@helyx/bot 1.3.1 → 1.4.0

package/dist/creator-invite-service.js

@@ -0,0 +1,686 @@
+import { isCreatorOverviewRouteCode } from "@helyx/control-protocol/creator-overview-routing";
+import { CREATOR_INVITE_REGENERATION_COOLDOWN_MS, CreatorInviteOperationError, HELYX_SERVICE_NAMES, isPublicCreatorRoleEligible, } from "@helyx/sdk";
+import { ChannelType, DiscordAPIError, PermissionFlagsBits, REST, RESTJSONErrorCodes, Routes, } from "discord.js";
+import { createCipheriv, createDecipheriv, createHmac, createHash, randomBytes, randomUUID, } from "node:crypto";
+import { normalizeDiscordPermission } from "./interactions.js";
+import { canAccessModule } from "./premium-access.js";
+import { discordRestOptions } from "./discord-rest.js";
+const MODULE_ID = "helyx.creator-connections";
+const snowflake = /^\d{17,20}$/u;
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+const inviteCode = /^[A-Za-z0-9_-]{1,128}$/u;
+/** Hosted, guild-owning core adapter. Modules never receive its encryption key/store. */
+export class DiscordCreatorInviteService {
+    client;
+    repository;
+    services;
+    module;
+    #key;
+    #rest = null;
+    #cleanupCursor;
+    constructor(client, repository, services, module, encodedEncryptionKey) {
+        this.client = client;
+        this.repository = repository;
+        this.services = services;
+        this.module = module;
+        const rootKey = Buffer.from(encodedEncryptionKey, "base64");
+        if (rootKey.length !== 32)
+            throw new Error("Creator invites require a 32-byte data encryption key");
+        this.#key = createHmac("sha256", rootKey)
+            .update("helyx.creator-owned-invites.v1")
+            .digest();
+    }
+    async selectableRoles(input) {
+        validateId(input.guildId);
+        validateId(input.actorUserId);
+        const guild = this.#ownedGuild(input.guildId);
+        await this.#authorise(guild, input.actorUserId);
+        const permissions = this.services.get(HELYX_SERVICE_NAMES.permissions);
+        if (!permissions.getGuildAccessPolicy)
+            throw new CreatorInviteOperationError("unavailable");
+        const policy = await permissions.getGuildAccessPolicy(guild.id);
+        const roles = await guild.roles.fetch();
+        const me = await guild.members.fetchMe({ force: true });
+        const actor = await guild.members.fetch({
+            user: input.actorUserId,
+            force: true,
+        });
+        return {
+            roleIds: roles
+                .filter((role) => isPublicCreatorRoleEligible({
+                guildId: guild.id,
+                roleId: role.id,
+                name: role.name,
+                exists: true,
+                guildMatches: true,
+                managed: role.managed,
+                everyone: role.id === guild.id,
+                assignable: role.editable,
+                actorAssignable: actor.id === guild.ownerId ||
+                    actor.roles.highest.comparePositionTo(role) > 0,
+                hierarchy: "assignable",
+                permissionNames: role.permissions
+                    .toArray()
+                    .map(normalizeDiscordPermission),
+                dangerousPermissionNames: [],
+            }, policy) && (role.permissions.bitfield & ~me.permissions.bitfield) === 0n)
+                .map((role) => role.id),
+        };
+    }
+    async create(input) {
+        validateId(input.guildId);
+        validateId(input.actorUserId);
+        validateId(input.channelId);
+        validateReference(input.operationId);
+        if (input.replacesReference)
+            validateReference(input.replacesReference);
+        if ((input.purpose === "welcome" && !input.roleId) ||
+            (input.purpose === "overview" && input.roleId !== null) ||
+            !["welcome", "overview"].includes(input.purpose))
+            throw new CreatorInviteOperationError("invalid_role");
+        const guild = this.#ownedGuild(input.guildId);
+        await this.#authorise(guild, input.actorUserId);
+        await this.#validateDestination(guild, input);
+        return this.repository.runGuildExclusive(input.guildId, async (store) => {
+            let record = await store.findByOperation(input.operationId);
+            if (record) {
+                if (record.channelId !== input.channelId ||
+                    record.roleId !== input.roleId ||
+                    record.purpose !== input.purpose ||
+                    record.replacesReference !== (input.replacesReference ?? null))
+                    throw new CreatorInviteOperationError("operation_conflict");
+                if (record.state === "rejected") {
+                    const beforeFingerprints = (await this.#list(record.channelId)).map((invite) => this.#fingerprint(invite.code));
+                    const createdAt = new Date();
+                    await store.retryRejected(record.reference, beforeFingerprints, createdAt);
+                    record = await this.#createIntent(store, {
+                        ...record,
+                        state: "creating",
+                        beforeFingerprints,
+                        createdAt,
