@helyx/module-account-gate 1.0.1

package/README.md

@@ -0,0 +1,90 @@
+# Access Control
+
+Access Control asks a joining member to complete short Discord interaction checks
+before Helyx grants the configured access role. It is a local
+human-interaction check: it can deter basic automated accounts, but it does not
+detect devices, network risk, alternate accounts or ban evasion.
+
+The default flow uses two different generated challenges and allows three
+attempts. Eight challenge types are implemented: Quick Sum, Button Sequence,
+Number Order, Symbol Match, Modal Recall, Server Question, Password Entry and
+Emoji Entry. Password Entry and Emoji Entry are static gates and are excluded
+from generated challenge allocation. A server selects one access type:
+generated Challenges, Password Entry or Emoji Entry.
+
+## Permissions and Discord configuration
+
+Access Control requires View Channel, Send Messages, Embed Links, Read Message
+History and Manage Roles. Kick Members is required only when final failure is
+configured to kick. Password Entry also requires Manage Messages, Guild
+Messages and the privileged Message Content intent; its channel health check
+explicitly requires View Channel, Read Message History and Manage Messages.
+Emoji Entry may require Add Reactions and the Guild Message Reactions intent.
+
+Helyx must be above the access role and every temporary role it removes. The
+module adds the access role before removing temporary roles so a partial
+Discord failure does not remove the member's only access route.
+
+Discord channel permissions are the sole authority for which channels pending
+members can see. Access Control validates its configured gate, Password Entry,
+Emoji Entry and staff-review channels, but it does not maintain a second
+dashboard allowlist of every other visible server channel. Administrators
+should configure the temporary pre-gate role's Discord permissions directly.
+The managed Start panel may be absent during the initial
+activation-and-publish flow, but runtime joins fail closed until its saved
+message exists. Enabling Server Question likewise requires at least one
+enabled managed question.
+
+The review-channel audience check rejects `@everyone` and every configured
+temporary pre-gate role. The current Discord inspection contract only reports
+roles explicitly requested by the module and Access Control has no configured
+staff-role allowlist, so it cannot prove that every other visible role is a
+staff role; administrators must keep that channel staff-only.
+
+## Failure and strict-mode behaviour
+
+Staff review is the default final-failure action. When kick is deliberately
+selected, Helyx first makes a best-effort attempt to send a neutral direct
+message explaining that Access Control was not completed. It then rechecks
+the current decision and kicks as soon as possible; a closed direct-message
+channel does not prevent the kick. The target is within 30 seconds and there is
+no deliberate delay.
+
+Authorised Access Control managers may activate temporary strict mode. It lasts
+15 minutes by default, can be configured from 5 to 60 minutes, adds one
+generated challenge without exceeding four, and expires automatically. It does
+not reduce attempts or enable kicking, Password Entry or Emoji Entry.
+
+Join deadlines and active-check expiry use durable one-shot tasks with exact
+join generations and session versions. Restarted or duplicate workers cannot
+enforce an old join or expire a newer check. A failed challenge applies the
+configured retry cooldown monotonically; passing or an authorised Approve or
+Retry decision clears it. Account age uses Discord's account-created and joined
+timestamps, and accepts the exact configured age boundary.
+
+Returning members are restored only when a prior success is retained, restore
+is enabled, re-verification is disabled, and the current access role is still
+assignable. Otherwise they enter a fresh pending generation. Adaptive chains
+add a generated challenge for a prior-failure or young-account signal, while
+temporary strict mode may add one more, capped at four.
+
+Password Entry and Emoji Entry are single-step access types rather than members
+of a generated challenge chain. Helyx sends answer-free private resume guidance
+that identifies the Discord server and gate channel. Closed direct messages
+never cause user-specific controls or answers to be posted publicly; the member
+can use the panel or `/access-control start` to resume the persisted check.
+
+## Stored data
+
+The module stores server questions, safe attempt outcomes, member summaries,
+staff-review decisions, recoverable role transitions and strict-mode
+activations. Raw Password Entry messages are never retained. Active challenge
+answers use the shared expiring Helyx session service rather than a module-owned
+session table. A versioned Privacy Service provider supports bounded access and
+erasure.
