@helyx/bot 0.4.2 → 0.4.4

package/dist/control-server.js

@@ -1,10 +1,11 @@
 import { AuditRepository, InstallationRepository, ModuleLoggingPolicyRepository, OptimisticConcurrencyError, PermissionPolicyRepository, withTransaction, } from "@helyx/database";
 import { DashboardActionValidationError, HELYX_SERVICE_NAMES, ModuleStateValidationError, } from "@helyx/sdk";
-import { ChannelType } from "discord.js";
+import { canUseCommand } from "@helyx/core";
+import { ChannelType, PermissionFlagsBits } from "discord.js";
 import Fastify, {} from "fastify";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { z, ZodError } from "zod";
-import { deleteChannelMessage as deleteDiscordChannelMessage, sendToChannel as sendDiscordMessageToChannel, } from "./interactions.js";
+import { addChannelMessageReaction as addDiscordChannelMessageReaction, deleteChannelMessage as deleteDiscordChannelMessage, editChannelMessage as editDiscordChannelMessage, normalizeDiscordPermission, sendToChannel as sendDiscordMessageToChannel, } from "./interactions.js";
 import { SHARD_HEALTH_STALE_MS, } from "./shard-contracts.js";
 const snowflake = z.string().regex(/^\d{17,20}$/u);
 const moduleId = z.string().regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/u);
@@ -41,6 +42,55 @@ const mutationContext = z.object({
     actorUserId: snowflake,
     correlationId: z.uuid(),
 });
+const resourceId = z.string().trim().min(1).max(100);
+const resourceCursor = z.string().min(1).max(2_048);
+const resourceActionId = z.string().regex(/^[a-z][a-z0-9_-]*$/u);
+const managedResourceFilters = z
+    .record(z.string().regex(/^[a-z][a-zA-Z0-9_]*$/u), z.string().trim().min(1).max(100))
+    .refine((value) => Object.keys(value).length <= 5);
+const managedResourceValue = z.custom((value) => isBoundedManagedResourceValue(value), "Managed resource value exceeds the transport limits");
+const managedResourceObject = z
+    .record(z.string().min(1).max(100), managedResourceValue)
+    .refine(hasBoundedManagedResourceBytes);
+const managedResourceSummarySchema = z
+    .object({
+    id: resourceId,
+    revision: z.number().int().min(0),
+    status: z.string().trim().min(1).max(100),
+    title: z.string().trim().min(1).max(200),
+    description: z.string().max(500).optional(),
+    attributes: managedResourceObject.optional(),
+    updatedAt: z.iso.datetime({ offset: true }),
+})
+    .strict();
+const managedResourceDetailSchema = managedResourceSummarySchema
+    .extend({ value: managedResourceObject })
+    .strict()
+    .refine(hasBoundedManagedResourceBytes);
+const managedResourcePageSchema = z
+    .object({
+    items: z.array(managedResourceSummarySchema).max(50),
+    nextCursor: resourceCursor.optional(),
+})
+    .strict()
+    .refine(hasBoundedManagedResourceBytes);
+const managedResourceRelationPageSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        id: resourceId,
+        value: managedResourceObject,
+    })
+        .strict())
+        .max(50),
+    nextCursor: resourceCursor.optional(),
+})
+    .strict()
+    .refine(hasBoundedManagedResourceBytes);
+const managedResourceDeleteResultSchema = z
+    .object({ deleted: z.boolean() })
+    .strict();
 export class DiscordGuildResourceDirectory {
     client;
     constructor(client) {
@@ -87,6 +137,55 @@ export class DiscordGuildResourceDirectory {
     deleteChannelMessage(channelId, messageId) {
         return deleteDiscordChannelMessage(this.client, channelId, messageId);
     }
+    editChannelMessage(channelId, messageId, response) {
+        return editDiscordChannelMessage(this.client, channelId, messageId, response);
+    }
+    addChannelMessageReaction(channelId, messageId, emojiIdentifier) {
+        return addDiscordChannelMessageReaction(this.client, channelId, messageId, emojiIdentifier);
+    }
+    async resolveActor(guildId, actorUserId) {
+        try {
+            const guild = await this.client.guilds.fetch(guildId);
+            const member = await guild.members.fetch(actorUserId);
+            return {
+                userId: member.id,
+                roleIds: [...member.roles.cache.keys()],
+                permissions: member.permissions
+                    .toArray()
+                    .map(normalizeDiscordPermission),
+                isServerOwner: guild.ownerId === member.id,
+                isAdministrator: member.permissions.has(PermissionFlagsBits.Administrator),
+            };
+        }
+        catch (error) {
+            if (isUnknownGuildError(error))
+                throw new BotControlNotFoundError();
+            if (isUnknownMemberError(error))
+                throw new BotControlForbiddenError();
+            throw error;
+        }
+    }
+    async sendPrivateSupportNotification(guildId, channelId, response, notificationId) {
+        let guild;
+        try {
+            guild = await this.client.guilds.fetch(guildId);
+        }
+        catch (error) {
+            if (isUnknownGuildError(error))
+                throw new BotControlNotFoundError();
