@helyx/bot 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## 1.4.0
+
+### Minor Changes
+
+- Report Discord readiness to owned-message cleanup so module startup cannot consume recovery attempts before bot login.
+
+- Drain active guild tracking and owner observations before closing Discord and
+  database resources; stop scheduling new reconciliation work during shutdown.
+
+- Prepare the coordinated Phase 8 minor release and align internal package dependencies. Existing deployment and database-support restrictions are unchanged.
+
+  Support checksum-only PostgreSQL startup inspection after a dedicated hosted
+  migration job, while preserving automatic migrations as the default and for
+  every Self-Hosted database.
+
+  Keep Server Health report links inside the current Cloud Connect installation for self-hosted bots. Hosted report links retain their existing route.
+
+  Keep hosted leave workers out of self-hosted runtimes and fence revoked
+  blacklist deliveries before a Discord leave. Preserve stopped delivery evidence
+  for review without changing independent leave requests.
+
+  Correct the generated starter's Cloud Connect command and document explicit server-command allowlists, required Discord intents, database TLS modes and the one-database Cloud Connect topology without changing runtime defaults.
+
+  Leave worker-owned server command collections intact when command writes are
+  disabled, including unsharded and sharded startup. Do not replace active module
+  commands with the internal developer root during a restart.
+  Keep public creator-page validation read-only rather than competing with the
+  invite cleanup/create/revoke lock; recheck active ownership before returning.
+
+### Patch Changes
+
+- Patch Fastify to5.12.7 before publication. Keep the reviewed Phase8 minor
+  version and existing Discord/Undici transport compatibility unchanged.
+
+- Updated dependencies
+  - @helyx/config@1.4.0
+  - @helyx/control-protocol@0.7.0
+  - @helyx/core@0.2.0
+  - @helyx/database-contracts@0.2.0
+  - @helyx/database-mysql@0.2.0
+  - @helyx/database@2.4.0
+  - @helyx/framework@0.2.0
+  - @helyx/module-automod@1.1.0
+  - @helyx/module-manifest@0.13.0
+  - @helyx/module-moderation@1.1.0
+  - @helyx/platform@1.3.0
+  - @helyx/sdk@0.15.0
+  - @helyx/status-client@0.3.0
+  - @helyx/verification-contracts@0.4.0
+
+## 1.3.3
+
+### Patch Changes
+
+- Updated dependencies
+  - @helyx/control-protocol@0.6.0
+
+## 1.3.2
+
+### Patch Changes
+
+- Support deferred source-message updates for modal submissions so poll draft
+  edits replace their previous controls instead of creating duplicate messages.
+- Move the complete installed feature-module list to `/dev modules` and show
+  compact names and versions for modules and `/dev bot` core functions.
+- Bound internal dependencies to compatible releases while preserving required
+  minimum API versions.
+- Forward the hosted moderation control credential to shard workers only when
+  hosted moderation is enabled, preserving the existing worker credential boundary.
+- Forward the explicit database-engine selection to shard workers while
+  preserving PostgreSQL as the default.
+- Update the HTTP client to 6.29.0 to include the current WebSocket and retry
+  interceptor security fixes.
+
+## 1.3.1
+
+### Patch Changes
+
+- Add optional bounded worker-owned module-record recovery. Configure ownership in
+  single-worker and sharded bots without exposing deployment topology to modules
+  or relaxing ordinary record-query filters.
+- Updated dependencies
+- Updated dependencies
+  - @helyx/database@2.3.0
+  - @helyx/sdk@0.14.0
+  - @helyx/platform@1.2.0
+  - @helyx/module-automod@1.0.2
+  - @helyx/module-moderation@1.0.2
+
 ## 1.3.0
 
