@helyx/bot 0.4.30 → 0.4.32

package/dist/modules.d.ts

@@ -12,11 +12,13 @@ export interface ConfiguredModulePackage extends LoadedDefinition {
 }
 export declare const secureRandomSelectionWorkerKeyName = "HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY";
 interface PlatformServiceEnvironment extends Pick<BotEnvironment, "HELYX_DATA_ENCRYPTION_KEY"> {
+    HELYX_DASHBOARD_PUBLIC_URL?: string;
     HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY?: string;
 }
 export declare function deriveSecureRandomSelectionKey(encodedDataEncryptionKey: string): Uint8Array;
 export declare function platformServiceOptions(environment: PlatformServiceEnvironment, modules: readonly ModuleDefinition[]): {
     secureRandomSelectionKey?: Uint8Array;
+    dashboardBaseUrl?: string;
 };
 export declare function loadConfiguredModules(specifiers: readonly string[], importer?: ModuleImporter): Promise<ModuleDefinition[]>;
 export declare function loadConfiguredModulePackages(specifiers: readonly string[], importer?: ModuleImporter, resolvePackageJson?: PackageJsonResolver, readPackageJson?: PackageJsonReader): Promise<ConfiguredModulePackage[]>;

package/dist/modules.js

@@ -21,9 +21,13 @@ export function deriveSecureRandomSelectionKey(encodedDataEncryptionKey) {
         .digest();
 }
 export function platformServiceOptions(environment, modules) {
+    const urls = environment.HELYX_DASHBOARD_PUBLIC_URL
+        ? { dashboardBaseUrl: environment.HELYX_DASHBOARD_PUBLIC_URL }
+        : {};
     const internalSelectionKey = environment.HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY;
     if (internalSelectionKey) {
         return {
+            ...urls,
             secureRandomSelectionKey: decodeSecureRandomSelectionKey(internalSelectionKey, secureRandomSelectionWorkerKeyName),
         };
     }
@@ -32,9 +36,10 @@ export function platformServiceOptions(environment, modules) {
         if (modules.some(({ manifest }) => manifest.id === giveawaysModuleId)) {
             throw new Error("HELYX_DATA_ENCRYPTION_KEY is required when Giveaways is loaded");
         }
-        return {};
+        return urls;
     }
     return {
+        ...urls,
         secureRandomSelectionKey: deriveSecureRandomSelectionKey(encodedKey),
     };
 }
@@ -103,7 +108,11 @@ export function validateContributionParity(definition) {
         ...(definition.events?.guildVoiceSession ?? []),
         ...(definition.events?.messageReactionAdd ?? []),
         ...(definition.events?.messageReactionRemove ?? []),
+        ...(definition.events?.messageReactionRemoveAll ?? []),
+        ...(definition.events?.messageReactionRemoveEmoji ?? []),
+        ...(definition.events?.guildMessageUpdate ?? []),
         ...(definition.events?.messageDelete ?? []),
+        ...(definition.events?.guildMessageDeleteBulk ?? []),
         ...(definition.events?.guildMemberAdd ?? []),
         ...(definition.events?.guildMemberRemove ?? []),
         ...(definition.events?.guildRoleDelete ?? []),

package/dist/oauth-module.d.ts

@@ -0,0 +1,2 @@
+export declare function createOAuthModule(): import("@helyx/sdk").ModuleDefinition;
+//# sourceMappingURL=oauth-module.d.ts.map