+            throw error;
+        }
+        const channel = await guild.channels.fetch(channelId);
+        if (!channel ||
+            (channel.type !== ChannelType.GuildText &&
+                channel.type !== ChannelType.GuildAnnouncement) ||
+            !channel.isSendable() ||
+            channel
+                .permissionsFor(guild.roles.everyone)
+                ?.has(PermissionFlagsBits.ViewChannel))
+            throw new BotControlNotFoundError("The support notification channel is missing or not private");
+        await sendDiscordMessageToChannel(this.client, channel.id, response, notificationId);
+    }
 }
 export class BotControlTransportError extends Error {
     status;
@@ -99,6 +198,7 @@ export class BotControlTransportError extends Error {
 export class BotControlService {
     database;
     resources;
+    supportNotifications;
     #modules;
     #dashboardModules;
     #configurations;
@@ -106,9 +206,10 @@ export class BotControlService {
     #permissions;
     #services;
     #privacyProviders;
-    constructor(database, modules, resources, services, privacyExecutor) {
+    constructor(database, modules, resources, services, privacyExecutor, supportNotifications) {
         this.database = database;
         this.resources = resources;
+        this.supportNotifications = supportNotifications;
         this.#modules = new Map(modules.map((module) => [module.manifest.id, module]));
         this.#dashboardModules = modules
             .filter((module) => module.manifest.dashboard !== undefined)
@@ -126,6 +227,40 @@ export class BotControlService {
             })
             : []);
     }
+    async sendSupportNotification(input) {
+        if (!this.supportNotifications)
+            throw new BotControlNotFoundError("The support notification channel is not configured");
+        if (!this.resources.sendPrivateSupportNotification)
+            throw new BotControlTransportError(503, "Support notification delivery is temporarily unavailable");
+        const caseType = {
+            bug: "Bug",
+            general_support: "General support",
+            security: "Security report",
+        }[input.caseType];
+        const source = input.source === "discord_command" ? "/bug" : "Dashboard";
+        const severity = input.reportedSeverity
+            ? `${input.reportedSeverity[0].toUpperCase()}${input.reportedSeverity.slice(1)}`
+            : "Untriaged";
+        await this.resources.sendPrivateSupportNotification(this.supportNotifications.guildId, this.supportNotifications.channelId, {
+            embed: {
+                title: input.caseType === "security" ||
+                    input.reportedSeverity === "critical"
+                    ? "Urgent support case received"
+                    : "New support case",
+                description: [
+                    `**${input.reference}**`,
+                    `Case type: ${caseType}`,
+                    `Category or module: ${input.categoryOrModule}`,
+                    `Severity: ${severity}`,
+                    `Source: ${source}`,
+                ].join("\n"),
+                color: input.caseType === "security" ||
+                    input.reportedSeverity === "critical"
+                    ? 0xdc2626
+                    : 0x7c3aed,
+            },
+        }, input.notificationId);
+    }
     listPrivacyProviders() {
         return Promise.resolve([...this.#privacyProviders.values()]
             .map((provider) => ({
@@ -391,6 +526,7 @@ export class BotControlService {
         if (!(await new InstallationRepository(this.database).isModuleEnabled(input.guildId, input.moduleId))) {
             throw new BotControlValidationError("Enable this module before running its dashboard actions");
         }
+        await this.#authorizeAction(input.guildId, module, input.actorUserId, dashboardActionPermissionId(module, input.actionId));
         return action.execute({
             guildId: input.guildId,
             actorUserId: input.actorUserId,
@@ -400,6 +536,151 @@ export class BotControlService {
             deleteChannelMessage: (channelId, messageId) => this.resources.deleteChannelMessage(channelId, messageId),
         });
     }
+    async listManagedResources(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "list");
+        this.#validateManagedResourceQuery(module, input.resourceType, input);
+        const result = await resource.list(await this.#managedResourceContext(input, module, "list"), {
+            ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+            limit: input.limit,
+            ...(input.search === undefined ? {} : { search: input.search }),
+            ...(input.filters === undefined ? {} : { filters: input.filters }),
+        });
+        return normalizeManagedResourcePage(managedResourcePageSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
+    }
+    async readManagedResource(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "read");
