@helyx/module-account-gate 1.0.12 → 1.0.14

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.0.14
+
+### Patch Changes
+
+- Move Access Control commands beneath `/access control` and register them only for servers where the module is selected.
+- Emit the declared completion and kick Logging events for automatic, staff and recovery outcomes.
+
+## 1.0.13
+
+### Patch Changes
+
+- Consolidate the module database migration history into a clean one-file baseline for the planned database rebuild.
+
 ## 1.0.12
 
 ### Patch Changes

package/README.md

@@ -72,7 +72,7 @@ Password Entry and Emoji Entry are single-step access types rather than members
 of a generated challenge chain. Helyx sends answer-free private resume guidance
 that identifies the Discord server and gate channel. Closed direct messages
 never cause user-specific controls or answers to be posted publicly; the member
-can use the panel or `/access-control start` to resume the persisted check.
+can use the panel or `/access control start` to resume the persisted check.
 
 ## Stored data
 
@@ -85,6 +85,6 @@ erasure.
 
 ## Release state
 
-Version 1.0.0 is private and in Testing. Live Discord validation has not yet
-been performed. Runtime enforcement rechecks module state, member state, kick
-permission and role hierarchy immediately before every kick.
+Access Control is a Live Helyx module. Runtime enforcement rechecks module
+state, member state, kick permission and role hierarchy immediately before
+every kick.

package/dist/commands.d.ts

@@ -1,10 +1,10 @@
-import type { CommandContribution, CommandInteractionContext } from "@helyx/sdk";
+import type { CommandInteractionContext, SharedCommandContribution } from "@helyx/sdk";
 type CommandHandler = (context: CommandInteractionContext) => Promise<void>;
 export declare function accountGateCommands(handlers: {
     start: CommandHandler;
     reset: CommandHandler;
     status: CommandHandler;
     strict: CommandHandler;
-}): readonly CommandContribution[];
+}): readonly SharedCommandContribution[];
 export {};
 //# sourceMappingURL=commands.d.ts.map

package/dist/commands.js

@@ -1,39 +1,37 @@
 export function accountGateCommands(handlers) {
     return [
         {
-            name: "access-control",
-            description: "Start or manage the server's Access Control checks",
+            family: "access",
+            path: "control.start",
+            description: "Start or resume your Access Control check",
             acknowledgement: "deferred-ephemeral",
-            registration: "global",
-            contexts: ["guild"],
-            integrationTypes: ["guild_install"],
-            subcommands: [
-                {
-                    name: "start",
-                    description: "Start or resume your Access Control check",
-                    rateLimit: { scope: "user", limit: 5, windowSeconds: 60 },
-                    execute: handlers.start,
-                },
-                {
-                    name: "reset",
-                    description: "Revoke your access and complete the gate again",
-                    permissionId: "account-gate.reset",
-                    rateLimit: { scope: "user", limit: 10, windowSeconds: 60 },
-                    execute: handlers.reset,
-                },
-                {
-                    name: "status",
-                    description: "Show Access Control health and strict-mode status",
-                    permissionId: "account-gate.manage",
-                    execute: handlers.status,
-                },
-                {
-                    name: "strict",
-                    description: "Activate temporary strict mode",
-                    permissionId: "account-gate.manage",
-                    execute: handlers.strict,
-                },
-            ],
+            rateLimit: { scope: "user", limit: 5, windowSeconds: 60 },
+            execute: handlers.start,
+        },
+        {
+            family: "access",
+            path: "control.reset",
+            description: "Revoke your access and complete the gate again",
+            acknowledgement: "deferred-ephemeral",
+            permissionId: "account-gate.reset",
+            rateLimit: { scope: "user", limit: 10, windowSeconds: 60 },
+            execute: handlers.reset,
+        },
+        {
+            family: "access",
+            path: "control.status",
+            description: "Show Access Control health and strict-mode status",
+            acknowledgement: "deferred-ephemeral",
+            permissionId: "account-gate.manage",
+            execute: handlers.status,
+        },
+        {
+            family: "access",
+            path: "control.strict",
+            description: "Activate temporary strict mode",
+            acknowledgement: "deferred-ephemeral",
+            permissionId: "account-gate.manage",
+            execute: handlers.strict,
         },
     ];
 }

package/dist/contracts.d.ts

@@ -2,7 +2,7 @@ export declare const ACCOUNT_GATE_IDENTITY: {
     readonly packageName: "@helyx/module-account-gate";
     readonly moduleId: "helyx.account-gate";
     readonly name: "Access Control";
-    readonly version: "1.0.12";
+    readonly version: "1.0.14";
     readonly releaseStatus: "live";
     readonly category: "safety";
     readonly icon: "shield-check";