+
+## Release state
+
+Version 1.0.0 is private and in Testing. Live Discord validation has not yet
+been performed. Runtime enforcement rechecks module state, member state, kick
+permission and role hierarchy immediately before every kick.

package/dist/challenges.d.ts

@@ -0,0 +1,16 @@
+import type { Challenge, ChallengeType, GeneratedChallengeType, RandomSource, ServerQuestion } from "./contracts.js";
+import type { AccountGateConfiguration } from "./configuration.js";
+export interface GenerateChainInput {
+    configuration: AccountGateConfiguration;
+    random: RandomSource;
+    operationContext: string;
+    strictModeActive: boolean;
+    adaptiveRisk?: boolean;
+    questions?: readonly ServerQuestion[];
+}
+export declare function allocateChallengeTypes(input: GenerateChainInput): readonly ChallengeType[];
+export declare function generateChallengeChain(input: GenerateChainInput): readonly Challenge[];
+export declare function generateChallenge(type: ChallengeType, random: RandomSource, operationContext: string, questions?: readonly ServerQuestion[]): Challenge;
+export declare function validateServerQuestion(input: unknown): ServerQuestion;
+export declare function isGeneratedChallengeType(type: ChallengeType): type is GeneratedChallengeType;
+//# sourceMappingURL=challenges.d.ts.map

package/dist/challenges.js

@@ -0,0 +1,233 @@
+import { GENERATED_CHALLENGE_TYPES } from "./contracts.js";
+import { effectiveChallengeCount, generatedChallengePool, } from "./configuration.js";
+const SYMBOLS = [
+    { symbol: "★", name: "Star" },
+    { symbol: "●", name: "Circle" },
+    { symbol: "▲", name: "Triangle" },
+    { symbol: "◆", name: "Diamond" },
+];
+const RECALL_ALPHABET = "ABCDEFGHJKMNPQRTUVWXYZ2346789";
+const COLOURS = ["red", "blue", "green"];
+export function allocateChallengeTypes(input) {
+    const { configuration, random, operationContext, strictModeActive } = input;
+    if (configuration.allocationMode === "fixed_chain") {
+        const fixed = [...configuration.fixedChallengeChain];
+        if (!strictModeActive || fixed.length >= 4)
+            return fixed;
+        const additional = generatedChallengePool(configuration).filter((type) => !fixed.includes(type));
+        if (additional.length > 0) {
+            const selected = additional[random.integer(additional.length, `${operationContext}:strict-additional`)];
+            const finalIsStatic = fixed.at(-1) === "password_entry" || fixed.at(-1) === "emoji_entry";
+            fixed.splice(finalIsStatic ? fixed.length - 1 : fixed.length, 0, selected);
+        }
+        return fixed;
+    }
+    const pool = [...generatedChallengePool(configuration)];
+    const count = configuration.allocationMode === "random_one"
+        ? Math.min(pool.length, strictModeActive ? 2 : 1)
+        : configuration.allocationMode === "adaptive_chain"
+            ? Math.min(pool.length, 4, 1 + (input.adaptiveRisk ? 1 : 0) + (strictModeActive ? 1 : 0))
+            : effectiveChallengeCount(configuration, strictModeActive);
+    const selected = [];
+    while (selected.length < count) {
+        const index = random.integer(pool.length, `${operationContext}:allocation:${selected.length}`);
+        selected.push(pool.splice(index, 1)[0]);
+    }
+    return selected;
+}
+export function generateChallengeChain(input) {
+    return allocateChallengeTypes(input).map((type, index) => generateChallenge(type, input.random, `${input.operationContext}:challenge:${index}`, input.questions ?? []));
+}
+export function generateChallenge(type, random, operationContext, questions = []) {
+    switch (type) {
+        case "quick_sum":
+            return quickSum(random, operationContext);
+        case "button_sequence":
+            return buttonSequence(random, operationContext);
+        case "number_order":
+            return numberOrder(random, operationContext);
+        case "symbol_match":
+            return symbolMatch(random, operationContext);
+        case "modal_recall":
