@helyx/bot 1.5.2 → 1.5.4

package/dist/control-error-mapping.js

@@ -0,0 +1,60 @@
+import { GuildCommandActiveLeaseError, GuildCommandRevisionConflictError, GuildCommandSetupConflictError, OptimisticConcurrencyError, } from "@helyx/database";
+import { parseDashboardFieldValidation, } from "@helyx/control-protocol/field-validation";
+import { DashboardActionValidationError, ModuleStateValidationError, } from "@helyx/sdk";
+import { ZodError } from "zod";
+import { BotControlForbiddenError, BotControlNotFoundError, BotControlValidationError, BotControlTransportError, } from "./control-errors.js";
+export function mapBotControlError(error) {
+    if (error instanceof ZodError)
+        return { status: 400, message: "The control request was invalid" };
+    if (error instanceof BotControlValidationError ||
+        error instanceof DashboardActionValidationError ||
+        error instanceof ModuleStateValidationError) {
+        const fieldError = safeBotControlFieldError(error);
+        return {
+            status: 400,
+            message: error.message,
+            ...(fieldError ? { fieldError } : {}),
+        };
+    }
+    if (error instanceof BotControlNotFoundError)
+        return { status: 404, message: error.message };
+    if (error instanceof BotControlForbiddenError)
+        return { status: 403, message: error.message };
+    if (error instanceof OptimisticConcurrencyError ||
+        (error instanceof Error &&
+            error.name === "DatabaseFailure" &&
+            "kind" in error &&
+            error.kind === "conflict"))
+        return {
+            status: 409,
+            message: "Configuration changed in another session. Reload and try again.",
+        };
+    if (error instanceof GuildCommandRevisionConflictError ||
+        (error instanceof Error &&
+            error.name === "GuildCommandRevisionConflictError"))
+        return {
+            status: 409,
+            message: "Command state changed in another session. Refresh and try again.",
+        };
+    if (error instanceof GuildCommandActiveLeaseError ||
+        (error instanceof Error && error.name === "GuildCommandActiveLeaseError"))
+        return {
+            status: 409,
+            message: "A command build is already running. Wait for it to finish.",
+        };
+    if (error instanceof GuildCommandSetupConflictError ||
+        (error instanceof Error && error.name === "GuildCommandSetupConflictError"))
+        return {
+            status: 409,
+            message: "Command setup changed. Reload the page and try again.",
+        };
+    return undefined;
+}
+export function safeBotControlFieldError(error) {
+    return error instanceof DashboardActionValidationError ||
+        (error instanceof BotControlTransportError &&
+            [400, 409].includes(error.status))
+        ? parseDashboardFieldValidation(error.fieldError)
+        : undefined;
+}
+//# sourceMappingURL=control-error-mapping.js.map

package/dist/control-errors.d.ts

@@ -1,9 +1,11 @@
 import { type PermissionMutationDenialReason } from "@helyx/core";
+import { type DashboardFieldValidation } from "@helyx/control-protocol/field-validation";
 export declare function isUnknownGuildError(error: unknown): boolean;
 export declare function isUnknownMemberError(error: unknown): boolean;
 export declare class BotControlTransportError extends Error {
     readonly status: 400 | 403 | 404 | 409 | 502 | 503 | 504;
-    constructor(status: 400 | 403 | 404 | 409 | 502 | 503 | 504, message: string);
+    readonly fieldError: DashboardFieldValidation | undefined;
+    constructor(status: 400 | 403 | 404 | 409 | 502 | 503 | 504, message: string, fieldError?: unknown);
 }
 export declare class BotControlValidationError extends Error {
     constructor(message: string);

package/dist/control-errors.js

@@ -1,4 +1,5 @@
 import { permissionMutationDenialMessage, } from "@helyx/core";
+import { parseDashboardFieldValidation, } from "@helyx/control-protocol/field-validation";
 export function isUnknownGuildError(error) {
     return (typeof error === "object" &&
         error !== null &&
@@ -13,10 +14,12 @@ export function isUnknownMemberError(error) {
 }
 export class BotControlTransportError extends Error {
     status;
-    constructor(status, message) {
+    fieldError;
+    constructor(status, message, fieldError) {
         super(message);
         this.status = status;
         this.name = "BotControlTransportError";
+        this.fieldError = parseDashboardFieldValidation(fieldError);
     }
 }
 export class BotControlValidationError extends Error {

