@helyx/bot 0.4.2 → 0.4.5

package/dist/index.js

@@ -3,7 +3,7 @@ import { safeError, ServiceRegistry } from "@helyx/core";
 import { checkDatabaseConnection, createDatabasePool, InteractionSessionRepository, RateLimitRepository, runCoreMigrations, runConfiguredModuleMigrations, } from "@helyx/database";
 import { createRuntime } from "@helyx/framework";
 import { createPlatformServices, PostgresPrivacyProviderExecutor, } from "@helyx/platform";
-import { HELYX_SERVICE_NAMES } from "@helyx/sdk";
+import { HELYX_SERVICE_NAMES, } from "@helyx/sdk";
 import { Client, Events, GatewayIntentBits, Partials } from "discord.js";
 import pino from "pino";
 import { randomUUID } from "node:crypto";
@@ -14,17 +14,21 @@ import { ClientCloudDiscordDirectory, CloudConnectorController, } from "./cloud-
 import { createCloudManagementModule } from "./cloud-management-module.js";
 import { installInteractions } from "./interactions.js";
 import { installGuildTracking } from "./guilds.js";
-import { loadConfiguredModulePackages } from "./modules.js";
+import { loadConfiguredModulePackages, platformServiceOptions, } from "./modules.js";
 import { resolveModulePackageSpecifiers } from "./module-configuration.js";
 import { createPermissionsModule } from "./permissions-module.js";
 import { createManagementModule } from "./management-module.js";
-import { installModuleEvents } from "./events.js";
+import { DiscordMemberRoleService, DiscordResourceInspection, installModuleEvents, } from "./events.js";
 import { DiscordModuleLoggingService } from "./module-logging.js";
 import { BotControlService, createBotControlServer, DiscordGuildResourceDirectory, } from "./control-server.js";
 import { startShardSupervisor } from "./shard-supervisor.js";
 import { parseShardWorkerLaunchContract, startShardWorker, } from "./shard-worker.js";
 import { createDeveloperOperationsModule } from "./developer-operations-module.js";
 import { shardHealthSnapshotSchema } from "./shard-contracts.js";
+import { createSupportModule } from "./support-module.js";
+import { DiscordOwnedMessageDeletionService } from "./discord-owned-message-service.js";
+import { CoreResourceAuthorizationService } from "./resource-authorization.js";
+import { createLocalScheduledTaskRoute, createScheduledTaskRunner, schedulerOperationalHealth, } from "./scheduled-task-runner.js";
 export { loadConfiguredModulePackages } from "./modules.js";
 export { resolveModulePackageSpecifiers } from "./module-configuration.js";
 export * from "./control-server.js";
@@ -143,12 +147,15 @@ async function startUnshardedBot(processEnvironment) {
                 configuredOwnerUserIds: environment.HELYX_OWNER_USER_IDS,
             })
             : undefined;
+        const supportModule = createSupportModule(cloudConnector);
         const publicModules = [
             managementModule,
             permissionsModule,
+            supportModule,
             ...(cloudManagementModule ? [cloudManagementModule] : []),
             ...featureModules,
         ];
+        let scheduledTasks;
         const unshardedSupervisorId = randomUUID();
         const deployedCommit = deploymentReference(processEnvironment);
         const operationsModule = environment.DISCORD_INTERNAL_GUILD_ID
@@ -160,6 +167,7 @@ async function startUnshardedBot(processEnvironment) {
                 coreFunctions: [
                     managementModule,
                     permissionsModule,
+                    supportModule,
                     ...(cloudManagementModule ? [cloudManagementModule] : []),
                 ].map(({ manifest }) => manifest),
                 modules: featureModules.map(({ manifest }) => manifest),
@@ -174,6 +182,12 @@ async function startUnshardedBot(processEnvironment) {
                             databaseHealthy = false;
                         }
                         const ready = client.isReady();
+                        const scheduler = scheduledTasks
+                            ? await scheduledTasks
+                                .getHealth()
+                                .then(schedulerOperationalHealth)
+                                .catch(() => ({ status: "unavailable" }))
+                            : { status: "unavailable" };
                         const observedAt = new Date().toISOString();
                         const gatewayPingMs = Number.isFinite(client.ws.ping)
                             ? client.ws.ping
@@ -182,7 +196,7 @@ async function startUnshardedBot(processEnvironment) {
                             version: 1,
                             mode: "off",
                             scope: "local",
-                            status: ready && databaseHealthy
+                            status: ready && databaseHealthy && scheduler.status === "available"
                                 ? "healthy"
                                 : ready
                                     ? "degraded"
@@ -196,6 +210,7 @@ async function startUnshardedBot(processEnvironment) {
                                 redis: "not_required",
                                 database: databaseHealthy ? "healthy" : "unavailable",
                             },
+                            scheduler,
                             shards: [
                                 {
                                     shardId: 0,
@@ -219,7 +234,11 @@ async function startUnshardedBot(processEnvironment) {
             ...publicModules,
             ...(operationsModule ? [operationsModule] : []),
         ];
-        const platformServices = new Map(createPlatformServices(database, publicModules));