+        const result = await resource.read(await this.#managedResourceContext(input, module, "read"), input.resourceId);
+        if (!result)
+            throw new BotControlNotFoundError("Managed resource was not found");
+        return normalizeManagedResourceDetail(managedResourceDetailSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
+    }
+    async listManagedResourceRelation(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "read");
+        const relation = module.manifest.dashboard?.resources
+            ?.find(({ id }) => id === input.resourceType)
+            ?.relations?.find(({ id }) => id === input.relationId);
+        if (!relation || !resource.listRelation)
+            throw new BotControlNotFoundError("Managed resource relation is not declared by this module");
+        const context = await this.#managedResourceContext(input, module, "read", relation.permissionId);
+        return normalizeManagedResourceRelationPage(managedResourceRelationPageSchema.parse(await resource.listRelation(context, input.resourceId, input.relationId, {
+            ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+            limit: input.limit,
+        })), relation.columns.map(({ key }) => key));
+    }
+    async previewManagedResource(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "preview");
+        return resource.preview(await this.#managedResourceContext(input, module, "preview"), input.value);
+    }
+    async createManagedResource(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "create");
+        const context = await this.#managedResourceContext(input, module, "create");
+        const declaredIntents = module.manifest.dashboard?.resources?.find(({ id }) => id === input.resourceType)?.creationIntents ?? ["publish"];
+        if (!declaredIntents.includes(input.intent))
+            throw new DashboardActionValidationError("This creation intent is not declared by the module.");
+        return normalizeManagedResourceDetail(managedResourceDetailSchema.parse(await resource.create(context, input.value, input.intent)), managedResourceColumnKeys(module, input.resourceType));
+    }
+    async updateManagedResource(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "update");
+        return normalizeManagedResourceDetail(managedResourceDetailSchema.parse(await resource.update(await this.#managedResourceContext(input, module, "update"), {
+            resourceId: input.resourceId,
+            expectedRevision: input.expectedRevision,
+            value: input.value,
+        })), managedResourceColumnKeys(module, input.resourceType));
+    }
+    async deleteManagedResource(input) {
+        const { module, resource } = await this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "delete");
+        return managedResourceDeleteResultSchema.parse(await resource.delete(await this.#managedResourceContext(input, module, "delete"), {
+            resourceId: input.resourceId,
+            expectedRevision: input.expectedRevision,
+        }));
+    }
+    async executeManagedResourceAction(input) {
+        const module = this.#requireDashboardModule(input.moduleId);
+        const declared = module.manifest.dashboard?.resources
+            ?.find(({ id }) => id === input.resourceType)
+            ?.actions?.find(({ id }) => id === input.actionId);
+        const resource = this.#requireManagedResource(module, input.resourceType);
+        this.#requireManagedResourceOperation(module, input.resourceType, "action");
+        if (!declared)
+            throw new BotControlNotFoundError("Managed resource action is not declared by this module");
+        await this.#requireEnabledManagedResource(input.guildId, input.moduleId);
+        const permissionId = managedResourcePermissionId(module, input.resourceType, "action", input.actionId, declared.permissionId);
+        const context = await this.#managedResourceContext(input, module, "action", permissionId);
+        validateManagedResourceActionValue(declared.inputs ?? [], input.value);
+        const result = await resource.executeAction(context, {
+            resourceId: input.resourceId,
+            actionId: input.actionId,
+            expectedRevision: input.expectedRevision,
+            value: input.value,
+        });
+        return result === null
+            ? null
+            : normalizeManagedResourceDetail(managedResourceDetailSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
+    }
+    async #prepareManagedResource(input) {
+        const module = this.#requireDashboardModule(input.moduleId);
+        const resource = this.#requireManagedResource(module, input.resourceType);
+        await this.#requireEnabledManagedResource(input.guildId, input.moduleId);
+        return { module, resource };
+    }
+    #requireManagedResource(module, resourceType) {
+        const declared = module.manifest.dashboard?.resources?.some(({ id }) => id === resourceType);
+        const resource = module.managedResources?.find(({ id }) => id === resourceType);
+        if (!declared || !resource)
