@helyx/bot 1.1.0 → 1.2.0

package/dist/discord-violation-thread-service.js

@@ -0,0 +1,789 @@
+import { VIOLATION_THREAD_LIMITS, VIOLATION_THREAD_REQUIRED_PERMISSIONS, VIOLATION_THREAD_RUNTIME_PERMISSIONS, } from "@helyx/sdk";
+import { ChannelType, DiscordAPIError, MessageFlags, PermissionFlagsBits, } from "discord.js";
+import { createHash } from "node:crypto";
+import { toReplyOptions } from "./interactions.js";
+const SNOWFLAKE_PATTERN = /^\d{17,20}$/u;
+const OPERATION_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const MAX_OPERATION_CACHE_ENTRIES = 10_000;
+const MAX_ARCHIVED_THREAD_PAGES = 20;
+const UNKNOWN_THREAD = Symbol("unknown-thread");
+const PERMISSION_FLAGS = Object.freeze({
+    VIEW_CHANNEL: PermissionFlagsBits.ViewChannel,
+    READ_MESSAGE_HISTORY: PermissionFlagsBits.ReadMessageHistory,
+    CREATE_PRIVATE_THREADS: PermissionFlagsBits.CreatePrivateThreads,
+    SEND_MESSAGES_IN_THREADS: PermissionFlagsBits.SendMessagesInThreads,
+    MANAGE_THREADS: PermissionFlagsBits.ManageThreads,
+    MANAGE_ROLES: PermissionFlagsBits.ManageRoles,
+    MANAGE_CHANNELS: PermissionFlagsBits.ManageChannels,
+});
+const ACCESS_PERMISSION_FLAGS = Object.freeze({
+    VIEW_CHANNEL: PermissionFlagsBits.ViewChannel,
+    READ_MESSAGE_HISTORY: PermissionFlagsBits.ReadMessageHistory,
+    SEND_MESSAGES_IN_THREADS: PermissionFlagsBits.SendMessagesInThreads,
+});
+const DANGEROUS_ROLE_PERMISSIONS = Object.freeze({
+    ADMINISTRATOR: PermissionFlagsBits.Administrator,
+    BAN_MEMBERS: PermissionFlagsBits.BanMembers,
+    KICK_MEMBERS: PermissionFlagsBits.KickMembers,
+    MANAGE_CHANNELS: PermissionFlagsBits.ManageChannels,
+    MANAGE_GUILD: PermissionFlagsBits.ManageGuild,
+    MANAGE_MESSAGES: PermissionFlagsBits.ManageMessages,
+    MANAGE_ROLES: PermissionFlagsBits.ManageRoles,
+    MANAGE_THREADS: PermissionFlagsBits.ManageThreads,
+    MANAGE_WEBHOOKS: PermissionFlagsBits.ManageWebhooks,
+    MODERATE_MEMBERS: PermissionFlagsBits.ModerateMembers,
+});
+/** Guild-owner-routed adapter for role-gated private violation threads. */
+export class DiscordViolationThreadAdapter {
+    client;
+    #operationResources = new Map();
+    #operationMessages = new Map();
+    constructor(client) {
+        this.client = client;
+    }
+    async inspectConfiguration(input) {
+        validateSnowflake(input.guildId);
+        validateSnowflake(input.parentChannelId);
+        if (input.accessRoleId !== null)
+            validateSnowflake(input.accessRoleId);
+        validateRoleList(input.moderatorRoleIds);
+        const guild = this.client.guilds.cache.get(input.guildId);
+        if (!guild)
+            return deniedInspection("guild_mismatch", "guild_not_owned");
+        const channel = await guild.channels
+            .fetch(input.parentChannelId)
+            .catch(() => null);
+        if (!channel ||
+            channel.guild.id !== guild.id ||
+            channel.type !== ChannelType.GuildText)
+            return deniedInspection("channel_missing", "parent_channel_missing");
+        if (input.accessRoleId === null) {
+            const moderatorRoles = await Promise.all(input.moderatorRoleIds.map((roleId) => guild.roles.fetch(roleId).catch(() => null)));
+            const revision = configurationRevision(channel, null, input.moderatorRoleIds);
+            if (moderatorRoles.some((role) => role === null))
+                return {
+                    outcome: "role_missing",
+                    configurationRevision: revision,
+                    accessRole: null,
+                    missingPermissions: [],
+                    requiredChanges: [],
+                    safeCode: "moderator_role_missing",
+                };
+            const botMember = guild.members.me;
+            const permissions = botMember ? channel.permissionsFor(botMember) : null;
+            const missingPermissions = VIOLATION_THREAD_REQUIRED_PERMISSIONS.filter((name) => name === "MANAGE_ROLES"
+                ? !botMember?.permissions.has(PermissionFlagsBits.ManageRoles)
+                : !permissions?.has(PERMISSION_FLAGS[name]));
+            if (missingPermissions.length > 0)
+                return {
+                    outcome: "denied",
+                    configurationRevision: revision,
+                    accessRole: null,
+                    missingPermissions,