package/dist/control-health-routes.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyInstance } from "fastify";
+import type { ShardHealthSnapshot } from "./shard-contracts.js";
+export declare function registerControlHealthRoutes(server: FastifyInstance, input: {
+    readiness?: () => Promise<boolean>;
+    shardHealth?: () => Promise<ShardHealthSnapshot>;
+    runtimeConfiguration?: {
+        hostedModerationEnabled: boolean;
+    };
+}): void;
+//# sourceMappingURL=control-health-routes.d.ts.map

package/dist/control-health-routes.js

@@ -0,0 +1,28 @@
+export function registerControlHealthRoutes(server, input) {
+    async function readiness(reply) {
+        const deploymentReadiness = input.readiness;
+        const shardHealth = input.shardHealth;
+        if (!deploymentReadiness && !shardHealth)
+            return { status: "ok" };
+        try {
+            if (deploymentReadiness && (await deploymentReadiness()))
+                return { status: "ok" };
+            if (deploymentReadiness)
+                return reply.code(503).send({ status: "unavailable" });
+            if (!shardHealth)
+                return reply.code(503).send({ status: "unavailable" });
+            if ((await shardHealth()).status === "healthy")
+                return { status: "ok" };
+        }
+        catch {
+            // Public readiness deliberately returns no internal detail.
+        }
+        return reply.code(503).send({ status: "unavailable" });
+    }
+    server.get("/health", (_request, reply) => readiness(reply));
+    server.get("/v1/health", (_request, reply) => readiness(reply));
+    server.get("/v1/runtime-configuration", (_request, reply) => reply.header("Cache-Control", "no-store").send({
+        hostedModerationEnabled: input.runtimeConfiguration?.hostedModerationEnabled ?? false,
+    }));
+}
+//# sourceMappingURL=control-health-routes.js.map

package/dist/control-server-schemas.d.ts

@@ -57,6 +57,13 @@ export declare const managedResourceDetailSchema: z.ZodObject<{
     updatedAt: z.ZodISODateTime;
     value: z.ZodRecord<z.ZodString, z.ZodCustom<ManagedResourceValue, ManagedResourceValue>>;
     availableActionIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    notices: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            info: "info";
+            warning: "warning";
+        }>;
+        message: z.ZodString;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const managedResourcePageSchema: z.ZodObject<{
     items: z.ZodArray<z.ZodObject<{

package/dist/control-server-schemas.js

@@ -70,6 +70,15 @@ export const managedResourceDetailSchema = managedResourceSummarySchema
     .extend({
     value: managedResourceObject,
     availableActionIds: z.array(z.string().min(1).max(100)).max(50).optional(),
+    notices: z
+        .array(z
+        .object({
+        kind: z.enum(["info", "warning"]),
+        message: z.string().trim().min(1).max(500),
+    })
+        .strict())
+        .max(5)
+        .optional(),
 })
     .strict()
     .refine(hasBoundedManagedResourceBytes);

