@helyx/bot 1.5.1 → 1.5.3

package/dist/cloud-connector.js

@@ -6,7 +6,10 @@ import { resolve } from "node:path";
 import WebSocket from "ws";
 import { z } from "zod";
 import { CloudControlDeniedError, CloudControlDispatcher, } from "./cloud-control-dispatcher.js";
-import { BotControlTransportError, } from "./control-server.js";
+import { BotControlTransportError, safeBotControlFieldError, } from "./control-server.js";
+import { BotControlForbiddenError } from "./control-errors.js";
+import { COMMAND_POLICY_CAPABILITY } from "@helyx/control-protocol/command-policy";
+import { CloudCommandPolicySynchronizer } from "./cloud-command-policy-sync.js";
 const enrolmentFileSchema = z
     .object({
     schemaVersion: z.literal(1),
@@ -83,6 +86,10 @@ export class CloudConnectorController {
     #stopping = false;
     #connectionBlocked = false;
     #loop;
+    #policyRuntime;
+    #policySession;
+    #policySynchronizer;
+    #policyAbort = new AbortController();
     #activeSupport;
     #pendingSupport = new Map();
     constructor(input) {
@@ -101,6 +108,61 @@ export class CloudConnectorController {
             ? new CloudControlDispatcher(this.input.database, handler, commands)
             : new CloudControlDispatcher({ repository: this.#repository }, handler, commands);
     }
+    /** Called only after the runtime has claimed its immutable SQL owner scope. */
+    async setCommandPolicyDelivery(runtime) {
+        const previous = this.#policySynchronizer;
+        this.#policyAbort.abort();
+        this.#policySession = undefined;
+        this.#policySynchronizer = undefined;
+        this.#policyRuntime = runtime;
+        this.#policyAbort = new AbortController();
+        this.#socket?.close(1012, "Command policy runtime replaced");
+        await previous?.stop();
+    }
+    #identityContext(identity) {
+        return {
+            runtime: this.#policyRuntime,
+            session: this.#policySession ?? null,
+            identity,
+            signal: this.#policyAbort.signal,
+            synchronizer: this.#policySynchronizer,
+        };
+    }
+    async #changeIdentity(context, change) {
+        if (!context.runtime)
+            return change(this.#repository);
+        context.signal.throwIfAborted();
+        if (context.runtime.isOwnerCurrent &&
+            !(await context.runtime.isOwnerCurrent()))
+            throw new Error("command_policy_owner_changed");
+        context.synchronizer?.cancel();
+        let result;
+        try {
+            result = await context.runtime.delivery.withIdentityChange({
+                owner: context.runtime.owner,
+                expectedSession: context.session,
+                expectedIdentity: context.identity
+                    ? {
+                        installationId: context.identity.installationId,
+                        credentialId: context.identity.credentialId,
+                        credentialGeneration: context.identity.credentialGeneration,
+                    }
+                    : null,
+                signal: context.signal,
+            }, change);
+        }
+        catch (error) {
+            if (context.synchronizer &&
+                this.#policySynchronizer === context.synchronizer)
+                this.#socket?.close(1012, "Connector identity transition held");
+            throw error;
+        }
+        if (this.#policySession?.sessionId === context.session?.sessionId) {
+            this.#policySession = undefined;
+            this.#policySynchronizer = undefined;
+        }
+        return result;
+    }
     async start() {
         if (!this.input.environment.HELYX_CLOUD_CONNECT_ENABLED)
             return;
@@ -170,6 +232,7 @@ export class CloudConnectorController {
         if (!this.input.environment.HELYX_CLOUD_CONNECT_ENABLED)
             throw new CloudConnectorUserError("Cloud Connect is disabled in this deployment");
         const existing = await this.#repository.getIdentity();
+        const identityContext = this.#identityContext(existing);
         const recoveringIdentity = existing && !existing.revokedAt && this.#state === "recovery_required";
         if (existing && !existing.revokedAt && !recoveringIdentity)
             throw new CloudConnectorUserError("This Helyx deployment is already connected");
@@ -217,19 +280,20 @@ export class CloudConnectorController {
         }
         const exchange = exchangeResponseSchema.parse(payload);
         const encrypted = encryptPrivateKey(keyPair.privateKey, this.#dataKey, exchange.installationId);
-        if (recoveringIdentity && !(await this.#repository.revoke())) {
-            throw new CloudConnectorUserError("The previous local Cloud Connect identity could not be reset");
-        }
-        this.#identity = await this.#repository.createIdentity({
-            installationId: exchange.installationId,
-            credentialId: exchange.credentialId,
-            cloudEndpointId: exchange.cloudEndpointId,
-            publicKey: keyPair.publicKey,
-            publicKeyFingerprint: keyPair.fingerprint,
