@helyx/bot 0.5.0 → 0.6.2

package/dist/premium-activation-module.js

@@ -0,0 +1,542 @@
+import { defineModule, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { INTERNAL_MODULE_MANIFEST_FIELDS } from "./internal-module-manifest.js";
+const MODULE_ID = "helyx.premium-activation";
+const PERMISSION_ID = "premium.activate";
+const SESSION_PURPOSE = "premium.activate";
+const SELECT_ID = "helyx.premium-activation.source";
+const COMMIT_PREFIX = "helyx.premium-activation.commit:";
+const CANCEL_PREFIX = "helyx.premium-activation.cancel:";
+const SESSION_LIFETIME_MS = 5 * 60 * 1_000;
+const VIOLET = 0x7c3aed;
+const GREEN = 0x16a34a;
+const RED = 0xdc2626;
+export function createPremiumActivationModule(options) {
+    const now = options.now ?? (() => new Date());
+    return defineModule({
+        manifest: {
+            ...INTERNAL_MODULE_MANIFEST_FIELDS,
+            releaseStatus: "live",
+            id: MODULE_ID,
+            name: "Helyx Premium activation",
+            version: "0.1.0",
+            description: "Assigns purchaser-owned Helyx Premium server slots.",
+            entry: "./dist/premium-activation-module.js",
+            framework: "^0.1.0",
+            dependencies: [],
+            permissions: [],
+            contributions: { commands: ["activate"], events: [] },
+        },
+        defaultPermissions: {
+            module: manageServerPolicy(),
+            commands: { [PERMISSION_ID]: manageServerPolicy() },
+        },
+        interactions: {
+            commands: [
+                {
+                    name: "activate",
+                    description: "Manage your Helyx Premium slot for this server",
+                    registrationPolicy: "platform-global",
+                    contexts: ["guild"],
+                    integrationTypes: ["guild_install"],
+                    permissionId: PERMISSION_ID,
+                    authorization: "self-authorized",
+                    acknowledgement: "deferred-ephemeral",
+                    rateLimit: { scope: "user", limit: 12, windowSeconds: 60 },
+                    async execute(context) {
+                        const guildId = context.serverId;
+                        if (!guildId) {
+                            await context.reply(message("This command can only be used in a server.", RED));
+                            return;
+                        }
+                        if (!(await canManageTarget(context, options.authority))) {
+                            await deny(options.allocations, context, "missing_manage_server");
+                            await context.reply(message("You need Manage Server permission to use this command.", RED));
+                            return;
+                        }
+                        const observedAt = now();
+                        const target = await options.allocations.inspectTarget({
+                            targetGuildId: guildId,
+                            observedAt,
+                        });
+                        if (!target.activeHostedInstallation) {
+                            await deny(options.allocations, context, "target_not_hosted");
+                            await context.reply(message("Helyx is not actively installed on this server.", RED));
+                            return;
+                        }
+                        const allocation = await options.allocations.getAccountAllocation({
+                            accountUserId: context.userId,
+                            provider: options.provider,
+                            providerEnvironment: options.providerEnvironment,
+                            targetGuildId: guildId,
+                            observedAt,
+                        });
+                        await presentInitial(context, options, target, allocation, observedAt);
+                    },
+                },
+            ],
+            selects: [
+                {
+                    customId: SELECT_ID,
+                    acknowledgement: "deferred-update",
+                    async execute(context) {
+                        await selectMoveSource(context, options, now());
+                    },
+                },
+            ],
+            buttons: [
+                {
+                    customIdPrefix: COMMIT_PREFIX,
+                    acknowledgement: "deferred-update",
+                    async execute(context) {
+                        await commit(context, options, now());
+                    },
+                },
+                {
+                    customIdPrefix: CANCEL_PREFIX,
+                    acknowledgement: "deferred-update",