+        const platformServices = new Map(createPlatformServices(database, publicModules, platformServiceOptions(environment, publicModules)));
+        platformServices.set(HELYX_SERVICE_NAMES.resourceAuthorization, new CoreResourceAuthorizationService(platformServices.get(HELYX_SERVICE_NAMES.permissions)));
+        platformServices.set(HELYX_SERVICE_NAMES.discordOwnedMessages, new DiscordOwnedMessageDeletionService(client));
+        platformServices.set(HELYX_SERVICE_NAMES.memberRoles, new DiscordMemberRoleService(client));
+        platformServices.set(HELYX_SERVICE_NAMES.discordResources, new DiscordResourceInspection(client));
         if (featureModules.some(({ manifest }) => manifest.id === "helyx.logging")) {
             platformServices.set(HELYX_SERVICE_NAMES.moduleLogging, new DiscordModuleLoggingService(client, database, publicModules, bootstrapLogger));
         }
@@ -232,6 +251,7 @@ async function startUnshardedBot(processEnvironment) {
         const enabledCoreModuleIds = new Set([
             managementModule.manifest.id,
             permissionsModule.manifest.id,
+            supportModule.manifest.id,
             ...(cloudManagementModule ? [cloudManagementModule.manifest.id] : []),
             ...(operationsModule ? [operationsModule.manifest.id] : []),
         ]);
@@ -241,13 +261,10 @@ async function startUnshardedBot(processEnvironment) {
                 ? { internalGuildId: environment.DISCORD_INTERNAL_GUILD_ID }
                 : {}),
             prepare: prepareGuilds,
-            ...(operationsModule
-                ? {
-                    selfAuthorizingGuildModuleIds: new Set([
-                        operationsModule.manifest.id,
-                    ]),
-                }
-                : {}),
+            selfAuthorizingGuildModuleIds: new Set([
+                supportModule.manifest.id,
+                ...(operationsModule ? [operationsModule.manifest.id] : []),
+            ]),
         }, bootstrapLogger, serviceAccess);
         const moduleEvents = installModuleEvents(client, publicModules, bootstrapLogger, serviceAccess);
         const controlService = new BotControlService(database, publicModules, guildResources, serviceAccess, privacyDatabase
@@ -256,6 +273,12 @@ async function startUnshardedBot(processEnvironment) {
                 executorPool: privacyDatabase,
                 modules: featureModules,
             })
+            : undefined, environment.DISCORD_INTERNAL_GUILD_ID &&
+            environment.HELYX_SUPPORT_STAFF_CHANNEL_ID
+            ? {
+                guildId: environment.DISCORD_INTERNAL_GUILD_ID,
+                channelId: environment.HELYX_SUPPORT_STAFF_CHANNEL_ID,
+            }
             : undefined);
         cloudConnector.setControlHandler(controlService);
         let controlServer;
@@ -268,6 +291,10 @@ async function startUnshardedBot(processEnvironment) {
             process.off("SIGTERM", onSigterm);
             if (retentionCleanupTimer)
                 clearInterval(retentionCleanupTimer);
+            await scheduledTasks?.stop().catch((error) => {
+                process.exitCode = 1;
+                bootstrapLogger.error({ event: "scheduler.stop_failed", error: safeError(error) }, "Scheduled task runner shutdown failed");
+            });
             bootstrapLogger.info({ event: "bot.shutdown", reason }, "Bot shutdown requested");
             await cloudConnector.stop().catch((error) => {
                 process.exitCode = 1;
@@ -300,6 +327,18 @@ async function startUnshardedBot(processEnvironment) {
             await runtime.start();
             await client.login(environment.DISCORD_TOKEN);
             await commandsReady;
+            scheduledTasks = createScheduledTaskRunner({
+                database,
+                modules: publicModules,
+                route: createLocalScheduledTaskRoute({
+                    modules: publicModules,
+                    services: serviceAccess,
+                    logger: bootstrapLogger,
+                }),
+                logger: bootstrapLogger,
+                workerId: `unsharded:${unshardedSupervisorId}`,
+            });
+            scheduledTasks.start();
             await cloudConnector.start();
             if (environment.HELYX_BOT_CONTROL_SECRET) {
                 controlServer = await createBotControlServer({
@@ -321,6 +360,7 @@ async function startUnshardedBot(processEnvironment) {
             }
         }
         catch (error) {
+            await scheduledTasks?.stop().catch(() => undefined);
             await cloudConnector.stop().catch(() => undefined);
             if (controlServer)
                 await controlServer.close().catch(() => undefined);
@@ -369,12 +409,20 @@ function deploymentReference(processEnvironment) {
 }
 export function gatewayIntentsForModules(modules) {
     const intents = [GatewayIntentBits.Guilds];
-    if (modules.some((module) => module.events?.messageReactionAdd?.length)) {
+    if (modules.some((module) => module.events?.messageReactionAdd?.length ||
+        module.events?.messageReactionRemove?.length)) {
         intents.push(GatewayIntentBits.GuildMessageReactions);
     }
+    if (modules.some((module) => module.events?.messageDelete?.length)) {
+        intents.push(GatewayIntentBits.GuildMessages);
+    }
     if (modules.some((module) => module.events?.guildMemberAdd?.length)) {
         intents.push(GatewayIntentBits.GuildMembers);
     }
+    if (modules.some((module) => module.events?.guildEmojiDelete?.length ||
+        module.events?.guildEmojiUpdate?.length)) {
+        intents.push(GatewayIntentBits.GuildExpressions);
+    }
     return intents;
 }
 if (process.argv[1] &&

