@helyx/bot 1.1.0 → 1.2.1

package/dist/shard-router.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { AUTOMOD_ENHANCED_CONTRACT_VERSION, AUTOMOD_ENHANCED_PROVIDER_ID, AUTOMOD_SCANNER_LIMITS, } from "@helyx/sdk";
 import { BotControlTransportError, } from "./control-server.js";
 import { SHARD_CONTROL_TIMEOUT_MS, controlOperationGuildId, guildIdToShardId, shardControlOperationSchema, shardControlResponseSchema, } from "./shard-contracts.js";
 // Cross-region/public Redis connections used by local staging routinely take
@@ -7,6 +8,7 @@ import { SHARD_CONTROL_TIMEOUT_MS, controlOperationGuildId, guildIdToShardId, sh
 // deadline turned healthy leases into deterministic 503s. Keep the check
 // bounded while allowing normal network variance.
 const LEASE_VALIDATION_TIMEOUT_MS = 3_000;
+const ECKO_RESULT_TIMEOUT_MS = AUTOMOD_SCANNER_LIMITS.actionDeadlineSeconds * 1_000;
 export class ShardControlRouter {
     input;
     constructor(input) {
@@ -15,11 +17,28 @@ export class ShardControlRouter {
     cleanupOAuthConsumer(input) {
         return this.#route({ kind: "oauth.consumer.cleanup", ...input });
     }
+    deliverHostedServerLeave(input) {
+        return this.#route({ kind: "hosted-server.leave.deliver", ...input });
+    }
+    refreshHostedServerOwner(guildId) {
+        return this.#route({ kind: "hosted-server.owner.refresh", guildId });
+    }
     listAvailabilityModules() {
         if (!this.input.availability)
             return Promise.reject(new BotControlTransportError(503, "Module availability catalogue is unavailable"));
         return this.input.availability.listAvailabilityModules();
     }
+    /** Routes an authenticated Ecko result to the current guild owner. */
+    acceptHostedEckoResult(input) {
+        return this.#route({ kind: "automod.enhanced.result.accept", ...input }, remainingEnhancedDeadline(input.result));
+    }
+    /** Reads the fenced leader's current Enhanced configuration snapshot. */
+    getHostedEckoConfigurationPage(input) {
+        return this.#routeLeader({
+            kind: "automod.enhanced.configuration.page",
+            ...input,
+        });
+    }
     getGuildState(guildId) {
         return this.#route({ kind: "guild.state.get", guildId });
     }
@@ -97,6 +116,12 @@ export class ShardControlRouter {
             ...input,
         }));
     }
+    previewConfiguration(input) {
+        return this.#route(shardControlOperationSchema.parse({
+            kind: "guild.module.configuration.preview",
+            ...input,
+        }));
+    }
     updatePermissions(input) {
         return this.#route({ kind: "guild.module.permissions.update", ...input });
     }
@@ -106,6 +131,9 @@ export class ShardControlRouter {
     executeDashboardAction(input) {
         return this.#route({ kind: "guild.module.action.execute", ...input });
     }
+    previewDashboardAction(input) {
+        return this.#route({ kind: "guild.module.action.preview", ...input });
+    }
     listManagedResources(input) {
         return this.#route(shardControlOperationSchema.parse({
             kind: "guild.module.resource.list",
@@ -130,6 +158,12 @@ export class ShardControlRouter {
             ...input,
         }));
     }
+    importManagedResource(input) {
+        return this.#route(shardControlOperationSchema.parse({
+            kind: "guild.module.resource.import",
+            ...input,
+        }));
+    }
     createManagedResource(input) {
         return this.#route(shardControlOperationSchema.parse({
             kind: "guild.module.resource.create",
@@ -188,7 +222,7 @@ export class ShardControlRouter {
             executeThrough: executeThrough.toISOString(),
         });
     }
-    async #route(operation) {
+    async #route(operation, timeoutMs = SHARD_CONTROL_TIMEOUT_MS) {
         const guildId = controlOperationGuildId(operation);
         if (!guildId)
             throw new BotControlTransportError(502, "The control operation has no shard route");
@@ -212,13 +246,13 @@ export class ShardControlRouter {
             requestId: randomUUID(),
             generation: this.input.generation,
             fencingToken: lease.fencingToken,
-            deadlineAt: new Date(Date.now() + SHARD_CONTROL_TIMEOUT_MS).toISOString(),
+            deadlineAt: new Date(Date.now() + timeoutMs).toISOString(),
             operation,
         };
         let response;
         try {
             response = localLease
-                ? await withDeadline(this.input.dispatchLocal(shardId, request), SHARD_CONTROL_TIMEOUT_MS)
+                ? await withDeadline(this.input.dispatchLocal(shardId, request), timeoutMs)
                 : await this.input.coordinator.routeRemote(lease, request);
         }
         catch (error) {
@@ -231,13 +265,13 @@ export class ShardControlRouter {
