@helyx/bot 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 1.3.0
+
+### Minor Changes
+
+- Release accountable Moderation and Discord-native plus Enhanced Auto Moderation with configurable thread layouts, individual staff notifications, strict configuration metadata, privacy-safe settings cleanup, durable action recovery and theme-aware dashboard controls. Publish compatible manifest and SDK contracts and refresh self-host package catalogues.
+
+### Patch Changes
+
+- Updated dependencies
+  - @helyx/module-manifest@0.11.0
+  - @helyx/sdk@0.13.0
+  - @helyx/module-automod@1.0.1
+  - @helyx/module-moderation@1.0.1
+
+## 1.2.1
+
+### Patch Changes
+
+- Load the embedded Auto Moderation engine only for a self-hosted runtime with its
+  scanner provider installed. Core-only and public-module installations no longer
+  require the optional Testing module to import or start the bot. Refresh the
+  self-host catalogue to reference the corrected bot release.
+
 ## 1.2.0
 
 ### Minor Changes

package/dist/control-server.js

@@ -24,9 +24,9 @@ import { registerDashboardPreviewImportRoutes, registerDashboardResourceMutation
 import { executeDashboardAction as executeDeclaredDashboardAction, previewDashboardAction as previewDeclaredDashboardAction, } from "./dashboard-action-control.js";
 import { registerDashboardActionRoutes, } from "./dashboard-action-routes.js";
 import { registerEckoTransportRoutes, } from "./ecko-transport-routes.js";
+import { validateDiscordUserSettingSelections, validateDiscordSettingSelections, } from "./dashboard-discord-settings.js";
 const snowflake = z.string().regex(/^\d{17,20}$/u);
 const moduleId = z.string().regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/u);
-const MAX_DISCORD_SETTING_SELECTIONS = 25;
 const configurationValue = z.record(z.string(), z.union([
     z.null(),
     z.string(),
@@ -92,7 +92,10 @@ const managedResourceSummarySchema = z
 })
     .strict();
 const managedResourceDetailSchema = managedResourceSummarySchema
-    .extend({ value: managedResourceObject })
+    .extend({
+    value: managedResourceObject,
+    availableActionIds: z.array(z.string().min(1).max(100)).max(50).optional(),
+})
     .strict()
     .refine(hasBoundedManagedResourceBytes);
 const managedResourcePageSchema = z
@@ -1230,43 +1233,11 @@ export class BotControlService {
     }
     async #validateDiscordSettings(guildId, module, value) {
         const settings = module.manifest.dashboard?.settings ?? [];
+        await validateDiscordUserSettingSelections(this.#services, guildId, settings, value);
         if (!settings.some((setting) => setting.type === "discord-channel" || setting.type === "discord-role"))
             return;
         const resources = await this.resources.getGuildResources(guildId);
-        const channels = new Map(resources.channels.map((channel) => [channel.id, channel]));
-        const roles = new Set(resources.roles.map((role) => role.id));
-        for (const setting of settings) {
-            const configured = value[setting.key];
-            if (setting.type === "discord-channel") {
-                if (configured === "" || configured === undefined)
-                    continue;
-                if (Boolean(setting.multiple) !== Array.isArray(configured))
-                    throw new BotControlValidationError(`${setting.label} has an invalid Discord channel selection`);
-                const configuredChannels = Array.isArray(configured)
-                    ? configured
-                    : [configured];
-                if (configuredChannels.length > MAX_DISCORD_SETTING_SELECTIONS ||
-                    new Set(configuredChannels).size !== configuredChannels.length ||
-                    configuredChannels.some((channelId) => {
-                        if (typeof channelId !== "string")
-                            return true;
-                        const channel = channels.get(channelId);
-                        return !channel || !setting.channelTypes.includes(channel.type);
-                    }))
-                    throw new BotControlValidationError(`${setting.label} must contain available supported Discord channels`);
-            }
-            if (setting.type === "discord-role") {
-                if (configured === "" || configured === undefined)
-                    continue;
-                if (Boolean(setting.multiple) !== Array.isArray(configured))
-                    throw new BotControlValidationError(`${setting.label} has an invalid Discord role selection`);
-                const configuredRoles = Array.isArray(configured)
-                    ? configured
-                    : [configured];
-                if (configuredRoles.some((roleId) => typeof roleId !== "string" || !roles.has(roleId)))
-                    throw new BotControlValidationError(`${setting.label} must contain available Discord roles`);
-            }
-        }
+        validateDiscordSettingSelections(settings, value, resources);
     }
     async #validatePermissionRoles(guildId, state) {
         const policies = [

