@helyx/bot 0.4.31 → 0.4.33

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.4.33
+
+### Patch Changes
+
+- Add versioned OAuth consumer cleanup contracts, durable and resumable
+  revocation state, least-privilege provider scopes, and Creator Connections
+  cleanup dispatch. Promote the hosted-only Creator Connections module to live
+  availability with clear OAuth activation validation. Ignore shard responses
+  that finish after shutdown has already detached their worker.
+
+## 0.4.32
+
+### Patch Changes
+
+- Add the live Server Health inspection runtime, OAuth service wiring, and faster control-request permission handling.
+
+### Updated Dependencies
+
+- @helyx/config@0.5.4
+- @helyx/database@0.8.1
+- @helyx/platform@0.5.1
+
 ## 0.4.31
 
 ### Patch Changes

package/dist/control-permissions.d.ts

@@ -0,0 +1,38 @@
+import type { ModuleDefinition, PermissionPolicy } from "@helyx/sdk";
+export interface DashboardPermissionPolicy {
+    preset: "everyone" | "moderators" | "administrators" | "custom";
+    allowedRoleIds: string[];
+    deniedRoleIds: string[];
+}
+export interface DashboardPermissionState {
+    version: number;
+    module: DashboardPermissionPolicy;
+    commands: Array<{
+        commandId: string;
+        version: number;
+        enabled: boolean;
+        policy: DashboardPermissionPolicy;
+    }>;
+}
+export interface PermissionPolicyTarget {
+    moduleId: string;
+    commandId?: string;
+}
+export interface ResolvedPermissionPolicy extends PermissionPolicyTarget {
+    policy: PermissionPolicy;
+    version: bigint | null;
+    inherited: boolean;
+}
+export type ManagedResourceOperation = "list" | "read" | "preview" | "create" | "update" | "delete" | "action";
+export declare function declaredManagedResourcePermission(module: ModuleDefinition, resourceType: string, operation: ManagedResourceOperation): string | undefined;
+export declare function dashboardActionPermissionId(module: ModuleDefinition, actionId: string): string;
+export declare function managedResourcePermissionId(module: ModuleDefinition, resourceType: string, operation: ManagedResourceOperation, actionId?: string, declaredPermissionId?: string): string;
+export declare function permissionPolicyKey(target: PermissionPolicyTarget): string;
+export declare function toDashboardPolicy(policy: PermissionPolicy): DashboardPermissionPolicy;
+export declare function fromDashboardPolicy(input: DashboardPermissionPolicy, current: PermissionPolicy): PermissionPolicy;
+export declare function emptyPolicy(): PermissionPolicy;
+export declare function permissionPoliciesEqual(left: PermissionPolicy, right: PermissionPolicy): boolean;
+export declare function safeVersion(version: bigint): number;
+export declare function safeOptionalVersion(version: bigint | null): number;
+export declare function assertVersion(actual: bigint | null, requested: number): void;
+//# sourceMappingURL=control-permissions.d.ts.map