 ### Minor Changes
@@ -420,34 +509,9 @@
 
 ### Patch Changes
 
-- Reuse active Verification links when available, report their expiry, and allow members to replace them while atomically invalidating the old request.---
-  "@helyx/bot": patch
-  "@helyx/database": patch
-  "@helyx/sdk": patch
-  "@helyx/verification-contracts": patch
-  ---
-
-  Reuse active Verification links when available, report their expiry, and allow members to replace them while atomically invalidating the old request.
-
-- Accept compatible internal Helyx releases within explicit minor-safe pre-1.0 or major-safe stable ranges, preventing dependency-only patch cascades.---
-  "@helyx/bot": patch
-  "@helyx/cli": patch
-  "@helyx/core": patch
-  "@helyx/framework": patch
-  "@helyx/platform": patch
-  "@helyx/sdk": patch
-  "@helyx/module-account-gate": patch
-  "@helyx/module-feedback": patch
-  "@helyx/module-giveaways": patch
-  "@helyx/module-levels": patch
-  "@helyx/module-logging": patch
-  "@helyx/module-polls": patch
-  "@helyx/module-reactionroles": patch
-  "@helyx/module-suggestions": patch
-  "@helyx/module-welcome": patch
-  ---
-
-  Accept compatible internal Helyx releases within explicit minor-safe pre-1.0 or major-safe stable ranges, preventing dependency-only patch cascades.
+- Reuse active Verification links when available, report their expiry, and allow members to replace them while atomically invalidating the old request.
+
+- Accept compatible internal Helyx releases within explicit minor-safe pre-1.0 or major-safe stable ranges, preventing dependency-only patch cascades.
 
 ## 0.4.23
 

package/README.md

@@ -1,6 +1,11 @@
 # Helyx bot
 
-The Helyx Discord runtime validates its environment, verifies and migrates PostgreSQL, validates explicitly configured module packages, applies their migrations, composes platform services, synchronises guild installations and commands, logs in with the non-privileged Guilds intent, and shuts down Discord, modules, and PostgreSQL safely.
+The Helyx Discord runtime validates its environment and explicitly configured
+module packages, loads the selected database adapter, prepares core and module
+migrations, composes platform services, synchronises installations and commands,
+and connects to Discord. Shutdown closes modules, Discord and database resources.
+Hosted services use PostgreSQL; Self-Hosted bots support PostgreSQL or a
+capability-compatible MySQL database with matching module support.
 
 Version-matched public guides, operator runbooks, environment reference
 material, and module-authoring instructions ship at `documentation/README.md`
@@ -21,7 +26,14 @@ for production and self-hosted deployments during migration. Use
 that mode startup publishes only platform globals and migrated customer
 commands come from each guild's command profile and enabled module state.
 
-The built-in global `/helyx` and `/permissions` commands are core infrastructure. `/helyx` gives server owners, administrators and members with Manage Server permission an ephemeral module-management flow. It lists installed feature packages, enables or disables them, stages schema-defined settings, uses native Discord channel and role selectors, validates the complete configuration, and saves through the same versioned configuration and audit services as the dashboard. Dependency rules prevent a required module being disabled or a dependent module being enabled out of order.
+The built-in global `/helyx` and `/permissions` commands are core infrastructure.
+`/helyx modules` gives server owners, administrators and members with Manage
+Server permission an ephemeral module-management flow. It lists installed
+feature packages, enables or disables them, stages schema-defined settings,
+uses native Discord channel and role selectors, validates the complete
+configuration, and saves through the same versioned configuration and audit
+services as the dashboard. Dependency rules prevent a required module being
+disabled or a dependent module being enabled out of order.
 
 `/permissions` uses an owner/administrator-protected select and modal flow with native Discord selectors to manage inherited module policies and command overrides. Feature packages require an explicit allowlist: hosted distributions carry a reviewed `hosted-modules.json` catalogue, generated self-host projects use `HELYX_MODULE_CATALOGUE_PATH`, and `HELYX_MODULE_PACKAGES` remains an intentional comma-separated override. The sources are merged and de-duplicated. A core distribution has no catalogue and runs core-only when both self-host selectors are empty.
 
@@ -32,7 +44,19 @@ to `/helyx` or the dashboard. In platform-only mode, migrated commands are
 included in a guild only when its command profile selects them. Package
 upgrades preserve each server's existing enabled or disabled state.
 