package/dist/contracts.js

@@ -2,7 +2,7 @@ export const ACCOUNT_GATE_IDENTITY = {
     packageName: "@helyx/module-account-gate",
     moduleId: "helyx.account-gate",
     name: "Access Control",
-    version: "1.0.12",
+    version: "1.0.14",
     releaseStatus: "live",
     category: "safety",
     icon: "shield-check",

package/dist/index.js

@@ -14,6 +14,7 @@ import { gatePanelResource, getGatePanelRuntime, hasPasswordGatePanel, } from ".
 import { isAccountGateWorkSuppressed } from "./privacy.js";
 import { applyChallengeAction, createAccountGateSessionState, parseAccountGateSessionState, rerollForAccessibility, } from "./workflow.js";
 import { accountGateCommands } from "./commands.js";
+import { accountGateLogging, emitAccountGateCompletedLog, emitAccountGateKickLog, emitLog, successfulKickOutcome, } from "./logging.js";
 const manifest = parseModuleManifest(JSON.parse(readFileSync(new URL("../manifest.json", import.meta.url), "utf8")));
 const VIOLET = 0x7c3aed;
 const GREEN = 0x16a34a;
@@ -49,7 +50,7 @@ export const accountGateModule = defineModule({
     async validateActivation(context) {
         const configuration = await getConfiguration(context.services, context.guildId);
         if (!configuration)
-            throw new ModuleStateValidationError("Save Access Control settings before enabling the module.");
+            return;
         const errors = await validateAccountGateSetup(context.services, context.guildId, configuration, false, true);
         if (errors.length > 0)
             throw new ModuleStateValidationError(errors[0]);
@@ -82,47 +83,14 @@ export const accountGateModule = defineModule({
         accountGateMemberResource,
         serverQuestionResource,
     ],
-    logging: {
-        events: [
-            {
-                id: "account-gate-completed",
-                name: "Account gate completed",
-                description: "Records successful completion using IDs and bounded outcome metadata.",
-                defaultEnabled: true,
-            },
-            {
-                id: "account-gate-review-created",
-                name: "Account gate review created",
-                description: "Records a staff-review request without copying challenge answers.",
-                defaultEnabled: true,
-            },
-            {
-                id: "account-gate-kicked",
-                name: "Account gate kick",
-                description: "Records the bounded enforcement and direct-message outcomes.",
-                defaultEnabled: true,
-            },
-            {
-                id: "account-gate-strict-mode-changed",
-                name: "Account gate strict mode changed",
-                description: "Records authorised strict-mode activation or automatic expiry.",
-                defaultEnabled: true,
-            },
-            {
-                id: "account-gate-resume-notice",
-                name: "Account gate resume notice",
-                description: "Records only whether private resume guidance could be delivered after a static gate.",
-                defaultEnabled: true,
-            },
-        ],
-    },
+    sharedCommands: accountGateCommands({
+        start: startCheck,
+        reset: resetOwnAccess,
+        status: showStatus,
+        strict: activateStrictModeCommand,
+    }),
+    logging: accountGateLogging,
     interactions: {
-        commands: accountGateCommands({
-            start: startCheck,
-            reset: resetOwnAccess,
-            status: showStatus,
-            strict: activateStrictModeCommand,
-        }),
         buttons: [
             {
                 customId: ACCOUNT_GATE_COMPONENTS.start,
@@ -167,6 +135,7 @@ export const accountGateModule = defineModule({
         modals: [
             {
                 customIdPrefix: ACCOUNT_GATE_COMPONENTS.recallSubmitPrefix,
+                acknowledgement: "deferred-ephemeral",
                 execute: submitRecallModal,
             },
         ],
@@ -920,20 +889,9 @@ async function rerollChallenge(context) {
 async function openRecallModal(context) {
     if (!context.serverId)
         return replyError(context, "This check is unavailable.");
-    const session = await context.services
-        .get(HELYX_SERVICE_NAMES.sessions)
-        .getFor(context.serverId, context.userId, ACCOUNT_GATE_SESSION_PURPOSE);
     const binding = parseComponentBinding(context.customId, ACCOUNT_GATE_COMPONENTS.recallOpenPrefix);
-    const state = session ? parseAccountGateSessionState(session.state) : null;
-    if (!session ||
-        !state ||
-        !binding ||
-        binding.sessionId !== session.sessionId ||
-        binding.version !== session.version ||
-        binding.step !== state.step ||
-        state.chain[state.currentStep]?.type !== "modal_recall") {
+    if (!binding)
         return replyError(context, "This recall challenge has expired.");
-    }
     await context.showModal({
         customId: boundComponentId(ACCOUNT_GATE_COMPONENTS.recallSubmitPrefix, binding),