+            throw new BotControlNotFoundError("Managed resource is not declared by this module");
+        return resource;
+    }
+    #requireManagedResourceOperation(module, resourceType, operation) {
+        const declared = module.manifest.dashboard?.resources?.find(({ id }) => id === resourceType);
+        if (!declared ||
+            (declared.operations !== undefined &&
+                !declared.operations.includes(operation)))
+            throw new BotControlNotFoundError("Managed resource operation is not declared by this module");
+    }
+    #validateManagedResourceQuery(module, resourceType, input) {
+        const query = module.manifest.dashboard?.resources?.find(({ id }) => id === resourceType)?.query;
+        if (input.search !== undefined && !query?.search)
+            throw new BotControlValidationError("Managed resource search is not declared by this module");
+        for (const [key, value] of Object.entries(input.filters ?? {})) {
+            const filter = query?.filters?.find((candidate) => candidate.key === key);
+            if (!filter)
+                throw new BotControlValidationError("Managed resource filter is not declared by this module");
+            if (filter.type === "select" &&
+                !filter.options.some((option) => option.value === value))
+                throw new BotControlValidationError("Managed resource filter value is not declared by this module");
+        }
+    }
+    async #requireEnabledManagedResource(guildId, moduleIdValue) {
+        if (!(await new InstallationRepository(this.database).isModuleEnabled(guildId, moduleIdValue)))
+            throw new BotControlValidationError("Enable this module before managing its resources");
+    }
+    async #managedResourceContext(input, module, operation, permissionId = managedResourcePermissionId(module, input.resourceType, operation)) {
+        const actor = await this.#authorizeAction(input.guildId, module, input.actorUserId, permissionId);
+        return {
+            guildId: input.guildId,
+            actor,
+            correlationId: input.correlationId,
+            services: this.#services,
+            sendToChannel: (channelId, response) => this.resources.sendToChannel(channelId, response),
+            deleteChannelMessage: (channelId, messageId) => this.resources.deleteChannelMessage(channelId, messageId),
+            editChannelMessage: (channelId, messageId, response) => this.resources.editChannelMessage(channelId, messageId, response),
+            addChannelMessageReaction: (channelId, messageId, emojiIdentifier) => this.resources.addChannelMessageReaction(channelId, messageId, emojiIdentifier),
+        };
+    }
+    async #authorizeAction(guildId, module, actorUserId, permissionId) {
+        const actor = await this.resources.resolveActor(guildId, actorUserId);
+        const policy = await this.#permissions.getEffectivePolicy(guildId, module.manifest.id, permissionId);
+        if (!canUseCommand(actor, policy))
+            throw new BotControlForbiddenError();
+        return actor;
+    }
     #requireModule(moduleIdValue) {
         const module = this.#modules.get(moduleIdValue);
         if (!module)
@@ -570,6 +851,28 @@ export async function createBotControlServer(input) {
         };
     });
     server.get("/v1/privacy/providers", () => input.service.listPrivacyProviders());
+    server.post("/v1/support/notifications", async (request, reply) => {
+        const body = z
+            .object({
+            notificationId: z.uuid(),
+            reference: z.string().trim().min(1).max(40),
+            caseType: z.enum(["bug", "general_support", "security"]),
+            categoryOrModule: z.string().trim().min(1).max(100),
+            reportedSeverity: z
+                .enum(["low", "medium", "high", "critical"])
+                .nullable(),
+            source: z.enum([
+                "dashboard_bug",
+                "dashboard_support",
+                "dashboard_security",
+                "discord_command",
+            ]),
+        })
+            .strict()
+            .parse(request.body);
+        await input.service.sendSupportNotification(body);
+        return reply.code(204).send();
+    });
     server.post("/v1/privacy/capture", async (request) => {
         const body = z
             .object({
@@ -630,6 +933,181 @@ export async function createBotControlServer(input) {
         const body = mutationContext.parse(request.body);
         return input.service.executeDashboardAction({ ...params, ...body });
     });
+    server.get("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+        })
+            .strict()
+            .parse(request.params);
+        const query = z
+            .object({
+            cursor: resourceCursor.optional(),
+            limit: z.coerce.number().int().min(1).max(50).default(50),
+            search: z.string().trim().min(1).max(200).optional(),
+            filters: z
+                .preprocess((value) => {
+                if (typeof value !== "string")