         return unwrapResponse(response);
     }
     async #routeLeader(operation) {
-        if (this.input.localLeaderLease && this.input.privacy) {
+        if (this.input.localLeaderLease) {
             if (this.input.coordinator) {
                 const current = await this.#currentLeaderLease();
                 if (!current || !sameLeaderLease(this.input.localLeaderLease, current))
                     throw new BotControlTransportError(503, "The shard leader is temporarily unavailable");
             }
-            return executePrivacy(this.input.privacy, operation);
+            return executeLeaderOperation(this.input, operation);
         }
         const coordinator = this.input.coordinator;
         const lease = await this.#currentLeaderLease();
@@ -283,6 +317,36 @@ export class ShardControlRouter {
         }
     }
 }
+async function executeLeaderOperation(input, operation) {
+    if (operation.kind === "automod.enhanced.configuration.page") {
+        if (!input.leaderScannerRegistry)
+            throw new BotControlTransportError(503, "The Enhanced configuration leader is unavailable");
+        return input.leaderScannerRegistry.getConfigurationPage({
+            adapter: "hosted_ecko",
+            providerId: AUTOMOD_ENHANCED_PROVIDER_ID,
+            contractVersion: AUTOMOD_ENHANCED_CONTRACT_VERSION,
+            limit: operation.limit,
+            ...(operation.cursor ? { cursor: operation.cursor } : {}),
+            ...(operation.knownFingerprint
+                ? { knownFingerprint: operation.knownFingerprint }
+                : {}),
+        });
+    }
+    if (!input.privacy)
+        throw new BotControlTransportError(503, "The shard leader is temporarily unavailable");
+    return executePrivacy(input.privacy, operation);
+}
+function remainingEnhancedDeadline(result) {
+    if (!result || typeof result !== "object")
+        return ECKO_RESULT_TIMEOUT_MS;
+    const deadlineAt = result["deadlineAt"];
+    if (typeof deadlineAt !== "string")
+        return ECKO_RESULT_TIMEOUT_MS;
+    const parsed = Date.parse(deadlineAt);
+    if (!Number.isFinite(parsed))
+        return ECKO_RESULT_TIMEOUT_MS;
+    return Math.max(1, Math.min(ECKO_RESULT_TIMEOUT_MS, parsed - Date.now()));
+}
 async function executePrivacy(privacy, operation) {
     if (operation.kind === "privacy.providers.list")
         return (await privacy.listPrivacyProviders());

package/dist/shard-supervisor.d.ts

@@ -4,6 +4,7 @@ import type { ModuleDefinition, NumericWriteBehindCommittedBatch, ScheduledTaskE
 import { buildApplicationCommandDefinitions } from "./interactions.js";
 import { type ShardCloudRequest, type ShardHealthSnapshot, type ShardIdentity, type ShardProcessHealth } from "./shard-contracts.js";
 import { type ShardCoordinator, type ShardGenerationDescriptor, type ShardLeaderLease, type ShardLease } from "./shard-coordinator.js";
+import { ShardControlRouter } from "./shard-router.js";
 import type { BotHandle } from "./index.js";
 export declare const STEADY_STATE_LEASE_LOSS_BOUND_MS: number;
 export declare function supervisorShutdownExitCode(reason: string): number | undefined;
@@ -17,6 +18,16 @@ export declare function relinquishRestartCircuitOwnership(input: {
 }): Promise<boolean>;
 export declare function deferScheduledRoutingFailures(route: () => Promise<ScheduledTaskExecutionResult>): Promise<ScheduledTaskExecutionResult>;
 export declare function startShardSupervisor(environment: BotEnvironment, processEnvironment: NodeJS.ProcessEnv, workerEntry: string): Promise<BotHandle>;
+export declare function shardHostedControlCallbacks(router: Pick<ShardControlRouter, "deliverHostedServerLeave" | "refreshHostedServerOwner">): {
+    deliverHostedServerLeave: (input: {
+        operationId: string;
+        guildId: string;
+    }) => Promise<"completed" | "requires_review" | "queued" | "not_currently_installed" | "accepted_for_retry">;
+    refreshHostedServerOwner: (guildId: string) => Promise<{
+        username: string;
+        observedAt: string;
+    }>;
+};
 export declare function splitNumericCommittedBatch(batch: NumericWriteBehindCommittedBatch, index: number): NumericWriteBehindCommittedBatch;
 export declare function buildShardWorkerEnvironment(source: NodeJS.ProcessEnv, identity: ShardIdentity, restartCount: number): NodeJS.ProcessEnv;
 export declare function shardRuntimeCompositionHash(modules: readonly ModuleDefinition[], internalGuildId?: string, globalCommandMode?: Parameters<typeof buildApplicationCommandDefinitions>[2]): string;

package/dist/shard-supervisor.js

@@ -1,7 +1,7 @@
 import { safeError, ServiceRegistry } from "@helyx/core";
-import { checkDatabaseConnection, createDatabasePool, AuditRepository, GuildCommandRepository, HostedServerSafetyRepository, InteractionSessionRepository, PremiumAllocationRepository, RateLimitRepository, runConfiguredModuleMigrations, runCoreMigrations, RuntimeStateRepository, } from "@helyx/database";