+                    });
+                }
+                else if (!record.encryptedCode && record.state !== "revoked")
+                    record = await this.#recover(store, record);
+            }
+            else {
+                const previous = input.replacesReference
+                    ? await store.find(input.replacesReference)
+                    : null;
+                if (input.replacesReference &&
+                    (!previous || previous.purpose !== input.purpose))
+                    throw new CreatorInviteOperationError("not_owned");
+                if (previous && (await store.hasSuccessor(previous.reference)))
+                    throw new CreatorInviteOperationError("operation_conflict");
+                const overviewCooldown = input.purpose === "overview" ? await store.overviewCooldown() : null;
+                if (overviewCooldown && overviewCooldown.getTime() > Date.now())
+                    throw new CreatorInviteOperationError("cooldown", overviewCooldown.toISOString());
+                if (previous?.regenerateAfter &&
+                    previous.regenerateAfter.getTime() > Date.now())
+                    throw new CreatorInviteOperationError("cooldown", previous.regenerateAfter.toISOString());
+                if (!previous &&
+                    input.purpose === "overview" &&
+                    (await store.hasUnfinishedOverview()))
+                    throw new CreatorInviteOperationError("operation_conflict");
+                const before = await this.#list(input.channelId);
+                const now = new Date();
+                record = {
+                    reference: randomUUID(),
+                    operationId: input.operationId,
+                    guildId: input.guildId,
+                    channelId: input.channelId,
+                    roleId: input.roleId,
+                    purpose: input.purpose,
+                    replacesReference: input.replacesReference ?? null,
+                    state: "creating",
+                    beforeFingerprints: before.map((invite) => this.#fingerprint(invite.code)),
+                    encryptedCode: null,
+                    regenerateAfter: previous
+                        ? new Date(now.getTime() + CREATOR_INVITE_REGENERATION_COOLDOWN_MS)
+                        : null,
+                    createdAt: now,
+                };
+                // Commit intent before Discord. Never retry a POST whose result is unknown.
+                await store.insert(record);
+                record = await this.#createIntent(store, record);
+            }
+            if (record.state !== "active")
+                throw new CreatorInviteOperationError("creation_uncertain");
+            await this.#assertOverviewRoutable(store, record);
+            if (record.replacesReference) {
+                const previous = await store.find(record.replacesReference);
+                if (!previous ||
+                    (await this.#revoke(store, previous)).state !== "revoked")
+                    throw new CreatorInviteOperationError("replacement_pending");
+            }
+            return publicInvite(record);
+        });
+    }
+    async inspect(input) {
+        validateId(input.guildId);
+        validateReference(input.reference);
+        this.#ownedGuild(input.guildId);
+        return this.repository.runGuildExclusive(input.guildId, async (store) => {
+            let record = await store.find(input.reference);
+            if (!record)
+                throw new CreatorInviteOperationError("not_owned");
+            if (!record.encryptedCode &&
+                !["revoked", "rejected"].includes(record.state))
+                record = await this.#recover(store, record);
+            if (record.encryptedCode && record.state === "active") {
+                const code = this.#decrypt(record);
+                const invite = (await this.#list(record.channelId)).find((item) => item.code === code);
+                const state = !invite
+                    ? "revoked"
+                    : this.#matches(invite, record)
+                        ? "active"
+                        : "unknown";
+                if (state !== record.state) {
+                    await store.update(record.reference, state);
+                    record = { ...record, state };
+                }
+            }
+            return publicInvite(record);
+        }, { waitMs: 5_000 });
+    }
+    async shareUrl(input) {
+        validateId(input.guildId);
+        validateId(input.actorUserId);
+        validateReference(input.reference);
+        const guild = this.#ownedGuild(input.guildId);
+        await this.#authorise(guild, input.actorUserId);
+        return this.repository.runGuildExclusive(input.guildId, async (store) => {
+            const record = await store.find(input.reference);
+            if (!record || record.state !== "active" || !record.encryptedCode)
+                throw new CreatorInviteOperationError("not_owned");
+            // An old public welcome link must not keep granting a role which has
+            // since become privileged or moved outside the current hierarchy.