package/dist/control-server.d.ts

@@ -1,6 +1,8 @@
+import { type DiscordUserIdentityControl, type DiscordUserIdentityRequest } from "@helyx/control-protocol/discord-user-identities";
 import { AuditRepository, GuildAccessPolicyRepository, InstallationRepository, ModuleLoggingPolicyRepository, PermissionPolicyRepository, type DatabasePool, type GuildShardOwnership } from "@helyx/database";
 import type { MysqlPool } from "@helyx/database-mysql";
 import type { CreatorOnboardingRequest, CreatorOnboardingResponse } from "@helyx/sdk";
+export { mapBotControlError, safeBotControlFieldError, } from "./control-error-mapping.js";
 import { type DashboardActionInspection, type DashboardActionResult, type FeatureAccessDecision, type GuildAccessPolicy, type ManagedResourceCreationIntent, type ManagedResourceDetail, type ManagedResourcePage, type ManagedResourceRelationPage, type ManagedResourceValue, type MessageResponse, type ModuleDefinition, type OAuthConsumerCleanupResult, type PermissionActor, type PrivacyCapturePage, type PrivacyErasePage, type PrivacyProviderExecutor, type PublicAchievementProjectionPage, type ServiceAccess } from "@helyx/sdk";
 import { type ActionReceipt, type SignedAssessmentEnvelope } from "@helyx/verification-contracts";
 import { type Client } from "discord.js";
@@ -10,10 +12,12 @@ import { type FirstTimeCommandSetupHandler } from "./first-time-command-setup.js
 import { type ShardHealthSnapshot } from "./shard-contracts.js";
 import { type DashboardPermissionState } from "./control-permissions.js";
 export { BotControlTransportError } from "./control-errors.js";
+import { type ManagedResourceCreateDefaultsInput, type ManagedResourceCreateDefaultsControl } from "./managed-resource-create-defaults.js";
 import type { ChannelAuditControl } from "@helyx/sdk";
 import { type DashboardModuleDefinition } from "./dashboard-module-projection.js";
 import { type AvailabilityModuleCatalogue } from "./module-availability-control.js";
 import { registerGuildCommandControlRoutes } from "./guild-command-control-routes.js";
+import { registerNexusCommandRecoveryControlRoutes } from "./nexus-command-recovery-control-routes.js";
 import { type DashboardActionInput, type DashboardActionPreviewInput } from "./dashboard-action-control.js";
 import { type DashboardActionHandler } from "./dashboard-action-routes.js";
 import { type EckoTelemetrySink } from "./ecko-transport-routes.js";
@@ -52,7 +56,7 @@ export interface BotGuildPresenceObservation {
     state: BotGuildPresenceState;
     observedAt: string;
 }
-export interface BotControlGuildResourceDirectory {
+export interface BotControlGuildResourceDirectory extends DiscordUserIdentityControl {
     listGuildPresence(guildIds: readonly string[]): Promise<BotGuildPresenceObservation[]>;
     getGuildResources(guildId: string): Promise<BotControlGuildResources>;
     getGuildPublicSummary(guildId: string): Promise<{
@@ -70,8 +74,17 @@ export interface BotControlGuildResourceDirectory {
     sendPrivateSupportNotification?(guildId: string, channelId: string, response: MessageResponse, notificationId: string): Promise<void>;
 }
 export declare class DiscordGuildResourceDirectory implements BotControlGuildResourceDirectory {
+    #private;
     private readonly client;
     constructor(client: Client);
+    resolveDiscordUserIdentities(input: DiscordUserIdentityRequest): Promise<{
+        guildId: string;
+        users: {
+            userId: string;
+            username: string | null;
+            displayName: string | null;
+        }[];
+    }>;
     listGuildPresence(guildIds: readonly string[]): Promise<BotGuildPresenceObservation[]>;
     getGuildResources(guildId: string): Promise<BotControlGuildResources>;
     getGuildPublicSummary(guildId: string): Promise<{
@@ -121,7 +134,7 @@ export interface DashboardGuildAccessState extends GuildAccessPolicy {
     actorHighestRolePosition: number | null;
     updatedAt: string | null;
 }
-export interface BotControlHandler extends FirstTimeCommandSetupHandler, DashboardActionHandler, ChannelAuditControl {
+export interface BotControlHandler extends FirstTimeCommandSetupHandler, DashboardActionHandler, ManagedResourceCreateDefaultsControl, ChannelAuditControl, DiscordUserIdentityControl {
     creatorOnboarding?(input: CreatorOnboardingRequest): Promise<CreatorOnboardingResponse>;
     cleanupOAuthConsumer(input: {
         consumerBindingId: string;
@@ -395,6 +408,14 @@ export declare class BotControlService implements BotControlHandler {
         executeThrough: Date;
         cursor?: string;
     }): Promise<PrivacyErasePage>;
+    resolveDiscordUserIdentities(input: DiscordUserIdentityRequest): Promise<{
+        guildId: string;
+        users: {
+            userId: string;
+            username: string | null;
+            displayName: string | null;
+        }[];
+    }>;
     getGuildState(guildId: string): Promise<BotControlState>;
     canAccessDashboard(input: {
         guildId: string;
@@ -571,6 +592,9 @@ export declare class BotControlService implements BotControlHandler {
         correlationId: string;
         actorAuthenticatedAt?: string;
     }): Promise<ManagedResourceDetail | null>;
+    getManagedResourceCreateDefaults(input: ManagedResourceCreateDefaultsInput): Promise<{
+        value: Readonly<Record<string, ManagedResourceValue>>;
+    }>;
     listAvailabilityModules(): Promise<AvailabilityModuleCatalogue>;
 }
 export declare function createBotControlServer(input: {
@@ -593,6 +617,7 @@ export declare function createBotControlServer(input: {
         observedAt: string;
     }>;
     guildCommands?: Parameters<typeof registerGuildCommandControlRoutes>[1];
+    nexusCommandRecovery?: Parameters<typeof registerNexusCommandRecoveryControlRoutes>[1];
     ecko?: {
         authenticator: EckoTransportAuthenticator;
         registry: AutoModerationScannerProviderRegistryService;
@@ -604,8 +629,4 @@ export declare function createBotControlServer(input: {
         telemetry?: EckoTelemetrySink;
     };
 }): Promise<FastifyInstance>;
-export declare function mapBotControlError(error: unknown): {
-    status: 400 | 403 | 404 | 409;
-    message: string;
-} | undefined;
 //# sourceMappingURL=control-server.d.ts.map