+                    requiredChanges: [],
+                    safeCode: "bot_permissions_missing",
+                };
+            return {
+                outcome: "allowed",
+                configurationRevision: revision,
+                accessRole: null,
+                missingPermissions: [],
+                requiredChanges: ["create_access_role"],
+            };
+        }
+        const accessRole = await guild.roles
+            .fetch(input.accessRoleId)
+            .catch(() => null);
+        if (!accessRole)
+            return {
+                outcome: "role_missing",
+                configurationRevision: configurationRevision(channel, null, input.moderatorRoleIds),
+                accessRole: null,
+                missingPermissions: [],
+                requiredChanges: [],
+                safeCode: "access_role_missing",
+            };
+        const accessInspection = await inspectAccessRole(guild, channel.id, accessRole);
+        const revision = configurationRevision(channel, accessRole, input.moderatorRoleIds);
+        if (accessInspection.outcome !== "safe")
+            return {
+                outcome: "unsafe_access_role",
+                configurationRevision: revision,
+                accessRole: accessInspection,
+                missingPermissions: [],
+                requiredChanges: [],
+                safeCode: `access_role_${accessInspection.outcome}`,
+            };
+        if (input.moderatorRoleIds.includes(guild.roles.everyone.id) ||
+            input.moderatorRoleIds.includes(accessRole.id))
+            return {
+                outcome: "denied",
+                configurationRevision: revision,
+                accessRole: accessInspection,
+                missingPermissions: [],
+                requiredChanges: [],
+                safeCode: "moderator_role_unsafe",
+            };
+        const moderatorRoles = await Promise.all(input.moderatorRoleIds.map((roleId) => guild.roles.fetch(roleId).catch(() => null)));
+        if (moderatorRoles.some((role) => role === null))
+            return {
+                outcome: "role_missing",
+                configurationRevision: revision,
+                accessRole: accessInspection,
+                missingPermissions: [],
+                requiredChanges: [],
+                safeCode: "moderator_role_missing",
+            };
+        const botMember = guild.members.me;
+        const permissions = botMember ? channel.permissionsFor(botMember) : null;
+        const missingPermissions = VIOLATION_THREAD_REQUIRED_PERMISSIONS.filter((name) => name === "MANAGE_ROLES"
+            ? !botMember?.permissions.has(PermissionFlagsBits.ManageRoles)
+            : !permissions?.has(PERMISSION_FLAGS[name]));
+        if (missingPermissions.includes("MANAGE_ROLES"))
+            return {
+                outcome: "denied",
+                configurationRevision: revision,
+                accessRole: accessInspection,
+                missingPermissions,
+                requiredChanges: [],
+                safeCode: "bot_permissions_missing",
+            };
+        return {
+            outcome: "allowed",
+            configurationRevision: revision,
+            accessRole: accessInspection,
+            missingPermissions,
+            requiredChanges: requiredConfigurationChanges(channel, guild, accessRole, moderatorRoles),
+        };
+    }
+    async createAccessRole(input) {
+        validateSnowflake(input.guildId);
+        validateOperationKey(input.operationKey);
+        validateName(input.name, "Violation access role");
+        const guild = this.client.guilds.cache.get(input.guildId);
+        if (!guild)
+            return { outcome: "failed", safeCode: "guild_not_owned" };
+        if (!guild.members.me?.permissions.has(PermissionFlagsBits.ManageRoles))
+            return { outcome: "missing_permission", safeCode: "manage_roles" };
+        const operationIdentity = `${input.guildId}:role:${input.operationKey}`;
+        const knownRoleId = this.#operationResources.get(operationIdentity);
+        if (knownRoleId) {
+            const known = await guild.roles.fetch(knownRoleId).catch(() => null);
+            if (known && isSafeCreatedAccessRole(known, guild))
+                return { outcome: "created", roleId: knownRoleId };
+            this.#operationResources.delete(operationIdentity);
