility would
+      // mail the assignee a copy and echo the message to its external sender
+      // (#6089) the moment the recipients waiver lets it compose. #6090 removes
+      // the forcing for every caller; until then it is skipped here for the
+      // ingest path only.
+      const sendViaEmail = isPublicVisibility && !input.inboundFromChannel ? true : input.sendViaEmail
       const message = trx.create(Message, {
         type: input.type,
         visibility: input.visibility ?? null,
@@ -407,7 +420,9 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         messageId,
         senderUserId: input.userId,
         recipientUserIds: input.recipients.map((recipient) => recipient.userId),
-        sendViaEmail: input.visibility === 'public' ? true : input.sendViaEmail,
+        sendViaEmail:
+          input.visibility === 'public' && !input.inboundFromChannel ? true : input.sendViaEmail,
+        inboundFromChannel: input.inboundFromChannel === true,
         externalEmail: responseExternalEmail,
         tenantId: input.tenantId,
         organizationId: input.organizationId,

package/src/modules/messages/data/validators.ts

@@ -116,6 +116,16 @@ const composeMessageBaseSchema = z.object({
    * asserting its own channel type.
    */
   sourceChannelType: z.string().min(1).max(64).optional(),
+  /**
+   * Set by channel ingest for a message that arrived FROM an external channel
+   * (#6093). On such a message `recipients` are not external addressees — a
+   * public message has none — but the internal users the hub routes it to
+   * (the conversation's assignee), so the "no recipients on a public message"
+   * rule does not apply. Server-only like `sourceChannelType`: the HTTP route
+   * strips any client-sent value, so a caller cannot waive the rule by
+   * asserting its message came in from a channel.
+   */
+  inboundFromChannel: z.boolean().optional(),
   recipients: z.array(messageRecipientSchema).max(100).optional().default([]),
   subject: z.string().max(500).optional().default(''),
   body: z.string().max(50000).optional().default(''),
@@ -155,7 +165,11 @@ function refineComposeMessage(value: ComposeMessageRefinementValue, ctx: z.Refin
           message: 'externalEmail is required when visibility is public',
         })
       }
-      if (recipientCount > 0) {
+      // #6093: a channel-ingested message is addressed to the assignee of its
+      // conversation; that recipient is internal routing, not a second
+      // external addressee, so only a user-composed public message is bound
+      // by this rule.
+      if (recipientCount > 0 && !value.inboundFromChannel) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           path: ['recipients'],
@@ -199,22 +213,23 @@ function refineComposeMessage(value: ComposeMessageRefinementValue, ctx: z.Refin
 }
 
 /**
- * Full compose contract, including the server-resolved `sourceChannelType`.
- * Used by the `messages.messages.compose` command and by the HTTP route AFTER
- * it has resolved the channel type itself.
+ * Full compose contract, including the server-resolved `sourceChannelType` and
+ * the ingest-only `inboundFromChannel`. Used by the `messages.messages.compose`
+ * command and by the HTTP route AFTER it has resolved the channel type itself.
  */
 export const composeMessageSchema = composeMessageBaseSchema.superRefine(refineComposeMessage)
 
 /**
- * Client-facing compose contract — the same rules minus `sourceChannelType`,
- * which is never accepted from a request body (#4975). Published in OpenAPI so
- * the documented request shape matches what `POST /api/messages` actually reads:
- * the route discards any client-sent channel type, resolves the real one from
- * the referenced conversation or parent message, and only then validates against
- * {@link composeMessageSchema}.
+ * Client-facing compose contract — the same rules minus the server-only fields:
+ * `sourceChannelType` is never accepted from a request body (#4975) and neither
+ * is `inboundFromChannel` (#6093). Published in OpenAPI so the documented
+ * request shape matches what `POST /api/messages` actually reads: the route
+ * discards any client-sent value for these, resolves the real channel type from
+ * the referenced conversation or parent message, and only then validates
+ * against {@link composeMessageSchema}.
  */
 export const composeMessageRequestSchema = composeMessageBaseSchema
-  .omit({ sourceChannelType: true })
+  .omit({ sourceChannelType: true, inboundFromChannel: true })
   .superRefine(refineComposeMessage)
 
 export const updateDraftSchema = z.object({

package/src/modules/messages/subscribers/message-notification.ts

@@ -22,6 +22,8 @@ type MessageSentPayload = {
   senderUserId: string
   recipientUserIds: string[]
   sendViaEmail: boolean
+  /** Set by compose for channel-ingested messages (#6093); see `resolveNotificationVariables`. */
+  inboundFromChannel?: boolean
   externalEmail?: string | null
   forwardedFrom?: string
   replyTo?: string
@@ -72,13 +74,23 @@ async function resolveNotificationVariables(payload: MessageSentPayload, ctx: Re
       ),
     ])
 
+    // #6093: a channel-ingested message is composed on behalf of the channel's
+    // system user (or, without one, the assignee), so `senderUserId` is not who
+    // wrote it. The correspondent is on the message itself.
+    const externalFrom = payload.inboundFromChannel
+      ? [message?.externalName, message?.externalEmail].find(
+          (value): value is string => typeof value === 'string' && value.trim().length > 0,
+        )
+      : undefined
+
     return {
       title: typeof message?.subject === 'string' ? message.subject : '',
-      from: typeof sender?.name === 'string' && sender.name.trim().length > 0
-        ? sender.name
-        : typeof sender?.email === 'string'
-          ? sender.email
-          : '',
+      from: externalFrom
+        ?? (typeof sender?.name === 'string' && sender.name.trim().length > 0
+          ? sender.name
+          : typeof sender?.email === 'string'
+            ? sender.email
+            : ''),
     }
   } catch {
     return { title: '', from: '' }

package/src/modules/sales/AGENTS.md

@@ -6,8 +6,7 @@ Use the sales module for orders, quotes, invoices, shipments, and payments. This
 
 1. **MUST use `salesCalculationService` from DI** for document math.
 2. **MUST follow document flow**: Quote → Order → Invoice — no skipping steps
-3. **MUST use `selectBestPrice`** from catalog pricing helpers.
-4. **MUST scope all documents to a channel** — channel selection affects pricing, numbering, and visibility
+3. **MUST scope all documents to a channel** — channel selection affects pricing, numbering, and visibility
 
 ## Ask First
 
@@ -51,7 +50,7 @@ const calcService = container.resolve('salesCalculationService')
 
 - Dispatches `sales.line.calculate.*` / `sales.document.calculate.*` events
 - Register line/totals calculators or override via DI
-- For catalog pricing: use `selectBestPrice`, `resolvePriceVariantId` from catalog module
+- **Not yet wired:** no code here calls catalog's `selectBestPrice`/`catalogPricingService` — lines are priced directly, not resolved from `CatalogProductPrice`. Out of scope for the pricing-engine spec; future wiring routes through `catalogPricingService` — never reimplement pricing inline.
 
 ## Data Model Constraints