+            await this.#validateDestination(guild, {
+                guildId: record.guildId,
+                channelId: record.channelId,
+                roleId: record.roleId,
+                purpose: record.purpose,
+                operationId: record.operationId,
+                actorUserId: input.actorUserId,
+            });
+            await this.#assertOverviewRoutable(store, record);
+            const code = this.#decrypt(record);
+            const current = (await this.#list(record.channelId)).find((invite) => invite.code === code);
+            if (!current || !this.#matches(current, record))
+                throw new CreatorInviteOperationError("unavailable");
+            if (record.replacesReference &&
+                (await store.find(record.replacesReference))?.state !== "revoked")
+                throw new CreatorInviteOperationError("replacement_pending");
+            return { url: `https://discord.com/invite/${code}` };
+        }, { waitMs: 5_000 });
+    }
+    async publicOverview(input) {
+        validateId(input.guildId);
+        validateReference(input.reference);
+        const guild = this.#ownedGuild(input.guildId);
+        if (!(await this.#enabled(guild.id)))
+            throw new CreatorInviteOperationError("unavailable");
+        const record = await this.repository.findOwnedOverview(input);
+        if (!record ||
+            record.purpose !== "overview" ||
+            record.roleId !== null ||
+            record.state !== "active" ||
+            !record.encryptedCode)
+            throw new CreatorInviteOperationError("not_owned");
+        if (record.replacesReference &&
+            (await this.repository.findOwnedOverview({
+                guildId: guild.id,
+                reference: record.replacesReference,
+            }))?.state !== "revoked")
+            throw new CreatorInviteOperationError("replacement_pending");
+        const code = this.#decrypt(record);
+        // A GET never mutates ownership. Background cleanup handles invalid codes;
+        // create/revoke/join operations retain their exclusive fences.
+        if (!isCreatorOverviewRouteCode(code))
+            throw new CreatorInviteOperationError("operation_conflict");
+        const actual = (await this.#list(record.channelId)).find((invite) => invite.code === code);
+        if (!actual || !this.#matches(actual, record))
+            throw new CreatorInviteOperationError("unavailable");
+        if (!(await this.repository.isActiveOverview(input)))
+            throw new CreatorInviteOperationError("not_owned");
+        return {
+            guildName: guild.name,
+            guildIconUrl: guild.iconURL({ size: 256 }),
+            discordInviteUrl: `https://discord.com/invite/${code}`,
+        };
+    }
+    async revoke(input) {
+        validateId(input.guildId);
+        validateReference(input.reference);
+        validateReference(input.operationId);
+        this.#ownedGuild(input.guildId);
+        return this.repository.runGuildExclusive(input.guildId, async (store) => {
+            let record = await store.find(input.reference);
+            if (!record)
+                throw new CreatorInviteOperationError("not_owned");
+            if (!record.encryptedCode &&
+                !["revoked", "rejected"].includes(record.state))
+                record = await this.#recover(store, record);
+            return this.#revoke(store, record);
+        });
+    }
+    /** Cancels a durable intent without issuing a create POST, including rejected intents. */
+    async cancelOperation(input) {
+        validateId(input.guildId);
+        validateReference(input.operationId);
+        this.#ownedGuild(input.guildId);
+        return this.repository.runGuildExclusive(input.guildId, async (store) => {
+            let record = await store.findByOperation(input.operationId);
+            // Intent persistence always precedes Discord creation. No intent means
+            // this operation cannot have issued a Discord POST.