package/dist/dashboard-discord-settings.d.ts

@@ -0,0 +1,20 @@
+import type { DashboardSetting } from "@helyx/module-manifest";
+import { type ServiceAccess } from "@helyx/sdk";
+type ChannelType = Extract<DashboardSetting, {
+    type: "discord-channel";
+}>["channelTypes"][number];
+/** Shape checks precede bounded, freshly resolved guild-membership checks. */
+export declare function discordUserSettingSelections(settings: readonly DashboardSetting[], value: Readonly<Record<string, unknown>>): string[];
+export declare function validateDiscordUserSettingSelections(services: ServiceAccess, guildId: string, settings: readonly DashboardSetting[], value: Readonly<Record<string, unknown>>): Promise<void>;
+/** Validates selections against the freshly fetched server resources. */
+export declare function validateDiscordSettingSelections(settings: readonly DashboardSetting[], value: Readonly<Record<string, unknown>>, resources: {
+    channels: readonly {
+        id: string;
+        type: ChannelType;
+    }[];
+    roles: readonly {
+        id: string;
+    }[];
+}): void;
+export {};
+//# sourceMappingURL=dashboard-discord-settings.d.ts.map

package/dist/dashboard-discord-settings.js

@@ -0,0 +1,67 @@
+import { DashboardActionValidationError, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+const MAX_DISCORD_SETTING_SELECTIONS = 25;
+/** Shape checks precede bounded, freshly resolved guild-membership checks. */
+export function discordUserSettingSelections(settings, value) {
+    const selected = new Set();
+    for (const setting of settings) {
+        if (setting.type !== "discord-user")
+            continue;
+        const configured = value[setting.key] === undefined ? [] : value[setting.key];
+        if (!Array.isArray(configured) ||
+            configured.length <
+                Math.max(setting.required ? 1 : 0, setting.minItems ?? 0) ||
+            configured.length >
+                (setting.maxItems ?? MAX_DISCORD_SETTING_SELECTIONS) ||
+            new Set(configured).size !== configured.length ||
+            configured.some((id) => typeof id !== "string" || !/^\d{17,20}$/u.test(id)))
+            throw new DashboardActionValidationError(`${setting.label} must contain a bounded list of Discord user IDs`);
+        for (const userId of configured)
+            selected.add(userId);
+    }
+    if (selected.size > MAX_DISCORD_SETTING_SELECTIONS)
+        throw new DashboardActionValidationError("Select at most 25 individual users across these settings");
+    return [...selected];
+}
+export async function validateDiscordUserSettingSelections(services, guildId, settings, value) {
+    const userIds = discordUserSettingSelections(settings, value);
+    if (!userIds.length)
+        return;
+    if (!services.has(HELYX_SERVICE_NAMES.discordResources))
+        throw new DashboardActionValidationError("Discord membership confirmation is temporarily unavailable");
+    const members = await services
+        .get(HELYX_SERVICE_NAMES.discordResources)
+        .resolveMemberSnapshots({ guildId, userIds });
+    if (userIds.some((userId) => !members.some((member) => member.userId === userId && member.exists && !member.isBot)))
+        throw new DashboardActionValidationError("Notification users must be current human members of this server");
+}
+/** Validates selections against the freshly fetched server resources. */
+export function validateDiscordSettingSelections(settings, value, resources) {
+    const channels = new Map(resources.channels.map(({ id, type }) => [id, type]));
+    const roles = new Set(resources.roles.map((role) => role.id));
+    for (const setting of settings) {
+        if (setting.type !== "discord-channel" && setting.type !== "discord-role")
+            continue;
+        const configured = value[setting.key];
+        if (configured === "" ||
+            configured === undefined ||
+            (configured === null && !setting.required && !setting.multiple))
+            continue;
+        if (Boolean(setting.multiple) !== Array.isArray(configured))
+            throw new DashboardActionValidationError(`${setting.label} has an invalid Discord ${setting.type === "discord-channel" ? "channel" : "role"} selection`);
+        const selections = Array.isArray(configured) ? configured : [configured];
+        if (setting.type === "discord-channel") {
+            if (selections.length > MAX_DISCORD_SETTING_SELECTIONS ||
+                new Set(selections).size !== selections.length ||
+                selections.some((channelId) => {
+                    if (typeof channelId !== "string")
+                        return true;
+                    const channel = channels.get(channelId);
+                    return !channel || !setting.channelTypes.includes(channel);
+                }))
+                throw new DashboardActionValidationError(`${setting.label} must contain available supported Discord channels`);
+        }
+        else if (selections.some((roleId) => typeof roleId !== "string" || !roles.has(roleId)))
+            throw new DashboardActionValidationError(`${setting.label} must contain available Discord roles`);
+    }
+}
+//# sourceMappingURL=dashboard-discord-settings.js.map