package/dist/control-server.js

@@ -1,12 +1,18 @@
-import { AuditRepository, GuildAccessPolicyRepository, GuildCommandActiveLeaseError, GuildCommandRevisionConflictError, GuildCommandSetupConflictError, InstallationRepository, ModuleLoggingPolicyRepository, OptimisticConcurrencyError, PermissionPolicyRepository, withTransaction, } from "@helyx/database";
+import { discordUserIdentityRequestSchema, } from "@helyx/control-protocol/discord-user-identities";
+import { createDiscordUserIdentityLookup, } from "./discord-user-identities.js";
+import { AuditRepository, GuildAccessPolicyRepository, InstallationRepository, ModuleLoggingPolicyRepository, OptimisticConcurrencyError, PermissionPolicyRepository, withTransaction, } from "@helyx/database";
 import { safeError } from "@helyx/core";
-import { DashboardActionValidationError, DEFAULT_GUILD_ACCESS_POLICY, HELYX_SERVICE_NAMES, ModuleStateValidationError, } from "@helyx/sdk";
+import { MemberRoleSnapshotError, snapshotMemberRoleIds, } from "./member-role-ids.js";
+import { mapBotControlError, safeBotControlFieldError, } from "./control-error-mapping.js";
+export { mapBotControlError, safeBotControlFieldError, } from "./control-error-mapping.js";
+import { DashboardActionValidationError, DEFAULT_GUILD_ACCESS_POLICY, HELYX_SERVICE_NAMES, nexusCommandLoggingControlOwner, ModuleStateValidationError, } from "@helyx/sdk";
 import { actionReceiptSchema, signedAssessmentEnvelopeSchema, } from "@helyx/verification-contracts";
 import { canAccessGuildDashboard, canMutatePermissionPolicy, canUseCommand, resolveHelyxAuthority, } from "@helyx/core";
 import { ChannelType, PermissionFlagsBits } from "discord.js";
 import Fastify, {} from "fastify";
 import { createHash, timingSafeEqual } from "node:crypto";
-import { z, ZodError } from "zod";
+import { z } from "zod";
+import { nexusModuleLabels } from "./nexus-command-references.js";
 import { addChannelMessageReaction as addDiscordChannelMessageReaction, deleteChannelMessage as deleteDiscordChannelMessage, editChannelMessage as editDiscordChannelMessage, normalizeDiscordPermission, sendToChannel as sendDiscordMessageToChannel, } from "./interactions.js";
 import { mutateDashboardModuleStatus, } from "./module-status-control.js";
 import { canAccessModule, PREMIUM_MODULE_UNAVAILABLE_MESSAGE, } from "./premium-access.js";
@@ -16,12 +22,18 @@ import { assertVersion, declaredManagedResourcePermission, fromDashboardPolicy,
 import { assertPermissionMutationAllowed, BotControlForbiddenError, BotControlNotFoundError, BotControlValidationError, BotControlTransportError, isUnknownGuildError, isUnknownMemberError, } from "./control-errors.js";
 export { BotControlTransportError } from "./control-errors.js";
 import { dashboardCommands } from "./dashboard-commands.js";
+import { dashboardLoggingPolicies } from "./dashboard-logging.js";
+import { authorizeManagedResourceContext } from "./managed-resource-authorization.js";
+import { readManagedResourceCreateDefaults, } from "./managed-resource-create-defaults.js";
+import { validateManagedResourceQuery } from "./managed-resource-query.js";
 import { registerChannelAuditRoutes } from "./channel-audit-routes.js";
 import { createChannelAuditControl } from "./channel-audit-control.js";
 import { executeCreatorOnboarding, registerCreatorOnboardingControlRoute, } from "./creator-onboarding-control.js";
 import { mapDashboardModule, } from "./dashboard-module-projection.js";
 import { availabilityCatalogueDefinitions, availabilityCatalogue, dashboardModuleStatus, disabledModuleSummary, moduleAvailabilityService, moduleAvailabilityStates, statusCatalogueDefinitions, } from "./module-availability-control.js";
 import { registerGuildCommandControlRoutes } from "./guild-command-control-routes.js";
+import { registerControlHealthRoutes } from "./control-health-routes.js";
+import { registerNexusCommandRecoveryControlRoutes } from "./nexus-command-recovery-control-routes.js";
 import { createPrivacyProviderRegistry, describePrivacyProviders, } from "./privacy-provider-registry.js";
 import { changedSettingFeatureIds, configurationPreviewFeatureIds, managedResourceColumnKeys, normalizeManagedResourceDetail, normalizeManagedResourcePage, normalizeManagedResourceRelationPage, projectManagedResourceObject, requireDashboardFeatures, resourceFieldFeatureIds, scalarInputFeatureIds, validateManagedResourceInput, } from "./dashboard-feature-control.js";
 import { registerDashboardPreviewImportRoutes, registerDashboardResourceMutationRoutes, } from "./dashboard-preview-import-routes.js";
@@ -32,8 +44,13 @@ import { validateDiscordUserSettingSelections, validateDiscordSettingSelections,
