@helyx/bot 0.4.27 → 0.4.29

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.4.29
+
+### Patch Changes
+
+- Harden dashboard authentication, privacy execution, control routing, database transactions, and self-host configuration.
+
+  Add bounded multi-value record reads and use them to batch Polls and Reaction Roles dashboard queries. Improve dashboard presentation, Forms workflows, release safety, and operational tooling across hosted and self-hosted deployments.
+
+- Updated dependencies
+  - @helyx/control-protocol@0.4.0
+  - @helyx/database@0.8.0
+  - @helyx/sdk@0.7.0
+  - @helyx/platform@0.5.0
+
+## 0.4.28
+
+### Patch Changes
+
+- Add the private testing-stage Forms module contracts and runtime integration,
+  and introduce server-configurable Helyx Administrator, Moderator, dashboard
+  access, and command-permission policies with fresh Discord authorization.
+
 ## 0.4.27
 
 ### Patch Changes

package/dist/cloud-connector.js

@@ -719,6 +719,9 @@ function connectorCapabilities() {
     return [
         "installation.health.read.v1",
         "guild.state.read.v1",
+        "guild.dashboard.access.read.v1",
+        "guild.access-policy.read.v1",
+        "guild.access-policy.write.v1",
         "guild.module.public.read.v1",
         "guild.module.status.write.v1",
         "guild.module.configuration.write.v1",

package/dist/cloud-control-dispatcher.js

@@ -25,6 +25,33 @@ export class CloudControlDispatcher {
                 result = await this.control.getGuildState(input.guildId);
                 break;
             }
+            case "guild.dashboard.access.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = {
+                    allowed: await this.control.canAccessDashboard({
+                        guildId: input.guildId,
+                        actorUserId: requiredActor(actorUserId),
+                    }),
+                };
+                break;
+            }
+            case "guild.access-policy.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.getGuildAccessPolicy({
+                    guildId: input.guildId,
+                    actorUserId: requiredActor(actorUserId),
+                });
+                break;
+            }
+            case "guild.access-policy.write.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                result = await this.control.updateGuildAccessPolicy({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
             case "guild.module.public.read.v1": {
                 const input = parseOperationInput(request.operation, request.input);
                 if (request.actor.kind !== "public")
@@ -116,6 +143,8 @@ export class CloudControlDispatcher {
                     resourceId: input.resourceId,
                     relationId: input.relationId,
                     ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+                    ...(input.search === undefined ? {} : { search: input.search }),
+                    ...(input.filters === undefined ? {} : { filters: input.filters }),
                     limit: input.limit,
                     actorUserId: requiredActor(actorUserId),
                     correlationId,

package/dist/control-server.d.ts

@@ -1,5 +1,5 @@
 import { type DatabasePool, type GuildShardOwnership } from "@helyx/database";
-import { type DashboardActionResult, type ManagedResourceCreationIntent, type ManagedResourceDetail, type ManagedResourcePage, type ManagedResourceRelationPage, type ManagedResourceValue, type MessageResponse, type ModuleDefinition, type PermissionActor, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type PublicAchievementProjectionPage, type ServiceAccess } from "@helyx/sdk";
+import { type DashboardActionResult, type GuildAccessPolicy, type ManagedResourceCreationIntent, type ManagedResourceDetail, type ManagedResourcePage, type ManagedResourceRelationPage, type ManagedResourceValue, type MessageResponse, type ModuleDefinition, type PermissionActor, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type PublicAchievementProjectionPage, type ServiceAccess } from "@helyx/sdk";
 import { type ActionReceipt, type SignedAssessmentEnvelope } from "@helyx/verification-contracts";
 import { type Client } from "discord.js";
 import { type FastifyInstance } from "fastify";
@@ -45,6 +45,7 @@ interface DashboardModuleDefinition {
     actions: DashboardActionDefinition[];
     achievementTriggers: NonNullable<ModuleDefinition["manifest"]["contributions"]["achievementTriggers"]>;
     resources: readonly DashboardResourceDefinition[];
+    workspace?: NonNullable<ModuleDefinition["manifest"]["dashboard"]>["workspace"];
 }
 interface DashboardLoggingPolicy {
     eventId: string;
@@ -71,6 +72,7 @@ export interface BotControlGuildResources {
         id: string;
         name: string;
         colour: string;
+        position: number;
     }>;
 }
 export interface BotPublicModuleProjection {
@@ -146,6 +148,14 @@ export interface BotControlState {
     permissions: Record<string, DashboardPermissionState>;
     logging: Record<string, DashboardLoggingPolicy[]>;
 }
+export interface DashboardGuildAccessState extends GuildAccessPolicy {
+    version: number;
+    canManage: boolean;
+    actorAuthority: "owner" | "administrator" | "moderator" | "member";
+    actorRoleIds: string[];
+    actorHighestRolePosition: number | null;
+    updatedAt: string | null;
+}
 export interface BotControlHandler {
     sendSupportNotification(input: SupportNotificationInput): Promise<void>;
     listGuildPresence(input: {
@@ -153,6 +163,21 @@ export interface BotControlHandler {
         correlationId: string;
     }): Promise<BotGuildPresenceObservation[]>;
     getGuildState(guildId: string): Promise<BotControlState>;
+    canAccessDashboard(input: {
+        guildId: string;
+        actorUserId: string;
+    }): Promise<boolean>;
+    getGuildAccessPolicy(input: {
+        guildId: string;
+        actorUserId: string;
+    }): Promise<DashboardGuildAccessState>;
+    updateGuildAccessPolicy(input: {
+        guildId: string;
+        actorUserId: string;
+        correlationId: string;
+        version: number;
+        policy: GuildAccessPolicy;
+    }): Promise<DashboardGuildAccessState>;
     readPublicModuleProjection(input: {
         guildId: string;
         moduleId: string;
@@ -235,6 +260,8 @@ export interface BotControlHandler {
         relationId: string;
         cursor?: string;
         limit: number;
+        search?: string;
+        filters?: Readonly<Record<string, string>>;
         actorUserId: string;
         correlationId: string;
     }): Promise<ManagedResourceRelationPage>;
@@ -354,6 +381,21 @@ export declare class BotControlService implements BotControlHandler {
         cursor?: string;
     }): Promise<PrivacyErasePage>;
     getGuildState(guildId: string): Promise<BotControlState>;
+    canAccessDashboard(input: {
+        guildId: string;
+        actorUserId: string;
+    }): Promise<boolean>;
+    getGuildAccessPolicy(input: {
+        guildId: string;
+        actorUserId: string;
+    }): Promise<DashboardGuildAccessState>;
+    updateGuildAccessPolicy(input: {
+        guildId: string;
+        actorUserId: string;
+        correlationId: string;
+        version: number;
+        policy: GuildAccessPolicy;
+    }): Promise<DashboardGuildAccessState>;
     readPublicModuleProjection(input: {
         guildId: string;
         moduleId: string;
@@ -436,6 +478,8 @@ export declare class BotControlService implements BotControlHandler {
         relationId: string;
         cursor?: string;
         limit: number;
+        search?: string;
+        filters?: Readonly<Record<string, string>>;
         actorUserId: string;
         correlationId: string;
     }): Promise<ManagedResourceRelationPage>;