package/dist/oauth-module.js

@@ -0,0 +1,192 @@
+import { defineModule, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+const MODULE_ID = "helyx.oauth";
+const MODAL_ID = "helyx.oauth.revoke";
+const SERVICE_FIELD_ID = "helyx.oauth.revoke.service";
+const CONFIRM_FIELD_ID = "helyx.oauth.revoke.confirm";
+const COMMENT_FIELD_ID = "helyx.oauth.revoke.comment";
+const everyonePolicy = {
+    everyone: true,
+    requiredPermissions: [],
+    allowedRoleIds: [],
+    deniedRoleIds: [],
+    allowedUserIds: [],
+    deniedUserIds: [],
+};
+export function createOAuthModule() {
+    return defineModule({
+        manifest: {
+            manifestVersion: "0.1",
+            releaseStatus: "live",
+            id: MODULE_ID,
+            name: "Helyx OAuth",
+            version: "0.1.0",
+            description: "Provides self-service OAuth connection revocation.",
+            entry: "./dist/oauth-module.js",
+            framework: "^0.1.0",
+            dependencies: [],
+            permissions: [],
+            contributions: { commands: ["oauth"], events: [] },
+        },
+        defaultPermissions: {
+            module: everyonePolicy,
+            commands: { "oauth.revoke": everyonePolicy },
+        },
+        interactions: {
+            commands: [
+                {
+                    name: "oauth",
+                    description: "Manage OAuth access granted to Helyx.",
+                    registration: "global",
+                    contexts: ["guild"],
+                    integrationTypes: ["guild_install"],
+                    subcommands: [
+                        {
+                            name: "revoke",
+                            description: "Revoke a service and delete the OAuth details Helyx stores for you.",
+                            rateLimit: { scope: "user", limit: 5, windowSeconds: 60 },
+                            execute: async (context) => {
+                                const oauth = context.services.get(HELYX_SERVICE_NAMES.oauth);
+                                let connections;
+                                try {
+                                    connections = await oauth.listConnections({
+                                        discordUserId: context.userId,
+                                    });
+                                }
+                                catch {
+                                    await context.reply(unavailable());
+                                    return;
+                                }
+                                if (connections.length === 0) {
+                                    await context.reply({
+                                        ephemeral: true,
+                                        componentsV2: {
+                                            text: [
+                                                {
+                                                    content: "You do not have any OAuth services connected to Helyx.",
+                                                },
+                                            ],
+                                        },
+                                    });
+                                    return;
+                                }
+                                await context.showModal({
+                                    customId: MODAL_ID,
+                                    title: "Revoke OAuth access",
+                                    items: [
+                                        {
+                                            type: "text-display",
+                                            content: "Choose one connection. This disconnects the service from Helyx everywhere. Any Helyx module, server or panel using it will lose access.",
+                                        },
+                                        {
+                                            type: "string-select",
+                                            customId: SERVICE_FIELD_ID,
+                                            label: "Connected service",
+                                            placeholder: "Choose a connection",
+                                            required: true,
+                                            minValues: 1,
+                                            maxValues: 1,
+                                            options: connections.slice(0, 25).map((connection) => ({
+                                                label: `${providerName(connection.provider)} — ${connection.displayName}`.slice(0, 100),
+                                                value: connection.selectionRef,
+                                                description: "Remove this connection",
+                                            })),
+                                        },
+                                        {
+                                            type: "string-select",
+                                            customId: CONFIRM_FIELD_ID,
+                                            label: "Confirm removal",
+                                            placeholder: "Select Remove access",
+                                            required: true,
+                                            minValues: 1,
+                                            maxValues: 1,
+                                            options: [
+                                                {
+                                                    label: "Remove access",
+                                                    value: "remove_access",
+                                                    description: "Revoke access and delete my stored details",
+                                                },
+                                            ],
+                                        },
+                                        {
+                                            customId: COMMENT_FIELD_ID,
+                                            label: "Reason or comment (optional)",
+                                            description: "Stored only in Helyx's restricted security audit.",
+                                            style: "paragraph",
+                                            required: false,
+                                            maxLength: 250,
+                                        },
+                                    ],
+                                    fields: [],
+                                });
+                            },
+                        },
+                    ],
+                },
+            ],
+            modals: [
+                {
+                    customId: MODAL_ID,
+                    execute: async (context) => {
+                        const selectionRef = context.getStringSelectValues(SERVICE_FIELD_ID)[0];
+                        const confirmation = context.getStringSelectValues(CONFIRM_FIELD_ID)[0];
+                        if (!selectionRef || confirmation !== "remove_access") {
+                            await context.reply({
+                                ephemeral: true,
+                                componentsV2: {
+                                    text: [{ content: "Access was not removed." }],
+                                },
+                            });
+                            return;
+                        }
+                        const comment = context.getField(COMMENT_FIELD_ID).trim();
+                        await context.deferReply?.(true);
+                        try {
+                            const result = await context.services
+                                .get(HELYX_SERVICE_NAMES.oauth)
+                                .revoke({
+                                discordUserId: context.userId,
+                                selectionRef,
+                                confirmation: "remove_access",
+                                ...(comment ? { comment } : {}),
+                                correlationId: context.interactionId,
+                            });
+                            await context.reply({
+                                ephemeral: true,
+                                componentsV2: {
+                                    text: [
+                                        {
+                                            content: result.providerRevocation === "completed"
+                                                ? `${providerName(result.provider)} access has been removed from Helyx. Local credentials were deleted.`
+                                                : `${providerName(result.provider)} access has been removed from Helyx and local credentials were deleted. Helyx could not confirm provider-side revocation, so you may also remove Helyx from your ${providerName(result.provider)} connected-app settings.`,
+                                        },
+                                    ],
+                                },
+                            });
+                        }
+                        catch {
+                            await context.reply(unavailable());
+                        }
+                    },
+                },
+            ],
+        },
+        start: () => Promise.resolve(),
+        stop: () => Promise.resolve(),
+    });
+}
+function providerName(provider) {
+    return provider === "youtube" ? "YouTube" : "Twitch";
+}
+function unavailable() {
+    return {
+        ephemeral: true,
+        componentsV2: {
+            text: [
+                {
+                    content: "OAuth access could not be updated right now. Nothing new was retained; please try again.",
+                },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=oauth-module.js.map