+            if (!record)
+                return { state: "revoked" };
+            if (!record.encryptedCode &&
+                !["revoked", "rejected"].includes(record.state)) {
+                try {
+                    record = await this.#recover(store, record);
+                }
+                catch (error) {
+                    if (unknownChannel(error)) {
+                        await store.update(record.reference, "revoked");
+                        return { state: "revoked" };
+                    }
+                    if (error instanceof CreatorInviteOperationError &&
+                        error.code === "operation_conflict") {
+                        // Recovery may have identified, encrypted and already revoked an
+                        // unsuitable public route code. Return that durable cancellation.
+                        const reconciled = await store.find(record.reference);
+                        if (reconciled?.state === "revoked")
+                            return { state: "revoked" };
+                        if (reconciled?.state === "revocation_pending")
+                            return { state: "revocation_pending" };
+                    }
+                    return { state: "unknown" };
+                }
+            }
+            return this.#revoke(store, record);
+        });
+    }
+    /** Runs outside module enablement; only proven access/safety loss initiates revocation. */
+    async cleanupUnavailableInvites() {
+        const candidates = await this.repository.listCleanupCandidates(50, this.#cleanupCursor);
+        const enabledGuilds = new Map();
+        let delayed = false;
+        for (const candidate of candidates) {
+            this.#cleanupCursor = candidate.reference;
+            if (!this.client.isReady() ||
+                !this.client.guilds.cache.get(candidate.guildId)?.available)
+                continue;
+            try {
+                let enabled = enabledGuilds.get(candidate.guildId);
+                if (enabled === undefined) {
+                    enabled = await this.#enabled(candidate.guildId);
+                    enabledGuilds.set(candidate.guildId, enabled);
+                }
+                await this.repository.runGuildExclusive(candidate.guildId, async (store) => {
+                    let record = await store.find(candidate.reference);
+                    if (!record || record.state === "revoked")
+                        return;
+                    const guild = this.#ownedGuild(candidate.guildId);
+                    // Retry already-started revocations even if the module was reenabled.
+                    if (enabled &&
+                        record.state !== "revocation_pending" &&
+                        (await this.#welcomeRoleSafe(guild, record)))
+                        return;
+                    if (!record.encryptedCode && record.state !== "rejected") {
+                        try {
+                            record = await this.#recover(store, record);
+                        }
+                        catch (error) {
+                            if (unknownChannel(error)) {
+                                await store.update(record.reference, "revoked");
+                                return;
+                            }
+                            throw error;
+                        }
+                    }
+                    if ((await this.#revoke(store, record)).state !== "revoked")
+                        delayed = true;
+                });
+            }
+            catch {
+                // One inaccessible guild must not starve cleanup in every later guild.
+                delayed = true;
+            }
+        }
+        if (candidates.length < 50)
+            this.#cleanupCursor = undefined;
+        if (delayed)
+            throw new Error("Creator invite cleanup requires reconciliation");
+    }
+    async #welcomeRoleSafe(guild, record) {
+        if (record.purpose === "overview")
+            return (!record.encryptedCode ||
+                isCreatorOverviewRouteCode(this.#decrypt(record)));
+        if (!record.roleId)
+            return false;
+        const permissions = this.services.get(HELYX_SERVICE_NAMES.permissions);
+        if (!permissions.getGuildAccessPolicy)
+            throw new CreatorInviteOperationError("unavailable");
+        const [policy, roles, me] = await Promise.all([
+            permissions.getGuildAccessPolicy(guild.id),
+            guild.roles.fetch(),
+            guild.members.fetchMe({ force: true }),
+        ]);
+        const role = roles.get(record.roleId);
+        return Boolean(role &&
+            isPublicCreatorRoleEligible({
+                guildId: guild.id,
+                roleId: role.id,
+                name: role.name,
+                exists: true,
+                guildMatches: true,
+                managed: role.managed,
+                everyone: role.id === guild.id,
+                assignable: role.editable,
+                // No manager is present during background cleanup. Its safety decision
+                // concerns bot hierarchy, configured staff roles and current permissions.