         title: "Enter the recalled code",
@@ -949,10 +907,30 @@ async function openRecallModal(context) {
             },
         ],
     });
-    await context.editSourceMessage?.(challengeMessage(state, {
+    let session;
+    try {
+        session = await context.services
+            .get(HELYX_SERVICE_NAMES.sessions)
+            .getFor(context.serverId, context.userId, ACCOUNT_GATE_SESSION_PURPOSE);
+    }
+    catch {
+        return;
+    }
+    const state = session ? parseAccountGateSessionState(session.state) : null;
+    if (!session ||
+        !state ||
+        binding.sessionId !== session.sessionId ||
+        binding.version !== session.version ||
+        binding.step !== state.step ||
+        state.chain[state.currentStep]?.type !== "modal_recall") {
+        return;
+    }
+    await context
+        .editSourceMessage?.(challengeMessage(state, {
         sessionId: session.sessionId,
         version: session.version,
-    }, { redactRecallCode: true }));
+    }, { redactRecallCode: true }))
+        .catch(() => undefined);
 }
 async function submitRecallModal(context) {
     const binding = parseComponentBinding(context.customId, ACCOUNT_GATE_COMPONENTS.recallSubmitPrefix);
@@ -1478,7 +1456,15 @@ async function enforceJoinDeadline(context, task) {
             },
         });
         if (["kicked", "member_missing"].includes(result.outcome)) {
-            await setSummaryDecision(records, guildId, memberUserId, generation, "kicked", "kick_pending");
+            const committed = await setSummaryDecision(records, guildId, memberUserId, generation, "kicked", "kick_pending");
+            if (committed)
+                await emitAccountGateKickLog(context.services, guildId, {
+                    memberUserId,
+                    outcome: successfulKickOutcome(result.outcome),
+                    directMessage: result.directMessage,
+                    source: "Join deadline",
+                    idempotencyKey: `account-gate-kick:deadline:${memberUserId}:${generation}`,
+                });
         }
     }
     return { outcome: "completed" };
@@ -1699,6 +1685,11 @@ async function finalizeTerminalFinalization(services, guildId, finalizationId) {
     const sessions = services.get(HELYX_SERVICE_NAMES.sessions);
     if (row.outcome === "passed") {
         if (summary.last_decision === "passed") {
+            await emitAccountGateCompletedLog(services, guildId, {
+                memberUserId,
+                roleOutcome: "already_applied",
+                idempotencyKey: `account-gate-completed:${finalizationId}`,
+            });
             await sessions.delete(stringValue(row.session_id));
             await finishTerminalRecord(records, row, "completed");
             return;
@@ -1728,6 +1719,11 @@ async function finalizeTerminalFinalization(services, guildId, finalizationId) {
                 await finishTerminalRecord(records, row, "cancelled");
                 return;
             }
+            await emitAccountGateCompletedLog(services, guildId, {
+                memberUserId,
+                roleOutcome: transition.outcome,
+                idempotencyKey: `account-gate-completed:${finalizationId}`,
+            });
         }
     }
     else {
@@ -1761,7 +1757,7 @@ async function applyDurableFailureAction(services, configuration, guildId, membe
     if (configuration.failureAction !== "kick")
         return;
     const records = services.get(HELYX_SERVICE_NAMES.records);
-    await services
+    const result = await services
         .get(HELYX_SERVICE_NAMES.memberEnforcement)
         .kick({
         guildId,
@@ -1799,6 +1795,14 @@ async function applyDurableFailureAction(services, configuration, guildId, membe
             return !(await isAccountGateWorkSuppressed(services, guildId, memberUserId, dateValue(terminal.work_created_at) ?? new Date(0)));
         },
     });
+    if (["kicked", "member_missing"].includes(result.outcome))
+        await emitAccountGateKickLog(services, guildId, {
+            memberUserId,
+            outcome: successfulKickOutcome(result.outcome),
+            directMessage: result.directMessage,
+            source: "Failed check",
+            idempotencyKey: `account-gate-kick:terminal:${stringValue(terminal.finalization_id)}`,
+        });
 }
 function validateReviewDeliveryPayload(input) {
     if (!input || typeof input !== "object" || Array.isArray(input))
@@ -1932,6 +1936,7 @@ async function recoverReviewClaim(context, task) {
     }
     const action = stringValue(row.claim_action);
     if (action === "approve") {
+        let completionRoleOutcome = null;
         if (summary.last_decision !== "passed") {
             const snapshots = await context.services
                 .get(HELYX_SERVICE_NAMES.discordResources)
@@ -1969,8 +1974,15 @@ async function recoverReviewClaim(context, task) {
                 await finalizeReviewClaim(records, guildId, reviewId, claimRevision, "dismissed", row);