package/dist/oauth-module.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth-module.test.d.ts.map

package/dist/oauth-module.test.js

@@ -0,0 +1,172 @@
+import { HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { describe, expect, it, vi } from "vitest";
+import { createOAuthModule } from "./oauth-module.js";
+describe("global OAuth command", () => {
+    it("is global, guild-scoped and available without management permissions", () => {
+        const module = createOAuthModule();
+        const command = module.interactions?.commands?.[0];
+        const revoke = command?.subcommands?.[0];
+        expect(command).toMatchObject({
+            name: "oauth",
+            registration: "global",
+            contexts: ["guild"],
+            integrationTypes: ["guild_install"],
+        });
+        expect(revoke).toMatchObject({
+            name: "revoke",
+            rateLimit: { scope: "user", limit: 5, windowSeconds: 60 },
+        });
+        expect(module.manifest.permissions).toEqual([]);
+        expect(module.defaultPermissions?.commands["oauth.revoke"]).toMatchObject({
+            everyone: true,
+            requiredPermissions: [],
+        });
+    });
+    it("does not open a modal when the acting user has no connections", async () => {
+        const oauth = oauthService({ connections: [] });
+        const showModal = vi.fn();
+        const replies = [];
+        const command = createOAuthModule().interactions?.commands?.[0]?.subcommands?.[0];
+        await command?.execute(commandContext(oauth, {
+            showModal,
+            reply: (response) => {
+                replies.push(response);
+                return Promise.resolve();
+            },
+        }));
+        expect(showModal).not.toHaveBeenCalled();
+        expect(replies).toEqual([expect.objectContaining({ ephemeral: true })]);
+        expect(replies[0]?.componentsV2?.text?.[0]?.content).toContain("do not have any OAuth services");
+    });
+    it("uses opaque selections and requires explicit removal confirmation", async () => {
+        const oauth = oauthService({
+            connections: [
+                {
+                    selectionRef: "opaque-selection-reference-123",
+                    provider: "youtube",
+                    displayName: "Example creator",
+                    connectedAt: new Date().toISOString(),
+                },
+            ],
+        });
+        const showModal = vi.fn();
+        const command = createOAuthModule().interactions?.commands?.[0]?.subcommands?.[0];
+        await command?.execute(commandContext(oauth, { showModal }));
+        const modal = showModal.mock.calls[0]?.[0];
+        expect(modal?.title).toBe("Revoke OAuth access");
+        const service = modal?.items?.find((item) => "customId" in item && item.customId.endsWith("service"));
+        const confirmation = modal?.items?.find((item) => "customId" in item && item.customId.endsWith("confirm"));
+        expect(service).toMatchObject({
+            type: "string-select",
+            required: true,
+            options: [
+                expect.objectContaining({ value: "opaque-selection-reference-123" }),
+            ],
+        });
+        expect(confirmation).toMatchObject({
+            type: "string-select",
+            required: true,
+            options: [expect.objectContaining({ value: "remove_access" })],
+        });
+    });
+    it("revokes only for the acting user and returns an ephemeral advisory", async () => {
+        const revoke = vi.fn().mockResolvedValue({