+            return modalRecall(random, operationContext);
+        case "server_question":
+            return serverQuestion(random, operationContext, questions);
+        case "password_entry":
+            return {
+                type,
+                prompt: "Enter the password for this gate in the Password Entry channel. Never enter your Discord password or authentication code.",
+            };
+        case "emoji_entry":
+            return {
+                type,
+                prompt: "Add the configured emoji reaction to the exact server message to continue.",
+            };
+    }
+}
+export function validateServerQuestion(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        throw new Error("Server question must be an object");
+    }
+    const value = input;
+    if (typeof value.id !== "string" ||
+        value.id.length < 1 ||
+        value.id.length > 100) {
+        throw new Error("Server question ID is invalid");
+    }
+    if (typeof value.question !== "string" ||
+        value.question.trim().length < 1 ||
+        value.question.trim().length > 200) {
+        throw new Error("Server question must contain 1 to 200 characters");
+    }
+    if (!Array.isArray(value.answers) ||
+        value.answers.length < 3 ||
+        value.answers.length > 5) {
+        throw new Error("Server question must have three to five answers");
+    }
+    const answers = value.answers.map((answer) => {
+        if (typeof answer !== "string" ||
+            answer.trim().length < 1 ||
+            answer.trim().length > 80) {
+            throw new Error("Server question answers must contain 1 to 80 characters");
+        }
+        return answer.trim();
+    });
+    if (new Set(answers.map((answer) => answer.toLocaleLowerCase("en-GB"))).size !==
+        answers.length) {
+        throw new Error("Server question answers must be unique");
+    }
+    if (!Number.isInteger(value.correctOption) ||
+        value.correctOption < 0 ||
+        value.correctOption >= answers.length) {
+        throw new Error("Server question must have exactly one correct answer");
+    }
+    return {
+        id: value.id,
+        question: value.question.trim(),
+        answers,
+        correctOption: value.correctOption,
+    };
+}
+export function isGeneratedChallengeType(type) {
+    return GENERATED_CHALLENGE_TYPES.includes(type);
+}
+function quickSum(random, context) {
+    const subtract = random.integer(2, `${context}:operator`) === 1;
+    const first = random.integer(16, `${context}:first`) + 4;
+    const secondMaximum = subtract ? first + 1 : 16;
+    const second = random.integer(secondMaximum, `${context}:second`);
+    const answer = subtract ? first - second : first + second;
+    const candidates = uniquePlausibleAnswers(answer);
+    const shuffled = shuffle(candidates, random, `${context}:answers`);
+    return {
+        type: "quick_sum",
+        prompt: `What is ${first} ${subtract ? "−" : "+"} ${second}?`,
+        options: shuffled.map(String),
+        expectedOption: shuffled.indexOf(answer),
+    };
+}
+function buttonSequence(random, context) {
+    const length = random.integer(4, `${context}:length`) + 3;
+    const sequence = Array.from({ length }, (_, index) => {
+        return COLOURS[random.integer(3, `${context}:press:${index}`)];
+    });
+    const grouped = [];
+    for (let index = 0; index < sequence.length;) {
+        const colour = sequence[index];
+        let count = 1;
+        while (sequence[index + count] === colour)
+            count += 1;
+        grouped.push(`${title(colour)} ${count === 1 ? "once" : count === 2 ? "twice" : `${count} times`}`);
+        index += count;
+    }
+    return {
+        type: "button_sequence",
+        prompt: `Press ${grouped.join(", then ")}.`,
+        expectedSequence: sequence,
+        progress: 0,
+    };
+}
+function numberOrder(random, context) {
+    const count = random.integer(2, `${context}:count`) + 3;
+    const values = [];