package/dist/dashboard-feature-control.d.ts

@@ -16,9 +16,10 @@ export declare function isBoundedManagedResourceValue(value: unknown, depth?: nu
     keys: number;
 }): value is ManagedResourceValue;
 export declare function hasBoundedManagedResourceBytes(value: unknown): boolean;
-export declare function normalizeManagedResourceDetail(value: Omit<ManagedResourceDetail, "description" | "attributes"> & {
+export declare function normalizeManagedResourceDetail(value: Omit<ManagedResourceDetail, "description" | "attributes" | "availableActionIds"> & {
     description?: string | undefined;
     attributes?: Readonly<Record<string, ManagedResourceValue>> | undefined;
+    availableActionIds?: readonly string[] | undefined;
 }, attributeKeys: readonly string[]): ManagedResourceDetail;
 export declare function normalizeManagedResourcePage(value: {
     items: readonly (Omit<ManagedResourcePage["items"][number], "description" | "attributes"> & {

package/dist/dashboard-feature-control.js

@@ -151,6 +151,9 @@ export function normalizeManagedResourceDetail(value, attributeKeys) {
             }),
         updatedAt: value.updatedAt,
         value: value.value,
+        ...(value.availableActionIds === undefined
+            ? {}
+            : { availableActionIds: value.availableActionIds }),
     };
 }
 export function normalizeManagedResourcePage(value, attributeKeys) {

package/dist/discord-automod-execution-ids.d.ts

@@ -0,0 +1,12 @@
+import type { AutoModerationActionExecution } from "discord.js";
+/** Discord supplies no message ID for blocked posts. Never key all such posts
+ * permanently by member/channel; correlate companion actions only transiently.
+ * Same-type actions begin a new attempt, while a known alert ID is a replay.
+ */
+export declare class DiscordAutoModerationExecutionIds {
+    #private;
+    private readonly now;
+    constructor(now?: () => number);
+    identify(execution: Pick<AutoModerationActionExecution, "guild" | "ruleId" | "userId" | "channelId" | "messageId" | "content" | "action" | "alertSystemMessageId">): string;
+}
+//# sourceMappingURL=discord-automod-execution-ids.d.ts.map