package/dist/control-server.js

@@ -1,13 +1,14 @@
-import { AuditRepository, InstallationRepository, ModuleLoggingPolicyRepository, OptimisticConcurrencyError, PermissionPolicyRepository, withTransaction, } from "@helyx/database";
-import { DashboardActionValidationError, HELYX_SERVICE_NAMES, ModuleStateValidationError, } from "@helyx/sdk";
+import { AuditRepository, GuildAccessPolicyRepository, InstallationRepository, ModuleLoggingPolicyRepository, OptimisticConcurrencyError, PermissionPolicyRepository, withTransaction, } from "@helyx/database";
+import { DashboardActionValidationError, DEFAULT_GUILD_ACCESS_POLICY, HELYX_SERVICE_NAMES, ModuleStateValidationError, } from "@helyx/sdk";
 import { actionReceiptSchema, signedAssessmentEnvelopeSchema, } from "@helyx/verification-contracts";
-import { canUseCommand } from "@helyx/core";
+import { canAccessGuildDashboard, canMutatePermissionPolicy, canUseCommand, permissionMutationDenialMessage, resolveHelyxAuthority, } from "@helyx/core";
 import { ChannelType, PermissionFlagsBits } from "discord.js";
 import Fastify, {} from "fastify";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { z, ZodError } from "zod";
 import { addChannelMessageReaction as addDiscordChannelMessageReaction, deleteChannelMessage as deleteDiscordChannelMessage, editChannelMessage as editDiscordChannelMessage, normalizeDiscordPermission, sendToChannel as sendDiscordMessageToChannel, } from "./interactions.js";
 import { SHARD_HEALTH_STALE_MS, } from "./shard-contracts.js";
+import { dashboardCategoryLabel } from "./dashboard-category.js";
 const snowflake = z.string().regex(/^\d{17,20}$/u);
 const moduleId = z.string().regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/u);
 const MAX_DISCORD_SETTING_SELECTIONS = 25;
@@ -41,6 +42,15 @@ const permissionState = z.object({
     }))
         .max(100),
 });
+const guildAccessPolicy = z
+    .object({
+    administratorRoleIds: z.array(snowflake).max(25),
+    moderatorRoleIds: z.array(snowflake).max(25),
+    dashboardModeratorsEnabled: z.boolean(),
+    dashboardAllowedRoleIds: z.array(snowflake).max(25),
+    dashboardDeniedRoleIds: z.array(snowflake).max(25),
+})
+    .strict();
 const mutationContext = z.object({
     actorUserId: snowflake,
     correlationId: z.uuid(),
@@ -146,6 +156,7 @@ export class DiscordGuildResourceDirectory {
                     id: role.id,
                     name: role.name,
                     colour: role.hexColor,
+                    position: role.position,
                 })),
             };
         }
@@ -181,7 +192,13 @@ export class DiscordGuildResourceDirectory {
     async resolveActor(guildId, actorUserId) {
         try {
             const guild = await this.client.guilds.fetch(guildId);
-            const member = await guild.members.fetch(actorUserId);
+            // Dashboard authorization must reflect current Discord roles and
+            // permissions even when a member-update gateway event was missed.
+            const member = await guild.members.fetch({
+                user: actorUserId,
+                force: true,
+                cache: true,
+            });
             return {
                 userId: member.id,
                 roleIds: [...member.roles.cache.keys()],
@@ -190,6 +207,7 @@ export class DiscordGuildResourceDirectory {
                     .map(normalizeDiscordPermission),
                 isServerOwner: guild.ownerId === member.id,
                 isAdministrator: member.permissions.has(PermissionFlagsBits.Administrator),
+                highestRolePosition: member.roles.highest.position,
             };
         }
         catch (error) {
@@ -425,6 +443,88 @@ export class BotControlService {
             logging,
         };
     }
+    async canAccessDashboard(input) {
+        const actor = await this.resources.resolveActor(input.guildId, input.actorUserId);
+        return canAccessGuildDashboard(actor, await this.#readGuildAccessPolicy(input.guildId));
+    }
+    async getGuildAccessPolicy(input) {
+        const actor = await this.resources.resolveActor(input.guildId, input.actorUserId);
+        const record = await new GuildAccessPolicyRepository(this.database).get(input.guildId);
+        const policy = record ?? DEFAULT_GUILD_ACCESS_POLICY;
+        return {
+            administratorRoleIds: [...policy.administratorRoleIds],
+            moderatorRoleIds: [...policy.moderatorRoleIds],
+            dashboardModeratorsEnabled: policy.dashboardModeratorsEnabled,
+            dashboardAllowedRoleIds: [...policy.dashboardAllowedRoleIds],
+            dashboardDeniedRoleIds: [...policy.dashboardDeniedRoleIds],
+            version: record ? safeVersion(record.version) : 0,
+            canManage: actor.isServerOwner || actor.isAdministrator,
+            actorAuthority: resolveHelyxAuthority(actor, policy),
+            actorRoleIds: [...actor.roleIds],
+            actorHighestRolePosition: actor.highestRolePosition ?? null,
+            updatedAt: record?.updatedAt.toISOString() ?? null,
+        };
+    }
+    async updateGuildAccessPolicy(input) {
+        const actor = await this.resources.resolveActor(input.guildId, input.actorUserId);
+        if (!actor.isServerOwner && !actor.isAdministrator)
+            throw new BotControlForbiddenError("Only the server owner or a Discord Administrator can change dashboard access");
+        const resources = await this.resources.getGuildResources(input.guildId);
+        const availableRoles = new Set(resources.roles.map(({ id }) => id));
+        const roleIds = [
+            ...input.policy.administratorRoleIds,
+            ...input.policy.moderatorRoleIds,
+            ...input.policy.dashboardAllowedRoleIds,
+            ...input.policy.dashboardDeniedRoleIds,
+        ];
+        if (roleIds.some((roleId) => !availableRoles.has(roleId)))
+            throw new BotControlValidationError("Dashboard access contains a Discord role that is no longer available");
+        const saved = await withTransaction(this.database, async (connection) => {
+            const record = await new GuildAccessPolicyRepository(connection).save({
+                guildId: input.guildId,
+                administratorRoleIds: [...input.policy.administratorRoleIds],
+                moderatorRoleIds: [...input.policy.moderatorRoleIds],
+                dashboardModeratorsEnabled: input.policy.dashboardModeratorsEnabled,
+                dashboardAllowedRoleIds: [...input.policy.dashboardAllowedRoleIds],
+                dashboardDeniedRoleIds: [...input.policy.dashboardDeniedRoleIds],
+                expectedVersion: input.version === 0 ? null : BigInt(input.version),
+                updatedBy: input.actorUserId,
+            });
+            await new AuditRepository(connection).append({
+                guildId: input.guildId,
+                actorUserId: input.actorUserId,
+                action: "guild.access.updated",
+                source: "dashboard",
+                correlationId: input.correlationId,
+                afterState: {
+                    version: record.version.toString(),
+                    administratorRoleCount: record.administratorRoleIds.length,
+                    moderatorRoleCount: record.moderatorRoleIds.length,
+                    dashboardAllowedRoleCount: record.dashboardAllowedRoleIds.length,
+                    dashboardDeniedRoleCount: record.dashboardDeniedRoleIds.length,
+                    dashboardModeratorsEnabled: record.dashboardModeratorsEnabled,
+                },
+            });
+            return record;
+        });
+        return {
+            administratorRoleIds: [...saved.administratorRoleIds],
+            moderatorRoleIds: [...saved.moderatorRoleIds],
+            dashboardModeratorsEnabled: saved.dashboardModeratorsEnabled,
+            dashboardAllowedRoleIds: [...saved.dashboardAllowedRoleIds],
+            dashboardDeniedRoleIds: [...saved.dashboardDeniedRoleIds],
+            version: safeVersion(saved.version),
+            canManage: true,
+            actorAuthority: resolveHelyxAuthority(actor, saved),
+            actorRoleIds: [...actor.roleIds],
+            actorHighestRolePosition: actor.highestRolePosition ?? null,
+            updatedAt: saved.updatedAt.toISOString(),
+        };
+    }
+    async #readGuildAccessPolicy(guildId) {
+        return ((await new GuildAccessPolicyRepository(this.database).get(guildId)) ??
+            DEFAULT_GUILD_ACCESS_POLICY);
+    }
     async readPublicModuleProjection(input) {
         const module = this.#requireModule(input.moduleId);
         if (!module.publicProjection)
@@ -583,6 +683,26 @@ export class BotControlService {
         ])));
         for (const command of commands)
             assertVersion(currentCommands.get(command.id).version, supplied.get(command.id).version);
+        const [actor, guildAccess, resources] = await Promise.all([
+            this.resources.resolveActor(input.guildId, input.actorUserId),
+            this.#permissions.getGuildAccessPolicy?.(input.guildId) ??
+                Promise.resolve(DEFAULT_GUILD_ACCESS_POLICY),
+            this.resources.getGuildResources(input.guildId),
+        ]);
+        const rolePositions = Object.fromEntries(resources.roles.map((role) => [role.id, role.position]));