+            provider: "twitch",
+            outcome: "completed",
+            providerRevocation: "failed",
+        });
+        const oauth = oauthService({ connections: [], revoke });
+        const replies = [];
+        const modal = createOAuthModule().interactions?.modals?.[0];
+        await modal?.execute(modalContext(oauth, {
+            reply: (response) => {
+                replies.push(response);
+                return Promise.resolve();
+            },
+        }));
+        expect(revoke).toHaveBeenCalledWith({
+            discordUserId: "12345678901234567",
+            selectionRef: "opaque-selection-reference-123",
+            confirmation: "remove_access",
+            comment: "No longer needed",
+            correlationId: "interaction-1",
+        });
+        expect(replies[0]).toMatchObject({ ephemeral: true });
+        expect(replies[0]?.componentsV2?.text?.[0]?.content).toContain("connected-app settings");
+    });
+});
+function oauthService(input) {
+    return {
+        connectionStatus: () => Promise.resolve([]),
+        listConnections: () => Promise.resolve(input.connections),
+        createAuthorization: () => Promise.resolve({
+            authorizationUrl: "https://example.com",
+            expiresAt: "",
+        }),
+        verifyEligibility: () => Promise.resolve({
+            provider: "youtube",
+            status: "unknown",
+            connected: false,
+            checkedAt: new Date().toISOString(),
+        }),
+        revoke: input.revoke ??
+            (() => Promise.resolve({
+                provider: "youtube",
+                outcome: "completed",
+                providerRevocation: "completed",
+            })),
+    };
+}
+function services(oauth) {
+    return {
+        has: (name) => name === HELYX_SERVICE_NAMES.oauth,
+        get: (name) => {
+            if (name !== HELYX_SERVICE_NAMES.oauth)
+                throw new Error("unknown service");
+            return oauth;
+        },
+    };
+}
+function commandContext(oauth, overrides = {}) {
+    return {
+        ...interactionBase(oauth),
+        showModal: () => Promise.resolve(),
+        getStringOption: () => null,
+        getBooleanOption: () => null,
+        getUserOption: () => null,
+        getChannelOption: () => null,
+        getRoleOption: () => null,
+        ...overrides,
+    };
+}
+function modalContext(oauth, overrides = {}) {
+    return {
+        ...interactionBase(oauth),
+        getField: (customId) => customId.endsWith("comment") ? "No longer needed" : "",
+        getStringSelectValues: (customId) => customId.endsWith("service")
+            ? ["opaque-selection-reference-123"]
+            : ["remove_access"],
+        getSelectedUserIds: () => [],
+        getSelectedRoleIds: () => [],
+        getSelectedMentionables: () => ({ userIds: [], roleIds: [] }),
+        getSelectedChannelIds: () => [],
+        ...overrides,
+    };
+}
+function interactionBase(oauth) {
+    return {
+        interactionId: "interaction-1",
+        userId: "12345678901234567",
+        userDisplayName: "Member",
+        userRoleIds: [],
+        isAdministrator: false,
+        serverId: "12345678901234568",
+        services: services(oauth),
+        reply: () => Promise.resolve(),
+        sendToChannel: () => Promise.resolve({ messageId: "message-1" }),
+        deleteChannelMessage: () => Promise.resolve(),
+        editChannelMessage: () => Promise.resolve(),
+        addChannelMessageReaction: () => Promise.resolve(),
+    };
+}
+//# sourceMappingURL=oauth-module.test.js.map