+import { checkDatabaseConnection, createDatabasePool, AuditRepository, GuildCommandRepository, HostedServerSafetyRepository, InteractionSessionRepository, EckoOperationsRepository, PremiumAllocationRepository, RateLimitRepository, runConfiguredModuleMigrations, runCoreMigrations, RuntimeStateRepository, } from "@helyx/database";
 import { createPlatformServices, gamingStatisticsRecordOwner, achievementContributionRecordOwner, PostgresPrivacyProviderExecutor, } from "@helyx/platform";
-import { HELYX_SERVICE_NAMES } from "@helyx/sdk";
+import { AUTOMOD_ENHANCED_CONTRACT_VERSION, AUTOMOD_ENHANCED_PROVIDER_ID, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
 import { Client, ShardingManager } from "discord.js";
 import { createHash, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
@@ -19,6 +19,11 @@ import { createPermissionsModule } from "./permissions-module.js";
 import { SHARD_CONTROL_MAX_BYTES, SHARD_CONTROL_TIMEOUT_MS, SHARD_HEALTH_STALE_MS, assertShardMessageSize, controlOperationGuildId, executeShardControlOperation, gatewayBotInformationSchema, guildIdToShardId, shardCloudRequestSchema, shardHealthSnapshotSchema, workerMessageSchema, } from "./shard-contracts.js";
 import { RedisShardCoordinator, } from "./shard-coordinator.js";
 import { ShardControlRouter } from "./shard-router.js";
+import { BotAutoModerationScannerRegistry } from "./auto-moderation-scanner-registry.js";
+import { ShardEckoScannerRegistry } from "./shard-ecko-scanner-registry.js";
+import { EckoEvidenceReceiver } from "./ecko-evidence-receiver.js";
+import { EckoTransportAuthenticator } from "./ecko-transport-auth.js";
+import { TransientViolationEvidenceStore } from "./transient-violation-evidence.js";
 import { createDeveloperOperationsModule } from "./developer-operations-module.js";
 import { SupervisorCloudDiscordDirectory } from "./supervisor-cloud-directory.js";
 import { createSupportModule } from "./support-module.js";
@@ -148,6 +153,7 @@ export async function startShardSupervisor(environment, processEnvironment, work
     let deploymentOrder = 1;
     let shardCount = 1;
     let privacyService;
+    let leaderScannerRegistry;
     let manager;
     let scheduledTasks;
     let guildCommandWorker;
@@ -180,6 +186,7 @@ export async function startShardSupervisor(environment, processEnvironment, work
             observedAt: new Date().toISOString(),
         };
         const supervisorDirectory = new SupervisorCloudDiscordDirectory(environment.DISCORD_TOKEN, database, environment.HELYX_OWNER_USER_IDS);
+        const eckoOperations = new EckoOperationsRepository(database);
         cloudConnector = new CloudConnectorController({
             environment,
             database,
@@ -288,6 +295,7 @@ export async function startShardSupervisor(environment, processEnvironment, work
             assertStartupLeaseHealthy();
             const services = new Map(createPlatformServices(database, publicModules, platformServiceOptions(environment, publicModules)));
             runtimeAvailability = services.get(HELYX_SERVICE_NAMES.moduleAvailability);
+            leaderScannerRegistry = new BotAutoModerationScannerRegistry(publicModules, new ServiceRegistry(services), "hosted", undefined, environment.HELYX_DEPLOYMENT_ENVIRONMENT);
             if (numericWriteBehind)
                 services.set(HELYX_SERVICE_NAMES.numericWriteBehind, numericWriteBehind);
             privacyService = new BotControlService(database, [
@@ -311,6 +319,7 @@ export async function startShardSupervisor(environment, processEnvironment, work
                 localLeases,
                 dispatchLocal,
                 privacy: privacyService,
+                leaderScannerRegistry,
                 availability: availabilityService,
                 localLeaderLease: leaderLease,
                 ...(coordinator ? { coordinator } : {}),
@@ -405,6 +414,7 @@ export async function startShardSupervisor(environment, processEnvironment, work
             localLeases,
             dispatchLocal,
             ...(privacyService ? { privacy: privacyService } : {}),
+            ...(leaderScannerRegistry ? { leaderScannerRegistry } : {}),
             availability: availabilityService,
             ...(leaderLease ? { localLeaderLease: leaderLease } : {}),
             ...(coordinator ? { coordinator } : {}),
@@ -437,13 +447,41 @@ export async function startShardSupervisor(environment, processEnvironment, work
             startScheduledTasks();
         assertStartupLeaseHealthy();
         if (environment.HELYX_BOT_CONTROL_SECRET) {
+            const supervisorEvidenceStore = new TransientViolationEvidenceStore();
+            const shardEckoRegistry = new ShardEckoScannerRegistry({