+    while (values.length < count) {
+        const candidate = random.integer(21, `${context}:value:${values.length}`);
+        if (!values.includes(candidate))
+            values.push(candidate);
+    }
+    const descending = random.integer(2, `${context}:direction`) === 1;
+    const expected = [...values].sort((a, b) => (descending ? b - a : a - b));
+    const options = shuffle(values, random, `${context}:answers`);
+    return {
+        type: "number_order",
+        prompt: `Press the numbers from ${descending ? "highest to lowest" : "lowest to highest"}.`,
+        options: options.map(String),
+        expectedSequence: expected.map((value) => options.indexOf(value)),
+        progress: 0,
+    };
+}
+function symbolMatch(random, context) {
+    const target = random.integer(SYMBOLS.length, `${context}:target`);
+    const shuffled = shuffle([...SYMBOLS], random, `${context}:answers`);
+    const expected = shuffled.findIndex((candidate) => candidate === SYMBOLS[target]);
+    return {
+        type: "symbol_match",
+        prompt: `Select the ${SYMBOLS[target].name.toLocaleLowerCase("en-GB")}.`,
+        options: shuffled.map(({ symbol, name }) => `${symbol} ${name}`),
+        expectedOption: expected,
+    };
+}
+function modalRecall(random, context) {
+    const length = random.integer(3, `${context}:length`) + 5;
+    let code = "";
+    for (let index = 0; index < length; index += 1) {
+        code +=
+            RECALL_ALPHABET[random.integer(RECALL_ALPHABET.length, `${context}:character:${index}`)];
+    }
+    const display = `${code.slice(0, 2)}-${code.slice(2)}`;
+    return {
+        type: "modal_recall",
+        prompt: `Remember this code: ${display}`,
+        expectedText: display,
+    };
+}
+function serverQuestion(random, context, questions) {
+    if (questions.length < 1) {
+        throw new Error("No enabled Server Question is available");
+    }
+    const selected = questions[random.integer(questions.length, `${context}:question`)];
+    const indexed = selected.answers.map((label, originalIndex) => ({
+        label,
+        originalIndex,
+    }));
+    const shuffled = shuffle(indexed, random, `${context}:answers`);
+    return {
+        type: "server_question",
+        prompt: selected.question,
+        options: shuffled.map(({ label }) => label),
+        expectedOption: shuffled.findIndex(({ originalIndex }) => originalIndex === selected.correctOption),
+    };
+}
+function uniquePlausibleAnswers(answer) {
+    const values = [answer];
+    for (const delta of [1, -1, 2, -2, 3, -3]) {
+        const candidate = answer + delta;
+        if (candidate >= 0 && !values.includes(candidate))
+            values.push(candidate);
+        if (values.length === 3)
+            break;
+    }
+    return values;
+}
+function shuffle(values, random, context) {
+    const result = [...values];
+    for (let index = result.length - 1; index > 0; index -= 1) {
+        const other = random.integer(index + 1, `${context}:${index}`);
+        [result[index], result[other]] = [result[other], result[index]];
+    }
+    return result;
+}
+function title(value) {
+    return value.slice(0, 1).toLocaleUpperCase("en-GB") + value.slice(1);
+}
+//# sourceMappingURL=challenges.js.map

package/dist/configuration.d.ts

@@ -0,0 +1,41 @@
+import type { ChallengeType, FailureAction, GeneratedChallengeType } from "./contracts.js";
+export interface AccountGateConfiguration extends Record<string, unknown> {
+    accessType: "challenges" | "password" | "emoji";
+    gateChannelId: string;
+    verifiedRoleId: string;
+    temporaryRoleIds: readonly string[];
+    reviewChannelId: string;
+    preset: "light" | "standard" | "strict" | "custom";
+    allocationMode: "random_one" | "random_chain" | "fixed_chain" | "adaptive_chain";
+    enabledChallengeTypes: readonly ChallengeType[];
+    fixedChallengeChain: readonly ChallengeType[];
+    challengeCount: number;
+    attempts: number;
+    sessionExpirySeconds: number;