-            privateKey: encrypted,
-            credentialGeneration: exchange.credentialGeneration,
-            protocolVersion: CLOUD_PROTOCOL_VERSION,
-            enrolledAt: new Date(),
+        this.#identity = await this.#changeIdentity(identityContext, async (repository) => {
+            if (recoveringIdentity && !(await repository.revoke()))
+                throw new CloudConnectorUserError("The previous local Cloud Connect identity could not be reset");
+            return repository.createIdentity({
+                installationId: exchange.installationId,
+                credentialId: exchange.credentialId,
+                cloudEndpointId: exchange.cloudEndpointId,
+                publicKey: keyPair.publicKey,
+                publicKeyFingerprint: keyPair.fingerprint,
+                privateKey: encrypted,
+                credentialGeneration: exchange.credentialGeneration,
+                protocolVersion: CLOUD_PROTOCOL_VERSION,
+                enrolledAt: new Date(),
+            });
         });
         this.#connectionBlocked = false;
         await this.#repository.appendAudit({
@@ -247,6 +311,7 @@ export class CloudConnectorController {
     async disconnect() {
         if (!this.#identity)
             throw new CloudConnectorUserError("This Helyx deployment is not connected");
+        const identityContext = this.#identityContext(this.#identity);
         await this.#performCredentialAction({
             protocolVersion: CLOUD_PROTOCOL_VERSION,
             action: "revoke",
@@ -256,6 +321,7 @@ export class CloudConnectorController {
             nonce: randomBytes(32).toString("base64url"),
             issuedAt: new Date().toISOString(),
         });
+        await this.#changeIdentity(identityContext, (repository) => repository.revoke());
         const revokedAt = new Date();
         this.#identity = {
             ...this.#identity,
@@ -264,7 +330,6 @@ export class CloudConnectorController {
         this.#connectionBlocked = true;
         this.#state = "revoked";
         this.#socket?.close(1000, "Local owner disconnected Cloud Connect");
-        await this.#repository.revoke();
         await this.#repository.appendAudit({
             action: "installation.disconnected",
             source: "discord",
@@ -273,11 +338,13 @@ export class CloudConnectorController {
     }
     async rotate() {
         const identity = this.#identity;
+        const identityContext = this.#identityContext(identity ?? null);
         if (!identity || identity.revokedAt)
             throw new CloudConnectorUserError("This Helyx deployment is not connected");
         if (!this.#dataKey)
             throw new CloudConnectorUserError("HELYX_DATA_ENCRYPTION_KEY is not configured");
         const nextKeyPair = generateConnectorKeyPair();
+        const dataKey = this.#dataKey;
         const result = rotationResponseSchema.parse(await this.#performCredentialAction({
             protocolVersion: CLOUD_PROTOCOL_VERSION,
             action: "rotate",
@@ -289,27 +356,27 @@ export class CloudConnectorController {
             newPublicKey: nextKeyPair.publicKey,
             newPublicKeyFingerprint: nextKeyPair.fingerprint,
         }));
-        this.#socket?.close(1012, "Connector credential rotated");
         let updated;
         try {
-            updated = await this.#repository.rotateIdentity({
+            updated = await this.#changeIdentity(identityContext, (repository) => repository.rotateIdentity({
                 credentialId: result.credentialId,
                 publicKey: nextKeyPair.publicKey,
                 publicKeyFingerprint: nextKeyPair.fingerprint,
-                privateKey: encryptPrivateKey(nextKeyPair.privateKey, this.#dataKey, identity.installationId),
+                privateKey: encryptPrivateKey(nextKeyPair.privateKey, dataKey, identity.installationId),
                 expectedGeneration: identity.credentialGeneration,
                 newGeneration: result.credentialGeneration,
-            });
+            }));
         }
         catch {
-            await this.#recordRotationRecovery(identity);
+            await this.#recordRotationRecovery(identity, identityContext);
             throw new CloudConnectorUserError("The cloud credential changed but could not be saved locally. Revoke this installation in the dashboard, then connect it again");
         }
         if (!updated)
-            await this.#recordRotationRecovery(identity);
+            await this.#recordRotationRecovery(identity, identityContext);
         if (!updated)
             throw new CloudConnectorUserError("The cloud credential changed while the local identity was being updated. Revoke this installation in the dashboard, then connect it again");
         this.#identity = updated;
+        this.#socket?.close(1012, "Connector credential rotated");
         this.#connectionBlocked = false;
         await this.#repository.appendAudit({
             action: "credential.rotated",
@@ -350,6 +417,8 @@ export class CloudConnectorController {