+                configurationRegistry: () => leaderScannerRegistry,
+                routeConfiguration: (input) => router.getHostedEckoConfigurationPage(input),
+                evidenceStore: supervisorEvidenceStore,
+                routeResult: (input) => router.acceptHostedEckoResult(input),
+            });
+            const ecko = environment.HELYX_ECKO_TRANSPORT_SECRET
+                ? {
+                    authenticator: new EckoTransportAuthenticator(environment.HELYX_DEPLOYMENT_ENVIRONMENT, [
+                        environment.HELYX_ECKO_TRANSPORT_SECRET,
+                        ...(environment.HELYX_ECKO_TRANSPORT_PREVIOUS_SECRET
+                            ? [environment.HELYX_ECKO_TRANSPORT_PREVIOUS_SECRET]
+                            : []),
+                    ]),
+                    registry: shardEckoRegistry,
+                    evidence: new EckoEvidenceReceiver(supervisorEvidenceStore, environment.HELYX_DEPLOYMENT_ENVIRONMENT, Buffer.from(environment.HELYX_ECKO_TRANSPORT_SECRET, "base64")),
+                    gateState: () => eckoOperations.readGate(),
+                    telemetry: {
+                        accept: (batch) => eckoOperations.acceptTelemetry(batch),
+                    },
+                }
+                : undefined;
             controlServer = await createBotControlServer({
                 service: router,
                 secret: environment.HELYX_BOT_CONTROL_SECRET,
+                ...shardHostedControlCallbacks(router),
                 logger: { level: environment.LOG_LEVEL },
+                runtimeConfiguration: {
+                    hostedModerationEnabled: environment.HELYX_HOSTED_MODERATION_ENABLED,
+                },
                 shardHealth: buildHealth,
                 readiness: buildDeploymentReadiness,
                 guildCommands: new GuildCommandReadService(database, environment.DISCORD_CLIENT_ID, () => guildCommandWorker?.getHealth(), environment.DISCORD_TOKEN, environment.HELYX_GUILD_COMMAND_WRITES_ENABLED, environment.HELYX_GUILD_COMMAND_WRITE_GUILD_IDS, environment.HELYX_GUILD_COMMAND_WRITE_SCOPE === "all", commandModules),
+                ...(ecko ? { ecko } : {}),
             });
             await controlServer.listen({
                 host: "::",
@@ -855,7 +893,10 @@ export async function startShardSupervisor(environment, processEnvironment, work
         });
     }
     async function executeLeaderControl(request) {
-        if (!leaderLease || !privacyService)
+        if (!leaderLease ||
+            !privacyService ||
+            (request.operation.kind === "automod.enhanced.configuration.page" &&
+                !leaderScannerRegistry))
             return unavailableControl(request.requestId);
         if (request.generation !== leaderLease.generation ||
             request.fencingToken !== leaderLease.fencingToken ||
@@ -867,7 +908,22 @@ export async function startShardSupervisor(environment, processEnvironment, work
                 type: "helyx.control.response",
                 requestId: request.requestId,
                 ok: true,
-                result: await executeShardControlOperation(privacyService, request.operation),
+                result: request.operation.kind === "automod.enhanced.configuration.page"
+                    ? await leaderScannerRegistry?.getConfigurationPage({
+                        adapter: "hosted_ecko",
+                        providerId: AUTOMOD_ENHANCED_PROVIDER_ID,
+                        contractVersion: AUTOMOD_ENHANCED_CONTRACT_VERSION,
+                        limit: request.operation.limit,
+                        ...(request.operation.cursor
+                            ? { cursor: request.operation.cursor }
+                            : {}),
+                        ...(request.operation.knownFingerprint
+                            ? {
+                                knownFingerprint: request.operation.knownFingerprint,
+                            }
+                            : {}),
+                    })
+                    : await executeShardControlOperation(privacyService, request.operation),
             };
         }
         catch (error) {
@@ -1454,6 +1510,12 @@ export async function startShardSupervisor(environment, processEnvironment, work
         logger.info({ event: "shard.supervisor_stopped", reason }, "Shard supervisor stopped");
     }
 }
+export function shardHostedControlCallbacks(router) {
+    return {
+        deliverHostedServerLeave: (input) => router.deliverHostedServerLeave(input),
+        refreshHostedServerOwner: (guildId) => router.refreshHostedServerOwner(guildId),
+    };
+}
 export function splitNumericCommittedBatch(batch, index) {
     const mutation = batch.mutations[index];
     const result = batch.results[index];