+                    return value;
+                if (value.length > 2_048)
+                    return value;
+                try {
+                    return JSON.parse(value);
+                }
+                catch {
+                    return value;
+                }
+            }, managedResourceFilters)
+                .optional(),
+            actorUserId: snowflake,
+            correlationId: z.uuid(),
+        })
+            .strict()
+            .parse(request.query);
+        return input.service.listManagedResources({
+            ...params,
+            ...(query.cursor === undefined ? {} : { cursor: query.cursor }),
+            ...(query.search === undefined ? {} : { search: query.search }),
+            ...(query.filters === undefined ? {} : { filters: query.filters }),
+            limit: query.limit,
+            actorUserId: query.actorUserId,
+            correlationId: query.correlationId,
+        });
+    });
+    server.get("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType/:resourceId", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+            resourceId,
+        })
+            .strict()
+            .parse(request.params);
+        const query = mutationContext.strict().parse(request.query);
+        return input.service.readManagedResource({ ...params, ...query });
+    });
+    server.get("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType/:resourceId/relations/:relationId", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+            resourceId,
+            relationId: resourceActionId,
+        })
+            .strict()
+            .parse(request.params);
+        const query = z
+            .object({
+            cursor: resourceCursor.optional(),
+            limit: z.coerce.number().int().min(1).max(50).default(50),
+            actorUserId: snowflake,
+            correlationId: z.uuid(),
+        })
+            .strict()
+            .parse(request.query);
+        return input.service.listManagedResourceRelation({
+            ...params,
+            ...(query.cursor === undefined ? {} : { cursor: query.cursor }),
+            limit: query.limit,
+            actorUserId: query.actorUserId,
+            correlationId: query.correlationId,
+        });
+    });
+    server.post("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType/preview", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+        })
+            .strict()
+            .parse(request.params);
+        const body = mutationContext
+            .extend({ value: managedResourceObject })
+            .strict()
+            .parse(request.body);
+        return input.service.previewManagedResource({ ...params, ...body });
+    });
+    server.post("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+        })
+            .strict()
+            .parse(request.params);
+        const body = mutationContext
+            .extend({
+            intent: z.enum(["draft", "publish"]).optional().default("publish"),
+            value: managedResourceObject,
+        })
+            .strict()
+            .parse(request.body);
+        return input.service.createManagedResource({ ...params, ...body });
+    });
+    server.put("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType/:resourceId", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+            resourceId,
+        })
+            .strict()
+            .parse(request.params);
+        const body = mutationContext
+            .extend({
+            expectedRevision: z.number().int().min(0),
+            value: managedResourceObject.optional().default({}),
+        })
+            .strict()
+            .parse(request.body);
+        return input.service.updateManagedResource({ ...params, ...body });
+    });
+    server.delete("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType/:resourceId", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+            resourceId,
+        })
+            .strict()
+            .parse(request.params);
+        const body = mutationContext
+            .extend({ expectedRevision: z.number().int().min(0) })
+            .strict()
+            .parse(request.body);
+        return input.service.deleteManagedResource({ ...params, ...body });
+    });
+    server.post("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType/:resourceId/actions/:actionId", async (request) => {
+        const params = z
+            .object({
+            guildId: snowflake,
+            moduleId,
+            resourceType: resourceActionId,
+            resourceId,
+            actionId: resourceActionId,
+        })
+            .strict()
+            .parse(request.params);
+        const body = mutationContext
+            .extend({
+            expectedRevision: z.number().int().min(0),
+            value: managedResourceObject,
+        })
+            .strict()
+            .parse(request.body);
+        return input.service.executeManagedResourceAction({
+            ...params,
+            ...body,
+        });
+    });