package/dist/oauth-service.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthConnectionSummary, OAuthEligibilityResult, OAuthService } from "@helyx/sdk";
+export declare class HttpOAuthService implements OAuthService {
+    #private;
+    private readonly internalSecret;
+    constructor(baseUrl: string, internalSecret: string);
+    listConnections(input: {
+        discordUserId: string;
+    }): Promise<readonly OAuthConnectionSummary[]>;
+    connectionStatus(input: {
+        discordUserId: string;
+    }): Promise<readonly ("youtube" | "twitch")[]>;
+    createAuthorization(input: Parameters<OAuthService["createAuthorization"]>[0]): ReturnType<OAuthService["createAuthorization"]>;
+    verifyEligibility(input: Parameters<OAuthService["verifyEligibility"]>[0]): Promise<OAuthEligibilityResult>;
+    revoke(input: Parameters<OAuthService["revoke"]>[0]): ReturnType<OAuthService["revoke"]>;
+}
+//# sourceMappingURL=oauth-service.d.ts.map

package/dist/oauth-service.js

@@ -0,0 +1,40 @@
+export class HttpOAuthService {
+    internalSecret;
+    #baseUrl;
+    constructor(baseUrl, internalSecret) {
+        this.internalSecret = internalSecret;
+        this.#baseUrl = new URL(baseUrl);
+    }
+    async listConnections(input) {
+        const result = await this.#request("/v1/internal/oauth/connections", input);
+        return result.connections;
+    }
+    async connectionStatus(input) {
+        const result = await this.#request("/v1/internal/oauth/status", input);
+        return result.providers;
+    }
+    createAuthorization(input) {
+        return this.#request("/v1/internal/oauth/authorizations", input);
+    }
+    verifyEligibility(input) {
+        return this.#request("/v1/internal/oauth/eligibility", input);
+    }
+    revoke(input) {
+        return this.#request("/v1/internal/oauth/revocations", input);
+    }
+    async #request(path, body) {
+        const response = await fetch(new URL(path, this.#baseUrl), {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${this.internalSecret}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(6_000),
+        });
+        if (!response.ok)
+            throw new Error(`oauth_service_http_${response.status}`);
+        return (await response.json());
+    }
+}
+//# sourceMappingURL=oauth-service.js.map

package/dist/shard-supervisor.js

@@ -22,6 +22,7 @@ import { ShardControlRouter } from "./shard-router.js";
 import { createDeveloperOperationsModule } from "./developer-operations-module.js";
 import { SupervisorCloudDiscordDirectory } from "./supervisor-cloud-directory.js";
 import { createSupportModule } from "./support-module.js";
+import { createOAuthModule } from "./oauth-module.js";
 import { createScheduledTaskRunner, schedulerOperationalHealth, } from "./scheduled-task-runner.js";
 import { numericWriteBehindRegistrations } from "./numeric-write-behind.js";
 import { executeRedisNumericOperation, RedisNumericWriteBehindService, } from "./numeric-write-behind-redis.js";
@@ -187,10 +188,14 @@ export async function startShardSupervisor(environment, processEnvironment, work
             })
             : undefined;
         const supportModule = createSupportModule(cloudConnector);
+        const oauthModule = environment.HELYX_OAUTH_ENABLED
+            ? createOAuthModule()
+            : undefined;
         const publicModules = [
             managementModule,
             permissionsModule,
             supportModule,
+            ...(oauthModule ? [oauthModule] : []),
             ...(cloudManagementModule ? [cloudManagementModule] : []),
             ...featureModules,
         ];
@@ -210,6 +215,7 @@ export async function startShardSupervisor(environment, processEnvironment, work
                     managementModule,
                     permissionsModule,
                     supportModule,
+                    ...(oauthModule ? [oauthModule] : []),
                     ...(cloudManagementModule ? [cloudManagementModule] : []),
                 ].map(({ manifest }) => manifest),
                 modules: featureModules.map(({ manifest }) => manifest),