+                    async execute(context) {
+                        const session = await boundSession(context, CANCEL_PREFIX);
+                        if (session)
+                            await context.services
+                                .get(HELYX_SERVICE_NAMES.sessions)
+                                .delete(session.sessionId);
+                        await respond(context, message("Premium slot changes cancelled.", VIOLET));
+                    },
+                },
+            ],
+        },
+        start() {
+            return Promise.resolve();
+        },
+        stop() {
+            return Promise.resolve();
+        },
+    });
+}
+async function presentInitial(context, options, target, allocation, observedAt) {
+    if (!context.serverId)
+        return;
+    const targetView = allocation?.target;
+    const ownSlot = allocation?.slots.find(({ guildId }) => guildId === context.serverId);
+    if (ownSlot && allocation) {
+        const session = await createSession(context, {
+            step: 0,
+            action: "release",
+            subscriptionVersion: allocation.subscriptionVersion.toString(),
+            slotId: ownSlot.slotId,
+            slotVersion: ownSlot.version.toString(),
+            sourceGuildId: context.serverId,
+            adminOverlap: targetView?.hasAdminOverride ?? target.hasAdminOverride,
+        }, observedAt);
+        await context.reply({
+            ...message(target.hasAdminOverride
+                ? "## Premium is active from two sources\nThis server has both an Admin override and your paid slot. Releasing your slot leaves the override active."
+                : "## Premium slot active\nRelease your paid slot from this server? Configuration and data are retained, and the slot is immediately available to assign elsewhere.", target.hasAdminOverride ? RED : VIOLET),
+            buttons: confirmButtons(session.sessionId, "Release slot", "danger", session.version),
+        });
+        return;
+    }
+    if (target.hasAdminOverride) {
+        await context.reply(message("## Premium is already active\nThis server is covered by an Admin override. Your paid slots were not changed.", GREEN));
+        return;
+    }
+    if (target.hasPaidAssignment || targetView?.hasOtherPaidAssignment) {
+        await context.reply(message("## Premium is already active\nThis server already has Premium access. No slot changes were made.", GREEN));
+        return;
+    }
+    if (!allocation || !subscriptionEligible(allocation, observedAt)) {
+        await context.reply(message(`## No active Premium plan\nPurchase or restore Helyx Premium in the [Billing centre](${billingUrl(context)}), then run \`/activate\` again.`, VIOLET));
+        return;
+    }
+    const free = allocation.slots.find((slot) => slot.guildId === null);
+    if (free) {
+        const session = await createSession(context, {
+            step: 0,
+            action: "assign",
+            subscriptionVersion: allocation.subscriptionVersion.toString(),
+        }, observedAt);
+        await context.reply({
+            ...message(`## Premium slot available\n${slotSummary(allocation)}\nActivate the lowest available slot for this server?`, VIOLET),
+            buttons: confirmButtons(session.sessionId, "Activate", "success", session.version),
+        });
+        return;
+    }
+    const movable = (await Promise.all(allocation.slots
+        .filter((slot) => slot.guildId !== null)
+        .map(async (slot) => ({
+        slot,
+        allowed: !slot.activeHostedInstallation ||
+            (await options.authority.canManageGuild({
+                guildId: slot.guildId,
+                userId: context.userId,
+            })),
+    }))))
+        .filter(({ allowed }) => allowed)
+        .map(({ slot }) => slot);
+    if (movable.length === 0) {
+        await deny(options.allocations, context, "missing_manage_server");
+        await context.reply(message("## All slots are assigned\nNo assigned slot you can manage is currently eligible to move.", VIOLET));
+        return;
+    }
+    const session = await createSession(context, {
+        step: 0,
+        action: "move_select",
+        subscriptionVersion: allocation.subscriptionVersion.toString(),
+        candidateSlotIds: movable.map(({ slotId }) => slotId),
+    }, observedAt);
+    await context.reply({
+        ...message("## Move a Premium slot\nChoose one of your eligible source servers. You will confirm the move next.", VIOLET),
+        selects: [
+            {
+                customId: SELECT_ID,
+                placeholder: "Choose a source server",
+                options: movable.slice(0, 25).map((slot) => ({