+        const requestedModulePolicy = fromDashboardPolicy(input.state.module, currentModule.policy);
+        if (!permissionPoliciesEqual(currentModule.policy, requestedModulePolicy))
+            assertPermissionMutationAllowed(canMutatePermissionPolicy(actor, currentModule.policy, requestedModulePolicy, guildAccess, rolePositions));
+        for (const command of commands) {
+            const requested = supplied.get(command.id);
+            const current = currentCommands.get(command.id);
+            const target = requested.enabled
+                ? fromDashboardPolicy(requested.policy, current.policy)
+                : requestedModulePolicy;
+            const enabledChanged = requested.enabled === current.inherited;
+            if (enabledChanged || !permissionPoliciesEqual(current.policy, target))
+                assertPermissionMutationAllowed(canMutatePermissionPolicy(actor, current.policy, target, guildAccess, rolePositions));
+        }
         await withTransaction(this.database, async (connection) => {
             const policies = new PermissionPolicyRepository(connection);
             const audit = new AuditRepository(connection);
@@ -765,6 +885,8 @@ export class BotControlService {
         return normalizeManagedResourceRelationPage(managedResourceRelationPageSchema.parse(await resource.listRelation(context, input.resourceId, input.relationId, {
             ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
             limit: input.limit,
+            ...(input.search === undefined ? {} : { search: input.search }),
+            ...(input.filters === undefined ? {} : { filters: input.filters }),
         })), relation.columns.map(({ key }) => key));
     }
     async previewManagedResource(input) {
@@ -877,7 +999,8 @@ export class BotControlService {
     async #authorizeAction(guildId, module, actorUserId, permissionId) {
         const actor = await this.resources.resolveActor(guildId, actorUserId);
         const policy = await this.#permissions.getEffectivePolicy(guildId, module.manifest.id, permissionId);
-        if (!canUseCommand(actor, policy))
+        const guildAccess = await this.#permissions.getGuildAccessPolicy?.(guildId);
+        if (!canUseCommand(actor, policy, guildAccess))
             throw new BotControlForbiddenError();
         return actor;
     }
@@ -1139,6 +1262,35 @@ export async function createBotControlServer(input) {
         const { guildId } = z.object({ guildId: snowflake }).parse(request.params);
         return input.service.getGuildState(guildId);
     });
+    server.post("/v1/guilds/:guildId/dashboard-access", async (request) => {
+        const { guildId } = z.object({ guildId: snowflake }).parse(request.params);
+        const { actorUserId } = z
+            .object({ actorUserId: snowflake })
+            .strict()
+            .parse(request.body);
+        return {
+            allowed: await input.service.canAccessDashboard({
+                guildId,
+                actorUserId,
+            }),
+        };
+    });
+    server.get("/v1/guilds/:guildId/access-policy", async (request) => {
+        const { guildId } = z.object({ guildId: snowflake }).parse(request.params);
+        const { actorUserId } = z
+            .object({ actorUserId: snowflake })
+            .strict()
+            .parse(request.query);
+        return input.service.getGuildAccessPolicy({ guildId, actorUserId });
+    });
+    server.put("/v1/guilds/:guildId/access-policy", async (request) => {
+        const { guildId } = z.object({ guildId: snowflake }).parse(request.params);
+        const body = mutationContext
+            .extend({ version: z.number().int().min(0), policy: guildAccessPolicy })
+            .strict()
+            .parse(request.body);
+        return input.service.updateGuildAccessPolicy({ guildId, ...body });
+    });
     server.get("/v1/guilds/:guildId/modules/:moduleId/public-projection", async (request) => {
         const params = z
             .object({ guildId: snowflake, moduleId })
@@ -1272,6 +1424,21 @@ export async function createBotControlServer(input) {
             .object({
             cursor: resourceCursor.optional(),
             limit: z.coerce.number().int().min(1).max(50).default(50),
+            search: z.string().trim().min(1).max(200).optional(),
+            filters: z
+                .preprocess((value) => {
+                if (typeof value !== "string")
+                    return value;
+                if (value.length > 2_048)
+                    return value;
+                try {
+                    return JSON.parse(value);
+                }
+                catch {
+                    return value;
+                }
+            }, managedResourceFilters)
+                .optional(),
             actorUserId: snowflake,
             correlationId: z.uuid(),
         })
@@ -1281,6 +1448,8 @@ export async function createBotControlServer(input) {
             ...params,
             ...(query.cursor === undefined ? {} : { cursor: query.cursor }),
             limit: query.limit,
+            ...(query.search === undefined ? {} : { search: query.search }),
+            ...(query.filters === undefined ? {} : { filters: query.filters }),
             actorUserId: query.actorUserId,
             correlationId: query.correlationId,
         });
@@ -1657,7 +1826,7 @@ function mapDashboardModule(module) {
         name: module.manifest.name,
         version: module.manifest.version,
         summary: module.manifest.description,
-        category: dashboard.category[0].toUpperCase() + dashboard.category.slice(1),
+        category: dashboardCategoryLabel(dashboard.category),
         icon: dashboard.icon,
         availability: "available",
         releaseStatus: module.manifest.releaseStatus,
@@ -1668,6 +1837,9 @@ function mapDashboardModule(module) {
         actions: (dashboard.actions ?? []).map((action) => ({ ...action })),
         achievementTriggers: (module.manifest.contributions?.achievementTriggers ?? []).map((trigger) => structuredClone(trigger)),
         resources: (dashboard.resources ?? []).map((resource) => structuredClone(resource)),
+        workspace: dashboard.workspace
+            ? structuredClone(dashboard.workspace)
+            : undefined,
     };
 }
 function dashboardCommands(module) {
@@ -1702,14 +1874,18 @@ function dashboardCommands(module) {
 function toDashboardPolicy(policy) {
     const preset = policy.everyone
         ? "everyone"
-        : policy.allowedRoleIds.length > 0 &&
-            policy.requiredPermissions.length === 0
-            ? "custom"
-            : policy.requiredPermissions.some((permission) => ["ADMINISTRATOR", "MANAGE_GUILD"].includes(permission))
-                ? "administrators"
-                : policy.requiredPermissions.length > 0
-                    ? "moderators"
-                    : "custom";
+        : policy.accessLevel === "administrator"
+            ? "administrators"
+            : policy.accessLevel === "moderator"
+                ? "moderators"
+                : policy.allowedRoleIds.length > 0 &&
+                    policy.requiredPermissions.length === 0
+                    ? "custom"
+                    : policy.requiredPermissions.includes("ADMINISTRATOR")
+                        ? "administrators"
+                        : policy.requiredPermissions.includes("MANAGE_GUILD")
+                            ? "moderators"
+                            : "custom";
     return {
         preset,
         allowedRoleIds: [...policy.allowedRoleIds],
@@ -1719,11 +1895,12 @@ function toDashboardPolicy(policy) {
 function fromDashboardPolicy(input, current) {
     return {
         everyone: input.preset === "everyone",
-        requiredPermissions: input.preset === "administrators"
-            ? ["MANAGE_GUILD"]
+        ...(input.preset === "administrators"
+            ? { accessLevel: "administrator" }
             : input.preset === "moderators"
-                ? ["MANAGE_MESSAGES"]
-                : [],
+                ? { accessLevel: "moderator" }
+                : {}),
+        requiredPermissions: [],
         allowedRoleIds: input.preset === "custom" ? input.allowedRoleIds : [],
         deniedRoleIds: input.deniedRoleIds,
         allowedUserIds: [...current.allowedUserIds],
@@ -1740,6 +1917,24 @@ function emptyPolicy() {
         deniedUserIds: [],
     };
 }
+function permissionPoliciesEqual(left, right) {
+    return (left.everyone === right.everyone &&
+        left.accessLevel === right.accessLevel &&
+        sameStrings(left.requiredPermissions, right.requiredPermissions) &&
+        sameStrings(left.allowedRoleIds, right.allowedRoleIds) &&
+        sameStrings(left.deniedRoleIds, right.deniedRoleIds) &&
+        sameStrings(left.allowedUserIds, right.allowedUserIds) &&
+        sameStrings(left.deniedUserIds, right.deniedUserIds));
+}
+function sameStrings(left, right) {
+    return (left.length === right.length &&
+        left.every((value, index) => value === right[index]));
+}
+function assertPermissionMutationAllowed(decision) {
+    if (decision.allowed)
+        return;
+    throw new BotControlForbiddenError(permissionMutationDenialMessage(decision.reason));
+}
 function safeVersion(version) {
     const value = Number(version);
     if (!Number.isSafeInteger(value) || value < 1)