package/dist/discord-automod-execution-ids.js

@@ -0,0 +1,62 @@
+import { createHash, randomUUID } from "node:crypto";
+const CORRELATION_LIFETIME_MS = 5_000;
+const MAX_CORRELATION_GROUPS = 1_000;
+const MAX_ATTEMPTS_PER_GROUP = 16;
+/** Discord supplies no message ID for blocked posts. Never key all such posts
+ * permanently by member/channel; correlate companion actions only transiently.
+ * Same-type actions begin a new attempt, while a known alert ID is a replay.
+ */
+export class DiscordAutoModerationExecutionIds {
+    now;
+    #groups = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    identify(execution) {
+        const identity = [
+            execution.guild.id,
+            execution.ruleId,
+            execution.userId,
+            execution.channelId,
+        ];
+        if (execution.messageId)
+            return createHash("sha256")
+                .update(JSON.stringify([...identity, execution.messageId]))
+                .digest("hex");
+        const now = this.now();
+        for (const [key, attempts] of this.#groups) {
+            if (attempts.at(-1).expiresAt > now)
+                break;
+            this.#groups.delete(key);
+        }
+        // Content is hashed inside the core adapter and never stored or exposed to
+        // module code, records, telemetry or logs by this correlation cache.
+        const key = createHash("sha256")
+            .update(JSON.stringify([...identity, execution.content]))
+            .digest("hex");
+        const attempts = (this.#groups.get(key) ?? []).filter((attempt) => attempt.expiresAt > now);
+        const knownAlert = execution.alertSystemMessageId
+            ? attempts.find((attempt) => attempt.alertMessageId === execution.alertSystemMessageId)
+            : undefined;
+        let attempt = knownAlert ??
+            attempts.find((candidate) => !candidate.actionTypes.has(execution.action.type));
+        if (!attempt) {
+            attempt = {
+                id: randomUUID(),
+                expiresAt: now + CORRELATION_LIFETIME_MS,
+                actionTypes: new Set(),
+                alertMessageId: null,
+            };
+            attempts.push(attempt);
+        }
+        attempt.actionTypes.add(execution.action.type);
+        if (execution.alertSystemMessageId)
+            attempt.alertMessageId = execution.alertSystemMessageId;
+        this.#groups.delete(key);
+        this.#groups.set(key, attempts.slice(-MAX_ATTEMPTS_PER_GROUP));
+        while (this.#groups.size > MAX_CORRELATION_GROUPS)
+            this.#groups.delete(this.#groups.keys().next().value);
+        return attempt.id;
+    }
+}
+//# sourceMappingURL=discord-automod-execution-ids.js.map

package/dist/discord-violation-evidence-message.d.ts

@@ -0,0 +1,12 @@
+import type { ModerationSeverity, ViolationEvidenceReference } from "@helyx/sdk";
+import { type MessageCreateOptions } from "discord.js";
+export interface ViolationEvidenceMessageContext {
+    severity: ModerationSeverity;
+    occurredAt: Date;
+    ruleName?: string;
+    confidenceClass?: string;
+    confidenceScore?: number;
+}
+/** Render only inside the core evidence boundary, directly into Discord. */
+export declare function violationEvidenceMessage(reference: ViolationEvidenceReference, content: string, context?: ViolationEvidenceMessageContext): MessageCreateOptions;
+//# sourceMappingURL=discord-violation-evidence-message.d.ts.map

package/dist/discord-violation-evidence-message.js

@@ -0,0 +1,63 @@
+import { escapeMarkdown } from "discord.js";
+/** Render only inside the core evidence boundary, directly into Discord. */
+export function violationEvidenceMessage(reference, content, context) {
+    const severity = context?.severity;
+    return {
+        allowedMentions: { parse: [] },
+        embeds: [
+            {
+                title: "Auto Moderation Trigger",
+                description: `Automated rule trigger from <@${reference.authorUserId}>${severity ? ` at severity ${severity}` : ""}.`,
+                color: severity === "critical" || severity === "high"
+                    ? 0xef4444
+                    : severity === "medium"
+                        ? 0xf59e0b
+                        : 0xf97316,
+                fields: [
+                    {
+                        name: "Original Channel",
+                        value: `<#${reference.channelId}>`,
+                        inline: true,
+                    },
+                    {
+                        name: "Rule",
+                        value: escapeMarkdown(context?.ruleName ?? "Auto Moderation rule"),
+                        inline: true,
+                    },
+                    {
+                        name: "Confidence",
+                        value: context?.confidenceScore !== undefined
+                            ? `${context.confidenceScore}%`
+                            : context?.confidenceClass === "native_equivalent"
+                                ? "Discord-native match (no score provided)"
+                                : (context?.confidenceClass ?? "Not available"),
+                        inline: true,
+                    },
+                    ...capturedMessageFields(content),
+                ],
+                ...(context ? { timestamp: context.occurredAt.toISOString() } : {}),
+            },
+        ],
+    };
+}
+function capturedMessageFields(content) {
+    // Preserve all evidence while respecting Discord's 1,024-character field
+    // limit. Keep escaped Markdown pairs and Unicode code points intact.
+    const chunks = [];
+    let chunk = "";
+    for (const token of escapeMarkdown(content).match(/\\.|./gsu) ?? []) {
+        if (chunk.length + token.length > 1_024) {
+            chunks.push(chunk);
+            chunk = "";
+        }
+        chunk += token;
+    }
+    if (chunk)
+        chunks.push(chunk);
+    return chunks.map((value, index) => ({
+        name: index === 0 ? "Original Message" : "Original Message (continued)",
+        value,
+        inline: false,
+    }));
+}
+//# sourceMappingURL=discord-violation-evidence-message.js.map