-Gateway intents are derived from installed event contributions. The bot always requests Guilds, adds non-privileged reaction access only for reaction modules, and adds the privileged Server Members intent only when an installed module handles member joins. Deployments containing such a module must enable the matching intent in the Discord Developer Portal before startup.
+Gateway intents are derived from installed contributions and explicit runtime
+settings. The bot always requests Guilds and adds the reaction, message, voice
+and Auto Moderation intents required by the loaded modules. Server Members is
+requested when member events/capabilities require it or
+`HELYX_GUILD_MEMBERS_ENABLED=true`; enable the matching privileged intent in the
+Discord Developer Portal before login. Set that flag when a selected workflow
+requires Helyx to advertise the Guild Members capability as available.
+
+Message Content requires `HELYX_MESSAGE_CONTENT_ENABLED=true` as well as the
+Developer Portal intent and a loaded contribution that needs it. Self-Hosted
+Enhanced Auto Moderation uses this local capability; Hosted Enhanced scanning
+uses the separately operated Ecko adapter. Match intents to the selected
+features rather than enabling every privileged intent.
 
 Moderation integrations use closed, versioned service contracts for native
 Discord Auto Moderation rules, member and message enforcement, restricted
@@ -51,7 +75,16 @@ results before they cross the control boundary.
 
 When `HELYX_BOT_CONTROL_SECRET` is configured, the bot also starts a private authenticated HTTP control server on `HELYX_BOT_CONTROL_PORT`. The dashboard API uses this service to obtain real Discord roles and channels and to apply validated module, configuration and permission changes. `/health` is unauthenticated. Ordinary `/v1` routes require the shared bearer secret; the narrow `/v1/ecko/*` routes instead require their dedicated rotating HMAC transport key. Keep this endpoint on a private service network and do not assign it a public domain.
 
-Optional Helyx Cloud Connect is a separate outbound management path for self-hosted deployments. It is disabled unless `HELYX_CLOUD_CONNECT_ENABLED=true` and requires a separate local `HELYX_DATA_ENCRYPTION_KEY`. Preserve that key across every restart and deployment. If it is lost or changed, revoke the old installation in the dashboard and use a new one-use code with `/helyx-cloud connect`; the connector stops retrying until that recovery is completed. The owner-only `/helyx-cloud` command supports connection-code enrolment, status, credential rotation, disconnection and bounded support consent. The bot never sends its Discord token, database URL or connector private key to Helyx Cloud, and local Discord operation continues when Cloud is unavailable.
+Optional Helyx Cloud Connect is a separate outbound management path for
+self-hosted deployments. It is disabled unless
+`HELYX_CLOUD_CONNECT_ENABLED=true` and requires a stable local
+`HELYX_DATA_ENCRYPTION_KEY`. Generated starters enable the connector but remain
+unpaired until an authorised owner supplies a one-use code with
+`/helyx cloud connect`. The `/helyx cloud` command group also supports status,
+credential rotation, disconnection and bounded support consent. If the key is
+lost or changed, revoke the old installation and enrol a new identity. The bot
+never sends its Discord token, database URL or connector private key to Helyx
+Cloud, and local Discord operation continues when Cloud is unavailable.
 
 Production Status reporting is opt-in and disabled by default. Set
 `HELYX_STATUS_ENABLED=true` only with the reviewed `HELYX_STATUS_URL`, the
@@ -65,11 +98,11 @@ Giveaways and Invite Tracking also require the existing
 checkpoints and stable invite-member fingerprints without exposing the key to
 a module. Keep it stable across deployments.
 
-Trivia uses questions already imported into PostgreSQL. Multiple Choice and
-Guess both run entirely from the saved question catalogue, and the bot runtime
-does not call an external trivia provider.
+Trivia uses the module's migrated question catalogue in the selected database.
+Multiple Choice, Guess and True or False run locally; gameplay does not call an
+external trivia provider.
 
-The always-available guild-only `/bug` command can be used by any guild member.
+The always-available guild-only `/helyx bug` command can be used by any guild member.
 Hosted deployments submit through the dedicated `HELYX_SUPPORT_SERVICE_SECRET`;
 paired self-hosted deployments use their authenticated Cloud Connect session
 and may receive a one-time link for claiming, tracking and replying to the
@@ -157,8 +190,29 @@ self-hosting is outside the first release.
 Changing the total shard count redistributes guild ownership. Treat it as a
 generation change: drain the old generation before admitting the new one and
 never run both as active owners. Shard-capable code does not authorize hosted
-activation. Phase 10 production activation, replica scaling, or any Railway
-variable change requires separate owner authorization; do not provision a new
+activation. New hosted shard activation, replica scaling, or provider
+configuration changes require separate owner authorization; preserve an existing
+reviewed topology rather than resetting it to the new-install default. Do not provision a new
 Redis or coordinator service for sharding.
 