package/dist/interactions.d.ts

@@ -21,12 +21,13 @@ export declare function toCommandDefinition(registered: {
     contribution: CommandContribution;
 }): import("discord.js").RESTPostAPIChatInputApplicationCommandsJSONBody;
 export declare function uniqueMap<T>(items: readonly T[], keyOf: (item: T) => string, label: string): Map<string, T>;
-export declare function sendToChannel(client: Client, channelId: string, response: MessageResponse): Promise<{
+export declare function sendToChannel(client: Client, channelId: string, response: MessageResponse, deliveryId?: string): Promise<{
     messageId: string;
 }>;
 export declare function deleteChannelMessage(client: Client, channelId: string, messageId: string): Promise<void>;
 export declare function editChannelMessage(client: Client, channelId: string, messageId: string, response: MessageResponse): Promise<void>;
-export declare function authorizeCommand(interaction: ChatInputCommandInteraction, moduleId: string, commandId: string, rateLimit: CommandContribution["rateLimit"], services: ServiceAccess, selfAuthorizingGuildCommand: boolean): Promise<boolean>;
+export declare function addChannelMessageReaction(client: Client, channelId: string, messageId: string, emojiIdentifier: string): Promise<void>;
+export declare function authorizeCommand(interaction: ChatInputCommandInteraction, moduleId: string, commandId: string, rateLimit: CommandContribution["rateLimit"], services: ServiceAccess, selfAuthorizingGuildCommand: boolean, resourceScopedCommand?: boolean): Promise<boolean>;
 export declare function normalizeDiscordPermission(permission: string): string;
 export declare function toReplyOptions(response: MessageResponse): InteractionReplyOptions;
 export declare function toUpdateOptions(response: MessageResponse): InteractionUpdateOptions;