+                    label: truncate(slot.guildName ?? `Premium slot ${String(slot.ordinal)}`, 100),
+                    description: `Slot ${String(slot.ordinal)} · eligible to move`,
+                    value: `${session.sessionId}.${session.version.toString()}.${slot.slotId}`,
+                })),
+            },
+        ],
+        buttons: [
+            {
+                type: "button",
+                customId: `${CANCEL_PREFIX}${session.sessionId}:${session.version.toString()}`,
+                label: "Cancel",
+                style: "secondary",
+            },
+        ],
+    });
+}
+async function selectMoveSource(context, options, observedAt) {
+    if (!context.serverId ||
+        !(await canManageTarget(context, options.authority))) {
+        await respond(context, message("This Premium session is no longer authorised.", RED));
+        return;
+    }
+    const selected = /^([0-9a-f-]{36})\.(\d+)\.([0-9a-f-]{36})$/iu.exec(context.selectedValues[0] ?? "");
+    if (!selected)
+        return expired(context);
+    const sessions = context.services.get(HELYX_SERVICE_NAMES.sessions);
+    const session = await sessions.get(selected[1]);
+    if (!session || !sessionMatches(session, context, BigInt(selected[2])))
+        return expired(context);
+    const state = parseState(session.state);
+    const slotId = selected[3];
+    if (state.step !== 0 ||
+        state.action !== "move_select" ||
+        !state.candidateSlotIds?.includes(slotId))
+        return expired(context);
+    const allocation = await options.allocations.getAccountAllocation({
+        accountUserId: context.userId,
+        provider: options.provider,
+        providerEnvironment: options.providerEnvironment,
+        targetGuildId: context.serverId,
+        observedAt,
+    });
+    const slot = allocation?.slots.find((candidate) => candidate.slotId === slotId);
+    if (!allocation ||
+        !slot?.guildId ||
+        (slot.activeHostedInstallation &&
+            !(await options.authority.canManageGuild({
+                guildId: slot.guildId,
+                userId: context.userId,
+            }))))
+        return expired(context);
+    const next = {
+        step: 1,
+        action: "move_confirm",
+        subscriptionVersion: allocation.subscriptionVersion.toString(),
+        slotId: slot.slotId,
+        slotVersion: slot.version.toString(),
+        sourceGuildId: slot.guildId,
+    };
+    const advanced = await sessions.advance({
+        sessionId: session.sessionId,
+        guildId: context.serverId,
+        userId: context.userId,
+        purpose: SESSION_PURPOSE,
+        expectedVersion: session.version,
+        expectedStep: 0,
+        nextStep: 1,
+        state: next,
+        expiresAt: sessionExpiry(observedAt),
+    });
+    await respond(context, {
+        ...message(`## Confirm Premium move\nMove slot ${String(slot.ordinal)} from **${escapeMarkdown(slot.guildName ?? "the selected server")}** to this server?`, RED),
+        buttons: confirmButtons(session.sessionId, "Move slot", "danger", advanced.version),
+    });
+}
+async function commit(context, options, observedAt) {
+    const session = await boundSession(context, COMMIT_PREFIX);
+    if (!session || !context.serverId)
+        return expired(context);
+    if (!(await canManageTarget(context, options.authority))) {
+        await deny(options.allocations, context, "missing_manage_server");
+        return respond(context, message("This Premium session is no longer authorised.", RED));
+    }
+    const state = parseState(session.state);
+    try {
+        let result;
+        const base = {
+            accountUserId: context.userId,
+            provider: options.provider,
+            providerEnvironment: options.providerEnvironment,
+            expectedSubscriptionVersion: BigInt(state.subscriptionVersion),
+            observedAt,
+            projectionId: context.interactionId,
+            reviewedPremiumModuleIds: options.reviewedPremiumModuleIds,
+            context: {
+                actorUserId: context.userId,
+                source: "discord",
+                correlationId: context.interactionId,
+                sessionClaim: {
+                    sessionId: session.sessionId,
+                    guildId: context.serverId,
+                    userId: context.userId,
+                    purpose: SESSION_PURPOSE,
+                    expectedVersion: session.version,
+                    expectedStep: state.step,
+                    requiredState: state,
+                },
+            },
+        };
+        if (state.action === "assign" && state.step === 0) {
+            result = await options.allocations.assignLowestAvailable({
