@helyx/bot 1.4.0 → 1.5.0

package/dist/channel-audit-routes.js

@@ -0,0 +1,42 @@
+import { channelAuditModuleIdSchema, channelAuditInputSchema, channelAuditConfigurationSchema, channelAuditReportSchema, } from "@helyx/control-protocol/channel-audit";
+import { z } from "zod";
+import { BotControlTransportError } from "./control-errors.js";
+const parameters = z
+    .object({
+    guildId: z.string().regex(/^\d{17,20}$/u),
+    moduleId: channelAuditModuleIdSchema,
+})
+    .strict();
+const actor = z
+    .object({
+    actorUserId: z.string().regex(/^\d{17,20}$/u),
+    correlationId: z.uuid(),
+})
+    .strict();
+export function registerChannelAuditRoutes(server, control) {
+    server.post("/v1/guilds/:guildId/modules/:moduleId/channel-audit/config", async (request) => {
+        const input = {
+            ...parameters.parse(request.params),
+            ...actor.parse(request.body),
+        };
+        if (!control.readChannelAuditConfiguration)
+            throw unsupported();
+        return channelAuditConfigurationSchema.parse(await control.readChannelAuditConfiguration(input));
+    });
+    server.post("/v1/guilds/:guildId/modules/:moduleId/channel-audit/check", async (request) => {
+        const input = {
+            ...parameters.parse(request.params),
+            ...actor
+                .extend({ assumptions: channelAuditInputSchema })
+                .strict()
+                .parse(request.body),
+        };
+        if (!control.checkChannelAudit)
+            throw unsupported();
+        return channelAuditReportSchema.parse(await control.checkChannelAudit(input));
+    });
+}
+function unsupported() {
+    return new BotControlTransportError(503, "This bot version does not support Channel audit. Update the bot before trying again.");
+}
+//# sourceMappingURL=channel-audit-routes.js.map

package/dist/cloud-connector.js

@@ -763,6 +763,8 @@ function connectorCapabilities() {
         "guild.module.status.write.v1",
         "guild.module.configuration.write.v1",
         "guild.module.configuration.preview.v1",
+        "guild.module.channel-audit.config.read.v1",
+        "guild.module.channel-audit.check.v1",
         "guild.module.permissions.write.v1",
         "guild.module.logging.write.v1",
         "guild.module.action.execute.v1",

package/dist/cloud-control-dispatcher.js

@@ -121,6 +121,28 @@ export class CloudControlDispatcher {
                 });
                 break;
             }
+            case "guild.module.channel-audit.config.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                if (!this.control.readChannelAuditConfiguration)
+                    throw new Error("Channel audit is not supported by this bot version");
+                result = await this.control.readChannelAuditConfiguration({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
+            case "guild.module.channel-audit.check.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                if (!this.control.checkChannelAudit)
+                    throw new Error("Channel audit is not supported by this bot version");
+                result = await this.control.checkChannelAudit({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
             case "guild.module.configuration.write.v1": {
                 const input = parseOperationInput(request.operation, request.input);
                 result = await this.control.updateConfiguration({

package/dist/control-errors.d.ts

@@ -1,8 +1,16 @@
 import { type PermissionMutationDenialReason } from "@helyx/core";
+export declare function isUnknownGuildError(error: unknown): boolean;
+export declare function isUnknownMemberError(error: unknown): boolean;
 export declare class BotControlTransportError extends Error {
     readonly status: 400 | 403 | 404 | 409 | 502 | 503 | 504;
     constructor(status: 400 | 403 | 404 | 409 | 502 | 503 | 504, message: string);
 }
+export declare class BotControlValidationError extends Error {
+    constructor(message: string);
+}
+export declare class BotControlNotFoundError extends Error {
+    constructor(message?: string);
+}
 export declare class BotControlForbiddenError extends Error {
     constructor(message?: string);
 }