                 return { outcome: "completed" };
             }
+            completionRoleOutcome = transition.outcome;
         }
-        await finalizeReviewClaim(records, guildId, reviewId, claimRevision, "approved", row);
+        const finalized = await finalizeReviewClaim(records, guildId, reviewId, claimRevision, "approved", row);
+        if (finalized && completionRoleOutcome)
+            await emitAccountGateCompletedLog(context.services, guildId, {
+                memberUserId,
+                roleOutcome: completionRoleOutcome,
+                idempotencyKey: `account-gate-completed:review:${reviewId}`,
+            });
         return { outcome: "completed" };
     }
     if (action === "retry") {
@@ -1988,6 +2000,8 @@ async function recoverReviewClaim(context, task) {
         const snapshots = await context.services
             .get(HELYX_SERVICE_NAMES.discordResources)
             .resolveMemberSnapshots({ guildId, userIds: [memberUserId] });
+        let kickOutcome = "member_missing";
+        let directMessage = "not_requested";
         if (snapshots[0]?.exists === true) {
             const result = await context.services
                 .get(HELYX_SERVICE_NAMES.memberEnforcement)
@@ -2016,8 +2030,18 @@ async function recoverReviewClaim(context, task) {
                         delayMs: 30_000,
                         safeCode: "review-kick-not-complete",
                     };
+            kickOutcome = successfulKickOutcome(result.outcome);
+            directMessage = result.directMessage;
         }
-        await finalizeReviewClaim(records, guildId, reviewId, claimRevision, "kicked", row);
+        const finalized = await finalizeReviewClaim(records, guildId, reviewId, claimRevision, "kicked", row);
+        if (finalized)
+            await emitAccountGateKickLog(context.services, guildId, {
+                memberUserId,
+                outcome: kickOutcome,
+                directMessage,
+                source: "Staff review recovery",
+                idempotencyKey: `account-gate-kick:review:${reviewId}`,
+            });
         return { outcome: "completed" };
     }
     await finalizeReviewClaim(records, guildId, reviewId, claimRevision, "dismissed", row);
@@ -2344,6 +2368,8 @@ async function handleReviewDecision(context, decision) {
         return;
     }
     let status;
+    let completionRoleOutcome = null;
+    let kickResult = null;
     if (decision === "approve") {
         const transition = await applyRoleTransition({
             guildId: context.serverId,
@@ -2372,6 +2398,7 @@ async function handleReviewDecision(context, decision) {
             await replyError(context, "The member rejoined before approval completed; the old review was dismissed.");
             return;
         }
+        completionRoleOutcome = transition.outcome;
         status = "approved";
     }
     else if (decision === "retry") {
@@ -2436,6 +2463,10 @@ async function handleReviewDecision(context, decision) {
             await replyError(context, `The member was not kicked (${result.outcome.replaceAll("_", " ")}). The claimed decision remains queued for safe recovery.`);
             return;
         }
+        kickResult = {
+            outcome: successfulKickOutcome(result.outcome),
+            directMessage: result.directMessage,
+        };
         status = "kicked";
     }
     else {
@@ -2476,6 +2507,19 @@ async function handleReviewDecision(context, decision) {
         await replyError(context, "This review changed in another session. Reload it before trying again.");
         return;
     }
+    if (status === "kicked" && kickResult)
+        await emitAccountGateKickLog(context.services, context.serverId, {
+            memberUserId,
+            ...kickResult,
+            source: "Staff review",
+            idempotencyKey: `account-gate-kick:review:${stringValue(row.review_id)}`,
+        });
+    if (status === "approved" && completionRoleOutcome)
+        await emitAccountGateCompletedLog(context.services, context.serverId, {
+            memberUserId,
+            roleOutcome: completionRoleOutcome,
+            idempotencyKey: `account-gate-completed:review:${stringValue(row.review_id)}`,
+        });
     if (context.channelId) {
         await context.editChannelMessage(context.channelId, context.messageId, {
             allowedUserMentionIds: [],
@@ -2937,22 +2981,6 @@ function secureRandom(services) {
         },
     };
 }
-async function emitLog(services, guildId, input) {
-    if (!services.has(HELYX_SERVICE_NAMES.moduleLogging))
-        return;
-    try {
-        await services
-            .get(HELYX_SERVICE_NAMES.moduleLogging)
-            .emit({
-            guildId,
-            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
-            ...input,
-        });
-    }
-    catch {
-        // Customer logging is optional and must not block the gate.
-    }
-}
 async function replyError(context, description) {
     await context.reply({
         ephemeral: true,