package/dist/control-permissions.js

@@ -0,0 +1,139 @@
+import { OptimisticConcurrencyError } from "@helyx/database";
+export function declaredManagedResourcePermission(module, resourceType, operation) {
+    if (operation === "action")
+        return undefined;
+    return module.manifest.dashboard?.resources?.find(({ id }) => id === resourceType)?.permissions?.[operation];
+}
+export function dashboardActionPermissionId(module, actionId) {
+    const namespace = modulePermissionNamespace(module);
+    return selectDeclaredPermission(module, [
+        `${namespace}.${actionId.replaceAll("-", ".")}`,
+        `${namespace}.configure`,
+    ]);
+}
+export function managedResourcePermissionId(module, resourceType, operation, actionId, declaredPermissionId) {
+    if (declaredPermissionId)
+        return declaredPermissionId;
+    const namespace = modulePermissionNamespace(module);
+    const resourcePermission = `resource.${resourceType}`;
+    const candidates = operation === "create" || operation === "preview"
+        ? [
+            `${resourcePermission}.create`,
+            `${namespace}.create`,
+            `${namespace}.manage`,
+        ]
+        : operation === "update"
+            ? [
+                `${resourcePermission}.update`,
+                `${namespace}.edit`,
+                `${namespace}.manage`,
+            ]
+            : operation === "delete"
+                ? [
+                    `${resourcePermission}.delete`,
+                    `${namespace}.delete`,
+                    `${namespace}.cancel`,
+                    `${namespace}.manage`,
+                ]
+                : operation === "action" && actionId
+                    ? [
+                        `${resourcePermission}.${actionId}`,
+                        `${resourcePermission}.action.${actionId}`,
+                        `${resourcePermission}.action`,
+                        `${namespace}.${actionId.replaceAll("-", ".")}`,
+                        `${namespace}.manage`,
+                    ]
+                    : [
+                        `${resourcePermission}.${operation}`,
+                        `${namespace}.read`,
+                        `${namespace}.list`,
+                        `${namespace}.manage`,
+                        `${namespace}.entries.read`,
+                    ];
+    return selectDeclaredPermission(module, candidates);
+}
+function modulePermissionNamespace(module) {
+    return module.manifest.id.startsWith("helyx.")
+        ? module.manifest.id.slice("helyx.".length)
+        : module.manifest.id;
+}
+function selectDeclaredPermission(module, candidates) {
+    const declared = module.defaultPermissions?.commands ?? {};
+    return (candidates.find((candidate) => candidate in declared) ?? candidates[0]);
+}
+export function permissionPolicyKey(target) {
+    return `${target.moduleId}\u0000${target.commandId ?? ""}`;
+}
+export function toDashboardPolicy(policy) {
+    const preset = policy.everyone
+        ? "everyone"
+        : policy.accessLevel === "administrator"
+            ? "administrators"
+            : policy.accessLevel === "moderator"
+                ? "moderators"
+                : policy.allowedRoleIds.length > 0 &&
+                    policy.requiredPermissions.length === 0
+                    ? "custom"
+                    : policy.requiredPermissions.includes("ADMINISTRATOR")
+                        ? "administrators"
+                        : policy.requiredPermissions.includes("MANAGE_GUILD")
+                            ? "moderators"
+                            : "custom";
+    return {
+        preset,
+        allowedRoleIds: [...policy.allowedRoleIds],
+        deniedRoleIds: [...policy.deniedRoleIds],
+    };
+}
+export function fromDashboardPolicy(input, current) {
+    return {
+        everyone: input.preset === "everyone",
+        ...(input.preset === "administrators"
+            ? { accessLevel: "administrator" }
+            : input.preset === "moderators"
+                ? { accessLevel: "moderator" }
+                : {}),
+        requiredPermissions: [],
+        allowedRoleIds: input.preset === "custom" ? input.allowedRoleIds : [],
+        deniedRoleIds: input.deniedRoleIds,
+        allowedUserIds: [...current.allowedUserIds],
+        deniedUserIds: [...current.deniedUserIds],
+    };
+}
+export function emptyPolicy() {
+    return {
+        everyone: false,
+        requiredPermissions: [],
+        allowedRoleIds: [],
+        deniedRoleIds: [],
+        allowedUserIds: [],
+        deniedUserIds: [],
+    };
+}
+export function permissionPoliciesEqual(left, right) {
+    return (left.everyone === right.everyone &&
+        left.accessLevel === right.accessLevel &&
+        sameStrings(left.requiredPermissions, right.requiredPermissions) &&
+        sameStrings(left.allowedRoleIds, right.allowedRoleIds) &&
+        sameStrings(left.deniedRoleIds, right.deniedRoleIds) &&
+        sameStrings(left.allowedUserIds, right.allowedUserIds) &&
+        sameStrings(left.deniedUserIds, right.deniedUserIds));
+}
+function sameStrings(left, right) {
+    return (left.length === right.length &&
+        left.every((value, index) => value === right[index]));
+}
+export function safeVersion(version) {
+    const value = Number(version);
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error("Configuration version exceeded the supported range");
+    return value;
+}
+export function safeOptionalVersion(version) {
+    return version === null ? 0 : safeVersion(version);
+}
+export function assertVersion(actual, requested) {
+    if (safeOptionalVersion(actual) !== requested)
+        throw new OptimisticConcurrencyError("Permission policy");
+}
+//# sourceMappingURL=control-permissions.js.map