package/dist/shard-worker.d.ts

@@ -34,6 +34,7 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     APPROVED_ROLES: string[];
     HELYX_MODULE_PACKAGES: string[];
     HELYX_MODULE_CATALOGUE_PATH: string | undefined;
+    HELYX_DASHBOARD_PUBLIC_URL: string;
     HELYX_SUPPORT_STAFF_CHANNEL_ID: string | undefined;
     HELYX_VERIFICATION_ENABLED: boolean;
     HELYX_VERIFICATION_SIGNING_PUBLIC_KEYS: Record<string, string>;
@@ -41,10 +42,12 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     HELYX_GUILD_RECONCILIATION_INTERVAL_SECONDS: number;
     HELYX_PRIVACY_ENABLED: boolean;
     HELYX_MESSAGE_CONTENT_ENABLED: boolean;
+    HELYX_GUILD_MEMBERS_ENABLED: boolean;
     HELYX_CLOUD_CONNECT_ENABLED: boolean;
     HELYX_CLOUD_ENROLMENT_TOKEN: string | undefined;
     HELYX_CLOUD_ENROLMENT_FILE: string;
     HELYX_CLOUD_API_URL: string;
+    HELYX_OAUTH_ENABLED: boolean;
     HELYX_CLOUD_ENDPOINT: string;
     HELYX_OWNER_USER_IDS: string[];
     HELYX_SHARD_MODE: "off" | "auto" | "fixed";
@@ -60,6 +63,7 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     HELYX_VERIFICATION_INTERNAL_SECRET?: string | undefined;
     HELYX_PRIVACY_EXECUTOR_DATABASE_URL?: string | undefined;
     HELYX_PRIVACY_EXECUTOR_DATABASE_SSL?: "disable" | "require" | "verify-full" | undefined;
+    HELYX_OAUTH_INTERNAL_SECRET?: string | undefined;
     HELYX_SHARD_COUNT?: number | undefined;
     HELYX_SHARD_REDIS_URL?: string | undefined;
     HELYX_SHARD_REDIS_NAMESPACE?: string | undefined;
@@ -71,5 +75,6 @@ export declare function shardWorkerCommandRegistration(input: {
     prepare: NonNullable<CommandRegistration["prepare"]>;
     operationsModuleId?: string;
     supportModuleId: string;
+    oauthModuleId?: string;
 }): CommandRegistration;
 //# sourceMappingURL=shard-worker.d.ts.map