         });
     }
     async stop() {
+        this.#policyAbort.abort();
+        await this.#policySynchronizer?.stop().catch(() => undefined);
         this.#stopping = true;
         this.#state = "stopped";
         this.#socket?.close(1001, "Helyx bot shutting down");
@@ -414,43 +483,69 @@ export class CloudConnectorController {
         const socket = new WebSocket(endpoint);
         this.#socket = socket;
         let incomingGuard;
+        let helloSent = false;
         let outgoingSequence = 0;
         let heartbeat;
         let plannedReconnect;
         let activeControlRequests = 0;
         let draining = false;
+        let policySynchronizer;
+        let policyStopping;
+        const policyRuntime = this.#policyRuntime;
+        const stopPolicy = () => {
+            if (!policyStopping) {
+                policyStopping = (policySynchronizer?.stop() ?? Promise.resolve()).catch(() => undefined);
+                if (this.#policySynchronizer === policySynchronizer) {
+                    this.#policySynchronizer = undefined;
+                    this.#policySession = undefined;
+                }
+            }
+            return policyStopping;
+        };
         const privateKey = decryptPrivateKey(identity.privateKey, this.#dataKey, identity.installationId);
         const finished = new Promise((resolveFinished, rejectFinished) => {
             const fail = (error) => {
                 clearInterval(heartbeat);
                 clearTimeout(plannedReconnect);
-                rejectFinished(error instanceof Error ? error : new Error("websocket_failed"));
+                void stopPolicy().finally(() => rejectFinished(error instanceof Error ? error : new Error("websocket_failed")));
             };
             socket.once("error", fail);
             socket.once("close", () => {
                 clearInterval(heartbeat);
                 clearTimeout(plannedReconnect);
-                this.#socket = undefined;
+                if (this.#socket === socket)
+                    this.#socket = undefined;
                 this.#activeSupport = undefined;
                 this.#rejectPendingSupport("Cloud Connect disconnected");
-                if (this.#stopping)
-                    resolveFinished();
-                else
-                    rejectFinished(new Error("connection_closed"));
+                void stopPolicy().finally(() => {
+                    if (this.#stopping)
+                        resolveFinished();
+                    else
+                        rejectFinished(new Error("connection_closed"));
+                });
             });
             socket.on("message", (raw) => {
                 void (async () => {
                     try {
+                        if (this.#socket !== socket || this.#stopping)
+                            return;
                         const bytes = rawDataBuffer(raw);
                         assertCloudMessageSize(bytes);
                         const payload = JSON.parse(bytes.toString("utf8"));
                         const challenge = connectorChallengeSchema.safeParse(payload);
                         if (challenge.success) {
                             await this.#sendHello(socket, identity, privateKey, challenge.data);
+                            helloSent = true;
                             return;
                         }
                         const accepted = connectorAcceptedSchema.safeParse(payload);
                         if (accepted.success) {
+                            if (!helloSent)
+                                throw new Error("connector_acceptance_before_hello");
+                            if (accepted.data.installationId !== identity.installationId)
+                                throw new Error("connector_acceptance_installation_mismatch");
+                            if (incomingGuard)
+                                throw new Error("duplicate_connector_acceptance");
                             incomingGuard = new ConnectionSequenceGuard(identity.installationId, accepted.data.connectionEpoch);
                             this.#state = "online";
                             this.#activeSupport = {
@@ -467,6 +562,54 @@ export class CloudConnectorController {
                                 },
                             };
                             this.#lastErrorCode = undefined;
+                            if (this.input.environment.HELYX_RUNTIME_PROFILE ===
+                                "self-hosted" &&
+                                policyRuntime &&
+                                accepted.data.capabilities.includes(COMMAND_POLICY_CAPABILITY)) {
+                                const session = {
+                                    installationId: identity.installationId,
+                                    credentialId: identity.credentialId,
+                                    credentialGeneration: identity.credentialGeneration,
+                                    connectionEpoch: accepted.data.connectionEpoch,