package/dist/dashboard-category.d.ts

@@ -0,0 +1,3 @@
+import type { ModuleManifest } from "@helyx/module-manifest";
+export declare function dashboardCategoryLabel(category: NonNullable<ModuleManifest["dashboard"]>["category"]): string;
+//# sourceMappingURL=dashboard-category.d.ts.map

package/dist/dashboard-category.js

@@ -0,0 +1,14 @@
+const categoryLabels = {
+    community: "Community",
+    safety: "Safety",
+    support: "Support & Staff",
+    automation: "Automation",
+    engagement: "Engagement",
+    gaming: "Gaming",
+    insights: "Insights",
+    integrations: "Integrations",
+};
+export function dashboardCategoryLabel(category) {
+    return categoryLabels[category];
+}
+//# sourceMappingURL=dashboard-category.js.map

package/dist/interactions.js

@@ -372,6 +372,9 @@ function createContext(interaction, services) {
         userRoleIds: interaction.member instanceof GuildMember
             ? [...interaction.member.roles.cache.keys()]
             : (interaction.member?.roles ?? []),
+        ...(interaction.member instanceof GuildMember
+            ? { userHighestRolePosition: interaction.member.roles.highest.position }
+            : {}),
         userPermissions: interaction.memberPermissions
             ?.toArray()
             .map(normalizeDiscordPermission) ?? [],
@@ -491,6 +494,9 @@ function createModalContext(interaction, services) {
         userRoleIds: interaction.member instanceof GuildMember
             ? [...interaction.member.roles.cache.keys()]
             : (interaction.member?.roles ?? []),
+        ...(interaction.member instanceof GuildMember
+            ? { userHighestRolePosition: interaction.member.roles.highest.position }
+            : {}),
         userPermissions: interaction.memberPermissions
             ?.toArray()
             .map(normalizeDiscordPermission) ?? [],
@@ -525,6 +531,12 @@ function createModalContext(interaction, services) {
                 roleIds: [...(selected?.roles.keys() ?? [])],
             };
         },
+        getSelectedRolePositions: (customId) => {
+            const roles = interaction.fields.getSelectedRoles(customId, false);
+            return Object.fromEntries([...(roles?.values() ?? [])]
+                .filter((role) => role !== null)
+                .map((role) => [role.id, role.position]));
+        },
         getSelectedChannelIds: (customId) => [
             ...(interaction.fields.getSelectedChannels(customId, false)?.keys() ??
                 []),
@@ -624,7 +636,8 @@ export async function authorizeCommand(interaction, moduleId, commandId, rateLim
             const permissions = services.get(HELYX_SERVICE_NAMES.permissions);
             const policy = await permissions.getEffectivePolicy(interaction.guildId, moduleId, commandId);
             const actor = permissionActor(interaction);
-            if (!canUseCommand(actor, policy)) {
+            const guildAccess = await permissions.getGuildAccessPolicy?.(interaction.guildId);
+            if (!canUseCommand(actor, policy, guildAccess)) {
                 await interaction.reply({
                     content: "You do not have permission to use this command.",
                     flags: MessageFlags.Ephemeral,
@@ -662,7 +675,8 @@ async function authorizeAutocomplete(interaction, moduleId, commandId, services,
         return true;
     const permissions = services.get(HELYX_SERVICE_NAMES.permissions);
     const policy = await permissions.getEffectivePolicy(interaction.guildId, moduleId, commandId);
-    return canUseCommand(permissionActor(interaction), policy);
+    const guildAccess = await permissions.getGuildAccessPolicy?.(interaction.guildId);
+    return canUseCommand(permissionActor(interaction), policy, guildAccess);
 }
 function permissionActor(interaction) {
     return {
@@ -676,6 +690,9 @@ function permissionActor(interaction) {
         isServerOwner: interaction.guild?.ownerId === interaction.user.id,
         isAdministrator: interaction.memberPermissions?.has(PermissionFlagsBits.Administrator) ??
             false,
+        ...(interaction.member instanceof GuildMember
+            ? { highestRolePosition: interaction.member.roles.highest.position }
+            : {}),
     };
 }
 export function normalizeDiscordPermission(permission) {
@@ -824,100 +841,116 @@ export function toModal(definition) {
     const modal = new ModalBuilder()
         .setCustomId(definition.customId)
         .setTitle(definition.title);
-    for (const text of definition.text ?? []) {
-        modal.addTextDisplayComponents(new TextDisplayBuilder().setContent(text.markdown === false ? escapeMarkdown(text.content) : text.content));
-    }
-    for (const field of definition.fields) {
-        const label = new LabelBuilder().setLabel(field.label);
-        if (field.description !== undefined)
-            label.setDescription(field.description);
-        if (field.type === undefined || field.type === "text") {
-            const input = new TextInputBuilder()
-                .setCustomId(field.customId)
-                .setStyle(field.style === "paragraph"
-                ? TextInputStyle.Paragraph
-                : TextInputStyle.Short)
-                .setRequired(field.required ?? false);
-            if (field.minLength !== undefined)
-                input.setMinLength(field.minLength);
-            if (field.maxLength !== undefined)
-                input.setMaxLength(field.maxLength);
-            if (field.placeholder !== undefined)
-                input.setPlaceholder(field.placeholder);
-            if (field.value !== undefined)
-                input.setValue(field.value);
-            label.setTextInputComponent(input);
-        }
-        else if (field.type === "string-select") {
-            const input = new StringSelectMenuBuilder()
-                .setCustomId(field.customId)
-                .setRequired(field.required ?? false)
-                .setMinValues(field.minValues ?? (field.required ? 1 : 0))
-                .setMaxValues(field.maxValues ?? 1)
-                .addOptions(field.options.map((option) => ({ ...option })));
-            if (field.placeholder !== undefined)
-                input.setPlaceholder(field.placeholder);
-            label.setStringSelectMenuComponent(input);
-        }
-        else if (field.type === "discord-user") {
-            const input = new UserSelectMenuBuilder()
-                .setCustomId(field.customId)
-                .setRequired(field.required ?? false)
-                .setMinValues(field.minValues ?? (field.required ? 1 : 0))
-                .setMaxValues(field.maxValues ?? 1);
-            if (field.placeholder !== undefined)
-                input.setPlaceholder(field.placeholder);
-            if (field.defaultValues?.length)
-                input.setDefaultUsers(...field.defaultValues);
-            label.setUserSelectMenuComponent(input);
-        }
-        else if (field.type === "discord-role") {
-            const input = new RoleSelectMenuBuilder()
-                .setCustomId(field.customId)
-                .setRequired(field.required ?? false)
-                .setMinValues(field.minValues ?? (field.required ? 1 : 0))