+                ...base,
+                targetGuildId: context.serverId,
+            });
+        }
+        else if (state.action === "release" &&
+            state.step === 0 &&
+            state.slotId &&
+            state.slotVersion &&
+            state.sourceGuildId === context.serverId) {
+            result = await options.allocations.releaseSlot({
+                ...base,
+                slotId: state.slotId,
+                sourceGuildId: state.sourceGuildId,
+                expectedSlotVersion: BigInt(state.slotVersion),
+            });
+        }
+        else if (state.action === "move_confirm" &&
+            state.step === 1 &&
+            state.slotId &&
+            state.slotVersion &&
+            state.sourceGuildId) {
+            const current = await options.allocations.getAccountAllocation({
+                accountUserId: context.userId,
+                provider: options.provider,
+                providerEnvironment: options.providerEnvironment,
+                targetGuildId: context.serverId,
+                observedAt,
+            });
+            const sourceSlot = current?.slots.find(({ slotId }) => slotId === state.slotId);
+            if (!sourceSlot?.guildId ||
+                sourceSlot.guildId !== state.sourceGuildId ||
+                (sourceSlot.activeHostedInstallation &&
+                    !(await options.authority.canManageGuild({
+                        guildId: state.sourceGuildId,
+                        userId: context.userId,
+                    })))) {
+                await deny(options.allocations, context, "missing_manage_server");
+                return respond(context, message("Manage Server is required on both servers to move this slot.", RED));
+            }
+            result = await options.allocations.moveSlot({
+                ...base,
+                slotId: state.slotId,
+                sourceGuildId: state.sourceGuildId,
+                targetGuildId: context.serverId,
+                expectedSlotVersion: BigInt(state.slotVersion),
+            });
+        }
+        else
+            return expired(context);
+        await respond(context, successResponse(state.action, result.slot));
+    }
+    catch (error) {
+        const code = allocationErrorCode(error);
+        if (code)
+            await deny(options.allocations, context, code);
+        await respond(context, safeFailure(code));
+    }
+}
+async function createSession(context, state, observedAt) {
+    if (!context.serverId)
+        throw new Error("Guild context is required");
+    return context.services
+        .get(HELYX_SERVICE_NAMES.sessions)
+        .create({
+        guildId: context.serverId,
+        userId: context.userId,
+        purpose: SESSION_PURPOSE,
+        state,
+        expiresAt: sessionExpiry(observedAt),
+        replace: true,
+    });
+}
+async function boundSession(context, prefix) {
+    const match = new RegExp(`^${escapeRegExp(prefix)}([0-9a-f-]{36}):(\\d+)$`, "iu").exec(context.customId ?? "");
+    if (!match)
+        return null;
+    const session = await context.services
+        .get(HELYX_SERVICE_NAMES.sessions)
+        .get(match[1]);
+    return session && sessionMatches(session, context, BigInt(match[2]))
+        ? session
+        : null;
+}
+function sessionMatches(session, context, expectedVersion) {
+    return (session.guildId === context.serverId &&
+        session.userId === context.userId &&
+        session.purpose === SESSION_PURPOSE &&
+        session.version === expectedVersion);
+}
+function parseState(value) {
+    const step = value.step;
+    const action = value.action;
+    const subscriptionVersion = value.subscriptionVersion;
+    if (!Number.isInteger(step) ||
+        (step !== 0 && step !== 1) ||
+        !["assign", "release", "move_select", "move_confirm"].includes(String(action)) ||
+        typeof subscriptionVersion !== "string" ||
+        !/^\d+$/u.test(subscriptionVersion))
+        throw new Error("Premium interaction session is invalid");
+    const optionalString = (key) => value[key] === undefined
+        ? undefined
+        : typeof value[key] === "string"
+            ? value[key]
+            : null;
+    const slotId = optionalString("slotId");
+    const slotVersion = optionalString("slotVersion");
+    const sourceGuildId = optionalString("sourceGuildId");
+    if (slotId === null || slotVersion === null || sourceGuildId === null)
+        throw new Error("Premium interaction session is invalid");
+    const candidates = value.candidateSlotIds;
+    if (candidates !== undefined &&
+        (!Array.isArray(candidates) ||
+            candidates.length > 5 ||
