@helyx/bot 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.4.4
+
+### Patch Changes
+
+- Add the reusable managed-resource, durable scheduling, secure checkpointed
+  selection and hosted/self-hosted runtime support required by the Reaction
+  Roles, Polls and Giveaways launch stages.
+- Updated dependencies
+  - @helyx/control-protocol@0.1.4
+  - @helyx/module-manifest@0.4.1
+  - @helyx/database@0.4.2
+  - @helyx/sdk@0.3.3
+  - @helyx/platform@0.2.5
+  - @helyx/core@0.1.8
+  - @helyx/framework@0.1.8
+
+## 0.4.3
+
+### Patch Changes
+
+- 18b228d: Add the unified Support transport, hosted configuration, shard-safe staff
+  notifications and paired self-host bug-report claim flow.
+- Updated dependencies [18b228d]
+- Updated dependencies [18b228d]
+  - @helyx/control-protocol@0.1.3
+  - @helyx/config@0.4.2
+  - @helyx/database@0.4.1
+  - @helyx/platform@0.2.4
+
 ## 0.4.2
 
 ### Patch Changes

package/README.md

@@ -18,6 +18,19 @@ When `HELYX_BOT_CONTROL_SECRET` is configured, the bot also starts a private aut
 
 Optional Helyx Cloud Connect is a separate outbound management path for self-hosted deployments. It is disabled unless `HELYX_CLOUD_CONNECT_ENABLED=true` and requires a separate local `HELYX_DATA_ENCRYPTION_KEY`. Preserve that key across every restart and deployment. If it is lost or changed, revoke the old installation in the dashboard and use a new one-use code with `/helyx-cloud connect`; the connector stops retrying until that recovery is completed. The owner-only `/helyx-cloud` command supports connection-code enrolment, status, credential rotation, disconnection and bounded support consent. The bot never sends its Discord token, database URL or connector private key to Helyx Cloud, and local Discord operation continues when Cloud is unavailable.
 
+Giveaways also requires the existing `HELYX_DATA_ENCRYPTION_KEY` so core can
+resume secure weighted-selection checkpoints without exposing the selection
+key to a module. Keep it stable across deployments; do not rotate it while a
+giveaway is drawing.
+
+The always-available guild-only `/bug` command can be used by any guild member.
+Hosted deployments submit through the dedicated `HELYX_SUPPORT_SERVICE_SECRET`;
+paired self-hosted deployments use their authenticated Cloud Connect session
+and may receive a one-time link for claiming, tracking and replying to the
+report. The hosted secret is never part of a self-host package. Configure
+`HELYX_SUPPORT_STAFF_CHANNEL_ID` with `DISCORD_INTERNAL_GUILD_ID` to deliver
+bounded new-case metadata to a private staff channel.
+
 Privacy providers ship in the same hosted and self-hosted module packages.
 `HELYX_PRIVACY_ENABLED` defaults to `false`; enabling it requires the private
 bot-control endpoint and a separate least-privilege PostgreSQL executor

package/dist/cloud-connector.d.ts

@@ -1,4 +1,5 @@
 import type { BotEnvironment } from "@helyx/config";
+import { type SupportBugCreatePayload, type SupportBugCreateResponsePayload } from "@helyx/control-protocol";
 import { type CloudConnectorConsentRecord, type DatabasePool } from "@helyx/database";
 import type { Client } from "discord.js";
 import type { Logger } from "pino";
@@ -38,6 +39,9 @@ export interface CloudConnector {
     enrol(rawToken: string, source: "startup" | "discord" | "file"): Promise<CloudConnectorStatus>;
     disconnect(): Promise<void>;
     rotate(): Promise<CloudConnectorStatus>;
+    submitBug(input: SupportBugCreatePayload): Promise<Extract<SupportBugCreateResponsePayload, {
+        ok: true;
+    }>["result"]>;
     stop(): Promise<void>;
 }
 export declare class ClientCloudDiscordDirectory implements CloudDiscordDirectory {
@@ -68,6 +72,9 @@ export declare class CloudConnectorController implements CloudConnector {
     enrol(rawToken: string, source: "startup" | "discord" | "file"): Promise<CloudConnectorStatus>;
     disconnect(): Promise<void>;
     rotate(): Promise<CloudConnectorStatus>;
+    submitBug(rawInput: SupportBugCreatePayload): Promise<Extract<SupportBugCreateResponsePayload, {
+        ok: true;
+    }>["result"]>;
     stop(): Promise<void>;
 }
 export declare class CloudConnectorUserError extends Error {