-                .setMaxValues(field.maxValues ?? 1);
-            if (field.placeholder !== undefined)
-                input.setPlaceholder(field.placeholder);
-            if (field.defaultValues?.length)
-                input.setDefaultRoles(...field.defaultValues);
-            label.setRoleSelectMenuComponent(input);
-        }
-        else if (field.type === "discord-mentionable") {
-            const input = new MentionableSelectMenuBuilder()
-                .setCustomId(field.customId)
-                .setRequired(field.required ?? false)
-                .setMinValues(field.minValues ?? (field.required ? 1 : 0))
-                .setMaxValues(field.maxValues ?? 1);
-            if (field.placeholder !== undefined)
-                input.setPlaceholder(field.placeholder);
-            if (field.defaultValues?.length) {
-                input.addDefaultUsers(...field.defaultValues
-                    .filter((value) => value.type === "user")
-                    .map((value) => value.id));
-                input.addDefaultRoles(...field.defaultValues
-                    .filter((value) => value.type === "role")
-                    .map((value) => value.id));
-            }
-            label.setMentionableSelectMenuComponent(input);
-        }
-        else if (field.type === "discord-channel") {
-            const input = new ChannelSelectMenuBuilder()
-                .setCustomId(field.customId)
-                .setRequired(field.required ?? false)
-                .setMinValues(field.minValues ?? (field.required ? 1 : 0))
-                .setMaxValues(field.maxValues ?? 1)
-                .setChannelTypes(...field.channelTypes.map(discordChannelType));
-            if (field.placeholder !== undefined)
-                input.setPlaceholder(field.placeholder);
-            if (field.defaultValues?.length)
-                input.setDefaultChannels(...field.defaultValues);
-            label.setChannelSelectMenuComponent(input);
+    if (definition.items !== undefined &&
+        ((definition.text?.length ?? 0) > 0 || definition.fields.length > 0))
+        throw new Error("Ordered modal items cannot be combined with legacy text or fields");
+    const items = definition.items ?? [
+        ...(definition.text ?? []).map((text) => ({
+            type: "text-display",
+            ...text,
+        })),
+        ...definition.fields,
+    ];
+    if (items.length > 5)
+        throw new Error("Discord modals support at most five components");
+    for (const item of items) {
+        if (item.type !== "text-display") {
+            modal.addLabelComponents(toModalLabel(item));
+            continue;
         }
-        modal.addLabelComponents(label);
+        modal.addTextDisplayComponents(new TextDisplayBuilder().setContent(item.markdown === false ? escapeMarkdown(item.content) : item.content));
     }
     return modal;
 }
+function toModalLabel(field) {
+    const label = new LabelBuilder().setLabel(field.label);
+    if (field.description !== undefined)
+        label.setDescription(field.description);
+    if (field.type === undefined || field.type === "text") {
+        const input = new TextInputBuilder()
+            .setCustomId(field.customId)
+            .setStyle(field.style === "paragraph"
+            ? TextInputStyle.Paragraph
+            : TextInputStyle.Short)
+            .setRequired(field.required ?? false);
+        if (field.minLength !== undefined)
+            input.setMinLength(field.minLength);
+        if (field.maxLength !== undefined)
+            input.setMaxLength(field.maxLength);
+        if (field.placeholder !== undefined)
+            input.setPlaceholder(field.placeholder);
+        if (field.value !== undefined)
+            input.setValue(field.value);
+        label.setTextInputComponent(input);
+    }
+    else if (field.type === "string-select") {
+        const input = new StringSelectMenuBuilder()
+            .setCustomId(field.customId)
+            .setRequired(field.required ?? false)
+            .setMinValues(field.minValues ?? (field.required ? 1 : 0))
+            .setMaxValues(field.maxValues ?? 1)
+            .addOptions(field.options.map((option) => ({ ...option })));
+        if (field.placeholder !== undefined)
+            input.setPlaceholder(field.placeholder);
+        label.setStringSelectMenuComponent(input);
+    }
+    else if (field.type === "discord-user") {
+        const input = new UserSelectMenuBuilder()
+            .setCustomId(field.customId)
+            .setRequired(field.required ?? false)
+            .setMinValues(field.minValues ?? (field.required ? 1 : 0))
+            .setMaxValues(field.maxValues ?? 1);
+        if (field.placeholder !== undefined)
+            input.setPlaceholder(field.placeholder);
+        if (field.defaultValues?.length)
+            input.setDefaultUsers(...field.defaultValues);
+        label.setUserSelectMenuComponent(input);
+    }
+    else if (field.type === "discord-role") {
+        const input = new RoleSelectMenuBuilder()
+            .setCustomId(field.customId)
+            .setRequired(field.required ?? false)
+            .setMinValues(field.minValues ?? (field.required ? 1 : 0))
+            .setMaxValues(field.maxValues ?? 1);
+        if (field.placeholder !== undefined)
+            input.setPlaceholder(field.placeholder);
+        if (field.defaultValues?.length)
+            input.setDefaultRoles(...field.defaultValues);
+        label.setRoleSelectMenuComponent(input);
+    }
+    else if (field.type === "discord-mentionable") {
+        const input = new MentionableSelectMenuBuilder()
+            .setCustomId(field.customId)
+            .setRequired(field.required ?? false)
+            .setMinValues(field.minValues ?? (field.required ? 1 : 0))
+            .setMaxValues(field.maxValues ?? 1);
+        if (field.placeholder !== undefined)
+            input.setPlaceholder(field.placeholder);
+        if (field.defaultValues?.length) {
+            input.addDefaultUsers(...field.defaultValues
+                .filter((value) => value.type === "user")
+                .map((value) => value.id));
+            input.addDefaultRoles(...field.defaultValues
+                .filter((value) => value.type === "role")
+                .map((value) => value.id));
+        }
+        label.setMentionableSelectMenuComponent(input);
+    }
+    else if (field.type === "discord-channel") {
+        const input = new ChannelSelectMenuBuilder()
+            .setCustomId(field.customId)
+            .setRequired(field.required ?? false)
+            .setMinValues(field.minValues ?? (field.required ? 1 : 0))
+            .setMaxValues(field.maxValues ?? 1)
+            .setChannelTypes(...field.channelTypes.map(discordChannelType));
+        if (field.placeholder !== undefined)
+            input.setPlaceholder(field.placeholder);
+        if (field.defaultValues?.length)
+            input.setDefaultChannels(...field.defaultValues);
+        label.setChannelSelectMenuComponent(input);
+    }
+    return label;
+}
 function discordChannelType(type) {
     if (type === "guild_announcement")
         return ChannelType.GuildAnnouncement;