package/dist/interactions.js

@@ -98,8 +98,9 @@ export function installInteractions(client, modules, registration, logger, servi
                     const commandId = subcommandName
                         ? `${command.name}.${subcommandName}`
                         : command.name;
-                    if (await authorizeCommand(interaction, moduleId, commandId, subcommand?.rateLimit ?? command.rateLimit, services, registration.selfAuthorizingGuildModuleIds?.has(moduleId) ??
-                        false)) {
+                    const permissionId = subcommand?.permissionId ?? command.permissionId ?? commandId;
+                    if (await authorizeCommand(interaction, moduleId, permissionId, subcommand?.rateLimit ?? command.rateLimit, services, registration.selfAuthorizingGuildModuleIds?.has(moduleId) ??
+                        false, subcommand?.authorization === "resource-scoped")) {
                         const context = createCommandContext(interaction, services);
                         await execute(context);
                     }
@@ -131,9 +132,17 @@ export function installInteractions(client, modules, registration, logger, servi
                 interaction.isChannelSelectMenu() ||
                 interaction.isRoleSelectMenu()) {
                 const select = selects.get(interaction.customId);
+                const context = select
+                    ? createSelectContext(interaction, services)
+                    : undefined;
+                if (context &&
+                    select?.contribution.acknowledgement === "deferred-ephemeral") {
+                    await context.deferReply?.(true);
+                }
                 if (select &&
+                    context &&
                     (await authorizeComponent(interaction, select.moduleId, services))) {
-                    await select.contribution.execute(createSelectContext(interaction, services));
+                    await select.contribution.execute(context);
                 }
             }
         }
@@ -269,6 +278,10 @@ function createContext(interaction, services) {
         userRoleIds: interaction.member instanceof GuildMember
             ? [...interaction.member.roles.cache.keys()]
             : (interaction.member?.roles ?? []),
+        userPermissions: interaction.memberPermissions
+            ?.toArray()
+            .map(normalizeDiscordPermission) ?? [],
+        isServerOwner: interaction.guild?.ownerId === interaction.user.id,
         isAdministrator: interaction.memberPermissions?.has(PermissionFlagsBits.Administrator) ??
             false,
         ...(interaction.guildId ? { serverId: interaction.guildId } : {}),
@@ -331,6 +344,10 @@ function createModalContext(interaction, services) {
         userRoleIds: interaction.member instanceof GuildMember
             ? [...interaction.member.roles.cache.keys()]
             : (interaction.member?.roles ?? []),
+        userPermissions: interaction.memberPermissions
+            ?.toArray()
+            .map(normalizeDiscordPermission) ?? [],
+        isServerOwner: interaction.guild?.ownerId === interaction.user.id,
         isAdministrator: interaction.memberPermissions?.has(PermissionFlagsBits.Administrator) ??
             false,
         ...(interaction.guildId ? { serverId: interaction.guildId } : {}),
@@ -376,12 +393,20 @@ function createSelectContext(interaction, services) {
         selectedValues: interaction.values,
     };
 }
-export async function sendToChannel(client, channelId, response) {
+export async function sendToChannel(client, channelId, response, deliveryId) {
     const channel = await client.channels.fetch(channelId);
     if (!channel?.isSendable())
         throw new Error("Configured channel is not sendable");
     const options = toReplyOptions({ ...response, ephemeral: false });
-    const message = await channel.send(options);
+    const message = await channel.send({
+        ...options,
+        ...(deliveryId
+            ? {
+                nonce: deliveryId.replaceAll("-", "").slice(0, 25),
+                enforceNonce: true,
+            }
+            : {}),
+    });
     return { messageId: message.id };
 }
 export async function deleteChannelMessage(client, channelId, messageId) {
@@ -406,7 +431,7 @@ async function replyToInteraction(interaction, response) {
     }
     await interaction.reply(toReplyOptions(response));
 }
-async function addChannelMessageReaction(client, channelId, messageId, emojiIdentifier) {
+export async function addChannelMessageReaction(client, channelId, messageId, emojiIdentifier) {
     const channel = await client.channels.fetch(channelId);
     if (!channel?.isTextBased()) {
         throw new Error("Configured channel cannot contain messages");
@@ -431,32 +456,33 @@ async function replyEphemeralText(interaction, content) {