package/dist/control-errors.js

@@ -1,4 +1,16 @@
 import { permissionMutationDenialMessage, } from "@helyx/core";
+export function isUnknownGuildError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === 10_004);
+}
+export function isUnknownMemberError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === 10_007);
+}
 export class BotControlTransportError extends Error {
     status;
     constructor(status, message) {
@@ -7,6 +19,18 @@ export class BotControlTransportError extends Error {
         this.name = "BotControlTransportError";
     }
 }
+export class BotControlValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BotControlValidationError";
+    }
+}
+export class BotControlNotFoundError extends Error {
+    constructor(message = "Discord server is not available to Helyx") {
+        super(message);
+        this.name = "BotControlNotFoundError";
+    }
+}
 export class BotControlForbiddenError extends Error {
     constructor(message = "You no longer have permission to perform this action") {
         super(message);

package/dist/control-server-schemas.d.ts

@@ -7,10 +7,10 @@ export declare const permissionState: z.ZodObject<{
     version: z.ZodNumber;
     module: z.ZodObject<{
         preset: z.ZodEnum<{
-            custom: "custom";
             everyone: "everyone";
             moderators: "moderators";
             administrators: "administrators";
+            custom: "custom";
         }>;
         allowedRoleIds: z.ZodArray<z.ZodString>;
         deniedRoleIds: z.ZodArray<z.ZodString>;
@@ -21,10 +21,10 @@ export declare const permissionState: z.ZodObject<{
         enabled: z.ZodBoolean;
         policy: z.ZodObject<{
             preset: z.ZodEnum<{
-                custom: "custom";
                 everyone: "everyone";
                 moderators: "moderators";
                 administrators: "administrators";
+                custom: "custom";
             }>;
             allowedRoleIds: z.ZodArray<z.ZodString>;
             deniedRoleIds: z.ZodArray<z.ZodString>;

package/dist/control-server.d.ts

@@ -10,6 +10,7 @@ import { type FirstTimeCommandSetupHandler } from "./first-time-command-setup.js
 import { type ShardHealthSnapshot } from "./shard-contracts.js";
 import { type DashboardPermissionState } from "./control-permissions.js";
 export { BotControlTransportError } from "./control-errors.js";
+import type { ChannelAuditControl } from "@helyx/sdk";
 import { type DashboardModuleDefinition } from "./dashboard-module-projection.js";
 import { type AvailabilityModuleCatalogue } from "./module-availability-control.js";
 import { registerGuildCommandControlRoutes } from "./guild-command-control-routes.js";
@@ -120,7 +121,7 @@ export interface DashboardGuildAccessState extends GuildAccessPolicy {
     actorHighestRolePosition: number | null;
     updatedAt: string | null;
 }
-export interface BotControlHandler extends FirstTimeCommandSetupHandler, DashboardActionHandler {
+export interface BotControlHandler extends FirstTimeCommandSetupHandler, DashboardActionHandler, ChannelAuditControl {
     creatorOnboarding?(input: CreatorOnboardingRequest): Promise<CreatorOnboardingResponse>;
     cleanupOAuthConsumer(input: {
         consumerBindingId: string;
@@ -349,6 +350,8 @@ export declare class BotControlService implements BotControlHandler {
     private readonly supportNotifications?;
     private readonly presenceOwnership?;
     private readonly presenceShardCount?;
+    readonly readChannelAuditConfiguration: Required<ChannelAuditControl>["readChannelAuditConfiguration"];
+    readonly checkChannelAudit: Required<ChannelAuditControl>["checkChannelAudit"];
     constructor(databaseOrPersistence: DatabasePool | BotControlPersistence, modules: readonly ModuleDefinition[], resources: BotControlGuildResourceDirectory, services: ServiceAccess, privacyExecutor?: PrivacyProviderExecutor, supportNotifications?: {
         guildId: string;
         channelId: string;