package/dist/permissions-module.js

@@ -1,5 +1,6 @@
 import { defineModule, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
 import { PermissionFlagsBits } from "discord.js";
+import { canMutatePermissionPolicy, permissionMutationDenialMessage, } from "@helyx/core";
 const MODULE_SELECT_ID = "helyx.permissions.module";
 const TARGET_SELECT_ID = "helyx.permissions.target";
 const MODULE_PREVIOUS_ID = "helyx.permissions.module.previous";
@@ -243,9 +244,32 @@ export function createPermissionsModule(configurableModules) {
                             allowedUserIds: [...allowed.userIds],
                             deniedUserIds: [...denied.userIds],
                         };
-                        await context.services
-                            .get(HELYX_SERVICE_NAMES.permissions)
-                            .setPolicy({
+                        const permissionService = context.services.get(HELYX_SERVICE_NAMES.permissions);
+                        const current = await permissionService.getPolicy(context.serverId, moduleId, commandId);
+                        const guildAccess = (await permissionService.getGuildAccessPolicy?.(context.serverId)) ?? {
+                            administratorRoleIds: [],
+                            moderatorRoleIds: [],
+                            dashboardModeratorsEnabled: false,
+                            dashboardAllowedRoleIds: [],
+                            dashboardDeniedRoleIds: [],
+                        };
+                        const rolePositions = {
+                            ...(context.getSelectedRolePositions?.(ALLOWED_MENTIONABLES_FIELD_ID) ?? {}),
+                            ...(context.getSelectedRolePositions?.(DENIED_MENTIONABLES_FIELD_ID) ?? {}),
+                        };
+                        const decision = canMutatePermissionPolicy({
+                            userId: context.userId,
+                            roleIds: context.userRoleIds,
+                            permissions: context.userPermissions ?? [],
+                            isServerOwner: context.isServerOwner ?? false,
+                            isAdministrator: context.isAdministrator,
+                            ...(context.userHighestRolePosition === undefined
+                                ? {}
+                                : { highestRolePosition: context.userHighestRolePosition }),
+                        }, current.policy, policy, guildAccess, rolePositions);
+                        if (!decision.allowed)
+                            throw new Error(permissionMutationDenialMessage(decision.reason));
+                        await permissionService.setPolicy({
                             guildId: context.serverId,
                             moduleId,
                             ...(commandId ? { commandId } : {}),
@@ -326,7 +350,8 @@ export function createPermissionsModule(configurableModules) {
 function restrictedPolicy() {
     return {
         everyone: false,
-        requiredPermissions: ["MANAGE_GUILD"],
+        accessLevel: "moderator",
+        requiredPermissions: [],
         allowedRoleIds: [],
         deniedRoleIds: [],
         allowedUserIds: [],