-For packaged operation use `helyx start`. `helyx migrate` applies core database migrations without Discord, and read-only `helyx doctor` verifies environment, PostgreSQL migration history, and configured package metadata.
+## Packaged operation and database checks
+
+Generated starters install `@helyx/cli` and expose `npm run setup`,
+`npm run doctor`, `npm start`, `npm run update:check` and `npm run update`.
+Follow their README for Node.js, Docker or managed-host commands; the bot
+package itself does not provide the `helyx` executable. Compiled npm packages
+do not require a source build before normal startup.
+
+`helyx start` applies pending core and selected-module migrations by default.
+`helyx migrate` deliberately applies only core migrations without Discord.
+Read-only `helyx doctor` validates environment, database connectivity, existing
+core migration history and configured package metadata; it inspects module
+migration history when core migrations are current. Pending migrations are
+reported without applying them. Startup performs database capability probes
+and the complete runtime/Discord checks that doctor does not perform.
+
+`DATABASE_ENGINE` defaults to `postgresql`; `mysql` selects the optional adapter
+and currently requires `HELYX_SHARD_MODE=off`. Changing the setting does not
+convert existing data between engines. Hosted PostgreSQL deployments may use
+`HELYX_DATABASE_STARTUP_MODE=inspect` after their separate approved migration
+job; Self-Hosted startup keeps automatic `apply` mode.

package/dist/cloud-connector.d.ts

@@ -4,6 +4,8 @@ import { type CloudConnectorConsentRecord, type DatabasePool } from "@helyx/data
 import type { Client } from "discord.js";
 import type { Logger } from "pino";
 import type { ConfiguredModulePackage } from "./modules.js";
+import type { GuildCommandReadHandler } from "./guild-command-read-service.js";
+import { type CloudConnectorStore } from "./cloud-control-dispatcher.js";
 import { type BotControlHandler } from "./control-server.js";
 type ConnectorState = "disabled" | "unpaired" | "connecting" | "online" | "offline" | "recovery_required" | "revoked" | "stopped";
 export interface CloudConnectorStatus {
@@ -27,7 +29,7 @@ export interface CloudDiscordDirectory {
     snapshot(): Promise<CloudDiscordSnapshot>;
 }
 export interface CloudConnector {
-    setControlHandler(handler: BotControlHandler): void;
+    setControlHandler(handler: BotControlHandler, commands?: GuildCommandReadHandler): void;
     start(): Promise<void>;
     status(): CloudConnectorStatus;
     getSupportConsent(): Promise<CloudConnectorConsentRecord>;
@@ -54,13 +56,18 @@ export declare class CloudConnectorController implements CloudConnector {
     private readonly input;
     constructor(input: {
         environment: BotEnvironment;
-        database: DatabasePool;
         discord: CloudDiscordDirectory;
         modules: readonly ConfiguredModulePackage[];
         coreVersion: string;
         logger: Logger;
-    });
-    setControlHandler(handler: BotControlHandler): void;
+    } & ({
+        database: DatabasePool;
+        repository?: never;
+    } | {
+        repository: CloudConnectorStore;
+        database?: never;
+    }));
+    setControlHandler(handler: BotControlHandler, commands?: GuildCommandReadHandler): void;
     start(): Promise<void>;
     status(): CloudConnectorStatus;
     getSupportConsent(): Promise<CloudConnectorConsentRecord>;