+    retryCooldownSeconds: number;
+    joinDeadlineSeconds: number;
+    failureAction: FailureAction;
+    strictModeDurationMinutes: number;
+    minimumAccountAgeDays: number;
+    reverifyReturningMembers: boolean;
+    restoreVerifiedMembers: boolean;
+    passwordChannelId: string;
+    passwordIgnoreCase: boolean;
+    passwordTrimWhitespace: boolean;
+    emojiChannelId: string;
+    emojiMessageId: string;
+    emojiIdentifier: string;
+}
+export interface RuntimeCapabilities {
+    guildMembers: boolean;
+    guildMessages: boolean;
+    guildMessageReactions: boolean;
+    messageContent: boolean;
+}
+export declare function parseAccountGateConfiguration(input: unknown): AccountGateConfiguration;
+export declare function validateRuntimeCapabilities(configuration: AccountGateConfiguration, capabilities: RuntimeCapabilities): readonly string[];
+export declare function generatedChallengePool(configuration: AccountGateConfiguration): readonly GeneratedChallengeType[];
+export declare function effectiveChallengeCount(configuration: AccountGateConfiguration, strictModeActive: boolean): number;
+export declare function isStrictModeActive(endsAt: Date | null, now?: Date): boolean;
+export declare const STATIC_TYPES: readonly ["password_entry", "emoji_entry"];
+//# sourceMappingURL=configuration.d.ts.map

package/dist/configuration.js

@@ -0,0 +1,224 @@
+import { CHALLENGE_TYPES, GENERATED_CHALLENGE_TYPES, STATIC_CHALLENGE_TYPES, } from "./contracts.js";
+const SNOWFLAKE = /^\d{17,20}$/u;
+export function parseAccountGateConfiguration(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        throw new Error("Access Control configuration must be an object");
+    }
+    const value = input;
+    let enabledChallengeTypes = parseChallengeList(value.enabledChallengeTypes, "enabledChallengeTypes", false);
+    let fixedChallengeChain = parseChallengeList(value.fixedChallengeChain ?? "", "fixedChallengeChain", true);
+    let preset = oneOf(value.preset, ["light", "standard", "strict", "custom"], "preset");
+    let allocationMode = oneOf(value.allocationMode, ["random_one", "random_chain", "fixed_chain", "adaptive_chain"], "allocationMode");
+    let challengeCount = integer(value.challengeCount, 1, 4, "challengeCount");
+    const accessType = value.accessType === undefined
+        ? inferLegacyAccessType(enabledChallengeTypes, fixedChallengeChain)
+        : oneOf(value.accessType, ["challenges", "password", "emoji"], "accessType");
+    const hasExplicitAccessType = value.accessType !== undefined;
+    if (hasExplicitAccessType && accessType === "challenges") {
+        if (enabledChallengeTypes.some((type) => STATIC_CHALLENGE_TYPES.includes(type))) {
+            throw new Error("Access Control challenge access cannot include Password Entry or Emoji Entry");
+        }
+    }
+    else if (hasExplicitAccessType && accessType !== "challenges") {
+        const staticType = accessType === "password" ? "password_entry" : "emoji_entry";
+        preset = "custom";
+        allocationMode = "fixed_chain";
+        enabledChallengeTypes = [staticType];
+        fixedChallengeChain = [staticType];
+        challengeCount = 1;
+    }
+    if (preset === "light") {
+        allocationMode = "random_one";
+        challengeCount = 1;
+    }
+    else if (preset === "standard") {
+        allocationMode = "random_chain";
+        challengeCount = 2;
+    }
+    else if (preset === "strict") {
+        allocationMode = "random_chain";
+        challengeCount = 3;
+    }
+    const generatedEnabled = enabledChallengeTypes.filter((type) => GENERATED_CHALLENGE_TYPES.includes(type));
+    if (allocationMode !== "fixed_chain" &&
+        challengeCount > generatedEnabled.length) {
+        throw new Error("Access Control challengeCount exceeds the enabled generated challenge pool");
+    }
+    if (allocationMode === "fixed_chain") {
+        if (fixedChallengeChain.length < 1 || fixedChallengeChain.length > 4) {