+        }
+        const marker = operationMarker(operationIdentity);
+        const roles = await guild.roles.fetch().catch(() => null);
+        if (!roles)
+            return { outcome: "ambiguous", safeCode: "role_lookup_failed" };
+        const existing = roles.find((role) => role.name.endsWith(`[${marker}]`));
+        if (existing) {
+            if (!isSafeCreatedAccessRole(existing, guild))
+                return { outcome: "failed", safeCode: "role_marker_collision" };
+            this.#remember(this.#operationResources, operationIdentity, existing.id);
+            return { outcome: "created", roleId: existing.id };
+        }
+        if (!(await safelyRevalidate(() => input.revalidate())))
+            return { outcome: "no_longer_required" };
+        try {
+            const role = await guild.roles.create({
+                name: markedName(input.name, marker),
+                permissions: 0n,
+                mentionable: false,
+                hoist: false,
+                reason: auditReason(input.operationKey),
+            });
+            this.#remember(this.#operationResources, operationIdentity, role.id);
+            return { outcome: "created", roleId: role.id };
+        }
+        catch (error) {
+            return configurationMutationFailure(error);
+        }
+    }
+    async configureParent(input) {
+        validateSnowflake(input.guildId);
+        validateSnowflake(input.parentChannelId);
+        validateSnowflake(input.accessRoleId);
+        validateRoleList(input.moderatorRoleIds);
+        validateOperationKey(input.operationKey);
+        const initial = await this.inspectConfiguration(input);
+        if (initial.outcome !== "allowed")
+            return configurationInspectionFailure(initial);
+        if (initial.missingPermissions.includes("MANAGE_CHANNELS"))
+            return { outcome: "missing_permission", safeCode: "manage_channels" };
+        if (initial.configurationRevision !== input.expectedConfigurationRevision)
+            return { outcome: "stale_inspection" };
+        if (initial.requiredChanges.length === 0)
+            return {
+                outcome: "already_configured",
+                configurationRevision: initial.configurationRevision,
+                appliedChanges: [],
+            };
+        if (!(await safelyRevalidate(() => input.revalidate())))
+            return { outcome: "failed", safeCode: "revalidation_rejected" };
+        const current = await this.inspectConfiguration(input);
+        if (current.outcome !== "allowed" ||
+            current.configurationRevision !== input.expectedConfigurationRevision)
+            return { outcome: "stale_inspection" };
+        const guild = this.client.guilds.cache.get(input.guildId);
+        const channel = (await guild.channels.fetch(input.parentChannelId));
+        const botMember = guild.members.me;
+        try {
+            await channel.permissionOverwrites.edit(guild.roles.everyone, { ViewChannel: false }, { reason: auditReason(input.operationKey) });
+            await channel.permissionOverwrites.edit(input.accessRoleId, {
+                ViewChannel: true,
+                ReadMessageHistory: true,
+                SendMessages: false,
+                SendMessagesInThreads: true,
+            }, { reason: auditReason(input.operationKey) });
+            await channel.permissionOverwrites.edit(botMember, {
+                ViewChannel: true,
+                ReadMessageHistory: true,
+                CreatePrivateThreads: true,
+                SendMessagesInThreads: true,
+                ManageThreads: true,
+                ManageChannels: true,
+            }, { reason: auditReason(input.operationKey) });
+            for (const roleId of input.moderatorRoleIds)
+                await channel.permissionOverwrites.edit(roleId, {
+                    ViewChannel: true,
+                    ReadMessageHistory: true,
+                    SendMessagesInThreads: true,
+                    ManageThreads: true,
+                }, { reason: auditReason(input.operationKey) });
+        }
+        catch (error) {
+            return isDiscordStatus(error, 403)
+                ? { outcome: "missing_permission", safeCode: "discord_forbidden" }
+                : { outcome: "ambiguous", safeCode: "configuration_partially_applied" };
+        }