     server.put("/v1/guilds/:guildId/modules/:moduleId/configuration", async (request) => {
         const params = z
             .object({ guildId: snowflake, moduleId })
@@ -690,6 +1168,8 @@ export function mapBotControlError(error) {
         return { status: 400, message: error.message };
     if (error instanceof BotControlNotFoundError)
         return { status: 404, message: error.message };
+    if (error instanceof BotControlForbiddenError)
+        return { status: 403, message: error.message };
     if (error instanceof OptimisticConcurrencyError)
         return {
             status: 409,
@@ -705,6 +1185,12 @@ class BotControlNotFoundError extends Error {
         this.name = "BotControlNotFoundError";
     }
 }
+class BotControlForbiddenError extends Error {
+    constructor(message = "You no longer have permission to perform this action") {
+        super(message);
+        this.name = "BotControlForbiddenError";
+    }
+}
 function digest(value) {
     return createHash("sha256").update(value).digest();
 }
@@ -714,6 +1200,181 @@ function isUnknownGuildError(error) {
         "code" in error &&
         error.code === 10_004);
 }
+function isUnknownMemberError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === 10_007);
+}
+function dashboardActionPermissionId(module, actionId) {
+    const namespace = modulePermissionNamespace(module);
+    return selectDeclaredPermission(module, [
+        `${namespace}.${actionId.replaceAll("-", ".")}`,
+        `${namespace}.configure`,
+    ]);
+}
+function managedResourcePermissionId(module, resourceType, operation, actionId, declaredPermissionId) {
+    if (declaredPermissionId)
+        return declaredPermissionId;
+    const namespace = modulePermissionNamespace(module);
+    const resourcePermission = `resource.${resourceType}`;
+    const candidates = operation === "create" || operation === "preview"
+        ? [`${resourcePermission}.create`, `${namespace}.create`]
+        : operation === "update"
+            ? [
+                `${resourcePermission}.update`,
+                `${namespace}.edit`,
+                `${namespace}.manage`,
+            ]
+            : operation === "delete"
+                ? [
+                    `${resourcePermission}.delete`,
+                    `${namespace}.delete`,
+                    `${namespace}.cancel`,
+                ]
+                : operation === "action" && actionId
+                    ? [
+                        `${resourcePermission}.${actionId}`,
+                        `${resourcePermission}.action.${actionId}`,
+                        `${resourcePermission}.action`,
+                        `${namespace}.${actionId.replaceAll("-", ".")}`,
+                        `${namespace}.manage`,
+                    ]
+                    : [
+                        `${resourcePermission}.${operation}`,
+                        `${namespace}.read`,
+                        `${namespace}.list`,
+                        `${namespace}.manage`,
+                        `${namespace}.entries.read`,
+                    ];
+    return selectDeclaredPermission(module, candidates);
+}
+function modulePermissionNamespace(module) {
+    return module.manifest.id.startsWith("helyx.")
+        ? module.manifest.id.slice("helyx.".length)
+        : module.manifest.id;
+}
+function selectDeclaredPermission(module, candidates) {
+    const declared = module.defaultPermissions?.commands ?? {};
+    return (candidates.find((candidate) => candidate in declared) ?? candidates[0]);
+}
+function isBoundedManagedResourceValue(value, depth = 0, budget = { keys: 0 }) {
+    if (depth > 8)
+        return false;
+    if (value === null ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value)))
+        return true;
+    if (typeof value === "string")
+        return value.length <= 4_000;
+    if (Array.isArray(value))
+        return (value.length <= 100 &&
+            value.every((item) => isBoundedManagedResourceValue(item, depth + 1, budget)));
+    if (typeof value !== "object")
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    const entries = Object.entries(value);
+    budget.keys += entries.length;
+    return (entries.length <= 100 &&
+        budget.keys <= 500 &&
+        entries.every(([key, item]) => key.length >= 1 &&
+            key.length <= 100 &&
+            isBoundedManagedResourceValue(item, depth + 1, budget)));
+}
+function hasBoundedManagedResourceBytes(value) {
+    return (new TextEncoder().encode(JSON.stringify(value)).byteLength <= 48 * 1_024);
+}
+function normalizeManagedResourceDetail(value, attributeKeys) {
+    return {
+        id: value.id,
+        revision: value.revision,
+        status: value.status,
+        title: value.title,
+        ...(value.description === undefined
+            ? {}
+            : { description: value.description }),
+        ...(value.attributes === undefined || attributeKeys.length === 0
+            ? {}
+            : {
+                attributes: projectManagedResourceObject(value.attributes, attributeKeys),