+                                    sessionId: randomUUID(),
+                                };
+                                policySynchronizer = new CloudCommandPolicySynchronizer({
+                                    applicationId: this.input.environment.DISCORD_CLIENT_ID,
+                                    owner: policyRuntime.owner,
+                                    session,
+                                    delivery: policyRuntime.delivery,
+                                    ...(policyRuntime.isOwnerCurrent
+                                        ? {
+                                            isOwnerCurrent: () => policyRuntime.isOwnerCurrent?.() ??
+                                                Promise.resolve(false),
+                                        }
+                                        : {}),
+                                    onHeld: () => {
+                                        this.#lastErrorCode = "command_policy_unverified";
+                                        socket.close(1012, "Command policy verification held");
+                                    },
+                                    send: (correlationId, pull) => {
+                                        if (socket.readyState !== WebSocket.OPEN ||
+                                            draining ||
+                                            this.#socket !== socket)
+                                            throw new Error("command_policy_session_closed");
+                                        socket.send(JSON.stringify(connectedMessage({
+                                            type: "command-policy.request",
+                                            installationId: identity.installationId,
+                                            connectionEpoch: session.connectionEpoch,
+                                            sequence: ++outgoingSequence,
+                                            correlationId,
+                                            payload: pull,
+                                        })));
+                                    },
+                                });
+                                this.#policySynchronizer = policySynchronizer;
+                                this.#policySession = session;
+                                await policySynchronizer.start();
+                                if (socket.readyState !== WebSocket.OPEN ||
+                                    this.#socket !== socket)
+                                    return;
+                            }
                             await this.#repository.markConnected();
                             this.#identity = {
                                 ...identity,
@@ -487,6 +630,7 @@ export class CloudConnectorController {
                                 if (socket.readyState !== WebSocket.OPEN)
                                     return;
                                 draining = true;
+                                void stopPolicy();
                                 socket.send(JSON.stringify(connectedMessage({
                                     type: "connector.draining",
                                     installationId: identity.installationId,
@@ -515,7 +659,7 @@ export class CloudConnectorController {
                                 this.#connectionBlocked = true;
                                 if (rejected.data.code === "revoked" ||
                                     rejected.data.code === "invalid_credential") {
-                                    await this.#repository.revoke();
+                                    await this.#changeIdentity(this.#identityContext(identity), (repository) => repository.revoke());
                                     this.#identity = {
                                         ...identity,
                                         revokedAt: new Date(),
@@ -530,6 +674,13 @@ export class CloudConnectorController {
                             return;
                         }
                         const message = connectedCloudMessageSchema.parse(payload);
+                        if (message.type === "command-policy.response") {
+                            if (!incomingGuard || !policySynchronizer || draining)
+                                throw new Error("command_policy_session_unavailable");
+                            incomingGuard.accept(message);
+                            policySynchronizer.accept(message.correlationId, message.payload, message.expiresAt);
+                            return;
+                        }
                         incomingGuard?.accept(message);
                         if (message.type === "support.response") {
                             const pending = this.#pendingSupport.get(message.correlationId);
@@ -579,6 +730,9 @@ export class CloudConnectorController {
             throw new Error("challenge_installation_mismatch");
         const discord = await this.input.discord.snapshot();
         const capabilities = connectorCapabilities();