package/dist/cloud-connector.js

@@ -1,4 +1,4 @@
-import { CLOUD_DEFAULT_REQUEST_TIMEOUT_MS, CLOUD_PROTOCOL_VERSION, ConnectionSequenceGuard, assertCloudHandshakeSize, assertCloudMessageSize, cloudControlResponsePayloadSchema, connectedCloudMessageSchema, connectorAcceptedSchema, connectorChallengeSchema, connectorCredentialActionSchema, connectorHelloSchema, connectorRejectedSchema, generateConnectorKeyPair, signConnectorCredentialAction, signConnectorChallenge, } from "@helyx/control-protocol";
+import { CLOUD_DEFAULT_REQUEST_TIMEOUT_MS, CLOUD_PROTOCOL_VERSION, ConnectionSequenceGuard, assertCloudHandshakeSize, assertCloudMessageSize, cloudControlResponsePayloadSchema, connectedCloudMessageSchema, connectorAcceptedSchema, connectorChallengeSchema, connectorCredentialActionSchema, connectorHelloSchema, connectorRejectedSchema, generateConnectorKeyPair, signConnectorCredentialAction, signConnectorChallenge, supportBugCreatePayloadSchema, } from "@helyx/control-protocol";
 import { CloudConnectorRepository, } from "@helyx/database";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
@@ -82,6 +82,8 @@ export class CloudConnectorController {
     #stopping = false;
     #connectionBlocked = false;
     #loop;
+    #activeSupport;
+    #pendingSupport = new Map();
     constructor(input) {
         this.input = input;
         this.#repository = new CloudConnectorRepository(input.database);
@@ -313,10 +315,41 @@ export class CloudConnectorController {
         this.#state = "connecting";
         return this.status();
     }
+    async submitBug(rawInput) {
+        const input = supportBugCreatePayloadSchema.parse(rawInput);
+        if (this.input.environment.HELYX_SUPPORT_SERVICE_SECRET)
+            return this.#submitHostedBug(input);
+        const session = this.#activeSupport;
+        if (!this.input.environment.HELYX_CLOUD_CONNECT_ENABLED ||
+            this.#state !== "online" ||
+            !session?.capabilities.includes("support.bug.create.v1"))
+            throw new CloudConnectorUserError("This deployment is not connected to Helyx Support");
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.#pendingSupport.delete(input.correlationId);
+                reject(new Error("support_request_timed_out"));
+            }, CLOUD_DEFAULT_REQUEST_TIMEOUT_MS);
+            timer.unref();
+            this.#pendingSupport.set(input.correlationId, {
+                resolve,
+                reject,
+                timer,
+            });
+            try {
+                session.send(input.correlationId, input);
+            }
+            catch (error) {
+                clearTimeout(timer);
+                this.#pendingSupport.delete(input.correlationId);
+                reject(error instanceof Error ? error : new Error("support_send_failed"));
+            }
+        });
+    }
     async stop() {
         this.#stopping = true;
         this.#state = "stopped";
         this.#socket?.close(1001, "Helyx bot shutting down");
+        this.#rejectPendingSupport("Cloud Connect stopped");
         await this.#loop?.catch(() => undefined);
     }
     #ensureLoop() {
@@ -392,6 +425,8 @@ export class CloudConnectorController {
                 clearInterval(heartbeat);
                 clearTimeout(plannedReconnect);
                 this.#socket = undefined;
+                this.#activeSupport = undefined;
+                this.#rejectPendingSupport("Cloud Connect disconnected");
                 if (this.#stopping)
                     resolveFinished();
                 else
@@ -412,6 +447,19 @@ export class CloudConnectorController {
                         if (accepted.success) {
                             incomingGuard = new ConnectionSequenceGuard(identity.installationId, accepted.data.connectionEpoch);
                             this.#state = "online";
+                            this.#activeSupport = {
+                                capabilities: accepted.data.capabilities,
+                                send: (correlationId, payload) => {
+                                    socket.send(JSON.stringify(connectedMessage({
+                                        type: "support.request",
+                                        installationId: identity.installationId,
+                                        connectionEpoch: accepted.data.connectionEpoch,
+                                        sequence: ++outgoingSequence,