package/dist/discord-violation-layout-message.d.ts

@@ -0,0 +1,13 @@
+import { type MessageResponse, type ViolationThreadService } from "@helyx/sdk";
+import { type APIMessageTopLevelComponent, type MessageCreateOptions } from "discord.js";
+import type { ViolationEvidenceMessageContext } from "./discord-violation-evidence-message.js";
+import type { ViolationEvidenceReference } from "@helyx/sdk";
+type Presentation = NonNullable<Parameters<ViolationThreadService["send"]>[0]["presentation"]>;
+/** Initial card has no evidence content; the request-bound core adapter fills its slots. */
+export declare function violationLayoutOpening(response: MessageResponse, presentation: Presentation): MessageCreateOptions;
+/** Replace nested controls in place; legacy top-level rows remain supported. */
+export declare function violationLayoutControls(components: readonly APIMessageTopLevelComponent[], buttons: NonNullable<MessageResponse["buttons"]>): APIMessageTopLevelComponent[];
+/** Evidence never leaves this core-owned transient renderer. */
+export declare function violationLayoutEvidence(components: readonly APIMessageTopLevelComponent[], reference: ViolationEvidenceReference, content: string, context?: ViolationEvidenceMessageContext, separateEvidence?: boolean): APIMessageTopLevelComponent[] | null;
+export {};
+//# sourceMappingURL=discord-violation-layout-message.d.ts.map