 import { configurationValue, guildAccessPolicy, managedResourceDeleteResultSchema, managedResourceDetailSchema, managedResourceFilters, managedResourceObject, managedResourcePageSchema, managedResourceRelationPageSchema, moduleId, mutationContext, permissionState, resourceActionId, resourceCursor, resourceId, snowflake, } from "./control-server-schemas.js";
 export class DiscordGuildResourceDirectory {
     client;
+    #identities;
     constructor(client) {
         this.client = client;
+        this.#identities = createDiscordUserIdentityLookup(client);
+    }
+    resolveDiscordUserIdentities(input) {
+        return this.#identities.resolve(input);
     }
     listGuildPresence(guildIds) {
         const observedAt = new Date().toISOString();
@@ -133,7 +150,13 @@ export class DiscordGuildResourceDirectory {
             });
             return {
                 userId: member.id,
-                roleIds: [...member.roles.cache.keys()],
+                roleIds: snapshotMemberRoleIds({
+                    member,
+                    client: this.client,
+                    guild,
+                    guildId,
+                    actorUserId,
+                }),
                 permissions: member.permissions
                     .toArray()
                     .map(normalizeDiscordPermission),
@@ -143,6 +166,8 @@ export class DiscordGuildResourceDirectory {
             };
         }
         catch (error) {
+            if (error instanceof MemberRoleSnapshotError)
+                throw new BotControlForbiddenError();
             if (isUnknownGuildError(error))
                 throw new BotControlNotFoundError();
             if (isUnknownMemberError(error))
@@ -231,7 +256,7 @@ export class BotControlService {
         this.#modules = new Map(modules.map((module) => [module.manifest.id, module]));
         this.#dashboardModules = modules
             .filter((module) => module.manifest.dashboard !== undefined)
-            .map(mapDashboardModule);
+            .map((module) => mapDashboardModule(module, modules));
         this.#availabilityModules = availabilityCatalogueDefinitions(modules);
         this.#statusModules = statusCatalogueDefinitions(statusModules ?? modules);
         this.#configurations = services.get(HELYX_SERVICE_NAMES.configuration);
@@ -377,6 +402,11 @@ export class BotControlService {
             ...(input.cursor ? { cursor: input.cursor } : {}),
         });
     }
+    resolveDiscordUserIdentities(input) {
+        if (!this.resources.resolveDiscordUserIdentities)
+            throw new BotControlTransportError(503, "Discord identity lookup is unavailable");
+        return this.resources.resolveDiscordUserIdentities(discordUserIdentityRequestSchema.parse(input));
+    }
     async getGuildState(guildId) {
         const dashboardEntries = this.#dashboardModules.map((dashboardModule) => ({
             dashboardModule,
@@ -404,12 +434,8 @@ export class BotControlService {
         const moduleStatuses = {};
         const configurations = {};
         const permissions = {};
-        const logging = {};
+        const logging = dashboardLoggingPolicies(this.#dashboardModules, storedLoggingPolicies);
         const featureAccess = {};
-        const loggingPolicies = new Map(storedLoggingPolicies.map((policy) => [
-            `${policy.sourceModuleId}:${policy.eventId}`,
-            policy,
-        ]));
         for (const { dashboardModule, module } of dashboardEntries) {
             const installation = installed.get(dashboardModule.id);
             moduleStatuses[dashboardModule.id] = dashboardModuleStatus(disabledModules.set, dashboardModule.id, installation);
@@ -420,14 +446,6 @@ export class BotControlService {
                     value: configuration.value,
                 };
             permissions[dashboardModule.id] = this.#buildPermissionState(module, storedPermissions);
-            logging[dashboardModule.id] = dashboardModule.logEvents.map((event) => {
-                const stored = loggingPolicies.get(`${dashboardModule.id}:${event.id}`);
-                return {
-                    eventId: event.id,
-                    enabled: stored?.enabled ?? event.defaultEnabled,
-                    version: stored ? safeVersion(stored.version) : 0,
-                };
-            });
             if (module.manifest.manifestVersion === "0.5" &&
                 module.manifest.features.length > 0) {
                 const access = this.#services.has(HELYX_SERVICE_NAMES.featureAccess)
@@ -450,7 +468,7 @@ export class BotControlService {
                 messageContent: runtime.messageContent,