package/dist/control-server.js

@@ -13,9 +13,11 @@ import { canAccessModule, PREMIUM_MODULE_UNAVAILABLE_MESSAGE, } from "./premium-
 import { completeFirstTimeCommandSetup, } from "./first-time-command-setup.js";
 import { SHARD_HEALTH_STALE_MS, } from "./shard-contracts.js";
 import { assertVersion, declaredManagedResourcePermission, fromDashboardPolicy, managedResourcePermissionId, permissionPoliciesEqual, permissionPolicyKey, safeOptionalVersion, safeVersion, toDashboardPolicy, } from "./control-permissions.js";
-import { assertPermissionMutationAllowed, BotControlForbiddenError, BotControlTransportError, } from "./control-errors.js";
+import { assertPermissionMutationAllowed, BotControlForbiddenError, BotControlNotFoundError, BotControlValidationError, BotControlTransportError, isUnknownGuildError, isUnknownMemberError, } from "./control-errors.js";
 export { BotControlTransportError } from "./control-errors.js";
 import { dashboardCommands } from "./dashboard-commands.js";
+import { registerChannelAuditRoutes } from "./channel-audit-routes.js";
+import { createChannelAuditControl } from "./channel-audit-control.js";
 import { executeCreatorOnboarding, registerCreatorOnboardingControlRoute, } from "./creator-onboarding-control.js";
 import { mapDashboardModule, } from "./dashboard-module-projection.js";
 import { availabilityCatalogueDefinitions, availabilityCatalogue, dashboardModuleStatus, disabledModuleSummary, moduleAvailabilityService, moduleAvailabilityStates, statusCatalogueDefinitions, } from "./module-availability-control.js";
@@ -215,6 +217,8 @@ export class BotControlService {
     #services;
     #privacyProviders;
     #persistence;
+    readChannelAuditConfiguration;
+    checkChannelAudit;
     constructor(databaseOrPersistence, modules, resources, services, privacyExecutor, supportNotifications, presenceOwnership, presenceShardCount, statusModules) {
         this.resources = resources;
         this.supportNotifications = supportNotifications;
@@ -235,6 +239,18 @@ export class BotControlService {
         this.#permissions = services.get(HELYX_SERVICE_NAMES.permissions);
         this.#services = services;
         this.#privacyProviders = createPrivacyProviderRegistry(modules, privacyExecutor, this.#services);
+        const audit = createChannelAuditControl({
+            modules: this.#modules,
+            resources,
+            services,
+            configurations: this.#configurations,
+            permissions: this.#permissions,
+            listModules: (guildId) => this.#persistence.repositories.installations.listModules(guildId),
+            readGuildPolicy: (guildId) => this.#readGuildAccessPolicy(guildId),
+            requireAccessible: (guildId, moduleId) => this.#requireModuleAccessible(guildId, moduleId),
+        });
+        this.readChannelAuditConfiguration = audit.readChannelAuditConfiguration;
+        this.checkChannelAudit = audit.checkChannelAudit;
     }
     async creatorOnboarding(input) {
         return executeCreatorOnboarding(input, {
@@ -1493,6 +1509,7 @@ export async function createBotControlServer(input) {
         return input.service.setModuleStatus({ ...params, ...body });
     });
     registerDashboardActionRoutes(server, input.service);
+    registerChannelAuditRoutes(server, input.service);
     server.get("/v1/guilds/:guildId/modules/:moduleId/resources/:resourceType", async (request) => {
         const params = z
             .object({
@@ -1690,31 +1707,7 @@ export function mapBotControlError(error) {
         };
     return undefined;
 }
-class BotControlValidationError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "BotControlValidationError";
-    }
-}
-class BotControlNotFoundError extends Error {
-    constructor(message = "Discord server is not available to Helyx") {
-        super(message);
-        this.name = "BotControlNotFoundError";
-    }
-}
 function digest(value) {
     return createHash("sha256").update(value).digest();
 }
-function isUnknownGuildError(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === 10_004);
-}
-function isUnknownMemberError(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === 10_007);
-}
 //# sourceMappingURL=control-server.js.map