+        const completed = await this.inspectConfiguration(input);
+        if (completed.outcome !== "allowed" ||
+            completed.missingPermissions.length > 0 ||
+            completed.requiredChanges.length > 0)
+            return { outcome: "ambiguous", safeCode: "configuration_recheck_failed" };
+        return {
+            outcome: "configured",
+            configurationRevision: completed.configurationRevision,
+            appliedChanges: initial.requiredChanges,
+        };
+    }
+    async create(input) {
+        validateMutation(input);
+        const guild = this.client.guilds.cache.get(input.guildId);
+        if (!guild)
+            return { outcome: "channel_missing", safeCode: "guild_not_owned" };
+        const parent = await guild.channels
+            .fetch(input.parentChannelId)
+            .catch(() => null);
+        if (!parent || parent.type !== ChannelType.GuildText)
+            return { outcome: "channel_missing" };
+        const me = guild.members.me;
+        const permissions = me ? parent.permissionsFor(me) : null;
+        const missingPermission = VIOLATION_THREAD_RUNTIME_PERMISSIONS.find((name) => !permissions?.has(PERMISSION_FLAGS[name]));
+        if (missingPermission)
+            return {
+                outcome: "missing_permission",
+                safeCode: missingPermission.toLowerCase(),
+            };
+        if (parent
+            .permissionsFor(guild.roles.everyone)
+            .has(PermissionFlagsBits.ViewChannel))
+            return {
+                outcome: "missing_permission",
+                safeCode: "parent_not_restricted",
+            };
+        const operationIdentity = `${input.guildId}:${input.parentChannelId}:${input.operationKey}`;
+        const marker = operationMarker(operationIdentity);
+        const knownThreadId = this.#operationResources.get(operationIdentity);
+        if (knownThreadId) {
+            const known = await guild.channels.fetch(knownThreadId).catch(() => null);
+            if (isOwnedPrivateThread(known, input.guildId, input.parentChannelId))
+                return { outcome: "already_exists", threadId: known.id };
+            this.#operationResources.delete(operationIdentity);
+        }
+        const existing = await findPrivateThreadByMarker(parent, marker);
+        if (existing === UNKNOWN_THREAD)
+            return { outcome: "ambiguous", safeCode: "idempotency_lookup_failed" };
+        if (existing) {
+            this.#remember(this.#operationResources, operationIdentity, existing);
+            return { outcome: "already_exists", threadId: existing };
+        }
+        if (!(await safelyRevalidate(() => input.revalidate())))
+            return { outcome: "no_longer_required" };
+        try {
+            const thread = await parent.threads.create({
+                name: markedName(input.name, marker),
+                type: ChannelType.PrivateThread,
+                invitable: false,
+                reason: auditReason(input.operationKey),
+            });
+            this.#remember(this.#operationResources, operationIdentity, thread.id);
+            return { outcome: "created", threadId: thread.id };
+        }
+        catch (error) {
+            return threadMutationFailure(error);
+        }
+    }
+    async addMember(input) {
+        return await this.#changeThreadMember(input, "add");
+    }
+    async removeMember(input) {
+        return await this.#changeThreadMember(input, "remove");
+    }
+    async send(input) {
+        validateThreadInput(input);
+        const operationIdentity = `${input.guildId}:${input.threadId}:message:${input.operationKey}`;
+        const known = this.#operationMessages.get(operationIdentity);
+        if (known)
+            return { outcome: "already_sent", messageId: known };
+        const thread = await this.#privateThread(input.guildId, input.threadId);
+        if (!thread)
+            return { outcome: "thread_missing" };
+        try {
+            const message = await thread.send(toReplyOptions({
+                ...input.response,
+                ephemeral: false,
+            }));
+            this.#remember(this.#operationMessages, operationIdentity, message.id);
+            return { outcome: "sent", messageId: message.id };
+        }
+        catch (error) {
+            return deliveryFailure(error);