             },
             ...resources,
-            modules: structuredClone(this.#dashboardModules),
+            modules: await nexusModuleLabels(this.#dashboardModules, this.#services, guildId),
             featureAccess,
             moduleStatuses,
             globallyDisabledModuleIds: disabledModules.ids,
@@ -832,7 +850,10 @@ export class BotControlService {
         if (!(await this.#persistence.repositories.installations.isModuleEnabled(input.guildId, "helyx.logging"))) {
             throw new BotControlValidationError("Enable Logging before changing activity events");
         }
-        const source = this.#requireModule(input.moduleId);
+        const ownerModuleId = nexusCommandLoggingControlOwner(input.moduleId, input.eventId);
+        if (ownerModuleId !== input.moduleId)
+            await this.#requireModuleAccessible(input.guildId, ownerModuleId);
+        const source = this.#requireModule(ownerModuleId);
         const event = source.logging?.events.find(({ id }) => id === input.eventId);
         if (!event) {
             throw new BotControlNotFoundError("Logging event is not declared by this module");
@@ -840,7 +861,7 @@ export class BotControlService {
         const saved = await this.#persistence.withTransaction(async (repositories) => {
             const policy = await repositories.loggingPolicies.save({
                 guildId: input.guildId,
-                sourceModuleId: input.moduleId,
+                sourceModuleId: ownerModuleId,
                 eventId: input.eventId,
                 enabled: input.enabled,
                 expectedVersion: input.expectedVersion === 0 ? null : BigInt(input.expectedVersion),
@@ -852,7 +873,7 @@ export class BotControlService {
                 action: "module.logging.updated",
                 source: "dashboard",
                 correlationId: input.correlationId,
-                moduleId: input.moduleId,
+                moduleId: ownerModuleId,
                 targetType: "module_log_event",
                 targetId: input.eventId,
                 afterState: {
@@ -1029,6 +1050,16 @@ export class BotControlService {
             ? null
             : normalizeManagedResourceDetail(managedResourceDetailSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
     }
+    async getManagedResourceCreateDefaults(input) {
+        await this.#requireModuleAccessible(input.guildId, input.moduleId);
+        const { module, resource } = this.#prepareManagedResource(input);
+        this.#requireManagedResourceOperation(module, input.resourceType, "create");
+        return readManagedResourceCreateDefaults({
+            module,
+            resource,
+            context: await this.#managedResourceContext(input, module, "create"),
+        });
+    }
     #prepareManagedResource(input) {
         const module = this.#requireDashboardModule(input.moduleId);
         const resource = this.#requireManagedResource(module, input.resourceType);
@@ -1049,17 +1080,7 @@ export class BotControlService {
             throw new BotControlNotFoundError("Managed resource operation is not declared by this module");
     }
     #validateManagedResourceQuery(module, resourceType, input) {
-        const query = module.manifest.dashboard?.resources?.find(({ id }) => id === resourceType)?.query;
-        if (input.search !== undefined && !query?.search)
-            throw new BotControlValidationError("Managed resource search is not declared by this module");
-        for (const [key, value] of Object.entries(input.filters ?? {})) {
-            const filter = query?.filters?.find((candidate) => candidate.key === key);
-            if (!filter)
-                throw new BotControlValidationError("Managed resource filter is not declared by this module");
-            if (filter.type === "select" &&
-                !filter.options.some((option) => option.value === value))
-                throw new BotControlValidationError("Managed resource filter value is not declared by this module");
-        }
+        validateManagedResourceQuery(module, resourceType, input);
     }
     async #requireEnabledManagedResource(guildId, moduleIdValue) {
         if (!(await this.#persistence.repositories.installations.isModuleEnabled(guildId, moduleIdValue)))
@@ -1067,26 +1088,31 @@ export class BotControlService {
     }
     async #managedResourceContext(input, module, operation, permissionId = managedResourcePermissionId(module, input.resourceType, operation, undefined, declaredManagedResourcePermission(module, input.resourceType, operation))) {