package/dist/discord-channel-audit.d.ts

@@ -0,0 +1,9 @@
+import type { Client } from "discord.js";
+import type { ChannelAuditInput, ChannelAuditModuleId, ChannelAuditReport } from "@helyx/sdk";
+/** Fresh guild roles/channels and the bot member only. Never reads messages or enumerates members. */
+export declare function inspectDiscordChannelAudit(client: Client, input: {
+    guildId: string;
+    moduleId: ChannelAuditModuleId;
+    assumptions: ChannelAuditInput;
+}): Promise<ChannelAuditReport>;
+//# sourceMappingURL=discord-channel-audit.d.ts.map

package/dist/discord-channel-audit.js

@@ -0,0 +1,195 @@
+import { PermissionFlagsBits } from "discord.js";
+import { channelAuditInputSchema, channelAuditReportSchema, } from "@helyx/control-protocol/channel-audit";
+import { buildChannelAuditReport, } from "./channel-audit-permissions.js";
+import { dangerousRolePermissions } from "./discord-role-safety.js";
+async function readBefore(read, deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        throw new Error("Channel audit read deadline reached");
+    let timer;
+    try {
+        return await Promise.race([
+            read(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("Channel audit read deadline reached")), remaining);
+                timer.unref();
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** Fresh guild roles/channels and the bot member only. Never reads messages or enumerates members. */
+export async function inspectDiscordChannelAudit(client, input) {
+    const assumptions = channelAuditInputSchema.parse(input.assumptions);
+    const deadline = Date.now() + 8_500;
+    const snapshot = {
+        guildId: input.guildId,
+        roles: [],
+        rolesComplete: false,
+        channels: [],
+        fetchedChannels: 0,
+        totalChannelsKnown: false,
+        fetchLimitations: [],
+    };
+    const guild = await readBefore(() => client.guilds.fetch(input.guildId), deadline).catch(() => null);
+    if (!guild) {
+        snapshot.fetchLimitations.push("The current Discord server could not be fetched; channel and role coverage is incomplete.");
+        return channelAuditReportSchema.parse(buildChannelAuditReport(snapshot, input.moduleId, assumptions, new Date().toISOString()));
+    }
+    if (guild.id !== input.guildId)
+        throw new Error("Discord returned a different server for this inspection");
+    const [rolesResult, channelsResult, memberResult] = await Promise.allSettled([
+        readBefore(() => guild.roles.fetch(), deadline),
+        readBefore(() => guild.channels.fetch(), deadline),
+        readBefore(() => guild.members.fetchMe({ force: true }), deadline),
+    ]);
+    const me = memberResult.status === "fulfilled" ? memberResult.value : null;
+    if (me && me.guild.id !== guild.id)
+        throw new Error("Discord bot member belongs to a different server");
+    if (!me)
+        snapshot.fetchLimitations.push("Helyx's current server member could not be fetched; bot publishing and assignment checks may be unknown.");
+    if (rolesResult.status === "fulfilled") {
+        snapshot.rolesComplete = true;
+        const canManage = me?.permissions.has(PermissionFlagsBits.ManageRoles) ?? false;
+        snapshot.roles = [...rolesResult.value.values()].map((role) => {
+            if (role.guild.id !== guild.id)
+                throw new Error("Discord role belongs to a different server");
+            const reason = role.id === guild.id
+                ? "The everyone role cannot be assigned."
+                : role.managed
+                    ? "This role is managed by Discord or an integration and cannot be assigned by Helyx."
+                    : !me
+                        ? undefined
+                        : !canManage
+                            ? "Helyx lacks Manage Roles in this server."
+                            : role.comparePositionTo(me.roles.highest) >= 0
+                                ? "The selected role is at or above Helyx's highest role."
+                                : undefined;
+            const dangerous = dangerousRolePermissions(role.permissions.bitfield);
+            return {
+                id: role.id,
+                permissions: role.permissions.bitfield,
+                managed: role.managed,
+                assignable: reason ? false : me ? true : null,
+                ...(reason ? { assignmentReason: reason } : {}),
+                ...(dangerous.length
+                    ? {
+                        assignmentPolicyReason: `Helyx's role-safety policy blocks managing roles with ${dangerous.join(", ")}. Discord hierarchy alone does not make this role eligible.`,
+                    }
+                    : {}),
+            };
+        });
+    }
+    else
+        snapshot.fetchLimitations.push("The current Discord role list could not be fetched; missing roles are unknown, not confirmed deleted.");