+        }
+    }
+    async close(input) {
+        validateThreadInput(input);
+        const thread = await this.#privateThread(input.guildId, input.threadId);
+        if (!thread)
+            return { outcome: "thread_missing" };
+        if (thread.archived && thread.locked)
+            return { outcome: "already_exists", threadId: thread.id };
+        if (!(await safelyRevalidate(() => input.revalidate())))
+            return { outcome: "no_longer_required" };
+        try {
+            await thread.edit({
+                archived: true,
+                locked: true,
+                reason: auditReason(input.operationKey),
+            });
+            return { outcome: "created", threadId: thread.id };
+        }
+        catch (error) {
+            return threadMutationFailure(error);
+        }
+    }
+    async reconcile(input) {
+        validateSnowflake(input.guildId);
+        validateSnowflake(input.parentChannelId);
+        validateOperationKey(input.operationKey);
+        if (!input.threadId)
+            return { outcome: "unknown", safeCode: "thread_id_unavailable" };
+        validateSnowflake(input.threadId);
+        const guild = this.client.guilds.cache.get(input.guildId);
+        if (!guild)
+            return { outcome: "unknown", safeCode: "guild_not_owned" };
+        try {
+            const channel = await guild.channels.fetch(input.threadId);
+            if (!isOwnedPrivateThread(channel, input.guildId) ||
+                channel.parentId !== input.parentChannelId)
+                return { outcome: "absent" };
+            return {
+                outcome: "exists",
+                threadId: channel.id,
+                archived: channel.archived ?? false,
+                locked: channel.locked ?? false,
+            };
+        }
+        catch (error) {
+            return isDiscordStatus(error, 404)
+                ? { outcome: "absent" }
+                : { outcome: "unknown", safeCode: "discord_inspection_failed" };
+        }
+    }
+    async #changeThreadMember(input, operation) {
+        validateThreadInput(input);
+        validateSnowflake(input.memberUserId);
+        const guild = this.client.guilds.cache.get(input.guildId);
+        const thread = await this.#privateThread(input.guildId, input.threadId);
+        if (!guild || !thread)
+            return { outcome: "thread_missing" };
+        const member = await guild.members
+            .fetch(input.memberUserId)
+            .catch(() => null);
+        if (!member)
+            return { outcome: "member_missing" };
+        const parent = thread.parent;
+        const memberPermissions = parent?.permissionsFor(member);
+        if (!memberPermissions?.has(PermissionFlagsBits.ViewChannel) ||
+            !memberPermissions.has(PermissionFlagsBits.SendMessagesInThreads))
+            return {
+                outcome: "missing_permission",
+                safeCode: "member_parent_access",
+            };
+        try {
+            const present = await thread.members
+                .fetch(input.memberUserId)
+                .catch(() => null);
+            if ((operation === "add" && present) ||
+                (operation === "remove" && !present))
+                return { outcome: "already_exists", threadId: thread.id };
+            if (operation === "add")
+                await thread.members.add(input.memberUserId);
+            else
+                await thread.members.remove(input.memberUserId);
+            return { outcome: "created", threadId: thread.id };
+        }
+        catch (error) {
+            return threadMutationFailure(error);
+        }
+    }
+    async #privateThread(guildId, threadId) {
+        const guild = this.client.guilds.cache.get(guildId);
+        if (!guild)
+            return null;
+        const channel = await guild.channels.fetch(threadId).catch(() => null);
+        return isOwnedPrivateThread(channel, guildId) ? channel : null;
+    }
+    #remember(cache, key, value) {
+        cache.delete(key);
+        cache.set(key, value);
+        while (cache.size > MAX_OPERATION_CACHE_ENTRIES) {
+            const oldest = cache.keys().next().value;
+            if (!oldest)
+                break;
+            cache.delete(oldest);
+        }
+    }
+}
+/** Bot-private capability; never installed in the module service map. */