package/dist/logging.d.ts

@@ -0,0 +1,44 @@
+import type { DirectMessageOutcome, MemberEnforcementOutcome, ModuleLoggingService, ServiceAccess } from "@helyx/sdk";
+export declare const accountGateLogging: {
+    readonly events: readonly [{
+        readonly id: "account-gate-completed";
+        readonly name: "Account gate completed";
+        readonly description: "Records successful completion using IDs and bounded outcome metadata.";
+        readonly defaultEnabled: true;
+    }, {
+        readonly id: "account-gate-review-created";
+        readonly name: "Account gate review created";
+        readonly description: "Records a staff-review request without copying challenge answers.";
+        readonly defaultEnabled: true;
+    }, {
+        readonly id: "account-gate-kicked";
+        readonly name: "Account gate kick";
+        readonly description: "Records the bounded enforcement and direct-message outcomes.";
+        readonly defaultEnabled: true;
+    }, {
+        readonly id: "account-gate-strict-mode-changed";
+        readonly name: "Account gate strict mode changed";
+        readonly description: "Records authorised strict-mode activation or automatic expiry.";
+        readonly defaultEnabled: true;
+    }, {
+        readonly id: "account-gate-resume-notice";
+        readonly name: "Account gate resume notice";
+        readonly description: "Records only whether private resume guidance could be delivered after a static gate.";
+        readonly defaultEnabled: true;
+    }];
+};
+export declare function successfulKickOutcome(outcome: MemberEnforcementOutcome): Extract<MemberEnforcementOutcome, "kicked" | "member_missing">;
+export declare function emitAccountGateCompletedLog(services: ServiceAccess, guildId: string, input: {
+    memberUserId: string;
+    roleOutcome: string;
+    idempotencyKey: string;
+}): Promise<void>;
+export declare function emitAccountGateKickLog(services: ServiceAccess, guildId: string, input: {
+    memberUserId: string;
+    outcome: Extract<MemberEnforcementOutcome, "kicked" | "member_missing">;
+    directMessage: DirectMessageOutcome;
+    source: string;
+    idempotencyKey: string;
+}): Promise<void>;
+export declare function emitLog(services: ServiceAccess, guildId: string, input: Omit<Parameters<ModuleLoggingService["emit"]>[0], "guildId" | "moduleId">): Promise<void>;
+//# sourceMappingURL=logging.d.ts.map

package/dist/logging.js

@@ -0,0 +1,84 @@
+import { HELYX_SERVICE_NAMES } from "@helyx/sdk";
+import { ACCOUNT_GATE_IDENTITY } from "./contracts.js";
+export const accountGateLogging = {
+    events: [
+        {
+            id: "account-gate-completed",
+            name: "Account gate completed",
+            description: "Records successful completion using IDs and bounded outcome metadata.",
+            defaultEnabled: true,
+        },
+        {
+            id: "account-gate-review-created",
+            name: "Account gate review created",
+            description: "Records a staff-review request without copying challenge answers.",
+            defaultEnabled: true,
+        },
+        {
+            id: "account-gate-kicked",
+            name: "Account gate kick",
+            description: "Records the bounded enforcement and direct-message outcomes.",
+            defaultEnabled: true,
+        },
+        {
+            id: "account-gate-strict-mode-changed",
+            name: "Account gate strict mode changed",
+            description: "Records authorised strict-mode activation or automatic expiry.",
+            defaultEnabled: true,
+        },
+        {
+            id: "account-gate-resume-notice",
+            name: "Account gate resume notice",
+            description: "Records only whether private resume guidance could be delivered after a static gate.",
+            defaultEnabled: true,
+        },
+    ],
+};
+export function successfulKickOutcome(outcome) {
+    if (outcome !== "kicked" && outcome !== "member_missing")
+        throw new Error("Access Control kick outcome is not successful");
+    return outcome;
+}
+export async function emitAccountGateCompletedLog(services, guildId, input) {
+    await emitLog(services, guildId, {
+        eventId: "account-gate-completed",
+        summary: "A member completed Access Control.",
+        details: [
+            { label: "Member ID", value: input.memberUserId },
+            { label: "Role update", value: input.roleOutcome },
+        ],
+        idempotencyKey: input.idempotencyKey,
+    });
+}
+export async function emitAccountGateKickLog(services, guildId, input) {
+    await emitLog(services, guildId, {
+        eventId: "account-gate-kicked",
+        summary: input.outcome === "kicked"
+            ? "Access Control removed a member from the server."
+            : "Access Control found that the member had already left the server.",
+        details: [
+            { label: "Member ID", value: input.memberUserId },
+            { label: "Outcome", value: input.outcome },
+            { label: "Direct message", value: input.directMessage },
+            { label: "Source", value: input.source },
+        ],
+        idempotencyKey: input.idempotencyKey,
+    });
+}
+export async function emitLog(services, guildId, input) {
+    if (!services.has(HELYX_SERVICE_NAMES.moduleLogging))
+        return;
+    try {
+        await services
+            .get(HELYX_SERVICE_NAMES.moduleLogging)
+            .emit({
+            guildId,
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            ...input,
+        });
+    }
+    catch {
+        // Customer logging is optional and must not block the gate.
+    }
+}
+//# sourceMappingURL=logging.js.map