package/dist/resource-authorization.js

@@ -6,7 +6,8 @@ export class CoreResourceAuthorizationService {
     }
     async canUse(input) {
         const policy = await this.#permissions.getEffectivePolicy(input.guildId, input.moduleId, input.permissionId);
-        return canUseCommand(input.actor, policy);
+        const guildAccess = await this.#permissions.getGuildAccessPolicy?.(input.guildId);
+        return canUseCommand(input.actor, policy, guildAccess);
     }
 }
 //# sourceMappingURL=resource-authorization.js.map

package/dist/shard-contracts.d.ts

@@ -169,6 +169,27 @@ export type ShardHealthSnapshot = z.infer<typeof shardHealthSnapshotSchema>;
 export declare const shardControlOperationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"guild.state.get">;
     guildId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"guild.dashboard.access">;
+    guildId: z.ZodString;
+    actorUserId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"guild.access-policy.get">;
+    guildId: z.ZodString;
+    actorUserId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    actorUserId: z.ZodString;
+    correlationId: z.ZodString;
+    kind: z.ZodLiteral<"guild.access-policy.update">;
+    guildId: z.ZodString;
+    version: z.ZodNumber;
+    policy: z.ZodObject<{
+        administratorRoleIds: z.ZodArray<z.ZodString>;
+        moderatorRoleIds: z.ZodArray<z.ZodString>;
+        dashboardModeratorsEnabled: z.ZodBoolean;
+        dashboardAllowedRoleIds: z.ZodArray<z.ZodString>;
+        dashboardDeniedRoleIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"guild.module.public.read">;
     guildId: z.ZodString;
@@ -285,6 +306,8 @@ export declare const shardControlOperationSchema: z.ZodDiscriminatedUnion<[z.Zod
     relationId: z.ZodString;
     cursor: z.ZodOptional<z.ZodString>;
     limit: z.ZodNumber;
+    search: z.ZodOptional<z.ZodString>;
+    filters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strict>, z.ZodObject<{
     actorUserId: z.ZodString;
     correlationId: z.ZodString;
@@ -485,6 +508,27 @@ export declare const shardControlRequestSchema: z.ZodObject<{
     operation: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"guild.state.get">;
         guildId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"guild.dashboard.access">;
+        guildId: z.ZodString;
+        actorUserId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"guild.access-policy.get">;
+        guildId: z.ZodString;
+        actorUserId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        actorUserId: z.ZodString;
+        correlationId: z.ZodString;
+        kind: z.ZodLiteral<"guild.access-policy.update">;
+        guildId: z.ZodString;
+        version: z.ZodNumber;
+        policy: z.ZodObject<{
+            administratorRoleIds: z.ZodArray<z.ZodString>;
+            moderatorRoleIds: z.ZodArray<z.ZodString>;
+            dashboardModeratorsEnabled: z.ZodBoolean;
+            dashboardAllowedRoleIds: z.ZodArray<z.ZodString>;
+            dashboardDeniedRoleIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"guild.module.public.read">;
         guildId: z.ZodString;
@@ -601,6 +645,8 @@ export declare const shardControlRequestSchema: z.ZodObject<{
         relationId: z.ZodString;
         cursor: z.ZodOptional<z.ZodString>;
         limit: z.ZodNumber;
+        search: z.ZodOptional<z.ZodString>;
+        filters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strict>, z.ZodObject<{
         actorUserId: z.ZodString;
         correlationId: z.ZodString;
@@ -1306,6 +1352,27 @@ export declare const supervisorMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     operation: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"guild.state.get">;
         guildId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"guild.dashboard.access">;
+        guildId: z.ZodString;
+        actorUserId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"guild.access-policy.get">;
+        guildId: z.ZodString;
+        actorUserId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        actorUserId: z.ZodString;
+        correlationId: z.ZodString;
+        kind: z.ZodLiteral<"guild.access-policy.update">;
+        guildId: z.ZodString;
+        version: z.ZodNumber;
+        policy: z.ZodObject<{
+            administratorRoleIds: z.ZodArray<z.ZodString>;
+            moderatorRoleIds: z.ZodArray<z.ZodString>;
+            dashboardModeratorsEnabled: z.ZodBoolean;
+            dashboardAllowedRoleIds: z.ZodArray<z.ZodString>;
+            dashboardDeniedRoleIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"guild.module.public.read">;
         guildId: z.ZodString;
@@ -1422,6 +1489,8 @@ export declare const supervisorMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         relationId: z.ZodString;
         cursor: z.ZodOptional<z.ZodString>;
         limit: z.ZodNumber;
+        search: z.ZodOptional<z.ZodString>;
+        filters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strict>, z.ZodObject<{
         actorUserId: z.ZodString;
         correlationId: z.ZodString;