+        if (this.input.environment.HELYX_RUNTIME_PROFILE === "self-hosted" &&
+            this.#policyRuntime)
+            capabilities.push(COMMAND_POLICY_CAPABILITY);
         const hello = connectorHelloSchema.parse({
             protocolVersion: CLOUD_PROTOCOL_VERSION,
             type: "connector.hello",
@@ -615,18 +769,7 @@ export class CloudConnectorController {
             });
         }
         catch (error) {
-            const denied = error instanceof CloudControlDeniedError;
-            return cloudControlResponsePayloadSchema.parse({
-                operation: request.operation,
-                ok: false,
-                error: {
-                    code: denied ? "forbidden" : mapControlError(error),
-                    message: denied
-                        ? "The self-hoster has not allowed this support view"
-                        : safeControlMessage(error),
-                    retryable: !denied && mapControlError(error) === "temporarily_unavailable",
-                },
-            });
+            return cloudControlFailureResponse(request.operation, error);
         }
     }
     async #submitHostedBug(input) {
@@ -727,19 +870,27 @@ export class CloudConnectorController {
             throw new CloudConnectorUserError("Helyx Cloud rejected the credential change");
         return payload;
     }
-    async #recordRotationRecovery(identity) {
-        this.#connectionBlocked = true;
-        this.#state = "revoked";
-        this.#identity = { ...identity, revokedAt: new Date() };
-        await Promise.allSettled([
-            this.#repository.revoke(),
-            this.#repository.appendAudit({
-                action: "credential.rotation_recovery_required",
-                source: "system",
-                outcome: "failed",
-                safeReasonCode: "local_identity_update_failed",
-            }),
-        ]);
+    async #recordRotationRecovery(identity, context = this.#identityContext(identity)) {
+        const revoked = await this.#changeIdentity(context, (repository) => repository.revoke()).catch(() => false);
+        // A delayed failed rotation must not replace a newer in-memory identity.
+        if (revoked &&
+            !context.signal.aborted &&
+            this.#identity?.installationId === identity.installationId &&
+            this.#identity.credentialId === identity.credentialId &&
+            this.#identity.credentialGeneration === identity.credentialGeneration) {
+            this.#connectionBlocked = true;
+            this.#state = "revoked";
+            this.#identity = { ...identity, revokedAt: new Date() };
+            this.#socket?.close(1012, "Connector rotation recovery required");
+        }
+        await this.#repository
+            .appendAudit({
+            action: "credential.rotation_recovery_required",
+            source: "system",
+            outcome: "failed",
+            safeReasonCode: "local_identity_update_failed",
+        })
+            .catch(() => undefined);
     }
 }
 export class CloudConnectorUserError extends Error {
@@ -752,6 +903,7 @@ function connectorCapabilities() {
     return [
         "installation.health.read.v1",
         "guild.state.read.v1",
+        "guild.user-identities.read.v1",
         "guild.dashboard.access.read.v1",
         "guild.access-policy.read.v1",
         "guild.access-policy.write.v1",
@@ -775,6 +927,7 @@ function connectorCapabilities() {
         "guild.module.resource.preview.v1",
         "guild.module.resource.import.v1",
         "guild.module.resource.create.v1",
+        "guild.module.resource.create-defaults.v1",
         "guild.module.resource.update.v1",
         "guild.module.resource.delete.v1",
         "guild.module.resource.action.execute.v1",
@@ -834,6 +987,8 @@ function connectedMessage(input) {
     });
 }
 export function mapControlError(error) {
+    if (error instanceof BotControlForbiddenError)
+        return "forbidden";
     if (error instanceof BotControlTransportError) {
         if (error.status === 400)
             return "bad_request";
@@ -857,6 +1012,22 @@ export function mapControlError(error) {
         return "temporarily_unavailable";
     return "internal_error";
 }
+export function cloudControlFailureResponse(operation, error) {
+    const denied = error instanceof CloudControlDeniedError;
+    const fieldError = denied ? undefined : safeBotControlFieldError(error);
+    return cloudControlResponsePayloadSchema.parse({
+        operation,
+        ok: false,
+        error: {
+            code: denied ? "forbidden" : mapControlError(error),
+            message: denied
+                ? "The self-hoster has not allowed this support view"
+                : safeControlMessage(error),
+            retryable: !denied && mapControlError(error) === "temporarily_unavailable",
+            ...(fieldError ? { fieldError } : {}),
+        },
+    });
+}
 export function safeControlMessage(error) {
     const code = mapControlError(error);
     if (code === "not_found")