+export class DiscordViolationEvidenceDeliveryAdapter {
+    client;
+    evidence;
+    #operationMessages = new Map();
+    constructor(client, evidence) {
+        this.client = client;
+        this.evidence = evidence;
+    }
+    async deliverEvidence(input) {
+        validateThreadInput(input);
+        const operationIdentity = `${input.guildId}:${input.threadId}:evidence:${input.operationKey}`;
+        const known = this.#operationMessages.get(operationIdentity);
+        if (known)
+            return { outcome: "already_sent", messageId: known };
+        if (input.evidenceReference.guildId !== input.guildId)
+            return { outcome: "evidence_mismatch" };
+        const guild = this.client.guilds.cache.get(input.guildId);
+        const channel = guild
+            ? await guild.channels.fetch(input.threadId).catch(() => null)
+            : null;
+        if (!isOwnedPrivateThread(channel, input.guildId))
+            return { outcome: "thread_missing" };
+        const evidence = this.evidence.read(input.evidenceReference);
+        if (evidence.outcome !== "available")
+            return {
+                outcome: evidence.outcome === "mismatch"
+                    ? "evidence_mismatch"
+                    : "evidence_unavailable",
+            };
+        try {
+            const message = await channel.send({
+                content: evidence.content,
+                allowedMentions: { parse: [] },
+                flags: MessageFlags.SuppressEmbeds,
+            });
+            rememberOperation(this.#operationMessages, operationIdentity, message.id);
+            this.evidence.discard(input.evidenceReference);
+            return { outcome: "sent", messageId: message.id };
+        }
+        catch (error) {
+            return deliveryFailure(error);
+        }
+    }
+}
+async function inspectAccessRole(guild, parentChannelId, role) {
+    const base = {
+        roleId: role.id,
+        dangerousPermissionNames: [],
+        unintendedChannelIds: [],
+        unintendedChannelCount: 0,
+        truncated: false,
+    };
+    if (role.id === guild.id)
+        return { outcome: "everyone", ...base };
+    if (role.managed)
+        return { outcome: "managed", ...base };
+    const me = guild.members.me;
+    if (!me || !role.editable || role.comparePositionTo(me.roles.highest) >= 0)
+        return { outcome: "hierarchy_blocked", ...base };
+    const dangerousPermissionNames = Object.entries(DANGEROUS_ROLE_PERMISSIONS)
+        .filter(([, permission]) => role.permissions.has(permission))
+        .map(([name]) => name);
+    if (dangerousPermissionNames.length > 0)
+        return {
+            outcome: "dangerous_permissions",
+            ...base,
+            dangerousPermissionNames,
+        };
+    let channels;
+    try {
+        channels = await guild.channels.fetch();
+    }
+    catch {
+        return { outcome: "unintended_channel_access", ...base, truncated: true };
+    }
+    const unintendedChannelIds = [];
+    let unintendedChannelCount = 0;
+    for (const channel of channels.values()) {
+        if (!channel ||
+            channel.id === parentChannelId ||
+            channel.isThread() ||
+            !channel.permissionsFor(role).has(PermissionFlagsBits.ViewChannel) ||
+            channel
+                .permissionsFor(guild.roles.everyone)
+                .has(PermissionFlagsBits.ViewChannel))
+            continue;
+        unintendedChannelCount += 1;
+        if (unintendedChannelIds.length <
+            VIOLATION_THREAD_LIMITS.unsafeChannelExamples)
+            unintendedChannelIds.push(channel.id);
+    }
+    if (unintendedChannelCount > 0)
+        return {
+            outcome: "unintended_channel_access",
+            ...base,
+            unintendedChannelIds,
+            unintendedChannelCount,
+            truncated: unintendedChannelCount > unintendedChannelIds.length,
+        };
+    return { outcome: "safe", roleId: role.id };
+}
+function isSafeCreatedAccessRole(role, guild) {
+    const me = guild.members.me;
+    return Boolean(me &&
+        role.id !== guild.id &&
+        !role.managed &&
+        role.editable &&
+        role.permissions.bitfield === 0n &&
+        role.comparePositionTo(me.roles.highest) < 0);
+}
+function requiredConfigurationChanges(channel, guild, accessRole, moderatorRoles) {