package/dist/control-server.d.ts

@@ -1,14 +1,10 @@
 import { type DatabasePool, type GuildShardOwnership } from "@helyx/database";
-import { type DashboardActionResult, type GuildAccessPolicy, type ManagedResourceCreationIntent, type ManagedResourceDetail, type ManagedResourcePage, type ManagedResourceRelationPage, type ManagedResourceValue, type MessageResponse, type ModuleDefinition, type PermissionActor, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type PublicAchievementProjectionPage, type ServiceAccess } from "@helyx/sdk";
+import { type DashboardActionResult, type GuildAccessPolicy, type ManagedResourceCreationIntent, type ManagedResourceDetail, type ManagedResourcePage, type ManagedResourceRelationPage, type ManagedResourceValue, type MessageResponse, type ModuleDefinition, type OAuthConsumerCleanupResult, type PermissionActor, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type PublicAchievementProjectionPage, type ServiceAccess } from "@helyx/sdk";
 import { type ActionReceipt, type SignedAssessmentEnvelope } from "@helyx/verification-contracts";
 import { type Client } from "discord.js";
 import { type FastifyInstance } from "fastify";
 import { type ShardHealthSnapshot } from "./shard-contracts.js";
-interface DashboardPermissionPolicy {
-    preset: "everyone" | "moderators" | "administrators" | "custom";
-    allowedRoleIds: string[];
-    deniedRoleIds: string[];
-}
+import { type DashboardPermissionPolicy, type DashboardPermissionState } from "./control-permissions.js";
 interface DashboardCommandDefinition {
     id: string;
     name: string;
@@ -52,16 +48,6 @@ interface DashboardLoggingPolicy {
     enabled: boolean;
     version: number;
 }
-interface DashboardPermissionState {
-    version: number;
-    module: DashboardPermissionPolicy;
-    commands: Array<{
-        commandId: string;
-        version: number;
-        enabled: boolean;
-        policy: DashboardPermissionPolicy;
-    }>;
-}
 export interface BotControlGuildResources {
     channels: Array<{
         id: string;
@@ -157,6 +143,17 @@ export interface DashboardGuildAccessState extends GuildAccessPolicy {
     updatedAt: string | null;
 }
 export interface BotControlHandler {
+    cleanupOAuthConsumer(input: {
+        consumerBindingId: string;
+        moduleId: string;
+        provider: "youtube" | "twitch";
+        guildId: string;
+        resourceType: string;
+        resourceId: string;
+        subjectUserId: string;
+        contractVersion: number;
+        correlationId: string;
+    }): Promise<OAuthConsumerCleanupResult>;
     sendSupportNotification(input: SupportNotificationInput): Promise<void>;
     listGuildPresence(input: {
         guildIds: readonly string[];
@@ -353,6 +350,17 @@ export declare class BotControlService implements BotControlHandler {
         guildId: string;
         channelId: string;
     } | undefined, presenceOwnership?: GuildShardOwnership | undefined, presenceShardCount?: number | undefined);
+    cleanupOAuthConsumer(input: {
+        consumerBindingId: string;
+        moduleId: string;
+        provider: "youtube" | "twitch";
+        guildId: string;
+        resourceType: string;
+        resourceId: string;
+        subjectUserId: string;
+        contractVersion: number;
+        correlationId: string;
+    }): Promise<OAuthConsumerCleanupResult>;
     listGuildPresence(input: {
         guildIds: readonly string[];
         correlationId: string;