+            candidates.some((item) => typeof item !== "string")))
+        throw new Error("Premium interaction session is invalid");
+    return {
+        step: step,
+        action: action,
+        subscriptionVersion,
+        ...(slotId ? { slotId } : {}),
+        ...(slotVersion ? { slotVersion } : {}),
+        ...(sourceGuildId ? { sourceGuildId } : {}),
+        ...(candidates ? { candidateSlotIds: candidates } : {}),
+        ...(value.adminOverlap === true ? { adminOverlap: true } : {}),
+    };
+}
+function subscriptionEligible(view, observedAt) {
+    return (view.subscriptionState === "active" ||
+        view.subscriptionState === "ending" ||
+        (view.subscriptionState === "past_due_grace" &&
+            !!view.gracePeriodEnd &&
+            view.gracePeriodEnd > observedAt));
+}
+async function canManageTarget(context, authority) {
+    if (!context.serverId)
+        return false;
+    return authority.canManageGuild({
+        guildId: context.serverId,
+        userId: context.userId,
+    });
+}
+async function deny(allocations, context, outcome) {
+    if (!context.serverId)
+        return;
+    await allocations
+        .auditDenied({
+        guildId: context.serverId,
+        actorUserId: context.userId,
+        correlationId: context.interactionId,
+        outcome,
+    })
+        .catch(() => undefined);
+}
+function confirmButtons(sessionId, label, style, version = 1n) {
+    return [
+        {
+            type: "button",
+            customId: `${COMMIT_PREFIX}${sessionId}:${version.toString()}`,
+            label,
+            style,
+        },
+        {
+            type: "button",
+            customId: `${CANCEL_PREFIX}${sessionId}:${version.toString()}`,
+            label: "Cancel",
+            style: "secondary",
+        },
+    ];
+}
+function successResponse(action, slot) {
+    if (action === "release")
+        return message(`## Slot released\nPremium slot ${String(slot.ordinal)} is unassigned and can be assigned again immediately.`, GREEN);
+    if (action === "move_confirm")
+        return message(`## Premium moved\nSlot ${String(slot.ordinal)} now supplies Premium to this server.`, GREEN);
+    return message(`## Premium activated\nSlot ${String(slot.ordinal)} now supplies Premium to this server.`, GREEN);
+}
+function safeFailure(code) {
+    if (code === "target_admin_override")
+        return message("This server is already covered by an Admin override. No paid slot was used.", GREEN);
+    if (code === "target_already_paid")
+        return message("Premium is already active on this server. No slot changes were made.", GREEN);
+    if (code === "slot_required_for_reduction")
+        return message("This slot must remain free for a scheduled quantity reduction.", RED);
+    return message("This Premium selection expired or changed. Run `/activate` again.", RED);
+}
+function allocationErrorCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return undefined;
+    const code = Reflect.get(error, "code");
+    return typeof code === "string"
+        ? code
+        : undefined;
+}
+function expired(context) {
+    return respond(context, message("This Premium selection expired or was already used. Run `/activate` again.", RED));
+}
+function respond(context, response) {
+    return context.updateResponse
+        ? context.updateResponse(response)
+        : context.reply(response);
+}
+function message(content, accentColor) {
+    return {
+        ephemeral: true,
+        componentsV2: { accentColor, text: [{ content }] },
+    };
+}
+function slotSummary(view) {
+    const assigned = view.slots.filter(({ guildId }) => guildId !== null).length;
+    return `${String(assigned)} of ${String(view.purchasedQuantity)} paid slots assigned.`;
+}
+function billingUrl(context) {
+    const service = context.services.get(HELYX_SERVICE_NAMES.applicationUrls);
+    return `${service.dashboardBaseUrl.replace(/\/$/u, "")}/billing`;
+}
+function sessionExpiry(now) {
+    return new Date(now.getTime() + SESSION_LIFETIME_MS);
+}
+function truncate(value, maximum) {
+    return value.length <= maximum ? value : `${value.slice(0, maximum - 1)}…`;
+}
+function escapeMarkdown(value) {
+    return value.replaceAll(/([\\`*_{}[\]()#+.!|>-])/gu, "\\$1");
+}
+function escapeRegExp(value) {
+    return value.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+function manageServerPolicy() {
+    return {
+        everyone: false,
+        requiredPermissions: ["MANAGE_GUILD"],
+        allowedRoleIds: [],
+        deniedRoleIds: [],
+        allowedUserIds: [],
+        deniedUserIds: [],
+    };
+}
+//# sourceMappingURL=premium-activation-module.js.map