package/dist/discord-violation-layout-message.js

@@ -0,0 +1,156 @@
+import { VIOLATION_THREAD_LAYOUTS, violationThreadLayoutContainers, } from "@helyx/sdk";
+import { ComponentType, MessageFlags, escapeMarkdown, } from "discord.js";
+import { toReplyOptions } from "./interactions.js";
+const SLOT_IDS = {
+    title: 501,
+    participants: 502,
+    opening: 503,
+    trigger: 504,
+    channel: 505,
+    evidence: 506,
+    controls: 507,
+};
+/** Initial card has no evidence content; the request-bound core adapter fills its slots. */
+export function violationLayoutOpening(response, presentation) {
+    if (!VIOLATION_THREAD_LAYOUTS.includes(presentation.layout) ||
+        !Number.isSafeInteger(presentation.caseNumber) ||
+        presentation.caseNumber < 1)
+        throw new Error("Invalid violation thread presentation");
+    const text = response.componentsV2?.text;
+    if (!text || text.length !== 2)
+        throw new Error("Invalid violation opening body");
+    const controls = controlRows(response.buttons ?? []);
+    const values = {
+        title: `**Moderation case · ${String(presentation.caseNumber).padStart(3, "0")}**`,
+        participants: text[0].content,
+        opening: escapeMarkdown(text[1].content),
+        trigger: "**Automated rule trigger**\nRule and confidence unavailable.",
+        channel: "**Original Channel**\nNot available.",
+        evidence: "**Original Message**\nEvidence unavailable or awaiting delivery.",
+    };
+    let separatorId = 700;
+    const components = violationThreadLayoutContainers(presentation.layout).map((container) => ({
+        type: ComponentType.Container,
+        id: container.id,
+        ...(container.accent ? { accent_color: 0xf97316 } : {}),
+        ...(container.spoiler ? { spoiler: true } : {}),
+        components: container.slots.flatMap((slot) => {
+            if (slot === "divider")
+                return [
+                    {
+                        type: ComponentType.Separator,
+                        id: separatorId++,
+                        divider: true,
+                        spacing: 1,
+                    },
+                ];
+            if (slot === "controls")
+                return controls;
+            return [
+                {
+                    type: ComponentType.TextDisplay,
+                    id: SLOT_IDS[slot],
+                    content: values[slot],
+                },
+            ];
+        }),
+    }));
+    const original = toReplyOptions(response);
+    if (textLength(components) > 4_000) {
+        // Keep an unusually Markdown-heavy configured message literal without
+        // doubling every character or dropping any of its text.
+        for (const container of components)
+            for (const child of container.components)
+                if (child.type === ComponentType.TextDisplay &&
+                    child.id === SLOT_IDS.opening)
+                    child.content = `\`\`\`\n${text[1].content.replaceAll("```", "``\u200b`")}\n\`\`\``;
+        if (textLength(components) > 4_000)
+            throw new Error("Violation opening exceeds Discord's display limit");
+    }
+    return {
+        flags: MessageFlags.IsComponentsV2,
+        components,
+        ...(original.allowedMentions
+            ? { allowedMentions: original.allowedMentions }
+            : {}),
+    };
+}
+/** Replace nested controls in place; legacy top-level rows remain supported. */
+export function violationLayoutControls(components, buttons) {
+    const rows = controlRows(buttons);
+    let nested = false;
+    const updated = components
+        .filter((component) => component.type !== ComponentType.ActionRow)
+        .map((component) => {
+        if (component.type !== ComponentType.Container)
+            return component;
+        return {
+            ...component,
+            components: component.components.flatMap((child) => {
+                if (child.type !== ComponentType.ActionRow)
+                    return [child];
+                nested = true;
+                return rows;
+            }),
+        };
+    });
+    return nested ? updated : [...updated, ...rows];
+}
+/** Evidence never leaves this core-owned transient renderer. */
+export function violationLayoutEvidence(components, reference, content, context, separateEvidence = false) {
+    let found = false;
+    const confidence = context?.confidenceScore !== undefined
+        ? `${context.confidenceScore}%`
+        : context?.confidenceClass === "native_equivalent"
+            ? "Discord-native match (no score provided)"
+            : "Not available";
+    const replacement = {
+        [SLOT_IDS.trigger]: `**Automated rule trigger${context ? ` at severity ${context.severity}` : ""}.**\nRule: ${escapeMarkdown(context?.ruleName ?? "Auto Moderation rule")} · Confidence: ${confidence}`,
+        [SLOT_IDS.channel]: `**Original Channel**\n<#${reference.channelId}>`,
+        [SLOT_IDS.evidence]: separateEvidence
+            ? "**Original Message**\nThe full original message requires a separate evidence card below."
+            : `**Original Message**\n${escapeMarkdown(content)}`,
+    };
+    const result = components.map((component) => {
+        if (component.type !== ComponentType.Container)
+            return component;
+        return {
+            ...component,
+            components: component.components.map((child) => {
+                if (child.type !== ComponentType.TextDisplay || child.id === undefined)
+                    return child;
+                const value = replacement[child.id];
+                if (value === undefined)
+                    return child;
+                if (child.id === SLOT_IDS.evidence)
+                    found = true;
+                return { ...child, content: value };
+            }),
+        };
+    });
+    if (!found)
+        return null;
+    // Long escaped text is delivered separately without truncating evidence.
+    return textLength(result) <= 4_000 ? result : null;
+}
+function textLength(components) {
+    return components.reduce((total, component) => total +
+        (component.type === ComponentType.TextDisplay
+            ? component.content.length
+            : component.type === ComponentType.Container
+                ? component.components.reduce((sum, child) => sum +
+                    (child.type === ComponentType.TextDisplay
+                        ? child.content.length
+                        : 0), 0)
+                : 0), 0);
+}
+function controlRows(buttons) {
+    const raw = toReplyOptions({ buttons }).components ?? [];
+    return raw.map((row) => {
+        const json = ("toJSON" in row ? row.toJSON() : row);
+        if (json.type !== ComponentType.ActionRow)
+            throw new Error("Invalid violation control row");
+        return { ...json, id: SLOT_IDS.controls };
+    });
+}
+//# sourceMappingURL=discord-violation-layout-message.js.map