package/dist/cloud-connector.js

@@ -87,7 +87,8 @@ export class CloudConnectorController {
     #pendingSupport = new Map();
     constructor(input) {
         this.input = input;
-        this.#repository = new CloudConnectorRepository(input.database);
+        this.#repository =
+            input.repository ?? new CloudConnectorRepository(input.database);
         this.#state = input.environment.HELYX_CLOUD_CONNECT_ENABLED
             ? "unpaired"
             : "disabled";
@@ -95,8 +96,10 @@ export class CloudConnectorController {
             ? Buffer.from(input.environment.HELYX_DATA_ENCRYPTION_KEY, "base64")
             : undefined;
     }
-    setControlHandler(handler) {
-        this.#dispatcher = new CloudControlDispatcher(this.input.database, handler);
+    setControlHandler(handler, commands) {
+        this.#dispatcher = this.input.database
+            ? new CloudControlDispatcher(this.input.database, handler, commands)
+            : new CloudControlDispatcher({ repository: this.#repository }, handler, commands);
     }
     async start() {
         if (!this.input.environment.HELYX_CLOUD_CONNECT_ENABLED)
@@ -414,6 +417,8 @@ export class CloudConnectorController {
         let outgoingSequence = 0;
         let heartbeat;
         let plannedReconnect;
+        let activeControlRequests = 0;
+        let draining = false;
         const privateKey = decryptPrivateKey(identity.privateKey, this.#dataKey, identity.installationId);
         const finished = new Promise((resolveFinished, rejectFinished) => {
             const fail = (error) => {
@@ -475,10 +480,32 @@ export class CloudConnectorController {
                                     installationId: identity.installationId,
                                     connectionEpoch: accepted.data.connectionEpoch,
                                     sequence: ++outgoingSequence,
-                                    payload: { state: "online" },
+                                    payload: { state: draining ? "draining" : "online" },
                                 })));
                             }, accepted.data.heartbeatIntervalSeconds * 1_000);
-                            plannedReconnect = setTimeout(() => socket.close(1012, "Planned Cloud Connect session rotation"), accepted.data.reconnectBeforeSeconds * 1_000);
+                            plannedReconnect = setTimeout(() => {
+                                if (socket.readyState !== WebSocket.OPEN)
+                                    return;
+                                draining = true;
+                                socket.send(JSON.stringify(connectedMessage({
+                                    type: "connector.draining",
+                                    installationId: identity.installationId,
+                                    connectionEpoch: accepted.data.connectionEpoch,
+                                    sequence: ++outgoingSequence,
+                                    payload: { reason: "session_rotation" },
+                                })));
+                                const deadline = Date.now() + 45_000;
+                                const closeWhenIdle = () => {
+                                    if (socket.readyState !== WebSocket.OPEN)
+                                        return;
+                                    if (activeControlRequests === 0 || Date.now() >= deadline) {
+                                        socket.close(1012, "Planned Cloud Connect session rotation");
+                                        return;
+                                    }
+                                    plannedReconnect = setTimeout(closeWhenIdle, 250);
+                                };
+                                plannedReconnect = setTimeout(closeWhenIdle, 1_000);
+                            }, accepted.data.reconnectBeforeSeconds * 1_000);
                             return;
                         }
                         const rejected = connectorRejectedSchema.safeParse(payload);
@@ -518,16 +545,22 @@ export class CloudConnectorController {
                         }
                         if (message.type !== "control.request")
                             return;
-                        const response = await this.#dispatch(message.payload, message.correlationId);
-                        if (socket.readyState === WebSocket.OPEN)
-                            socket.send(JSON.stringify(connectedMessage({
-                                type: "control.response",
-                                installationId: identity.installationId,
-                                connectionEpoch: message.connectionEpoch,
-                                sequence: ++outgoingSequence,
-                                correlationId: message.correlationId,
-                                payload: response,
-                            })));
+                        activeControlRequests += 1;
+                        try {
+                            const response = await this.#dispatch(message.payload, message.correlationId);
+                            if (socket.readyState === WebSocket.OPEN)
+                                socket.send(JSON.stringify(connectedMessage({
+                                    type: "control.response",
+                                    installationId: identity.installationId,
+                                    connectionEpoch: message.connectionEpoch,
+                                    sequence: ++outgoingSequence,
+                                    correlationId: message.correlationId,
+                                    payload: response,
+                                })));
+                        }
+                        finally {
+                            activeControlRequests -= 1;
+                        }
                     }
                     catch (error) {
                         this.input.logger.warn({
@@ -722,6 +755,10 @@ function connectorCapabilities() {
         "guild.dashboard.access.read.v1",
         "guild.access-policy.read.v1",
         "guild.access-policy.write.v1",
+        "guild.commands.status.read.v1",
+        "guild.commands.history.read.v1",
+        "guild.commands.status.refresh.v1",
+        "guild.commands.rebuild.v1",
         "guild.module.public.read.v1",
         "guild.module.status.write.v1",
         "guild.module.configuration.write.v1",