     }
     await interaction.reply({ content, flags: MessageFlags.Ephemeral });
 }
-export async function authorizeCommand(interaction, moduleId, commandId, rateLimit, services, selfAuthorizingGuildCommand) {
+export async function authorizeCommand(interaction, moduleId, commandId, rateLimit, services, selfAuthorizingGuildCommand, resourceScopedCommand = false) {
     if (!interaction.guildId)
         return true;
     if (!selfAuthorizingGuildCommand) {
         if (!(await authorizeComponent(interaction, moduleId, services)))
             return false;
-        const permissions = services.get(HELYX_SERVICE_NAMES.permissions);
-        const policy = await permissions.getEffectivePolicy(interaction.guildId, moduleId, commandId);
-        const actor = {
-            userId: interaction.user.id,
-            roleIds: interaction.member instanceof GuildMember
-                ? [...interaction.member.roles.cache.keys()]
-                : (interaction.member?.roles ?? []),
-            permissions: interaction.memberPermissions
-                ?.toArray()
-                .map(normalizeDiscordPermission) ?? [],
-            isServerOwner: interaction.guild?.ownerId === interaction.user.id,
-            isAdministrator: interaction.memberPermissions?.has(PermissionFlagsBits.Administrator) ??
-                false,
-        };
-        if (!canUseCommand(actor, policy)) {
-            await interaction.reply({
-                content: "You do not have permission to use this command.",
-                flags: MessageFlags.Ephemeral,
-            });
-            return false;
+        if (!resourceScopedCommand) {
+            const permissions = services.get(HELYX_SERVICE_NAMES.permissions);
+            const policy = await permissions.getEffectivePolicy(interaction.guildId, moduleId, commandId);
+            const actor = {
+                userId: interaction.user.id,
+                roleIds: interaction.member instanceof GuildMember
+                    ? [...interaction.member.roles.cache.keys()]
+                    : (interaction.member?.roles ?? []),
+                permissions: interaction.memberPermissions
+                    ?.toArray()
+                    .map(normalizeDiscordPermission) ?? [],
+                isServerOwner: interaction.guild?.ownerId === interaction.user.id,
+                isAdministrator: interaction.memberPermissions?.has(PermissionFlagsBits.Administrator) ?? false,
+            };
+            if (!canUseCommand(actor, policy)) {
+                await interaction.reply({
+                    content: "You do not have permission to use this command.",
+                    flags: MessageFlags.Ephemeral,
+                });
+                return false;
+            }
         }
     }
     if (rateLimit) {
@@ -517,6 +543,7 @@ export function toReplyOptions(response) {
                                 ...(button.emojiIdentifier
                                     ? { emoji: toButtonEmoji(button.emojiIdentifier) }
                                     : {}),
+                                ...(button.disabled ? { disabled: true } : {}),
                             })),
                         },
                     ]
@@ -542,6 +569,9 @@ export function toReplyOptions(response) {
                 if (button.emojiIdentifier) {
                     builder.setEmoji(toButtonEmoji(button.emojiIdentifier));
                 }
+                if (button.disabled !== undefined) {
+                    builder.setDisabled(button.disabled);
+                }
                 return builder;
             })),
         ]
@@ -576,7 +606,7 @@ function toSelectRows(response) {
                 .setMaxValues(select.maxValues ?? 1)));
             continue;
         }
-        rows.push(new ActionRowBuilder().addComponents(new StringSelectMenuBuilder()
+        const builder = new StringSelectMenuBuilder()
             .setCustomId(select.customId)
             .setPlaceholder(select.placeholder)
             .setMinValues(select.minValues ?? 1)
@@ -584,10 +614,15 @@ function toSelectRows(response) {
             .addOptions(select.options.map((option) => ({
             label: option.label,
             value: option.value,
-            ...(option.description
-                ? { description: option.description }
+            ...(option.description ? { description: option.description } : {}),
+            ...(option.emojiIdentifier
+                ? { emoji: toButtonEmoji(option.emojiIdentifier) }
                 : {}),
-        })))));
+        })));
+        if (select.disabled !== undefined) {
+            builder.setDisabled(select.disabled);
+        }
+        rows.push(new ActionRowBuilder().addComponents(builder));
     }
     return rows;
 }