package/dist/discord-violation-notification-users.d.ts

@@ -0,0 +1,12 @@
+import { type Guild, type GuildMember, type TextChannel } from "discord.js";
+/** Notification identities receive only reviewed parent/thread access. */
+export declare function inspectViolationNotificationUsers(guild: Guild, channel: TextChannel, userIds: readonly string[]): Promise<{
+    outcome: "allowed";
+    members: readonly GuildMember[];
+    requiredChanges: string[];
+} | {
+    outcome: "denied";
+    safeCode: "moderator_user_unavailable";
+}>;
+export declare function configureViolationNotificationUsers(channel: TextChannel, members: readonly GuildMember[], revalidate: () => Promise<boolean>, reason: string): Promise<boolean>;
+//# sourceMappingURL=discord-violation-notification-users.d.ts.map

package/dist/discord-violation-notification-users.js

@@ -0,0 +1,37 @@
+import { VIOLATION_THREAD_LIMITS } from "@helyx/sdk";
+import { PermissionFlagsBits, } from "discord.js";
+const NOTIFICATION_ACCESS = Object.freeze({
+    view_channel: PermissionFlagsBits.ViewChannel,
+    read_message_history: PermissionFlagsBits.ReadMessageHistory,
+    send_messages_in_threads: PermissionFlagsBits.SendMessagesInThreads,
+});
+/** Notification identities receive only reviewed parent/thread access. */
+export async function inspectViolationNotificationUsers(guild, channel, userIds) {
+    if (userIds.length > VIOLATION_THREAD_LIMITS.moderatorUsers ||
+        new Set(userIds).size !== userIds.length ||
+        userIds.some((id) => !/^\d{17,20}$/u.test(id)))
+        throw new Error("Violation notification user list is invalid");
+    const members = await Promise.all(userIds.map((user) => guild.members.fetch({ user, force: true }).catch(() => null)));
+    if (members.some((member) => !member || member.guild.id !== guild.id || member.user.bot))
+        return { outcome: "denied", safeCode: "moderator_user_unavailable" };
+    const confirmed = members;
+    const requiredChanges = [];
+    for (const member of confirmed)
+        for (const [name, flag] of Object.entries(NOTIFICATION_ACCESS))
+            if (!channel.permissionOverwrites.cache.get(member.id)?.allow.has(flag))
+                requiredChanges.push(`allow_moderator_user_${member.id}_${name}`);
+    return { outcome: "allowed", members: confirmed, requiredChanges };
+}
+export async function configureViolationNotificationUsers(channel, members, revalidate, reason) {
+    for (const member of members) {
+        if (!(await revalidate()))
+            return false;
+        await channel.permissionOverwrites.edit(member, {
+            ViewChannel: true,
+            ReadMessageHistory: true,
+            SendMessagesInThreads: true,
+        }, { reason });
+    }
+    return true;
+}
+//# sourceMappingURL=discord-violation-notification-users.js.map

package/dist/discord-violation-thread-close.d.ts

@@ -0,0 +1,5 @@
+import type { ViolationThreadMutationResult, ViolationThreadService } from "@helyx/sdk";
+import { type Client } from "discord.js";
+/** Destructive lifecycle is restricted to the bot-created, durably bound private thread. */
+export declare function closeAndDeleteViolationThread(client: Client, input: Parameters<ViolationThreadService["close"]>[0], reason: string, revalidate: () => Promise<boolean>): Promise<ViolationThreadMutationResult>;
+//# sourceMappingURL=discord-violation-thread-close.d.ts.map