@@ -1583,6 +1645,7 @@ export function buildShardWorkerEnvironment(source, identity, restartCount) {
         "HELYX_MESSAGE_CONTENT_ENABLED",
         "HELYX_GUILD_MEMBERS_ENABLED",
         "HELYX_GUILD_RECONCILIATION_INTERVAL_SECONDS",
+        "HELYX_HOSTED_MODERATION_ENABLED",
         "HELYX_MODULE_CATALOGUE_PATH",
         "STRIPE_ENVIRONMENT",
         "HELYX_CLOUD_CONNECT_ENABLED",

package/dist/shard-worker.d.ts

@@ -1,5 +1,7 @@
 import { type CommandRegistration } from "./interactions.js";
-import { type ShardIdentity, type ShardScheduledTaskRequest, type ShardScheduledTaskResponse } from "./shard-contracts.js";
+import type { BotAutoModerationScannerRegistry } from "./auto-moderation-scanner-registry.js";
+import type { TransientViolationEvidenceStore } from "./transient-violation-evidence.js";
+import { type ShardControlOperation, type ShardIdentity, type ShardScheduledTaskRequest, type ShardScheduledTaskResponse } from "./shard-contracts.js";
 import { type BotHandle } from "./index.js";
 import { type ScheduledTaskRoute } from "./scheduled-task-runner.js";
 export declare const WORKER_ORPHAN_TERMINATION_BOUND_MS: number;
@@ -28,6 +30,7 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     HELYX_SHARD_WORKER_DATABASE_POOL_MAX: number | undefined;
     DATABASE_URL: string;
     DATABASE_SSL: "disable" | "require" | "verify-full";
+    HELYX_RUNTIME_PROFILE: "hosted" | "self-hosted";
     DISCORD_TOKEN: string;
     DISCORD_CLIENT_ID: string;
     DISCORD_INTERNAL_GUILD_ID: string | undefined;
@@ -35,6 +38,7 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     HELYX_MODULE_PACKAGES: string[];
     HELYX_MODULE_CATALOGUE_PATH: string | undefined;
     HELYX_DASHBOARD_PUBLIC_URL: string;
+    HELYX_DEPLOYMENT_ENVIRONMENT: string;
     HELYX_HOSTED_MODERATION_ENABLED: boolean;
     HELYX_SUPPORT_STAFF_CHANNEL_ID: string | undefined;
     HELYX_VERIFICATION_ENABLED: boolean;
@@ -47,6 +51,11 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     HELYX_GUILD_COMMAND_WRITE_GUILD_IDS: string[];
     HELYX_PRIVACY_ENABLED: boolean;
     HELYX_MESSAGE_CONTENT_ENABLED: boolean;
+    HELYX_AUTOMOD_EMBEDDED_WORKERS: number;
+    HELYX_AUTOMOD_EMBEDDED_QUEUE_ITEMS: number;
+    HELYX_AUTOMOD_EMBEDDED_QUEUE_BYTES: number;
+    HELYX_AUTOMOD_EMBEDDED_QUEUE_ITEMS_PER_GUILD: number;
+    HELYX_AUTOMOD_EMBEDDED_REFRESH_SECONDS: number;
     HELYX_GUILD_MEMBERS_ENABLED: boolean;
     HELYX_CLOUD_CONNECT_ENABLED: boolean;
     HELYX_CLOUD_ENROLMENT_TOKEN: string | undefined;
@@ -66,6 +75,8 @@ export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.P
     HELYX_STATUS_HEARTBEAT_INTERVAL_SECONDS: number;
     STRIPE_ENVIRONMENT?: "sandbox" | "live" | undefined;
     HELYX_BOT_CONTROL_SECRET?: string | undefined;
+    HELYX_ECKO_TRANSPORT_SECRET?: string | undefined;
+    HELYX_ECKO_TRANSPORT_PREVIOUS_SECRET?: string | undefined;
     HELYX_SUPPORT_SERVICE_SECRET?: string | undefined;
     HELYX_VERIFICATION_INSTALLATION_ID?: string | undefined;
     HELYX_VERIFICATION_URL?: string | undefined;
@@ -91,4 +102,7 @@ export declare function shardWorkerCommandRegistration(input: {
     premiumActivationModuleId?: string;
     oauthModuleId?: string;
 }): CommandRegistration;
+export declare function acceptEnhancedAutoModerationResult(registry: Pick<BotAutoModerationScannerRegistry, "acceptResult"> | undefined, evidenceStore: TransientViolationEvidenceStore | undefined, operation: Extract<ShardControlOperation, {
+    kind: "automod.enhanced.result.accept";
+}>): Promise<import("@helyx/sdk").AutoModerationEnhancedResultOutcome>;
 //# sourceMappingURL=shard-worker.d.ts.map

package/dist/shard-worker.js

@@ -4,14 +4,15 @@ import { checkDatabaseConnection, createDatabasePool, PremiumAllocationRepositor
 import { REVIEWED_PREMIUM_MODULE_IDS } from "@helyx/module-manifest";
 import { createRuntime } from "@helyx/framework";
 import { createPlatformServices, PlatformMemberRoleGrantOwnershipService, PostgresMemberRoleGrantOwnershipStore, } from "@helyx/platform";
-import { HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { AUTOMOD_ENHANCED_CONTRACT_VERSION, AUTOMOD_ENHANCED_PROVIDER_ID, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
 import { Client, Events, Partials } from "discord.js";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import pino from "pino";
 import { createCloudManagementModule } from "./cloud-management-module.js";
-import { BotControlService, DiscordGuildResourceDirectory, mapBotControlError, } from "./control-server.js";
+import { BotControlService, BotControlTransportError, DiscordGuildResourceDirectory, mapBotControlError, } from "./control-server.js";
 import { HttpVerificationService } from "./verification-service.js";