+                actorAssignable: true,
+                hierarchy: "assignable",
+                permissionNames: role.permissions
+                    .toArray()
+                    .map(normalizeDiscordPermission),
+                dangerousPermissionNames: [],
+            }, policy) &&
+            (role.permissions.bitfield & ~me.permissions.bitfield) === 0n);
+    }
+    async #assertOverviewRoutable(store, record) {
+        if (record.purpose !== "overview" ||
+            isCreatorOverviewRouteCode(this.#decrypt(record)))
+            return;
+        // The raw code has already been encrypted and durably stored. Revocation
+        // can therefore retry after a lost delete response without another POST.
+        // A new manager operation may replace it only after cancellation is proven.
+        await this.#revoke(store, record);
+        throw new CreatorInviteOperationError("operation_conflict");
+    }
+    async #revoke(store, record) {
+        if (record.state === "revoked")
+            return { state: "revoked" };
+        if (record.state === "rejected") {
+            await store.update(record.reference, "revoked");
+            return { state: "revoked" };
+        }
+        if (!record.encryptedCode)
+            return { state: "unknown" };
+        await store.update(record.reference, "revocation_pending");
+        try {
+            const code = this.#decrypt(record);
+            // An already-deleted destination means its channel-backed invite cannot remain usable.
+            try {
+                await this.#discord().delete(Routes.invite(code), {
+                    reason: "Helyx Creator Connections owned invite revoked",
+                });
+            }
+            catch (error) {
+                if (!unknownInvite(error))
+                    throw error;
+            }
+            const remaining = await this.#list(record.channelId).catch((error) => {
+                if (unknownChannel(error))
+                    return [];
+                throw error;
+            });
+            if (remaining.some((invite) => invite.code === code))
+                return { state: "revocation_pending" };
+            await store.update(record.reference, "revoked");
+            return { state: "revoked" };
+        }
+        catch {
+            return { state: "revocation_pending" };
+        }
+    }
+    async #createIntent(store, record) {
+        const body = {
+            max_age: 0,
+            max_uses: 0,
+            temporary: false,
+            unique: true,
+            ...(record.roleId ? { role_ids: [record.roleId] } : {}),
+        };
+        let created;
+        try {
+            created = (await this.#discord().post(Routes.channelInvites(record.channelId), {
+                body,
+                reason: `Helyx Creator Connections ${record.purpose}; operation ${record.operationId}`,
+            }));
+        }
+        catch (error) {
+            // A returned Discord API rejection is different from a lost response or
+            // transport failure. Only the former permits a new POST for this intent.
+            const rejected = error instanceof DiscordAPIError &&
+                error.status >= 400 &&
+                error.status < 500 &&
+                error.status !== 429;
+            await store.update(record.reference, rejected ? "rejected" : "unknown");
+            throw new CreatorInviteOperationError(rejected ? "creation_rejected" : "creation_uncertain");
+        }
+        if (!this.#matches(created, record)) {
+            await store.update(record.reference, "unknown");
+            throw new CreatorInviteOperationError("creation_uncertain");
+        }
+        const encryptedCode = this.#encrypt(record, created.code);
+        // If this write fails, the durable intent remains recoverable; never POST again.
+        await store.update(record.reference, "active", encryptedCode, record.purpose === "overview"
+            ? createHash("sha256").update(created.code).digest("hex")
+            : undefined);
+        const ownedRecord = { ...record, state: "active", encryptedCode };
+        await this.#assertOverviewRoutable(store, ownedRecord);
+        return ownedRecord;
+    }
+    async #recover(store, record) {
+        const candidates = (await this.#list(record.channelId)).filter((invite) => !record.beforeFingerprints.includes(this.#fingerprint(invite.code)) &&
+            this.#matches(invite, record) &&
+            invite.created_at &&
+            new Date(invite.created_at).getTime() >=
+                record.createdAt.getTime() - 1000);
+        // Candidate shape alone is not ownership proof: another bot operation may have
+        // created it. Recover only when Discord's audit reason names this exact intent.