+    const observedIds = new Set();
+    if (channelsResult.status === "fulfilled") {
+        snapshot.fetchedChannels = channelsResult.value.size;
+        for (const channel of channelsResult.value.values()) {
+            if (!channel)
+                continue;
+            if (channel.guild.id !== guild.id)
+                throw new Error("Discord channel belongs to a different server");
+            observedIds.add(channel.id);
+            const flags = "flags" in channel ? BigInt(channel.flags.bitfield) : 0n;
+            const obfuscated = (flags & 131072n) !== 0n || channel.name === "___hidden___";
+            const overwrites = "permissionOverwrites" in channel
+                ? [...channel.permissionOverwrites.cache.values()].map((overwrite) => ({
+                    id: overwrite.id,
+                    type: overwrite.type,
+                    allow: overwrite.allow.bitfield,
+                    deny: overwrite.deny.bitfield,
+                }))
+                : [];
+            const botPermissions = !obfuscated && me
+                ? (channel.permissionsFor(me)?.bitfield ?? null)
+                : null;
+            snapshot.channels.push({
+                id: channel.id,
+                name: obfuscated ? "Unknown channel" : channel.name,
+                type: channel.type,
+                obfuscated,
+                overwrites: obfuscated ? [] : overwrites,
+                botPermissions,
+            });
+        }
+        snapshot.totalChannelsKnown =
+            me?.permissions.has(PermissionFlagsBits.Administrator) ?? false;
+    }
+    else
+        snapshot.fetchLimitations.push("Discord's channel list could not be fetched; cached metadata is not used as fresh permission evidence.");
+    // Bulk lists can omit invisible channels. Resolve only explicitly selected
+    // missing IDs; a permission failure or deadline remains unknown.
+    const selected = new Set([
+        assumptions.entryChannelId,
+        ...assumptions.allowedChannelIds,
+        ...(assumptions.reviewChannelId ? [assumptions.reviewChannelId] : []),
+    ]);
+    snapshot.invalidSelectedChannels = [];
+    for (const id of selected) {
+        if (observedIds.has(id))
+            continue;
+        try {
+            const channel = await readBefore(() => guild.channels.fetch(id, { force: true, cache: false }), deadline);
+            if (!channel)
+                continue;
+            if (channel.guild.id !== guild.id) {
+                snapshot.invalidSelectedChannels.push({ id, reason: "wrong_guild" });
+                continue;
+            }
+            observedIds.add(id);
+            const obfuscated = (BigInt("flags" in channel ? channel.flags.bitfield : 0) & 131072n) !==
+                0n || channel.name === "___hidden___";
+            snapshot.channels.push({
+                id,
+                name: obfuscated ? "Unknown channel" : channel.name,
+                type: channel.type,
+                obfuscated,
+                overwrites: !obfuscated && "permissionOverwrites" in channel
+                    ? [...channel.permissionOverwrites.cache.values()].map((overwrite) => ({
+                        id: overwrite.id,
+                        type: overwrite.type,
+                        allow: overwrite.allow.bitfield,
+                        deny: overwrite.deny.bitfield,
+                    }))
+                    : [],
+                botPermissions: !obfuscated && me
+                    ? (channel.permissionsFor(me)?.bitfield ?? null)
+                    : null,
+            });
+            snapshot.fetchedChannels += 1;
+        }
+        catch (error) {
+            const code = error && typeof error === "object" && "code" in error
+                ? error.code
+                : undefined;
+            if (code === 10003 || code === "GuildChannelUnowned")
+                snapshot.invalidSelectedChannels.push({
+                    id,
+                    reason: code === 10003 ? "not_found" : "wrong_guild",
+                });
+        }
+    }
+    // Cache-only entries establish known inventory, never current permissions or deletion.
+    for (const channel of guild.channels.cache.values()) {
+        if (observedIds.has(channel.id))
+            continue;
+        snapshot.channels.push(unknownChannel(channel));
+        snapshot.totalChannelsKnown = false;
+    }
+    return channelAuditReportSchema.parse(buildChannelAuditReport(snapshot, input.moduleId, assumptions, new Date().toISOString()));
+}
+function unknownChannel(channel) {
+    return {
+        id: channel.id,
+        name: "Unknown channel",
+        type: channel.type,
+        obfuscated: true,
+        overwrites: [],
+        botPermissions: null,
+    };
+}
+//# sourceMappingURL=discord-channel-audit.js.map

