security hardening

services/channelQueue.js

@@ -95,4 +95,20 @@ function enqueueMove(channel, categoryId) {
   return channel.setParent(categoryId, { lockPermissions: true });
 }
 
-module.exports = { enqueueRename, enqueueMove };
+// Per-channel promise chain for send ordering and to prevent interleaving.
+const sendChains = new Map();
+
+function enqueueSend(channel, ...args) {
+  if (!channel || typeof channel.send !== 'function') {
+    return Promise.reject(new Error('enqueueSend: invalid channel'));
+  }
+  const prev = sendChains.get(channel.id) || Promise.resolve();
+  const next = prev.catch(() => {}).then(() => channel.send(...args));
+  sendChains.set(channel.id, next);
+  next.catch(() => {}).finally(() => {
+    if (sendChains.get(channel.id) === next) sendChains.delete(channel.id);
+  });
+  return next;
+}
+
+module.exports = { enqueueRename, enqueueMove, enqueueSend };