-import { DiscordMessageDeliveryService, DiscordMemberEnforcementService, DiscordMemberRoleService, DiscordVerificationMemberService, DiscordResourceInspection, installModuleEvents, } from "./events.js";
+import { DiscordMessageDeliveryService, DiscordMemberRoleService, DiscordVerificationMemberService, DiscordResourceInspection, installModuleEvents, } from "./events.js";
+import { DiscordModerationMemberEnforcementAdapter } from "./discord-member-enforcement-service.js";
 import { installGuildTracking, } from "./guilds.js";
 import { installInteractions, } from "./interactions.js";
 import { createManagementModule } from "./management-module.js";
@@ -24,6 +25,7 @@ import { DiscordPremiumGuildAuthority } from "./premium-guild-authority.js";
 import { assertReviewedPremiumCatalogue, requirePremiumProviderEnvironment, } from "./premium-access.js";
 import { WorkerCloudConnectorProxy } from "./shard-cloud-proxy.js";
 import { DiscordOwnedMessageDeletionService } from "./discord-owned-message-service.js";
+import { installModerationPlatformServices } from "./moderation-platform-services.js";
 import { DiscordGuildHealthInspection } from "./discord-guild-health.js";
 import { DiscordAnalyticsInspection } from "./discord-analytics.js";
 import { DiscordInviteInspection } from "./discord-invites.js";
@@ -80,8 +82,9 @@ export async function startShardWorker(processEnvironment = process.env, identit
             ? {}
             : { maxConnections: environment.HELYX_SHARD_WORKER_DATABASE_POOL_MAX }),
     });
+    const hostedOwnerObserver = new PostgresHostedGuildSafety(database);
     const hostedSafety = environment.HELYX_HOSTED_MODERATION_ENABLED
-        ? new PostgresHostedGuildSafety(database)
+        ? hostedOwnerObserver
         : undefined;
     const developerModeration = environment.HELYX_HOSTED_MODERATION_ENABLED
         ? new HostedServerModerationClient(environment.HELYX_CLOUD_API_URL, environment.HELYX_BOT_CONTROL_SECRET)
@@ -100,6 +103,9 @@ export async function startShardWorker(processEnvironment = process.env, identit
     let client;
     let cloudProxy;
     let shardHealthProvider;
+    let embeddedScanner;
+    let autoModerationScannerRegistry;
+    let violationEvidenceStore;
     let hostedLeaveWorker;
     let leaseHeartbeatWatchdog;
     let forcedLeaseExit;
@@ -120,6 +126,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
         await cloudProxy?.stop().catch(() => undefined);
         shardHealthProvider?.stop();
         await moduleEvents?.stop().catch(() => undefined);
+        await embeddedScanner?.stop().catch(() => undefined);
         if (runtimeStarted)
             await runtime?.stop().catch(() => undefined);
         await numericWriteBehind?.stop();
@@ -137,7 +144,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
         assertReviewedPremiumCatalogue(featureModules);
         client = new Client({
             rest: discordRestOptions,
-            intents: gatewayIntentsForModules(featureModules, environment.HELYX_MESSAGE_CONTENT_ENABLED, environment.HELYX_GUILD_MEMBERS_ENABLED),
+            intents: gatewayIntentsForModules(featureModules, environment.HELYX_MESSAGE_CONTENT_ENABLED, environment.HELYX_GUILD_MEMBERS_ENABLED, environment.HELYX_RUNTIME_PROFILE),
             partials: [Partials.Message, Partials.Channel, Partials.Reaction],
             allowedMentions: { parse: [] },
             shards: [identity.shardId],
@@ -245,11 +252,29 @@ export async function startShardWorker(processEnvironment = process.env, identit
         platformServices.set(HELYX_SERVICE_NAMES.resourceAuthorization, new CoreResourceAuthorizationService(platformServices.get(HELYX_SERVICE_NAMES.permissions)));
         platformServices.set(HELYX_SERVICE_NAMES.discordMessages, new DiscordMessageDeliveryService(client));
         platformServices.set(HELYX_SERVICE_NAMES.discordOwnedMessages, new DiscordOwnedMessageDeletionService(client));
-        platformServices.set(HELYX_SERVICE_NAMES.memberEnforcement, new DiscordMemberEnforcementService(client));
+        platformServices.set(HELYX_SERVICE_NAMES.memberEnforcement, new DiscordModerationMemberEnforcementAdapter(client));
         const memberRoles = new DiscordMemberRoleService(client);
         platformServices.set(HELYX_SERVICE_NAMES.memberRoles, memberRoles);
         platformServices.set(HELYX_SERVICE_NAMES.memberRoleGrants, new PlatformMemberRoleGrantOwnershipService(new PostgresMemberRoleGrantOwnershipStore(database), memberRoles));
         platformServices.set(HELYX_SERVICE_NAMES.discordResources, new DiscordResourceInspection(client));
+        const moderationPlatformServices = await installModerationPlatformServices({
+            services: platformServices,
+            serviceAccess,
+            client,
+            modules: publicModules,
+            runtimeProfile: environment.HELYX_RUNTIME_PROFILE,