package/dist/shard-worker.js

@@ -20,11 +20,14 @@ import { loadConfiguredModulePackages, platformServiceOptions, secureRandomSelec
 import { createPermissionsModule } from "./permissions-module.js";
 import { WorkerCloudConnectorProxy } from "./shard-cloud-proxy.js";
 import { DiscordOwnedMessageDeletionService } from "./discord-owned-message-service.js";
+import { DiscordGuildHealthInspection } from "./discord-guild-health.js";
 import { CoreResourceAuthorizationService } from "./resource-authorization.js";
 import { createDeveloperOperationsModule, WorkerShardHealthProvider, } from "./developer-operations-module.js";
 import { assertShardMessageSize, controlOperationGuildId, executeShardControlOperation, guildIdToShardId, SHARD_LEASE_HEARTBEAT_TIMEOUT_MS, shardIdentitySchema, supervisorMessageSchema, } from "./shard-contracts.js";
 import { gatewayIntentsForModules, readBotVersion, } from "./index.js";
 import { createSupportModule } from "./support-module.js";
+import { createOAuthModule } from "./oauth-module.js";
+import { HttpOAuthService } from "./oauth-service.js";
 import { createLocalScheduledTaskRoute, } from "./scheduled-task-runner.js";
 import { createLocalNumericWriteBehind } from "./numeric-write-behind.js";
 import { WorkerNumericWriteBehindProxy } from "./numeric-write-behind-proxy.js";
@@ -111,7 +114,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
         const modulePackages = await loadConfiguredModulePackages(moduleSpecifiers);
         const featureModules = modulePackages.map(({ definition }) => definition);
         client = new Client({
-            intents: gatewayIntentsForModules(featureModules, environment.HELYX_MESSAGE_CONTENT_ENABLED),
+            intents: gatewayIntentsForModules(featureModules, environment.HELYX_MESSAGE_CONTENT_ENABLED, environment.HELYX_GUILD_MEMBERS_ENABLED),
             partials: [Partials.Message, Partials.Channel, Partials.Reaction],
             allowedMentions: { parse: [] },
             shards: [identity.shardId],
@@ -130,10 +133,14 @@ export async function startShardWorker(processEnvironment = process.env, identit
             })
             : undefined;
         const supportModule = createSupportModule(cloudProxy);
+        const oauthModule = environment.HELYX_OAUTH_ENABLED
+            ? createOAuthModule()
+            : undefined;
         const publicModules = [
             managementModule,
             permissionsModule,
             supportModule,
+            ...(oauthModule ? [oauthModule] : []),
             ...(cloudManagementModule ? [cloudManagementModule] : []),
             ...featureModules,
         ];
@@ -152,6 +159,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
                     managementModule,
                     permissionsModule,
                     supportModule,
+                    ...(oauthModule ? [oauthModule] : []),
                     ...(cloudManagementModule ? [cloudManagementModule] : []),
                 ].map(({ manifest }) => manifest),
                 modules: featureModules.map(({ manifest }) => manifest),
@@ -182,6 +190,9 @@ export async function startShardWorker(processEnvironment = process.env, identit
             }));
             platformServices.set(HELYX_SERVICE_NAMES.verificationMembers, new DiscordVerificationMemberService(client));
         }
+        if (environment.HELYX_OAUTH_ENABLED &&
+            environment.HELYX_OAUTH_INTERNAL_SECRET)
+            platformServices.set(HELYX_SERVICE_NAMES.oauth, new HttpOAuthService(environment.HELYX_CLOUD_API_URL, environment.HELYX_OAUTH_INTERNAL_SECRET));
         numericWriteBehind =
             identity.scope === "coordinated"
                 ? new WorkerNumericWriteBehindProxy(identity)
@@ -193,6 +204,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
         platformServices.set(HELYX_SERVICE_NAMES.memberEnforcement, new DiscordMemberEnforcementService(client));
         platformServices.set(HELYX_SERVICE_NAMES.memberRoles, new DiscordMemberRoleService(client));
         platformServices.set(HELYX_SERVICE_NAMES.discordResources, new DiscordResourceInspection(client));
+        platformServices.set(HELYX_SERVICE_NAMES.discordGuildHealth, new DiscordGuildHealthInspection(client, publicModules, serviceAccess));
         if (featureModules.some(({ manifest }) => manifest.id === "helyx.logging"))
             platformServices.set(HELYX_SERVICE_NAMES.moduleLogging, new DiscordModuleLoggingService(client, database, publicModules, logger));
         const scheduledTaskRoute = createLocalScheduledTaskRoute({
@@ -205,6 +217,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
             managementModule.manifest.id,
             permissionsModule.manifest.id,
             supportModule.manifest.id,
+            ...(oauthModule ? [oauthModule.manifest.id] : []),
             ...(cloudManagementModule ? [cloudManagementModule.manifest.id] : []),
             ...(operationsModule ? [operationsModule.manifest.id] : []),
         ]);
@@ -226,6 +239,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
                 ? { operationsModuleId: operationsModule.manifest.id }
                 : {}),
             supportModuleId: supportModule.manifest.id,
+            ...(oauthModule ? { oauthModuleId: oauthModule.manifest.id } : {}),
         }), logger, serviceAccess);
         moduleEvents = installModuleEvents(client, publicModules, logger, serviceAccess);
         const controlService = new BotControlService(database, publicModules, guildResources, serviceAccess, undefined, environment.DISCORD_INTERNAL_GUILD_ID &&
@@ -419,6 +433,7 @@ export function shardWorkerCommandRegistration(input) {
         synchronise: false,
         selfAuthorizingGuildModuleIds: new Set([
             input.supportModuleId,
+            ...(input.oauthModuleId ? [input.oauthModuleId] : []),
             ...(input.operationsModuleId ? [input.operationsModuleId] : []),
         ]),
     };