package/manifest.json

@@ -3,7 +3,7 @@
   "releaseStatus": "live",
   "id": "helyx.account-gate",
   "name": "Access Control",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Require new members to complete configurable Discord interaction checks before gaining access.",
   "entry": "./dist/index.js",
   "framework": "^0.1.0",
@@ -732,7 +732,12 @@
     ]
   },
   "contributions": {
-    "commands": ["access-control"],
+    "commands": [
+      "access.control.start",
+      "access.control.reset",
+      "access.control.status",
+      "access.control.strict"
+    ],
     "events": [
       "discord.guild-member-add",
       "discord.guild-member-remove",

package/migrations/0001_account_gate_foundation.sql

@@ -1,3 +1,5 @@
+-- Baseline source: 0001_account_gate_foundation.sql
+
 CREATE TABLE IF NOT EXISTS account_gate_gate_panels (
   panel_id text PRIMARY KEY,
   guild_id text NOT NULL UNIQUE,
@@ -9,13 +11,6 @@ CREATE TABLE IF NOT EXISTS account_gate_gate_panels (
   CHECK (updated_at >= created_at)
 );
 
-CREATE TABLE IF NOT EXISTS account_gate_public_channels (
-  guild_id text NOT NULL,
-  channel_id text NOT NULL,
-  created_at timestamptz NOT NULL,
-  PRIMARY KEY (guild_id, channel_id)
-);
-
 CREATE TABLE IF NOT EXISTS account_gate_questions (
   question_id text PRIMARY KEY,
   guild_id text NOT NULL,
@@ -48,17 +43,6 @@ CREATE INDEX IF NOT EXISTS account_gate_question_creator_privacy_idx
     attribution_id
   );
 