package/dist/cloud-control-dispatcher.js

@@ -30,6 +30,13 @@ export class CloudControlDispatcher {
                 result = await this.control.getGuildState(input.guildId);
                 break;
             }
+            case "guild.user-identities.read.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                if (!this.control.resolveDiscordUserIdentities)
+                    throw new Error("Discord identity lookup is unavailable");
+                result = await this.control.resolveDiscordUserIdentities(input);
+                break;
+            }
             case "guild.dashboard.access.read.v1": {
                 const input = parseOperationInput(request.operation, request.input);
                 result = {
@@ -270,6 +277,17 @@ export class CloudControlDispatcher {
                 });
                 break;
             }
+            case "guild.module.resource.create-defaults.v1": {
+                const input = parseOperationInput(request.operation, request.input);
+                if (!this.control.getManagedResourceCreateDefaults)
+                    throw new Error("Creation defaults are unavailable");
+                result = await this.control.getManagedResourceCreateDefaults({
+                    ...input,
+                    actorUserId: requiredActor(actorUserId),
+                    correlationId,
+                });
+                break;
+            }
             case "guild.module.resource.update.v1": {
                 const input = parseOperationInput(request.operation, request.input);
                 result = await this.control.updateManagedResource({

package/dist/command-policy-runtime.d.ts

@@ -0,0 +1,23 @@
+import type { CommandPolicyOwnerToken, CommandPolicyRuntimeScope } from "@helyx/database-contracts";
+import type { CommandPolicyDeliveryService } from "@helyx/platform";
+import type { ShardCoordinator, ShardGenerationDescriptor, ShardLeaderLease } from "./shard-coordinator.js";
+export interface CommandPolicyRuntime {
+    delivery: CommandPolicyDeliveryService;
+    owner: CommandPolicyOwnerToken;
+    isOwnerCurrent?(): Promise<boolean>;
+}
+/** Capture once; a conflict must not recapture a newer authority version. */
+export declare function admitStandaloneCommandPolicy(delivery: CommandPolicyDeliveryService): Promise<CommandPolicyRuntime>;
+/** Captured immediately after elected-leader/Core DB readiness, before module work. */
+export declare function captureShardedCommandPolicyAdmission(delivery: CommandPolicyDeliveryService, ownerId: string): Promise<{
+    claim(leaderToken: string, isOwnerCurrent: () => Promise<boolean>): Promise<CommandPolicyRuntime>;
+}>;
+export declare function shardCommandPolicyScope(generation: string, deploymentOrder: number | undefined): CommandPolicyRuntimeScope;
+/** Redis ownership is a preflight; the SQL owner tuple remains the commit fence. */
+export declare function commandPolicyLeaderIsCurrent(input: {
+    coordinator: Pick<ShardCoordinator, "refreshGeneration" | "getLeaderLease">;
+    descriptor: ShardGenerationDescriptor;
+    deploymentOrder: number;
+    leader: ShardLeaderLease;
+}): Promise<boolean>;
+//# sourceMappingURL=command-policy-runtime.d.ts.map