+    const changes = [];
+    if (!overwriteDenies(channel, guild.roles.everyone.id, PermissionFlagsBits.ViewChannel))
+        changes.push("deny_everyone_view_channel");
+    for (const [name, permission] of Object.entries(ACCESS_PERMISSION_FLAGS))
+        if (!overwriteAllows(channel, accessRole.id, permission))
+            changes.push(`allow_access_role_${name.toLowerCase()}`);
+    if (!overwriteDenies(channel, accessRole.id, PermissionFlagsBits.SendMessages))
+        changes.push("deny_access_role_parent_messages");
+    const botMemberId = guild.members.me.id;
+    for (const name of [
+        ...VIOLATION_THREAD_RUNTIME_PERMISSIONS,
+        "MANAGE_CHANNELS",
+    ]) {
+        const permission = PERMISSION_FLAGS[name];
+        if (!overwriteAllows(channel, botMemberId, permission))
+            changes.push(`allow_bot_${name.toLowerCase()}`);
+    }
+    for (const role of moderatorRoles)
+        for (const [name, permission] of Object.entries({
+            VIEW_CHANNEL: PermissionFlagsBits.ViewChannel,
+            READ_MESSAGE_HISTORY: PermissionFlagsBits.ReadMessageHistory,
+            SEND_MESSAGES_IN_THREADS: PermissionFlagsBits.SendMessagesInThreads,
+            MANAGE_THREADS: PermissionFlagsBits.ManageThreads,
+        }))
+            if (!overwriteAllows(channel, role.id, permission))
+                changes.push(`allow_moderator_${role.id}_${name.toLowerCase()}`);
+    return changes;
+}
+function overwriteAllows(channel, id, permission) {
+    return (channel.permissionOverwrites.cache.get(id)?.allow.has(permission) ?? false);
+}
+function overwriteDenies(channel, id, permission) {
+    return (channel.permissionOverwrites.cache.get(id)?.deny.has(permission) ?? false);
+}
+function rememberOperation(cache, key, value) {
+    cache.delete(key);
+    cache.set(key, value);
+    while (cache.size > MAX_OPERATION_CACHE_ENTRIES) {
+        const oldest = cache.keys().next().value;
+        if (!oldest)
+            break;
+        cache.delete(oldest);
+    }
+}
+function configurationRevision(channel, role, moderatorRoleIds) {
+    const overwrites = [...channel.permissionOverwrites.cache.values()]
+        .map((overwrite) => ({
+        id: overwrite.id,
+        type: overwrite.type,
+        allow: overwrite.allow.bitfield.toString(),
+        deny: overwrite.deny.bitfield.toString(),
+    }))
+        .sort((left, right) => left.id.localeCompare(right.id));
+    return createHash("sha256")
+        .update(JSON.stringify({
+        channelId: channel.id,
+        role: role
+            ? {
+                id: role.id,
+                permissions: role.permissions.bitfield.toString(),
+                position: role.position,
+                managed: role.managed,
+            }
+            : null,
+        moderatorRoleIds: [...moderatorRoleIds].sort(),
+        overwrites,
+    }))
+        .digest("hex");
+}
+function deniedInspection(outcome, safeCode) {
+    return {
+        outcome,
+        configurationRevision: null,
+        accessRole: null,
+        missingPermissions: [...VIOLATION_THREAD_REQUIRED_PERMISSIONS],
+        requiredChanges: [],
+        safeCode,
+    };
+}
+function configurationInspectionFailure(inspection) {
+    if (inspection.outcome === "channel_missing")
+        return { outcome: "channel_missing", safeCode: inspection.safeCode };
+    if (inspection.outcome === "role_missing")
+        return { outcome: "role_missing", safeCode: inspection.safeCode };
+    if (inspection.outcome === "unsafe_access_role")
+        return { outcome: "unsafe_access_role", safeCode: inspection.safeCode };
+    if (inspection.missingPermissions.length > 0)
+        return { outcome: "missing_permission", safeCode: inspection.safeCode };
+    return { outcome: "failed", safeCode: inspection.safeCode };
+}
+function configurationMutationFailure(error) {
+    if (isDiscordStatus(error, 403))
+        return { outcome: "missing_permission", safeCode: "discord_forbidden" };
+    if (error instanceof DiscordAPIError)
+        return {
+            outcome: "failed",
+            safeCode: `discord_${error.code}`.slice(0, 80),
+        };
+    return { outcome: "ambiguous", safeCode: "discord_transport_unknown" };
+}
+function threadMutationFailure(error) {
+    if (isDiscordStatus(error, 403))
+        return { outcome: "missing_permission", safeCode: "discord_forbidden" };