+                                        correlationId,
+                                        payload,
+                                    })));
+                                },
+                            };
                             this.#lastErrorCode = undefined;
                             await this.#repository.markConnected();
                             this.#identity = {
@@ -455,6 +503,18 @@ export class CloudConnectorController {
                         }
                         const message = connectedCloudMessageSchema.parse(payload);
                         incomingGuard?.accept(message);
+                        if (message.type === "support.response") {
+                            const pending = this.#pendingSupport.get(message.correlationId);
+                            if (!pending)
+                                return;
+                            clearTimeout(pending.timer);
+                            this.#pendingSupport.delete(message.correlationId);
+                            if (message.payload.ok)
+                                pending.resolve(message.payload.result);
+                            else
+                                pending.reject(new Error(message.payload.error.code));
+                            return;
+                        }
                         if (message.type !== "control.request")
                             return;
                         const response = await this.#dispatch(message.payload, message.correlationId);
@@ -535,6 +595,54 @@ export class CloudConnectorController {
             });
         }
     }
+    async #submitHostedBug(input) {
+        let response;
+        try {
+            response = await fetch(`${this.input.environment.HELYX_CLOUD_API_URL.replace(/\/$/u, "")}/v1/internal/discord-bugs`, {
+                method: "POST",
+                headers: {
+                    Accept: "application/json",
+                    Authorization: `Bearer ${this.input.environment.HELYX_SUPPORT_SERVICE_SECRET}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    source: "discord_command",
+                    transport: "hosted",
+                    reporterDiscordUserId: input.reporterDiscordUserId,
+                    guildId: input.guildId,
+                    moduleOrArea: input.moduleOrArea,
+                    summary: input.summary,
+                    whatHappened: input.whatHappened,
+                    ...(input.extraDetail ? { extraDetail: input.extraDetail } : {}),
+                    interactionId: input.interactionId,
+                    correlationId: input.correlationId,
+                }),
+                signal: AbortSignal.timeout(CLOUD_DEFAULT_REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch {
+            throw new Error("support_api_unavailable");
+        }
+        const payload = z
+            .object({
+            reference: z.string().trim().min(1).max(40),
+            created: z.boolean(),
+        })
+            .strict()
+            .safeParse(await response.json().catch(() => null));
+        if (!response.ok || !payload.success)
+            throw new Error(response.status === 429
+                ? "support_rate_limited"
+                : "support_api_rejected");
+        return payload.data;
+    }
+    #rejectPendingSupport(message) {
+        for (const pending of this.#pendingSupport.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(new Error(message));
+        }
+        this.#pendingSupport.clear();
+    }
     async #readBootstrap() {
         const environmentToken = this.input.environment.HELYX_CLOUD_ENROLMENT_TOKEN;
         const filePath = resolve(process.cwd(), this.input.environment.HELYX_CLOUD_ENROLMENT_FILE);
@@ -615,7 +723,16 @@ function connectorCapabilities() {
         "guild.module.permissions.write.v1",
         "guild.module.logging.write.v1",
         "guild.module.action.execute.v1",
+        "guild.module.resource.list.v1",
+        "guild.module.resource.read.v1",
+        "guild.module.resource.relation.list.v1",
+        "guild.module.resource.preview.v1",
+        "guild.module.resource.create.v1",
+        "guild.module.resource.update.v1",
+        "guild.module.resource.delete.v1",
+        "guild.module.resource.action.execute.v1",
         "support.guild.snapshot.read.v1",
+        "support.bug.create.v1",
     ];
 }
 function normalizeEnrolmentToken(value) {