+        if (candidates.length !== 1)
+            throw new CreatorInviteOperationError("creation_uncertain");
+        const audit = (await this.#discord()
+            .get(Routes.guildAuditLog(record.guildId), {
+            query: new URLSearchParams({
+                action_type: "40",
+                user_id: this.client.user.id,
+                limit: "100",
+            }),
+        })
+            .catch(() => null));
+        const expectedReason = `Helyx Creator Connections ${record.purpose}; operation ${record.operationId}`;
+        const owned = audit?.audit_log_entries.some((entry) => entry.user_id === this.client.user.id &&
+            entry.reason === expectedReason &&
+            entry.changes?.some((change) => change.key === "code" &&
+                "new_value" in change &&
+                change.new_value === candidates[0].code));
+        if (!owned)
+            throw new CreatorInviteOperationError("creation_uncertain");
+        const encryptedCode = this.#encrypt(record, candidates[0].code);
+        await store.update(record.reference, "active", encryptedCode, record.purpose === "overview"
+            ? createHash("sha256").update(candidates[0].code).digest("hex")
+            : undefined);
+        const ownedRecord = { ...record, state: "active", encryptedCode };
+        await this.#assertOverviewRoutable(store, ownedRecord);
+        return ownedRecord;
+    }
+    #matches(invite, record) {
+        const roles = invite.roles?.map((role) => role.id) ?? [];
+        return (inviteCode.test(invite.code) &&
+            invite.guild?.id === record.guildId &&
+            invite.channel?.id === record.channelId &&
+            invite.inviter?.id === this.client.user?.id &&
+            invite.max_age === 0 &&
+            invite.max_uses === 0 &&
+            invite.temporary === false &&
+            (record.roleId
+                ? roles.length === 1 && roles[0] === record.roleId
+                : roles.length === 0));
+    }
+    async #validateDestination(guild, input) {
+        await guild.roles.fetch();
+        const channel = await guild.channels.fetch(input.channelId);
+        const me = await guild.members.fetchMe({ force: true });
+        const actor = await guild.members.fetch({
+            user: input.actorUserId,
+            force: true,
+        });
+        if (!channel ||
+            ![ChannelType.GuildText, ChannelType.GuildAnnouncement].includes(channel.type) ||
+            !channel.viewable ||
+            !channel
+                .permissionsFor(me)
+                ?.has([
+                PermissionFlagsBits.ViewChannel,
+                PermissionFlagsBits.CreateInstantInvite,
+                PermissionFlagsBits.ManageChannels,
+            ]) ||
+            !channel.permissionsFor(actor)?.has(PermissionFlagsBits.ViewChannel))
+            throw new CreatorInviteOperationError("invalid_channel");
+        if (input.roleId) {
+            validateId(input.roleId);
+            const permissions = this.services.get(HELYX_SERVICE_NAMES.permissions);
+            if (!permissions.getGuildAccessPolicy)
+                throw new CreatorInviteOperationError("unavailable");
+            const policy = await permissions.getGuildAccessPolicy(guild.id);
+            const role = await this.services
+                .get(HELYX_SERVICE_NAMES.discordResources)
+                .inspectRole({
+                guildId: guild.id,
+                roleId: input.roleId,
+                actorUserId: input.actorUserId,
+            });
+            if (!isPublicCreatorRoleEligible(role, policy))
+                throw new CreatorInviteOperationError("invalid_role");
+            const liveRole = await guild.roles.fetch(input.roleId);
+            if (!liveRole ||
+                (liveRole.permissions.bitfield & ~me.permissions.bitfield) !== 0n)
+                throw new CreatorInviteOperationError("invalid_role");
+        }
+    }
+    async #enabled(guildId) {
+        if (!this.module)
+            return false;
+        return ((await this.services
+            .get(HELYX_SERVICE_NAMES.installations)
+            .isModuleEnabled(guildId, MODULE_ID)) &&
+            (await this.services
+                .get(HELYX_SERVICE_NAMES.moduleAvailability)
+                .isAvailable(MODULE_ID)) &&