+            throw new Error("Access Control fixedChallengeChain must contain one to four challenges");
+        }
+        for (const type of fixedChallengeChain) {
+            if (!enabledChallengeTypes.includes(type)) {
+                throw new Error("Access Control fixedChallengeChain contains a disabled challenge");
+            }
+        }
+    }
+    const temporaryRoleIds = snowflakeList(value.temporaryRoleIds ?? [], "temporaryRoleIds");
+    const verifiedRoleId = snowflake(value.verifiedRoleId, "verifiedRoleId");
+    if (temporaryRoleIds.includes(verifiedRoleId)) {
+        throw new Error("Access Control access role cannot also be a temporary role");
+    }
+    const passwordEnabled = enabledChallengeTypes.includes("password_entry");
+    const passwordChannelId = optionalSnowflake(value.passwordChannelId, "passwordChannelId");
+    if (passwordEnabled && !passwordChannelId) {
+        throw new Error("Access Control Password Entry requires an exact channel");
+    }
+    const emojiEnabled = enabledChallengeTypes.includes("emoji_entry");
+    const emojiChannelId = optionalSnowflake(value.emojiChannelId, "emojiChannelId");
+    const emojiMessageId = optionalSnowflake(value.emojiMessageId, "emojiMessageId");
+    const emojiIdentifier = optionalString(value.emojiIdentifier, 100, "emojiIdentifier");
+    if (emojiEnabled &&
+        (!emojiChannelId || !emojiMessageId || !emojiIdentifier)) {
+        throw new Error("Access Control Emoji Entry requires an exact channel, message and emoji");
+    }
+    const failureAction = oneOf(value.failureAction, ["restricted", "review", "kick"], "failureAction");
+    const reviewChannelId = optionalSnowflake(value.reviewChannelId, "reviewChannelId");
+    if (!reviewChannelId)
+        throw new Error("Access Control requires a private reviewChannelId for recovery cases");
+    return {
+        accessType,
+        gateChannelId: snowflake(value.gateChannelId, "gateChannelId"),
+        verifiedRoleId,
+        temporaryRoleIds,
+        reviewChannelId,
+        preset,
+        allocationMode,
+        enabledChallengeTypes,
+        fixedChallengeChain,
+        challengeCount,
+        attempts: integer(value.attempts, 1, 10, "attempts"),
+        sessionExpirySeconds: integer(value.sessionExpirySeconds, 60, 600, "sessionExpirySeconds"),
+        retryCooldownSeconds: integer(value.retryCooldownSeconds, 0, 600, "retryCooldownSeconds"),
+        joinDeadlineSeconds: integer(value.joinDeadlineSeconds, 300, 3600, "joinDeadlineSeconds"),
+        failureAction,
+        strictModeDurationMinutes: integer(value.strictModeDurationMinutes, 5, 60, "strictModeDurationMinutes"),
+        minimumAccountAgeDays: integer(value.minimumAccountAgeDays, 0, 3650, "minimumAccountAgeDays"),
+        reverifyReturningMembers: boolean(value.reverifyReturningMembers, "reverifyReturningMembers"),
+        restoreVerifiedMembers: boolean(value.restoreVerifiedMembers, "restoreVerifiedMembers"),
+        passwordChannelId,
+        passwordIgnoreCase: boolean(value.passwordIgnoreCase, "passwordIgnoreCase"),
+        passwordTrimWhitespace: boolean(value.passwordTrimWhitespace, "passwordTrimWhitespace"),
+        emojiChannelId,
+        emojiMessageId,
+        emojiIdentifier,
+    };
+}
+function inferLegacyAccessType(enabledChallengeTypes, fixedChallengeChain) {
+    if (enabledChallengeTypes.length === 1 &&
+        fixedChallengeChain.length === 1 &&
+        enabledChallengeTypes[0] === fixedChallengeChain[0]) {
+        if (fixedChallengeChain[0] === "password_entry")
+            return "password";
+        if (fixedChallengeChain[0] === "emoji_entry")
+            return "emoji";
+    }
+    return "challenges";
+}
+export function validateRuntimeCapabilities(configuration, capabilities) {
+    const errors = [];
+    if (!capabilities.guildMembers) {
+        errors.push("Guild Members intent is unavailable.");
+    }
+    if (configuration.enabledChallengeTypes.includes("password_entry") &&
+        (!capabilities.guildMessages || !capabilities.messageContent)) {