package/dist/cloud-control-dispatcher.js

@@ -70,6 +70,90 @@ export class CloudControlDispatcher {
                 });
                 break;
             }
+            case "guild.module.resource.list.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.listManagedResources({
+                    guildId: input.guildId,
+                    moduleId: input.moduleId,
+                    resourceType: input.resourceType,
+                    ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+                    ...(input.search === undefined ? {} : { search: input.search }),
+                    ...(input.filters === undefined ? {} : { filters: input.filters }),
+                    limit: input.limit,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.readManagedResource({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.relation.list.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.listManagedResourceRelation({
+                    guildId: input.guildId,
+                    moduleId: input.moduleId,
+                    resourceType: input.resourceType,
+                    resourceId: input.resourceId,
+                    relationId: input.relationId,
+                    ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+                    limit: input.limit,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.preview.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.previewManagedResource({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.create.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.createManagedResource({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.update.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.updateManagedResource({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.delete.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.deleteManagedResource({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.resource.action.execute.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.executeManagedResourceAction({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
             case "support.guild.snapshot.read.v1": {
                 const input = parseOperationInput(request.operation, request.input);
                 if (request.actor.kind !== "helyx_staff")

package/dist/control-server.d.ts

@@ -1,5 +1,5 @@
 import { type DatabasePool } from "@helyx/database";
-import { type DashboardActionResult, type MessageResponse, type ModuleDefinition, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type ServiceAccess } from "@helyx/sdk";
+import { type DashboardActionResult, type ManagedResourceCreationIntent, type ManagedResourceDetail, type ManagedResourcePage, type ManagedResourceRelationPage, type ManagedResourceValue, type MessageResponse, type ModuleDefinition, type PermissionActor, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type ServiceAccess } from "@helyx/sdk";
 import { type Client } from "discord.js";
 import { type FastifyInstance } from "fastify";
 import { type ShardHealthSnapshot } from "./shard-contracts.js";
@@ -27,6 +27,7 @@ interface DashboardActionDefinition {
     buttonLabel: string;
     style: "primary" | "secondary" | "danger";
 }
+type DashboardResourceDefinition = NonNullable<NonNullable<ModuleDefinition["manifest"]["dashboard"]>["resources"]>[number];
 interface DashboardModuleDefinition {
     id: string;
     name: string;
@@ -41,6 +42,7 @@ interface DashboardModuleDefinition {
     commands: DashboardCommandDefinition[];
     logEvents: DashboardLogEventDefinition[];
     actions: DashboardActionDefinition[];
+    resources: readonly DashboardResourceDefinition[];
 }
 interface DashboardLoggingPolicy {
     eventId: string;
@@ -75,6 +77,10 @@ export interface BotControlGuildResourceDirectory {
         messageId: string;
     }>;
     deleteChannelMessage(channelId: string, messageId: string): Promise<void>;
+    editChannelMessage(channelId: string, messageId: string, response: MessageResponse): Promise<void>;
+    addChannelMessageReaction(channelId: string, messageId: string, emojiIdentifier: string): Promise<void>;
+    resolveActor(guildId: string, actorUserId: string): Promise<PermissionActor>;
+    sendPrivateSupportNotification?(guildId: string, channelId: string, response: MessageResponse, notificationId: string): Promise<void>;
 }
 export declare class DiscordGuildResourceDirectory implements BotControlGuildResourceDirectory {
     private readonly client;
@@ -84,6 +90,18 @@ export declare class DiscordGuildResourceDirectory implements BotControlGuildRes
         messageId: string;
     }>;
     deleteChannelMessage(channelId: string, messageId: string): Promise<void>;
+    editChannelMessage(channelId: string, messageId: string, response: MessageResponse): Promise<void>;
+    addChannelMessageReaction(channelId: string, messageId: string, emojiIdentifier: string): Promise<void>;
+    resolveActor(guildId: string, actorUserId: string): Promise<PermissionActor>;
+    sendPrivateSupportNotification(guildId: string, channelId: string, response: MessageResponse, notificationId: string): Promise<void>;
+}
+export interface SupportNotificationInput {
+    notificationId: string;
+    reference: string;
+    caseType: "bug" | "general_support" | "security";
+    categoryOrModule: string;
+    reportedSeverity: "low" | "medium" | "high" | "critical" | null;
+    source: "dashboard_bug" | "dashboard_support" | "dashboard_security" | "discord_command";
 }
 export interface BotControlState {
     channels: BotControlGuildResources["channels"];