package/dist/discord-guild-health.d.ts

@@ -163,8 +163,8 @@ export declare class DiscordGuildHealthInspection implements DiscordGuildHealthI
             resourceValidationValid: boolean | null;
             activationValid: boolean | null;
             catalogueMatches: boolean;
-            requiredCapabilities: readonly ("guild-members" | "message-content")[];
-            missingCapabilities: ("guild-members" | "message-content")[];
+            requiredCapabilities: readonly ("message-content" | "guild-members")[];
+            missingCapabilities: ("message-content" | "guild-members")[];
             missingPermissions: string[];
             healthStatus: "healthy" | "degraded" | "unhealthy";
             healthMessage: string | null;

package/dist/discord-role-safety.d.ts

@@ -0,0 +1,4 @@
+/** The existing Helyx role-grant policy, shared by delivery and inspection. */
+export declare const dangerousRolePermissionNames: Set<string>;
+export declare function dangerousRolePermissions(permissions: bigint): string[];
+//# sourceMappingURL=discord-role-safety.d.ts.map

package/dist/discord-role-safety.js

@@ -0,0 +1,30 @@
+import { PermissionsBitField } from "discord.js";
+/** The existing Helyx role-grant policy, shared by delivery and inspection. */
+export const dangerousRolePermissionNames = new Set([
+    "ADMINISTRATOR",
+    "BAN_MEMBERS",
+    "DEAFEN_MEMBERS",
+    "KICK_MEMBERS",
+    "MANAGE_CHANNELS",
+    "MANAGE_EVENTS",
+    "MANAGE_GUILD",
+    "MANAGE_GUILD_EXPRESSIONS",
+    "MANAGE_MESSAGES",
+    "MANAGE_NICKNAMES",
+    "MANAGE_ROLES",
+    "MANAGE_THREADS",
+    "MANAGE_WEBHOOKS",
+    "MENTION_EVERYONE",
+    "MODERATE_MEMBERS",
+    "MOVE_MEMBERS",
+    "MUTE_MEMBERS",
+    "VIEW_AUDIT_LOG",
+]);
+export function dangerousRolePermissions(permissions) {
+    return new PermissionsBitField(permissions)
+        .toArray()
+        .map((permission) => permission.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase())
+        .filter((permission) => dangerousRolePermissionNames.has(permission))
+        .sort();
+}
+//# sourceMappingURL=discord-role-safety.js.map

package/dist/events.d.ts

@@ -1,4 +1,5 @@
 import type { DiscordChannelAudienceInspection, DiscordChannelInspection, DiscordEmojiInspection, DiscordMessageInspection, DiscordGuildCapabilityInspection, DiscordGuildChannelAudienceInspection, DiscordResourceInspectionService, DiscordRoleInspection, DiscordMessageService, InstallationService, MemberEnforcementService, MemberRoleService, ModuleDefinition, ServiceAccess, VerificationMemberService } from "@helyx/sdk";
+import { inspectDiscordChannelAudit } from "./discord-channel-audit.js";
 import { type Client, type MessageReaction, type PartialMessageReaction } from "discord.js";
 import { type InteractionLogger } from "./interactions.js";
 import type { TransientViolationEvidenceStore } from "./transient-violation-evidence.js";
@@ -80,6 +81,7 @@ export declare class DiscordResourceInspection implements DiscordResourceInspect
     #private;
     private readonly client;
     constructor(client: Client);
+    inspectChannelAudit(input: Parameters<typeof inspectDiscordChannelAudit>[1]): Promise<import("@helyx/sdk").ChannelAuditReport>;
     inspectGuildCapabilities(input: {
         guildId: string;
     }): Promise<DiscordGuildCapabilityInspection>;