package/dist/cloud-control-dispatcher.d.ts

@@ -1,11 +1,16 @@
 import { type CloudControlRequestPayload } from "@helyx/control-protocol";
-import { type DatabasePool } from "@helyx/database";
+import { CloudConnectorRepository, type DatabasePool } from "@helyx/database";
 import type { BotControlHandler, BotControlState } from "./control-server.js";
+import type { GuildCommandReadHandler } from "./guild-command-read-service.js";
+export type CloudConnectorStore = Pick<CloudConnectorRepository, "getIdentity" | "createIdentity" | "rotateIdentity" | "markConnected" | "revoke" | "getConsent" | "updateConsent" | "appendAudit" | "cleanupAudit">;
 export declare class CloudControlDispatcher {
     #private;
-    private readonly database;
     private readonly control;
-    constructor(database: DatabasePool, control: BotControlHandler);
+    private readonly commands?;
+    constructor(database: DatabasePool, control: BotControlHandler, commands?: GuildCommandReadHandler);
+    constructor(input: {
+        repository: CloudConnectorStore;
+    }, control: BotControlHandler, commands?: GuildCommandReadHandler);
     execute(request: CloudControlRequestPayload, correlationId: string): Promise<unknown>;
 }
 export declare class CloudControlDeniedError extends Error {

package/dist/cloud-control-dispatcher.js

@@ -1,11 +1,16 @@
 import { assertCloudResponseSize, parseOperationInput, } from "@helyx/control-protocol";
 import { CloudConnectorRepository } from "@helyx/database";
 export class CloudControlDispatcher {
-    database;
     control;
-    constructor(database, control) {
-        this.database = database;
+    commands;
+    #repository;
+    constructor(databaseOrInput, control, commands) {
         this.control = control;
+        this.commands = commands;
+        this.#repository =
+            "repository" in databaseOrInput
+                ? databaseOrInput.repository
+                : new CloudConnectorRepository(databaseOrInput);
     }
     async execute(request, correlationId) {
         const actorUserId = request.actor.kind === "customer"
@@ -52,6 +57,48 @@ export class CloudControlDispatcher {
                 });
                 break;
             }
+            case "guild.commands.status.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                await this.#requireCommandAccess(input.guildId, actorUserId);
+                result = await this.#commands().getStatus(input.guildId);
+                break;
+            }
+            case "guild.commands.history.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                await this.#requireCommandAccess(input.guildId, actorUserId);
+                result = await this.#commands().listHistory({
+                    guildId: input.guildId,
+                    ...(input.before ? { beforeEventId: BigInt(input.before) } : {}),
+                    ...(input.since ? { since: new Date(input.since) } : {}),
+                    limit: input.limit,
+                });
+                break;
+            }
+            case "guild.commands.status.refresh.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                const actor = await this.#requireCommandAccess(input.guildId, actorUserId);
+                result = await this.#commands().refreshStatus({
+                    guildId: input.guildId,
+                    actorUserId: actor,
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.commands.rebuild.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                const actor = await this.#requireCommandAccess(input.guildId, actorUserId);
+                result = await this.#commands().requestReconciliation({
+                    guildId: input.guildId,
+                    actorUserId: actor,
+                    correlationId,
+                    expectedRevision: BigInt(input.expectedRevision),
+                    source: "customer_rebuild",
+                    budgetClass: "customer",
+                    delayMs: 120_000,
+                    summary: "A server manager requested a command rebuild.",
+                });
+                break;
+            }
             case "guild.module.public.read.v1": {
                 const input = parseOperationInput(request.operation, request.input);
                 if (request.actor.kind !== "public")
@@ -245,8 +292,19 @@ export class CloudControlDispatcher {
         assertCloudResponseSize(result);
         return result;
     }
+    #commands() {
+        if (!this.commands)
+            throw new Error("guild_command_state_unavailable");
+        return this.commands;
+    }
+    async #requireCommandAccess(guildId, actorUserId) {
+        const actor = requiredActor(actorUserId);
+        if (!(await this.control.canAccessDashboard({ guildId, actorUserId: actor })))
+            throw new CloudControlDeniedError("guild_command_access_denied");
+        return actor;
+    }
     async #supportSnapshot(input) {
-        const repository = new CloudConnectorRepository(this.database);
+        const repository = this.#repository;
         const consent = await repository.getConsent();
         const requested = input.dataClasses.filter((dataClass) => consent.supportDataClasses.includes(dataClass));
         if (!consent.supportInspectionEnabled || requested.length === 0) {