@@ -98,6 +116,7 @@ export interface BotControlState {
     logging: Record<string, DashboardLoggingPolicy[]>;
 }
 export interface BotControlHandler {
+    sendSupportNotification(input: SupportNotificationInput): Promise<void>;
     getGuildState(guildId: string): Promise<BotControlState>;
     setModuleStatus(input: {
         guildId: string;
@@ -140,6 +159,85 @@ export interface BotControlHandler {
         actorUserId: string;
         correlationId: string;
     }): Promise<DashboardActionResult>;
+    listManagedResources(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        cursor?: string;
+        limit: number;
+        search?: string;
+        filters?: Readonly<Record<string, string>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourcePage>;
+    readManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail>;
+    listManagedResourceRelation(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        relationId: string;
+        cursor?: string;
+        limit: number;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceRelationPage>;
+    previewManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<MessageResponse>;
+    createManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        intent: ManagedResourceCreationIntent;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail>;
+    updateManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        expectedRevision: number;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail>;
+    deleteManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        expectedRevision: number;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<{
+        deleted: boolean;
+    }>;
+    executeManagedResourceAction(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        actionId: string;
+        expectedRevision: number;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail | null>;
     listPrivacyProviders(): Promise<readonly {
         id: string;
         version: number;
@@ -163,14 +261,19 @@ export interface BotControlHandler {
     }): Promise<PrivacyErasePage>;
 }
 export declare class BotControlTransportError extends Error {
-    readonly status: 400 | 404 | 409 | 502 | 503 | 504;
-    constructor(status: 400 | 404 | 409 | 502 | 503 | 504, message: string);
+    readonly status: 400 | 403 | 404 | 409 | 502 | 503 | 504;
+    constructor(status: 400 | 403 | 404 | 409 | 502 | 503 | 504, message: string);
 }
 export declare class BotControlService implements BotControlHandler {
     #private;
     private readonly database;
     private readonly resources;
-    constructor(database: DatabasePool, modules: readonly ModuleDefinition[], resources: BotControlGuildResourceDirectory, services: ServiceAccess, privacyExecutor?: PrivacyProviderExecutor);
+    private readonly supportNotifications?;
+    constructor(database: DatabasePool, modules: readonly ModuleDefinition[], resources: BotControlGuildResourceDirectory, services: ServiceAccess, privacyExecutor?: PrivacyProviderExecutor, supportNotifications?: {
+        guildId: string;
+        channelId: string;
+    } | undefined);
+    sendSupportNotification(input: SupportNotificationInput): Promise<void>;
     listPrivacyProviders(): Promise<readonly {
         id: string;
         version: number;
@@ -234,6 +337,85 @@ export declare class BotControlService implements BotControlHandler {
         actorUserId: string;
         correlationId: string;
     }): Promise<DashboardActionResult>;
+    listManagedResources(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        cursor?: string;
+        limit: number;
+        search?: string;
+        filters?: Readonly<Record<string, string>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourcePage>;
+    readManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail>;
+    listManagedResourceRelation(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        relationId: string;
+        cursor?: string;
+        limit: number;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceRelationPage>;
+    previewManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<MessageResponse>;
+    createManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        intent: ManagedResourceCreationIntent;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail>;
+    updateManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        expectedRevision: number;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail>;
+    deleteManagedResource(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        expectedRevision: number;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<{
+        deleted: boolean;
+    }>;
+    executeManagedResourceAction(input: {
+        guildId: string;
+        moduleId: string;
+        resourceType: string;
+        resourceId: string;
+        actionId: string;
+        expectedRevision: number;
+        value: Readonly<Record<string, ManagedResourceValue>>;
+        actorUserId: string;
+        correlationId: string;
+    }): Promise<ManagedResourceDetail | null>;
 }
 export declare function createBotControlServer(input: {
     service: BotControlHandler;
@@ -244,7 +426,7 @@ export declare function createBotControlServer(input: {
     shardHealth?: () => Promise<ShardHealthSnapshot>;
 }): Promise<FastifyInstance>;
 export declare function mapBotControlError(error: unknown): {
-    status: 400 | 404 | 409;
+    status: 400 | 403 | 404 | 409;
     message: string;
 } | undefined;
 export {};