+            deploymentEnvironment: environment.HELYX_DEPLOYMENT_ENVIRONMENT,
+            embedded: {
+                workers: environment.HELYX_AUTOMOD_EMBEDDED_WORKERS,
+                maximumItems: environment.HELYX_AUTOMOD_EMBEDDED_QUEUE_ITEMS,
+                maximumBytes: environment.HELYX_AUTOMOD_EMBEDDED_QUEUE_BYTES,
+                maximumItemsPerGuild: environment.HELYX_AUTOMOD_EMBEDDED_QUEUE_ITEMS_PER_GUILD,
+                refreshIntervalMs: environment.HELYX_AUTOMOD_EMBEDDED_REFRESH_SECONDS * 1_000,
+            },
+        });
+        embeddedScanner = moderationPlatformServices.embeddedScanner;
+        autoModerationScannerRegistry = moderationPlatformServices.scannerRegistry;
+        violationEvidenceStore = moderationPlatformServices.evidenceStore;
         platformServices.set(HELYX_SERVICE_NAMES.discordGuildHealth, new DiscordGuildHealthInspection(client, publicModules, serviceAccess));
         platformServices.set(HELYX_SERVICE_NAMES.discordAnalytics, new DiscordAnalyticsInspection(client));
         if (serviceOptions.inviteFingerprintKey)
@@ -278,14 +303,12 @@ export async function startShardWorker(processEnvironment = process.env, identit
             shardId: identity.shardId,
             fencingToken: BigInt(identity.fencingToken),
         };
-        const prepareGuilds = installGuildTracking(client, database, publicModules, logger, enabledCoreModuleIds, shardOwnership, environment.HELYX_GUILD_RECONCILIATION_INTERVAL_SECONDS * 1_000, identity.shardCount, environment.DISCORD_CLIENT_ID, hostedSafety, hostedInviteGate);
+        const prepareGuilds = installGuildTracking(client, database, publicModules, logger, enabledCoreModuleIds, shardOwnership, environment.HELYX_GUILD_RECONCILIATION_INTERVAL_SECONDS * 1_000, identity.shardCount, environment.DISCORD_CLIENT_ID, hostedSafety, hostedInviteGate, hostedOwnerObserver);
         guildTracking = prepareGuilds;
-        hostedLeaveWorker = hostedSafety
-            ? new HostedServerLeaveWorker(database, client, logger, {
-                shardId: identity.shardId,
-                shardCount: identity.shardCount,
-            })
-            : undefined;
+        hostedLeaveWorker = new HostedServerLeaveWorker(database, client, logger, {
+            shardId: identity.shardId,
+            shardCount: identity.shardCount,
+        });
         const commandsReady = installInteractions(client, modules, shardWorkerCommandRegistration({
             ...(environment.DISCORD_INTERNAL_GUILD_ID
                 ? { internalGuildId: environment.DISCORD_INTERNAL_GUILD_ID }
@@ -300,7 +323,10 @@ export async function startShardWorker(processEnvironment = process.env, identit
                 : {}),
             ...(oauthModule ? { oauthModuleId: oauthModule.manifest.id } : {}),
         }), logger, serviceAccess);
-        moduleEvents = installModuleEvents(client, publicModules, logger, serviceAccess);
+        moduleEvents = installModuleEvents(client, publicModules, logger, serviceAccess, {
+            runtimeProfile: environment.HELYX_RUNTIME_PROFILE,
+            evidenceStore: moderationPlatformServices.evidenceStore,
+        });
         const controlService = new BotControlService(database, publicModules, guildResources, serviceAccess, undefined, environment.DISCORD_INTERNAL_GUILD_ID &&
             environment.HELYX_SUPPORT_STAFF_CHANNEL_ID
             ? {
@@ -313,7 +339,7 @@ export async function startShardWorker(processEnvironment = process.env, identit
             if (!parsed.success)
                 return;
             if (parsed.data.type === "helyx.control.request") {
-                void handleControl(identity, controlService, parsed.data, logger);
+                void handleControl(identity, controlService, hostedOwnerObserver, client, hostedLeaveWorker, autoModerationScannerRegistry, violationEvidenceStore, parsed.data, logger);
             }
             else if (parsed.data.type === "helyx.lease.heartbeat") {
                 if (sameShardIdentity(parsed.data.identity, identity))
@@ -375,6 +401,9 @@ export async function startShardWorker(processEnvironment = process.env, identit
             await cloudProxy.start();
         await runtime.start();
         runtimeStarted = true;
+        await embeddedScanner?.synchronize().catch((error) => {
+            logger.warn({ event: "automod.embedded_sync_failed", error: safeError(error) }, "Embedded Auto Moderation scanner started in Standard fallback");
+        });
         await client.login(environment.DISCORD_TOKEN);
         await commandsReady;
         hostedLeaveWorker?.start();
@@ -501,7 +530,7 @@ export function shardWorkerCommandRegistration(input) {
         ]),
     };
 }
-async function handleControl(identity, service, request, logger) {