package/dist/module-logging.d.ts

@@ -14,6 +14,7 @@ export declare class DiscordModuleLoggingService implements ModuleLoggingService
         eventId: string;
         summary: string;
         details?: readonly ModuleLogDetail[];
+        idempotencyKey?: string;
     }): Promise<{
         delivered: boolean;
     }>;

package/dist/module-logging.js

@@ -1,5 +1,6 @@
 import { InstallationRepository, ModuleConfigurationRepository, ModuleLoggingPolicyRepository, } from "@helyx/database";
 import { toReplyOptions } from "./interactions.js";
+import { createHash } from "node:crypto";
 const LOGGING_MODULE_ID = "helyx.logging";
 const VIOLET = 0x7c3aed;
 export class DiscordModuleLoggingService {
@@ -68,7 +69,13 @@ export class DiscordModuleLoggingService {
                     ],
                 },
             });
-            await channel.send(response);
+            const delivery = input.idempotencyKey
+                ? loggingDeliveryNonce(input)
+                : undefined;
+            await channel.send({
+                ...response,
+                ...(delivery ? { nonce: delivery, enforceNonce: true } : {}),
+            });
             return { delivered: true };
         }
         catch (error) {
@@ -83,6 +90,17 @@ export class DiscordModuleLoggingService {
         }
     }
 }
+function loggingDeliveryNonce(input) {
+    if (!input.idempotencyKey)
+        return undefined;
+    if (input.idempotencyKey.length > 200 ||
+        !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(input.idempotencyKey))
+        throw new Error("Module logging idempotency key is invalid");
+    return createHash("sha256")
+        .update(`${input.guildId}\u0000${input.moduleId}\u0000${input.eventId}\u0000${input.idempotencyKey}`)
+        .digest("hex")
+        .slice(0, 25);
+}
 function normalizeText(value, maximum, label) {
     const normalized = value.normalize("NFKC").trim();
     if (normalized.length === 0 || normalized.length > maximum) {

package/dist/modules.d.ts

@@ -1,3 +1,4 @@
+import type { BotEnvironment } from "@helyx/config";
 import type { ModuleDefinition } from "@helyx/sdk";
 type ModuleImporter = (specifier: string) => Promise<unknown>;
 type PackageJsonResolver = (specifier: string) => string;
@@ -9,6 +10,14 @@ interface LoadedDefinition {
 export interface ConfiguredModulePackage extends LoadedDefinition {
     packageRoot: string;
 }
+export declare const secureRandomSelectionWorkerKeyName = "HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY";
+interface PlatformServiceEnvironment extends Pick<BotEnvironment, "HELYX_DATA_ENCRYPTION_KEY"> {
+    HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY?: string;
+}
+export declare function deriveSecureRandomSelectionKey(encodedDataEncryptionKey: string): Uint8Array;
+export declare function platformServiceOptions(environment: PlatformServiceEnvironment, modules: readonly ModuleDefinition[]): {
+    secureRandomSelectionKey?: Uint8Array;
+};
 export declare function loadConfiguredModules(specifiers: readonly string[], importer?: ModuleImporter): Promise<ModuleDefinition[]>;
 export declare function loadConfiguredModulePackages(specifiers: readonly string[], importer?: ModuleImporter, resolvePackageJson?: PackageJsonResolver, readPackageJson?: PackageJsonReader): Promise<ConfiguredModulePackage[]>;
 export declare function validateContributionParity(definition: ModuleDefinition): void;