+        errors.push("Password Entry requires Guild Messages and the privileged Message Content intent.");
+    }
+    if (configuration.enabledChallengeTypes.includes("emoji_entry") &&
+        !capabilities.guildMessageReactions) {
+        errors.push("Emoji Entry requires the Guild Message Reactions intent.");
+    }
+    return errors;
+}
+export function generatedChallengePool(configuration) {
+    return configuration.enabledChallengeTypes.filter((type) => GENERATED_CHALLENGE_TYPES.includes(type));
+}
+export function effectiveChallengeCount(configuration, strictModeActive) {
+    if (configuration.allocationMode === "fixed_chain") {
+        if (!strictModeActive)
+            return configuration.fixedChallengeChain.length;
+        const generatedOutsideChain = generatedChallengePool(configuration).some((type) => !configuration.fixedChallengeChain.includes(type));
+        return Math.min(4, configuration.fixedChallengeChain.length +
+            (generatedOutsideChain ? 1 : 0));
+    }
+    return Math.min(4, generatedChallengePool(configuration).length, configuration.challengeCount + (strictModeActive ? 1 : 0));
+}
+export function isStrictModeActive(endsAt, now = new Date()) {
+    return endsAt !== null && endsAt.getTime() > now.getTime();
+}
+function parseChallengeList(input, field, allowEmpty) {
+    const values = typeof input === "string"
+        ? input
+            .split(",")
+            .map((part) => part.trim())
+            .filter(Boolean)
+        : Array.isArray(input)
+            ? input
+            : null;
+    if (!values || (!allowEmpty && values.length < 1) || values.length > 8) {
+        throw new Error(`Access Control ${field} is invalid`);
+    }
+    const result = [];
+    for (const value of values) {
+        if (typeof value !== "string" ||
+            !CHALLENGE_TYPES.includes(value)) {
+            throw new Error(`Access Control ${field} has an unknown challenge type`);
+        }
+        if (result.includes(value)) {
+            throw new Error(`Access Control ${field} contains a duplicate challenge`);
+        }
+        result.push(value);
+    }
+    return result;
+}
+function snowflake(input, field) {
+    if (typeof input !== "string" || !SNOWFLAKE.test(input)) {
+        throw new Error(`Access Control ${field} must be a Discord snowflake`);
+    }
+    return input;
+}
+function optionalSnowflake(input, field) {
+    if (input === undefined || input === null || input === "")
+        return "";
+    return snowflake(input, field);
+}
+function snowflakeList(input, field) {
+    if (!Array.isArray(input) || input.length > 10) {
+        throw new Error(`Access Control ${field} must be a bounded role list`);
+    }
+    const result = input.map((value) => snowflake(value, field));
+    if (new Set(result).size !== result.length) {
+        throw new Error(`Access Control ${field} contains a duplicate role`);
+    }
+    return result;
+}
+function optionalString(input, maximum, field) {
+    if (input === undefined || input === null)
+        return "";
+    if (typeof input !== "string" || input.length > maximum) {
+        throw new Error(`Access Control ${field} must be bounded text`);
+    }
+    return input;
+}
+function integer(input, minimum, maximum, field) {
+    if (!Number.isInteger(input) ||
+        input < minimum ||
+        input > maximum) {
+        throw new Error(`Access Control ${field} must be a whole number from ${minimum} to ${maximum}`);
+    }
+    return input;
+}
+function boolean(input, field) {
+    if (typeof input !== "boolean") {
+        throw new Error(`Access Control ${field} must be boolean`);
+    }
+    return input;
+}
+function oneOf(input, values, field) {
+    if (typeof input !== "string" || !values.includes(input)) {
+        throw new Error(`Access Control ${field} is invalid`);
+    }
+    return input;
+}
+export const STATIC_TYPES = STATIC_CHALLENGE_TYPES;
+//# sourceMappingURL=configuration.js.map