-CREATE TABLE IF NOT EXISTS account_gate_password_secrets (
-  guild_id text PRIMARY KEY,
-  encoded_hash text NOT NULL,
-  ignore_case boolean NOT NULL,
-  trim_whitespace boolean NOT NULL,
-  revision integer NOT NULL CHECK (revision > 0),
-  created_at timestamptz NOT NULL,
-  updated_at timestamptz NOT NULL,
-  CHECK (updated_at >= created_at)
-);
-
 CREATE TABLE IF NOT EXISTS account_gate_attempts (
   attempt_id text PRIMARY KEY,
   guild_id text NOT NULL,
@@ -301,3 +285,152 @@ DROP TRIGGER IF EXISTS account_gate_terminal_privacy_suppressed
 CREATE TRIGGER account_gate_terminal_privacy_suppressed
 AFTER DELETE ON account_gate_terminal_finalizations
 FOR EACH ROW EXECUTE FUNCTION account_gate_install_privacy_suppression();
+
+-- Baseline source: 0002_account_gate_panel_message.sql
+
+ALTER TABLE account_gate_gate_panels
+  ADD COLUMN IF NOT EXISTS message_body text;
+
+UPDATE account_gate_gate_panels
+SET message_body =
+  'Complete a short human-interaction check to access the server. Press the button below when you are ready.'
+WHERE message_body IS NULL;
+
+ALTER TABLE account_gate_gate_panels
+  ALTER COLUMN message_body SET DEFAULT
+    'Complete a short human-interaction check to access the server. Press the button below when you are ready.',
+  ALTER COLUMN message_body SET NOT NULL;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'account_gate_gate_panels_message_body_length'
+      AND conrelid = 'account_gate_gate_panels'::regclass
+  ) THEN
+    ALTER TABLE account_gate_gate_panels
+      ADD CONSTRAINT account_gate_gate_panels_message_body_length
+      CHECK (char_length(message_body) BETWEEN 1 AND 1000);
+  END IF;
+END
+$$;
+
+-- Baseline source: 0003_account_gate_revoked_member_status.sql
+
+DO $$
+BEGIN
+  IF to_regclass('account_gate_member_summaries') IS NOT NULL THEN
+    ALTER TABLE account_gate_member_summaries
+      DROP CONSTRAINT IF EXISTS account_gate_member_summaries_last_decision_check;
+
+    ALTER TABLE account_gate_member_summaries
+      ADD CONSTRAINT account_gate_member_summaries_last_decision_check
+      CHECK (
+        last_decision IN (
+          'pending', 'finalizing', 'passed', 'failed', 'review', 'kick_pending',
+          'kicked', 'dismissed', 'revoked'
+        )
+      );
+  END IF;
+END
+$$;
+
+-- Baseline source: 0004_account_gate_multiple_panels.sql
+
+ALTER TABLE account_gate_gate_panels
+  ADD COLUMN IF NOT EXISTS access_type text NOT NULL DEFAULT 'challenges';
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'account_gate_gate_panels_access_type'
+      AND conrelid = 'account_gate_gate_panels'::regclass
+  ) THEN
+    ALTER TABLE account_gate_gate_panels
+      ADD CONSTRAINT account_gate_gate_panels_access_type
+      CHECK (access_type IN ('challenges', 'password', 'emoji'));
+  END IF;
+END
+$$;
+
+ALTER TABLE account_gate_gate_panels
+  DROP CONSTRAINT IF EXISTS account_gate_gate_panels_guild_id_key;
+
+CREATE INDEX IF NOT EXISTS account_gate_gate_panels_guild_idx
+  ON account_gate_gate_panels (guild_id, created_at, panel_id);
+
+-- Baseline source: 0005_account_gate_panel_passwords.sql
+
+ALTER TABLE account_gate_gate_panels
+  ADD COLUMN IF NOT EXISTS password_hash text,
+  ADD COLUMN IF NOT EXISTS password_ignore_case boolean NOT NULL DEFAULT true,
+  ADD COLUMN IF NOT EXISTS password_trim_whitespace boolean NOT NULL DEFAULT true;
+
+CREATE OR REPLACE FUNCTION account_gate_enforce_panel_limit()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  PERFORM pg_advisory_xact_lock(
+    hashtextextended(NEW.guild_id, 4815162342)
+  );
+
+  IF (
+    SELECT count(*)
+    FROM account_gate_gate_panels
+    WHERE guild_id = NEW.guild_id
+  ) >= 10 THEN
+    RAISE EXCEPTION USING
+      ERRCODE = 'check_violation',
+      MESSAGE = 'Account Gate panel limit reached';
+  END IF;
+
+  RETURN NEW;
+END
+$$;
+
+DROP TRIGGER IF EXISTS account_gate_gate_panels_limit
+  ON account_gate_gate_panels;
+
+CREATE TRIGGER account_gate_gate_panels_limit
+BEFORE INSERT ON account_gate_gate_panels
+FOR EACH ROW
+EXECUTE FUNCTION account_gate_enforce_panel_limit();
+
+-- Baseline source: 0007_privacy_suppression_trigger_privileges.sql
+
+-- Privacy erasure deletes Account Gate subject rows through a deliberately
+-- column-scoped executor role. The deletion triggers must still be able to
+-- write the suppression tombstone that prevents erased data being recreated.
+CREATE OR REPLACE FUNCTION public.account_gate_install_privacy_suppression()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, public
+AS $$
+BEGIN
+  INSERT INTO public.account_gate_privacy_suppressions (
+    suppression_id,
+    guild_id,
+    member_user_id,
+    suppressed_at,
+    created_at
+  )
+  VALUES (
+    OLD.guild_id || ':' || OLD.member_user_id,
+    OLD.guild_id,
+    OLD.member_user_id,
+    clock_timestamp(),
+    clock_timestamp()
+  )
+  ON CONFLICT (guild_id, member_user_id)
+  DO UPDATE SET suppressed_at = GREATEST(
+    public.account_gate_privacy_suppressions.suppressed_at,
+    EXCLUDED.suppressed_at
+  );
+  RETURN OLD;
+END;
+$$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/module-account-gate",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Require configurable Discord interaction checks before new members gain access.",
   "keywords": [
     "helyx",
@@ -49,6 +49,6 @@
   },
   "dependencies": {
     "@helyx/module-manifest": ">=0.7.0 <0.8.0",
-    "@helyx/sdk": ">=0.8.0 <0.9.0"
+    "@helyx/sdk": ">=0.8.4 <0.9.0"
   }
 }

package/migrations/0002_account_gate_panel_message.sql

@@ -1,27 +0,0 @@
-ALTER TABLE account_gate_gate_panels
-  ADD COLUMN IF NOT EXISTS message_body text;
-
-UPDATE account_gate_gate_panels
-SET message_body =
-  'Complete a short human-interaction check to access the server. Press the button below when you are ready.'
-WHERE message_body IS NULL;
-
-ALTER TABLE account_gate_gate_panels
-  ALTER COLUMN message_body SET DEFAULT
-    'Complete a short human-interaction check to access the server. Press the button below when you are ready.',
-  ALTER COLUMN message_body SET NOT NULL;
-
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1
-    FROM pg_constraint
-    WHERE conname = 'account_gate_gate_panels_message_body_length'
-      AND conrelid = 'account_gate_gate_panels'::regclass
-  ) THEN
-    ALTER TABLE account_gate_gate_panels
-      ADD CONSTRAINT account_gate_gate_panels_message_body_length
-      CHECK (char_length(message_body) BETWEEN 1 AND 1000);
-  END IF;
-END
-$$;