         const resource = this.#requireManagedResource(module, input.resourceType);
-        const [actor] = await Promise.all([
-            this.#authorizeAction(input.guildId, module, input.actorUserId, permissionId),
-            resource.availableWhileDisabled
-                ? Promise.resolve()
-                : this.#requireEnabledManagedResource(input.guildId, module.manifest.id),
-        ]);
-        return {
-            guildId: input.guildId,
-            actor,
-            ...("actorAuthenticatedAt" in input &&
-                typeof input.actorAuthenticatedAt === "string"
-                ? { actorAuthenticatedAt: input.actorAuthenticatedAt }
-                : {}),
-            correlationId: input.correlationId,
-            services: this.#services,
-            sendToChannel: (channelId, response) => this.resources.sendToChannel(channelId, response),
-            deleteChannelMessage: (channelId, messageId) => this.resources.deleteChannelMessage(channelId, messageId),
-            editChannelMessage: (channelId, messageId, response) => this.resources.editChannelMessage(channelId, messageId, response),
-            addChannelMessageReaction: (channelId, messageId, emojiIdentifier) => this.resources.addChannelMessageReaction(channelId, messageId, emojiIdentifier),
-        };
+        if (!resource.availableWhileDisabled)
+            await this.#requireEnabledManagedResource(input.guildId, module.manifest.id);
+        return authorizeManagedResourceContext({
+            ...input,
+            module,
+            resource,
+            operation,
+            permissionId,
+            authorize: (id) => this.#authorizeAction(input.guildId, module, input.actorUserId, id),
+            createContext: (actor, authorizationScope) => ({
+                guildId: input.guildId,
+                actor,
+                authorizationScope,
+                ...("actorAuthenticatedAt" in input &&
+                    typeof input.actorAuthenticatedAt === "string"
+                    ? { actorAuthenticatedAt: input.actorAuthenticatedAt }
+                    : {}),
+                correlationId: input.correlationId,
+                services: this.#services,
+                sendToChannel: (channelId, response) => this.resources.sendToChannel(channelId, response),
+                deleteChannelMessage: (channelId, messageId) => this.resources.deleteChannelMessage(channelId, messageId),
+                editChannelMessage: (channelId, messageId, response) => this.resources.editChannelMessage(channelId, messageId, response),
+                addChannelMessageReaction: (channelId, messageId, emojiIdentifier) => this.resources.addChannelMessageReaction(channelId, messageId, emojiIdentifier),
+            }),
+        });
     }
     async #authorizeAction(guildId, module, actorUserId, permissionId) {
         const [actor, policy, guildAccess] = await Promise.all([
@@ -1246,33 +1272,8 @@ export async function createBotControlServer(input) {
         if (!timingSafeEqual(expectedSecret, digest(supplied)))
             return reply.code(401).send({ message: "Control authentication failed" });
     });
-    async function readiness(reply) {
-        const deploymentReadiness = input.readiness;
-        const shardHealth = input.shardHealth;
-        if (!deploymentReadiness && !shardHealth)
-            return { status: "ok" };
-        try {
-            if (deploymentReadiness && (await deploymentReadiness()))
-                return { status: "ok" };
-            if (deploymentReadiness)
-                return reply.code(503).send({ status: "unavailable" });
-            if (!shardHealth)
-                return reply.code(503).send({ status: "unavailable" });
-            const health = await shardHealth();
-            if (health.status === "healthy")
-                return { status: "ok" };
-        }
-        catch {
-            // The public readiness route deliberately returns no internal detail.
-        }
-        return reply.code(503).send({ status: "unavailable" });
-    }
-    server.get("/health", (_request, reply) => readiness(reply));
+    registerControlHealthRoutes(server, input);
     registerCreatorOnboardingControlRoute(server, input.service);
-    server.get("/v1/health", (_request, reply) => readiness(reply));
-    server.get("/v1/runtime-configuration", (_request, reply) => reply.header("Cache-Control", "no-store").send({
-        hostedModerationEnabled: input.runtimeConfiguration?.hostedModerationEnabled ?? false,
-    }));
     server.post("/v1/hosted-server-moderation/leave/deliver", async (request) => {
         if (!input.deliverHostedServerLeave)