package/dist/command-policy-runtime.js

@@ -0,0 +1,53 @@
+/** Capture once; a conflict must not recapture a newer authority version. */
+export async function admitStandaloneCommandPolicy(delivery) {
+    const ticket = await delivery.captureStandaloneAdmission();
+    return { delivery, owner: await delivery.claimStandalone(ticket) };
+}
+/** Captured immediately after elected-leader/Core DB readiness, before module work. */
+export async function captureShardedCommandPolicyAdmission(delivery, ownerId) {
+    const admission = await delivery.captureShardedAdmission({ ownerId });
+    let claimed;
+    return {
+        claim(leaderToken, isOwnerCurrent) {
+            claimed ??= (async () => {
+                if (!(await isOwnerCurrent()))
+                    throw new Error("Command policy leader changed before admission");
+                const owner = await delivery.claimSharded({
+                    ownerId,
+                    leaderToken,
+                    admission,
+                });
+                if (!(await isOwnerCurrent()))
+                    throw new Error("Command policy leader changed after admission");
+                return { delivery, owner, isOwnerCurrent };
+            })();
+            return claimed;
+        },
+    };
+}
+export function shardCommandPolicyScope(generation, deploymentOrder) {
+    if (!generation ||
+        !Number.isSafeInteger(deploymentOrder) ||
+        deploymentOrder < 1)
+        throw new Error("Command policy requires the current shard generation and deployment order");
+    return {
+        mode: "sharded",
+        generation,
+        deploymentOrder: String(deploymentOrder),
+    };
+}
+/** Redis ownership is a preflight; the SQL owner tuple remains the commit fence. */
+export async function commandPolicyLeaderIsCurrent(input) {
+    try {
+        if (!(await input.coordinator.refreshGeneration(input.descriptor, input.deploymentOrder)))
+            return false;
+        const actual = await input.coordinator.getLeaderLease();
+        return (actual?.generation === input.leader.generation &&
+            actual.supervisorId === input.leader.supervisorId &&
+            actual.fencingToken === input.leader.fencingToken);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=command-policy-runtime.js.map

package/dist/command-root-catalogue.d.ts

@@ -0,0 +1,5 @@
+import { type CommandCatalogueSnapshot } from "@helyx/database-contracts";
+export declare function parseBundledCommandCatalogue(contents: string): CommandCatalogueSnapshot;
+/** Metadata only: never import packages omitted from the configured runtime. */
+export declare function loadBundledCommandCatalogue(): Promise<CommandCatalogueSnapshot>;
+//# sourceMappingURL=command-root-catalogue.d.ts.map

package/dist/command-root-catalogue.js

@@ -0,0 +1,16 @@
+import { readFile } from "node:fs/promises";
+import { normalizeCommandCatalogueSnapshot, } from "@helyx/database-contracts";
+export function parseBundledCommandCatalogue(contents) {
+    const value = JSON.parse(contents);
+    if (!value ||
+        typeof value !== "object" ||
+        !("fingerprint" in value) ||
+        typeof value.fingerprint !== "string")
+        throw new Error("The bundled approved command catalogue must include its fingerprint");
+    return normalizeCommandCatalogueSnapshot(value);
+}
+/** Metadata only: never import packages omitted from the configured runtime. */
+export async function loadBundledCommandCatalogue() {
+    return parseBundledCommandCatalogue(await readFile(new URL("../command-root-catalogue.json", import.meta.url), "utf8"));
+}
+//# sourceMappingURL=command-root-catalogue.js.map

package/dist/control-error-mapping.d.ts

@@ -0,0 +1,8 @@
+import { type DashboardFieldValidation } from "@helyx/control-protocol/field-validation";
+export declare function mapBotControlError(error: unknown): {
+    status: 400 | 403 | 404 | 409;
+    message: string;
+    fieldError?: DashboardFieldValidation;
+} | undefined;
+export declare function safeBotControlFieldError(error: unknown): DashboardFieldValidation | undefined;
+//# sourceMappingURL=control-error-mapping.d.ts.map