package/dist/premium-catalogue-enforcement.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from "@helyx/sdk";
+import type { Pool } from "pg";
+export declare const PREMIUM_CATALOGUE_ENFORCEMENT_INTERVAL_MS: number;
+export declare function enforcePremiumCatalogue(database: Pool, logger: Logger): Promise<void>;
+//# sourceMappingURL=premium-catalogue-enforcement.d.ts.map

package/dist/premium-catalogue-enforcement.js

@@ -0,0 +1,29 @@
+import { PremiumEntitlementProjectionRepository } from "@helyx/database";
+import { REVIEWED_PREMIUM_MODULE_IDS } from "@helyx/module-manifest";
+import { randomUUID } from "node:crypto";
+const ENFORCEMENT_PAGE_SIZE = 100;
+export const PREMIUM_CATALOGUE_ENFORCEMENT_INTERVAL_MS = 24 * 60 * 60 * 1_000;
+export async function enforcePremiumCatalogue(database, logger) {
+    const projection = new PremiumEntitlementProjectionRepository(database);
+    const projectionId = `premium-catalogue-startup:${randomUUID()}`;
+    let scannedGuilds = 0;
+    let disabledModules = 0;
+    for (;;) {
+        const page = await projection.enforceCataloguePage({
+            projectionId,
+            observedAt: new Date(),
+            reviewedPremiumModuleIds: REVIEWED_PREMIUM_MODULE_IDS,
+            limit: ENFORCEMENT_PAGE_SIZE,
+        });
+        scannedGuilds += page.scannedGuilds;
+        disabledModules += page.disabledModules.length;
+        if (page.scannedGuilds < ENFORCEMENT_PAGE_SIZE)
+            break;
+    }
+    logger.info({
+        event: "premium.catalogue_enforced",
+        scannedGuilds,
+        disabledModules,
+    }, "Premium module catalogue enforced");
+}
+//# sourceMappingURL=premium-catalogue-enforcement.js.map

package/dist/premium-guild-authority.d.ts

@@ -0,0 +1,12 @@
+import { type Client } from "discord.js";
+import type { PremiumGuildAuthority } from "./premium-activation-module.js";
+/** Fresh, fail-closed Discord authority used for cross-guild slot moves. */
+export declare class DiscordPremiumGuildAuthority implements PremiumGuildAuthority {
+    private readonly client;
+    constructor(client: Client);
+    canManageGuild(input: {
+        guildId: string;
+        userId: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=premium-guild-authority.d.ts.map

package/dist/premium-guild-authority.js

@@ -0,0 +1,25 @@
+import { PermissionFlagsBits } from "discord.js";
+/** Fresh, fail-closed Discord authority used for cross-guild slot moves. */
+export class DiscordPremiumGuildAuthority {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async canManageGuild(input) {
+        try {
+            const guild = await this.client.guilds.fetch(input.guildId);
+            if (guild.ownerId === input.userId)
+                return true;
+            const member = await guild.members.fetch({
+                user: input.userId,
+                force: true,
+            });
+            return (member.permissions.has(PermissionFlagsBits.Administrator) ||
+                member.permissions.has(PermissionFlagsBits.ManageGuild));
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=premium-guild-authority.js.map

package/dist/scheduled-task-runner.js

@@ -1,6 +1,7 @@
 import { CORE_RECORD_RETENTION_TASK, MODULE_ACTIVATION_RECOVERY_TASK, ScheduledTaskRepository, } from "@helyx/database";
 import { getModuleScheduledTaskContribution, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
 import { randomUUID } from "node:crypto";
+import { canAccessModule } from "./premium-access.js";
 const DEFAULT_POLL_INTERVAL_MS = 1_000;
 const DEFAULT_LEASE_MS = 45_000;
 const DEFAULT_CLAIM_LIMIT = 8;
@@ -350,8 +351,18 @@ export function createLocalScheduledTaskRoute(input) {
             if (enabled !== (state === "enabled"))
                 return { outcome: "completed" };
             const context = { guildId: task.guildId, services: input.services };
-            if (state === "enabled")
+            if (state === "enabled") {
+                if (typeof input.services.has === "function" &&
+                    input.services.has(HELYX_SERVICE_NAMES.moduleAvailability)) {
+                    const availability = input.services.get(HELYX_SERVICE_NAMES.moduleAvailability);
+                    if (typeof availability?.isAvailable === "function" &&
+                        !(await availability.isAvailable(task.moduleId)))
+                        return deferred("module_globally_disabled", DEFAULT_POLL_INTERVAL_MS * 30);
+                }
+                if (!(await canAccessModule(input.services, task.guildId, module)))
+                    return deferred("premium_entitlement_unavailable", DEFAULT_POLL_INTERVAL_MS * 30);
                 await module.onActivated?.(context);
+            }
             else
                 await module.onDeactivated?.(context);
             return { outcome: "completed" };
@@ -369,6 +380,8 @@ export function createLocalScheduledTaskRoute(input) {
                 .isModuleEnabled(task.guildId, task.moduleId);
             if (!enabled)
                 return deferred("module_disabled", DEFAULT_POLL_INTERVAL_MS * 30);
+            if (!(await canAccessModule(input.services, task.guildId, module)))
+                return deferred("premium_entitlement_unavailable", DEFAULT_POLL_INTERVAL_MS * 30);
         }
         const contribution = getModuleScheduledTaskContribution(module, task.taskKind);
         if (!contribution ||