package/dist/shard-contracts.js

@@ -46,6 +46,15 @@ const permissionState = z
         .max(100),
 })
     .strict();
+const guildAccessPolicy = z
+    .object({
+    administratorRoleIds: z.array(snowflake).max(25),
+    moderatorRoleIds: z.array(snowflake).max(25),
+    dashboardModeratorsEnabled: z.boolean(),
+    dashboardAllowedRoleIds: z.array(snowflake).max(25),
+    dashboardDeniedRoleIds: z.array(snowflake).max(25),
+})
+    .strict();
 const configurationValue = z.record(z.string().min(1).max(100), z.union([
     z.null(),
     z.string().max(4_000),
@@ -222,6 +231,29 @@ export const shardHealthSnapshotSchema = z
 });
 export const shardControlOperationSchema = z.discriminatedUnion("kind", [
     z.object({ kind: z.literal("guild.state.get"), guildId: snowflake }).strict(),
+    z
+        .object({
+        kind: z.literal("guild.dashboard.access"),
+        guildId: snowflake,
+        actorUserId: snowflake,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("guild.access-policy.get"),
+        guildId: snowflake,
+        actorUserId: snowflake,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("guild.access-policy.update"),
+        guildId: snowflake,
+        version: z.number().int().min(0),
+        policy: guildAccessPolicy,
+        ...mutationContext.shape,
+    })
+        .strict(),
     z
         .object({
         kind: z.literal("guild.module.public.read"),
@@ -330,6 +362,8 @@ export const shardControlOperationSchema = z.discriminatedUnion("kind", [
         relationId: resourceType,
         cursor: resourceCursor.optional(),
         limit: z.number().int().min(1).max(50),
+        search: z.string().trim().min(1).max(200).optional(),
+        filters: managedResourceFilters.optional(),
         ...mutationContext.shape,
     })
         .strict(),
@@ -911,6 +945,12 @@ export async function executeShardControlOperation(handler, operation) {
             });
         case "guild.state.get":
             return handler.getGuildState(operation.guildId);
+        case "guild.dashboard.access":
+            return handler.canAccessDashboard(operation);
+        case "guild.access-policy.get":
+            return handler.getGuildAccessPolicy(operation);
+        case "guild.access-policy.update":
+            return handler.updateGuildAccessPolicy(operation);
         case "guild.module.public.read":
             return handler.readPublicModuleProjection({
                 guildId: operation.guildId,
@@ -1008,6 +1048,10 @@ export async function executeShardControlOperation(handler, operation) {
                 resourceId: operation.resourceId,
                 relationId: operation.relationId,
                 ...(operation.cursor === undefined ? {} : { cursor: operation.cursor }),
+                ...(operation.search === undefined ? {} : { search: operation.search }),
+                ...(operation.filters === undefined
+                    ? {}
+                    : { filters: operation.filters }),
                 limit: operation.limit,
                 actorUserId: operation.actorUserId,
                 correlationId: operation.correlationId,

package/dist/shard-router.d.ts

@@ -16,6 +16,9 @@ export declare class ShardControlRouter implements BotControlHandler {
         notificationGuildId?: string;
     });
     getGuildState(guildId: string): ReturnType<BotControlHandler["getGuildState"]>;
+    canAccessDashboard(input: Parameters<BotControlHandler["canAccessDashboard"]>[0]): ReturnType<BotControlHandler["canAccessDashboard"]>;
+    getGuildAccessPolicy(input: Parameters<BotControlHandler["getGuildAccessPolicy"]>[0]): ReturnType<BotControlHandler["getGuildAccessPolicy"]>;
+    updateGuildAccessPolicy(input: Parameters<BotControlHandler["updateGuildAccessPolicy"]>[0]): ReturnType<BotControlHandler["updateGuildAccessPolicy"]>;
     readPublicModuleProjection(input: Parameters<BotControlHandler["readPublicModuleProjection"]>[0]): ReturnType<BotControlHandler["readPublicModuleProjection"]>;
     canAccessManagedResource(input: Parameters<BotControlHandler["canAccessManagedResource"]>[0]): ReturnType<BotControlHandler["canAccessManagedResource"]>;
     listGuildPresence(input: Parameters<BotControlHandler["listGuildPresence"]>[0]): ReturnType<BotControlHandler["listGuildPresence"]>;

package/dist/shard-router.js

@@ -1,7 +1,12 @@
 import { randomUUID } from "node:crypto";
 import { BotControlTransportError, } from "./control-server.js";
 import { SHARD_CONTROL_TIMEOUT_MS, controlOperationGuildId, guildIdToShardId, shardControlOperationSchema, shardControlResponseSchema, } from "./shard-contracts.js";
-const LEASE_VALIDATION_TIMEOUT_MS = 1_000;
+// Cross-region/public Redis connections used by local staging routinely take
+// just under one second. Privacy operations validate the leader lease several
+// times in succession (provider discovery plus execution), so a one-second
+// deadline turned healthy leases into deterministic 503s. Keep the check
+// bounded while allowing normal network variance.
+const LEASE_VALIDATION_TIMEOUT_MS = 3_000;
 export class ShardControlRouter {
     input;
     constructor(input) {
@@ -10,6 +15,25 @@ export class ShardControlRouter {
     getGuildState(guildId) {
         return this.#route({ kind: "guild.state.get", guildId });
     }
+    canAccessDashboard(input) {
+        return this.#route({ kind: "guild.dashboard.access", ...input });
+    }
+    getGuildAccessPolicy(input) {
+        return this.#route({ kind: "guild.access-policy.get", ...input });
+    }
+    updateGuildAccessPolicy(input) {
+        return this.#route({
+            kind: "guild.access-policy.update",
+            ...input,
+            policy: {
+                administratorRoleIds: [...input.policy.administratorRoleIds],
+                moderatorRoleIds: [...input.policy.moderatorRoleIds],
+                dashboardModeratorsEnabled: input.policy.dashboardModeratorsEnabled,
+                dashboardAllowedRoleIds: [...input.policy.dashboardAllowedRoleIds],
+                dashboardDeniedRoleIds: [...input.policy.dashboardDeniedRoleIds],
+            },
+        });
+    }
     readPublicModuleProjection(input) {
         return this.#route({ kind: "guild.module.public.read", ...input });
     }

package/dist/supervisor-cloud-directory.d.ts

@@ -1,6 +1,6 @@
 import type { DatabasePool } from "@helyx/database";
 import type { CloudDiscordDirectory, CloudDiscordSnapshot } from "./cloud-connector.js";
-export declare const CLOUD_HELLO_GUILD_LIMIT = 10000;
+export declare const CLOUD_HELLO_GUILD_LIMIT = 1000;
 export declare class SupervisorCloudDiscordDirectory implements CloudDiscordDirectory {
     #private;
     private readonly database;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/bot",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "description": "Production Discord runtime for the modular Helyx platform.",
   "keywords": [
     "helyx",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@helyx/config": ">=0.5.0 <0.6.0",
-    "@helyx/control-protocol": ">=0.3.0 <0.4.0",
+    "@helyx/control-protocol": ">=0.4.0 <0.5.0",
     "@helyx/core": ">=0.1.0 <0.2.0",
-    "@helyx/database": ">=0.7.10 <0.8.0",
+    "@helyx/database": ">=0.8.0 <0.9.0",
     "@helyx/framework": ">=0.1.0 <0.2.0",
     "@helyx/module-manifest": ">=0.6.0 <0.7.0",
-    "@helyx/platform": ">=0.4.0 <0.5.0",
-    "@helyx/sdk": ">=0.6.0 <0.7.0",
+    "@helyx/platform": ">=0.5.0 <0.6.0",
+    "@helyx/sdk": ">=0.7.0 <0.8.0",
     "@helyx/verification-contracts": ">=0.3.0 <0.4.0",
     "discord.js": "14.27.0",
     "fastify": "5.10.0",