+            }),
+        updatedAt: value.updatedAt,
+        value: value.value,
+    };
+}
+function normalizeManagedResourcePage(value, attributeKeys) {
+    return {
+        items: value.items.map((item) => ({
+            id: item.id,
+            revision: item.revision,
+            status: item.status,
+            title: item.title,
+            ...(item.description === undefined
+                ? {}
+                : { description: item.description }),
+            ...(item.attributes === undefined || attributeKeys.length === 0
+                ? {}
+                : {
+                    attributes: projectManagedResourceObject(item.attributes, attributeKeys),
+                }),
+            updatedAt: item.updatedAt,
+        })),
+        ...(value.nextCursor === undefined ? {} : { nextCursor: value.nextCursor }),
+    };
+}
+function normalizeManagedResourceRelationPage(value, valueKeys) {
+    return {
+        items: value.items.map((item) => ({
+            id: item.id,
+            value: projectManagedResourceObject(item.value, valueKeys),
+        })),
+        ...(value.nextCursor === undefined ? {} : { nextCursor: value.nextCursor }),
+    };
+}
+function projectManagedResourceObject(value, declaredKeys) {
+    const allowed = new Set(declaredKeys);
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => allowed.has(key))
+        .map(([key, item]) => [key, structuredClone(item)]));
+}
+function managedResourceColumnKeys(module, resourceType) {
+    return (module.manifest.dashboard?.resources
+        ?.find(({ id }) => id === resourceType)
+        ?.columns?.map(({ key }) => key) ?? []);
+}
+function validateManagedResourceActionValue(inputs, value) {
+    const declared = new Map(inputs.map((input) => [input.key, input]));
+    for (const key of Object.keys(value))
+        if (!declared.has(key))
+            throw new DashboardActionValidationError(`The action value "${key}" is not declared by the module.`);
+    for (const input of inputs) {
+        const item = value[input.key];
+        if (item === undefined) {
+            if (input.required)
+                throw new DashboardActionValidationError(`${input.label} is required for this action.`);
+            continue;
+        }
+        const valid = input.type === "boolean"
+            ? typeof item === "boolean"
+            : input.type === "integer"
+                ? typeof item === "number" &&
+                    Number.isInteger(item) &&
+                    item >= input.minimum &&
+                    item <= input.maximum
+                : input.type === "select"
+                    ? typeof item === "string" &&
+                        input.options.some(({ value: option }) => option === item)
+                    : input.type === "discord-channel" || input.type === "discord-role"
+                        ? typeof item === "string" && snowflake.safeParse(item).success
+                        : typeof item === "string" &&
+                            item.length >= input.minLength &&
+                            item.length <= input.maxLength;
+        if (!valid)
+            throw new DashboardActionValidationError(`${input.label} is not a valid action value.`);
+    }
+}
 function mapDashboardModule(module) {
     const dashboard = module.manifest.dashboard;
     return {
@@ -730,12 +1391,15 @@ function mapDashboardModule(module) {
         commands: dashboardCommands(module),
         logEvents: (module.logging?.events ?? []).map((event) => ({ ...event })),
         actions: (dashboard.actions ?? []).map((action) => ({ ...action })),
+        resources: (dashboard.resources ?? []).map((resource) => structuredClone(resource)),
     };
 }
 function dashboardCommands(module) {
-    return (module.interactions?.commands ?? []).flatMap((command) => command.subcommands?.length
+    const commands = (module.interactions?.commands ?? []).flatMap((command) => command.subcommands?.length
         ? command.subcommands.map((subcommand) => {
-            const id = `${command.name}.${subcommand.name}`;
+            const id = subcommand.permissionId ??
+                command.permissionId ??
+                `${command.name}.${subcommand.name}`;
             return {
                 id,
                 name: `/${command.name} ${subcommand.name}`,
@@ -747,7 +1411,7 @@ function dashboardCommands(module) {
         })
         : [
             {
-                id: command.name,
+                id: command.permissionId ?? command.name,
                 name: `/${command.name}`,
                 description: command.description,
                 defaultPreset: toDashboardPolicy(module.defaultPermissions?.commands[command.name] ??
@@ -755,6 +1419,9 @@ function dashboardCommands(module) {
                     emptyPolicy()).preset,
             },
         ]);
+    return [
+        ...new Map(commands.map((command) => [command.id, command])).values(),
+    ];
 }
 function toDashboardPolicy(policy) {
     const preset = policy.everyone