+    if (isDiscordStatus(error, 404))
+        return { outcome: "thread_missing" };
+    if (error instanceof DiscordAPIError)
+        return {
+            outcome: "failed",
+            safeCode: `discord_${error.code}`.slice(0, 80),
+        };
+    return { outcome: "ambiguous", safeCode: "discord_transport_unknown" };
+}
+function deliveryFailure(error) {
+    if (isDiscordStatus(error, 403))
+        return { outcome: "missing_permission", safeCode: "discord_forbidden" };
+    if (isDiscordStatus(error, 404))
+        return { outcome: "thread_missing" };
+    if (error instanceof DiscordAPIError)
+        return {
+            outcome: "failed",
+            safeCode: `discord_${error.code}`.slice(0, 80),
+        };
+    return { outcome: "ambiguous", safeCode: "discord_transport_unknown" };
+}
+function isOwnedPrivateThread(channel, guildId, parentChannelId) {
+    return Boolean(channel?.isThread() &&
+        channel.type === ChannelType.PrivateThread &&
+        channel.guild.id === guildId &&
+        (!parentChannelId || channel.parentId === parentChannelId));
+}
+async function findPrivateThreadByMarker(parent, marker) {
+    const matches = (name) => name?.endsWith(`[${marker}]`) ?? false;
+    const cached = parent.threads.cache.find((thread) => thread.type === ChannelType.PrivateThread && matches(thread.name));
+    if (cached)
+        return cached.id;
+    try {
+        const active = await parent.threads.fetchActive();
+        const activeMatch = active.threads.find((thread) => thread.type === ChannelType.PrivateThread && matches(thread.name));
+        if (activeMatch)
+            return activeMatch.id;
+        let before;
+        for (let page = 0; page < MAX_ARCHIVED_THREAD_PAGES; page += 1) {
+            const archived = await parent.threads.fetchArchived({
+                type: "private",
+                limit: 100,
+                ...(before ? { before } : {}),
+            });
+            const match = archived.threads.find((thread) => matches(thread.name));
+            if (match)
+                return match.id;
+            if (!archived.hasMore)
+                return null;
+            const oldest = archived.threads.last();
+            if (!oldest || oldest.id === before)
+                return UNKNOWN_THREAD;
+            before = oldest.id;
+        }
+        return UNKNOWN_THREAD;
+    }
+    catch {
+        return UNKNOWN_THREAD;
+    }
+}
+function validateMutation(input) {
+    validateSnowflake(input.guildId);
+    validateSnowflake(input.parentChannelId);
+    validateOperationKey(input.operationKey);
+    validateName(input.name, "Violation thread");
+}
+function validateThreadInput(input) {
+    validateSnowflake(input.guildId);
+    validateSnowflake(input.threadId);
+    validateOperationKey(input.operationKey);
+}
+function validateRoleList(roleIds) {
+    if (roleIds.length > VIOLATION_THREAD_LIMITS.moderatorRoles ||
+        new Set(roleIds).size !== roleIds.length)
+        throw new Error("Violation thread moderator roles are invalid");
+    for (const roleId of roleIds)
+        validateSnowflake(roleId);
+}
+function validateSnowflake(value) {
+    if (!SNOWFLAKE_PATTERN.test(value))
+        throw new Error("Violation thread Discord identity is invalid");
+}
+function validateOperationKey(value) {
+    if (!OPERATION_KEY_PATTERN.test(value))
+        throw new Error("Violation thread operation key is invalid");
+}
+function validateName(value, subject) {
+    if (value.trim().length < 1 || value.length > 100)
+        throw new Error(`${subject} name is invalid`);
+}
+function operationMarker(operationIdentity) {
+    return `hx-${createHash("sha256").update(operationIdentity).digest("hex").slice(0, 12)}`;
+}
+function markedName(name, marker) {
+    const suffix = ` [${marker}]`;
+    return `${name
+        .trim()
+        .slice(0, 100 - suffix.length)
+        .trimEnd()}${suffix}`;
+}
+function auditReason(operationKey) {
+    return `Helyx moderation ${operationKey}`.slice(0, 512);
+}
+async function safelyRevalidate(revalidate) {
+    try {
+        return await revalidate();
+    }
+    catch {
+        return false;
+    }
+}
+function isDiscordStatus(error, status) {
+    return error instanceof DiscordAPIError && error.status === status;
+}
+//# sourceMappingURL=discord-violation-thread-service.js.map