package/migrations/0003_account_gate_revoked_member_status.sql

@@ -1,17 +0,0 @@
-DO $$
-BEGIN
-  IF to_regclass('account_gate_member_summaries') IS NOT NULL THEN
-    ALTER TABLE account_gate_member_summaries
-      DROP CONSTRAINT IF EXISTS account_gate_member_summaries_last_decision_check;
-
-    ALTER TABLE account_gate_member_summaries
-      ADD CONSTRAINT account_gate_member_summaries_last_decision_check
-      CHECK (
-        last_decision IN (
-          'pending', 'finalizing', 'passed', 'failed', 'review', 'kick_pending',
-          'kicked', 'dismissed', 'revoked'
-        )
-      );
-  END IF;
-END
-$$;

package/migrations/0004_account_gate_multiple_panels.sql

@@ -1,23 +0,0 @@
-ALTER TABLE account_gate_gate_panels
-  ADD COLUMN IF NOT EXISTS access_type text NOT NULL DEFAULT 'challenges';
-
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1
-    FROM pg_constraint
-    WHERE conname = 'account_gate_gate_panels_access_type'
-      AND conrelid = 'account_gate_gate_panels'::regclass
-  ) THEN
-    ALTER TABLE account_gate_gate_panels
-      ADD CONSTRAINT account_gate_gate_panels_access_type
-      CHECK (access_type IN ('challenges', 'password', 'emoji'));
-  END IF;
-END
-$$;
-
-ALTER TABLE account_gate_gate_panels
-  DROP CONSTRAINT IF EXISTS account_gate_gate_panels_guild_id_key;
-
-CREATE INDEX IF NOT EXISTS account_gate_gate_panels_guild_idx
-  ON account_gate_gate_panels (guild_id, created_at, panel_id);

package/migrations/0005_account_gate_panel_passwords.sql

@@ -1,45 +0,0 @@
-ALTER TABLE account_gate_gate_panels
-  ADD COLUMN IF NOT EXISTS password_hash text,
-  ADD COLUMN IF NOT EXISTS password_ignore_case boolean NOT NULL DEFAULT true,
-  ADD COLUMN IF NOT EXISTS password_trim_whitespace boolean NOT NULL DEFAULT true;
-
-UPDATE account_gate_gate_panels AS panel
-SET
-  password_hash = secret.encoded_hash,
-  password_ignore_case = secret.ignore_case,
-  password_trim_whitespace = secret.trim_whitespace
-FROM account_gate_password_secrets AS secret
-WHERE panel.guild_id = secret.guild_id
-  AND panel.access_type = 'password'
-  AND panel.password_hash IS NULL;
-
-CREATE OR REPLACE FUNCTION account_gate_enforce_panel_limit()
-RETURNS trigger
-LANGUAGE plpgsql
-AS $$
-BEGIN
-  PERFORM pg_advisory_xact_lock(
-    hashtextextended(NEW.guild_id, 4815162342)
-  );
-
-  IF (
-    SELECT count(*)
-    FROM account_gate_gate_panels
-    WHERE guild_id = NEW.guild_id
-  ) >= 10 THEN
-    RAISE EXCEPTION USING
-      ERRCODE = 'check_violation',
-      MESSAGE = 'Account Gate panel limit reached';
-  END IF;
-
-  RETURN NEW;
-END
-$$;
-
-DROP TRIGGER IF EXISTS account_gate_gate_panels_limit
-  ON account_gate_gate_panels;
-
-CREATE TRIGGER account_gate_gate_panels_limit
-BEFORE INSERT ON account_gate_gate_panels
-FOR EACH ROW
-EXECUTE FUNCTION account_gate_enforce_panel_limit();

package/migrations/0006_remove_legacy_gate_storage.sql

@@ -1,2 +0,0 @@
-DROP TABLE IF EXISTS account_gate_public_channels;
-DROP TABLE IF EXISTS account_gate_password_secrets;

package/migrations/0007_privacy_suppression_trigger_privileges.sql

@@ -1,32 +0,0 @@
--- Privacy erasure deletes Account Gate subject rows through a deliberately
--- column-scoped executor role. The deletion triggers must still be able to
--- write the suppression tombstone that prevents erased data being recreated.
-CREATE OR REPLACE FUNCTION public.account_gate_install_privacy_suppression()
-RETURNS trigger
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog, public
-AS $$
-BEGIN
-  INSERT INTO public.account_gate_privacy_suppressions (
-    suppression_id,
-    guild_id,
-    member_user_id,
-    suppressed_at,
-    created_at
-  )
-  VALUES (
-    OLD.guild_id || ':' || OLD.member_user_id,
-    OLD.guild_id,
-    OLD.member_user_id,
-    clock_timestamp(),
-    clock_timestamp()
-  )
-  ON CONFLICT (guild_id, member_user_id)
-  DO UPDATE SET suppressed_at = GREATEST(
-    public.account_gate_privacy_suppressions.suppressed_at,
-    EXCLUDED.suppressed_at
-  );
-  RETURN OLD;
-END;
-$$;