package/dist/modules.js

@@ -1,8 +1,43 @@
 import { orderModuleManifests, parseModuleManifest, } from "@helyx/module-manifest";
+import { createHmac } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
 const officialModulePackage = /^@helyx\/module-[a-z0-9][a-z0-9-]*$/u;
+const giveawaysModuleId = "helyx.giveaways";
+export const secureRandomSelectionWorkerKeyName = "HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY";
+const secureRandomSelectionKeyContext = "helyx.secure-random-selection.worker.v1";
+function decodeSecureRandomSelectionKey(encodedKey, variableName) {
+    const key = Buffer.from(encodedKey, "base64");
+    if (key.byteLength !== 32) {
+        throw new Error(`${variableName} must contain exactly 32 bytes`);
+    }
+    return key;
+}
+export function deriveSecureRandomSelectionKey(encodedDataEncryptionKey) {
+    const dataEncryptionKey = decodeSecureRandomSelectionKey(encodedDataEncryptionKey, "HELYX_DATA_ENCRYPTION_KEY");
+    return createHmac("sha256", dataEncryptionKey)
+        .update(secureRandomSelectionKeyContext, "utf8")
+        .digest();
+}
+export function platformServiceOptions(environment, modules) {
+    const internalSelectionKey = environment.HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY;
+    if (internalSelectionKey) {
+        return {
+            secureRandomSelectionKey: decodeSecureRandomSelectionKey(internalSelectionKey, secureRandomSelectionWorkerKeyName),
+        };
+    }
+    const encodedKey = environment.HELYX_DATA_ENCRYPTION_KEY;
+    if (!encodedKey) {
+        if (modules.some(({ manifest }) => manifest.id === giveawaysModuleId)) {
+            throw new Error("HELYX_DATA_ENCRYPTION_KEY is required when Giveaways is loaded");
+        }
+        return {};
+    }
+    return {
+        secureRandomSelectionKey: deriveSecureRandomSelectionKey(encodedKey),
+    };
+}
 function isModuleDefinition(value) {
     if (typeof value !== "object" || value === null)
         return false;
@@ -58,14 +93,24 @@ export function validateContributionParity(definition) {
     const executableCommands = (definition.interactions?.commands ?? []).map(({ name }) => name);
     const executableEvents = [
         ...(definition.events?.messageReactionAdd ?? []),
+        ...(definition.events?.messageReactionRemove ?? []),
+        ...(definition.events?.messageDelete ?? []),
         ...(definition.events?.guildMemberAdd ?? []),
+        ...(definition.events?.guildRoleDelete ?? []),
+        ...(definition.events?.guildRoleUpdate ?? []),
+        ...(definition.events?.channelDelete ?? []),
+        ...(definition.events?.channelUpdate ?? []),
+        ...(definition.events?.guildEmojiDelete ?? []),
+        ...(definition.events?.guildEmojiUpdate ?? []),
     ].map(({ type }) => type);
     const executableLogs = (definition.logging?.events ?? []).map(({ id }) => id);
     const executableDashboardActions = (definition.dashboardActions ?? []).map(({ id }) => id);
+    const executableManagedResources = (definition.managedResources ?? []).map(({ id }) => id);
     assertSameContributionIds(definition.manifest.contributions.commands, executableCommands, "commands");
     assertSameContributionIds(definition.manifest.contributions.events, executableEvents, "events");
     assertSameContributionIds(definition.manifest.contributions.logs ?? [], executableLogs, "logs");
     assertSameContributionIds(definition.manifest.dashboard?.actions?.map(({ id }) => id) ?? [], executableDashboardActions, "dashboard actions");
+    assertSameContributionIds(definition.manifest.dashboard?.resources?.map(({ id }) => id) ?? [], executableManagedResources, "dashboard resources");
     validatePrivacyParity(definition);
 }
 function validatePrivacyParity(definition) {

package/dist/resource-authorization.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionPolicyService, ResourceAuthorizationService } from "@helyx/sdk";
+export declare class CoreResourceAuthorizationService implements ResourceAuthorizationService {
+    #private;
+    constructor(permissions: PermissionPolicyService);
+    canUse(input: Parameters<ResourceAuthorizationService["canUse"]>[0]): Promise<boolean>;
+}
+//# sourceMappingURL=resource-authorization.d.ts.map

package/dist/resource-authorization.js

@@ -0,0 +1,12 @@
+import { canUseCommand } from "@helyx/core";
+export class CoreResourceAuthorizationService {
+    #permissions;
+    constructor(permissions) {
+        this.#permissions = permissions;
+    }
+    async canUse(input) {
+        const policy = await this.#permissions.getEffectivePolicy(input.guildId, input.moduleId, input.permissionId);
+        return canUseCommand(input.actor, policy);
+    }
+}
+//# sourceMappingURL=resource-authorization.js.map