+            (await canAccessModule(this.services, guildId, this.module)));
+    }
+    async #authorise(guild, actorUserId) {
+        if (!(await this.#enabled(guild.id)))
+            throw new CreatorInviteOperationError("unavailable");
+        const member = await guild.members.fetch({
+            user: actorUserId,
+            force: true,
+        });
+        const permitted = await this.services
+            .get(HELYX_SERVICE_NAMES.resourceAuthorization)
+            .canUse({
+            guildId: guild.id,
+            moduleId: MODULE_ID,
+            permissionId: "creator-connections.manage",
+            actor: {
+                userId: member.id,
+                roleIds: [...member.roles.cache.keys()],
+                permissions: member.permissions
+                    .toArray()
+                    .map(normalizeDiscordPermission),
+                isServerOwner: member.id === guild.ownerId,
+                isAdministrator: member.permissions.has(PermissionFlagsBits.Administrator),
+                highestRolePosition: member.roles.highest.position,
+            },
+        });
+        if (!permitted)
+            throw new CreatorInviteOperationError("forbidden");
+    }
+    #ownedGuild(guildId) {
+        const guild = this.client.guilds.cache.get(guildId);
+        if (!this.client.isReady() || !guild?.available)
+            throw new CreatorInviteOperationError("unavailable");
+        return guild;
+    }
+    #discord() {
+        if (!this.client.token)
+            throw new CreatorInviteOperationError("unavailable");
+        // Only this adapter disables transport retries; ordinary bot REST behaviour is unchanged.
+        this.#rest ??= new REST({
+            ...discordRestOptions,
+            retries: 0,
+            timeout: 15_000,
+        }).setToken(this.client.token);
+        return this.#rest;
+    }
+    async #list(channelId) {
+        return (await this.#discord().get(Routes.channelInvites(channelId)));
+    }
+    #fingerprint(code) {
+        return createHmac("sha256", this.#key).update(code).digest("base64url");
+    }
+    #encrypt(record, code) {
+        const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", this.#key, iv);
+        cipher.setAAD(Buffer.from(`${record.guildId}:${record.reference}:${record.purpose}`));
+        const data = Buffer.concat([cipher.update(code, "utf8"), cipher.final()]);
+        return JSON.stringify({
+            v: 1,
+            iv: iv.toString("base64"),
+            tag: cipher.getAuthTag().toString("base64"),
+            data: data.toString("base64"),
+        });
+    }
+    #decrypt(record) {
+        const sealed = JSON.parse(record.encryptedCode);
+        if (sealed.v !== 1)
+            throw new CreatorInviteOperationError("unavailable");
+        const decipher = createDecipheriv("aes-256-gcm", this.#key, Buffer.from(sealed.iv, "base64"));
+        decipher.setAAD(Buffer.from(`${record.guildId}:${record.reference}:${record.purpose}`));
+        decipher.setAuthTag(Buffer.from(sealed.tag, "base64"));
+        const code = Buffer.concat([
+            decipher.update(Buffer.from(sealed.data, "base64")),
+            decipher.final(),
+        ]).toString("utf8");
+        if (!inviteCode.test(code))
+            throw new CreatorInviteOperationError("unavailable");
+        return code;
+    }
+}
+function publicInvite(record) {
+    return {
+        reference: record.reference,
+        guildId: record.guildId,
+        channelId: record.channelId,
+        roleId: record.roleId,
+        purpose: record.purpose,
+        state: ["creating", "rejected"].includes(record.state)
+            ? "unknown"
+            : record.state,
+        regenerateAfter: record.regenerateAfter?.toISOString() ?? null,
+    };
+}
+function validateId(value) {
+    if (!snowflake.test(value))
+        throw new CreatorInviteOperationError("forbidden");
+}
+function validateReference(value) {
+    if (!uuid.test(value))
+        throw new CreatorInviteOperationError("not_owned");
+}
+function unknownInvite(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === RESTJSONErrorCodes.UnknownInvite);
+}
+function unknownChannel(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === RESTJSONErrorCodes.UnknownChannel);
+}
+//# sourceMappingURL=creator-invite-service.js.map