+async function handleControl(identity, service, hostedOwnerObserver, client, hostedLeaveWorker, scannerRegistry, evidenceStore, request, logger) {
     let response;
     const guildId = controlOperationGuildId(request.operation);
     if (request.generation !== identity.generation ||
@@ -525,7 +554,13 @@ async function handleControl(identity, service, request, logger) {
                 type: "helyx.control.response",
                 requestId: request.requestId,
                 ok: true,
-                result: await executeShardControlOperation(service, request.operation),
+                result: request.operation.kind === "automod.enhanced.result.accept"
+                    ? await acceptEnhancedAutoModerationResult(scannerRegistry, evidenceStore, request.operation)
+                    : request.operation.kind === "hosted-server.leave.deliver"
+                        ? await deliverHostedLeave(hostedLeaveWorker, request.operation)
+                        : request.operation.kind === "hosted-server.owner.refresh"
+                            ? await refreshHostedOwner(hostedOwnerObserver, client, request.operation.guildId)
+                            : await executeShardControlOperation(service, request.operation),
             };
         }
         catch (error) {
@@ -570,6 +605,49 @@ async function handleControl(identity, service, request, logger) {
     }
     process.send?.(response);
 }
+export async function acceptEnhancedAutoModerationResult(registry, evidenceStore, operation) {
+    if (!registry || !evidenceStore)
+        return {
+            outcome: "rejected",
+            code: "module_unavailable",
+        };
+    const resultGuildId = operation.result && typeof operation.result === "object"
+        ? operation.result["guildId"]
+        : undefined;
+    if (resultGuildId !== operation.guildId)
+        return { outcome: "rejected", code: "wrong_owner" };
+    const evidenceReference = operation.evidence
+        ? evidenceStore.capture({
+            source: "enhanced_scanner",
+            ...operation.evidence,
+        })
+        : null;
+    if (operation.evidence && !evidenceReference)
+        return {
+            outcome: "rejected",
+            code: "module_unavailable",
+        };
+    return registry.acceptResult({
+        adapter: "hosted_ecko",
+        providerId: AUTOMOD_ENHANCED_PROVIDER_ID,
+        contractVersion: AUTOMOD_ENHANCED_CONTRACT_VERSION,
+        result: operation.result,
+        ...(evidenceReference ? { evidenceReference } : {}),
+    });
+}
+function deliverHostedLeave(worker, input) {
+    if (!worker)
+        throw new BotControlTransportError(503, "Hosted server moderation delivery is unavailable");
+    return worker.deliverOperation(input);
+}
+function refreshHostedOwner(ownerObserver, client, guildId) {
+    if (!client)
+        throw new BotControlTransportError(503, "Hosted server owner refresh is unavailable");
+    const guild = client.guilds.cache.get(guildId);
+    if (!guild)
+        throw new BotControlTransportError(404, "The hosted server is not installed");
+    return ownerObserver.refreshOwner(guild);
+}
 function health(identity, client, status, eventLoopDelayNanoseconds, queueDepth) {
     return {
         shardId: identity.shardId,

package/dist/transient-violation-evidence.d.ts

@@ -0,0 +1,39 @@
+import { type ViolationEvidenceReference } from "@helyx/sdk";
+export interface TransientViolationEvidenceStoreLimits {
+    entries?: number;
+    totalBytes?: number;
+}
+export type TransientEvidenceReadResult = {
+    outcome: "available";
+    content: string;
+} | {
+    outcome: "unavailable";
+} | {
+    outcome: "mismatch";
+};
+export type TransientViolationEvidenceCaptureInput = (Omit<Extract<ViolationEvidenceReference, {
+    source: "discord_auto_moderation";
+}>, "key"> & {
+    content: string;
+}) | (Omit<Extract<ViolationEvidenceReference, {
+    source: "enhanced_scanner";
+}>, "key"> & {
+    content: string;
+});
+/**
+ * Bot-private, memory-only hand-off for message content. The opaque reference is
+ * safe to cross module boundaries; the content and this vault are not.
+ */
+export declare class TransientViolationEvidenceStore {
+    #private;
+    private readonly now;
+    private readonly createKey;
+    constructor(now?: () => number, createKey?: () => string, limits?: TransientViolationEvidenceStoreLimits);
+    capture(input: TransientViolationEvidenceCaptureInput): ViolationEvidenceReference | null;
+    consume(reference: ViolationEvidenceReference): TransientEvidenceReadResult;
+    /** Read without discarding so a failed Discord send can be retried. */
+    read(reference: ViolationEvidenceReference): TransientEvidenceReadResult;
+    discard(reference: ViolationEvidenceReference): void;
+    get size(): number;
+}
+//# sourceMappingURL=transient-violation-evidence.d.ts.map