package/dist/control-errors.d.ts

@@ -1,4 +1,8 @@
 import { type PermissionMutationDenialReason } from "@helyx/core";
+export declare class BotControlTransportError extends Error {
+    readonly status: 400 | 403 | 404 | 409 | 502 | 503 | 504;
+    constructor(status: 400 | 403 | 404 | 409 | 502 | 503 | 504, message: string);
+}
 export declare class BotControlForbiddenError extends Error {
     constructor(message?: string);
 }

package/dist/control-errors.js

@@ -1,4 +1,12 @@
 import { permissionMutationDenialMessage, } from "@helyx/core";
+export class BotControlTransportError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "BotControlTransportError";
+    }
+}
 export class BotControlForbiddenError extends Error {
     constructor(message = "You no longer have permission to perform this action") {
         super(message);

package/dist/control-server-schemas.d.ts

@@ -0,0 +1,84 @@
+import type { ManagedResourceValue } from "@helyx/sdk";
+import { z } from "zod";
+export declare const snowflake: z.ZodString;
+export declare const moduleId: z.ZodString;
+export declare const configurationValue: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodNull, z.ZodString, z.ZodBoolean, z.ZodNumber, z.ZodArray<z.ZodString>]>>;
+export declare const permissionState: z.ZodObject<{
+    version: z.ZodNumber;
+    module: z.ZodObject<{
+        preset: z.ZodEnum<{
+            custom: "custom";
+            everyone: "everyone";
+            moderators: "moderators";
+            administrators: "administrators";
+        }>;
+        allowedRoleIds: z.ZodArray<z.ZodString>;
+        deniedRoleIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    commands: z.ZodArray<z.ZodObject<{
+        commandId: z.ZodString;
+        version: z.ZodNumber;
+        enabled: z.ZodBoolean;
+        policy: z.ZodObject<{
+            preset: z.ZodEnum<{
+                custom: "custom";
+                everyone: "everyone";
+                moderators: "moderators";
+                administrators: "administrators";
+            }>;
+            allowedRoleIds: z.ZodArray<z.ZodString>;
+            deniedRoleIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const guildAccessPolicy: z.ZodObject<{
+    administratorRoleIds: z.ZodArray<z.ZodString>;
+    moderatorRoleIds: z.ZodArray<z.ZodString>;
+    dashboardModeratorsEnabled: z.ZodBoolean;
+    dashboardAllowedRoleIds: z.ZodArray<z.ZodString>;
+    dashboardDeniedRoleIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const mutationContext: z.ZodObject<{
+    actorUserId: z.ZodString;
+    correlationId: z.ZodUUID;
+}, z.core.$strip>;
+export declare const resourceId: z.ZodString;
+export declare const resourceCursor: z.ZodString;
+export declare const resourceActionId: z.ZodString;
+export declare const managedResourceFilters: z.ZodRecord<z.ZodString, z.ZodString>;
+export declare const managedResourceObject: z.ZodRecord<z.ZodString, z.ZodCustom<ManagedResourceValue, ManagedResourceValue>>;
+export declare const managedResourceDetailSchema: z.ZodObject<{
+    id: z.ZodString;
+    revision: z.ZodNumber;
+    status: z.ZodString;
+    title: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodCustom<ManagedResourceValue, ManagedResourceValue>>>;
+    updatedAt: z.ZodISODateTime;
+    value: z.ZodRecord<z.ZodString, z.ZodCustom<ManagedResourceValue, ManagedResourceValue>>;
+    availableActionIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const managedResourcePageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+        status: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodCustom<ManagedResourceValue, ManagedResourceValue>>>;
+        updatedAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodOptional<z.ZodString>;
+    total: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const managedResourceRelationPageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        value: z.ZodRecord<z.ZodString, z.ZodCustom<ManagedResourceValue, ManagedResourceValue>>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const managedResourceDeleteResultSchema: z.ZodObject<{
+    deleted: z.ZodBoolean;
+}, z.core.$strict>;
+//# sourceMappingURL=control-server-schemas.d.ts.map