package/dist/events.js

@@ -1,4 +1,6 @@
 import { HELYX_SERVICE_NAMES } from "@helyx/sdk";
+import { inspectDiscordChannelAudit } from "./discord-channel-audit.js";
+import { dangerousRolePermissionNames } from "./discord-role-safety.js";
 import { safeError } from "@helyx/core";
 import { ChannelType, Events, GatewayIntentBits, GuildMemberFlags, PermissionFlagsBits, RESTJSONErrorCodes, UserFlags, } from "discord.js";
 import { toReplyOptions } from "./interactions.js";
@@ -1272,26 +1274,6 @@ export function reactionCacheKey(emojiIdentifier) {
 const discordSnowflake = /^\d{17,20}$/u;
 const moduleIdentifier = /^helyx\.[a-z0-9][a-z0-9-]*$/u;
 const customEmojiIdentifier = /^(?:<a?:([A-Za-z0-9_]{2,32}):(\d{17,20})>|([A-Za-z0-9_]{2,32}):(\d{17,20}))$/u;
-const dangerousRolePermissionNames = new Set([
-    "ADMINISTRATOR",
-    "BAN_MEMBERS",
-    "DEAFEN_MEMBERS",
-    "KICK_MEMBERS",
-    "MANAGE_CHANNELS",
-    "MANAGE_EVENTS",
-    "MANAGE_GUILD",
-    "MANAGE_GUILD_EXPRESSIONS",
-    "MANAGE_MESSAGES",
-    "MANAGE_NICKNAMES",
-    "MANAGE_ROLES",
-    "MANAGE_THREADS",
-    "MANAGE_WEBHOOKS",
-    "MENTION_EVERYONE",
-    "MODERATE_MEMBERS",
-    "MOVE_MEMBERS",
-    "MUTE_MEMBERS",
-    "VIEW_AUDIT_LOG",
-]);
 const directMessageAttemptTimeoutMs = 5_000;
 const guildChannelAudienceInspectionLimit = 500;
 export class DiscordMessageDeliveryService {
@@ -1696,6 +1678,9 @@ export class DiscordResourceInspection {
     constructor(client) {
         this.client = client;
     }
+    inspectChannelAudit(input) {
+        return inspectDiscordChannelAudit(this.client, input);
+    }
     async inspectGuildCapabilities(input) {
         validateSnowflake(input.guildId, "guild");
         const guild = await this.client.guilds.fetch(input.guildId);

package/dist/hosted-server-moderation.d.ts

@@ -11,8 +11,8 @@ declare const resultSchema: z.ZodObject<{
     }>;
     outcome: z.ZodEnum<{
         completed: "completed";
-        failed: "failed";
         requires_review: "requires_review";
+        failed: "failed";
         queued: "queued";
         not_currently_installed: "not_currently_installed";
         accepted_for_retry: "accepted_for_retry";
@@ -45,7 +45,7 @@ export declare class HostedServerModerationClient implements DeveloperServerMode
         idempotencyKey: string;
     }): Promise<{
         operationId: string;
-        outcome: "completed" | "failed" | "requires_review" | "queued" | "not_currently_installed" | "accepted_for_retry" | "already_blacklisted";
+        outcome: "completed" | "requires_review" | "failed" | "queued" | "not_currently_installed" | "accepted_for_retry" | "already_blacklisted";
         paidSlotsReleased: number;
     }>;
 }