             throw new BotControlTransportError(503, "Hosted server moderation delivery is unavailable");
@@ -1289,6 +1290,7 @@ export async function createBotControlServer(input) {
         return input.refreshHostedServerOwner(guildId);
     });
     registerGuildCommandControlRoutes(server, input.guildCommands, input.service);
+    registerNexusCommandRecoveryControlRoutes(server, input.nexusCommandRecovery);
     if (input.ecko)
         registerEckoTransportRoutes(server, input.ecko);
     server.post("/v1/verification/results", async (request) => input.service.acceptVerificationResult(signedAssessmentEnvelopeSchema.parse(request.body)));
@@ -1423,6 +1425,18 @@ export async function createBotControlServer(input) {
             ...(cursor ? { cursor } : {}),
         });
     });
+    server.post("/v1/guilds/:guildId/user-identities", async (request) => {
+        const { guildId } = z
+            .object({ guildId: snowflake })
+            .strict()
+            .parse(request.params);
+        const body = discordUserIdentityRequestSchema
+            .pick({ userIds: true })
+            .parse(request.body);
+        if (!input.service.resolveDiscordUserIdentities)
+            throw new BotControlTransportError(503, "Discord identity lookup is unavailable");
+        return input.service.resolveDiscordUserIdentities({ guildId, ...body });
+    });
     server.get("/v1/guilds/:guildId/state", async (request) => {
         const { guildId } = z.object({ guildId: snowflake }).parse(request.params);
         return input.service.getGuildState(guildId);
@@ -1653,9 +1667,17 @@ export async function createBotControlServer(input) {
     server.setErrorHandler(async (error, request, reply) => {
         const mapped = mapBotControlError(error);
         if (mapped)
-            return reply.code(mapped.status).send({ message: mapped.message });
+            return reply.code(mapped.status).send({
+                message: mapped.message,
+                ...(mapped.fieldError ? { fieldError: mapped.fieldError } : {}),
+            });
         if (error instanceof BotControlTransportError)
-            return reply.code(error.status).send({ message: error.message });
+            return reply.code(error.status).send({
+                message: error.message,
+                ...(safeBotControlFieldError(error)
+                    ? { fieldError: safeBotControlFieldError(error) }
+                    : {}),
+            });
         request.log.error({
             error: safeError(error),
             errorCode: typeof error.code === "string"
@@ -1666,47 +1688,6 @@ export async function createBotControlServer(input) {
     });
     return server;
 }
-export function mapBotControlError(error) {
-    if (error instanceof ZodError)
-        return { status: 400, message: "The control request was invalid" };
-    if (error instanceof BotControlValidationError ||
-        error instanceof DashboardActionValidationError ||
-        error instanceof ModuleStateValidationError)
-        return { status: 400, message: error.message };
-    if (error instanceof BotControlNotFoundError)
-        return { status: 404, message: error.message };
-    if (error instanceof BotControlForbiddenError)
-        return { status: 403, message: error.message };
-    if (error instanceof OptimisticConcurrencyError ||
-        (error instanceof Error &&
-            error.name === "DatabaseFailure" &&
-            "kind" in error &&
-            error.kind === "conflict"))
-        return {
-            status: 409,
-            message: "Configuration changed in another session. Reload and try again.",
-        };
-    if (error instanceof GuildCommandRevisionConflictError ||
-        (error instanceof Error &&
-            error.name === "GuildCommandRevisionConflictError"))
-        return {
-            status: 409,
-            message: "Command state changed in another session. Refresh and try again.",
-        };
-    if (error instanceof GuildCommandActiveLeaseError ||
-        (error instanceof Error && error.name === "GuildCommandActiveLeaseError"))
-        return {
-            status: 409,
-            message: "A command build is already running. Wait for it to finish.",
-        };
-    if (error instanceof GuildCommandSetupConflictError ||
-        (error instanceof Error && error.name === "GuildCommandSetupConflictError"))
-        return {
-            status: 409,
-            message: "Command setup changed. Reload the page and try again.",
-        };
-    return undefined;
-}
 function digest(value) {
     return createHash("sha256").update(value).digest();
 }